User with developer role gets 403 when updating pull mirror

Summary

Users with the role of Developer are unable to force an update of a pull mirror. Our documentation states that any user with a role of Developer or higher should be able to.

Steps to reproduce

  1. Set up a pull mirrored repository.
  2. Add a user to the project with a role of Developer
  3. Have the user update the mirror with curl --request POST --header "PRIVATE-TOKEN: xxxxxxxxxx" "https://gitlab.example.com/api/v4/projects/<id>/mirror/pull"
  4. Navigate Repository -> Branches, notice that the Update now button is greyed out

What is the current bug behavior?

Users with a Developer role cannot force an update to a pull mirror. This contradicts the documentation.

What is the expected correct behavior?

Users with a Developer role can force an update to a pull mirror.

Relevant logs and/or screenshots

{"message":"403 Forbidden"}%

Observed on 12.10.14-ee and reproduced on 13.2.2-ee

Links

Docs: https://docs.gitlab.com/ee/user/project/repository/repository_mirroring.html#overview Customer ticket: https://gitlab.zendesk.com/agent/tickets/169206

Edited by Aric Buerer