Skip to content

Prevent namespace creation on enabled BSO and on user limit

Summary

This issue tracks the implementation of seat management controls to prevent non-billable users from creating groups and projects when block seat overages (BSO) is activated and no seats are available.

Background

Organizations need better control over their GitLab usage to ensure they don't accidentally exceed their licensed capacity through new group and project creation. Currently, users can create groups and projects even when no seats are available, potentially causing new billable seats and with that unexpected billing.

Proposed Solution

  • Prevent users from creating groups and projects when block seat overages is activated and no seats are available
  • Update user interface text to clarify that "Restricted access" setting prevents both exceeding licensed seat count and stops non-members from creating groups/projects when seats aren't available
  • Only applies to Self-Managed instances (GitLab.com always allows creation in the user namespace and user already have specific roles applied)

Implementation Details

Backend Changes

  • Add seat_upgrade_allowed? method to GitlabSubscriptions::MemberManagement::BlockSeatOverages
  • Override allow_user_to_create_group_and_project? in EE::User model to check seat availability
  • Logic flow:
    1. Always allow on GitLab.com
    2. Allow if block seat overages are disabled
    3. Allow if seats are available for the user
    4. Otherwise deny

Frontend Changes

  • Update help text for "Restricted access" setting to include group/project creation restrictions
  • Text change: "Prevent the billable user count from exceeding the number of seats in the license and non-members from creating groups and projects."

Acceptance Criteria

  • Users cannot create groups when BSO is enabled and no seats available (self-managed only)
  • Users cannot create projects when BSO is enabled and no seats available (self-managed only)
  • GitLab.com users are unaffected (always allowed)
  • UI text accurately describes the restriction behavior
  • Comprehensive test coverage for all scenarios

Related Work

Technical Notes

The implementation uses the existing seat availability checking logic from BlockSeatOverages service, ensuring consistency with other seat management features.

Edited by Lukas Wanko