3 files changed, 23 insertions, 1 deletions
diff --git a/app/models/members/group_member.rb b/app/models/members/group_member.rb
index ad1ad1e74fe..796b05b7fff 100644
--- a/app/models/members/group_member.rb
+++ b/app/models/members/group_member.rb
@@ -55,6 +55,12 @@ class GroupMember < Member
     { group: group }
   end
 
+  def last_owner_of_the_group?
+    return false unless access_level == Gitlab::Access::OWNER
+
+    group.member_last_owner?(self) || group.member_last_blocked_owner?(self)
+  end
+
   private
 
   override :refresh_member_authorized_projects
diff --git a/app/models/members/member_role.rb b/app/models/members/member_role.rb
index b4e3d6874ef..e9d7b1d3f80 100644
--- a/app/models/members/member_role.rb
+++ b/app/models/members/member_role.rb
@@ -1,18 +1,30 @@
 # frozen_string_literal: true
 
 class MemberRole < ApplicationRecord  # rubocop:disable Gitlab/NamespacedClass
+  include IgnorableColumns
+  ignore_column :download_code, remove_with: '15.9', remove_after: '2023-01-22'
+
   has_many :members
   belongs_to :namespace
 
   validates :namespace, presence: true
   validates :base_access_level, presence: true
   validate :belongs_to_top_level_namespace
+  validate :validate_namespace_locked, on: :update
+
+  validates_associated :members
 
   private
 
   def belongs_to_top_level_namespace
     return if !namespace || namespace.root?
 
-    errors.add(:namespace, s_("must be top-level namespace"))
+    errors.add(:namespace, s_("MemberRole|must be top-level namespace"))
+  end
+
+  def validate_namespace_locked
+    return unless namespace_id_changed?
+
+    errors.add(:namespace, s_("MemberRole|can't be changed"))
   end
 end
diff --git a/app/models/members/project_member.rb b/app/models/members/project_member.rb
index 1099e0f48c0..6aa6afb595d 100644
--- a/app/models/members/project_member.rb
+++ b/app/models/members/project_member.rb
@@ -96,6 +96,10 @@ class ProjectMember < Member
     { project: project }
   end
 
+  def holder_of_the_personal_namespace?
+    project.personal_namespace_holder?(user)
+  end
+
   private
 
   override :access_level_inclusion