Protected branches api fails to add merge and pull access at the same time
Summary
Using the api, users cannot be granted merge and pull access at the same time on a protected branch.
Steps to reproduce
- Make a new repo
- Make a new branch
- Try to protect the branch, giving yourself merge and pull rights:
curl -g --request POST --header "PRIVATE-TOKEN: <your-secret-token>" 'https://gitlab.com/api/v4/projects/<your-project-id>/protected_branches?name=<branch-to-protect>&allowed_to_push[][user_id]=<your-user-id>&allowed_to_merge[][user_id]=<your-user-id>'
- Reply will be
{"message":["Cannot add users or groups unless they have access to the project"]}
and the branch will not be protected
However, granting only merge or only push rights does work:
- only push:
curl -g --request POST --header "PRIVATE-TOKEN: <your-secret-token>" 'https://gitlab.com/api/v4/projects/<your-project-id>/protected_branches?name=<branch-to-protect>&allowed_to_push[][user_id]=<your-user-id>'
- only merge:
curl -g --request POST --header "PRIVATE-TOKEN: <your-secret-token>" 'https://gitlab.com/api/v4/projects/<your-project-id>/protected_branches?name=<branch-to-protect>&allowed_to_merge[][user_id]=<your-user-id>'
Output of checks
This bug happens on GitLab.com as well on a private hosted instance.
Edited by Nero Vanbiervliet