zulip/docs/subsystems/billing.md

Billing

Zulip uses a third party (Stripe) for billing, so working on the billing system requires a little bit of setup.

To set up the development environment to work on the billing code:

• Create a Stripe account
• Go to https://dashboard.stripe.com/account/apikeys, and add the publishable key and secret key as stripe_publishable_key and stripe_secret_key to zproject/dev-secrets.conf.
• Run ./manage.py setup_stripe.

It is safe to run manage.py setup_stripe multiple times.

Nearly all the billing-relevant code lives in zilencer/.

General architecture

Notes:

• Anything that talks directly to Stripe should go in zilencer/lib/stripe.py.
• We generally try to store billing-related data in Stripe, rather than in Zulip database tables. We'd rather pay the penalty of making extra stripe API requests than deal with keeping two sources of data in sync.
• A realm should have a customer object in Stripe if and only if it has a Customer object in Zulip.

The two main billing-related states for a realm are "have never successfully been charged for anything" and its opposite. This is determined by whether the realm has a corresponding Customer object with has_billing_relationship=True. There are only a few cases where a realm might have a Customer object with has_billing_relationship=False:

• They are approved as a non-profit or otherwise have a partial discount, but haven't entered any payment info.
• They entered valid payment info, but the initial charge failed (rare but possible).

If a realm doesn't have a billing relationship, all the messaging, screens, etc. are geared towards making it easy to upgrade. If a realm does have a billing relationship, all the screens are geared toward making it easy to access current and historical billing information.

Note that having a billing relationship doesn't necessarily mean they are currently on a paid plan, or that they currently have a card on file.

Notes:

• When manually testing, I find I often run Customer.objects.all().delete() to reset the state.
• 4242424242424242 is Stripe's test credit card, also useful for manually testing. You can put anything in the address fields, any future expiry date, and anything for the CVV code. https://stripe.com/docs/testing#cards-responses has some other fun ones.

BillingProcessor

The general strategy here is that billing-relevant events get written to RealmAuditLog with requires_billing_update = True, and then a worker goes through, reads RealmAuditLog row by row, and makes the appropriate updates in Stripe (in order), keeping track of its state in BillingProcessor. An invariant is that it cannot be important when exactly the worker gets around to making the update in Stripe, as long as the updates for each customer (realm) are made in RealmAuditLog.id order.

Almost all the complexity in the code is due to error handling. We distinguish three kinds of errors:

• Transient errors, like rate limiting or network failures, where we just wait a bit and try again.
• Card decline errors (see below)
• Everything else (e.g. misconfigured API keys, errors thrown by buggy code, etc.), where we just throw an exception and stop the worker.

We use the following strategy for card decline errors. There is a global BillingProcessor (with realm=None) that processes RealmAuditLog entries for every customer (realm). If it runs into a card decline error on some entry, it gives up on that entry and (temporarily) all future entries of that realm, and spins off a realm-specific BillingProcessor that marks that realm as needing manual attention. When whatever issue has been corrected, the realm-specific BillingProcessor completes any realm-specific RealmAuditLog entries, and then deletes itself.

Notes for manually resolving errors:

• BillingProcessor.objects.filter(state='stalled') is always safe to handle manually.
• BillingProcessor.objects.filter(state='started') is safe to handle manually only if the billing process worker is not running.
• After resolving the issue, set the processor's state to done.
• Stripe's idempotency keys are only valid for 24 hours. So be mindful of that if manually cleaning something up more than 24 hours after the error occured.