API members/all missing some inherited members.
Summary
API endpoints /projects/ID/members/all
and /groups/ID/members/all
do not list members of other groups that are granted access to the corresponding group.
Steps to reproduce
Consider the following setup:
- Groups: G1, G2
- Project: P1
- Users: U1, U2, U3
With the following relationships
- Project P1 belongs to group G1
- Group G2 is "member" of (has access to) group G1
- User U1 is member of P1, U2 member of G1, U3 member of G2
Results in
- Request
/projects/P1/members/all
will return only U1 and U2. - Request
/grops/G1/members/all
will return only U2.
Example Project
- P1: https://gitlab.com/gitlab-test-member-inheritance-g1/gitlab-test-member-inheritance-p1
- G1: https://gitlab.com/gitlab-test-member-inheritance-g1
- G2: https://gitlab.com/gitlab-test-member-inheritance-g2
What is the current bug behavior?
- Request
/projects/P1/members/all
will return only U1 and U2. - Request
/grops/G1/members/all
will return only U2.
What is the expected correct behavior?
- Request
/projects/P1/members/all
should return U1, U2, U3 - Request
/grops/G1/members/all
should return U2, U3
Output of checks
This bug happens on GitLab.com