Skip to content

Add state machine for "GroupMember#state"

Etienne Baqué requested to merge 332592-add-state-machine-to-members into master

What does this MR do?

Relates to #332592 (closed)

This MR introduces state machine for GroupMember#state. It also applies the correct state to a GroupMember instance upon creation, depending on the value returned by the root group's user cap: after creation, a GroupMember will be either awaiting or active

This state switch is hidden behind the saas_user_caps feature flag.

Manual testing with screenshots

For convenience of reading these screenshots, SQL logging was disabled during manual testing (config.active_record.logger = nil in config/environments/development.rb)

1. Creation of GroupMember with saas_user_caps FF turned on - user cap not reached yet.

The following scenario shows the creation of a GroupMember for a given group which user cap has not been reached. As a result, we successfully creates a GroupMember which is active (state: 2)

Screenshot_from_2021-09-08_10-16-57

2. Creation of GroupMember with saas_user_caps FF turned on - user cap already reached.

In this second scenario, we first destroy the user created above (so that we can reuse the same params used earlier), then we set the user cap limit to the current number of group members for this group. This implicitly means that the cap has been reached. Then we create a new group member: as expected it's created and awaiting (state: 1)

Screenshot_from_2021-09-08_10-18-19

3. Creation of GroupMember with saas_user_caps FF turned off.

In this last scenario, we create a group member while the saas_user_caps is turned off. The created group member is just created, which is the default state (0).

Screenshot_from_2021-09-08_10-19-50

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Related to #332592 (closed)

Edited by Etienne Baqué

Merge request reports