[Backend] Feature Restriction & Access Control Based on Subscription Plan

[rdodiya]

📌 Description

Currently, subscription plans are being introduced in RestroHub. Along with subscription CRUD APIs, we also need a centralized system to dynamically restrict feature access based on the restaurant’s active subscription plan.

This issue focuses specifically on implementing feature-level restriction and validation logic.

---

🎯 Objective

Create a reusable subscription validation system that controls feature access dynamically across backend APIs and services.

---

---

🛠️ Scope of Work

Backend

• Create centralized subscription validation module/service

• Validate restaurant subscription before feature execution

• Add reusable feature access methods like:

  • canUseWhatsApp()

  • canUseAiTranslation()

  • canAddBranch()

  • canUseCustomDomain()

• Add branch limit validation logic

• Handle custom plan configurations dynamically

---

Middleware / Interceptor

Implement reusable request validation:

• Spring Interceptor / Filter / Aspect

• Restrict API access based on subscription

• Return proper error response if feature is blocked

Example:

{
  "message": "Your current subscription does not support this feature",
  "feature": "WHATSAPP_NOTIFICATION"
}

---

🧩 Suggested Components

Services

• SubscriptionValidationService

• FeatureAccessService

Entities

• SubscriptionPlan

• RestaurantSubscription

• FeatureConfig (optional)

Enum Suggestions

• SubscriptionType

• FeatureType

---

🔗 Areas Where Restriction Will Be Applied

• WhatsApp Notification APIs

• AI Translation APIs

• Website Template APIs

• Branch Creation APIs

• Custom Domain APIs

• Future premium features

---

🎯 Expected Outcome

• Centralized feature restriction system

• Dynamic validation based on restaurant subscription

• Reusable and scalable architecture

• Easy integration for future premium features

---

🚀 Tech Stack

• Spring Boot

• JPA/Hibernate

• REST APIs

• Spring Interceptor / AOP (optional)

---

📦 Deliverables

• Feature validation service

• API restriction mechanism

• Branch limit validation

• Proper exception handling

• Reusable architecture for future modules

• PR targeting gssoc_develop

Happy Contributing 🚀

[Slakshminarayana2006]

Hey @rdodiya I hope you're doing well!
I came across issue #129 – [Backend] Feature Restriction & Access Control Based on Subscription Plan and I'm genuinely excited about this one. I would love to be assigned to this issue and contribute meaningfully to the project. Let me explain why I believe I'm a great fit:
My Relevant Experience:
I have hands-on experience building backend systems that involve subscription-based access control. I've worked with role-based and plan-based permission systems where specific features are gated behind subscription tiers (e.g., Free, Basic, Pro, Enterprise). I understand how to structure middleware and guard layers that intercept requests and validate whether the authenticated user's current subscription plan grants them access to the requested resource.
My Approach to This Issue:
I will start by thoroughly reading the existing codebase to understand the current authentication flow and how subscription plans are currently stored and referenced.
I will design a clean SubscriptionGuard / PlanMiddleware that checks the user's active plan before allowing access to restricted routes or features.
I'll ensure the solution is scalable — meaning adding new features to a plan in the future should require minimal changes (ideally just config-level updates, not code rewrites).
I'll handle edge cases such as expired subscriptions, downgraded plans, and users with no active plan — returning clear and meaningful HTTP responses (e.g., 403 Forbidden with a descriptive message like "Your current plan does not support this feature").
I'll write clean, well-documented code with comments explaining the logic, so future contributors can easily understand and extend it.
I'll make sure to not break any existing functionality and will test all related endpoints thoroughly before submitting the PR.
Why This Matters:
Subscription-based access control is one of the most critical backend features for any SaaS or platform product. Done right, it protects business logic, prevents unauthorized access, and creates a smooth user experience when users hit a plan limit — encouraging upgrades rather than frustration.
I'm also a participant in GirlScript SoC '26 and I'm actively looking for challenging, high-impact issues to contribute to. This issue perfectly aligns with my skill set and my goal of making meaningful contributions.
I'm available to discuss the implementation approach with you or any maintainer before starting, if that would help. I'll also ensure the PR is submitted with proper documentation and test cases.
Please consider assigning this issue to me — I promise to deliver quality work within a reasonable timeline!
Thank you so much for your time!

[anshika1179]

/assign gssoc

[aryanchoudharyyyy]

Hi @rdodiya,

I would like to work on this issue.
I’m planning to implement a centralized subscription validation and feature restriction system using Spring AOP for scalable and reusable access control.

Planned work includes:

• SubscriptionValidationService
• Feature-based access checks
• Branch limit validation
• Custom annotation + AOP restriction layer
• Proper exception handling
• Scalable architecture for future premium features

Please assign this issue to me under GSSOC'26.

Thank you 🚀

[amritbej]

Hello @rdodiya ,

I would like to work on this issue. I can implement a centralized subscription validation and feature access control system to dynamically restrict backend functionality based on the restaurant’s active subscription plan.

My approach will include:

• Creating reusable services such as "SubscriptionValidationService" and "FeatureAccessService"
• Implementing feature-level validation methods ("canUseWhatsApp", "canAddBranch", etc.)
• Adding branch limit validation and dynamic custom plan handling
• Building reusable middleware/interceptor-based API restriction logic

.

Please assign this issue to me. Thank you!