Let fine-grained tokens read SPDX licenses and package advisories

José M. Requena Plensrequested to merge
gitlab-community/gitlab-org/gitlab:jmrp-granular-pat-composition-analysis into master

What does this MR do and why?

A fine-grained personal access token gets null from Query.spdxLicenses and Query.packageMetadataAdvisory, and a list of null advisories from Query.packageMetadataAdvisories, because SpdxLicense, PackageMetadataAdvisory and PackageMetadataAdvisoryIdentifier declare no authorize_granular_token directive.

SpdxLicense and PackageMetadataAdvisory hold catalogue data that is the same for every user, so they declare read_metadata on the instance, as SecurityScanProfileVariable does. The resolver of Query.packageMetadataAdvisories checks the same permission, so a token without it gets null rather than a list of null advisories. PackageMetadataAdvisoryIdentifier is returned only by PackageMetadataAdvisory.identifiers, so it declares read_metadata with parent_authorizes: (added by !266839 (merged)). The three leave authorization_todo.txt.

The checks for the user do not change: the advisories still need a signed-in user, the pm_advisory_graphql flag and the dependency scanning license.

This is the Composition Analysis domain's merge request, agreed in !267273 (comment 4195231927). It adds no permission.

References

Closes #639810

I found this while working on gitlab-mcp-server.

Screenshots or screen recordings

No UI change.

How to set up and validate locally

  1. Create a fine-grained token with Metadata: Read on the instance.
  2. Run query { spdxLicenses { spdxIdentifier } } with it.
  3. On master spdxLicenses is null; on this branch it lists the licenses.

I ran these steps as the new request spec examples: on master the token with the permission gets no data from spdxLicenses or packageMetadataAdvisory, and on this branch every example passes.

Checks I ran (Ruby 3.3.11)
  • The granular token shared example on spdxLicenses, packageMetadataAdvisory and packageMetadataAdvisories, the skipped child type example for PackageMetadataAdvisory.identifiers, and a directive pin in each type spec.
  • With master's code and todo list, the five changed spec files give 35 examples, 8 failures: the three pins, the granted token on spdxLicenses and packageMetadataAdvisory, the skipped child type with the parent's grant, and the two denials of the advisory list, which returns a list of null advisories on master.
  • On this branch: 35 examples, 0 failures, 6 pending (the shared example's cases that need a project or group boundary).
  • gitlab:permissions:validate, RuboCop, the commit linter and Danger's commit and title linters pass. gitlab:permissions:graphql:compile_docs adds the three rows to fine_grained_access_tokens_graphql.md, and with them both compile_docs tasks change nothing. Left to the pipeline: Ruby 3.4.10 and the FOSS run.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports