Draft: Draft: Answer every Orbit redaction ability in one request [ci skip]

Michael Angelo Riverarequested to merge
michaelangeloio/orbit-redaction-by-ability into master

What does this MR do and why?

Orbit checks Project nodes with read_project and code nodes with read_code, and both use the project resource type. Rails accepted one redaction entry for each resource type, so Orbit had to check Project with read_code. A project with its repository turned off was then hidden in Orbit.

Now QueryRunner sets redaction_by_ability on the Orbit request. Orbit then sends one entry for each resource type and ability, in one request. Rails answers each entry with its ability, and Authz::RedactionService loads the records of a type once for all of its abilities.

Blocked: this MR needs a gitlab-orbit-proto release with the new proto fields, from gitlab-org/orbit/knowledge-graph!2794 (closed). Then bump the gem here.

References

Screenshots or screen recordings

Not a UI change.

How to set up and validate locally

  1. Run the specs. 184 examples pass with a local build of the proto gem from gitlab-org/orbit/knowledge-graph!2794 (closed).

    bundle exec rspec spec/services/authz/redaction_service_spec.rb \
  ee/spec/lib/analytics/knowledge_graph/query_runner_spec.rb

  2. With the Orbit stack and Feature.enable(:orbit_query_in_rails), query a project and its branches as a Reporter. Use a project with the repository turned off:

    MATCH (p:Project {id: <id>}) RETURN p.name
MATCH (p:Project {id: <id>})-[:CONTAINS]->(b:Branch) RETURN p.name, b.name

    The first query returns the project, and the second returns no rows. Orbit logs one redaction request with 2 entries for the second query. On GDK, these results matched with the flag on.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports