Project Access Tokens have inconsistent permissions for internal repositories and their package registries

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

Hi, I try to understand the actual capabilities of Project Access Tokens. From my current observations (in a self-hosted instance):

  • if I create a PAT with the read_api scope in Project A, I can pull packages from Project A PyPI registry AND all the other internally public PyPI registries
  • however, I can't clone other internally public repositories - even if I enable all the scopes

Tbh I find it pretty confusing and I don't really understand that difference. The behaviour with PyPI registry is pretty nice, because I can install internal Python packages and I don't need to ask their maintainers to generate deploy tokens for me. But if I would like to achieve the same with git-based dependencies - I can't, because the only way to install them without asking for a token is, AFAIK, to use either Personal Access Token (which is okay for personal needs, but not really sufficient for project needs) or CI job token (which would ofc work only within GitLab CI).

Looking at the docs:
read_api Grants read access to the scoped project API, including the Package Registry.
read_repository Allows read access (pull) to the repository.

it seems the expected behaviour would be actually to only access given project, but not really the other ones...

...however, when looking at the descriptions in Project -> Settings -> Access Tokens:
read_api Grants read access to the API, including all groups and projects, the container registry, and the package registry.
read_repository Grants read-only access to repositories on private projects using Git-over-HTTP or the Repository Files API.

the conclusions are completely different.

I also asked about it our instance admins and I got such an answer:

I'm not familiar with any technical specification when it comes to the permission model. The closest I've found is this one which:

  • contradicts with your observation that a particular Project Access Token can be used to access other project's registries
  • contradicts another piece of documentation in that Job Tokens do not have access to a projects registry (they do)

so I'm not the only one confused here.

Edited by 🤖 GitLab Bot 🤖