fix(billing): deny entitlement for a feature with no products - #1858

What

CheckFeatureEntitlement wrongly returns true for a feature that is attached to no product. entitlement.Service.Check does productService.List(Filter{ProductIDs: feature.ProductIDs}), and when feature.ProductIDs is empty the store treats the empty id filter as no filter (billing_plan… billing_product_repository.go: if len(flt.ProductIDs) > 0), so it returns every product. The plan-bound product is in that list, its plan_ids matches an active subscription, and Check grants the feature to any active subscriber.

Why it matters

A feature ends up with empty ProductIDs whenever it is removed from its last product — the exact effect of RemoveFeatureFromProduct (called by updateProductFeatures when a product update drops a feature). So retiring a feature would silently leave every subscriber entitled to it. This is an over-grant (grants access it should deny), independent of the reconcile/Stripe path.

Fix

Guard in Check: a feature attached to no product cannot belong to any plan, so return false before the list call.

if len(feature.ProductIDs) == 0 {
    return false, nil
}

The fix lives in Check, not in the store's empty-filter behaviour, because other callers rely on "empty filter = all products".

Test

Added TestService_Check_FeatureWithNoProducts: an active subscriber, a feature with empty ProductIDs. It asserts Check returns false and leaves the ProductService.List mock unset, so the test fails if Check ever calls List again (a regression guard). Verified it fails without the guard (the mock rejects the unexpected List call) and passes with it.

How it was found

Surfaced while testing the BillingProduct reconcile feature-remove flow in a local sandbox: after detaching a feature, GetPlan correctly dropped it, but the entitlement check kept returning true.