- 14-day cooling-off (UK / EU consumers). If you buy a - paid subscription as a consumer, you have 14 days from the day of - purchase to cancel and receive a full refund of that purchase, under - the Consumer Contracts (Information, Cancellation and Additional - Charges) Regulations 2013. As noted in clause 5, if you start using - a paid feature inside the cancellation window you lose the right to - cancel in respect of digital content already delivered. + 14-day cooling-off period (UK / EU consumers). + The Consumer Contracts (Information, Cancellation and Additional + Charges) Regulations 2013 give consumers a 14-day right to cancel + digital service contracts. We honour this right in different ways + depending on your billing cadence. +
++ 1a. Annual subscriptions. Every new annual + subscription begins with a 14-day free trial. No payment is taken + during the trial; cancel any time before the trial ends and you + are not charged. This is offered as a substitute for, and is at + least as generous as, the statutory 14-day refund right. After + the trial ends and the first payment is taken, the rules in + paragraph 2 below apply. +
++ 1b. Monthly subscriptions. Monthly subscribers + receive immediate access to paid features at checkout and are + billed on day one. Before you can start a monthly subscription + you must tick a required consent box on the pricing page in + which you (i) agree to these Terms, (ii) give express consent to + begin performance immediately, and (iii) acknowledge that, under + Regulation 36 of the Consumer Contracts Regulations 2013, doing + so extinguishes your statutory 14-day right to cancel in respect + of digital content already delivered. The rules in paragraph 2 + below apply from the first day.
Cancellation after the cooling-off window. You can diff --git a/tests/test_stripe_billing.py b/tests/test_stripe_billing.py index 61bf410..f00e72d 100644 --- a/tests/test_stripe_billing.py +++ b/tests/test_stripe_billing.py @@ -190,6 +190,110 @@ def test_subscription_deleted_drops_tier_to_free(tmp_path): assert sid is None +def test_subscription_trialing_stores_trial_end(tmp_path): + """customer.subscription.created with status=trialing + trial_end + should grant paid AND persist the trial_end timestamp so the + settings page can show 'N days remaining'. + + Realistic flow: checkout.session.completed fires first (linking + customer_id to user.id via client_reference_id), then + subscription.created fires moments later carrying trial_end.""" + import datetime as _dt + client, factory, _ = _build_app(tmp_path) + # First: link the user to the Stripe customer via checkout. + _post_webhook(client, body={ + "id": "evt_link", + "type": "checkout.session.completed", + "data": {"object": { + "client_reference_id": "1", + "customer": "cus_trial", + "subscription": "sub_trial", + }}, + }) + # Then: the subscription event carrying trial_end (12 days out). + trial_end_ts = int((_dt.datetime.now(_dt.timezone.utc) + + _dt.timedelta(days=12)).timestamp()) + r = _post_webhook(client, body={ + "id": "evt_trial", + "type": "customer.subscription.created", + "data": {"object": { + "id": "sub_trial", + "customer": "cus_trial", + "status": "trialing", + "trial_end": trial_end_ts, + }}, + }) + assert r.status_code == 200, r.text + + async def _check(): + from sqlalchemy import select + from app.models import User + async with factory() as session: + u = (await session.execute( + select(User).where(User.id == 1) + )).scalar_one() + return u.tier, u.stripe_trial_end_at + + tier, end = asyncio.run(_check()) + assert tier == "paid", "trial users must have paid features" + assert end is not None + # Stored value should match the trial_end we sent (within a second). + expected = _dt.datetime.fromtimestamp(trial_end_ts, tz=_dt.timezone.utc) + if end.tzinfo is None: + end = end.replace(tzinfo=_dt.timezone.utc) + assert abs((end - expected).total_seconds()) < 2 + + +def test_subscription_active_clears_trial_end(tmp_path): + """When the subscription transitions trialing -> active (day 15), + the trial_end marker should be cleared so settings stops showing + 'trial — N days remaining'.""" + import datetime as _dt + client, factory, _ = _build_app(tmp_path) + # Link the customer first via checkout, then plant a trial state. + _post_webhook(client, body={ + "id": "evt_link2", + "type": "checkout.session.completed", + "data": {"object": { + "client_reference_id": "1", + "customer": "cus_t", + "subscription": "sub_t", + }}, + }) + trial_end_ts = int((_dt.datetime.now(_dt.timezone.utc) + + _dt.timedelta(days=12)).timestamp()) + _post_webhook(client, body={ + "id": "evt_t1", + "type": "customer.subscription.created", + "data": {"object": { + "id": "sub_t", "customer": "cus_t", + "status": "trialing", "trial_end": trial_end_ts, + }}, + }) + # Now transition to active. + _post_webhook(client, body={ + "id": "evt_t2", + "type": "customer.subscription.updated", + "data": {"object": { + "id": "sub_t", "customer": "cus_t", + "status": "active", + }}, + }) + + async def _check(): + from sqlalchemy import select + from app.models import User + async with factory() as session: + u = (await session.execute( + select(User).where(User.id == 1) + )).scalar_one() + return u.tier, u.stripe_trial_end_at + + tier, end = asyncio.run(_check()) + assert tier == "paid" + assert end is None, "trial_end_at must be cleared once active" + + def test_subscription_active_grants_paid(tmp_path): """customer.subscription.updated with status=active should also grant paid — covers the case where checkout.session.completed @@ -282,9 +386,9 @@ def test_unknown_event_is_acked(tmp_path): # --- /api/stripe/checkout (with Stripe SDK mocked) ------------------------ -def test_checkout_endpoint_creates_session_and_returns_url(tmp_path): - client, _, session_cookie = _build_app(tmp_path) - # Mock the Stripe SDK call so no real HTTP goes out. +def _fake_checkout_client(asserter): + """Build a fake Stripe client whose checkout.sessions.create calls + the supplied asserter on the params dict and returns a stub URL.""" fake_session = SimpleNamespace( id="cs_test_123", url="https://checkout.stripe.com/test", ) @@ -292,10 +396,7 @@ def test_checkout_endpoint_creates_session_and_returns_url(tmp_path): class _FakeSessions: @staticmethod def create(params): # noqa: ANN001 - assert params["mode"] == "subscription" - assert params["line_items"][0]["price"] == _PRICE_MONTHLY - assert params["client_reference_id"] == "1" - assert params["customer_email"] == "buyer@x" + asserter(params) return fake_session class _FakeCheckout: @@ -304,8 +405,28 @@ def test_checkout_endpoint_creates_session_and_returns_url(tmp_path): class _FakeClient: checkout = _FakeCheckout() + return _FakeClient() + + +def test_checkout_monthly_has_no_trial_and_no_stripe_consent(tmp_path): + """Monthly checkout must NOT carry a free trial (£7 × 14 days would + halve cycle-1 revenue) AND must NOT use Stripe's account-wide + consent_collection — the Reg-36 waiver is collected on /pricing + so each product can use its own Terms URL.""" + client, _, session_cookie = _build_app(tmp_path) + + def asserter(params): + assert params["mode"] == "subscription" + assert params["line_items"][0]["price"] == _PRICE_MONTHLY + assert params["client_reference_id"] == "1" + assert params["customer_email"] == "buyer@x" + assert "subscription_data" not in params, "no trial on monthly" + assert "consent_collection" not in params, ( + "consent is collected on /pricing, not via Stripe's account-wide setting" + ) + with patch("app.routers.stripe_billing._stripe_client", - return_value=_FakeClient()): + return_value=_fake_checkout_client(asserter)): r = client.post( "/api/stripe/checkout", json={"cadence": "monthly"}, @@ -315,6 +436,28 @@ def test_checkout_endpoint_creates_session_and_returns_url(tmp_path): assert r.json()["url"] == "https://checkout.stripe.com/test" +def test_checkout_annual_uses_trial_not_consent_collection(tmp_path): + """Annual checkout gets the 14-day free trial (substitutes for the + statutory cooling-off right; no money moves during the trial).""" + client, _, session_cookie = _build_app(tmp_path) + + def asserter(params): + assert params["mode"] == "subscription" + assert params["line_items"][0]["price"] == _PRICE_ANNUAL + assert params["subscription_data"]["trial_period_days"] == 14 + assert "consent_collection" not in params, "annual relies on trial, not consent" + + with patch("app.routers.stripe_billing._stripe_client", + return_value=_fake_checkout_client(asserter)): + r = client.post( + "/api/stripe/checkout", + json={"cadence": "annual"}, + cookies={"cassandra_session": session_cookie}, + ) + assert r.status_code == 200, r.text + assert r.json()["url"] == "https://checkout.stripe.com/test" + + def test_checkout_endpoint_requires_login(tmp_path): client, _, _ = _build_app(tmp_path) r = client.post("/api/stripe/checkout", json={"cadence": "monthly"})