Token prefixes: Instance wide prefix only matches are invalid

• Please check this box if this contribution uses AI-generated content (including content generated by GitLab Duo features) as outlined in the GitLab DCO & CLA. As a benefit of being a GitLab Community Contributor, you receive complimentary access to GitLab Duo.

What does this MR do and why?

Authn::Tokens::OauthApplicationSecrets.prefix? returns true even if only the instance wide prefix matched. This caused other tokens to be wrongly identified as OauthApplicationSecrets. E.g. instancewideprefix-glpat would be identified as an OauthApplicationSecret, since the occurence of gloas is not properly checked for tokens with instance wide prefixes. Only tokens starting with gloas or instancewideprefix-gloas should match.

This MR fixes this behaviour by properly extracting the gloas- from the OAUTH_APPLICATION_SECRET_PREFIX_FORMAT. Instead of using split('-'), we are now deleting the format at the end of the string.

References

• Allow custom instance token prefix for all toke... (#388379)
• https://docs.gitlab.com/administration/settings/account_and_limit_settings/#instance-token-prefix

How to set up and validate locally

1. Start the rails console: bundle exec rails c
2. Enable the feature flag Feature.enable(:custom_prefix_for_all_token_types)
3. Change the instance wide token prefix: Admin area > General > Account and limit > Instance token prefix, e.g. to mycustomprefix
4. Without this MR, Authn::Tokens::OauthApplicationSecret.prefix?('mycustomprefix-glpat') in rails console will return true, because gloas is removed by split as well. With this MR, the same command will return false, as it now properly checks that gloas is also included.
5. Test with Authn::Tokens::OauthApplicationSecret.prefix?('mycustomprefix-gloas-token') to validate that the behaviour works for a correct token.

MR acceptance checklist

checklist

• Changelog entry added, if necessary
• Documentation created/updated via this MR
• Documentation reviewed by technical writer or follow-up review issue created
• Tests added for this feature/bug
• Tested in all supported browsers
• Conforms to the code review guidelines
• Conforms to the merge request performance guidelines
• Conforms to the style guides
• Conforms to the javascript style guides
• Conforms to the database guides

Related to #388379