Loading Total time chart in Group level VSA fails with 403 for Auditor

Summary

This customer reported an erroneous behaviour that auditor user couldn't load total time chart when accessing a group level VSA

Steps to reproduce

1. Set user's access level to auditor to access a group level VSA
2. Total time chart is not displayed with status code 403

This is an issue observed at the group level VSA, not the project level

Example Project

N/A (Customer's project)

What is the current bug behavior?

Total time chart doesn't load when accessing group level VSA

What is the expected correct behavior?

Users with auditor access have read-only access to all groups, projects as documented

Relevant logs and/or screenshots

Output of checks

Results of GitLab environment info

The error was reproduced on my dev environment

Expand for output related to GitLab environment info

System information System: Ubuntu 22.04 Proxy: no Current User: git Using RVM: no Ruby Version: 3.1.5p253 Gem Version: 3.5.9 Bundler Version:2.5.9 Rake Version: 13.0.6 Redis Version: 7.0.15 Sidekiq Version:7.1.6 Go Version: unknown GitLab information Version: 17.0.1-ee Revision: cf71f280df3 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: PostgreSQL DB Version: 14.11 URL: https://yk-gitlab-demo.com HTTP Clone URL: https://yk-gitlab-demo.com/some-group/some-project.git SSH Clone URL: git@yk-gitlab-demo.com:some-group/some-project.git Elasticsearch: no Geo: no Using LDAP: no Using Omniauth: yes Omniauth Providers: GitLab Shell Version: 14.35.0 Repository storages: - default: unix:/var/opt/gitlab/gitaly/gitaly.socket GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell Gitaly - default Address: unix:/var/opt/gitlab/gitaly/gitaly.socket - default Version: 17.0.1 - default Git Version: 2.44.1.gl1

Expand for output related to the GitLab application check

Checking GitLab subtasks ...

Checking GitLab Shell ...

GitLab Shell: ... GitLab Shell version \>= 14.35.0 ? ... OK (14.35.0) Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Internal API available: OK Redis available via internal API: OK gitlab-shell self-check successful

Checking GitLab Shell ... Finished

Checking Gitaly ...

Gitaly: ... default ... OK

Checking Gitaly ... Finished

Checking Sidekiq ...

Sidekiq: ... Running? ... yes Number of Sidekiq processes (cluster/worker) ... 1/1

Checking Sidekiq ... Finished

Checking Incoming Email ...

Incoming Email: ... Reply by email is disabled in config/gitlab.yml

Checking Incoming Email ... Finished

Checking LDAP ...

LDAP: ... LDAP is disabled in config/gitlab.yml

Checking LDAP ... Finished

Checking GitLab App ...

Database config exists? ... yes Tables are truncated? ... skipped All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Cable config exists? ... yes Resque config exists? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... yes Systemd unit files or init script exist? ... skipped (omnibus-gitlab has neither init script nor systemd units) Systemd unit files or init script up-to-date? ... skipped (omnibus-gitlab has neither init script nor systemd units) Projects have namespace: ... 3/1 ... yes Redis version \>= 6.2.14? ... yes Ruby version \>= 3.0.6 ? ... yes (3.1.5) Git user has default SSH configuration? ... yes Active users: ... 2 Is authorized keys file accessible? ... yes GitLab configured to store new projects in hashed storage? ... yes All projects are in hashed storage? ... yes Elasticsearch version 7.x-8.x or OpenSearch version 1.x ... skipped (Advanced Search is disabled) All migrations must be finished before doing a major upgrade ... skipped (Advanced Search is disabled)

Checking GitLab App ... Finished

Checking GitLab subtasks ... Finished

Possible fixes

Adding auditor users to access VSA. This configuration is here: https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/policies/ee/group_policy.rb#L346

Update the documentation related to the permissions and include the auditor user.