Skip to content

Allow cross-project issues to be closed by merged MRs

Mario Celi requested to merge 471849-allow-external-issues-autoclose into master

What does this MR do and why?

We want to allow issues marked to be closed when an MR is merged, to be closed even if the user merging the MR does not have access to the issues they are closing with the merge.

This MR disables authorization when closing the issue, only if the closing association was created outside of using the closing pattern in the MR description (through the work item development widget).

Alternatives

  1. We can leave as is on this MR.
  2. We can add a user_id FK to the merge_requests_closing_issues table so we know who created the association (more useful for records created from the work item dev widget). I don't think we'd want to check that the user that created the record can update the work item at the time of merging the MR (user might have left the team, but we'd still expect the work item to be closed as it was configured, right? cc @nickleonard @gweaver ). We could potentially use this record to make sure the user is not banned when merging? In case of potential abuse.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #471849 (closed)

Edited by Mario Celi

Merge request reports