Allow project creation in scope of group for non-admin but group owners

app/models/project.rb

@@ -95,7 +95,6 @@ class Project < ActiveRecord::Base
 
     def create_by_user(params, user)
       namespace_id = params.delete(:namespace_id)
-      namespace_id ||= user.namespace.try(:id)
 
       project = Project.new params
 
@@ -109,7 +108,18 @@ class Project < ActiveRecord::Base
         project.path = project.name.dup.parameterize
 
         project.owner = user
-        project.namespace_id = namespace_id
+
+        # Apply namespace if user has access to it
+        # else fallback to user namespace
+        project.namespace_id = user.namespace_id
+
+        if namespace_id
+          group = Group.find_by_id(namespace_id)
+          if user.can? :manage_group, group
+            project.namespace_id = namespace_id
+          end
+        end
+
         project.save!
 
         # Add user as project master

app/models/user.rb

@@ -48,6 +48,7 @@ class User < ActiveRecord::Base
 
   # Namespace for personal projects
   has_one :namespace, class_name: "Namespace", foreign_key: :owner_id, conditions: 'type IS NULL', dependent: :destroy
+  has_many :groups, class_name: "Group", foreign_key: :owner_id
 
   has_many :keys, dependent: :destroy
   has_many :projects, through: :users_projects
@@ -120,15 +121,4 @@ class User < ActiveRecord::Base
       self.password = self.password_confirmation = Devise.friendly_token.first(8)
     end
   end
-
-  def namespaces
-    namespaces = []
-    namespaces << self.namespace if self.namespace
-    namespaces = namespaces + Group.all if admin
-    namespaces
-  end
-
-  def several_namespaces?
-    namespaces.size > 1
-  end
 end