2.5.4

Upgraded pro/extra access

check-subscription.php

@@ -0,0 +1,28 @@
+<?php
+// ─── SunScope Extra — Subscription Still Active? ─────────────────────────────
+// JSON endpoint polled roughly once a day per visitor (see useAppState.js)
+// to catch subscribers who cancelled in Stripe. One-off payers never call
+// this - their access is permanent by design.
+//
+// Returns {"active": bool}
+
+require __DIR__ . '/secrets.local.php';
+
+header('Content-Type: application/json');
+
+$customer = trim($_GET['customer'] ?? $_POST['customer'] ?? '');
+
+if ($customer === '' || !preg_match('/^cus_[A-Za-z0-9_]+$/', $customer)) {
+    echo json_encode(['active' => false]);
+    exit;
+}
+
+$ch = curl_init('https://api.stripe.com/v1/subscriptions?customer=' . urlencode($customer) . '&status=active&limit=1');
+curl_setopt_array($ch, [
+    CURLOPT_RETURNTRANSFER => true,
+    CURLOPT_USERPWD        => STRIPE_SECRET_KEY . ':',
+]);
+$response = json_decode(curl_exec($ch), true);
+curl_close($ch);
+
+echo json_encode(['active' => !empty($response['data'])]);