Validate remote mirror url uniqueness and self-reference

What does this MR do and why?

Contributes to #603810 (closed)

Problem

The RemoteMirror model did not prevent a project from adding multiple push mirrors with the same URL, nor from pointing a mirror at the project's own repository. Both were silently accepted, leading to redundant sync jobs and self-mirroring loops.

Solution

  • Add a create-only url_not_duplicated validation that rejects a second mirror with the same sanitized URL on the same project.
  • Add a create-only url_not_pointing_to_self validation that rejects a mirror targeting the project's own HTTP or SSH repository URL.
  • Compare on the sanitized stored URL so credentials neither leak into errors nor make detection credential-sensitive.
  • Scope both to on: :create so existing duplicate or self-mirrors are grandfathered and ongoing syncs, toggles, and edits keep working.

References

Screenshots or screen recordings

Before After
remote-mirror-duplicate-before remote-mirror-duplicate-after

How to set up and validate locally

  1. Go to a project's Settings > Repository > Mirroring repositories.
  2. Add a push mirror with some URL, then try adding a second mirror with the same URL — it is now rejected.
  3. Try adding a mirror pointing at the project's own repository URL — it is now rejected.
  4. Run the specs: bin/rspec spec/models/remote_mirror_spec.rb.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Vasilii Iakliushin

Merge request reports

Loading