I'm building a paid feature for my application & the clients who haven't enabled it won't have access to it
While building all the API's around it, I see that I'm doing a lot of permission checks in every API (whether the feature is enabled for that client)
My question is, should I really bother?
The reason why I say so is because, my application is served through a UI and if the feature is disabled then the UI won't exist for it
The only reason why I added permission checks is because of the possibility of someone doing a
Am I over engineering it? I guess it depends on how critical the application is? What's the best practice here?