archetecture security fix

apps/api/src/middleware/requireSubscription.ts

@@ -0,0 +1,29 @@
+import { Request, Response, NextFunction } from 'express'
+import { sendUnauthorized, sendPaymentRequired } from './authHelpers'
+
+const BLOCKED_STATUSES = ['SUSPENDED', 'PENDING']
+
+/**
+ * Blocks requests for companies with lapsed or unactivated subscriptions.
+ * Must be applied after `requireTenant`.
+ *
+ * Guarantees on success:
+ *   req.company.status is not SUSPENDED or PENDING
+ */
+export function requireSubscription(req: Request, res: Response, next: NextFunction) {
+  const company = req.company
+  if (!company) return sendUnauthorized(res, 'unauthenticated', 'No company context')
+
+  if (BLOCKED_STATUSES.includes(company.status)) {
+    return sendPaymentRequired(
+      res,
+      `subscription_${company.status.toLowerCase()}`,
+      company.status === 'SUSPENDED'
+        ? 'Your account has been suspended. Please contact support or renew your subscription.'
+        : 'Your account is pending activation. Please complete your subscription setup.',
+      { billingUrl: `${process.env.NEXT_PUBLIC_DASHBOARD_URL}/billing` },
+    )
+  }
+
+  next()
+}