Optionally block enabling configured feature flags via Management UI/API

Useful to avoid accidentally enabling for example experiemental
feature flags from the Management UI on sensitive clusters.

deps/rabbitmq_management/src/rabbit_mgmt_wm_feature_flag_enable.erl

@@ -38,13 +38,18 @@ accept_content(ReqData, #context{} = Context) ->
     NameS = rabbit_mgmt_util:id(name, ReqData),
     try
         Name = list_to_existing_atom(binary_to_list(NameS)),
-        case rabbit_feature_flags:enable(Name) of
-            ok ->
-                {true, ReqData, Context};
-            {error, Reason1} ->
-                FormattedReason1 = rabbit_ff_extra:format_error(Reason1),
-                rabbit_mgmt_util:bad_request(
-                  list_to_binary(FormattedReason1), ReqData, Context)
+        case is_feature_flag_blocked(Name) of
+            {true, Message} ->
+                rabbit_web_dispatch_access_control:not_authorised(Message, ReqData, Context);
+            false ->
+                case rabbit_feature_flags:enable(Name) of
+                    ok ->
+                        {true, ReqData, Context};
+                    {error, Reason1} ->
+                        FormattedReason1 = rabbit_ff_extra:format_error(Reason1),
+                        rabbit_mgmt_util:bad_request(
+                          list_to_binary(FormattedReason1), ReqData, Context)
+                end
         end
     catch
         _:badarg ->
@@ -53,3 +58,8 @@ accept_content(ReqData, #context{} = Context) ->
             rabbit_mgmt_util:bad_request(
               list_to_binary(FormattedReason2), ReqData, Context)
     end.
+
+-spec is_feature_flag_blocked(rabbit_feature_flags:feature_name()) -> {true, string()} | false.
+is_feature_flag_blocked(Name) ->
+    BlockedFFs = application:get_env(rabbitmq_management, blocked_feature_flags, []),
+    proplists:get_value(Name, BlockedFFs, false).