Session 9: api-football + FootApi + Tank01 adapters, grace period middleware, cookie consent, /pricing page, OOM fix documented (1240 tests)

src/routes/alerts.js

@@ -1,12 +1,13 @@
 const express = require('express');
 const { requireAuth } = require('../middleware/auth');
+const { checkGracePeriod } = require('../middleware/gracePeriod');
 const { getAlertsForUser, markAlertRead } = require('../services/alertService');
 
 const router = express.Router();
 
 const PAID_TIERS = new Set(['analyst', 'desk']);
 
-router.get('/', requireAuth, async (req, res) => {
+router.get('/', requireAuth, checkGracePeriod, async (req, res) => {
   if (!PAID_TIERS.has(req.user.tier)) {
     return res.status(403).json({ error: 'Alerts are available on Analyst and Desk tiers' });
   }
@@ -20,7 +21,7 @@ router.get('/', requireAuth, async (req, res) => {
   }
 });
 
-router.patch('/:id/read', requireAuth, async (req, res) => {
+router.patch('/:id/read', requireAuth, checkGracePeriod, async (req, res) => {
   if (!PAID_TIERS.has(req.user.tier)) {
     return res.status(403).json({ error: 'Alerts are available on Analyst and Desk tiers' });
   }

src/routes/props.js

@@ -1,11 +1,12 @@
 const express = require('express');
 const { requireAuth } = require('../middleware/auth');
+const { checkGracePeriod } = require('../middleware/gracePeriod');
 const { getSupabaseServiceClient } = require('../utils/supabase');
 
 const router = express.Router();
 
 // GET /joint-history — joint outcome history and phi coefficient
-router.get('/joint-history', requireAuth, async (req, res) => {
+router.get('/joint-history', requireAuth, checkGracePeriod, async (req, res) => {
   const { player_a, stat_a, player_b, stat_b } = req.query;
 
   // Block free tier

src/routes/scan.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const { requireAuth } = require('../middleware/auth');
+const { checkGracePeriod } = require('../middleware/gracePeriod');
 const { scanLimit } = require('../middleware/scanLimit');
 const { scanParlay } = require('../services/parlayScanService');
 
@@ -38,7 +39,12 @@ function validateLegs(legs) {
   return null;
 }
 
-router.post('/parlay', requireAuth, scanLimit(), async (req, res) => {
+// requireAuth → checkGracePeriod → scanLimit ordering matters:
+// requireAuth populates req.user; checkGracePeriod may downgrade
+// req.user.tier; scanLimit reads tier off req.user to pick the
+// per-tier quota. If grace check ran AFTER scanLimit, a just-
+// expired Desk user would get unlimited quota for one final scan.
+router.post('/parlay', requireAuth, checkGracePeriod, scanLimit(), async (req, res) => {
   const { legs } = req.body;
 
   const validationError = validateLegs(legs);