1 files changed, 42 insertions, 0 deletions
diff --git a/app/models/ci/job_token/allowlist.rb b/app/models/ci/job_token/allowlist.rb
new file mode 100644
index 00000000000..9e9a0a68ebd
--- /dev/null
+++ b/app/models/ci/job_token/allowlist.rb
@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+module Ci
+  module JobToken
+    class Allowlist
+      def initialize(source_project, direction:)
+        @source_project = source_project
+        @direction = direction
+      end
+
+      def includes?(target_project)
+        source_links
+          .with_target(target_project)
+          .exists?
+      end
+
+      def projects
+        Project.from_union(target_projects, remove_duplicates: false)
+      end
+
+      private
+
+      def source_links
+        Ci::JobToken::ProjectScopeLink
+          .with_source(@source_project)
+          .where(direction: @direction)
+      end
+
+      def target_project_ids
+        source_links
+          # pluck needed to avoid ci and main db join
+          .pluck(:target_project_id)
+      end
+
+      def target_projects
+        [
+          Project.id_in(@source_project),
+          Project.id_in(target_project_ids)
+        ]
+      end
+    end
+  end
+end