feat(auth): owner allowlist — founder gets full access, never plan-gated #4062

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/AlecRae.com/pull/69

The problem

New accounts default to the free plan tier (accounts.planTier default). So when the founder signs in with Google, he gets a free-tier account and is plan-gated on his own product — no way to use it as the owner.

The fix

An env-driven owner allowlist (apps/api/src/lib/owner-allowlist.ts):

• Owner emails are pinned to the enterprise tier (highest = full access, no billing)
• Granted on account creation and reconciled on every login — so the founder's existing free account is upgraded in place the next time he signs in (no manual DB edit needed)
• The founder email (ccantynz@gmail.com) is built in, so it works with zero env config on the box (important — Craig is operating from an iPad)
• OWNER_EMAILS env var adds more owners (staff, co-founders) without a code change
• Wired into both the Google OAuth callback and the password-login path

Role (owner) and plan (enterprise) are now both correct for the founder, and the sidebar role badge from PR #67 will show OWNER.

Verification

• bun run typecheck ✅ clean
• 7 new unit tests (tests/owner-allowlist.test.ts) ✅ all pass — covers built-in founder, env additions, case/whitespace normalization, non-owner rejection, upgrade + no-op reconciliation
• .env.example documents OWNER_EMAILS

To take effect

The box needs to pull this build (the new "Deploy to Box" workflow from #68, or the one-liner). After it's live, sign in again — the free account upgrades to enterprise automatically.

https://claude.ai/code/session_0162YN9hcciwvFju6Ead8s2J

Generated by Claude Code