Add a new identifier for deploy token
What does this MR do and why?
This MR is part of the effort to fix Git Streaming Audit Events 404/401 errors for non-human actors in HTTP requests.
When a git push/pull is performed using a DeployToken, the audit event fails because the gl_id is incorrectly
generated as user-{id} instead of deploy-token-{id}. This causes the audit endpoint to fail when trying to look
up the actor.
This MR updates Gitlab::GlId.gl_id to return type-specific identifiers:
-
User→user-{id} -
DeployToken→deploy-token-{id} -
Key→key-{id}(also covers DeployKey via inheritance)
This is a prerequisite for #570235 (closed), which will update Workhorse to send this identifier to the audit endpoint.
Note on Key support
The original issue suggested adding Key support to gl_id. After investigation, gl_id is
called from four places, and none of them pass a Key:
- call site: lib/gitlab/workhorse.rb
- what's passed:
user - why not Key: comes from
authenticated_userwhich returns User or DeployToken from HTTP
auth
- what's passed:
user - why not Key: same as above, even the Geo override returns deploy_key.user (User), not the key itself
- call site: lib/api/internal/base.rb
- what's passed:
actor.user - why not Key: GitAccessActor sets
@user = key.user, so it's always a User
- call site: lib/gitlab/git/user.rb
- what's passed:
gitlab_user - why not Key: all callers pass current_user or similar User objects
References
Issue: #570234 (closed)
Epic: gitlab-org#20506
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.