Inaccessible groups are missing in the CI Job Token AllowList in the UI
When a project maintainer tries to inspect the CI Job token Allowlist in CI/CD settings and the Allowlist contains a group that the maintainer has no Guest+ permissions, the group is NOT displayed in the UI even though it exists.
This is misleading to the project maintainer because a group that can use the current project's CI Job Token Authorization exist but is NOT showing up in the list because the current user DOES NOT have access to the specific group
Steps to Reproduce
- For User A create a
private_group_a - For User B create a project_b.
- Give maintainer access to User B on
private_group_a - On
project_badd aprivate_group_ato allowlist - Check the allowlist it will have a
private_group_aon it. - Remove User B from maintainers of
private_group_a - As result
private_group_awill disappear from the allowlist, it doesn't raise any errors like with none authoirized projects. But, it could be considered as a bug, as we still have aprivate_group_ain the allowlist if we will check::Ci::JobToken::Allowlist.new(project_b).groups