Remove cross-database joins in job token scope code

app/models/ci/job_token/project_scope_link.rb

@@ -5,7 +5,7 @@
 
 module Ci
   module JobToken
-    class ProjectScopeLink < ApplicationRecord
+    class ProjectScopeLink < Ci::ApplicationRecord
       self.table_name = 'ci_job_token_project_scope_links'
 
       belongs_to :source_project, class_name: 'Project'

app/models/ci/job_token/scope.rb

@@ -32,12 +32,15 @@ module Ci
       def all_projects
         Project.from_union([
           Project.id_in(source_project),
-          Project.where_exists(
-            Ci::JobToken::ProjectScopeLink
-              .from_project(source_project)
-              .where('projects.id = ci_job_token_project_scope_links.target_project_id'))
+          Project.id_in(target_project_ids)
         ], remove_duplicates: false)
       end
+
+      private
+
+      def target_project_ids
+        Ci::JobToken::ProjectScopeLink.from_project(source_project).pluck(:target_project_id)
+      end
     end
   end
 end

spec/support/database/cross-join-allowlist.yml

@@ -121,7 +121,6 @@
 - "./spec/migrations/schedule_migrate_security_scans_spec.rb"
 - "./spec/models/ci/build_spec.rb"
 - "./spec/models/ci/job_artifact_spec.rb"
-- "./spec/models/ci/job_token/scope_spec.rb"
 - "./spec/models/ci/pipeline_spec.rb"
 - "./spec/models/ci/runner_spec.rb"
 - "./spec/models/clusters/applications/runner_spec.rb"