## Summary The REST API for the group credentials inventory (`API::Manage::Groups`) does not check the `credentials_inventory` license. On GitLab.com, a group Owner on any plan can use this Ultimate feature through the API. The UI blocks it for groups without Ultimate. Found during the OpenAPI `route_setting :tier` backfill in https://gitlab.com/gitlab-org/gitlab/-/work_items/631956. That work only documents the intended tier. It does not change behavior. ## Steps to reproduce This requires GitLab.com, or an instance that simulates SaaS. You also need a group that does not have Ultimate (Free or Premium). The results below are expected from reading the code and have not yet been confirmed on a live instance. 1. Create a top-level group without Ultimate. 1. Sign in as a user with the Owner role in that group. 1. Open the group's credentials inventory page in the UI. It returns 404, and the sidebar does not show the entry. 1. Call the API with a token for the Owner: `GET /groups/:id/manage/personal_access_tokens`. 1. Call `GET /groups/:id/manage/ssh_keys` and `GET /groups/:id/manage/resource_access_tokens`. 1. Optionally call the `DELETE` and `rotate` routes on a member's token or key. ## What is the current bug behavior? The API returns data and accepts changes. A group Owner on a non-Ultimate plan can: - list, revoke, and rotate group members' personal access tokens - list, revoke, and rotate resource access tokens - list and delete SSH keys The API also does not check that the group is a top-level group. The policy does. This still needs to be confirmed. ## What is the expected correct behavior? The API should follow the same rules as the UI. Requests for a group without the `credentials_inventory` license should be denied. Subgroups should be denied too, as the policy does today. ## Proposal Use the policy the UI already uses in the API `before` block of `ee/lib/api/manage/groups.rb`. - Replace the bare SaaS check and `admin_group` check with `authorize! :admin_group_credentials_inventory, user_group` for write routes. - Use `:read_group_credentials_inventory` for read routes. - Alternatively, add `licensed_feature_available?(:credentials_inventory)` and a top-level-group check to the `before` block. - Add request specs for unlicensed (Free and Premium) groups and for subgroups. - Correct the tier in `doc/api/groups.md`. Affected routes (8): - `GET /groups/:id/manage/personal_access_tokens` - `DELETE /groups/:id/manage/personal_access_tokens/:pat_id` - `POST /groups/:id/manage/personal_access_tokens/:pat_id/rotate` - `GET /groups/:id/manage/resource_access_tokens` - `DELETE /groups/:id/manage/resource_access_tokens/:prat_id` - `POST /groups/:id/manage/resource_access_tokens/:prat_id/rotate` - `GET /groups/:id/manage/ssh_keys` - `DELETE /groups/:id/manage/ssh_keys/:key_id` ## Open questions - What is the intended tier? The feature docs say Ultimate. The API docs say Premium, Ultimate. - How many non-Ultimate groups rely on this API today? What is the impact on them if we add the check? ANd is that important? <details> <summary>Evidence</summary> **API `before` block** `ee/lib/api/manage/groups.rb` (lines 10-14) only does three things: - `not_found! unless ::Gitlab::Saas.feature_available?(:group_credentials_inventory)` - `authenticate!` - `authorize! :admin_group, user_group` The SaaS check is GitLab.com-only. It is not a license tier check. **The feature is Ultimate** - `credentials_inventory` is in `ULTIMATE_FEATURES` in `ee/app/models/gitlab_subscriptions/features.rb`. - `doc/administration/credentials_inventory.md` says Tier: Ultimate. **The UI checks the license** - `ee/app/controllers/groups/security/credentials_controller.rb` has `before_action :validate_group_level_credentials_inventory_available!`. It renders 404 unless `can?(current_user, :read_group_credentials_inventory, group)`. - The helper is in `ee/app/helpers/groups/security_features_helper.rb` (lines 13-14). - The sidebar (`ee/lib/sidebars/groups/menus/security_compliance_menu.rb`, lines 222-223) uses the same permission. - The policy (`ee/app/policies/ee/group_policy.rb`, lines 75-77 and 716-719) prevents `read_group_credentials_inventory` and `admin_group_credentials_inventory` unless `::Gitlab::Saas.feature_available?(:group_credentials_inventory) && @subject.licensed_feature_available?(:credentials_inventory)`. - The policy also blocks subgroups (`has_parent`). **No GraphQL API** No GraphQL API for the group credentials inventory was found. **No checks below the API** These have no `credentials_inventory` check: - `PersonalAccessTokensFinder` - `KeysFinder` - PAT revoke and rotate - `ResourceAccessTokens::RevokeService` - `Keys::DestroyService` The only reference is a narrow fallback in `ee/app/services/ee/personal_access_tokens/revoke_service.rb` (lines 23-28) for enterprise-managed users. **History** - The API was first gated only by the feature flag `manage_pat_by_group_owners_ready`. - Commit 3103713dc983 (2025-06-05) added the SaaS check. - Commit 5506a71352f4 (2025-12-12, "Clean up FF") removed the flag and left no license check. - No commit records a decision to skip the license check. The flag looks like it stood in for gating during rollout. **Docs conflict** The API docs (`doc/api/groups.md`, section "Credentials inventory management") say Tier: Premium, Ultimate. This conflicts with the feature docs (Ultimate). One of them needs correcting. </details>