Modify the user cap logic to ignore non-human users
Summary
When admin approval or user cap are enabled, project access tokens fail to create
When these settings are in effect, project token bot users require admin approval. This makes them "blocked" on creation, and the token creation fails as a result.
- Admin Approval for new Sign ups
- User Cap, if the cap has been reached
Proposal
See comments thread starting with #323191 (comment 521360633) for direction on how to resolve.
Steps to reproduce
- As an admin user, go to Admin Area > Settings > General and in the sign up restrictions section enabled both the approval for new signups, or set a user cap that is equal to the number of users you already have.
- As a non-admin user that has maintainer or owner permissions on a project, go to Project Settings > Access Tokens and try to make a project access token with any settings.
- Notice the token creation fails with a message that the user is not permitted to create the token.
To resolve, go to admin settings again and remove BOTH the sign up approval and the user cap. The maintainer of the project can now create a token.
Example Project
N/A, gitlab.com doesn't have sign up settings.
What is the current bug behavior?
When admin approval or user cap are enabled, if the user cap is reached project access tokens cannot be created until both settings are removed.
Oddly, if only one of those settings is enabled token creation works fine.
Strike that, my test was that I only had admin approval, but signups were disabled. Settings specifically states that admin approval only matters if you have sign ups enabled. I can replicate by only setting the user cap.
What is the expected correct behavior?
Even when sign up restrictions are enabled, tokens should be created because their bot users do not count towards billing and shouldn't be counted in the user cap.
Relevant logs and/or screenshots
Log failure from token creation and associated bot user creation/deletion in my test instance (deletion happened automatically). I did a grep of everything using the correlation ID so hopefully that gives a good amount of info.
Expand for logs
sidekiq/current:{"severity":"INFO","time":"2021-03-02T14:00:48.536Z","class":"SetUserStatusBasedOnUserCapSettingWorker","args":["84"],"retry":3,"queue":"set_user_status_based_on_user_cap_setting","version":0,"jid":"d0778a7bcd9344c5aea51ecf","created_at":"2021-03-02T14:00:48.534Z","meta.user":"kmc","meta.project":"parent-group-a/sub-group-b/project-b","meta.root_namespace":"parent-group-a","meta.caller_id":"Projects::Settings::AccessTokensController#create","meta.remote_ip":"73.13.242.253","meta.feature_category":"authentication_and_authorization","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","enqueued_at":"2021-03-02T14:00:48.535Z","pid":30169,"message":"SetUserStatusBasedOnUserCapSettingWorker JID-d0778a7bcd9344c5aea51ecf: start","job_status":"start","scheduling_latency_s":0.001373,"job_size_bytes":553} sidekiq/current:{"severity":"INFO","time":"2021-03-02T14:00:48.547Z","class":"SetUserStatusBasedOnUserCapSettingWorker","args":["84"],"retry":3,"queue":"set_user_status_based_on_user_cap_setting","version":0,"jid":"d0778a7bcd9344c5aea51ecf","created_at":"2021-03-02T14:00:48.534Z","meta.user":"kmc","meta.project":"parent-group-a/sub-group-b/project-b","meta.root_namespace":"parent-group-a","meta.caller_id":"Projects::Settings::AccessTokensController#create","meta.remote_ip":"73.13.242.253","meta.feature_category":"authentication_and_authorization","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","enqueued_at":"2021-03-02T14:00:48.535Z","pid":30169,"message":"SetUserStatusBasedOnUserCapSettingWorker JID-d0778a7bcd9344c5aea51ecf: done: 0.011072 sec","job_status":"done","scheduling_latency_s":0.001373,"job_size_bytes":553,"cpu_s":0.007174,"redis_calls":2,"redis_duration_s":0.000377,"redis_read_bytes":2,"redis_write_bytes":210,"redis_queues_calls":2,"redis_queues_duration_s":0.000377,"redis_queues_read_bytes":2,"redis_queues_write_bytes":210,"db_count":2,"db_write_count":0,"db_cached_count":0,"duration_s":0.011072,"completed_at":"2021-03-02T14:00:48.547Z","db_duration_s":0.001896} sidekiq/current:{"severity":"INFO","time":"2021-03-02T14:00:48.755Z","class":"DeleteUserWorker","args":["1","84","{\"hard_delete\"=\u003etrue, \"skip_authorization\"=\u003etrue}"],"retry":3,"queue":"delete_user","version":0,"jid":"f2b5658bfdecefc52524a3b0","created_at":"2021-03-02T14:00:48.752Z","meta.user":"kmc","meta.project":"parent-group-a/sub-group-b/project-b","meta.root_namespace":"parent-group-a","meta.caller_id":"Projects::Settings::AccessTokensController#create","meta.remote_ip":"73.13.242.253","meta.feature_category":"authentication_and_authorization","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","enqueued_at":"2021-03-02T14:00:48.753Z","pid":30169,"message":"DeleteUserWorker JID-f2b5658bfdecefc52524a3b0: start","job_status":"start","scheduling_latency_s":0.00142,"job_size_bytes":549} sidekiq/current:{"severity":"INFO","time":"2021-03-02T14:00:48.905Z","class":"DeleteUserWorker","args":["1","84","{\"hard_delete\"=\u003etrue, \"skip_authorization\"=\u003etrue}"],"retry":3,"queue":"delete_user","version":0,"jid":"f2b5658bfdecefc52524a3b0","created_at":"2021-03-02T14:00:48.752Z","meta.user":"kmc","meta.project":"parent-group-a/sub-group-b/project-b","meta.root_namespace":"parent-group-a","meta.caller_id":"Projects::Settings::AccessTokensController#create","meta.remote_ip":"73.13.242.253","meta.feature_category":"authentication_and_authorization","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","enqueued_at":"2021-03-02T14:00:48.753Z","pid":30169,"message":"DeleteUserWorker JID-f2b5658bfdecefc52524a3b0: done: 0.150192 sec","job_status":"done","scheduling_latency_s":0.00142,"job_size_bytes":549,"cpu_s":0.092415,"redis_calls":5,"redis_duration_s":0.001161,"redis_read_bytes":313,"redis_write_bytes":337,"redis_cache_calls":3,"redis_cache_duration_s":0.000736,"redis_cache_read_bytes":311,"redis_cache_write_bytes":157,"redis_queues_calls":2,"redis_queues_duration_s":0.000425,"redis_queues_read_bytes":2,"redis_queues_write_bytes":180,"db_count":81,"db_write_count":13,"db_cached_count":1,"duration_s":0.150192,"completed_at":"2021-03-02T14:00:48.905Z","db_duration_s":0.061736} gitlab-workhorse/current:{"content_type":"text/html; charset=utf-8","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","duration_ms":372,"host":"gitlarb.party","level":"info","method":"POST","msg":"access","proto":"HTTP/1.1","referrer":"https://gitlarb.party/parent-group-a/sub-group-b/project-b/-/settings/access_tokens","remote_addr":"73.13.242.253:0","remote_ip":"73.13.242.253","route":"","status":302,"system":"http","time":"2021-03-02T14:00:48Z","ttfb_ms":372,"uri":"/parent-group-a/sub-group-b/project-b/-/settings/access_tokens","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:86.0) Gecko/20100101 Firefox/86.0","written_bytes":149} gitlab-rails/audit_json.log:{"severity":"INFO","time":"2021-03-02T14:00:48.563Z","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","author_id":1,"author_name":"Kaitlyn","entity_id":84,"entity_type":"User","ip_address":"73.13.242.253","add":"user","target_id":84,"target_type":"User","target_details":"project_4_bot","entity_path":"project_4_bot"} gitlab-rails/audit_json.log:{"severity":"INFO","time":"2021-03-02T14:00:48.747Z","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","author_id":84,"author_name":"test-admin","entity_id":84,"entity_type":"User","ip_address":"73.13.242.253","custom_message":"Attempted to create personal access token but failed with message: Not permitted to create","target_id":84,"target_type":"User","target_details":"project_4_bot","entity_path":"project_4_bot"} gitlab-rails/audit_json.log:{"severity":"INFO","time":"2021-03-02T14:00:48.757Z","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","author_id":1,"author_name":"Kaitlyn","entity_id":4,"entity_type":"Project","ip_address":"73.13.242.253","target_details":null,"action":"custom","custom_message":"Attempted to create project access token but failed with message: Not permitted to create","entity_path":"parent-group-a/sub-group-b/project-b"} gitlab-rails/audit_json.log:{"severity":"INFO","time":"2021-03-02T14:00:48.894Z","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","author_id":1,"author_name":"Kaitlyn","entity_id":84,"entity_type":"User","ip_address":"73.13.242.253","remove":"user","target_id":84,"target_type":"User","target_details":"project_4_bot","entity_path":"project_4_bot"} gitlab-rails/production_json.log:{"method":"POST","path":"/parent-group-a/sub-group-b/project-b/-/settings/access_tokens","format":"html","controller":"Projects::Settings::AccessTokensController","action":"create","status":302,"location":"https://gitlarb.party/parent-group-a/sub-group-b/project-b/-/settings/access_tokens","time":"2021-03-02T14:00:48.767Z","params":[{"key":"utf8","value":"✓"},{"key":"authenticity_token","value":"[FILTERED]"},{"key":"project_access_token","value":"[FILTERED]"},{"key":"namespace_id","value":"parent-group-a/sub-group-b"},{"key":"project_id","value":"project-b"}],"remote_ip":"73.13.242.253","user_id":1,"username":"kmc","ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:86.0) Gecko/20100101 Firefox/86.0","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","meta.user":"kmc","meta.project":"parent-group-a/sub-group-b/project-b","meta.root_namespace":"parent-group-a","meta.caller_id":"Projects::Settings::AccessTokensController#create","meta.remote_ip":"73.13.242.253","meta.feature_category":"authentication_and_authorization","redis_calls":14,"redis_duration_s":0.003567,"redis_read_bytes":526,"redis_write_bytes":4561,"redis_cache_calls":5,"redis_cache_duration_s":0.001153,"redis_cache_read_bytes":210,"redis_cache_write_bytes":429,"redis_queues_calls":4,"redis_queues_duration_s":0.001126,"redis_queues_read_bytes":129,"redis_queues_write_bytes":2785,"redis_shared_state_calls":5,"redis_shared_state_duration_s":0.001288,"redis_shared_state_read_bytes":187,"redis_shared_state_write_bytes":1347,"db_count":51,"db_write_count":15,"db_cached_count":1,"rack_attack_redis_count":1,"rack_attack_redis_duration_s":0.0007188039999164175,"cpu_s":0.220168,"queue_duration_s":0.006731,"db_duration_s":0.13757,"view_duration_s":0.0,"duration_s":0.34907} gitlab-rails/application_json.log:{"severity":"INFO","time":"2021-03-02T14:00:48.536Z","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","message":"User \"test-admin\" (project4_bot@example.com) was created"} gitlab-rails/application_json.log:{"severity":"INFO","time":"2021-03-02T14:00:48.735Z","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","event":"authorized_projects_refresh","authorized_projects_refresh.source":"AuthorizedProjectsWorker","authorized_projects_refresh.rows_deleted":0,"authorized_projects_refresh.rows_added":1} gitlab-rails/application_json.log:{"severity":"ERROR","time":"2021-03-02T14:00:48.742Z","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","message":"Cannot obtain an exclusive lease. There must be another instance already in execution."} gitlab-rails/application_json.log:{"severity":"INFO","time":"2021-03-02T14:00:48.884Z","correlation_id":"01EZSKVJ0D6S865F8HWTRNQSYR","message":"User \"test-admin\" (project4_bot@example.com) was removed"}
Output of checks
Results of GitLab environment info
Expand for output related to GitLab environment info
System information System: Ubuntu 18.04 Proxy: no Current User: git Using RVM: no Ruby Version: 2.7.2p137 Gem Version: 3.1.4 Bundler Version:2.1.4 Rake Version: 13.0.3 Redis Version: 6.0.10 Git Version: 2.29.0 Sidekiq Version:5.2.9 Go Version: unknown GitLab information Version: 13.9.1-ee Revision: 8ae438629fa Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: PostgreSQL DB Version: 12.5 URL: https://gitlarb.party HTTP Clone URL: https://gitlarb.party/some-group/some-project.git SSH Clone URL: git@gitlarb.party:some-group/some-project.git Elasticsearch: no Geo: no Using LDAP: no Using Omniauth: yes Omniauth Providers: GitLab Shell Version: 13.16.1 Repository storage paths: - default: /var/opt/gitlab/git-data/repositories GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell Git: /opt/gitlab/embedded/bin/git
Results of GitLab application Check
Expand for output related to the GitLab application check
Checking GitLab subtasks ...
Checking GitLab Shell ...
GitLab Shell: ... GitLab Shell version >= 13.16.1 ? ... OK (13.16.1) Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Internal API available: OK Redis available via internal API: OK gitlab-shell self-check successful
Checking GitLab Shell ... Finished
Checking Gitaly ...
Gitaly: ... default ... OK
Checking Gitaly ... Finished
Checking Sidekiq ...
Sidekiq: ... Running? ... yes Number of Sidekiq processes ... 1
Checking Sidekiq ... Finished
Checking Incoming Email ...
Incoming Email: ... Reply by email is disabled in config/gitlab.yml
Checking Incoming Email ... Finished
Checking LDAP ...
LDAP: ... LDAP is disabled in config/gitlab.yml
Checking LDAP ... Finished
Checking GitLab App ...
Git configured correctly? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... yes Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) Projects have namespace: ... 2/1 ... yes 3/2 ... yes 11/4 ... yes 12/5 ... yes 1/6 ... yes 1/7 ... yes 1/8 ... yes 12/9 ... yes 1/10 ... yes 74/12 ... yes 1/13 ... yes 76/14 ... yes 1/20 ... yes 1/21 ... yes 1/22 ... yes 1/24 ... yes 11/25 ... yes 10/26 ... yes 11/27 ... yes 11/28 ... yes 11/29 ... yes 1/30 ... yes Redis version >= 4.0.0? ... yes Ruby version >= 2.7.2 ? ... yes (2.7.2) Git version >= 2.29.0 ? ... yes (2.29.0) Git user has default SSH configuration? ... yes Active users: ... 7 Is authorized keys file accessible? ... yes GitLab configured to store new projects in hashed storage? ... yes All projects are in hashed storage? ... yes Elasticsearch version 7.x (6.4 - 6.x deprecated to be removed in 13.8)? ... skipped (elasticsearch is disabled)
Checking GitLab App ... Finished
Checking GitLab subtasks ... Finished