Display Namespace User Cap Reached Banner

app/views/layouts/_page.html.haml

@@ -17,6 +17,7 @@
       = render_two_factor_auth_recovery_settings_check
       = render_if_exists "layouts/header/ee_subscribable_banner"
       = render_if_exists "shared/namespace_storage_limit_alert"
+      = render_if_exists "shared/namespace_user_cap_reached_alert"
       = render_if_exists "shared/new_user_signups_cap_reached_alert"
       = yield :page_level_alert
       = yield :customize_homepage_banner

ee/app/helpers/ee/namespace_user_cap_reached_alert_helper.rb

+# frozen_string_literal: true
+
+module EE
+  module NamespaceUserCapReachedAlertHelper
+    def display_namespace_user_cap_reached_alert?(namespace)
+      root_namespace = namespace.root_ancestor
+      return false unless ::Feature.enabled?(:saas_user_caps, root_namespace, default_enabled: :yaml)
+
+      return false if root_namespace.user_namespace?
+
+      can?(current_user, :admin_namespace, root_namespace) && user_cap_reached?(root_namespace)
+    end
+
+    private
+
+    def user_cap_reached?(root_namespace)
+      Rails.cache.fetch("namespace_user_cap_reached:#{root_namespace.id}", expires_in: 2.hours) do
+        root_namespace.user_cap_reached?
+      end
+    end
+  end
+end

ee/app/views/shared/_namespace_user_cap_reached_alert.html.haml

+- return unless current_user
 - namespace = @project&.namespace || @group
 - return unless namespace.present?
+- return unless display_namespace_user_cap_reached_alert?(namespace)
 
 - root_namespace = namespace.root_ancestor
 - pending_users_link = usage_quotas_path(root_namespace, anchor: 'seats-quota-tab')

ee/spec/features/namespace_user_cap_reached_alert_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Namespace user cap reached alert', :feature, :js do
+  let_it_be(:group, refind: true) do
+    create(:group, :public,
+           namespace_settings: create(:namespace_settings, new_user_signups_cap: 2))
+  end
+
+  let_it_be(:subgroup, refind: true) { create(:group, parent: group) }
+  let_it_be(:project) { create(:project, namespace: subgroup) }
+  let_it_be(:owner) { create(:user) }
+  let_it_be(:developer) { create(:user) }
+  let_it_be(:subgroup_owner) { create(:user) }
+
+  before_all do
+    group.add_owner(owner)
+    group.add_developer(developer)
+    subgroup.add_owner(subgroup_owner)
+  end
+
+  context 'with an exceeded user cap' do
+    it 'displays the banner to a group owner' do
+      sign_in(owner)
+      visit group_path(group)
+
+      expect(page).to have_text 'Your group has reached its billable member limit'
+    end
+
+    it 'displays the banner to a group owner on a subgroup page' do
+      sign_in(owner)
+      visit group_path(subgroup)
+
+      expect(page).to have_text 'Your group has reached its billable member limit'
+    end
+
+    it 'displays the banner to a group owner on a project page' do
+      sign_in(owner)
+      visit project_path(project)
+
+      expect(page).to have_text 'Your group has reached its billable member limit'
+    end
+
+    it 'does not display the banner when the feature flag is off' do
+      stub_feature_flags(saas_user_caps: false)
+      sign_in(owner)
+      visit group_path(group)
+
+      expect_banner_to_be_absent(group)
+    end
+
+    it 'does not display the banner to a user who is not a group owner' do
+      sign_in(developer)
+      visit group_path(group)
+
+      expect_banner_to_be_absent(group)
+    end
+
+    it 'does not display the banner to a user who owns a subgroup' do
+      sign_in(subgroup_owner)
+      visit group_path(subgroup)
+
+      expect_banner_to_be_absent(subgroup)
+    end
+
+    it 'does not display the banner to an unauthenticated user' do
+      visit group_path(group)
+
+      expect_banner_to_be_absent(group)
+    end
+  end
+
+  context 'with a user cap that has not been exceeded' do
+    before do
+      group.namespace_settings.update!(new_user_signups_cap: 4)
+    end
+
+    it 'does not display the banner to a group owner' do
+      sign_in(owner)
+      visit group_path(group)
+
+      expect_banner_to_be_absent(group)
+    end
+  end
+
+  context 'without a user cap set' do
+    before do
+      group.namespace_settings.update!(new_user_signups_cap: nil)
+    end
+
+    it 'does not display the banner to a group owner' do
+      sign_in(owner)
+      visit group_path(group)
+
+      expect_banner_to_be_absent(group)
+    end
+  end
+
+  context 'with a user namespace' do
+    it 'renders the page without a banner' do
+      personal_project = create(:project, namespace: owner.namespace)
+
+      sign_in(owner)
+      visit project_path(personal_project)
+
+      expect(page).to have_text owner.name
+      expect(page).to have_text personal_project.name
+      expect(page).not_to have_text 'Your group has reached its billable member limit'
+    end
+  end
+
+  def expect_banner_to_be_absent(group)
+    expect(page).to have_text group.name
+    expect(page).to have_text "Group ID: #{group.id}"
+    expect(page).not_to have_text 'Your group has reached its billable member limit'
+  end
+end

ee/spec/views/shared/_namespace_user_cap_reached_alert.html.haml_spec.rb

@@ -3,12 +3,23 @@
 require 'spec_helper'
 
 RSpec.describe 'shared/namespace_user_cap_reached_alert' do
-  let_it_be(:group) { create(:group) }
+  let_it_be(:group, refind: true) { create(:group, namespace_settings: create(:namespace_settings, new_user_signups_cap: 1)) }
   let_it_be(:subgroup) { create(:group, parent: group) }
-  let_it_be(:project) { create(:project) }
+  let_it_be(:other_group) { create(:group, namespace_settings: create(:namespace_settings, new_user_signups_cap: 1)) }
+  let_it_be(:project, refind: true) { create(:project, namespace: other_group) }
+  let_it_be(:owner) { create(:user) }
 
   let(:partial) { 'shared/namespace_user_cap_reached_alert' }
 
+  before_all do
+    group.add_owner(owner)
+    other_group.add_owner(owner)
+  end
+
+  before do
+    allow(view).to receive(:current_user).and_return(owner)
+  end
+
   it 'renders a link to pending user approvals' do
     assign(:group, group)