Replicate owning_cell_id to IAM oauth_clients

What does this MR do and why?

Send owning_cell_id on every OAuth application upsert to IAM, and update the vendored gitlab-iam-grpc gem to IAM 0a44f0f.

IAM oauth_clients gained an owning_cell_id column in gitlab-org/auth/iam!687. IAM needs the value to tell Rails-owned clients (owning_cell_id set) apart from IAM-native dynamic clients (owning_cell_id NULL), so Layer 4 orphan detection only reconciles the clients a cell actually owns. IAM main already requires owning_cell_id >= 1 on upsert, so until this ships, every Rails upsert against that main fails with INVALID_ARGUMENT.

The value sent is Gitlab.config.cell.id.to_i, the same expression AcceptLoginChallengeService already sends to IAM's login-accept RPC. It is not guarded on cell.enabled: replication is a Cells-era mechanism, so an unconfigured cell (id nil, sent as 0) should fail loudly rather than silently replicate ownerless.

References

Related to #629574 (closed).

Precedent: !255329 (merged), !254771 (merged).

Screenshots or screen recordings

N/A, backend-only change.

How to set up and validate locally

  1. Enable the flag: Feature.enable(:iam_data_replication)
  2. Create or update an Authn::OauthApplication and let it replicate (or drive Authn::IamReplication::OauthApplicationReplicator#deliver directly)
  3. Confirm the upsert request IAM receives carries owning_cell_id equal to Gitlab.config.cell.id

In case you want to test E2E: !249860 (merged)

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Daniele Bracciani

Merge request reports

Loading
Loading