Fix Duo Enterprise add-on check to use seat assignment instead of namespace membership

What does this MR do and why?

Fixes the Duo Enterprise add-on check in Ai::DuoCodeReview::Modes::Dap to correctly validate seat assignments instead of namespace membership.

The bug was in user_has_duo_enterprise_add_on? which used for_active_add_ons([:duo_enterprise], user). This method checks if the user is a member of a namespace with active Duo Enterprise purchases, not whether the user has been assigned a seat.

This is incorrect because:

  • A user can be a namespace member without having a seat assigned
  • The check should validate actual seat assignment, not just membership

More context: https://gitlab.com/gitlab-org/gitlab/-/issues/587404#note_3048444301

How to set up and validate locally

  1. Create a namespace with Duo Enterprise add-on
  2. Add a user as a member and assign them a seat
  3. Verify the user cannot access DAP code review (classic duo code review should be used)
  4. Un-assign the user a seat
  5. Verify the user can now access DAP code review

Screenshots

Seat Assigned Seat Un-assigned
assigned_seat Screenshot_2026-01-30_at_2.12.00_PM

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to https://gitlab.com/gitlab-org/gitlab/-/issues/587404

Edited by Kinshuk Singh

Merge request reports

Loading