Add RuboCop rule to enforce class-level allow_access_with_scope

Halil Cobanrequested to merge
rubocop-rule-for-allow-access-scope into master

What does this MR do and why?

This MR adds a RuboCop rule to enforce class-level allow_access_with_scope

This ensures the method is only used at the class level, not nested in namespaces. Because, if this method is called multiple times on the same class, the scopes are all aggregated

References

This commit was initially introduced as part of a security fix, but was removed from the security MR to keep security MR minimal.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After

How to set up and validate locally

  1. Add allow_access_with_scope call nested in a namespace or resource. Eg:
diff --git a/lib/api/usage_data_service_ping.rb b/lib/api/usage_data_service_ping.rb
index 37f03fd94ebf..337aca4eda86 100644
--- a/lib/api/usage_data_service_ping.rb
+++ b/lib/api/usage_data_service_ping.rb
@@ -8,6 +8,7 @@ class UsageDataServicePing < UsageData

     namespace 'usage_data' do
       resource :service_ping do
+        allow_access_with_scope :read_service_ping
         before do
           authenticated_as_admin!
         end
  1. Run rubocop lib/**/api/**/*.rb ee/**/api/**/*.rb
  2. You should get an error

Resolves https://gitlab.com/gitlab-org/gitlab/-/issues/505454

Merge request reports