fix(bulk-import): fix gitlab oauth flow#2765
Merged
dzemanov merged 1 commit intoredhat-developer:mainfrom Apr 16, 2026
Merged
Conversation
Signed-off-by: Dominika Zemanovicova <dzemanov@redhat.com>
dzemanov
requested review from
a team,
debsmita1,
its-mitesh-kumar and
rm3l
as code owners
Review Summary by QodoFix GitLab OAuth token configuration in bulk-import backend
WalkthroughsDescription• Fixed GitLab OAuth flow by using oauthToken instead of token • Enables proper authentication on behalf of signed-in user • Added changeset documenting the patch release Diagramflowchart LR
A["GitLab API Config"] -->|"Changed token to oauthToken"| B["OAuth Flow Fixed"]
B -->|"Enables user delegation"| C["Signed-in User Auth"]
File Changes1. workspaces/bulk-import/plugins/bulk-import-backend/src/gitlab/utils/glUtils.ts
|
Code Review by Qodo
|
Changed Packages
|
|
![rhdh-qodo-merge[bot]](https://avatars.githubusercontent.com/in/1961108?s=60&v=4){kind=small}
Comment on lines
43
to
46
| const apiThing = new Gitlab({ | ||
| host: baseUrl, | ||
| token: input.credential.token, | ||
| oauthToken: input.credential.token, | ||
| }); |
There was a problem hiding this comment.
1. Auth mode hard-coded 🐞 Bug ≡ Correctness
buildGitlab now always passes credential.token as Gitbeaker oauthToken, ignoring that credentials in this codebase can be typed as 'token' and/or include explicit headers. This forces all GitLab calls (including those using integration-config credentials) down the OAuth/Bearer path, which can break call paths that require non-OAuth token semantics and lead to authentication failures.
Agent Prompt
## Issue description
`buildGitlab` always constructs the Gitbeaker client with `oauthToken`, regardless of what kind of credential it receives. The codebase can represent credentials with a `type` field (e.g. `'token'`) and/or explicit headers, and it also uses both user-scoped OAuth tokens and integration-config tokens.
## Issue Context
Hard-coding `oauthToken` forces all GitLab calls down a single auth mode and risks breaking integrations that expect non-OAuth token handling.
## Fix Focus Areas
- workspaces/bulk-import/plugins/bulk-import-backend/src/gitlab/utils/glUtils.ts[31-47]
- workspaces/bulk-import/plugins/bulk-import-backend/src/gitlab/GitlabAppManager.ts[30-49]
## Suggested fix
- Update `buildGitlab` to choose the Gitbeaker auth option based on the credential shape:
- Prefer `input.credential.type` if present (e.g., `type === 'oauthToken'` -> `oauthToken`, otherwise -> `token`).
- If `type` is absent, infer from `input.credential.headers` (e.g., `Authorization: Bearer ...` -> `oauthToken`) and fall back to `token`.
- Keep behavior for user tokens (Bearer/OAuth) while preserving compatibility for non-OAuth tokens.
- Add/adjust a unit test around `buildGitlab` (or an integration-style test using the constructor mock) to assert the right constructor option is used for both cases.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
PatAKnight
approved these changes
Apr 15, 2026
Member
PatAKnight
left a comment
PatAKnight
left a comment
There was a problem hiding this comment.
I tested with the PR/MR flow and the scaffolder template flow. Did not try the orchestrator workflow flow but I would assume that it works the same
/lgtm
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hey, I just made a Pull Request!
Fixed GitLab OAuth flow for on behalf of the signed-in user
✔️ Checklist