### Summary

The Begin of the insertionAPI v3 allows reading/writing internal comments when the `enabled_internal_comments` project settingEnd of the insertion Begin of the deletion [**Capabilities API**](https://www.openproject.org/docs/api/endpoints/actions-capabilities/)End of the deletion is Begin of the insertiondisabled orEnd of the insertion Begin of the deletion currently out of sync with Project Settings. EvenEnd of the deletion when Begin of the insertionthe EnterpriseToken doesn't allow internal comments.

 Additionally, client apps need a way to check whether internal commentsEnd of the insertion Begin of the deletion "Internal Comments"End of the deletion are Begin of the insertionenabled/possibleEnd of the insertion Begin of the deletion disabledEnd of the deletion for a specific Begin of the insertionproject.End of the insertion Begin of the deletion project via the web interface, the API continues to report that the user has the capability to create them. Furthermore, the API accepts creation requests (`201 Created`) for data that the system is configured to ignore, leading to data inconsistency between the Mobile and Web apps.End of the deletion

### Steps to reproduce

Begin of the insertion1.  InEnd of the insertion Begin of the deletion * **Configure Project:** InEnd of the deletion the OpenProject Web UI, go to Project Settings and **disable** "Enable internal comments." Begin of the insertion(or remove enterprise token allowing internal comments)End of the insertion

Begin of the insertion2. AsEnd of the insertion Begin of the deletion * **Check Capabilities via API:** PerformEnd of the deletion a Begin of the deletion `GET` request to `/api/v3/capabilities` for aEnd of the deletion user Begin of the insertionwith view\_internal\_comments permission, call `GET /api/v3/work_packages/:id/activities`

3. Internal comments are still visibleEnd of the insertion Begin of the deletion who has the "Write internal comments" permissionEnd of the deletion in Begin of the insertionthe response

4. AsEnd of the insertion Begin of the deletion their role.

* **Current API Result:** ReturnsEnd of the deletion a Begin of the insertionuser with `add_internal_comments` permission, call POST /api/v3/work\_packages/:id/activities with internal: true

5. InternalEnd of the insertion Begin of the deletion positive capability for `internal_comments/create`.

* **Attempt Creation:** Perform a `POST` to create an internalEnd of the deletion comment Begin of the deletion on a work package in that project.

* **Current API Result:** Returns `201 Created`, but the commentEnd of the deletion is Begin of the insertioncreated despiteEnd of the insertion Begin of the deletion (correctly) hidden inEnd of the deletion the Begin of the insertionproject setting being disabled


End of the insertion Begin of the deletion Web UI.


End of the deletion ### Expected behavior

Begin of the insertion1. **Enforcement**: Internal commentsEnd of the insertion Begin of the deletion The **Capabilities API**End of the deletion should Begin of the insertiononly be readable/writable when ALL conditions are met:

1. EnterpriseToken allows internal\_comments

2. End of the insertion Begin of the deletion act as the single source of truth for the Mobile UI. It must account for both User Permissions **AND**End of the deletion Project Begin of the insertionsetting enabled\_internal\_commentsEnd of the insertion Begin of the deletion Settings:

* If "Enable internal comments"End of the deletion is Begin of the insertiontrue

3. User hasEnd of the insertion Begin of the deletion **OFF** atEnd of the deletion the Begin of the insertionappropriate permission

2. **Mobile App Support**: A project-scoped configuration endpoint `GET /api/v3/projects/:id/configuration`End of the insertion Begin of the deletion project level, the Capabilities APIEnd of the deletion should Begin of the insertionreturn:

1. All global configuration properties (including `availableFeatures`End of the insertion Begin of the deletion return a **negative** responseEnd of the deletion for Begin of the insertionenterprise token check)

2. `enabledInternalComments` -End of the insertion Begin of the deletion `internal_comments/create`, regardless ofEnd of the deletion the Begin of the deletion user's role permissions.

* The API should return an error (e.g., `403 Forbidden`) if a client attempts to post an internal comment to aEnd of the deletion project Begin of the insertionsetting (boolean, defaults to false)End of the insertion Begin of the deletion where the feature is disabled.End of the deletion