Resolve "Read and write User "Admin notes" via API"
What does this MR do?
This MR adds the ability to read and write admin notes via the API.
Changes:
GET /users/ now exposes note attribute for each user in the response when the API call is made by an admin. This attribute is not exposed if the user making the call is not an admin.
GET /users/:id now exposes note attribute for a single user in the response when the API call is made by an admin. This attribute is not exposed if the user making the call is not an admin.
GET /user now exposes note attribute for the currently logged in user or sudoed user only if the logged in or sudoed user is an admin. This attribute is not exposed if the user making the call is not an admin.
PUT /users/:id now accepts the note parameter which will be set as the new note for this user (admin users only - user update calls can only be made by the admin as of today)
CE Backport: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/30775
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry -
Documentation created/updated or follow-up review issue created -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Performance and testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec -
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team