Add latest changes from gitlab-org/gitlab@master

changelogs/unreleased/add-shard-label-to-queue-timing-histogram-metric.yml

+---
+title: Add 'shard' label for 'job_queue_duration_seconds' metric
+merge_request: 23536
+author:
+type: changed

changelogs/unreleased/georgekoltsov-fix-group-members-owner-access-level.yml

+---
+title: Fix an issue with Group Import members with Owner access level being imported with Maintainer access level. Owner access level is now preserved
+merge_request: 25595
+author:
+type: fixed

db/migrate/20200221105436_update_application_setting_npm_package_requests_forwarding_default.rb

+# frozen_string_literal: true
+
+class UpdateApplicationSettingNpmPackageRequestsForwardingDefault < ActiveRecord::Migration[6.0]
+  DOWNTIME = false
+
+  def up
+    change_column_default :application_settings, :npm_package_requests_forwarding, true
+
+    execute('UPDATE application_settings SET npm_package_requests_forwarding = TRUE')
+  end
+
+  def down
+    change_column_default :application_settings, :npm_package_requests_forwarding, false
+
+    execute('UPDATE application_settings SET npm_package_requests_forwarding = FALSE')
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
-ActiveRecord::Schema.define(version: 2020_02_20_180944) do
+ActiveRecord::Schema.define(version: 2020_02_21_105436) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "pg_trgm"
@@ -351,7 +351,7 @@ ActiveRecord::Schema.define(version: 2020_02_20_180944) do
     t.boolean "prevent_merge_requests_committers_approval", default: false, null: false
     t.boolean "email_restrictions_enabled", default: false, null: false
     t.text "email_restrictions"
-    t.boolean "npm_package_requests_forwarding", default: false, null: false
+    t.boolean "npm_package_requests_forwarding", default: true, null: false
     t.index ["custom_project_templates_group_id"], name: "index_application_settings_on_custom_project_templates_group_id"
     t.index ["file_template_project_id"], name: "index_application_settings_on_file_template_project_id"
     t.index ["instance_administration_project_id"], name: "index_applicationsettings_on_instance_administration_project_id"

doc/user/project/integrations/gitlab_slack_application.md

@@ -3,9 +3,9 @@
 NOTE: **Note:**
 The GitLab Slack application is only configurable for GitLab.com. It will **not**
 work for on-premises installations where you can configure the
-[Slack slash commands](slack_slash_commands.md) service instead. We're working
-with Slack on making this configurable for all GitLab installations, but there's
-no ETA.
+[Slack slash commands](slack_slash_commands.md) service instead. We're planning
+to make this configurable for all GitLab installations, but there's
+no ETA - see [#28164](https://gitlab.com/gitlab-org/gitlab/issues/28164).
 It was first introduced in GitLab 9.4 and distributed to Slack App Directory in
 GitLab 10.2.

doc/user/project/integrations/webhooks.md

@@ -174,7 +174,8 @@ X-Gitlab-Event: Push Hook
   "commits": [
     {
       "id": "b6568db1bc1dcd7f8b4d5a946b0b91f9dacd7327",
-      "message": "Update Catalan translation to e38cb41.",
+      "message": "Update Catalan translation to e38cb41.\n\nSee https://gitlab.com/gitlab-org/gitlab for more information",
+      "title": "Update Catalan translation to e38cb41.",
       "timestamp": "2011-12-12T14:27:31+02:00",
       "url": "http://example.com/mike/diaspora/commit/b6568db1bc1dcd7f8b4d5a946b0b91f9dacd7327",
       "author": {
@@ -188,6 +189,7 @@ X-Gitlab-Event: Push Hook
     {
       "id": "da1560886d4f094c3e6c9ef40349f7d38b5d27d7",
       "message": "fixed readme",
+      "title": "fixed readme",
       "timestamp": "2012-01-03T23:36:29+02:00",
       "url": "http://example.com/mike/diaspora/commit/da1560886d4f094c3e6c9ef40349f7d38b5d27d7",
       "author": {

doc/user/search/index.md

@@ -41,6 +41,7 @@ groups:
    - [Label](../project/labels.md)
    - My-reaction
    - Confidential
+   - Epic ([Introduced](https://gitlab.com/gitlab-org/gitlab/issues/195704) in GitLab 12.8)
    - Search for this text
 1. Select or type the operator to use for filtering the attribute. The following operators are
    available:

lib/api/entities/internal.rb → lib/api/entities/internal/pages/lookup_path.rb

@@ -8,11 +8,6 @@ module API
           expose :project_id, :access_control,
             :source, :https_only, :prefix
         end
-
-        class VirtualDomain < Grape::Entity
-          expose :certificate, :key
-          expose :lookup_paths, using: LookupPath
-        end
       end
     end
   end

lib/api/entities/internal/pages/virtual_domain.rb

+# frozen_string_literal: true
+
+module API
+  module Entities
+    module Internal
+      module Pages
+        class VirtualDomain < Grape::Entity
+          expose :certificate, :key
+          expose :lookup_paths, using: LookupPath
+        end
+      end
+    end
+  end
+end

lib/api/entities/internal/serverless/lookup_path.rb

+# frozen_string_literal: true
+
+module API
+  module Entities
+    module Internal
+      module Serverless
+        class LookupPath < Grape::Entity
+          expose :source
+        end
+      end
+    end
+  end
+end

lib/api/entities/internal/serverless/virtual_domain.rb

+# frozen_string_literal: true
+
+module API
+  module Entities
+    module Internal
+      module Serverless
+        class VirtualDomain < Grape::Entity
+          expose :certificate, :key
+          expose :lookup_paths, using: LookupPath
+        end
+      end
+    end
+  end
+end

lib/api/internal/pages.rb

@@ -24,13 +24,26 @@ module API
             requires :host, type: String, desc: 'The host to query for'
           end
           get "/" do
-            host = Namespace.find_by_pages_host(params[:host]) || PagesDomain.find_by_domain(params[:host])
-            no_content! unless host
-            virtual_domain = host.pages_virtual_domain
-            no_content! unless virtual_domain
-            present virtual_domain, with: Entities::Internal::Pages::VirtualDomain
+            serverless_domain_finder = ServerlessDomainFinder.new(params[:host])
+            if serverless_domain_finder.serverless?
+              # Handle Serverless domains
+              serverless_domain = serverless_domain_finder.execute
+              no_content! unless serverless_domain
+              virtual_domain = Serverless::VirtualDomain.new(serverless_domain)
+              no_content! unless virtual_domain
+              present virtual_domain, with: Entities::Internal::Serverless::VirtualDomain
+            else
+              # Handle Pages domains
+              host = Namespace.find_by_pages_host(params[:host]) || PagesDomain.find_by_domain(params[:host])
+              no_content! unless host
+
+              virtual_domain = host.pages_virtual_domain
+              no_content! unless virtual_domain
+
+              present virtual_domain, with: Entities::Internal::Pages::VirtualDomain
+            end
           end
         end
       end

lib/gitlab/ci/config/entry/bridge.rb

@@ -9,34 +9,21 @@ module Gitlab
         # defining a downstream project trigger.
         #
         class Bridge < ::Gitlab::Config::Entry::Node
-          include ::Gitlab::Config::Entry::Configurable
-          include ::Gitlab::Config::Entry::Attributable
-          include ::Gitlab::Config::Entry::Inheritable
-          ALLOWED_KEYS = %i[trigger stage allow_failure only except
-                            when extends variables needs rules].freeze
+          include ::Gitlab::Ci::Config::Entry::Processable
+          ALLOWED_KEYS = %i[trigger allow_failure when variables needs].freeze
           validations do
-            validates :config, allowed_keys: ALLOWED_KEYS
-            validates :config, presence: true
-            validates :name, presence: true
-            validates :name, type: Symbol
-            validates :config, disallowed_keys: {
-                in: %i[only except when start_in],
-                message: 'key may not be used with `rules`'
-              },
-              if: :has_rules?
+            validates :config, allowed_keys: ALLOWED_KEYS + PROCESSABLE_ALLOWED_KEYS
             with_options allow_nil: true do
               validates :when,
                 inclusion: { in: %w[on_success on_failure always],
                               message: 'should be on_success, on_failure or always' }
-              validates :extends, type: String
-              validates :rules, array_of_hashes: true
             end
             validate on: :composed do
-              unless trigger.present? || bridge_needs.present?
+              unless trigger_defined? || bridge_needs.present?
                 errors.add(:config, 'should contain either a trigger or a needs:pipeline')
               end
             end
@@ -58,32 +45,13 @@ module Gitlab
             inherit: false,
             metadata: { allowed_needs: %i[job bridge] }
-          entry :stage, ::Gitlab::Ci::Config::Entry::Stage,
-            description: 'Pipeline stage this job will be executed into.',
-            inherit: false
-
-          entry :only, ::Gitlab::Ci::Config::Entry::Policy,
-            description: 'Refs policy this job will be executed for.',
-            default: ::Gitlab::Ci::Config::Entry::Policy::DEFAULT_ONLY,
-            inherit: false
-
-          entry :except, ::Gitlab::Ci::Config::Entry::Policy,
-            description: 'Refs policy this job will be executed for.',
-            inherit: false
-
-          entry :rules, ::Gitlab::Ci::Config::Entry::Rules,
-            description: 'List of evaluable Rules to determine job inclusion.',
-            inherit: false,
-            metadata: {
-              allowed_when: %w[on_success on_failure always never manual delayed].freeze
-            }
-
           entry :variables, ::Gitlab::Ci::Config::Entry::Variables,
             description: 'Environment variables available for this job.',
             inherit: false
-          helpers(*ALLOWED_KEYS)
-          attributes(*ALLOWED_KEYS)
+          helpers :trigger, :needs, :variables
+
+          attributes :when, :allow_failure
           def self.matching?(name, config)
             !name.to_s.start_with?('.') &&
@@ -95,56 +63,20 @@ module Gitlab
             true
           end
-          def compose!(deps = nil)
-            super do
-              has_workflow_rules = deps&.workflow&.has_rules?
-
-              # If workflow:rules: or rules: are used
-              # they are considered not compatible
-              # with `only/except` defaults
-              #
-              # Context: https://gitlab.com/gitlab-org/gitlab/merge_requests/21742
-              if has_rules? || has_workflow_rules
-                # Remove only/except defaults
-                # defaults are not considered as defined
-                @entries.delete(:only) unless only_defined?
-                @entries.delete(:except) unless except_defined?
-              end
-            end
-          end
-
-          def has_rules?
-            @config&.key?(:rules)
-          end
-
-          def name
-            @metadata[:name]
-          end
-
           def value
-            { name: name,
+            super.merge(
               trigger: (trigger_value if trigger_defined?),
               needs: (needs_value if needs_defined?),
               ignore: !!allow_failure,
-              stage: stage_value,
-              when: when_value,
-              extends: extends_value,
+              when: self.when,
               variables: (variables_value if variables_defined?),
-              rules: (rules_value if has_rules?),
-              only: only_value,
-              except: except_value,
-              scheduling_type: needs_defined? && !bridge_needs ? :dag : :stage }.compact
+              scheduling_type: needs_defined? && !bridge_needs ? :dag : :stage
+            ).compact
           end
           def bridge_needs
             needs_value[:bridge] if needs_value
           end
-
-          private
-
-          def overwrite_entry(deps, key, current_entry)
-            deps.default[key] unless current_entry.specified?
-          end
         end
       end
     end

lib/gitlab/ci/config/entry/job.rb

@@ -8,33 +8,21 @@ module Gitlab
         # Entry that represents a concrete CI/CD job.
         #
         class Job < ::Gitlab::Config::Entry::Node
-          include ::Gitlab::Config::Entry::Configurable
-          include ::Gitlab::Config::Entry::Attributable
-          include ::Gitlab::Config::Entry::Inheritable
+          include ::Gitlab::Ci::Config::Entry::Processable
           ALLOWED_WHEN = %w[on_success on_failure always manual delayed].freeze
-          ALLOWED_KEYS = %i[tags script only except rules type image services
-                            allow_failure type stage when start_in artifacts cache
+          ALLOWED_KEYS = %i[tags script type image services
+                            allow_failure type when start_in artifacts cache
                             dependencies before_script needs after_script variables
-                            environment coverage retry parallel extends interruptible timeout
+                            environment coverage retry parallel interruptible timeout
                             resource_group release].freeze
           REQUIRED_BY_NEEDS = %i[stage].freeze
           validations do
-            validates :config, type: Hash
-            validates :config, allowed_keys: ALLOWED_KEYS
+            validates :config, allowed_keys: ALLOWED_KEYS + PROCESSABLE_ALLOWED_KEYS
             validates :config, required_keys: REQUIRED_BY_NEEDS, if: :has_needs?
-            validates :config, presence: true
             validates :script, presence: true
-            validates :name, presence: true
-            validates :name, type: Symbol
-            validates :config,
-              disallowed_keys: {
-                in: %i[only except when start_in],
-                message: 'key may not be used with `rules`'
-              },
-              if: :has_rules?
             validates :config,
               disallowed_keys: {
                 in: %i[release],
@@ -53,8 +41,6 @@ module Gitlab
               }
               validates :dependencies, array_of_strings: true
-              validates :extends, array_of_strings_or_string: true
-              validates :rules, array_of_hashes: true
               validates :resource_group, type: String
             end
@@ -81,10 +67,6 @@ module Gitlab
             description: 'Commands that will be executed in this job.',
             inherit: false
-          entry :stage, Entry::Stage,
-            description: 'Pipeline stage this job will be executed into.',
-            inherit: false
-
           entry :type, Entry::Stage,
             description: 'Deprecated: stage this job will be executed into.',
             inherit: false
@@ -125,22 +107,6 @@ module Gitlab
             description: 'Artifacts configuration for this job.',
             inherit: true
-          entry :only, Entry::Policy,
-            description: 'Refs policy this job will be executed for.',
-            default: ::Gitlab::Ci::Config::Entry::Policy::DEFAULT_ONLY,
-            inherit: false
-
-          entry :except, Entry::Policy,
-            description: 'Refs policy this job will be executed for.',
-            inherit: false
-
-          entry :rules, Entry::Rules,
-            description: 'List of evaluable Rules to determine job inclusion.',
-            inherit: false,
-            metadata: {
-              allowed_when: %w[on_success on_failure always never manual delayed].freeze
-            }
-
           entry :needs, Entry::Needs,
             description: 'Needs configuration for this job.',
             metadata: { allowed_needs: %i[job cross_dependency] },
@@ -162,13 +128,13 @@ module Gitlab
             description: 'This job will produce a release.',
             inherit: false
-          helpers :before_script, :script, :stage, :type, :after_script,
-                  :cache, :image, :services, :only, :except, :variables,
-                  :artifacts, :environment, :coverage, :retry, :rules,
-                  :parallel, :needs, :interruptible, :release, :tags
+          helpers :before_script, :script, :type, :after_script,
+                  :cache, :image, :services, :variables,
+                  :artifacts, :environment, :coverage, :retry,
+                  :needs, :interruptible, :release, :tags
           attributes :script, :tags, :allow_failure, :when, :dependencies,
-                     :needs, :retry, :parallel, :extends, :start_in, :rules,
+                     :needs, :retry, :parallel, :start_in,
                      :interruptible, :timeout, :resource_group, :release
           def self.matching?(name, config)
@@ -187,31 +153,9 @@ module Gitlab
               end
               @entries.delete(:type)
-
-              has_workflow_rules = deps&.workflow&.has_rules?
-
-              # If workflow:rules: or rules: are used
-              # they are considered not compatible
-              # with `only/except` defaults
-              #
-              # Context: https://gitlab.com/gitlab-org/gitlab/merge_requests/21742
-              if has_rules? || has_workflow_rules
-                # Remove only/except defaults
-                # defaults are not considered as defined
-                @entries.delete(:only) unless only_defined?
-                @entries.delete(:except) unless except_defined?
-              end
             end
           end
-          def name
-            @metadata[:name]
-          end
-
-          def value
-            @config.merge(to_hash.compact)
-          end
-
           def manual_action?
             self.when == 'manual'
           end
@@ -220,38 +164,27 @@ module Gitlab
             self.when == 'delayed'
           end
-          def has_rules?
-            @config.try(:key?, :rules)
-          end
-
           def ignored?
             allow_failure.nil? ? manual_action? : allow_failure
           end
-          private
-
-          def overwrite_entry(deps, key, current_entry)
-            deps.default[key] unless current_entry.specified?
-          end
-
-          def to_hash
-            { name: name,
+          def value
+            super.merge(
               before_script: before_script_value,
               script: script_value,
               image: image_value,
               services: services_value,
-              stage: stage_value,
               cache: cache_value,
               tags: tags_value,
-              only: only_value,
-              except: except_value,
-              rules: has_rules? ? rules_value : nil,
+              when: self.when,
+              start_in: self.start_in,
+              dependencies: dependencies,
               variables: variables_defined? ? variables_value : {},
               environment: environment_defined? ? environment_value : nil,
               environment_name: environment_defined? ? environment_value[:name] : nil,
               coverage: coverage_defined? ? coverage_value : nil,
               retry: retry_defined? ? retry_value : nil,
-              parallel: parallel_defined? ? parallel_value.to_i : nil,
+              parallel: has_parallel? ? parallel.to_i : nil,
               interruptible: interruptible_defined? ? interruptible_value : nil,
               timeout: has_timeout? ? ChronicDuration.parse(timeout.to_s) : nil,
               artifacts: artifacts_value,
@@ -260,7 +193,8 @@ module Gitlab
               ignore: ignored?,
               needs: needs_defined? ? needs_value : nil,
               resource_group: resource_group,
-              scheduling_type: needs_defined? ? :dag : :stage }
+              scheduling_type: needs_defined? ? :dag : :stage
+            ).compact
           end
         end
       end

lib/gitlab/ci/config/entry/processable.rb

+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    class Config
+      module Entry
+        ##
+        # Entry that represents a CI/CD Processable (a job)
+        #
+        module Processable
+          extend ActiveSupport::Concern
+
+          include ::Gitlab::Config::Entry::Configurable
+          include ::Gitlab::Config::Entry::Attributable
+          include ::Gitlab::Config::Entry::Inheritable
+
+          PROCESSABLE_ALLOWED_KEYS = %i[extends stage only except rules].freeze
+
+          included do
+            validations do
+              validates :config, presence: true
+              validates :name, presence: true
+              validates :name, type: Symbol
+
+              validates :config, disallowed_keys: {
+                  in: %i[only except when start_in],
+                  message: 'key may not be used with `rules`'
+                },
+                if: :has_rules?
+
+              with_options allow_nil: true do
+                validates :extends, array_of_strings_or_string: true
+                validates :rules, array_of_hashes: true
+              end
+            end
+
+            entry :stage, Entry::Stage,
+              description: 'Pipeline stage this job will be executed into.',
+              inherit: false
+
+            entry :only, ::Gitlab::Ci::Config::Entry::Policy,
+              description: 'Refs policy this job will be executed for.',
+              default: ::Gitlab::Ci::Config::Entry::Policy::DEFAULT_ONLY,
+              inherit: false
+
+            entry :except, ::Gitlab::Ci::Config::Entry::Policy,
+              description: 'Refs policy this job will be executed for.',
+              inherit: false
+
+            entry :rules, ::Gitlab::Ci::Config::Entry::Rules,
+              description: 'List of evaluable Rules to determine job inclusion.',
+              inherit: false,
+              metadata: {
+                allowed_when: %w[on_success on_failure always never manual delayed].freeze
+              }
+
+            helpers :stage, :only, :except, :rules
+
+            attributes :extends, :rules
+          end
+
+          def compose!(deps = nil)
+            super do
+              has_workflow_rules = deps&.workflow&.has_rules?
+
+              # If workflow:rules: or rules: are used
+              # they are considered not compatible
+              # with `only/except` defaults
+              #
+              # Context: https://gitlab.com/gitlab-org/gitlab/merge_requests/21742
+              if has_rules? || has_workflow_rules
+                # Remove only/except defaults
+                # defaults are not considered as defined
+                @entries.delete(:only) unless only_defined? # rubocop:disable Gitlab/ModuleWithInstanceVariables
+                @entries.delete(:except) unless except_defined? # rubocop:disable Gitlab/ModuleWithInstanceVariables
+              end
+
+              yield if block_given?
+            end
+          end
+
+          def name
+            metadata[:name]
+          end
+
+          def overwrite_entry(deps, key, current_entry)
+            deps.default[key] unless current_entry.specified?
+          end
+
+          def value
+            { name: name,
+              stage: stage_value,
+              extends: extends,
+              rules: rules_value,
+              only: only_value,
+              except: except_value }.compact
+          end
+        end
+      end
+    end
+  end
+end

lib/gitlab/ci/config/entry/root.rb

@@ -67,7 +67,9 @@ module Gitlab
           entry :workflow, Entry::Workflow,
             description: 'List of evaluable rules to determine Pipeline status'
-          helpers :default, :jobs, :stages, :types, :variables, :workflow
+          helpers :default, :stages, :types, :variables, :workflow
+
+          helpers :jobs, dynamic: true
           delegate :before_script_value,
                    :image_value,

lib/gitlab/config/entry/configurable.rb

@@ -75,6 +75,8 @@ module Gitlab
           # rubocop: disable CodeReuse/ActiveRecord
           def entry(key, entry, description: nil, default: nil, inherit: nil, reserved: nil, metadata: {})
+            raise ArgumentError, "Entry #{key} already defined" if @nodes.to_h[key.to_sym]
+
             factory = ::Gitlab::Config::Entry::Factory.new(entry)
               .with(description: description)
               .with(default: default)
@@ -86,8 +88,16 @@ module Gitlab
           end
           # rubocop: enable CodeReuse/ActiveRecord
-          def helpers(*nodes)
+          def helpers(*nodes, dynamic: false)
             nodes.each do |symbol|
+              if method_defined?("#{symbol}_defined?") || method_defined?("#{symbol}_value")
+                raise ArgumentError, "Method #{symbol}_defined? or #{symbol}_value already defined"
+              end
+
+              unless @nodes.to_h[symbol]
+                raise ArgumentError, "Entry for #{symbol} is undefined" unless dynamic
+              end
+
               define_method("#{symbol}_defined?") do
                 entries[symbol]&.specified?
               end

lib/gitlab/danger/helper.rb

@@ -128,9 +128,12 @@ module Gitlab
         %r{\A(ee/)?db/(?!fixtures)[^/]+} => :database,
         %r{\A(ee/)?lib/gitlab/(database|background_migration|sql|github_import)(/|\.rb)} => :database,
         %r{\A(app/models/project_authorization|app/services/users/refresh_authorized_projects_service)(/|\.rb)} => :database,
+        %r{\A(ee/)?app/finders/} => :database,
         %r{\Arubocop/cop/migration(/|\.rb)} => :database,
         %r{\A(\.gitlab-ci\.yml\z|\.gitlab\/ci)} => :engineering_productivity,
+        %r{\A\.overcommit\.yml\.example\z} => :engineering_productivity,
+        %r{\Atooling/overcommit/} => :engineering_productivity,
         %r{Dangerfile\z} => :engineering_productivity,
         %r{\A(ee/)?(danger/|lib/gitlab/danger/)} => :engineering_productivity,
         %r{\A(ee/)?scripts/} => :engineering_productivity,

lib/gitlab/gon_helper.rb

@@ -46,6 +46,7 @@ module Gitlab
       push_frontend_feature_flag(:monaco_snippets, default_enabled: false)
       push_frontend_feature_flag(:monaco_blobs, default_enabled: false)
       push_frontend_feature_flag(:monaco_ci, default_enabled: false)
+      push_frontend_feature_flag(:snippets_edit_vue, default_enabled: false)
     end
     # Exposes the state of a feature flag to the frontend code.

lib/gitlab/import_export/members_mapper.rb

@@ -51,7 +51,7 @@ module Gitlab
         @importable.members.destroy_all # rubocop: disable DestroyAll
-        relation_class.create!(user: @user, access_level: relation_class::MAINTAINER, source_id: @importable.id, importing: true)
+        relation_class.create!(user: @user, access_level: highest_access_level, source_id: @importable.id, importing: true)
       rescue => e
         raise e, "Error adding importer user to #{@importable.class} members. #{e.message}"
       end
@@ -59,7 +59,7 @@ module Gitlab
       def user_already_member?
         member = @importable.members&.first
-        member&.user == @user && member.access_level >= relation_class::MAINTAINER
+        member&.user == @user && member.access_level >= highest_access_level
       end
       def add_team_member(member, existing_user = nil)
@@ -72,7 +72,7 @@ module Gitlab
         parsed_hash(member).merge(
           'source_id' => @importable.id,
           'importing' => true,
-          'access_level' => [member['access_level'], relation_class::MAINTAINER].min
+          'access_level' => [member['access_level'], highest_access_level].min
         ).except('user_id')
       end
@@ -97,6 +97,12 @@ module Gitlab
           GroupMember
         end
       end
+
+      def highest_access_level
+        return relation_class::OWNER if relation_class == GroupMember
+
+        relation_class::MAINTAINER
+      end
     end
   end
 end