Gate Orbit on the orbit_promo add-on on GitLab.com

What does this MR do and why?

During the Orbit promo, a group needs the orbit_promo add-on or an active trial to use Orbit. Premium or Ultimate alone is not enough. This MR adds that gate on GitLab.com behind the orbit_promo_access_gate flag, off by default. Self-managed does not change.

With the flag on, the REST API, MCP, code navigation, and the Knowledge Graph JWT apply the gate. Beta groups lose access and can start a trial. Owners can still turn Orbit off.

Database queries

Add-on lookup for the root groups of a user (at most 500 ids):

SELECT "subscription_add_on_purchases"."namespace_id" FROM "subscription_add_on_purchases"
WHERE "subscription_add_on_purchases"."subscription_add_on_uid" = 10
  AND (started_at IS NULL OR started_at <= '2026-10-08') AND ('2026-10-08' < expires_on)
  AND "subscription_add_on_purchases"."namespace_id" IN (9970, 9971)

Add-on check for one group:

SELECT 1 AS one FROM "subscription_add_on_purchases"
WHERE "subscription_add_on_purchases"."subscription_add_on_uid" = 10
  AND (started_at IS NULL OR started_at <= '2026-10-08') AND ('2026-10-08' < expires_on)
  AND "subscription_add_on_purchases"."namespace_id" = 9970 LIMIT 1

Trials in progress for root groups with Orbit on:

SELECT "orbit_namespace_enrollments"."namespace_id" FROM "orbit_namespace_enrollments"
WHERE "orbit_namespace_enrollments"."source" = 2 AND "orbit_namespace_enrollments"."trial_ended_at" IS NULL
  AND "orbit_namespace_enrollments"."namespace_id" IN (
    SELECT "knowledge_graph_enabled_namespaces"."root_namespace_id" FROM "knowledge_graph_enabled_namespaces"
    WHERE "knowledge_graph_enabled_namespaces"."root_namespace_id" IN (9970, 9971))

Beta row to trial row when a trial starts:

UPDATE "orbit_namespace_enrollments" SET "source" = 2, "updated_at" = NOW()
WHERE "orbit_namespace_enrollments"."source" = 1 AND "orbit_namespace_enrollments"."namespace_id" = 9970

Plans: TODO.

References

https://gitlab.com/groups/gitlab-org/-/work_items/23874

Screenshots or screen recordings

N/A (backend only)

How to set up and validate locally

1. Run GDK with GITLAB_SIMULATE_SAAS=1.

2. In a Rails console, take a Premium top-level group and enable the flag for it:

   Feature.enable(:orbit_promo_access_gate, group)
   Analytics::KnowledgeGraph::OrbitLicense.entitled?(group) # => false

3. Add the add-on and check again:

   GitlabSubscriptions::AddOnPurchase.create!(
     add_on: GitlabSubscriptions::AddOn.find_or_create_by_name(:orbit_promo),
     namespace: group, organization: group.organization,
     quantity: 1, started_at: Date.current, expires_on: 1.year.from_now, purchase_xid: 'A-S00000001'
   )
   Analytics::KnowledgeGraph::OrbitLicense.entitled?(group) # => true

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.