[Kitenite]

Summary

Relay access no longer requires a paid subscription. The relay gate (checkHostAccess) now grants access based solely on result.allowed from host.checkAccess, dropping the && result.paidPlan requirement. Free-plan users whose host is authorized in their org can now use the relay HTTP proxy and /tunnel WebSocket instead of getting 403 Forbidden / a closed socket.

Scope is limited to the relay server enforcement — the only place that actually blocked free users. The desktop paywall UI is intentionally left untouched. The paidPlan field returned by host.checkAccess is now unused by any consumer but kept in place to minimize the diff.

Test Plan

• Free-plan user's authorized host connects via relay (no 403 / tunnel close)
• Non-authorized host (wrong org) still denied
• Paid-plan behavior unchanged

---

---

Summary by cubic

Allow free-plan users with an authorized host to use the relay HTTP proxy and /tunnel WebSocket. Access now relies only on host.checkAccess returning allowed, removing the paid plan check.

^{Written for commit de920be. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes
  • Host access is now granted whenever access is approved, including for eligible plans that were previously blocked by an unnecessary plan-status check.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[ghost]

Ready to review this PR? Stage has broken it down into 1 individual chapter for you:

	Title
1	Remove paid plan requirement for relay access

_{Chapters generated by Stage for commit de920be on Jul 10, 2026 6:03pm UTC.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: dea0e663-4972-4803-abc7-021855f6f639

📥 Commits

Reviewing files that changed from the base of the PR and between a7fccb8 and de920be.

📒 Files selected for processing (1)

• apps/relay/src/access.ts

---

📝 Walkthrough

Walkthrough

checkHostAccess now grants access whenever the API result is allowed, without requiring paidPlan. Routing checks, cache behavior, and TTL handling remain unchanged.

Changes

Host access authorization

Layer / File(s)	Summary
Allowed-result authorization apps/relay/src/access.ts	Access decisions now depend only on result.allowed; existing routing checks, API bypasses, caching, and return logic remain unchanged.

Estimated code review effort: 2 (Simple) | ~5 minutes

Possibly related PRs

• superset-sh/superset#4491: Both changes modify checkHostAccess authorization outcome logic in apps/relay/src/access.ts.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: removing the paid-plan requirement for relay access.
Description check	✅ Passed	The description covers the change summary and testing, but omits template sections like Related Issues, Type of Change, Screenshots, and Additional Notes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch unblock-relay-free-users

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR removes the paidPlan requirement from the relay access gate, so free-plan users whose host is authorized in their org can now connect via the relay HTTP proxy and WebSocket tunnel. The change is limited to a single expression in checkHostAccess.

• The ok condition in apps/relay/src/access.ts changes from result.allowed && result.paidPlan to result.allowed, granting relay access based solely on host authorization rather than subscription tier.
• The paidPlan field returned by host.checkAccess is retained but no longer consumed by any caller; the desktop paywall UI is intentionally unchanged.

Confidence Score: 5/5

Safe to merge — the change is a one-line relaxation of a business-logic gate with no effect on the surrounding auth, caching, or error-handling paths.

The only modified line drops && result.paidPlan from the access decision. Host authorization (result.allowed) is still enforced, org membership is still checked locally before any API call, and the LRU caches continue to behave correctly. The unused paidPlan field is kept in the response type to minimise diff surface. No auth bypass, no data-plane change, no cache semantic shift.

No files require special attention.

Important Files Changed

Filename	Overview
apps/relay/src/access.ts	Single-line change removing && result.paidPlan from the relay access gate; logic is correct and cache semantics are unaffected.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Client
    participant Relay
    participant Cache
    participant API as API (host.checkAccess)

    Client->>Relay: HTTP/WebSocket request (token, hostId)
    Relay->>Relay: parseHostRoutingKey(hostId)
    alt hostId invalid or org mismatch
        Relay-->>Client: 403 Denied (local short-circuit)
    else org matches
        Relay->>Cache: lookup allowedCache[userId:hostId]
        alt cached allowed
            Cache-->>Relay: true
            Relay-->>Client: Access granted
        else not cached
            Relay->>Cache: lookup deniedCache[userId:hostId]
            alt cached denied
                Cache-->>Relay: true
                Relay-->>Client: 403 Denied
            else no cache
                Relay->>API: "host.checkAccess({ hostId })"
                API-->>Relay: "{ allowed, paidPlan }"
                Note over Relay: ok = result.allowed (paidPlan no longer required)
                alt "ok === true"
                    Relay->>Cache: "allowedCache.set(key, true) TTL=15m"
                    Relay-->>Client: Access granted
                else "ok === false"
                    Relay->>Cache: "deniedCache.set(key, true) TTL=30s"
                    Relay-->>Client: 403 Denied
                end
            end
        end
    end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Client
    participant Relay
    participant Cache
    participant API as API (host.checkAccess)

    Client->>Relay: HTTP/WebSocket request (token, hostId)
    Relay->>Relay: parseHostRoutingKey(hostId)
    alt hostId invalid or org mismatch
        Relay-->>Client: 403 Denied (local short-circuit)
    else org matches
        Relay->>Cache: lookup allowedCache[userId:hostId]
        alt cached allowed
            Cache-->>Relay: true
            Relay-->>Client: Access granted
        else not cached
            Relay->>Cache: lookup deniedCache[userId:hostId]
            alt cached denied
                Cache-->>Relay: true
                Relay-->>Client: 403 Denied
            else no cache
                Relay->>API: "host.checkAccess({ hostId })"
                API-->>Relay: "{ allowed, paidPlan }"
                Note over Relay: ok = result.allowed (paidPlan no longer required)
                alt "ok === true"
                    Relay->>Cache: "allowedCache.set(key, true) TTL=15m"
                    Relay-->>Client: Access granted
                else "ok === false"
                    Relay->>Cache: "deniedCache.set(key, true) TTL=30s"
                    Relay-->>Client: 403 Denied
                end
            end
        end
    end

Loading

_{Reviews (1): Last reviewed commit: "fix(relay): allow free plans to use the ..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[github-actions]

🚀 Preview Deployment

🔗 Preview Links

Service	Status	Link
Database (Neon)	✅	View Branch
API (Vercel)	✅	Open Preview
Web (Vercel)	✅	Open Preview
Marketing (Vercel)	✅	Open Preview
Admin (Vercel)	✅	Open Preview
Docs (Vercel)	✅	Open Preview

---

Preview updates automatically with new commits