Add subscription requirement check to POST /api/generate #1315

New issue

Open

opened 2026-04-13 13:02:19 -04:00 by pook · 0 comments

pook commented

2026-04-13 13:02:19 -04:00

Owner

POST /api/generate has no subscription verification — users can generate compliance documents for free. Add middleware:

Extract user identity from request (API key or Authorization header)
Look up subscription status from the billing module (use data from PR #758 subscription module)
Return 402 { error: 'Active subscription required', code: 'SUBSCRIPTION_REQUIRED' } if no active subscription
Allow config override via SKIP_SUBSCRIPTION_CHECK=true env var for dev/testing
Add unit tests for gate-open and gate-closed scenarios

Acceptance: Requests without active subscription get 402. Subscribed requests pass through. Tests pass.

Generated by CEO Planner (priority: 2)

POST /api/generate has no subscription verification — users can generate compliance documents for free. Add middleware: 1. Extract user identity from request (API key or Authorization header) 2. Look up subscription status from the billing module (use data from PR #758 subscription module) 3. Return 402 `{ error: 'Active subscription required', code: 'SUBSCRIPTION_REQUIRED' }` if no active subscription 4. Allow config override via `SKIP_SUBSCRIPTION_CHECK=true` env var for dev/testing 5. Add unit tests for gate-open and gate-closed scenarios Acceptance: Requests without active subscription get 402. Subscribed requests pass through. Tests pass. --- *Generated by CEO Planner (priority: 2)*