From bf692e8b08b0c2baed9c50d31ede0525a176f979 Mon Sep 17 00:00:00 2001
From: Philipinho <16838612+Philipinho@users.noreply.github.com>
Date: Fri, 13 Mar 2026 23:06:19 +0000
Subject: [PATCH] fix

---
 .../src/ee/entitlement/entitlement-atom.ts    |  8 ++++---
 .../client/src/ee/security/pages/security.tsx |  2 +-
 .../src/core/space/services/space.service.ts  |  2 +-
 .../workspace/services/workspace.service.ts   | 24 +++++++++++++++----
 apps/server/src/ee                            |  2 +-
 .../environment/license-check.service.ts      | 10 ++++++--
 6 files changed, 35 insertions(+), 13 deletions(-)

diff --git a/apps/client/src/ee/entitlement/entitlement-atom.ts b/apps/client/src/ee/entitlement/entitlement-atom.ts
index a2d4e2cb..e6d38512 100644
--- a/apps/client/src/ee/entitlement/entitlement-atom.ts
+++ b/apps/client/src/ee/entitlement/entitlement-atom.ts
@@ -1,5 +1,7 @@
-import { atom } from "jotai";
+import { atomWithStorage } from "jotai/utils";
 import type { Entitlements } from "./entitlement.types";
 
-const initialValue: Entitlements | null = null;
-export const entitlementAtom = atom(initialValue);
+export const entitlementAtom = atomWithStorage<Entitlements | null>(
+  "entitlements",
+  null,
+);
diff --git a/apps/client/src/ee/security/pages/security.tsx b/apps/client/src/ee/security/pages/security.tsx
index c87192d3..b4a5a103 100644
--- a/apps/client/src/ee/security/pages/security.tsx
+++ b/apps/client/src/ee/security/pages/security.tsx
@@ -60,7 +60,7 @@ export default function Security() {
         </>
       )}
 
-      {hasSecurityAccess && (
+      {(isCloud() || hasSecurityAccess) && (
         <>
           <AllowedDomains />
           <Divider my="lg" />
diff --git a/apps/server/src/core/space/services/space.service.ts b/apps/server/src/core/space/services/space.service.ts
index 870655f3..e512e644 100644
--- a/apps/server/src/core/space/services/space.service.ts
+++ b/apps/server/src/core/space/services/space.service.ts
@@ -139,7 +139,7 @@ export class SpaceService {
       });
 
       if (
-        !this.licenseCheckService.hasFeature(workspace.licenseKey, 'security:settings')
+        !this.licenseCheckService.hasFeature(workspace.licenseKey, 'security:settings', workspace.plan)
       ) {
         throw new ForbiddenException(
           'This feature requires a valid license',
diff --git a/apps/server/src/core/workspace/services/workspace.service.ts b/apps/server/src/core/workspace/services/workspace.service.ts
index bf7c7f96..f1597aad 100644
--- a/apps/server/src/core/workspace/services/workspace.service.ts
+++ b/apps/server/src/core/workspace/services/workspace.service.ts
@@ -329,7 +329,7 @@ export class WorkspaceService {
     ) {
       const ws = await this.db
         .selectFrom('workspaces')
-        .select(['id', 'licenseKey', 'trashRetentionDays'])
+        .select(['id', 'licenseKey', 'plan', 'trashRetentionDays'])
         .where('id', '=', workspaceId)
         .executeTakeFirst();
 
@@ -337,10 +337,24 @@ export class WorkspaceService {
         throw new NotFoundException('Workspace not found');
       }
 
-      if (!this.licenseCheckService.hasFeature(ws.licenseKey, 'security:settings')) {
-        throw new ForbiddenException(
-          'This feature requires a valid license',
-        );
+      if (typeof updateWorkspaceDto.mcpEnabled !== 'undefined') {
+        if (!this.licenseCheckService.hasFeature(ws.licenseKey, 'mcp', ws.plan)) {
+          throw new ForbiddenException(
+            'This feature requires a valid license',
+          );
+        }
+      }
+
+      if (
+        typeof updateWorkspaceDto.disablePublicSharing !== 'undefined' ||
+        typeof updateWorkspaceDto.trashRetentionDays !== 'undefined' ||
+        typeof updateWorkspaceDto.restrictApiToAdmins !== 'undefined'
+      ) {
+        if (!this.licenseCheckService.hasFeature(ws.licenseKey, 'security:settings', ws.plan)) {
+          throw new ForbiddenException(
+            'This feature requires a valid license',
+          );
+        }
       }
 
       if (
diff --git a/apps/server/src/ee b/apps/server/src/ee
index a1327584..5082385c 160000
--- a/apps/server/src/ee
+++ b/apps/server/src/ee
@@ -1 +1 @@
-Subproject commit a13275849184a804c6e7324ab5f70bb780881c61
+Subproject commit 5082385c451582c8025829b820e1bcd3122fb5b1
diff --git a/apps/server/src/integrations/environment/license-check.service.ts b/apps/server/src/integrations/environment/license-check.service.ts
index b1c53bc6..35c2295a 100644
--- a/apps/server/src/integrations/environment/license-check.service.ts
+++ b/apps/server/src/integrations/environment/license-check.service.ts
@@ -26,9 +26,15 @@ export class LicenseCheckService {
     }
   }
 
-  hasFeature(licenseKey: string, feature: string): boolean {
+  hasFeature(licenseKey: string, feature: string, plan?: string): boolean {
     if (this.environmentService.isCloud()) {
-      return true;
+      try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const { getFeaturesForCloudPlan } = require('../../ee/licence/feature-registry');
+        return getFeaturesForCloudPlan(plan).has(feature);
+      } catch {
+        return false;
+      }
     }
 
     try {