Add user feature permissions and unified account management

backend/app/routers/events.py

@@ -9,7 +9,9 @@ from typing import Any, Dict, Optional
 from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import StreamingResponse
 
-from ..auth import get_current_user_event_stream
+from ..feature_guards import require_request_stream, check
+from ..feature_access import permissions
+from ..db import get_user_by_username
 from . import requests as requests_router
 
 router = APIRouter(prefix="/events", tags=["events"])
@@ -76,7 +78,7 @@ async def events_stream(
     request: Request,
     recent_days: int = 90,
     recent_stage: str = "all",
-    user: Dict[str, Any] = Depends(get_current_user_event_stream),
+    user: Dict[str, Any] = Depends(require_request_stream),
 ) -> StreamingResponse:
     recent_days = max(0, min(int(recent_days or 90), 3650))
     recent_take = 50 if user.get("role") == "admin" else 6
@@ -91,6 +93,13 @@ async def events_stream(
             if await request.is_disconnected():
                 break
 
+            try:
+                account = get_user_by_username(user.get("username", ""))
+                if not account or account.get("is_blocked") or account.get("is_expired"):
+                    break
+                check({**account, "features": permissions(account)}, "requests")
+            except HTTPException:
+                break
             now = time.monotonic()
             sent_any = False
 
@@ -148,7 +157,7 @@ async def events_stream(
 async def request_events_stream(
     request_id: str,
     request: Request,
-    user: Dict[str, Any] = Depends(get_current_user_event_stream),
+    user: Dict[str, Any] = Depends(require_request_stream),
 ) -> StreamingResponse:
     request_id = str(request_id).strip()
     if not request_id:
@@ -164,6 +173,13 @@ async def request_events_stream(
             if await request.is_disconnected():
                 break
 
+            try:
+                account = get_user_by_username(user.get("username", ""))
+                if not account or account.get("is_blocked") or account.get("is_expired"):
+                    break
+                check({**account, "features": permissions(account)}, "requests")
+            except HTTPException:
+                break
             now = time.monotonic()
             sent_any = False