Skip to content

Add project level access tokens

What does this MR do?

See #210181 (closed) and &2587

Adds the ability to add access tokens scoped to a project (PrAT). Adding PrAT also creates a "Project Bot User" that holds the access token. Revoking an access token removes the "Project Bot User" from the project and deletes the user making it a "Ghost User". This feature will be for self-managed instances only.

Other related changes

  • Moves shared access token partials to views/shared/access_tokens
  • Refactors access token partials to be more flexible
  • Upgrades datepicker (used by PrAT, PAT, and impersonation tokens) to GitLab UI datepicker
  • Grays out past dates in datepicker so an already expired token can't be created
  • Improves consistency of capitalization across PAT and impersonation tokens
  • Improves consistency of single quotes/double quotes in access token partials

Steps to setup a PrAT

  1. Enable the :resource_access_token feature flag
    • bin/rails console
    • `Feature.enable(:resource_access_token)
  2. Create a project
  3. Create a new PrAT in "Settings" -> "Access Tokens"
  4. Copy your PrAT and save it.
  5. A "Project Bot User" will show in "Settings" -> "Members", but you can't edit the user (#215297 (closed))
  6. Revoke the PrAT in "Settings" -> "Access Tokens", the "Project Bot User" will also be removed from the project.

Followup Issues

Screenshots

Review App: https://gitlab-review-210181-pro-umzb60.gitlab-review.app/root/test-project/-/settings/access_tokens

Page Before After
Project Access Tokens N/A Screen_Shot_2020-05-08_at_10.30.43_AM
PAT Screen_Shot_2020-05-06_at_9.50.42_AM Screen_Shot_2020-05-08_at_10.35.22_AM
Impersonation tokens Screen_Shot_2020-05-06_at_9.51.09_AM Screen_Shot_2020-05-08_at_10.34.48_AM
Datepicker Screen_Shot_2020-05-06_at_10.04.53_AM Screen_Shot_2020-05-08_at_10.29.46_AM

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Peter Hegman

Merge request reports