[thomasluizon]

Confirming account deletion now stops subscription renewal through a durable Hangfire job while preserving the paid period and the existing deletion schedule. Provider failures escape the job for retry and leave confirmation successful.

Closes thomasluizon/orbit-tickets#115. Implements ORB-109.

Intended approach

• IBillingService and StripeBillingService update cancel_at_period_end in either direction with the existing retry and exception wrapper. They never immediately cancel the subscription.
• IPlayBillingService and GooglePlayBillingService call Publisher v2 cancel. The job verifies the purchase first and skips inactive or unknown purchases. Paid entitlement is unchanged.
• ConfirmAccountDeletionCommand saves deactivation, then queues CancelSubscriptionOnDeletionJob with primitive provider identifiers. Hangfire retries failures at 60 seconds, 300 seconds, then hourly. The job locks and reloads the current user, preventing delayed cancellation or restoration from reversing a later account action.
• VerifyCodeCommand and the shared GoogleSignInFlow queue Stripe restoration after reactivation only while the paid period remains unexpired. The shared flow covers Google auth and OAuth callbacks. User.CancelDeactivation returns an expired subscription to the free plan without dropping identifiers that the deletion backstop may need. Play reactivation does not restore renewal from the server; the person must resume in the Play Store.
• AccountDeletionService rechecks deletion eligibility under the same user row lock and checks both retained provider identifiers before deleting any owned data or removing the user. Failed provider calls retain the row for another scheduled attempt. Already stopped Stripe subscriptions do not receive another update.
• Unit coverage follows the confirmation, job, domain, Google auth, and OAuth paths. The hard-delete tests drive the actual scheduled service with the existing SQLite unit-test factory, asserting provider cancellation before removal and row retention on failure.

No endpoint or DTO contract changes, migrations, dependency updates, or new configuration are required. The OpenAPI documents remain unchanged after the build.

External interface evidence

Verified the installed assemblies with ilspycmd and their accompanying XML documentation, rather than deriving new provider fields from mocks:

• Stripe.net 52.4.2: Stripe.SubscriptionUpdateOptions.CancelAtPeriodEnd is a nullable bool serialized as cancel_at_period_end. Stripe.SubscriptionService.UpdateAsync(string, SubscriptionUpdateOptions, RequestOptions, CancellationToken) posts to /v1/subscriptions/{id}; CancelAsync instead sends DELETE. Stripe.Subscription exposes status and cancel_at_period_end; its status documentation includes canceled and incomplete_expired. The backstop uses those verified fields through the existing billing DTO. Provider tests assert update arguments, error wrapping, transient retries, and no immediate cancellation.
• Android Publisher 1.77.0.4284: PurchasesResource.Subscriptionsv2Resource.Cancel(CancelSubscriptionPurchaseRequest, string packageName, string token) creates a POST to androidpublisher/v3/applications/{packageName}/purchases/subscriptionsv2/tokens/{token}:cancel. CancelSubscriptionPurchaseRequest.CancellationContext and CancellationContext.CancellationType are required. The Google API reference confirms USER_REQUESTED_STOP_RENEWALS and an empty success response. The live Publisher discovery schema was also read: schemas.CancellationContext.properties.cancellationType.enum contains CANCELLATION_TYPE_UNSPECIFIED, USER_REQUESTED_STOP_RENEWALS, and DEVELOPER_REQUESTED_STOP_PAYMENTS. A unit test captures the actual SDK request and asserts its method, path, and serialized context, with an empty success body.
• Hangfire.Core 1.8.25: Hangfire.Common.Job exposes Type, Method, and Args, which the queue tests inspect. AutomaticRetryAttribute repeats the last configured delay after exhausting its delay array, so hourly retries continue instead of abandoning billing cancellation after the default attempt limit.

Reproduce the installed-source checks with ilspycmd -t <type> <assembly> using these package-relative assemblies:

stripe.net/52.4.2/lib/net9.0/Stripe.net.dll
  Stripe.SubscriptionUpdateOptions
  Stripe.SubscriptionService
  Stripe.Subscription
google.apis.androidpublisher.v3/1.77.0.4284/lib/net6.0/Google.Apis.AndroidPublisher.v3.dll
  Google.Apis.AndroidPublisher.v3.PurchasesResource
  Google.Apis.AndroidPublisher.v3.Data.CancelSubscriptionPurchaseRequest
  Google.Apis.AndroidPublisher.v3.Data.CancellationContext
hangfire.core/1.8.25/lib/netstandard2.0/Hangfire.Core.dll
  Hangfire.Common.Job
  Hangfire.AutomaticRetryAttribute

Assumptions

• Preserve the checked-out handler's existing 30-day grace cap, rejecting the older ticket excerpt that omitted the cap. The existing boundary tests remain unchanged in their scheduling assertions.
• Restore Google and OAuth accounts in their shared GoogleSignInFlow, rejecting edits to obsolete direct CancelDeactivation callsites. The OAuth regression test drives controller, command handlers, and the shared flow together.
• Supply the required Play USER_REQUESTED_STOP_RENEWALS context, rejecting the ticket's empty request body. This follows the decision that the person can resume in the Play Store; the API does not attempt a server-side restoration.
• Reconcile delayed jobs against the current account state under a row lock, rejecting unconditional replay of stale cancel or restore arguments.
• Used seven days overdue instead of a persisted attempt counter, avoiding a migration.
• Used 26 retries with the existing delays instead of indefinite retries.

Retained the existing tested seven-day billing handoff. The snapshot merged without conflicts, so regeneration was unnecessary.

Test evidence

Before implementation, the unchanged suite passed with the defect present:

dotnet test tests/Orbit.Application.Tests --filter FullyQualifiedName~ConfirmAccountDeletionCommandHandlerTests --verbosity quiet
15 passed, 0 failed.

Strengthened Handle_ProPlanWithinGraceCap_SchedulesDeletionSevenDaysAfterPlanExpiry to require one queued billing job. With production code still unchanged:

dotnet test tests/Orbit.Application.Tests --filter FullyQualifiedName~Handle_ProPlanWithinGraceCap_SchedulesDeletionSevenDaysAfterPlanExpiry --verbosity quiet
0 passed, 1 failed.

The detailed rerun with --no-build --logger 'console;verbosity=normal' reported ReceivedCallsException: expected one Create(any Job, any IState) call, received none. After implementation, the same strengthened test passed in the focused confirmation suite. Additional confirmation cases assert the provider-specific job arguments, preserved expiry, unchanged grace math, no queue work for free/trial users, and successful confirmation followed by a retryable provider failure.

The restoration expiry test also passed for ordinary subscriptions before strengthening it with lifetime access. The strengthened ExecuteAsync_Restoration_OnlyRestoresBeforeExpiry initially failed for expired: true, lifetime: true; after checking the actual paid-period end, all four combinations pass.

The first broader run exposed missing job-client wiring in the existing concurrency fixture and eager billing resolution on free-account hard deletion. Both were corrected, and targeted reruns passed: 52 application cases and 28 deletion-service cases, including the existing deletion, marketing opt-out, and concurrency tests.

Final validation:

dotnet build Orbit.slnx --verbosity quiet
Exit 0, 0 errors. Existing package/API warnings remain.

dotnet test tests/Orbit.Domain.Tests --no-build --verbosity quiet
Exit 0: 675 passed, 0 failed.

dotnet test tests/Orbit.Application.Tests --no-build --verbosity quiet
Exit 0: 5519 passed, 0 failed.

dotnet test tests/Orbit.Infrastructure.Tests --no-build --verbosity quiet
Exit 0: 3372 passed, 0 failed.

dotnet test tests/Orbit.Analyzers.Tests --no-build --verbosity quiet
Exit 0: 32 passed, 0 failed.

All 9598 tests passed. Focused confirmation/job/reactivation/orphan-webhook coverage also passed (50 application cases), as did focused provider/deletion/OAuth coverage (51 infrastructure cases). Source search found one Users.Remove path, guarded by the cancellation backstop; free accounts skip billing dependency resolution entirely. No new bare narration comments were introduced. Formatting, dash, timeless-text, root-allowlist, and suppression-allowlist hooks passed. No server, browser, live database, or mutation testing was used.

Exact regression commands:

dotnet test tests/Orbit.Application.Tests --filter FullyQualifiedName~CancelSubscriptionOnDeletionJobTests
dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~AccountDeletionServiceTests|FullyQualifiedName~StripeBillingServiceTests|FullyQualifiedName~GooglePlayBillingServiceTests'

Suite	Unchanged tests, defective head	Strengthened tests, defective head	Fixed
Application focused	19 passed	4 failed	21 passed
Infrastructure focused	47 passed	16 failed	73 passed

Finding 1 regressions include GetSubscriptionDetailsAsync_MissingSubscription_ReturnsNull, VerifyAsync_MissingPurchase_ReturnsNull, and RunAsync_DuePaidAccount_CancelsBeforeRemovingAndRetainsRowOnFailure. Finding 2’s ExecuteAsync_ProviderFailure_PropagatesForDurableRetry failed because retries were 2147483647 instead of bounded.

The additional null-queue regression failed before its guard was added, then passed.

Final checks, all exit 0:

• dotnet build Orbit.slnx: zero errors.
• dotnet test tests/Orbit.Domain.Tests: 675 passed.
• dotnet test tests/Orbit.Application.Tests: 5,521 passed.
• dotnet test tests/Orbit.Infrastructure.Tests: 3,398 passed.
• All commit hooks passed. Generated OpenAPI files were unchanged.

External members were verified against package-pinned source: Stripe exception members and error code mapping, Google HTTP status, and Hangfire retry behavior, nullable creation result, and job arguments. Missing-record semantics match Stripe’s codes and Play’s HTTP errors.

All required commands exited 0:

• dotnet build: zero errors.
• git diff --exit-code -- src/Orbit.Api/openapi.json: no drift.
• dotnet test tests/Orbit.Domain.Tests: 730 passed.
• dotnet test tests/Orbit.Application.Tests: 5,547 passed.
• dotnet test tests/Orbit.Infrastructure.Tests: 3,553 passed.
• dotnet test tests/Orbit.Analyzers.Tests: 32 passed.

Regression proof using dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~AccountDeletionServiceTests.RunAsync_DuePaidAccount_CancelsBeforeRemovingAndRetainsRowOnFailure:

• Original assertions, with storage registered: 15 passed with the incorrect uploads-first order.
• Strengthened assertions: five failed because upload deletion was attempted before billing failure retained the account.
• After correcting the order, dotnet test tests/Orbit.Infrastructure.Tests --no-build --filter FullyQualifiedName~AccountDeletionService: all 42 passed.

Manual steps

None. No new configuration, secrets, migrations or backfills are required.

None introduced by this merge.

[pullfrog]

Caution

This PR can restart customer-canceled Stripe renewals and leave linked Play subscriptions renewing after deletion. The three billing issues below should be addressed before merging.

Reviewed changes: Reviewed the account-deletion cancellation flow, provider adapters, reactivation paths, hard-delete backstop, and associated tests across all 24 changed files.

• Durable cancellation: Confirmation queues provider work that reconciles current account state under a row lock and retries provider failures.
• Provider operations: Stripe updates period-end cancellation, while Play uses Publisher v2 user-requested cancellation without revoking the paid period.
• Reactivation: Email and Google/OAuth sign-in queue Stripe restoration for unexpired paid periods, and expired non-lifetime plans return to Free.
• Deletion backstop: Scheduled deletion checks retained provider identifiers before removing the account and retains the row on provider failure.
• Verification: All 100 focused application and infrastructure unit tests passed; the scenarios identified below are not covered by those assertions.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

Important

No new High or Critical issues found in this commit. The existing blocking billing threads remain unresolved, so this review does not approve the PR.

Reviewed changes: Reviewed 452fdc96 against the previous review at cbd4b0e1, with the full PR diff as context.

• Bounded cancellation retries to 26 attempts, retaining exhausted work in Hangfire's failed state for manual recovery.
• Added erasure handoff after seven days overdue, persisting provider identifiers before deletion and refusing erasure when enqueueing fails.
• Enabled post-erasure cancellation using retained job arguments without permitting restoration for a missing user, and attempted both providers independently.
• Handled missing provider records and timeouts, treating confirmed missing records as completed work while preserving retryable provider failures and caller cancellation.
• Verified focused regression coverage with 39 application and 73 infrastructure unit tests passing.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new High or Critical issues found.

Reviewed changes: Reviewed 9d225cf1 since the prior Pullfrog review at 452fdc96, with the full PR diff as context. All three resolved findings have fix explanations supported by the current implementation and regression tests.

• Persisted renewal ownership: Added guarded domain state and an EF migration so reactivation restores only Stripe renewal actually stopped by account deletion, preserving independent cancellation intent.
• Separated Play renewability: Added CanRenew independently of entitlement, allowing paused and on-hold auto-renewing purchases to be canceled without granting paid access.
• Reconciled both providers: Queued every retained provider identifier regardless of entitlement ownership and committed successful cancellation ownership before retrying another provider's failure, including the hard-delete backstop.
• Extracted Google notifications: Moved existing welcome-email and referral effects into the registered GoogleSignInNotifications service without changing their behavior.
• Verified regressions: Passed all 275 focused unit tests: 92 Application, 16 Domain, and 167 Infrastructure, covering billing adapters, persistence/reload, deletion, retries, and email/Google/OAuth reactivation. The full suite was not rerun locally.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new High or Critical issues found.

Reviewed changes: Reviewed the merge at 489e9289 since the prior Pullfrog review at 9d225cf1, with the full PR diff as context.

• Preserved erasure ordering: Integrated main's upload cleanup after successful billing reconciliation or durable cancellation handoff, keeping uploads intact when billing or enqueueing fails.
• Strengthened regression coverage: Added a populated object store to the paid-account deletion cases and asserted that retained accounts keep their uploads while completed erasure removes them.
• Verified combined paths: Passed all 45 focused deletion-service and cancellation-persistence unit tests, including storage retries, provider failures, and post-erasure cancellation. The full suite was not rerun locally.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new High or Critical issues found.

Reviewed changes: Reviewed the merge at 0ff557f7 since the prior Pullfrog review at 489e9289, with the full PR diff as context.

• Preserved transactional restoration: Retained Stripe restoration after successful email and Google/OAuth reactivation while integrating main's transactional user provisioning and session creation.
• Integrated durable signup work: Preserved signup-job dispatch alongside renewal restoration, replacing the earlier Google notification extraction with main's shared durable signup flow.
• Strengthened merged assertions: Distinguished restoration jobs from signup jobs across email, Google token, Google code, and OAuth callback tests, and retained migration-model checks for both renewal-ownership columns.
• Verified combined behavior: Passed all 277 focused unit tests: 100 Application and 177 Infrastructure, covering reactivation, signup dispatch and concurrency, migration composition, deletion, and cancellation persistence. The full suite was not rerun locally.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
99.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud