From f007af903ddf9c547c69e15122ef8bc1fb5b71da Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Sun, 11 Oct 2026 13:42:06 +0200
Subject: [PATCH] Add missing check

---
 .../mcp-authorization.middleware.ts           | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/apps/api/src/middlewares/mcp-authorization.middleware.ts b/apps/api/src/middlewares/mcp-authorization.middleware.ts
index 47c4332b08..902b37db9c 100644
--- a/apps/api/src/middlewares/mcp-authorization.middleware.ts
+++ b/apps/api/src/middlewares/mcp-authorization.middleware.ts
@@ -3,6 +3,7 @@ import { getAccessIdOfBearerToken } from '@ghostfolio/api/helper/bearer-token.he
 import { ConfigurationService } from '@ghostfolio/api/services/configuration/configuration.service';
 import { ImpersonationService } from '@ghostfolio/api/services/impersonation/impersonation.service';
 import { HEADER_KEY_TOKEN, MCP_REALM } from '@ghostfolio/common/config';
+import { hasRole } from '@ghostfolio/common/permissions';
 import type { ImpersonationContext } from '@ghostfolio/common/types';
 
 import { RequestClient } from '@prisma/client';
@@ -20,6 +21,10 @@ import { getReasonPhrase, StatusCodes } from 'http-status-codes';
  * authorization server. A client which reads the challenge asks the user for
  * the identifier of the access instead of starting a flow which would fail.
  *
+ * With the subscription, the user who granted the access has the same limits
+ * as with the other clients: an inactive user and a user who exceeds the daily
+ * request limit get the status 429, which also has to come from here.
+ *
  * An authorized request is counted in the analytics of the user who granted
  * the access, as the strategies do for the requests of the other clients.
  */
@@ -65,6 +70,22 @@ export function createMcpAuthorizationMiddleware({
     }
 
     if (configurationService.get('ENABLE_FEATURE_SUBSCRIPTION')) {
+      const user = await userService.user({ id: impersonation.userId });
+
+      // The daily requests of an inactive user are not counted, as in the
+      // strategies
+      const isRequestLimitExceeded =
+        hasRole(user, 'INACTIVE') ||
+        (await userService.isDailyRequestLimitExceeded({ user }));
+
+      if (isRequestLimitExceeded) {
+        return response.status(StatusCodes.TOO_MANY_REQUESTS).json({
+          error: getReasonPhrase(StatusCodes.TOO_MANY_REQUESTS),
+          message:
+            'The request limit of the user who granted the access is exceeded'
+        });
+      }
+
       await userService.updateAnalytics({
         requestClient: RequestClient.MCP,
         userId: impersonation.userId