Declare read_group as the parent permission of GroupStats

José M. Requena Plensrequested to merge
gitlab-community/gitlab-org/gitlab:jmrp-granular-pat-group-stats into master

What does this MR do and why?

GroupStats skips granular token authorization with parent_authorizes, but names no permission, so it is still listed in authorization_todo.txt. It now declares parent_authorizes: :read_group and leaves the list. This follows !269587 (merged), which authorized GroupReleaseStats.

Why read_group and not read_release:

  • Group.stats is its only parent, and Group checks read_group, so no token gains or loses data.
  • Its only field, releaseStats, returns GroupReleaseStats, which checks read_release on the group itself since that MR. Declaring read_release on GroupStats would hide stats from a token that reads the group but not its releases. The example 'denying a granular token that only authorizes the parent of a field' in ee/spec/requests/api/graphql/group/release_stats_spec.rb already expects group.stats with read_group alone.

It also pins the directive in the type spec, and updates a comment in group_query_spec.rb that still said releaseStats was not authorized.

References

Related to #639319

Related to #593878

I found this while working on gitlab-mcp-server.

Screenshots or screen recordings

No UI change.

How to set up and validate locally

  1. bundle exec rake gitlab:permissions:validate passes. With master's group_stats_type.rb and this todo list, it lists GroupStats as a type that declares no permission.
  2. bundle exec rspec ee/spec/graphql/types/group_stats_type_spec.rb ee/spec/requests/api/graphql/group_query_spec.rb ee/spec/requests/api/graphql/group/release_stats_spec.rb passes.
Checks I ran (Ruby 3.3.11)
  • The type spec, group_query_spec.rb, release_stats_spec.rb and the GroupReleaseStats type spec: 51 examples, 0 failures, 1 pending.
  • With master's group_stats_type.rb, the same specs: 51 examples, 1 failure, the new type spec example.
  • gitlab:permissions:validate, RuboCop, the commit linter and Danger's linters pass; both compile_docs tasks leave the committed docs unchanged.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports