### Summary `GET /projects/:id/forks` documents a `statistics` boolean ([`doc/api/project_forks.md`](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/doc/api/project_forks.md#L73)), but the route never declares it. Its `params` block uses only `collection_params` and `with_custom_attributes` ([`lib/api/projects.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/lib/api/projects.rb#L708-711)), and `collection_params` does not include `statistics_params` ([`lib/api/projects.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/lib/api/projects.rb#L155-166)). Grape leaves an undeclared parameter as the raw query string. `apply_filters` and `present_projects` read `params[:statistics]` as it is ([`lib/api/projects.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/lib/api/projects.rb#L30), [`lib/api/projects.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/lib/api/projects.rb#L253)), and the entity exposes `statistics` whenever that value is truthy ([`lib/api/entities/project.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/lib/api/entities/project.rb#L179-181)). The strings `"false"` and `"0"` are truthy in Ruby, so every value of `statistics` includes the statistics object, and only leaving the parameter out omits it. `GET /projects` declares the parameter as a Boolean ([`lib/api/projects.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/lib/api/projects.rb#L460-464)) and behaves as documented. `GET /users/:user_id/starred_projects` has the same gap for `with_custom_attributes`: it is documented ([`doc/api/project_starring.md`](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/doc/api/project_starring.md#L38)) but not declared ([`lib/api/projects.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/lib/api/projects.rb#L408-412)), and `with_custom_attributes` reads it with the same truthiness check ([`lib/api/helpers/custom_attributes.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/lib/api/helpers/custom_attributes.rb#L21-25)). From the code, `with_custom_attributes=false` includes custom attributes there for an administrator. I have not reproduced this half, because it needs an administrator. The generated `doc/api/openapi/openapi_v3.yaml` shows both gaps: it lists no `statistics` parameter for `/api/v4/projects/{id}/forks` and no `with_custom_attributes` for `/api/v4/users/{user_id}/starred_projects`. ### Steps to reproduce 1. Find a project with at least one fork on which you have at least the Reporter role. 1. Request `GET /api/v4/projects/:id/forks?statistics=false`. 1. Repeat with `statistics=0`, `statistics=true` and with no `statistics` parameter. 1. For comparison, request `GET /api/v4/projects?owned=true&statistics=false`. ### Example Project I reproduced it with the forks of `gitlab-org/cells/http-router` (project ID `54957577`), filtered with `owned=true` to my own public fork `jmrp/http-router`: ```shell curl --header "PRIVATE-TOKEN: <your_access_token>" \ --url "https://gitlab.com/api/v4/projects/54957577/forks?owned=true&statistics=false" ``` ### What is the current *bug* behavior? The forks list includes `statistics` for any value of the parameter: | Query | `GET /projects/:id/forks` | `GET /projects` | |:----------------------|:--------------------------|:----------------| | `statistics=false` | included | omitted | | `statistics=0` | included | omitted | | `statistics=` (empty) | included | omitted | | `statistics=true` | included | included | | no `statistics` | omitted | omitted | ### What is the expected *correct* behavior? `statistics` behaves on the forks list as it does on `GET /projects`, `GET /users/:user_id/projects` and `GET /users/:user_id/starred_projects`: `statistics=false`, `statistics=0` and an absent parameter omit `statistics`, and `statistics=true` includes it for users with at least the Reporter role. On the starred projects list, `with_custom_attributes=false` omits custom attributes. ### Relevant logs and/or screenshots For `statistics=false`, each fork in the response carries the full statistics object: ```plaintext commit_count, container_registry_size, job_artifacts_size, lfs_objects_size, packages_size, pipeline_artifacts_size, repository_size, snippets_size, storage_size, uploads_size, wiki_size ``` ### Output of checks This bug happens on GitLab.com (19.5.0-pre, revision `f2f37752ef9`). ### Possible fixes Declare the parameters on the two routes in `lib/api/projects.rb`: - Add `use :statistics_params` to the `GET /projects/:id/forks` params block ([L708-711](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/lib/api/projects.rb#L708-711)). - Add `use :with_custom_attributes` to the `GET /users/:user_id/starred_projects` params block ([L408-412](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/lib/api/projects.rb#L408-412)). This also declares the `custom_attributes` filter, which `project_finder_params` already reads from the raw params of this route ([`lib/api/helpers.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/f967fc7d877b2be5ed289151f624752e6bdcfbd6/lib/api/helpers.rb#L940-951)). Then add request specs for `true`, `false` and an absent parameter on both routes, and regenerate `doc/api/openapi/openapi_v3.yaml`. The Markdown documentation already describes the expected behavior. `GET /users/:user_id/contributed_projects` goes through the same `present_projects` and also returns statistics for `statistics=false`, but it documents neither parameter, so I have left it out of this issue. I'd like to work on this.