Remove pricing/licensing — make all features free

[tianzhou]

Summary

pgconsole is now entirely free with all features unconditionally enabled. This removes the plan/license system end to end across the app, server, MCP, the Stripe webhook worker, the marketing site, tests, config, and docs.

Removed (pricing-only):

• Plan tiers + license verification (src/lib/plan.ts, server/lib/license.ts)
• Subscription modal, license-expiry banner, subscription hook
• The Stripe→Keygen webhook worker (worker/stripe-webhook/)
• The website /pricing page + its section components and nav/sitemap links
• The license docs page (docs/configuration/license.mdx)

Ungated (now always on): SSO (Google/Keycloak/Okta), audit logging, groups, announcement banner, branding.

Docs: scrubbed all license/plan/tier references; rewrote the FAQ License section to "source available and free, all features included."

IAM is now opt-in (off by default)

Removing the plan gate would have left IAM always enforced whenever [auth] is on — meaning a deployment with users but no [[iam]] rules would lock everyone out. To keep onboarding friction-free, IAM is now presence-based opt-in:

Setup	Behavior
No [auth]	Everyone → full access
[auth], no [[iam]] rules	All authenticated users → full access (IAM off)
[auth], ≥1 [[iam]] rule	Enforcement on; unmatched user/connection → denied

This restores the pre-pricing default. Note it's a global switch: the first rule turns enforcement on for all connections (unlisted connections become hidden).

Test plan

• tsc -b clean · vite build clean · build:server clean
• 460/460 tests pass; updated iam.test.ts / mcp.test.ts for the new IAM default and dropped license.test.ts / plan.test.ts

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pgconsole	Ready	Preview, Comment	Jun 25, 2026 9:13am

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
pgconsole	🟢 Ready	View Preview	Jun 25, 2026, 8:54 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[greptile-apps]

Greptile Summary

This PR removes all plan-tier and license infrastructure — deleting src/lib/plan.ts, server/lib/license.ts, the Stripe webhook worker, and the subscription UI — and makes every previously gated feature (SSO, audit logs, groups, banners, branding) unconditionally available. As part of the change, IAM enforcement is converted from plan-gated to presence-based opt-in: with no [[iam]] rules defined, all authenticated users receive full access.

• License/plan system removed end-to-end: plan tier checks, license key config parsing, seat-limit validation, license expiry warnings, subscription modal, and LicenseExpiryBanner are all deleted across server, client, MCP, worker, docs, and tests.
• IAM semantics changed: resolvePermissions now short-circuits to full access when rules.length === 0 rather than when !feature('IAM', plan), restoring the pre-pricing default for deployments without [[iam]] config.
• Audit log, groups, branding: previously Enterprise/Team-gated gates removed; the emit() guard and getGroupsForUser plan check are simply dropped so these features work unconditionally.

Confidence Score: 4/5

Safe to merge. The IAM opt-in change is a well-considered and documented behavioral shift, and the remaining 460 tests validate the new default correctly.

The change is a large but coherent removal of a pricing layer. The IAM presence-based opt-in design is clearly reasoned and tested. The only nits are a cosmetic indentation artifact in App.tsx and the loss of a direct unit-test assertion for the agent connection cap (which is still exercised indirectly). No logic regressions were found in the auth, IAM, or audit paths.

No files require special attention. server/lib/iam.ts carries the most consequential behavioral change and is clean; tests/mcp.test.ts lost a small piece of direct coverage but retains functional coverage of the same path.

Important Files Changed

Filename	Overview
server/lib/iam.ts	Core IAM change: replaces !feature('IAM', getPlan()) with rules.length === 0 for the short-circuit. Logic is clean and correctly documented; the opt-in semantics match the PR description and updated tests.
server/lib/config.ts	Removes license resolution, plan fields, seat-limit validation, and the getPlan/getLicense* exports. loadedConfig shape and DEFAULT_CONFIG are cleanly updated with no leftover fields.
server/lib/audit.ts	Removes the feature('AUDIT_LOG', getPlan()) guard from emit(), making audit events unconditional. Straightforward and correct.
server/auth-routes.ts	Removes per-provider plan middleware and the requiredPlan field from the /providers response. All SSO routes are now unconditionally reachable.
src/App.tsx	Removes SubscriptionModalProvider and LicenseExpiryBanner wrappers. After flattening the nesting, children inside the remaining div retained their old (extra-deep) indentation — a cosmetic inconsistency.
tests/iam.test.ts	Tests updated to reflect the new presence-based IAM default: "no rules → full access" replaces "plan unlicensed → full access". New test correctly covers the short-circuit path.
tests/mcp.test.ts	Removes the "delegated connection cap blocks other connections" unit test. The connection-cap behavior is still exercised via the dispatchTool "fails closed on an inaccessible connection" test, so coverage isn't fully lost.
src/lib/plan.ts	File deleted entirely. All feature/plan logic is removed with no orphaned references.
worker/stripe-webhook/src/index.js	Entire Stripe webhook worker deleted. No longer needed since there are no paid plans to provision.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Incoming Request] --> B{isAuthEnabled?}
    B -- No --> C[Full Access ALL_PERMISSIONS]
    B -- Yes --> D{IAM rules defined?\nrules.length === 0?}
    D -- No rules --> C
    D -- Has rules --> E[Iterate matching IAM rules\nfor connection + principal]
    E --> F{Any rule matches?}
    F -- Yes --> G[Union matched permissions]
    F -- No --> H[Empty set — Access denied / hidden]
    G --> I[Return permission set]
    C --> I

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Incoming Request] --> B{isAuthEnabled?}
    B -- No --> C[Full Access ALL_PERMISSIONS]
    B -- Yes --> D{IAM rules defined?\nrules.length === 0?}
    D -- No rules --> C
    D -- Has rules --> E[Iterate matching IAM rules\nfor connection + principal]
    E --> F{Any rule matches?}
    F -- Yes --> G[Union matched permissions]
    F -- No --> H[Empty set — Access denied / hidden]
    G --> I[Return permission set]
    C --> I

Loading

_{Reviews (1): Last reviewed commit: "feat: remove pricing/licensing, make all..." | Re-trigger Greptile}

[Copilot]

Pull request overview

Removes the pricing/licensing system across the app (server + client), deletes the Stripe→Keygen webhook worker and marketing pricing page, and changes IAM to be opt-in (enforced only once at least one [[iam]] rule exists) while making previously gated features always available.

Changes:

• Removed plan/license enforcement (including server license verification, plan-based feature gating, and related UI/tests).
• Deleted Stripe webhook worker and marketing site pricing page/components/links.
• Updated IAM semantics + tests/docs so “no [[iam]] rules” ⇒ IAM off (full access for authenticated users).

Reviewed changes

Copilot reviewed 41 out of 42 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
worker/stripe-webhook/wrangler.toml	Removed Cloudflare Worker config for Stripe webhook worker.
worker/stripe-webhook/src/index.js	Removed Stripe webhook handler (Stripe verification → Keygen license creation → email).
worker/stripe-webhook/package.json	Removed Stripe worker package manifest (stripe + wrangler deps).
worker/stripe-webhook/package-lock.json	Removed Stripe worker lockfile.
website/src/components/shared/navbar.tsx	Removed “Pricing” link from website navbar.
website/src/components/sections/pricing-single-tier-two-column.tsx	Removed pricing section component.
website/src/components/sections/pricing-multi-tier.tsx	Removed multi-tier pricing section component.
website/src/components/sections/pricing-hero-multi-tier.tsx	Removed pricing hero (tabbed) component.
website/src/components/sections/plan-comparison-table.tsx	Removed plan comparison table component.
website/src/app/sitemap.ts	Removed /pricing from sitemap output.
website/src/app/pricing/page.tsx	Removed /pricing page implementation.
tests/plan.test.ts	Removed tests for plan gating logic (plan module removed).
tests/mcp.test.ts	Updated MCP/IAM-related tests for IAM opt-in default; removed plan-based assumptions.
tests/license.test.ts	Removed license verification tests (license module removed).
tests/iam.test.ts	Updated IAM tests for opt-in enforcement when rules exist; removed plan gating mocks.
src/lib/plan.ts	Removed plan tier + feature gating helpers.
src/lib/auth-client.ts	Removed requiredPlan field from auth provider shape.
src/hooks/useSubscriptionModal.ts	Removed subscription modal hook/context.
src/hooks/useSetting.ts	Removed plan/license fields from settings response + hook return value.
src/components/SubscriptionModal.tsx	Removed subscription management modal UI.
src/components/LicenseExpiryBanner.tsx	Removed license expiry banner UI.
src/components/Header.tsx	Removed “Subscription” menu item and related imports/hooks.
src/components/AuthForm.tsx	Removed SSO “requires plan” disablement + messaging; always enables providers.
src/App.tsx	Removed subscription modal provider wrapper and license banner from layout.
server/lib/license.ts	Removed server-side license JWT verification.
server/lib/iam.ts	Made IAM enforcement presence-based (no rules ⇒ full access); removed plan gate.
server/lib/config.ts	Removed license parsing, plan resolution, seat/user-limit enforcement, and related getters.
server/lib/audit.ts	Removed plan gate so audit logging always emits when called.
server/index.ts	Simplified /api/setting to always return banner/branding; removed plan/license fields.
server/auth-routes.ts	Removed plan gating for OAuth routes and provider “requiredPlan” reporting.
docs/getting-started/faq.mdx	Updated License FAQ to “source available and free, all features included.”
docs/features/white-labeling.mdx	Removed “Enterprise plan required” notice.
docs/features/mcp-server.mdx	Removed “license seat” language for agents.
docs/features/database-access-control.mdx	Documented IAM opt-in behavior; removed plan requirement notice.
docs/features/audit-log.mdx	Removed “Enterprise plan required” notice.
docs/docs.json	Removed docs navigation entry for configuration/license page.
docs/configuration/license.mdx	Removed license management documentation page.
docs/configuration/config.mdx	Removed license field from config reference; updated IAM/owner/agents wording.
docs/authentication/overview.mdx	Updated SSO “Best for” wording to remove plan association.
docs/authentication/okta.mdx	Removed “Enterprise plan required” notice.
docs/authentication/keycloak.mdx	Removed “Enterprise plan required” notice.
docs/authentication/google.mdx	Removed “Team/Enterprise plan required” notice.

Files not reviewed (1)

• worker/stripe-webhook/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 43 out of 44 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• worker/stripe-webhook/package-lock.json: Generated file

[Copilot]

Pull request overview

Copilot reviewed 43 out of 44 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• worker/stripe-webhook/package-lock.json: Generated file