Inherit permissions from parent group

What does this MR do?

Includes group parents into group access policy

Are there points in the code the reviewer needs to double check?

no

Why was this MR needed?

It allows access to nested group if you have membership in one of it parents

Screenshots (if relevant)

no

Does this MR meet the acceptance criteria?

• Changelog entry added
• Documentation created/updated
• API support added
• Tests
  • Added for this feature/bug
  • All builds are passing
• Conform by the merge request performance guides
• Conform by the style guides
• Branch has no merge conflicts with master (if it does - rebase it please)
• Squashed related commits together

What are the relevant issue numbers?

https://gitlab.com/gitlab-org/gitlab-ce/issues/2772

mentioned in issue #2772 (closed)

added 8 commits

• 6328f26c - Show full path in header UI for nested groups/projects
• 8128ce30 - Show full path for nested groups at dashboard groups list
• 5c06875c - Use full group name for admin group index and show pages
• d806230f - Add parents method to Namespace
• 78115dc1 - Use full_name for Group in UI
• f8a17a38 - Add tests for Namespace#full_name method
• 82f9957d - Refactor Namespace#parents method
• 34780f59 - Include group parents into read access for project and group

Compare with previous version

added 315 commits

• 34780f59...b1120fc3 - 314 commits from branch master
• 74629ba2 - Include group parents into read access for project and group

Compare with previous version

added 1 commit

• e0ba4260 - Include group parents into read access for project and group

Compare with previous version

added 178 commits

• e0ba4260...a50cd9eb - 177 commits from branch master
• 77af5c33 - Include group parents into read access for project and group

Compare with previous version

added 178 commits

• e0ba4260...a50cd9eb - 177 commits from branch master
• 77af5c33 - Include group parents into read access for project and group

Compare with previous version

added 1 commit

• f0cd3868 - Include group parents into read access for project and group

Compare with previous version

marked the task Squashed related commits together as completed

marked the task Branch has no merge conflicts with master (if it does - rebase it please) as completed

marked the task Conform by the style guides as completed

unmarked as a Work In Progress

marked the task Conform by the merge request performance guides as completed

@rymai please review

assigned to @rymai

@rspeicher please review

assigned to @rspeicher

added 509 commits

• f0cd3868...645412b5 - 508 commits from branch master
• 7b4b3d5f - Include group parents into read access for project and group

Compare with previous version

@rspeicher @smcgivern I know we are all busy with holidays and release. But if one of you have time today/tomorrow to review it I would be so happy. please

This seems too simple! Maybe it is all we need - I'd love it if that was the case. I have some questions:

1. Does Users::RefreshAuthorizedProjectsService handle this properly?
2. What about project group links?
3. How do we find out which groups you have access to?

assigned to @dzaporozhets

This seems too simple!

@smcgivern I don't like huge merge requests so prefer to implement isolated parts. This one is focused on group access policy. More is coming.

added 1 commit

• 9f39953e - Improve Group#users_with_parents method

Compare with previous version

resolved all discussions

Does Users::RefreshAuthorizedProjectsService handle this properly?

@smcgivern I will make tests to see how it handles nested groups in separate MR

What about project group links?

separate MR

How do we find out which groups you have access to?

by collection your membership from nested group up to parent group. If you are member of any - you have access.

enabled an automatic merge when the pipeline for 9f39953e succeeds

mentioned in merge request !8308 (merged)

merged

mentioned in commit c595b418

by collection your membership from nested group up to parent group. If you are member of any - you have access.

With this question I meant: how can I enumerate all the groups someone has access to?

@smcgivern you get groups via membership. Then get the rest from routes table (everything that has authorized groups paths as prefix)