GitLab Next

What does this MR do?

1. Adds individual inherited member lookup

Adds the endpoints

/(groups|projects)/:id/members/all/:user_id

similar to the existing

/(groups|projects)/:id/members/all      # all members of group or project, including inherited members
/(groups|projects)/:id/members/:user_id # is this user a direct member of the group or project?

It is a new endpoint because changing the behavior of

/(groups|projects)/:id/members/:user_id

is technically not backwards compatible and would just introduce the inverse problem (no simple way to check for direct membership).

2. Adds filtering by user ID on search endpoints

Since

/(groups|projects)/:id/members/
/(groups|projects)/:id/members/all

only allow to filter on a fuzzy search param, I'm proposing we also add a query parameter

user_ids[]=...

as an alternative to making multiple requests of the type

/(groups|projects)/:id/members/(all/):user_id

Background

Currently, JupyterHub login via gitlab is failing for members inherited from parent groups, #31165 (closed). The reason is that the

/(groups|projects)/:id/members/:user_id

endpoints only look up direct members, not inherited ones. The idea was to use

/(groups|projects)/:id/members/all?query=:username

on the oauthenticator side instead, but we discovered that this search is a bit too fuzzy for our purposes (see also the oauthenticator pull request https://github.com/jupyterhub/oauthenticator/pull/283) and would overcomplicate something that should be very simple.

Screenshots

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Documentation created/updated or follow-up review issue created
• Code review guidelines
• Merge request performance guidelines
• Style guides
• Database guides
• Separation of EE specific content

Performance and Testing

• [-] Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
• [-] Tested in all supported browsers

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

• [-] Label as security and @ mention @gitlab-com/gl-security/appsec
• [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
• [-] Security reports checked/validated by a reviewer from the AppSec team