Skip to content

Add personal access token verification before GitLab Migration starts

Problem

Currently, some migrations fail in the middle of the process, because provided personal access token's scope is not sufficient, and that scope is not checked before the migration begins.

Some migrations also fail after the migration begins when the token's scopes change or it expires.

Proposed solution

With the recent addition of an API endpoint to view details of the provided token /api/v4/personal_access_tokens/self we can view the details of the provided personal access token to stop migration attempts early, if the provided token has insufficient scope.

Implementation

  1. Add an early migration check that validates provided personal access token against /api/v4/personal_access_tokens/self if the source instance Gitlab version is 15.5 or higher and do not start the migration if provided token doesn't have required api scope (we use GraphQL API which needs api scope).

  2. Display an error in the UI after the user enters the url/token information.

  3. Additionally, at the start of the migration, before creating anything, check the token's scope again and return an error if provided token doesn't have required api scope. It's a safe guard measure, if a user manages to bypass initial validation, we should check the scope again, once the migration has started.

Store this error in bulk_import_failures table and display in UI on Import History page and in API response.

Edited by Carla Drago