Add a new identifier for deploy token

What does this MR do and why?

This MR is part of the effort to fix Git Streaming Audit Events 404/401 errors for non-human actors in HTTP requests.

When a git push/pull is performed using a DeployToken, the audit event fails because the gl_id is incorrectly
generated as user-{id} instead of deploy-token-{id}. This causes the audit endpoint to fail when trying to look up the actor.

This MR updates Gitlab::GlId.gl_id to return type-specific identifiers:

  • Useruser-{id}
  • DeployTokendeploy-token-{id}
  • Keykey-{id} (also covers DeployKey via inheritance)

This is a prerequisite for #570235 (closed), which will update Workhorse to send this identifier to the audit endpoint.

Note on Key support

The original issue suggested adding Key support to gl_id. After investigation, gl_id is
called from four places, and none of them pass a Key:

  1. call site: lib/gitlab/workhorse.rb
  • what's passed: user
  • why not Key: comes from authenticated_user which returns User or DeployToken from HTTP
    auth
  1. call site: ee/app/controllers/ee/repositories/git_http_controller.rb
  • what's passed: user
  • why not Key: same as above, even the Geo override returns deploy_key.user (User), not the key itself
  1. call site: lib/api/internal/base.rb
  • what's passed: actor.user
  • why not Key: GitAccessActor sets @user = key.user, so it's always a User
  1. call site: lib/gitlab/git/user.rb
  • what's passed: gitlab_user
  • why not Key: all callers pass current_user or similar User objects

References

Issue: #570234 (closed)

Epic: gitlab-org#20506

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Emma Park

Merge request reports

Loading