Add write option for Repositories in job token fine-grained permissions
What does this MR do and why?
During staging verification of the allow_push_to_allowlisted_projects feature flag, it was found that the allowlist's per-resource fine-grained form has no admin/write option for Repositories — only None/Read. Every other resource with a backend admin policy renders "Read and write" in the same form.
app/assets/javascripts/token_access/constants.js (POLICIES_BY_RESOURCE) was missing a POLICY_ADMIN_REPOSITORIES entry, although the backend (lib/ci/job_token/policies.rb) already accepts :admin_repositories.
This MR is a frontend-only fix: it adds POLICY_ADMIN_REPOSITORIES to app/assets/javascripts/token_access/constants.js (plus the matching test mock), which surfaces the missing Read and write option in the Repositories dropdown. No backend changes are needed.
Validation:
- With fine-grained ON and Repositories set to "Read and write", cross-project push succeeds.
- With Repositories set to "Read" only, push correctly returns 403 — confirming both branches of
policies_allowed?(..., [:admin_repositories])work as expected.
References
- Feature flag rollout issue: #597258 (closed)
- Feature issue: #479907 (closed)
- Original implementation MR: !229671 (merged) (backend)
- Original implementation MR: !232351 (merged) (frontend)
Screenshots or screen recordings
| Before | After |
|---|---|
![]() |
![]() |
How to set up and validate locally
- Enable the
allow_push_to_allowlisted_projectsfeature flag in GDK. - Navigate to a target project's Settings > CI/CD > Token Access.
- Enable inbound job token scope and add a source project to the allowlist.
- Enable fine-grained permissions for the allowlist entry.
- Verify the Repositories dropdown now shows "None", "Read", and "Read and write".
- Set Repositories to "Read and write" and confirm a cross-project
git pushfrom the source project's CI pipeline succeeds. - Set Repositories back to "Read" and confirm the push returns 403.
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

