fix

apps/api/internal/httpapi/middleware.go

@@ -89,6 +89,49 @@ func (s *Server) allowCompanyAdminOrPlatform(w http.ResponseWriter, r *http.Requ
 	return false
 }
 
+// allowCompanyOwnerOrPlatform allows the company billing owner or a platform admin.
+// When owner_user_id is unset (pre-backfill), falls back to company admin so billing is not locked out.
+func (s *Server) allowCompanyOwnerOrPlatform(w http.ResponseWriter, r *http.Request) bool {
+	uid, ok := UserIDFromContext(r.Context())
+	if !ok {
+		Error(w, http.StatusUnauthorized, "unauthorized")
+		return false
+	}
+	isAdmin, err := s.checkPlatformAdmin(r.Context(), uid)
+	if err != nil {
+		Error(w, http.StatusInternalServerError, "authorization check failed")
+		return false
+	}
+	if isAdmin {
+		return true
+	}
+	cid, ok := CompanyIDFromContext(r.Context())
+	if !ok {
+		Error(w, http.StatusForbidden, "company required")
+		return false
+	}
+	if s.Auth != nil {
+		ownerID, hasOwner, err := s.Auth.CompanyOwnerID(r.Context(), cid)
+		if err != nil {
+			Error(w, http.StatusInternalServerError, "authorization check failed")
+			return false
+		}
+		if hasOwner {
+			if ownerID == uid {
+				return true
+			}
+			Error(w, http.StatusForbidden, "company owner required")
+			return false
+		}
+	}
+	// Legacy fallback before owner backfill, or unit tests without Auth wired.
+	if CompanyAdminAllowed(r.Context()) {
+		return true
+	}
+	Error(w, http.StatusForbidden, "company owner required")
+	return false
+}
+
 func (s *Server) RequireSession(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		uidStr := s.Sessions.GetString(r.Context(), auth.SessionUserIDKey)