@girardmedia/bootspring 1.2.0 → 2.0.3

package/core/entitlements.js

@@ -5,9 +5,22 @@
 
 const LOCAL_MODE = 'local';
 const SERVER_MODE = 'server';
-const PRO_TIERS = new Set(['pro', 'team', 'enterprise']);
 const policies = require('./policies');
 
+// Use tier-enforcement for tier checking (lazy-loaded to avoid circular dependency)
+let _tierEnforcement = null;
+function getTierEnforcement() {
+  if (!_tierEnforcement) {
+    _tierEnforcement = require('./tier-enforcement');
+  }
+  return _tierEnforcement;
+}
+
+// Check if tier meets pro requirement
+function isProTier(tier) {
+  return getTierEnforcement().meetsTierRequirement('pro', tier);
+}
+
 function parseBoolean(value) {
   if (typeof value === 'boolean') return value;
   if (value === null || value === undefined) return false;
@@ -53,50 +66,108 @@ function isExternalSkill(skillId) {
   return String(skillId || '').startsWith('external/');
 }
 
+function isPremiumPattern(skillTier) {
+  const tier = String(skillTier || 'free').toLowerCase();
+  return tier === 'pro' || tier === 'premium';
+}
+
 function checkSkillAccess(skillId, options = {}) {
   const context = resolveAccessContext(options);
+  const skillTier = options.skillTier;
+
+  // External skills
+  if (isExternalSkill(skillId)) {
+    const policy = policies.getPolicyProfile(context.policyProfile, options);
+    if (!policy.allowExternalSkills) {
+      return {
+        allowed: false,
+        code: 'external_policy_blocked',
+        reason: `External skills are blocked by ${policy.id} policy profile.`,
+        context
+      };
+    }
+
+    if (context.mode !== SERVER_MODE) {
+      return {
+        allowed: true,
+        code: 'external_local_mode',
+        reason: 'External skills are enabled in local mode.',
+        context
+      };
+    }
+
+    if (context.entitled || isProTier(context.tier)) {
+      return {
+        allowed: true,
+        code: 'external_entitled',
+        reason: 'External skill access granted.',
+        context
+      };
+    }
 
-  if (!isExternalSkill(skillId)) {
     return {
-      allowed: true,
-      code: 'built_in',
-      reason: 'Built-in skills are always available.',
+      allowed: false,
+      code: 'external_subscription_required',
+      reason: 'External skills require entitlement in server mode. Set BOOTSPRING_SKILLS_ENTITLED=true or use tier=pro/team/enterprise.',
       context
     };
   }
 
-  const policy = policies.getPolicyProfile(context.policyProfile, options);
-  if (!policy.allowExternalSkills) {
+  // Local mode - all patterns accessible for development
+  if (context.mode !== SERVER_MODE) {
+    if (isPremiumPattern(skillTier)) {
+      return {
+        allowed: true,
+        code: 'premium_local_mode',
+        reason: 'Premium patterns are enabled in local mode.',
+        context
+      };
+    }
     return {
-      allowed: false,
-      code: 'external_policy_blocked',
-      reason: `External skills are blocked by ${policy.id} policy profile.`,
+      allowed: true,
+      code: 'free_local_mode',
+      reason: 'Patterns are enabled in local mode.',
       context
     };
   }
 
-  if (context.mode !== SERVER_MODE) {
+  // Server mode - all patterns require authentication
+  // Check if user has any entitlement (authenticated)
+  const isAuthenticated = context.entitled || context.tier !== 'free' || isProTier(context.tier);
+
+  if (!isAuthenticated) {
+    // Unauthenticated in server mode - block all patterns
     return {
-      allowed: true,
-      code: 'external_local_mode',
-      reason: 'External skills are enabled in local mode.',
+      allowed: false,
+      code: 'authentication_required',
+      reason: 'Patterns require authentication in server mode. Sign in at bootspring.com or use BOOTSPRING_SKILLS_ENTITLED=true for development.',
       context
     };
   }
 
-  if (context.entitled || PRO_TIERS.has(context.tier)) {
+  // Authenticated - check tier for premium patterns
+  if (isPremiumPattern(skillTier)) {
+    if (isProTier(context.tier)) {
+      return {
+        allowed: true,
+        code: 'premium_entitled',
+        reason: 'Premium pattern access granted.',
+        context
+      };
+    }
     return {
-      allowed: true,
-      code: 'external_entitled',
-      reason: 'External skill access granted.',
+      allowed: false,
+      code: 'premium_subscription_required',
+      reason: 'Premium pattern requires Pro subscription. Upgrade at bootspring.com/pricing.',
       context
     };
   }
 
+  // Authenticated free tier user accessing free pattern
   return {
-    allowed: false,
-    code: 'external_subscription_required',
-    reason: 'External skills require entitlement in server mode. Set BOOTSPRING_SKILLS_ENTITLED=true or use tier=pro/team/enterprise.',
+    allowed: true,
+    code: 'free_entitled',
+    reason: 'Free tier pattern access granted.',
     context
   };
 }
@@ -157,7 +228,7 @@ function checkWorkflowAccess(workflow, options = {}) {
     };
   }
 
-  if (context.entitled || PRO_TIERS.has(context.tier)) {
+  if (context.entitled || isProTier(context.tier)) {
     return {
       allowed: true,
       code: 'workflow_entitled',