Enforce user limiter also for API key middleware

pkg/api/middlewares.go

@@ -363,6 +363,13 @@ func (am *AuthMiddleware) APIKey(keyFunc func(r *http.Request) string) func(http
 					http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
 					return
 				}
+
+				// if user is not an active subscriber, their properties and orgs might still exist but should not allow API
+				if softRestriction, err := am.Limiter.Evaluate(ctx, apiKey.UserID.Int32); (err == nil) && !softRestriction {
+					http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
+					return
+				}
+
 				ctx = context.WithValue(ctx, common.APIKeyContextKey, apiKey)
 			} else {
 				ctx = context.WithValue(ctx, common.SecretContextKey, secret)

pkg/api/server.go

@@ -88,6 +88,7 @@ func (a *apiKeyOwnerSource) apiKey(ctx context.Context) (*dbgen.APIKey, error) {
 
 	if secret, ok := ctx.Value(common.SecretContextKey).(string); ok && (len(secret) > 0) {
 		// this is the "postponed" DB access mentioned in APIKey() middleware
+		// NOTE: here we do NOT verify user's subscription validity, it's done only in middleware
 		key, err := a.Store.Impl().RetrieveAPIKey(ctx, secret)
 		if err != nil {
 			a.cachedKey = key