Add user callout for instances with registration enabled by default

Shown only to admins to let them know that anybody can register on
their instance

app/assets/javascripts/persistent_user_callouts.js

@@ -6,6 +6,7 @@ const PERSISTENT_USER_CALLOUTS = [
   '.js-admin-licensed-user-count-threshold',
   '.js-buy-pipeline-minutes-notification-callout',
   '.js-token-expiry-callout',
+  '.js-registration-enabled-callout',
 ];
 
 const initCallouts = () => {

app/helpers/application_settings_helper.rb

@@ -394,6 +394,10 @@ module ApplicationSettingsHelper
   def show_documentation_base_url_field?
     Feature.enabled?(:help_page_documentation_redirect)
   end
+
+  def signup_enabled?
+    !!Gitlab::CurrentSettings.signup_enabled
+  end
 end
 
 ApplicationSettingsHelper.prepend_if_ee('EE::ApplicationSettingsHelper')

app/helpers/user_callouts_helper.rb

@@ -10,6 +10,7 @@ module UserCalloutsHelper
   WEBHOOKS_MOVED = 'webhooks_moved'
   CUSTOMIZE_HOMEPAGE = 'customize_homepage'
   FEATURE_FLAGS_NEW_VERSION = 'feature_flags_new_version'
+  REGISTRATION_ENABLED_CALLOUT = 'registration_enabled_callout'
 
   def show_admin_integrations_moved?
     !user_dismissed?(ADMIN_INTEGRATIONS_MOVED)
@@ -55,6 +56,10 @@ module UserCalloutsHelper
     !user_dismissed?(FEATURE_FLAGS_NEW_VERSION)
   end
 
+  def show_registration_enabled_user_callout?
+    current_user&.admin? && signup_enabled? && !user_dismissed?(REGISTRATION_ENABLED_CALLOUT)
+  end
+
   private
 
   def user_dismissed?(feature_name, ignore_dismissal_earlier_than = nil)

app/models/user_callout.rb

@@ -25,7 +25,8 @@ class UserCallout < ApplicationRecord
     personal_access_token_expiry: 21,          # EE-only
     suggest_pipeline: 22,
     customize_homepage: 23,
-    feature_flags_new_version: 24
+    feature_flags_new_version: 24,
+    registration_enabled_callout: 25
   }
 
   validates :user, presence: true

app/views/admin/projects/show.html.haml

@@ -14,7 +14,7 @@
 - if @project.last_repository_check_failed?
   .row
     .col-md-12
-      .gl-alert.gl-alert-danger.gl-mb-5
+      .gl-alert.gl-alert-danger.gl-mb-5{ data: { testid: 'last-repository-check-failed-alert' } }
         = sprite_icon('error', size: 16, css_class: 'gl-icon gl-alert-icon gl-alert-icon-no-title')
         .gl-alert-body
           - last_check_message = _("Last repository check (%{last_check_timestamp}) failed. See the 'repocheck.log' file for error messages.")

app/views/layouts/_page.html.haml

@@ -10,6 +10,7 @@
       = render_if_exists "layouts/header/token_expiry_notification"
       = render "layouts/broadcast"
       = render "layouts/header/read_only_banner"
+      = render "layouts/header/registration_enabled_callout"
       = render "layouts/nav/classification_level_banner"
       = yield :flash_message
       = render "shared/ping_consent"

app/views/layouts/header/_registration_enabled_callout.html.haml

+- return unless show_registration_enabled_user_callout?
+
+%div{ class: [container_class, @content_class, 'gl-pt-5!'] }
+  .gl-alert.gl-alert-warning.js-registration-enabled-callout{ role: 'alert', data: { feature_id: UserCalloutsHelper::REGISTRATION_ENABLED_CALLOUT, dismiss_endpoint: user_callouts_path } }
+    = sprite_icon('warning', size: 16, css_class: 'gl-alert-icon')
+    %button.gl-alert-dismiss.js-close{ type: 'button', aria: { label: _('Close') }, data: { testid: 'close-registration-enabled-callout' } }
+      = sprite_icon('close', size: 16)
+    .gl-alert-title
+      = _('Open registration is enabled on your instance.')
+    .gl-alert-body
+      = html_escape(_('%{anchorOpen}Learn more%{anchorClose} about how you can customize / disable registration on your instance.')) % { anchorOpen: "<a href=\"#{help_page_path('user/admin_area/settings/sign_up_restrictions')}\">".html_safe, anchorClose: '</a>'.html_safe }
+    .gl-alert-actions
+      = link_to general_admin_application_settings_path(anchor: 'js-signup-settings'), class: 'btn gl-alert-action btn-info btn-md gl-button' do
+        %span.gl-button-text
+          = _('View setting')

changelogs/unreleased/237905-add-signup-enabled-alert.yml

+---
+title: Add user callout to alert admins that registration is open by default
+merge_request: 47425
+author:
+type: added

ee/app/views/layouts/header/_licensed_user_count_threshold.html.haml

@@ -2,7 +2,7 @@
 .container-fluid.container-limited.pt-3
   .gl-alert.gl-alert-info.gitlab-ee-license-banner.js-admin-licensed-user-count-threshold{ role: 'alert', data: { feature_id: UserCalloutsHelper::ACTIVE_USER_COUNT_THRESHOLD, dismiss_endpoint: user_callouts_path } }
     = sprite_icon('information-o', css_class: 'gl-icon gl-alert-icon')
-    %button.js-close.gl-alert-dismiss{ type: 'button', 'aria-label' => _('Dismiss') }
+    %button.js-close.gl-alert-dismiss{ type: 'button', 'aria-label' => _('Dismiss'), data: { testid: 'gitlab-ee-license-banner-dismiss' } }
       = sprite_icon('close', css_class: 'gl-icon')
     .gl-alert-body
       %h4.gl-alert-title= _('Your instance is approaching its licensed user count')

ee/spec/features/admin/licenses/show_user_count_threshold_spec.rb

@@ -52,7 +52,7 @@ RSpec.describe 'Display approaching user count limit banner', :js do
         context 'when banner was dismissed' do
           before do
             visit admin_root_path
-            find('.gl-alert-dismiss').click
+            find('[data-testid="gitlab-ee-license-banner-dismiss"]').click
           end
 
           it_behaves_like 'a hidden banner'

locale/gitlab.pot

@@ -356,6 +356,9 @@ msgstr ""
 msgid "%{address} is an invalid IP address range"
 msgstr ""
 
+msgid "%{anchorOpen}Learn more%{anchorClose} about how you can customize / disable registration on your instance."
+msgstr ""
+
 msgid "%{author_link} wrote:"
 msgstr ""
 
@@ -19003,6 +19006,9 @@ msgstr ""
 msgid "Open raw"
 msgstr ""
 
+msgid "Open registration is enabled on your instance."
+msgstr ""
+
 msgid "Open sidebar"
 msgstr ""
 
@@ -29803,6 +29809,9 @@ msgstr ""
 msgid "View replaced file @ "
 msgstr ""
 
+msgid "View setting"
+msgstr ""
+
 msgid "View supported languages and frameworks"
 msgstr ""
 

spec/features/admin/admin_uses_repository_checks_spec.rb

@@ -46,7 +46,7 @@ RSpec.describe 'Admin uses repository checks', :request_store, :clean_gitlab_red
       )
       visit_admin_project_page(project)
 
-      page.within('.gl-alert') do
+      page.within('[data-testid="last-repository-check-failed-alert"]') do
         expect(page.text).to match(/Last repository check \(just now\) failed/)
       end
     end

spec/features/callouts/registration_enabled_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Registration enabled callout' do
+  let_it_be(:admin) { create(:admin) }
+  let_it_be(:non_admin) { create(:user) }
+
+  context 'when "Sign-up enabled" setting is `true`' do
+    before do
+      stub_application_setting(signup_enabled: true)
+    end
+
+    context 'when an admin is logged in' do
+      before do
+        sign_in(admin)
+        visit root_dashboard_path
+      end
+
+      it 'displays callout' do
+        expect(page).to have_content 'Open registration is enabled on your instance.'
+        expect(page).to have_link 'View setting', href: general_admin_application_settings_path(anchor: 'js-signup-settings')
+      end
+
+      context 'when callout is dismissed', :js do
+        before do
+          find('[data-testid="close-registration-enabled-callout"]').click
+
+          visit root_dashboard_path
+        end
+
+        it 'does not display callout' do
+          expect(page).not_to have_content 'Open registration is enabled on your instance.'
+        end
+      end
+    end
+
+    context 'when a non-admin is logged in' do
+      before do
+        sign_in(non_admin)
+        visit root_dashboard_path
+      end
+
+      it 'does not display callout' do
+        expect(page).not_to have_content 'Open registration is enabled on your instance.'
+      end
+    end
+  end
+end

spec/helpers/application_settings_helper_spec.rb

@@ -166,4 +166,32 @@ RSpec.describe ApplicationSettingsHelper do
       it { is_expected.to eq(false) }
     end
   end
+
+  describe '.signup_enabled?' do
+    subject { helper.signup_enabled? }
+
+    context 'when signup is enabled' do
+      before do
+        stub_application_setting(signup_enabled: true)
+      end
+
+      it { is_expected.to be true }
+    end
+
+    context 'when signup is disabled' do
+      before do
+        stub_application_setting(signup_enabled: false)
+      end
+
+      it { is_expected.to be false }
+    end
+
+    context 'when `signup_enabled` is nil' do
+      before do
+        stub_application_setting(signup_enabled: nil)
+      end
+
+      it { is_expected.to be false }
+    end
+  end
 end

spec/helpers/user_callouts_helper_spec.rb

@@ -161,4 +161,50 @@ RSpec.describe UserCalloutsHelper do
       it { is_expected.to be_falsy }
     end
   end
+
+  describe '.show_registration_enabled_user_callout?' do
+    let_it_be(:admin) { create(:user, :admin) }
+
+    subject { helper.show_registration_enabled_user_callout? }
+
+    context 'when `current_user` is not an admin' do
+      before do
+        allow(helper).to receive(:current_user).and_return(user)
+        stub_application_setting(signup_enabled: true)
+        allow(helper).to receive(:user_dismissed?).with(described_class::REGISTRATION_ENABLED_CALLOUT) { false }
+      end
+
+      it { is_expected.to be false }
+    end
+
+    context 'when signup is disabled' do
+      before do
+        allow(helper).to receive(:current_user).and_return(admin)
+        stub_application_setting(signup_enabled: false)
+        allow(helper).to receive(:user_dismissed?).with(described_class::REGISTRATION_ENABLED_CALLOUT) { false }
+      end
+
+      it { is_expected.to be false }
+    end
+
+    context 'when user has dismissed callout' do
+      before do
+        allow(helper).to receive(:current_user).and_return(admin)
+        stub_application_setting(signup_enabled: true)
+        allow(helper).to receive(:user_dismissed?).with(described_class::REGISTRATION_ENABLED_CALLOUT) { true }
+      end
+
+      it { is_expected.to be false }
+    end
+
+    context 'when `current_user` is an admin, signup is enabled, and user has not dismissed callout' do
+      before do
+        allow(helper).to receive(:current_user).and_return(admin)
+        stub_application_setting(signup_enabled: true)
+        allow(helper).to receive(:user_dismissed?).with(described_class::REGISTRATION_ENABLED_CALLOUT) { false }
+      end
+
+      it { is_expected.to be true }
+    end
+  end
 end