[waleedlatif1]

Summary

• A Stripe hosted checkout left open while the same organization links an AWS Marketplace license passed both the checkout guard and the link-time Stripe check, so Stripe and AWS could both bill the customer. No lock can span a hosted checkout, so the fix runs when Stripe binds the subscription.
• onSubscriptionComplete now calls cancelStripeSubscriptionBilledThroughMarketplace first. Under the organization mutation lock, then the subscription row lock, it rechecks for a live Marketplace license. If one bills the reference, it queues the existing immediate-cancel outbox event (prorated, invoiced now) and a team notice to refund the charge, then skips the paid-plan setup. A redelivered webhook queues nothing twice.
• Both link paths (buyer and admin) take the same organization mutation lock first, so a binding either runs before a link's Stripe check (and the link is refused) or after it commits (and the binding sees the license).
• Enterprise subscriptions the team issues, inactive licenses, unbound rows, and deployments that don't sell on AWS are left alone, matching the link-time check. Personal plans are fenced the same way the personal checkout guard refuses them.
• The immediate-cancel payload's requester and organization are now optional: a system cancellation is audited where it is decided, not as an admin request.

Type of Change

• Bug fix

Testing

• New stripe-fence.integration.ts (real Postgres, 11 tests): cancels once across redelivery and queues the team notice; personal plan; leaves alone (no license, inactive, Enterprise, unbound, not selling); link-then-bind; bind-then-link (link refused, subscription kept); a binding waits for a link holding the lock and then sees its license; a link waits for a binding holding the lock.
• Red→green: removing the fence's lock, the admin link's lock, the redelivery dedupe, or the Enterprise exclusion each turns exactly its test red.
• lifecycle.integration.ts (103) and checkout-guard.integration.ts (10) pass; outbox-handlers.test.ts passes; bun run lint.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 13, 2026 3:00am UTC

[greptile-apps]

Confidence Score: 4/5

[Critical impact] The change reaches Stripe subscription billing when AWS Marketplace already bills the same customer.

The PR appears safe to merge, with a non-blocking correction needed in the cancellation email.

Findings

1.  Email reports cancellation too early ▶

Summary

Adds a check when Stripe completes checkout to cancel a self-serve subscription if AWS Marketplace already bills its customer.

• Stripe checkout bindings cancel when AWS Marketplace already bills the customer.

Acknowledged intent: waleedlatif1 explicitly described leaving Enterprise subscriptions and inactive licenses alone.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Stripe checkout completes] --> B[Check subscription under locks]
  B --> C{Marketplace bills customer?}
  C -->|No| D[Continue paid-plan setup]
  C -->|Yes| E[Queue cancellation and team notice]
  E --> F[Skip paid-plan setup]
  E --> G[Outbox requests Stripe cancellation]
  E --> H[Outbox sends team notice]
  G --> I[Deletion webhook ends subscription]

Loading

_{Reviews (1) · Last reviewed commit: "fix(aws-marketplace): cancel a Stripe su..." · Reviewed by Greptile}

[greptile-apps]

Email reports cancellation too early

The team notice says Sim already cancelled the Stripe subscription, but it is queued alongside the cancellation request, not after it succeeds. The outbox handles these events separately, so support can receive the email while cancellation is still retrying or has failed. They could refund a subscription that continues to renew.

Say cancellation was requested and ask support to check its result, or send the success notice only after Stripe confirms cancellation.

[cubic-dev-ai]

4 issues found across 9 files

Confidence score: 3/5

• The notice in notifications.ts says cancellation has happened even though the Stripe cancellation is only queued, so customers could be told something that may still fail. Say the cancellation is queued.
• In stripe-fence.ts, a replay after cancellation completes can return null on the terminal row before checking the existing cancellation event, so it may skip normal completion handling. Check for the existing event before returning.
• stripe-fence.integration.ts treats any request over 300 ms as proof of lock contention, so a slow or unscheduled request can pass without reaching the lock. Assert that PostgreSQL reports the request waiting on a lock.
• The “refuses the link when the subscription binds first” case in stripe-fence.integration.ts leaves an active unlinked license behind, and afterAll does not remove it. Delete that fixture explicitly.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/billing/aws-marketplace/stripe-fence.integration.ts">

<violation number="1" location="apps/sim/lib/billing/aws-marketplace/stripe-fence.integration.ts:43">
P3: The lock-order tests treat every operation taking over 300 ms as evidence of lock contention, so a slow or unscheduled request can pass without reaching the lock. Wait for the request's PostgreSQL backend to report `wait_event_type = 'Lock'` before releasing the holder.</violation>

<violation number="2" location="apps/sim/lib/billing/aws-marketplace/stripe-fence.integration.ts:47">
P3: The 'refuses the link when the subscription binds first' case leaves its unlinked license behind. `afterAll` only deletes licenses by organization or linker, and this row has neither, so every run adds another active `product-placeholder` row that the admin unlinked-license queue lists. Track inserted license IDs in `insertLicense` and delete them in `afterAll`.</violation>
</file>

<file name="apps/sim/lib/billing/aws-marketplace/notifications.ts">

<violation number="1" location="apps/sim/lib/billing/aws-marketplace/notifications.ts:190">
P2: This copy says the cancellation already happened, but it is only queued. The Stripe cancel runs as a separate outbox event that can be retried or fail, and this notice can be sent before it. Say it was queued in the subject and opening, e.g. 'Stripe cancellation queued', so staff do not refund while the subscription is still live.</violation>
</file>

<file name="apps/sim/lib/billing/aws-marketplace/stripe-fence.ts">

<violation number="1" location="apps/sim/lib/billing/aws-marketplace/stripe-fence.ts:45">
P2: A replay after the queued cancellation completes is treated as uncancelled: the deletion webhook leaves the row terminal, so this returns `null` before checking the existing cancellation event and normal completion setup runs. Check for the deterministic cancellation event before returning false so replayed completion deliveries continue to skip setup.</violation>
</file>

_{Turn on auto-fix | Re-trigger cubic}

[cubic-dev-ai]

P2: This copy says the cancellation already happened, but it is only queued. The Stripe cancel runs as a separate outbox event that can be retried or fail, and this notice can be sent before it. Say it was queued in the subject and opening, e.g. 'Stripe cancellation queued', so staff do not refund while the subscription is still live.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/lib/billing/aws-marketplace/notifications.ts, line 190:

<comment>This copy says the cancellation already happened, but it is only queued. The Stripe cancel runs as a separate outbox event that can be retried or fail, and this notice can be sent before it. Say it was queued in the subject and opening, e.g. 'Stripe cancellation queued', so staff do not refund while the subscription is still live.</comment>

<file context>
@@ -184,6 +184,14 @@ New agreement: ${notice.agreementId}`,
+    case 'stripe-cancelled':
+      return {
+        subject: `Stripe subscription cancelled: ${account}`,
+        opening: `A Stripe checkout completed for a customer AWS Marketplace already bills, so Sim cancelled the Stripe subscription at once.
+Sim subscription: ${notice.subscriptionId}
+Stripe subscription: ${notice.stripeSubscriptionId}`,
</file context>

Suggested change

	opening: `A Stripe checkout completed for a customer AWS Marketplace already bills, so Sim cancelled the Stripe subscription at once.
	opening: `A Stripe checkout completed for a customer AWS Marketplace already bills, so Sim queued an immediate Stripe cancellation.

[cubic-dev-ai]

P2: A replay after the queued cancellation completes is treated as uncancelled: the deletion webhook leaves the row terminal, so this returns null before checking the existing cancellation event and normal completion setup runs. Check for the deterministic cancellation event before returning false so replayed completion deliveries continue to skip setup.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/lib/billing/aws-marketplace/stripe-fence.ts, line 45:

<comment>A replay after the queued cancellation completes is treated as uncancelled: the deletion webhook leaves the row terminal, so this returns `null` before checking the existing cancellation event and normal completion setup runs. Check for the deterministic cancellation event before returning false so replayed completion deliveries continue to skip setup.</comment>

<file context>
@@ -0,0 +1,85 @@
+    const organizationId = (await organizationExists(tx, referenceId)) ? referenceId : null
+    if (organizationId) await acquireOrganizationMutationLock(tx, organizationId)
+    const bound = await lockSelfServeStripeSubscription(tx, subscriptionId)
+    if (!bound) return null
+    if (bound.referenceId !== referenceId) {
+      throw new Error('Subscription changed billing reference while checking AWS Marketplace')
</file context>

[cubic-dev-ai]

P3: The lock-order tests treat every operation taking over 300 ms as evidence of lock contention, so a slow or unscheduled request can pass without reaching the lock. Wait for the request's PostgreSQL backend to report wait_event_type = 'Lock' before releasing the holder.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/lib/billing/aws-marketplace/stripe-fence.integration.ts, line 43:

<comment>The lock-order tests treat every operation taking over 300 ms as evidence of lock contention, so a slow or unscheduled request can pass without reaching the lock. Wait for the request's PostgreSQL backend to report `wait_event_type = 'Lock'` before releasing the holder.</comment>

<file context>
@@ -0,0 +1,347 @@
+
+const ADMIN = { id: null, name: 'Fence fixture admin', email: null }
+/** Long enough that a statement not waiting on a lock has finished. */
+const LOCK_WAIT_PROBE_MS = 300
+
+const userIds: string[] = []
</file context>

[cubic-dev-ai]

P3: The 'refuses the link when the subscription binds first' case leaves its unlinked license behind. afterAll only deletes licenses by organization or linker, and this row has neither, so every run adds another active product-placeholder row that the admin unlinked-license queue lists. Track inserted license IDs in insertLicense and delete them in afterAll.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/lib/billing/aws-marketplace/stripe-fence.integration.ts, line 47:

<comment>The 'refuses the link when the subscription binds first' case leaves its unlinked license behind. `afterAll` only deletes licenses by organization or linker, and this row has neither, so every run adds another active `product-placeholder` row that the admin unlinked-license queue lists. Track inserted license IDs in `insertLicense` and delete them in `afterAll`.</comment>

<file context>
@@ -0,0 +1,347 @@
+
+const userIds: string[] = []
+const organizationIds: string[] = []
+const subscriptionIds: string[] = []
+
+async function createUser(): Promise<string> {
</file context>

[waleedlatif1]

Closing: the window (a hosted Stripe checkout left open while the same organization links an AWS Marketplace license) is narrow and recoverable with a refund, and this fix would add a lock and a transaction to every Stripe subscription binding. Not worth the risk on that path.