1 files changed, 22 insertions, 11 deletions
diff --git a/app/services/projects/group_links/destroy_service.rb b/app/services/projects/group_links/destroy_service.rb
index a2307bfebf0..e0218ae087e 100644
--- a/app/services/projects/group_links/destroy_service.rb
+++ b/app/services/projects/group_links/destroy_service.rb
@@ -3,8 +3,10 @@
 module Projects
   module GroupLinks
     class DestroyService < BaseService
-      def execute(group_link)
-        return false unless group_link
+      def execute(group_link, skip_authorization: false)
+        unless valid_to_destroy?(group_link, skip_authorization)
+          return ServiceResponse.error(message: 'Not found', reason: :not_found)
+        end
 
         if group_link.project.private?
           TodosDestroyer::ProjectPrivateWorker.perform_in(Todo::WAIT_FOR_DELETE, project.id)
@@ -12,20 +14,29 @@ module Projects
           TodosDestroyer::ConfidentialIssueWorker.perform_in(Todo::WAIT_FOR_DELETE, nil, project.id)
         end
 
-        group_link.destroy.tap do |link|
-          refresh_project_authorizations_asynchronously(link.project)
+        link = group_link.destroy
 
-          # Until we compare the inconsistency rates of the new specialized worker and
-          # the old approach, we still run AuthorizedProjectsWorker
-          # but with some delay and lower urgency as a safety net.
-          link.group.refresh_members_authorized_projects(
-            priority: UserProjectAccessChangedService::LOW_PRIORITY
-          )
-        end
+        refresh_project_authorizations_asynchronously(link.project)
+
+        # Until we compare the inconsistency rates of the new specialized worker and
+        # the old approach, we still run AuthorizedProjectsWorker
+        # but with some delay and lower urgency as a safety net.
+        link.group.refresh_members_authorized_projects(
+          priority: UserProjectAccessChangedService::LOW_PRIORITY
+        )
+
+        ServiceResponse.success(payload: { link: link })
       end
 
       private
 
+      def valid_to_destroy?(group_link, skip_authorization)
+        return false unless group_link
+        return true if skip_authorization
+
+        current_user.can?(:admin_project_group_link, group_link)
+      end
+
       def refresh_project_authorizations_asynchronously(project)
         AuthorizedProjectUpdate::ProjectRecalculateWorker.perform_async(project.id)
       end