fix: enforce expired trial subscription menu access

apps/api/src/middleware/requireSubscription.ts

@@ -1,4 +1,6 @@
 import { Request, Response, NextFunction } from 'express'
+import { prisma } from '../lib/prisma'
+import { getAccessLevel, hasAnyAccess } from '../modules/subscriptions/subscription.policy'
 import { sendUnauthorized, sendPaymentRequired } from './authHelpers'
 
 const BLOCKED_STATUSES = ['SUSPENDED', 'PENDING']
@@ -8,9 +10,9 @@ const BLOCKED_STATUSES = ['SUSPENDED', 'PENDING']
  * Must be applied after `requireTenant`.
  *
  * Guarantees on success:
- *   req.company.status is not SUSPENDED or PENDING
+ *   req.company.status is not SUSPENDED or PENDING, and subscription access is not none
  */
-export function requireSubscription(req: Request, res: Response, next: NextFunction) {
+export async function requireSubscription(req: Request, res: Response, next: NextFunction) {
   const company = req.company
   if (!company) return sendUnauthorized(res, 'unauthenticated', 'No company context')
 
@@ -25,5 +27,24 @@ export function requireSubscription(req: Request, res: Response, next: NextFunct
     )
   }
 
+  const subscription = await prisma.subscription.findUnique({
+    where: { companyId: company.id },
+    select: { status: true },
+  })
+  const subscriptionStatus = subscription?.status ?? 'EXPIRED'
+
+  if (!hasAnyAccess(subscriptionStatus)) {
+    return sendPaymentRequired(
+      res,
+      'subscription_required',
+      'Your subscription has ended. Please reactivate to continue.',
+      {
+        billingUrl: `${process.env.NEXT_PUBLIC_DASHBOARD_URL}/subscription`,
+        subscriptionStatus,
+        accessLevel: getAccessLevel(subscriptionStatus),
+      },
+    )
+  }
+
   next()
 }