Add permissions route setting to pipeline schedule rest api endpoints

What does this MR do and why?

  • Adds authorization route setting to pipeline schedule REST API endpoints listed in #575295 (closed).
  • This is part of a bigger epic, &18555 to add granular permissions to personal access tokens.

How to set up and validate locally

  1. In Rails console, create a personal access token with the necessary permissions
# Enable feature flag
Feature.enable(:authorize_granular_pats)

user = User.first

# Create a personal access token
token = PersonalAccessTokens::CreateService.new(
  current_user: user,
  target_user: user,
  organization_id: user.organization_id,
  params: { expires_at: 1.month.from_now, scopes: ['granular'], granular: true, name: 'gPAT' }
).execute[:personal_access_token]

# Get a project
project = user.projects.first

# Create a pipeline schedule
Ci::PipelineSchedule.create(description: 'test', project: project, cron: '1 2 3 4 *', cron_timezone: 'UTC', ref: 'master')

# Add permissions to the token
project_scope = Authz::GranularScope.new(namespace: project.project_namespace, permissions: [:read_pipeline_schedule])

Authz::GranularScopeService.new(token).add_granular_scopes(project_scope)

# Get the token
token.token
  1. Curl the endpoint with the token
curl http://127.0.0.0.1:3000/api/v4/projects/<PROJECT_ID>/pipeline_schedules -X GET -H "PRIVATE-TOKEN: <TOKEN>"

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #575295 (closed)

Edited by Hinam Mehra

Merge request reports

Loading