Merge branch 'master' into 'master'

Fixed Membership Lock should propagate from parent group to sub-groups.

Closes gitlab-ce#42093

See merge request gitlab-org/gitlab-ee!4127

app/models/namespace.rb

@@ -49,6 +49,7 @@ class Namespace < ActiveRecord::Base
   after_commit :refresh_access_of_projects_invited_groups, on: :update, if: -> { previous_changes.key?('share_with_group_lock') }
 
   before_create :sync_share_with_group_lock_with_parent
+  before_create :sync_membership_lock_with_parent
   before_update :sync_share_with_group_lock_with_parent, if: :parent_changed?
   after_update :force_share_with_group_lock_on_descendants, if: -> { share_with_group_lock_changed? && share_with_group_lock? }
 
@@ -256,6 +257,12 @@ class Namespace < ActiveRecord::Base
     end
   end
 
+  def sync_membership_lock_with_parent
+    if parent&.membership_lock?
+      self.membership_lock = true
+    end
+  end
+
   def force_share_with_group_lock_on_descendants
     return unless Group.supports_nested_groups?
 

changelogs/unreleased-ee/4510-fix-membership-lock-progagate-from-parent.yml

+---
+title: Fixed membership Lock should propagate from parent group to sub-groups
+merge_request: 4111
+author:
+type: fixed

spec/models/namespace_spec.rb

@@ -550,6 +550,118 @@ describe Namespace do
     end
   end
 
+  describe '#membership_lock with subgroups', :nested_groups do
+    context 'when creating a subgroup' do
+      let(:subgroup) { create(:group, parent: root_group) }
+
+      context 'under a parent with "Membership lock" enabled' do
+        let(:root_group) { create(:group, membership_lock: true) }
+
+        it 'enables "Membership lock" on the subgroup' do
+          expect(subgroup.membership_lock).to be_truthy
+        end
+      end
+
+      context 'under a parent with "Membership lock" disabled' do
+        let(:root_group) { create(:group) }
+
+        it 'does not enable "Membership lock" on the subgroup' do
+          expect(subgroup.membership_lock).to be_falsey
+        end
+      end
+
+      context 'when enabling the parent group "Membership lock"' do
+        let(:root_group) { create(:group) }
+        let!(:subgroup) { create(:group, parent: root_group) }
+
+        it 'the subgroup "Membership lock" not changed' do
+          root_group.update!(membership_lock: true)
+
+          expect(subgroup.reload.membership_lock).to be_falsey
+        end
+      end
+
+      context 'when disabling the parent group "Membership lock" (which was already enabled)' do
+        let(:root_group) { create(:group, membership_lock: true) }
+
+        context 'and the subgroup "Membership lock" is enabled' do
+          let(:subgroup) { create(:group, parent: root_group, membership_lock: true) }
+
+          it 'the subgroup "Membership lock" does not change' do
+            root_group.update!(membership_lock: false)
+
+            expect(subgroup.reload.membership_lock).to be_truthy
+          end
+        end
+
+        context 'but the subgroup "Membership lock" is disabled' do
+          let(:subgroup) { create(:group, parent: root_group) }
+
+          it 'the subgroup "Membership lock" does not change' do
+            root_group.update!(membership_lock: false)
+
+            expect(subgroup.reload.membership_lock?).to be_falsey
+          end
+        end
+      end
+    end
+
+    # Note: Group transfers are not yet implemented
+    context 'when a group is transferred into a root group' do
+      context 'when the root group "Membership lock" is enabled' do
+        let(:root_group) { create(:group, membership_lock: true) }
+
+        context 'when the subgroup "Membership lock" is enabled' do
+          let(:subgroup) { create(:group, membership_lock: true) }
+
+          it 'the subgroup "Membership lock" does not change' do
+            subgroup.parent = root_group
+            subgroup.save!
+
+            expect(subgroup.membership_lock).to be_truthy
+          end
+        end
+
+        context 'when the subgroup "Membership lock" is disabled' do
+          let(:subgroup) { create(:group) }
+
+          it 'the subgroup "Membership lock" not changed' do
+            subgroup.parent = root_group
+            subgroup.save!
+
+            expect(subgroup.membership_lock).to be_falsey
+          end
+        end
+      end
+
+      context 'when the root group "Membership lock" is disabled' do
+        let(:root_group) { create(:group) }
+
+        context 'when the subgroup "Membership lock" is enabled' do
+          let(:subgroup) { create(:group, membership_lock: true) }
+
+          it 'the subgroup "Membership lock" does not change' do
+            subgroup.parent = root_group
+            subgroup.save!
+
+            expect(subgroup.membership_lock).to be_truthy
+          end
+        end
+
+        context 'when the subgroup "Membership lock" is disabled' do
+          let(:subgroup) { create(:group) }
+
+          it 'the subgroup "Membership lock" does not change' do
+            subgroup.parent = root_group
+            subgroup.save!
+
+            expect(subgroup.membership_lock).to be_falsey
+          end
+        end
+      end
+    end
+  end
+
   describe '#find_fork_of?' do
     let(:project) { create(:project, :public) }
     let!(:forked_project) { fork_project(project, namespace.owner, namespace: namespace) }