Skip to content

Advanced search: User filtering by group or project

Problem to solve

Advanced user search is currently restricted to the global level (group and project level user searches are basic). In order to extend advanced search to group and project levels, we need to perform filtering by namespaces to return a subset of matching users for the selected group/project.

Background

Basic group filtering issue

Currently basic search uses this method call to determine valid users for groups. This method takes avg 15 seconds to load which leads to many timeouts in user group searches, mostly due the complexity of retrieving valid groups for the search. One of the purposes of moving to elasticsearch is to decrease the response time of searches so we need a better way to get the right users for group filtering. Project filtering is simple and doesn't have performance issues.

Elasticsearch

A field called namespace_ancestry_ids is indexed as part of user documents in elasticsearch. The field has a dash-separated string of namespace ancestors e.g.:

  • ["22-","70-78-79-"] when the user is a member of group 22 and group 79 which has ancestors 78 and 70.
  • ["12-27-p86"] when the user is a member of project 86 which belongs to group 27 with ancestor 12.

Requirements

Implement group and project level advanced user search so that the response time is decreased of such searches. Release the simplest viable implementation to keep complexity low, as opposed to the current complex filtering.

Group-level filtering

For a group x with namespaces y and z, a user must match either:

  • A prefix on the full namespace i.e. z-y-x-
  • Any exact term of ancestors i.e. z-y- or z-

* We make the assumption that if a user can select a group, they have access to the group.

Project-level filtering

For a project A in group x with namespaces y and z, a user must match either:

  • The exact term of the project namespace ancestry i.e. z-y-x-pA-
  • Any exact term of the project's ancestors i.e. z-y-x-, z-y- or z-

* We make the assumption that if a user can select a project, they have access to the project.

Also replace https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/services/concerns/search/elasticsearchable.rb#L21 with user-actor feature flag(s) so that we can enable project and group filtering for advanced user search.

Note: #386558 (closed) should be done fairly soon after this work has been released to make sure the ancestry field is kept up to date in elasticsearch.

Metrics to track

  • Response time of group-level user searches
  • Response time of project-level user searches
  • Frequency of timeouts for group-level user searches for basic vs. advanced