Skip to content

Consolidate CC services access check logic

Alejandro Rodríguezrequested to merge
consolidate-cc-service-access-check into master

What does this MR do and why?

In !162183 (merged) we added a enabled_by_namespace_ids method to CloudConnector::BaseAvailableServiceData to determine which namespaces allowed a user to use a given AI feature. The logic we implemented is incomplete: it only considers add-on purchases, but our full authorization logic also depends on other factors. For example:

  • The service's cut-off date
  • Whether any of the user groups has the FF duo_chat_requires_licensed_seat
  • Whether the feature is on SaaS or self-managed

Currently, this authorization logic is repeated on every individual AI service access check. We thus consolidate CloudConnector::BaseAvailableServiceData.enabled_for? as the Single Source of Truth for access checks, and make it provide the namespace IDs

Closes #473087 (closed)

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

Edited by Alejandro Rodríguez

Merge request reports