Resolve 621649: Add Terraform state restore service

Sai Charanrequested to merge
gitlab-community/gitlab-org/gitlab:621469-restore-soft-deleted-terraform-states-v2 into master

What does this MR do and why?

Adds backend support to restore a soft-deleted Terraform state within the seven-day grace period, preventing accidental state loss while preserving authorization and auditability.

Changes

  • Adds CE and EE Terraform state restore services
  • Adds the terraformStateRestore GraphQL mutation
  • Adds restore authorization and granular personal-access-token permission support
  • Returns errors when the state is not deleted, is outside the grace period, or the user lacks permission
  • Adds a successful-restore audit event
  • Adds service, GraphQL mutation, request, and EE audit specs

References

Relates to #621469 (closed)

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #621469 (closed)

Database review

This change restores one Terraform state by its primary-key ID.

UPDATE "terraform_states"
SET "updated_at" = '2026-10-07 05:04:35.431640',
    "deleted_at" = NULL,
    "activerecord_lock_version" = 2
WHERE "terraform_states"."id" = 1
  AND "terraform_states"."activerecord_lock_version" = 1

Query plan: https://console.postgres.ai/gitlab/projects/gitlab-production-main/sessions/61799/commands/166922

Edited by Taka Nishida

Merge request reports