InstaNode-dev
diff --git a/‎internal/jobs/billing_reconciler_integration_test.go‎
Lines changed: 151 additions & 0 deletions b/‎internal/jobs/billing_reconciler_integration_test.go‎
Lines changed: 151 additions & 0 deletions
diff --git a/‎internal/jobs/team_deletion_executor_integration_test.go‎
Lines changed: 135 additions & 0 deletions b/‎internal/jobs/team_deletion_executor_integration_test.go‎
Lines changed: 135 additions & 0 deletions
@@ -0,0 +1,151 @@
+package jobs
+
+// billing_reconciler_integration_test.go — REAL-Postgres integration test for
+// the billing reconciler's terminal-downgrade round-trip.
+//
+// Per INTEGRATION-COVERAGE-PLAN-2026-06-04.md §5 #1, billing_reconciler is a
+// Tier-1 (money-adjacent) job whose DB round-trip was fake-tested only — the
+// sibling billing_reconciler_test.go drives Work() with a stubGrace and asserts
+// the stub's call counts, never the persisted teams row. THIS test seeds a real
+// paid (pro) team carrying a Razorpay subscription id, runs Work() against a
+// live platform Postgres with a stub fetcher that reports the subscription
+// `cancelled` (a terminal status), and asserts the worker actually wrote:
+//
+//   - teams.plan_tier flipped pro → "hobby" (terminalDowngradeTier — never the
+//     ephemeral "free" tier; the cross-repo contract D28 F1), AND
+//   - a subscription.canceled audit_log row was emitted for the team (the
+//     event the email forwarder dispatches the cancellation email from).
+//
+// The Razorpay leg stays stubbed (no live Razorpay — CLAUDE P0: recurring not
+// enabled, plan §4 BLOCKED-bypass: drive the state directly). The DB leg —
+// the candidate SELECT, the UpdatePlanTier UPDATE, the audit INSERT — is REAL.
+// This is the convergence a sqlmock test cannot prove: that the downgrade
+// UPDATE's WHERE id = $2 matched the live row and the audit row landed.
+//
+// Determinism on a shared local DB: the reconciler scans EVERY team with a
+// non-empty stripe_customer_id, not just ours. The stub fetcher therefore
+// keys on subscription_id — it returns `cancelled` ONLY for the seeded team's
+// subscription and a benign `active`-at-hobby (a no-op for any already-hobby
+// team) for everything else, so the sweep cannot mutate unrelated rows in a way
+// that perturbs this assertion. grace is left nil so the real dbGracePeriodOpener
+// runs against the live DB (its TerminateActiveGracePeriod is an idempotent
+// no-op when the team has no active grace row).
+//
+// GATING: testhelpers.SetupTestDB skips under -short / no-DB, so the regular
+// `make gate` stays green without a Postgres; the non-short CI integration job
+// runs it for real.
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/riverqueue/river"
+	"github.com/riverqueue/river/rivertype"
+
+	"instant.dev/worker/internal/testhelpers"
+)
+
+// subKeyedFetcher is a subscriptionFetcher that returns a caller-supplied
+// status for ONE target subscription id and a benign no-op status (`active` at
+// the lowest paid tier) for every other id. Keyed-by-sub so the reconciler's
+// full-table sweep cannot perturb the assertion on a shared DB.
+type subKeyedFetcher struct {
+	targetSub    string
+	targetStatus string
+	planID       string
+}
+
+func (f *subKeyedFetcher) FetchSubscriptionForReconciler(_ context.Context, subID string) (*reconcilerSubscriptionDetails, error) {
+	if subID == f.targetSub {
+		return &reconcilerSubscriptionDetails{
+			Status:    f.targetStatus,
+			PlanID:    f.planID,
+			PaidCount: 1,
+		}, nil
+	}
+	// Any other team in the shared DB: report `created` — a guaranteed
+	// no-action status (rzpStatusClassNoAction). This is strictly safer than
+	// `active`, which (with an unrecognised plan_id) resolves to "hobby" and
+	// could upgrade an anonymous/free team that happens to carry a
+	// subscription id in a polluted local DB. `created` mutates nothing, so
+	// the sweep touches ONLY the seeded target team.
+	return &reconcilerSubscriptionDetails{Status: "created", PlanID: "", PaidCount: 0}, nil
+}
+
+func fakeBillingJob() *river.Job[BillingReconcilerArgs] {
+	return &river.Job[BillingReconcilerArgs]{JobRow: &rivertype.JobRow{ID: 1}}
+}
+
+// TestIntegration_BillingReconciler_TerminalDowngradePersistsHobby seeds a
+// pro-tier team with a Razorpay subscription id, runs the reconciler with a
+// fetcher that reports that subscription `cancelled`, and asserts the worker
+// persisted plan_tier='hobby' to the REAL team row AND emitted the
+// subscription.canceled audit row.
+func TestIntegration_BillingReconciler_TerminalDowngradePersistsHobby(t *testing.T) {
+	db, cleanup := testhelpers.SetupTestDB(t)
+	defer cleanup()
+
+	subID := "sub_itest_" + uuid.New().String()[:12]
+	teamID := testhelpers.SeedTeamWithSubscription(t, db, "pro", subID)
+
+	fetcher := &subKeyedFetcher{targetSub: subID, targetStatus: "cancelled"}
+	// grace == nil → real dbGracePeriodOpener against the live DB.
+	w := NewBillingReconcilerWorker(db, fetcher, nil)
+
+	if err := w.Work(context.Background(), fakeBillingJob()); err != nil {
+		t.Fatalf("Work: %v", err)
+	}
+
+	// The team's plan_tier must have flipped pro → hobby (terminalDowngradeTier).
+	got := testhelpers.TeamPlanTier(t, db, teamID)
+	if got != terminalDowngradeTier {
+		t.Errorf("plan_tier = %q after terminal downgrade, want %q (terminalDowngradeTier)", got, terminalDowngradeTier)
+	}
+	if got == "free" {
+		t.Error("terminal downgrade landed on 'free' — must be 'hobby' (D28 F1: 'free' strands permanent paid resources)")
+	}
+
+	// A subscription.canceled audit row must have been emitted for the team —
+	// this is what the event-email forwarder dispatches the cancellation
+	// confirmation email from.
+	if n := testhelpers.CountAuditLogByTeam(t, db, teamID, "subscription.canceled"); n < 1 {
+		t.Errorf("subscription.canceled audit rows = %d, want >= 1 (the downgrade must emit the cancellation audit)", n)
+	}
+}
+
+// TestIntegration_BillingReconciler_ActiveNoDriftLeavesTierUntouched is the
+// complement: a paid team Razorpay reports `active` at its CURRENT tier must
+// NOT be re-written (no gap → continue) and NO audit row is emitted. This pins
+// the live "DB tier already at/above expected" no-op branch against real data —
+// a regression that always-writes would burn a tier UPDATE + a spurious
+// upgrade email every 15-minute tick. It is also fast: the target sorts first
+// and the stub reports a no-action for everything else.
+func TestIntegration_BillingReconciler_ActiveNoDriftLeavesTierUntouched(t *testing.T) {
+	db, cleanup := testhelpers.SetupTestDB(t)
+	defer cleanup()
+
+	subID := "sub_itest_" + uuid.New().String()[:12]
+	teamID := testhelpers.SeedTeamWithSubscription(t, db, "pro", subID)
+
+	// Razorpay reports active; with an empty plan_id the expected tier resolves
+	// to "hobby" — and the team is already "pro" (>= hobby) → no-op.
+	fetcher := &subKeyedFetcher{targetSub: subID, targetStatus: "active"}
+	w := NewBillingReconcilerWorker(db, fetcher, nil)
+
+	if err := w.Work(context.Background(), fakeBillingJob()); err != nil {
+		t.Fatalf("Work: %v", err)
+	}
+
+	// Tier untouched (still pro — NOT downgraded to the resolved-hobby).
+	if got := testhelpers.TeamPlanTier(t, db, teamID); got != "pro" {
+		t.Errorf("plan_tier = %q for an at-or-above-expected team, want \"pro\" (untouched)", got)
+	}
+	// No upgrade / cancel audit emitted for a no-op.
+	if n := testhelpers.CountAuditLogByTeam(t, db, teamID, "subscription.upgraded"); n != 0 {
+		t.Errorf("subscription.upgraded audit rows = %d for a no-op tick, want 0", n)
+	}
+	if n := testhelpers.CountAuditLogByTeam(t, db, teamID, "subscription.canceled"); n != 0 {
+		t.Errorf("subscription.canceled audit rows = %d for a no-op tick, want 0", n)
+	}
+}
@@ -0,0 +1,135 @@
+package jobs
+
+// team_deletion_executor_integration_test.go — REAL-Postgres integration test
+// for the team-deletion purge cascade. This is the §5 #1 single highest-value
+// data-loss gap: GDPR Article 17 right-to-be-forgotten teardown that, if it
+// silently fails or scrubs the wrong rows, is both a compliance breach and a
+// data-loss incident (cf. the 2026-06-03 truehomie-db DROP incident class).
+//
+// The sibling team_deletion_executor_test.go drives Work() with fake S3 / k8s
+// clients and asserts the destruction *attempts* against those fakes. THIS test
+// seeds a real team whose 30-day grace window has elapsed, with real resources
+// (carrying connection_url + key_prefix secrets), real users (carrying PII),
+// and a real deployment, then runs Work() against a live platform Postgres with
+// provisioner/S3/k8s all nil (fail-open per NewTeamDeletionExecutorWorker) and
+// asserts the PERSISTED purge cascade:
+//
+//   - teams.status flipped deletion_requested → tombstoned, tombstoned_at set,
+//   - resources.connection_url scrubbed to NULL, key_prefix blanked to '',
+//   - users.email scrubbed to the deleted-<id>@tombstoned.invalid placeholder
+//     (NULL would violate the NOT NULL UNIQUE constraint),
+//   - a team.tombstoned audit_log row emitted.
+//
+// The S3 / k8s / gRPC legs are nil-skipped (CI has no bucket / cluster /
+// provisioner; the job is fail-open by design). The DB leg — the candidate
+// scan (deletion_requested_at + 30d < now()), the status flip, the
+// scrub transaction, the audit emit — is REAL and is the integration target.
+// A sqlmock test passes whether or not the scrub UPDATE's WHERE team_id = $1
+// matched the seeded rows; this proves it did, against the real schema's
+// constraints (the users.email NOT NULL UNIQUE that forces the placeholder
+// instead of a NULL).
+//
+// GATING: testhelpers.SetupTestDB skips under -short / no-DB.
+
+import (
+	"context"
+	"testing"
+
+	"github.com/riverqueue/river"
+	"github.com/riverqueue/river/rivertype"
+
+	"instant.dev/worker/internal/testhelpers"
+)
+
+func fakeTeamDeletionJob() *river.Job[TeamDeletionExecutorArgs] {
+	return &river.Job[TeamDeletionExecutorArgs]{JobRow: &rivertype.JobRow{ID: 1}}
+}
+
+// TestIntegration_TeamDeletionExecutor_PurgeCascadeTombstones seeds a team
+// past its 30-day grace window with secret-bearing resources, PII-bearing
+// users, and a deployment, runs the executor with no external clients, and
+// asserts the full persisted tombstone cascade.
+func TestIntegration_TeamDeletionExecutor_PurgeCascadeTombstones(t *testing.T) {
+	db, cleanup := testhelpers.SetupTestDB(t)
+	defer cleanup()
+
+	// Grace window elapsed (40 > 30 days) → the candidate scan selects it.
+	teamID := testhelpers.SeedTeamPendingDeletion(t, db, "pro", 40)
+	resID := testhelpers.SeedResourceWithSecret(t, db, teamID, "postgres")
+	userID := testhelpers.SeedUser(t, db, teamID, "purge-itest-"+teamID.String()[:8]+"@example.com")
+	// A deployment so fetchTeamDeployAppIDs has a row to enumerate (the k8s
+	// leg is nil-skipped, but the row must not break the pure-DB cascade).
+	_ = testhelpers.SeedDeployment(t, db, teamID, "healthy", "app-purge-itest")
+
+	// provisioner / s3 / k8s all nil → fail-open; pure-DB cascade only.
+	w := NewTeamDeletionExecutorWorker(db, nil, nil, nil, "")
+
+	if err := w.Work(context.Background(), fakeTeamDeletionJob()); err != nil {
+		t.Fatalf("Work: %v", err)
+	}
+
+	// 1. Team tombstoned.
+	if got := testhelpers.TeamStatus(t, db, teamID); got != "tombstoned" {
+		t.Errorf("team status = %q after purge, want \"tombstoned\"", got)
+	}
+
+	// 2. Resource secrets scrubbed.
+	connURL, keyPrefix := testhelpers.ResourceSecretFields(t, db, resID)
+	if connURL.Valid {
+		t.Errorf("resource connection_url = %q after purge, want NULL", connURL.String)
+	}
+	if keyPrefix != "" {
+		t.Errorf("resource key_prefix = %q after purge, want empty", keyPrefix)
+	}
+
+	// 3. User PII scrubbed to the tombstone placeholder (NOT the original email,
+	//    NOT NULL — the NOT NULL UNIQUE constraint forces the placeholder).
+	email := testhelpers.UserEmail(t, db, userID)
+	wantPrefix := "deleted-" + userID.String()
+	if email != wantPrefix+"@tombstoned.invalid" {
+		t.Errorf("user email = %q after purge, want %q@tombstoned.invalid", email, wantPrefix)
+	}
+
+	// 4. team.tombstoned audit row emitted.
+	if n := testhelpers.CountAuditLogByTeam(t, db, teamID, auditKindTombstoned); n < 1 {
+		t.Errorf("%s audit rows = %d, want >= 1", auditKindTombstoned, n)
+	}
+}
+
+// TestIntegration_TeamDeletionExecutor_WithinGraceNotPurged is the safety
+// complement: a team still INSIDE its 30-day grace window (the customer can
+// still restore) MUST NOT be tombstoned. This pins the candidate scan's time
+// predicate against real data — a regression that ignores the grace window
+// would destroy data a customer is legally entitled to recover. Asserting the
+// no-op is as important as asserting the purge: the truehomie-class incident is
+// "the destroy path ran when it should not have."
+func TestIntegration_TeamDeletionExecutor_WithinGraceNotPurged(t *testing.T) {
+	db, cleanup := testhelpers.SetupTestDB(t)
+	defer cleanup()
+
+	// Only 5 days elapsed (< 30) → still restorable → must NOT be swept.
+	teamID := testhelpers.SeedTeamPendingDeletion(t, db, "pro", 5)
+	resID := testhelpers.SeedResourceWithSecret(t, db, teamID, "postgres")
+
+	w := NewTeamDeletionExecutorWorker(db, nil, nil, nil, "")
+
+	if err := w.Work(context.Background(), fakeTeamDeletionJob()); err != nil {
+		t.Fatalf("Work: %v", err)
+	}
+
+	// Team still in deletion_requested (untouched), NOT tombstoned.
+	if got := testhelpers.TeamStatus(t, db, teamID); got != "deletion_requested" {
+		t.Errorf("team status = %q for an in-grace team, want \"deletion_requested\" (must not be swept)", got)
+	}
+
+	// Resource secret still present (NOT scrubbed).
+	connURL, _ := testhelpers.ResourceSecretFields(t, db, resID)
+	if !connURL.Valid || connURL.String == "" {
+		t.Error("resource connection_url was scrubbed for an in-grace team — the grace window predicate failed (data-loss regression)")
+	}
+
+	// No tombstone audit.
+	if n := testhelpers.CountAuditLogByTeam(t, db, teamID, auditKindTombstoned); n != 0 {
+		t.Errorf("%s audit rows = %d for an in-grace team, want 0", auditKindTombstoned, n)
+	}
+}