/** Gates webhooks and self-serve API keys. Admin-settable always
 * (users.isDeveloper, toggled in admin/users/[id]); also self-serve
 * toggleable by the user themselves once on a paid tier, no added fee —
 * see PATCH /api/v1/users/me/developer-access. Both paths write the same
 * column, so this check doesn't need to know which one granted it. */
export function hasDeveloperAccess(user: { isDeveloper: boolean }): boolean {
  return user.isDeveloper;
}

/** Gates BYOK AI provider keys — deliberately separate from
 * hasDeveloperAccess: routing real AI provider spend through Epicure on
 * the user's own key warrants a manual admin check-in, not blanket
 * self-serve like webhooks/API keys get. Admin-only, no self-serve path. */
export function hasByokAccess(user: { isByokEnabled: boolean }): boolean {
  return user.isByokEnabled;
}

/** Self-serve developer-access opt-in (webhooks + API keys) is only open
 * to paid tiers — free-tier users still need an admin grant. */
export function canSelfServeDeveloperAccess(user: { tier: string }): boolean {
  return user.tier !== "free";
}