// src/lib/billing/authorize.ts — who may act on an org's billing.
// Used as the Stripe plugin's `authorizeReference` guard: only org owners can
// upgrade/cancel/restore subscriptions or open the billing portal.
import "server-only";
import { and, eq } from "drizzle-orm";
import { member } from "@/lib/db/auth-schema";
import { db } from "@/lib/db/client";

/** True when the user is the owner of the given organization. */
export async function isOrgBillingManager(
  userId: string,
  orgId: string,
): Promise<boolean> {
  const [row] = await db
    .select({ id: member.id })
    .from(member)
    .where(
      and(
        eq(member.organizationId, orgId),
        eq(member.userId, userId),
        eq(member.role, "owner"),
      ),
    )
    .limit(1);
  return Boolean(row);
}