feat(auth): include subscription tier in token and session payload

- Adds subscription tier info to access/refresh tokens.
- Stores tier details in session Redis record.
- Returns tier data in login/register response.
- Uses default tier when user has none.

app/api/subscription-tiers/assign/route.ts

@@ -0,0 +1,136 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireAdminUser } from "@/lib/auth/middleware";
+import {
+  assignUserToSubscriptionTier,
+  getSubscriptionTierById,
+  getSubscriptionTierBySlug,
+  getDefaultSubscriptionTier,
+} from "@/lib/prisma/queries/subscription-tiers";
+import { assignSubscriptionTierSchema } from "@/lib/validation-schemas";
+import { secureLogger } from "@/lib/secure-logger";
+import { getUserById } from "@/lib/prisma/queries/users";
+
+export async function POST(request: NextRequest) {
+  const auth = await requireAdminUser(request);
+  if (auth instanceof NextResponse) {
+    return auth;
+  }
+
+  try {
+    const body = await request.json();
+    const parsed = assignSubscriptionTierSchema.parse(body);
+
+    const user = await getUserById(parsed.userId);
+    if (!user) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "Usuário não encontrado.",
+        },
+        { status: 404 }
+      );
+    }
+
+    let targetTierId: number | null = null;
+    let targetTier:
+      | {
+          subscription_tier_id: number;
+          name: string;
+          slug: string;
+          level: number;
+        }
+      | null = null;
+
+    if (parsed.tierId !== undefined) {
+      if (parsed.tierId === null) {
+        const defaultTier = await getDefaultSubscriptionTier();
+        if (!defaultTier) {
+          return NextResponse.json(
+            {
+              success: false,
+              error: "Plano padrão não encontrado.",
+            },
+            { status: 500 }
+          );
+        }
+        targetTier = defaultTier;
+      } else {
+        const tierById = await getSubscriptionTierById(parsed.tierId, false);
+        if (!tierById) {
+          return NextResponse.json(
+            {
+              success: false,
+              error: "Plano informado não existe.",
+            },
+            { status: 404 }
+          );
+        }
+        targetTier = tierById;
+      }
+    } else if (parsed.tierSlug) {
+      const tierBySlug = await getSubscriptionTierBySlug(parsed.tierSlug, false);
+      if (!tierBySlug) {
+        return NextResponse.json(
+          {
+            success: false,
+            error: "Plano informado não existe.",
+          },
+          { status: 404 }
+        );
+      }
+      targetTier = tierBySlug;
+    }
+
+    if (!targetTier) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "Plano de assinatura não identificado.",
+        },
+        { status: 400 }
+      );
+    }
+
+    targetTierId = targetTier.subscription_tier_id;
+
+    await assignUserToSubscriptionTier(parsed.userId, targetTierId);
+
+    return NextResponse.json(
+      {
+        success: true,
+        userId: parsed.userId,
+        tier: {
+          id: targetTier.subscription_tier_id,
+          name: targetTier.name,
+          slug: targetTier.slug,
+          level: targetTier.level,
+        },
+      },
+      { status: 200 }
+    );
+  } catch (error) {
+    if (error instanceof Error && "issues" in error) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: "Dados inválidos",
+          details: (error as any).issues,
+        },
+        { status: 400 }
+      );
+    }
+
+    secureLogger.error("❌ Erro ao atribuir subscription tier", {
+      error: error instanceof Error ? error.message : "Erro desconhecido",
+    });
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: "Erro ao atribuir plano de assinatura ao usuário",
+      },
+      { status: 500 }
+    );
+  }
+}
+