3 files changed, 30 insertions, 2 deletions
diff --git a/app/models/deploy_key.rb b/app/models/deploy_key.rb
index 570f5e91c13..85d52d558cd 100644
--- a/app/models/deploy_key.rb
+++ b/app/models/deploy_key.rb
@@ -7,6 +7,7 @@
 #  created_at  :datetime
 #  updated_at  :datetime
 #  key         :text
+#  public      :boolean          default(FALSE)
 #  title       :string(255)
 #  type        :string(255)
 #  fingerprint :string(255)
@@ -17,4 +18,21 @@ class DeployKey < Key
   has_many :projects, through: :deploy_keys_projects
 
   scope :in_projects, ->(projects) { joins(:deploy_keys_projects).where('deploy_keys_projects.project_id in (?)', projects) }
+  scope :are_public,  -> { where(public: true) }
+
+  def private?
+    !public?
+  end
+
+  def orphaned?
+    self.deploy_keys_projects.length == 0
+  end
+
+  def almost_orphaned?
+    self.deploy_keys_projects.length == 1
+  end
+
+  def destroyed_when_orphaned?
+    self.private?
+  end
 end
diff --git a/app/models/deploy_keys_project.rb b/app/models/deploy_keys_project.rb
index 7e88903b9af..18db521741f 100644
--- a/app/models/deploy_keys_project.rb
+++ b/app/models/deploy_keys_project.rb
@@ -22,6 +22,8 @@ class DeployKeysProject < ActiveRecord::Base
   private
 
   def destroy_orphaned_deploy_key
-    self.deploy_key.destroy if self.deploy_key.deploy_keys_projects.length == 0
+    return unless self.deploy_key.destroyed_when_orphaned? && self.deploy_key.orphaned?
+    
+    self.deploy_key.destroy
   end
 end
diff --git a/app/models/user.rb b/app/models/user.rb
index e2b6757bc4d..a40111e62dd 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -414,8 +414,16 @@ class User < ActiveRecord::Base
     @ldap_identity ||= identities.find_by(["provider LIKE ?", "ldap%"])
   end
 
+  def project_deploy_keys
+    DeployKey.in_projects(self.authorized_projects.pluck(:id))
+  end
+
   def accessible_deploy_keys
-    DeployKey.in_projects(self.authorized_projects.pluck(:id)).uniq
+    @accessible_deploy_keys ||= begin
+      key_ids = project_deploy_keys.pluck(:id)
+      key_ids.push(*DeployKey.are_public.pluck(:id))
+      DeployKey.where(id: key_ids)
+    end
   end
 
   def created_by