Add pipeline validator to check identity verification
What does this MR do and why?
As part of Iteration 1 for identity verification, this MR introduces the backend functionality to block a pipeline if a user has not yet verified their identity.
Closes: https://gitlab.com/gitlab-org/modelops/anti-abuse/team-tasks/-/issues/669
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
Screenshots are required for UI changes, and strongly recommended for all other merge requests.
Before | After |
---|---|
How to set up and validate locally
Numbered steps to set up and validate the change are strongly suggested.
-
Start GDK with SaaS simulation
$ export GITLAB_SIMULATE_SAAS=1 $ gdk start
-
Ensure that you have a runner setup in GDK.
-
Enable the relevant feature flags and configure the required settings
> Feature.enable(:opt_in_identity_verification) > Feature.enable(:identity_verification_phone_number) > Feature.enable(:ci_requires_identity_verification_on_free_plan)
-
Setup Telesign
> ApplicationSetting.first.update(telesign_customer_xid: '<value_is_in_1Pass>', telesign_api_key: '<value_is_in_1Pass>')
Credentials are in 1Password under Telesign API Keys (use
GITLAB - DEVELOPMENT
) -
Update
ee/app/models/concerns/identity_verifiable.rb
to skip the check to ensure a user was created after the release date.diff --git a/ee/app/models/concerns/identity_verifiable.rb b/ee/app/models/concerns/identity_verifiable.rb index 8db2775658db..990f022cd4bf 100644 --- a/ee/app/models/concerns/identity_verifiable.rb +++ b/ee/app/models/concerns/identity_verifiable.rb @@ -279,7 +279,7 @@ def identity_verification_exemption_attribute end def user_has_restrictions? - created_at > NEW_USER_RESTRICTIONS_RELEASE_DATE + true end def project_requires_identity_verification_for_pipelines?(project)
-
Login with a new user
-
Attempt to trigger a pipeline. This should be blocked with an error due to identity verification.
-
Navigate to http://gdk.test:3000/-/identity_verification and verify a phone number.
-
Attempt to trigger a pipeline again. The pipeline should be created successfully.