fix(byok): do not cache a billing outage as an unentitled organization

resolveOrganizationPlan maps a failed billing read to false, which is
indistinguishable from a real plan lapse. The entitlement cache stored that,
so one transient outage held the gate shut for the full TTL and every
inheriting run silently fell back to a metered hosted key — and the cache's
rejection path, which exists to prevent exactly this, was unreachable.

Give the resolver the onError option its neighbours already have and let the
cached read ask for 'throw', so a failure stays out of the cache and the next
resolution retries. Behavior for the call that saw the error is unchanged:
getBYOKKey still fails closed.

Reported by Cursor Bugbot.

Author: icecrasher321

apps/sim/lib/api-key/byok-entitlement.test.ts

@@ -92,6 +92,20 @@ describe('organization BYOK entitlement', () => {
     expect(mockResolveOrganizationPlan).toHaveBeenCalledTimes(2)
   })
 
+  /**
+   * The rejection path only exists in production because the cached read asks
+   * for it. `resolveOrganizationPlan` otherwise maps a billing outage to
+   * `false` — indistinguishable from a real lapse — and caching that would hold
+   * the gate shut for the full TTL, silently metering every inheriting run.
+   */
+  it('asks billing to throw rather than report an outage as unentitled', async () => {
+    await isOrganizationBYOKEntitledCached(ORGANIZATION_ID)
+
+    expect(mockResolveOrganizationPlan).toHaveBeenCalledWith(ORGANIZATION_ID, {
+      onError: 'throw',
+    })
+  })
+
   it('does not cache a rejection, so a transient failure cannot pin the gate shut', async () => {
     mockResolveOrganizationPlan.mockRejectedValueOnce(new Error('billing read failed'))
 

apps/sim/lib/api-key/byok-entitlement.ts

@@ -65,7 +65,15 @@ export async function isOrganizationBYOKEntitledCached(organizationId: string):
     if (cached.value !== null && cached.expiresAt > Date.now()) return cached.value
   }
 
-  const inflight = resolveOrganizationPlan(organizationId).then(
+  /**
+   * `onError: 'throw'` is load-bearing. Without it a billing-read outage
+   * resolves to `false` exactly like a real plan lapse, and the entry below
+   * would pin the gate shut for the whole TTL — every inheriting run silently
+   * falling back to a metered hosted key. Throwing keeps the failure out of the
+   * cache so the next resolution retries; `getBYOKKey` still fails closed for
+   * the one call that saw it.
+   */
+  const inflight = resolveOrganizationPlan(organizationId, { onError: 'throw' }).then(
     (entitled) => {
       entitlementCache.set(organizationId, {
         value: entitled,

apps/sim/lib/billing/core/subscription.ts

@@ -462,7 +462,21 @@ async function resolveOrganizationEnterprisePlan(organizationId: string): Promis
  * {@link resolveOrganizationEnterprisePlan}, which gates the Enterprise-only
  * tier. A billing-blocked organization resolves false either way.
  */
-export async function resolveOrganizationPlan(organizationId: string): Promise<boolean> {
+interface ResolveOrganizationPlanOptions {
+  /**
+   * What a billing-read failure resolves to. `'return-false'` (default) fails
+   * closed, which is what a one-shot gate wants. A caller that *caches* the
+   * answer must pass `'throw'`: a swallowed failure is indistinguishable from a
+   * real plan lapse, so caching it would hold the gate shut for the whole TTL
+   * over what may be a momentary outage.
+   */
+  onError?: 'return-false' | 'throw'
+}
+
+export async function resolveOrganizationPlan(
+  organizationId: string,
+  options: ResolveOrganizationPlanOptions = {}
+): Promise<boolean> {
   try {
     if (!isBillingEnabled) {
       return true
@@ -486,6 +500,9 @@ export async function resolveOrganizationPlan(organizationId: string): Promise<b
     return !!orgSub && checkOrgPlan(orgSub)
   } catch (error) {
     logger.error('Error checking organization plan status', { error, organizationId })
+    if (options.onError === 'throw') {
+      throw error
+    }
     return false
   }
 }