API members/all missing some inherited members.

Summary

API endpoints /projects/ID/members/all and /groups/ID/members/all do not list members of other groups that are granted access to the corresponding group.

Steps to reproduce

Consider the following setup:

• Groups: G1, G2
• Project: P1
• Users: U1, U2, U3

With the following relationships

• Project P1 belongs to group G1
• Group G2 is "member" of (has access to) group G1
• User U1 is member of P1, U2 member of G1, U3 member of G2

Results in

• Request /projects/P1/members/all will return only U1 and U2.
• Request /grops/G1/members/all will return only U2.

Example Project

• P1: https://gitlab.com/gitlab-test-member-inheritance-g1/gitlab-test-member-inheritance-p1
• G1: https://gitlab.com/gitlab-test-member-inheritance-g1
• G2: https://gitlab.com/gitlab-test-member-inheritance-g2

What is the current bug behavior?

• Request /projects/P1/members/all will return only U1 and U2.
• Request /grops/G1/members/all will return only U2.

What is the expected correct behavior?

• Request /projects/P1/members/all should return U1, U2, U3
• Request /grops/G1/members/all should return U2, U3

Output of checks

This bug happens on GitLab.com