Skip to content

Block and respond with an error `Project cannot be deleted because it is linked as Security Policy Project` if user attempts to delete a security policy project

Release post

To ensure secure management of security policies and prevent disruption to enabled and enforced policies, we've added a protection to prevent deletion of security policy projects that in active use.

If a security policy project is linked to any groups or projects, the links must be removed before it can be deleted.

Description

Security policies should lock and prevent security policy project deletion, as removal of the project impacts enforcement of policies.

Proposal

  1. If there are any links to the SPP, block deletion of the project.
  2. Present a warning to the user "security policy project links must be removed before project deletion is allowed".

Implementation

There are several places I found where a user can delete a project:

  1. In the project (project => Settings => General => Advanced => Delete this project) (app/views/projects/_remove.html.haml, ee/app/views/projects/_remove.html.haml)
  2. In the admin section (admin => Projects) (app/views/admin/projects/_projects.html.haml)
  3. The rails console
  4. The API

The UI ways are in haml files and will require both frontend and backend work to prevent deletion. Perhaps all of these use all the same method to delete at a high enough level? 🤞

Edited by Grant Hickman