enforce membership feature access in api and surface plans in admin

apps/admin/src/app/api/hydration/route.ts

@@ -3,6 +3,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { getDatabase } from "@/lib/database";
 import { ensureUserSynced } from "@/lib/sync-user";
 import log from "@/lib/logger";
+import { getUserMembershipContext } from "@/lib/membership/access";
 
 export async function POST(req: NextRequest) {
   try {
@@ -11,6 +12,18 @@ export async function POST(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.hydrationTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Hydration tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const body = await req.json();
     const { date, entries, totalWater, waterGoal } = body;
@@ -58,6 +71,18 @@ export async function GET(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.hydrationTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Hydration tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const date = url.searchParams.get("date");
@@ -100,6 +125,18 @@ export async function DELETE(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.hydrationTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Hydration tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const id = url.searchParams.get("id");