## Summary Monolith frontend spec monolith/S09 - Repository access management. Type: Slice. The GA-scope **Manage access** side panel on the repository detail page. An Artifact Admin can: - list a repository's direct role assignments, - add organization members with an Artifact Registry role, - change a member's role, - remove a member. The UI consumes the monolith's existing role-assignment GraphQL surface, backed by the IAM Relationships API. The slice also makes two backend changes: - The repository role-assignment lookup names the repository's verified namespace as its ancestor, so a namespace-level Artifact Admin can list members. - A failed lookup carries an error code that tells a denial from an outage. "Access overrides" was the pre-pivot name for repository role assignment ([gitlab#606444 Scope](https://gitlab.com/gitlab-org/gitlab/-/work_items/606444#scope), ADR-021). The per-repository retention override modal is not part of this slice. It belongs to monolith/S08. ## Designs - Current design: Figma AR-concepting node 6327:100068, confirmed with the designer: https://www.figma.com/design/b5gaaEDjfxZbphoRQ3jVGv/AR-concepting?node-id=6327-100068 - History: [gitlab#597754](https://gitlab.com/gitlab-org/gitlab/-/work_items/597754) holds the earlier "role overrides" design, which the pivot turned into repository role assignment. - Prototype, GA mode, repository detail kebab, then Manage access: <https://gitlab-org.gitlab.io/ci-cd/package-stage/artifact-central-design-proposal/users/index.html> ## Spec - Spec file: `docs/specs/monolith/S09-repository-access-management.md`. - Spec MR: https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/3060 - Plan MR: https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/3214. Step MRs open in gitlab-org/gitlab after it merges. ## Dependencies Plan: https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/3214 (monolith plan, 7 steps). Spec: `docs/specs/monolith/S09-repository-access-management.md` in https://gitlab.com/gitlab-org/ops/artifact-registry. ### Graph ```mermaid graph TD subgraph Plan["Plan !3214: monolith steps"] S1[Step 1: entry and side panel] S2[Step 2: Direct members card] S3[Step 3: Add members modal] S4[Step 4: Remove member] S5[Step 5: Edit access modal] S6[Step 6: expose member verdicts] S7[Step 7: switch controls to verdicts] end A1["gitlab#632787: lookup ancestor and error code (Authorization)"] O1["gitlab#629709: organizationUsers search (Organizations)"] O2["gitlab#629718: grant replaces role (Organizations)"] O3["gitlab#603284: member search for non-owner Admins"] R1["artifact-registry#1505: member verdicts decision"] R2["AR serves the 4 member verdicts, ADR-021 amendment (tracked in artifact-registry#1505)"] R3["Spec MR: S09 and S15 read the verdicts (tracked in artifact-registry#1505)"] RO{{Flag rollout}} S1 --> S2 --> S3 S3 --> S4 S3 --> S5 S4 --> S7 S5 --> S7 S6 --> S7 A1 -- error code --> S2 O1 --> S3 O2 --> S5 R1 --> R2 --> S6 R1 --> R3 --> S6 S7 --> RO A1 -- whole issue --> RO O3 --> RO subgraph FU["Follow-up gitlab#631412"] F1[Inherited counts for repo-level Admins and Manage members link] end O4["gitlab#629700: org access page route"] O5["gitlab#629721: assigneeIds filter"] O6["gitlab#631862: role assignment counts"] A2["gitlab#632248: IAM count asks"] O4 --> F1 O5 --> F1 O6 --> F1 A2 --> F1 ``` Arrows point from a blocker to what it blocks. ### Blocks steps - https://gitlab.com/gitlab-org/gitlab/-/work_items/632787 (Authorization): the lookup names the verified namespace as ancestor, and each lookup failure carries an error code. The error code blocks Step 2 (Direct members card). The whole issue blocks the flag rollout. - https://gitlab.com/gitlab-org/gitlab/-/work_items/629709 (Organizations): `search:` on `organizationUsers`. It blocks Step 3 (Add members). Through Step 3, it also blocks Steps 4, 5, and 7. - https://gitlab.com/gitlab-org/gitlab/-/work_items/629718 (Organizations): a grant replaces an existing role. It blocks Step 5 (Edit access). - AR serves the four repository member verdicts, as https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1505#note_3970150484 proposes. A separate spec MR then updates monolith/S09 and monolith/S15 to read them. Together they block Step 6. https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/1505 tracks this work, including the ADR-021 amendment. ### Blocks the rollout only - https://gitlab.com/gitlab-org/gitlab/-/work_items/603284: member search must admit a non-owner Artifact Admin at the repository and namespace scopes. - Step 7 is merged. - All of https://gitlab.com/gitlab-org/gitlab/-/work_items/632787 is merged. ### Related, not blocking - https://gitlab.com/gitlab-org/gitlab/-/work_items/631886: `role` is null for the Organization Administrator tuple. - https://gitlab.com/gitlab-org/gitlab/-/work_items/631861: per-row `userPermissions` on each role assignment. The side panel does not read them. - https://gitlab.com/gitlab-org/gitlab/-/work_items/610042: offboarding does not revoke Artifact Registry role assignments in IAM. ### Follow-up - https://gitlab.com/gitlab-org/gitlab/-/work_items/631412 is blocked by https://gitlab.com/gitlab-org/gitlab/-/work_items/629700, https://gitlab.com/gitlab-org/gitlab/-/work_items/629721, https://gitlab.com/gitlab-org/gitlab/-/work_items/631862, and the IAM count ask in https://gitlab.com/gitlab-org/gitlab/-/work_items/632248. ## Out of scope - The organization-level access page, organization-level roles and users, and namespace-level assignment: epic [&22956](https://gitlab.com/groups/gitlab-org/-/work_items/22956). - Access rules: deferred by ADR-021. monolith/S12 holds the planned slot. - Retention override (Manage retention in the detail kebab): monolith/S08. ## Follow-ups - https://gitlab.com/gitlab-org/gitlab/-/work_items/631412: inherited access counts and the links to the organization-level access page. Its blockers are in the Follow-up part of the Dependencies section. --- 🤖 Drafted with [Claude Code](https://claude.com/claude-code)