Authorize ExternalStatusCheck for fine-grained tokens

José M. Requena Plensrequested to merge
gitlab-community/gitlab-org/gitlab:jmrp-granular-pat-external-status-check into master

What does this MR do and why?

ExternalStatusCheck declares no granular token permission (it is in config/authz/graphql/authorization_todo.txt), so it is null to a fine-grained personal access token whatever the token is granted: branchRuleExternalStatusCheckCreate and branchRuleExternalStatusCheckUpdate write the check, then answer null for externalStatusCheck.

This MR declares read_external_status_check on the type, bounded by the check's project: the permission the type's authorize already checks for the user. It is already assignable, like the create, update and delete the mutations declare, and REST asks for it to list a merge request's status checks. The to-do entry goes, and the generated GraphQL permissions page lists the type.

A token with only create or update still gets null for the check it wrote, and BranchRule.externalStatusChecks stays null until BranchRule is authorized (read_branch_rule has no assignable permission).

References

I found this while working on gitlab-mcp-server, which records such gaps in upstream-bugs.md.

Screenshots or screen recordings

Not applicable: no UI change.

How to set up and validate locally

  1. In an Ultimate project with a protected branch, as a Maintainer, create a fine-grained personal access token for the project with External Status Check: Create and Read.

  2. Save as mutation.json, with the ID of the protected branch:

    {"query": "mutation { branchRuleExternalStatusCheckCreate(input: {branchRuleId: \"gid://gitlab/Projects::BranchRule/<protected_branch_id>\", name: \"Demo\", externalUrl: \"https://example.com/status\"}) { externalStatusCheck { id name } errors } }"}

  3. Send it with the token:

    curl --request POST --header "Authorization: Bearer <your_access_token>" --header "Content-Type: application/json" \
  --data @mutation.json --url "http://gdk.test:3000/api/graphql"

  4. On master the check is created and externalStatusCheck is null; on this branch it carries the check.

Specs I ran (Ruby 3.3.11)
  • The two mutation specs with master's type: 42 examples, 2 failures, the two new examples where the token can also read, each with externalStatusCheck nil. On this branch, with the type spec and the branch rule query spec of the type: 49 examples, 0 failures. In both runs 2 are pending, the shared example's skip for a project with no top-level group.
  • bundle exec rake gitlab:permissions:graphql:compile_docs adds the one row, and bundle exec rake gitlab:permissions:validate passes.
  • RuboCop on the three Ruby files: no offenses. The commit linter: no findings.
  • Left to the pipeline: Ruby 3.4.10 and the rest of the suite.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports