lib/gitlab/background_migration/backfill_admin_mode_scope_for_personal_access_tokens.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

# frozen_string_literal: true

module Gitlab
  module BackgroundMigration
    # Backfill `admin_mode` scope for a range of personal access tokens
    class BackfillAdminModeScopeForPersonalAccessTokens < ::Gitlab::BackgroundMigration::BatchedMigrationJob
      scope_to ->(relation) do
        relation.joins('INNER JOIN users ON personal_access_tokens.user_id = users.id')
                .where(users: { admin: true })
                .where(revoked: [false, nil])
                .where.not('expires_at IS NOT NULL AND expires_at <= ?', Time.current)
      end

      operation_name :update_all
      feature_category :authentication_and_authorization

      ADMIN_MODE_SCOPE = ['admin_mode'].freeze

      def perform
        each_sub_batch do |sub_batch|
          sub_batch.each do |token|
            token.update!(scopes: (YAML.safe_load(token.scopes) + ADMIN_MODE_SCOPE).uniq.to_yaml)
          end
        end
      end
    end
  end
end