feat: gate token API access and account webhooks behind api_and_webhooks flag

spec/controllers/api/base_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'API Base', type: :request do
-  let!(:account) { create(:account) }
+  let!(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
   let!(:user) { create(:user, account: account) }
 
   describe 'request with api_access_token for user' do
@@ -23,6 +23,32 @@ RSpec.describe 'API Base', type: :request do
       end
     end
 
+    context 'when the account does not have the api_and_webhooks feature' do
+      let!(:admin) { create(:user, :administrator, account: account) }
+      let!(:conversation) { create(:conversation, account: account) }
+
+      before do
+        account.disable_features!('api_and_webhooks')
+      end
+
+      it 'returns unauthorized for token authenticated requests' do
+        get "/api/v1/accounts/#{account.id}/conversations/#{conversation.display_id}",
+            headers: { api_access_token: admin.access_token.token },
+            as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.parsed_body['error']).to eq('Invalid Access Token')
+      end
+
+      it 'allows session authenticated requests' do
+        get "/api/v1/accounts/#{account.id}/conversations/#{conversation.display_id}",
+            headers: admin.create_new_auth_token,
+            as: :json
+
+        expect(response).to have_http_status(:success)
+      end
+    end
+
     context 'when it is an invalid api_access_token' do
       it 'returns unauthorized' do
         get '/api/v1/profile',
@@ -94,6 +120,19 @@ RSpec.describe 'API Base', type: :request do
       end
     end
 
+    context 'when the account does not have the api_and_webhooks feature' do
+      it 'returns unauthorized for accessible bot endpoints' do
+        create(:agent_bot_inbox, inbox: inbox, agent_bot: agent_bot)
+        account.disable_features!('api_and_webhooks')
+
+        post "/api/v1/accounts/#{account.id}/conversations/#{conversation.display_id}/toggle_status",
+             headers: { api_access_token: agent_bot.access_token.token },
+             as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
     context 'when the account is suspended' do
       it 'returns 401 unauthorized' do
         account.update!(status: :suspended)

spec/controllers/api/v1/accounts/conversations/assignments_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversation Assignment API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'POST /api/v1/accounts/{account.id}/conversations/<id>/assignments' do
     let(:conversation) { create(:conversation, account: account) }

spec/controllers/api/v1/accounts/conversations/messages_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversation Messages API', type: :request do
-  let!(:account) { create(:account) }
+  let!(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'POST /api/v1/accounts/{account.id}/conversations/<id>/messages' do
     let!(:inbox) { create(:inbox, account: account) }

spec/controllers/api/v1/accounts/conversations_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversations API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'GET /api/v1/accounts/{account.id}/conversations' do
     context 'when it is an unauthenticated user' do

spec/controllers/api/v1/accounts/webhook_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Webhooks API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
   let(:inbox) { create(:inbox, account: account) }
   let(:webhook) { create(:webhook, account: account, inbox: inbox, url: 'https://hello.com', name: 'My Webhook') }
   let(:administrator) { create(:user, account: account, role: :administrator) }
@@ -26,6 +26,16 @@ RSpec.describe 'Webhooks API', type: :request do
         expect(response.parsed_body['payload']['webhooks'].count).to eql account.webhooks.count
       end
     end
+
+    context 'when api_and_webhooks feature is disabled' do
+      it 'returns unauthorized even for an admin' do
+        account.disable_features!('api_and_webhooks')
+        get "/api/v1/accounts/#{account.id}/webhooks",
+            headers: administrator.create_new_auth_token,
+            as: :json
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
   end
 
   describe 'POST /api/v1/accounts/<account_id>/webhooks' do