Redirect scope-only personal access token URLs

Torben Buckrequested to merge
gitlab-community/gitlab-org/gitlab:fix/scopes-only-pat-links into master

What does this MR do and why?

Scopes-only personal access token URLs, such as /-/user_settings/personal_access_tokens?scopes=api, currently remain on the overview page when granular_personal_access_tokens is enabled but granular tokens are not enforced. The redirect requires a non-empty token name.

This MR applies a small compatibility fix: remove only the non-empty-name condition from the redirect. Valid scopes are still required, and the existing feature flag and enforcement behavior remain unchanged. Users enter the required name on the Legacy creation form, and token creation validation is unchanged.

Regression coverage includes missing, empty, and whitespace-only names; one or multiple scopes; absent, empty, and invalid scopes; enforced granular tokens; and the feature-disabled case. The documentation is also updated.

References

Closes #628548 (closed)

The issue contains the available integration evidence.

Screenshots or screen recordings

The screenshots below show local GDK validation with granular_personal_access_tokens enabled and enforcement disabled. Before the patch, ?scopes=api remains on the overview; after the patch, it opens /legacy/new?scopes=api with API preselected. Submitting an empty name still shows Token name is required.

Scenario Before After
Visit /-/user_settings/personal_access_tokens?scopes=api with granular_personal_access_tokens enabled and enforcement inactive The personal access token overview remains visible The Legacy creation form opens with the API scope preselected; the user must still enter a name
Browser verification pat-scopes-before pat-scopes-after

How to set up and validate locally

  1. Enable the feature flag in the Rails console:

    Feature.enable(:granular_personal_access_tokens)

  2. Ensure granular personal access tokens are not enforced.

  3. Visit /-/user_settings/personal_access_tokens?scopes=api.

  4. Confirm that the Legacy creation form opens with the API scope preselected.

  5. Confirm that a name is still required to create the token.

Run the focused regression specs:

bundle exec rspec spec/controllers/user_settings/personal_access_tokens_controller_spec.rb

Validation is current for source SHA 36d32e824e33922833abffc3d852f44b2bf9bdb2: the parent pipeline, CE predictive pipeline, and EE predictive pipeline passed, with all 47 focused controller examples passing in CE.

Local GDK browser validation confirmed the before/after redirect, single and multiple scope preselection, preservation of supplied name and description, and redirect behavior for missing and blank names. Missing, empty, and invalid scopes stay on the overview. Required-name validation is unchanged, and no token was created. Feature-disabled and enforced behavior is covered by specs.

MR acceptance checklist

See the acceptance checklist guidance.

  • The redirect change is limited to removing the non-empty-name condition.
  • Regression specs cover the affected and preserved behaviors.
  • Documentation is updated.
  • Ruby syntax checks passed.
  • git diff --check passed.
  • Independent static review completed with no findings.
  • AppSec review by @gitlab-com/gl-security/appsec is complete.
  • Focused controller spec passed all 47 examples on the latest tip.
  • CI has passed for the latest tip.
  • Browser validation has been completed.
Edited by Torben Buck

Merge request reports