fix: update stripe team member billing (#2991)

packages/lib/jobs/client.ts

@@ -17,6 +17,7 @@ import { SEND_SIGNING_REJECTION_EMAILS_JOB_DEFINITION } from './definitions/emai
 import { SEND_SIGNING_EMAIL_JOB_DEFINITION } from './definitions/emails/send-signing-email';
 import { SEND_TEAM_DELETED_EMAIL_JOB_DEFINITION } from './definitions/emails/send-team-deleted-email';
 import { ADMIN_DELETE_ORGANISATION_JOB_DEFINITION } from './definitions/internal/admin-delete-organisation';
+import { ALERT_ORGANISATION_SEAT_DRIFT_JOB_DEFINITION } from './definitions/internal/alert-organisation-seat-drift';
 import { BACKPORT_SUBSCRIPTION_CLAIM_JOB_DEFINITION } from './definitions/internal/backport-subscription-claims';
 import { BULK_SEND_TEMPLATE_JOB_DEFINITION } from './definitions/internal/bulk-send-template';
 import { CANCEL_ORGANISATION_SUBSCRIPTION_JOB_DEFINITION } from './definitions/internal/cancel-organisation-subscription';
@@ -29,6 +30,7 @@ import { SEAL_DOCUMENT_JOB_DEFINITION } from './definitions/internal/seal-docume
 import { SEAL_DOCUMENT_SWEEP_JOB_DEFINITION } from './definitions/internal/seal-document-sweep';
 import { SEND_SIGNING_REMINDERS_SWEEP_JOB_DEFINITION } from './definitions/internal/send-signing-reminders-sweep';
 import { SYNC_EMAIL_DOMAINS_JOB_DEFINITION } from './definitions/internal/sync-email-domains';
+import { SYNC_ORGANISATION_SEATS_JOB_DEFINITION } from './definitions/internal/sync-organisation-seats';
 
 /**
  * The `as const` assertion is load bearing as it provides the correct level of type inference for
@@ -64,7 +66,9 @@ export const jobsClient = new JobClient([
   CLEANUP_RATE_LIMITS_JOB_DEFINITION,
   SYNC_EMAIL_DOMAINS_JOB_DEFINITION,
   ADMIN_DELETE_ORGANISATION_JOB_DEFINITION,
+  ALERT_ORGANISATION_SEAT_DRIFT_JOB_DEFINITION,
   CANCEL_ORGANISATION_SUBSCRIPTION_JOB_DEFINITION,
+  SYNC_ORGANISATION_SEATS_JOB_DEFINITION,
 ] as const);
 
 export const jobs = jobsClient;

packages/lib/jobs/definitions/internal/alert-organisation-seat-drift.handler.ts

@@ -0,0 +1,67 @@
+import { mailer } from '@documenso/email/mailer';
+import { prisma } from '@documenso/prisma';
+import { IS_BILLING_ENABLED, SUPPORT_EMAIL } from '../../../constants/app';
+import { DOCUMENSO_INTERNAL_EMAIL } from '../../../constants/email';
+import type { JobRunIO } from '../../client/_internal/job';
+import type { TAlertOrganisationSeatDriftJobDefinition } from './alert-organisation-seat-drift';
+
+/**
+ * Daily check for organisations whose member count exceeds their paid seat
+ * count (`organisationClaim.memberCount`, where `0` means unlimited).
+ */
+export const run = async ({ io }: { payload: TAlertOrganisationSeatDriftJobDefinition; io: JobRunIO }) => {
+  if (!IS_BILLING_ENABLED()) {
+    return;
+  }
+
+  const organisations = await prisma.organisation.findMany({
+    where: {
+      // Exclude unlimited-seat plans (memberCount === 0).
+      organisationClaim: {
+        memberCount: {
+          not: 0,
+        },
+      },
+    },
+    select: {
+      id: true,
+      name: true,
+      organisationClaim: {
+        select: {
+          memberCount: true,
+        },
+      },
+      _count: {
+        select: {
+          members: true,
+        },
+      },
+    },
+  });
+
+  const driftedOrganisations = organisations.filter(
+    (organisation) =>
+      organisation.organisationClaim !== null &&
+      organisation._count.members > organisation.organisationClaim.memberCount,
+  );
+
+  if (driftedOrganisations.length === 0) {
+    io.logger.info('No organisations exceed their paid seat count');
+
+    return;
+  }
+
+  await mailer.sendMail({
+    to: SUPPORT_EMAIL,
+    from: DOCUMENSO_INTERNAL_EMAIL,
+    subject: `[Billing] ${driftedOrganisations.length} organisation(s) exceed their paid seat count`,
+    text: [
+      `${driftedOrganisations.length} organisation(s) have more members than their paid seat count:`,
+      '',
+      ...driftedOrganisations.map(
+        (organisation) =>
+          `- ${organisation.name} (${organisation.id}): ${organisation._count.members} members vs ${organisation.organisationClaim?.memberCount ?? 0} paid seats`,
+      ),
+    ].join('\n'),
+  });
+};

packages/lib/jobs/definitions/internal/alert-organisation-seat-drift.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+
+import type { JobDefinition } from '../../client/_internal/job';
+
+const ALERT_ORGANISATION_SEAT_DRIFT_JOB_DEFINITION_ID = 'internal.alert-organisation-seat-drift';
+
+const ALERT_ORGANISATION_SEAT_DRIFT_JOB_DEFINITION_SCHEMA = z.object({});
+
+export type TAlertOrganisationSeatDriftJobDefinition = z.infer<
+  typeof ALERT_ORGANISATION_SEAT_DRIFT_JOB_DEFINITION_SCHEMA
+>;
+
+export const ALERT_ORGANISATION_SEAT_DRIFT_JOB_DEFINITION = {
+  id: ALERT_ORGANISATION_SEAT_DRIFT_JOB_DEFINITION_ID,
+  name: 'Alert Organisation Seat Drift',
+  version: '1.0.0',
+  trigger: {
+    name: ALERT_ORGANISATION_SEAT_DRIFT_JOB_DEFINITION_ID,
+    schema: ALERT_ORGANISATION_SEAT_DRIFT_JOB_DEFINITION_SCHEMA,
+    cron: '0 0 * * *', // Once a day at midnight.
+  },
+  handler: async ({ payload, io }) => {
+    const handler = await import('./alert-organisation-seat-drift.handler');
+
+    await handler.run({ payload, io });
+  },
+} as const satisfies JobDefinition<
+  typeof ALERT_ORGANISATION_SEAT_DRIFT_JOB_DEFINITION_ID,
+  TAlertOrganisationSeatDriftJobDefinition
+>;

packages/lib/jobs/definitions/internal/sync-organisation-seats.handler.ts

@@ -0,0 +1,54 @@
+import { syncMemberCountWithStripeSeatPlan } from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
+import { prisma } from '@documenso/prisma';
+import { SubscriptionStatus } from '@prisma/client';
+import { IS_BILLING_ENABLED } from '../../../constants/app';
+import type { JobRunIO } from '../../client/_internal/job';
+import type { TSyncOrganisationSeatsJobDefinition } from './sync-organisation-seats';
+
+export const run = async ({ payload }: { payload: TSyncOrganisationSeatsJobDefinition; io: JobRunIO }) => {
+  const { organisationId } = payload;
+
+  if (!IS_BILLING_ENABLED()) {
+    return;
+  }
+
+  const organisation = await prisma.organisation.findUnique({
+    where: {
+      id: organisationId,
+    },
+    include: {
+      subscription: true,
+      organisationClaim: true,
+    },
+  });
+
+  if (!organisation || !organisation.subscription) {
+    return;
+  }
+
+  // Skip canceled/terminal subscriptions — Stripe rejects quantity updates on a
+  // canceled subscription. PAST_DUE is still live and a no-proration shrink is
+  // safe, so it's allowed through.
+  if (organisation.subscription.status === SubscriptionStatus.INACTIVE) {
+    return;
+  }
+
+  const memberCount = await prisma.organisationMember.count({
+    where: {
+      organisationId,
+    },
+  });
+
+  // An organisation always retains its owner; guarding zero avoids writing the
+  // unlimited sentinel to the claim.
+  if (memberCount === 0) {
+    return;
+  }
+
+  await syncMemberCountWithStripeSeatPlan(
+    organisation.subscription,
+    organisation.organisationClaim,
+    memberCount,
+    'shrink',
+  );
+};

packages/lib/jobs/definitions/internal/sync-organisation-seats.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+
+import type { JobDefinition } from '../../client/_internal/job';
+
+const SYNC_ORGANISATION_SEATS_JOB_DEFINITION_ID = 'internal.sync-organisation-seats';
+
+const SYNC_ORGANISATION_SEATS_JOB_DEFINITION_SCHEMA = z.object({
+  organisationId: z.string(),
+});
+
+export type TSyncOrganisationSeatsJobDefinition = z.infer<typeof SYNC_ORGANISATION_SEATS_JOB_DEFINITION_SCHEMA>;
+
+export const SYNC_ORGANISATION_SEATS_JOB_DEFINITION = {
+  id: SYNC_ORGANISATION_SEATS_JOB_DEFINITION_ID,
+  name: 'Sync Organisation Seats',
+  version: '1.0.0',
+  trigger: {
+    name: SYNC_ORGANISATION_SEATS_JOB_DEFINITION_ID,
+    schema: SYNC_ORGANISATION_SEATS_JOB_DEFINITION_SCHEMA,
+  },
+  handler: async ({ payload, io }) => {
+    const handler = await import('./sync-organisation-seats.handler');
+
+    await handler.run({ payload, io });
+  },
+} as const satisfies JobDefinition<
+  typeof SYNC_ORGANISATION_SEATS_JOB_DEFINITION_ID,
+  TSyncOrganisationSeatsJobDefinition
+>;

packages/lib/server-only/organisation/accept-organisation-invitation.ts

@@ -1,7 +1,12 @@
+import {
+  assertMemberCountWithinCap,
+  syncMemberCountWithStripeSeatPlan,
+} from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
 import { prisma } from '@documenso/prisma';
 import type { OrganisationGroup, OrganisationMemberRole } from '@prisma/client';
-import { OrganisationGroupType, OrganisationMemberInviteStatus } from '@prisma/client';
+import { OrganisationGroupType, OrganisationMemberInviteStatus, SubscriptionStatus } from '@prisma/client';
 
+import { IS_BILLING_ENABLED } from '../../constants/app';
 import { AppError, AppErrorCode } from '../../errors/app-error';
 import { jobs } from '../../jobs/client';
 import { generateDatabaseId } from '../../universal/id';
@@ -22,6 +27,13 @@ export const acceptOrganisationInvitation = async ({ token }: AcceptOrganisation
       organisation: {
         include: {
           groups: true,
+          organisationClaim: true,
+          subscription: true,
+          members: {
+            select: {
+              id: true,
+            },
+          },
         },
       },
     },
@@ -66,6 +78,35 @@ export const acceptOrganisationInvitation = async ({ token }: AcceptOrganisation
     return;
   }
 
+  const newMemberCount = organisation.members.length + 1;
+
+  // Billing occurs when a user accepts an invite.
+  // Assert that the new member count is within the cap and sync the seat plan with Stripe.
+  if (IS_BILLING_ENABLED()) {
+    const { subscription, organisationClaim } = organisation;
+
+    // A canceled subscription cannot have its seat quantity updated in Stripe,
+    // and an organisation with lapsed billing should not gain new members.
+    // Throw a deliberate error so the invite page can render an accurate
+    // message instead of an opaque Stripe failure.
+    if (subscription && subscription.status === SubscriptionStatus.INACTIVE) {
+      throw new AppError('SUBSCRIPTION_INACTIVE', {
+        message: 'The organisation subscription is inactive',
+      });
+    }
+
+    // Organisations can exist without a subscription (e.g. after being
+    // downgraded to the free plan). The claim cap remains authoritative in
+    // that case, surfacing LIMIT_EXCEEDED instead of an opaque "subscription
+    // not found" error.
+    await assertMemberCountWithinCap(subscription, organisationClaim, newMemberCount);
+
+    if (subscription) {
+      await syncMemberCountWithStripeSeatPlan(subscription, organisationClaim, newMemberCount, 'grow');
+    }
+  }
+
+  // Todo: Logging
   await addUserToOrganisation({
     userId: user.id,
     organisationId: organisation.id,

packages/lib/server-only/organisation/create-organisation-member-invites.ts

@@ -1,7 +1,3 @@
-import {
-  assertMemberCountWithinCap,
-  syncMemberCountWithStripeSeatPlan,
-} from '@documenso/ee/server-only/stripe/update-subscription-item-quantity';
 import { OrganisationInviteEmailTemplate } from '@documenso/email/templates/organisation-invite';
 import { NEXT_PUBLIC_WEBAPP_URL } from '@documenso/lib/constants/app';
 import { ORGANISATION_MEMBER_ROLE_PERMISSIONS_MAP } from '@documenso/lib/constants/organisations';
@@ -17,7 +13,6 @@ import { createElement } from 'react';
 
 import { getI18nInstance } from '../../client-only/providers/i18n-server';
 import { generateDatabaseId } from '../../universal/id';
-import { validateIfSubscriptionIsRequired } from '../../utils/billing';
 import { buildOrganisationWhereQuery } from '../../utils/organisations';
 import { renderEmailWithI18N } from '../../utils/render-email-with-i18n';
 import { getEmailContext } from '../email/get-email-context';
@@ -62,8 +57,6 @@ export const createOrganisationMemberInvites = async ({
         },
       },
       organisationGlobalSettings: true,
-      organisationClaim: true,
-      subscription: true,
     },
   });
 
@@ -71,10 +64,6 @@ export const createOrganisationMemberInvites = async ({
     throw new AppError(AppErrorCode.NOT_FOUND);
   }
 
-  const { organisationClaim } = organisation;
-
-  const subscription = validateIfSubscriptionIsRequired(organisation.subscription);
-
   const currentOrganisationMemberRole = await getMemberOrganisationRole({
     organisationId: organisation.id,
     reference: {
@@ -120,19 +109,6 @@ export const createOrganisationMemberInvites = async ({
     }),
   );
 
-  const numberOfCurrentMembers = organisation.members.length;
-  const numberOfCurrentInvites = organisation.invites.length;
-  const numberOfNewInvites = organisationMemberInvites.length;
-
-  const totalMemberCountWithInvites = numberOfCurrentMembers + numberOfCurrentInvites + numberOfNewInvites;
-
-  // Enforce the seat cap and sync billing for seat based plans.
-  if (subscription) {
-    await assertMemberCountWithinCap(subscription, organisationClaim, totalMemberCountWithInvites);
-
-    await syncMemberCountWithStripeSeatPlan(subscription, organisationClaim, totalMemberCountWithInvites);
-  }
-
   await prisma.organisationMemberInvite.createMany({
     data: organisationMemberInvites,
   });

packages/lib/server-only/user/delete-user.ts

@@ -1,6 +1,7 @@
 import { prisma } from '@documenso/prisma';
 
 import { AppError, AppErrorCode } from '../../errors/app-error';
+import { jobs } from '../../jobs/client';
 import { deleteOrganisation } from '../organisation/delete-organisation';
 
 export type DeleteUserOptions = {
@@ -59,6 +60,13 @@ export const deleteUser = async ({ id }: DeleteUserOptions) => {
       })),
     );
 
+  // Organisations the user is a member of (but not owner). Owned organisations
+  // are fully torn down below (including subscription cancellation), so only
+  // these need a seat sync after the user's memberships cascade away.
+  const memberOrganisationIds = user.organisationMember
+    .filter((member) => member.organisation.ownerUserId !== user.id)
+    .map((member) => member.organisationId);
+
   // For organisations the user owns - fully tear them down (orphan envelopes,
   // delete the organisation, and cancel any Stripe subscription). Without this
   // the organisations would only cascade away when the user row is deleted,
@@ -82,9 +90,21 @@ export const deleteUser = async ({ id }: DeleteUserOptions) => {
     }),
   );
 
-  return await prisma.user.delete({
+  const deletedUser = await prisma.user.delete({
     where: {
       id: user.id,
     },
   });
+
+  // The user's memberships were cascade-deleted with the user row — queue a
+  // seat sync for each organisation they belonged to so the Stripe quantity
+  // trues down to the new member count (no proration, no credit).
+  for (const organisationId of memberOrganisationIds) {
+    await jobs.triggerJob({
+      name: 'internal.sync-organisation-seats',
+      payload: { organisationId },
+    });
+  }
+
+  return deletedUser;
 };