Skip to content

Refactor `app/services/resource_access_tokens/create_service.rb`

Manoj M J requested to merge 371610-follow-up-1-prevent-project-maintainers-from-modifying-or-creating-owner-members into master

What does this MR do and why?

This MR does a minor refactor in the app/services/resource_access_tokens/create_service.rb file.

This is related to the discussion in https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/2335#note_899704832.

Previously

We had to manually include a case where - in a project, a MAINTAINER is trying to create a Project access token with OWNER access level. Such a creation should not be allowed, so we had to handle that case manually using an if condition.

After the change

We do not need this if condition anymore, because the Member creation services has evolved from the time we wrote this condition, and now the service itself can handle this scenario, and it gracefully returns a false in such a case from over here.

After this change, no specs have failed, and hence we can be sure that the change works as expected.

The spec we are most interested in, for this specific case is the one here, and it passes even after the changes in this MR.

No changelog added as this is only a refactor.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #371610 (closed)

Edited by Manoj M J

Merge request reports