Exclude keys linked to other projects

app/models/project.rb

@@ -1265,7 +1265,18 @@ class Project < ActiveRecord::Base
   end
 
   def remove_private_deploy_keys
-    deploy_keys.where(public: false).delete_all
+    exclude_keys_linked_to_other_projects = <<-SQL
+      NOT EXISTS (
+        SELECT 1
+        FROM deploy_keys_projects dkp2
+        WHERE dkp2.deploy_key_id = deploy_keys_projects.deploy_key_id
+        AND dkp2.project_id != deploy_keys_projects.project_id
+      )
+    SQL
+
+    deploy_keys.where(public: false)
+               .where(exclude_keys_linked_to_other_projects)
+               .delete_all
   end
 
   def remove_pages

changelogs/unreleased/mk-fix-deploy-key-deletion.yml

+---
+title: Fix deletion of deploy keys linked to other projects
+merge_request: 13162
+author:

spec/models/project_spec.rb

@@ -2238,19 +2238,43 @@ describe Project do
   end
 
   describe '#remove_private_deploy_keys' do
-    it 'removes the private deploy keys of a project' do
-      project = create(:empty_project)
+    let!(:project) { create(:empty_project) }
+
+    context 'for a private deploy key' do
+      let!(:key) { create(:deploy_key, public: false) }
+      let!(:deploy_keys_project) { create(:deploy_keys_project, deploy_key: key, project: project) }
+
+      context 'when the key is not linked to another project' do
+        it 'removes the key' do
+          project.remove_private_deploy_keys
+
+          expect(project.deploy_keys).not_to include(key)
+        end
+      end
+
+      context 'when the key is linked to another project' do
+        before do
+          another_project = create(:empty_project)
+          create(:deploy_keys_project, deploy_key: key, project: another_project)
+        end
+
+        it 'does not remove the key' do
+          project.remove_private_deploy_keys
 
-      private_key = create(:deploy_key, public: false)
-      public_key = create(:deploy_key, public: true)
+          expect(project.deploy_keys).to include(key)
+        end
+      end
+    end
 
-      create(:deploy_keys_project, deploy_key: private_key, project: project)
-      create(:deploy_keys_project, deploy_key: public_key, project: project)
+    context 'for a public deploy key' do
+      let!(:key) { create(:deploy_key, public: true) }
+      let!(:deploy_keys_project) { create(:deploy_keys_project, deploy_key: key, project: project) }
 
+      it 'does not remove the key' do
         project.remove_private_deploy_keys
 
-      expect(project.deploy_keys.where(public: false).any?).to eq(false)
-      expect(project.deploy_keys.where(public: true).any?).to eq(true)
+        expect(project.deploy_keys).to include(key)
+      end
     end
   end
 end