Merge branch 'ajk-group-member-policy' into 'master'

Fix overly aggressive prevent call

See merge request gitlab-org/gitlab!47455

app/policies/group_member_policy.rb

@@ -11,7 +11,10 @@ class GroupMemberPolicy < BasePolicy
   condition(:is_target_user) { @user && @subject.user_id == @user.id }
 
   rule { anonymous }.prevent_all
-  rule { last_owner }.prevent_all
+  rule { last_owner }.policy do
+    prevent :update_group_member
+    prevent :destroy_group_member
+  end
 
   rule { can?(:admin_group_member) }.policy do
     enable :update_group_member

changelogs/unreleased/ajk-group-member-policy.yml

+---
+title: Fix overly aggressive prevent call
+merge_request: 47455
+author:
+type: fixed

spec/policies/group_member_policy_spec.rb

@@ -42,6 +42,7 @@ RSpec.describe GroupMemberPolicy do
     it do
       expect_disallowed(:destroy_group_member)
       expect_disallowed(:update_group_member)
+      expect_allowed(:read_group)
     end
   end