Include and process visibility_level

What does this MR do and why?

This change removes the omission of the visibility_level attribute from the file-based group export file, and adds logic to assign a visibility_level to imported subgroups which correctly aligns with those permitted by the destination group's visibility_level.

This change is needed because previously, with the visibility_level attribute omitted from the export file, the visibility level for each top-level source group would be set to the same visibility as the destination group, and any source subgroups would be set to PRIVATE, regardless of their original visibility level on the source. See #405168 (closed)

Now, the source subgroup visibility_level is maintained when it conforms to the rules for subgroup visibility levels (public groups can contain public, internal or private subgroups, internal groups can contain internal or private subgroups, private groups can only contain private subgroups), or is changed to the same visibility level of the destination group.

Changelog: fixed

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

With this public source group:

Imported to a public destination group

The source visibility levels are maintained for each subgroup:

Imported to an internal destination group

The allowed visibility levels are maintained for each subgroup, with the public subgroup becoming internal:

Imported to a private destination group

All subgroup visibility levels become private:

How to set up and validate locally

1. On a source instance create a public group with a public, an internal, and a private subgroup.
2. In the Group's Settings > General > Advanced > Export group, click the [Export Group] button
3. refresh the page until the [Download Export] button appears and download the export file.
4. on the destination instance create a public, internal, and private group and take note of their IIds
5. In a terminal window, in the same directory as the downloaded export file, make a curl request to the destination instance to create several POST requests, using the id of each destination group just created:

curl --request POST --header "PRIVATE-TOKEN: [ACCESS TOKEN FOR DESTINATION INSTANCE]" \                                                                                                
      --form "name=[NAME FOR IMPORTED GROUP]" --form "path=[PATH FOR IMPORTED GROUP]" --form "parent_id=[DESTINATION GROUP ID]" \
     --form "file=@[NAME OF EXPORT FILE eg:public-group-3_export.tar.gz]" "[DESTINATION INSTANCE API ENDPOINT eg:]http://gdk.test:3000/api/v4/groups/import"

For each POST request you should see the source group and subgroups imported with the correct visibility level.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Related to #405168 (closed)

lib/gitlab/import_export/group/tree_restorer.rb

@@ -65,6 +65,17 @@ def process_root(group_id)
           # with existing groups name and/or path.
           group_attributes.delete_attributes('name', 'path')
 
+          if @top_level_group.parent.nil?
+            if Gitlab::VisibilityLevel.restricted_level?(group_attributes.attributes['visibility_level'])
+              group_attributes.delete_attribute('visibility_level')
+            end
+          else
+            group_attributes.attributes['visibility_level'] = sub_group_visibility_level(
+              group_attributes.attributes['visibility_level'],
+              @top_level_group.parent
+            )
+          end
+
           restore_group(@top_level_group, group_attributes)
         end
 
@@ -86,16 +97,16 @@ def create_group(group_attributes)
           parent_id = group_attributes.delete_attribute('parent_id')
           name = group_attributes.delete_attribute('name')
           path = group_attributes.delete_attribute('path')
+          visibility_level = group_attributes.delete_attributes('visibility_level')
 
           parent_group = @groups_mapping.fetch(parent_id) { raise(ArgumentError, 'Parent group not found') }
-          destination_group = parent_group.ancestors.find_by(parent_id: nil) || parent_group
 
           group = ::Groups::CreateService.new(
             user,
             name: name,
             path: path,
             parent_id: parent_group.id,
-            visibility_level: sub_group_visibility_level(group_attributes.attributes, destination_group)
+            visibility_level: sub_group_visibility_level(visibility_level[0], parent_group)
           ).execute
 
           group.validate!
@@ -125,14 +136,14 @@ def relation_reader
           end
         end
 
-        def sub_group_visibility_level(group_hash, destination_group)
-          destination_visibility_level = destination_group.visibility_level
+        def sub_group_visibility_level(visibility_level, parent_group)
+          parent_visibility_level = parent_group.visibility_level
 
-          original_visibility_level = group_hash['visibility_level'] ||
-            closest_allowed_level(destination_visibility_level)
+          original_visibility_level = visibility_level ||
+            closest_allowed_level(parent_visibility_level)
 
-          if destination_visibility_level < original_visibility_level
-            closest_allowed_level(destination_visibility_level)
+          if parent_visibility_level < original_visibility_level
+            closest_allowed_level(parent_visibility_level)
           else
             closest_allowed_level(original_visibility_level)
           end