fix(webapp): gate remaining webhook dashboard routes behind the feature flag

The webhook handler detail page and the deliveries-live and samples resource
loaders were reachable by direct URL without the hasWebhooksAccess flag. Add
the same org-flag guard the other webhook routes use, so the whole dashboard
surface stays hidden until the flag is enabled (admins and impersonators still
pass).

Author: ericallam

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.$webhookParam/route.tsx

@@ -52,6 +52,8 @@ import {
 } from "~/presenters/v3/WebhookDetailPresenter.server";
 import { clickhouseFactory } from "~/services/clickhouse/clickhouseFactoryInstance.server";
 import { requireUser } from "~/services/session.server";
+import { FEATURE_FLAG } from "~/v3/featureFlags";
+import { flag } from "~/v3/featureFlags.server";
 import {
   docsPath,
   EnvironmentParamSchema,
@@ -88,6 +90,19 @@ export const loader = async ({ request, params }: LoaderFunctionArgs) => {
     throw new Response("Environment not found", { status: 404 });
   }
 
+  if (!user.admin && !user.isImpersonating) {
+    const org = await $replica.organization.findFirst({
+      where: { id: project.organizationId },
+      select: { featureFlags: true },
+    });
+    const enabled = await flag({
+      key: FEATURE_FLAG.hasWebhooksAccess,
+      defaultValue: false,
+      overrides: (org?.featureFlags as Record<string, unknown>) ?? {},
+    });
+    if (!enabled) throw new Response("Not found", { status: 404 });
+  }
+
   const url = new URL(request.url);
   const period = url.searchParams.get("period") ?? undefined;
   const from = parseFiniteInt(url.searchParams.get("from"));

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.deliveries.live.ts

@@ -5,6 +5,9 @@ import { $replica, webhookReplica } from "~/db.server";
 import { resolveDeliveryRunTargets } from "~/presenters/v3/WebhookDetailPresenter.server";
 import { clickhouseFactory } from "~/services/clickhouse/clickhouseFactoryInstance.server";
 import { loadProjectEnvironmentFromRequest } from "~/services/loadProjectEnvironmentFromRequest.server";
+import { requireUser } from "~/services/session.server";
+import { FEATURE_FLAG } from "~/v3/featureFlags";
+import { flag } from "~/v3/featureFlags.server";
 import {
   type ListedWebhookDelivery,
   webhookDeliveriesRepository,
@@ -75,6 +78,20 @@ export async function loader({ request, params }: LoaderFunctionArgs) {
 
   const { project, environment } = await loadProjectEnvironmentFromRequest(request, params);
 
+  const user = await requireUser(request);
+  if (!user.admin && !user.isImpersonating) {
+    const org = await $replica.organization.findFirst({
+      where: { id: project.organizationId },
+      select: { featureFlags: true },
+    });
+    const enabled = await flag({
+      key: FEATURE_FLAG.hasWebhooksAccess,
+      defaultValue: false,
+      overrides: (org?.featureFlags as Record<string, unknown>) ?? {},
+    });
+    if (!enabled) throw new Response("Not found", { status: 404 });
+  }
+
   const clickhouse = await clickhouseFactory.getClickhouseForOrganization(
     project.organizationId,
     "standard"

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.samples.ts

@@ -7,9 +7,12 @@ import {
 } from "@internal/webhook-sources";
 import { type LoaderFunctionArgs } from "@remix-run/server-runtime";
 import { typedjson } from "remix-typedjson";
+import { $replica } from "~/db.server";
 import { findProjectBySlug } from "~/models/project.server";
 import { requireUser } from "~/services/session.server";
 import { EnvironmentParamSchema } from "~/utils/pathBuilder";
+import { FEATURE_FLAG } from "~/v3/featureFlags";
+import { flag } from "~/v3/featureFlags.server";
 
 export type WebhookSampleMeta = {
   provider: string;
@@ -49,6 +52,19 @@ export async function loader({ request, params }: LoaderFunctionArgs) {
   if (!project)
     return typedjson({ kind: "error", error: "Project not found" } as WebhookSamplesData);
 
+  if (!user.admin && !user.isImpersonating) {
+    const org = await $replica.organization.findFirst({
+      where: { id: project.organizationId },
+      select: { featureFlags: true },
+    });
+    const enabled = await flag({
+      key: FEATURE_FLAG.hasWebhooksAccess,
+      defaultValue: false,
+      overrides: (org?.featureFlags as Record<string, unknown>) ?? {},
+    });
+    if (!enabled) throw new Response("Not found", { status: 404 });
+  }
+
   const url = new URL(request.url);
   const provider = url.searchParams.get("provider") ?? undefined;
   const eventType = url.searchParams.get("eventType") ?? undefined;