Skip to content

Unify permissions to manage Vulnerabilities under admin_vulnerability

What does this MR do?

This MR replaces two abilities resolve_vulnerability and dismiss_vulnerability with a single admin_vulnerability that is used in both cases from now.

This is in line with how permissions for other GitLab entities are defined. It makes sense to extract separate permissions from admin_* only in case when a particular action is granted to a specific user access level, see the example with Vulnerability Feedback: !9700 (merged), b8fa8b82.

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Merge request reports