feat: enforce plan limits via Pennant in policies

app/Policies/BrandPolicy.php

@@ -5,9 +5,11 @@
 namespace App\Policies;
 
 use App\Enums\UserWorkspace\Role;
+use App\Features\BrandLimit;
 use App\Models\Brand;
 use App\Models\User;
 use App\Models\Workspace;
+use Laravel\Pennant\Feature;
 
 class BrandPolicy
 {
@@ -26,13 +28,9 @@ public function create(User $user, Workspace $workspace): bool
             return true;
         }
 
-        $plan = $workspace->plan;
+        $limit = Feature::for($workspace)->value(BrandLimit::class);
 
-        if (! $plan) {
-            return false;
-        }
-
-        return $workspace->brands()->count() < $plan->brand_limit;
+        return $workspace->brands()->count() < $limit;
     }
 
     public function update(User $user, Brand $brand): bool

app/Policies/WorkspacePolicy.php

@@ -5,8 +5,10 @@
 namespace App\Policies;
 
 use App\Enums\UserWorkspace\Role;
+use App\Features\MemberLimit;
 use App\Models\User;
 use App\Models\Workspace;
+use Laravel\Pennant\Feature;
 
 class WorkspacePolicy
 {
@@ -65,6 +67,21 @@ public function manageBilling(User $user, Workspace $workspace): bool
         return $this->hasRole($user, $workspace, [Role::Owner]);
     }
 
+    public function inviteMember(User $user, Workspace $workspace): bool
+    {
+        if (! $this->hasRole($user, $workspace, [Role::Owner, Role::Admin])) {
+            return false;
+        }
+
+        if (config('trypost.self_hosted')) {
+            return true;
+        }
+
+        $limit = Feature::for($workspace)->value(MemberLimit::class);
+
+        return $workspace->members()->count() < $limit;
+    }
+
     /**
      * @param  Role[]  $roles
      */

database/migrations/2026_04_14_213055_create_features_table.php

@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+use Laravel\Pennant\Migrations\PennantMigration;
+
+return new class extends PennantMigration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('features', function (Blueprint $table) {
+            $table->id();
+            $table->string('name');
+            $table->string('scope');
+            $table->text('value');
+            $table->timestamps();
+
+            $table->unique(['name', 'scope']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('features');
+    }
+};

tests/Feature/LimitEnforcementTest.php

@@ -0,0 +1,74 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Enums\UserWorkspace\Role;
+use App\Models\Brand;
+use App\Models\Plan;
+use App\Models\User;
+use App\Models\Workspace;
+
+beforeEach(function () {
+    config(['trypost.self_hosted' => false]);
+
+    $this->plan = Plan::first();
+    $this->plan->update([
+        'brand_limit' => 5,
+        'member_limit' => 5,
+    ]);
+
+    $this->user = User::factory()->create();
+    $this->workspace = Workspace::factory()->create([
+        'user_id' => $this->user->id,
+        'plan_id' => $this->plan->id,
+    ]);
+    $this->workspace->members()->attach($this->user->id, ['role' => Role::Owner->value]);
+    $this->user->update(['current_workspace_id' => $this->workspace->id]);
+});
+
+test('can create brand within limit', function () {
+    Brand::factory()->count(3)->create(['workspace_id' => $this->workspace->id]);
+
+    expect($this->user->can('create', [Brand::class, $this->workspace]))->toBeTrue();
+});
+
+test('cannot create brand beyond limit', function () {
+    Brand::factory()->count(5)->create(['workspace_id' => $this->workspace->id]);
+
+    expect($this->user->can('create', [Brand::class, $this->workspace]))->toBeFalse();
+});
+
+test('can invite member within limit', function () {
+    expect($this->user->can('inviteMember', $this->workspace))->toBeTrue();
+});
+
+test('cannot invite member beyond limit', function () {
+    $members = User::factory()->count(4)->create();
+
+    foreach ($members as $member) {
+        $this->workspace->members()->attach($member->id, ['role' => Role::Member->value]);
+    }
+
+    // 1 owner + 4 members = 5, which is the limit
+    expect($this->user->can('inviteMember', $this->workspace))->toBeFalse();
+});
+
+test('self hosted mode bypasses brand limit', function () {
+    config(['trypost.self_hosted' => true]);
+
+    Brand::factory()->count(10)->create(['workspace_id' => $this->workspace->id]);
+
+    expect($this->user->can('create', [Brand::class, $this->workspace]))->toBeTrue();
+});
+
+test('self hosted mode bypasses member limit', function () {
+    config(['trypost.self_hosted' => true]);
+
+    $members = User::factory()->count(10)->create();
+
+    foreach ($members as $member) {
+        $this->workspace->members()->attach($member->id, ['role' => Role::Member->value]);
+    }
+
+    expect($this->user->can('inviteMember', $this->workspace))->toBeTrue();
+});