Duo Chat: only allow access when in the context of a group with Chat enabled
Problem to solve
If a user is an organization that has disabled experimental/beta features, the user can still access the chat. However, the functionalities of the chat in this case are limited to only answering documentation and coding questions.
This is a bug, as the organization has disabled experimental/beta features, but the user is still using an experimental/beta feature, albeit with limited functionality. We are not respecting the organization's settings.
Current behavior
- While on any page of GitLab, I can ask the following types of questions to Chat:
- Documentation questions ("How do I reset my password?")
- General coding questions ("In ruby, what is the difference between the print method and the puts method?")
- While viewing resources within a group that has the necessary license + settings enabled, I can ask the following types of questions to Chat:
- Issue summarization ("What is this issue about?")
- Epic information ("Summarize this epic")
Expected behavior
| Current page | Current user has AI enabled for ONE of the groups? | Current user has AI enabled for this group? | Chat button visible? | Chat usable for documentation questions? | Chat usable for "this" scoped questions about issues/epics? | Chat usable for questions about issues/epics within AI enabled groups using links or identifiers? |
|---|---|---|---|---|---|---|
| page outside of group (dashboard, profile, personal projects) | true | - | YES | YES | - | YES |
| page outside of group (dashboard, profile, personal projects) | false | - | NO | NO | - | - |
| resource within group with AI | true | true | YES | YES | YES | YES |
| resource within group without AI | true | false | NO | - | - | - |
| resource within group without AI | false | false | NO | - | - | - |
More detail
This issue comes out of a conversation here (Internal only).
Right now, Chat is access via the "Help" menu in the sidebar. That is generated via vue code in ee/app/assets/javascripts/ai/tanuki_bot/components/app.vue.
We should also make sure that these checks are run for showing the breadcrumbs button, while will be shown via this feature flag. Thatt feature flag was introduced here and does the authorization check with Gitlab::Llm::TanukiBot.show_breadcrumbs_entry_point_for. That method calls User#any_group_with_ai_available? method is used to determine if a user can see Chat. We will need to update this logic to be aware of whether the current namespace has access to AI features and has all the necessary toggles enabled.
Future iterations
There has been some discussion on this point:
When I do not have access to chat (because I do not have the necessary license + settings enabled) I do not see any link or button to access the chat.
It could be confusing to the user that sometimes they see a button to open the chat, and sometimes they do not. There are a number of ways we could mitigate that confusion, as discussed below. We will learn from the ongoing UX research about how orgs want to control access to AI features and customer feedback to determine if the solution proposed in this issue needs to amended.
UX research is ongoing and should be concluding around 2023-11-01 (ish)