Add write option for Repositories in job token fine-grained permissions

What does this MR do and why?

During staging verification of the allow_push_to_allowlisted_projects feature flag, it was found that the allowlist's per-resource fine-grained form has no admin/write option for Repositories — only None/Read. Every other resource with a backend admin policy renders "Read and write" in the same form.

app/assets/javascripts/token_access/constants.js (POLICIES_BY_RESOURCE) was missing a POLICY_ADMIN_REPOSITORIES entry, although the backend (lib/ci/job_token/policies.rb) already accepts :admin_repositories.

This MR is a frontend-only fix: it adds POLICY_ADMIN_REPOSITORIES to app/assets/javascripts/token_access/constants.js (plus the matching test mock), which surfaces the missing Read and write option in the Repositories dropdown. No backend changes are needed.

Validation:

  • With fine-grained ON and Repositories set to "Read and write", cross-project push succeeds.
  • With Repositories set to "Read" only, push correctly returns 403 — confirming both branches of policies_allowed?(..., [:admin_repositories]) work as expected.

References

Screenshots or screen recordings

Before After
image image

How to set up and validate locally

  1. Enable the allow_push_to_allowlisted_projects feature flag in GDK.
  2. Navigate to a target project's Settings > CI/CD > Token Access.
  3. Enable inbound job token scope and add a source project to the allowlist.
  4. Enable fine-grained permissions for the allowlist entry.
  5. Verify the Repositories dropdown now shows "None", "Read", and "Read and write".
  6. Set Repositories to "Read and write" and confirm a cross-project git push from the source project's CI pipeline succeeds.
  7. Set Repositories back to "Read" and confirm the push returns 403.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Dmytro Biryukov

Merge request reports

Loading
Loading