Skip to content

Use abilities explicitly related to CI minute access

Allison Browne requested to merge 346935-define-explicit-policies-for-who-can-view-ci-minute-and-duration-data into master

Related to #346935 (closed)

What does this MR do and why?

We used to use admin_group to check if a user can purchase ci minutes or view the usage quotas page. Now (read_usage_quotas)

In #346935 (closed) we define abilities that are specific to ci_minutes. These are:

  • admin_ci_minutes
  • read_ci_minutes_overview

Here we use the admin_ci_minutes ability check throughout the application.

prework: - In !113248 (merged) we create the admin_ci_minutes permission which should cover viewing the usage quota page for a group where minute usage has a reporting breakdown by project and also purchasing ci minutes

Changes:

  • Use admin_ci_minutes in these places:
    • group usage quota page pipeline tab only
  • Update the documentation with the prerequisite permissions for purchasing minutes
  • Update the documentation with the prerequisite permissions for personal namespace (view and purchase)

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Allison Browne

Merge request reports