Skip to content

Add Users AllowList to Git abuse rate limit settings

Hinam Mehra requested to merge anti-abuse/17-create-users-allowlist-for-git-anti-abuse-settings into master

What does this MR do and why?

Resolves https://gitlab.com/gitlab-org/modelops/anti-abuse/team-tasks/-/issues/17

  1. Adds an Excluded Users input to the Git abuse rate limit settings form. This input will let admin configure an allowlist of users who will not be banned even if they exceed the set git rate limits.
  2. The maximum number of users an admin can add to this allowlist is a 100.
  3. In the database, this allowlist will be stored as an array of usernames in the application_settings table in column git_rate_limit_users_allowlist. This is because downstream, we will use the ApplicationRateLimiter to enforce these limits.
  4. git_rate_limit_users_allowlist will be exposed as part of the /application/settings API endpoint
  5. Since, the allowlist is a dynamic component, this MR also refactors the existing Git abuse rate limit settings form HAML to Vue. Subsequently, feature specs + view specs + API specs are all updated.

Screenshots or screen recordings

allowlist

How to set up and validate locally

  1. Enable the feature flag git_abuse_rate_limit_feature_flag: echo "Feature.enable(:git_abuse_rate_limit_feature_flag)" | rails c
  2. Sign in as admin
  3. Navigate to http://localhost:3000/admin/application_settings/reporting

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Hinam Mehra

Merge request reports