From 17c6c8f60b314da70a06c4f323e5c855cfc5f9a3 Mon Sep 17 00:00:00 2001
From: Ben Senescu <44480372+bensenescu@users.noreply.github.com>
Date: Fri, 19 Jun 2026 18:29:41 -0400
Subject: [PATCH] fix: block user-initiated org creation  (#276)

---
 src/lib/auth-config.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/lib/auth-config.ts b/src/lib/auth-config.ts
index d34d77c..f5838eb 100644
--- a/src/lib/auth-config.ts
+++ b/src/lib/auth-config.ts
@@ -17,7 +17,14 @@ export function createBaseAuthConfig() {
       },
     },
     plugins: [
-      organization(),
+      // Block user-initiated org creation: each org is its own Autumn customer
+      // with its own onboarding-plan credit grant, so an authenticated user
+      // hitting POST /api/auth/organization/create could mint unlimited fresh
+      // grants. The app gives every user exactly one workspace, created
+      // server-side at signup via `auth.api.createOrganization({ body: { userId }})`
+      // — that's a "system action" (no session + userId in body) which better-auth
+      // exempts from this flag, so the bootstrap keeps working.
+      organization({ allowUserToCreateOrganization: false }),
       genericOAuth({
         config: [
           {