Reduce false signup trial risk alerts

tests/test_web_observability.py

@@ -315,6 +315,15 @@ def test_ops_billing_risk_surfaces_trial_payment_referral_and_points(monkeypatch
         DBManager,
         "list_app_analytics_events",
         lambda self, limit=20000, since_iso=None: [
+            {
+                "id": 10,
+                "event_type": "login_start",
+                "user_id": None,
+                "client_id": "c1",
+                "session_id": "session-gap",
+                "created_at": recent,
+                "payload": {"mode": "signup"},
+            },
             {
                 "id": 11,
                 "event_type": "signup_success",
@@ -419,6 +428,108 @@ def test_ops_billing_risk_does_not_flag_signup_when_backend_trial_exists(monkeyp
     assert not any(issue["category"] == "signup_trial" for issue in payload["issues"])
 
 
+def test_ops_billing_risk_ignores_account_visit_without_signup_intent(monkeypatch):
+    from src.database.db_manager import DBManager
+
+    recent = datetime.now(timezone.utc).isoformat()
+
+    monkeypatch.setattr(ops_api.legacy_routes, "_require_ops_admin", lambda request: {"email": "ops@example.com"})
+    monkeypatch.setattr(ops_api, "_supabase_rest_rows", lambda table, params, *, timeout=10: [])
+    monkeypatch.setattr(
+        DBManager,
+        "list_app_analytics_events",
+        lambda self, limit=20000, since_iso=None: [
+            {
+                "id": 61,
+                "event_type": "signup_success",
+                "user_id": "returning-no-trial-user",
+                "client_id": "client-return",
+                "session_id": "session-return",
+                "created_at": recent,
+                "payload": {
+                    "entry": "account_center",
+                    "user_id": "returning-no-trial-user",
+                },
+            }
+        ],
+    )
+    monkeypatch.setattr(
+        DBManager,
+        "list_payment_audit_events",
+        lambda self, limit=50, event_type=None: [],
+    )
+
+    payload = ops_api.get_ops_billing_risk(None, days=30, limit=20)
+
+    assert payload["summary"]["trial_gaps"] == 0
+    assert not any(issue["category"] == "signup_trial" for issue in payload["issues"])
+
+
+def test_ops_billing_risk_treats_expired_signup_trial_subscription_as_backend_evidence(monkeypatch):
+    from src.database.db_manager import DBManager
+
+    now = datetime.now(timezone.utc)
+    recent = now.isoformat()
+    expired = (now - timedelta(days=2)).isoformat()
+
+    def fake_supabase_rows(table, params, *, timeout=10):
+        if table == "subscriptions" and params.get("or") == "(source.eq.signup_trial,plan_code.eq.signup_trial_3d)":
+            return [
+                {
+                    "id": 81,
+                    "user_id": "expired-trial-user",
+                    "plan_code": "signup_trial_3d",
+                    "source": "signup_trial",
+                    "status": "expired",
+                    "starts_at": (now - timedelta(days=5)).isoformat(),
+                    "expires_at": expired,
+                    "created_at": (now - timedelta(days=5)).isoformat(),
+                    "updated_at": expired,
+                }
+            ]
+        return []
+
+    monkeypatch.setattr(ops_api.legacy_routes, "_require_ops_admin", lambda request: {"email": "ops@example.com"})
+    monkeypatch.setattr(ops_api, "_supabase_rest_rows", fake_supabase_rows)
+    monkeypatch.setattr(
+        DBManager,
+        "list_app_analytics_events",
+        lambda self, limit=20000, since_iso=None: [
+            {
+                "id": 80,
+                "event_type": "login_start",
+                "user_id": None,
+                "client_id": "client-expired",
+                "session_id": "session-expired",
+                "created_at": recent,
+                "payload": {"mode": "signup"},
+            },
+            {
+                "id": 82,
+                "event_type": "signup_success",
+                "user_id": "expired-trial-user",
+                "client_id": "client-expired",
+                "session_id": "session-expired",
+                "created_at": recent,
+                "payload": {
+                    "entry": "account_center",
+                    "user_id": "expired-trial-user",
+                },
+            },
+        ],
+    )
+    monkeypatch.setattr(
+        DBManager,
+        "list_payment_audit_events",
+        lambda self, limit=50, event_type=None: [],
+    )
+
+    payload = ops_api.get_ops_billing_risk(None, days=30, limit=20)
+
+    assert payload["summary"]["trial_gaps"] == 0
+    assert not any(issue["category"] == "signup_trial" for issue in payload["issues"])
+
+
 def test_ops_payment_incidents_expose_top_level_reason_and_filters_resolved(monkeypatch):
     from src.database.db_manager import DBManager
 

web/services/ops_api.py

@@ -545,18 +545,41 @@ def get_ops_billing_risk(
             "limit": str(max(safe_limit * 10, 500)),
         },
     )
-    subscription_rows = collect(
+    trial_subscription_rows = collect(
         "subscriptions",
         {
             "select": (
                 "id,user_id,plan_code,source,status,starts_at,expires_at,"
                 "created_at,updated_at"
             ),
-            "or": "(source.eq.signup_trial,plan_code.eq.signup_trial_3d,status.eq.active)",
+            "or": "(source.eq.signup_trial,plan_code.eq.signup_trial_3d)",
             "order": "created_at.desc",
             "limit": str(max(safe_limit * 20, 1000)),
         },
     )
+    active_subscription_rows = collect(
+        "subscriptions",
+        {
+            "select": (
+                "id,user_id,plan_code,source,status,starts_at,expires_at,"
+                "created_at,updated_at"
+            ),
+            "status": "eq.active",
+            "order": "created_at.desc",
+            "limit": str(max(safe_limit * 20, 1000)),
+        },
+    )
+    subscription_rows: List[Dict[str, Any]] = []
+    seen_subscription_keys: set[str] = set()
+    for row in [*trial_subscription_rows, *active_subscription_rows]:
+        key = str(row.get("id") or "").strip() or (
+            f"{row.get('user_id')}:{row.get('plan_code')}:{row.get('source')}:"
+            f"{row.get('starts_at')}:{row.get('expires_at')}"
+        )
+        if key in seen_subscription_keys:
+            continue
+        seen_subscription_keys.add(key)
+        subscription_rows.append(row)
     entitlement_trial_events = collect(
         "entitlement_events",
         {
@@ -751,6 +774,40 @@ def get_ops_billing_risk(
     def normalize_user_key(value: Any) -> str:
         return str(value or "").strip().lower()
 
+    def analytics_payload(row: Dict[str, Any]) -> Dict[str, Any]:
+        payload = row.get("payload")
+        return payload if isinstance(payload, dict) else {}
+
+    def analytics_correlation_keys(row: Dict[str, Any]) -> set[str]:
+        payload = analytics_payload(row)
+        keys: set[str] = set()
+        user_id = normalize_user_key(row.get("user_id") or payload.get("user_id"))
+        client_id = str(row.get("client_id") or "").strip()
+        session_id = str(row.get("session_id") or "").strip()
+        if user_id:
+            keys.add(f"user:{user_id}")
+        if client_id:
+            keys.add(f"client:{client_id}")
+        if session_id:
+            keys.add(f"session:{session_id}")
+        return keys
+
+    signup_intent_keys: set[str] = set()
+    for row in events:
+        if str(row.get("event_type") or "").strip().lower() != "login_start":
+            continue
+        payload = analytics_payload(row)
+        mode = str(payload.get("mode") or payload.get("auth_mode") or "").strip().lower()
+        if mode == "signup":
+            signup_intent_keys.update(analytics_correlation_keys(row))
+
+    def has_signup_intent(row: Dict[str, Any]) -> bool:
+        payload = analytics_payload(row)
+        mode = str(payload.get("mode") or payload.get("auth_mode") or "").strip().lower()
+        if mode == "signup" or payload.get("signup_intent") is True:
+            return True
+        return bool(analytics_correlation_keys(row).intersection(signup_intent_keys))
+
     trial_actor_keys = {
         _app_analytics_actor_key(row)
         for row in events
@@ -817,10 +874,12 @@ def get_ops_billing_risk(
             )
 
     for row in signup_rows[:300]:
+        if not has_signup_intent(row):
+            continue
         actor_key = _app_analytics_actor_key(row)
         if actor_key in trial_actor_keys:
             continue
-        payload = row.get("payload") if isinstance(row.get("payload"), dict) else {}
+        payload = analytics_payload(row)
         signup_user_id = normalize_user_key(row.get("user_id") or payload.get("user_id"))
         if not signup_user_id:
             continue