Draft: Add group setting to allow web search in Duo Chat

Rafa Fredericorequested to merge
604068-group-duo-web-search-toggle into master

This merge request adds the frontend for the group owner web search setting. Web search lets GitLab Duo Chat query an external search provider for current information the model cannot know from training data or GitLab context alone, such as package versions, vulnerability advisories, and deprecations. Because sending a question to an external provider is a compliance decision, only a group owner can turn it on for their group. It is off by default.

This is the second merge request in a two-merge-request stack. The branch is 604068-group-duo-web-search-toggle. It previously targeted master and now targets the backend branch 587234-group-web-search-setting-backend, which is !253643 (merged). That merge request must merge first.

An earlier version of this description said the control could not render because the backend attribute did not exist. That is no longer true. Stacked on the backend merge request, the checkbox renders and saves.

What this MR contains

  • A new controlled checkbox component, duo_web_search_form.vue.
  • Wiring in the group Duo settings page: the value, the dirty-state check that enables the Save button, the feature flag gate, and the REST payload key.
  • Parsing of the two data attributes the backend merge request adds.
  • Jest specs. 91 tests pass across the three affected suites, plus the 80 tests of the sibling admin settings suite that shares the mount helper. ESLint, Prettier, and the circular dependency check are clean.

Gating

The checkbox renders only when the dap_web_search feature flag is on and the backend reports the setting as available, meaning a top-level group and a user with the admin_duo_workflow ability.

Local validation

  1. Check out this branch, which already contains the backend commit.
  2. Run bin/rails db:migrate so the new column exists.
  3. Enable the dap_web_search feature flag from the Rails features endpoint.
  4. Open the group Duo settings configuration page for a top-level group you own.
  5. Confirm the checkbox appears under Data privacy.
  6. Tick it and save.
  7. Reload and confirm the value persisted.

Also set Duo availability to never on, to see the checkbox disable with an explanatory tooltip.

Reviewer notes

There is no changelog entry, because the dap_web_search flag is an experiment flag that is off by default. The backend merge request carries the changelog entry for the migration.

There is no documentation yet, for the same reason. Documentation belongs with the rollout.

There is one known accessibility limitation, pre-existing and shared with three sibling settings in the same section. When Duo availability is never on, the checkbox is disabled and a tooltip explains why, but a disabled checkbox is not keyboard reachable, so that explanation does not reach keyboard and screen reader users. Should this be fixed here for all four controls, or tracked separately?

Stack

This work is a three merge request stack:

  1. Backend, the group setting itself: !253643 (merged)
  2. Frontend, the group settings checkbox: !253620
  3. Honouring the setting in the chat UI: !253676

They must merge in that order.

References

Video recording

Edited by Rafa Frederico

Merge request reports