fixes

apps/api/internal/billing/stripe.go

@@ -99,12 +99,32 @@ func (s *StripeService) cfg(ctx context.Context) StripeConfig {
 }
 
 var (
-	ErrStripeNotConfigured   = errors.New("stripe not configured")
-	ErrStripePlanUnsupported = errors.New("plan is not available for self-serve checkout")
-	ErrStripePriceMissing    = errors.New("stripe price id not configured for plan/term")
-	ErrStripeBadSignature    = errors.New("invalid stripe signature")
+	ErrStripeNotConfigured        = errors.New("stripe not configured")
+	ErrStripeSelfServeUnavailable = errors.New("self-serve checkout is unavailable until Stripe is configured")
+	ErrStripePlanUnsupported      = errors.New("plan is not available for self-serve checkout")
+	ErrStripePriceMissing         = errors.New("stripe price id not configured for plan/term")
+	ErrStripeBadSignature         = errors.New("invalid stripe signature")
 )
 
+// EnsureSelfServeCheckout allows live Stripe for any caller, and mock checkout
+// only for platform admins (so new tenant users cannot buy while STRIPE_MOCK is on).
+func (s *StripeService) EnsureSelfServeCheckout(ctx context.Context, platformAdmin bool) error {
+	_, cfg, err := s.bindCfg(ctx)
+	if err != nil {
+		return err
+	}
+	if !cfg.MockMode() {
+		return nil
+	}
+	if cfg.AllowMockPurchase() && platformAdmin {
+		return nil
+	}
+	if cfg.AllowMockPurchase() {
+		return ErrStripeSelfServeUnavailable
+	}
+	return ErrStripeNotConfigured
+}
+
 // CheckoutRequest is the body for POST /api/billing/checkout.
 // Set Pack for a one-time AI credit top-up, or Plan (+ Term) for a subscription.
 type CheckoutRequest struct {