{{ message }}
fix(site/src/pages/DeploymentSettingsPage): gate browser-only paywall on entitlement - #28660
Merged
david-fraley merged 1 commit intoAug 26, 2026
Merged
Conversation
… on entitlement The Security settings page showed the premium paywall whenever the browser_only feature was not enabled. Enabled means the deployment turned browser-only connections on (CODER_BROWSER_ONLY), so licensed premium and trial deployments that leave the feature off saw an upgrade paywall for a feature they already have. Gate the paywall on the browser_only entitlement instead, keeping the enabled flag for the Enabled/Disabled badge.
david-fraley
marked this pull request as ready for review
August 26, 2026 19:15
david-fraley
enabled auto-merge (squash)
August 26, 2026 19:18
david-fraley
disabled auto-merge
August 26, 2026 19:18
untra
approved these changes
Aug 26, 2026
untra
left a comment
untra
left a comment
Contributor
There was a problem hiding this comment.
paywall keyed off of entitled features.browser_only entitlement , not just if it's enabled 👍
david-fraley
deleted the
dfraley/devex-828-browser-only-paywall-entitlement
branch
August 26, 2026 19:27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DEVEX-828
TL;DR
If you already paid for Coder, stop showing you an ad asking you to pay for Coder.
The Security settings page was showing the "upgrade to Premium" box to customers who already have Premium. It now only shows to deployments with no license.
Problem
The Security settings page rendered the premium paywall whenever
entitlements.features.browser_only.enabledwas false:Feature.Enabledis not "the license covers this feature". Forbrowser_onlythe server sets it from the deployment's own config:license.LicensesEntitlementsthen only forcesEnabledto false when the feature is not entitled. Soenabled === truerequires a license andCODER_BROWSER_ONLY=true, and any licensed premium or trial deployment that leaves browser-only connections turned off (the default) was shown an upgrade paywall for a feature it already owns.Fix
Gate the paywall on the entitlement and keep
enabledfor the Enabled/Disabled badge, matching the pattern already used by the External Auth settings page:grace_periodcounts as entitled, so expiring licenses do not flip to a paywall either.Verified against
license.LicensesEntitlementswithCODER_BROWSER_ONLYoff, which is the state in the report:entitlementenablednot_entitledentitledentitledentitledgrace_periodWith browser-only turned on, entitled deployments keep the Enabled badge and no paywall.
Proof
Before, premium license with browser-only connections turned off:
After, same state:
After, community deployment still gets the paywall:
Both states are covered by new
playassertions inSecuritySettingsPageView.stories.tsx(EntitledAndTurnedOff,NotEntitled).Notes
canViewPremium, while other paywall surfaces passpermissions.viewAllLicenses.Investigation notes
SecuritySettingsPage.tsxpassedentitlements.features.browser_only.enabledinto the view as the paywall condition.enterprise/coderd/coderd.gobuilds the enablements map from deployment config, sobrowser_onlyenablement isapi.BrowserOnly(CODER_BROWSER_ONLY).enterprise/coderd/license/license.goappliesEnabled: enablements[featureName] || featureName.AlwaysEnable()for licensed features and only downgradesEnabledto false for not-entitled features. Entitlement and enablement are therefore independent signals, and only entitlement should drive an upgrade prompt.ExternalAuthSettingsPageViewandAppearanceSettingsPagealready gate their paywalls onentitlement !== "not_entitled"; this page was the outlier.Generated by Coder Agents on behalf of @david-fraley.