Enforce every plan limit on the server from one entitlement table

How to do it

A check that lives only in the browser hides a button but leaves the API open, so a free account calls the paid feature directly. Store each entitlement as a flag or a number, such as exports allowed or 10 projects. The function works out the account's plan from Give access from the subscription status. It answers allowed or not, with the limit and current use. Count limits in the same transaction that creates the resource, so two requests at once cannot both pass. Answer a refused call with HTTP 403 or 402 and the name of the plan that unlocks it. Per-customer overrides, such as a sales deal, are rows in the same table with an end date. The browser may read the table to hide buttons, but never decides.

Examples

TypeScript example

const ENTITLEMENTS: Record<string, Record<string, boolean | number>> = {
  free: { exports: false, projects: 3 },
  team: { exports: true, projects: 50 },
}

export async function checkEntitlement(db, account, feature: string) {
  const plan = await db.currentPlan(account.id)
  const limit = (await db.override(account.id, feature)) ?? ENTITLEMENTS[plan][feature]
  if (typeof limit === 'boolean') return { allowed: limit }
  const used = await db.countForUpdate(account.id, feature)
  return { allowed: used < limit, limit, used }
}

Python example

ENTITLEMENTS = {
    "free": {"exports": False, "projects": 3},
    "team": {"exports": True, "projects": 50},
}

def check_entitlement(db, account, feature: str) -> dict:
    plan = db.current_plan(account.id)
    limit = db.override(account.id, feature)
    if limit is None:
        limit = ENTITLEMENTS[plan][feature]
    if isinstance(limit, bool):
        return {"allowed": limit}
    used = db.count_for_update(account.id, feature)
    return {"allowed": used < limit, "limit": limit, "used": used}

How to check

An API test signs in as a free account and calls every paid endpoint directly. Each one is refused. A test creates resources up to the plan limit from 10 parallel requests, and the count never passes the limit. Search the code for plan names compared outside the entitlement function. None are found.

Sources

• OWASP API5:2023 Broken Function Level Authorization

Related rules

• PRC-3 Give access from the subscription status in Pricing, plans and entitlements