Fix bug where users could not be added in protected branch rules

dbf7978b introduced a regression where protected branches and tags
could only be added if the user getting access to push or merge was a
direct member of the project. However, this does not consider that
team members can gain access to a project via group membership. Fix this
by checking the user has any access within the team.

Closes https://gitlab.com/gitlab-org/gitlab-ee/issues/9591

ee/app/models/concerns/ee/protected_ref_access.rb

@@ -96,7 +96,7 @@ module EE
     def validate_user_membership
       return unless user
 
-      unless project.members.where(user: user).exists?
+      unless project.team.member?(user)
         self.errors.add(:user, 'is not a member of the project')
       end
     end

ee/changelogs/unreleased/sh-fix-issue-9591.yml

+---
+title: Fix bug where users could not be added in protected branch rules
+merge_request: 9474
+author:
+type: fixed

ee/spec/models/ee/protected_ref_access_spec.rb

@@ -77,6 +77,16 @@ describe EE::ProtectedRefAccess do
           expect(access_level.errors.count).to eq 1
           expect(access_level.errors[:user].first).to eq 'is not a member of the project'
         end
+
+        it 'allows users with access through group' do
+          new_project = create(:project, group: group)
+          new_user = create(:user)
+
+          group.add_developer(new_user)
+          access_level.user = new_user
+
+          expect(access_level).to be_valid
+        end
       end
 
       it 'requires access_level if no user or group is specified' do