fix(deleter): clean up all billing and kyc records during org delete (#1835)

Organization delete could fail halfway and leave the org without owners
and with a billing account pointing to a deleted Stripe customer.
Checkout and kyc rows were never removed, so their foreign keys made
the hard delete of billing_customers and organizations fail after the
Stripe customer was already gone. Retrying hit the same error forever.

- delete checkout rows before the billing customer row
- delete the org_kyc row before the org row
- delete credit transactions instead of orphaning them
- always remove local subscription and invoice rows, also for offline
  billing accounts
- tear down billing first and org policies near the end, so a failure
  at any step leaves the org owned and the delete retryable
- treat subscriptions already gone or canceled on the provider as
  canceled instead of failing the teardown

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: whoAbhishekSah

billing/checkout/service.go

@@ -63,6 +63,7 @@ type Repository interface {
 	Create(ctx context.Context, ch Checkout) (Checkout, error)
 	UpdateByID(ctx context.Context, ch Checkout) (Checkout, error)
 	List(ctx context.Context, filter Filter) ([]Checkout, error)
+	DeleteByCustomerID(ctx context.Context, customerID string) error
 }
 
 type CustomerService interface {
@@ -768,6 +769,12 @@ func (s *Service) List(ctx context.Context, filter Filter) ([]Checkout, error) {
 	return s.repository.List(ctx, filter)
 }
 
+// DeleteByCustomer removes all checkout records of a billing account. Checkout
+// sessions on the billing provider are not touched as they expire on their own.
+func (s *Service) DeleteByCustomer(ctx context.Context, customerID string) error {
+	return s.repository.DeleteByCustomerID(ctx, customerID)
+}
+
 func (s *Service) CreateSessionForPaymentMethod(ctx context.Context, ch Checkout) (Checkout, error) {
 	billingCustomer, err := s.customerService.RegisterToProviderIfRequired(ctx, ch.CustomerID)
 	if err != nil {

billing/credit/mocks/transaction_repository.go

@@ -20,6 +20,7 @@ type TransactionRepository interface {
 	GetByID(ctx context.Context, id string) (Transaction, error)
 	GetBalanceForRange(ctx context.Context, accountID string, start time.Time, end time.Time) (int64, error)
 	GetBalanceForRangeWithoutOverdraft(ctx context.Context, accountID string, start time.Time, end time.Time) (int64, error)
+	DeleteByAccountID(ctx context.Context, accountID string) error
 }
 
 type CustomerRepository interface {
@@ -175,6 +176,12 @@ func (s Service) GetByID(ctx context.Context, id string) (Transaction, error) {
 	return s.transactionRepository.GetByID(ctx, id)
 }
 
+// DeleteByAccountID removes all credit transactions of a billing account. It is
+// meant for account teardown; the deletion is recorded in audit records.
+func (s Service) DeleteByAccountID(ctx context.Context, accountID string) error {
+	return s.transactionRepository.DeleteByAccountID(ctx, accountID)
+}
+
 // createAuditRecord creates an audit record for billing transaction events.
 func (s Service) createAuditRecord(ctx context.Context, customerID string, eventType pkgAuditRecord.Event, txID string, txEntry Transaction) error {
 	customerAcc, err := s.customerRepository.GetByID(ctx, customerID)

billing/credit/service.go

@@ -304,11 +304,20 @@ func (s *Service) Cancel(ctx context.Context, id string, immediate bool) (Subscr
 	}
 
 	// check if schedule exists
-	_, stripeSchedule, err := s.createOrGetSchedule(ctx, sub)
+	stripeSubscription, stripeSchedule, err := s.createOrGetSchedule(ctx, sub)
 	if err != nil {
 		return sub, err
 	}
 
+	if stripeSubscription != nil && stripeSubscription.Status == stripe.SubscriptionStatusCanceled {
+		// already canceled on the provider, just sync the local state
+		sub.State = string(stripeSubscription.Status)
+		if stripeSubscription.CanceledAt > 0 {
+			sub.CanceledAt = utils.AsTimeFromEpoch(stripeSubscription.CanceledAt)
+		}
+		return s.repository.UpdateByID(ctx, sub)
+	}
+
 	if immediate || stripeSchedule == nil {
 		stripeSubscription, err := s.stripeClient.Subscriptions.Cancel(sub.ProviderID, &stripe.SubscriptionCancelParams{
 			Params: stripe.Params{
@@ -1076,19 +1085,21 @@ func (s *Service) ensureCreditsForPlan(ctx context.Context, sub Subscription, su
 	return nil
 }
 
+// DeleteByCustomer tears down all subscriptions of a billing account. Active
+// subscriptions are canceled on the billing provider first. A subscription
+// that is already gone or canceled on the provider counts as canceled, so a
+// teardown that failed midway can be run again. Offline accounts have nothing
+// on the provider; only their local records are removed.
 func (s *Service) DeleteByCustomer(ctx context.Context, customr customer.Customer) error {
 	subs, err := s.List(ctx, Filter{
 		CustomerID: customr.ID,
 	})
 	if err != nil {
 		return err
 	}
-	if err := s.SyncWithProvider(ctx, customr); err != nil {
-		return err
-	}
 	for _, sub := range subs {
-		if sub.IsActive() {
-			if _, err := s.Cancel(ctx, sub.ID, true); err != nil {
+		if !customr.IsOffline() && sub.IsActive() {
+			if _, err := s.Cancel(ctx, sub.ID, true); err != nil && !errors.Is(err, ErrSubscriptionOnProviderNotFound) {
 				return err
 			}
 		}

billing/subscription/service.go

@@ -618,7 +618,8 @@ func buildAPIDependencies(
 
 	cascadeDeleter := deleter.NewCascadeDeleter(organizationService, projectService, resourceService,
 		groupService, membershipService, policyService, roleService, invitationService, userService, userPATService,
-		serviceUserService, customerService, subscriptionService, invoiceService,
+		serviceUserService, customerService, subscriptionService, invoiceService, checkoutService,
+		creditService, orgKycService,
 	)
 
 	// we should default it with a stdout logger repository as postgres can start to bloat really fast