Changes to the default group visibility should not break signup and registration flows

Problem

There is a dependency between the default group visibility settings and the signup and registration flow that can cause these flows to break when the default group visibility setting is changed to "Internal".

Additional information

⚠ This problem may also surface in other areas, not just signup&registration, but it may be easier to work around, whereas in signup user is stuck and can't complete the process.

ℹ There has been a change made that disabled "Internal" visibility for new projects and groups which may be connected (or even a root cause) to this problem

Next Steps

Investigate and implement a solution to handle these changes, and/or provide better alerting when this happens.

❓ Questions to answer

Q: How does normal Group creation outside of the registration process handle this? It is known that normal group creation has a visibility selection that signup does not, and does it hide the levels admin has restricted? If so, maybe we put that back(perhaps only in certain cases)?

A: When user has the option to select visibility, restricted levels are hidden, this is the case of normal group creation. There's another case that visibility is determined for user, is in creating group via import, visibility is set here where if creating top level group, visibility defaults to private.

Q: Does the admin settings allow for all visibility levels to be restricted? If so, should it?

A: Yes. We are arguing the level that is setting as the default group visibility should not be allowed to be restricted. But maybe only on SaaS, since SM use case can be complicated.

Q: Should admin setting even allow "Internal" as default visibility based on the change mentioned above?

A: On SaaS, no.

Q: Should/does there need to be a fix outside of registration group creation?

A: So far, the case when creating group via import needs to be fixed, since if private level is restricted, group creation will fail.

Proposed solution

In admin settings page, if on SaaS, disable Restricted visibility levels option which is setting as the Default group visibility to prevent conflict.

Related to gitlab-com/gl-infra/production#15788 (closed)