admin_security_attributes and read_security_attribute custom abilities incorrectly set to project_ability: false

Summary

The custom ability definitions for admin_security_attributes and read_security_attribute in ee/config/custom_abilities/ have project_ability: false and group_ability: true. This means a custom role with these abilities cannot manage security attributes at the project level, making the abilities effectively unusable for their intended purpose.

Steps to Reproduce

  1. Create a custom role with admin_security_attributes and read_security_attribute abilities.
  2. Assign a user with that custom role (Reporter base) to a group.
  3. Attempt to set or edit security attributes on a project within that group.
  4. Observe that the operation fails — the permission is only granted at the group level, not the project level.

Expected Behavior

admin_security_attributes and read_security_attribute should have project_ability: true, consistent with the original design intent documented in epic 562417.

Actual Behavior

  • ee/config/custom_abilities/admin_security_attributes.yml and ee/config/custom_abilities/read_security_attribute.yml both declare project_ability: false.
  • The current YAML state appears to be the result of an accidental change in commit 745dd85.

Impact

Users cannot create a narrow least-privilege custom role for security attribute automation at the project level. The only workaround is to grant the Security Manager role, which carries 43+ project-level and 25+ group-level raw permissions — a significant and unnecessary blast-radius expansion.

Proposed Fix

Flip project_ability: false → project_ability: true in:

  • ee/config/custom_abilities/admin_security_attributes.yml
  • ee/config/custom_abilities/read_security_attribute.yml

References

Edited by 🤖 GitLab Bot 🤖