fix: enforce expired trial subscription menu access

apps/api/src/middleware/requireSubscription.test.ts

@@ -1,6 +1,15 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { NextFunction, Request, Response } from 'express'
 
+vi.mock('../lib/prisma', () => ({
+  prisma: {
+    subscription: {
+      findUnique: vi.fn(),
+    },
+  },
+}))
+
+import { prisma } from '../lib/prisma'
 import { requireSubscription } from './requireSubscription'
 
 function responseStub() {
@@ -12,27 +21,28 @@ function responseStub() {
 
 describe('requireSubscription middleware', () => {
   beforeEach(() => {
+    vi.clearAllMocks()
     process.env.NEXT_PUBLIC_DASHBOARD_URL = 'https://dashboard.example.test'
   })
 
-  it('requires tenant/company context first', () => {
+  it('requires tenant/company context first', async () => {
     const req = {} as Request
     const res = responseStub()
     const next = vi.fn() as NextFunction
 
-    requireSubscription(req, res, next)
+    await requireSubscription(req, res, next)
 
     expect(res.status).toHaveBeenCalledWith(401)
     expect(res.json).toHaveBeenCalledWith({ error: 'unauthenticated', message: 'No company context', statusCode: 401 })
     expect(next).not.toHaveBeenCalled()
   })
 
-  it('blocks suspended companies with a subscription recovery URL', () => {
+  it('blocks suspended companies with a subscription recovery URL', async () => {
     const req = { company: { status: 'SUSPENDED' } } as Request
     const res = responseStub()
     const next = vi.fn() as NextFunction
 
-    requireSubscription(req, res, next)
+    await requireSubscription(req, res, next)
 
     expect(res.status).toHaveBeenCalledWith(402)
     expect(res.json).toHaveBeenCalledWith({
@@ -42,14 +52,15 @@ describe('requireSubscription middleware', () => {
       billingUrl: 'https://dashboard.example.test/subscription',
     })
     expect(next).not.toHaveBeenCalled()
+    expect(prisma.subscription.findUnique).not.toHaveBeenCalled()
   })
 
-  it('blocks pending companies with setup guidance', () => {
+  it('blocks pending companies with setup guidance', async () => {
     const req = { company: { status: 'PENDING' } } as Request
     const res = responseStub()
     const next = vi.fn() as NextFunction
 
-    requireSubscription(req, res, next)
+    await requireSubscription(req, res, next)
 
     expect(res.status).toHaveBeenCalledWith(402)
     expect(res.json).toHaveBeenCalledWith(expect.objectContaining({
@@ -59,12 +70,39 @@ describe('requireSubscription middleware', () => {
     expect(next).not.toHaveBeenCalled()
   })
 
-  it('allows active companies through', () => {
-    const req = { company: { status: 'ACTIVE' } } as Request
+  it('blocks expired trial subscriptions with a subscription recovery URL', async () => {
+    vi.mocked(prisma.subscription.findUnique).mockResolvedValue({ status: 'EXPIRED' } as never)
+
+    const req = { company: { id: 'company_1', status: 'TRIALING' } } as Request
     const res = responseStub()
     const next = vi.fn() as NextFunction
 
-    requireSubscription(req, res, next)
+    await requireSubscription(req, res, next)
+
+    expect(prisma.subscription.findUnique).toHaveBeenCalledWith({
+      where: { companyId: 'company_1' },
+      select: { status: true },
+    })
+    expect(res.status).toHaveBeenCalledWith(402)
+    expect(res.json).toHaveBeenCalledWith({
+      error: 'subscription_required',
+      message: 'Your subscription has ended. Please reactivate to continue.',
+      statusCode: 402,
+      billingUrl: 'https://dashboard.example.test/subscription',
+      subscriptionStatus: 'EXPIRED',
+      accessLevel: 'none',
+    })
+    expect(next).not.toHaveBeenCalled()
+  })
+
+  it('allows active companies with active subscriptions through', async () => {
+    vi.mocked(prisma.subscription.findUnique).mockResolvedValue({ status: 'ACTIVE' } as never)
+
+    const req = { company: { id: 'company_1', status: 'ACTIVE' } } as Request
+    const res = responseStub()
+    const next = vi.fn() as NextFunction
+
+    await requireSubscription(req, res, next)
 
     expect(next).toHaveBeenCalledTimes(1)
     expect(res.status).not.toHaveBeenCalled()

apps/api/src/middleware/requireSubscription.ts

@@ -1,4 +1,6 @@
 import { Request, Response, NextFunction } from 'express'
+import { prisma } from '../lib/prisma'
+import { getAccessLevel, hasAnyAccess } from '../modules/subscriptions/subscription.policy'
 import { sendUnauthorized, sendPaymentRequired } from './authHelpers'
 
 const BLOCKED_STATUSES = ['SUSPENDED', 'PENDING']
@@ -8,9 +10,9 @@ const BLOCKED_STATUSES = ['SUSPENDED', 'PENDING']
  * Must be applied after `requireTenant`.
  *
  * Guarantees on success:
- *   req.company.status is not SUSPENDED or PENDING
+ *   req.company.status is not SUSPENDED or PENDING, and subscription access is not none
  */
-export function requireSubscription(req: Request, res: Response, next: NextFunction) {
+export async function requireSubscription(req: Request, res: Response, next: NextFunction) {
   const company = req.company
   if (!company) return sendUnauthorized(res, 'unauthenticated', 'No company context')
 
@@ -25,5 +27,24 @@ export function requireSubscription(req: Request, res: Response, next: NextFunct
     )
   }
 
+  const subscription = await prisma.subscription.findUnique({
+    where: { companyId: company.id },
+    select: { status: true },
+  })
+  const subscriptionStatus = subscription?.status ?? 'EXPIRED'
+
+  if (!hasAnyAccess(subscriptionStatus)) {
+    return sendPaymentRequired(
+      res,
+      'subscription_required',
+      'Your subscription has ended. Please reactivate to continue.',
+      {
+        billingUrl: `${process.env.NEXT_PUBLIC_DASHBOARD_URL}/subscription`,
+        subscriptionStatus,
+        accessLevel: getAccessLevel(subscriptionStatus),
+      },
+    )
+  }
+
   next()
 }