require update_two_factor_requirement on all sub-entities users

2 files changed, 3 insertions, 2 deletions

diff --git a/app/models/group.rb b/app/models/group.rb
index cdb4e6e87f6..5e58b48a366 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -423,7 +423,7 @@ class Group < Namespace
   def update_two_factor_requirement
     return unless saved_change_to_require_two_factor_authentication? || saved_change_to_two_factor_grace_period?
 
-    users.find_each(&:update_two_factor_requirement)
+    User.from_union([users_with_descendants, project_users_with_descendants]).find_each(&:update_two_factor_requirement)
   end
 
   def path_changed_hook
diff --git a/app/models/user.rb b/app/models/user.rb
index 2eb5c63a4cc..916a0aa74f0 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -728,7 +728,8 @@ class User < ApplicationRecord
   end
 
   def expanded_groups_requiring_two_factor_authentication
-    all_expanded_groups.where(require_two_factor_authentication: true)
+    Group.from_union([all_expanded_groups.where(require_two_factor_authentication: true),
+                      authorized_groups.where(require_two_factor_authentication: true)])
   end
 
   # rubocop: disable CodeReuse/ServiceClass