Add personal access token verification before GitLab Migration starts
Problem
Currently, some migrations fail in the middle of the process, because provided personal access token's scope is not sufficient, and that scope is not checked before the migration begins.
Some migrations also fail after the migration begins when the token's scopes change or it expires.
Proposed solution
With the recent addition of an API endpoint to view details of the provided token /api/v4/personal_access_tokens/self
we can view the details of the provided personal access token to stop migration attempts early, if the provided token has insufficient scope.
Implementation
-
Add an early migration check that validates provided personal access token against
/api/v4/personal_access_tokens/self
if the source instance Gitlab version is 15.5 or higher and do not start the migration if provided token doesn't have requiredapi
scope (we use GraphQL API which needsapi
scope). -
Display an error in the UI after the user enters the url/token information.
-
Additionally, at the start of the migration, before creating anything, check the token's scope again and return an error if provided token doesn't have requiredapi
scope. It's a safe guard measure, if a user manages to bypass initial validation, we should check the scope again, once the migration has started.
Store this error in bulk_import_failures
table and display in UI on Import History page and in API response.