Skip to content

Support disabled immediate deletion in groups and projects API

Depends on Add the allow_immediate_namespaces_deletion app... (!205554 - merged).

What does this MR do and why?

This change introduces API support for a new admin setting that controls whether users can immediately delete groups and projects that are scheduled for deletion, rather than waiting for the retention period to expire.

Previously, this functionality was controlled by a feature flag. Now it's a proper instance setting that administrators can configure. By default, immediate deletion is allowed on self-managed GitLab instances, but it's disabled on GitLab.com and GitLab Dedicated for safety reasons.

It updates the API documentation to clarify that the permanently_remove parameter won't work when immediate deletion is disabled by the administrator.

For users on GitLab.com, this means they can no longer immediately delete projects or groups - they must wait for the 30-day retention period or contact support. Self-managed instance administrators now have clear control over whether their users can bypass deletion protection periods.

The code changes replace the feature flag logic with checks against the new application setting, and administrators always retain the ability to immediately delete items through admin pages regardless of the setting.

The feature is behind by the allow_immediate_namespaces_deletion feature flag. Documentation has been updated to explain the new setting, and tests have been added to verify the functionality works correctly.

References

How to set up and validate locally

With the allow_immediate_namespaces_deletion FF disabled

  1. Mark a group/project as deleted via the API
  2. Repeat the same API call with permanently_remove=true (and full_path=<full path of the group for a group)
  3. The group/project should be permanently deleted

With the allow_immediate_namespaces_deletion FF enabled

  1. Mark a group/project as deleted via the API
  2. Repeat the same API call with permanently_remove=true (and full_path=<full path of the group for a group)
  3. You should get a 400 error `permanently_remove` option is not permitted on this instance..

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Rémy Coutable

Merge request reports

Loading