The API for Group members returns true for is_using_seat even when user is not
Summary
Currently, The api to list the group's members with the parameter show_seat_info=true
on Gitlab.com returns true even if they are not belonging to the paid seat within the requested namespace.
Steps to reproduce
Add a user to Gitlab.com and the user's data will be returned as is_using_seat
true if the user has permission more than Guest in any Group within Gitlab.com
Example Project
https://gitlab.com/api/v4/groups/9970/members?show_seat_info=true
What is the expected correct behavior?
If the API is being hit on self hosted then
- it should check if the License exists and it excludes guest from active count
- If it excludes then if the user is not a guest should return true
- Else return true
If the API is being hit on Gitlab.com then
- check if within the namespace the user is billed or not
Edited by Shreyas Agarwal