chore(billing): tidy payer-pool concealment cleanup

Author: waleedlatif1

apps/sim/lib/billing/application/billing-use-cases.test.ts

@@ -24,11 +24,11 @@ const mocks = vi.hoisted(() => ({
   getUsageLogs: vi.fn(),
   getWorkspaceUsageLogs: vi.fn(),
   recordAudit: vi.fn(),
-  canManageWorkspaceBilling: vi.fn(),
+  canUserManageWorkspaceBilling: vi.fn(),
 }))
 
 vi.mock('@/lib/billing/core/workspace-billing-authority', () => ({
-  canUserManageWorkspaceBilling: mocks.canManageWorkspaceBilling,
+  canUserManageWorkspaceBilling: mocks.canUserManageWorkspaceBilling,
 }))
 
 vi.mock('@/lib/workspaces/application/workspace-context', () => ({
@@ -99,7 +99,7 @@ describe('billing application use cases', () => {
     vi.clearAllMocks()
     mocks.loadWorkspace.mockResolvedValue(workspaceContext)
     mocks.resolvePermission.mockResolvedValue('read')
-    mocks.canManageWorkspaceBilling.mockResolvedValue(false)
+    mocks.canUserManageWorkspaceBilling.mockResolvedValue(false)
     mocks.checkUsageStatus.mockResolvedValue({ currentUsage: 1, limit: 10, isExceeded: false })
     mocks.checkAttributedBlocks.mockResolvedValue({ blocked: false })
     mocks.toUsageLimitSubscription.mockReturnValue(null)
@@ -188,7 +188,7 @@ describe('billing application use cases', () => {
 
     expect(result.credits).toBeNull()
     expect(result.storage).toBeNull()
-    expect(mocks.canManageWorkspaceBilling).not.toHaveBeenCalled()
+    expect(mocks.canUserManageWorkspaceBilling).not.toHaveBeenCalled()
   })
 
   it('never reads the payer storage pool it may not disclose', async () => {
@@ -216,7 +216,7 @@ describe('billing application use cases', () => {
 
   it('withholds the payer pool from a workspace member who cannot manage billing', async () => {
     mocks.resolvePermission.mockResolvedValue('read')
-    mocks.canManageWorkspaceBilling.mockResolvedValue(false)
+    mocks.canUserManageWorkspaceBilling.mockResolvedValue(false)
 
     const result = await getBillingStatus.execute({
       principal: personalPrincipal,
@@ -226,12 +226,12 @@ describe('billing application use cases', () => {
     expect(result.credits).toBeNull()
     expect(result.storage).toBeNull()
     expect(result).toMatchObject({ workspaceId: 'workspace-1', plan: 'free', status: 'active' })
-    expect(mocks.canManageWorkspaceBilling).toHaveBeenCalledWith(workspaceContext, 'user-1')
+    expect(mocks.canUserManageWorkspaceBilling).toHaveBeenCalledWith(workspaceContext, 'user-1')
   })
 
   it('withholds the payer pool from a workspace admin who cannot manage billing', async () => {
     mocks.resolvePermission.mockResolvedValue('admin')
-    mocks.canManageWorkspaceBilling.mockResolvedValue(false)
+    mocks.canUserManageWorkspaceBilling.mockResolvedValue(false)
 
     const result = await getBillingStatus.execute({
       principal: personalPrincipal,
@@ -243,7 +243,7 @@ describe('billing application use cases', () => {
   })
 
   it('still reports an exceeded payer limit without disclosing the pool', async () => {
-    mocks.canManageWorkspaceBilling.mockResolvedValue(false)
+    mocks.canUserManageWorkspaceBilling.mockResolvedValue(false)
     mocks.checkUsageStatus.mockResolvedValue({ currentUsage: 40, limit: 10, isExceeded: true })
 
     const result = await getBillingStatus.execute({
@@ -256,7 +256,7 @@ describe('billing application use cases', () => {
   })
 
   it('projects the payer pool to a member who can manage billing', async () => {
-    mocks.canManageWorkspaceBilling.mockResolvedValue(true)
+    mocks.canUserManageWorkspaceBilling.mockResolvedValue(true)
 
     const result = await getBillingStatus.execute({
       principal: personalPrincipal,
@@ -272,7 +272,7 @@ describe('billing application use cases', () => {
   })
 
   it('always reports the account-scoped pool the caller owns', async () => {
-    mocks.canManageWorkspaceBilling.mockResolvedValue(false)
+    mocks.canUserManageWorkspaceBilling.mockResolvedValue(false)
     mocks.getSubscription.mockResolvedValue({ plan: 'pro' })
     mocks.deriveBillingContext.mockReturnValue({
       billingEntity: { type: 'user', id: 'user-1' },

apps/sim/lib/billing/application/get-billing-status.ts

@@ -66,6 +66,14 @@ function storageStatus(usedBytes: number, limitBytes: number): BillingStorageSta
   }
 }
 
+function creditsStatus(usage: { currentUsage: number; limit: number }): BillingCreditsStatus {
+  return {
+    used: dollarsToCredits(usage.currentUsage),
+    limit: dollarsToCredits(usage.limit),
+    remaining: dollarsToCredits(usage.limit - usage.currentUsage),
+  }
+}
+
 /**
  * Resolves whether a caller may read the resolved payer's pooled allowances.
  *
@@ -89,15 +97,15 @@ function storageStatus(usedBytes: number, limitBytes: number): BillingStorageSta
  * A workspace key still reads the plan, period, and standing it needs to
  * monitor the workspace, including `limit_exceeded` and `billing_blocked`.
  */
-function canReadPayerPool(
+async function canReadPayerPool(
   principal: BillingReadPrincipal,
   workspace: WorkspaceBillingAuthorityContext
 ): Promise<boolean> {
-  if (principal.kind !== 'personal_api_key') return Promise.resolve(false)
+  if (principal.kind !== 'personal_api_key') return false
   return canUserManageWorkspaceBilling(workspace, principal.userId)
 }
 
-/** Reads the payer's storage pool. Only called once disclosure is authorized. */
+/** Only invoked once payer-pool disclosure is authorized. */
 async function resolvePayerStorage(workspaceId: string): Promise<BillingStorageStatus> {
   const storageContext = await resolveStorageBillingContext(workspaceId)
   const usedBytes = await getStorageUsageForBillingContext(storageContext)
@@ -128,13 +136,7 @@ export const getBillingStatus = defineAuthorizedBillingReadUseCase({
         period: attribution.billingPeriod,
         plan: attribution.payerSubscription?.plan ?? 'free',
         status: block.blocked ? 'billing_blocked' : usage.isExceeded ? 'limit_exceeded' : 'active',
-        credits: canViewPayerPool
-          ? {
-              used: dollarsToCredits(usage.currentUsage),
-              limit: dollarsToCredits(usage.limit),
-              remaining: dollarsToCredits(usage.limit - usage.currentUsage),
-            }
-          : null,
+        credits: canViewPayerPool ? creditsStatus(usage) : null,
         storage,
       }
     }
@@ -163,11 +165,7 @@ export const getBillingStatus = defineAuthorizedBillingReadUseCase({
           : usage.isExceeded
             ? 'limit_exceeded'
             : 'active',
-      credits: {
-        used: dollarsToCredits(usage.currentUsage),
-        limit: dollarsToCredits(usage.limit),
-        remaining: dollarsToCredits(usage.limit - usage.currentUsage),
-      },
+      credits: creditsStatus(usage),
       storage: storageStatus(storageUsedBytes, storageLimitBytes),
     }
   },

apps/sim/lib/billing/core/workspace-billing-authority.ts

@@ -1,7 +1,4 @@
-import { db } from '@sim/db'
-import { member } from '@sim/db/schema'
-import { isOrgAdminRole } from '@sim/platform-authz/workspace'
-import { and, eq } from 'drizzle-orm'
+import { isOrganizationAdminOrOwner } from '@/lib/workspaces/permissions/utils'
 
 /**
  * Canonical workspace state needed to decide payer-billing authority.
@@ -26,14 +23,7 @@ export async function canUserManageWorkspaceBilling(
   userId: string
 ): Promise<boolean> {
   if (context.workspaceOrganizationId) {
-    const [membership] = await db
-      .select({ role: member.role })
-      .from(member)
-      .where(
-        and(eq(member.organizationId, context.workspaceOrganizationId), eq(member.userId, userId))
-      )
-      .limit(1)
-    return isOrgAdminRole(membership?.role)
+    return isOrganizationAdminOrOwner(userId, context.workspaceOrganizationId)
   }
 
   return context.billedAccountUserId === userId