Split access requests out of memberships
Prior discussions:
- https://gitlab.com/gitlab-org/gitlab-ce/issues/21650
- https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/1994
Currently, the members table tracks two states that, I believe, should be split out:
- Invitation to join a group or project
- Request to join a group or project
Moving them into separate access_requests
and invitations
tables makes it much harder to mistakenly count one of these rows as a current, active membership. There's also data loss at the moment when an access request is granted, which could be solved at the same time (request_at is just set to nil).
We treat invitations as current, active memberships at the moment, which I believe is inappropriate, but this issue is focusing on access requests, as they are the main security concern.