Update issues in Elasticsearch when project visibility_level changes

Since the `visibility_level` of issues will later be used for filtering
internal issues we need to ensure the value is correctly set.

ee/app/models/concerns/elastic/application_versioned_search.rb

@@ -50,12 +50,23 @@ module Elastic
 
     def maintain_elasticsearch_update
       ::Elastic::ProcessBookkeepingService.track!(self)
+
+      associations_to_update = associations_needing_elasticsearch_update
+      unless associations_to_update.blank?
+        ElasticAssociationIndexerWorker.perform_async(self.class.name, id, associations_to_update)
+      end
     end
 
     def maintain_elasticsearch_destroy
       ::Elastic::ProcessBookkeepingService.track!(self)
     end
 
+    # Override in child object if there are associations that need to be
+    # updated when specific fields are updated
+    def associations_needing_elasticsearch_update
+      []
+    end
+
     class_methods do
       def __elasticsearch__
         @__elasticsearch__ ||= ::Elastic::MultiVersionClassProxy.new(self)

ee/app/models/ee/project.rb

@@ -627,6 +627,15 @@ module EE
       ElasticCommitIndexerWorker.perform_async(id, nil, nil, true) if use_elasticsearch? && !forked?
     end
 
+    override :associations_needing_elasticsearch_update
+    def associations_needing_elasticsearch_update
+      if previous_changes.include?(:visibility_level)
+        ['issues']
+      else
+        []
+      end
+    end
+
     def log_geo_updated_events
       repository.log_geo_updated_event
       wiki.repository.log_geo_updated_event

ee/spec/models/project_spec.rb

@@ -2638,4 +2638,30 @@ RSpec.describe Project do
       project.add_template_export_job(current_user: user)
     end
   end
+
+  context 'indexing updates in Elasticsearch', :elastic do
+    before do
+      stub_ee_application_setting(elasticsearch_indexing: true)
+    end
+
+    context 'on update' do
+      let(:project) { create(:project, :public) }
+
+      context 'when updating the visibility_level' do
+        it 'triggers ElasticAssociationIndexerWorker to update issues' do
+          expect(ElasticAssociationIndexerWorker).to receive(:perform_async).with('Project', project.id, ['issues'])
+
+          project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+        end
+      end
+
+      context 'when changing the title' do
+        it 'does not trigger ElasticAssociationIndexerWorker to update issues' do
+          expect(ElasticAssociationIndexerWorker).not_to receive(:perform_async)
+
+          project.update!(title: 'The new title')
+        end
+      end
+    end
+  end
 end