fix(subscription): close fake-Pro fall-through path on /api/subscription

[operatoruplift]

Real security gap closed

The legacy "confirm" fall-through path on POST /api/subscription was a real fake-Pro vulnerability. Any authenticated user posting:

POST /api/subscription
Authorization: Bearer <valid-privy-jwt>
Content-Type: application/json

{ "tx_signature": "anything-here" }

…would be marked tier=pro, status=active without any on-chain verification. The TODO at line 159 admitted it: "Verify the Solana tx on-chain before activating. For devnet/demo, we trust the client-provided signature."

Same fabrication class as the council PRs already cleaned up (#147, #155, #156) and the dashboard fabrication PRs (#164, #167, #173) — but worse, because this one let users claim a paid subscription without paying.

What about the real callers?

Zero calls in the codebase use this path:

grep -rn "tx_signature.*subscription" --include="*.ts" --include="*.tsx" | grep -v tests
# (no hits)

• The paywall page (app/(auth)/paywall/page.tsx) uses action="create_invoice" exclusively.
• Real on-chain settlement runs through /api/access/verify-payment, which does call verifyPayment(reference) against the Solana RPC.

What this PR does

Closes the path with HTTP 410 Gone + a nextAction pointing callers at /api/access/verify-payment, the route that actually verifies the on-chain tx.

The two known-good actions (create_invoice and dev_simulate) are unchanged.

Verified

pnpm exec tsc --noEmit
# exit 0

pnpm check
# 3 passed, 0 failed

grep -rn "tx_signature.*subscription" --include="*.ts" --include="*.tsx" app/ src/ \
  | grep -v "tests/\|//.*"
# 0 callers

Net diff

1 file changed, 18 insertions(+), 28 deletions(-)

Rollback

Single git revert. Note: rolling this back re-introduces the fake-Pro path; investigate the regression before reverting.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
website	Ready	Preview, Comment	Apr 27, 2026 4:14pm