1 files changed, 34 insertions, 13 deletions

diff --git a/lib/bulk_imports/clients/http.rb b/lib/bulk_imports/clients/http.rb
index 8129ff6151c..6c36875111b 100644
--- a/lib/bulk_imports/clients/http.rb
+++ b/lib/bulk_imports/clients/http.rb
@@ -8,6 +8,7 @@ module BulkImports
       API_VERSION = 'v4'
       DEFAULT_PAGE = 1
       DEFAULT_PER_PAGE = 30
+      PAT_ENDPOINT_MIN_VERSION = '15.5.0'
 
       def initialize(url:, token:, page: DEFAULT_PAGE, per_page: DEFAULT_PER_PAGE, api_version: API_VERSION)
         @url = url
@@ -66,38 +67,57 @@ module BulkImports
         instance_version >= BulkImport.min_gl_version_for_project_migration
       end
 
-      private
+      def options
+        { headers: { 'Content-Type' => 'application/json' }, query: { private_token: @token } }
+      end
 
-      def validate_instance_version!
-        return if @compatible_instance_version
+      def validate_import_scopes!
+        return true unless instance_version >= ::Gitlab::VersionInfo.parse(PAT_ENDPOINT_MIN_VERSION)
 
-        if instance_version.major < BulkImport::MIN_MAJOR_VERSION
-          raise ::BulkImports::Error.unsupported_gitlab_version
-        else
-          @compatible_instance_version = true
+        response = with_error_handling do
+          Gitlab::HTTP.get(resource_url("personal_access_tokens/self"), options)
         end
+
+        return true if response['scopes']&.include?('api')
+
+        raise ::BulkImports::Error.scope_validation_failure
+      end
+
+      def validate_instance_version!
+        return true unless instance_version.major < BulkImport::MIN_MAJOR_VERSION
+
+        raise ::BulkImports::Error.unsupported_gitlab_version
       end
 
+      private
+
       def metadata
         response = begin
           with_error_handling do
-            Gitlab::HTTP.get(resource_url(:version), default_options)
+            Gitlab::HTTP.get(resource_url(:version), options)
           end
         rescue BulkImports::NetworkError
           # `version` endpoint is not available, try `metadata` endpoint instead
           with_error_handling do
-            Gitlab::HTTP.get(resource_url(:metadata), default_options)
+            Gitlab::HTTP.get(resource_url(:metadata), options)
           end
         end
 
         response.parsed_response
+      rescue BulkImports::NetworkError => e
+        case e&.response&.code
+        when 401, 403
+          raise ::BulkImports::Error.scope_validation_failure
+        when 404
+          raise ::BulkImports::Error.invalid_url
+        else
+          raise
+        end
       end
       strong_memoize_attr :metadata
 
       # rubocop:disable GitlabSecurity/PublicSend
       def request(method, resource, options = {}, &block)
-        validate_instance_version!
-
         with_error_handling do
           Gitlab::HTTP.public_send(
             method,
@@ -134,9 +154,10 @@ module BulkImports
       def with_error_handling
         response = yield
 
-        raise ::BulkImports::NetworkError.new("Unsuccessful response #{response.code} from #{response.request.path.path}. Body: #{response.parsed_response}", response: response) unless response.success?
+        return response if response.success?
+
+        raise ::BulkImports::NetworkError.new("Unsuccessful response #{response.code} from #{response.request.path.path}. Body: #{response.parsed_response}", response: response)
 
-        response
       rescue *Gitlab::HTTP::HTTP_ERRORS => e
         raise ::BulkImports::NetworkError, e
       end