Add team capabilities to service-utils

Author: jnsdls

.changeset/loose-comics-serve.md

@@ -0,0 +1,5 @@
+---
+"@thirdweb-dev/service-utils": patch
+---
+
+add team capabilities

packages/service-utils/src/core/api.ts

@@ -43,6 +43,41 @@ export type ApiResponse = {
   };
 };
 
+// needs to be kept in sync with the capabilities from the backend
+type TeamCapabilities = {
+  rpc: {
+    enabled: boolean;
+    rateLimit: number;
+  };
+  insight: {
+    enabled: boolean;
+    rateLimit: number;
+  };
+  storage: {
+    enabled: boolean;
+    download: {
+      rateLimit: number;
+    };
+    upload: {
+      rateLimit: number;
+    };
+  };
+  nebula: {
+    enabled: boolean;
+    rateLimit: number;
+  };
+  bundler: {
+    enabled: true;
+    mainnetEnabled: boolean;
+    rateLimit: number;
+  };
+  embeddedWallets: {
+    enabled: boolean;
+    customAuth: boolean;
+    customBranding: boolean;
+  };
+};
+
 export type TeamResponse = {
   id: string;
   name: string;
@@ -68,6 +103,7 @@ export type TeamResponse = {
   canCreatePublicChains: boolean | null;
   enabledScopes: ServiceName[];
   isOnboarded: boolean;
+  capabilities: TeamCapabilities;
 };
 
 export type ProjectSecretKey = {

packages/service-utils/src/core/authorize/index.ts

@@ -1,6 +1,7 @@
 import {
   type CoreServiceConfig,
   type TeamAndProjectResponse,
+  type TeamResponse,
   fetchTeamAndProject,
 } from "../api.js";
 import { authorizeClient } from "./client.js";
@@ -129,6 +130,21 @@ export async function authorize(
       errorCode: "INVALID_KEY",
     };
   }
+  // check if the service is maybe disabled for the team (usually due to a billing issue / exceeding the free plan limit)
+  if (
+    !isServiceEnabledForTeam(
+      serviceConfig.serviceScope,
+      teamAndProjectResponse.team.capabilities,
+    )
+  ) {
+    return {
+      authorized: false,
+      status: 403,
+      errorMessage:
+        "You currently do not have access to this service. Please check if your subscription includes this service and is active.",
+      errorCode: "SERVICE_TEMPOARILY_DISABLED",
+    };
+  }
   // now we can validate the key itself
   const clientAuth = authorizeClient(authData, teamAndProjectResponse);
 
@@ -161,3 +177,26 @@ export async function authorize(
     authMethod: clientAuth.authMethod,
   };
 }
+
+function isServiceEnabledForTeam(
+  scope: CoreServiceConfig["serviceScope"],
+  teamCapabilities: TeamResponse["capabilities"],
+): boolean {
+  switch (scope) {
+    case "rpc":
+      return teamCapabilities.rpc.enabled;
+    case "bundler":
+      return teamCapabilities.bundler.enabled;
+    case "storage":
+      return teamCapabilities.storage.enabled;
+    case "insight":
+      return teamCapabilities.insight.enabled;
+    case "nebula":
+      return teamCapabilities.nebula.enabled;
+    case "embeddedWallets":
+      return teamCapabilities.embeddedWallets.enabled;
+    default:
+      // always return true for any legacy / un-named services
+      return true;
+  }
+}

packages/service-utils/src/mocks.ts

@@ -59,6 +59,39 @@ export const validTeamResponse: TeamResponse = {
   canCreatePublicChains: false,
   enabledScopes: ["storage", "rpc", "bundler"],
   isOnboarded: true,
+  capabilities: {
+    rpc: {
+      enabled: true,
+      rateLimit: 1000,
+    },
+    insight: {
+      enabled: true,
+      rateLimit: 1000,
+    },
+    storage: {
+      enabled: true,
+      download: {
+        rateLimit: 1000,
+      },
+      upload: {
+        rateLimit: 1000,
+      },
+    },
+    nebula: {
+      enabled: true,
+      rateLimit: 1000,
+    },
+    bundler: {
+      enabled: true,
+      mainnetEnabled: true,
+      rateLimit: 1000,
+    },
+    embeddedWallets: {
+      enabled: true,
+      customAuth: true,
+      customBranding: true,
+    },
+  },
 };
 
 export const validTeamAndProjectResponse: TeamAndProjectResponse = {