Add coupon support to invoice preview and subscription creation by cyprain-okeke · Pull Request #6994 · bitwarden/server

cyprain-okeke · 2026-02-12T11:35:42Z

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-30272

📔 Objective

This PR adds coupon/discount code support to the subscription purchase flow, enabling users to apply promotional discounts during both
tax preview and subscription creation for Premium and Organization subscriptions.

What's Changed

1. Tax Preview with Coupon Support

Added optional coupon parameter to tax preview endpoints, allowing users to see discounted pricing before purchase:

Organization Tax Preview: POST /api/billing/preview-invoice/organization-subscription-purchase-tax
Premium Tax Preview: POST /api/billing/preview-invoice/premium-subscription-purchase-tax

Both endpoints now accept an optional coupon field in the request body and return tax calculations with the discount applied.

2. Subscription Creation with Coupon Support

Updated subscription creation endpoints to accept and validate coupon codes:

Premium Subscription: POST /api/billing/vnext/accounts/premium-cloud-hosted-subscription
Organization Subscription: Handled via OrganizationBillingService.Finalize()

Coupons are validated server-side before being applied to ensure user eligibility.

3. Server-Side Validation

Implemented ISubscriptionDiscountService to validate coupon eligibility:

Verifies coupon exists in database
Checks if coupon is within valid date range
Validates user meets audience targeting criteria (e.g., no previous subscriptions)
Returns appropriate error messages for invalid/ineligible coupons

4. Special Case Handling

Sponsored Plans: User-provided coupons are ignored (organization gets free plan)
Standalone Secrets Manager: System coupon takes precedence over user coupons
Invalid Coupons: Returns 400 Bad Request with message: "The coupon code is invalid or you are not eligible for this discount."

Technical Implementation

API Layer:

Added Coupon property to request models with [MaxLength(50)] validation
Updated controllers to extract and pass coupon parameter to commands
Input sanitization: whitespace is trimmed before processing

Business Logic:

PreviewOrganizationTaxCommand: Applies coupon to Stripe invoice preview
PreviewPremiumTaxCommand: Applies coupon to Stripe invoice preview
CreatePremiumCloudHostedSubscriptionCommand: Validates and applies coupon to subscription
OrganizationBillingService: Validates and applies coupon to organization subscription

📸 Screenshots

github-actions · 2026-02-12T11:47:01Z

Checkmarx One – Scan Summary & Details – c55da753-6bd6-49e6-a049-cc59b802e54f

New Issues (2)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1527	details Method at line 1527 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector
2		CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1403	details Method at line 1403 of /src/Api/Vault/Controllers/CiphersController.cs gets a parameter from a user request from id. This parameter value flows ... Attack Vector

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	~~CSRF~~	/src/Api/Vault/Controllers/CiphersController.cs: 293

codecov · 2026-02-12T11:57:39Z

Codecov Report

❌ Patch coverage is 30.55556% with 50 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.26%. Comparing base (c15c418) to head (56109c1).

Files with missing lines	Patch %	Lines
...ces/Implementations/SubscriptionDiscountService.cs	0.00%	18 Missing ⚠️
...nds/CreatePremiumCloudHostedSubscriptionCommand.cs	33.33%	9 Missing and 1 partial ⚠️
...ganizations/Services/OrganizationBillingService.cs	30.00%	6 Missing and 1 partial ⚠️
...pi/Billing/Controllers/PreviewInvoiceController.cs	0.00%	4 Missing ⚠️
...lling/Premium/Commands/PreviewPremiumTaxCommand.cs	40.00%	3 Missing ⚠️
...Controllers/VNext/AccountBillingVNextController.cs	0.00%	2 Missing ⚠️
...s/Premium/PremiumCloudHostedSubscriptionRequest.cs	0.00%	2 Missing ⚠️
...eviewOrganizationSubscriptionPurchaseTaxRequest.cs	0.00%	2 Missing ⚠️
...ce/PreviewPremiumSubscriptionPurchaseTaxRequest.cs	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6994      +/-   ##
==========================================
- Coverage   56.28%   56.26%   -0.02%     
==========================================
  Files        1986     1987       +1     
  Lines       87660    87718      +58     
  Branches     7814     7821       +7     
==========================================
+ Hits        49339    49355      +16     
- Misses      36490    36530      +40     
- Partials     1831     1833       +2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…with-Coupon-Support

amorask-bitwarden

Good start - few changes we need to clean this up.

For testing, can you:

Add tests for SubscriptionDiscountService
Update the tests for CreatePremiumCloudHostedSubscriptionCommand to validate coupon functionality instead of passing null to all
Update the tests for PreviewPremiumTaxCommand to validate coupon functionality instead of passing null to all

If you want, optionally add more tests for OrganizationBillingService.Finalize to cover your cases.

amorask-bitwarden · 2026-02-12T20:26:30Z

src/Core/Billing/Services/Implementations/SubscriptionDiscountService.cs

@@ -0,0 +1,34 @@
+#nullable enable


❌ Not needed

amorask-bitwarden · 2026-02-12T20:27:34Z

src/Core/Billing/Services/Implementations/SubscriptionDiscountService.cs

+        return discount.AudienceType switch
+        {
+            DiscountAudienceType.UserHasNoPreviousSubscriptions =>
+                !user.Premium && string.IsNullOrEmpty(user.GatewaySubscriptionId),


❌ This checks if the user has a premium subscription; not if they've ever had a premium subscription. I think we need to check this and also pull their customer to check for any inactive premium subscriptions from the past.

amorask-bitwarden · 2026-02-12T20:28:45Z

src/Core/Billing/Organizations/Commands/PreviewOrganizationTaxCommand.cs

        OrganizationSubscriptionPurchase purchase,
-        BillingAddress billingAddress);
+        BillingAddress billingAddress,
+        string? coupon);


❌ This should be part of the OrganizationSubscriptionPurchase.

amorask-bitwarden · 2026-02-12T20:57:07Z

src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs

        [FromBody] PremiumCloudHostedSubscriptionRequest request)
    {
-        var (paymentMethod, billingAddress, additionalStorageGb) = request.ToDomain();
+        var (paymentMethod, billingAddress, additionalStorageGb, coupon) = request.ToDomain();


⛏️ At 4 values, I think this is becoming a bit too unwieldy. Can we create a new PremiumSubscriptionPurchase in src/Core/Billing/Premium/Models, similar to the OrganizationSubscriptionPurchase and pass that into the command instead?

amorask-bitwarden · 2026-02-12T20:57:38Z

src/Api/Billing/Controllers/PreviewInvoiceController.cs

    {
-        var (purchase, billingAddress) = request.ToDomain();
-        var result = await previewOrganizationTaxCommand.Run(purchase, billingAddress);
+        var (purchase, billingAddress, coupon) = request.ToDomain();


❌ coupon should be part of the purchase.

amorask-bitwarden · 2026-02-12T21:05:22Z

src/Core/Billing/Organizations/Services/OrganizationBillingService.cs

-        var (organization, customerSetup, subscriptionSetup) = sale;
+        var (organization, customerSetup, subscriptionSetup, owner) = sale;
+
+        if (!string.IsNullOrWhiteSpace(customerSetup?.Coupon) && owner != null)


❌ If the owner is set to null in the OrganizationSignup model that constructed the sale, the validation you've added will be bypassed and the coupon will be applied regardless.

Additionally:

This change would break SM Standalone coupon application on release, since that coupon isn't represented as a SubscriptionDiscount nor does it have an audience.

This change applies to all organization sales regardless of tier even though the ticket specifies these coupons are only for users purchasing Premium or Families.

amorask-bitwarden · 2026-02-12T21:07:58Z

src/Api/Billing/Models/Requests/Premium/PremiumCloudHostedSubscriptionRequest.cs

    [Range(0, 99)]
    public short AdditionalStorageGb { get; set; } = 0;

+    public string? Coupon { get; set; }


⛏️ The DB only takes 50 characters so we should [MaxLength(50)] this.

amorask-bitwarden · 2026-02-12T21:08:03Z

.../Billing/Models/Requests/PreviewInvoice/PreviewOrganizationSubscriptionPurchaseTaxRequest.cs


-    public (OrganizationSubscriptionPurchase, BillingAddress) ToDomain() =>
-        (Purchase.ToDomain(), BillingAddress.ToDomain());
+    public string? Coupon { get; set; }


⛏️ The DB only takes 50 characters so we should [MaxLength(50)] this.

amorask-bitwarden · 2026-02-12T21:08:08Z

src/Api/Billing/Models/Requests/PreviewInvoice/PreviewPremiumSubscriptionPurchaseTaxRequest.cs

    public required MinimalBillingAddressRequest BillingAddress { get; set; }

-    public (short, BillingAddress) ToDomain() => (AdditionalStorage, BillingAddress.ToDomain());
+    public string? Coupon { get; set; }


⛏️ The DB only takes 50 characters so we should [MaxLength(50)] this.

amorask-bitwarden · 2026-02-12T21:10:50Z

src/Core/Billing/Services/ISubscriptionDiscountService.cs

+    /// <item>The user meets the audience targeting criteria for the discount</item>
+    /// </list>
+    /// </remarks>
+    Task<bool> ValidateDiscountForUserAsync(User user, string stripeCouponId);


❌ The signature and description of this method are too vague in asserting what it actually does. It doesn't just validate a coupon ID for a user; it specifically checks to see if that coupon ID matches a specific discount audience. That needs to be explicit here. Your options are:

Rename the method to emphasize the specific audience the discount is being validated against

Take in an audience as a parameter to validate against

…with-Coupon-Support

sonarqubecloud · 2026-02-13T19:42:44Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Add coupon support to invoice preview and subscription creation

7d15cbc

cyprain-okeke requested a review from a team as a code owner February 12, 2026 11:35

cyprain-okeke requested a review from sbrown-livefront February 12, 2026 11:35

cyprain-okeke and others added 2 commits February 12, 2026 13:10

Fix the build lint error

9dacedb

Merge branch 'main' into billing/pm-30272/Subscription-Purchase-Flow-…

56109c1

…with-Coupon-Support

amorask-bitwarden requested changes Feb 12, 2026

View reviewed changes

cyprain-okeke added 5 commits February 13, 2026 19:38

Resolve the initial review comments

c3e4a4e

Merge branch 'main' into billing/pm-30272/Subscription-Purchase-Flow-…

0572b39

…with-Coupon-Support

fix the failing test

d2644e3

fix the build lint error

1c4eba3

Fix the failing test

c9399ec

cyprain-okeke requested a review from amorask-bitwarden February 13, 2026 19:54

Conversation

cyprain-okeke commented Feb 12, 2026

🎟️ Tracking

📔 Objective

Technical Implementation

📸 Screenshots

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

amorask-bitwarden left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Feb 13, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Feb 12, 2026 •

edited

Loading

codecov bot commented Feb 12, 2026 •

edited

Loading