Add granular token directives to project statistics types

José M. Requena Plensrequested to merge
gitlab-community/gitlab-org/gitlab:jmrp-gpat-project-statistics into master

What does this MR do and why?

With a fine-grained personal access token, Project.statistics, Project.statisticsDetailsPaths and Group.projectStatistics return null whatever the token grants: their types have no granular token directive, and a type without one is denied to such a token (L51-52). REST gives the same token the same statistics with GET /projects/:id?statistics=true, which needs only Project: Read (L631).

This MR gives the three types skip_reason: :parent_authorizes and removes them from the todo list. Each is returned by one field, whose type already checks the token:

  • ProjectStatistics: Project.statistics (read_project)
  • ProjectStatisticsRedirect: Project.statisticsDetailsPaths (read_project)
  • NamespaceProjectStatistics: Group.projectStatistics (read_group)

The read_statistics role check stays, as in REST (L179-181). Legacy tokens are not affected.

I did not use Statistic: Read (read_statistic): REST uses it for the 30-day fetch statistics, so it would make GraphQL stricter than REST here. Happy to switch if you prefer it.

References

I found this while working on gitlab-mcp-server.

Screenshots or screen recordings

Not applicable: no UI change.

How to set up and validate locally

  1. Create a fine-grained personal access token with Project: Read for a project where you have at least the Reporter role.

  2. Send this query to /api/graphql with the token:

    query { project(fullPath: "<project>") { statistics { commitCount storageSize } statisticsDetailsPaths { repository } } }

    On master both fields are null; on this branch they are returned.

  3. With a Group: Read token for a group you own, send query { groups(search: "<group>") { nodes { projectStatistics { storageSize } } } }. On master projectStatistics is null; on this branch it is returned.

Specs I ran (Ruby 3.3.11)
  • With master's three type files and todo list in place, the three new examples fail, one per parent, and nothing else does (project_statistics_spec.rb, project_statistics_redirect_spec.rb, groups_query_spec.rb: 73 examples, 3 failures).
  • On this branch, those three files plus the specs of the three types (CE and EE) and admin_groups_query_spec.rb: 131 examples, 0 failures.
  • bundle exec rake gitlab:permissions:validate: all valid, GraphQL field documentation up to date.
  • RuboCop on the six changed Ruby files: no offenses. The commit linter: no findings.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports