[PM-30908]Correct Premium subscription status handling

[cyprain-okeke]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-30908

📔 Objective

Fix premium subscription status handling to enable resubscription for users with canceled or expired subscriptions, and improve incomplete subscription payment retry logic.

Changes

API Layer (AccountBillingVNextController.cs:105)

• Return 404 Not Found when user has no subscription instead of 200 OK with null body

Payment Processing (PaymentMethodAttachedHandler.cs:107-136)

• Extend payment retry logic to handle both unpaid and incomplete subscription statuses
• Add safeguard to prevent overcharging when multiple incomplete subscriptions exist
• Log warning and skip retry when multiple incomplete subscriptions detected
• Improve logging messages to include subscription status

Subscription Management (SubscriptionUpdatedHandler.cs:120-131)

• Remove automatic cancellation logic for incomplete subscriptions with open invoices
• This prevents premature cancellation and enables proper resubscription flow

Premium Subscription Creation (CreatePremiumCloudHostedSubscriptionCommand.cs:75-154)

• Allow resubscription for users with canceled or incomplete_expired subscriptions
• Update payment method on resubscribe scenarios to use new payment method
• Accept incomplete status as valid for premium activation (in addition to active)
• Skip "already premium" validation for users with terminal subscription states

Subscription Query (GetBitwardenSubscriptionQuery.cs:41-46)

• Return null when user has no GatewaySubscriptionId instead of attempting to fetch subscription
• Change return type from BitwardenSubscription to BitwardenSubscription?

📸 Screenshots

https://github.com/user-attachments/assets/ccef0537-32ee-4920-9c39-fa79e10625a4
https://github.com/user-attachments/assets/4c7d71fc-3ce0-4a3a-b304-4dced91853a0
https://github.com/user-attachments/assets/ea66df1d-6d74-46e4-8fed-2e02bca804f1

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

Checkmarx One – Scan Summary & Details – 71fcf8e0-634b-4c48-8e36-91d1586a3978

Great job! No new security vulnerabilities introduced in this pull request

[codecov]

Codecov Report

❌ Patch coverage is 36.61972% with 45 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.05%. Comparing base (c812466) to head (2bbeb74).

Files with missing lines	Patch %	Lines
...es/Implementations/PaymentMethodAttachedHandler.cs	0.00%	26 Missing ⚠️
...ing/Payment/Commands/UpdatePaymentMethodCommand.cs	0.00%	13 Missing and 1 partial ⚠️
...nds/CreatePremiumCloudHostedSubscriptionCommand.cs	85.18%	2 Missing and 2 partials ⚠️
...Controllers/VNext/AccountBillingVNextController.cs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6877      +/-   ##
==========================================
- Coverage   56.08%   56.05%   -0.04%     
==========================================
  Files        1968     1968              
  Lines       86937    86977      +40     
  Branches     7744     7750       +6     
==========================================
- Hits        48756    48751       -5     
- Misses      36378    36422      +44     
- Partials     1803     1804       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kdenney]

Nice job; just a couple suggestions and a request for more tests. :)

[amorask-bitwarden]

A few things and a couple missed requirements:

1. We should no longer auto-cancel and void invoices for premium subscriptions that enter unpaid or incomplete_expired status. We should still disable premium.
2. The UpdatePaymentMethodCommand’s AddPayPalAsync method needs to be updated to do the same thing as Task 2 above (pay the single, incomplete subscription invoice) using the IBraintreeService.PayInvoice method when the user adds or replaces their PayPal payment method.