MCM-32 — MSP Access Restriction on Subscription Expiry

← Back to MCM Nexus overview

As an MCM MSP Admin,
I want my whole MCM instance to warn me before, and block access once, my Nexus-issued subscription expires,
so that I'm never surprised by a lockout and always know exactly how to extend it.

Acceptance Criteria

• Every deployed MCM instance already has its Nexus-issued subscription state available from MCM-08's cached poll result: status, start date, end date, role/plan.
• Once the current date passes the subscription's end date (or status is DEACTIVATED/EXPIRED), the entire MCM instance becomes inaccessible to every user — every authenticated route redirects to a single "Subscription Expired" screen; only that screen and logout remain reachable.
• The Subscription Expired screen includes a "Check Again" action that re-checks the subscription on demand, via MCM-08's same endpoint, instead of waiting for the next scheduled poll (every 24 hours). If the subscription is now ACTIVE, access is restored immediately; otherwise the user stays on this screen.
• Starting 7 days before the end date, every page shows a persistent top banner stating the subscription is expiring soon and the exact end date, linking to the Plan Details page. The banner warns only — it never blocks usage.
• A dedicated Plan Details page (reachable from the banner and from the blocked-access screen) shows the current role/plan, start date, end date, and days remaining (or "Expired"), plus a prominent "Extend Plan" link out to nexus.mcm.revdau.ai's own Request Purchase or Extension flow.
• This is entirely separate from the existing per-Enterprise/per-module billing plans already shown in the product's Billing dashboard ("Current Plan" tab) — those are unaffected and keep working exactly as they do today; this story only governs whether the MSP instance as a whole is reachable at all.
• The blocked/expired state and the warning banner both derive from the same cached MCM-08 status — a transient Nexus outage does not lock out an instance that is still genuinely within its validity window.
• Once the subscription is renewed via Nexus, access is restored either by the instance's next scheduled poll picking up the new ACTIVE status and validity window (within 24 hours), or immediately if the MCM MSP Admin uses "Check Again" on the blocked screen — no manual unlock step on the instance side either way.

---

Technical Design

This lands entirely in mcm-api/mcm-ui — no new mcm-nexus work. Today, mcm-common-lib's JwtAuthFilter only checks JWT validity and User.StatusType; it has no concept of subscription expiry. A new check is added to that same request-time gate, reading the instance's locally cached MCM-08 poll result (not a live per-request Nexus call): once past the cached end date, every request short-circuits to the Subscription-Expired response, using the already-defined but currently unwired AppConstants.ERROR_SUBSCRIPTION_EXPIRED/MESSAGE_SUBSCRIPTION_EXPIRED constants — these exist in the codebase today for exactly this purpose but are never referenced. Note this is unrelated to UpcomingBillingPlanScheduler's existing deactivateExpiredPlans() job or the dead ActivePlanService, which govern per-Enterprise/per-module EnterprisePlan billing status, not the MSP's own instance-wide Nexus license. mcm-ui adds a global top-banner component and a new Plan Details page, distinct from the existing per-module BillingDashboard.

---

UI / Frontend Changes

• Global top banner (mcm-ui), shown app-wide starting 7 days before expiry, stating the exact end date and linking to the new Plan Details page.
• New Plan Details page: current role/plan, start date, end date, days remaining (or "Expired"), and a prominent "Extend Plan" button linking out to nexus.mcm.revdau.ai's purchase/extension flow.
• Whole-instance block screen once expired: every route redirects here except this page and logout; clear messaging on how to extend, plus a "Check Again" button that re-checks the subscription on demand and unblocks immediately if it now comes back ACTIVE, rather than waiting for the next scheduled 24-hour poll.
• "Check Again" shows a loading state while the on-demand check is in flight, and a brief inline message ("Still not active — try again later") if the subscription is still not ACTIVE.
• No changes to the existing per-Enterprise "Current Plan" tab in the Billing dashboard — that's a separate concept and stays as-is.