[PM-21421] Support legacy > current plan transition when resubscribing

[amorask-bitwarden]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-21421

📔 Objective

The RestartSubscriptionCommand was allowing organizations to resubscribe to plans that are no longer active (i.e. Enterprise 2020). This PR refactors it to allow for a legacy to current plan transition including the necessary DB updates.

📸 Screenshots

Screen.Recording.2025-12-12.at.9.57.34.AM.mov

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[claude]

Claude finished @amorask-bitwarden's task —— View job

---

Code Review Complete

• Launch code reviewer agent to analyze PR changes
• Complete review

---

Summary

I've completed a comprehensive code review of PR #6728. The reviewer agent has posted detailed inline comments directly on the PR files.

Critical Issues Identified:

1. Null Reference Vulnerabilities - Missing null checks for newPlan.SecretsManager properties that could cause crashes
2. Missing Payment Method Validation - Code creates subscriptions without verifying customer has valid payment method
3. Transaction Safety Issues - No rollback logic if Stripe succeeds but database update fails, leading to inconsistent state
4. Incomplete Property Updates - Missing updates for autoscale limits and storage properties during plan transitions

Priority Recommendations:

• P0 (Must Fix): Add null checks, payment validation, transaction rollback, and null handling for expiration dates
• P1 (Should Fix): Validate plan structure compatibility and update all organization properties
• P2 (Nice to Have): Add audit logging and telemetry

All specific issues have been posted as inline comments on the PR files for easy reference and addressing.

---

[github-actions]

Checkmarx One – Scan Summary & Details – cc295d8e-e7c2-4302-8b6a-1f3cbf5d16d4

Great job! No new security vulnerabilities introduced in this pull request

[codecov]

Codecov Report

❌ Patch coverage is 95.04950% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 53.95%. Comparing base (72c8967) to head (c528791).

Files with missing lines	Patch %	Lines
...bscriptions/Commands/RestartSubscriptionCommand.cs	95.04%	0 Missing and 5 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6728      +/-   ##
==========================================
+ Coverage   53.90%   53.95%   +0.04%     
==========================================
  Files        1922     1922              
  Lines       85214    85280      +66     
  Branches     7621     7633      +12     
==========================================
+ Hits        45937    46015      +78     
+ Misses      37511    37493      -18     
- Partials     1766     1772       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cyprain-okeke]

Looks Great