Provide option to disable project access token creation [RUN ALL RSPEC] [RUN AS-IF-FOSS]
What does this MR do?
Issue: #287707 (closed)
Customers with strong internal access controls may not want the option to use project access tokens, as they obfuscate which user performed a task.
This MR adds the option to enable/disable project access token creation on the group level.
Enabling and disabling of project access tokens can only be done in root groups. All subgroups under them will follow the setting of their group ancestor. Projects in personal namespaces will be able to use project access tokens. Disabling the setting only affects token creation; project/group admins will still be able to view, revoke, and use existing tokens. Also removes resource_access_token_feature feature flag. gitlab-org/quality/triage-reports#1819 (comment 505234558)
Screenshots (strongly suggested)
- Added a checkbox to Group > Settings > General > Permissions, LFS, 2FA. The checkbox only renders for top-level groups (not subgroups), since the setting can only be toggled in root groups.
- With checkbox checked (token creation allowed), Project Access Tokens page looks like this. No change from how it currently is.
- With checkbox unchecked (token creation not allowed), Project Access Tokens page looks like this. The token creation form does not render, and the sidebar text lets the user know that creation is not available and prompts them to toggle the setting if desired.
- Project access token docs:
Does this MR meet the acceptance criteria?
Conformity
-
📋 Does this MR need a changelog?-
I have included a changelog entry. -
I have not included a changelog entry because _____.
-
-
Documentation (if required) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers -
Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec -
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team