Merge branch '250681_fix_incorrect_validation_for_forked_projects' into 'master'

Fix visibility level validation for deep nested forks

See merge request gitlab-org/gitlab!50081

app/services/projects/fork_service.rb

@@ -34,11 +34,6 @@ module Projects
       new_project = CreateService.new(current_user, new_fork_params).execute
       return new_project unless new_project.persisted?
 
-      # Set the forked_from_project relation after saving to avoid having to
-      # reload the project to reset the association information and cause an
-      # extra query.
-      new_project.forked_from_project = @project
-
       builds_access_level = @project.project_feature.builds_access_level
       new_project.project_feature.update(builds_access_level: builds_access_level)
 
@@ -47,6 +42,7 @@ module Projects
 
     def new_fork_params
       new_params = {
+        forked_from_project:       @project,
         visibility_level:          allowed_visibility_level,
         description:               @project.description,
         name:                      target_name,

changelogs/unreleased/250681_fix_incorrect_validation_for_forked_projects.yml

+---
+title: Fix visibility level validation for deep nested forks
+merge_request: 50081
+author:
+type: fixed

spec/services/projects/fork_service_spec.rb

@@ -116,6 +116,24 @@ RSpec.describe Projects::ForkService do
             expect(to_project.fork_network_member.forked_from_project).to eq(from_forked_project)
           end
 
+          context 'when the forked project has higher visibility than the root project' do
+            let(:root_project) { create(:project, :public) }
+
+            it 'successfully creates a fork of the fork with correct visibility' do
+              forked_project = fork_project(root_project, @to_user, using_service: true)
+
+              root_project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+
+              # Forked project visibility is not affected by root project visibility change
+              expect(forked_project).to have_attributes(visibility_level: Gitlab::VisibilityLevel::PUBLIC)
+
+              fork_of_the_fork = fork_project(forked_project, @to_user, namespace: other_namespace, using_service: true)
+
+              expect(fork_of_the_fork).to be_valid
+              expect(fork_of_the_fork).to have_attributes(visibility_level: Gitlab::VisibilityLevel::PUBLIC)
+            end
+          end
+
           it_behaves_like 'forks count cache refresh' do
             let(:from_project) { from_forked_project }
             let(:to_user) { @to_user }