[PM-40292] fix: Handle deleted Stripe customer on Admin user and provider edit pages

[amorask-bitwarden]

🎟️ Tracking

Resolves PM-40292

📔 Objective

The Admin Portal user-edit and provider-edit pages returned a 500 when the subscriber's linked Stripe customer had been deleted. Retrieving a deleted Stripe customer returns an HTTP 200 stub (Deleted = true, Metadata = null) instead of a 404, which produced two different crashes:

• User edit — GetBillingAsync calls Stripe's payment-methods list endpoint, which does return resource_missing for a deleted customer, throwing StripeException.
• Provider edit — CustomerExtensions.ApprovedToPayByInvoice dereferenced the stub's null Metadata, throwing NullReferenceException.

Both pages now degrade gracefully, mirroring the organization fix from PM-38874:

• UsersController.Edit (GET) wraps the billing loads in try/catch — resource_missing surfaces a Warning toast, any other failure an Error toast, and both billing values reset to null so the page still renders.
• ApprovedToPayByInvoice guards null Metadata (fixing the root cause for all three callers), and ProvidersController.GetEditModel surfaces a Warning toast when the customer is a deleted stub.

In every case the admin can still edit the page and set a valid Gateway Customer ID.

Tests: new UsersControllerTests and CustomerExtensionsTests, plus a deleted-customer case added to ProvidersControllerTests.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the Admin Portal handling of deleted Stripe customers across UsersController.Edit (GET), ProvidersController.GetEditModel, the ApprovedToPayByInvoice null-Metadata guard, the Views/Users/Edit.cshtml partial guard, and the new tests. The try/catch, logging, and toast wording mirror the organization fix from PM-38874 (OrganizationsController.cs:239-266), and the Deleted: true pattern correctly handles Stripe's nullable Deleted flag. The view guard only suppresses the billing section when a billing load actually failed — GetBillingAsync/GetBillingHistoryAsync always return non-null instances on success, so unaffected users see no change, and the Gateway Customer ID field and its scripts live outside the guarded block so admins can still remediate.

Code Review Details

No findings.

Note: the github-code-quality annotation on the generic catch (Exception) in src/Admin/Controllers/UsersController.cs:133 is not raised here — the block wraps only the two payment-service calls and matches the established pattern in OrganizationsController.GetEditModel.

[codecov]

Codecov Report

❌ Patch coverage is 89.74359% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 63.55%. Comparing base (13faf3e) to head (4c6823b).
⚠️ Report is 9 commits behind head on main.

Files with missing lines	Patch %	Lines
...in/AdminConsole/Controllers/ProvidersController.cs	75.00%	0 Missing and 2 partials ⚠️
src/Admin/Controllers/UsersController.cs	96.42%	1 Missing ⚠️
src/Admin/Views/Users/Edit.cshtml	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8256      +/-   ##
==========================================
+ Coverage   63.19%   63.55%   +0.35%     
==========================================
  Files        2409     2430      +21     
  Lines      104393   105554    +1161     
  Branches     9453     9642     +189     
==========================================
+ Hits        65971    67082    +1111     
- Misses      36164    36169       +5     
- Partials     2258     2303      +45     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sbrown-livefront]

✅

[amorask-bitwarden]

Superseded by #8276. This PR was auto-closed when the branch was renamed to lowercase (PM → pm) per release-engineering's no-capitals rule. The renamed branch and all commits (including the fix for the CRITICAL billing-partial review finding, commit 4c6823b) carried over to #8276.