NoMethodError: undefined method `can?' for nil in Groups::GroupMembersController#export_csv

Summary

An exception is being raised in the group members CSV export endpoint when current_user is nil:

Exception: undefined method `can?' for nil

The failing line is ee/app/controllers/ee/groups/group_members_controller.rb:61:

def export_csv
  return render_404 unless current_user.can?(:export_group_memberships, group)
  ...
end

Because current_user is nil, calling current_user.can?(...) raises NoMethodError. This indicates an unauthenticated request is reaching the export_csv action.

Backtrace

[ee/app/controllers/ee/groups/group_members_controller.rb:61:in `export_csv',
 actionpack (7.2.3.1) lib/action_controller/metal/basic_implicit_render.rb:8:in `send_action',
 actionpack (7.2.3.1) lib/abstract_controller/base.rb:215:in `process_action',
 ...
 app/controllers/application_controller.rb:516:in `set_current_admin',
 ...
 warden (1.2.9) lib/warden/manager.rb:36:in `block in call',
 ...]

(Full backtrace available in the originating exception report.)

Analysis

export_csv is added to admin_not_required_endpoints in the EE concern, which redefines the authorize_admin_group_member! before_action to skip these endpoints. The permission check for this action is instead done inline via current_user.can?(:export_group_memberships, group). When the request is unauthenticated, current_user is nil and the inline check raises NoMethodError instead of returning a 401/404.

Proposed fix

Guard against a nil current_user (smallest change), for example:

def export_csv
  return render_404 unless current_user&.can?(:export_group_memberships, group)
  ...
end

or ensure the action requires authentication before it runs.

Source

Reported via the staging exception process: ElasticCloud watcher NoMethodError runbook

Related MR: !66755 (merged)