Eliminate statement timeouts when namespace is blank

When some Git clients attempt to fetch a project without a namespace
(e.g. project.git instead of group/project.git), a database with large
number of rows may encounter a statement timeout while attempting to
look up an empty namespace (`WHERE route.path IS NULL`) in
`GitAccess#ensure_project_on_push!`.

To avoid this, we now check that a valid namespace is available before
attempting to do more validation.

Closes https://gitlab.com/gitlab-org/gitlab/issues/199207

changelogs/unreleased/sh-fix-empty-namespace-git-access.yml

+---
+title: Eliminate statement timeouts when namespace is blank
+merge_request: 23839
+author:
+type: fixed

lib/gitlab/git_access.rb

@@ -50,8 +50,8 @@ module Gitlab
       @project  = project
       @protocol = protocol
       @authentication_abilities = authentication_abilities
-      @namespace_path = namespace_path
-      @project_path = project_path
+      @namespace_path = namespace_path || project&.namespace&.full_path
+      @project_path = project_path || project&.path
       @redirected_path = redirected_path
       @auth_result_type = auth_result_type
     end
@@ -60,6 +60,7 @@ module Gitlab
       @logger = Checks::TimedLogger.new(timeout: INTERNAL_TIMEOUT, header: LOG_HEADER)
       @changes = changes
 
+      check_namespace!
       check_protocol!
       check_valid_actor!
       check_active_user!
@@ -136,6 +137,12 @@ module Gitlab
       end
     end
 
+    def check_namespace!
+      return if namespace_path.present?
+
+      raise NotFoundError, ERROR_MESSAGES[:project_not_found]
+    end
+
     def check_active_user!
       return unless user
 

spec/lib/gitlab/git_access_spec.rb

@@ -75,6 +75,32 @@ describe Gitlab::GitAccess do
     end
   end
 
+  describe '#check_namespace!' do
+    context 'when namespace exists' do
+      before do
+        project.add_maintainer(user)
+      end
+
+      it 'allows push and pull access' do
+        aggregate_failures do
+          expect { push_access_check }.not_to raise_error
+          expect { pull_access_check }.not_to raise_error
+        end
+      end
+    end
+
+    context 'when namespace does not exist' do
+      let(:namespace_path) { nil }
+
+      it 'does not allow push and pull access' do
+        aggregate_failures do
+          expect { push_access_check }.to raise_not_found
+          expect { pull_access_check }.to raise_not_found
+        end
+      end
+    end
+  end
+
   describe '#check_project_accessibility!' do
     context 'when the project exists' do
       context 'when actor exists' do