Authorize 11 Source Code GraphQL types and a mutation for fine-grained tokens

Summary

A fine-grained personal access token is denied the Source Code GraphQL types below: they declare no authorize_granular_token directive and are still listed in config/authz/graphql/authorization_todo.txt, so the fields that return them give the token null or an empty list, even when it can read the commit or the repository. BranchRuleSquashOptionCreate is listed too, so the token cannot create a squash option for a branch rule. A legacy token can use them.

As agreed in !267273 (comment 4195231927), I will send this domain's types and mutation in one merge request, which closes this issue.

Proposal

  • authorize_granular_token with the existing permission that their REST endpoints use: GpgSignature, SshSignature and X509Signature (read_commit_signature) and CommitReferences (read_commit_ref). PathLock has no REST endpoint and takes read_code, which the path lock read ability follows.
  • ForkDetails: read_code on the fork and on its upstream, which the field already checks for the user.
  • BranchRuleSquashOptionCreate: create_squash_option on the project of the branch rule, as the update mutation checks update_squash_option.
  • Returned only below one of those, so each declares the permission its parent checks (parent_authorizes:), with a spec for each parent: CommitParentNames (read_commit_ref), X509Certificate and X509Issuer (read_commit_signature), and PathLockPermissions (read_code).
  • SquashOption skips with parent_authorizes and no permission for now: the squash option mutations that return it check the token themselves, and the branch rule type, which also returns it, has no directive yet.

The same merge request declares the parent permission of Blame, RepositoryCodeownerValidation and AccessLevelDeployKey, which already skip with parent_authorizes.

This adds create_squash_option to the existing create_branch_rule, next to update_squash_option in update_branch_rule and delete_squash_option in delete_branch_rule. No other permission changes.

Related to #593878.

I found this while working on gitlab-mcp-server.

Edited by 🤖 GitLab Bot 🤖