Skip to content

[SE-663] Require AdminElevation for global admins to act on a project - #25984

Draft
klaustopher wants to merge 46 commits into
devfrom
sudo-mode
Draft

klaustopher wants to merge 46 commits into
devfrom
sudo-mode

Conversation

@klaustopher

Copy link
Copy Markdown
Contributor

Ticket

https://community.openproject.org/projects/SE/work_packages/SE-663/activity

What are you trying to accomplish?

Screenshots

What approach did you choose and why?

AI involvement

Merge checklist

  • Added/updated tests
  • Added/updated documentation in Lookbook (patterns, previews, etc)
  • Tested major browsers (Chrome, Firefox, Edge, ...)

@github-actions

github-actions Bot commented Oct 13, 2026 •

Copy link
Copy Markdown
1 Warning
⚠️ Attention developer & reviewer: Files with potential user references found:

  • db/migrate/20261012141653_create_admin_elevation_sessions.rb (migration with user reference)

Please make sure:

  1. You've added proper relationships (has_many, belongs_to, …) and their inverse in your models
  2. You deal with model destruction dependencies: dependent: :destroy or dependent: :delete_all
  3. You add behavior and tests for the Principal::DeleteJob (app/workers/principals/delete_job.rb)
  4. You replace references to users with deleted user in Principal::ReplaceReferencesService (app/services/principals/replace_references_service.rb) by adding to the replacements initailizer (config/initializers/replace_references_service.rb) for the core, or using the replace_principal_references helper in modules/plugins.
  5. You test the above behaviors with an integration test (e.g., like this one to confirm deletion of users is possible.

This helps prevent dangling database objects when users are deleted and resulting bugs.

Generated by 🚫 Danger

@github-actions

Copy link
Copy Markdown

Warning

Flaky specs

  • rspec ./modules/wikis/spec/features/admin/internal_provider_spec.rb[1:1]
  • rspec ./spec/features/projects/creation_wizard/wizard_from_template_flow_spec.rb[1:1]
  • rspec ./spec/features/types/creation_wizard_workflow_choice_spec.rb[1:5:2]
🤖 Ask Copilot to investigate

Copy the prompt below into a new comment on this PR to delegate the investigation to GitHub Copilot. It will look into the flakiness and open a separate pull request with you as reviewer.

@copilot The following spec(s) are flaky in CI (first seen on PR #25984, linked for reference only):

- `rspec ./modules/wikis/spec/features/admin/internal_provider_spec.rb[1:1]`
- `rspec ./spec/features/projects/creation_wizard/wizard_from_template_flow_spec.rb[1:1]`
- `rspec ./spec/features/types/creation_wizard_workflow_choice_spec.rb[1:5:2]`

Treat this as a standalone task, unrelated to PR #25984. Create a new branch from origin/dev and open a new pull request targeting dev — do not stack it on PR #25984 or reuse that branch.

Follow the playbook in docs/development/testing/handling-flaky-tests/README.md to find the root cause and fix the underlying race — do not skip, delete, or weaken the spec to make it pass; disabling is a last resort per the playbook, and only with a bug ticket. Verify the fix by running the spec(s) repeatedly (e.g. `script/bulk_run_rspec --run-count 10`).

If you cannot reproduce the flake or are not confident in a fix after reasonable investigation, do not fabricate a change or skip the spec to force CI green. Instead, leave the pull request in draft and document what you tried, the suspected cause, and any leads in its description, then assign @klaustopher to take over.

Once the fix is verified, title the PR after the spec(s) it fixes, and use the PR description to explain the root cause, how the change resolves it, and the before/after results. Label the PR `flaky-spec`, assign @klaustopher, and request a review from @klaustopher.
On every commit, set @klaustopher as the sole co-author with a `Co-authored-by:` trailer (use their GitHub no-reply email so it links to their account), so it is traceable who dispatched the fix.

@klaustopher klaustopher changed the title Sudo mode [SE-663] Require AdminElevation for global admins to act on a project Oct 13, 2026
When requesting via an API key (APIv3 and Rails) we default to the scope
that allows all admin access until we later add scopes to the API keys
@github-actions

Copy link
Copy Markdown

Warning

Flaky specs

  • rspec ./modules/backlogs/spec/features/work_packages/create_work_package_spec.rb[1:3:1]
🤖 Ask Copilot to investigate

Copy the prompt below into a new comment on this PR to delegate the investigation to GitHub Copilot. It will look into the flakiness and open a separate pull request with you as reviewer.

@copilot The following spec(s) are flaky in CI (first seen on PR #25984, linked for reference only):

- `rspec ./modules/backlogs/spec/features/work_packages/create_work_package_spec.rb[1:3:1]`

Treat this as a standalone task, unrelated to PR #25984. Create a new branch from origin/dev and open a new pull request targeting dev — do not stack it on PR #25984 or reuse that branch.

Follow the playbook in docs/development/testing/handling-flaky-tests/README.md to find the root cause and fix the underlying race — do not skip, delete, or weaken the spec to make it pass; disabling is a last resort per the playbook, and only with a bug ticket. Verify the fix by running the spec(s) repeatedly (e.g. `script/bulk_run_rspec --run-count 10`).

If you cannot reproduce the flake or are not confident in a fix after reasonable investigation, do not fabricate a change or skip the spec to force CI green. Instead, leave the pull request in draft and document what you tried, the suspected cause, and any leads in its description, then assign @klaustopher to take over.

Once the fix is verified, title the PR after the spec(s) it fixes, and use the PR description to explain the root cause, how the change resolves it, and the before/after results. Label the PR `flaky-spec`, assign @klaustopher, and request a review from @klaustopher.
On every commit, set @klaustopher as the sole co-author with a `Co-authored-by:` trailer (use their GitHub no-reply email so it links to their account), so it is traceable who dispatched the fix.

@github-actions

Copy link
Copy Markdown

Warning

Flaky specs

  • rspec ./spec/features/work_packages/cancel_editing_spec.rb[1:5]
🤖 Ask Copilot to investigate

Copy the prompt below into a new comment on this PR to delegate the investigation to GitHub Copilot. It will look into the flakiness and open a separate pull request with you as reviewer.

@copilot The following spec(s) are flaky in CI (first seen on PR #25984, linked for reference only):

- `rspec ./spec/features/work_packages/cancel_editing_spec.rb[1:5]`

Treat this as a standalone task, unrelated to PR #25984. Create a new branch from origin/dev and open a new pull request targeting dev — do not stack it on PR #25984 or reuse that branch.

Follow the playbook in docs/development/testing/handling-flaky-tests/README.md to find the root cause and fix the underlying race — do not skip, delete, or weaken the spec to make it pass; disabling is a last resort per the playbook, and only with a bug ticket. Verify the fix by running the spec(s) repeatedly (e.g. `script/bulk_run_rspec --run-count 10`).

If you cannot reproduce the flake or are not confident in a fix after reasonable investigation, do not fabricate a change or skip the spec to force CI green. Instead, leave the pull request in draft and document what you tried, the suspected cause, and any leads in its description, then assign @klaustopher to take over.

Once the fix is verified, title the PR after the spec(s) it fixes, and use the PR description to explain the root cause, how the change resolves it, and the before/after results. Label the PR `flaky-spec`, assign @klaustopher, and request a review from @klaustopher.
On every commit, set @klaustopher as the sole co-author with a `Co-authored-by:` trailer (use their GitHub no-reply email so it links to their account), so it is traceable who dispatched the fix.

@github-actions

Copy link
Copy Markdown

Warning

Flaky specs

  • rspec ./modules/wikis/spec/features/admin/internal_provider_spec.rb[1:1]
  • rspec ./spec/features/work_packages/table/delete_work_packages_with_descendants_spec.rb[1:1:1]
🤖 Ask Copilot to investigate

Copy the prompt below into a new comment on this PR to delegate the investigation to GitHub Copilot. It will look into the flakiness and open a separate pull request with you as reviewer.

@copilot The following spec(s) are flaky in CI (first seen on PR #25984, linked for reference only):

- `rspec ./modules/wikis/spec/features/admin/internal_provider_spec.rb[1:1]`
- `rspec ./spec/features/work_packages/table/delete_work_packages_with_descendants_spec.rb[1:1:1]`

Treat this as a standalone task, unrelated to PR #25984. Create a new branch from origin/dev and open a new pull request targeting dev — do not stack it on PR #25984 or reuse that branch.

Follow the playbook in docs/development/testing/handling-flaky-tests/README.md to find the root cause and fix the underlying race — do not skip, delete, or weaken the spec to make it pass; disabling is a last resort per the playbook, and only with a bug ticket. Verify the fix by running the spec(s) repeatedly (e.g. `script/bulk_run_rspec --run-count 10`).

If you cannot reproduce the flake or are not confident in a fix after reasonable investigation, do not fabricate a change or skip the spec to force CI green. Instead, leave the pull request in draft and document what you tried, the suspected cause, and any leads in its description, then assign @klaustopher to take over.

Once the fix is verified, title the PR after the spec(s) it fixes, and use the PR description to explain the root cause, how the change resolves it, and the before/after results. Label the PR `flaky-spec`, assign @klaustopher, and request a review from @klaustopher.
On every commit, set @klaustopher as the sole co-author with a `Co-authored-by:` trailer (use their GitHub no-reply email so it links to their account), so it is traceable who dispatched the fix.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

1 participant