close race with personal pro / org inclusions

Author: icecrasher321

apps/sim/lib/auth/auth.ts

@@ -50,7 +50,8 @@ import {
   ensureOrganizationForTeamSubscription,
   syncSubscriptionUsageLimits,
 } from '@/lib/billing/organization'
-import { isTeam } from '@/lib/billing/plan-helpers'
+import { pauseProSubscriptionForOrgCoverage } from '@/lib/billing/organizations/membership'
+import { isPro, isTeam } from '@/lib/billing/plan-helpers'
 import { getPlans, resolvePlanFromStripeSubscription } from '@/lib/billing/plans'
 import { syncSeatsFromStripeQuantity } from '@/lib/billing/validation/seat-management'
 import { handleAbandonedCheckout } from '@/lib/billing/webhooks/checkout'
@@ -3161,11 +3162,11 @@ export const auth = betterAuth({
               authorizeReference: async ({ user, referenceId, action }, ctx) => {
                 const body: unknown = ctx?.body
                 const requestedPlan =
-                  body &&
                   typeof body === 'object' &&
+                  body !== null &&
                   'plan' in body &&
-                  typeof (body as { plan: unknown }).plan === 'string'
-                    ? (body as { plan: string }).plan
+                  typeof body.plan === 'string'
+                    ? body.plan
                     : undefined
                 return await authorizeSubscriptionReference(
                   user.id,
@@ -3206,7 +3207,7 @@ export const auth = betterAuth({
                   )
                 }
 
-                await syncSubscriptionPlan(
+                const syncedPlan = await syncSubscriptionPlan(
                   subscription.id,
                   subscription.plan,
                   planFromStripe,
@@ -3215,7 +3216,7 @@ export const auth = betterAuth({
 
                 const subscriptionForOrg = {
                   ...subscription,
-                  plan: planFromStripe ?? subscription.plan,
+                  plan: syncedPlan ?? subscription.plan,
                   enterpriseOperationId: stripeSubscription.metadata?.enterpriseOperationId ?? null,
                 }
 
@@ -3242,6 +3243,17 @@ export const auth = betterAuth({
 
                 await syncSubscriptionUsageLimits(resolvedSubscription)
 
+                /**
+                 * Transactional fence behind the personal-checkout admission
+                 * guard: if the user joined a paid organization while their
+                 * checkout was in flight, pause the fresh personal Pro at
+                 * period end (same state a paid-org joiner's personal Pro
+                 * enters; restored automatically if they leave the org).
+                 */
+                if (isPro(resolvedSubscription.plan)) {
+                  await pauseProSubscriptionForOrgCoverage(resolvedSubscription.referenceId)
+                }
+
                 await writeBillingInterval(resolvedSubscription.id, isAnnual ? 'year' : 'month')
 
                 await sendPlanWelcomeEmail(resolvedSubscription)
@@ -3274,8 +3286,6 @@ export const auth = betterAuth({
                 const isUpgradeToTeam =
                   isTeamPlan && !isTeam(subscription.plan) && referenceOrganizationId == null
 
-                const effectivePlanForTeamFeatures = planFromStripe ?? subscription.plan
-
                 logger.info('[onSubscriptionUpdate] Subscription updated', {
                   subscriptionId: subscription.id,
                   status: subscription.status,
@@ -3294,16 +3304,24 @@ export const auth = betterAuth({
                   )
                 }
 
-                await syncSubscriptionPlan(
+                const syncedPlan = await syncSubscriptionPlan(
                   subscription.id,
                   subscription.plan,
                   planFromStripe,
                   subscription.referenceId
                 )
 
+                /**
+                 * All downstream processing keys off the plan the DB actually
+                 * holds after the sync — a plan write refused by the org/plan
+                 * invariant must not leak the rejected Stripe plan into org
+                 * resolution, seat sync, or usage limits.
+                 */
+                const effectivePlanForTeamFeatures = syncedPlan ?? subscription.plan
+
                 const subscriptionForOrg = {
                   ...subscription,
-                  plan: planFromStripe ?? subscription.plan,
+                  plan: effectivePlanForTeamFeatures,
                   enterpriseOperationId: stripeSubscription.metadata?.enterpriseOperationId ?? null,
                 }
 

apps/sim/lib/billing/core/subscription.test.ts

@@ -111,37 +111,39 @@ describe('syncSubscriptionPlan', () => {
     vi.clearAllMocks()
   })
 
-  it('writes the resolved plan for a user-referenced subscription', async () => {
+  it('writes the resolved plan for a user-referenced subscription and returns it', async () => {
     dbChainMockFns.limit.mockResolvedValueOnce([])
 
     await expect(syncSubscriptionPlan('sub-1', 'pro_6000', 'pro_25000', 'user-1')).resolves.toBe(
-      true
+      'pro_25000'
     )
     expect(dbChainMockFns.update).toHaveBeenCalled()
   })
 
   it('writes a team plan onto an org-referenced subscription without an org lookup', async () => {
     await expect(syncSubscriptionPlan('sub-1', 'pro_6000', 'team_6000', 'org-1')).resolves.toBe(
-      true
+      'team_6000'
     )
     expect(dbChainMockFns.limit).not.toHaveBeenCalled()
     expect(dbChainMockFns.update).toHaveBeenCalled()
   })
 
-  it('refuses to write a pro plan onto an org-referenced subscription', async () => {
+  it('refuses a pro plan on an org-referenced subscription and returns the current plan', async () => {
     dbChainMockFns.limit.mockResolvedValueOnce([{ id: 'org-1' }])
 
     await expect(syncSubscriptionPlan('sub-1', 'team_6000', 'pro_6000', 'org-1')).resolves.toBe(
-      false
+      'team_6000'
     )
     expect(dbChainMockFns.update).not.toHaveBeenCalled()
   })
 
-  it('no-ops when the plan is unchanged or unresolved', async () => {
+  it('returns the current plan when the Stripe plan is unchanged or unresolved', async () => {
     await expect(syncSubscriptionPlan('sub-1', 'team_6000', 'team_6000', 'org-1')).resolves.toBe(
-      false
+      'team_6000'
+    )
+    await expect(syncSubscriptionPlan('sub-1', 'team_6000', null, 'org-1')).resolves.toBe(
+      'team_6000'
     )
-    await expect(syncSubscriptionPlan('sub-1', 'team_6000', null, 'org-1')).resolves.toBe(false)
     expect(dbChainMockFns.update).not.toHaveBeenCalled()
   })
 })

apps/sim/lib/billing/core/subscription.ts

@@ -89,8 +89,7 @@ export async function writeBillingInterval(
 /**
  * Sync the subscription's `plan` column to match Stripe. Closes a gap
  * where plan changes (Pro → Team upgrades, tier swaps) updated price,
- * seats, and referenceId at Stripe but left the DB plan stale. Returns
- * `true` if a write was issued, `false` if no change was needed.
+ * seats, and referenceId at Stripe but left the DB plan stale.
  *
  * Enforces the billing invariant that organization-referenced
  * subscriptions only ever hold Team or Enterprise plans: when Stripe
@@ -99,6 +98,11 @@ export async function writeBillingInterval(
  * an error is logged so operators fix the price in Stripe — the DB row
  * never becomes an org-scoped Pro subscription.
  *
+ * Returns the plan the DB row holds after the call. Callers must drive all
+ * downstream processing (org ensure, seat sync, usage limits) from this
+ * value — never from the raw Stripe plan — so a refused write cannot leak
+ * the rejected plan into the rest of the webhook handler.
+ *
  * The organization lookup is inlined rather than delegated to
  * `isSubscriptionOrgScoped` because that helper lives in `core/billing.ts`,
  * which imports this module — delegating would create an import cycle.
@@ -108,9 +112,9 @@ export async function syncSubscriptionPlan(
   currentPlan: string | null,
   planFromStripe: string | null,
   referenceId: string
-): Promise<boolean> {
-  if (!planFromStripe) return false
-  if (currentPlan === planFromStripe) return false
+): Promise<string | null> {
+  if (!planFromStripe) return currentPlan
+  if (currentPlan === planFromStripe) return currentPlan
 
   if (!isOrgPlan(planFromStripe)) {
     const [referencedOrganization] = await db
@@ -129,7 +133,7 @@ export async function syncSubscriptionPlan(
           rejectedPlan: planFromStripe,
         }
       )
-      return false
+      return currentPlan
     }
   }
 
@@ -144,7 +148,7 @@ export async function syncSubscriptionPlan(
     newPlan: planFromStripe,
   })
 
-  return true
+  return planFromStripe
 }
 
 /**

apps/sim/lib/billing/organizations/membership.ts

@@ -312,6 +312,113 @@ export async function restoreUserProSubscription(userId: string): Promise<Restor
   return result
 }
 
+export interface PauseProForOrgCoverageResult {
+  paused: boolean
+  subscriptionId?: string
+  organizationId?: string
+}
+
+/**
+ * Pause (cancel at period end) a user's entitled personal Pro subscription
+ * because an organization with an entitled paid subscription already covers
+ * them. Transactional fence behind the checkout admission guard: it closes
+ * the race where a user starts a personal checkout while uncovered, joins a
+ * paid org mid-checkout, and completes payment after the join.
+ *
+ * The user keeps the period they paid for and the subscription simply does
+ * not renew — the same state a paid-org joiner's personal Pro enters, so the
+ * billing UI already renders it. If they leave the org before period end,
+ * `restoreUserProSubscription` un-pauses it automatically.
+ *
+ * Unlike `applyPaidOrgJoinBillingTx` (the join-time pause), this does NOT
+ * snapshot or zero current-period usage: by the time this runs the user's
+ * usage already attributes to the organization pool, and moving it into the
+ * pro snapshot would undercount the org's period.
+ *
+ * Idempotent: no-ops when there is no entitled personal Pro, when it is
+ * already pausing, or when no entitled paid org covers the user. All checks
+ * re-run under the user billing identity lock and a `FOR UPDATE` read of the
+ * personal subscription row — the same serialization points as the join and
+ * restore paths.
+ */
+export async function pauseProSubscriptionForOrgCoverage(
+  userId: string
+): Promise<PauseProForOrgCoverageResult> {
+  const result: PauseProForOrgCoverageResult = { paused: false }
+
+  await db.transaction(async (tx) => {
+    await acquireUserBillingIdentityLock(tx, userId)
+
+    const [personalPro] = await tx
+      .select()
+      .from(subscriptionTable)
+      .where(
+        and(
+          eq(subscriptionTable.referenceId, userId),
+          inArray(subscriptionTable.status, ENTITLED_SUBSCRIPTION_STATUSES),
+          sqlIsPro(subscriptionTable.plan)
+        )
+      )
+      .for('update')
+      .limit(1)
+
+    if (!personalPro || personalPro.cancelAtPeriodEnd) return
+
+    const memberships = await tx
+      .select({ organizationId: member.organizationId })
+      .from(member)
+      .where(eq(member.userId, userId))
+    if (memberships.length === 0) return
+
+    const organizationSubscriptions = await tx
+      .select({ plan: subscriptionTable.plan, referenceId: subscriptionTable.referenceId })
+      .from(subscriptionTable)
+      .where(
+        and(
+          inArray(
+            subscriptionTable.referenceId,
+            memberships.map((membership) => membership.organizationId)
+          ),
+          inArray(subscriptionTable.status, ENTITLED_SUBSCRIPTION_STATUSES)
+        )
+      )
+    const coveringSubscription = organizationSubscriptions.find((organizationSubscription) =>
+      isPaid(organizationSubscription.plan)
+    )
+    if (!coveringSubscription) return
+
+    await tx
+      .update(subscriptionTable)
+      .set({ cancelAtPeriodEnd: true })
+      .where(eq(subscriptionTable.id, personalPro.id))
+
+    if (personalPro.stripeSubscriptionId) {
+      await enqueueOutboxEvent(tx, OUTBOX_EVENT_TYPES.STRIPE_SYNC_CANCEL_AT_PERIOD_END, {
+        stripeSubscriptionId: personalPro.stripeSubscriptionId,
+        subscriptionId: personalPro.id,
+        reason: 'covered-by-organization',
+      })
+    }
+
+    result.paused = true
+    result.subscriptionId = personalPro.id
+    result.organizationId = coveringSubscription.referenceId
+  })
+
+  if (result.paused) {
+    logger.warn(
+      'Paused personal Pro created while covered by an organization subscription (kept until period end, Stripe sync queued)',
+      {
+        userId,
+        subscriptionId: result.subscriptionId,
+        organizationId: result.organizationId,
+      }
+    )
+  }
+
+  return result
+}
+
 export interface AddMemberParams {
   userId: string
   organizationId: string