fix(payments): add org membership check to top-up checkout

[evanjacobson]

Summary

• Adds an organization authorization check to the top-up checkout route (/payments/topup)
• Previously, any authenticated user could initiate a checkout for any organization by passing an arbitrary organization-id query param
• Now uses getAuthorizedOrgContext to verify the user is a member of the org (or an admin) before creating/reusing the org's Stripe customer

Test plan

• Verify top-up works normally for a user's own account (no organization-id)
• Verify top-up works for an org the user belongs to
• Verify top-up returns 404 when organization-id belongs to an org the user is not a member of
• Verify admin users can still top up any org

[kilo-code-bot]

Code Review Summary

Status: 1 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Fix these issues in Kilo Cloud

Issue Details (click to expand)

Previous warning in src/app/payments/topup/route.ts is resolved in the latest commit. No new issues found in the incremental diff.

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
src/components/organizations/OrganizationPaymentDetails.tsx	122	The payment-details page currently renders CreditPurchaseOptions for any org member, so regular members will now see billing controls that the updated server-side route rejects.

Files Reviewed (1 files)

• src/app/payments/topup/route.ts - previous warning resolved

---

_{Reviewed by gpt-5.4-20260305 · 198,364 tokens}