Update docs and add feature flag

Remove mention of access token in docs. Also
mention enabling the feature flag for feedback.

Since visual review tools don't work without the
anonymous feedback endpoint which is behind
a feature flag, I'm hiding the visual review tools
behind the same feature flag.

app/assets/javascripts/vue_merge_request_widget/components/mr_widget_pipeline_container.vue

@@ -62,7 +62,7 @@ export default {
       return this.isPostMerge ? this.mr.mergePipeline : this.mr.pipeline;
     },
     showVisualReviewAppLink() {
-      return this.mr.visualReviewAppAvailable;
+      return this.mr.visualReviewAppAvailable && this.mr.visualReviewFF;
     },
     showMergeTrainPositionIndicator() {
       return _.isNumber(this.mr.mergeTrainIndex);

doc/ci/review_apps/index.md

@@ -163,6 +163,9 @@ that spawned the Review App.
 
 ### Configuring Visual Reviews
 
+Ensure that the `anonymous_visual_review_feedback` feature flag is enabled on
+your GitLab instance or project if you are self-hosting.
+
 The feedback form is served through a script you add to pages in your Review App.
 If you have [Developer permissions](../../user/permissions.md) to the project,
 you can access it by clicking the **Review** button in the **Pipeline** section
@@ -221,6 +224,17 @@ NOTE: **Note:**
 Future enhancements [are planned](https://gitlab.com/gitlab-org/gitlab/issues/11322)
 to make this process even easier.
 
+### Determining merge request ID
+
+The merge request ID can be automatically determined through the script tag
+via the data attribute `data-merge-request-id`.
+
+There are three ways to provide a merge request ID to a Visual Review app:
+
+- By hardcoding it in the script tag via the data attribute `data-merge-request-id`
+- Dynamically adding the `data-merge-request-id` value during build.
+- Supplying it manually through the visual review form.
+
 ### Using Visual Reviews
 
 After Visual Reviews has been [enabled](#configuring-visual-reviews) for the
@@ -231,25 +245,15 @@ the bottom-right corner.
 
 To use the feedback form:
 
-1. Create a [personal access token](../../user/profile/personal_access_tokens.md)
-   with the API scope selected.
-1. Paste the token into the feedback box when prompted. If you select **Remember me**,
-   your browser stores the token so that future visits to Review Apps at the same URL
-   will not require you to re-enter the token. To clear the token, click **Log out**.
 1. Make a comment on the visual review. You can make use of all the
    [Markdown annotations](../../user/markdown.md) that are also available in
    merge request comments.
+1. Submit your feedback anonymously or add your name.
 1. Finally, click **Send feedback**.
 
 After you make and submit a comment in the visual review box, it will appear
 automatically in the respective merge request.
 
-TIP: **Tip:**
-Because tokens must be entered on a per-domain basis and they can only be accessed
-once, different review apps will not remember your token. You can save the token
-to your password manager specifically for the purpose of Visual Reviews. This way,
-you will not need to create additional tokens for each merge request.
-
 ## Limitations
 
 Review App limitations are the same as [environments limitations](../environments.md#limitations).

ee/app/assets/javascripts/vue_merge_request_widget/stores/mr_widget_store.js

@@ -31,6 +31,7 @@ export default class MergeRequestStore extends CEMergeRequestStore {
     this.canDismissVulnerability = Boolean(this.createVulnerabilityFeedbackDismissalPath);
     this.canCreateFeedback = data.can_create_feedback || false;
     this.visualReviewAppAvailable = Boolean(data.visual_review_app_available);
+    this.visualReviewFF = gon && gon.features && gon.features.anonymousVisualReviewFeedback;
     this.appUrl = gon && gon.gitlab_url;
 
     this.initCodeclimate(data);

ee/app/controllers/ee/projects/merge_requests_controller.rb

@@ -16,6 +16,7 @@ module EE
           push_frontend_feature_flag(:container_scanning_merge_request_report_api, default_enabled: true)
           push_frontend_feature_flag(:dependency_scanning_merge_request_report_api, default_enabled: true)
           push_frontend_feature_flag(:parsed_license_report)
+          push_frontend_feature_flag(:anonymous_visual_review_feedback)
         end
 
         before_action :whitelist_query_limiting_ee_merge, only: [:merge]