Allow group owner to enable runners from subgroups (#41981)

3 files changed, 32 insertions, 5 deletions

diff --git a/app/models/user.rb b/app/models/user.rb
index 2b95be3f888..01ca1446376 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -955,6 +955,10 @@ class User < ActiveRecord::Base
     Gitlab::GroupHierarchy.new(owned_and_master_groups).base_and_descendants
   end
 
+  def manageable_group_projects
+    Project.where(namespace: manageable_groups)
+  end
+
   def namespaces
     namespace_ids = groups.pluck(:id)
     namespace_ids.push(namespace.id)
@@ -1205,12 +1209,15 @@ class User < ActiveRecord::Base
   end
 
   def ci_projects_union
-    scope  = { access_level: [Gitlab::Access::MASTER, Gitlab::Access::OWNER] }
-    groups = groups_projects.where(members: scope)
-    other  = projects.where(members: scope)
+    manageable_other_projects = projects.where(members: {
+      access_level: [Gitlab::Access::MASTER, Gitlab::Access::OWNER]
+    })
 
-    Gitlab::SQL::Union.new([personal_projects.select(:id), groups.select(:id),
-                            other.select(:id)])
+    Gitlab::SQL::Union.new([
+      manageable_group_projects.select(:id),
+      personal_projects.select(:id),
+      manageable_other_projects.select(:id)
+    ])
   end
 
   # Added according to https://github.com/plataformatec/devise/blob/7df57d5081f9884849ca15e4fde179ef164a575f/README.md#activejob-integration
diff --git a/changelogs/unreleased/41981-allow-group-owner-to-enable-runners-from-subgroups.yml b/changelogs/unreleased/41981-allow-group-owner-to-enable-runners-from-subgroups.yml
new file mode 100644
index 00000000000..30481e7af84
--- /dev/null
+++ b/changelogs/unreleased/41981-allow-group-owner-to-enable-runners-from-subgroups.yml
@@ -0,0 +1,5 @@
+---
+title: 'Allow group owner to enable runners from subgroups (#41981)'
+merge_request: 18009
+author:
+type: fixed
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 73266c0085f..35db7616efb 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -1850,6 +1850,21 @@ describe User do
 
       it_behaves_like :member
     end
+
+    context 'with subgroup with different owner for project runner', :nested_groups do
+      let(:group) { create(:group) }
+      let(:another_user) { create(:user) }
+      let(:subgroup) { create(:group, parent: group) }
+      let(:project) { create(:project, group: subgroup) }
+
+      def add_user(access)
+        group.add_user(user, access)
+        group.add_user(another_user, :owner)
+        subgroup.add_user(another_user, :owner)
+      end
+
+      it_behaves_like :member
+    end
   end
 
   describe '#projects_with_reporter_access_limited_to' do