# ADR 0004 — Coming-soon subscribe on public launch (no simulated VIP)

Date: 2026-10-03

## Status

Accepted

## Context

Until Stripe keys exist, the subscribe flow had two self-grant holes that are fatal on a public site:

1. `POST /api/subscribe` (no keys) returned `{ url: '/payment-success?simulated=1' }`.
2. `/payment-success` without a `session_id` set `activate = true` — i.e. any logged-in user visiting the URL became `role: 'vip'` for free.

On the public internet this lets anyone self-grant VIP.

## Decision

- With no Stripe keys, `POST /api/subscribe` returns `{ comingSoon: true }` and no `url`; `SubscribeButton` already renders a disabled «قريباً» button whenever the response has no `url`.
- `/payment-success` no longer activates anything without a session: the `else if (!sessionId) { activate = true }` branch is deleted and `simulated` is removed from the page props. After the activation block, free users (`role` not `vip`/`admin`) are redirected to `/subscription`. VIP/admin users pass through to the success copy.
- The real Stripe path is unchanged: `session_id` present + `STRIPE_SECRET_KEY` set → session verified with Stripe → VIP activated.
- When Stripe keys land, the same pages switch to real Checkout without further flow changes.

## Consequences

- No revenue until Stripe is configured; VIP can still be granted manually by an admin in `/admin`.
- Anyone with a saved `?simulated=1` link gets redirected — the query param is simply ignored now.