Reject cross-organization Offline Transfer imports

Rezrequested to merge
reza/orgs-cross-org-offline-transfer into master

What

Offline Transfer can currently import into a different organization than the one you're working in. This blocks that when either organization has isolation turned on. It's the same gap we already fixed for Direct Transfer, just in a different service.

How

Import::Offline::Imports::CreateService now checks each entity's destination org before creating the import. If the destination belongs to a different org than your current one, and either org is isolated, it returns a ServiceResponse.error instead of proceeding.

If neither org is isolated, nothing changes, so today's GitLab.com flows are unaffected.

Try it locally

  1. Two orgs A and B, a user in both, and a destination group in B.
  2. In the Rails console: Organizations::Organization.find_by_path('org-a').mark_as_isolated!
  3. As a user scoped to A, POST /offline_imports targeting a group in B. It's rejected.
  4. mark_as_not_isolated! and it works again.

MR acceptance checklist

Closes #600608 (closed). Part of &21584 (closed).

Follows the same isolated?-gated pattern as Direct Transfer in !236603 (merged) (#595674 (closed)), reusing its shared BulkImports::Error.cross_organization_destination helper.

Edited by Rez

Merge request reports