:warning: **We should ask AppSec (`@ameyadarshan`) to review the MRs that implement the confirmation skip to make sure we don't accidentally implement a loophole** Combination of these 2 issues: - Instance admin: https://gitlab.com/gitlab-org/gitlab/-/issues/523259+ - Group owner on behalf of their enterprise users only: https://gitlab.com/gitlab-org/gitlab/-/issues/503356+ ## Summary This issue addresses a problem where larger customers with many users need a way to auto-approve user contribution and membership mapping without requiring user confirmation emails, as users often don't check their emails, preventing reassignment completion. ## Proposed Solution 1. Add an Admin setting to allow admins to assign contributions from placeholders to users without requiring user confirmation 2. Show a warning banner on the "Placeholders" tab for admins when this setting is enabled, informing them that reassignment confirmation emails will be skipped 3. Display a popup when an admin performs a reassignment, requiring acknowledgment that it bypasses user confirmation and is not reversible (with a checkbox option to not show again) 4. Send emails to users after reassignment is completed to inform them that contributions were reassigned to them 5. Add event tracking for admin reassignment actions ## Security Considerations * No need to force admin users to enable 2FA specifically for this feature * GitLab already includes a feature to enforce 2FA for admin users (disabled by default) * The first recommendation in GitLab administration documentation is to enable 2FA ## Feature flag This feature is behind a feature flag `importer_user_mapping_allow_bypass_of_confirmation`.