Enforce subscription period quotas

app.py

@@ -129,7 +129,15 @@ async def backend_error(request: Request, error: httpx.HTTPStatusError):
     status = error.response.status_code
     logger.error("Analysis backend request failed: path=%s status=%s response=%s",
         request.url.path, status, error.response.text[:500])
-    return JSONResponse({"detail": "Backend request failed"}, status_code=status if status < 500 else 502)
+    try:
+        backend_body = error.response.json()
+    except ValueError:
+        backend_body = {}
+    detail = backend_body.get("error") or backend_body.get("detail") or "Backend request failed"
+    payload = {"detail": detail}
+    if backend_body.get("code"):
+        payload["code"] = backend_body["code"]
+    return JSONResponse(payload, status_code=status if status < 500 else 502)
 
 
 @app.middleware("http")

src/analysis.ts

@@ -9,7 +9,7 @@ export function stableId(value: string) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-5${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
 }
 
-const beginSchema = z.object({ clientId: z.uuid(), playerId: z.string().trim().min(1).max(100), name: z.string().trim().max(150) });
+const beginSchema = z.object({ clientId: z.uuid(), playerId: z.uuid(), name: z.string().trim().max(150) });
 const reportSchema = z.object({
   index: z.number().int().nonnegative(), action: z.string().min(1).max(50),
   start_frame: z.number().int().nonnegative().optional(), end_frame: z.number().int().nonnegative().optional(),
@@ -46,18 +46,39 @@ export function analysisRouter(db: SupabaseClient, secret: string) {
     try {
       const input = beginSchema.parse(req.body);
       const userId = res.locals.userId as string;
-      if (!await activeSubscriptionFor(userId, { refresh: true })) {
+      const subscription = await activeSubscriptionFor(userId, { refresh: true });
+      if (!subscription) {
         return res.status(402).json({ error: "An active subscription is required to start a new analysis.", code: "subscription_required" });
       }
-      const playerId = z.uuid().safeParse(input.playerId);
+      const { data: usage, error: usageError } = await db.from("users_subscriptions")
+        .select("num_sessions_month").eq("user_id", userId).maybeSingle();
+      if (usageError) return res.status(503).json({ error: "Unable to check your session quota." });
+      const usedSessions = Number(usage?.num_sessions_month ?? 0);
+      const sessionLimit = subscription.monthly_session_limit == null ? null : Number(subscription.monthly_session_limit);
+      if (sessionLimit !== null && usedSessions >= sessionLimit) {
+        return res.status(403).json({
+          error: "You have used all sessions included in this plan period. Renew or upgrade your plan to analyze another session.",
+          code: "quota_exceeded", resource: "sessions", used: usedSessions, limit: sessionLimit,
+        });
+      }
+      const { data: player, error: playerError } = await db.from("players")
+        .select("player_id").eq("player_id", input.playerId).maybeSingle();
+      if (playerError) return res.status(503).json({ error: "Unable to verify the selected player." });
+      if (!player) return res.status(404).json({ error: "Choose a player from the available roster before starting analysis." });
       const { data, error } = await db.rpc("begin_analysis", {
         p_session_id: input.clientId, p_user_id: userId,
-        p_player_id: playerId.success ? playerId.data : stableId(`${userId}:player:${input.playerId}`),
-        p_reference: playerId.success ? null : input.playerId,
+        p_player_id: input.playerId,
+        p_reference: null,
         p_name: input.name || `Session ${input.clientId.slice(0, 8)}`,
       });
       if (error) {
         console.error("Unable to prepare analysis session", { code: error.code, message: error.message });
+        if (error.code === "P0001" && error.message.includes("subscription_quota_exceeded")) {
+          return res.status(403).json({ error: "You have used all sessions included in this plan period. Renew or upgrade your plan to analyze another session.", code: "quota_exceeded", resource: "sessions" });
+        }
+        if (error.code === "P0001" && error.message.includes("subscription_required")) {
+          return res.status(402).json({ error: "An active subscription is required to start an analysis.", code: "subscription_required" });
+        }
         return res.status(error.code === "P0001" ? 409 : 503).json({ error: "Unable to prepare analysis session" });
       }
       return res.json(data);

src/profile-images.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import express, { type Express, type Request, type Response } from "express";
 import { z } from "zod";
 import { authenticatedUser } from "./auth.js";
+import { activeSubscriptionFor } from "./subscriptions.js";
 import { supabaseAdmin } from "./supabase.js";
 
 const BUCKET = "profile-images";
@@ -120,8 +121,12 @@ export function registerProfileImageRoutes(app: Express) {
       if (!current) return res.status(401).json({ error: "Authentication required." });
       const id = playerIdSchema.safeParse(req.params.playerId);
       if (!id.success) return res.status(404).json({ error: "Player not found." });
-      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).maybeSingle();
+      const { data, error } = await supabaseAdmin.from("players").select("user_id,image_path").eq("player_id", id.data).maybeSingle();
       if (error) throw new Error(`Unable to load player image: ${error.message}`);
+      if (!data) return res.status(404).json({ error: "Player not found." });
+      if (data.user_id !== current.user.id && !await activeSubscriptionFor(current.user.id, { refresh: true })) {
+        return res.status(403).json({ error: "An active subscription is required to view shared player profiles.", code: "subscription_required" });
+      }
       return await sendImage(res, safePreviousPath("players", id.data, data?.image_path));
     } catch (error) { next(error); }
   });
@@ -132,7 +137,7 @@ export function registerProfileImageRoutes(app: Express) {
       if (!current) return res.status(401).json({ error: "Authentication required." });
       const id = playerIdSchema.safeParse(req.params.playerId);
       if (!id.success) return res.status(404).json({ error: "Player not found." });
-      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).maybeSingle();
+      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).eq("user_id", current.user.id).maybeSingle();
       if (error || !data) return res.status(404).json({ error: "Player not found." });
       return await uploadImage(req, res, "players", id.data, data.image_path);
     } catch (error) { next(error); }
@@ -144,7 +149,7 @@ export function registerProfileImageRoutes(app: Express) {
       if (!current) return res.status(401).json({ error: "Authentication required." });
       const id = playerIdSchema.safeParse(req.params.playerId);
       if (!id.success) return res.status(404).json({ error: "Player not found." });
-      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).maybeSingle();
+      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).eq("user_id", current.user.id).maybeSingle();
       if (error || !data) return res.status(404).json({ error: "Player not found." });
       return await deleteImage(res, "players", id.data, data.image_path);
     } catch (error) { next(error); }

src/server.ts

@@ -114,11 +114,25 @@ async function requireActiveSubscription(req: Request, res: Response) {
     res.status(401).json({ error: "Authentication required." });
     return null;
   }
-  if (!await activeSubscriptionFor(current.user.id, { refresh: true })) {
+  const subscription = await activeSubscriptionFor(current.user.id, { refresh: true });
+  if (!subscription) {
     res.status(402).json({ error: "An active subscription is required to access Sporalize Labs.", code: "subscription_required" });
     return null;
   }
-  return current;
+  return { ...current, subscription };
+}
+
+async function enforcePlayerQuota(userId: string, limit: number | null, res: Response) {
+  const { data, error } = await supabaseAdmin.from("users_subscriptions")
+    .select("num_players").eq("user_id", userId).maybeSingle();
+  if (error) throw new Error(`Unable to check subscription usage: ${error.message}`);
+  const used = Number(data?.num_players ?? 0);
+  if (limit === null || used < limit) return true;
+  res.status(403).json({
+    error: "You have used all player slots included in this plan period. Renew or upgrade your plan to add another player.",
+    code: "quota_exceeded", resource: "players", used, limit,
+  });
+  return false;
 }
 
 app.get("/health", (_req, res) => res.json({ ok: true }));
@@ -126,7 +140,7 @@ app.get("/health", (_req, res) => res.json({ ok: true }));
 app.get("/api/subscriptions", async (_req, res, next) => {
   try {
     const { data, error } = await supabaseAdmin.from("subscriptions")
-      .select("subscription_id,plan,price")
+      .select("subscription_id,plan,price,player_limit,monthly_session_limit")
       .order("price", { ascending: true });
     if (error) throw new Error(`Unable to load subscription plans: ${error.message}`);
     const plans = (data ?? []).map((row) => ({
@@ -134,6 +148,8 @@ app.get("/api/subscriptions", async (_req, res, next) => {
       subscriptionId: row.subscription_id,
       name: row.plan,
       monthlyPrice: Number(row.price),
+      playerLimit: row.player_limit == null ? null : Number(row.player_limit),
+      monthlySessions: row.monthly_session_limit == null ? null : Number(row.monthly_session_limit),
     }));
     return res.json({ plans });
   } catch (error) { next(error); }
@@ -154,13 +170,13 @@ app.get("/api/plan-billing", async (req, res, next) => {
     if (!current) return res.status(401).json({ error: "Authentication required." });
     const userId = current.user.id;
     const assignmentResult = await supabaseAdmin.from("users_subscriptions")
-      .select("subscription_id,startdate,enddate,num_players,num_sessions").eq("user_id", userId).maybeSingle();
+      .select("subscription_id,startdate,enddate,num_players,num_sessions,num_sessions_month").eq("user_id", userId).maybeSingle();
     if (assignmentResult.error) throw new Error(`Unable to load plan assignment: ${assignmentResult.error.message}`);
     const assignment = assignmentResult.data;
     let subscription = null;
     if (assignment?.subscription_id) {
       const { data: plan, error } = await supabaseAdmin.from("subscriptions")
-        .select("subscription_id,plan,price").eq("subscription_id", assignment.subscription_id).maybeSingle();
+        .select("subscription_id,plan,price,player_limit,monthly_session_limit").eq("subscription_id", assignment.subscription_id).maybeSingle();
       if (error) throw new Error(`Unable to load plan: ${error.message}`);
       if (plan) {
         const today = new Date().toISOString().slice(0, 10);
@@ -168,6 +184,8 @@ app.get("/api/plan-billing", async (req, res, next) => {
           subscriptionId: plan.subscription_id,
           name: plan.plan,
           price: Number(plan.price),
+          playerLimit: plan.player_limit == null ? null : Number(plan.player_limit),
+          monthlySessions: plan.monthly_session_limit == null ? null : Number(plan.monthly_session_limit),
           startDate: assignment.startdate,
           endDate: assignment.enddate,
           status: today < assignment.startdate ? "scheduled" : today > assignment.enddate ? "expired" : "active",
@@ -175,7 +193,80 @@ app.get("/api/plan-billing", async (req, res, next) => {
       }
     }
     res.set("Cache-Control", "no-store");
-    return res.json({ subscription, usage: { players: assignment?.num_players ?? 0, sessions: assignment?.num_sessions ?? 0 }, billingHistoryAvailable: false });
+    const monthlySessionUsage = Number(assignment?.num_sessions_month ?? 0);
+    return res.json({ subscription, usage: { players: assignment?.num_players ?? 0, sessions: assignment?.num_sessions ?? 0, monthlySessions: monthlySessionUsage }, billingHistoryAvailable: false });
+  } catch (error) { next(error); }
+});
+
+app.get("/api/owned-players", async (req, res, next) => {
+  try {
+    const current = await authenticatedUser(req, res);
+    if (!current) return res.status(401).json({ error: "Authentication required." });
+    const subscribed = Boolean(await activeSubscriptionFor(current.user.id, { refresh: true }));
+    const { data, error } = await supabaseAdmin.from("players")
+      .select("player_id,user_id,fname,lname,position,club,gender,image_path")
+      .order("fname", { ascending: true });
+    if (error) throw new Error(`Unable to load players: ${error.message}`);
+    const visiblePlayers = subscribed ? (data ?? []) : (data ?? []).filter((player) => player.user_id === current.user.id);
+    return res.json({ players: visiblePlayers.map((player) => ({
+      playerId: player.player_id,
+      name: [player.fname, player.lname].filter(Boolean).join(" "),
+      isOwner: player.user_id === current.user.id,
+      position: player.position ?? "",
+      club: player.club ?? "",
+      gender: player.gender ?? null,
+      imagePath: player.image_path ?? null,
+    })) });
+  } catch (error) { next(error); }
+});
+
+app.post("/api/players", async (req, res, next) => {
+  try {
+    const current = await requireActiveSubscription(req, res);
+    if (!current) return;
+    if (!await enforcePlayerQuota(current.user.id, current.subscription.player_limit == null ? null : Number(current.subscription.player_limit), res)) return;
+    const input = playerProfileSchema.parse(req.body);
+    const age = input.age ? Number(input.age) : null;
+    const height = input.heightCm ? Number(input.heightCm) : null;
+    const weight = input.weightKg ? Number(input.weightKg) : null;
+    if ((age !== null && (age < 4 || age > 60)) || (height !== null && (height < 100 || height > 230)) || (weight !== null && (weight < 20 || weight > 150))) {
+      return res.status(400).json({ error: "Check the player's age, height and weight." });
+    }
+    const [fname, ...lastParts] = input.name.split(/\s+/);
+    const lname = lastParts.join(" ");
+    if (fname.length > 100 || lname.length > 100) return res.status(400).json({ error: "Player first and last names must be 100 characters or fewer." });
+    let birthday: string | null = null;
+    if (age !== null) {
+      const date = new Date();
+      date.setUTCFullYear(date.getUTCFullYear() - age);
+      birthday = date.toISOString().slice(0, 10);
+    }
+    const { data, error } = await supabaseAdmin.from("players").insert({
+      user_id: current.user.id,
+      fname,
+      lname,
+      bdate: birthday,
+      height,
+      weight,
+      club: input.club || null,
+      position: input.position || null,
+      gender: input.gender || null,
+    }).select("player_id,fname,lname,position,club,gender,image_path").single();
+    if (error?.code === "P0001" && error.message.includes("subscription_quota_exceeded")) {
+      return res.status(403).json({ error: "You have used all player slots included in this plan period. Renew or upgrade your plan to add another player.", code: "quota_exceeded", resource: "players" });
+    }
+    if (error?.code === "P0001" && error.message.includes("subscription_required")) {
+      return res.status(402).json({ error: "An active subscription is required to add a player.", code: "subscription_required" });
+    }
+    if (error) throw new Error(`Unable to create player: ${error.message}`);
+    return res.status(201).json({ player: {
+      playerId: data.player_id,
+      name: [data.fname, data.lname].filter(Boolean).join(" "),
+      position: data.position ?? "",
+      club: data.club ?? "",
+      gender: data.gender ?? null,
+      imagePath: data.image_path ?? null,
+    } });
   } catch (error) { next(error); }
 });
 
@@ -193,7 +284,7 @@ app.put("/api/players/:playerId", async (req, res, next) => {
       return res.status(400).json({ error: "Check the player's age, height and weight." });
     }
     const { data: existing, error: readError } = await supabaseAdmin.from("players")
-      .select("player_id,bdate").eq("player_id", id.data).maybeSingle();
+      .select("player_id,bdate").eq("player_id", id.data).eq("user_id", current.user.id).maybeSingle();
     if (readError) throw new Error(`Unable to load player: ${readError.message}`);
     if (!existing) return res.status(404).json({ error: "Player not found." });
     const [fname, ...lastParts] = input.name.split(/\s+/);
@@ -215,29 +306,32 @@ app.put("/api/players/:playerId", async (req, res, next) => {
       club: input.club || null,
       position: input.position || null,
       gender: input.gender || null,
-    }).eq("player_id", id.data);
+    }).eq("player_id", id.data).eq("user_id", current.user.id);
     if (error) throw new Error(`Unable to update player: ${error.message}`);
     return res.json({ ok: true });
   } catch (error) { next(error); }
 });
 
-// Players and sessions are currently a shared workspace: all signed-in users
-// can read the common catalogue. Revisit these read scopes if per-user data is
-// introduced later. The service-role client bypasses RLS, so keep this explicit.
+// Player management and analysis choices are scoped to the signed-in owner.
 app.get("/api/players-overview", async (req, res, next) => {
   try {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
 
-    const { data: rows, error } = await supabaseAdmin.from("players")
+    const subscription = await activeSubscriptionFor(current.user.id, { refresh: true });
+    let playersQuery = supabaseAdmin.from("players")
       .select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path")
       .order("fname", { ascending: true });
+    if (!subscription) playersQuery = playersQuery.eq("user_id", current.user.id);
+    const { data: rows, error } = await playersQuery;
     if (error) throw new Error(`Unable to load players: ${error.message}`);
 
     const playerIds = (rows ?? []).map((row) => row.player_id);
+    let sessionsQuery = supabaseAdmin.from("sessions").select("session_id,player_id,name,created_at")
+      .in("player_id", playerIds).order("created_at", { ascending: false });
+    if (!subscription) sessionsQuery = sessionsQuery.eq("user_id", current.user.id);
     const { data: sessions, error: sessionsError } = playerIds.length
-      ? await supabaseAdmin.from("sessions").select("session_id,player_id,name,created_at")
-        .in("player_id", playerIds).order("created_at", { ascending: false })
+      ? await sessionsQuery
       : { data: [], error: null };
     if (sessionsError) throw new Error(`Unable to load player sessions: ${sessionsError.message}`);
 
@@ -273,6 +367,7 @@ app.get("/api/players-overview", async (req, res, next) => {
       });
       return {
         playerId: row.player_id,
+        isOwner: row.user_id === current.user.id,
         name: [row.fname, row.lname].filter(Boolean).join(" "),
         age: ageFromBirthday(row.bdate),
         heightCm: row.height == null ? "" : String(row.height),
@@ -301,17 +396,23 @@ app.get("/api/players-overview/:playerId", async (req, res, next) => {
     if (!current) return res.status(401).json({ error: "Authentication required." });
     const playerId = z.string().uuid().safeParse(req.params.playerId);
     if (!playerId.success) return res.status(404).json({ error: "Player not found." });
-    const { data, error } = await supabaseAdmin.from("players").select("player_id")
-      .eq("player_id", playerId.data).maybeSingle();
+    const subscription = await activeSubscriptionFor(current.user.id, { refresh: true });
+    let playerQuery = supabaseAdmin.from("players").select("player_id,user_id")
+      .eq("player_id", playerId.data);
+    if (!subscription) playerQuery = playerQuery.eq("user_id", current.user.id);
+    const { data, error } = await playerQuery.maybeSingle();
     if (error) throw new Error(`Unable to load player: ${error.message}`);
     if (!data) return res.status(404).json({ error: "Player not found." });
 
-    const { data: overview, error: overviewError } = await supabaseAdmin.from("players")
+    let overviewQuery = supabaseAdmin.from("players")
       .select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path")
       .order("fname", { ascending: true });
+    if (!subscription) overviewQuery = overviewQuery.eq("user_id", current.user.id);
+    const { data: overview, error: overviewError } = await overviewQuery;
     if (overviewError) throw new Error(`Unable to load players: ${overviewError.message}`);
-    const { data: sessions, error: sessionsError } = await supabaseAdmin.from("sessions")
-      .select("session_id,player_id,name,created_at");
+    let sessionsQuery = supabaseAdmin.from("sessions").select("session_id,player_id,name,created_at");
+    if (!subscription) sessionsQuery = sessionsQuery.eq("user_id", current.user.id);
+    const { data: sessions, error: sessionsError } = await sessionsQuery;
     if (sessionsError) throw new Error(`Unable to load sessions: ${sessionsError.message}`);
     const { data: actions, error: actionsError } = (sessions ?? []).length
       ? await supabaseAdmin.from("actions").select("action_id,session_id,type").in("session_id", sessions!.map((row) => row.session_id))
@@ -346,7 +447,9 @@ app.get("/api/players-overview/:playerId", async (req, res, next) => {
       const values = sessionActions.map((action) => scoreMap.get(action.action_id)).filter((score): score is number => score != null && Number.isFinite(score));
       return { sessionId: row.session_id, createdAt: Date.parse(row.created_at) || 0, score: meanPlayerScore(values), actionCount: sessionActions.length, scoredCount: values.length };
     });
-    const { data: peers, error: peersError } = await supabaseAdmin.from("players").select("player_id");
+    let peersQuery = supabaseAdmin.from("players").select("player_id");
+    if (!subscription) peersQuery = peersQuery.eq("user_id", current.user.id);
+    const { data: peers, error: peersError } = await peersQuery;
     if (peersError) throw new Error(`Unable to load roster: ${peersError.message}`);
     const playerScores = new Map<string, number[]>();
     for (const action of actions ?? []) {
@@ -361,6 +464,7 @@ app.get("/api/players-overview/:playerId", async (req, res, next) => {
     const squadAverage = { byQuality: [], byAction: squadByAction };
     return res.json({
       playerId: player.player_id, name: [player.fname, player.lname].filter(Boolean).join(" "),
+      isOwner: player.user_id === current.user.id,
       age: ageFromBirthday(player.bdate),
       heightCm: player.height == null ? "" : String(player.height), weightKg: player.weight == null ? "" : String(player.weight),
       club: player.club ?? "", position: player.position ?? "", gender: player.gender ?? null,
@@ -378,9 +482,12 @@ app.get("/api/sessions-overview", async (req, res, next) => {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
 
-    const { data: sessions, error } = await supabaseAdmin.from("sessions")
-      .select("session_id,player_id,name,path,created_at,status")
+    const subscription = await activeSubscriptionFor(current.user.id, { refresh: true });
+    let sessionsQuery = supabaseAdmin.from("sessions")
+      .select("session_id,player_id,user_id,name,path,created_at,status")
       .order("created_at", { ascending: false });
+    if (!subscription) sessionsQuery = sessionsQuery.eq("user_id", current.user.id);
+    const { data: sessions, error } = await sessionsQuery;
     if (error) throw new Error(`Unable to load sessions: ${error.message}`);
     const playerIds = [...new Set((sessions ?? []).flatMap((row) => row.player_id ? [row.player_id] : []))];
     const { data: players, error: playersError } = playerIds.length
@@ -403,7 +510,7 @@ app.get("/api/sessions-overview", async (req, res, next) => {
     return res.json({ sessions: (sessions ?? []).map((row) => {
       const actionBreakdown = breakdownBySession.get(row.session_id) ?? {};
       return {
-        sessionId: row.session_id, playerId: row.player_id ?? "", playerName: row.player_id ? playerNames.get(row.player_id) ?? "" : "",
+        sessionId: row.session_id, isOwner: row.user_id === current.user.id, playerId: row.player_id ?? "", playerName: row.player_id ? playerNames.get(row.player_id) ?? "" : "",
         playerGender: row.player_id ? playerImages.get(row.player_id)?.gender ?? null : null,
         playerImagePath: row.player_id ? playerImages.get(row.player_id)?.imagePath ?? null : null,
         name: row.name, createdAt: Date.parse(row.created_at) || 0,
@@ -422,9 +529,12 @@ app.get("/api/sessions/:sessionId/reviews", async (req, res, next) => {
     if (!sessionId.success) return res.sendStatus(404);
 
     const { data: session, error: sessionError } = await supabaseAdmin.from("sessions")
-      .select("session_id").eq("session_id", sessionId.data).maybeSingle();
+      .select("session_id,user_id").eq("session_id", sessionId.data).maybeSingle();
     if (sessionError) throw new Error(`Unable to verify review session: ${sessionError.message}`);
     if (!session) return res.sendStatus(404);
+    if (session.user_id !== current.user.id && !await activeSubscriptionFor(current.user.id, { refresh: true })) {
+      return res.status(403).json({ error: "An active subscription is required to view shared sessions.", code: "subscription_required" });
+    }
 
     const { data: actions, error: actionsError } = await supabaseAdmin.from("actions")
       .select("action_id").eq("session_id", sessionId.data);
@@ -729,6 +839,22 @@ app.delete("/api/auth/account", async (req, res, next) => {
 async function proxyAnalysisRequest(req: Request, res: Response) {
   const current = await authenticatedUser(req, res);
   if (!current) return res.status(401).json({ error: "Authentication required." });
+  const resourcePath = req.path;
+  const sessionMatch = resourcePath.match(/^\/(?:sessions\/)?([0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})(?:\/|$)/i);
+  if (["GET", "HEAD"].includes(req.method) && sessionMatch) {
+    const subscribed = await activeSubscriptionFor(current.user.id, { refresh: true });
+    if (!subscribed) {
+      const { data: session, error } = await supabaseAdmin.from("sessions")
+        .select("session_id").eq("session_id", sessionMatch[1]).eq("user_id", current.user.id).maybeSingle();
+      if (error) throw new Error(`Unable to verify session access: ${error.message}`);
+      if (!session) return res.status(403).json({ error: "An active subscription is required to view shared sessions.", code: "subscription_required" });
+    }
+  } else if (sessionMatch) {
+    const { data: session, error } = await supabaseAdmin.from("sessions")
+      .select("session_id").eq("session_id", sessionMatch[1]).eq("user_id", current.user.id).maybeSingle();
+    if (error) throw new Error(`Unable to verify session ownership: ${error.message}`);
+    if (!session) return res.status(403).json({ error: "Only the session owner can change or delete this session." });
+  }
   // Archived sessions and results remain available after expiry. Only starting
   // a new analysis is gated here; the internal begin-analysis route repeats
   // this check before creating its player/session rows.

src/subscriptions.ts

@@ -46,7 +46,7 @@ async function loadActiveSubscription(userId: string) {
   if (!assignment?.subscription_id || assignment.startdate > today || assignment.enddate < today) return null;
 
   const { data: plan, error: planError } = await supabaseAdmin.from("subscriptions")
-    .select("subscription_id,plan,price").eq("subscription_id", assignment.subscription_id).maybeSingle();
+    .select("subscription_id,plan,price,player_limit,monthly_session_limit").eq("subscription_id", assignment.subscription_id).maybeSingle();
   if (planError) throw new Error(`Unable to load subscription plan: ${planError.message}`);
   return plan ? { ...plan, startdate: assignment.startdate, enddate: assignment.enddate } : null;
 }