make webpush endpoints 404 if experiment not enabled

johnstcn · johnstcn · commit ef22b357f406 · 2025-03-26T16:37:01.000Z
diff --git a/cli/server.go b/cli/server.go
@@ -790,6 +790,8 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				options.WebpushDispatcher = webpusher
 			} else {
 				options.WebpushDispatcher = &webpush.NoopWebpusher{
+					// Users will likely not see this message as the endpoints return 404
+					// if not enabled. Just in case...
 					Msg: "Web Push notifications are an experimental feature and are disabled by default. Enable the 'web-push' experiment to use this feature.",
 				}
 			}
diff --git a/coderd/notifications.go b/coderd/notifications.go
@@ -337,6 +337,10 @@ func (api *API) putUserNotificationPreferences(rw http.ResponseWriter, r *http.R
 func (api *API) postUserWebpushSubscription(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	user := httpmw.UserParam(r)
+	if !api.Experiments.Enabled(codersdk.ExperimentWebPush) {
+		httpapi.ResourceNotFound(rw)
+		return
+	}
 
 	var req codersdk.WebpushSubscription
 	if !httpapi.Read(ctx, rw, r, &req) {
@@ -382,6 +386,11 @@ func (api *API) deleteUserWebpushSubscription(rw http.ResponseWriter, r *http.Re
 	ctx := r.Context()
 	user := httpmw.UserParam(r)
 
+	if !api.Experiments.Enabled(codersdk.ExperimentWebPush) {
+		httpapi.ResourceNotFound(rw)
+		return
+	}
+
 	var req codersdk.DeleteWebpushSubscription
 	if !httpapi.Read(ctx, rw, r, &req) {
 		return
@@ -414,6 +423,11 @@ func (api *API) postUserPushNotificationTest(rw http.ResponseWriter, r *http.Req
 	ctx := r.Context()
 	user := httpmw.UserParam(r)
 
+	if !api.Experiments.Enabled(codersdk.ExperimentWebPush) {
+		httpapi.ResourceNotFound(rw)
+		return
+	}
+
 	if err := api.WebpushDispatcher.Dispatch(ctx, user.ID, codersdk.WebpushMessage{
 		Title: "It's working!",
 		Body:  "You've subscribed to push notifications.",
diff --git a/coderd/notifications_test.go b/coderd/notifications_test.go
@@ -390,7 +390,11 @@ func TestWebpushSubscribeUnsubscribe(t *testing.T) {
 
 	ctx := testutil.Context(t, testutil.WaitShort)
 
-	client := coderdtest.New(t, nil)
+	dv := coderdtest.DeploymentValues(t)
+	dv.Experiments = []string{string(codersdk.ExperimentWebPush)}
+	client := coderdtest.New(t, &coderdtest.Options{
+		DeploymentValues: dv,
+	})
 	owner := coderdtest.CreateFirstUser(t, client)
 	memberClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 

Original file line number	Diff line number	Diff line change
`@@ -790,6 +790,8 @@ func (r RootCmd) Server(newAPI func(context.Context, coderd.Options) (*coderd.`
`790`	`790`	`options.WebpushDispatcher = webpusher`
`791`	`791`	`} else {`
`792`	`792`	`options.WebpushDispatcher = &webpush.NoopWebpusher{`
	`793`	`+ // Users will likely not see this message as the endpoints return 404`
	`794`	`+ // if not enabled. Just in case...`
`793`	`795`	`Msg: "Web Push notifications are an experimental feature and are disabled by default. Enable the 'web-push' experiment to use this feature.",`
`794`	`796`	`}`
`795`	`797`	`}`