diff --git a/app/policies/base_policy.rb b/app/policies/base_policy.rb index 8688988122c2cd78c80a9257968c7b3477fd6763..98c99b8d85a108d3720f554a78b8dfe49d636abe 100644 --- a/app/policies/base_policy.rb +++ b/app/policies/base_policy.rb @@ -4,7 +4,7 @@ class BasePolicy < DeclarativePolicy::Base desc "User is an instance admin" with_options scope: :user, score: 0 condition(:admin) do - next false if ::Feature.enabled?(:prevent_job_token_admin_permissions, @user) && @user&.from_ci_job_token? + next false if @user&.from_ci_job_token? if Gitlab::CurrentSettings.admin_mode Gitlab::Auth::CurrentUserMode.new(@user).admin_mode? diff --git a/config/feature_flags/development/prevent_job_token_admin_permissions.yml b/config/feature_flags/development/prevent_job_token_admin_permissions.yml deleted file mode 100644 index 0ecb9168f56ea80ae5d226791a85ef3db912468f..0000000000000000000000000000000000000000 --- a/config/feature_flags/development/prevent_job_token_admin_permissions.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -name: prevent_job_token_admin_permissions -introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/167449 -feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/474775 -rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/495627 -milestone: '17.5' -type: development -group: group::pipeline security -default_enabled: false diff --git a/spec/policies/base_policy_spec.rb b/spec/policies/base_policy_spec.rb index 4479de40e69dded898091c42871e1897fe981bec..cb3de5c72a0cff365076cfabf9659586663d07f5 100644 --- a/spec/policies/base_policy_spec.rb +++ b/spec/policies/base_policy_spec.rb @@ -58,22 +58,6 @@ def policy it 'prevents when user is admin' do is_expected.to be_disallowed(ability) end - - context 'and feature flag prevent_job_token_admin_permissions is disabled' do - before do - stub_feature_flags(prevent_job_token_admin_permissions: false) - end - - it 'does not prevent settings in admin mode' do - allow(Gitlab::CurrentSettings).to receive(:admin_mode).and_return(true) - - is_expected.to be_allowed(ability) - end - - it 'allows when user is admin' do - is_expected.to be_allowed(ability) - end - end end it 'prevented when not in admin mode' do