Use devise authenticate_user! for search controller
What does this MR do and why?
Updates the way the search controller authenticates users per #501305 (closed).
It changes so that we authenticate users for search requests:
- when the public visibility level is restricted
- when the
allow_anonymous_searches
flag is disabled (existing check) - when the
block_anonymous_global_searches
feature flag is enabled - for global search scope only (existing check)
We use the devise authenticate_user!
check which handles redirect based on the setup, for example if SSO is setup it would redirect to the SSO page instead of /users/sign_in
which could contain banners and information customers don't want to expose.
References
Please include cross links to any resources that are relevant to this MR This will give reviewers and future readers helpful context to give an efficient review of the changes introduced.
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
How to set up and validate locally
Open an incognito tab at <gdk url>/search
:
- if none of the flags/settings require authentication, note that search is available
::Gitlab::CurrentSettings.update!(restricted_visibility_levels: []) Feature.enable(:allow_anonymous_searches) Feature.disable(:block_anonymous_global_searches)
- if public visibility is restricted, you get redirected
::Gitlab::CurrentSettings.update!(restricted_visibility_levels: [20])
- if
allow_anonymous_searches
is disabled, you get redirected::Gitlab::CurrentSettings.update!(restricted_visibility_levels: []) Feature.disable(:allow_anonymous_searches)
- if
block_anonymous_global_searches
is enabledFeature.enable(:allow_anonymous_searches) Feature.enable(:block_anonymous_global_searches)
- You can do group/project searches: http://127.0.0.1:3000/search?search=gitlab&group_id=24
- You get redirected for global searches: http://127.0.0.1:3000/search?search=gitlab
Related to #501305 (closed)