Add revoke button to the PAT tab of the instance credentials inventory
What does this MR do?
This is a two-part resolution to #214811 (closed).
This first part adds a revoke button to each row in the Personal Access Tokens section of the instances credentials inventory. This revoke button is shown when the personal access token is active, which is defined as a token which is not revoked and is not expired (!revoked? && !expired?).
If the revoke button is clicked, it will take the user to /admin/credentials/[PAT_ID]/revoke. If the user has instance credentials access, this will use the PersonalAccessTokens::RevokeService to trigger an update to the token to make revoked true, irrespective of its current value. It will then redirect the user back to the instances credentials inventory with either a success or error flash message.
The next part of this resolution !40742 (merged) will be implemented once #238989 (closed) is completed.
In the meantime, we are using the helper method revoke_button_available? to decide whether to show the button. The value is only true for the instance credentials.
Screenshots
| Before | After | Group credentials |
|---|---|---|
 |
 |
 |
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry - [-] Documentation (if required) - See !41090 (merged)
-
Code review guidelines -
Merge request performance guidelines -
Style guides - [-] Database guides
-
Separation of EE specific content
Availability and Testing
- Go to
/admin/credentialsand confirm the button is shown - Click the button and confirm it is revoked
- Confirm the button is not shown on that row once revoked
- Try going to the endpoint as a user without instance credentials access and confirm it is blocked
The button should be shown in the following instances:
| Token state | Expiry Enforced? (expired? returns true) |
Show Revoke button | Comments |
|---|---|---|---|
| Active | Enforced | Yes | When admin voluntarily wishes to revoke (e.g. compromised account) |
| Active | Not Enforced | Yes | When admin voluntarily wishes to revoke (e.g. compromised account) |
| Expired | Enforced | No | PAT expires automatically |
| Expired | Not Enforced | Yes | Admin revokes to prevent users from using the PAT indefinitely |
| Revoked | Enforced | No | Not applicable to revoke an already revoked token |
| Revoked | Not Enforced | No | Not applicable to revoke an already revoked token |
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers - [-] Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
- [-] Label as security and @ mention
@gitlab-com/gl-security/appsec - [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
- [-] Security reports checked/validated by a reviewer from the AppSec team
Relates #214811 (closed)