Skip to content

Support `deploy_token` URL parameter for relevant APIs

naruaway requested to merge gitlab-community/gitlab:support-deploy-token-url-param into master

Closes #454844

What does this MR do and why?

The main purpose of this MR is to close #454844. However, this MR does more than that. I just added deploy_token URL parameter support for every APIs which already supports deploy-token HTTP header. I think this makes sense assuming there is no security concern. For personal/project access tokens, both HTTP header and URL parameter are already supported.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

I set up the following Generic Package registry state in my local environment using GDK-in-a-box:

How to set up and validate locally

After setting up the Generic Package registry like the above screenshot, I used the following Node.js script for the verification:

const deployToken = "gldt-PwRgRbKYJv7JXZFM7RCQ"; // This deploy token is with read_package_registry scope

const res = await fetch(
  `http://gdk.local:3000/api/v4/projects/${encodeURIComponent(
    "root/naru-test-test",
  )}/packages/generic/mypkg/v1/hello.txt?deploy_token=${deployToken}`,
);
console.log(res.status);
console.log(await res.text());

Before this MR, it returned 401 HTTP error. After this MR, it returned 200 HTTP status with the correct response body.

Edited by naruaway

Merge request reports