feat: Add UI support for RSS notification channels (#2441)

* feat(spanner): support intent-based RSS in storage layer and protect system channels

This change implements the storage layer requirements for the Intent-Based RSS notification architecture.

- Expose ChannelType in Subscriptions: Updated SavedSearchSubscriptionView to include ChannelType by joining with NotificationChannels in SelectOne and SelectList queries. This allows the API to return the channel type (e.g., 'rss') in subscription responses without extra lookups.

- Protect System Channels: Updated Get, Update, and Delete NotificationChannel methods to enforce that system-managed channels (like RSS) cannot be accessed or modified directly by users.

- Allow System Channels for Subscriptions: Updated createSavedSearchSubscription to allow linking to system channels during ownership checks.

- Fixed tests and lints: Resolved UUID type mismatches in backend_test.go and added ChannelType to struct literals to satisfy the exhaustruct linter.

* feat(api): implement XOR validation and enforce privacy for intent-based RSS

This change implements the server layer requirements for the Intent-Based RSS notification architecture.

- XOR Validation in CreateSubscription: Enforced that exactly one of 'channel_id' (Explicit Mode) or 'channel_type' (Implicit Mode) must be provided in CreateSubscription requests.

- Hiding RSS Channels: Ensured that system-managed RSS channels are not exposed in list responses or directly accessible via CRUD operations (returning 404).

- Hardening Create Notification Channel: Updated handler to explicitly reject manual creation of 'rss' channels, forcing users to use the intent-based subscription API.

- Updated tests to reflect the new behavior and verify validation rules.

* feat: Add UI support for RSS notification channels + tests

Move from manual RSS channel management to implicit when subscribing.

Author: neilv-g

e2e/tests/notification-channels.spec.ts

@@ -60,7 +60,6 @@ test.describe('Notification Channels Page', () => {
     // Verify RSS panel content.
     const rssPanel = page.locator('webstatus-notification-rss-channels');
     await expect(rssPanel).toBeVisible();
-    await expect(rssPanel).toContainText('Coming soon');
 
     // Verify Webhook panel content.
     const webhookPanel = page.locator(

e2e/tests/notification-channels.spec.ts-snapshots/notification-channels-authenticated-chromium-linux.png

@@ -194,6 +194,8 @@ export const ALL_CHANNELS: ChannelsParameter[] = [
   EXPERIMENTAL_CHANNEL,
 ];
 
+export const CHANNEL_TYPE_RSS = 'rss';
+
 export const TEST_COUNT_METRIC_VIEW: components['schemas']['WPTMetricView'] =
   'test_counts';
 export const SUBTEST_COUNT_METRIC_VIEW: components['schemas']['WPTMetricView'] =
@@ -295,13 +297,19 @@ function base64urlEncode(str: string): string {
 
 export class APIClient {
   private readonly client: ReturnType<typeof createClient<paths>>;
+  private readonly baseUrl: string;
   constructor(baseUrl: string) {
+    this.baseUrl = baseUrl;
     this.client = createClient<paths>({
       baseUrl,
       ...fetchOptions,
     });
   }
 
+  public getBaseUrl(): string {
+    return this.baseUrl;
+  }
+
   // Internal client detail for constructing a FeatureResultOffsetCursor pagination token.
   // Typically, users of the /v1/features endpoint should use the provided pagination token.
   // However, this token can be used to facilitate a UI where we have selectable page numbers.

e2e/tests/notification-channels.spec.ts-snapshots/notification-channels-authenticated-dark-chromium-linux.png

@@ -28,6 +28,10 @@ import '@shoelace-style/shoelace/dist/components/button/button.js';
 // Mock used to isolate nested form rendering and avoid needing to cast to access the component field.
 class MockConfigForm extends HTMLElement {
   validate = () => true;
+  getUpdate = () => ({
+    updates: {name: 'Updated name'},
+    mask: ['name'],
+  });
 }
 
 if (!customElements.get('mock-config-form')) {

e2e/tests/notification-channels.spec.ts-snapshots/notification-channels-authenticated-dark-firefox-linux.png

@@ -316,6 +316,57 @@ describe('webstatus-manage-subscriptions-dialog', () => {
     }
   });
 
+  it('sets actionState correctly on successful create for RSS', async () => {
+    const eventSpy = sandbox.spy();
+    element.addEventListener('subscription-save-success', eventSpy);
+
+    // Make it dirty for creation.
+    element.savedSearchId = 'new-saved-search-id';
+    element['_activeChannelId'] = 'rss';
+    element['_selectedFrequency'] = 'monthly';
+    element['_selectedTriggers'] = ['feature_baseline_to_newly'];
+    element['_initialSelectedFrequency'] = 'immediate';
+    element['_initialSelectedTriggers'] = [];
+    await element.updateComplete;
+    expect(element.isDirty).to.be.true;
+
+    // Use a promise that we can resolve manually to check intermediate state.
+    const savePromise = new Promise(resolve => {
+      (apiClient.createSubscription as sinon.SinonStub).callsFake(() => {
+        resolve(mockInitialSubscription);
+        return Promise.resolve(mockInitialSubscription);
+      });
+    });
+
+    const saveOperation = element['_handleSave']();
+    await element.updateComplete;
+
+    // Check intermediate 'saving' state and loading property on button.
+    expect(element['_actionState'].phase).to.equal('saving');
+    const saveButton = element.shadowRoot?.querySelector<SlButton>(
+      'sl-button[variant="primary"]',
+    );
+    expect(saveButton!.loading).to.be.true;
+
+    await savePromise;
+    await saveOperation;
+    await element.updateComplete;
+
+    expect(apiClient.createSubscription).to.have.been.calledWith('test-token', {
+      saved_search_id: 'new-saved-search-id',
+      channel_type: 'rss',
+      frequency: 'monthly',
+      triggers: ['feature_baseline_to_newly'],
+    });
+    expect(eventSpy).to.have.been.calledOnce;
+
+    // Check final 'success' state.
+    expect(element['_actionState'].phase).to.equal('success');
+    if (element['_actionState'].phase === 'success') {
+      expect(element['_actionState'].message).to.equal('Subscription saved.');
+    }
+  });
+
   it('sets actionState correctly on successful update', async () => {
     const eventSpy = sandbox.spy();
     element.addEventListener('subscription-save-success', eventSpy);