Create add-on purchases when applying an offline license

Prior to this change, add-on purchases were only created for online
cloud licenses during an instance activation or the daily/manual seat
sync.

This change provisions and deprovisions add-on purchases when applying
an offline license as well. The deprovisioning is also already part of
the logic to destroy a license and doesn't require additional changes.

Changelog: added
EE: true

config/initializers/1_settings.rb

@@ -930,6 +930,9 @@
   Settings.cron_jobs['gitlab_subscriptions_add_on_purchases_cleanup_worker'] ||= {}
   Settings.cron_jobs['gitlab_subscriptions_add_on_purchases_cleanup_worker']['cron'] ||= '0 1 * * *'
   Settings.cron_jobs['gitlab_subscriptions_add_on_purchases_cleanup_worker']['job_class'] = 'GitlabSubscriptions::AddOnPurchases::CleanupWorker'
+  Settings.cron_jobs['gitlab_subscriptions_offline_cloud_license_provision_worker'] ||= {}
+  Settings.cron_jobs['gitlab_subscriptions_offline_cloud_license_provision_worker']['cron'] ||= '30 0 * * *'
+  Settings.cron_jobs['gitlab_subscriptions_offline_cloud_license_provision_worker']['job_class'] = 'GitlabSubscriptions::AddOnPurchases::OfflineCloudLicenseProvisionWorker'
   Settings.cron_jobs['observability_alert_query_worker'] ||= {}
   Settings.cron_jobs['observability_alert_query_worker']['cron'] ||= '* * * * *'
   Settings.cron_jobs['observability_alert_query_worker']['job_class'] = 'Observability::AlertQueryWorker'

ee/app/workers/all_queues.yml

@@ -345,6 +345,15 @@
   :weight: 1
   :idempotent: true
   :tags: []
+- :name: cronjob:gitlab_subscriptions_add_on_purchases_offline_cloud_license_provision
+  :worker_name: GitlabSubscriptions::AddOnPurchases::OfflineCloudLicenseProvisionWorker
+  :feature_category: :add-on_provisioning
+  :has_external_dependencies: false
+  :urgency: :low
+  :resource_boundary: :unknown
+  :weight: 1
+  :idempotent: true
+  :tags: []
 - :name: cronjob:gitlab_subscriptions_add_on_purchases_schedule_bulk_refresh_user_assignments
   :worker_name: GitlabSubscriptions::AddOnPurchases::ScheduleBulkRefreshUserAssignmentsWorker
   :feature_category: :seat_cost_management

ee/app/workers/gitlab_subscriptions/add_on_purchases/offline_cloud_license_provision_worker.rb

+# frozen_string_literal: true
+
+module GitlabSubscriptions
+  module AddOnPurchases
+    class OfflineCloudLicenseProvisionWorker
+      include ::Gitlab::Utils::StrongMemoize
+      include ApplicationWorker
+      include CronjobQueue # rubocop:disable Scalability/CronWorkerContext -- Context unnecessary
+
+      data_consistency :sticky
+      feature_category :"add-on_provisioning"
+      idempotent!
+
+      def perform
+        return unless license&.offline_cloud_license?
+
+        log_event provision_add_on_purchases
+      end
+
+      private
+
+      def license
+        License.current
+      end
+      strong_memoize_attr :license
+
+      def provision_add_on_purchases
+        ::GitlabSubscriptions::AddOnPurchases::SelfManaged::ProvisionServices::Duo.new.execute
+      end
+
+      def log_event(response)
+        Gitlab::AppLogger.info(
+          message: 'Offline license checked for potentially new add-on purchases',
+          subscription_id: license.subscription_id,
+          subscription_name: license.subscription_name,
+          response: response.to_h
+        )
+      end
+    end
+  end
+end

ee/spec/workers/gitlab_subscriptions/add_on_purchases/offline_cloud_license_provision_worker_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe GitlabSubscriptions::AddOnPurchases::OfflineCloudLicenseProvisionWorker, :without_license, feature_category: :subscription_management do
+  it_behaves_like 'worker with data consistency', described_class, data_consistency: :sticky
+
+  it { is_expected.to include_module(ApplicationWorker) }
+  it { is_expected.to include_module(CronjobQueue) }
+  it { expect(described_class.get_feature_category).to eq(:"add-on_provisioning") }
+
+  describe '#perform' do
+    subject(:perform) { described_class.new.perform }
+
+    let_it_be(:default_organization) { create(:organization, :default) }
+    let_it_be(:restrictions) do
+      {
+        subscription_id: "0000001",
+        subscription_name: "SUB-001",
+        add_on_products: {
+          duo_pro: [
+            {
+              quantity: 1,
+              started_on: Date.current.to_s,
+              expires_on: 1.year.from_now.to_date.to_s,
+              purchase_xid: "A-S000001",
+              trial: false
+            }
+          ]
+        }
+      }
+    end
+
+    let(:gitlab_license) { build(:gitlab_license, :offline, restrictions: restrictions) }
+    let!(:license) { create(:license, data: gitlab_license.export) }
+    let(:execution_log) do
+      {
+        message: 'Offline license checked for potentially new add-on purchases',
+        response: {
+          add_on_purchase: kind_of(GitlabSubscriptions::AddOnPurchase),
+          http_status: :ok,
+          message: nil,
+          reason: nil,
+          status: :success
+        },
+        subscription_id: license.subscription_id,
+        subscription_name: license.subscription_name
+      }
+    end
+
+    it_behaves_like 'an idempotent worker'
+
+    it 'provisions add-on purchases' do
+      expect { perform }.to change { GitlabSubscriptions::AddOnPurchase.count }.by(1)
+    end
+
+    it { is_expected.to be_present }
+
+    it 'logs execution' do
+      expect(Gitlab::AppLogger).to receive(:info).with(execution_log)
+
+      perform
+    end
+
+    shared_examples 'does nothing' do
+      it 'provisions no add-on purchases' do
+        expect { perform }.not_to change { GitlabSubscriptions::AddOnPurchase.count }
+      end
+
+      it { is_expected.to be_nil }
+
+      it 'does not log execution' do
+        expect(Gitlab::AppLogger).not_to receive(:info)
+
+        perform
+      end
+    end
+
+    context 'without license' do
+      let(:license) { nil }
+
+      it_behaves_like 'does nothing'
+    end
+
+    context 'with online license' do
+      let(:gitlab_license) { build(:gitlab_license, :online, restrictions: restrictions) }
+
+      it_behaves_like 'does nothing'
+    end
+
+    context 'with legacy license' do
+      # Legacy licenses do not include add_on_products in the restrictions attribute,
+      # but we provide them for testing to ensure there are no changes in the add-on purchase count.
+      let(:gitlab_license) { build(:gitlab_license, :legacy, restrictions: restrictions) }
+
+      it_behaves_like 'does nothing'
+    end
+  end
+end