fix(authorization): paid plan entitlement assigned by email instead of stable user ID

[rixel-code]

Automated fix generated by Rhea for a HIGH AUTHORIZATION finding:

Paid plan entitlement assigned by email instead of stable user ID

I'll update applyOrderPaidEntitlement to match users by externalId first, then fall back to email, with simple order-id replay protection.

Summary

Updated applyOrderPaidEntitlement in lib/billing.ts so paid plan entitlements bind to a stable user identity first:

1. Primary match: look up the user by order.customer.externalId (app / Better Auth user id).
2. Fallback: if that is missing or no user is found, match by normalized email.
3. Replay protection: skip the update when user.polarLastOrderId === order.id.

This avoids granting paid access based only on email when Polar already provides a stable externalId. Typecheck noise from missing deps in the limited verify environment is expected and not caused by this change.

---

🤖 Generated by Rhea — review before merging.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gridly	Ready	Preview, Comment	Jul 13, 2026 1:31pm

[beetle-ai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @beetle command.

⚙️ Settings

Severity Threshold: Medium — Balanced feedback — medium and high severity issues only. — Change in Settings
Custom Rules: Define your own review rules — Set Custom Rules
PR Summary: Configure PR summary — Change in Settings

📖 User Guide

• Once repos are connected, PR analysis is automatically enabled. You can disable analysis for this repo from beetleai.dev/analysis
• Comment @beetle on any PR to start analysis manually
• Comment @beetle stop to stop any ongoing analysis

---

Follow us: Beetle · X · LinkedIn