Feature Access Edge Case: Cozi Calendar Denied for FamilyCast Users

🐛 Bug Report: Feature Access Logic Issue

Problem

The Cozi Calendar integration is incorrectly showing as "allowed": false for FamilyCast users, when it should be "allowed": true based on the feature restriction configuration.

Expected Behavior

• FamilyCast users should have access to Cozi Calendar integration
• Feature access check should return "allowed": true for integration:COZI_CALENDAR when X-App-Type: familycast

Actual Behavior

• Both BrandCast AND FamilyCast users are denied access to Cozi Calendar
• API returns: {"allowed": false, "reason": "Available in familycast only"}

Evidence from API Audit

Feature Restriction Configuration (from database seed):

{
  featureKey: 'integration:COZI_CALENDAR',
  featureType: FeatureType.INTEGRATION,
  allowedProductLines: ['familycast'], // ✅ Correctly configured
  displayName: 'Cozi Family Calendar',
  description: 'Family-focused calendar integration',
  upgradeMessage: 'Switch to FamilyCast to access family-oriented features'
}

API Test Results:

# FamilyCast context - SHOULD BE ALLOWED
curl -H "X-App-Type: familycast" \
  -d '{"featureKeys": ["integration:COZI_CALENDAR"]}' \
  /api/feature-restrictions/check

# Returns: {"allowed": false} ❌ INCORRECT

# BrandCast context - SHOULD BE DENIED  
curl -H "X-App-Type: brandcast" \
  -d '{"featureKeys": ["integration:COZI_CALENDAR"]}' \
  /api/feature-restrictions/check

# Returns: {"allowed": false} ✅ CORRECT

Root Cause Analysis

Likely issues in the feature access logic:

1. App context not being properly passed to feature gating service
2. Product line resolution not working correctly for FamilyCast app type
3. Feature access logic not properly checking allowedProductLines against current app context

Files to Investigate

• apps/backend/src/services/featureGateService.ts - Feature access logic
• apps/backend/src/middleware/appContext.ts - App context detection
• apps/backend/src/routes/featureRestrictions.ts - Feature restriction endpoints
• packages/shared-backend/src/types/featureGating.ts - Type definitions

Impact

• User Experience: FamilyCast users cannot access their intended family-focused integration
• Business Logic: Brand isolation is not working as designed for this feature
• Testing Gap: Need integration tests for feature access per brand

Severity

🟡 Medium - Specific feature affected, brand isolation compromised for one integration

Environment

• API Version: Current development
• Auth: Admin user testing
• Discovered during: Brand isolation audit

Next Steps

1. Debug app context propagation in feature access checks
2. Verify product line mapping (familycast string vs AppType.FAMILYCAST enum)
3. Add integration tests for brand-specific feature access
4. Review other features with allowedProductLines for similar issues