Add the Organization access page behind a feature flag

Tim Rizzirequested to merge
629700-organization-access-page into master

What does this MR do and why?

This MR adds an empty "Organization access" page behind a feature flag. It is step 1.1 of Organization Access.

Page: GET /o/:organization_path/-/access (access_organization_path) renders an empty page titled "Organization access". Controller: Organizations::AccessController#index in ee/app/controllers/organizations/access_controller.rb. View: ee/app/views/organizations/access/index.html.haml. It has a #js-organization-access mount element with data-organization-path. Sidebar: an "Organization access" item in the Organization Manage menu. It lives in ee/lib/ee/sidebars/organizations/menus/manage_menu.rb and is hooked in with prepend_mod in the CE menu. Feature flag: new WIP flag organization_access_ui (user actor, default off). The page and the sidebar item are hidden when the flag is off. Access: only organization owners and instance admins can see the page and the item. It uses the existing read_organization_user ability, the same one as the organization Users page. Plain members and non-members get a 404. Generated files: JS route helper accessOrganizationPath (bin/rake gitlab:js:routes), locale/gitlab.pot, and the Cells routes snapshot config/routing/gitlab_routes.json.

Not in this MR:

Work Where
Vue app for the page #629701
Artifact Registry access page #631817
Widen access to Artifact Admins #629722
Why owners only?

The issue left permissions open. The epic says the page is gated by the Org Admin role. read_organization_user already maps to owners, so we reuse it. The follow-up in #629722 will widen access to Artifact Admins.

Router sync skipped: This MR has the pipeline:skip-router-sync label. The paired HTTP Router MR, gitlab-org/cells/http-router!1405 (merged), is merged. It adds the routes for this MR and the stacked MR !259772 at once. So the router snapshot includes /o/:organization_path/-/access/artifact-registry, which only !259772 adds, and the cells-routes:router-in-sync check fails here for that one route. !259772 runs the check without the label.

Database: no database changes.

References

Screenshots or screen recordings

Not needed. The only UI is an empty page and one sidebar item. The Vue app comes in #629701.

How to set up and validate locally

  1. Enable the feature flags in the Rails console. 
    Feature.enable(:org_pages)
Feature.enable(:organization_access_ui)
  2. Sign in as an organization owner and open the organization.
  3. Go to Manage > Organization access. It opens /o/<path>/-/access with an empty page.
  4. Disable the flag. 
    Feature.disable(:organization_access_ui)
  5. Reload. The sidebar item is gone and the URL returns 404.

Tests: 24 examples pass locally, including the existing organization sidebar specs.

  • ee/spec/requests/organizations/access_controller_spec.rb: owner gets 200 with the mount element. Flag off, org_pages off, member without owner role, and non-member all get 404. Signed-out users go to sign in.
  • ee/spec/lib/ee/sidebars/organizations/menus/manage_menu_spec.rb: owner sees the item and it links to the page. Flag off hides it. A member does not see it.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Generated with Claude Code

Edited by Tim Rizzi

Merge request reports