People from one subgroup cannot tag people from other subgroup within the same repository of a same parent group
Summary
With release of #24822 (closed) we got into situation when our subgroup members cannot tag each other.
Consider this group structure
- GoOutNet
- GoOutNet - Developers
- GoOutNet - Marketing
- GoOutNet - Content
Then consider a project, where all the subgroups are assigned. Person from Developers is unable to mention people from Marketing.
I believe the security release was supposed to handle completely private groups, but these are groups within our organization and they should be able to tag each other.
I have previously described the problem in #35557 (closed), after which I was told this was caused by the security release.
Steps to reproduce
- See repository https://gitlab.com/GoOutNet/IssueTracker/-/project_members where the groups are assigned
- Login as @nowakova from GoOutNet/Content
- Try to create a new issue in IssueTracker repository
- Try to tag @knyttl - the tag autocompletion will work
- Try to tag @lenakoehler - the tag autocompletion will not work even though her group is added to the repository
Example Project
https://gitlab.com/GoOutNet/IssueTracker/
What is the current bug behavior?
People cannot tag people from other groups in same repository.
What is the expected correct behavior?
People should be able to tag each other.
Output of checks
This happens on gitlab.com
Proposal
Two things are affected
- app/services/projects/participants_service.rb - it's currently showing
public_or_visible_to_user
- app/services/groups/participants_service.rb - it's currently showing
group.direct_and_indirect_users
.
Both needs to be modified to show private group members, ideally only to other project members
NOTE: Maybe re-use Autocomplete::UsersFinder
?