diff --git a/ee/app/models/sbom/occurrence.rb b/ee/app/models/sbom/occurrence.rb index 073f3ddb61f509ed448a9500f4056d5ebb0299da..30230daa086fac25d49eb930ce6f569a6436e720 100644 --- a/ee/app/models/sbom/occurrence.rb +++ b/ee/app/models/sbom/occurrence.rb @@ -126,9 +126,9 @@ class Occurrence < Gitlab::Database::SecApplicationRecord end scope :filter_by_search_with_component_and_group, ->(search, component_id, group) do - relation = includes(project: :namespace) - .where(component_version_id: component_id, project: group.all_projects) - .allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/472113') + relation = for_namespace_and_descendants(group) + .preload(project: :namespace) + .where(component_version_id: component_id) if search.present? relation.where('input_file_path ILIKE ?', "%#{sanitize_sql_like(search.to_s)}%") # rubocop:disable GitlabSecurity/SqlInjection -- This cop is a false positive as we are using parameterization via ? diff --git a/ee/spec/models/sbom/occurrence_spec.rb b/ee/spec/models/sbom/occurrence_spec.rb index 3a7052950f75638ad2f32b48efd470ec23531a7e..26323fc4e21d108e98d2551619acc2c2c04f5b74 100644 --- a/ee/spec/models/sbom/occurrence_spec.rb +++ b/ee/spec/models/sbom/occurrence_spec.rb @@ -455,6 +455,19 @@ end end + describe '.for_namespace_and_descendants' do + let_it_be(:group) { create(:group) } + let_it_be(:project1) { create(:project, namespace: group) } + let_it_be(:project2) { create(:project, namespace: group) } + let_it_be(:occurrence_npm1) { create(:sbom_occurrence, project: project1) } + let_it_be(:occurrence_npm2) { create(:sbom_occurrence, project: project2) } + + it 'returns records' do + result = described_class.for_namespace_and_descendants(group) + expect(result).to match_array([occurrence_npm1, occurrence_npm2]) + end + end + describe '.filter_by_search_with_component_and_group' do let_it_be(:group) { create(:group) } let_it_be(:project) { create(:project, namespace: group) }