fix(admin): block org delete on any live subscription, not just entitled ones

ENTITLED_SUBSCRIPTION_STATUSES excludes trialing, so a trial — which grants no
entitlement but is a live Stripe subscription that will convert — slipped past
the delete guard and could be stranded against a removed organization id.

Adds TERMINAL_SUBSCRIPTION_STATUSES and inverts the predicate: block unless the
row is finished. Expressed as the terminal set so a status Stripe adds later
defaults to blocking, which is the safe direction for a destructive operation.

Author: icecrasher321

apps/sim/app/api/v1/admin/organizations/[id]/route.ts

@@ -34,7 +34,7 @@ import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import { member, organization, subscription } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, count, eq, inArray } from 'drizzle-orm'
+import { and, count, eq, inArray, isNull, not, or } from 'drizzle-orm'
 import {
   adminV1DeleteOrganizationContract,
   adminV1GetOrganizationContract,
@@ -47,7 +47,10 @@ import {
   OrganizationSlugTakenError,
   validateOrganizationSlugOrThrow,
 } from '@/lib/billing/organizations/create-organization'
-import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
+import {
+  ENTITLED_SUBSCRIPTION_STATUSES,
+  TERMINAL_SUBSCRIPTION_STATUSES,
+} from '@/lib/billing/subscriptions/utils'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { detachOrganizationWorkspaces } from '@/lib/workspaces/organization-workspaces'
 import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
@@ -243,17 +246,23 @@ export const DELETE = withRouteHandler(
        * would strand it, and its Stripe billing, against an id that no longer
        * resolves. Refuse instead of guessing whether to cancel.
        *
-       * Scoped to entitled statuses. A canceled or ended row bills nobody, so
-       * treating it as a blocker would make an organization that once had a
-       * subscription permanently undeletable.
+       * Scoped to non-terminal rows. A canceled row bills nobody, so treating
+       * it as a blocker would make an organization that once had a
+       * subscription permanently undeletable — but entitlement is the wrong
+       * test in the other direction too, since a `trialing` subscription grants
+       * nothing today and is still live in Stripe. A null status is unknown, so
+       * it blocks.
        */
       const [existingSubscription] = await db
         .select({ id: subscription.id, plan: subscription.plan })
         .from(subscription)
         .where(
           and(
             eq(subscription.referenceId, organizationId),
-            inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES)
+            or(
+              isNull(subscription.status),
+              not(inArray(subscription.status, TERMINAL_SUBSCRIPTION_STATUSES))
+            )
           )
         )
         .limit(1)

apps/sim/lib/billing/subscriptions/utils.test.ts

@@ -11,6 +11,7 @@ import {
   hasPaidSubscriptionStatus,
   hasUsableSubscriptionAccess,
   hasUsableSubscriptionStatus,
+  TERMINAL_SUBSCRIPTION_STATUSES,
 } from '@/lib/billing/subscriptions/utils'
 
 describe('billing subscription status helpers', () => {
@@ -50,3 +51,28 @@ describe('billing subscription status helpers', () => {
     expect(getEffectiveSeats({ plan: 'team_8000', status: 'canceled', seats: null })).toBe(0)
   })
 })
+
+describe('TERMINAL_SUBSCRIPTION_STATUSES', () => {
+  const terminal = TERMINAL_SUBSCRIPTION_STATUSES as readonly string[]
+
+  it('covers only the statuses that can no longer bill', () => {
+    expect(terminal).toEqual(['canceled', 'incomplete_expired'])
+  })
+
+  it('does not treat trialing as terminal', () => {
+    /**
+     * A trial grants no entitlement, so it is absent from
+     * ENTITLED_SUBSCRIPTION_STATUSES — but it is a live Stripe subscription
+     * that will convert. Anything keying off "is this row still real" must not
+     * reuse the entitlement set, or it will happily delete out from under an
+     * active trial.
+     */
+    expect(terminal).not.toContain('trialing')
+  })
+
+  it('treats every other live status as non-terminal', () => {
+    for (const status of ['active', 'past_due', 'unpaid', 'trialing', 'incomplete']) {
+      expect(terminal).not.toContain(status)
+    }
+  })
+})

apps/sim/lib/billing/subscriptions/utils.ts

@@ -20,6 +20,22 @@ export const ENTITLED_SUBSCRIPTION_STATUSES = ['active', 'past_due'] as const
 
 export const USABLE_SUBSCRIPTION_STATUSES = ['active'] as const
 
+/**
+ * Statuses where the subscription is finished and can no longer bill anyone.
+ *
+ * The inverse of this set — `active`, `past_due`, `unpaid`, `trialing`,
+ * `incomplete` — is still attached to a live Stripe subscription that can
+ * convert or retry, even where it grants no entitlement today. Use this, not
+ * {@link ENTITLED_SUBSCRIPTION_STATUSES}, when the question is "would removing
+ * the thing this row points at strand live billing?" — a `trialing`
+ * subscription is unentitled but very much alive.
+ *
+ * Deliberately expressed as the terminal set rather than the live one, so a
+ * status Stripe adds later is treated as live by default. For a destructive
+ * operation that is the safe direction to be wrong in.
+ */
+export const TERMINAL_SUBSCRIPTION_STATUSES = ['canceled', 'incomplete_expired'] as const
+
 /**
  * Returns true when a subscription should still count as a paid plan entitlement.
  */