Gate the artifact registry settings route on the update ability

Rahul Chanilarequested to merge
608396-activation-and-deactivation-step-11 into master

What does this MR do and why?

The organization Artifact Registry settings route admitted any organization member. ArtifactRegistryGating checks only read_artifact_registry, and every organization member holds that ability, so a plain member could load the settings page.

This authorizes update_organization as well, via the inherited Organizations::ApplicationController#authorize_admin_organization!, so only a viewer who may administer the organization reaches the page.

The callback is registered after include ArtifactRegistryGating, so it runs later in the chain. ensure_artifact_registry_available! calls render_404, which halts the chain, so the flag-off and missing-read-ability responses are byte-unchanged.

This mirrors the shape already on master in the sibling repositories controller, ee/app/controllers/organizations/artifact_registry_controller.rb.

Scope

This is the owner-only half of the settings gate. The activation-only half — returning not found when the organization has no registry — needs the activation state and lands with it. Until then an owner of an organization with no registry still reaches a settings page about a registry it does not have. That is behind the disabled artifact_registry_ui flag, so it is not user-visible.

References

Implements Step 11 of the monolith S10 activation plan (Settings route owner gate). Feature flag: artifact_registry_ui, pre-existing and disabled; this MR mints none.

Screenshots or screen recordings

Not applicable: no UI change. The change is a controller authorization callback, and the flag is off.

How to set up and validate locally

  1. Enable the flag in the Rails console:

    Feature.enable(:artifact_registry_ui)

  2. As an organization owner, visit /-/organizations/<organization-path>/settings/artifact_registry. The page renders.

  3. As a plain organization member, visit the same path. You get a 404.

  4. Disable the flag again and repeat as the owner. You get a 404, unchanged from before this MR.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Testing

ee/spec/requests/organizations/settings/artifact_registry_controller_spec.rb covers: an owner reaching the page; a member holding only the read ability getting not found; and the two flag-off contexts (artifact_registry_ui and ui_for_organizations) now exercised as an owner, so they can fail rather than passing on the owner gate alone.

ee/spec/features/organizations/settings/artifact_registry_spec.rb had its user retargeted to an owner; without that it would go red on this change.

No changelog

Deliberate. The slice is dark behind the disabled artifact_registry_ui flag, so there is nothing user-facing to announce yet. The changelog lands with the flag default-on.

Related to #608396 (closed)

Merge request reports