Server-side Access Checks

type AppActorUserResponse = {
  data: {
    user: {
      appUserId: string;
      entitlements: Record<
        string,
        {
          isActive: boolean;
          status: 'active' | 'grace';
          expiresAt: string | null;
          gracePeriodExpiresAt: string | null;
        }
      >;
    };
  };
};

export async function requirePremium(appUserId: string) {
  const response = await fetch(
    `https://api.appactor.com/v1/api/users/${encodeURIComponent(appUserId)}`,
    {
      headers: {
        Authorization: `Bearer ${process.env.APPACTOR_PROJECT_SECRET_KEY}`,
        'X-AppActor-App-Id': process.env.APPACTOR_APP_ID!,
      },
    }
  );

  if (!response.ok) {
    throw new Error(`AppActor access check failed: ${response.status}`);
  }

  const body = (await response.json()) as AppActorUserResponse;
  const premium = body.data.user.entitlements.premium;

  if (!premium?.isActive) {
    throw new Response('Premium required', { status: 403 });
  }

  return body.data.user;
}