Complete the read to read_metadata action rename for secrets permissions

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

Why are we doing this work

#602726 (closed) planned to rename the read action to read_metadata as part of its frontend MR:

Remove the deprecated read: stop sending it, flip backend readback to emit read_metadata, and drop the read input alias.

The read_value work it was bundled with did ship, and the issue is closed as complete. The rename did not. On master today:

  • The permissions modal still sends read as the action key. See the actions object in ee/app/assets/javascripts/pages/projects/shared/permissions/secrets_manager/components/secrets_manager_permissions_modal.vue. The UI label reads "Read metadata" but the value sent is read.
  • #set_actions_from_capabilities in ee/app/models/secrets_management/base_secrets_permission.rb still emits ACTIONS[:read] on readback.
  • The read input alias is still in ACTIONS.

Nothing is broken by this. The problem is that the comments in base_secrets_permission.rb describe a migration that is in progress, when it is not, so the next person reading them draws the wrong conclusion about what is safe to change. read is also dead weight in a public-facing action list that we are about to stabilise for GA.

What needs to change

This has to be one coordinated change, it cannot be split across two MRs on either side:

  • Frontend: send and display read_metadata instead of read.
  • Backend: flip readback in #set_actions_from_capabilities to emit read_metadata.
  • Backend: drop the read input alias from ACTIONS and METADATA_READ_ACTIONS.
  • Backend: update validate_actions, which currently accepts read or read_metadata.
  • Remove the two stale comments describing the migration.
  • Check for other consumers of the read action string before removing it, including specs, QA page objects, and any docs or API examples.

Notes

  • Not urgent and not scheduled for 19.4. It blocks nothing.
  • The frontend half could ride along with #623352 (closed), which is already changing the permissions table UI. That would avoid a separate round of frontend and backend coordination.
  • Worth doing before #596011 removes the experiment: annotations from the Secrets Management GraphQL mutations. While the mutations are still experiment level, dropping an accepted input value is cheap. Afterwards it would need a deprecation cycle.
  • #623435 (closed) also changes #set_actions_from_capabilities, but deliberately leaves the read alias alone, so the two do not conflict beyond a possible rebase.

Related

Edited by 🤖 GitLab Bot 🤖