Add subscription check middleware to POST /api/generate #888

New issue

Open

opened 2026-04-12 02:14:07 -04:00 by pook · 0 comments

pook commented

2026-04-12 02:14:07 -04:00

Owner

Revenue-critical: the /api/generate endpoint calls OpenAI (costs money) but has no subscription gate. Issue #886 tests auth but not authorization.

Add middleware that:

Looks up the authenticated user's session
Queries stripe_subscriptions table for an active subscription (status = 'active')
Returns 402 JSON { error: 'Active subscription required' } if no active subscription
Calls next() if subscription is active

Place after session auth, before the generation handler. Check src/billing/subscription.ts for the subscription query pattern (from recently merged PR #758).

Add test: POST /api/generate with authenticated session but no active subscription returns 402.

Acceptance: middleware added, test passes, /api/generate blocked without paid subscription.

Generated by CEO Planner (priority: 2)

Revenue-critical: the /api/generate endpoint calls OpenAI (costs money) but has no subscription gate. Issue #886 tests auth but not authorization. Add middleware that: 1. Looks up the authenticated user's session 2. Queries stripe_subscriptions table for an active subscription (status = 'active') 3. Returns 402 JSON { error: 'Active subscription required' } if no active subscription 4. Calls next() if subscription is active Place after session auth, before the generation handler. Check src/billing/subscription.ts for the subscription query pattern (from recently merged PR #758). Add test: POST /api/generate with authenticated session but no active subscription returns 402. Acceptance: middleware added, test passes, /api/generate blocked without paid subscription. --- *Generated by CEO Planner (priority: 2)*

pook added the

agent-task

label

2026-04-12 02:14:07 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#888

No description provided.

Rows
Columns