The work_items feature flag checks 3 actors

work_items FF can be enabled at the project, group
or root_ancestor level

app/controllers/projects/issues_controller.rb

@@ -48,7 +48,7 @@ class Projects::IssuesController < Projects::ApplicationController
     push_frontend_feature_flag(:confidential_notes, project&.group, default_enabled: :yaml)
     push_frontend_feature_flag(:issue_assignees_widget, project, default_enabled: :yaml)
     push_frontend_feature_flag(:paginated_issue_discussions, project, default_enabled: :yaml)
-    push_frontend_feature_flag(:work_items, project&.group, default_enabled: :yaml)
+    push_force_frontend_feature_flag(:work_items, project&.work_items_feature_flag_enabled?)
   end
 
   around_action :allow_gitaly_ref_name_caching, only: [:discussions]

app/controllers/projects/work_items_controller.rb

@@ -2,12 +2,12 @@
 
 class Projects::WorkItemsController < Projects::ApplicationController
   before_action do
-    push_frontend_feature_flag(:work_items, project, default_enabled: :yaml)
+    push_force_frontend_feature_flag(:work_items, project&.work_items_feature_flag_enabled?)
   end
 
   feature_category :not_owned
 
   def index
-    render_404 unless Feature.enabled?(:work_items, project, default_enabled: :yaml)
+    render_404 unless project&.work_items_feature_flag_enabled?
   end
 end

app/controllers/projects_controller.rb

@@ -41,7 +41,7 @@ class ProjectsController < Projects::ApplicationController
     push_frontend_feature_flag(:increase_page_size_exponentially, @project, default_enabled: :yaml)
     push_frontend_feature_flag(:new_dir_modal, @project, default_enabled: :yaml)
     push_licensed_feature(:file_locks) if @project.present? && @project.licensed_feature_available?(:file_locks)
-    push_frontend_feature_flag(:work_items, @project, default_enabled: :yaml)
+    push_force_frontend_feature_flag(:work_items, @project&.work_items_feature_flag_enabled?)
   end
 
   layout :determine_layout

app/graphql/mutations/work_items/create.rb

@@ -33,7 +33,7 @@ module Mutations
       def resolve(project_path:, **attributes)
         project = authorized_find!(project_path)
 
-        unless Feature.enabled?(:work_items, project, default_enabled: :yaml)
+        unless project.work_items_feature_flag_enabled?
           return { errors: ['`work_items` feature flag disabled for this project'] }
         end
 

app/graphql/mutations/work_items/create_from_task.rb

@@ -31,7 +31,7 @@ module Mutations
       def resolve(id:, work_item_data:)
         work_item = authorized_find!(id: id)
 
-        unless Feature.enabled?(:work_items, work_item.project, default_enabled: :yaml)
+        unless work_item.project.work_items_feature_flag_enabled?
           return { errors: ['`work_items` feature flag disabled for this project'] }
         end
 

app/graphql/mutations/work_items/delete.rb

@@ -20,7 +20,7 @@ module Mutations
       def resolve(id:)
         work_item = authorized_find!(id: id)
 
-        unless Feature.enabled?(:work_items, work_item.project, default_enabled: :yaml)
+        unless work_item.project.work_items_feature_flag_enabled?
           return { errors: ['`work_items` feature flag disabled for this project'] }
         end
 

app/graphql/mutations/work_items/update.rb

@@ -28,7 +28,7 @@ module Mutations
       def resolve(id:, **attributes)
         work_item = authorized_find!(id: id)
 
-        unless Feature.enabled?(:work_items, work_item.project, default_enabled: :yaml)
+        unless work_item.project.work_items_feature_flag_enabled?
           return { errors: ['`work_items` feature flag disabled for this project'] }
         end
 

app/graphql/resolvers/work_item_resolver.rb

@@ -12,7 +12,7 @@ module Resolvers
 
     def resolve(id:)
       work_item = authorized_find!(id: id)
-      return unless Feature.enabled?(:work_items, work_item.project, default_enabled: :yaml)
+      return unless work_item.project.work_items_feature_flag_enabled?
 
       work_item
     end

app/graphql/resolvers/work_items/types_resolver.rb

@@ -11,7 +11,7 @@ module Resolvers
                             ' Argument is experimental and can be removed in the future without notice.'
 
       def resolve(taskable: nil)
-        return unless Feature.enabled?(:work_items, object, default_enabled: :yaml)
+        return unless feature_flag_enabled_for_parent?(object)
 
         # This will require a finder in the future when groups/projects get their work item types
         # All groups/projects use the default types for now
@@ -20,6 +20,14 @@ module Resolvers
 
         base_scope.order_by_name_asc
       end
+
+      private
+
+      def feature_flag_enabled_for_parent?(parent)
+        return false unless parent.is_a?(::Project) || parent.is_a?(::Group)
+
+        parent.work_items_feature_flag_enabled?
+      end
     end
   end
 end

app/models/group.rb

@@ -815,6 +815,15 @@ class Group < Namespace
     ].compact.min
   end
 
+  def work_items_feature_flag_enabled?
+    actors = [root_ancestor]
+    actors << self if root_ancestor != self
+
+    actors.any? do |actor|
+      Feature.enabled?(:work_items, actor, default_enabled: :yaml)
+    end
+  end
+
   private
 
   def max_member_access(user_ids)

app/models/project.rb

@@ -2832,6 +2832,10 @@ class Project < ApplicationRecord
     pending_delete? || hidden?
   end
 
+  def work_items_feature_flag_enabled?
+    group&.work_items_feature_flag_enabled? || Feature.enabled?(:work_items, self, default_enabled: :yaml)
+  end
+
   private
 
   # overridden in EE

lib/gitlab/gon_helper.rb

@@ -73,6 +73,15 @@ module Gitlab
       push_to_gon_attributes(:features, name, enabled)
     end
 
+    # Exposes the state of a feature flag to the frontend code.
+    # Can be used for more complex feature flag checks.
+    #
+    # name - The name of the feature flag, e.g. `my_feature`.
+    # enabled - Boolean to be pushed directly to the frontend. Should be fetched by checking a feature flag.
+    def push_force_frontend_feature_flag(name, enabled)
+      push_to_gon_attributes(:features, name, !!enabled)
+    end
+
     def push_to_gon_attributes(key, name, enabled)
       var_name = name.to_s.camelize(:lower)
       # Here the `true` argument signals gon that the value should be merged

spec/graphql/resolvers/work_items/types_resolver_spec.rb

@@ -53,5 +53,15 @@ RSpec.describe Resolvers::WorkItems::TypesResolver do
 
       it_behaves_like 'a work item type resolver'
     end
+
+    context 'when parent is not a group or project' do
+      let(:object) { 'not a project/group' }
+
+      it 'returns nil because of feature flag check' do
+        result = resolve(described_class, obj: object, args: {})
+
+        expect(result).to be_nil
+      end
+    end
   end
 end

spec/lib/gitlab/gon_helper_spec.rb

@@ -64,6 +64,34 @@ RSpec.describe Gitlab::GonHelper do
     end
   end
 
+  describe '#push_force_frontend_feature_flag' do
+    let(:gon) { class_double('Gon') }
+
+    before do
+      skip_feature_flags_yaml_validation
+
+      allow(helper)
+        .to receive(:gon)
+        .and_return(gon)
+    end
+
+    it 'pushes a feature flag to the frontend with the provided value' do
+      expect(gon)
+        .to receive(:push)
+        .with({ features: { 'myFeatureFlag' => true } }, true)
+
+      helper.push_force_frontend_feature_flag(:my_feature_flag, true)
+    end
+
+    it 'pushes a disabled feature flag if provided value is nil' do
+      expect(gon)
+        .to receive(:push)
+        .with({ features: { 'myFeatureFlag' => false } }, true)
+
+      helper.push_force_frontend_feature_flag(:my_feature_flag, nil)
+    end
+  end
+
   describe '#default_avatar_url' do
     it 'returns an absolute URL' do
       url = helper.default_avatar_url

spec/models/group_spec.rb

@@ -3248,4 +3248,46 @@ RSpec.describe Group do
       it_behaves_like 'no effective expiration interval'
     end
   end
+
+  describe '#work_items_feature_flag_enabled?' do
+    let_it_be(:root_group) { create(:group) }
+    let_it_be(:group) { create(:group, parent: root_group) }
+    let_it_be(:project) { create(:project, group: group) }
+
+    subject { group.work_items_feature_flag_enabled? }
+
+    context 'when work_items FF is enabled for the root group' do
+      before do
+        stub_feature_flags(work_items: root_group)
+      end
+
+      it { is_expected.to be_truthy }
+    end
+
+    context 'when work_items FF is enabled for the group' do
+      before do
+        stub_feature_flags(work_items: group)
+      end
+
+      it { is_expected.to be_truthy }
+
+      context 'when root_group is the actor' do
+        it 'is not enabled if the FF is enabled for a child' do
+          expect(root_group).not_to be_work_items_feature_flag_enabled
+        end
+      end
+    end
+
+    context 'when work_items FF is disabled globally' do
+      before do
+        stub_feature_flags(work_items: false)
+      end
+
+      it { is_expected.to be_falsey }
+    end
+
+    context 'when work_items FF is enabled globally' do
+      it { is_expected.to be_truthy }
+    end
+  end
 end

spec/models/project_spec.rb

@@ -8011,6 +8011,62 @@ RSpec.describe Project, factory_default: :keep do
     end
   end
 
+  describe '#work_items_feature_flag_enabled?' do
+    shared_examples 'project checking work_items feature flag' do
+      context 'when work_items FF is disabled globally' do
+        before do
+          stub_feature_flags(work_items: false)
+        end
+
+        it { is_expected.to be_falsey }
+      end
+
+      context 'when work_items FF is enabled for the project' do
+        before do
+          stub_feature_flags(work_items: project)
+        end
+
+        it { is_expected.to be_truthy }
+      end
+
+      context 'when work_items FF is enabled globally' do
+        it { is_expected.to be_truthy }
+      end
+    end
+
+    subject { project.work_items_feature_flag_enabled? }
+
+    context 'when a project does not belong to a group' do
+      let_it_be(:project) { create(:project, namespace: namespace) }
+
+      it_behaves_like 'project checking work_items feature flag'
+    end
+
+    context 'when project belongs to a group' do
+      let_it_be(:root_group) { create(:group) }
+      let_it_be(:group) { create(:group, parent: root_group) }
+      let_it_be(:project) { create(:project, group: group) }
+
+      it_behaves_like 'project checking work_items feature flag'
+
+      context 'when work_items FF is enabled for the root group' do
+        before do
+          stub_feature_flags(work_items: root_group)
+        end
+
+        it { is_expected.to be_truthy }
+      end
+
+      context 'when work_items FF is enabled for the group' do
+        before do
+          stub_feature_flags(work_items: group)
+        end
+
+        it { is_expected.to be_truthy }
+      end
+    end
+  end
+
   describe 'serialization' do
     let(:object) { build(:project) }
 

spec/requests/projects/work_items_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Work Items' do
+  let_it_be(:work_item) { create(:work_item) }
+  let_it_be(:developer) { create(:user) }
+
+  before_all do
+    work_item.project.add_developer(developer)
+  end
+
+  describe 'GET /:namespace/:project/work_items/:id' do
+    before do
+      sign_in(developer)
+    end
+
+    context 'when the work_items feature flag is enabled' do
+      it 'renders index' do
+        get project_work_items_url(work_item.project, work_items_path: work_item.id)
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+
+    context 'when the work_items feature flag is disabled' do
+      before do
+        stub_feature_flags(work_items: false)
+      end
+
+      it 'returns 404' do
+        get project_work_items_url(work_item.project, work_items_path: work_item.id)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+    end
+  end
+end