Added Visual Review Bot

- Added class method and bot_type enum value to User
- Granted no access except for create_note
- Will be used for anonymous visual review tools feedback

ee/app/models/ee/user.rb

@@ -82,7 +82,8 @@ module EE
 
       enum bot_type: {
         support_bot: 1,
-        alert_bot: 2
+        alert_bot: 2,
+        visual_review_bot: 3
       }
     end
 
@@ -107,6 +108,15 @@ module EE
         end
       end
 
+      def visual_review_bot
+        email_pattern = "visual_review%s@#{Settings.gitlab.host}"
+
+        unique_internal(where(bot_type: :visual_review_bot), 'visual-review-bot', email_pattern) do |u|
+          u.bio = 'The Gitlab Visual Review feedback bot'
+          u.name = 'Gitlab Visual Review Bot'
+        end
+      end
+
       override :internal
       def internal
         super.or(where.not(bot_type: nil))

ee/app/policies/ee/base_policy.rb

@@ -14,6 +14,9 @@ module EE
       with_scope :user
       condition(:alert_bot, score: 0) { @user&.alert_bot? }
 
+      with_scope :user
+      condition(:visual_review_bot, score: 0) { @user&.visual_review_bot? }
+
       with_scope :global
       condition(:license_block) { License.block_changes? }
     end

ee/app/policies/ee/policy_actor.rb

@@ -13,5 +13,9 @@ module EE
     def alert_bot?
       false
     end
+
+    def visual_review_bot?
+      false
+    end
   end
 end

ee/app/policies/ee/project_policy.rb

@@ -102,6 +102,11 @@ module EE
         prevent :read_project
       end
 
+      rule { visual_review_bot }.policy do
+        prevent :read_note
+        enable :create_note
+      end
+
       rule { license_block }.policy do
         prevent :create_issue
         prevent :create_merge_request_in
@@ -284,6 +289,7 @@ module EE
       return ::Gitlab::Access::NO_ACCESS if needs_new_sso_session?
       return ::Gitlab::Access::REPORTER if alert_bot?
       return ::Gitlab::Access::GUEST if support_bot? && service_desk_enabled?
+      return ::Gitlab::Access::NO_ACCESS if visual_review_bot?
 
       super
     end

ee/spec/models/user_spec.rb

@@ -571,8 +571,9 @@ describe User do
     let!(:ghost) { described_class.ghost }
     let!(:support_bot) { described_class.support_bot }
     let!(:alert_bot) { described_class.alert_bot }
+    let!(:visual_review_bot) { described_class.visual_review_bot }
     let!(:non_internal) { [user] }
-    let!(:internal) { [ghost, support_bot, alert_bot] }
+    let!(:internal) { [ghost, support_bot, alert_bot, visual_review_bot] }
 
     it 'returns non internal users' do
       expect(described_class.internal).to eq(internal)
@@ -591,6 +592,7 @@ describe User do
 
         expect(support_bot.bot?).to eq(true)
         expect(alert_bot.bot?).to eq(true)
+        expect(visual_review_bot.bot?).to eq(true)
       end
     end
   end

ee/spec/policies/project_policy_spec.rb

@@ -965,6 +965,14 @@ describe ProjectPolicy do
     end
   end
 
+  context 'visual review bot' do
+    let(:current_user) { User.visual_review_bot }
+
+    it { expect_allowed(:create_note) }
+    it { expect_disallowed(:read_note) }
+    it { expect_disallowed(:resolve_note) }
+  end
+
   context 'commit_committer_check is not enabled by the current license' do
     before do
       stub_licensed_features(commit_committer_check: false)