diff --git a/app/validators/json_schemas/admin_role_permissions.json b/app/validators/json_schemas/admin_role_permissions.json
index a1fd6f37f76eb00c075fa4053c6ce2c3b0254f35..f41a02fbf314c7b8bd9ece79239263be81df414e 100644
--- a/app/validators/json_schemas/admin_role_permissions.json
+++ b/app/validators/json_schemas/admin_role_permissions.json
@@ -21,6 +21,9 @@
},
"read_admin_projects": {
"type": "boolean"
+ },
+ "read_admin_general_settings": {
+ "type": "boolean"
}
}
}
diff --git a/app/validators/json_schemas/member_role_permissions.json b/app/validators/json_schemas/member_role_permissions.json
index 805a44425c8cc66b257c971c864ea62a27c79e0c..280f07a4356cc3269a7fba352ed07f0e57d0f97c 100644
--- a/app/validators/json_schemas/member_role_permissions.json
+++ b/app/validators/json_schemas/member_role_permissions.json
@@ -85,6 +85,9 @@
"read_admin_projects": {
"type": "boolean"
},
+ "read_admin_general_settings": {
+ "type": "boolean"
+ },
"read_code": {
"type": "boolean"
},
diff --git a/doc/api/graphql/reference/_index.md b/doc/api/graphql/reference/_index.md
index 5cc204ddef6ef4eb35e24b11d70e9ef67f53220a..083d936a631dd675f7c938ac9a532640840b4d21 100644
--- a/doc/api/graphql/reference/_index.md
+++ b/doc/api/graphql/reference/_index.md
@@ -46952,6 +46952,7 @@ Member role admin permission.
| Value | Description |
| ----- | ----------- |
| `READ_ADMIN_CICD` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 17.9. **Status**: Experiment. Read CI/CD details for runners and jobs in the Admin Area. |
+| `READ_ADMIN_GENERAL_SETTINGS` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 18.3. **Status**: Experiment. Read general settings of an instance in the Admin Area. |
| `READ_ADMIN_GROUPS` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 18.3. **Status**: Experiment. Read group details in the Admin Area. |
| `READ_ADMIN_MONITORING` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 17.9. **Status**: Experiment. Read system information such as background migrations, health checks, audit logs, and Gitaly in the Admin Area. |
| `READ_ADMIN_PROJECTS` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 18.3. **Status**: Experiment. Read project details in the Admin Area. |
@@ -46986,6 +46987,7 @@ Member role permission.
| `MANAGE_PROTECTED_TAGS` | Create, read, update, and delete protected tags. |
| `MANAGE_SECURITY_POLICY_LINK` | Allows linking security policy projects. |
| `READ_ADMIN_CICD` | Read CI/CD details for runners and jobs in the Admin Area. |
+| `READ_ADMIN_GENERAL_SETTINGS` | Read general settings of an instance in the Admin Area. |
| `READ_ADMIN_GROUPS` | Read group details in the Admin Area. |
| `READ_ADMIN_MONITORING` | Read system information such as background migrations, health checks, audit logs, and Gitaly in the Admin Area. |
| `READ_ADMIN_PROJECTS` | Read project details in the Admin Area. |
diff --git a/doc/api/openapi/openapi_v2.yaml b/doc/api/openapi/openapi_v2.yaml
index 2eec9b62c22ab9d56ab90157ef8d2c327cdb6a01..dde5aec4e2c882ad1a508c2bace47a7f0471609b 100644
--- a/doc/api/openapi/openapi_v2.yaml
+++ b/doc/api/openapi/openapi_v2.yaml
@@ -48986,6 +48986,8 @@ definitions:
type: boolean
admin_web_hook:
type: boolean
+ read_admin_general_settings:
+ type: boolean
read_compliance_dashboard:
type: boolean
read_admin_cicd:
diff --git a/doc/user/custom_roles/abilities.md b/doc/user/custom_roles/abilities.md
index b32d7555c4a4aabb403d90345cef38ee5d0eaee7..4b86ac31ad3bd08f0362946df7c01e22ac12cea9 100644
--- a/doc/user/custom_roles/abilities.md
+++ b/doc/user/custom_roles/abilities.md
@@ -34,6 +34,7 @@ Any dependencies are noted in the `Description` column for each permission.
| Permission | Description | API Attribute | Scope | Introduced |
|:-----------|:------------|:--------------|:------|:-----------|
+| Read admin general settings | Read general settings of an instance in the Admin Area. | [`read_admin_general_settings`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/198095) | Instance | GitLab [18.3](https://gitlab.com/gitlab-org/gitlab/-/issues/527112) |
| View CI/CD | Read CI/CD details for runners and jobs in the Admin Area. | [`read_admin_cicd`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/177233) | Instance | GitLab [17.9](https://gitlab.com/gitlab-org/gitlab/-/issues/507960) |
| View Groups | Read group details in the Admin Area. | [`read_admin_groups`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197777) | Instance | GitLab [18.3](https://gitlab.com/gitlab-org/gitlab/-/issues/534449) |
| View Projects | Read project details in the Admin Area. | [`read_admin_projects`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197777) | Instance | GitLab [18.3](https://gitlab.com/gitlab-org/gitlab/-/issues/534449) |
diff --git a/ee/app/policies/ee/global_policy.rb b/ee/app/policies/ee/global_policy.rb
index 1b94ec6eb5993e838fb01b5d1aa6a2a5521888e2..e72b2ef8543330db5583d0ccffd9e256fbece9e6 100644
--- a/ee/app/policies/ee/global_policy.rb
+++ b/ee/app/policies/ee/global_policy.rb
@@ -255,6 +255,10 @@ module GlobalPolicy
enable :read_licenses
end
+ rule { custom_role_enables_read_admin_general_settings }.policy do
+ enable :read_admin_general_settings
+ end
+
rule { custom_role_enables_read_admin_users }.policy do
enable :read_admin_users
end
diff --git a/ee/config/custom_abilities/admin/read_admin_general_settings.yml b/ee/config/custom_abilities/admin/read_admin_general_settings.yml
new file mode 100644
index 0000000000000000000000000000000000000000..2d64949ba115a056f3560a5804938a9fce2cb531
--- /dev/null
+++ b/ee/config/custom_abilities/admin/read_admin_general_settings.yml
@@ -0,0 +1,8 @@
+---
+title: Read admin general settings
+name: read_admin_general_settings
+description: Read general settings of an instance in the Admin Area.
+introduced_by_issue: https://gitlab.com/gitlab-org/gitlab/-/issues/527112
+introduced_by_mr: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/198095
+feature_category: admin
+milestone: '18.3'
diff --git a/ee/spec/policies/global_policy_spec.rb b/ee/spec/policies/global_policy_spec.rb
index 8527d488bfe3660245da339bf85e99520f5cec4c..1219273176089e9c48b349c4e80de06ec6bf70fa 100644
--- a/ee/spec/policies/global_policy_spec.rb
+++ b/ee/spec/policies/global_policy_spec.rb
@@ -925,6 +925,7 @@
:read_admin_users | %i[read_admin_users]
:read_admin_groups | %i[read_admin_groups]
:read_admin_projects | %i[read_admin_projects]
+ :read_admin_general_settings | %i[read_admin_general_settings]
end
with_them do