chore: import upstream snapshot with attribution

apps/sim/app/api/organizations/[id]/members/[memberId]/route.ts

@@ -0,0 +1,528 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db, dbReplica } from '@sim/db'
+import { member, user, userStats } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
+import { and, eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { updateOrganizationMemberRoleContract } from '@/lib/api/contracts/organization'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { setActiveOrganizationForCurrentSession } from '@/lib/auth/active-organization'
+import { getOrgMemberLedgerByUser } from '@/lib/billing/core/organization'
+import { getUserUsageData } from '@/lib/billing/core/usage'
+import {
+  removeExternalUserFromOrganizationWorkspaces,
+  removeUserFromOrganization,
+  WORKSPACE_BILLING_ACCOUNT_REMOVAL_ERROR,
+} from '@/lib/billing/organizations/membership'
+import { reconcileOrganizationSeats } from '@/lib/billing/organizations/seats'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { captureServerEvent } from '@/lib/posthog/server'
+
+const logger = createLogger('OrganizationMemberAPI')
+
+/**
+ * GET /api/organizations/[id]/members/[memberId]
+ * Get individual organization member details
+ */
+export const GET = withRouteHandler(
+  async (
+    request: NextRequest,
+    { params }: { params: Promise<{ id: string; memberId: string }> }
+  ) => {
+    try {
+      const session = await getSession()
+
+      if (!session?.user?.id) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+
+      const { id: organizationId, memberId } = await params
+      const url = new URL(request.url)
+      const includeUsage = url.searchParams.get('include') === 'usage'
+
+      const userMember = await db
+        .select()
+        .from(member)
+        .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+        .limit(1)
+
+      if (userMember.length === 0) {
+        return NextResponse.json(
+          { error: 'Forbidden - Not a member of this organization' },
+          { status: 403 }
+        )
+      }
+
+      const userRole = userMember[0].role
+      const hasAdminAccess = isOrgAdminRole(userRole)
+
+      const memberQuery = db
+        .select({
+          id: member.id,
+          userId: member.userId,
+          organizationId: member.organizationId,
+          role: member.role,
+          createdAt: member.createdAt,
+          userName: user.name,
+          userEmail: user.email,
+        })
+        .from(member)
+        .innerJoin(user, eq(member.userId, user.id))
+        .where(and(eq(member.organizationId, organizationId), eq(member.userId, memberId)))
+        .limit(1)
+
+      const memberEntry = await memberQuery
+
+      if (memberEntry.length === 0) {
+        return NextResponse.json({ error: 'Member not found' }, { status: 404 })
+      }
+
+      const canViewDetails = hasAdminAccess || session.user.id === memberId
+
+      if (!canViewDetails) {
+        return NextResponse.json({ error: 'Forbidden - Insufficient permissions' }, { status: 403 })
+      }
+
+      let memberData = memberEntry[0]
+
+      if (includeUsage && hasAdminAccess) {
+        const usageData = await db
+          .select({
+            currentPeriodCost: userStats.currentPeriodCost,
+            currentUsageLimit: userStats.currentUsageLimit,
+            usageLimitUpdatedAt: userStats.usageLimitUpdatedAt,
+            lastPeriodCost: userStats.lastPeriodCost,
+          })
+          .from(userStats)
+          .where(eq(userStats.userId, memberId))
+          .limit(1)
+
+        const computed = await getUserUsageData(memberId, dbReplica)
+
+        if (usageData.length > 0) {
+          // currentPeriodCost is only a baseline; add this member's attributed
+          // usage_log for the period. (getUserUsageData returns the org POOL for
+          // org-scoped members, so it can't supply the per-member figure.)
+          const memberLedger =
+            (
+              await getOrgMemberLedgerByUser(
+                organizationId,
+                computed.billingPeriodStart && computed.billingPeriodEnd
+                  ? { start: computed.billingPeriodStart, end: computed.billingPeriodEnd }
+                  : null,
+                dbReplica
+              )
+            ).get(memberId) ?? 0
+          memberData = {
+            ...memberData,
+            usage: {
+              ...usageData[0],
+              currentPeriodCost: (
+                Number(usageData[0].currentPeriodCost ?? 0) + memberLedger
+              ).toString(),
+              billingPeriodStart: computed.billingPeriodStart,
+              billingPeriodEnd: computed.billingPeriodEnd,
+            },
+          } as typeof memberData & {
+            usage: (typeof usageData)[0] & {
+              billingPeriodStart: Date | null
+              billingPeriodEnd: Date | null
+            }
+          }
+        }
+      }
+
+      return NextResponse.json({
+        success: true,
+        data: memberData,
+        userRole,
+        hasAdminAccess,
+      })
+    } catch (error) {
+      logger.error('Failed to get organization member', {
+        organizationId: (await params).id,
+        memberId: (await params).memberId,
+        error,
+      })
+
+      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+    }
+  }
+)
+
+/**
+ * PUT /api/organizations/[id]/members/[memberId]
+ * Update organization member role
+ */
+export const PUT = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string; memberId: string }> }) => {
+    try {
+      const session = await getSession()
+
+      if (!session?.user?.id) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+
+      const parsed = await parseRequest(updateOrganizationMemberRoleContract, request, context)
+      if (!parsed.success) return parsed.response
+
+      const { id: organizationId, memberId } = parsed.data.params
+      const { role } = parsed.data.body
+
+      const userMember = await db
+        .select()
+        .from(member)
+        .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+        .limit(1)
+
+      if (userMember.length === 0) {
+        return NextResponse.json(
+          { error: 'Forbidden - Not a member of this organization' },
+          { status: 403 }
+        )
+      }
+
+      if (!isOrgAdminRole(userMember[0].role)) {
+        return NextResponse.json({ error: 'Forbidden - Admin access required' }, { status: 403 })
+      }
+
+      const targetMember = await db
+        .select({
+          id: member.id,
+          role: member.role,
+          userId: member.userId,
+          email: user.email,
+          name: user.name,
+        })
+        .from(member)
+        .innerJoin(user, eq(member.userId, user.id))
+        .where(and(eq(member.organizationId, organizationId), eq(member.userId, memberId)))
+        .limit(1)
+
+      if (targetMember.length === 0) {
+        return NextResponse.json({ error: 'Member not found' }, { status: 404 })
+      }
+
+      if (targetMember[0].role === 'owner') {
+        return NextResponse.json({ error: 'Cannot change owner role' }, { status: 400 })
+      }
+
+      if (role === 'owner') {
+        return NextResponse.json(
+          {
+            error:
+              'Ownership transfer is not supported via this endpoint. Use POST /organizations/[id]/transfer-ownership instead.',
+          },
+          { status: 400 }
+        )
+      }
+
+      const updatedMember = await db
+        .update(member)
+        .set({ role })
+        .where(and(eq(member.organizationId, organizationId), eq(member.userId, memberId)))
+        .returning()
+
+      if (updatedMember.length === 0) {
+        return NextResponse.json({ error: 'Failed to update member role' }, { status: 500 })
+      }
+
+      logger.info('Organization member role updated', {
+        organizationId,
+        memberId,
+        newRole: role,
+        updatedBy: session.user.id,
+      })
+
+      recordAudit({
+        workspaceId: null,
+        actorId: session.user.id,
+        action: AuditAction.ORG_MEMBER_ROLE_CHANGED,
+        resourceType: AuditResourceType.ORGANIZATION,
+        resourceId: organizationId,
+        actorName: session.user.name ?? undefined,
+        actorEmail: session.user.email ?? undefined,
+        description: `Changed role for member ${memberId} to ${role}`,
+        metadata: {
+          targetUserId: memberId,
+          targetEmail: targetMember[0].email ?? undefined,
+          targetName: targetMember[0].name ?? undefined,
+          changes: [{ field: 'role', from: targetMember[0].role, to: role }],
+        },
+        request,
+      })
+
+      captureServerEvent(
+        session.user.id,
+        'org_member_role_changed',
+        { organization_id: organizationId, new_role: role },
+        { groups: { organization: organizationId } }
+      )
+
+      return NextResponse.json({
+        success: true,
+        message: 'Member role updated successfully',
+        data: {
+          id: updatedMember[0].id,
+          userId: updatedMember[0].userId,
+          role: updatedMember[0].role,
+          updatedBy: session.user.id,
+        },
+      })
+    } catch (error) {
+      logger.error('Failed to update organization member role', {
+        organizationId: (await context.params).id,
+        memberId: (await context.params).memberId,
+        error,
+      })
+
+      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+    }
+  }
+)
+
+/**
+ * DELETE /api/organizations/[id]/members/[memberId]
+ * Remove member from organization
+ */
+export const DELETE = withRouteHandler(
+  async (
+    request: NextRequest,
+    { params }: { params: Promise<{ id: string; memberId: string }> }
+  ) => {
+    try {
+      const session = await getSession()
+
+      if (!session?.user?.id) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+
+      const { id: organizationId, memberId: targetUserId } = await params
+
+      const userMember = await db
+        .select()
+        .from(member)
+        .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+        .limit(1)
+
+      if (userMember.length === 0) {
+        return NextResponse.json(
+          { error: 'Forbidden - Not a member of this organization' },
+          { status: 403 }
+        )
+      }
+
+      const canRemoveMembers =
+        isOrgAdminRole(userMember[0].role) || session.user.id === targetUserId
+
+      if (!canRemoveMembers) {
+        return NextResponse.json({ error: 'Forbidden - Insufficient permissions' }, { status: 403 })
+      }
+
+      const targetMember = await db
+        .select({ id: member.id, role: member.role, email: user.email, name: user.name })
+        .from(member)
+        .innerJoin(user, eq(member.userId, user.id))
+        .where(and(eq(member.organizationId, organizationId), eq(member.userId, targetUserId)))
+        .limit(1)
+
+      if (targetMember.length === 0) {
+        const [targetUser] = await db
+          .select({ id: user.id, email: user.email, name: user.name })
+          .from(user)
+          .where(eq(user.id, targetUserId))
+          .limit(1)
+
+        if (!targetUser) {
+          return NextResponse.json({ error: 'Member not found' }, { status: 404 })
+        }
+
+        const externalResult = await removeExternalUserFromOrganizationWorkspaces({
+          userId: targetUserId,
+          organizationId,
+        })
+
+        if (!externalResult.success) {
+          const error = externalResult.error || 'External workspace member not found'
+          const status =
+            error === 'External workspace member not found'
+              ? 404
+              : error === 'User is an organization member'
+                ? 409
+                : error === WORKSPACE_BILLING_ACCOUNT_REMOVAL_ERROR
+                  ? 400
+                  : 500
+
+          return NextResponse.json({ error }, { status })
+        }
+
+        logger.info('External workspace member removed from organization workspaces', {
+          organizationId,
+          removedMemberId: targetUserId,
+          removedBy: session.user.id,
+          workspaceAccessRevoked: externalResult.workspaceAccessRevoked,
+          permissionGroupsRevoked: externalResult.permissionGroupsRevoked,
+          credentialMembershipsRevoked: externalResult.credentialMembershipsRevoked,
+          pendingInvitationsCancelled: externalResult.pendingInvitationsCancelled,
+        })
+
+        recordAudit({
+          workspaceId: null,
+          actorId: session.user.id,
+          action: AuditAction.ORG_MEMBER_REMOVED,
+          resourceType: AuditResourceType.ORGANIZATION,
+          resourceId: organizationId,
+          actorName: session.user.name ?? undefined,
+          actorEmail: session.user.email ?? undefined,
+          description: `Removed external workspace member ${targetUserId} from organization`,
+          metadata: {
+            targetUserId,
+            targetEmail: targetUser.email ?? undefined,
+            targetName: targetUser.name ?? undefined,
+            membershipType: 'external',
+            workspaceAccessRevoked: externalResult.workspaceAccessRevoked,
+            permissionGroupsRevoked: externalResult.permissionGroupsRevoked,
+            credentialMembershipsRevoked: externalResult.credentialMembershipsRevoked,
+            pendingInvitationsCancelled: externalResult.pendingInvitationsCancelled,
+          },
+          request,
+        })
+
+        captureServerEvent(
+          session.user.id,
+          'org_member_removed',
+          { organization_id: organizationId, is_self_removal: session.user.id === targetUserId },
+          { groups: { organization: organizationId } }
+        )
+
+        return NextResponse.json({
+          success: true,
+          message: 'External member removed successfully',
+          data: {
+            removedMemberId: targetUserId,
+            removedBy: session.user.id,
+            removedAt: new Date().toISOString(),
+            membershipType: 'external',
+            workspaceAccessRevoked: externalResult.workspaceAccessRevoked,
+            permissionGroupsRevoked: externalResult.permissionGroupsRevoked,
+            credentialMembershipsRevoked: externalResult.credentialMembershipsRevoked,
+            pendingInvitationsCancelled: externalResult.pendingInvitationsCancelled,
+          },
+        })
+      }
+
+      const result = await removeUserFromOrganization({
+        userId: targetUserId,
+        organizationId,
+        memberId: targetMember[0].id,
+      })
+
+      if (!result.success) {
+        if (result.error === 'Cannot remove organization owner') {
+          return NextResponse.json({ error: result.error }, { status: 400 })
+        }
+        if (result.error === 'Member not found') {
+          return NextResponse.json({ error: result.error }, { status: 404 })
+        }
+        if (result.error === WORKSPACE_BILLING_ACCOUNT_REMOVAL_ERROR) {
+          return NextResponse.json({ error: result.error }, { status: 400 })
+        }
+        return NextResponse.json({ error: result.error }, { status: 500 })
+      }
+
+      let seatReduction: Awaited<ReturnType<typeof reconcileOrganizationSeats>> | null = null
+      try {
+        seatReduction = await reconcileOrganizationSeats({
+          organizationId,
+          reason: 'member-removed',
+          actorId: session.user.id,
+        })
+      } catch (seatError) {
+        logger.error('Failed to reduce seats after member removal', {
+          organizationId,
+          removedMemberId: targetUserId,
+          removedBy: session.user.id,
+          error: seatError,
+        })
+        seatReduction = {
+          changed: false,
+          reason: 'Failed to reduce seats after member removal',
+        }
+      }
+
+      if (session.user.id === targetUserId) {
+        try {
+          await setActiveOrganizationForCurrentSession(null)
+        } catch (clearError) {
+          logger.warn('Failed to clear active organization after self-removal', {
+            userId: session.user.id,
+            organizationId,
+            error: clearError,
+          })
+        }
+      }
+
+      logger.info('Organization member removed', {
+        organizationId,
+        removedMemberId: targetUserId,
+        removedBy: session.user.id,
+        wasSelfRemoval: session.user.id === targetUserId,
+        billingActions: result.billingActions,
+        seatReduction,
+      })
+
+      recordAudit({
+        workspaceId: null,
+        actorId: session.user.id,
+        action: AuditAction.ORG_MEMBER_REMOVED,
+        resourceType: AuditResourceType.ORGANIZATION,
+        resourceId: organizationId,
+        actorName: session.user.name ?? undefined,
+        actorEmail: session.user.email ?? undefined,
+        description:
+          session.user.id === targetUserId
+            ? 'Left the organization'
+            : `Removed member ${targetUserId} from organization`,
+        metadata: {
+          targetUserId,
+          targetEmail: targetMember[0].email ?? undefined,
+          targetName: targetMember[0].name ?? undefined,
+          wasSelfRemoval: session.user.id === targetUserId,
+          seatReduction,
+        },
+        request,
+      })
+
+      captureServerEvent(
+        session.user.id,
+        'org_member_removed',
+        { organization_id: organizationId, is_self_removal: session.user.id === targetUserId },
+        { groups: { organization: organizationId } }
+      )
+
+      return NextResponse.json({
+        success: true,
+        message:
+          session.user.id === targetUserId
+            ? 'You have left the organization'
+            : 'Member removed successfully',
+        data: {
+          removedMemberId: targetUserId,
+          removedBy: session.user.id,
+          removedAt: new Date().toISOString(),
+          seatReduction,
+        },
+      })
+    } catch (error) {
+      logger.error('Failed to remove organization member', {
+        organizationId: (await params).id,
+        memberId: (await params).memberId,
+        error,
+      })
+
+      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+    }
+  }
+)

apps/sim/app/api/organizations/[id]/members/[memberId]/usage-limit/route.test.ts

@@ -0,0 +1,176 @@
+/**
+ * @vitest-environment node
+ */
+import { auditMock, createMockRequest, createSession } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockGetSession,
+  mockIsOrganizationOwnerOrAdmin,
+  mockGetOrgMemberUsageLimit,
+  mockGetOrgMemberWorkspaceUsage,
+  mockSetOrgMemberUsageLimit,
+  mockGetOrganizationSubscription,
+  mockFlags,
+} = vi.hoisted(() => ({
+  mockGetSession: vi.fn(),
+  mockIsOrganizationOwnerOrAdmin: vi.fn(),
+  mockGetOrgMemberUsageLimit: vi.fn(),
+  mockGetOrgMemberWorkspaceUsage: vi.fn(),
+  mockSetOrgMemberUsageLimit: vi.fn(),
+  mockGetOrganizationSubscription: vi.fn(),
+  mockFlags: { isHosted: true },
+}))
+
+vi.mock('@/lib/auth', () => ({
+  auth: { api: { getSession: vi.fn() } },
+  getSession: mockGetSession,
+}))
+
+vi.mock('@sim/audit', () => auditMock)
+
+vi.mock('@/lib/billing/core/organization', () => ({
+  isOrganizationOwnerOrAdmin: mockIsOrganizationOwnerOrAdmin,
+}))
+
+vi.mock('@/lib/billing/organizations/member-limits', () => ({
+  getOrgMemberUsageLimit: mockGetOrgMemberUsageLimit,
+  getOrgMemberWorkspaceUsage: mockGetOrgMemberWorkspaceUsage,
+  setOrgMemberUsageLimit: mockSetOrgMemberUsageLimit,
+}))
+
+vi.mock('@/lib/billing/core/billing', () => ({
+  getOrganizationSubscription: mockGetOrganizationSubscription,
+}))
+
+vi.mock('@/lib/core/config/env-flags', () => ({
+  get isHosted() {
+    return mockFlags.isHosted
+  },
+}))
+
+import { GET, PUT } from '@/app/api/organizations/[id]/members/[memberId]/usage-limit/route'
+
+function context() {
+  return { params: Promise.resolve({ id: 'org-1', memberId: 'user-2' }) }
+}
+
+function putRequest(body: unknown) {
+  return createMockRequest('PUT', body)
+}
+
+function getRequest() {
+  return createMockRequest('GET')
+}
+
+describe('GET /api/organizations/[id]/members/[memberId]/usage-limit', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockFlags.isHosted = true
+    mockGetSession.mockResolvedValue(createSession({ userId: 'admin-1' }))
+    mockIsOrganizationOwnerOrAdmin.mockResolvedValue(true)
+    mockGetOrgMemberWorkspaceUsage.mockResolvedValue(1) // $1 -> 200 credits
+    mockGetOrgMemberUsageLimit.mockResolvedValue(2) // $2 -> 400 credits
+    mockGetOrganizationSubscription.mockResolvedValue(null)
+  })
+
+  it('returns 401 without a session', async () => {
+    mockGetSession.mockResolvedValue(null)
+    const res = await GET(getRequest(), context())
+    expect(res.status).toBe(401)
+  })
+
+  it('returns 404 when not hosted', async () => {
+    mockFlags.isHosted = false
+    const res = await GET(getRequest(), context())
+    expect(res.status).toBe(404)
+  })
+
+  it('returns 403 for non-admin callers', async () => {
+    mockIsOrganizationOwnerOrAdmin.mockResolvedValue(false)
+    const res = await GET(getRequest(), context())
+    expect(res.status).toBe(403)
+  })
+
+  it('returns credits used and limit converted to credits', async () => {
+    const res = await GET(getRequest(), context())
+    expect(res.status).toBe(200)
+    await expect(res.json()).resolves.toEqual({
+      success: true,
+      data: {
+        creditsUsed: 200,
+        creditLimit: 400,
+        billingInterval: 'month',
+      },
+    })
+  })
+
+  it('returns null creditLimit when no cap is set', async () => {
+    mockGetOrgMemberUsageLimit.mockResolvedValue(null)
+    const res = await GET(getRequest(), context())
+    const body = await res.json()
+    expect(body.data.creditLimit).toBeNull()
+  })
+
+  it('reports a yearly billing interval from subscription metadata', async () => {
+    mockGetOrganizationSubscription.mockResolvedValue({ metadata: { billingInterval: 'year' } })
+    const res = await GET(getRequest(), context())
+    const body = await res.json()
+    expect(body.data.billingInterval).toBe('year')
+  })
+
+  it('prefers the billing_interval column when metadata lacks it', async () => {
+    mockGetOrganizationSubscription.mockResolvedValue({ billingInterval: 'year', metadata: {} })
+    const res = await GET(getRequest(), context())
+    const body = await res.json()
+    expect(body.data.billingInterval).toBe('year')
+  })
+})
+
+describe('PUT /api/organizations/[id]/members/[memberId]/usage-limit', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockFlags.isHosted = true
+    mockGetSession.mockResolvedValue(createSession({ userId: 'admin-1' }))
+    mockIsOrganizationOwnerOrAdmin.mockResolvedValue(true)
+    mockSetOrgMemberUsageLimit.mockResolvedValue(undefined)
+  })
+
+  it('returns 404 when not hosted', async () => {
+    mockFlags.isHosted = false
+    const res = await PUT(putRequest({ creditLimit: 400 }), context())
+    expect(res.status).toBe(404)
+    expect(mockSetOrgMemberUsageLimit).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 for non-admin callers', async () => {
+    mockIsOrganizationOwnerOrAdmin.mockResolvedValue(false)
+    const res = await PUT(putRequest({ creditLimit: 400 }), context())
+    expect(res.status).toBe(403)
+    expect(mockSetOrgMemberUsageLimit).not.toHaveBeenCalled()
+  })
+
+  it('persists the limit as dollars (credits / 200) and audits', async () => {
+    const res = await PUT(putRequest({ creditLimit: 400 }), context())
+    expect(res.status).toBe(200)
+    expect(mockSetOrgMemberUsageLimit).toHaveBeenCalledWith('org-1', 'user-2', 2, 'admin-1')
+    expect(auditMock.recordAudit).toHaveBeenCalledTimes(1)
+    await expect(res.json()).resolves.toEqual({
+      success: true,
+      message: 'Member credit limit updated successfully',
+      data: { creditLimit: 400 },
+    })
+  })
+
+  it('clears the cap when creditLimit is null', async () => {
+    const res = await PUT(putRequest({ creditLimit: null }), context())
+    expect(res.status).toBe(200)
+    expect(mockSetOrgMemberUsageLimit).toHaveBeenCalledWith('org-1', 'user-2', null, 'admin-1')
+  })
+
+  it('rejects a negative credit limit with 400', async () => {
+    const res = await PUT(putRequest({ creditLimit: -5 }), context())
+    expect(res.status).toBe(400)
+    expect(mockSetOrgMemberUsageLimit).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/api/organizations/[id]/members/[memberId]/usage-limit/route.ts

@@ -0,0 +1,134 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  getOrganizationMemberUsageLimitContract,
+  updateOrganizationMemberUsageLimitContract,
+} from '@/lib/api/contracts/organization'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { getOrganizationSubscription } from '@/lib/billing/core/billing'
+import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
+import { resolveBillingInterval } from '@/lib/billing/core/subscription'
+import { creditsToDollars, dollarsToCredits } from '@/lib/billing/credits/conversion'
+import {
+  getOrgMemberUsageLimit,
+  getOrgMemberWorkspaceUsage,
+  setOrgMemberUsageLimit,
+} from '@/lib/billing/organizations/member-limits'
+import { isHosted } from '@/lib/core/config/env-flags'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+const logger = createLogger('OrgMemberUsageLimitAPI')
+
+/**
+ * GET /api/organizations/[id]/members/[memberId]/usage-limit
+ *
+ * Returns the member's current-period credits used inside the org's workspaces
+ * and their per-member credit cap (both in credits). Owner/admin only and
+ * hosted-only (the feature is meaningless where Sim does not own the DB/billing).
+ * `memberId` is the target user id, so external members are supported.
+ */
+export const GET = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string; memberId: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    if (!isHosted) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 })
+    }
+
+    const parsed = await parseRequest(getOrganizationMemberUsageLimitContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id: organizationId, memberId } = parsed.data.params
+
+    const hasAccess = await isOrganizationOwnerOrAdmin(session.user.id, organizationId)
+    if (!hasAccess) {
+      return NextResponse.json({ error: 'Forbidden - Admin access required' }, { status: 403 })
+    }
+
+    const [usage, limitDollars, orgSubscription] = await Promise.all([
+      getOrgMemberWorkspaceUsage(organizationId, memberId),
+      getOrgMemberUsageLimit(organizationId, memberId),
+      getOrganizationSubscription(organizationId),
+    ])
+
+    return NextResponse.json({
+      success: true,
+      data: {
+        creditsUsed: dollarsToCredits(usage),
+        creditLimit: limitDollars === null ? null : dollarsToCredits(limitDollars),
+        billingInterval: resolveBillingInterval(orgSubscription),
+      },
+    })
+  }
+)
+
+/**
+ * PUT /api/organizations/[id]/members/[memberId]/usage-limit
+ *
+ * Sets (or clears, when `creditLimit` is null) the member's per-org credit cap.
+ * Owner/admin only and hosted-only. The target need not be an org `member` row,
+ * so external members are supported.
+ */
+export const PUT = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string; memberId: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    if (!isHosted) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 })
+    }
+
+    const parsed = await parseRequest(updateOrganizationMemberUsageLimitContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { id: organizationId, memberId } = parsed.data.params
+    const { creditLimit } = parsed.data.body
+
+    const hasAccess = await isOrganizationOwnerOrAdmin(session.user.id, organizationId)
+    if (!hasAccess) {
+      return NextResponse.json({ error: 'Forbidden - Admin access required' }, { status: 403 })
+    }
+
+    const limitDollars = creditLimit === null ? null : creditsToDollars(creditLimit)
+    await setOrgMemberUsageLimit(organizationId, memberId, limitDollars, session.user.id)
+
+    logger.info('Updated per-member usage limit', {
+      organizationId,
+      memberId,
+      creditLimit,
+      updatedBy: session.user.id,
+    })
+
+    recordAudit({
+      workspaceId: null,
+      actorId: session.user.id,
+      action: AuditAction.ORG_MEMBER_USAGE_LIMIT_CHANGED,
+      resourceType: AuditResourceType.ORGANIZATION,
+      resourceId: organizationId,
+      actorName: session.user.name ?? undefined,
+      actorEmail: session.user.email ?? undefined,
+      description:
+        creditLimit === null
+          ? `Cleared credit limit for member ${memberId}`
+          : `Set credit limit for member ${memberId} to ${creditLimit} credits`,
+      metadata: {
+        targetUserId: memberId,
+        creditLimit,
+      },
+      request,
+    })
+
+    return NextResponse.json({
+      success: true,
+      message: 'Member credit limit updated successfully',
+      data: { creditLimit },
+    })
+  }
+)

apps/sim/app/api/organizations/[id]/members/route.ts

@@ -0,0 +1,380 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import {
+  invitation,
+  member,
+  subscription as subscriptionTable,
+  user,
+  userStats,
+} from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { isOrgAdminRole } from '@sim/platform-authz/workspace'
+import { normalizeEmail } from '@sim/utils/string'
+import { and, eq, inArray } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  inviteOrganizationMemberContract,
+  organizationMemberQuerySchema,
+  organizationParamsSchema,
+} from '@/lib/api/contracts/organization'
+import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { getOrgMemberLedgerByUser } from '@/lib/billing/core/organization'
+import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
+import { validateSeatAvailability } from '@/lib/billing/validation/seat-management'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import {
+  cancelPendingInvitation,
+  createPendingInvitation,
+  sendInvitationEmail,
+} from '@/lib/invitations/send'
+import { quickValidateEmail } from '@/lib/messaging/email/validation'
+import {
+  InvitationsNotAllowedError,
+  validateInvitationsAllowed,
+} from '@/ee/access-control/utils/permission-check'
+
+const logger = createLogger('OrganizationMembersAPI')
+
+/**
+ * GET /api/organizations/[id]/members
+ * Get organization members with optional usage data
+ */
+export const GET = withRouteHandler(
+  async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    try {
+      const session = await getSession()
+
+      if (!session?.user?.id) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+
+      const paramsResult = organizationParamsSchema.safeParse(await params)
+      if (!paramsResult.success) {
+        return NextResponse.json(
+          { error: getValidationErrorMessage(paramsResult.error, 'Invalid route parameters') },
+          { status: 400 }
+        )
+      }
+
+      const { id: organizationId } = paramsResult.data
+      const queryResult = organizationMemberQuerySchema.safeParse(
+        Object.fromEntries(request.nextUrl.searchParams.entries())
+      )
+      if (!queryResult.success) {
+        return NextResponse.json(
+          { error: getValidationErrorMessage(queryResult.error, 'Invalid query parameters') },
+          { status: 400 }
+        )
+      }
+      const includeUsage = queryResult.data.include === 'usage'
+
+      // Verify user has access to this organization
+      const memberEntry = await db
+        .select()
+        .from(member)
+        .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+        .limit(1)
+
+      if (memberEntry.length === 0) {
+        return NextResponse.json(
+          { error: 'Forbidden - Not a member of this organization' },
+          { status: 403 }
+        )
+      }
+
+      const userRole = memberEntry[0].role
+      const hasAdminAccess = isOrgAdminRole(userRole)
+
+      // Get organization members
+      const query = db
+        .select({
+          id: member.id,
+          userId: member.userId,
+          organizationId: member.organizationId,
+          role: member.role,
+          createdAt: member.createdAt,
+          userName: user.name,
+          userEmail: user.email,
+        })
+        .from(member)
+        .innerJoin(user, eq(member.userId, user.id))
+        .where(eq(member.organizationId, organizationId))
+
+      // Include usage data if requested and user has admin access
+      if (includeUsage && hasAdminAccess) {
+        const base = await db
+          .select({
+            id: member.id,
+            userId: member.userId,
+            organizationId: member.organizationId,
+            role: member.role,
+            createdAt: member.createdAt,
+            userName: user.name,
+            userEmail: user.email,
+            currentPeriodCost: userStats.currentPeriodCost,
+            currentUsageLimit: userStats.currentUsageLimit,
+            usageLimitUpdatedAt: userStats.usageLimitUpdatedAt,
+          })
+          .from(member)
+          .innerJoin(user, eq(member.userId, user.id))
+          .leftJoin(userStats, eq(user.id, userStats.userId))
+          .where(eq(member.organizationId, organizationId))
+
+        // The billing period is the same for every member — it comes from
+        // whichever subscription covers them. Fetch once and attach to
+        // every row instead of calling `getUserUsageData` per-member,
+        // which would run an O(N) pooled query for each of N rows.
+        const [orgSub] = await db
+          .select({
+            periodStart: subscriptionTable.periodStart,
+            periodEnd: subscriptionTable.periodEnd,
+          })
+          .from(subscriptionTable)
+          .where(
+            and(
+              eq(subscriptionTable.referenceId, organizationId),
+              inArray(subscriptionTable.status, ENTITLED_SUBSCRIPTION_STATUSES)
+            )
+          )
+          .limit(1)
+
+        const billingPeriodStart = orgSub?.periodStart ?? null
+        const billingPeriodEnd = orgSub?.periodEnd ?? null
+
+        // currentPeriodCost is only a baseline; add each member's attributed
+        // usage_log for the period (batched, one query) so the roster shows real
+        // usage rather than the frozen baseline.
+        const usageByUser = await getOrgMemberLedgerByUser(
+          organizationId,
+          billingPeriodStart && billingPeriodEnd
+            ? { start: billingPeriodStart, end: billingPeriodEnd }
+            : null
+        )
+
+        const membersWithUsage = base.map((row) => ({
+          ...row,
+          currentPeriodCost: (
+            Number(row.currentPeriodCost ?? 0) + (usageByUser.get(row.userId) ?? 0)
+          ).toString(),
+          billingPeriodStart,
+          billingPeriodEnd,
+        }))
+
+        return NextResponse.json({
+          success: true,
+          data: membersWithUsage,
+          total: membersWithUsage.length,
+          userRole,
+          hasAdminAccess,
+        })
+      }
+
+      const members = await query
+
+      return NextResponse.json({
+        success: true,
+        data: members,
+        total: members.length,
+        userRole,
+        hasAdminAccess,
+      })
+    } catch (error) {
+      logger.error('Failed to get organization members', {
+        organizationId: (await params).id,
+        error,
+      })
+
+      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+    }
+  }
+)
+
+/**
+ * POST /api/organizations/[id]/members
+ * Invite new member to organization
+ */
+export const POST = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    try {
+      const session = await getSession()
+
+      if (!session?.user?.id) {
+        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+      }
+
+      const parsed = await parseRequest(inviteOrganizationMemberContract, request, context)
+      if (!parsed.success) return parsed.response
+
+      const { id: organizationId } = parsed.data.params
+
+      await validateInvitationsAllowed(session.user.id, { organizationId })
+
+      const { email, role = 'member' } = parsed.data.body
+
+      // Validate and normalize email
+      const normalizedEmail = normalizeEmail(email)
+      const validation = quickValidateEmail(normalizedEmail)
+      if (!validation.isValid) {
+        return NextResponse.json(
+          { error: validation.reason || 'Invalid email format' },
+          { status: 400 }
+        )
+      }
+
+      // Verify user has admin access
+      const memberEntry = await db
+        .select()
+        .from(member)
+        .where(and(eq(member.organizationId, organizationId), eq(member.userId, session.user.id)))
+        .limit(1)
+
+      if (memberEntry.length === 0) {
+        return NextResponse.json(
+          { error: 'Forbidden - Not a member of this organization' },
+          { status: 403 }
+        )
+      }
+
+      if (!isOrgAdminRole(memberEntry[0].role)) {
+        return NextResponse.json({ error: 'Forbidden - Admin access required' }, { status: 403 })
+      }
+
+      // Check seat availability
+      const seatValidation = await validateSeatAvailability(organizationId, 1)
+      if (!seatValidation.canInvite) {
+        return NextResponse.json(
+          {
+            error: `Cannot invite teammate. Using ${seatValidation.currentSeats} of ${seatValidation.maxSeats} seats.`,
+            details: seatValidation,
+          },
+          { status: 400 }
+        )
+      }
+
+      // Check if user is already a member
+      const existingUser = await db
+        .select({ id: user.id })
+        .from(user)
+        .where(eq(user.email, normalizedEmail))
+        .limit(1)
+
+      if (existingUser.length > 0) {
+        const existingMember = await db
+          .select()
+          .from(member)
+          .where(
+            and(eq(member.organizationId, organizationId), eq(member.userId, existingUser[0].id))
+          )
+          .limit(1)
+
+        if (existingMember.length > 0) {
+          return NextResponse.json(
+            { error: 'User is already a member of this organization' },
+            { status: 400 }
+          )
+        }
+      }
+
+      // Check for existing pending invitation
+      const existingInvitation = await db
+        .select()
+        .from(invitation)
+        .where(
+          and(
+            eq(invitation.organizationId, organizationId),
+            eq(invitation.email, normalizedEmail),
+            eq(invitation.status, 'pending')
+          )
+        )
+        .limit(1)
+
+      if (existingInvitation.length > 0) {
+        return NextResponse.json(
+          { error: 'Pending invitation already exists for this email' },
+          { status: 400 }
+        )
+      }
+
+      const { invitationId, token } = await createPendingInvitation({
+        kind: 'organization',
+        email: normalizedEmail,
+        inviterId: session.user.id,
+        organizationId,
+        role,
+        grants: [],
+      })
+
+      const [inviterRow] = await db
+        .select({ name: user.name, email: user.email })
+        .from(user)
+        .where(eq(user.id, session.user.id))
+        .limit(1)
+      const inviterName = inviterRow?.name || inviterRow?.email || 'A user'
+
+      const emailResult = await sendInvitationEmail({
+        invitationId,
+        token,
+        kind: 'organization',
+        email: normalizedEmail,
+        inviterName,
+        organizationId,
+        organizationRole: role,
+        grants: [],
+      })
+
+      if (!emailResult.success) {
+        logger.error('Failed to send organization invitation email', {
+          email: normalizedEmail,
+          invitationId,
+          error: emailResult.error,
+        })
+        await cancelPendingInvitation(invitationId)
+        return NextResponse.json(
+          { error: emailResult.error || 'Failed to send invitation email' },
+          { status: 502 }
+        )
+      }
+
+      logger.info('Member invitation sent', {
+        email: normalizedEmail,
+        organizationId,
+        invitationId,
+        role,
+      })
+
+      recordAudit({
+        workspaceId: null,
+        actorId: session.user.id,
+        action: AuditAction.ORG_INVITATION_CREATED,
+        resourceType: AuditResourceType.ORGANIZATION,
+        resourceId: organizationId,
+        actorName: session.user.name ?? undefined,
+        actorEmail: session.user.email ?? undefined,
+        description: `Invited ${normalizedEmail} to organization as ${role}`,
+        metadata: { invitationId, targetEmail: normalizedEmail, targetRole: role },
+        request,
+      })
+
+      return NextResponse.json({
+        success: true,
+        message: `Invitation sent to ${normalizedEmail}`,
+        data: {
+          invitationId,
+          email: normalizedEmail,
+          role,
+        },
+      })
+    } catch (error) {
+      if (error instanceof InvitationsNotAllowedError) {
+        return NextResponse.json({ error: error.message }, { status: 403 })
+      }
+      logger.error('Failed to invite organization member', {
+        organizationId: (await context.params).id,
+        error,
+      })
+
+      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+    }
+  }
+)