Don't prevent creating drafts, or you won't get to see the upgrade banner

Instead:

- Always let you create drafts when pressing "Add card"
- Prevent creations of published cards via API
- Prevent publication of cards in all cases when the limit is exceeded

saas/app/controllers/concerns/card/limited_creation.rb

@@ -0,0 +1,14 @@
+module Card::LimitedCreation
+  extend ActiveSupport::Concern
+
+  included do
+    # Only limit API requests. We let you create drafts in the app to actually show the banner, no matter the card count.
+    # We limit card publications separately. See +Card::LimitedPublishing+.
+    before_action :ensure_can_create_cards, only: %i[ create ], if: -> { request.format.json? }
+  end
+
+  private
+    def ensure_can_create_cards
+      head :forbidden if Current.account.exceeding_card_limit?
+    end
+end

saas/app/controllers/concerns/card/limited_publishing.rb

@@ -1,12 +1,12 @@
-module Card::Limited
+module Card::LimitedPublishing
   extend ActiveSupport::Concern
 
   included do
-    before_action :ensure_can_create_cards, only: %i[ create ]
+    before_action :ensure_can_publish_cards, only: %i[ create ]
   end
 
   private
-    def ensure_can_create_cards
+    def ensure_can_publish_cards
       head :forbidden if Current.account.exceeding_card_limit?
     end
 end

saas/lib/fizzy/saas/engine.rb

@@ -128,8 +128,9 @@ module Fizzy
 
       config.to_prepare do
         ::Account.include(Account::Billing)
-        ::CardsController.include(Card::Limited)
         ::Signup.prepend(Fizzy::Saas::Signup)
+        CardsController.include(Card::LimitedCreation)
+        Cards::PublishesController.include(Card::LimitedPublishing)
 
         Queenbee::Subscription.short_names = Subscription::SHORT_NAMES
 

saas/test/controllers/card/limited_creation_test.rb

@@ -0,0 +1,43 @@
+require "test_helper"
+
+class Card::LimitedCreationTest < ActionDispatch::IntegrationTest
+  test "cannot create cards via JSON when card limit exceeded" do
+    sign_in_as :mike
+
+    accounts(:initech).update_column(:cards_count, 1001)
+
+    assert_no_difference -> { Card.count } do
+      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug, format: :json)
+    end
+
+    assert_response :forbidden
+  end
+
+  test "can create cards via HTML when card limit exceeded but they are drafts" do
+    sign_in_as :mike
+
+    accounts(:initech).update_column(:cards_count, 1001)
+    boards(:miltons_wish_list).cards.drafted.where(creator: users(:mike)).destroy_all
+
+    assert_difference -> { Card.count } do
+      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug)
+    end
+
+    assert_response :redirect
+    assert Card.last.drafted?
+  end
+
+  test "cannot force published status via HTML when card limit exceeded" do
+    sign_in_as :mike
+
+    accounts(:initech).update_column(:cards_count, 1001)
+    boards(:miltons_wish_list).cards.drafted.where(creator: users(:mike)).destroy_all
+
+    assert_difference -> { Card.count } do
+      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug), params: { card: { status: "published" } }
+    end
+
+    assert_response :redirect
+    assert Card.last.drafted?
+  end
+end

saas/test/controllers/card/limited_publishing_test.rb

@@ -0,0 +1,14 @@
+require "test_helper"
+
+class Card::LimitedPublishingTest < ActionDispatch::IntegrationTest
+  test "cannot publish cards when card limit exceeded" do
+    sign_in_as :mike
+
+    accounts(:initech).update_column(:cards_count, 1001)
+
+    post card_publish_path(cards(:unfinished_thoughts), script_name: accounts(:initech).slug)
+
+    assert_response :forbidden
+    assert cards(:unfinished_thoughts).reload.drafted?
+  end
+end

saas/test/controllers/card/limited_test.rb

@@ -1,15 +0,0 @@
-require "test_helper"
-
-class Card::LimitedTest < ActionDispatch::IntegrationTest
-  test "cannot create cards when card limit exceeded" do
-    sign_in_as :mike
-
-    accounts(:initech).update_column(:cards_count, 1001)
-
-    assert_no_difference -> { Card.count } do
-      post board_cards_path(boards(:miltons_wish_list), script_name: accounts(:initech).slug)
-    end
-
-    assert_response :forbidden
-  end
-end