fix(web): auth gate Ask APIs for Public SaaS

[msukkari]

Fixes SOU-2308

Require authenticated users for the streaming and blocking Ask APIs when EXPERIMENT_ASK_GH_ENABLED is enabled, while preserving anonymous Ask behavior for self-hosted deployments. The auth override is checked inline at the Ask and MCP HTTP entry points.

Conflict resolution:

• Resolved the simple CHANGELOG.md conflict by preserving the entries from both branches.
• Accepted main's non-conflicting removal of the obsolete Ask tutorial/example-query assets and UI.
• No conflicting intent or semantic conflict remained.

Validation:

• Web tests: 147 files, 1,503 tests passed (.next/** excluded from Vitest discovery)
• Public SaaS deployment verification: unauthenticated /api/chat/blocking and /api/ee/chat requests returned 401 NOT_AUTHENTICATED

Linear Issue: SOU-2308

  

---

Summary by cubic

Requires authenticated users for the streaming and blocking Ask APIs and the MCP ask_codebase tool when EXPERIMENT_ASK_GH_ENABLED is enabled, fixing SOU-2308. Anonymous Ask access is unchanged for self-hosted deployments.

• Unauthenticated requests are rejected with a 401 (NOT_AUTHENTICATED) service error via an inlined boolean gate at each entry point.
• The CHANGELOG records the auth requirement for the Ask APIs in Public SaaS deployments.

^{Written for commit 1daff8a. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes
  • Ask chat requests in Public SaaS now require authentication when the Ask experiment is enabled. Unauthenticated requests are rejected before entitlement checks or chat processing.
  • The blocking Ask API also rejects unauthenticated requests in this configuration.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 094e3161-9c5e-4cbf-889d-9a80efcb987a

📥 Commits

Reviewing files that changed from the base of the PR and between d12a32e and 1daff8a.

📒 Files selected for processing (3)

• CHANGELOG.md
• packages/web/src/app/api/(server)/ee/chat/route.ts
• packages/web/src/ee/features/mcp/askCodebase.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

When EXPERIMENT_ASK_GH_ENABLED is 'true', the chat route and askCodebase return notAuthenticated() if no user is authenticated. The Unreleased changelog records the authentication requirement for streaming and blocking Ask APIs in Public SaaS deployments.

Changes

Ask API authentication

Layer / File(s)	Summary
Add authentication checks to Ask paths packages/web/src/app/api/(server)/ee/chat/route.ts, packages/web/src/ee/features/mcp/askCodebase.ts, CHANGELOG.md	The chat route and askCodebase return notAuthenticated() when the Ask experiment is enabled and no user is present. The changelog records the Public SaaS authentication requirement.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: brendan-kellam

Merge Risk: ⚪ Minimal · up to 1daff

The streaming and blocking Ask APIs enforce the intended authentication requirement when the experiment is enabled. No merge-blocking issue was identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding authentication gates to the Ask APIs for Public SaaS.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

Review completed against the latest diff

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>