Create a queue to run safety-net refreshes of project_authorizations

What does this MR do and why?

  • Instead of running a safety net refresh per request of project_authorizations, we maintain a queue of users whose access level is changed recently and we re-verify their access levels using a cron worker.

Steps to reproduce

  1. Enable feature flag
Feature.enable(:use_db_to_queue_safety_net_auth_refresh)
  1. Add user as a member
user = User.find_by(username: 'root')
project = Project.first

# Simulate a missed refresh by deleting the authorization row, then run the cron worker directly:

project.add_developer(user) unless project.member?(user)
ProjectAuthorization.where(user_id: user.id, project_id: project.id).delete_all

Authz::ReverifyProjectAuthorizationsCronWorker.new.perform

ProjectAuthorization.exists?(user_id: user.id, project_id: project.id)   # => true (restored)
Authz::ProjectAuthorizationReverification.where(user_id: user.id).exists? # => false (dequeued)

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Resolves https://gitlab.com/gitlab-org/gitlab/-/work_items/541448 & #589595

Edited by Hinam Mehra

Merge request reports

Loading
Loading