Authorize 14 Code Review GraphQL types for fine-grained tokens

Summary

A fine-grained personal access token is denied the Code Review GraphQL types below: they declare no authorize_granular_token directive and are still listed in config/authz/graphql/authorization_todo.txt, so the fields that return them give the token null, an empty list or an error. A legacy token can use them.

As discussed in !267273 (comment 4195231927), I will send this domain's types in one merge request, which closes this issue. Those already in an open merge request stay there.

Already in an open merge request

Proposal

  • Each holds data of the object that returns it, so it relies on that object's check (parent_authorizes), with a spec for each parent: MergeRequestMergeabilityCheck, DiffRefs, DiffLine, DiscussionPermissions, WikiPagePermissions, SavedReply, ProjectSavedReply, ProjectTargetBranchRule.
  • GroupSavedReply checks read_group on the group of each reply, as labels do with read_label, because a group's saved replies can include those of its ancestor groups.

DiffRefs relies on read_note, because DiffPosition, which relies on read_note, returns it too, so MergeRequest.diffRefs will need read_note as well. Saved replies and target branch rules have no assignable permission to read them, so they rely on the read permission of their parent, or of the reply's group.

I expect no new permission.

Related to #593878.

I found this while working on gitlab-mcp-server.

Edited by José M. Requena Plens