Move to minimum role project create restriction
What does this MR do and why?
As group setting of Roles allowed to create projects means minimum roles allowed to create projects, I changed code like below.
- Added the word
minimumto the dropdown title. - Changed the dropdown item of
Developers + MaintainerstoDevelopers. - Renamed
DEVELOPER_MAINTAINER_PROJECT_ACCESStoDEVELOPER_PROJECT_ACCESSthroughout the codebase, including variable and method names of a similar nature. (BecauseDEVELOPER_MAINTAINER_PROJECT_ACCESSmeantDevelopers + Maintainers.) - Added one test for
user#manageable_groupsafter renamed the method's argument name. Because I found that there wasn't a test for it. - Changed the order of the dropdown items from highest to lowest roles.
References
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
Please see the dropdown title, the item of Developers and the items' order.
- Group settings
| Before | After |
|---|---|
![]() |
![]() |
![]() |
![]() |
- Group settings in admin area
| Before | After |
|---|---|
![]() |
![]() |
![]() |
![]() |
- Default settings in admin area
| Before | After |
|---|---|
![]() |
![]() |
How to set up and validate locally
- Open gdk in a browser, and log in as an admin user.
- Open group settings. http://gdk.local:3000/groups/twitter/-/edit#js-permissions-settings
SeeMinimum roles allowed to create projects. (Please read it differently, if your gdk's domain and group names are different) - Open group settings in admin area. http://gdk.local:3000/admin/groups/twitter/edit
SeeMinimum roles allowed to create projects. - Open default settings in admin area. http://gdk.local:3000/admin/application_settings/general#js-visibility-settings
SeeDefault minimum roles for project creation protection.
Concern
I changed Roles allowed to create projects to Minimum roles allowed to create projects of the dropdown title in group settings. I think Roles allowed to create subgroups below it also means minimum roles. I suggest to add word minimum to it in another MR.

The reason why it means minimum is that Owner and Maintainer with ::Gitlab::Access::MAINTAINER_SUBGROUP_ACCESS can create subgroups according to the following code.
https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/policies/group_policy.rb#L330
rule { maintainer & maintainer_can_create_group }.enable :create_subgroup
https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/policies/group_policy.rb#L20
condition(:maintainer) { access_level >= GroupMember::MAINTAINER }
Note
I found Gitlab::Access.project_creation_options in https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/views/admin/application_settings/_project_creation_level.html.haml#L6.
But I don't think this file is called from anywhere. So there isn't a screenshot.
Related to #507410 (closed)









