Skip to content

Add individual inherited member lookup API

What does this MR do?

1. Adds individual inherited member lookup

Adds the endpoints


similar to the existing

/(groups|projects)/:id/members/all      # all members of group or project, including inherited members
/(groups|projects)/:id/members/:user_id # is this user a direct member of the group or project?

It is a new endpoint because changing the behavior of


is technically not backwards compatible and would just introduce the inverse problem (no simple way to check for direct membership).

2. Adds filtering by user ID on search endpoints



only allow to filter on a fuzzy search param, I'm proposing we also add a query parameter


as an alternative to making multiple requests of the type



Currently, JupyterHub login via gitlab is failing for members inherited from parent groups, #31165 (closed). The reason is that the


endpoints only look up direct members, not inherited ones. The idea was to use


on the oauthenticator side instead, but we discovered that this search is a bit too fuzzy for our purposes (see also the oauthenticator pull request and would overcomplicate something that should be very simple.


Does this MR meet the acceptance criteria?


Performance and Testing


If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by 🤖 GitLab Bot 🤖

Merge request reports