fix(relay): allow free plans to use the relay
Summary
Relay access no longer requires a paid subscription. The relay gate (checkHostAccess) now grants access based solely on result.allowed from host.checkAccess, dropping the && result.paidPlan requirement. Free-plan users whose host is authorized in their org can now use the relay HTTP proxy and /tunnel WebSocket instead of getting 403 Forbidden / a closed socket.
Scope is limited to the relay server enforcement — the only place that actually blocked free users. The desktop paywall UI is intentionally left untouched. The paidPlan field returned by host.checkAccess is now unused by any consumer but kept in place to minimize the diff.
Test Plan
- Free-plan user's authorized host connects via relay (no 403 / tunnel close)
- Non-authorized host (wrong org) still denied
- Paid-plan behavior unchanged
Summary by cubic
Allow free-plan users with an authorized host to use the relay HTTP proxy and /tunnel WebSocket. Access now relies only on host.checkAccess returning allowed, removing the paid plan check.
Summary by CodeRabbit
- Bug Fixes
- Host access is now granted whenever access is approved, including for eligible plans that were previously blocked by an unnecessary plan-status check.