Skip to content

Add admin API to revoke user support PIN

What does this MR do and why?

This MR adds the ability for administrators to revoke a user's Support PIN before its natural expiration.

What's changed:

  • Adds a new API endpoint (POST /users/:id/support_pin/revoke) that allows administrators to immediately invalidate a user's Support PIN
  • Implements a RevokeService to handle the Support PIN revocation logic

References

Screenshots or screen recordings

Before After
sequenceDiagram
    participant Admin as Administrator
    participant API as GitLab API
    participant RevokeSvc as RevokeService
    participant BaseSvc as BaseService
    participant Redis as Redis Cache

    Admin->>API: POST /users/:id/support_pin/revoke
    Note over API: authenticated_as_admin!
    API->>API: Find user by ID
    
    API->>RevokeSvc: new(user).execute
    
    RevokeSvc->>BaseSvc: pin_exists?
    BaseSvc->>Redis: exists(pin_key)
    Redis-->>BaseSvc: true/false
    BaseSvc-->>RevokeSvc: true/false
    
    alt PIN does not exist
        RevokeSvc-->>API: {status: :not_found, message: 'Support PIN not found...'}
        API-->>Admin: 404 Not Found
    else PIN exists
        RevokeSvc->>RevokeSvc: revoke_pin
        RevokeSvc->>Redis: expire(pin_key, 0)
        Redis-->>RevokeSvc: success/failure
        
        alt Revocation successful
            RevokeSvc-->>API: {status: :success}
            API-->>Admin: 202 Accepted
        else Revocation failed
            RevokeSvc-->>API: {status: :error, message: 'Failed to revoke...'}
            API-->>Admin: 400 Bad Request
        end
    end

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Michael Trainor

Merge request reports

Loading