Clarify behaviour of group member lock feature

doc/administration/compliance.md

@@ -73,7 +73,7 @@ These features can also help with compliance requirements:
 - [**Generate reports on permission levels of users**](../user/admin_area/index.md#user-permission-export) (for
   instances): Administrators can generate a report listing all users' access permissions for groups and projects in the
   instance.
-- [**Lock project membership to group**](../user/group/index.md#prevent-members-from-being-added-to-a-group) (for
+- [**Lock project membership to group**](../user/group/index.md#prevent-members-from-being-added-to-projects-in-a-group) (for
   groups): Group owners can prevent new members from being added to projects within a group.
 - [**LDAP group sync**](auth/ldap/ldap_synchronization.md#group-sync) (for instances): Gives administrators the ability
   to automatically sync groups and manage SSH keys, permissions, and authentication, so you can focus on building your

doc/api/groups.md

@@ -788,7 +788,7 @@ Parameters:
 | `name`                               | string  | yes      | The name of the group. |
 | `path`                               | string  | yes      | The path of the group. |
 | `description`                        | string  | no       | The group's description. |
-| `membership_lock`                    | boolean | no       | **(PREMIUM)** Prevent adding new members to project membership within this group. |
+| `membership_lock`                    | boolean | no       | **(PREMIUM)** Prevent adding new members to projects within this group. |
 | `visibility`                         | string  | no       | The group's visibility. Can be `private`, `internal`, or `public`. |
 | `share_with_group_lock`              | boolean | no       | Prevent sharing a project with another group within this group. |
 | `require_two_factor_authentication`  | boolean | no       | Require all users in this group to setup Two-factor authentication. |
@@ -864,7 +864,7 @@ PUT /groups/:id
 | `name`                                     | string  | no       | The name of the group. |
 | `path`                                     | string  | no       | The path of the group. |
 | `description`                              | string  | no       | The description of the group. |
-| `membership_lock`                          | boolean | no       | **(PREMIUM)** Prevent adding new members to project membership within this group. |
+| `membership_lock`                          | boolean | no       | **(PREMIUM)** Prevent adding new members to projects within this group. |
 | `share_with_group_lock`                    | boolean | no       | Prevent sharing a project with another group within this group. |
 | `visibility`                               | string  | no       | The visibility level of the group. Can be `private`, `internal`, or `public`. |
 | `require_two_factor_authentication`        | boolean | no       | Require all users in this group to setup Two-factor authentication. |

doc/subscriptions/bronze_starter.md

@@ -28,7 +28,7 @@ the tiers are no longer mentioned in GitLab documentation:
   - [Creating group memberships via CN](../user/group/index.md#create-group-links-via-cn)
   - [Group push rules](../user/group/index.md#group-push-rules)
   - [Managing group memberships via LDAP](../user/group/index.md#manage-group-memberships-via-ldap)
-  - [Member locking](../user/group/index.md#prevent-members-from-being-added-to-a-group)
+  - [Member locking](../user/group/index.md#prevent-members-from-being-added-to-projects-in-a-group)
   - [Overriding user permissions](../user/group/index.md#override-user-permissions)
   - [User contribution analytics](../user/group/contribution_analytics/index.md)
   - [Kerberos integration](../integration/kerberos.md)

doc/user/group/index.md

@@ -508,7 +508,7 @@ To prevent a project from being shared with other groups:
 This setting applies to all subgroups unless overridden by a group owner. Groups already
 added to a project lose access when the setting is enabled.
 
-## Prevent members from being added to a group **(PREMIUM)**
+## Prevent members from being added to projects in a group **(PREMIUM)**
 
 As a group owner, you can prevent any new project membership for all
 projects in a group, allowing tighter control over project membership.
@@ -516,7 +516,11 @@ projects in a group, allowing tighter control over project membership.
 For example, if you want to lock the group for an [Audit Event](../../administration/audit_events.md),
 you can guarantee that project membership cannot be modified during the audit.
 
-To prevent members from being added to a group:
+You can still invite groups or to add members to groups, implicitly giving members access to projects in the **locked** group.
+
+The setting does not cascade. Projects in subgroups observe the subgroup configuration, ignoring the parent group.
+
+To prevent members from being added to projects in a group:
 
 1. Go to the group's **Settings > General** page.
 1. Expand the **Permissions, LFS, 2FA** section.

ee/app/views/groups/_member_lock_setting.html.haml

@@ -2,5 +2,5 @@
 
 .form-group
   = f.gitlab_ui_checkbox_component :membership_lock,
-      _('Prevent adding new members to project membership within this group'),
+      _('Prevent adding new members to projects within this group'),
       checkbox_options: { data: { qa_selector: 'membership_lock_checkbox' } }

ee/lib/ee/api/helpers/groups_helpers.rb

@@ -8,7 +8,7 @@ module EE
 
         prepended do
           params :optional_params_ee do
-            optional :membership_lock, type: ::Grape::API::Boolean, desc: 'Prevent adding new members to project membership within this group'
+            optional :membership_lock, type: ::Grape::API::Boolean, desc: 'Prevent adding new members to projects within this group'
             optional :ldap_cn, type: String, desc: 'LDAP Common Name'
             optional :ldap_access, type: Integer, desc: 'A valid access level'
             optional :shared_runners_minutes_limit, type: Integer, desc: '(admin-only) Pipeline minutes quota for this group'

ee/spec/features/groups/group_settings_spec.rb

@@ -76,7 +76,7 @@ RSpec.describe 'Edit group settings' do
       it 'is not visible' do
         visit edit_group_path(group)
 
-        expect(page).not_to have_content('Prevent adding new members to project membership within this group')
+        expect(page).not_to have_content('Prevent adding new members to projects within this group')
       end
     end
 
@@ -84,7 +84,7 @@ RSpec.describe 'Edit group settings' do
       it 'is visible' do
         visit edit_group_path(group)
 
-        expect(page).to have_content('Prevent adding new members to project membership within this group')
+        expect(page).to have_content('Prevent adding new members to projects within this group')
       end
 
       context 'when current user is not the Owner' do

locale/gitlab.pot

@@ -26217,7 +26217,7 @@ msgstr ""
 msgid "Prev"
 msgstr ""
 
-msgid "Prevent adding new members to project membership within this group"
+msgid "Prevent adding new members to projects within this group"
 msgstr ""
 
 msgid "Prevent auto-stopping"