AR admins on the namespace cannot manage roles on repositories inside their namespace
Problem
An Artifact Registry admin on a namespace cannot change who has access to the repositories inside that namespace.
Managing roles on the namespace itself works. Managing roles on a repository inside it is refused, unless the person also holds an admin role on that exact repository.
Why it happens
When Rails asks IAM to add or remove a role, it sends the target resource on its own.
object: ::Gitlab::Iam::Relationships::V1::Object.new(id: resource_id)IAM will accept an admin role held on a resource above the target, but only if the request says which resource that is. Rails never says, so IAM looks for an admin role on the exact repository and finds none.
Evidence
Run against a local database, with a user holding the admin role on the namespace and nothing on the repository.
| request | result |
|---|---|
| the repository on its own, as Rails sends it | PermissionDenied |
| the same request, naming the namespace as the parent | allowed |
| user given the admin role on the repository itself | allowed |
The middle row shows the cause. Same user, same permissions, same target. The only difference is that the request said which namespace the repository belongs to.
Fix
Name the organization's namespace as the parent when Rails builds a grant or revoke for a repository.
Only repositories need it. A grant on the namespace itself already works, and a grant on the organization is the org owner path, governed separately.
Rails already has the namespace. GrantRoleAssignmentsService reads organization.artifact_registry_namespace_mapping.ar_namespace_id when it verifies resources. RevokeRoleAssignmentsService does not load it today, so that is the one new piece.
One ordering detail
IAM reads only the first parent in the list and ignores the rest, so order matters and length does not. Verified against a local database:
| request | result |
|---|---|
parents [namespace, org] |
allowed |
parents [org, namespace] |
PermissionDenied |
Naming a parent is additive. If the caller holds no role on the named parent, IAM falls back to requiring a role on the object itself, which is today's behaviour. So this cannot make any currently working case fail.
What it changes
More people can change roles than today. Anyone who administers a namespace can manage roles on repositories inside it. That is the intended behaviour, and it matches what the same role already permits through Artifact Registry.
It is still a permissions change rather than plumbing, so it should be reviewed as one.
Depends on one namespace per organization
Today there is exactly one namespace per organization, enforced by a unique index on organization_id, so "the organization's namespace" has a single answer. @10io has raised that an organization will eventually need more than one, for example after an acquisition. At that point Rails can no longer work out the parent on its own and would need Artifact Registry to tell it.