Update epic tree when group is transfered

- nulify parent - child relationship if child
can't be attached to the parent after the
transfer

ee/app/models/ee/epic.rb

@@ -188,6 +188,11 @@ module EE
         ::Group
       end
 
+      def nullify_lost_group_parents(groups, lost_groups)
+        epics_to_update = in_selected_groups(groups).where(parent: in_selected_groups(lost_groups))
+        epics_to_update.update_all(parent_id: nil)
+      end
+
       # Return the deepest relation level for an epic.
       # Example 1:
       # epic1 - parent: nil

ee/app/services/ee/groups/transfer_service.rb

@@ -9,6 +9,12 @@ module EE
         group_contains_npm_packages: s_('TransferGroup|Group contains projects with NPM packages.')
       }.freeze
 
+      def update_group_attributes
+        ::Epic.nullify_lost_group_parents(group.self_and_descendants, lost_groups)
+
+        super
+      end
+
       private
 
       override :ensure_allowed_transfer
@@ -36,6 +42,16 @@ module EE
       def different_root_ancestor?
         group.root_ancestor != new_parent_group&.root_ancestor
       end
+
+      def lost_groups
+        ancestors = group.ancestors
+
+        if ancestors.include?(new_parent_group)
+          group.ancestors_upto(new_parent_group)
+        else
+          ancestors
+        end
+      end
     end
   end
 end

ee/changelogs/unreleased/security-epic-groups.yml

+---
+title: Update epic tree when group is transfered
+merge_request:
+author:
+type: security

ee/spec/services/groups/transfer_service_spec.rb

@@ -97,4 +97,75 @@ describe Groups::TransferService, '#execute' do
       expect(group.parent).to eq(new_group)
     end
   end
+
+  context 'with epics' do
+    context 'when epics feature is disabled' do
+      it 'transfers a group successfully' do
+        transfer_service.execute(new_group)
+
+        expect(group.parent).to eq(new_group)
+      end
+    end
+
+    context 'when epics feature is enabled' do
+      let(:root_group) { create(:group) }
+      let(:subgroup_group_level_1) { create(:group, parent: root_group) }
+      let(:subgroup_group_level_2) { create(:group, parent: subgroup_group_level_1) }
+      let(:subgroup_group_level_3) { create(:group, parent: subgroup_group_level_2) }
+
+      let!(:root_epic) { create(:epic, group: root_group) }
+      let!(:level_1_epic_1) { create(:epic, group: subgroup_group_level_1, parent: root_epic) }
+      let!(:level_1_epic_2) { create(:epic, group: subgroup_group_level_1, parent: level_1_epic_1) }
+      let!(:level_2_epic_1) { create(:epic, group: subgroup_group_level_2, parent: root_epic) }
+      let!(:level_2_epic_2) { create(:epic, group: subgroup_group_level_2, parent: level_1_epic_1) }
+      let!(:level_2_subepic) { create(:epic, group: subgroup_group_level_2, parent: level_2_epic_2) }
+      let!(:level_3_epic) { create(:epic, group: subgroup_group_level_3, parent: level_2_epic_2) }
+
+      before do
+        root_group.add_owner(user)
+
+        stub_licensed_features(epics: true)
+      end
+
+      context 'when group is moved completely out of the main group' do
+        let(:group) { subgroup_group_level_1 }
+
+        before do
+          transfer_service.execute(new_group)
+        end
+
+        it 'keeps relations between epics in the group structure' do
+          expect(level_1_epic_2.reload.parent).to eq(level_1_epic_1)
+          expect(level_2_epic_2.reload.parent).to eq(level_1_epic_1)
+          expect(level_2_subepic.reload.parent).to eq(level_2_epic_2)
+          expect(level_3_epic.reload.parent).to eq(level_2_epic_2)
+        end
+
+        it 'removes relations to epics of the old parent group' do
+          expect(level_1_epic_1.reload.parent).to be_nil
+          expect(level_2_epic_1.reload.parent).to be_nil
+        end
+      end
+
+      context 'when group is moved some levels up' do
+        let(:group) { subgroup_group_level_2 }
+
+        before do
+          transfer_service.execute(root_group)
+        end
+
+        it 'keeps relations between epics in the group structure' do
+          expect(level_1_epic_1.reload.parent).to eq(root_epic)
+          expect(level_1_epic_2.reload.parent).to eq(level_1_epic_1)
+          expect(level_2_epic_1.reload.parent).to eq(root_epic)
+          expect(level_2_subepic.reload.parent).to eq(level_2_epic_2)
+          expect(level_3_epic.reload.parent).to eq(level_2_epic_2)
+        end
+
+        it 'removes relations to epics of the old parent group' do
+          expect(level_2_epic_2.reload.parent).to be_nil
+        end
+      end
+    end
+  end
 end