feat(Contributions): ability to pause non-transferable

cron/daily/60-clean-orders.js

@@ -20,6 +20,14 @@ Promise.all([
   AND "Orders"."createdAt" <  (NOW() - interval '2 month')
   `,
   ),
+  // Mark all paused Orders as EXPIRED after 1 year
+  sequelize.query(
+    `UPDATE "Orders"
+  SET "status" = 'EXPIRED', "updatedAt" = NOW()
+  WHERE "Orders"."status" = 'PAUSED'
+  AND "Orders"."updatedAt" <  (NOW() - interval '1 year')
+  `,
+  ),
 ]).then(() => {
   console.log('>>> Clean Orders: done');
   process.exit(0);

cron/hourly/70-cancel-subscriptions-for-cancelled-orders.ts

@@ -10,7 +10,7 @@ import OrderStatuses from '../../server/constants/order-status';
 import logger from '../../server/lib/logger';
 import { reportErrorToSentry } from '../../server/lib/sentry';
 import { sleep } from '../../server/lib/utils';
-import models, { Op } from '../../server/models';
+import models, { Collective, Op } from '../../server/models';
 import { OrderModelInterface } from '../../server/models/Order';
 
 /**
@@ -32,17 +32,29 @@ const getHostFromOrder = async order => {
   return models.Collective.findByPk(hostIds[0]);
 };
 
-const getOrderCancelationReason = (collective, order, orderHost) => {
-  if (order.TierId && !order.Tier) {
-    return ['DELETED_TIER', `Order tier deleted`];
+const getOrderCancelationReason = (
+  collective: Collective,
+  order: OrderModelInterface,
+  orderHost: Collective,
+): {
+  code: 'TRANSFER' | 'DELETED_TIER' | 'ARCHIVED_ACCOUNT' | 'UNHOSTED_COLLECTIVE' | 'CHANGED_HOST' | 'CANCELLED_ORDER';
+  message: string;
+} => {
+  if (order.status === 'PAUSED' && order.data?.pausedForTransfer) {
+    return {
+      code: 'TRANSFER',
+      message: `Your contribution to the Collective was paused. We'll inform you when it will be ready for re-activation.`,
+    };
+  } else if (order.TierId && !order.Tier) {
+    return { code: 'DELETED_TIER', message: `Order tier deleted` };
   } else if (collective.deactivatedAt) {
-    return ['ARCHIVED_ACCOUNT', `@${collective.slug} archived their account`];
+    return { code: 'ARCHIVED_ACCOUNT', message: `@${collective.slug} archived their account` };
   } else if (!collective.HostCollectiveId) {
-    return ['UNHOSTED_COLLECTIVE', `@${collective.slug} was un-hosted`];
+    return { code: 'UNHOSTED_COLLECTIVE', message: `@${collective.slug} was un-hosted` };
   } else if (collective.HostCollectiveId !== orderHost.id) {
-    return ['CHANGED_HOST', `@${collective.slug} changed host`];
+    return { code: 'CHANGED_HOST', message: `@${collective.slug} changed host` };
   } else {
-    return ['CANCELLED_ORDER', `Order cancelled`];
+    return { code: 'CANCELLED_ORDER', message: `Order cancelled` };
   }
 };
 
@@ -53,7 +65,7 @@ const getOrderCancelationReason = (collective, order, orderHost) => {
  */
 export async function run() {
   const orphanOrders = await models.Order.findAll<OrderModelInterface>({
-    where: { status: OrderStatuses.CANCELLED },
+    where: { status: [OrderStatuses.CANCELLED, OrderStatuses.PAUSED] },
     include: [
       {
         model: models.Tier,
@@ -85,14 +97,14 @@ export async function run() {
     for (const order of accountOrders) {
       try {
         const host = await getHostFromOrder(order);
-        const [reasonCode, reason] = getOrderCancelationReason(collective, order, host);
+        const reason = getOrderCancelationReason(collective, order, host);
         logger.debug(
           `Cancelling subscription ${order.Subscription.id} from order ${order.id} of @${collectiveHandle} (host: ${host.slug})`,
         );
         if (!process.env.DRY) {
-          await order.Subscription.deactivate(reason, host);
+          await order.Subscription.deactivate(reason.message, host);
           await models.Activity.create({
-            type: activities.SUBSCRIPTION_CANCELED,
+            type: reason.code === 'TRANSFER' ? activities.SUBSCRIPTION_PAUSED : activities.SUBSCRIPTION_CANCELED,
             CollectiveId: order.CollectiveId,
             FromCollectiveId: order.FromCollectiveId,
             HostCollectiveId: order.collective.HostCollectiveId,
@@ -102,8 +114,8 @@ export async function run() {
               subscription: order.Subscription,
               collective: order.collective.minimal,
               fromCollective: order.fromCollective.minimal,
-              reasonCode: reasonCode,
-              reason: reason,
+              reasonCode: reason.code,
+              reason: reason.message,
               order: order.info,
               tier: order.Tier?.info,
             },

server/constants/activities.ts

@@ -83,6 +83,7 @@ enum ActivityTypes {
   CONTRIBUTION_REJECTED = 'contribution.rejected',
   SUBSCRIPTION_ACTIVATED = 'subscription.activated',
   SUBSCRIPTION_CANCELED = 'subscription.canceled',
+  SUBSCRIPTION_PAUSED = 'subscription.paused',
   TICKET_CONFIRMED = 'ticket.confirmed',
   ORDER_CANCELED_ARCHIVED_COLLECTIVE = 'order.canceled.archived.collective',
   ORDER_PENDING = 'order.pending',
@@ -239,6 +240,7 @@ export const ActivitiesPerClass: Record<ActivityClasses, ActivityTypes[]> = {
     ActivityTypes.PAYMENT_FAILED,
     ActivityTypes.SUBSCRIPTION_ACTIVATED,
     ActivityTypes.SUBSCRIPTION_CANCELED,
+    ActivityTypes.SUBSCRIPTION_PAUSED,
     ActivityTypes.SUBSCRIPTION_CONFIRMED,
   ],
   [ActivityClasses.ACTIVITIES_UPDATES]: [

server/constants/order-status.ts

@@ -24,6 +24,7 @@ enum OrderStatuses {
   // Disputed charges from Stripe
   DISPUTED = 'DISPUTED',
   REFUNDED = 'REFUNDED',
+  PAUSED = 'PAUSED',
   // In review charges from Stripe,
   IN_REVIEW = 'IN_REVIEW',
 }

server/graphql/v2/mutation/HostApplicationMutations.ts

@@ -1,6 +1,6 @@
 import config from 'config';
 import express from 'express';
-import { GraphQLList, GraphQLNonNull, GraphQLObjectType, GraphQLString } from 'graphql';
+import { GraphQLBoolean, GraphQLList, GraphQLNonNull, GraphQLObjectType, GraphQLString } from 'graphql';
 import { GraphQLJSON } from 'graphql-scalars';
 
 import { activities } from '../../../constants';
@@ -12,15 +12,15 @@ import { purgeAllCachesForAccount, purgeCacheForCollective } from '../../../lib/
 import emailLib from '../../../lib/email';
 import * as github from '../../../lib/github';
 import { OSCValidator, ValidatedRepositoryInfo } from '../../../lib/osc-validator';
-import { getPolicy, hasPolicy } from '../../../lib/policies';
+import { getPolicy } from '../../../lib/policies';
 import { stripHTML } from '../../../lib/sanitize-html';
 import twoFactorAuthLib from '../../../lib/two-factor-authentication';
 import models, { Collective, Op, sequelize } from '../../../models';
 import ConversationModel from '../../../models/Conversation';
 import { HostApplicationStatus } from '../../../models/HostApplication';
 import { processInviteMembersInput } from '../../common/members';
 import { checkRemoteUserCanUseAccount, checkRemoteUserCanUseHost, checkScope } from '../../common/scope-check';
-import { Forbidden, NotFound, Unauthorized, ValidationFailed } from '../../errors';
+import { Forbidden, NotFound, ValidationFailed } from '../../errors';
 import { GraphQLProcessHostApplicationAction } from '../enum/ProcessHostApplicationAction';
 import { fetchAccountWithReference, GraphQLAccountReferenceInput } from '../input/AccountReferenceInput';
 import { GraphQLInviteMemberInput } from '../input/InviteMemberInput';
@@ -224,6 +224,12 @@ const HostApplicationMutations = {
       },
       message: {
         type: GraphQLString,
+        description: 'An optional message to explain the reason for unhosting',
+      },
+      pauseContributions: {
+        type: new GraphQLNonNull(GraphQLBoolean),
+        description: 'If true, contributions will be paused rather than canceled',
+        defaultValue: false,
       },
     },
     resolve: async (_, args, req: express.Request): Promise<Collective> => {
@@ -238,19 +244,22 @@ const HostApplicationMutations = {
       if (!host) {
         return account;
       }
-      if (!req.remoteUser.isAdminOfCollective(host) && !(req.remoteUser.isRoot() && checkScope(req, 'root'))) {
-        throw new Unauthorized();
-      }
 
-      if (await hasPolicy(host, POLICIES.REQUIRE_2FA_FOR_ADMINS)) {
-        await twoFactorAuthLib.validateRequest(req, {
-          alwaysAskForToken: true,
-          requireTwoFactorAuthEnabled: true,
-          FromCollectiveId: host.id,
-        });
+      if (
+        !req.remoteUser.isAdminOfCollective(host) &&
+        !req.remoteUser.isAdminOfCollective(account) &&
+        !(req.remoteUser.isRoot() && checkScope(req, 'root'))
+      ) {
+        throw new Forbidden('Only the host admin or the account admin can trigger this action');
       }
 
-      await account.changeHost(null);
+      // TODO handle message
+      await twoFactorAuthLib.enforceForAccountsUserIsAdminOf(req, [account, host], { alwaysAskForToken: true });
+
+      await account.changeHost(null, req.remoteUser, {
+        pauseContributions: args.pauseContributions,
+        messageForContributors: args.message,
+      });
 
       await models.Activity.create({
         type: activities.COLLECTIVE_UNHOSTED,

server/lib/emailTemplates.ts

@@ -92,6 +92,7 @@ export const templateNames = [
   'report.platform',
   'report.platform.weekly',
   'subscription.canceled',
+  'subscription.paused',
   'taxform.request',
   'ticket.confirmed',
   'ticket.confirmed.fearlesscitiesbrussels',

server/lib/notifications/email.ts

@@ -232,6 +232,7 @@ export const notifyByEmail = async (activity: Activity) => {
       break;
 
     case ActivityTypes.SUBSCRIPTION_CANCELED:
+    case ActivityTypes.SUBSCRIPTION_PAUSED:
       await notify.user(activity);
       break;
 

server/lib/recurring-contributions.js

@@ -31,13 +31,22 @@ export const MAX_RETRIES = 6;
 export async function ordersWithPendingCharges({ limit, startDate } = {}) {
   return models.Order.findAndCountAll({
     where: {
+      status: { [Op.not]: status.PAUSED },
       SubscriptionId: { [Op.ne]: null },
       deletedAt: null,
     },
     limit: limit,
     include: [
       { model: models.User, as: 'createdByUser' },
-      { model: models.Collective, as: 'collective', required: true },
+      {
+        model: models.Collective,
+        as: 'collective',
+        required: true,
+        where: {
+          HostCollectiveId: { [Op.not]: null },
+          isActive: true,
+        },
+      },
       { model: models.Collective, as: 'fromCollective', required: true },
       { model: models.PaymentMethod, as: 'paymentMethod' },
       { model: models.Tier, as: 'Tier' },

server/lib/timeline.ts

@@ -154,6 +154,7 @@ const makeTimelineQuery = async (
         ActivityTypes.PAYMENT_CREDITCARD_EXPIRING,
         ActivityTypes.PAYMENT_FAILED,
         ActivityTypes.SUBSCRIPTION_CANCELED,
+        ActivityTypes.SUBSCRIPTION_PAUSED,
       ],
     );
   }

server/lib/webhooks.js

@@ -142,7 +142,7 @@ export const sanitizeActivity = activity => {
     cleanActivity.data = pick(activity.data, ['recipient.name']);
     cleanActivity.data.tier = getTierInfo(activity.data.tier);
     cleanActivity.data.order = getOrderInfo(activity.data.order);
-  } else if (type === activities.SUBSCRIPTION_CANCELED) {
+  } else if (type === activities.SUBSCRIPTION_CANCELED || type === activities.SUBSCRIPTION_PAUSED) {
     cleanActivity.data = pick(activity.data, ['subscription.id']);
     cleanActivity.data.order = getOrderInfo(activity.data.order);
     cleanActivity.data.tier = getTierInfo(activity.data.tier);

server/models/Collective.ts

@@ -2412,7 +2412,11 @@ class Collective extends Model<
       });
     }
 
-    await Order.cancelNonTransferableActiveOrdersByCollectiveId(this.id);
+    if (options?.pauseContributions) {
+      await Order.pauseNonTransferableActiveOrdersByCollectiveId(this.id);
+    } else {
+      await Order.cancelNonTransferableActiveOrdersByCollectiveId(this.id);
+    }
 
     const virtualCards = await VirtualCard.findAll({ where: { CollectiveId: this.id } });
     await Promise.all(virtualCards.map(virtualCard => virtualCard.delete()));

server/models/Order.ts

@@ -41,6 +41,7 @@ interface OrderModelStaticInterface {
   generateDescription(collective, amount, interval, tier): string;
   cancelActiveOrdersByCollective(collectiveId: number): Promise<[affectedCount: number]>;
   cancelActiveOrdersByTierId(tierId: number): Promise<[affectedCount: number]>;
+  pauseNonTransferableActiveOrdersByCollectiveId(collectiveId: number): Promise<[affectedCount: number]>;
   cancelNonTransferableActiveOrdersByCollectiveId(collectiveId: number): Promise<[affectedCount: number]>;
   clearExpiredLocks(): Promise<[null, number]>;
 }
@@ -693,6 +694,36 @@ Order.cancelNonTransferableActiveOrdersByCollectiveId = function (collectiveId:
   );
 };
 
+/**
+ * Pause all orders with subscriptions that cannot be transferred when changing hosts (i.e. PayPal).
+ * The CRON job `70-cancel-subscriptions-for-cancelled-orders` will then take care of cancelling them on the payment processor's side.
+ */
+Order.pauseNonTransferableActiveOrdersByCollectiveId = function (collectiveId: number) {
+  // TODO: Add stripe intents
+  return sequelize.query(
+    `
+        UPDATE public."Orders"
+        SET
+          status = 'PAUSED',
+          "updatedAt" = NOW(),
+          data = COALESCE(data, '{}'::JSONB) || '{"pausedForTransfer": true}'
+        WHERE id IN (
+          SELECT "Orders".id FROM public."Orders"
+          INNER JOIN public."Subscriptions" ON "Subscriptions".id = "Orders"."SubscriptionId"
+          WHERE
+            "Orders".status NOT IN ('PAID', 'PAUSED', 'CANCELLED', 'REJECTED', 'EXPIRED') AND
+            "Subscriptions"."isManagedExternally" AND
+            "Subscriptions"."isActive" AND
+            "Orders"."CollectiveId" = ?
+        )
+      `,
+    {
+      type: QueryTypes.UPDATE,
+      replacements: [collectiveId],
+    },
+  );
+};
+
 Temporal(Order, sequelize);
 
 export default Order;

templates/emails/subscription.paused.hbs

@@ -0,0 +1,22 @@
+Subject: Your contribution to {{{collective.name}}} has been paused
+
+{{> header}}
+
+<p>{{> greeting}}</p>
+
+<p>Your recurring contribution to {{collective.name}} for {{currency subscription.amount currency=subscription.currency}}/{{subscription.interval}} has been paused.</p>
+
+{{#if reason}}
+  <p>The reason for this cancellation was:</p>
+  <blockquote style="color: #6a737d;font-size: 12px; font-style: italic; text-align: left;padding: 0.5em 0.75em;margin: 1em 0;border-left: 3px solid #e4e4e4;white-space: pre-line;">{{reason}}</blockquote>
+{{/if}}
+
+<p>We'll inform you when it will be ready for re-activation.</p>
+
+<p>Warmly,</p>
+
+<p>
+  – {{collective.name}}
+</p>
+
+{{> footer}}