Remove snippets without access checks when `hard_delete` option is present
Let's take a look at a chunk from the Users::DestroyService
:
MigrateToGhostUserService.new(user).execute unless options[:hard_delete]
response = Snippets::BulkDestroyService.new(current_user, user.snippets).execute
raise DestroyError, response.message if response.error?
Basically, when the option hard_delete
is present, we don't try to migrate the associated user resources to the ghost user. This is to remove every association when the user has been reported of abuse.
Nevertheless, when we go to remove snippets we don't pass that option to the service. This means, that we will check the snippet access rights for the user (related https://gitlab.com/gitlab-org/gitlab/-/issues/213806). That check can fail and, therefore, the user won't be removed.
Instead, what we should do is to pass the hard_delete
option to the Snippets::BulkDestroyService
and avoid the access right checking (we still need to remove the associated snippet repositories on disk so we still need to call this service). This way, the repository will be removed and the snippet record in the database too.
/cc @dsatcher