fix: flag-gate ABv1 edit block behind deprecation flags [ACTION-5731]

[neelasha-writer]

Summary

The ABv1 edit block (BuilderEditBlockedState overlay + disabled canvas interactions) is currently enforced purely from the x-is-org-admin / x-can-edit-agent request headers read in app_runner.py. Those headers have no producer yet — nothing in be.agent-manager, the platform gateway, or fe.web-app sets them (PR #1291 added only the reader and notes the agent-manager side is a follow-up).

Because of that, in any Writer cloud session both headers resolve to false, so canEditAgent becomes false for everyone — including org admins — which blocks all editing. That makes the framework unshippable ahead of the header producer.

This PR gates the edit-block enforcement behind the existing ABv2 deprecation flags (beforeDeprecationCutoffAbv2 / afterDeprecationCutoffAbv2):

• When neither flag is active, canEditAgent is always true, so the block can never engage unintentionally (safe to deploy before the header producer ships, and for orgs not in the deprecation rollout).
• When a deprecation flag is active, the existing permission logic (isOrganizationAdmin / canEdit) applies exactly as before.

The banner and remigration dialog were already flag-gated; this brings the edit block in line with them.

Changes

• core/index.ts: canEditAgent now short-circuits to true unless a deprecation flag is present.
• tests/mocks.ts: mock canEditAgent mirrors the real gating so builder tests stay accurate.
• tests/canEditAgent.spec.ts: new spec covering the gating matrix (no flag → editable; flag + non-admin/no-edit → blocked; flag + admin or canEdit → editable).

Design note

I gated behind either deprecation flag since the whole ABv1 edit-gating is part of the ABv2 deprecation rollout. If we'd rather only block editing post-cutoff (afterDeprecationCutoffAbv2 only) or introduce a dedicated flag for finer control, that's an easy change — happy to adjust.

Test plan

• vitest run src/tests/canEditAgent.spec.ts (6 passing)
• eslint + prettier clean on changed files
• Verify in dev with beforeDeprecationCutoffAbv2 off: editing works normally (no block)
• Verify with flag on + non-admin/no edit access: block shows as before

Made with Cursor

Summary by CodeRabbit

• Bug Fixes

  • Updated agent editing access to respect deprecation cutoff feature flags.
  • Preserved editing access for organization administrators and users with explicit edit permission.
  • Allowed editing without additional gating when the relevant feature flags are inactive.

• Tests

  • Added coverage for editing permissions across gated, unrestricted, administrator, and explicitly permitted scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 08f18675-ad02-445b-8e07-39332c61a920

📥 Commits

Reviewing files that changed from the base of the PR and between 57944ba and 9b9d61b.

📒 Files selected for processing (3)

• src/ui/src/core/index.ts
• src/ui/src/tests/canEditAgent.spec.ts
• src/ui/src/tests/mocks.ts

---

📝 Walkthrough

Walkthrough

ABv1 edit gating now checks deprecation cutoff feature flags before applying existing Writer Cloud, organization-admin, and application edit permissions. The mock core and Vitest tests cover inactive and active gating scenarios.

Changes

ABv1 edit gating

Layer / File(s)	Summary
Permission gating logic src/ui/src/core/index.ts	Adds a computed ABv1 gating flag for the two deprecation cutoff feature flags and incorporates it into canEditAgent.
Permission behavior validation src/ui/src/tests/mocks.ts, src/ui/src/tests/canEditAgent.spec.ts	Updates the mocked permission computation and tests inactive gating, active cutoff flags, organization-admin access, and application edit permission.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• writer/writer-framework#1288: Adds organization-admin plumbing and deprecation UI behavior using the same cutoff flags.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: gating the ABv1 edit block behind deprecation flags.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-ACTION-5731-flag-gate-edit-block

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}