### Summary Invited group is not shown in "Allowed to" dropdowns for protected tags, environments, and branches when it is checked by an indirect member of a group. ### Steps to reproduce - Create a group `group-A`, subgroup `group-AA` and a project `project-A` inside it - Create a subgroup `group-AB` inside `group-A` - Add some members to `group-A` as Maintainers or Owners and make sure that they are also shown as members in both subgroups, but they are not direct members of these subgroups - In the project `project-A`, go to **Project Information > Members > Invite group**, and invite `group-AB` - In the project `project-A`, go to **Repository > Tags** and create a tag - As a direct member of `group-AB` or as Administrator, go to **Settings > Repository > Protected tags**, expand `Allowed to create` dropdown - the group `group-AB` is shown in the dropdown - Impersonate as one of the users who is a member of `group-AB` (but not a direct member), go to **Settings > Repository > Protected tags**, expand `Allowed to create` dropdown - the group `group-AB` **will not be shown** in the dropdown - Same things happens for projected environments in **Settings > CI/CD > Protected environments > Allowed to deploy** & for protected branches in **Settings > Repository > Protected branches > Allowed to merge / Allowed to push** ### What is the current *bug* behavior? The invited group is not shown in `Allowed to *` dropdowns for protected tags, environments, and branches when it is checked by an indirect member of a group. ### What is the expected *correct* behavior? The invited group should be shown in `Allowed to *` dropdowns for protected tags, environments, and branches in all cases. ### Workaround Log in as the direct member of the subgroup `group-AB`: then you will be able to see the invited group in the list for protected tags, branches, and environments. ### Relevant logs and/or screenshots n/a Reproduced on a self-managed instance, but it was also reported by one of our customers for GitLab.com: [internal ZD ticket](https://gitlab.zendesk.com/agent/tickets/247799). ### Output of checks #### Results of GitLab environment info <details> <summary>Expand for output related to GitLab environment info</summary> <pre> System information System: Ubuntu 20.04 Proxy: no Current User: git Using RVM: no Ruby Version: 2.7.4p191 Gem Version: 3.1.4 Bundler Version:2.1.4 Rake Version: 13.0.6 Redis Version: 6.0.14 Git Version: 2.33.0. Sidekiq Version:6.2.2 Go Version: unknown GitLab information Version: 14.4.0-ee Revision: 19c719febd7 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: PostgreSQL DB Version: 12.7 URL: https://gitlabhost.tld HTTP Clone URL: https://gitlabhost.tld/some-group/some-project.git SSH Clone URL: git@gitlabhost.tld:some-group/some-project.git Elasticsearch: no Geo: no Using LDAP: yes Using Omniauth: yes Omniauth Providers: GitLab Shell Version: 13.21.1 Repository storage paths: - default: /var/opt/gitlab/git-data/repositories GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell Git: /opt/gitlab/embedded/bin/git </pre> </details> #### Results of GitLab application Check <details> <summary>Expand for output related to the GitLab application check</summary> <pre> Checking GitLab subtasks ... Checking GitLab Shell ... GitLab Shell: ... GitLab Shell version >= 13.21.1 ? ... OK (13.21.1) Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Internal API available: OK Redis available via internal API: OK gitlab-shell self-check successful Checking GitLab Shell ... Finished Checking Gitaly ... Gitaly: ... default ... OK Checking Gitaly ... Finished Checking Sidekiq ... Sidekiq: ... Running? ... yes Number of Sidekiq processes (cluster/worker) ... 1/1 Checking Sidekiq ... Finished Checking Incoming Email ... Incoming Email: ... Reply by email is disabled in config/gitlab.yml Checking Incoming Email ... Finished Checking LDAP ... LDAP: ... Server: ldapmain Exception: getaddrinfo: Name or service not known Checking LDAP ... Finished Checking GitLab App ... Git configured correctly? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... yes Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) Projects have namespace: ... ... Redis version >= 5.0.0? ... yes Ruby version >= 2.7.2 ? ... yes (2.7.4) Git version >= 2.33.0 ? ... yes (2.33.0) Git user has default SSH configuration? ... yes Active users: ... 51 Is authorized keys file accessible? ... yes GitLab configured to store new projects in hashed storage? ... yes All projects are in hashed storage? ... yes Elasticsearch version 7.x (6.4 - 6.x deprecated to be removed in 13.8)? ... skipped (elasticsearch is disabled) Checking GitLab App ... Finished Checking GitLab subtasks ... Finished </pre> </details>