Skip to content

Link project_bot user deletion audit event to its resource if possible

What does this MR do and why?

Related to #488166 (closed)

Currently, when deleting user with any user type, GitLab creates user_destroyed audit event. That audit event is linked to User. Meaning that only instance admins can see that audit event.

The goal of this MR to allow resource(group/project) owners see user_destroyed audit events that are related to the resource project_bot user deletion by linking that audit event to the resource if possible.

That MR also

  • improves user_destroyed audit event creation by mentioning reason of the user deletion in the message
  • ensures user_destroyed audit event is created even without current_user
    • I think we and users could benefit from having audit events about user deletions without current_user(when user is deleted from rails console for instance). See !167021 (comment 2137711286)

Screenshots or screen recordings

Before After
Screenshot_from_2024-09-11_16-41-37 Screenshot_from_2024-10-04_12-44-04

How to set up and validate locally

  1. Create project access token or group access token. (Under the hood it creates a user with project_bot type)
  2. Revoke the token or simulate token expiration.
  3. Visit the group/project's /audit_events page. You should see the event about the project_bot deletion with the reason in the message.
Edited by Bogdan Denkovych

Merge request reports

Loading