Exempt paid subgroup members from identity verification (!243890) · Merge requests · GitLab.org / GitLab

What does this MR do and why?

Exempt paid subgroup members from identity verification

belongs_to_paid_namespace? only counted direct Reporter+ roles on a root group, so a member with a qualifying role on a subgroup of a paid namespace (but Guest/none at the root) read as non-paid and was routed through identity verification.

Add an opt-in include_subgroup_membership flag that resolves subgroup memberships to their root ancestor's subscription (traversal_ids[1]). The identity_verification_exempt? caller opts in behind the identity_verification_paid_subgroup_membership feature flag.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Database review

This MR modifies the query in User#paid_namespaces (via namespace_union_for_reporter_developer_maintainer_owned). When include_subgroup_membership: true (behind the identity_verification_paid_subgroup_membership FF), the group arm of the UNION drops the namespaces.parent_id IS NULL (top_level) predicate so subgroup memberships are matched, and selects traversal_ids[1] (root ancestor) so subscriptions still resolve at the root namespace.

Runtime path is belongs_to_paid_namespace subgroup memberships are matched, and selects traversal_ids[1]` (root ancestor) so subscriptions still resolve at the root namespace.

Runtime path is belongs_to_paid_namespace query in a LIMIT 1existence check. Plans below use the fullSELECT(a superset of the executed cost) with the documenteduser_id = 1614863` (gitlab-qa).

Old query (include_subgroup_membership: false)

SELECT "namespaces"."id" FROM ((SELECT "namespaces"."id" FROM "namespaces" WHERE "namespaces"."type" = 'User' AND "namespaces"."owner_id" = 1614863) UNION (SELECT "namespaces"."id" FROM "namespaces" INNER JOIN "members" ON "namespaces"."id" = "members"."source_id" WHERE "members"."type" = 'GroupMember' AND "members"."source_type" = 'Namespace' AND "namespaces"."type" = 'Group' AND "members"."user_id" = 1614863 AND "members"."requested_at" IS NULL AND (access_level >= 10) AND "members"."access_level" IN (20, 30, 40, 50) AND "namespaces"."parent_id" IS NULL)) namespaces LEFT OUTER JOIN "gitlab_subscriptions" ON "gitlab_subscriptions"."namespace_id" = "namespaces"."id" WHERE "gitlab_subscriptions"."hosted_plan_id" IN (SELECT "plans"."id" FROM "plans" WHERE "plans"."name" IN ('bronze', 'silver', 'premium', 'gold', 'ultimate', 'ultimate_trial', 'ultimate_trial_paid_customer', 'premium_trial', 'opensource')) AND ("gitlab_subscriptions"."trial" = FALSE OR "gitlab_subscriptions"."trial" IS NULL OR "gitlab_subscriptions"."trial_ends_on" <= '2026-07-05')

Query plan: https://console.postgres.aiundefined/shared/6b8ea3a6-573e-4bb5-afe1-e623d9761259

Nested Loop  (cost=5.20..47.07 rows=2 width=4) (actual time=83.577..385.513 rows=8 loops=1)  
   Buffers: shared hit=997 read=342 dirtied=135  
   WAL: records=136 fpi=135 bytes=1078027  
   I/O Timings: read=360.693 write=0.000  
   ->  Nested Loop  (cost=5.05..46.70 rows=2 width=8) (actual time=43.841..384.874 rows=10 loops=1)  
         Buffers: shared hit=978 read=341 dirtied=135  
          
[...SKIP...]

Time: 416.208 ms  
  - planning: 30.511 ms  
  - execution: 385.697 ms  
    - I/O read: 360.693 ms  
    - I/O write: 0.000 ms  
  
Shared buffers:  
  - hits: 997 (~7.80 MiB) from the buffer pool  
  - reads: 342 (~2.70 MiB) from the OS file cache, including disk I/O  
  - dirtied: 135 (~1.10 MiB)  
  - writes: 0

New query (include_subgroup_membership: true)

SELECT "namespaces"."id" FROM ((SELECT "namespaces"."id" FROM "namespaces" WHERE "namespaces"."type" = 'User' AND "namespaces"."owner_id" = 1614863) UNION (SELECT namespaces.traversal_ids[1] FROM "namespaces" INNER JOIN "members" ON "namespaces"."id" = "members"."source_id" WHERE "members"."type" = 'GroupMember' AND "members"."source_type" = 'Namespace' AND "namespaces"."type" = 'Group' AND "members"."user_id" = 1614863 AND "members"."requested_at" IS NULL AND (access_level >= 10) AND "members"."access_level" IN (20, 30, 40, 50))) namespaces LEFT OUTER JOIN "gitlab_subscriptions" ON "gitlab_subscriptions"."namespace_id" = "namespaces"."id" WHERE "gitlab_subscriptions"."hosted_plan_id" IN (SELECT "plans"."id" FROM "plans" WHERE "plans"."name" IN ('bronze', 'silver', 'premium', 'gold', 'ultimate', 'ultimate_trial', 'ultimate_trial_paid_customer', 'premium_trial', 'opensource')) AND ("gitlab_subscriptions"."trial" = FALSE OR "gitlab_subscriptions"."trial" IS NULL OR "gitlab_subscriptions"."trial_ends_on" <= '2026-07-05')

 Nested Loop  (cost=45.38..52.08 rows=2 width=4) (actual time=294.437..294.495 rows=8 loops=1)  
   Buffers: shared hit=1612 read=332 dirtied=48  
   WAL: records=66 fpi=48 bytes=382622  
   I/O Timings: read=283.500 write=0.000  
   ->  Nested Loop  (cost=45.23..51.71 rows=2 width=8) (actual time=294.395..294.461 rows=10 loops=1)  
         Buffers: shared hit=1592 read=332 dirtied=48  
         
[...SKIP...]

Time: 301.645 ms  
  - planning: 7.015 ms  
  - execution: 294.630 ms  
    - I/O read: 283.500 ms  
    - I/O write: 0.000 ms  
  
Shared buffers:  
  - hits: 1612 (~12.60 MiB) from the buffer pool  
  - reads: 332 (~2.60 MiB) from the OS file cache, including disk I/O  
  - dirtied: 48 (~384.00 KiB)  
  - writes: 0

Query plan: https://console.postgres.aiundefined/shared/9ffd6897-b308-4593-af3d-627881b937d0

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited Jul 06, 2026 by Jay