RABC fejlesztése és beélesítése hibák kijavításával

backend/app/api/v1/endpoints/documents.py

@@ -89,11 +89,15 @@ async def get_document_status(
 
 # RBAC helper function
 def _check_premium_or_admin(user: User) -> bool:
-    """Check if user has premium subscription or admin role."""
-    premium_plans = ['PREMIUM', 'PREMIUM_PLUS', 'VIP', 'VIP_PLUS']
-    if user.role == 'admin':
-        return True
-    if hasattr(user, 'subscription_plan') and user.subscription_plan in premium_plans:
+    """Check if user has premium subscription or admin role.
+    
+    P0: Legacy subscription_plan string check removed.
+    The Single Source of Truth is now subscription_tier JSONB rules.
+    Premium entitlement should be checked via the SubscriptionTier entitlements array.
+    """
+    premium_roles = ['admin', 'superadmin']
+    user_role = user.role.value if hasattr(user.role, 'value') else str(user.role)
+    if user_role.lower() in premium_roles:
         return True
     return False