Include shared projects in group's package registry

Problem to solve

When a project is shared with another group, the packages of the project's package registry should also be inside of the package registry of the shared group.

Intended users

• Sam (Security Analyst)
• Allison (Application Ops)

User experience goal

A user that is a member of a group can access the group's package registry. That registry should also contain all the packages from projects that are shared with that group. That way the user only has to access the group's registry to get all packages of that group and doesn't have to configure each project individually.

Further details

I want to share access to specific private composer projects with external users that shall not have access to other projects that are in the existing group(s).

I can give them the Reporter role to individual projects, so that they have read access and can access the project's registry. But they don't have a common registry for all of the projects they have access to. So they'd have to configure each project individually.

Groups are having a registry that combines the registries of all of their projects and sub-groups recursively. But in order for an external user to have access to the group's registry, they need to at least have the Guest role for that group. But that'd expose ALL projects in that group and sub-groups to them.

It's possible to create a separate group for those users and only share individual projects with that group. But the registry of that extra group doesn't include packages of shared projects currently. I think sharing a project with another group should also add its package registry to that of the shared group.