diff --git a/app/validators/json_schemas/admin_role_permissions.json b/app/validators/json_schemas/admin_role_permissions.json index a1fd6f37f76eb00c075fa4053c6ce2c3b0254f35..f41a02fbf314c7b8bd9ece79239263be81df414e 100644 --- a/app/validators/json_schemas/admin_role_permissions.json +++ b/app/validators/json_schemas/admin_role_permissions.json @@ -21,6 +21,9 @@ }, "read_admin_projects": { "type": "boolean" + }, + "read_admin_general_settings": { + "type": "boolean" } } } diff --git a/app/validators/json_schemas/member_role_permissions.json b/app/validators/json_schemas/member_role_permissions.json index 805a44425c8cc66b257c971c864ea62a27c79e0c..280f07a4356cc3269a7fba352ed07f0e57d0f97c 100644 --- a/app/validators/json_schemas/member_role_permissions.json +++ b/app/validators/json_schemas/member_role_permissions.json @@ -85,6 +85,9 @@ "read_admin_projects": { "type": "boolean" }, + "read_admin_general_settings": { + "type": "boolean" + }, "read_code": { "type": "boolean" }, diff --git a/doc/api/graphql/reference/_index.md b/doc/api/graphql/reference/_index.md index 5cc204ddef6ef4eb35e24b11d70e9ef67f53220a..083d936a631dd675f7c938ac9a532640840b4d21 100644 --- a/doc/api/graphql/reference/_index.md +++ b/doc/api/graphql/reference/_index.md @@ -46952,6 +46952,7 @@ Member role admin permission. | Value | Description | | ----- | ----------- | | `READ_ADMIN_CICD` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 17.9. **Status**: Experiment. Read CI/CD details for runners and jobs in the Admin Area. | +| `READ_ADMIN_GENERAL_SETTINGS` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 18.3. **Status**: Experiment. Read general settings of an instance in the Admin Area. | | `READ_ADMIN_GROUPS` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 18.3. **Status**: Experiment. Read group details in the Admin Area. | | `READ_ADMIN_MONITORING` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 17.9. **Status**: Experiment. Read system information such as background migrations, health checks, audit logs, and Gitaly in the Admin Area. | | `READ_ADMIN_PROJECTS` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 18.3. **Status**: Experiment. Read project details in the Admin Area. | @@ -46986,6 +46987,7 @@ Member role permission. | `MANAGE_PROTECTED_TAGS` | Create, read, update, and delete protected tags. | | `MANAGE_SECURITY_POLICY_LINK` | Allows linking security policy projects. | | `READ_ADMIN_CICD` | Read CI/CD details for runners and jobs in the Admin Area. | +| `READ_ADMIN_GENERAL_SETTINGS` | Read general settings of an instance in the Admin Area. | | `READ_ADMIN_GROUPS` | Read group details in the Admin Area. | | `READ_ADMIN_MONITORING` | Read system information such as background migrations, health checks, audit logs, and Gitaly in the Admin Area. | | `READ_ADMIN_PROJECTS` | Read project details in the Admin Area. | diff --git a/doc/api/openapi/openapi_v2.yaml b/doc/api/openapi/openapi_v2.yaml index 2eec9b62c22ab9d56ab90157ef8d2c327cdb6a01..dde5aec4e2c882ad1a508c2bace47a7f0471609b 100644 --- a/doc/api/openapi/openapi_v2.yaml +++ b/doc/api/openapi/openapi_v2.yaml @@ -48986,6 +48986,8 @@ definitions: type: boolean admin_web_hook: type: boolean + read_admin_general_settings: + type: boolean read_compliance_dashboard: type: boolean read_admin_cicd: diff --git a/doc/user/custom_roles/abilities.md b/doc/user/custom_roles/abilities.md index b32d7555c4a4aabb403d90345cef38ee5d0eaee7..4b86ac31ad3bd08f0362946df7c01e22ac12cea9 100644 --- a/doc/user/custom_roles/abilities.md +++ b/doc/user/custom_roles/abilities.md @@ -34,6 +34,7 @@ Any dependencies are noted in the `Description` column for each permission. | Permission | Description | API Attribute | Scope | Introduced | |:-----------|:------------|:--------------|:------|:-----------| +| Read admin general settings | Read general settings of an instance in the Admin Area. | [`read_admin_general_settings`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/198095) | Instance | GitLab [18.3](https://gitlab.com/gitlab-org/gitlab/-/issues/527112) | | View CI/CD | Read CI/CD details for runners and jobs in the Admin Area. | [`read_admin_cicd`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/177233) | Instance | GitLab [17.9](https://gitlab.com/gitlab-org/gitlab/-/issues/507960) | | View Groups | Read group details in the Admin Area. | [`read_admin_groups`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197777) | Instance | GitLab [18.3](https://gitlab.com/gitlab-org/gitlab/-/issues/534449) | | View Projects | Read project details in the Admin Area. | [`read_admin_projects`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197777) | Instance | GitLab [18.3](https://gitlab.com/gitlab-org/gitlab/-/issues/534449) | diff --git a/ee/app/policies/ee/global_policy.rb b/ee/app/policies/ee/global_policy.rb index 1b94ec6eb5993e838fb01b5d1aa6a2a5521888e2..e72b2ef8543330db5583d0ccffd9e256fbece9e6 100644 --- a/ee/app/policies/ee/global_policy.rb +++ b/ee/app/policies/ee/global_policy.rb @@ -255,6 +255,10 @@ module GlobalPolicy enable :read_licenses end + rule { custom_role_enables_read_admin_general_settings }.policy do + enable :read_admin_general_settings + end + rule { custom_role_enables_read_admin_users }.policy do enable :read_admin_users end diff --git a/ee/config/custom_abilities/admin/read_admin_general_settings.yml b/ee/config/custom_abilities/admin/read_admin_general_settings.yml new file mode 100644 index 0000000000000000000000000000000000000000..2d64949ba115a056f3560a5804938a9fce2cb531 --- /dev/null +++ b/ee/config/custom_abilities/admin/read_admin_general_settings.yml @@ -0,0 +1,8 @@ +--- +title: Read admin general settings +name: read_admin_general_settings +description: Read general settings of an instance in the Admin Area. +introduced_by_issue: https://gitlab.com/gitlab-org/gitlab/-/issues/527112 +introduced_by_mr: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/198095 +feature_category: admin +milestone: '18.3' diff --git a/ee/spec/policies/global_policy_spec.rb b/ee/spec/policies/global_policy_spec.rb index 8527d488bfe3660245da339bf85e99520f5cec4c..1219273176089e9c48b349c4e80de06ec6bf70fa 100644 --- a/ee/spec/policies/global_policy_spec.rb +++ b/ee/spec/policies/global_policy_spec.rb @@ -925,6 +925,7 @@ :read_admin_users | %i[read_admin_users] :read_admin_groups | %i[read_admin_groups] :read_admin_projects | %i[read_admin_projects] + :read_admin_general_settings | %i[read_admin_general_settings] end with_them do