GitLab group and project access token modules (#7964)

* Adding gitlab group and project acess token modules

* Documentation corrections and recreate option change

* Documentation corrections

* Correcting documentation for return objects

tests/integration/targets/gitlab_group_access_token/aliases

@@ -0,0 +1,7 @@
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+azp/posix/1
+gitlab/ci
+disabled

tests/integration/targets/gitlab_group_access_token/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
+# Copyright (c) 2024, Zoran Krleza <zoran.krleza@true-north.hr>
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+gitlab_api_token: 
+gitlab_api_url: 
+gitlab_validate_certs: false
+gitlab_group_name: 
+gitlab_token_name: 

tests/integration/targets/gitlab_group_access_token/tasks/main.yml

@@ -0,0 +1,221 @@
+---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
+# Copyright (c) 2024, Zoran Krleza <zoran.krleza@true-north.hr>
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+- name: Install required libs
+  pip:
+    name: python-gitlab
+    state: present
+
+- block:
+    - name: Try to create access token in nonexisting group
+      community.general.gitlab_group_access_token:
+        api_token: "{{ gitlab_api_token }}"
+        api_url: "{{ gitlab_api_url }}"
+        validate_certs: "{{ gitlab_validate_certs }}"
+        group: "some_nonexisting_group"
+        name: "{{ gitlab_token_name }}"
+        state: present
+        expires_at: '2025-01-01'
+        access_level: developer
+        scopes:
+        - api
+        - read_api
+      register: create_pfail_token_status
+  always:
+    - name: Assert that token creation in nonexisting group failed
+      assert:
+        that:
+          - create_pfail_token_status is failed
+  ignore_errors: true
+
+- block:
+    - name: Try to create access token with nonvalid expires_at
+      community.general.gitlab_group_access_token:
+        api_token: "{{ gitlab_api_token }}"
+        api_url: "{{ gitlab_api_url }}"
+        validate_certs: "{{ gitlab_validate_certs }}"
+        group: "some_nonexisting_group"
+        name: "{{ gitlab_token_name }}"
+        state: present
+        expires_at: '2025-13-01'
+        access_level: developer
+        scopes:
+        - api
+        - read_api
+      register: create_efail_token_status
+  always:
+    - name: Assert that token creation with invalid expires_at failed
+      assert:
+        that:
+          - create_efail_token_status is failed
+  ignore_errors: true
+
+- name: Create access token
+  community.general.gitlab_group_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    group: "{{ gitlab_group_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: present
+    expires_at: '2024-12-31'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+  register: create_token_status
+- name: Assert that token creation with valid arguments is successfull
+  assert:
+    that:
+      - create_token_status is changed
+      - create_token_status.access_token.token is defined
+
+- name: Check existing access token recreate=never (default)
+  community.general.gitlab_group_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    group: "{{ gitlab_group_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: present
+    expires_at: '2024-12-31'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+  register: check_token_status
+- name: Assert that token creation without changes and recreate=never succeeds with status not changed
+  assert:
+    that:
+      - check_token_status is not changed
+      - check_token_status.access_token.token is not defined
+
+- name: Check existing access token with recreate=state_change
+  community.general.gitlab_group_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    group: "{{ gitlab_group_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: present
+    expires_at: '2024-12-31'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+    recreate: state_change
+  register: check_recreate_token_status
+- name: Assert that token creation without changes and recreate=state_change succeeds with status not changed
+  assert:
+    that:
+      - check_recreate_token_status is not changed
+      - check_recreate_token_status.access_token.token is not defined
+
+- block:
+    - name: Try to change existing access token with recreate=never
+      community.general.gitlab_group_access_token:
+        api_token: "{{ gitlab_api_token }}"
+        api_url: "{{ gitlab_api_url }}"
+        validate_certs: "{{ gitlab_validate_certs }}"
+        group: "{{ gitlab_group_name }}"
+        name: "{{ gitlab_token_name }}"
+        state: present
+        expires_at: '2025-01-01'
+        access_level: developer
+        scopes:
+        - api
+        - read_api
+      register: change_token_status
+  always:
+    - name: Assert that token change with recreate=never fails
+      assert:
+        that:
+          - change_token_status is failed
+  ignore_errors: true
+
+- name: Try to change existing access token with recreate=state_change
+  community.general.gitlab_group_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    group: "{{ gitlab_group_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: present
+    expires_at: '2025-01-01'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+    recreate: state_change
+  register: change_recreate_token_status
+- name: Assert that token change with recreate=state_change succeeds
+  assert:
+    that:
+      - change_recreate_token_status is changed
+      - change_recreate_token_status.access_token.token is defined
+
+- name: Try to change existing access token with recreate=always
+  community.general.gitlab_group_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    group: "{{ gitlab_group_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: present
+    expires_at: '2025-01-01'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+    recreate: always
+  register: change_recreate1_token_status
+- name: Assert that token change with recreate=always succeeds
+  assert:
+    that:
+      - change_recreate1_token_status is changed
+      - change_recreate1_token_status.access_token.token is defined
+
+- name: Revoke access token
+  community.general.gitlab_group_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    group: "{{ gitlab_group_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: absent
+    expires_at: '2024-12-31'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+  register: revoke_token_status
+- name: Assert that token revocation succeeds
+  assert:
+    that:
+      - revoke_token_status is changed
+
+- name: Revoke nonexisting access token
+  community.general.gitlab_group_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    group: "{{ gitlab_group_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: absent
+    expires_at: '2024-12-31'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+  register: revoke_token_status
+- name: Assert that token revocation succeeds with status not changed
+  assert:
+    that:
+      - revoke_token_status is not changed

tests/integration/targets/gitlab_project_access_token/aliases

@@ -0,0 +1,7 @@
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+azp/posix/1
+gitlab/ci
+disabled

tests/integration/targets/gitlab_project_access_token/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
+# Copyright (c) 2024, Zoran Krleza <zoran.krleza@true-north.hr>
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+gitlab_api_token: 
+gitlab_api_url: 
+gitlab_validate_certs: false
+gitlab_project_name: 
+gitlab_token_name: 

tests/integration/targets/gitlab_project_access_token/tasks/main.yml

@@ -0,0 +1,221 @@
+---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
+# Copyright (c) 2024, Zoran Krleza <zoran.krleza@true-north.hr>
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+- name: Install required libs
+  pip:
+    name: python-gitlab
+    state: present
+
+- block:
+    - name: Try to create access token in nonexisting project
+      community.general.gitlab_project_access_token:
+        api_token: "{{ gitlab_api_token }}"
+        api_url: "{{ gitlab_api_url }}"
+        validate_certs: "{{ gitlab_validate_certs }}"
+        project: "some_nonexisting_project"
+        name: "{{ gitlab_token_name }}"
+        state: present
+        expires_at: '2025-01-01'
+        access_level: developer
+        scopes:
+        - api
+        - read_api
+      register: create_pfail_token_status
+  always:
+    - name: Assert that token creation in nonexisting project failed
+      assert:
+        that:
+          - create_pfail_token_status is failed
+  ignore_errors: true
+
+- block:
+    - name: Try to create access token with nonvalid expires_at
+      community.general.gitlab_project_access_token:
+        api_token: "{{ gitlab_api_token }}"
+        api_url: "{{ gitlab_api_url }}"
+        validate_certs: "{{ gitlab_validate_certs }}"
+        project: "some_nonexisting_project"
+        name: "{{ gitlab_token_name }}"
+        state: present
+        expires_at: '2025-13-01'
+        access_level: developer
+        scopes:
+        - api
+        - read_api
+      register: create_efail_token_status
+  always:
+    - name: Assert that token creation with invalid expires_at failed
+      assert:
+        that:
+          - create_efail_token_status is failed
+  ignore_errors: true
+
+- name: Create access token
+  community.general.gitlab_project_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    project: "{{ gitlab_project_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: present
+    expires_at: '2024-12-31'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+  register: create_token_status
+- name: Assert that token creation with valid arguments is successfull
+  assert:
+    that:
+      - create_token_status is changed
+      - create_token_status.access_token.token is defined
+
+- name: Check existing access token recreate=never (default)
+  community.general.gitlab_project_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    project: "{{ gitlab_project_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: present
+    expires_at: '2024-12-31'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+  register: check_token_status
+- name: Assert that token creation without changes and recreate=never succeeds with status not changed
+  assert:
+    that:
+      - check_token_status is not changed
+      - check_token_status.access_token.token is not defined
+
+- name: Check existing access token with recreate=state_change
+  community.general.gitlab_project_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    project: "{{ gitlab_project_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: present
+    expires_at: '2024-12-31'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+    recreate: state_change
+  register: check_recreate_token_status
+- name: Assert that token creation without changes and recreate=state_change succeeds with status not changed
+  assert:
+    that:
+      - check_recreate_token_status is not changed
+      - check_recreate_token_status.access_token.token is not defined
+
+- block:
+    - name: Try to change existing access token with recreate=never
+      community.general.gitlab_project_access_token:
+        api_token: "{{ gitlab_api_token }}"
+        api_url: "{{ gitlab_api_url }}"
+        validate_certs: "{{ gitlab_validate_certs }}"
+        project: "{{ gitlab_project_name }}"
+        name: "{{ gitlab_token_name }}"
+        state: present
+        expires_at: '2025-01-01'
+        access_level: developer
+        scopes:
+        - api
+        - read_api
+      register: change_token_status
+  always:
+    - name: Assert that token change with recreate=never fails
+      assert:
+        that:
+          - change_token_status is failed
+  ignore_errors: true
+
+- name: Try to change existing access token with recreate=state_change
+  community.general.gitlab_project_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    project: "{{ gitlab_project_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: present
+    expires_at: '2025-01-01'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+    recreate: state_change
+  register: change_recreate_token_status
+- name: Assert that token change with recreate=state_change succeeds
+  assert:
+    that:
+      - change_recreate_token_status is changed
+      - change_recreate_token_status.access_token.token is defined
+
+- name: Try to change existing access token with recreate=always
+  community.general.gitlab_project_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    project: "{{ gitlab_project_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: present
+    expires_at: '2025-01-01'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+    recreate: always
+  register: change_recreate1_token_status
+- name: Assert that token change with recreate=always succeeds
+  assert:
+    that:
+      - change_recreate1_token_status is changed
+      - change_recreate1_token_status.access_token.token is defined
+
+- name: Revoke access token
+  community.general.gitlab_project_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    project: "{{ gitlab_project_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: absent
+    expires_at: '2024-12-31'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+  register: revoke_token_status
+- name: Assert that token revocation succeeds
+  assert:
+    that:
+      - revoke_token_status is changed
+
+- name: Revoke nonexisting access token
+  community.general.gitlab_project_access_token:
+    api_token: "{{ gitlab_api_token }}"
+    api_url: "{{ gitlab_api_url }}"
+    validate_certs: "{{ gitlab_validate_certs }}"
+    project: "{{ gitlab_project_name }}"
+    name: "{{ gitlab_token_name }}"
+    state: absent
+    expires_at: '2024-12-31'
+    access_level: developer
+    scopes:
+    - api
+    - read_api
+  register: revoke_token_status
+- name: Assert that token revocation succeeds with status not changed
+  assert:
+    that:
+      - revoke_token_status is not changed

tests/unit/plugins/modules/gitlab.py

@@ -284,6 +284,36 @@ def resp_delete_group(url, request):
     return response(204, content, headers, None, 5, request)
 
 
+@urlmatch(scheme="http", netloc="localhost", path="/api/v4/groups/1/access_tokens", method="get")
+def resp_list_group_access_tokens(url, request):
+    headers = {'content-type': 'application/json'}
+    content = ('[{"user_id" : 1, "scopes" : ["api"], "name" : "token1", "expires_at" : "2021-01-31",'
+               '"id" : 1, "active" : false, "created_at" : "2021-01-20T22:11:48.151Z", "revoked" : true,'
+               '"access_level": 40},{"user_id" : 2, "scopes" : ["api"], "name" : "token2", "expires_at" : "2021-02-31",'
+               '"id" : 2, "active" : true, "created_at" : "2021-02-20T22:11:48.151Z", "revoked" : false,'
+               '"access_level": 40}]')
+    content = content.encode("utf-8")
+    return response(200, content, headers, None, 5, request)
+
+
+@urlmatch(scheme="http", netloc="localhost", path="/api/v4/groups/1/access_tokens", method="post")
+def resp_create_group_access_tokens(url, request):
+    headers = {'content-type': 'application/json'}
+    content = ('{"user_id" : 1, "scopes" : ["api"], "name" : "token1", "expires_at" : "2021-01-31",'
+               '"id" : 1, "active" : false, "created_at" : "2021-01-20T22:11:48.151Z", "revoked" : true,'
+               '"access_level": 40, "token": "Der423FErcdv35qEEWc"}')
+    content = content.encode("utf-8")
+    return response(201, content, headers, None, 5, request)
+
+
+@urlmatch(scheme="http", netloc="localhost", path="/api/v4/groups/1/access_tokens/1", method="delete")
+def resp_revoke_group_access_tokens(url, request):
+    headers = {'content-type': 'application/json'}
+    content = ('')
+    content = content.encode("utf-8")
+    return response(204, content, headers, None, 5, request)
+
+
 '''
 GROUP MEMBER API
 '''
@@ -534,6 +564,36 @@ def resp_delete_protected_branch(url, request):
     return response(204, content, headers, None, 5, request)
 
 
+@urlmatch(scheme="http", netloc="localhost", path="/api/v4/projects/1/access_tokens", method="get")
+def resp_list_project_access_tokens(url, request):
+    headers = {'content-type': 'application/json'}
+    content = ('[{"user_id" : 1, "scopes" : ["api"], "name" : "token1", "expires_at" : "2021-01-31",'
+               '"id" : 1, "active" : false, "created_at" : "2021-01-20T22:11:48.151Z", "revoked" : true,'
+               '"access_level": 40},{"user_id" : 2, "scopes" : ["api"], "name" : "token2", "expires_at" : "2021-02-31",'
+               '"id" : 2, "active" : true, "created_at" : "2021-02-20T22:11:48.151Z", "revoked" : false,'
+               '"access_level": 40}]')
+    content = content.encode("utf-8")
+    return response(200, content, headers, None, 5, request)
+
+
+@urlmatch(scheme="http", netloc="localhost", path="/api/v4/projects/1/access_tokens", method="post")
+def resp_create_project_access_tokens(url, request):
+    headers = {'content-type': 'application/json'}
+    content = ('{"user_id" : 1, "scopes" : ["api"], "name" : "token1", "expires_at" : "2021-01-31",'
+               '"id" : 1, "active" : false, "created_at" : "2021-01-20T22:11:48.151Z", "revoked" : true,'
+               '"access_level": 40, "token": "Der423FErcdv35qEEWc"}')
+    content = content.encode("utf-8")
+    return response(201, content, headers, None, 5, request)
+
+
+@urlmatch(scheme="http", netloc="localhost", path="/api/v4/projects/1/access_tokens/1", method="delete")
+def resp_revoke_project_access_tokens(url, request):
+    headers = {'content-type': 'application/json'}
+    content = ('')
+    content = content.encode("utf-8")
+    return response(204, content, headers, None, 5, request)
+
+
 '''
 HOOK API
 '''

tests/unit/plugins/modules/test_gitlab_group_access_token.py

@@ -0,0 +1,107 @@
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2023, Zoran Krleza (zoran.krleza@true-north.hr)
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import pytest
+import gitlab
+
+from ansible_collections.community.general.plugins.modules.gitlab_group_access_token import GitLabGroupAccessToken
+
+# python-gitlab 3.1+ is needed for python-gitlab access tokens api
+PYTHON_GITLAB_MINIMAL_VERSION = (3, 1)
+
+
+def python_gitlab_version_match_requirement():
+    return tuple(map(int, gitlab.__version__.split('.'))) >= PYTHON_GITLAB_MINIMAL_VERSION
+
+
+def _dummy(x):
+    """Dummy function.  Only used as a placeholder for toplevel definitions when the test is going
+    to be skipped anyway"""
+    return x
+
+
+pytestmark = []
+try:
+    from .gitlab import (GitlabModuleTestCase,
+                         resp_get_user,
+                         resp_get_group,
+                         resp_list_group_access_tokens,
+                         resp_create_group_access_tokens,
+                         resp_revoke_group_access_tokens)
+
+except ImportError:
+    pytestmark.append(pytest.mark.skip("Could not load gitlab module required for testing"))
+    # Need to set these to something so that we don't fail when parsing
+    GitlabModuleTestCase = object
+    resp_list_group_access_tokens = _dummy
+    resp_create_group_access_tokens = _dummy
+    resp_revoke_group_access_tokens = _dummy
+    resp_get_user = _dummy
+    resp_get_group = _dummy
+
+# Unit tests requirements
+try:
+    from httmock import with_httmock  # noqa
+except ImportError:
+    pytestmark.append(pytest.mark.skip("Could not load httmock module required for testing"))
+    with_httmock = _dummy
+
+
+class TestGitlabGroupAccessToken(GitlabModuleTestCase):
+    @with_httmock(resp_get_user)
+    def setUp(self):
+        super(TestGitlabGroupAccessToken, self).setUp()
+        if not python_gitlab_version_match_requirement():
+            self.skipTest("python-gitlab %s+ is needed for gitlab_group_access_token" % ",".join(map(str, PYTHON_GITLAB_MINIMAL_VERSION)))
+
+        self.moduleUtil = GitLabGroupAccessToken(module=self.mock_module, gitlab_instance=self.gitlab_instance)
+
+    @with_httmock(resp_get_group)
+    @with_httmock(resp_list_group_access_tokens)
+    def test_find_access_token(self):
+        group = self.gitlab_instance.groups.get(1)
+        self.assertIsNotNone(group)
+
+        rvalue = self.moduleUtil.find_access_token(group, "token1")
+        self.assertEqual(rvalue, False)
+        self.assertIsNotNone(self.moduleUtil.access_token_object)
+
+    @with_httmock(resp_get_group)
+    @with_httmock(resp_list_group_access_tokens)
+    def test_find_access_token_negative(self):
+        groups = self.gitlab_instance.groups.get(1)
+        self.assertIsNotNone(groups)
+
+        rvalue = self.moduleUtil.find_access_token(groups, "nonexisting")
+        self.assertEqual(rvalue, False)
+        self.assertIsNone(self.moduleUtil.access_token_object)
+
+    @with_httmock(resp_get_group)
+    @with_httmock(resp_create_group_access_tokens)
+    def test_create_access_token(self):
+        groups = self.gitlab_instance.groups.get(1)
+        self.assertIsNotNone(groups)
+
+        rvalue = self.moduleUtil.create_access_token(groups, {'name': "tokenXYZ", 'scopes': ["api"], 'access_level': 20, 'expires_at': "2024-12-31"})
+        self.assertEqual(rvalue, True)
+        self.assertIsNotNone(self.moduleUtil.access_token_object)
+
+    @with_httmock(resp_get_group)
+    @with_httmock(resp_list_group_access_tokens)
+    @with_httmock(resp_revoke_group_access_tokens)
+    def test_revoke_access_token(self):
+        groups = self.gitlab_instance.groups.get(1)
+        self.assertIsNotNone(groups)
+
+        rvalue = self.moduleUtil.find_access_token(groups, "token1")
+        self.assertEqual(rvalue, False)
+        self.assertIsNotNone(self.moduleUtil.access_token_object)
+
+        rvalue = self.moduleUtil.revoke_access_token()
+        self.assertEqual(rvalue, True)

tests/unit/plugins/modules/test_gitlab_project_access_token.py

@@ -0,0 +1,107 @@
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2023, Zoran Krleza (zoran.krleza@true-north.hr)
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import pytest
+import gitlab
+
+from ansible_collections.community.general.plugins.modules.gitlab_project_access_token import GitLabProjectAccessToken
+
+# python-gitlab 3.1+ is needed for python-gitlab access tokens api
+PYTHON_GITLAB_MINIMAL_VERSION = (3, 1)
+
+
+def python_gitlab_version_match_requirement():
+    return tuple(map(int, gitlab.__version__.split('.'))) >= PYTHON_GITLAB_MINIMAL_VERSION
+
+
+def _dummy(x):
+    """Dummy function.  Only used as a placeholder for toplevel definitions when the test is going
+    to be skipped anyway"""
+    return x
+
+
+pytestmark = []
+try:
+    from .gitlab import (GitlabModuleTestCase,
+                         resp_get_user,
+                         resp_get_project,
+                         resp_list_project_access_tokens,
+                         resp_create_project_access_tokens,
+                         resp_revoke_project_access_tokens)
+
+except ImportError:
+    pytestmark.append(pytest.mark.skip("Could not load gitlab module required for testing"))
+    # Need to set these to something so that we don't fail when parsing
+    GitlabModuleTestCase = object
+    resp_list_project_access_tokens = _dummy
+    resp_create_project_access_tokens = _dummy
+    resp_revoke_project_access_tokens = _dummy
+    resp_get_user = _dummy
+    resp_get_project = _dummy
+
+# Unit tests requirements
+try:
+    from httmock import with_httmock  # noqa
+except ImportError:
+    pytestmark.append(pytest.mark.skip("Could not load httmock module required for testing"))
+    with_httmock = _dummy
+
+
+class TestGitlabProjectAccessToken(GitlabModuleTestCase):
+    @with_httmock(resp_get_user)
+    def setUp(self):
+        super(TestGitlabProjectAccessToken, self).setUp()
+        if not python_gitlab_version_match_requirement():
+            self.skipTest("python-gitlab %s+ is needed for gitlab_project_access_token" % ",".join(map(str, PYTHON_GITLAB_MINIMAL_VERSION)))
+
+        self.moduleUtil = GitLabProjectAccessToken(module=self.mock_module, gitlab_instance=self.gitlab_instance)
+
+    @with_httmock(resp_get_project)
+    @with_httmock(resp_list_project_access_tokens)
+    def test_find_access_token(self):
+        project = self.gitlab_instance.projects.get(1)
+        self.assertIsNotNone(project)
+
+        rvalue = self.moduleUtil.find_access_token(project, "token1")
+        self.assertEqual(rvalue, False)
+        self.assertIsNotNone(self.moduleUtil.access_token_object)
+
+    @with_httmock(resp_get_project)
+    @with_httmock(resp_list_project_access_tokens)
+    def test_find_access_token_negative(self):
+        project = self.gitlab_instance.projects.get(1)
+        self.assertIsNotNone(project)
+
+        rvalue = self.moduleUtil.find_access_token(project, "nonexisting")
+        self.assertEqual(rvalue, False)
+        self.assertIsNone(self.moduleUtil.access_token_object)
+
+    @with_httmock(resp_get_project)
+    @with_httmock(resp_create_project_access_tokens)
+    def test_create_access_token(self):
+        project = self.gitlab_instance.projects.get(1)
+        self.assertIsNotNone(project)
+
+        rvalue = self.moduleUtil.create_access_token(project, {'name': "tokenXYZ", 'scopes': ["api"], 'access_level': 20, 'expires_at': "2024-12-31"})
+        self.assertEqual(rvalue, True)
+        self.assertIsNotNone(self.moduleUtil.access_token_object)
+
+    @with_httmock(resp_get_project)
+    @with_httmock(resp_list_project_access_tokens)
+    @with_httmock(resp_revoke_project_access_tokens)
+    def test_revoke_access_token(self):
+        project = self.gitlab_instance.projects.get(1)
+        self.assertIsNotNone(project)
+
+        rvalue = self.moduleUtil.find_access_token(project, "token1")
+        self.assertEqual(rvalue, False)
+        self.assertIsNotNone(self.moduleUtil.access_token_object)
+
+        rvalue = self.moduleUtil.revoke_access_token()
+        self.assertEqual(rvalue, True)