fix: enforce expired trial subscription menu access

apps/api/src/modules/menu/menu.service.test.ts

@@ -268,4 +268,45 @@ describe('menu.service', () => {
       'settings',
     ])
   })
+
+  it('returns no feature menu for expired trial subscriptions', async () => {
+    vi.mocked(prisma.employee.findUniqueOrThrow).mockResolvedValue({
+      id: 'employee_1',
+      role: 'OWNER',
+      isActive: true,
+      companyId: 'company_1',
+    } as never)
+
+    vi.mocked(prisma.company.findUniqueOrThrow).mockResolvedValue({
+      id: 'company_1',
+      name: 'Atlas Cars',
+      status: 'TRIALING',
+      subscription: { plan: 'STARTER', status: 'EXPIRED' },
+    } as never)
+
+    vi.mocked(prisma.menuItem.findMany).mockResolvedValue([
+      {
+        id: 'item_dashboard',
+        systemKey: 'dashboard',
+        label: 'Dashboard',
+        itemType: 'INTERNAL_PAGE',
+        routeOrUrl: '/',
+        icon: 'LayoutDashboard',
+        parentId: null,
+        openInNewTab: false,
+        isRequired: true,
+        isActive: true,
+        displayOrder: 10,
+        roleVisibilities: [{ role: 'OWNER' }],
+        subscriptionAssignments: [{ plan: 'STARTER', displayOrder: 10, isActive: true }],
+        companyAssignments: [],
+      },
+    ] as never)
+
+    const result = await getEmployeeMenu('employee_1')
+
+    expect(result.subscriptionStatus).toBe('EXPIRED')
+    expect(result.subscriptionAccessLevel).toBe('none')
+    expect(result.items).toEqual([])
+  })
 })

apps/api/src/modules/menu/menu.service.ts

@@ -1,5 +1,6 @@
 import { AppError } from '../../http/errors'
 import { prisma } from '../../lib/prisma'
+import { getAccessLevel, hasFullAccess, type AccessLevel } from '../subscriptions/subscription.policy'
 
 type EmployeeRole = 'OWNER' | 'MANAGER' | 'AGENT'
 type Plan = 'STARTER' | 'GROWTH' | 'PRO'
@@ -466,23 +467,27 @@ async function getMenuEvaluationContext(companyId: string, role: EmployeeRole, e
   })
 
   const currentPlan = company.subscription?.plan ?? null
-  const currentPlanName = currentPlan as Plan | null
+  const subscriptionStatus = company.subscription?.status ?? 'EXPIRED'
+  const subscriptionAccessLevel = getAccessLevel(subscriptionStatus)
+  const subscriptionHasFullAccess = hasFullAccess(subscriptionStatus)
+  const currentPlanName = subscriptionHasFullAccess ? currentPlan as Plan | null : null
 
   const evaluated: EvaluatedMenuItem[] = (menuItems as any[]).map((item: any) => {
     const defaultsToAllSubscriptions = item.subscriptionAssignments.length === 0
     const subscriptionAssignment = item.subscriptionAssignments.find(
-      (assignment: any) => assignment.isActive && (!currentPlan || assignment.plan === currentPlan),
+      (assignment: any) => assignment.isActive && (!currentPlanName || assignment.plan === currentPlanName),
     )
     const companyAssignment = item.companyAssignments.find((assignment: any) => assignment.isActive)
     const roleAllowed = item.roleVisibilities.length === 0 || item.roleVisibilities.some((visibility: any) => visibility.role === role)
-    const subscriptionEntitled = Boolean(subscriptionAssignment || (defaultsToAllSubscriptions && currentPlan))
-    const entitled = Boolean(subscriptionEntitled || companyAssignment)
+    const subscriptionEntitled = Boolean(subscriptionHasFullAccess && (subscriptionAssignment || (defaultsToAllSubscriptions && currentPlanName)))
+    const entitled = Boolean(subscriptionHasFullAccess && (subscriptionEntitled || companyAssignment))
     const visible = Boolean(item.isActive && entitled && roleAllowed && employeeIsActive)
     const displayOrder = companyAssignment?.displayOrder ?? subscriptionAssignment?.displayOrder ?? item.displayOrder
 
     const reasons: string[] = []
     if (!item.isActive) reasons.push('Hidden because the menu item is inactive.')
     if (!employeeIsActive) reasons.push('Hidden because the user account is inactive.')
+    if (!subscriptionHasFullAccess) reasons.push(`Hidden because subscription status ${subscriptionStatus} does not allow dashboard feature access.`)
     if (!entitled) reasons.push(describeEntitlement(currentPlanName, false, false, false))
     if (entitled) {
       reasons.push(
@@ -518,6 +523,8 @@ async function getMenuEvaluationContext(companyId: string, role: EmployeeRole, e
     company,
     role,
     currentPlan: currentPlanName,
+    subscriptionStatus,
+    subscriptionAccessLevel: subscriptionAccessLevel as AccessLevel,
     items: sortByDisplayOrder(evaluated),
   }
 }
@@ -578,6 +585,8 @@ export async function previewCompanyMenu(input: MenuPreviewInput) {
     company: context.company,
     role: context.role,
     subscriptionPlan: context.currentPlan,
+    subscriptionStatus: context.subscriptionStatus,
+    subscriptionAccessLevel: context.subscriptionAccessLevel,
     items: context.items,
     finalMenu: buildMenuTree(
       context.items
@@ -615,6 +624,8 @@ export async function getEmployeeMenu(employeeId: string) {
     companyId: employee.companyId,
     role: employee.role,
     subscriptionPlan: context.currentPlan,
+    subscriptionStatus: context.subscriptionStatus,
+    subscriptionAccessLevel: context.subscriptionAccessLevel,
     items: buildMenuTree(
       visibleItems.map((item) => ({
         id: item.id,