Skip to content

Write to ProjectFeature#container_registry_access_level

What does this MR do?

We are in the process of migrating code to use ProjectFeature#container_registry_access_level instead of Project#container_registry_enabled.

Current state:
All readers read directly from project_features.container_registry_access_level (changed in !55071 (merged)). This is done by delegating Project#container_registry_enabled to ProjectFeature. All writers continue writing to projects.container_registry_enabled, which is then copied over to project_features.container_registry_access_level by a before_update callback on the Project model.

This MR changes all writes to go to project_features.container_registry_access_level as well as projects.container_registry_enabled by

  • Overriding the Project#container_registry_enabled= setter to write to ProjectFeature#container_registry_access_level as well.
    • project.update(container_registry_enabled: true) will set project.project_feature.container_registry_access_level to ENABLED.
    • project.update(container_registry_enabled: false) will set project.project_feature.container_registry_access_level to DISABLED.
    • Users cannot set container_registry_access_level to PRIVATE as yet since the APIs do not allow setting container_registry_access_level directly. This will be added in !62662 (merged).

We need to override the setter because the project create/edit public API writes to Project#container_registry_enabled. At the next major version, we could drop support for the boolean container_registry_enabled key in projects API. API users can instead modify container_registry_access_level, whose values can be one of private, enabled or disabled (to be added in !62662 (merged)).

Screenshots (strongly suggested)

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Related to #18792 (closed)

Edited by Reuben Pereira

Merge request reports