[PM-35101] feat: Complete Stripe premium checkout flow by andrebispo5 · Pull Request #2574 · bitwarden/ios

andrebispo5 · 2026-04-24T17:18:56Z

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-35101

📔 Objective

Implements the complete Stripe premium checkout flow for iOS:

Adds PremiumCheckoutStatus and SubscriptionStatus enums
Extends BillingService with checkout status publishing, premiumCheckoutCanceled(), and premiumStatusChanged()
Adds billing alerts (payment not received, checkout failed, upgrade pending)
Routes the premiumStatusChanged push notification through BillingService instead of a plain sync
Handles the bitwarden://premium-checkout-result deep link in AppProcessor
Subscribes to checkout status in PremiumUpgradeProcessor (loading overlay, cancel/retry alert, dismiss on confirm)
Adds an "Upgraded to Premium" action card to the vault list and streams checkout status to update premium state

📸 Screenshots

ScreenRecording_04-27-2026.17-47-23_1.mov

…ingService

…ssor

…deProcessor

…heckout streaming

…bounce and early-exit guard

…miss navigation

…Combine subscription

…sor to VaultListProcessor

# Conflicts: # BitwardenShared/Core/Platform/Services/NotificationServiceTests.swift # BitwardenShared/UI/Billing/PremiumUpgrade/PremiumUpgradeProcessorTests.swift

github-actions · 2026-04-28T17:40:49Z

Checkmarx One – Scan Summary & Details – 1c8601c1-bc34-42f4-9775-6de0ec23c392

Great job! No new security vulnerabilities introduced in this pull request

codecov · 2026-04-28T17:50:20Z

Codecov Report

❌ Patch coverage is 94.94949% with 40 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.15%. Comparing base (2ed2b51) to head (12b4155).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
...lling/PremiumUpgrade/PremiumUpgradeProcessor.swift	65.21%	16 Missing ⚠️
...hared/UI/Vault/Vault/VaultList/VaultListView.swift	21.05%	15 Missing ⚠️
...enShared/UI/Billing/Extensions/Alert+Billing.swift	89.47%	6 Missing ⚠️
.../UI/Vault/Vault/VaultList/VaultListProcessor.swift	94.23%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2574      +/-   ##
==========================================
- Coverage   87.20%   86.15%   -1.05%     
==========================================
  Files        1892     2126     +234     
  Lines      167474   183009   +15535     
==========================================
+ Hits       146045   157675   +11630     
- Misses      21429    25334    +3905

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

Implements the end-to-end Stripe Premium checkout experience in the iOS app, wiring together deep-link/push triggers, billing-state publishing, UI reactions, and post-upgrade confirmation UI.

Changes:

Added PremiumCheckoutStatus + SubscriptionStatus enums and extended BillingService to publish checkout status and react to deep link/push signals.
Routed premium upgrade results through AppProcessor deep-link handling and NotificationService, with new billing-specific alerts and UI behaviors.
Updated Vault list and Premium upgrade flows to subscribe to checkout status, dismiss/refresh appropriately, and show an “Upgraded to Premium” action card with a route into plan details.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
BitwardenShared/UI/Vault/Vault/VaultRoute.swift	Adds `viewPlanDetails` navigation route.
BitwardenShared/UI/Vault/Vault/VaultList/VaultListView.swift	Adds “Upgraded to Premium” action card UI.
BitwardenShared/UI/Vault/Vault/VaultList/VaultListState.swift	Adds state flag for upgraded action card visibility.
BitwardenShared/UI/Vault/Vault/VaultList/VaultListProcessorTests.swift	Adds tests for checkout-status subscription behavior + new route/action.
BitwardenShared/UI/Vault/Vault/VaultList/VaultListProcessor.swift	Subscribes to billing checkout status; refreshes vault/updates premium UI state; adds plan details routing.
BitwardenShared/UI/Vault/Vault/VaultList/VaultListEffect.swift	Adds effect for dismissing the upgraded action card.
BitwardenShared/UI/Vault/Vault/VaultList/VaultListAction.swift	Adds action for “View plan details”.
BitwardenShared/UI/Vault/Vault/VaultCoordinatorTests.swift	Updates dismiss semantics and adds route test for plan details.
BitwardenShared/UI/Vault/Vault/VaultCoordinator.swift	Adds `DismissCompletionContext`; supports dismiss completion; routes plan details to Settings premium plan.
BitwardenShared/UI/Platform/Application/AppProcessorTests.swift	Adds deep-link tests for premium checkout result handling.
BitwardenShared/UI/Platform/Application/AppProcessor.swift	Handles `bitwarden://premium-checkout-result` deep link and delegates to `BillingService`.
BitwardenShared/UI/Billing/PremiumUpgrade/PremiumUpgradeProcessor.swift	Creates checkout session, shows overlays/alerts, subscribes to checkout status.
BitwardenShared/UI/Billing/PremiumPlan/PremiumPlanStatus.swift	Maps raw subscription status to UI plan status.
BitwardenShared/UI/Billing/Extensions/Alert+BillingTests.swift	Adds unit tests for new billing alerts.
BitwardenShared/UI/Billing/Extensions/Alert+Billing.swift	Adds billing-specific alert builders.
BitwardenShared/Core/Platform/Utilities/BitwardenDeepLinkConstants.swift	Adds constants for premium checkout result deep link + query param.
BitwardenShared/Core/Platform/Services/ServiceContainer.swift	Wires `BillingService` into container and into `NotificationService`.
BitwardenShared/Core/Platform/Services/NotificationServiceTests.swift	Updates expectations to route premium status change via billing service.
BitwardenShared/Core/Platform/Services/NotificationService.swift	Handles `premiumStatusChanged` push by calling `billingService.premiumStatusChanged()`.
BitwardenShared/Core/Billing/Services/BillingServiceTests.swift	Adds tests for status publishing/reset and sync behavior.
BitwardenShared/Core/Billing/Services/BillingService.swift	Extends `BillingService` API; implements status publisher + sync-triggered state publishing.
BitwardenShared/Core/Billing/Models/Response/BitwardenSubscriptionResponseModel.swift	Changes subscription `status` from `String` to `SubscriptionStatus`.
BitwardenShared/Core/Billing/Models/Enum/SubscriptionStatus.swift	Adds raw Stripe subscription status enum.
BitwardenShared/Core/Billing/Models/Enum/PremiumCheckoutStatus.swift	Adds premium checkout sync status enum.
BitwardenResources/Localizations/en.lproj/Localizable.strings	Adds new strings for checkout alerts, overlays, and confirmation card.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-28T18:20:16Z

+        if result == BitwardenDeepLinkConstants.PremiumCheckoutResultQuery.successValue {
+            await services.billingService.premiumStatusChanged()
+        } else {
+            services.billingService.premiumCheckoutCanceled()
+        }
+        return true


handlePremiumCheckoutResult treats any premium-checkout-result URL whose result query item is missing or not equal to success as a cancellation. That means malformed/unknown values (e.g. missing result, typos, future values) will incorrectly trigger the “payment not received” flow. Consider explicitly handling only the known values (e.g. success and canceled) and returning false (or logging + returning false) for anything else so unrelated/invalid deep links don’t affect billing state.

Suggested change

if result == BitwardenDeepLinkConstants.PremiumCheckoutResultQuery.successValue {

await services.billingService.premiumStatusChanged()

} else {

services.billingService.premiumCheckoutCanceled()

}

return true

if result == BitwardenDeepLinkConstants.PremiumCheckoutResultQuery.successValue {

await services.billingService.premiumStatusChanged()

return true

}

if result == BitwardenDeepLinkConstants.PremiumCheckoutResultQuery.canceledValue {

services.billingService.premiumCheckoutCanceled()

return true

}

return false

Copilot · 2026-04-28T18:20:16Z

+    private func subscribeToPremiumCheckoutStatus() {
+        premiumStatusChangedCancellable = services.billingService
+            .premiumCheckoutStatusPublisher()
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] status in
+                guard let self else { return }
+                switch status {
+                case .canceled:
+                    premiumStatusChangedCancellable = nil
+                    coordinator.showAlert(.paymentNotReceivedYet {
+                        self.state.checkoutURL = self.lastCheckoutURL
+                    })
+                case .confirmed,


In subscribeToPremiumCheckoutStatus, the .canceled branch sets premiumStatusChangedCancellable = nil and then shows the “Go back” alert which reopens lastCheckoutURL. If the user taps “Go back” and later completes checkout, there will no longer be an active subscription to receive .syncing/.confirmed/.pending, so the rest of the flow (dismissal/overlay/refresh) won’t run. Keep the subscription alive across cancel-and-retry (or re-subscribe in the “Go back” handler before reopening Stripe).

Copilot · 2026-04-28T18:20:17Z

+                guard let self else { return }
+                switch status {
+                case .canceled:
+                    premiumStatusChangedCancellable = nil


subscribeToPremiumCheckoutStatus cancels the subscription on .canceled. If the user reopens Stripe from the “Go back” action (without re-entering the upgrade flow), subsequent .syncing/.confirmed/.pending events from a successful retry won’t be observed here—so the vault list won’t run the dismiss/refresh logic or show the “Upgraded to Premium” action card. Consider keeping the subscription alive across a cancel-and-retry, or resubscribing when the user chooses to retry checkout.

Suggested change

premiumStatusChangedCancellable = nil

break

Copilot · 2026-04-28T18:20:17Z

+    case paused
+    case pastDue = "past_due"
+    case trialing
+    case unpaid


SubscriptionStatus is a closed String-backed Codable enum. If the API ever returns a new/unknown Stripe status value, decoding BitwardenSubscriptionResponseModel will fail and subscription fetching will break. Consider adding an unknown case and a custom init(from:) that defaults to .unknown (optionally logging the raw value) so the client remains forward-compatible.

Suggested change

case unpaid

case unpaid

case unknown

init(from decoder: Decoder) throws {

let container = try decoder.singleValueContainer()

let rawValue = try container.decode(String.self)

self = Self(rawValue: rawValue) ?? .unknown

}

…ipe-payment # Conflicts: # BitwardenShared/Core/Billing/Models/Enum/SubscriptionStatus.swift # BitwardenShared/Core/Billing/Services/BillingService.swift # BitwardenShared/Core/Billing/Services/BillingServiceTests.swift # BitwardenShared/UI/Billing/PremiumPlan/PremiumPlanStatus.swift

fedemkr · 2026-04-29T17:12:57Z

+    func premiumCheckoutCanceled() {
+        premiumCheckoutStatusSubject.send(.canceled)
+        premiumCheckoutStatusSubject.send(nil)
+    }


🤔 Why do you need to send nil after canceled?

private let premiumCheckoutStatusSubject = CurrentValueSubject<PremiumCheckoutStatus?, Never>(nil) saves the last value passed for new subscribers. when we get to the .canceled state we want to remove it from being propagated again so we set it at nil. We can also send them in sequence because the .compactMap(\.self) will clear the nil before the debounce.

And can't you use PassthroughSubject instead? which doesn't hold the last value and just propagates only to already subscribed subscribers.

fedemkr · 2026-04-29T17:13:54Z

+    func premiumCheckoutStatusPublisher() -> AnyPublisher<PremiumCheckoutStatus, Never> {
+        premiumCheckoutStatusSubject
+            .compactMap(\.self)
+            .debounce(for: .milliseconds(300), scheduler: DispatchQueue.main)


🤔 Are you adding the debounce in case several status are sent in a row and you only want to publish the last one?

yup exactly.

fedemkr · 2026-04-29T17:28:04Z

+        premiumCheckoutStatusSubject.send(hasPremium ? .confirmed : .pending)
+        if hasPremium {
+            premiumCheckoutStatusSubject.send(nil)
+        }


🤔 Why is it needed to send nil if you have already sent confirmed?

same explanation has above in this case .confirmed is an end state.

fedemkr · 2026-04-29T17:38:07Z

+        premiumStatusChangedCancellable = services.billingService
+            .premiumCheckoutStatusPublisher()
+            .receive(on: DispatchQueue.main)
+            .sink { [weak self] status in


🤔 Why aren't you using for await here instead of this sink subscription? Additionally, if the user goes back (away from this screen) after it's subscribed, is the subscription canceled or remains in memory?

Using this method is easier to cancel the subscription without having to explicitly handling tasks.

Regarding the cancellation:

It will be cancelled and released:

premiumStatusChangedCancellable is a property on the processor

When the processor deallocates, that property deallocates with it

AnyCancellable automatically calls cancel() on deallocation → subscription is torn down

The [weak self] is the key safety piece. Without it:

processor → cancellable → sink closure → strong self (processor)

That's a retain cycle — the processor would keep itself alive and never deallocate.

With [weak self]:
processor → cancellable → sink closure → weak ref (processor)

No cycle. Processor can deallocate freely, taking the cancellable with it.

fedemkr · 2026-04-29T17:40:24Z

+    /// - Returns: `true` if the URL was a premium checkout result and was handled.
+    ///
+    private func handlePremiumCheckoutResult(url: URL) async -> Bool {
+        guard url.scheme == "bitwarden", url.host == "premium-checkout-result" else {


🎨 You can use isBitwardenAppScheme String extension for the scheme and I would move the host to the constants file.

fedemkr · 2026-04-29T17:46:18Z

+        try await Task.sleep(nanoseconds: 100_000_000)
+        XCTAssertEqual(coordinator.routes.count, routeCountBeforeSend)


⛏️ Use waitForAsync instead.

fedemkr · 2026-04-29T17:48:53Z

+// MARK: - DismissCompletionContext
+
+/// A context object used to pass a completion handler through `coordinator.navigate(to: .dismiss)`.
+///
+class DismissCompletionContext: NSObject {
+    let completion: () -> Void
+
+    init(completion: @escaping () -> Void) {
+        self.completion = completion
+    }
+}


🤔 Isn't this alike DismissAction? Or how is this different?

of course we can... 🤦

…ordering

…ltRoute and VaultCoordinator

…sites

…ails (#2590)

fedemkr

Looks good, just some minor ⛏️

fedemkr · 2026-04-30T13:10:31Z

-        XCTAssertEqual(coordinator.routes.last, .dismiss)
-        context.completion()
+        try await waitForAsync {
+            guard case .dismiss(let action) = self.coordinator.routes.last else { return false }


⛏️ We usually use guard case let instead of the let inside.

fedemkr · 2026-04-30T13:10:36Z

-        XCTAssertEqual(coordinator.routes.last, .dismiss)
-        context.completion()
+        try await waitForAsync {
+            guard case .dismiss(let action) = self.coordinator.routes.last else { return false }


⛏️ We usually use guard case let instead of the let inside.

fedemkr · 2026-04-30T13:10:52Z

-        XCTAssertEqual(coordinator.routes.last, .dismiss)
-        context.completion()
+        try await waitForAsync {
+            guard case .dismiss(let action) = self.coordinator.routes.last else { return false }


⛏️ We usually use guard case let instead of the let inside.

andrebispo5 added 15 commits April 20, 2026 16:25

[PM-33847] feat: Add premiumStatusChanged notification type

7c29363

[PM-33847] feat: Trigger sync on premiumStatusChanged notification

7ad422f

[PM-33847] test: Add premiumStatusChanged notification test

4c9ba52

[PM-35101] feat: Add PremiumCheckoutStatus and SubscriptionStatus enums

ffbb392

[PM-35101] feat: Add premium checkout status to BillingService

f4e003c

[PM-35101] feat: Add billing alerts and localizations

16e2c2b

[PM-35101] feat: Route premiumStatusChanged notification through Bill…

874f62f

…ingService

[PM-35101] feat: Handle premium checkout result deep link in AppProce…

2442099

…ssor

[PM-35101] feat: Subscribe to premium checkout status in PremiumUpgra…

532d133

…deProcessor

[PM-35101] feat: Add upgraded-to-premium action card and vault list c…

d34888e

…heckout streaming

[PM-35101] feat: Switch BillingService to CurrentValueSubject with de…

3e39c05

…bounce and early-exit guard

[PM-35101] feat: Add DismissCompletionContext to VaultCoordinator dis…

7dc159b

…miss navigation

[PM-35101] refactor: Replace streamPremiumCheckoutStatus effect with …

c76547d

…Combine subscription

[PM-35101] refactor: Move dismiss ownership from PremiumUpgradeProces…

fe73e4a

…sor to VaultListProcessor

Merge branch 'main' into pm-35101/complete-stripe-payment

2f03388

# Conflicts: # BitwardenShared/Core/Platform/Services/NotificationServiceTests.swift # BitwardenShared/UI/Billing/PremiumUpgrade/PremiumUpgradeProcessorTests.swift

github-actions Bot added app:password-manager Bitwarden Password Manager app context app:authenticator Bitwarden Authenticator app context t:feature labels Apr 28, 2026

andrebispo5 requested a review from Copilot April 28, 2026 18:11

Copilot started reviewing on behalf of andrebispo5 April 28, 2026 18:11 View session

Copilot AI reviewed Apr 28, 2026

View reviewed changes

andrebispo5 marked this pull request as ready for review April 29, 2026 09:26

andrebispo5 requested review from a team and matt-livefront as code owners April 29, 2026 09:26

andrebispo5 added 4 commits April 29, 2026 10:54

[PM-35101] Fix PR suggestions

dc18017

[PM-35101] Guard premiumStatusChanged against self-host and feature flag

82dced1

[PM-35101] Add tests for premiumStatusChanged guards

7adb75d

fedemkr reviewed Apr 29, 2026

View reviewed changes

andrebispo5 and others added 5 commits April 29, 2026 22:52

[PM-35101] Remove unused premiumCheckoutResult constant and fix type …

8d1e16f

…ordering

[PM-35101] Replace DismissCompletionContext with DismissAction in Vau…

68c53ad

…ltRoute and VaultCoordinator

[PM-35101] Update processors to use DismissAction and dismiss() call …

52df062

…sites

[PM-35101] Update tests for DismissAction and dismiss() syntax

6171a87

[PM-35757] feat: Show pricing error banner when premium price fetch f…

3a4e645

…ails (#2590)

andrebispo5 requested a review from fedemkr April 29, 2026 22:19

andrebispo5 and others added 2 commits April 30, 2026 08:46

[PM-35101] Remove task sleep

7aa80c1

Merge branch 'main' into pm-35101/complete-stripe-payment

f1c1873

fedemkr reviewed Apr 30, 2026

View reviewed changes

andrebispo5 added 2 commits April 30, 2026 15:30

[PM-35101] test: fix guard case let style in dismiss pattern tests

b6c2a68

[PM-35101] Re apply remove task sleep commit.

12b4155

fedemkr approved these changes Apr 30, 2026

View reviewed changes

andrebispo5 enabled auto-merge (squash) April 30, 2026 15:10

andrebispo5 merged commit 139286b into main Apr 30, 2026
19 checks passed

andrebispo5 deleted the pm-35101/complete-stripe-payment branch April 30, 2026 15:17

-    case unpaid
+    case unpaid
+    case unknown
+    init(from decoder: Decoder) throws {
+        let container = try decoder.singleValueContainer()
+        let rawValue = try container.decode(String.self)
+        self = Self(rawValue: rawValue) ?? .unknown
+    }

		try await Task.sleep(nanoseconds: 100_000_000)
		XCTAssertEqual(coordinator.routes.count, routeCountBeforeSend)

Conversation

andrebispo5 commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎟️ Tracking

📔 Objective

📸 Screenshots

Uh oh!

github-actions Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Great job! No new security vulnerabilities introduced in this pull request

Uh oh!

codecov Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fedemkr left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

andrebispo5 commented Apr 24, 2026 •

edited

Loading

github-actions Bot commented Apr 28, 2026 •

edited

Loading

codecov Bot commented Apr 28, 2026 •

edited

Loading