Add latest changes from gitlab-org/gitlab@master

2 files changed, 31 insertions, 0 deletions

diff --git a/app/models/members/group_member.rb b/app/models/members/group_member.rb
index ab044b80133..a13133c90e9 100644
--- a/app/models/members/group_member.rb
+++ b/app/models/members/group_member.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 class GroupMember < Member
+  extend ::Gitlab::Utils::Override
   include FromUnion
   include CreatedAtFilterable
 
@@ -49,6 +50,19 @@ class GroupMember < Member
     { group: group }
   end
 
+  override :refresh_member_authorized_projects
+  def refresh_member_authorized_projects
+    # Here, `destroyed_by_association` will be present if the
+    # GroupMember is being destroyed due to the `dependent: :destroy`
+    # callback on Group. In this case, there is no need to refresh the
+    # authorizations, because whenever a Group is being destroyed,
+    # its projects are also destroyed, so the removal of project_authorizations
+    # will happen behind the scenes via DB foreign keys anyway.
+    return if destroyed_by_association.present?
+
+    super
+  end
+
   private
 
   def access_level_inclusion
diff --git a/app/models/members/project_member.rb b/app/models/members/project_member.rb
index 8ea12a043d4..49144d9dbf3 100644
--- a/app/models/members/project_member.rb
+++ b/app/models/members/project_member.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 class ProjectMember < Member
+  extend ::Gitlab::Utils::Override
   SOURCE_TYPE = 'Project'
 
   belongs_to :project, foreign_key: 'source_id'
@@ -89,6 +90,22 @@ class ProjectMember < Member
     { project: project }
   end
 
+  override :refresh_member_authorized_projects
+  def refresh_member_authorized_projects
+    return super unless Feature.enabled?(:specialized_service_for_project_member_auth_refresh)
+    return unless user
+
+    # rubocop:disable CodeReuse/ServiceClass
+    AuthorizedProjectUpdate::ProjectRecalculatePerUserService.new(project, user).execute
+
+    # Until we compare the inconsistency rates of the new, specialized service and
+    # the old approach, we still run AuthorizedProjectsWorker
+    # but with some delay and lower urgency as a safety net.
+    UserProjectAccessChangedService.new(user_id)
+      .execute(blocking: false, priority: UserProjectAccessChangedService::LOW_PRIORITY)
+    # rubocop:enable CodeReuse/ServiceClass
+  end
+
   private
 
   def send_invite