1 files changed, 13 insertions, 1 deletions
diff --git a/app/models/members/member_role.rb b/app/models/members/member_role.rb
index b4e3d6874ef..e9d7b1d3f80 100644
--- a/app/models/members/member_role.rb
+++ b/app/models/members/member_role.rb
@@ -1,18 +1,30 @@
 # frozen_string_literal: true
 
 class MemberRole < ApplicationRecord  # rubocop:disable Gitlab/NamespacedClass
+  include IgnorableColumns
+  ignore_column :download_code, remove_with: '15.9', remove_after: '2023-01-22'
+
   has_many :members
   belongs_to :namespace
 
   validates :namespace, presence: true
   validates :base_access_level, presence: true
   validate :belongs_to_top_level_namespace
+  validate :validate_namespace_locked, on: :update
+
+  validates_associated :members
 
   private
 
   def belongs_to_top_level_namespace
     return if !namespace || namespace.root?
 
-    errors.add(:namespace, s_("must be top-level namespace"))
+    errors.add(:namespace, s_("MemberRole|must be top-level namespace"))
+  end
+
+  def validate_namespace_locked
+    return unless namespace_id_changed?
+
+    errors.add(:namespace, s_("MemberRole|can't be changed"))
   end
 end