feat: feature gate api routes by organization, disabled by default

Author: shreddedbacon

services/api/database/migrations/20250925000000_routes.js

@@ -59,6 +59,9 @@ exports.up = async function(knex) {
             table.text('autogenerated_path_routes') // would be JSON equivalent of what is in lagoon.yml, would override lagoon.yml if defined
             table.boolean('disable_request_verification'); // default to null to retain lagoon.yml as the source, would override lagoon.yml if defined
         })
+        .alterTable('organization', function (table) {
+            table.boolean('feature_api_routes'.defaultTo(0)); // disable api routes feature by default, future release of lagoon will remove this when routes api becomes generally available
+        })
     }
     else {
         return knex.schema

services/api/src/resolvers.js

@@ -192,7 +192,8 @@ const {
   removeProjectMetadataByKey,
   getPrivateKey,
   getProjectDeployKey,
-  getAutogeneratedRoutePrefixes
+  getAutogeneratedRoutePrefixes,
+  getFeatureApiRoutes
 } = require('./resources/project/resolvers');
 
 const {
@@ -520,6 +521,7 @@ async function getResolvers() {
       apiRoutes: getRoutesByProjectId,
       autogeneratedRoutePrefixes: getAutogeneratedRoutePrefixes,
       autogeneratedPathRoutes: getAutogeneratedPathRoutes,
+      featureApiRoutes: getFeatureApiRoutes,
     },
     GroupInterface: {
       __resolveType(group) {

services/api/src/resources/organization/resolvers.ts

@@ -230,6 +230,15 @@ export const updateOrganization: ResolverFn = async (
       await hasPermission('organization', 'updateOrganization', input.id);
     }
 
+    // if the beta feature flag for api routes is being updated, check if permission to enable this flag is set
+    // this feature will become generally available in a future version and this flag will not
+    // be required
+    if (input.patch.featureApiRoutes) {
+      await hasPermission('organization', 'update');
+    } else {
+      await hasPermission('organization', 'updateOrganization', input.id);
+    }
+
     if (input.patch.name) {
       // check if the name is valid
       isValidName(input.patch.name)

services/api/src/resources/project/helpers.ts

@@ -5,6 +5,7 @@ import { query } from '../../util/db';
 import { Sql } from './sql';
 import { Sql as environmentSql } from '../environment/sql';
 import { Sql as backupSql } from '../backup/sql';
+import { Helpers as organizationHelpers } from '../organization/helpers';
 // import { logger } from '../../loggers/logger';
 
 export const Helpers = (sqlClientPool: Pool) => {
@@ -102,6 +103,14 @@ export const Helpers = (sqlClientPool: Pool) => {
   const getProjectsByIds = (projectIds: number[]) =>
     query(sqlClientPool, Sql.selectProjectsByIds(projectIds));
 
+  const checkApiRoutesFeature = async (organizationId: number) => {
+    const organization = await organizationHelpers(sqlClientPool).getOrganizationById(organizationId);
+    if (!organization) {
+      return false;
+    }
+    return organization.featureApiRoutes;
+  };
+
   return {
     checkOrgProjectViewPermission,
     checkOrgProjectUpdatePermission,
@@ -111,6 +120,7 @@ export const Helpers = (sqlClientPool: Pool) => {
     getProjectsByIds,
     getProjectByEnvironmentId,
     getProjectByOrganizationId,
+    checkApiRoutesFeature,
     getProjectIdByName: async (name: string): Promise<number> => {
       const pidResult = await query(
         sqlClientPool,

services/api/src/resources/project/resolvers.ts

@@ -1138,3 +1138,18 @@ export const getAutogeneratedRoutePrefixes: ResolverFn = async (
 ) => {
   return input.autogeneratedRoutePrefixes?.split(",");
 };
+
+
+/*
+  getFeatureApiRoutes is a field resolver
+  it has no permission checks as it isn't called directly
+  this is used to set the beta feature flag on a project from the organization
+  this feature will eventually be made generally available and the feature flag will be removed
+*/
+export const getFeatureApiRoutes: ResolverFn = async (
+  input,
+  args,
+  { sqlClientPool }
+) => {
+  return Helpers(sqlClientPool).checkApiRoutesFeature(input.organization);
+};

services/api/src/resources/routes/resolvers.ts

@@ -57,6 +57,12 @@ export const addRouteToProject: ResolverFn = async (
     project: projectId
   });
 
+  // this is used to set the beta feature flag on a project from the organization
+  // this feature will eventually be made generally available and the feature flag will be removed
+  if (await projectHelpers(sqlClientPool).checkApiRoutesFeature(projectData.organization) === false) {
+    throw Error(`This feature is currently unavailable`)
+  }
+
   // trim spaces from domain name
   const domainName = domain.trim()
 
@@ -267,6 +273,12 @@ export const updateRouteOnProject: ResolverFn = async (
     project: projectId
   });
 
+  // this is used to set the beta feature flag on a project from the organization
+  // this feature will eventually be made generally available and the feature flag will be removed
+  if (await projectHelpers(sqlClientPool).checkApiRoutesFeature(projectData.organization) === false) {
+    throw Error(`This feature is currently unavailable`)
+  }
+
   const existsProject = await query(
     sqlClientPool,
     Sql.selectRouteByDomainAndProjectID(domain, projectId)
@@ -357,6 +369,13 @@ export const addOrUpdateRouteOnEnvironment: ResolverFn = async (
   await hasPermission('route', 'add:environment', {
     project: projectId
   });
+
+  // this is used to set the beta feature flag on a project from the organization
+  // this feature will eventually be made generally available and the feature flag will be removed
+  if (await projectHelpers(sqlClientPool).checkApiRoutesFeature(projectData.organization) === false) {
+    throw Error(`This feature is currently unavailable`)
+  }
+
   const env = await environmentHelpers(sqlClientPool).getEnvironmentByNameAndProject(environment, projectId)
   const environmentData = env[0]
 
@@ -567,6 +586,13 @@ export const removeRouteFromEnvironment: ResolverFn = async (
   await hasPermission('route', 'remove:environment', {
     project: projectId
   });
+
+  // this is used to set the beta feature flag on a project from the organization
+  // this feature will eventually be made generally available and the feature flag will be removed
+  if (await projectHelpers(sqlClientPool).checkApiRoutesFeature(projectData.organization) === false) {
+    throw Error(`This feature is currently unavailable`)
+  }
+
   const env = await environmentHelpers(sqlClientPool).getEnvironmentByNameAndProject(environment, projectId)
   const environmentData = env[0]
 
@@ -650,6 +676,12 @@ export const addRouteAlternativeDomains: ResolverFn = async (
     project: projectData.id
   });
 
+  // this is used to set the beta feature flag on a project from the organization
+  // this feature will eventually be made generally available and the feature flag will be removed
+  if (await projectHelpers(sqlClientPool).checkApiRoutesFeature(projectData.organization) === false) {
+    throw Error(`This feature is currently unavailable`)
+  }
+
   if (alternativeNames !== undefined) {
     for (const d of alternativeNames) {
       if (d == route.domain) {
@@ -743,6 +775,12 @@ export const removeRouteAlternativeDomain: ResolverFn = async (
     project: projectData.id
   });
 
+  // this is used to set the beta feature flag on a project from the organization
+  // this feature will eventually be made generally available and the feature flag will be removed
+  if (await projectHelpers(sqlClientPool).checkApiRoutesFeature(projectData.organization) === false) {
+    throw Error(`This feature is currently unavailable`)
+  }
+
   const alternateDomain = await query(
     sqlClientPool,
     Sql.selectRouteAlternativeDomainsByDomainAndProjectID(domain, route.project)
@@ -804,6 +842,12 @@ export const addRouteAnnotation: ResolverFn = async (
     project: projectData.id
   });
 
+  // this is used to set the beta feature flag on a project from the organization
+  // this feature will eventually be made generally available and the feature flag will be removed
+  if (await projectHelpers(sqlClientPool).checkApiRoutesFeature(projectData.organization) === false) {
+    throw Error(`This feature is currently unavailable`)
+  }
+
   await Helpers(sqlClientPool).addRouteAnnotations(route.id, annotations)
 
   await query(
@@ -865,6 +909,12 @@ export const removeRouteAnnotation: ResolverFn = async (
     project: projectData.id
   });
 
+  // this is used to set the beta feature flag on a project from the organization
+  // this feature will eventually be made generally available and the feature flag will be removed
+  if (await projectHelpers(sqlClientPool).checkApiRoutesFeature(projectData.organization) === false) {
+    throw Error(`This feature is currently unavailable`)
+  }
+
   await Helpers(sqlClientPool).deleteRouteAnnotation(route.id, key)
 
   await query(
@@ -927,6 +977,12 @@ export const addPathRoutesToRoute: ResolverFn = async (
     project: projectData.id
   });
 
+  // this is used to set the beta feature flag on a project from the organization
+  // this feature will eventually be made generally available and the feature flag will be removed
+  if (await projectHelpers(sqlClientPool).checkApiRoutesFeature(projectData.organization) === false) {
+    throw Error(`This feature is currently unavailable`)
+  }
+
   let pr: PathRoutes = [];
 
   pr = JSON.parse(route.pathRoutes)
@@ -1001,6 +1057,12 @@ export const removePathRouteFromRoute: ResolverFn = async (
     project: projectData.id
   });
 
+  // this is used to set the beta feature flag on a project from the organization
+  // this feature will eventually be made generally available and the feature flag will be removed
+  if (await projectHelpers(sqlClientPool).checkApiRoutesFeature(projectData.organization) === false) {
+    throw Error(`This feature is currently unavailable`)
+  }
+
   let pr: PathRoutes = [];
 
   pr = JSON.parse(route.pathRoutes)
@@ -1064,6 +1126,12 @@ export const deleteRoute: ResolverFn = async (
     project: projectData.id
   });
 
+  // this is used to set the beta feature flag on a project from the organization
+  // this feature will eventually be made generally available and the feature flag will be removed
+  if (await projectHelpers(sqlClientPool).checkApiRoutesFeature(projectData.organization) === false) {
+    throw Error(`This feature is currently unavailable`)
+  }
+
   if (!adminScopes.platformOwner) {
     // general users can't delete routes with these sources from the api
     if (route.source.toLowerCase() == RouteSource.AUTOGENERATED) {

services/api/src/typeDefs.js

@@ -806,6 +806,7 @@ const typeDefs = gql`
     autogeneratedRoutePrefixes: [String]
     autogeneratedPathRoutes: [AutogeneratedPathRoute]
     disableRequestVerification: Boolean
+    featureApiRoutes: Boolean @deprecated(reason: "Beta API routes feature flag, will be generally available in a future release and this feature gate will be removed")
   }
 
   """
@@ -1313,6 +1314,7 @@ const typeDefs = gql`
     retentionPolicies are the available retention policies to an organization
     """
     retentionPolicies(type: RetentionPolicyType): [RetentionPolicy]
+    featureApiRoutes: Boolean @deprecated(reason: "Beta API routes feature flag, will be generally available in a future release and this feature gate will be removed")
   }
 
   input AddOrganizationInput {
@@ -1325,6 +1327,10 @@ const typeDefs = gql`
     quotaNotification: Int
     quotaEnvironment: Int
     quotaRoute: Int
+    """
+    @deprecated(reason: "Beta API routes feature flag, will be generally available in a future release and this feature gate will be removed")
+    """
+    featureApiRoutes: Boolean
   }
 
   input DeleteOrganizationInput {
@@ -1340,6 +1346,10 @@ const typeDefs = gql`
     quotaNotification: Int
     quotaEnvironment: Int
     quotaRoute: Int
+    """
+    @deprecated(reason: "Beta API routes feature flag, will be generally available in a future release and this feature gate will be removed")
+    """
+    featureApiRoutes: Boolean
   }
 
   input UpdateOrganizationInput {