fix(security): gate custom_role and SLA assignment on their premium feature flags

enterprise/app/controllers/enterprise/api/v1/accounts/agents_controller.rb

@@ -15,6 +15,8 @@ module Enterprise::Api::V1::Accounts::AgentsController
     # `super` may render payment-required without creating an agent (seat limit lost in the locked check);
     # skip the association so that response is preserved instead of raising on a nil agent.
     return if @agent.blank?
+    # Custom roles are a premium feature; ignore custom_role_id assignment when the feature is disabled.
+    return unless Current.account.feature_enabled?('custom_roles')
 
     @agent.current_account_user.update!(custom_role_id: params[:custom_role_id])
   end

enterprise/app/controllers/enterprise/api/v1/accounts/conversations_controller.rb

@@ -16,6 +16,9 @@ module Enterprise::Api::V1::Accounts::ConversationsController
   end
 
   def permitted_update_params
+    # SLA is a premium feature; only accept sla_policy_id assignment when it is enabled for the account.
+    return super unless Current.account.feature_enabled?('sla')
+
     super.merge(params.permit(:sla_policy_id))
   end
 

spec/enterprise/controllers/enterprise/api/v1/accounts/agents_controller_spec.rb

@@ -5,6 +5,8 @@ RSpec.describe 'Enterprise Agents API', type: :request do
   let(:admin) { create(:user, account: account, role: :administrator) }
   let!(:custom_role) { create(:custom_role, account: account) }
 
+  before { account.enable_features!('custom_roles') }
+
   describe 'POST /api/v1/accounts/{account.id}/agents' do
     let(:params) { { email: 'test@example.com', name: 'Test User', role: 'agent', custom_role_id: custom_role.id } }