Convert CI/CD settings "Job token permissions" toggles to radio buttons

Problem to solve

We have a toggle in some project => Settings => CI/CD => Job token permissions (formerly known as Token Access) that controls whether another project must be on the allowlist in order to access some project using a CI/CD job token (CI_JOB_TOKEN). We would like to change this setting to allow for a more secure default option: Allow no access via CI/CD job tokens.

Additionally, the toggle currently works this way:

  • ✅ enabled (default): Only projects in the allowlist have permission to access this project
  • ⛔ disabled: Any project has permission to access this project

... but it is easy to assume that the toggle works this way (the way it should ideally work) if you don't read the description carefully:

  • ⛔ disabled (default): No projects have permission to access this project
  • ✅ enabled: Only projects in the allowlist have permission to access this project

This setting should be incredibly clear because it allows or denies access to project resources, which could be a security risk if misinterpreted.

Proposal

We could first convert this toggle to a set of two radio buttons (this issue):

🔘 All groups and projects (current "off" setting)
🔘 This project and any groups and projects in the allowlist (current "on" setting, default)

Expand to see the plan for future iterations

Then add an option ( #470424 (closed)):

🔘 All groups and projects

🔘 This project only (new setting, equivalent to empty allowlist, default)
🔘 Any groups and projects in the allowlist

Then deprecate/remove the least secure option ( #470425 (closed)):

🔘 All groups and projects (deprecate/remove)
🔘 This project only
🔘 Any groups and projects in the allowlist

And finally end up with the set of options that we want:

🔘 This project only **(default)**
🔘 Any groups and projects in the allowlist

More details

  • The new setting is equivalent to the current default, so the default shouldn't need to be changed 🎉
  • For transparency, continue to show the allowlist in the UI no matter which option is selected. We could explore options on how to mark it as not currently active, but we don't have an existing UI/UX pattern for this.

Implementation plan

Replace the GlToggle in inbound_token_access.vue with a GlFormRadioGroup with two GlFormRadio options:

Authorized groups and projects:

  • 🔘 All groups and projects (which sets inboundJobTokenScopeEnabled: false)
  • 🔘 This project and any groups and projects in the allowlist (which sets inboundJobTokenScopeEnabled: true)
  • All groups and projects should set inboundJobTokenScopeEnabled: false
  • This project and any groups and projects in the allowlist should set inboundJobTokenScopeEnabled: true

This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.

Edited by Bonnie Tsang