Add feature flag to cut off cloud connector free_access?

- Add specs
- The feature flag is only accessible for Self-Signed on Staging and for dev and testing environments.

ee/config/feature_flags/ops/cloud_connector_cut_off_date_expired.yml

+---
+name: cloud_connector_cut_off_date_expired
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/479121
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/165312
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/483364
+milestone: '17.5'
+group: group::cloud connector
+type: ops
+default_enabled: false

ee/lib/cloud_connector/self_signed/available_service_data.rb

@@ -14,6 +14,11 @@ def initialize(name, cut_off_date, bundled_with, backend)
         @backend = backend
       end
 
+      override :free_access?
+      def free_access?
+        cut_off_date_expired_enabled? ? false : super
+      end
+
       override :access_token
       def access_token(resource = nil, extra_claims: {})
         ::Gitlab::CloudConnector::SelfIssuedToken.new(
@@ -26,6 +31,12 @@ def access_token(resource = nil, extra_claims: {})
 
       private
 
+      def cut_off_date_expired_enabled?
+        return false unless ::Gitlab.dev_or_test_env? || ::Gitlab.staging?
+
+        Feature.enabled?(:cloud_connector_cut_off_date_expired, :instance, type: :ops)
+      end
+
       def scopes_for(resource)
         free_access? ? allowed_scopes_during_free_access : allowed_scopes_from_purchased_bundles_for(resource)
       end

ee/spec/lib/cloud_connector/self_signed/available_service_data_spec.rb

@@ -3,16 +3,40 @@
 require 'spec_helper'
 
 RSpec.describe CloudConnector::SelfSigned::AvailableServiceData, feature_category: :cloud_connector do
+  let(:cut_off_date) { 1.month.ago }
+  let(:bundled_with) { {} }
+  let(:backend) { 'gitlab-ai-gateway' }
+  let(:available_service_data) { described_class.new(:duo_chat, cut_off_date, bundled_with, backend) }
+
+  describe '#free_access?' do
+    subject(:free_access) { available_service_data.free_access? }
+
+    let(:cut_off_date) { 1.month.from_now }
+
+    context 'when cloud_connector_cut_off_date_expired feature flag is disabled' do
+      before do
+        stub_feature_flags(cloud_connector_cut_off_date_expired: false)
+      end
+
+      it { is_expected.to be true }
+    end
+
+    context 'when cloud_connector_cut_off_date_expired feature flag is enabled' do
+      before do
+        stub_feature_flags(cloud_connector_cut_off_date_expired: true)
+      end
+
+      it { is_expected.to be false }
+    end
+  end
+
   describe '#access_token' do
     let(:resource) { create(:user) }
     let(:encoded_token_string) { 'token_string' }
-    let(:cut_off_date) { 1.month.ago }
     let(:dc_unit_primitives) { [:duo_chat_up1, :duo_chat_up2] }
     let(:duo_pro_scopes) { dc_unit_primitives + [:duo_chat_up3] }
     let(:duo_extra_scopes) { dc_unit_primitives + [:duo_chat_up4] }
     let(:bundled_with) { { "duo_pro" => duo_pro_scopes, "duo_extra" => duo_extra_scopes } }
-    let(:backend) { 'gitlab-ai-gateway' }
-    let(:available_service_data) { described_class.new(:duo_chat, cut_off_date, bundled_with, backend) }
     let(:extra_claims) { {} }
     let(:expected_token) do
       instance_double('Gitlab::CloudConnector::SelfIssuedToken', encoded: encoded_token_string)

ee/spec/spec_helper.rb

@@ -29,6 +29,13 @@
     metadata[:without_license] = true
   end
 
+  config.before do |example|
+    if example.metadata.fetch(:stub_feature_flags, true)
+      # Specs should not require cut_off_date to be expired by default for cloud connector features.
+      stub_feature_flags(cloud_connector_cut_off_date_expired: false)
+    end
+  end
+
   config.before(:context, :with_license) do
     License.destroy_all # rubocop: disable Cop/DestroyAll
     TestLicense.init