[Priyanshubhartistm]

Description

Builds on the subscription data model (#849). Nothing changes unless payments.enabled is true and payments.subscriptionPlans is non-empty.

• POST /invoices takes a planId (instead of a fee schedule) when plans are configured. The invoice is created for the plan price and stores the plan.
• PaymentsService.confirmInvoice starts or extends the subscription in the same transaction as the invoice confirmation, and admits the user. The plan comes from the stored invoice, so the five confirmation paths (maintenance poll and the Zebedee/LNbits/OpenNode/Nodeless callbacks) need no change. A payment below the plan price does not start or extend a period.
  • A payment while access is still running extends from the current period end (paying early loses nothing); after access lapsed, or off the grandfathered plan, the period starts now.
• New SubscriptionService.processLifecycle, run from the maintenance worker each minute: moves subscriptions whose period ended into grace (counted from the period end) or straight to expired (plan has no grace), expires subscriptions whose grace is over, and about three days before a period ends creates a renewal invoice and marks it renewal_pending. Each pass is bounded and a stuck row cannot loop it.
• isUserAdmitted checks the subscription behind the existing admission cache (no extra read per event). Access is judged from the dates, not only the stored status, so a lagging sweep neither locks anyone out nor keeps them in, and the admitted cache entry never outlives the end of access. Admitted users with no subscription row (admitted after the migration, or by invite code / NIP-43) keep access.
• With plans configured and no enabled admission fee, a plan is what admits a user. Pubkeys whitelisted on an admission fee schedule still bypass.
• CONFIGURATION.md describes the behaviour; the .knip.json ignore for the new repository is removed now that it is used.

Related Issue

Closes #908

Motivation and Context

With the data model in place nothing created or ended a subscription: write access still depended only on the permanent is_admitted flag. This adds the billing lifecycle (subscribe, renew, grace, expire) on the existing processors.

[changeset-bot]

🦋 Changeset detected

Latest commit: 4667dc0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coveralls]

Coverage Report for CI Build 39453853954

Coverage increased (+0.4%) to 74.21%

Details

• Coverage increased (+0.4%) from the base build.
• Patch coverage: 1 uncovered change across 1 file (211 of 212 lines covered, 99.53%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
src/app/maintenance-worker.ts	7	6	85.71%
Total (12 files)	212	211	99.53%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	11255
Covered Lines:	8753
Line Coverage:	77.77%
Relevant Branches:	5903
Covered Branches:	3980
Branch Coverage:	67.42%
Branches in Coverage %:	Yes
Coverage Strength:	800.08 hits per line

---

💛 - Coveralls

[greptile-apps]

Confidence Score: 2/5

[Medium impact] The PR changes billing and write access for relays that enable subscription plans.

Fix the invoice price check and the mirrored-write bypass before merging.

Findings

1.  Paid invoices can grant nothing ▶
2.   Mirrored writes skip subscription expiry ▶

Summary

Adds recurring subscriptions when payments and plans are enabled.

• Users can choose a plan and pay to start or extend a subscription.
• The maintenance job requests renewals and moves subscriptions through grace to expiry.
• Write access follows subscription dates while preserving access for admitted users without a plan row.

Two issues need fixing: outstanding invoices can lose their quoted price, and mirrored writes skip the subscription check.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Plan invoice paid] --> B[Confirm payment]
  B --> C[Start or extend subscription]
  C --> D[Client write]
  D --> E[Check subscription dates]
  F[Maintenance] --> G[Create renewal invoice]
  F --> H[Move through grace and expiry]
  I[Mirrored write] --> J[Check permanent admission and balance]
  J --> K[Store event without subscription check]

Loading

_{Reviews (3) · Last reviewed commit: "fix(payments): keep the subscription swe..." · Reviewed by Greptile}

[greptile-apps]

Paid invoices can grant nothing

confirmInvoice checks the current plan.amount, not the price quoted by the stored invoice. If an operator raises a plan's price while an invoice is payable, paying that invoice in full confirms the payment but grants no subscription. Later callbacks skip it because confirmedAt is already set.

Compare payment against the stored amountRequested, converted using its stored unit, so an issued invoice keeps its quoted price.

[greptile-apps]

Mirrored writes skip subscription expiry

The new subscription check only covers EventMessageHandler. If a mirror is configured with skipAdmissionCheck unset, StaticMirroringWorker.isUserAdmitted still accepts an admitted user based on isAdmitted and balance, without checking the subscription. An expired subscriber can publish to the upstream relay and have that event stored locally. Plan-only setups also let never-admitted users through this path because there is no admission fee.

Apply the same subscription check to mirrored writes.

How this was verified: Mirrored events pass through a separate admission check that never reads the subscription, then reach eventRepository.create.