fix: enforce expired trial subscription menu access

apps/api/src/middleware/requireSubscription.test.ts

@@ -1,6 +1,15 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { NextFunction, Request, Response } from 'express'
 
+vi.mock('../lib/prisma', () => ({
+  prisma: {
+    subscription: {
+      findUnique: vi.fn(),
+    },
+  },
+}))
+
+import { prisma } from '../lib/prisma'
 import { requireSubscription } from './requireSubscription'
 
 function responseStub() {
@@ -12,27 +21,28 @@ function responseStub() {
 
 describe('requireSubscription middleware', () => {
   beforeEach(() => {
+    vi.clearAllMocks()
     process.env.NEXT_PUBLIC_DASHBOARD_URL = 'https://dashboard.example.test'
   })
 
-  it('requires tenant/company context first', () => {
+  it('requires tenant/company context first', async () => {
     const req = {} as Request
     const res = responseStub()
     const next = vi.fn() as NextFunction
 
-    requireSubscription(req, res, next)
+    await requireSubscription(req, res, next)
 
     expect(res.status).toHaveBeenCalledWith(401)
     expect(res.json).toHaveBeenCalledWith({ error: 'unauthenticated', message: 'No company context', statusCode: 401 })
     expect(next).not.toHaveBeenCalled()
   })
 
-  it('blocks suspended companies with a subscription recovery URL', () => {
+  it('blocks suspended companies with a subscription recovery URL', async () => {
     const req = { company: { status: 'SUSPENDED' } } as Request
     const res = responseStub()
     const next = vi.fn() as NextFunction
 
-    requireSubscription(req, res, next)
+    await requireSubscription(req, res, next)
 
     expect(res.status).toHaveBeenCalledWith(402)
     expect(res.json).toHaveBeenCalledWith({
@@ -42,14 +52,15 @@ describe('requireSubscription middleware', () => {
       billingUrl: 'https://dashboard.example.test/subscription',
     })
     expect(next).not.toHaveBeenCalled()
+    expect(prisma.subscription.findUnique).not.toHaveBeenCalled()
   })
 
-  it('blocks pending companies with setup guidance', () => {
+  it('blocks pending companies with setup guidance', async () => {
     const req = { company: { status: 'PENDING' } } as Request
     const res = responseStub()
     const next = vi.fn() as NextFunction
 
-    requireSubscription(req, res, next)
+    await requireSubscription(req, res, next)
 
     expect(res.status).toHaveBeenCalledWith(402)
     expect(res.json).toHaveBeenCalledWith(expect.objectContaining({
@@ -59,12 +70,39 @@ describe('requireSubscription middleware', () => {
     expect(next).not.toHaveBeenCalled()
   })
 
-  it('allows active companies through', () => {
-    const req = { company: { status: 'ACTIVE' } } as Request
+  it('blocks expired trial subscriptions with a subscription recovery URL', async () => {
+    vi.mocked(prisma.subscription.findUnique).mockResolvedValue({ status: 'EXPIRED' } as never)
+
+    const req = { company: { id: 'company_1', status: 'TRIALING' } } as Request
     const res = responseStub()
     const next = vi.fn() as NextFunction
 
-    requireSubscription(req, res, next)
+    await requireSubscription(req, res, next)
+
+    expect(prisma.subscription.findUnique).toHaveBeenCalledWith({
+      where: { companyId: 'company_1' },
+      select: { status: true },
+    })
+    expect(res.status).toHaveBeenCalledWith(402)
+    expect(res.json).toHaveBeenCalledWith({
+      error: 'subscription_required',
+      message: 'Your subscription has ended. Please reactivate to continue.',
+      statusCode: 402,
+      billingUrl: 'https://dashboard.example.test/subscription',
+      subscriptionStatus: 'EXPIRED',
+      accessLevel: 'none',
+    })
+    expect(next).not.toHaveBeenCalled()
+  })
+
+  it('allows active companies with active subscriptions through', async () => {
+    vi.mocked(prisma.subscription.findUnique).mockResolvedValue({ status: 'ACTIVE' } as never)
+
+    const req = { company: { id: 'company_1', status: 'ACTIVE' } } as Request
+    const res = responseStub()
+    const next = vi.fn() as NextFunction
+
+    await requireSubscription(req, res, next)
 
     expect(next).toHaveBeenCalledTimes(1)
     expect(res.status).not.toHaveBeenCalled()

apps/api/src/middleware/requireSubscription.ts

@@ -1,4 +1,6 @@
 import { Request, Response, NextFunction } from 'express'
+import { prisma } from '../lib/prisma'
+import { getAccessLevel, hasAnyAccess } from '../modules/subscriptions/subscription.policy'
 import { sendUnauthorized, sendPaymentRequired } from './authHelpers'
 
 const BLOCKED_STATUSES = ['SUSPENDED', 'PENDING']
@@ -8,9 +10,9 @@ const BLOCKED_STATUSES = ['SUSPENDED', 'PENDING']
  * Must be applied after `requireTenant`.
  *
  * Guarantees on success:
- *   req.company.status is not SUSPENDED or PENDING
+ *   req.company.status is not SUSPENDED or PENDING, and subscription access is not none
  */
-export function requireSubscription(req: Request, res: Response, next: NextFunction) {
+export async function requireSubscription(req: Request, res: Response, next: NextFunction) {
   const company = req.company
   if (!company) return sendUnauthorized(res, 'unauthenticated', 'No company context')
 
@@ -25,5 +27,24 @@ export function requireSubscription(req: Request, res: Response, next: NextFunct
     )
   }
 
+  const subscription = await prisma.subscription.findUnique({
+    where: { companyId: company.id },
+    select: { status: true },
+  })
+  const subscriptionStatus = subscription?.status ?? 'EXPIRED'
+
+  if (!hasAnyAccess(subscriptionStatus)) {
+    return sendPaymentRequired(
+      res,
+      'subscription_required',
+      'Your subscription has ended. Please reactivate to continue.',
+      {
+        billingUrl: `${process.env.NEXT_PUBLIC_DASHBOARD_URL}/subscription`,
+        subscriptionStatus,
+        accessLevel: getAccessLevel(subscriptionStatus),
+      },
+    )
+  }
+
   next()
 }

apps/api/src/modules/menu/menu.service.test.ts

@@ -268,4 +268,45 @@ describe('menu.service', () => {
       'settings',
     ])
   })
+
+  it('returns no feature menu for expired trial subscriptions', async () => {
+    vi.mocked(prisma.employee.findUniqueOrThrow).mockResolvedValue({
+      id: 'employee_1',
+      role: 'OWNER',
+      isActive: true,
+      companyId: 'company_1',
+    } as never)
+
+    vi.mocked(prisma.company.findUniqueOrThrow).mockResolvedValue({
+      id: 'company_1',
+      name: 'Atlas Cars',
+      status: 'TRIALING',
+      subscription: { plan: 'STARTER', status: 'EXPIRED' },
+    } as never)
+
+    vi.mocked(prisma.menuItem.findMany).mockResolvedValue([
+      {
+        id: 'item_dashboard',
+        systemKey: 'dashboard',
+        label: 'Dashboard',
+        itemType: 'INTERNAL_PAGE',
+        routeOrUrl: '/',
+        icon: 'LayoutDashboard',
+        parentId: null,
+        openInNewTab: false,
+        isRequired: true,
+        isActive: true,
+        displayOrder: 10,
+        roleVisibilities: [{ role: 'OWNER' }],
+        subscriptionAssignments: [{ plan: 'STARTER', displayOrder: 10, isActive: true }],
+        companyAssignments: [],
+      },
+    ] as never)
+
+    const result = await getEmployeeMenu('employee_1')
+
+    expect(result.subscriptionStatus).toBe('EXPIRED')
+    expect(result.subscriptionAccessLevel).toBe('none')
+    expect(result.items).toEqual([])
+  })
 })

apps/api/src/modules/menu/menu.service.ts

@@ -1,5 +1,6 @@
 import { AppError } from '../../http/errors'
 import { prisma } from '../../lib/prisma'
+import { getAccessLevel, hasFullAccess, type AccessLevel } from '../subscriptions/subscription.policy'
 
 type EmployeeRole = 'OWNER' | 'MANAGER' | 'AGENT'
 type Plan = 'STARTER' | 'GROWTH' | 'PRO'
@@ -466,23 +467,27 @@ async function getMenuEvaluationContext(companyId: string, role: EmployeeRole, e
   })
 
   const currentPlan = company.subscription?.plan ?? null
-  const currentPlanName = currentPlan as Plan | null
+  const subscriptionStatus = company.subscription?.status ?? 'EXPIRED'
+  const subscriptionAccessLevel = getAccessLevel(subscriptionStatus)
+  const subscriptionHasFullAccess = hasFullAccess(subscriptionStatus)
+  const currentPlanName = subscriptionHasFullAccess ? currentPlan as Plan | null : null
 
   const evaluated: EvaluatedMenuItem[] = (menuItems as any[]).map((item: any) => {
     const defaultsToAllSubscriptions = item.subscriptionAssignments.length === 0
     const subscriptionAssignment = item.subscriptionAssignments.find(
-      (assignment: any) => assignment.isActive && (!currentPlan || assignment.plan === currentPlan),
+      (assignment: any) => assignment.isActive && (!currentPlanName || assignment.plan === currentPlanName),
     )
     const companyAssignment = item.companyAssignments.find((assignment: any) => assignment.isActive)
     const roleAllowed = item.roleVisibilities.length === 0 || item.roleVisibilities.some((visibility: any) => visibility.role === role)
-    const subscriptionEntitled = Boolean(subscriptionAssignment || (defaultsToAllSubscriptions && currentPlan))
-    const entitled = Boolean(subscriptionEntitled || companyAssignment)
+    const subscriptionEntitled = Boolean(subscriptionHasFullAccess && (subscriptionAssignment || (defaultsToAllSubscriptions && currentPlanName)))
+    const entitled = Boolean(subscriptionHasFullAccess && (subscriptionEntitled || companyAssignment))
     const visible = Boolean(item.isActive && entitled && roleAllowed && employeeIsActive)
     const displayOrder = companyAssignment?.displayOrder ?? subscriptionAssignment?.displayOrder ?? item.displayOrder
 
     const reasons: string[] = []
     if (!item.isActive) reasons.push('Hidden because the menu item is inactive.')
     if (!employeeIsActive) reasons.push('Hidden because the user account is inactive.')
+    if (!subscriptionHasFullAccess) reasons.push(`Hidden because subscription status ${subscriptionStatus} does not allow dashboard feature access.`)
     if (!entitled) reasons.push(describeEntitlement(currentPlanName, false, false, false))
     if (entitled) {
       reasons.push(
@@ -518,6 +523,8 @@ async function getMenuEvaluationContext(companyId: string, role: EmployeeRole, e
     company,
     role,
     currentPlan: currentPlanName,
+    subscriptionStatus,
+    subscriptionAccessLevel: subscriptionAccessLevel as AccessLevel,
     items: sortByDisplayOrder(evaluated),
   }
 }
@@ -578,6 +585,8 @@ export async function previewCompanyMenu(input: MenuPreviewInput) {
     company: context.company,
     role: context.role,
     subscriptionPlan: context.currentPlan,
+    subscriptionStatus: context.subscriptionStatus,
+    subscriptionAccessLevel: context.subscriptionAccessLevel,
     items: context.items,
     finalMenu: buildMenuTree(
       context.items
@@ -615,6 +624,8 @@ export async function getEmployeeMenu(employeeId: string) {
     companyId: employee.companyId,
     role: employee.role,
     subscriptionPlan: context.currentPlan,
+    subscriptionStatus: context.subscriptionStatus,
+    subscriptionAccessLevel: context.subscriptionAccessLevel,
     items: buildMenuTree(
       visibleItems.map((item) => ({
         id: item.id,