Dattavani Backend: Access and Limits Diagram

v2 routes run checks 2 to 5 in SQL: check_content_access_rpc behind POST /api/check-usage, and again inside v2_complete_chunk_progression_rpc.
v1 learning and story routes, Ask Tataji and Swamiji voice run them in Python: membership_guard plus enforce_kid_daily_usage_async.
Python caches the subscription snapshot for 60 s per worker. A subscription write clears it only in the worker that made the write, so other workers can lag up to a minute.
Keep both copies in step when a rule changes. The Python and SQL premium rules already differ (see the next card).

Status comes from the latest user_subscriptions row: is_trial, status, and trial_ended_at or current_period_end compared with now().
No job is needed at expiry. An ended window reads as expired immediately.
SQL treats a parent as paid when status is active and not trial, or parent_profile.is_premium_user (admin grant) is true. Python also counts any active or trialing RevenueCat row as paid.
Writers: Stripe and RevenueCat webhooks, trial start, and POST /api/promo/redeem, which extends through Stripe, RevenueCat or the local row. Billing detail: ../payments/index.html.

The parent sets one daily limit (PUT /api/parent/daily-usage-limit, bounds in app_config). Each kid gets the full limit on their own.
The app adds minutes with POST /api/usage/heartbeat. SQL clamps each beat to 1 to 60 minutes and counts by the client's date.
Trial cap: per parent, per day, default 2 chapters and 2 stories (app_config trial_*_daily_limit). Re-opening an item already counted today is free.
The trial count uses the server's CURRENT_DATE, not client_date, so it can roll over at a different hour than screen time.

GET /api/config is cached 60 s; app_config rows are cached 10 minutes. Force update needs both the platform's minimum build and its store URL; a non-numeric build is ignored.
The platform comes from X-App-Platform, else the user agent. An unknown platform never gets a force update.
GET /api/config/features: audio_video_feature_enabled defaults off, and the app shows audio and video only when it is on and is_premium_user is true. swamiji_voice_enabled stays on unless its row says false.
Flags and is_premium_user are cached 300 s per worker.

When true, the emails in TEST_AUTH_EMAIL sign in with the fixed TEST_AUTH_CODE; no real one-time code is sent.
When true, a Stripe event without parent_id is credited to the first parent_profile row (load_parent_id_from_metadata).
Both paths are meant for app review and QA accounts only.