Fix email confirmation for subgroup/project service accounts

What does this MR do and why?

Skips email confirmation for subgroup/project service account creation and updates when the desired email uses a domain the top-level group has verified. If created outside the top-level group, email confirmation is required.

Note: A subgroup Owner or a project Maintainer with no membership in the root group can now create or update a service account with a pre-confirmed email when the desired email uses a domain the top-level group has verified.

This already happens for top-level group SAs, however, it seems this wasn't handled when Allow service account creation for subgroups an... (!225485 - merged) was implemented.

Note: removing the CE skip_confirmation? override in GroupUpdateService also fixes a latent bug in FOSS. Group#owner_of_email? only exists in EE (ee/group.rb#L660), so the old CE code raised NoMethodError when email confirmation was on.

References

• !225485 (merged)

Screenshots or screen recordings

Before	After

How to set up and validate locally

1. Simulate SaaS

2. Allow top-level group Owners to create service accounts

3. Create a top-level group

4. Create a project within the group

5. Verify a domain within the top-level group *

   group = Group.find(GROUP_ID)
   project = group.projects.first
   project.pages_domains.create!(domain: 'example.com', verified_at: Time.current)

6. Create a service account with an email that matches the verified domain, in a:

   • Subgroup
   • Project or subgroup project
   • Another top-level group, etc.

7. If created in the hierarchy of the verifying group, the email is confirmed. If created elsewhere, it requires confirmation.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.