feat(auth): include subscription tier in token and session payload

- Adds subscription tier info to access/refresh tokens.
- Stores tier details in session Redis record.
- Returns tier data in login/register response.
- Uses default tier when user has none.

app/[locale]/admin/subscriptions/page.tsx

@@ -0,0 +1,64 @@
+import type { Metadata } from "next";
+import { redirect } from "next/navigation";
+import { cookies } from "next/headers";
+import Header from "@/components/Header";
+import { getSession } from "@/lib/redis/session";
+import { getAllSubscriptionTiers } from "@/lib/prisma/queries/subscription-tiers";
+import { AdminSubscriptionDashboard } from "@/components/admin/subscription-dashboard";
+import { getUserById } from "@/lib/prisma/queries/users";
+
+export async function generateMetadata(): Promise<Metadata> {
+  return {
+    title: "Assinaturas e Permissões",
+    description:
+      "Gerencie os planos de assinatura, recursos avançados e permissões dos usuários.",
+  };
+}
+
+export default async function AdminSubscriptionsPage({
+  params,
+}: {
+  params: Promise<{ locale: string }>;
+}) {
+  const { locale } = await params;
+  const cookieStore = await cookies();
+  const sessionId = cookieStore.get("sessionId")?.value;
+
+  if (!sessionId) {
+    redirect(`/${locale}`);
+  }
+
+  const session = await getSession(sessionId);
+
+  if (!session || session.userId !== 1) {
+    redirect(`/${locale}`);
+  }
+
+  const tiers = await getAllSubscriptionTiers(true);
+  const adminUser = await getUserById(session.userId);
+
+  return (
+    <div className="min-h-screen bg-background text-foreground">
+      <Header />
+      <main className="container mx-auto px-4 py-10 space-y-8">
+        <section className="space-y-2">
+          <h1 className="text-3xl font-bold">Assinaturas & Permissões</h1>
+          <p className="text-muted-foreground">
+            Configure planos, recursos e vincule usuários às assinaturas disponíveis.
+          </p>
+          {adminUser?.subscription_tier && (
+            <p className="text-sm text-muted-foreground">
+              Seu plano atual:{" "}
+              <span className="font-semibold uppercase">
+                {adminUser.subscription_tier.name} ({adminUser.subscription_tier.slug})
+              </span>
+            </p>
+          )}
+        </section>
+
+        <AdminSubscriptionDashboard initialTiers={tiers} />
+      </main>
+    </div>
+  );
+}
+

app/api/auth/login/route.ts

@@ -18,6 +18,10 @@ import {
 } from "@/lib/prisma/queries/users";
 import { setSession } from "@/lib/redis/session";
 import { randomUUID } from "crypto";
+import {
+  getDefaultSubscriptionTier,
+  getSubscriptionTierById,
+} from "@/lib/prisma/queries/subscription-tiers";
 
 export async function POST(request: NextRequest) {
   try {
@@ -125,8 +129,20 @@ export async function POST(request: NextRequest) {
     await updateLastLogin(user.user_id);
 
     // Gerar tokens
-    const accessToken = generateAccessToken(user.user_id, user.username);
-    const refreshToken = generateRefreshToken(user.user_id, user.username);
+    const tierInfo =
+      user.subscription_tier ??
+      (user.subscription_tier_id
+        ? await getSubscriptionTierById(user.subscription_tier_id)
+        : await getDefaultSubscriptionTier());
+
+    const accessToken = generateAccessToken(user.user_id, user.username, {
+      tierSlug: tierInfo?.slug ?? undefined,
+      tierLevel: tierInfo?.level ?? undefined,
+    });
+    const refreshToken = generateRefreshToken(user.user_id, user.username, {
+      tierSlug: tierInfo?.slug ?? undefined,
+      tierLevel: tierInfo?.level ?? undefined,
+    });
 
     // Criar sessão no Redis
     const sessionId = randomUUID();
@@ -136,6 +152,10 @@ export async function POST(request: NextRequest) {
       email: user.email,
       accessToken,
       createdAt: Date.now(),
+      subscriptionTierId: tierInfo?.subscription_tier_id ?? null,
+      subscriptionTierSlug: tierInfo?.slug ?? null,
+      subscriptionTierName: tierInfo?.name ?? null,
+      subscriptionTierLevel: tierInfo?.level ?? null,
     });
 
     // Criar resposta
@@ -150,6 +170,14 @@ export async function POST(request: NextRequest) {
           lastName: user.last_name,
           accountLevel: user.account_level,
           hasDonated: user.has_donated,
+          subscriptionTier: tierInfo
+            ? {
+                id: tierInfo.subscription_tier_id,
+                name: tierInfo.name,
+                slug: tierInfo.slug,
+                level: tierInfo.level,
+              }
+            : null,
         },
         accessToken,
       },

app/api/auth/register/route.ts

@@ -23,6 +23,7 @@ import { setSession } from "@/lib/redis/session";
 import { randomUUID } from "crypto";
 import { createUser } from "@/lib/prisma/queries/users";
 import { createCharacter } from "@/lib/prisma/queries/characters";
+import { getDefaultSubscriptionTier } from "@/lib/prisma/queries/subscription-tiers";
 
 export async function POST(request: NextRequest) {
   try {
@@ -186,10 +187,19 @@ export async function POST(request: NextRequest) {
     });
 
     // Gerar tokens
-    const accessToken = generateAccessToken(newUser.userId, newUser.username);
+    const defaultTier = await getDefaultSubscriptionTier();
+
+    const accessToken = generateAccessToken(newUser.userId, newUser.username, {
+      tierSlug: defaultTier?.slug ?? undefined,
+      tierLevel: defaultTier?.level ?? undefined,
+    });
     const refreshToken = generateRefreshToken(
       newUser.userId,
-      newUser.username
+      newUser.username,
+      {
+        tierSlug: defaultTier?.slug ?? undefined,
+        tierLevel: defaultTier?.level ?? undefined,
+      }
     );
 
     // Criar sessão no Redis
@@ -200,6 +210,10 @@ export async function POST(request: NextRequest) {
       email: newUser.email,
       accessToken,
       createdAt: Date.now(),
+      subscriptionTierId: defaultTier?.subscription_tier_id ?? null,
+      subscriptionTierSlug: defaultTier?.slug ?? null,
+      subscriptionTierName: defaultTier?.name ?? null,
+      subscriptionTierLevel: defaultTier?.level ?? null,
     });
 
     // Criar resposta
@@ -210,6 +224,14 @@ export async function POST(request: NextRequest) {
           userId: newUser.userId,
           username: newUser.username,
           email: newUser.email,
+          subscriptionTier: defaultTier
+            ? {
+                id: defaultTier.subscription_tier_id,
+                name: defaultTier.name,
+                slug: defaultTier.slug,
+                level: defaultTier.level,
+              }
+            : null,
         },
         accessToken,
       },

app/api/auth/session/route.ts

@@ -1,9 +1,11 @@
 import { NextRequest, NextResponse } from "next/server";
 import { cookies } from "next/headers";
 import { secureLogger } from "@/lib/secure-logger";
-import { getSession, refreshSession, deleteSession } from "@/lib/redis/session";
+import { getSession, refreshSession, deleteSession, setSession } from "@/lib/redis/session";
 import { verifyAccessToken } from "@/lib/auth/jwt";
 import { getMainCharacter } from "@/lib/prisma/queries/characters";
+import { getUserById } from "@/lib/prisma/queries/users";
+import { getSubscriptionTierById, getDefaultSubscriptionTier } from "@/lib/prisma/queries/subscription-tiers";
 
 /**
  * GET /api/auth/session
@@ -27,7 +29,7 @@ export async function GET(request: NextRequest) {
     }
 
     // Buscar sessão no Redis
-    const session = await getSession(sessionId);
+    let session = await getSession(sessionId);
 
     if (!session) {
       // Limpar cookie se sessão não existe
@@ -63,6 +65,55 @@ export async function GET(request: NextRequest) {
       return response;
     }
 
+    let tierInfo:
+      | {
+          subscription_tier_id: number | null;
+          name: string | null;
+          slug: string | null;
+          level: number | null;
+        }
+      | null = {
+      subscription_tier_id: session.subscriptionTierId,
+      name: session.subscriptionTierName,
+      slug: session.subscriptionTierSlug,
+      level: session.subscriptionTierLevel,
+    };
+
+    if (
+      tierInfo.subscription_tier_id === undefined ||
+      tierInfo.subscription_tier_id === null ||
+      tierInfo.slug === null
+    ) {
+      const dbUser = await getUserById(session.userId);
+      const fetchedTier = dbUser?.subscription_tier
+        ? await getSubscriptionTierById(dbUser.subscription_tier.subscription_tier_id)
+        : await getDefaultSubscriptionTier();
+
+      tierInfo = fetchedTier
+        ? {
+            subscription_tier_id: fetchedTier.subscription_tier_id,
+            name: fetchedTier.name,
+            slug: fetchedTier.slug,
+            level: fetchedTier.level,
+          }
+        : {
+            subscription_tier_id: null,
+            name: null,
+            slug: null,
+            level: null,
+          };
+
+      session = {
+        ...session,
+        subscriptionTierId: tierInfo.subscription_tier_id,
+        subscriptionTierName: tierInfo.name,
+        subscriptionTierSlug: tierInfo.slug,
+        subscriptionTierLevel: tierInfo.level,
+      };
+
+      await setSession(sessionId, session);
+    }
+
     // Atualizar TTL da sessão
     await refreshSession(sessionId);
 
@@ -78,6 +129,14 @@ export async function GET(request: NextRequest) {
           username: session.username,
           email: session.email,
           characterName: mainCharacter?.character_name || null,
+          subscriptionTier: tierInfo
+            ? {
+                id: tierInfo.subscription_tier_id,
+                name: tierInfo.name,
+                slug: tierInfo.slug,
+                level: tierInfo.level,
+              }
+            : null,
         },
       },
       { status: 200 }

app/api/subscription-tiers/[id]/route.ts

@@ -0,0 +1,210 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireAdminUser } from "@/lib/auth/middleware";
+import {
+  getSubscriptionTierById,
+  updateSubscriptionTier,
+  deleteSubscriptionTier,
+  countUsersInSubscriptionTier,
+} from "@/lib/prisma/queries/subscription-tiers";
+import { updateSubscriptionTierSchema } from "@/lib/validation-schemas";
+import { secureLogger } from "@/lib/secure-logger";
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const auth = await requireAdminUser(request);
+  if (auth instanceof NextResponse) {
+    return auth;
+  }
+
+  try {
+    const { id } = await params;
+    const tierId = Number.parseInt(id, 10);
+
+    if (Number.isNaN(tierId) || tierId <= 0) {
+      return NextResponse.json(
+        { success: false, error: "ID de tier inválido" },
+        { status: 400 }
+      );
+    }
+
+    const tier = await getSubscriptionTierById(tierId, true);
+
+    if (!tier) {
+      return NextResponse.json(
+        { success: false, error: "Plano não encontrado" },
+        { status: 404 }
+      );
+    }
+
+    return NextResponse.json(
+      {
+        success: true,
+        tier,
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    secureLogger.error("❌ Erro ao consultar subscription tier", {
+      error: error instanceof Error ? error.message : "Erro desconhecido",
+    });
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: "Erro ao consultar plano de assinatura",
+      },
+      { status: 500 }
+    );
+  }
+}
+
+export async function PATCH(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const auth = await requireAdminUser(request);
+  if (auth instanceof NextResponse) {
+    return auth;
+  }
+
+  try {
+    const { id } = await params;
+    const tierId = Number.parseInt(id, 10);
+
+    if (Number.isNaN(tierId) || tierId <= 0) {
+      return NextResponse.json(
+        { success: false, error: "ID de tier inválido" },
+        { status: 400 }
+      );
+    }
+
+    const body = await request.json();
+    const parsed = updateSubscriptionTierSchema.parse(body);
+
+    const updatedTier = await updateSubscriptionTier(tierId, {
+      name: parsed.name,
+      slug: parsed.slug,
+      description: parsed.description ?? undefined,
+      level: parsed.level,
+      price_monthly: parsed.priceMonthly ?? undefined,
+      price_yearly: parsed.priceYearly ?? undefined,
+      is_active: parsed.isActive,
+      features: parsed.features?.map((feature, index) => ({
+        feature_key: feature.featureKey,
+        label: feature.label,
+        description: feature.description ?? null,
+        sort_order: feature.sortOrder ?? index,
+        _delete: feature._delete ?? false,
+      })),
+    });
+
+    return NextResponse.json(
+      {
+        success: true,
+        tier: updatedTier,
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    if (error instanceof Error && "issues" in error) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "Dados inválidos",
+          details: (error as any).issues,
+        },
+        { status: 400 }
+      );
+    }
+
+    secureLogger.error("❌ Erro ao atualizar subscription tier", {
+      error: error instanceof Error ? error.message : "Erro desconhecido",
+    });
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: "Erro ao atualizar plano de assinatura",
+      },
+      { status: 500 }
+    );
+  }
+}
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const auth = await requireAdminUser(request);
+  if (auth instanceof NextResponse) {
+    return auth;
+  }
+
+  try {
+    const { id } = await params;
+    const tierId = Number.parseInt(id, 10);
+
+    if (Number.isNaN(tierId) || tierId <= 0) {
+      return NextResponse.json(
+        { success: false, error: "ID de tier inválido" },
+        { status: 400 }
+      );
+    }
+
+    const tier = await getSubscriptionTierById(tierId, false);
+
+    if (!tier) {
+      return NextResponse.json(
+        { success: false, error: "Plano não encontrado" },
+        { status: 404 }
+      );
+    }
+
+    if (tier.slug === "free") {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "O plano padrão 'free' não pode ser removido.",
+        },
+        { status: 400 }
+      );
+    }
+
+    const userCount = await countUsersInSubscriptionTier(tierId);
+
+    if (userCount > 0) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "Plano não pode ser removido enquanto houver usuários associados.",
+          users: userCount,
+        },
+        { status: 409 }
+      );
+    }
+
+    await deleteSubscriptionTier(tierId);
+
+    return NextResponse.json(
+      {
+        success: true,
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    secureLogger.error("❌ Erro ao remover subscription tier", {
+      error: error instanceof Error ? error.message : "Erro desconhecido",
+    });
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: "Erro ao remover plano de assinatura",
+      },
+      { status: 500 }
+    );
+  }
+}
+

app/api/subscription-tiers/assign/route.ts

@@ -0,0 +1,136 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireAdminUser } from "@/lib/auth/middleware";
+import {
+  assignUserToSubscriptionTier,
+  getSubscriptionTierById,
+  getSubscriptionTierBySlug,
+  getDefaultSubscriptionTier,
+} from "@/lib/prisma/queries/subscription-tiers";
+import { assignSubscriptionTierSchema } from "@/lib/validation-schemas";
+import { secureLogger } from "@/lib/secure-logger";
+import { getUserById } from "@/lib/prisma/queries/users";
+
+export async function POST(request: NextRequest) {
+  const auth = await requireAdminUser(request);
+  if (auth instanceof NextResponse) {
+    return auth;
+  }
+
+  try {
+    const body = await request.json();
+    const parsed = assignSubscriptionTierSchema.parse(body);
+
+    const user = await getUserById(parsed.userId);
+    if (!user) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "Usuário não encontrado.",
+        },
+        { status: 404 }
+      );
+    }
+
+    let targetTierId: number | null = null;
+    let targetTier:
+      | {
+          subscription_tier_id: number;
+          name: string;
+          slug: string;
+          level: number;
+        }
+      | null = null;
+
+    if (parsed.tierId !== undefined) {
+      if (parsed.tierId === null) {
+        const defaultTier = await getDefaultSubscriptionTier();
+        if (!defaultTier) {
+          return NextResponse.json(
+            {
+              success: false,
+              error: "Plano padrão não encontrado.",
+            },
+            { status: 500 }
+          );
+        }
+        targetTier = defaultTier;
+      } else {
+        const tierById = await getSubscriptionTierById(parsed.tierId, false);
+        if (!tierById) {
+          return NextResponse.json(
+            {
+              success: false,
+              error: "Plano informado não existe.",
+            },
+            { status: 404 }
+          );
+        }
+        targetTier = tierById;
+      }
+    } else if (parsed.tierSlug) {
+      const tierBySlug = await getSubscriptionTierBySlug(parsed.tierSlug, false);
+      if (!tierBySlug) {
+        return NextResponse.json(
+          {
+            success: false,
+            error: "Plano informado não existe.",
+          },
+          { status: 404 }
+        );
+      }
+      targetTier = tierBySlug;
+    }
+
+    if (!targetTier) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "Plano de assinatura não identificado.",
+        },
+        { status: 400 }
+      );
+    }
+
+    targetTierId = targetTier.subscription_tier_id;
+
+    await assignUserToSubscriptionTier(parsed.userId, targetTierId);
+
+    return NextResponse.json(
+      {
+        success: true,
+        userId: parsed.userId,
+        tier: {
+          id: targetTier.subscription_tier_id,
+          name: targetTier.name,
+          slug: targetTier.slug,
+          level: targetTier.level,
+        },
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    if (error instanceof Error && "issues" in error) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "Dados inválidos",
+          details: (error as any).issues,
+        },
+        { status: 400 }
+      );
+    }
+
+    secureLogger.error("❌ Erro ao atribuir subscription tier", {
+      error: error instanceof Error ? error.message : "Erro desconhecido",
+    });
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: "Erro ao atribuir plano de assinatura ao usuário",
+      },
+      { status: 500 }
+    );
+  }
+}
+

app/api/subscription-tiers/route.ts

@@ -0,0 +1,102 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireAdminUser } from "@/lib/auth/middleware";
+import {
+  getAllSubscriptionTiers,
+  createSubscriptionTier,
+} from "@/lib/prisma/queries/subscription-tiers";
+import { createSubscriptionTierSchema } from "@/lib/validation-schemas";
+import { secureLogger } from "@/lib/secure-logger";
+
+export async function GET(request: NextRequest) {
+  const auth = await requireAdminUser(request);
+  if (auth instanceof NextResponse) {
+    return auth;
+  }
+
+  try {
+    const tiers = await getAllSubscriptionTiers(true);
+    return NextResponse.json(
+      {
+        success: true,
+        tiers,
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    secureLogger.error("❌ Erro ao listar subscription tiers", {
+      error: error instanceof Error ? error.message : "Erro desconhecido",
+    });
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: "Erro ao listar planos de assinatura",
+      },
+      { status: 500 }
+    );
+  }
+}
+
+export async function POST(request: NextRequest) {
+  const auth = await requireAdminUser(request);
+  if (auth instanceof NextResponse) {
+    return auth;
+  }
+
+  try {
+    const body = await request.json();
+    const parsed = createSubscriptionTierSchema.parse(body);
+
+    const tier = await createSubscriptionTier({
+      name: parsed.name,
+      slug: parsed.slug,
+      description: parsed.description ?? null,
+      level: parsed.level ?? 0,
+      price_monthly: parsed.priceMonthly ?? null,
+      price_yearly: parsed.priceYearly ?? null,
+      is_active: parsed.isActive ?? true,
+      features: parsed.features?.map((feature, index) => ({
+        feature_key: feature.featureKey,
+        label: feature.label,
+        description: feature.description ?? null,
+        sort_order: feature.sortOrder ?? index,
+      })),
+    });
+
+    return NextResponse.json(
+      {
+        success: true,
+        tier,
+      },
+      { status: 201 }
+    );
+  } catch (error) {
+    if (error instanceof NextResponse) {
+      throw error;
+    }
+
+    if (error instanceof Error && "issues" in error) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "Dados inválidos",
+          details: (error as any).issues,
+        },
+        { status: 400 }
+      );
+    }
+
+    secureLogger.error("❌ Erro ao criar subscription tier", {
+      error: error instanceof Error ? error.message : "Erro desconhecido",
+    });
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: "Erro ao criar plano de assinatura",
+      },
+      { status: 500 }
+    );
+  }
+}
+