Do not redirect beta users from secrets details

What does this MR do and why?

This fixes a bug where going to the secrets details page redirects the user to the secrets index page. This applies when the entitlement state is trial_eligible, but users who participated in the beta program should be exempted from this check since they would have existing secrets they created from the beta period.

Additionally, I added a small fix to make sure we show the feedback link to everyone regardless of the entitlement state (it currently doesn't show for trial_eligible).

References

Fixes some items in #629297 (closed).

Screenshots or screen recordings

Before After

Also notice that the feedback and Documentation links are now available to trial_eligible.

If the secrets manager has not been enabled yet, a user going to the secrets details page (of a secrets that does not exist yet) will still be redirected to the empty state:

Screenshot_2026-09-22_at_17.34.25

How to set up and validate locally

Setting up the secrets manager

  1. Make sure you're running on SaaS: GITLAB_SIMULATE_SAAS=1 gdk start

  2. Set up the GDK with OpenBao: https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/main/doc/howto/openbao.md

  3. Enable the following feature flags: secrets_manager, group_secrets_manager, secrets_manager_namespace_enrollment, secrets_manager_paid_experience.

  4. Run the following on rails console:

    # must be a top-level group
    g = Group.find_by_full_path('<your-tlg>')
    
    # enable licensed feature
    GitlabSubscription.create!(namespace: g, hosted_plan: Plan.find_by(name: 'ultimate'))
    
    # enroll them in the beta program
    SecretsManagement::NamespaceEnrollment.create!(namespace: g, beta: true)
  5. The entitlement resolver communicates with the CDot API. We will monkey-patch this and mock the results of the API so we can control the entitlement state locally. To mock the API, add these files config/secrets_manager_stub.yml and config/initializers/zz_secrets_manager_stub.rb and restart your gdk. This will mock the entitlement state returned by GraphQL (which we normally get from CDot).

    secrets_manager_stub.yml

    zz_secrets_manager_stub.rb

These will allow you to test with different entitlement states. By default, it is trial_eligible. If you need to clear/reset the cached entitlement, run SecretsManagement::Entitlement.stub_reset! from the rails console.

Verifying the feature

  1. Go to /path-to-your-tlg/-/secrets and set up the secrets manager by starting a trial. Create a new secret.
  2. Enable the end_secrets_manager_beta_program feature flag.
  3. Go to /path-to-your-tlg/-/secrets and click on the secret you just created from the secrets table. You should be redirected to the details page.
  4. If you change the entitlement state to paid, you should still be able to see the links to the documentation and feedback form.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Mireya Andres

Merge request reports

Loading
Loading