Function POST

web/src/app/api/orgs/[orgId]/credits/route.ts:24–341

(request: NextRequest, { params }: RouteParams)

const ORG_MIN_PURCHASE_CREDITS = 5000 // $50 minimum for organizations

export async function POST(request: NextRequest, { params }: RouteParams) {
  if (!ORG_BILLING_ENABLED) {
    return NextResponse.json({ error: 'Organization billing is temporarily disabled' }, { status: 503 })
  }

  const session = await getServerSession(authOptions)
  if (!session?.user?.id) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  const { orgId } = await params

  try {
    const body = await request.json()
    const { amount: credits } = body // Frontend sends 'amount' which is actually credits

    if (!credits || credits < ORG_MIN_PURCHASE_CREDITS) {
      return NextResponse.json(
        {
          error: `Minimum purchase is ${ORG_MIN_PURCHASE_CREDITS.toLocaleString()} credits`,
        },
        { status: 400 },
      )
    }

    // Check if user is banned
    const user = await db.query.user.findFirst({
      where: eq(schema.user.id, session.user.id),
      columns: { banned: true },
    })

    if (user?.banned) {
      logger.warn(
        { userId: session.user.id, orgId },
        'Banned user attempted to purchase organization credits',
      )
      return NextResponse.json(
        { error: 'Your account has been suspended. Please contact support.' },
        { status: 403 },
      )
    }

    // Verify user has permission to purchase credits for this organization
    const membership = await db.query.orgMember.findFirst({
      where: and(
        eq(schema.orgMember.org_id, orgId),
        eq(schema.orgMember.user_id, session.user.id),
        // Only owners can purchase credits for now
        eq(schema.orgMember.role, 'owner'),
      ),
    })

    if (!membership) {
      return NextResponse.json(
        { error: 'Forbidden or Organization not found' },
        { status: 403 },
      )
    }