Allow API scope declarations to be applied conditionally.

- Scope declarations of the form:

    allow_access_with_scope :read_user, if: -> (request) { request.get? }

  will only apply for `GET` requests

- Add a negative test to a `POST` endpoint in the `users` API to test this. Also
  test for this case in the `AccessTokenValidationService` unit tests.

1 files changed, 10 insertions, 0 deletions

diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index c8e22799ba4..982c1a50e3b 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -321,6 +321,16 @@ describe API::Users do
         .to eq([Gitlab::PathRegex.namespace_format_message])
     end
 
+    context 'when the requesting token has the "read_user" scope' do
+      let(:token) { create(:personal_access_token, scopes: ['read_user'], user: admin) }
+
+      it 'returns a "401" response' do
+        post api("/users", admin, personal_access_token: token), attributes_for(:user, projects_limit: 3)
+
+        expect(response).to have_http_status(401)
+      end
+    end
+
     it "is not available for non admin users" do
       post api("/users", user), attributes_for(:user)
       expect(response).to have_http_status(403)