Track subscription usage and gate new analyses

src/analysis.ts

@@ -2,6 +2,7 @@ import { createHash, timingSafeEqual } from "node:crypto";
 import express from "express";
 import type { SupabaseClient } from "@supabase/supabase-js";
 import { z } from "zod";
+import { activeSubscriptionFor } from "./subscriptions.js";
 
 export function stableId(value: string) {
   const hex = createHash("sha256").update(value).digest("hex");
@@ -44,10 +45,14 @@ export function analysisRouter(db: SupabaseClient, secret: string) {
   router.post("/", async (req, res, next) => {
     try {
       const input = beginSchema.parse(req.body);
+      const userId = res.locals.userId as string;
+      if (!await activeSubscriptionFor(userId, { refresh: true })) {
+        return res.status(402).json({ error: "An active subscription is required to start a new analysis.", code: "subscription_required" });
+      }
       const playerId = z.uuid().safeParse(input.playerId);
       const { data, error } = await db.rpc("begin_analysis", {
-        p_session_id: input.clientId, p_user_id: res.locals.userId,
-        p_player_id: playerId.success ? playerId.data : stableId(`${res.locals.userId}:player:${input.playerId}`),
+        p_session_id: input.clientId, p_user_id: userId,
+        p_player_id: playerId.success ? playerId.data : stableId(`${userId}:player:${input.playerId}`),
         p_reference: playerId.success ? null : input.playerId,
         p_name: input.name || `Session ${input.clientId.slice(0, 8)}`,
       });

src/server.ts

@@ -114,7 +114,7 @@ async function requireActiveSubscription(req: Request, res: Response) {
     res.status(401).json({ error: "Authentication required." });
     return null;
   }
-  if (!await activeSubscriptionFor(current.user.id)) {
+  if (!await activeSubscriptionFor(current.user.id, { refresh: true })) {
     res.status(402).json({ error: "An active subscription is required to access Sporalize Labs.", code: "subscription_required" });
     return null;
   }
@@ -153,14 +153,9 @@ app.get("/api/plan-billing", async (req, res, next) => {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
     const userId = current.user.id;
-    const [assignmentResult, playersResult, sessionsResult] = await Promise.all([
-      supabaseAdmin.from("users_subscriptions").select("subscription_id,startdate,enddate").eq("user_id", userId).maybeSingle(),
-      supabaseAdmin.from("players").select("player_id", { count: "exact", head: true }).eq("user_id", userId),
-      supabaseAdmin.from("sessions").select("session_id", { count: "exact", head: true }).eq("user_id", userId),
-    ]);
+    const assignmentResult = await supabaseAdmin.from("users_subscriptions")
+      .select("subscription_id,startdate,enddate,num_players,num_sessions").eq("user_id", userId).maybeSingle();
     if (assignmentResult.error) throw new Error(`Unable to load plan assignment: ${assignmentResult.error.message}`);
-    if (playersResult.error) throw new Error(`Unable to count players: ${playersResult.error.message}`);
-    if (sessionsResult.error) throw new Error(`Unable to count sessions: ${sessionsResult.error.message}`);
     const assignment = assignmentResult.data;
     let subscription = null;
     if (assignment?.subscription_id) {
@@ -180,7 +175,7 @@ app.get("/api/plan-billing", async (req, res, next) => {
       }
     }
     res.set("Cache-Control", "no-store");
-    return res.json({ subscription, usage: { players: playersResult.count ?? 0, sessions: sessionsResult.count ?? 0 }, billingHistoryAvailable: false });
+    return res.json({ subscription, usage: { players: assignment?.num_players ?? 0, sessions: assignment?.num_sessions ?? 0 }, billingHistoryAvailable: false });
   } catch (error) { next(error); }
 });
 
@@ -421,8 +416,8 @@ app.get("/api/sessions-overview", async (req, res, next) => {
 
 app.get("/api/sessions/:sessionId/reviews", async (req, res, next) => {
   try {
-    const current = await requireActiveSubscription(req, res);
-    if (!current) return;
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
     const sessionId = z.uuid().safeParse(req.params.sessionId);
     if (!sessionId.success) return res.sendStatus(404);
 
@@ -732,8 +727,15 @@ app.delete("/api/auth/account", async (req, res, next) => {
 });
 
 async function proxyAnalysisRequest(req: Request, res: Response) {
-  const current = await requireActiveSubscription(req, res);
-  if (!current) return;
+  const current = await authenticatedUser(req, res);
+  if (!current) return res.status(401).json({ error: "Authentication required." });
+  // Archived sessions and results remain available after expiry. Only starting
+  // a new analysis is gated here; the internal begin-analysis route repeats
+  // this check before creating its player/session rows.
+  if (req.method === "POST" && req.path === "/analyze") {
+    const active = await activeSubscriptionFor(current.user.id, { refresh: true });
+    if (!active) return res.status(402).json({ error: "An active subscription is required to create or change Labs data.", code: "subscription_required" });
+  }
 
   const target = new URL(req.originalUrl, env.ANALYSIS_API_URL);
   const headers = new Headers();