Commit 34f5f02a authored by Manoj M J's avatar Manoj M J

Use specialized worker to refresh authorizations on project transfer

With this change, we will be using a specialized
worker to refresh authorizations whenever a
project is transferred to a new namespace/group.

Changelog: performance
parent e3ee45a3
...@@ -154,19 +154,15 @@ module Projects ...@@ -154,19 +154,15 @@ module Projects
user_ids = @old_namespace.user_ids_for_project_authorizations | user_ids = @old_namespace.user_ids_for_project_authorizations |
@new_namespace.user_ids_for_project_authorizations @new_namespace.user_ids_for_project_authorizations
if Feature.enabled?(:specialized_worker_for_project_transfer_auth_recalculation) AuthorizedProjectUpdate::ProjectRecalculateWorker.perform_async(project.id)
AuthorizedProjectUpdate::ProjectRecalculateWorker.perform_async(project.id)
# Until we compare the inconsistency rates of the new specialized worker and
# Until we compare the inconsistency rates of the new specialized worker and # the old approach, we still run AuthorizedProjectsWorker
# the old approach, we still run AuthorizedProjectsWorker # but with some delay and lower urgency as a safety net.
# but with some delay and lower urgency as a safety net. UserProjectAccessChangedService.new(user_ids).execute(
UserProjectAccessChangedService.new(user_ids).execute( blocking: false,
blocking: false, priority: UserProjectAccessChangedService::LOW_PRIORITY
priority: UserProjectAccessChangedService::LOW_PRIORITY )
)
else
UserProjectAccessChangedService.new(user_ids).execute
end
end end
def rollback_side_effects def rollback_side_effects
......
---
name: specialized_worker_for_project_transfer_auth_recalculation
introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/61967
rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/334237
milestone: '14.1'
type: development
group: group::access
default_enabled: false
...@@ -478,58 +478,30 @@ RSpec.describe Projects::TransferService do ...@@ -478,58 +478,30 @@ RSpec.describe Projects::TransferService do
group.add_owner(user) group.add_owner(user)
end end
context 'when the feature flag `specialized_worker_for_project_transfer_auth_recalculation` is enabled' do it 'calls AuthorizedProjectUpdate::ProjectRecalculateWorker to update project authorizations' do
before do expect(AuthorizedProjectUpdate::ProjectRecalculateWorker)
stub_feature_flags(specialized_worker_for_project_transfer_auth_recalculation: true) .to receive(:perform_async).with(project.id)
end
it 'calls AuthorizedProjectUpdate::ProjectRecalculateWorker to update project authorizations' do
expect(AuthorizedProjectUpdate::ProjectRecalculateWorker)
.to receive(:perform_async).with(project.id)
execute_transfer
end
it 'calls AuthorizedProjectUpdate::UserRefreshFromReplicaWorker with a delay to update project authorizations' do execute_transfer
user_ids = [user.id, member_of_old_group.id, member_of_new_group.id].map { |id| [id] }
expect(AuthorizedProjectUpdate::UserRefreshFromReplicaWorker).to(
receive(:bulk_perform_in)
.with(1.hour,
user_ids,
batch_delay: 30.seconds, batch_size: 100)
)
subject
end
it 'refreshes the permissions of the members of the old and new namespace', :sidekiq_inline do
expect { execute_transfer }
.to change { member_of_old_group.authorized_projects.include?(project) }.from(true).to(false)
.and change { member_of_new_group.authorized_projects.include?(project) }.from(false).to(true)
end
end end
context 'when the feature flag `specialized_worker_for_project_transfer_auth_recalculation` is disabled' do it 'calls AuthorizedProjectUpdate::UserRefreshFromReplicaWorker with a delay to update project authorizations' do
before do user_ids = [user.id, member_of_old_group.id, member_of_new_group.id].map { |id| [id] }
stub_feature_flags(specialized_worker_for_project_transfer_auth_recalculation: false)
end
it 'calls UserProjectAccessChangedService to update project authorizations' do expect(AuthorizedProjectUpdate::UserRefreshFromReplicaWorker).to(
user_ids = [user.id, member_of_old_group.id, member_of_new_group.id] receive(:bulk_perform_in)
.with(1.hour,
expect_next_instance_of(UserProjectAccessChangedService, user_ids) do |service| user_ids,
expect(service).to receive(:execute) batch_delay: 30.seconds, batch_size: 100)
end )
execute_transfer subject
end end
it 'refreshes the permissions of the members of the old and new namespace' do it 'refreshes the permissions of the members of the old and new namespace', :sidekiq_inline do
expect { execute_transfer } expect { execute_transfer }
.to change { member_of_old_group.authorized_projects.include?(project) }.from(true).to(false) .to change { member_of_old_group.authorized_projects.include?(project) }.from(true).to(false)
.and change { member_of_new_group.authorized_projects.include?(project) }.from(false).to(true) .and change { member_of_new_group.authorized_projects.include?(project) }.from(false).to(true)
end
end end
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment