Add latest changes from gitlab-org/gitlab@master

2 files changed, 19 insertions, 11 deletions

diff --git a/lib/api/helpers/members_helpers.rb b/lib/api/helpers/members_helpers.rb
index 1a23dcd0d3c..6d1cd9d8cd9 100644
--- a/lib/api/helpers/members_helpers.rb
+++ b/lib/api/helpers/members_helpers.rb
@@ -85,20 +85,30 @@ module API
         user_id = create_service_params[:user_id]
         user = User.find_by(id: user_id) # rubocop: disable CodeReuse/ActiveRecord
 
-        if user
-          conflict!('Member already exists') if member_already_exists?(source, user_id)
+        not_found!('User') unless user
 
-          instance = ::Members::CreateService.new(current_user, create_service_params)
-          instance.execute
+        conflict!('Member already exists') if member_already_exists?(source, user_id)
 
-          not_allowed! if instance.membership_locked # This currently can only be reached in EE if group membership is locked
+        instance = ::Members::CreateService.new(current_user, create_service_params)
+        result = instance.execute
 
-          member = instance.single_member
-          render_validation_error!(member) if member.invalid?
+        # This currently can only be reached in EE if group membership is locked
+        not_allowed! if instance.membership_locked
 
-          present_members(member)
+        if result[:status] == :error && result[:http_status] == :unauthorized
+          raise Gitlab::Access::AccessDeniedError
+        end
+
+        # prefer responding with model validations, if present
+        member = instance.single_member
+        render_validation_error!(member) if member.invalid?
+
+        # if errors occurred besides model validations or authorization failures,
+        # render those appropriately
+        if result[:status] == :error
+          render_structured_api_error!(result, :bad_request)
         else
-          not_found!('User')
+          present_members(member)
         end
       end
 
diff --git a/lib/api/members.rb b/lib/api/members.rb
index 908733d4aa1..e4bd29640cd 100644
--- a/lib/api/members.rb
+++ b/lib/api/members.rb
@@ -119,8 +119,6 @@ module API
         post ":id/members", feature_category: feature_category do
           source = find_source(source_type, params[:id])
 
-          authorize_admin_source_member!(source_type, source)
-
           create_service_params = params.merge(source: source)
 
           if add_multiple_members?(params[:user_id].to_s)