## Summary Introduce a single predicate over the Artifact Registry base URL setting and apply it to every Artifact Registry surface, so an instance whose base URL is unset or malformed hides every entry point, renders the Artifact Registry routes not-found, and returns service-unavailable to a direct GraphQL caller instead of leaking the setting's name. Based on the plan: [`docs/plans/monolith/2026-08-14-unconfigured-ar-base-url.md`](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/plans/monolith/2026-08-14-unconfigured-ar-base-url.md), added in [gitlab-org/ops/artifact-registry!1556](https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/1556). ## Context An instance whose Artifact Registry base URL is unset renders the pages, hides the URL-copy affordances without saying why, and fails every GraphQL query with the literal message `base_url is required`. The setting is absent by default in production, so this is the state a self-managed instance is in until an operator acts. ## Approach - **One predicate (`configured?`) for the gate and the browser value**, so they cannot disagree and a rendered page always carries a non-`nil` `client_base_url`. `HTTP_ORIGIN_PATTERN` is deleted. - **A distinct exception class, not a message swap.** `ConfigurationError` sits under the client's `Error` so `rescue ::ArgumentError` does not reach it; maps to service-unavailable with a log. - **No gate on the resolver or the mutation** — a resolver gate would return a null field, indistinguishable from the feature flag being off. The client constructor stays the single enforcement point for callers that bypass the routes. - **A new mount-data key (`artifact_registry_configured`), not a wider ability.** - **Scope:** one predicate applied to the routes and every entry point, plus a typed client exception. **Out of scope:** the rest of the transport rule (HTTPS except loopback, no query/fragment), owned by the S02 spec follow-ups. ## Acceptance - With `api_url` unset: navigation entries absent, the organization overview page renders neither the Artifact Registry link nor its wording, routes return 404. - Set to a well-formed URL: every surface behaves as today. - Set to `http://`, `ftp://host`, or a credential-bearing value: the unset behavior applies. - A direct `artifactRegistryRepositories` query and a repository mutation each return service-unavailable, no response body contains `base_url`, and that path logs; caller-input faults still render their own messages. <details> <summary>Implementation details</summary> ### Files - `ee/lib/artifact_registry/configuration.rb` (**Create**): `api_url`, `configured?`, `client_base_url`. `api_url` reads the stanza's hash key (raises `Gitlab::Configs::MissingConfig` on an instance that never set it). `configured?` parses through `Gitlab::Utils.parse_url`. - `ee/lib/artifact_registry/client.rb` (**Modify**): constructor fallback reads `Configuration.api_url`; adds `ConfigurationError` under the client's `Error`, raised from the constructor's base-URL guards. Caller-input `ArgumentError` sites unchanged. - `ee/app/graphql/resolvers/concerns/artifact_registry/renders_errors.rb` (**Modify**): a `ConfigurationError` arm that logs through `Gitlab::ErrorTracking` and raises the existing service-unavailable error. - `ee/app/helpers/organizations/artifact_registry_helper.rb` (**Modify**): `artifact_registry_client_base_url` delegates to `Configuration.client_base_url`; deletes `HTTP_ORIGIN_PATTERN`. Method keeps its name and signature. - `ee/app/controllers/concerns/artifact_registry_gating.rb` (**Modify**): `ensure_artifact_registry_available!` also requires `configured?`. - `ee/lib/sidebars/organizations/menus/artifact_registry_menu.rb` (**Modify**): `render?` also requires `configured?`. - `ee/lib/ee/sidebars/organizations/menus/settings_menu.rb` (**Modify**): `show_artifact_registry_menu_item?` also requires `configured?`. - `ee/app/helpers/ee/organizations/organization_helper.rb` (**Modify**): `organization_show_app_data` merges `artifact_registry_configured`. - `ee/app/assets/javascripts/organizations/show/index.js` (**Modify**): destructures `artifactRegistryConfigured`, passes it as a prop. - `ee/app/assets/javascripts/organizations/show/components/app.vue` (**Modify**): new required Boolean prop, ANDed into `showArtifactRegistry`. - `ee/app/helpers/organizations/settings/artifact_registry_helper.rb`: **no change** (inherits the delegation); its spec is still updated. **Feature flag:** `artifact_registry_ui`, unchanged. The new condition applies whether the flag is on or off. ### Tests - `ee/spec/lib/artifact_registry/configuration_spec.rb` (Create): accept/reject set + `client_base_url` nil/origin. - `ee/spec/lib/artifact_registry/client_spec.rb` (Modify): fallback through `Configuration.api_url`; `ConfigurationError` from each guard; caller-input sites still raising `ArgumentError` (assert both classes). - `ee/spec/graphql/resolvers/concerns/artifact_registry/renders_errors_spec.rb` (Modify): new arm under `:query` and `:mutation`, the log call, absence of the raised message. - `ee/spec/helpers/organizations/artifact_registry_helper_spec.rb` + `.../settings/artifact_registry_helper_spec.rb` (Modify): `client_base_url` against unset/malformed. - `ee/spec/helpers/ee/organizations/organization_helper_spec.rb` (Modify): new `artifact_registry_configured` key. - `ee/spec/requests/organizations/artifact_registry_controller_spec.rb`, `.../artifact_registry_repositories_controller_spec.rb`, `.../settings/artifact_registry_controller_spec.rb` (Modify): 404 with the setting unset. - `ee/spec/lib/sidebars/organizations/menus/artifact_registry_menu_spec.rb` + `.../ee/sidebars/organizations/menus/settings_menu_spec.rb` (Modify): entries hidden with the setting unset. - `ee/spec/frontend/organizations/show/components/app_spec.js` (Modify): link + wording absent when prop is `false`, present when `true`. ### Naming conventions | Name | Kind | Notes | | --- | --- | --- | | `ArtifactRegistry::Configuration` | Module, `ee/lib/artifact_registry/` | Beside the client, its main consumer | | `.api_url` | Module method | The raw value, or `nil` | | `.configured?` | Module method | The single precondition predicate | | `.client_base_url` | Module method | Origin for the browser, `nil` unless `configured?` | | `ArtifactRegistry::Client::ConfigurationError` | Exception class | Under the client's `Error` | | `artifact_registry_configured` | Mount-data key | Snake case in the Rails dataset | | `artifactRegistryConfigured` | Vue prop | Camel case after `convertObjectPropsToCamelCase` | ### Dependencies - A related issue for the `Related to` line the step's MR needs, since a `fix` is behavior-changing. - No unlanded monolith work blocks this step. `2026-08-04-activation-and-deactivation.md` calls `artifact_registry_client_base_url` and modifies both Artifact Registry helpers in unlanded steps; the method keeps its name and signature, and the helper edits are additive in either merge order. ### Testing strategy RSpec and Jest only. No new test type, no conformance surface, no Artifact Registry service change. The predicate is the only new unit under test; the entry points and routes are asserted at their own layers. E2E scenario impact: none. </details>