Paid Access (Entitlements)

An entitlement is a key a member holds — “pro”, “course-101”, “vip”. Payments grant keys; access rules check them. That one idea powers every paid feature: membership tiers, paid courses, gated files, even paid chat rooms.

The loop: a Product names an entitlement key → a member buys it (your Stripe, or manual/cash you approve) → the key is granted automatically → everything gated with that key unlocks. Cancel/expiry revokes it just as automatically.

Gate anything with one rule

The same rule works on pages, tables, files, backend functions, realtime channels, and email-campaign audiences:

{ "type": "has_entitlement", "key": "pro" }

Pages can also check state for UI (show “Upgrade” vs the content):

const mine = await serenities.user.entitlements();
const isPro = mine.some((e) => e.key === 'pro' && e.isLive);

Lifetimes that match how you sell

Forever — one-time purchase, lifetime access
N days — passes and time-boxed access
While subscribed — follows the Stripe subscription, with a 7-day grace period on failed payments (members aren’t locked out over a card hiccup; access ends only if payment truly stops)

Why it’s trustworthy

One audited ledger. Every grant, extension, suspension, and revocation is recorded with who/why — payments, owner actions, and function code (ctx.entitlements.*) all write through the same guarded API.
Payment-agnostic. Stripe checkout, manual/cash with owner approval, a custom gateway’s backend function, or a grant you make by hand — the key is the same, so your content rules never care how someone paid.
Checks are fail-closed. No key, expired key, or any doubt = no access.