feat: gate token API access and account webhooks behind api_and_webhooks flag

spec/controllers/api/v1/accounts/conversations/assignments_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversation Assignment API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'POST /api/v1/accounts/{account.id}/conversations/<id>/assignments' do
     let(:conversation) { create(:conversation, account: account) }

spec/controllers/api/v1/accounts/conversations/messages_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversation Messages API', type: :request do
-  let!(:account) { create(:account) }
+  let!(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'POST /api/v1/accounts/{account.id}/conversations/<id>/messages' do
     let!(:inbox) { create(:inbox, account: account) }

spec/controllers/api/v1/accounts/conversations_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversations API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'GET /api/v1/accounts/{account.id}/conversations' do
     context 'when it is an unauthenticated user' do

spec/controllers/api/v1/accounts/webhook_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Webhooks API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
   let(:inbox) { create(:inbox, account: account) }
   let(:webhook) { create(:webhook, account: account, inbox: inbox, url: 'https://hello.com', name: 'My Webhook') }
   let(:administrator) { create(:user, account: account, role: :administrator) }
@@ -26,6 +26,16 @@ RSpec.describe 'Webhooks API', type: :request do
         expect(response.parsed_body['payload']['webhooks'].count).to eql account.webhooks.count
       end
     end
+
+    context 'when api_and_webhooks feature is disabled' do
+      it 'returns unauthorized even for an admin' do
+        account.disable_features!('api_and_webhooks')
+        get "/api/v1/accounts/#{account.id}/webhooks",
+            headers: administrator.create_new_auth_token,
+            as: :json
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
   end
 
   describe 'POST /api/v1/accounts/<account_id>/webhooks' do