Skip to content

Show membership source when the user can read group through inheritance

Abdul Wadood requested to merge 455884-unmask-groups-with-read-permission into master

What does this MR do and why?

We are now showing the invited group members on the shared group members page behind the webui_members_inherited_users feature flag which is being rolled out in #364078 (closed).

We mask the source of membership if the current user cannot access the invited group. We missed an edge case here where the source of membership was being masked if the user had access to the invited group through inheritance. Now the source of membership is not masked if the user has access to the invited group through its parent group membership.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Before After
image image

How to set up and validate locally

  1. Enable the feature flag Feature.enable :webui_members_inherited_users.
  2. Create two top-level groups Invited Parent Group and Shared Group.
  3. Create Invited Child Group under Invited Parent Group and invite Invited Child Group to Shared Group using Invite a group button on https://gdk.test:3000/groups/shared-group/-/group_members.
  4. Add user User1 to Invited Parent Group & Shared group with Guest access and User2 to Shared Child Group.
  5. Login using User1 and navigate to https://gdk.test:3000/groups/shared-group/-/group_members?tab=0.
  6. The source of membership would show up as Private for User2 on the master branch and on this branch it will show the real source as shown in the screenshot.

Related to #455884 (closed)

Edited by Abdul Wadood

Merge request reports