fix(billing): keep deleted identities 30 days, drop Google subjects, leave the dialog unchanged

- Identity digests now expire 30 days after the deletion, inside the privacy
  policy's 30-day Account Data window.
- Google subject ids are no longer recorded or matched (the policy keeps
  Google API data only 7 days after deletion); a Google re-signup is still
  caught by its email digest. GitHub and Microsoft subjects are kept.
- The deletion dialog is unchanged from staging.
- Callers added on staging pass the deletion option.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/settings/components/general/components/delete-account-modal.tsx

@@ -6,7 +6,6 @@ import { createLogger } from '@sim/logger'
 import { sleep } from '@sim/utils/helpers'
 import { formatQuotedNameList, normalizeEmail } from '@sim/utils/string'
 import { signOut } from '@/lib/auth/client'
-import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { useAccountDeletionPlan, useDeleteAccount } from '@/hooks/queries/account-deletion'
 import { clearUserData } from '@/stores'
 
@@ -43,7 +42,6 @@ function names(workspaces: { name: string }[]): string {
  */
 export function DeleteAccountModal({ open, onOpenChange, email }: DeleteAccountModalProps) {
   const [confirmEmail, setConfirmEmail] = useState('')
-  const { billingEnabled } = useDeploymentShape()
   const { data: plan, isFetching: isPlanFetching, error: planError } = useAccountDeletionPlan(open)
   const deleteAccount = useDeleteAccount()
 
@@ -130,12 +128,6 @@ export function DeleteAccountModal({ open, onOpenChange, email }: DeleteAccountM
             workflows, chats, files, knowledge bases and credentials.{' '}
             <span className='text-[var(--text-error)]'>This cannot be undone.</span>
           </p>
-          {billingEnabled && (
-            <p className='text-[var(--text-secondary)] text-sm'>
-              Free credits are granted once per person. A new account on this email or sign-in
-              starts without them for a year.
-            </p>
-          )}
           {toDelete.length > 0 && (
             <p className='text-[var(--text-secondary)] text-sm'>
               {toDelete.length === 1 ? 'The workspace ' : 'The workspaces '}

apps/sim/lib/billing/core/usage.ts

@@ -3,7 +3,6 @@ import { member, organization, userStats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
 import { and, eq, isNull, sql } from 'drizzle-orm'
-import { isSignInProviderAllowed } from '@/lib/auth/constants'
 import { getEffectiveBillingStatus } from '@/lib/billing/core/access'
 import { defaultBillingPeriod } from '@/lib/billing/core/billing-period'
 import {
@@ -237,7 +236,8 @@ export async function handleNewUser(userId: string, authRequest?: object | null)
  * same auth request as its user is a signup. A sign-in linked to an existing
  * user in a later request never withholds anything; that includes a SCIM- or
  * SSO-provisioned user, whose email was already checked when it was created.
- * Integration connections are skipped.
+ * Only GitHub and Microsoft subjects are matched (see `lib/users/deleted-identity`);
+ * a Google sign-in is matched by its email, and integration connections never are.
  *
  * @param authRequest Better Auth's endpoint context for the request creating the account
  */
@@ -254,7 +254,6 @@ export async function handleNewSignInAccount(
   authRequest: object | null | undefined
 ): Promise<void> {
   if (!authRequest || usersCreatedInAuthRequest.get(authRequest) !== userId) return
-  if (!isSignInProviderAllowed(providerId)) return
   if (!(await isDeletedAccountIdentity({ oauthSubjects: [{ providerId, accountId }] }))) return
   await forfeitFreeTierAllowance(userId)
 }

apps/sim/lib/execution/removal-stops.integration.ts

@@ -264,7 +264,7 @@ describe.runIf(Boolean(redisUrl))('removals stop the workflow runs they orphan',
     )
     const keptQueued = await seedQueuedJob(keptWorkspaceId)
 
-    await deleteUserAccount(departingId)
+    await deleteUserAccount(departingId, { recordIdentity: false })
 
     await expect.poll(() => isCancelled(running)).toBe(true)
     await expect.poll(() => isCancelled(resuming)).toBe(true)

apps/sim/lib/users/account-deletion-attachments.test.ts

@@ -97,7 +97,7 @@ describe('account deletion of private organization Assistant images', () => {
     ])
     queueTableRows(schemaMock.document, [{ key: IMAGE_KEY }])
 
-    await deleteUserAccount('user-1')
+    await deleteUserAccount('user-1', { recordIdentity: false })
 
     expect(mockDeleteFiles).toHaveBeenCalledExactlyOnceWith([FAILED_IMAGE_KEY], 'mothership')
   })

apps/sim/lib/users/deleted-identity.integration.ts

@@ -249,20 +249,47 @@ describe('deleted account identities and the free allowance', () => {
   })
 
   it('never withholds from a stats-less user’s fallback row for a sign-in linked in a later request', async () => {
-    const google = { providerId: 'google', accountId: `google-${generateId()}` }
-    await deleteOwnAccount(
-      await signUp(`google-gone.${generateId()}@deleted-identity.test`, google)
-    )
+    const microsoft = { providerId: 'microsoft', accountId: `ms-${generateId()}` }
+    await deleteOwnAccount(await signUp(`ms-gone.${generateId()}@deleted-identity.test`, microsoft))
     const legacy = await insertUser(`legacy.${generateId()}@deleted-identity.test`)
     const laterRequest = {}
-    await linkAccount(legacy, google)
+    await linkAccount(legacy, microsoft)
 
     await ensureUserStatsExists(legacy, laterRequest)
-    await handleNewSignInAccount({ userId: legacy, ...google }, laterRequest)
+    await handleNewSignInAccount({ userId: legacy, ...microsoft }, laterRequest)
 
     expect(await statsOf(legacy)).toEqual({ freeTierEligible: true, limit: getFreeTierLimit() })
   })
 
+  it('catches a Google re-signup by its email and never records the Google subject', async () => {
+    const email = `google.${generateId()}@deleted-identity.test`
+    const google = { providerId: 'google', accountId: `google-${generateId()}` }
+    const written = await deleteOwnAccount(await signUp(email, google))
+
+    const sameEmail = await signUp(email, google)
+    const newEmail = await signUp(`google-new.${generateId()}@deleted-identity.test`, google)
+
+    expect(written).toHaveLength(1)
+    expect(await statsOf(sameEmail)).toEqual({ freeTierEligible: false, limit: 0 })
+    expect(await statsOf(newEmail)).toEqual({ freeTierEligible: true, limit: getFreeTierLimit() })
+  })
+
+  it('keeps a deleted identity for 30 days from the deletion', async () => {
+    const email = `window.${generateId()}@deleted-identity.test`
+    const userId = await signUp(email)
+    const deletedAt = Date.now()
+    const written = await deleteOwnAccount(userId)
+
+    const rows = await db
+      .select({ expiresAt: deletedAccountIdentity.expiresAt })
+      .from(deletedAccountIdentity)
+      .where(inArray(deletedAccountIdentity.identityHash, written))
+
+    const thirtyDays = 30 * 24 * 60 * 60 * 1000
+    expect(rows).toHaveLength(1)
+    expect(Math.abs(rows[0].expiresAt.getTime() - (deletedAt + thirtyDays))).toBeLessThan(60_000)
+  })
+
   it('records only sign-in identities, as keyed digests holding no address or subject', async () => {
     const email = `digest.${generateId()}@deleted-identity.test`
     const githubSubject = `gh-${generateId()}`

apps/sim/lib/users/deleted-identity.ts

@@ -4,7 +4,6 @@ import { createLogger } from '@sim/logger'
 import { hmacSha256Hex } from '@sim/security/hmac'
 import { getErrorMessage } from '@sim/utils/errors'
 import { and, eq, gt, inArray, lte, sql } from 'drizzle-orm'
-import { isSignInProviderAllowed, SIGN_IN_PROVIDER_IDS } from '@/lib/auth/constants'
 import { env } from '@/lib/core/config/env'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import type { DbOrTx } from '@/lib/db/types'
@@ -14,7 +13,7 @@ import type { DbOrTx } from '@/lib/db/types'
  *
  * The free allowance is a one-time grant per person, but deletion erases the
  * account row and the usage ledger with it, so without this a person could
- * delete and re-register the same Google, GitHub, or email identity for a fresh
+ * delete and re-register the same email, GitHub, or Microsoft identity for a fresh
  * allowance each time. Deletion keeps only keyed one-way digests of the
  * account's sign-in identities; a new account on a matching identity is created
  * normally but without the free allowance. This is the "one free trial per
@@ -35,10 +34,12 @@ const logger = createLogger('DeletedAccountIdentity')
 
 /**
  * How long a deleted account's identity digests are kept, and so how long they
- * withhold the free allowance from new accounts on the same identity: 365 days.
- * Each recorded deletion restarts the window for the identities it records.
+ * withhold the free allowance from new accounts on the same identity: 30 days,
+ * inside the privacy policy's stated retention of Account Data "for 30 days
+ * after a deletion request". Each recorded deletion restarts the window for
+ * the identities it records.
  */
-const DELETED_IDENTITY_RETENTION_MS = 365 * 24 * 60 * 60 * 1000
+const DELETED_IDENTITY_RETENTION_MS = 30 * 24 * 60 * 60 * 1000
 
 /** Expired rows removed per recorded deletion, which keeps the table bounded without a cron. */
 const EXPIRED_PURGE_BATCH = 100
@@ -66,11 +67,17 @@ const PLUS_ADDRESSING_DOMAINS = new Set([
 ])
 
 /**
- * One social sign-in identity: the provider and that provider's stable subject
- * id. Only `SIGN_IN_PROVIDER_IDS` count; integration connections share the
- * `account` table but carry per-connection ids, and the email/password row's
- * `accountId` is the user id itself.
+ * Sign-in providers whose subject ids are recorded and matched. Google is left
+ * out: the privacy policy keeps Google API data only 7 days after deletion, and
+ * a Google re-signup is still caught by its email digest. Integration
+ * connections share the `account` table but carry per-connection ids, and the
+ * email/password row's `accountId` is the user id itself, so neither counts.
  */
+const RECORDED_SIGN_IN_PROVIDER_IDS = ['github', 'microsoft'] as const
+
+const recordedSignInProviderIdSet: ReadonlySet<string> = new Set(RECORDED_SIGN_IN_PROVIDER_IDS)
+
+/** One social sign-in identity: the provider and that provider's stable subject id. */
 interface OAuthSubject {
   providerId: string
   accountId: string
@@ -114,7 +121,7 @@ function identityHashes(identity: SignInIdentity): string[] {
   const email = identity.email ? canonicalizeEmail(identity.email) : null
   if (email) preimages.push(`email:${email}`)
   for (const subject of identity.oauthSubjects ?? []) {
-    if (!isSignInProviderAllowed(subject.providerId) || !subject.accountId) continue
+    if (!recordedSignInProviderIdSet.has(subject.providerId) || !subject.accountId) continue
     preimages.push(`oauth:${subject.providerId}:${subject.accountId}`)
   }
   const key = getIdentityKey()
@@ -131,7 +138,12 @@ async function loadSignInIdentity(executor: DbOrTx, userId: string): Promise<Sig
   const oauthSubjects = await executor
     .select({ providerId: account.providerId, accountId: account.accountId })
     .from(account)
-    .where(and(eq(account.userId, userId), inArray(account.providerId, [...SIGN_IN_PROVIDER_IDS])))
+    .where(
+      and(
+        eq(account.userId, userId),
+        inArray(account.providerId, [...RECORDED_SIGN_IN_PROVIDER_IDS])
+      )
+    )
   return { email: profile?.email, oauthSubjects }
 }
 

apps/sim/lib/users/storage-sweep.integration.ts

@@ -278,7 +278,7 @@ describe('account deletion storage sweep', () => {
     async () => {
       const f = await seed()
       const startedAt = Date.now()
-      await deleteUserAccount(f.departingId)
+      await deleteUserAccount(f.departingId, { recordIdentity: false })
 
       const sweeps = await sweepEvents(f.doomedId)
       const objects = await objectEvents(f.departingId)
@@ -338,7 +338,7 @@ describe('account deletion storage sweep', () => {
       .update(user)
       .set({ image: avatarUrl(f.keys.othersAvatar) })
       .where(inArray(user.id, [f.ownerId, f.departingId]))
-    await deleteUserAccount(f.departingId)
+    await deleteUserAccount(f.departingId, { recordIdentity: false })
 
     await runNow((await objectEvents(f.departingId)).map((event) => event.id))
 
@@ -347,7 +347,7 @@ describe('account deletion storage sweep', () => {
 
   check('a sweep for a workspace that exists again completes without deleting', async () => {
     const f = await seed()
-    await deleteUserAccount(f.departingId)
+    await deleteUserAccount(f.departingId, { recordIdentity: false })
     const [sweep] = await sweepEvents(f.doomedId)
     await insertAdminWorkspace(f.doomedId, f.ownerId)
     const restored = `workspace/${f.doomedId}/restored.txt`