Fix users autocomplete in a subgroup

We should include users who have access from parent groups, not just direct
members of the current group.

3 files changed, 21 insertions, 1 deletions

diff --git a/app/finders/autocomplete_users_finder.rb b/app/finders/autocomplete_users_finder.rb
index b8f52e31926..c3f5358b577 100644
--- a/app/finders/autocomplete_users_finder.rb
+++ b/app/finders/autocomplete_users_finder.rb
@@ -45,7 +45,7 @@ class AutocompleteUsersFinder
 
   def find_users
     return users_from_project if project
-    return group.users if group
+    return group.users_with_parents if group
     return User.all if current_user
 
     User.none
diff --git a/changelogs/unreleased/fix-subgroup-autocomplete.yml b/changelogs/unreleased/fix-subgroup-autocomplete.yml
new file mode 100644
index 00000000000..4baa2b02f77
--- /dev/null
+++ b/changelogs/unreleased/fix-subgroup-autocomplete.yml
@@ -0,0 +1,5 @@
+---
+title: Fix user autocomplete in subgroups
+merge_request:
+author:
+type: fixed
diff --git a/spec/finders/autocomplete_users_finder_spec.rb b/spec/finders/autocomplete_users_finder_spec.rb
index 684af74d750..dcf9111776e 100644
--- a/spec/finders/autocomplete_users_finder_spec.rb
+++ b/spec/finders/autocomplete_users_finder_spec.rb
@@ -42,6 +42,21 @@ describe AutocompleteUsersFinder do
       it { is_expected.to match_array([user1]) }
     end
 
+    context 'when passed a subgroup', :nested_groups do
+      let(:grandparent) { create(:group, :public) }
+      let(:parent) { create(:group, :public, parent: grandparent) }
+      let(:child) { create(:group, :public, parent: parent) }
+      let(:group) { parent }
+
+      let!(:grandparent_user) { create(:group_member, :developer, group: grandparent).user }
+      let!(:parent_user) { create(:group_member, :developer, group: parent).user }
+      let!(:child_user) { create(:group_member, :developer, group: child).user }
+
+      it 'includes users from parent groups as well' do
+        expect(subject).to match_array([grandparent_user, parent_user])
+      end
+    end
+
     it { is_expected.to match_array([user1, external_user, omniauth_user, current_user]) }
 
     context 'when filtered by search' do