improvement(aws-marketplace): close billing gaps and simplify the license write paths by waleedlatif1 · Pull Request #9946 · simstudioai/sim

waleedlatif1 · 2026-11-12T19:55:48Z

Summary

Linking a Marketplace license to an organization that already pays Stripe for a self-serve plan is refused (buyer and admin paths), so AWS and Stripe never bill the same organization. Enterprise stays linkable, since the team provisions it with collection paused
The Stripe checkout block counts only licenses of listings this deployment still sells
A usage record frozen for sending is never added to, even when the charge and the freeze hold locks for different organizations (a license relinked after its organization was deleted); the charge rolls back and its units go to the next record
Container license: a delegate grant, or one pending, rejected, disabled, or deleted by the license administrator, no longer turns Enterprise on; replicas restart at random points over ten minutes on a license change instead of all at once
CloudFormation prerequisites: the RDS password is a fixed, URL-safe generated secret. RDS's managed password rotates every 7 days and may contain characters that break the connection URL, while the chart copies it into a Kubernetes Secret once
Example values use a placeholder product ID, and say how to read both passwords out of Secrets Manager
Simplification: one insert path for new licenses, the inactive-has-no-claim rule applied in one place, a once-only team notice helper, a single buyer contact shape, the claim lookup, lock recheck, and audit entry each written once, a shared products-map type, and a misplaced doc comment moved to its function

Type of Change

Bug fix
Improvement

Testing

lifecycle.integration.ts, metering.integration.ts, checkout-guard.integration.ts against Postgres: 96 pass
New tests: Stripe-billed organizations are refused and Enterprise ones linked; a license on a listing no longer sold does not block checkout. Each goes red with its guard reverted
authorization.test.ts, entitlements.test.ts, aws-marketplace.test.tsx: 22 pass
bun run lint, type-check, check:audits (all but the local-only docs content registry); aws cloudformation validate-template on the prerequisites template

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-11-12T19:55:53Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 12, 2026 8:36pm UTC

gitguardian · 2026-11-12T19:56:01Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
40009848	Triggered	Generic Password	`c48df42`	helm/sim/examples/aws-marketplace-prerequisites.yaml	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

greptile-apps · 2026-11-12T20:00:40Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge with the open-checkout race explicitly deferred.

Summary

This PR tightens AWS Marketplace billing checks and combines repeated license writes.

Marketplace licenses cannot link to organizations with a live self-serve plan.
Sent AWS usage reports keep their recorded quantity.
Enterprise access requires a usable Marketplace license grant.
License registration and event updates share the same write helpers.
The Marketplace setup example uses a fixed database password and clearer secret guidance.

The earlier pending-payment finding is fixed. waleedlatif1 accepted and deferred the open-checkout race: a Stripe checkout already in progress can finish after Marketplace linking. Their stated follow-up is to check Marketplace ownership when the Stripe completion webhook runs. Neither supplied root thread has a comment number, so neither receives a numbered previous-finding entry.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Link Marketplace license] --> B{Already linked here?}
  B -->|Yes| C[Keep existing link]
  B -->|No| D{Live self-serve Stripe subscription?}
  D -->|Yes| E[Refuse link]
  D -->|No| F[Save link]
  G[Start Stripe checkout] --> H{Holds license for configured product?}
  H -->|Yes| I[Refuse checkout]
  H -->|No| J[Continue existing checkout checks]

_{Reviews (5) · Last reviewed commit: "chore(helm): bump chart to 1.11.16 for t..." · Reviewed by Greptile}

cubic-dev-ai

All reported issues were addressed across 14 files

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-11-12T20:07:35Z

@greptile

waleedlatif1 · 2026-11-12T20:07:37Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-12T20:07:43Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 14 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

…ense write paths - Refuse linking a Marketplace license to an organization already paying Stripe for a self-serve plan, so it is never billed twice - Count only listings this deployment sells when blocking Stripe checkout - Never add to a usage record after it is frozen for sending, even under a lock taken for another organization - Container license: require a grant the account may use, and stagger replica restarts on a license change - CloudFormation prerequisites: a fixed URL-safe database password instead of RDS's rotating one; placeholder product ID in the example values - One insert path, one claim invariant, and one once-only notice helper in the repository; shared claim lookup, lock recheck, and audit entry in the use cases

…ling the organization - A trialing or incomplete self-serve subscription becomes a charge, so linking refuses any bound subscription that is not finished; an abandoned checkout with no Stripe subscription stays linkable - Example values name the CloudFormation outputs as secret ARNs and mark the product ID as editable

waleedlatif1 · 2026-11-12T20:32:15Z

@greptile

waleedlatif1 · 2026-11-12T20:32:16Z

@cubic-dev-ai review this PR

waleedlatif1 · 2026-11-12T20:32:18Z

@GitGuardian The flagged line in helm/sim/examples/aws-marketplace-prerequisites.yaml is a CloudFormation dynamic reference ({{resolve:secretsmanager:...}}) to a password that CloudFormation generates in Secrets Manager at deploy time; no secret value is in the template. False positive.

cubic-dev-ai · 2026-11-12T20:32:23Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 15 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-11-12T20:47:28Z

@greptile

vercel Bot deployed to Preview November 12, 2026 20:00

View deployment

greptile-apps Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread apps/sim/lib/billing/aws-marketplace/repository.ts Resolved

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

waleedlatif1 force-pushed the chore/aws-marketplace-audit branch from 6c01fb8 to 26591af Compare November 12, 2026 20:07

vercel Bot deployed to Preview November 12, 2026 20:13

View deployment

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

waleedlatif1 added 3 commits November 12, 2026 12:31

chore(helm): bump chart to 1.11.16 for the Marketplace example changes

8e9c0d4

waleedlatif1 force-pushed the chore/aws-marketplace-audit branch from 26591af to 8e9c0d4 Compare November 12, 2026 20:32

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

greptile-apps Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread apps/sim/lib/billing/aws-marketplace/application/use-cases.ts Resolved

vercel Bot deployed to Preview November 12, 2026 20:36

View deployment

waleedlatif1 merged commit 8fbc750 into staging Nov 12, 2026
88 checks passed

waleedlatif1 deleted the chore/aws-marketplace-audit branch November 12, 2026 20:58

Conversation

waleedlatif1 commented Nov 12, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitguardian Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

greptile-apps Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Nov 12, 2026 •

edited

Loading

gitguardian Bot commented Nov 12, 2026 •

edited

Loading

greptile-apps Bot commented Nov 12, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading