fix(service): fixes importing private datasets in deployments with external gitlab

renku/ui/service/jobs/datasets.py

@@ -15,6 +15,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 """Dataset jobs."""
+import os
 import urllib
 
 from urllib3.exceptions import HTTPError
@@ -87,7 +88,7 @@ def dataset_import(
 
 def _is_safe_to_pass_gitlab_token(project_git_url, dataset_uri):
     """Passing token is safe if project and dataset belong to the same deployment."""
-    project_host = GitURL.parse(project_git_url).hostname
+    project_host = os.environ.get("RENKU_DOMAIN") or GitURL.parse(project_git_url).hostname
     dataset_host = urllib.parse.urlparse(dataset_uri).netloc
 
     # NOTE: URLs changed from domain/gitlab to gitlab.domain when moving to cloud native gitlab

tests/service/jobs/test_datasets.py

@@ -710,3 +710,22 @@ def test_unlink_dataset_sync(svc_client_cache, it_remote_repo_url_temp_branch, v
     assert updated_job
     assert {"unlinked", "remote_branch"} == updated_job.ctrl_result["result"].keys()
     assert ["data/data1"] == updated_job.ctrl_result["result"]["unlinked"]
+
+
+@pytest.mark.parametrize(
+    "renku_domain,dataset_url,result",
+    [
+        ("renkulab.io", "https://renkulab.io/datasets/abcdefg", True),
+        ("gitlab.renkulab.io", "https://renkulab.io/datasets/abcdefg", True),
+        ("renkulab.io", "https://dev.renku.ch/datasets/abcdefg", False),
+        ("dev.renku.ch", "https://ci-9999.dev.renku.ch/datasets/abcdefg", False),
+    ],
+)
+def test_dataset_gitlab_token_logic(renku_domain, dataset_url, result, monkeypatch):
+    """Test that logic for forwarding gitlab tokens works correctly."""
+    from renku.ui.service.jobs.datasets import _is_safe_to_pass_gitlab_token
+
+    with monkeypatch.context() as monkey:
+        monkey.setenv("RENKU_DOMAIN", renku_domain)
+
+        assert _is_safe_to_pass_gitlab_token("", dataset_url) == result