Resolve "Group Secrets Manager: `read_secrets_manager` authorization restricts page access for users with roles below Maintainer"

Ahmad Husseinrequested to merge
599180-fix-group-secrets-authorization into master

What does this MR do and why?

There was an issue with the group secrets manager where even after granting a user read/write access to secrets, they would not be able to load the secrets manager page properly if they had a role below Maintainer level. This is because the query to fetch the group secrets manager status was using authorize :read_secrets_manager which is only present for Maintainer+, this authorization is also used for the group secrets manager permissions which makes sense there.

In this MR we switch to using authorize :read_secret to gate fetching the group secret manager status. The Group::SecretsController uses this same :read_secret ability to control if the page can be viewed.

With this change in place, a user with Reporter+ level access can properly load the secrets manager page as would be expected. They could still see a permission error if they have not been given permission to read secrets but this is expected.

Note: This was not an issue observed for the project secrets manager as it seems there is a separate read_project_secrets_manager_status ability that gates the secrets manager status there, which operates as expected and exists for the Reporter+ role.

References

#599180 (closed)

Screenshots or screen recordings

A user that has been given read permissions in the group secrets manager permission settings

before:

image

after:

image

How to set up and validate locally

  1. Upload a Premium license (or above).
  2. Set up openbao and enable the secrets manager on your gdk.
  3. Enable the group_secrets_manager feature flags.
  4. Go to your group settings (Settings > General) and expand Permissions and group features (for groups)
  5. Add a user permission in the secrets manager permission table, providing read/write access to a user with Reporter or Developer role in the group
  6. Navigate to the admin area -> Users, find the user from step 5, and click on them. Then click Impersonate.
  7. Navigate to Secure > Secrets Manager page, and verify the page loads correctly.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #599180 (closed)

Merge request reports