Invalid merge request approval rules created when show_private_groups_as_approvers enabled

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Close this issue

Summary

When the show_private_groups_as_approvers feature flag is enabled, merge requests can be created with invalid approval rules

Steps to reproduce

1. Invite a private group to a project
2. Create a project approval rule with the private group as the only approvers
3. As a user that does not have access to the private group: create a merge request

What is the current bug behavior?

The merge request approval rule has no approvers.

What is the expected correct behavior?

There should be an approval rule with approvers

Possible fixes

Seems related to this method: https://gitlab.com/gitlab-org/gitlab/-/blob/2bb320d5bd2ee6d1ca4f0c56c60b31d027d853c9/ee/app/services/approval_rules/params_filtering_service.rb#L75