fixes

apps/api/internal/httpapi/stripe_handlers_test.go

@@ -100,6 +100,29 @@ func TestHandleStripeCheckoutMockRequiresAdmin(t *testing.T) {
 	}
 }
 
+func TestHandleStripeCheckoutMockBlocksNonPlatformAdmin(t *testing.T) {
+	t.Parallel()
+	s := &Server{
+		Config: config.Config{StripeMock: true},
+		Stripe: &billing.StripeService{Cfg: billing.StripeConfig{ForceMock: true}},
+		testPlatformAdmin: func(context.Context, uuid.UUID) (bool, error) {
+			return false, nil
+		},
+	}
+	cid := uuid.New()
+	uid := uuid.New()
+	ctx := context.WithValue(context.Background(), ctxUserID, uid)
+	ctx = context.WithValue(ctx, ctxCompanyID, cid)
+	ctx = context.WithValue(ctx, ctxRole, "admin")
+	req := httptest.NewRequest(http.MethodPost, "/api/billing/checkout", bytes.NewBufferString(`{"plan":"starter","term":"monthly"}`))
+	req = req.WithContext(ctx)
+	rec := httptest.NewRecorder()
+	s.handleStripeCheckout(rec, req)
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status=%d body=%s want 503", rec.Code, rec.Body.String())
+	}
+}
+
 func signHandlerStripePayload(t *testing.T, secret string, payload []byte) string {
 	t.Helper()
 	ts := time.Now().Unix()