WPB-25314 team feature: preventAdminlessGroups

[battermann]

https://wearezeta.atlassian.net/browse/WPB-25314

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[Copilot]

Pull request overview

This PR introduces a new team feature flag/config, preventAdminlessGroups, and wires it through the Wire API type system, Galley public/internal feature endpoints, Stern admin endpoints, and integration tests so it can be configured and lock/unlocked like other team features.

Changes:

• Add PreventAdminlessGroupsConfig (including schema/types/defaults) and register it in the global Features list and feature-defaults infrastructure.
• Expose the feature via Galley public + internal feature APIs and Stern feature routes (GET/PUT + lock/unlock).
• Extend integration fixtures and add a dedicated integration test module for the new feature.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/stern/test/integration/API.hs	Adds Stern integration coverage for the new feature routes.
tools/stern/src/Stern/API/Routes.hs	Adds Stern API route entries (GET/PUT + lock/unlock) for the new feature.
tools/stern/src/Stern/API.hs	Wires Stern handlers/sitemap entries for the new feature routes.
services/galley/src/Galley/API/Teams/Features.hs	Registers SetFeatureConfig instance for the new feature config type.
services/galley/src/Galley/API/Public/Feature.hs	Extends Galley public feature API wiring to include the new feature.
services/galley/src/Galley/API/Internal.hs	Extends Galley internal feature API wiring (including lock status update route).
libs/wire-subsystems/src/Wire/FeaturesConfigSubsystem/Types.hs	Registers GetFeatureConfig instance for the new config.
libs/wire-api/src/Wire/API/Team/FeatureFlags.hs	Adds defaults wrapper/newtype for the new feature config.
libs/wire-api/src/Wire/API/Team/Feature.hs	Defines PreventAdminlessGroupsConfig + promotion strategy enum and registers it as a feature.
libs/wire-api/src/Wire/API/Routes/Public/Galley/Feature.hs	Adds the new feature to the public feature API type.
libs/wire-api/src/Wire/API/Routes/Internal/Galley.hs	Adds the new feature to internal lock-status put endpoints.
integration/test/Test/FeatureFlags/Util.hs	Extends default feature fixtures JSON to include the new feature.
integration/test/Test/FeatureFlags/PreventAdminlessGroups.hs	Adds integration tests for valid/invalid updates and patch semantics.
integration/integration.cabal	Includes the new test module in the integration test library.
changelog.d/2-features/WPB-25314	Adds changelog entry for the new team feature.

Comments suppressed due to low confidence (1)

tools/stern/src/Stern/API/Routes.hs:476

• Similarly for the lock/unlock route id: this block uses "domain-registration-lock" / "channels-lock", while the new entry is "lock-unlock-route-prevent-adminless-groups-config". Consider using a consistent id scheme within this block (and update Stern/API.hs accordingly).

    :<|> Named "domain-registration-lock" (MkFeatureLockUnlockRoute DomainRegistrationConfig)
    :<|> Named "channels-lock" (MkFeatureLockUnlockRoute ChannelsConfig)
    :<|> Named "lock-unlock-route-prevent-adminless-groups-config" (MkFeatureLockUnlockRoute PreventAdminlessGroupsConfig)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.