Protected branch merge access levels don't work with inherited access via groups
ZD: https://gitlab.zendesk.com/agent/tickets/119125
To reproduce:
- Create a group
hello
. - Add a
myuser
user as an Owner tohello
. - Create a subgroup
hello/mergers
. - Create a project
hello/test
. - Inside the project Settings->Members for
hello/test
, invitehello/mergers
. - Inside the project Settings->Repository, create a protected branch rule with
hello/mergers
allowed to merge andNo one
for allowed to push.
For this user, the Merge
button is not available because this line in https://gitlab.com/gitlab-org/gitlab-ee/blob/4d336ab526e4dcbd4b9a0263c6e33aaa81e8688a/ee/app/models/concerns/ee/protected_ref_access.rb#L75 expects the user to be a member of that group, but myuser
isn't a direct member.
I think we can omit that line entirely because I think we need to check parent groups.check_access
checks the max team access level, so members don't need to be a direct member to have access.
This line has been there since 2016, so I suspect this predated subgroups and protected branch group permissions.
Relevant MR: https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/5103
Edited by Stan Hu