Exempt dedicated installations from sunset blocking

Add isDedicatedInstallation parameter to sunset check functions.
Dedicated installations always return false (not blocked) regardless
of feature flag state.

Changes:
- isUserLoginBlockedBySunset: add isDedicatedInstallation param
- isWorkspaceStartBlockedBySunset: add isDedicatedInstallation param
- UserController: pass config.isDedicatedInstallation to login check
- WorkspaceServiceAPI: inject Config and pass isDedicatedInstallation

This ensures the sunset only affects gitpod.io (PAYG) and not
dedicated installations.

Co-authored-by: Ona <[email protected]>

Author: geropl

components/server/src/api/workspace-service-api.ts

@@ -63,6 +63,7 @@ import { isWorkspaceId } from "@gitpod/gitpod-protocol/lib/util/parse-workspace-
 import { SYSTEM_USER, SYSTEM_USER_ID } from "../authorization/authorizer";
 import { isWorkspaceStartBlockedBySunset } from "../util/featureflags";
 import { User } from "@gitpod/gitpod-protocol";
+import { Config } from "../config";
 
 @injectable()
 export class WorkspaceServiceAPI implements ServiceImpl<typeof WorkspaceServiceInterface> {
@@ -71,9 +72,10 @@ export class WorkspaceServiceAPI implements ServiceImpl<typeof WorkspaceServiceI
     @inject(ContextService) private readonly contextService: ContextService;
     @inject(UserService) private readonly userService: UserService;
     @inject(ContextParser) private contextParser: ContextParser;
+    @inject(Config) private readonly config: Config;
 
     private async checkClassicPaygSunset(user: User, organizationId: string): Promise<void> {
-        if (await isWorkspaceStartBlockedBySunset(user, organizationId)) {
+        if (await isWorkspaceStartBlockedBySunset(user, organizationId, this.config.isDedicatedInstallation)) {
             throw new ApplicationError(
                 ErrorCodes.PERMISSION_DENIED,
                 "Gitpod Classic PAYG has sunset. Please visit https://app.ona.com/login to continue.",

components/server/src/user/user-controller.ts

@@ -73,7 +73,7 @@ export class UserController {
 
                 // Check if authenticated user is blocked by sunset
                 const user = req.user as User;
-                if (await isUserLoginBlockedBySunset(user)) {
+                if (await isUserLoginBlockedBySunset(user, this.config.isDedicatedInstallation)) {
                     log.info("(Auth) User blocked by Classic PAYG sunset", {
                         userId: user.id,
                         organizationId: user.organizationId,

components/server/src/util/featureflags.ts

@@ -35,7 +35,16 @@ export async function getClassicPaygSunsetConfig(userId: string): Promise<Classi
     }
 }
 
-export async function isWorkspaceStartBlockedBySunset(user: User, organizationId: string): Promise<boolean> {
+export async function isWorkspaceStartBlockedBySunset(
+    user: User,
+    organizationId: string,
+    isDedicatedInstallation: boolean,
+): Promise<boolean> {
+    // Dedicated installations are never blocked
+    if (isDedicatedInstallation) {
+        return false;
+    }
+
     const config = await getClassicPaygSunsetConfig(user.id);
 
     if (!config.enabled) {
@@ -51,7 +60,12 @@ export async function isWorkspaceStartBlockedBySunset(user: User, organizationId
     return true;
 }
 
-export async function isUserLoginBlockedBySunset(user: User): Promise<boolean> {
+export async function isUserLoginBlockedBySunset(user: User, isDedicatedInstallation: boolean): Promise<boolean> {
+    // Dedicated installations are never blocked
+    if (isDedicatedInstallation) {
+        return false;
+    }
+
     const config = await getClassicPaygSunsetConfig(user.id);
 
     if (!config.enabled) {