fix(taxcode): reject soft-deleted tax codes as organization defaults

Author: borbelyr-kong

openmeter/taxcode/service/organizationdefaulttaxcodes.go

@@ -24,19 +24,34 @@ func (s *Service) UpsertOrganizationDefaultTaxCodes(ctx context.Context, input t
 	}
 
 	return transaction.Run(ctx, s.adapter, func(ctx context.Context) (taxcode.OrganizationDefaultTaxCodes, error) {
-		// Ensure both tax code IDs belong to the namespace.
-		if _, err := s.GetTaxCode(ctx, taxcode.GetTaxCodeInput{
-			NamespacedID: models.NamespacedID{Namespace: input.Namespace, ID: input.InvoicingTaxCodeID},
-		}); err != nil {
+		// Ensure both tax code IDs belong to the namespace and are not soft-deleted.
+		if err := s.requireActiveTaxCode(ctx, input.Namespace, input.InvoicingTaxCodeID); err != nil {
 			return taxcode.OrganizationDefaultTaxCodes{}, err
 		}
 
-		if _, err := s.GetTaxCode(ctx, taxcode.GetTaxCodeInput{
-			NamespacedID: models.NamespacedID{Namespace: input.Namespace, ID: input.CreditGrantTaxCodeID},
-		}); err != nil {
+		if err := s.requireActiveTaxCode(ctx, input.Namespace, input.CreditGrantTaxCodeID); err != nil {
 			return taxcode.OrganizationDefaultTaxCodes{}, err
 		}
 
 		return s.adapter.UpsertOrganizationDefaultTaxCodes(ctx, input)
 	})
 }
+
+// requireActiveTaxCode ensures the tax code belongs to the namespace and is not soft-deleted.
+// GetTaxCode returns soft-deleted rows by ID (so billing can still resolve frozen Stripe
+// mappings), so a deleted code must be rejected explicitly to prevent it from being
+// designated as an organization default.
+func (s *Service) requireActiveTaxCode(ctx context.Context, namespace, id string) error {
+	tc, err := s.GetTaxCode(ctx, taxcode.GetTaxCodeInput{
+		NamespacedID: models.NamespacedID{Namespace: namespace, ID: id},
+	})
+	if err != nil {
+		return err
+	}
+
+	if tc.DeletedAt != nil {
+		return taxcode.NewTaxCodeNotFoundError(id)
+	}
+
+	return nil
+}

openmeter/taxcode/service/organizationdefaulttaxcodes_test.go

@@ -117,6 +117,44 @@ func TestOrganizationDefaultTaxCodesService(t *testing.T) {
 			assert.True(t, taxcode.IsTaxCodeNotFoundError(err), "tax code from another namespace must not resolve")
 		})
 
+		t.Run("SoftDeleted/InvoicingTaxCodeIsDeleted", func(t *testing.T) {
+			dns := testutils.NameGenerator.Generate().Key
+			env.SetupNamespaceDefaults(t, dns)
+			deleted := env.CreateTaxCode(t, dns)
+			active := env.CreateTaxCode(t, dns)
+
+			require.NoError(t, env.Service.DeleteTaxCode(t.Context(), taxcode.DeleteTaxCodeInput{
+				NamespacedID: models.NamespacedID{Namespace: dns, ID: deleted.ID},
+			}))
+
+			_, err := env.Service.UpsertOrganizationDefaultTaxCodes(t.Context(), taxcode.UpsertOrganizationDefaultTaxCodesInput{
+				Namespace:            dns,
+				InvoicingTaxCodeID:   deleted.ID,
+				CreditGrantTaxCodeID: active.ID,
+			})
+			require.Error(t, err)
+			assert.True(t, taxcode.IsTaxCodeNotFoundError(err), "soft-deleted tax code must not be settable as an organization default")
+		})
+
+		t.Run("SoftDeleted/CreditGrantTaxCodeIsDeleted", func(t *testing.T) {
+			dns := testutils.NameGenerator.Generate().Key
+			env.SetupNamespaceDefaults(t, dns)
+			active := env.CreateTaxCode(t, dns)
+			deleted := env.CreateTaxCode(t, dns)
+
+			require.NoError(t, env.Service.DeleteTaxCode(t.Context(), taxcode.DeleteTaxCodeInput{
+				NamespacedID: models.NamespacedID{Namespace: dns, ID: deleted.ID},
+			}))
+
+			_, err := env.Service.UpsertOrganizationDefaultTaxCodes(t.Context(), taxcode.UpsertOrganizationDefaultTaxCodesInput{
+				Namespace:            dns,
+				InvoicingTaxCodeID:   active.ID,
+				CreditGrantTaxCodeID: deleted.ID,
+			})
+			require.Error(t, err)
+			assert.True(t, taxcode.IsTaxCodeNotFoundError(err), "soft-deleted tax code must not be settable as an organization default")
+		})
+
 		t.Run("Create", func(t *testing.T) {
 			ns2 := testutils.NameGenerator.Generate().Key
 			invoicing := env.CreateTaxCode(t, ns2)