Plan → belongs to the ORG (not the user)
Credit → the ORG's wallet (not the user's)
Billing → charged to the ORG

Signup (email/password or OAuth)
  → Account is created (auth.users)
  → Redirected to "Create Org" page
  → Enters org name + industry info
  → Automatically becomes "owner"
  → Onboarding begins

Invitation:
  Owner/Admin sends email invitation
  → Invitee signs up (if needed) or logs in
  → Automatically linked to org as "member"
  → Role can be changed later

1. Enable Supabase Auth (email/password + Google + Apple)
2. Founder signs up → user_id is created
3. Existing DOSE org (cd3c0336...) → link with founder's user_id as "owner"
4. Set raw_app_meta_data.platform_role = 'super_admin'
5. Replace hardcoded ORGANIZATION_ID → read from JWT claims
6. DELETE all temp_dev_anon_access RLS policies
7. Write JWT-based RLS policies
8. Existing 1591 companies + 1522 contacts remain unchanged

export_ai_organizations  → Exists but profiles table is not linked to auth.users
export_ai_profiles       → Will be removed or merged with auth.users

-- Supabase Auth built-in (do not touch)
auth.users
  id UUID PK
  email TEXT
  raw_app_meta_data JSONB  -- \{ platform_role?: 'super_admin' \}
  raw_user_meta_data JSONB -- \{ full_name, avatar_url \}

-- Existing table to be updated
export_ai_organizations
  id UUID PK (existing: cd3c0336...)
  name TEXT NOT NULL
  slug TEXT UNIQUE          -- URL-friendly (new)
  plan TEXT DEFAULT 'free'  -- 'free' | 'pro' | 'team' | 'enterprise' (new)
  stripe_customer_id TEXT   -- nullable, empty during beta (new)
  created_by UUID → auth.users (new)
  settings JSONB DEFAULT '\{\}' -- org-specific config (new)
  created_at TIMESTAMPTZ
  updated_at TIMESTAMPTZ

-- New table (replaces export_ai_profiles)
export_ai_organization_members
  id UUID PK DEFAULT gen_random_uuid()
  user_id UUID NOT NULL → auth.users
  organization_id UUID NOT NULL → export_ai_organizations
  role TEXT NOT NULL DEFAULT 'member'  -- CHECK: owner/admin/member/viewer
  status TEXT NOT NULL DEFAULT 'active' -- CHECK: invited/active/suspended
  invited_by UUID → auth.users
  invited_at TIMESTAMPTZ
  joined_at TIMESTAMPTZ DEFAULT now()
  UNIQUE(user_id, organization_id)

-- Example: companies table
CREATE POLICY "org_member_access" ON export_ai_companies
  FOR ALL
  USING (
    organization_id IN (
      SELECT organization_id FROM export_ai_organization_members
      WHERE user_id = auth.uid()
      AND status = 'active'
    )
  );

-- Super admin: view all data
CREATE POLICY "super_admin_access" ON export_ai_companies
  FOR ALL
  USING (
    (auth.jwt() -> 'app_metadata' ->> 'platform_role') = 'super_admin'
  );

// lib/auth/session.ts
interface ISessionContext {
  userId: string;
  activeOrgId: string;
  orgRole: 'owner' | 'admin' | 'member' | 'viewer';
  platformRole?: 'super_admin';
  orgPlan: 'free' | 'pro' | 'team' | 'enterprise';
}

// In every API route:
const session = await getSession(request);
// session.activeOrgId → used instead of ORGANIZATION_ID
// session.orgRole → permission checks
// session.orgPlan → feature/limit checks