diff --git a/app/models/ci/job_token/authorization.rb b/app/models/ci/job_token/authorization.rb index e53c2ec58aec2a1d08d0ed976550fc55fe3820f1..7a6b48b823428dcffbe8326ab0119616499f0ffa 100644 --- a/app/models/ci/job_token/authorization.rb +++ b/app/models/ci/job_token/authorization.rb @@ -19,8 +19,6 @@ class Authorization < Ci::ApplicationRecord # Record in SafeRequestStore a cross-project access attempt def self.capture(origin_project:, accessed_project:) - return if Feature.disabled?(:ci_job_token_authorizations_log, accessed_project) - # Skip self-referential accesses as they are always allowed and don't need # to be logged neither added to the allowlist. return if origin_project == accessed_project @@ -44,8 +42,6 @@ def self.log_captures_async return unless authorizations accessed_project_id = authorizations[:accessed_project_id] - return if Feature.disabled?(:ci_job_token_authorizations_log, Project.actor_from_id(accessed_project_id)) - Ci::JobToken::LogAuthorizationWorker # rubocop:disable CodeReuse/Worker -- This method is called from a middleware and it's better tested .perform_in(CAPTURE_DELAY, accessed_project_id, authorizations[:origin_project_id]) end diff --git a/config/feature_flags/gitlab_com_derisk/ci_job_token_authorizations_log.yml b/config/feature_flags/gitlab_com_derisk/ci_job_token_authorizations_log.yml deleted file mode 100644 index 2cd7da44ee42777d914c1873ccc17303dc7ade83..0000000000000000000000000000000000000000 --- a/config/feature_flags/gitlab_com_derisk/ci_job_token_authorizations_log.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -name: ci_job_token_authorizations_log -feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/467292 -introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/162645 -rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/478869 -milestone: '17.5' -group: group::pipeline security -type: gitlab_com_derisk -default_enabled: false diff --git a/spec/models/ci/job_token/authorization_spec.rb b/spec/models/ci/job_token/authorization_spec.rb index 3dc92c401a5b7a019a93944f8af58034b6e6305a..933010bfbab3e666f9239fdc8bd43fce05db7946 100644 --- a/spec/models/ci/job_token/authorization_spec.rb +++ b/spec/models/ci/job_token/authorization_spec.rb @@ -25,17 +25,6 @@ accessed_project_id: accessed_project.id) end - context 'when feature flag ci_job_token_authorizations_log is disabled' do - before do - stub_feature_flags(ci_job_token_authorizations_log: false) - end - - it 'does not capture the authorization' do - capture - expect(described_class.captured_authorizations).to be_nil - end - end - context 'when origin project is the same as the accessed project' do let(:accessed_project) { origin_project } @@ -81,14 +70,6 @@ it_behaves_like 'does not log the authorization' end - - context 'when feature flag ci_job_token_authorization is disabled' do - before do - stub_feature_flags(ci_job_token_authorizations_log: false) - end - - it_behaves_like 'does not log the authorization' - end end context 'when authorizations have not been captured during the request' do diff --git a/spec/models/ci/job_token/scope_spec.rb b/spec/models/ci/job_token/scope_spec.rb index 899f35472cc4fc00c5032ebfc271292395a35529..69abe77319e1a1734ea4480cfebf2049a789bf59 100644 --- a/spec/models/ci/job_token/scope_spec.rb +++ b/spec/models/ci/job_token/scope_spec.rb @@ -225,18 +225,6 @@ accessed_project_id: fully_accessible_project.id, origin_project_id: current_project.id) end - - context 'when feature flag ci_job_token_authorizations_log is disabled' do - before do - stub_feature_flags(ci_job_token_authorizations_log: false) - end - - it 'does not log authorizations', :request_store do - scope.accessible?(fully_accessible_project) - - expect(Ci::JobToken::Authorization.captured_authorizations).to be_nil - end - end end end end diff --git a/spec/support/shared_examples/job_token_authorization_shared_examples.rb b/spec/support/shared_examples/job_token_authorization_shared_examples.rb index a10c0c53c6e2ecdbb83875efe7647824aef7cbed..bf3000002a8131811898bd5be4c8698de444f05a 100644 --- a/spec/support/shared_examples/job_token_authorization_shared_examples.rb +++ b/spec/support/shared_examples/job_token_authorization_shared_examples.rb @@ -16,24 +16,6 @@ expect(response).to have_gitlab_http_status(success_status) end - - context 'when feature flag ci_job_token_authorizations_log is disabled' do - before do - stub_feature_flags(ci_job_token_authorizations_log: false) - end - - it 'does not capture neither log authorizations' do - expect(::Gitlab::SafeRequestStore).to receive(:fetch).at_least(:once).and_call_original - expect(::Gitlab::SafeRequestStore) - .not_to receive(:fetch).with(::Ci::JobToken::Authorization::REQUEST_CACHE_KEY) - - expect(Ci::JobToken::LogAuthorizationWorker).not_to receive(:perform_in) - - perform_request - - expect(response).to have_gitlab_http_status(success_status) - end - end end shared_examples 'does not attempt to capture authorization' do |response_status|