LImit oauth entry with FF

Author: mustard-mh

components/server/src/oauth-server/db.ts

@@ -179,3 +179,5 @@ for (const clientId in inMemoryDatabase.clients) {
         inMemoryDatabase.scopes[scope.name] = scope;
     }
 }
+
+export const toolboxClient = toolbox;

components/server/src/oauth-server/oauth-controller.ts

@@ -15,7 +15,8 @@ import { inject, injectable } from "inversify";
 import { URL } from "url";
 import { Config } from "../config";
 import { clientRepository, createAuthorizationServer } from "./oauth-authorization-server";
-import { inMemoryDatabase } from "./db";
+import { inMemoryDatabase, toolboxClient } from "./db";
+import { getExperimentsClientForBackend } from "@gitpod/gitpod-protocol/lib/experiments/configcat-server";
 
 @injectable()
 export class OAuthController {
@@ -147,6 +148,18 @@ export class OAuthController {
                 return;
             }
 
+            if (clientID === toolboxClient.id) {
+                const enableExperimentalJBTB = await getExperimentsClientForBackend().getValueAsync(
+                    "enable_experimental_jbtb",
+                    false,
+                    { user },
+                );
+                if (!enableExperimentalJBTB) {
+                    res.sendStatus(400);
+                    return false;
+                }
+            }
+
             const request = new OAuthRequest(req);
 
             try {