A member can buy an add-on that has no entitlement set, pay for it every period, and receive nothing #272
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: wiki-cafe/member-console#272
Reference in New Issue
Block a user
What happens
Some terms first. An entitlement set is the named collection of rules that says what a product delivers, such as a number of wiki sites. An add-on is a product a member can buy that is not a tier of any plan ladder. A reconcile is the console reading a subscription back from Stripe and delivering what it pays for.
A product's entitlement set can be cleared after the product exists: the product edit form offers "None" for it (
productSetOptions,internal/server/operator_product_forms.go:192-207), and the line under the field says a product with none delivers no capabilities (:82). The operator's readiness panel then reads "Incomplete; missing: entitlement set" (internal/server/product_readiness.go:398-413,:559-576).The member side never reads the set. The member gate, the one test of whether a member can see or buy a product, checks only that it is published, active and listed (
internal/server/product_readiness.go:281-310). The Products page lists every such product that is a tier of no ladder and has a default recurring price Stripe can reach (buildAddonsData,internal/server/member_addons.go:70-131;ListPublicProducts,internal/billing/queries/products.sql:10-13), and Checkout sells it on the same tests (internal/server/billing.go:248,:271-273). When the new subscription is reconciled, the console records its item, logs "reconcile: product has no entitlement set, skipping provision", and delivers nothing (mirrorItems,internal/fulfillment/reconcile.go:532-536). Stripe bills the member every period for an add-on that delivers nothing.This is the second time a product that delivers nothing has reached members: #153 is the same fault through an organization type's default ladder. The change planned for #153 refuses a ladder tier with no entitlement set, which leaves add-ons open.
What should happen
A product with no entitlement set is never sold to a member: the Products page does not list it and Checkout refuses it, as the readiness panel already reports it incomplete.
Where
internal/server/product_readiness.go:281-310(memberGate,evaluateMemberGate);internal/server/member_addons.go:70-131;internal/server/billing.go:248,:271-273;internal/fulfillment/reconcile.go:532-536.Steps
Why it matters
A member pays every period for an add-on the console never delivers, and no page tells the member or the operator that a subscription pays for it.
Selling a product that has no entitlement set stays allowed, on purpose. A cooperative can sell something the console does not deliver, for example email support it provides by hand, and the console should not stand in the way of that. It is not the best practice, so the operator is warned and not stopped: the product form's line under Entitlement set says "The set is what the product delivers; a product with none delivers no capabilities.", and the product's readiness panel reads "Incomplete; missing: entitlement set" with "Assign an entitlement set; a product with none confers nothing." That is the whole of what this needs.
A plan tier is different: a tier is a position on a ladder and has to deliver something there, so a ladder tier without an entitlement set is refused (#153).
Closing as won't fix.