1 files changed, 121 insertions, 0 deletions
diff --git a/lib/gitlab/project_authorizations.rb b/lib/gitlab/project_authorizations.rb
new file mode 100644
index 00000000000..a9270cd536e
--- /dev/null
+++ b/lib/gitlab/project_authorizations.rb
@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+# This class relies on Common Table Expressions to efficiently get all data,
+# including data for nested groups.
+module Gitlab
+  class ProjectAuthorizations
+    attr_reader :user
+
+    # user - The User object for which to calculate the authorizations.
+    def initialize(user)
+      @user = user
+    end
+
+    def calculate
+      cte = recursive_cte
+      cte_alias = cte.table.alias(Group.table_name)
+      projects = Project.arel_table
+      links = ProjectGroupLink.arel_table
+
+      relations = [
+        # The project a user has direct access to.
+        user.projects.select_for_project_authorization,
+
+        # The personal projects of the user.
+        user.personal_projects.select_as_maintainer_for_project_authorization,
+
+        # Projects that belong directly to any of the groups the user has
+        # access to.
+        Namespace
+          .unscoped
+          .select([alias_as_column(projects[:id], 'project_id'),
+                   cte_alias[:access_level]])
+          .from(cte_alias)
+          .joins(:projects),
+
+        # Projects shared with any of the namespaces the user has access to.
+        Namespace
+          .unscoped
+          .select([
+            links[:project_id],
+            least(cte_alias[:access_level], links[:group_access], 'access_level')
+          ])
+          .from(cte_alias)
+          .joins('INNER JOIN project_group_links ON project_group_links.group_id = namespaces.id')
+          .joins('INNER JOIN projects ON projects.id = project_group_links.project_id')
+          .joins('INNER JOIN namespaces p_ns ON p_ns.id = projects.namespace_id')
+          .where('p_ns.share_with_group_lock IS FALSE')
+      ]
+
+      ProjectAuthorization
+        .unscoped
+        .with
+        .recursive(cte.to_arel)
+        .select_from_union(relations)
+    end
+
+    private
+
+    # Builds a recursive CTE that gets all the groups the current user has
+    # access to, including any nested groups.
+    def recursive_cte
+      cte = Gitlab::SQL::RecursiveCTE.new(:namespaces_cte)
+      members = Member.arel_table
+      namespaces = Namespace.arel_table
+
+      # Namespaces the user is a member of.
+      cte << user.groups
+        .select([namespaces[:id], members[:access_level]])
+        .except(:order)
+
+      # Sub groups of any groups the user is a member of.
+      cte << Group.select([
+          namespaces[:id],
+          greatest(members[:access_level], cte.table[:access_level], 'access_level')
+        ])
+        .joins(join_cte(cte))
+        .joins(join_members)
+        .except(:order)
+
+      cte
+    end
+
+    # Builds a LEFT JOIN to join optional memberships onto the CTE.
+    def join_members
+      members = Member.arel_table
+      namespaces = Namespace.arel_table
+
+      cond = members[:source_id]
+        .eq(namespaces[:id])
+        .and(members[:source_type].eq('Namespace'))
+        .and(members[:requested_at].eq(nil))
+        .and(members[:user_id].eq(user.id))
+
+      Arel::Nodes::OuterJoin.new(members, Arel::Nodes::On.new(cond))
+    end
+
+    # Builds an INNER JOIN to join namespaces onto the CTE.
+    def join_cte(cte)
+      namespaces = Namespace.arel_table
+      cond = cte.table[:id].eq(namespaces[:parent_id])
+
+      Arel::Nodes::InnerJoin.new(cte.table, Arel::Nodes::On.new(cond))
+    end
+
+    def greatest(left, right, column_alias)
+      sql_function('GREATEST', [left, right], column_alias)
+    end
+
+    def least(left, right, column_alias)
+      sql_function('LEAST', [left, right], column_alias)
+    end
+
+    def sql_function(name, args, column_alias)
+      alias_as_column(Arel::Nodes::NamedFunction.new(name, args), column_alias)
+    end
+
+    def alias_as_column(value, alias_to)
+      Arel::Nodes::As.new(value, Arel::Nodes::SqlLiteral.new(alias_to))
+    end
+  end
+end