Merge branch 'allowlist_runner_callsites' into 'master'

Allow various runner scopes that issues cross-db query

See merge request gitlab-org/gitlab!72564

app/controllers/admin/runners_controller.rb

@@ -86,9 +86,11 @@ class Admin::RunnersController < Admin::ApplicationController
         Project.all
       end
 
+    ::Gitlab::Database.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/338659') do
       @projects = @projects.where.not(id: runner.projects.select(:id)) if runner.projects.any?
       @projects = @projects.inc_routes
       @projects = @projects.page(params[:page]).per(30).without_count
     end
+  end
   # rubocop: enable CodeReuse/ActiveRecord
 end

app/models/ci/runner.rb

@@ -82,7 +82,9 @@ module Ci
         groups = Gitlab::ObjectHierarchy.new(groups).base_and_ancestors
       end
 
-      joins(:runner_namespaces).where(ci_runner_namespaces: { namespace_id: groups })
+      joins(:runner_namespaces)
+        .where(ci_runner_namespaces: { namespace_id: groups })
+        .allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/336433')
     }
 
     scope :belonging_to_group_or_project, -> (group_id, project_id) {
@@ -111,7 +113,7 @@ module Ci
           instance_type
         ],
         remove_duplicates: false
-      )
+      ).allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/336433')
     end
 
     scope :assignable_for, ->(project) do

app/models/user.rb

@@ -1610,8 +1610,6 @@ class User < ApplicationRecord
     true
   end
 
-  # TODO Please check all callers and remove allow_cross_joins_across_databases,
-  # when https://gitlab.com/gitlab-org/gitlab/-/issues/336436 is done.
   def ci_owned_runners
     @ci_owned_runners ||= begin
       project_runners = Ci::RunnerProject
@@ -1624,7 +1622,7 @@ class User < ApplicationRecord
         .joins(:runner)
         .select('ci_runners.*')
 
-      Ci::Runner.from_union([project_runners, group_runners])
+      Ci::Runner.from_union([project_runners, group_runners]).allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/336436')
     end
   end
 

lib/api/entities/ci/runner_details.rb

@@ -15,18 +15,18 @@ module API
         # rubocop: disable CodeReuse/ActiveRecord
         expose :projects, with: Entities::BasicProjectDetails do |runner, options|
           if options[:current_user].admin? # rubocop: disable Cop/UserAdmin
-            runner.projects
+            runner.projects.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/338659')
           else
-            options[:current_user].authorized_projects.where(id: runner.projects)
+            options[:current_user].authorized_projects.where(id: runner.projects).allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/338659')
           end
         end
         # rubocop: enable CodeReuse/ActiveRecord
         # rubocop: disable CodeReuse/ActiveRecord
         expose :groups, with: Entities::BasicGroupDetails do |runner, options|
           if options[:current_user].admin? # rubocop: disable Cop/UserAdmin
-            runner.groups
+            runner.groups.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/338659')
           else
-            options[:current_user].authorized_groups.where(id: runner.groups)
+            options[:current_user].authorized_groups.where(id: runner.groups).allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/338659')
           end
         end
         # rubocop: enable CodeReuse/ActiveRecord

spec/support/database/cross-join-allowlist.yml

@@ -38,7 +38,6 @@
 - "./spec/models/user_spec.rb"
 - "./spec/presenters/packages/detail/package_presenter_spec.rb"
 - "./spec/requests/api/ci/runner/runners_post_spec.rb"
-- "./spec/requests/api/ci/runners_spec.rb"
 - "./spec/requests/api/graphql/ci/runner_spec.rb"
 - "./spec/requests/api/graphql/group_query_spec.rb"
 - "./spec/requests/api/graphql/packages/composer_spec.rb"