GitLab Secrets Manager: Access-Level Filtering for Member Selection

Context

GitLab’s Secrets Manager allows administrators to control which users can access and manage stored secrets at the group and project level.

Permissions are configured through a member-selection UI that relies on shared GraphQL queries to fetch eligible users.

Problem

The existing implementation fetched group and project members without filtering by access level.

As a result, users without sufficient permissions (below Reporter) appeared in the Secrets Manager permissions dropdown. Attempting to add these users would fail later with an API error.

This created a confusing user experience and allowed invalid choices to be presented in the UI.

My Contribution

I updated the shared GraphQL queries used for member lookup to support access-level filtering.

For project members, a single accessLevel parameter is applied. For group members, the query accepts an accessLevels array, matching the underlying resolver behavior.

This ensures that only users with Reporter or higher access are returned by the query, preventing invalid selections before they reach the API.

Example Query Change

The fix was implemented at the GraphQL query layer, keeping the UI and resolver logic unchanged.

// Group members query (excerpt)
groupMembers(
  search: $search
  relations: [DIRECT, DESCENDANTS, INHERITED]
  accessLevels: $accessLevels
) {
  nodes {
    id
    user {
      name
      username
    }
  }
}

A similar update was applied to the project members query using the accessLevel argument.

Current Status

The changes have been pushed to the GitLab community fork and are under review as a merge request.

By filtering results at the GraphQL layer, the Secrets Manager permissions UI now only presents valid, assignable users.

Reflection

This contribution focused on data correctness and user experience rather than UI changes.

It highlights how small, well-scoped GraphQL improvements can eliminate entire classes of frontend errors and make permission systems safer and more intuitive.

The work also reinforced the importance of understanding resolver contracts and shared query usage in large codebases like GitLab.