Check if user is allowed to use Agentic Chat in the current context

What does this MR do and why?

In gitlab-org/modelops/applied-ml/code-suggestions/ai-assist#1769 (closed) we noticed a bug where a user who has more than one Duo-enabled namespace but no default namespace selected would generate billable events with null namespace ids. In these cases, we require the user to configure their default namespace to be able to access Agentic Chat.

References

Closes gitlab-org/modelops/applied-ml/code-suggestions/ai-assist#1769 (closed)

Screenshots or screen recordings

Before	After

How to set up and validate locally

• Add export GITLAB_SIMULATE_SAAS=1 to your GDK's env.runit
• gdk restart
• Setup at least two namespaces with Duo enabled:
  • GITLAB_SIMULATE_SAAS=1 gdk rails gitlab:duo:setup (will setup group gitlab-duo)
  • In a gdk rails console: Gitlab::Duo::Developments::GitlabComStrategy.new('gitlab-org', {}).execute
• Pick another namespace, leave it and enable Duo on it:
  • Go to http://gdk.test:3000/groups/twitter/-/group_members, pick another owner and leave the group
  • In a gdk rails console: Gitlab::Duo::Developments::GitlabComStrategy.new('twitter', {}).execute
• Navigate to the namespace with Duo access you belong to, http://gdk.test:3000/gitlab-duo. You should be able to use Agentic Chat
• Navigate to a namespace with Duo access you don't belong to, http://gdk.test:3000/twitter. You should only be able to use non-agentic Chat
• Navigate to a path that doesn't belong to a namespace, e.g. http://gdk.test:3000. You should see a message asking you to choose a default namespace

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.