Merge Request Approval Rules Still Create Todos for Non-Project Members After Paid Plans Expire

Summary

Merge request approvals still assign Todos to non-project members after a paid plan expires.

This bug was originally reported by a user (GitLab internal): https://gitlab.zendesk.com/agent/tickets/119661

Steps to reproduce

  1. Sign up for a Bronze Subscription.
  2. Create a project.
  3. Add a user as a Developer, called "TestUser" for example.
  4. Set a Merge Request Approval rule and add "TestUser".
  5. Remove or let the paid plan expire.
  6. Remove "TestUser" from the project.
  7. Create a new Merge Request. A Todo with the MR details will be assigned to "TestUser". The rendered link to the MR will 404 when clicked.

What is the current bug behavior?

The Todo is assigned to the non-member. The title of merge request is available in the tooltip of the rendered link.

What is the expected correct behavior?

No Todo should be assigned. All existing Todos should expire (this may be a separate bug).

Relevant logs and/or screenshots

Todos___Dashboard___GitLab

Output of checks

This bug happens on GitLab.com.