Support disabled immediate deletion in groups and projects API
Depends on Add the allow_immediate_namespaces_deletion app... (!205554 - merged).
What does this MR do and why?
This change introduces API support for a new admin setting that controls whether users can immediately delete groups and projects that are scheduled for deletion, rather than waiting for the retention period to expire.
Previously, this functionality was controlled by a feature flag. Now it's a proper instance setting that administrators can configure. By default, immediate deletion is allowed on self-managed GitLab instances, but it's disabled on GitLab.com and GitLab Dedicated for safety reasons.
It updates the API documentation to clarify that the permanently_remove
parameter won't work when immediate deletion is disabled by the administrator.
For users on GitLab.com, this means they can no longer immediately delete projects or groups - they must wait for the 30-day retention period or contact support. Self-managed instance administrators now have clear control over whether their users can bypass deletion protection periods.
The code changes replace the feature flag logic with checks against the new application setting, and administrators always retain the ability to immediately delete items through admin pages regardless of the setting.
The feature is behind by the allow_immediate_namespaces_deletion
feature flag. Documentation has been updated to explain the new setting, and tests have been added to verify the functionality works correctly.
References
- Implements Support disabled immediate deletion in groups a... (#571152 - closed)
- Part of Introduce a new "Allow immediate deletion" appl... (#569453)
How to set up and validate locally
allow_immediate_namespaces_deletion
FF disabled
With the - Mark a group/project as deleted via the API
- Repeat the same API call with
permanently_remove=true
(andfull_path=<full path of the group
for a group) - The group/project should be permanently deleted
allow_immediate_namespaces_deletion
FF enabled
With the - Mark a group/project as deleted via the API
- Repeat the same API call with
permanently_remove=true
(andfull_path=<full path of the group
for a group) - You should get a 400 error
`permanently_remove` option is not permitted on this instance.
.
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.