From 43d27d5c268a1f0e44e6c65724e9b09c14f25bf4 Mon Sep 17 00:00:00 2001
From: Darby Frey <dfrey@gitlab.com>
Date: Mon, 13 Jan 2025 12:12:49 -0600
Subject: [PATCH 1/8] =?UTF-8?q?Add=20=E2=80=9CAdded=20from=20log=E2=80=9D?=
 =?UTF-8?q?=20icon=20in=20job=20token=20allowlist=20UI?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Job token allowlist entries now display an icon indicating when they were added from the authentication log.

MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/177785
Changelog: added
---
 .../components/inbound_token_access.vue       | 13 ++++++++++
 .../components/token_access_table.vue         | 25 ++++++++++++++++++-
 .../allowlist_entry.fragment.graphql          |  2 ++
 ...ects_with_ci_job_token_scope.query.graphql |  2 ++
 .../job_token_scope/allowlist_entry_type.rb   |  5 ++++
 app/graphql/types/ci/job_token_scope_type.rb  | 14 +++++++++++
 app/models/ci/job_token/allowlist.rb          |  8 ++++++
 app/models/ci/job_token/scope.rb              |  8 ++++++
 doc/api/graphql/reference/index.md            |  3 +++
 locale/gitlab.pot                             |  3 +++
 10 files changed, 82 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/token_access/components/inbound_token_access.vue b/app/assets/javascripts/token_access/components/inbound_token_access.vue
index b927483ade5c1f..a3eb90cdf4d46b 100644
--- a/app/assets/javascripts/token_access/components/inbound_token_access.vue
+++ b/app/assets/javascripts/token_access/components/inbound_token_access.vue
@@ -132,6 +132,13 @@ export default {
         } else {
           projects = project?.ciJobTokenScope?.inboundAllowlist?.nodes ?? [];
           groups = project?.ciJobTokenScope?.groupsAllowlist?.nodes ?? [];
+          const groupAllowlistAutopopulatedIds =
+            project?.ciJobTokenScope?.groupAllowlistAutopopulatedIds ?? [];
+          const inboundAllowlistAutopopulatedIds =
+            project?.ciJobTokenScope?.inboundAllowlistAutopopulatedIds ?? [];
+
+          projects = this.addAutopopulatedAttribute(projects, inboundAllowlistAutopopulatedIds);
+          groups = this.addAutopopulatedAttribute(groups, groupAllowlistAutopopulatedIds);
         }
 
         return { projects, groups };
@@ -269,6 +276,12 @@ export default {
       this.namespaceToEdit = namespace;
       showFormFn();
     },
+    addAutopopulatedAttribute(collection, idList) {
+      return collection.map((item) => ({
+        ...item,
+        autopopulated: idList.includes(item.id),
+      }));
+    },
   },
 };
 </script>
diff --git a/app/assets/javascripts/token_access/components/token_access_table.vue b/app/assets/javascripts/token_access/components/token_access_table.vue
index c7d1e0bb91978f..d145aaac1430ef 100644
--- a/app/assets/javascripts/token_access/components/token_access_table.vue
+++ b/app/assets/javascripts/token_access/components/token_access_table.vue
@@ -1,5 +1,13 @@
 <script>
-import { GlButton, GlIcon, GlLink, GlTable, GlLoadingIcon, GlSprintf } from '@gitlab/ui';
+import {
+  GlButton,
+  GlIcon,
+  GlLink,
+  GlTable,
+  GlLoadingIcon,
+  GlSprintf,
+  GlTooltipDirective,
+} from '@gitlab/ui';
 import { TYPENAME_GROUP } from '~/graphql_shared/constants';
 import ProjectAvatar from '~/vue_shared/components/project_avatar.vue';
 import { s__, __ } from '~/locale';
@@ -15,6 +23,12 @@ export default {
     GlSprintf,
     ProjectAvatar,
   },
+  directives: {
+    GlTooltip: GlTooltipDirective,
+  },
+  i18n: {
+    autopopulated: s__('CICD|Added from log.'),
+  },
   inject: ['fullPath'],
   props: {
     items: {
@@ -101,6 +115,15 @@ export default {
         <gl-link :href="item.webUrl" data-testid="token-access-name">
           {{ item.fullPath }}
         </gl-link>
+        <gl-icon
+          v-if="item.autopopulated"
+          v-gl-tooltip
+          :title="$options.i18n.autopopulated"
+          :aria-label="$options.i18n.autopopulated"
+          name="log"
+          class="gl-ml-3 gl-shrink-0"
+          data-testid="autopopulated-icon"
+        />
       </div>
     </template>
 
diff --git a/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql b/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
index cb2c7cb17405a9..332ec62294d7cd 100644
--- a/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
+++ b/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
@@ -8,6 +8,7 @@ fragment AllowlistEntry on CiJobTokenScopeAllowlistEntry {
       fullPath
       avatarUrl
       webUrl
+      autopopulated
     }
     ... on Project {
       id
@@ -15,6 +16,7 @@ fragment AllowlistEntry on CiJobTokenScopeAllowlistEntry {
       fullPath
       avatarUrl
       webUrl
+      autopopulated
     }
   }
 }
diff --git a/app/assets/javascripts/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql b/app/assets/javascripts/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql
index bd35648453efb6..c8651523e5217a 100644
--- a/app/assets/javascripts/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql
+++ b/app/assets/javascripts/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql
@@ -20,6 +20,8 @@ query inboundGetGroupsAndProjectsWithCIJobTokenScope($fullPath: ID!) {
           webUrl
         }
       }
+      groupAllowlistAutopopulatedIds
+      inboundAllowlistAutopopulatedIds
     }
   }
 }
diff --git a/app/graphql/types/ci/job_token_scope/allowlist_entry_type.rb b/app/graphql/types/ci/job_token_scope/allowlist_entry_type.rb
index d23b0ca2cec2a6..aa83e8c5b4357e 100644
--- a/app/graphql/types/ci/job_token_scope/allowlist_entry_type.rb
+++ b/app/graphql/types/ci/job_token_scope/allowlist_entry_type.rb
@@ -46,6 +46,11 @@ class AllowlistEntryType < BaseObject
           null: false,
           description: 'When the entry was created.'
 
+        field :autopopulated,
+          GraphQL::Types::Boolean,
+          null: true,
+          description: 'Indicates whether the entry is created by the autopopulation process.'
+
         def source_project
           Gitlab::Graphql::Loaders::BatchModelLoader.new(Project, object.source_project_id).find
         end
diff --git a/app/graphql/types/ci/job_token_scope_type.rb b/app/graphql/types/ci/job_token_scope_type.rb
index 7fc1feba2ece73..a58fe84e1fbdc4 100644
--- a/app/graphql/types/ci/job_token_scope_type.rb
+++ b/app/graphql/types/ci/job_token_scope_type.rb
@@ -53,6 +53,20 @@ class JobTokenScopeType < BaseObject
           "by authenticating with a CI/CD job token. " \
           "The count does not include subgroups.",
         method: :groups_count
+
+      field :group_allowlist_autopopulated_ids,
+        [::Types::GlobalIDType[::Group]],
+        null: false,
+        description: 'List of IDs of groups which have been createc by the  ' \
+          'autopopulation process.',
+        method: :autopopulated_group_ids
+
+      field :inbound_allowlist_autopopulated_ids,
+        [::Types::GlobalIDType[::Project]],
+        null: false,
+        description: 'List of IDs of projects which have been created by the  ' \
+          'autopopulation process.',
+        method: :autopopulated_inbound_project_ids
     end
   end
   # rubocop: enable Graphql/AuthorizeTypes
diff --git a/app/models/ci/job_token/allowlist.rb b/app/models/ci/job_token/allowlist.rb
index a34cf54f4e025d..cae1622a27ad49 100644
--- a/app/models/ci/job_token/allowlist.rb
+++ b/app/models/ci/job_token/allowlist.rb
@@ -68,6 +68,14 @@ def project_link_traversal_ids
       def group_link_traversal_ids
         group_links.includes(:target_group).map { |g| g.target_group.traversal_ids }
       end
+      
+      def autopopulated_project_global_ids
+        project_links.where(autopopulated: true).map { |link| link.target_project.to_global_id }.uniq
+      end
+
+      def autopopulated_group_global_ids
+        group_links.where(autopopulated: true).map { |link| link.target_group.to_global_id }.uniq
+      end
 
       def project_links
         Ci::JobToken::ProjectScopeLink
diff --git a/app/models/ci/job_token/scope.rb b/app/models/ci/job_token/scope.rb
index fcd6f0f68733b6..df71fc39ebc179 100644
--- a/app/models/ci/job_token/scope.rb
+++ b/app/models/ci/job_token/scope.rb
@@ -62,6 +62,14 @@ def groups_count
         groups.count
       end
 
+      def autopopulated_group_ids
+        inbound_allowlist.autopopulated_group_global_ids
+      end
+
+      def autopopulated_inbound_project_ids
+        inbound_allowlist.autopopulated_project_global_ids
+      end
+
       def self_referential?(accessed_project)
         current_project.id == accessed_project.id
       end
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 58866fcac9aada..4a865513d4f0b0 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -21110,6 +21110,7 @@ Represents an allowlist entry for the CI_JOB_TOKEN.
 | Name | Type | Description |
 | ---- | ---- | ----------- |
 | <a id="cijobtokenscopeallowlistentryaddedby"></a>`addedBy` | [`UserCore`](#usercore) | User that added the entry. |
+| <a id="cijobtokenscopeallowlistentryautopopulated"></a>`autopopulated` | [`Boolean`](#boolean) | Indicates whether the entry is created by the autopopulation process. |
 | <a id="cijobtokenscopeallowlistentrycreatedat"></a>`createdAt` | [`Time!`](#time) | When the entry was created. |
 | <a id="cijobtokenscopeallowlistentrydefaultpermissions"></a>`defaultPermissions` | [`Boolean`](#boolean) | Indicates whether default permissions are enabled (true) or fine-grained permissions are enabled (false). |
 | <a id="cijobtokenscopeallowlistentrydirection"></a>`direction` | [`String`](#string) | Direction of access. Defaults to INBOUND. |
@@ -21123,9 +21124,11 @@ Represents an allowlist entry for the CI_JOB_TOKEN.
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
+| <a id="cijobtokenscopetypegroupallowlistautopopulatedids"></a>`groupAllowlistAutopopulatedIds` | [`[GroupID!]!`](#groupid) | List of IDs of groups which have been createc by the autopopulation process. |
 | <a id="cijobtokenscopetypegroupsallowlist"></a>`groupsAllowlist` | [`GroupConnection!`](#groupconnection) | Allowlist of groups that can access the current project by authenticating with a CI/CD job token. (see [Connections](#connections)) |
 | <a id="cijobtokenscopetypegroupsallowlistcount"></a>`groupsAllowlistCount` | [`Int!`](#int) | Count of groups that can access the current project by authenticating with a CI/CD job token. The count does not include subgroups. |
 | <a id="cijobtokenscopetypeinboundallowlist"></a>`inboundAllowlist` | [`ProjectConnection!`](#projectconnection) | Allowlist of projects that can access the current project by authenticating with a CI/CD job token. (see [Connections](#connections)) |
+| <a id="cijobtokenscopetypeinboundallowlistautopopulatedids"></a>`inboundAllowlistAutopopulatedIds` | [`[ProjectID!]!`](#projectid) | List of IDs of projects which have been created by the autopopulation process. |
 | <a id="cijobtokenscopetypeinboundallowlistcount"></a>`inboundAllowlistCount` | [`Int!`](#int) | Count of projects that can access the current project by authenticating with a CI/CD job token. The count does not include nested projects. |
 | <a id="cijobtokenscopetypeoutboundallowlist"></a>`outboundAllowlist` | [`ProjectConnection!`](#projectconnection) | Allow list of projects that are accessible using the current project's CI Job tokens. (see [Connections](#connections)) |
 | <a id="cijobtokenscopetypeprojects"></a>`projects` **{warning-solid}** | [`ProjectConnection!`](#projectconnection) | **Deprecated** in GitLab 15.9. The `projects` attribute is being deprecated. Use `outbound_allowlist`. |
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 14f7c5df97fbb4..a73c737d8cbea9 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -11033,6 +11033,9 @@ msgstr ""
 msgid "CICD|Add an existing project to the scope"
 msgstr ""
 
+msgid "CICD|Added from log."
+msgstr ""
+
 msgid "CICD|Additional permissions"
 msgstr ""
 
-- 
GitLab


From 4988e45d24313d7ed59a76c463930bfe8f6ac278 Mon Sep 17 00:00:00 2001
From: Darby Frey <dfrey@gitlab.com>
Date: Fri, 17 Jan 2025 16:51:56 -0600
Subject: [PATCH 2/8] Move autopopulated attribute in the AllowlistEntryType

---
 .../token_access/components/inbound_token_access.vue           | 1 +
 .../graphql/fragments/allowlist_entry.fragment.graphql         | 3 +--
 app/models/ci/job_token/allowlist.rb                           | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/assets/javascripts/token_access/components/inbound_token_access.vue b/app/assets/javascripts/token_access/components/inbound_token_access.vue
index a3eb90cdf4d46b..82d3be7b9f2f72 100644
--- a/app/assets/javascripts/token_access/components/inbound_token_access.vue
+++ b/app/assets/javascripts/token_access/components/inbound_token_access.vue
@@ -208,6 +208,7 @@ export default {
         ...node.target,
         defaultPermissions: node.defaultPermissions,
         jobTokenPolicies: node.jobTokenPolicies,
+        autopopulated: node.autopopulated,
       }));
     },
     async updateCIJobTokenScope() {
diff --git a/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql b/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
index 332ec62294d7cd..916561d81eb177 100644
--- a/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
+++ b/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
@@ -1,6 +1,7 @@
 fragment AllowlistEntry on CiJobTokenScopeAllowlistEntry {
   defaultPermissions
   jobTokenPolicies
+  autopopulated
   target {
     ... on Group {
       id
@@ -8,7 +9,6 @@ fragment AllowlistEntry on CiJobTokenScopeAllowlistEntry {
       fullPath
       avatarUrl
       webUrl
-      autopopulated
     }
     ... on Project {
       id
@@ -16,7 +16,6 @@ fragment AllowlistEntry on CiJobTokenScopeAllowlistEntry {
       fullPath
       avatarUrl
       webUrl
-      autopopulated
     }
   }
 }
diff --git a/app/models/ci/job_token/allowlist.rb b/app/models/ci/job_token/allowlist.rb
index cae1622a27ad49..6fccbf18015b32 100644
--- a/app/models/ci/job_token/allowlist.rb
+++ b/app/models/ci/job_token/allowlist.rb
@@ -68,7 +68,7 @@ def project_link_traversal_ids
       def group_link_traversal_ids
         group_links.includes(:target_group).map { |g| g.target_group.traversal_ids }
       end
-      
+
       def autopopulated_project_global_ids
         project_links.where(autopopulated: true).map { |link| link.target_project.to_global_id }.uniq
       end
-- 
GitLab


From e4868cbf2669d1d4ba5e762012f5ac983e47cb89 Mon Sep 17 00:00:00 2001
From: Darby Frey <dfrey@gitlab.com>
Date: Tue, 21 Jan 2025 10:20:41 -0600
Subject: [PATCH 3/8] Fixing test failures

---
 spec/frontend/token_access/mock_data.js                        | 2 ++
 .../types/ci/job_token_scope/allowlist_entry_type_spec.rb      | 1 +
 spec/graphql/types/ci/job_token_scope_type_spec.rb             | 3 ++-
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/spec/frontend/token_access/mock_data.js b/spec/frontend/token_access/mock_data.js
index 57679d11195a6d..cd1ce2853588f0 100644
--- a/spec/frontend/token_access/mock_data.js
+++ b/spec/frontend/token_access/mock_data.js
@@ -192,6 +192,8 @@ export const inboundGroupsAndProjectsWithScopeResponse = {
             },
           ],
         },
+        groupAllowlistAutopopulatedIds: ['gid://gitlab/Group/45'],
+        inboundAllowlistAutopopulatedIds: ['gid://gitlab/Project/23'],
       },
     },
   },
diff --git a/spec/graphql/types/ci/job_token_scope/allowlist_entry_type_spec.rb b/spec/graphql/types/ci/job_token_scope/allowlist_entry_type_spec.rb
index 58dd4cd18b2690..7e3b4896f335f5 100644
--- a/spec/graphql/types/ci/job_token_scope/allowlist_entry_type_spec.rb
+++ b/spec/graphql/types/ci/job_token_scope/allowlist_entry_type_spec.rb
@@ -14,6 +14,7 @@
       job_token_policies
       added_by
       created_at
+      autopopulated
     ]
 
     expect(described_class).to have_graphql_fields(*expected_fields)
diff --git a/spec/graphql/types/ci/job_token_scope_type_spec.rb b/spec/graphql/types/ci/job_token_scope_type_spec.rb
index 1445d17276bb81..0034aa57bf6101 100644
--- a/spec/graphql/types/ci/job_token_scope_type_spec.rb
+++ b/spec/graphql/types/ci/job_token_scope_type_spec.rb
@@ -7,7 +7,8 @@
 
   it 'has the correct fields' do
     expected_fields = [:projects, :inboundAllowlist, :outboundAllowlist,
-      :groupsAllowlist, :inboundAllowlistCount, :groupsAllowlistCount]
+      :groupsAllowlist, :inboundAllowlistCount, :groupsAllowlistCount,
+      :groupAllowlistAutopopulatedIds, :inboundAllowlistAutopopulatedIds]
 
     expect(described_class).to have_graphql_fields(*expected_fields)
   end
-- 
GitLab


From ea8948c6db340ed9471d6f0f9436166263e54390 Mon Sep 17 00:00:00 2001
From: Darby Frey <dfrey@gitlab.com>
Date: Mon, 27 Jan 2025 15:20:10 -0600
Subject: [PATCH 4/8] Adding specs

---
 spec/frontend/token_access/mock_data.js       |  5 +++
 .../token_access/token_access_table_spec.js   | 29 ++++++++++++
 spec/models/ci/job_token/allowlist_spec.rb    | 44 +++++++++++++++++++
 3 files changed, 78 insertions(+)

diff --git a/spec/frontend/token_access/mock_data.js b/spec/frontend/token_access/mock_data.js
index cd1ce2853588f0..8cb2e1f79f28d0 100644
--- a/spec/frontend/token_access/mock_data.js
+++ b/spec/frontend/token_access/mock_data.js
@@ -78,6 +78,7 @@ export const mockGroups = [
     webUrl: 'http://localhost/some-group',
     defaultPermissions: false,
     jobTokenPolicies: ['READ_JOBS', 'ADMIN_CONTAINERS'],
+    autopopulated: true,
     __typename: 'Group',
   },
   {
@@ -87,6 +88,7 @@ export const mockGroups = [
     webUrl: 'http://localhost/another-group',
     defaultPermissions: true,
     jobTokenPolicies: [],
+    autopopulated: true,
     __typename: 'Group',
   },
   {
@@ -96,6 +98,7 @@ export const mockGroups = [
     webUrl: 'http://localhost/a-sub-group',
     defaultPermissions: false,
     jobTokenPolicies: [],
+    autopopulated: false,
     __typename: 'Group',
   },
 ];
@@ -113,6 +116,7 @@ export const mockProjects = [
     defaultPermissions: false,
     jobTokenPolicies: ['READ_JOBS'],
     isLocked: false,
+    autopopulated: true,
     __typename: 'Project',
   },
   {
@@ -127,6 +131,7 @@ export const mockProjects = [
     defaultPermissions: true,
     jobTokenPolicies: [],
     isLocked: true,
+    autopopulated: false,
     __typename: 'Project',
   },
 ];
diff --git a/spec/frontend/token_access/token_access_table_spec.js b/spec/frontend/token_access/token_access_table_spec.js
index 682c14f912ed13..9278d05c7d15e6 100644
--- a/spec/frontend/token_access/token_access_table_spec.js
+++ b/spec/frontend/token_access/token_access_table_spec.js
@@ -21,6 +21,7 @@ describe('Token access table', () => {
   const findProjectAvatar = () => wrapper.findByTestId('token-access-avatar');
   const findName = () => wrapper.findByTestId('token-access-name');
   const findPolicies = () => findAllTableRows().at(0).findAll('td').at(1);
+  const findAutopopulatedIcon = () => wrapper.findByTestId('autopopulated-icon');
 
   describe.each`
     type         | items
@@ -124,4 +125,32 @@ describe('Token access table', () => {
       expect(findEditButton().exists()).toBe(false);
     });
   });
+
+  describe('group auto-populated icon', () => {
+    it('shows the icon when the item is auto-populated', () => {
+      createComponent({ items: [mockGroups[0]] });
+
+      expect(findAutopopulatedIcon().exists()).toBe(true);
+    });
+
+    it('does no shows the icon when the item is not auto-populated', () => {
+      createComponent({ items: [mockGroups[2]] });
+
+      expect(findAutopopulatedIcon().exists()).toBe(false);
+    });
+  });
+
+  describe('project auto-populated icon', () => {
+    it('shows the icon when the item is auto-populated', () => {
+      createComponent({ items: [mockProjects[0]] });
+
+      expect(findAutopopulatedIcon().exists()).toBe(true);
+    });
+
+    it('does no shows the icon when the item is not auto-populated', () => {
+      createComponent({ items: [mockProjects[1]] });
+
+      expect(findAutopopulatedIcon().exists()).toBe(false);
+    });
+  });
 });
diff --git a/spec/models/ci/job_token/allowlist_spec.rb b/spec/models/ci/job_token/allowlist_spec.rb
index b08b292b1cb056..7f120806bb0f1b 100644
--- a/spec/models/ci/job_token/allowlist_spec.rb
+++ b/spec/models/ci/job_token/allowlist_spec.rb
@@ -392,4 +392,48 @@
       end
     end
   end
+
+  describe '#autopopulated_project_global_ids' do
+    let!(:project_link1) do
+      create(:ci_job_token_project_scope_link, source_project: source_project, autopopulated: true)
+    end
+
+    let!(:project_link2) do
+      create(:ci_job_token_project_scope_link, source_project: source_project, autopopulated: true)
+    end
+
+    let!(:project_link3) do
+      create(:ci_job_token_project_scope_link, source_project: source_project)
+    end
+
+    it 'returns an array of autopopulated project global ids only' do
+      project_global_ids = allowlist.autopopulated_project_global_ids
+
+      expect(project_global_ids.size).to eq 2
+      expect(project_global_ids).to contain_exactly(project_link1.target_project.to_global_id,
+        project_link2.target_project.to_global_id)
+    end
+  end
+
+  describe '#autopopulated_group_global_ids' do
+    let!(:group_link1) do
+      create(:ci_job_token_group_scope_link, source_project: source_project, autopopulated: true)
+    end
+
+    let!(:group_link2) do
+      create(:ci_job_token_group_scope_link, source_project: source_project, autopopulated: true)
+    end
+
+    let!(:group_link3) do
+      create(:ci_job_token_group_scope_link, source_project: source_project)
+    end
+
+    it 'returns an array of autopopulated group global ids only' do
+      group_global_ids = allowlist.autopopulated_group_global_ids
+
+      expect(group_global_ids.size).to eq 2
+      expect(group_global_ids).to contain_exactly(group_link1.target_group.to_global_id,
+        group_link2.target_group.to_global_id)
+    end
+  end
 end
-- 
GitLab


From 4bce2ff505839304e3ae0c9617c54e970670468a Mon Sep 17 00:00:00 2001
From: Darby Frey <dfrey@gitlab.com>
Date: Mon, 27 Jan 2025 16:09:23 -0600
Subject: [PATCH 5/8] Use autopopulated scope on project and group links

---
 app/models/ci/job_token/allowlist.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/models/ci/job_token/allowlist.rb b/app/models/ci/job_token/allowlist.rb
index 6fccbf18015b32..1123ff4773bc30 100644
--- a/app/models/ci/job_token/allowlist.rb
+++ b/app/models/ci/job_token/allowlist.rb
@@ -70,11 +70,11 @@ def group_link_traversal_ids
       end
 
       def autopopulated_project_global_ids
-        project_links.where(autopopulated: true).map { |link| link.target_project.to_global_id }.uniq
+        project_links.autopopulated.map { |link| link.target_project.to_global_id }.uniq
       end
 
       def autopopulated_group_global_ids
-        group_links.where(autopopulated: true).map { |link| link.target_group.to_global_id }.uniq
+        group_links.autopopulated.map { |link| link.target_group.to_global_id }.uniq
       end
 
       def project_links
-- 
GitLab


From f512741064643acc881b39dca2e9a806df69545a Mon Sep 17 00:00:00 2001
From: Darby Frey <dfrey@gitlab.com>
Date: Tue, 28 Jan 2025 12:39:19 -0600
Subject: [PATCH 6/8] Fix test failures

---
 spec/requests/api/graphql/packages/package_spec.rb      | 3 ++-
 spec/requests/api/graphql/project/merge_request_spec.rb | 6 ++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/spec/requests/api/graphql/packages/package_spec.rb b/spec/requests/api/graphql/packages/package_spec.rb
index 4054d848b0dba8..511a4008dfe8d0 100644
--- a/spec/requests/api/graphql/packages/package_spec.rb
+++ b/spec/requests/api/graphql/packages/package_spec.rb
@@ -18,7 +18,8 @@
   let(:depth) { 3 }
   let(:excluded) do
     %w[metadata apiFuzzingCiConfiguration pipeline packageFiles
-      runners inboundAllowlistCount groupsAllowlistCount mergeTrains ciJobTokenAuthLogs]
+      runners inboundAllowlistCount groupsAllowlistCount mergeTrains ciJobTokenAuthLogs
+      groupAllowlistAutopopulatedIds inboundAllowlistAutopopulatedIds]
   end
 
   let(:metadata) { query_graphql_fragment('ComposerMetadata') }
diff --git a/spec/requests/api/graphql/project/merge_request_spec.rb b/spec/requests/api/graphql/project/merge_request_spec.rb
index 6f9b3068af25c7..19a0b80b9be35b 100644
--- a/spec/requests/api/graphql/project/merge_request_spec.rb
+++ b/spec/requests/api/graphql/project/merge_request_spec.rb
@@ -24,11 +24,13 @@
     # we exclude Project.pipeline because it needs arguments,
     # codequalityReportsComparer because it is behind a feature flag
     # and runners because the user is not an admin and therefore has no access
-    # and inboundAllowlistCount, groupsAllowlistCount the user has no access
+    # and inboundAllowlistCount, groupsAllowlistCount, groupAllowlistAutopopulatedIds,
+    #   inboundAllowlistAutopopulatedIds the user has no access
     # mergeTrains because it is a licensed feature
     let(:excluded) do
       %w[jobs pipeline runners codequalityReportsComparer
-        mlModels inboundAllowlistCount groupsAllowlistCount mergeTrains ciJobTokenAuthLogs mlExperiments]
+        mlModels inboundAllowlistCount groupsAllowlistCount mergeTrains ciJobTokenAuthLogs mlExperiments
+        groupAllowlistAutopopulatedIds inboundAllowlistAutopopulatedIds]
     end
 
     let(:mr_fields) { all_graphql_fields_for('MergeRequest', excluded: excluded) }
-- 
GitLab


From 65520e0e19d6510b8ecfb8fed0cffad2afe774fa Mon Sep 17 00:00:00 2001
From: Darby Frey <dfrey@gitlab.com>
Date: Thu, 30 Jan 2025 13:17:19 +0000
Subject: [PATCH 7/8] Apply 1 suggestion(s) to 1 file(s)

Co-authored-by: Surabhi Suman <ssuman@gitlab.com>
---
 app/graphql/types/ci/job_token_scope_type.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/graphql/types/ci/job_token_scope_type.rb b/app/graphql/types/ci/job_token_scope_type.rb
index a58fe84e1fbdc4..2fed56ad739f64 100644
--- a/app/graphql/types/ci/job_token_scope_type.rb
+++ b/app/graphql/types/ci/job_token_scope_type.rb
@@ -57,7 +57,7 @@ class JobTokenScopeType < BaseObject
       field :group_allowlist_autopopulated_ids,
         [::Types::GlobalIDType[::Group]],
         null: false,
-        description: 'List of IDs of groups which have been createc by the  ' \
+        description: 'List of IDs of groups which have been created by the  ' \
           'autopopulation process.',
         method: :autopopulated_group_ids
 
-- 
GitLab


From 650e6123050ed6c22aed20ed1a2a4ebfb9822575 Mon Sep 17 00:00:00 2001
From: Darby Frey <dfrey@gitlab.com>
Date: Thu, 30 Jan 2025 09:50:35 -0600
Subject: [PATCH 8/8] GraphQL docs fix

---
 doc/api/graphql/reference/index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 4a865513d4f0b0..930f9f1a906602 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -21124,7 +21124,7 @@ Represents an allowlist entry for the CI_JOB_TOKEN.
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
-| <a id="cijobtokenscopetypegroupallowlistautopopulatedids"></a>`groupAllowlistAutopopulatedIds` | [`[GroupID!]!`](#groupid) | List of IDs of groups which have been createc by the autopopulation process. |
+| <a id="cijobtokenscopetypegroupallowlistautopopulatedids"></a>`groupAllowlistAutopopulatedIds` | [`[GroupID!]!`](#groupid) | List of IDs of groups which have been created by the autopopulation process. |
 | <a id="cijobtokenscopetypegroupsallowlist"></a>`groupsAllowlist` | [`GroupConnection!`](#groupconnection) | Allowlist of groups that can access the current project by authenticating with a CI/CD job token. (see [Connections](#connections)) |
 | <a id="cijobtokenscopetypegroupsallowlistcount"></a>`groupsAllowlistCount` | [`Int!`](#int) | Count of groups that can access the current project by authenticating with a CI/CD job token. The count does not include subgroups. |
 | <a id="cijobtokenscopetypeinboundallowlist"></a>`inboundAllowlist` | [`ProjectConnection!`](#projectconnection) | Allowlist of projects that can access the current project by authenticating with a CI/CD job token. (see [Connections](#connections)) |
-- 
GitLab