Make sure things are paywalled in the blueprints

server/lib/blueprints/proxyResources.ts

@@ -47,6 +47,7 @@ import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { fireHealthCheckUnknownAlert } from "@server/lib/alerts";
 import { tierMatrix } from "../billing/tierMatrix";
 import { defaultRoleAllowedActions } from "@server/routers/role/createRole";
+import { build } from "@server/build";
 
 export type ProxyResourcesResults = {
     proxyResource: Resource;
@@ -222,17 +223,59 @@ export async function updateProxyResources(
             headers = JSON.stringify(resourceData.headers);
         }
 
+        if (["ssh", "rdp", "vnc"].includes(resourceData.mode || "")) {
+            const isLicensed = await isLicensedOrSubscribed(
+                orgId,
+                tierMatrix.advancedPublicResources
+            );
+            if (!isLicensed) {
+                throw new Error(
+                    "Your current subscription does not support browser gateway resources. Please upgrade to access this feature."
+                );
+            }
+        }
+
+        if (resourceData.policy) {
+            const isLicensed = await isLicensedOrSubscribed(
+                orgId,
+                tierMatrix.resourcePolicies
+            );
+            if (!isLicensed) {
+                throw new Error(
+                    "Your current subscription does not support shared resource policies. Please upgrade to access this feature."
+                );
+            }
+        }
+
         if (existingResource) {
             let domain;
             if (
                 ["http", "ssh", "rdp", "vnc"].includes(resourceData.mode || "")
             ) {
+                if (resourceData["full-domain"]?.startsWith("*.")) {
+                    const isLicensed = await isLicensedOrSubscribed(
+                        orgId,
+                        tierMatrix.wildcardSubdomain
+                    );
+                    if (!isLicensed) {
+                        throw new Error(
+                            "Wildcard subdomains are not supported on your current plan. Please upgrade to access this feature."
+                        );
+                    }
+                }
+
                 domain = await getDomain(
                     existingResource.resourceId,
                     resourceData["full-domain"]!,
                     orgId,
                     trx
                 );
+
+                await enforceDomainNamespacePaywall(
+                    orgId,
+                    domain.domainId,
+                    trx
+                );
             }
 
             // check if the only key in the resource is targets, if so, skip the update
@@ -906,12 +949,30 @@ export async function updateProxyResources(
             if (
                 ["http", "ssh", "rdp", "vnc"].includes(resourceData.mode || "")
             ) {
+                if (resourceData["full-domain"]?.startsWith("*.")) {
+                    const isLicensed = await isLicensedOrSubscribed(
+                        orgId,
+                        tierMatrix.wildcardSubdomain
+                    );
+                    if (!isLicensed) {
+                        throw new Error(
+                            "Wildcard subdomains are not supported on your current plan. Please upgrade to access this feature."
+                        );
+                    }
+                }
+
                 domain = await getDomain(
                     undefined,
                     resourceData["full-domain"]!,
                     orgId,
                     trx
                 );
+
+                await enforceDomainNamespacePaywall(
+                    orgId,
+                    domain.domainId,
+                    trx
+                );
             }
 
             const isLicensed = await isLicensedOrSubscribed(
@@ -1866,6 +1927,37 @@ function checkIfTargetChanged(
     return false;
 }
 
+async function enforceDomainNamespacePaywall(
+    orgId: string,
+    domainId: string,
+    trx: Transaction
+) {
+    if (build !== "saas") {
+        return;
+    }
+
+    const hasDomainNamespaceAccess = await isLicensedOrSubscribed(
+        orgId,
+        tierMatrix.domainNamespaces
+    );
+
+    if (hasDomainNamespaceAccess) {
+        return;
+    }
+
+    const [namespaceDomain] = await trx
+        .select()
+        .from(domainNamespaces)
+        .where(eq(domainNamespaces.domainId, domainId))
+        .limit(1);
+
+    if (namespaceDomain) {
+        throw new Error(
+            "Your current subscription does not support custom domain namespaces. Please upgrade to access this feature."
+        );
+    }
+}
+
 export async function getDomain(
     resourceId: number | undefined,
     fullDomain: string,