Add granular PAT support for security policy GraphQL types

Summary

Granular PAT (Personal Access Token) authorization does not currently work for security policy GraphQL types (e.g., OrchestrationPolicyType, PipelineExecutionSchedulePolicyType).

Problem

There are two issues preventing granular PAT authorization:

1. Cross-boundary authorization

Queries like project(fullPath:...).pipelineExecutionSchedulePolicies.upcomingSchedules require permissions on two different boundaries:

  • :read_project on the target project
  • :read_pipeline_execution_project_schedule on the policy_management_project

2. Hash-based GraphQL objects

Security policy types represent policies as hashes rather than ActiveRecord models. When adding authorize_granular_token with boundary: :security_policy_management_project, the BoundaryExtractor fails because:

  1. security_policy_management_project isn't in VALID_BOUNDARY_ACCESSOR_METHODS (only allows project, group, itself, owner)
  2. Even if added, the extractor calls obj.public_send(:security_policy_management_project) on the unwrapped hash, which doesn't have this method

The policy hash structure is:

{
  name: "...",
  config: <Security::OrchestrationPolicyConfiguration>,  # Has the project reference
  type: "pipeline_execution_schedule_policy",
  ...
}

Proposed Solutions

  1. Add security_policy_management_project to VALID_BOUNDARY_ACCESSOR_METHODS in BoundaryExtractor
  2. Modify boundary extraction to check the GraphQL type wrapper (which has the method) before unwrapping to the hash
  3. OR refactor security policy types to use model-backed presenter objects instead of raw hashes

Related

  • MR: !238114 (merged)
  • File: lib/gitlab/graphql/authz/boundary_extractor.rb
  • File: ee/app/graphql/types/security_orchestration/orchestration_policy_type.rb
Edited by 🤖 GitLab Bot 🤖