feat: auth foundation, similar tools, costs, redundancy, anonymous voting

artifacts/api-server/src/index.ts

@@ -55,6 +55,7 @@ async function seedAdminUser(): Promise<void> {
       username: adminUsername,
       passwordHash,
       role: "admin",
+      tier: "enterprise",
     });
     logger.info({ username: adminUsername }, "Admin user created");
   } catch (err) {
@@ -62,9 +63,79 @@ async function seedAdminUser(): Promise<void> {
   }
 }
 
+async function ensureToolRelationsTable(): Promise<void> {
+  try {
+    const exists = await db.execute(
+      sql`SELECT EXISTS (SELECT FROM information_schema.tables WHERE table_name = 'tool_relations')`,
+    );
+    const rows = exists.rows as [{ exists: boolean }];
+    if (rows[0]?.exists) return;
+
+    await db.execute(
+      sql`CREATE TABLE "tool_relations" ("id" serial NOT NULL, "tool_id" integer NOT NULL REFERENCES "tools"("id") ON DELETE CASCADE, "related_tool_id" integer NOT NULL REFERENCES "tools"("id") ON DELETE CASCADE, "relation_type" text NOT NULL DEFAULT 'similar', "notes" text, "created_by" integer REFERENCES "users"("id"), "created_at" timestamp with time zone NOT NULL DEFAULT NOW())`,
+    );
+    await db.execute(sql`ALTER TABLE "tool_relations" ADD PRIMARY KEY ("id")`);
+    logger.info("tool_relations table created");
+  } catch (err) {
+    logger.error({ err }, "Failed to ensure tool_relations table");
+  }
+}
+
+async function ensureToolCostsTable(): Promise<void> {
+  try {
+    const exists = await db.execute(
+      sql`SELECT EXISTS (SELECT FROM information_schema.tables WHERE table_name = 'tool_costs')`,
+    );
+    const rows = exists.rows as [{ exists: boolean }];
+    if (rows[0]?.exists) return;
+
+    await db.execute(
+      sql`CREATE TABLE "tool_costs" ("id" serial NOT NULL, "tool_id" integer NOT NULL REFERENCES "tools"("id") ON DELETE CASCADE, "license_type" text NOT NULL DEFAULT 'free', "cost" numeric(10,2), "currency" text DEFAULT 'EUR', "renewal_date" timestamp with time zone, "notes" text, "created_by" integer REFERENCES "users"("id"), "created_at" timestamp with time zone NOT NULL DEFAULT NOW())`,
+    );
+    await db.execute(sql`ALTER TABLE "tool_costs" ADD PRIMARY KEY ("id")`);
+    logger.info("tool_costs table created");
+  } catch (err) {
+    logger.error({ err }, "Failed to ensure tool_costs table");
+  }
+}
+
+async function ensureVoterTokenColumn(): Promise<void> {
+  try {
+    const exists = await db.execute(
+      sql`SELECT EXISTS (SELECT FROM information_schema.columns WHERE table_name = 'ratings' AND column_name = 'voter_token')`,
+    );
+    const rows = exists.rows as [{ exists: boolean }];
+    if (rows[0]?.exists) return;
+
+    await db.execute(sql`ALTER TABLE "ratings" ADD COLUMN "voter_token" text`);
+    logger.info("voter_token column added to ratings");
+  } catch (err) {
+    logger.error({ err }, "Failed to add voter_token column");
+  }
+}
+
+async function ensureAdminTier(): Promise<void> {
+  try {
+    const result = await db
+      .update(usersTable)
+      .set({ tier: "enterprise" })
+      .where(sql`role = 'admin' AND (tier IS NULL OR tier = 'free')`)
+      .returning({ id: usersTable.id, username: usersTable.username });
+    if (result.length > 0) {
+      logger.info({ count: result.length }, "Admin users upgraded to enterprise tier");
+    }
+  } catch (err) {
+    logger.error({ err }, "Failed to upgrade admin tier");
+  }
+}
+
 async function start(): Promise<void> {
   await ensureSessionsTable();
+  await ensureToolRelationsTable();
+  await ensureToolCostsTable();
+  await ensureVoterTokenColumn();
   await seedAdminUser();
+  await ensureAdminTier();
 
   app.listen(port, (err) => {
     if (err) {

artifacts/api-server/src/middleware/feature.ts

@@ -0,0 +1,26 @@
+import { type Request, type Response, type NextFunction } from "express";
+
+const TIER_FEATURES: Record<string, string[]> = {
+  free: ["browse", "rate", "search"],
+  premium: ["browse", "rate", "search", "similar-tools", "costs", "redundancy", "analytics-advanced"],
+  enterprise: ["browse", "rate", "search", "similar-tools", "costs", "redundancy", "analytics-advanced", "sso", "audit-export", "api-access"],
+};
+
+export function hasFeature(tier: string | undefined, feature: string): boolean {
+  const features = TIER_FEATURES[tier ?? "free"] ?? TIER_FEATURES.free;
+  return features.includes(feature);
+}
+
+export function requireFeature(feature: string) {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    if (!req.session.user) {
+      res.status(401).json({ error: "Authentication required" });
+      return;
+    }
+    if (!hasFeature(req.session.user.tier, feature)) {
+      res.status(403).json({ error: `Feature "${feature}" requires a higher tier` });
+      return;
+    }
+    next();
+  };
+}

artifacts/api-server/src/routes/admin.ts

@@ -0,0 +1,62 @@
+import { Router, type IRouter } from "express";
+import { sql } from "drizzle-orm";
+import { db, toolsTable, ratingsTable } from "@workspace/db";
+import { requireAuth } from "../middleware/auth";
+
+const router: IRouter = Router();
+
+router.get("/admin/redundancy", requireAuth, async (_req, res): Promise<void> => {
+  const tools = await db.select().from(toolsTable).orderBy(toolsTable.category, toolsTable.name);
+
+  const allRatings = await db
+    .select({ toolId: ratingsTable.toolId, usefulness: ratingsTable.usefulness, usability: ratingsTable.usability })
+    .from(ratingsTable);
+
+  const ratingsByTool = new Map<number, { usefulness: number; usability: number }[]>();
+  for (const r of allRatings) {
+    const arr = ratingsByTool.get(r.toolId) ?? [];
+    arr.push({ usefulness: r.usefulness, usability: r.usability });
+    ratingsByTool.set(r.toolId, arr);
+  }
+
+  function buildStats(t: typeof toolsTable.$inferSelect) {
+    const ratings = ratingsByTool.get(t.id) ?? [];
+    const count = ratings.length;
+    const avgU = count > 0 ? ratings.reduce((s, r) => s + r.usefulness, 0) / count : null;
+    const avgUs = count > 0 ? ratings.reduce((s, r) => s + r.usability, 0) / count : null;
+    return {
+      id: t.id, name: t.name, category: t.category, features: t.features ?? [], tags: t.tags ?? [],
+      ratingCount: count,
+      avgUsefulness: avgU, avgUsability: avgUs,
+      avgCombined: avgU != null && avgUs != null ? (avgU + avgUs) / 2 : null,
+    };
+  }
+
+  const grouped: Record<string, any[]> = {};
+  for (const t of tools) {
+    const g = grouped[t.category] ?? [];
+    g.push(buildStats(t));
+    grouped[t.category] = g;
+  }
+
+  const result = Object.entries(grouped).map(([category, items]) => {
+    const pairs: { a: any; b: any; overlap: number; scoreDiff: number }[] = [];
+    for (let i = 0; i < items.length; i++) {
+      for (let j = i + 1; j < items.length; j++) {
+        const aFeat = new Set(items[i].features);
+        const bFeat = new Set(items[j].features);
+        const shared = [...aFeat].filter((f) => bFeat.has(f)).length;
+        const total = new Set([...aFeat, ...bFeat]).size;
+        const overlap = total > 0 ? Math.round((shared / total) * 100) : 0;
+        const scoreDiff = (items[j].avgCombined ?? 0) - (items[i].avgCombined ?? 0);
+        pairs.push({ a: items[i], b: items[j], overlap, scoreDiff });
+      }
+    }
+    pairs.sort((a, b) => b.overlap - a.overlap || Math.abs(b.scoreDiff) - Math.abs(a.scoreDiff));
+    return { category, tools: items, pairs: pairs.slice(0, 5) };
+  });
+
+  res.json(result);
+});
+
+export default router;

artifacts/api-server/src/routes/auth.ts

@@ -52,6 +52,46 @@ async function getClient(): Promise<Client | null> {
   }
 }
 
+async function upsertUserFromOidc(userinfo: Record<string, unknown>): Promise<{ id: number; tier: string; role: string }> {
+  const sub = String(userinfo.sub ?? "");
+  if (!sub) throw new Error("Missing sub claim");
+
+  const email = typeof userinfo.email === "string" ? userinfo.email : undefined;
+  const preferredUsername = typeof userinfo.preferred_username === "string" ? userinfo.preferred_username : undefined;
+  const name = typeof userinfo.name === "string" ? userinfo.name : preferredUsername;
+  const username = preferredUsername ?? email ?? `oidc-${sub.slice(0, 8)}`;
+
+  const [existing] = await db
+    .select({ id: usersTable.id, tier: usersTable.tier, role: usersTable.role })
+    .from(usersTable)
+    .where(eq(usersTable.authProviderId, sub))
+    .limit(1);
+
+  if (existing) {
+    await db
+      .update(usersTable)
+      .set({ email, displayName: name })
+      .where(eq(usersTable.id, existing.id));
+    return existing;
+  }
+
+  const [created] = await db
+    .insert(usersTable)
+    .values({
+      username,
+      email,
+      displayName: name,
+      role: "user",
+      tier: "free",
+      authProvider: "oidc",
+      authProviderId: sub,
+    })
+    .returning({ id: usersTable.id, tier: usersTable.tier, role: usersTable.role });
+
+  logger.info({ username, sub }, "OIDC user created");
+  return created;
+}
+
 router.get("/auth/mode", (_req, res): void => {
   res.json({ mode: isOidcConfigured() ? "oidc" : "local" });
 });
@@ -74,7 +114,7 @@ router.post("/auth/login", async (req, res): Promise<void> => {
     .where(eq(usersTable.username, String(username)))
     .limit(1);
 
-  if (!user) {
+  if (!user || !user.passwordHash) {
     res.status(401).json({ error: "Invalid username or password" });
     return;
   }
@@ -91,6 +131,7 @@ router.post("/auth/login", async (req, res): Promise<void> => {
     preferred_username: user.username,
     email: user.email ?? undefined,
     role: (user.role as "admin" | "user") ?? "user",
+    tier: (user.tier as "free" | "premium" | "enterprise") ?? "free",
     isLocal: true,
   };
 
@@ -100,6 +141,7 @@ router.post("/auth/login", async (req, res): Promise<void> => {
     name: user.username,
     preferredUsername: user.username,
     role: user.role,
+    tier: user.tier,
     isLocal: true,
   });
 });
@@ -152,13 +194,15 @@ router.get("/auth/callback", async (req, res): Promise<void> => {
     });
 
     const userinfo = await client.userinfo(tokenSet.access_token!);
+    const dbUser = await upsertUserFromOidc(userinfo);
 
     req.session.user = {
-      sub: userinfo.sub,
+      sub: dbUser.id.toString(),
       email: typeof userinfo.email === "string" ? userinfo.email : undefined,
       name: typeof userinfo.name === "string" ? userinfo.name : undefined,
       preferred_username: typeof userinfo.preferred_username === "string" ? userinfo.preferred_username : undefined,
-      role: "user",
+      role: (dbUser.role as "admin" | "user") ?? "user",
+      tier: (dbUser.tier as "free" | "premium" | "enterprise") ?? "free",
       isLocal: false,
     };
     delete req.session.codeVerifier;
@@ -198,6 +242,7 @@ router.get("/auth/me", async (req, res): Promise<void> => {
     name: u.name ?? null,
     preferredUsername: u.preferred_username ?? null,
     role: u.role ?? "user",
+    tier: u.tier ?? "free",
     isLocal: u.isLocal ?? false,
   });
 });

artifacts/api-server/src/routes/costs.ts

@@ -0,0 +1,81 @@
+import { Router, type IRouter } from "express";
+import { eq, and } from "drizzle-orm";
+import { db, toolsTable, toolCostsTable } from "@workspace/db";
+import { requireAuth } from "../middleware/auth";
+import { requireFeature } from "../middleware/feature";
+import { writeAuditLog } from "../lib/audit";
+
+const router: IRouter = Router();
+
+router.get("/tools/:id/costs", async (req, res): Promise<void> => {
+  const toolId = Number(req.params.id);
+  if (isNaN(toolId)) { res.status(400).json({ error: "Invalid id" }); return; }
+
+  const [tool] = await db.select().from(toolsTable).where(eq(toolsTable.id, toolId));
+  if (!tool) { res.status(404).json({ error: "Tool not found" }); return; }
+
+  const costs = await db
+    .select()
+    .from(toolCostsTable)
+    .where(eq(toolCostsTable.toolId, toolId))
+    .orderBy(toolCostsTable.createdAt);
+
+  res.json(costs);
+});
+
+router.post("/tools/:id/costs", requireAuth, requireFeature("costs"), async (req, res): Promise<void> => {
+  const toolId = Number(req.params.id);
+  if (isNaN(toolId)) { res.status(400).json({ error: "Invalid id" }); return; }
+
+  const [tool] = await db.select().from(toolsTable).where(eq(toolsTable.id, toolId));
+  if (!tool) { res.status(404).json({ error: "Tool not found" }); return; }
+
+  const { licenseType, cost, currency, renewalDate, notes } = req.body;
+
+  const [entry] = await db.insert(toolCostsTable).values({
+    toolId,
+    licenseType: licenseType ?? "free",
+    cost: cost ?? null,
+    currency: currency ?? "EUR",
+    renewalDate: renewalDate ? new Date(renewalDate) : null,
+    notes: notes ?? null,
+    createdBy: Number(req.session.user!.sub),
+  }).returning();
+
+  await writeAuditLog(req, "tool_cost", entry.id, "create", { toolId, licenseType, cost });
+  res.status(201).json(entry);
+});
+
+router.patch("/costs/:id", requireAuth, async (req, res): Promise<void> => {
+  const id = Number(req.params.id);
+  if (isNaN(id)) { res.status(400).json({ error: "Invalid id" }); return; }
+
+  const [existing] = await db.select().from(toolCostsTable).where(eq(toolCostsTable.id, id));
+  if (!existing) { res.status(404).json({ error: "Cost entry not found" }); return; }
+
+  const { licenseType, cost, currency, renewalDate, notes } = req.body;
+  const updateData: Record<string, unknown> = {};
+  if (licenseType !== undefined) updateData.licenseType = licenseType;
+  if (cost !== undefined) updateData.cost = cost;
+  if (currency !== undefined) updateData.currency = currency;
+  if (renewalDate !== undefined) updateData.renewalDate = renewalDate ? new Date(renewalDate) : null;
+  if (notes !== undefined) updateData.notes = notes;
+
+  const [updated] = await db.update(toolCostsTable).set(updateData).where(eq(toolCostsTable.id, id)).returning();
+  await writeAuditLog(req, "tool_cost", id, "update", { toolId: existing.toolId, ...updateData });
+  res.json(updated);
+});
+
+router.delete("/costs/:id", requireAuth, async (req, res): Promise<void> => {
+  const id = Number(req.params.id);
+  if (isNaN(id)) { res.status(400).json({ error: "Invalid id" }); return; }
+
+  const [existing] = await db.select().from(toolCostsTable).where(eq(toolCostsTable.id, id));
+  if (!existing) { res.status(404).json({ error: "Cost entry not found" }); return; }
+
+  await writeAuditLog(req, "tool_cost", id, "delete", { toolId: existing.toolId });
+  await db.delete(toolCostsTable).where(eq(toolCostsTable.id, id));
+  res.sendStatus(204);
+});
+
+export default router;

artifacts/api-server/src/routes/index.ts

@@ -6,6 +6,8 @@ import analyticsRouter from "./analytics";
 import authRouter from "./auth";
 import usersRouter from "./users";
 import auditRouter from "./audit";
+import costsRouter from "./costs";
+import adminRouter from "./admin";
 
 const router: IRouter = Router();
 
@@ -13,6 +15,8 @@ router.use(authRouter);
 router.use(healthRouter);
 router.use(toolsRouter);
 router.use(ratingsRouter);
+router.use(costsRouter);
+router.use(adminRouter);
 router.use(analyticsRouter);
 router.use(usersRouter);
 router.use(auditRouter);

artifacts/api-server/src/routes/ratings.ts

@@ -1,5 +1,5 @@
 import { Router, type IRouter } from "express";
-import { eq } from "drizzle-orm";
+import { eq, and } from "drizzle-orm";
 import { db, toolsTable, ratingsTable } from "@workspace/db";
 import {
   ListToolRatingsParams,
@@ -7,9 +7,16 @@ import {
   CreateRatingBody,
 } from "@workspace/api-zod";
 import { requireAuth } from "../middleware/auth";
+import crypto from "crypto";
 
 const router: IRouter = Router();
 
+const VOTER_SECRET = process.env.VOTER_SECRET || "dev-voter-secret-change-in-production";
+
+function computeVoterToken(userId: string): string {
+  return crypto.createHmac("sha256", VOTER_SECRET).update(userId).digest("hex");
+}
+
 router.get("/tools/:id/ratings", async (req, res): Promise<void> => {
   const params = ListToolRatingsParams.safeParse(req.params);
   if (!params.success) {
@@ -51,12 +58,26 @@ router.post("/tools/:id/ratings", requireAuth, async (req, res): Promise<void> =
     return;
   }
 
+  const token = computeVoterToken(req.session.user!.sub);
+
+  const [existing] = await db
+    .select()
+    .from(ratingsTable)
+    .where(and(eq(ratingsTable.toolId, params.data.id), eq(ratingsTable.voterToken, token)))
+    .limit(1);
+
+  if (existing) {
+    res.status(409).json({ error: "You have already reviewed this tool." });
+    return;
+  }
+
   const [rating] = await db.insert(ratingsTable).values({
     toolId: params.data.id,
     usefulness: parsed.data.usefulness,
     usability: parsed.data.usability,
     comment: parsed.data.comment ?? null,
     reviewerName: parsed.data.reviewerName ?? null,
+    voterToken: token,
   }).returning();
 
   res.status(201).json(rating);

artifacts/api-server/src/routes/tools.ts

@@ -1,6 +1,6 @@
 import { Router, type IRouter } from "express";
-import { eq, ilike, desc, sql } from "drizzle-orm";
-import { db, toolsTable, ratingsTable } from "@workspace/db";
+import { eq, ilike, desc, sql, and, not } from "drizzle-orm";
+import { db, toolsTable, ratingsTable, toolRelationsTable } from "@workspace/db";
 import {
   ListToolsQueryParams,
   CreateToolBody,
@@ -10,6 +10,7 @@ import {
   DeleteToolParams,
 } from "@workspace/api-zod";
 import { requireAuth } from "../middleware/auth";
+import { requireFeature } from "../middleware/feature";
 import { writeAuditLog } from "../lib/audit";
 
 const router: IRouter = Router();
@@ -242,4 +243,122 @@ router.get("/features/all", async (_req, res): Promise<void> => {
   res.json([...featureSet].sort());
 });
 
+// ── Similar Tools ──────────────────────────────────────────
+
+function computeSimilarityScore(
+  a: typeof toolsTable.$inferSelect,
+  b: typeof toolsTable.$inferSelect,
+): number {
+  let score = 0;
+  if (a.category === b.category) score += 10;
+  const sharedTags = (a.tags ?? []).filter((t) => (b.tags ?? []).includes(t)).length;
+  score += sharedTags * 3;
+  const sharedFeatures = (a.features ?? []).filter((f) => (b.features ?? []).includes(f)).length;
+  score += sharedFeatures * 2;
+  return score;
+}
+
+router.get("/tools/:id/similar", async (req, res): Promise<void> => {
+  const { id } = req.params;
+  const toolId = Number(id);
+  if (isNaN(toolId)) { res.status(400).json({ error: "Invalid id" }); return; }
+
+  const [tool] = await db.select().from(toolsTable).where(eq(toolsTable.id, toolId));
+  if (!tool) { res.status(404).json({ error: "Tool not found" }); return; }
+
+  const allOthers = await db
+    .select()
+    .from(toolsTable)
+    .where(not(eq(toolsTable.id, toolId)));
+
+  const manualRelations = await db
+    .select({
+      id: toolRelationsTable.id,
+      relatedToolId: toolRelationsTable.relatedToolId,
+      relationType: toolRelationsTable.relationType,
+      notes: toolRelationsTable.notes,
+    })
+    .from(toolRelationsTable)
+    .where(eq(toolRelationsTable.toolId, toolId));
+
+  const manualIds = new Set(manualRelations.map((r) => r.relatedToolId));
+
+  const autoSimilar = allOthers
+    .filter((t) => !manualIds.has(t.id))
+    .map((t) => ({ tool: t, score: computeSimilarityScore(tool, t), source: "auto" as const }))
+    .filter((t) => t.score > 0)
+    .sort((a, b) => b.score - a.score)
+    .slice(0, 5);
+
+  const manualTools = allOthers.filter((t) => manualIds.has(t.id));
+
+  const allRatings = await db
+    .select({ toolId: ratingsTable.toolId, usefulness: ratingsTable.usefulness, usability: ratingsTable.usability })
+    .from(ratingsTable)
+    .where(sql`${ratingsTable.toolId} = ANY(${sql`ARRAY[${sql.join([...manualIds, ...autoSimilar.map((a) => a.tool.id)].map((id) => sql`${id}`), sql`, `)}]::int[]`})`);
+
+  const ratingsByTool = new Map<number, { usefulness: number; usability: number }[]>();
+  for (const r of allRatings) {
+    const arr = ratingsByTool.get(r.toolId) ?? [];
+    arr.push({ usefulness: r.usefulness, usability: r.usability });
+    ratingsByTool.set(r.toolId, arr);
+  }
+
+  function buildStats(t: typeof toolsTable.$inferSelect) {
+    const ratings = ratingsByTool.get(t.id) ?? [];
+    const count = ratings.length;
+    const avgU = count > 0 ? ratings.reduce((s, r) => s + r.usefulness, 0) / count : null;
+    const avgUs = count > 0 ? ratings.reduce((s, r) => s + r.usability, 0) / count : null;
+    return { ...t, ratingCount: count, avgUsefulness: avgU, avgUsability: avgUs, avgCombined: avgU != null && avgUs != null ? (avgU + avgUs) / 2 : null };
+  }
+
+  const manual = manualRelations.map((r) => {
+    const t = manualTools.find((mt) => mt.id === r.relatedToolId);
+    return t ? { ...buildStats(t), relationId: r.id, relationType: r.relationType, notes: r.notes, source: "manual" as const } : null;
+  }).filter(Boolean);
+
+  const auto = autoSimilar.map((a) => ({ ...buildStats(a.tool), score: a.score, source: a.source }));
+
+  res.json({ manual, auto });
+});
+
+router.post("/tools/:id/relations", requireAuth, requireFeature("similar-tools"), async (req, res): Promise<void> => {
+  const toolId = Number(req.params.id);
+  if (isNaN(toolId)) { res.status(400).json({ error: "Invalid id" }); return; }
+
+  const { relatedToolId, relationType, notes } = req.body;
+  if (!relatedToolId) { res.status(400).json({ error: "relatedToolId is required" }); return; }
+
+  const [existing] = await db
+    .select()
+    .from(toolRelationsTable)
+    .where(and(eq(toolRelationsTable.toolId, toolId), eq(toolRelationsTable.relatedToolId, relatedToolId)))
+    .limit(1);
+
+  if (existing) { res.status(409).json({ error: "Relation already exists" }); return; }
+
+  const [relation] = await db.insert(toolRelationsTable).values({
+    toolId,
+    relatedToolId,
+    relationType: relationType ?? "similar",
+    notes: notes ?? null,
+    createdBy: Number(req.session.user!.sub),
+  }).returning();
+
+  await writeAuditLog(req, "tool_relation", relation.id, "create", { toolId, relatedToolId, relationType });
+  res.status(201).json(relation);
+});
+
+router.delete("/tools/relations/:id", requireAuth, async (req, res): Promise<void> => {
+  const id = Number(req.params.id);
+  if (isNaN(id)) { res.status(400).json({ error: "Invalid id" }); return; }
+
+  const [existing] = await db.select().from(toolRelationsTable).where(eq(toolRelationsTable.id, id));
+  if (!existing) { res.status(404).json({ error: "Relation not found" }); return; }
+
+  await writeAuditLog(req, "tool_relation", id, "delete", { toolId: existing.toolId, relatedToolId: existing.relatedToolId });
+  await db.delete(toolRelationsTable).where(eq(toolRelationsTable.id, id));
+  res.sendStatus(204);
+});
+
 export default router;

artifacts/api-server/src/types/session.d.ts

@@ -8,6 +8,7 @@ declare module "express-session" {
       name?: string;
       preferred_username?: string;
       role?: "admin" | "user";
+      tier?: "free" | "premium" | "enterprise";
       isLocal?: boolean;
     };
     codeVerifier?: string;