Skip to content

Imported group membership not reflected in child project members API

Summary

  1. Create a group and a subgroup, let's say group1 and group1/group2
  2. Import another group, let's say imported-group, into either of them
  3. Create a project under group1/group2, let's say project
  4. Check membership API for project members (projectID/members/all). This should list all project members including inherited from parent groups
  5. Observe that members of imported-group are missing from the API. This happens both with importing the group into group1 and group1/group2

Steps to reproduce

See above

Example Project

What is the current bug behavior?

Members from groups imported into parent groups in the project don't show up in the members API endpoint of the project. The membership itself works, as the imported members have permissions to do everything in the web UI. It's just an API problem.

What is the expected correct behavior?

When listing members/all, all members including ones from the imported groups are listed

Relevant logs and/or screenshots

Output of checks

This bug happens on GitLab.com

Possible fixes

@leopardm was helping with debugging the problem. Copying his full comment over:

I tried to see if a workaround to this could be a GraphQL query. I set up this structure:

abc123
    test-group (1 member)
        shared with group_of_people
        test-project
            shared with another_group_of_people
group_of_people (6 members)
another_group_of_people (1 member)

I tried this query:

query {
	project(fullPath: "abc123/test-group/test-project") {
    fullPath,
    projectMembers(relations:[INVITED_GROUPS, DIRECT, INHERITED, DESCENDANTS]){
      nodes{
        id,
        user{
          name,
          publicEmail,
          ...
        }
      }
    }
  }
}

And was able to retrieve all the members of the project, including those belonging to the directly invited groups. However, it still did not include any members inherited into test-group. Also, it appears the INVITED_GROUPS relation is not present when using GraphQL to query a group and all of its members.

It looks like the lack of a concept of INVITED_GROUPS at the group level is causing this problem, in both the REST API and GraphQL API