Fix self-managed admin/owner cannot enroll namespaces into Orbit
What does this MR do and why?
On self-managed, instance admins and top-level group Owners couldn't enroll a namespace into Orbit from the UI even with a valid Premium/Ultimate license and the knowledge_graph flag on. The only working path was a Rails console command.
The :update_knowledge_graph_setting group ability is granted to Owners through the role system (and to admins via admin_all_resources), but the prevent rule in ee/app/policies/ee/group_policy.rb also required knowledge_graph_saas_mode, which is always false on self-managed, so the ability was blocked for everyone including root. This MR drops that SaaS gate from the prevent rule, so enrollment is governed only by the meaningful conditions that already applied on SaaS: namespace eligibility (root group, :orbit licensed) and the knowledge_graph flag. On self-managed, licensed_feature_available?(:orbit) reads the instance license, so eligibility stays deployment-aware. It also fixes the /dashboard/orbit empty state, which told licensed self-managed instances they lacked a Premium license they actually have. All the other UI surfaces (GraphQL knowledgeGraphAvailable, /admin/orbit, group settings, ToggleNamespaceService) share this ability check, so they're fixed by the same change.
How to set up and validate locally
- Self-managed GDK with a Premium or Ultimate license.
Feature.enable(:knowledge_graph).- As root or a top-level group Owner, visit
/dashboard/orbit. Before: empty state claiming a Premium license is required. After: eligible groups appear with a working "Turn on" button.
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
Related to #606374 (closed)