- Shipped
- August 11, 2026 at 1:43 AM UTC
- Author
- Kamo
- Commit
- f11583b
Self-pay had no route inside the console. Everything on the billing surface is account-shaped — you must already hold an AccountMember row before Plans & Billing shows you anything, and the only way to get one was an owner action — so a member who wanted to pay for themselves was told to go and ask. The one real self-pay path that existed, the consumer checkout used by white-label products, is unreachable from the console because the billing proxy rebuilds headers from scratch and never forwards the cookie its session resolver needs. The buyer is whoever the session says they are. X-Member-Id is set by the proxy from *** and never by the caller, so unlike the account routes there is no id in the path to swap — which is the whole reason this is its own route rather than another handler under /accounts/{accountUid}. The organization's policy is checked server-side, so hiding the option elsewhere is more than decoration, and the per-payer seat cap is enforced here rather than trusted from the client. Also closes a cross-tenant hole on POST /accounts. That route has no account id in its PATH, so AccountOrgScopeInterceptor — which keys on that segment — never saw it, and any member of any organization could name another organization's account in the BODY and rewrite its billing contact, redirecting its invoices and receipts. Naming an arbitrary memberId did the same from the other direction. Both are now required to belong to the caller's organization.