Merge branch '14729-from-group-deploy-keys-to-projects' into 'master'

Backend to show Group Deploy Keys at Project level

Closes #14729

See merge request gitlab-org/gitlab!39148

app/models/group_deploy_key.rb

@@ -8,6 +8,10 @@ class GroupDeployKey < Key
 
   validates :user, presence: true
 
+  scope :for_groups, ->(group_ids) do
+    joins(:group_deploy_keys_groups).where(group_deploy_keys_groups: { group_id: group_ids }).uniq
+  end
+
   def type
     'DeployKey'
   end

app/models/project.rb

@@ -2526,6 +2526,12 @@ class Project < ApplicationRecord
     ci_config_path.presence || Ci::Pipeline::DEFAULT_CONFIG_PATH
   end
 
+  def enabled_group_deploy_keys
+    return GroupDeployKey.none unless group
+
+    GroupDeployKey.for_groups(group.self_and_ancestors_ids)
+  end
+
   private
 
   def find_service(services, name)

spec/models/group_deploy_key_spec.rb

@@ -82,4 +82,25 @@ RSpec.describe GroupDeployKey do
       end
     end
   end
+
+  describe '.for_groups' do
+    context 'when group deploy keys are enabled for some groups' do
+      let_it_be(:group1) { create(:group) }
+      let_it_be(:group2) { create(:group) }
+      let_it_be(:group3) { create(:group) }
+      let_it_be(:gdk1) { create(:group_deploy_key) }
+      let_it_be(:gdk2) { create(:group_deploy_key) }
+      let_it_be(:gdk3) { create(:group_deploy_key) }
+
+      it 'returns these group deploy keys' do
+        gdk1.groups << group1
+        gdk1.groups << group2
+        gdk2.groups << group3
+        gdk3.groups << group2
+
+        expect(described_class.for_groups([group1.id, group3.id])).to contain_exactly(gdk1, gdk2)
+        expect(described_class.for_groups([group2.id])).to contain_exactly(gdk1, gdk3)
+      end
+    end
+  end
 end

spec/models/project_spec.rb

@@ -6536,6 +6536,49 @@ RSpec.describe Project do
     end
   end
 
+  describe '#enabled_group_deploy_keys' do
+    let_it_be(:project) { create(:project) }
+
+    subject { project.enabled_group_deploy_keys }
+
+    context 'when a project does not have a group' do
+      it { is_expected.to be_empty }
+    end
+
+    context 'when a project has a parent group' do
+      let!(:group) { create(:group, projects: [project]) }
+
+      context 'and this group has a group deploy key enabled' do
+        let!(:group_deploy_key) { create(:group_deploy_key, groups: [group]) }
+
+        it { is_expected.to contain_exactly(group_deploy_key) }
+
+        context 'and this group has parent group which also has a group deploy key enabled' do
+          let(:super_group) { create(:group) }
+
+          it 'returns both group deploy keys' do
+            super_group = create(:group)
+            super_group_deploy_key = create(:group_deploy_key, groups: [super_group])
+            group.update!(parent: super_group)
+
+            expect(subject).to contain_exactly(group_deploy_key, super_group_deploy_key)
+          end
+        end
+      end
+
+      context 'and another group has a group deploy key enabled' do
+        let_it_be(:group_deploy_key) { create(:group_deploy_key) }
+
+        it 'does not return this group deploy key' do
+          another_group = create(:group)
+          create(:group_deploy_key, groups: [another_group])
+
+          expect(subject).to be_empty
+        end
+      end
+    end
+  end
+
   def finish_job(export_job)
     export_job.start
     export_job.finish