GitLab Migration: Show error to the user when provided personal access token has insufficient scope
Note: This is the frontend issue for Add personal access token verification before G... (#375057 - closed)
Release notes
Some migrations could fail in the middle of the process, because provided personal access token's scope was not sufficient. The check of the token's scope was done only after the migration has started. Now we perform the token's scope check at the moment you provide your token information and in case of insufficient scope, you will see an informative error message, so that you can provide a PAT with sufficient scope.
Problem
Currently, some migrations fail in the middle of the process, because provided personal access token's scope is not sufficient, and that scope is not checked before the migration begins.
Proposed solution
With the recent addition of an API endpoint to view details of the provided token /api/v4/personal_access_tokens/self we can view the details of the provided personal access token to stop migration attempts early, if the provided token has insufficient scope.
Implementation
-
Add an early migration check that validates provided personal access token against
/api/v4/personal_access_tokens/selfand do not start the migration if provided token doesn't have requiredapiscope (we use GraphQL API which needsapiscope). -
Display an error in the UI after the user enters the url/token information.
-
Additionally, at the start of the migration, before creating anything, check the token's scope again and return an error if provided token doesn't have required
apiscope. It's a safe guard measure, if a user manages to bypass initial validation, we should check the scope again, once the migration has started.
Store this error in bulk_import_failures table and display in UI on Import History page and in API response.