feat: gate token API access and account webhooks behind api_and_webhooks flag

app/controllers/api/v1/accounts/base_controller.rb

@@ -2,5 +2,12 @@ class Api::V1::Accounts::BaseController < Api::BaseController
   include SwitchLocale
   include EnsureCurrentAccountHelper
   before_action :current_account
+  before_action :validate_token_api_access, if: :authenticate_by_access_token?
   around_action :switch_locale_using_account_locale
+
+  private
+
+  def validate_token_api_access
+    render_unauthorized('Invalid Access Token') unless Current.account.feature_enabled?('api_and_webhooks')
+  end
 end

app/controllers/api/v1/accounts/webhooks_controller.rb

@@ -1,4 +1,5 @@
 class Api::V1::Accounts::WebhooksController < Api::V1::Accounts::BaseController
+  before_action :ensure_api_and_webhooks_enabled
   before_action :check_authorization
   before_action :fetch_webhook, only: [:update, :destroy]
 
@@ -22,6 +23,10 @@ class Api::V1::Accounts::WebhooksController < Api::V1::Accounts::BaseController
 
   private
 
+  def ensure_api_and_webhooks_enabled
+    render_unauthorized('You are not authorized to do this action') unless Current.account.feature_enabled?('api_and_webhooks')
+  end
+
   def webhook_params
     params.require(:webhook).permit(:inbox_id, :name, :url, subscriptions: [])
   end