# HG changeset patch
# User Vasilii Iakliushin <viakliushin@gitlab.com>
# Date 1726865408 0
#      Fri Sep 20 20:50:08 2024 +0000
# Node ID ac8cc786a34bb5cedfb752db4e7f0d3149ead0d2
# Parent  4434a54b8bffb350563034ac9434010dc4228f4c
Support PAT configuration for gitlab-shell

New configuration options were added to gitlab-shell:
https://gitlab.com/gitlab-org/gitlab-shell/-/merge_requests/1141.

Adds an option to configure them in Omnibus.

Related https://gitlab.com/gitlab-org/gitlab/-/issues/460290

Changelog: added

diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template
--- a/files/gitlab-config-template/gitlab.rb.template
+++ b/files/gitlab-config-template/gitlab.rb.template
@@ -1365,6 +1365,7 @@
 # gitlab_shell['dir'] = "/var/opt/gitlab/gitlab-shell"
 
 # gitlab_shell['lfs_pure_ssh_protocol'] = false
+# gitlab_shell['pat'] = { enabled: true, allowed_scopes: [] }
 
 ################################################################################
 ## gitlab-sshd
diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb
--- a/files/gitlab-cookbooks/gitlab/attributes/default.rb
+++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb
@@ -758,6 +758,7 @@
 default['gitlab']['gitlab_shell']['migration'] = { enabled: true, features: [] }
 default['gitlab']['gitlab_shell']['ssl_cert_dir'] = "#{node['package']['install-dir']}/embedded/ssl/certs/"
 default['gitlab']['gitlab_shell']['lfs_pure_ssh_protocol'] = false
+default['gitlab']['gitlab_shell']['pat'] = { enabled: true, allowed_scopes: [] }
 # DEPRECATED! Not used by gitlab-shell
 default['gitlab']['gitlab_shell']['git_data_directories'] = {
   "default" => { "path" => "/var/opt/gitlab/git-data" }
diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb
--- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb
+++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb
@@ -146,7 +146,8 @@
         migration: node['gitlab']['gitlab_shell']['migration'],
         ssl_cert_dir: node['gitlab']['gitlab_shell']['ssl_cert_dir'],
         gitlab_sshd: gitlab_sshd_enabled ? sshd_helper.json_config : nil,
-        lfs_pure_ssh_protocol: node['gitlab']['gitlab_shell']['lfs_pure_ssh_protocol']
+        lfs_pure_ssh_protocol: node['gitlab']['gitlab_shell']['lfs_pure_ssh_protocol'],
+        pat: node['gitlab']['gitlab_shell']['pat']
       }
     end
   )
diff --git a/files/gitlab-cookbooks/gitlab/templates/default/gitlab-shell-config.yml.erb b/files/gitlab-cookbooks/gitlab/templates/default/gitlab-shell-config.yml.erb
--- a/files/gitlab-cookbooks/gitlab/templates/default/gitlab-shell-config.yml.erb
+++ b/files/gitlab-cookbooks/gitlab/templates/default/gitlab-shell-config.yml.erb
@@ -68,3 +68,8 @@
 lfs:
   pure_ssh_protocol: <%= @lfs_pure_ssh_protocol %>
 <%- end -%>
+
+<%- if @pat -%>
+pat:
+  <%= @pat.to_json %>
+<% end %>
diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb
--- a/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb
+++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb
@@ -34,7 +34,8 @@
           gitlab_relative_path: '',
           ssl_cert_dir: '/opt/gitlab/embedded/ssl/certs/',
           gitlab_sshd: nil,
-          lfs_pure_ssh_protocol: false
+          lfs_pure_ssh_protocol: false,
+          pat: { enabled: true, allowed_scopes: [] }
         )
       )
     end
@@ -52,6 +53,7 @@
         expect(data['ssl_cert_dir']).to eq('/opt/gitlab/embedded/ssl/certs/')
         expect(data['sshd']).to be_nil
         expect(data['lfs']).to be_nil
+        expect(data['pat']).to eq({ "enabled" => true, "allowed_scopes" => [] })
       }
     end
   end
@@ -161,6 +163,30 @@
       end
     end
 
+    context 'when pat is disabled (set to false)' do
+      before do
+        stub_gitlab_rb(
+          gitlab_shell: {
+            pat: {
+              enabled: false,
+              allowed_scopes: []
+            }
+          }
+        )
+      end
+
+      it 'creates the config file with pat disabled' do
+        expect(chef_run).to create_templatesymlink('Create a config.yml and create a symlink to Rails root').with_variables(
+          hash_including(
+            pat: {
+              enabled: false,
+              allowed_scopes: []
+            }
+          )
+        )
+      end
+    end
+
     context 'with a non-default workhorse unix socket' do
       context 'without sockets_directory defined' do
         before do