Zulip uses a third party (Stripe) for billing, so working on the billing system requires a little bit of setup.
To set up the development environment to work on the billing code:
- Create a Stripe account
- Go to https://dashboard.stripe.com/account/apikeys, and add the
publishable key and secret key as
It is safe to run
manage.py setup_stripe multiple times.
Nearly all the billing-relevant code lives in
- Anything that talks directly to Stripe should go in
- We generally try to store billing-related data in Stripe, rather than in Zulip database tables. We’d rather pay the penalty of making extra stripe API requests than deal with keeping two sources of data in sync.
- A realm should have a customer object in Stripe if and only if it has a
Customerobject in Zulip.
The two main billing-related states for a realm are “have never successfully
been charged for anything” and its opposite. This is determined by whether
realm has a corresponding
Customer object with
has_billing_relationship=True. There are only a few cases where a
might have a
Customer object with
- They are approved as a non-profit or otherwise have a partial discount, but haven’t entered any payment info.
- They entered valid payment info, but the initial charge failed (rare but possible).
If a realm doesn’t have a billing relationship, all the messaging, screens, etc. are geared towards making it easy to upgrade. If a realm does have a billing relationship, all the screens are geared toward making it easy to access current and historical billing information.
Note that having a billing relationship doesn’t necessarily mean they are currently on a paid plan, or that they currently have a card on file.
- When manually testing, I find I often run
Customer.objects.all().delete()to reset the state.
- 4242424242424242 is Stripe’s test credit card, also useful for manually testing. You can put anything in the address fields, any future expiry date, and anything for the CVV code. https://stripe.com/docs/testing#cards-responses has some other fun ones.
The general strategy here is that billing-relevant events get written to
requires_billing_update = True, and then a worker
goes through, reads RealmAuditLog row by row, and makes the appropriate
updates in Stripe (in order), keeping track of its state in
BillingProcessor. An invariant is that it cannot be important when
exactly the worker gets around to making the update in Stripe, as long
as the updates for each customer (realm) are made in
Almost all the complexity in the code is due to error handling. We distinguish three kinds of errors:
- Transient errors, like rate limiting or network failures, where we just wait a bit and try again.
- Card decline errors (see below)
- Everything else (e.g. misconfigured API keys, errors thrown by buggy code, etc.), where we just throw an exception and stop the worker.
We use the following strategy for card decline errors. There is a global
realm=None) that processes RealmAuditLog
entries for every customer (realm). If it runs into a card decline error on
some entry, it gives up on that entry and (temporarily) all future entries
of that realm, and spins off a realm-specific BillingProcessor that
marks that realm as needing manual attention. When whatever issue has been
corrected, the realm-specific BillingProcessor completes any
realm-specific RealmAuditLog entries, and then deletes itself.
Notes for manually resolving errors:
BillingProcessor.objects.filter(state='stalled')is always safe to handle manually.
BillingProcessor.objects.filter(state='started')is safe to handle manually only if the billing process worker is not running.
- After resolving the issue, set the processor’s state to
- Stripe’s idempotency keys are only valid for 24 hours. So be mindful of that if manually cleaning something up more than 24 hours after the error occured.