3 files changed, 21 insertions, 0 deletions
diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb
index db858fd6796..a823b8a93fb 100644
--- a/app/models/application_setting.rb
+++ b/app/models/application_setting.rb
@@ -720,6 +720,10 @@ class ApplicationSetting < MainClusterwide::ApplicationRecord
     allow_nil: false,
     inclusion: { in: [true, false], message: N_('must be a boolean value') }
 
+  validates :ai_access_token,
+    presence: { message: N_("is required to enable Code Suggestions") },
+    if: :instance_level_code_suggestions_enabled
+
   attr_encrypted :asset_proxy_secret_key,
     mode: :per_attribute_iv,
     key: Settings.attr_encrypted_db_key_base_truncated,
@@ -948,4 +952,5 @@ class ApplicationSetting < MainClusterwide::ApplicationRecord
   end
 end
 
+ApplicationSetting.prepend(ApplicationSettingMaskedAttrs)
 ApplicationSetting.prepend_mod_with('ApplicationSetting')
diff --git a/app/models/application_setting_implementation.rb b/app/models/application_setting_implementation.rb
index ea07fe99c99..c73bdf8793c 100644
--- a/app/models/application_setting_implementation.rb
+++ b/app/models/application_setting_implementation.rb
@@ -37,6 +37,7 @@ module ApplicationSettingImplementation
       {
         admin_mode: false,
         after_sign_up_text: nil,
+        ai_access_token: nil,
         akismet_enabled: false,
         akismet_api_key: nil,
         allow_local_requests_from_system_hooks: true,
@@ -104,6 +105,7 @@ module ApplicationSettingImplementation
         housekeeping_gc_period: 200,
         housekeeping_incremental_repack_period: 10,
         import_sources: Settings.gitlab['import_sources'],
+        instance_level_code_suggestions_enabled: false,
         invisible_captcha_enabled: false,
         issues_create_limit: 300,
         jira_connect_application_key: nil,
diff --git a/app/models/concerns/application_setting_masked_attrs.rb b/app/models/concerns/application_setting_masked_attrs.rb
new file mode 100644
index 00000000000..14a7185e39e
--- /dev/null
+++ b/app/models/concerns/application_setting_masked_attrs.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# Similar to MASK_PASSWORD mechanism we do for EE, see:
+# https://gitlab.com/gitlab-org/gitlab/-/blob/463bb1f855d71fadef931bd50f1692ee04f211a8/ee/app/models/ee/application_setting.rb#L15
+# but for non-EE attributes.
+module ApplicationSettingMaskedAttrs
+  MASK = '*****'
+
+  def ai_access_token=(value)
+    return if value == MASK
+
+    super
+  end
+end