fix: set email when creating new session for trial days

[pavelbrm]

Summary

This PR improves handling of the customer email on a Stripe checkout session when setting trial days on an order and session.

#2698 improved handling, but that was not enough. When we're setting trial days on a session, the caller already has the correct email. SKUs attempts to work out the email based on the old session. Because the two calls (the creation of the initial session and setting trial days) happen very close to each other, the customer record might not be ready yet or miss information.

This PR makes use of the passed email address, and falls back to the old behaviour (i.e. takes the email from on old session) only if it was not passed.

This should address the majority of cases where the checkout page for products with trial might be shown without a pre-filled email address.

Type of Change

• Product feature
• Bug fix
• Performance improvement
• Refactor
• Other

Tested Environments

• Development
• Staging
• Production

Before Requesting Review

• Does your code build cleanly without any errors or warnings?
• Have you used auto closing keywords?
• Have you added tests for new functionality?
• Have validated query efficiency for new database queries?
• Have documented new functionality in README or in comments?
• Have you squashed all intermediate commits?
• Is there a clear title that explains what the PR does?
• Have you used intuitive function, variable and other naming?
• Have you requested security and/or privacy review if needed
• Have you performed a self review of this PR?

Manual Test Plan

[pavelbrm]

This does not do anything useful for Premium orders. The endpoint is already authenticated. The merchant is always the same, it's brave.com, and we set it ourselves. And it seems like caveats for Premium are not populated at all, so the check is useless at least, and it also wastes two queries to the database to fetch the order.

[github-actions]

[puLL-Merge] - brave-intl/bat-go@2710

Description

This PR refactors the handling of trial days for orders in the BAT-Go project. It introduces changes to improve the process of setting trial days and creating Stripe sessions for orders, particularly focusing on the setOrderTrialDays functionality.

Changes

Changes

1. services/skus/controllers.go:

   • Removed setTrialDaysRequest struct and replaced it with model.SetTrialDaysRequest.
   • Updated handleSetOrderTrialDays to use the new setOrderTrialDays method.
   • Added time.Now().UTC() to get the current time for consistency.

2. services/skus/datastore.go:

   • Removed SetOrderTrialDays method from the Datastore interface.
   • Removed SetTrialDays method from the orderStore interface.

3. services/skus/instrumented_datastore.go:

   • Removed SetOrderTrialDays method implementation.

4. services/skus/mockdatastore.go:

   • Removed mock implementations for SetOrderTrialDays and SetTrialDays.

5. services/skus/model/model.go:

   • Added SetTrialDaysRequest struct with Email and TrialDays fields.
   • Updated ShouldSetTrialDays to ShouldCreateTrialSessionStripe.
   • Added IsPaidAt method to check if an order is paid at a specific time.

6. services/skus/model/model_test.go:

   • Updated tests for ShouldCreateTrialSessionStripe and IsPaidAt.

7. services/skus/service.go:

   • Added SetTrialDays method to orderStoreSvc interface.
   • Implemented setOrderTrialDays and setOrderTrialDaysTx methods.
   • Updated recreateStripeSession to handle email parameter.

8. services/skus/service_nonint_test.go:

   • Added tests for setOrderTrialDaysTx.

9. services/skus/storage/repository/mock.go:

   • Added FnSetTrialDays to MockOrder struct.

10. services/skus/storage/repository/repository.go:

    • Updated SetTrialDays method to use execUpdate.

11. services/skus/storage/repository/repository_test.go:

    • Updated tests for SetTrialDays.

Possible Issues

1. The Email field in SetTrialDaysRequest is marked as TODO to make it required, which might lead to inconsistencies if not addressed soon.
2. The removal of validateOrderMerchantAndCaveats in handleSetOrderTrialDays might potentially bypass some important validations.

Security Hotspots

1. The io.ReadAll function in handleSetOrderTrialDays reads the entire request body into memory, which could potentially be exploited for a Denial of Service attack if not properly limited.

[pavelbrm]

1. The io.ReadAll function in handleSetOrderTrialDays reads the entire request body into memory, which could potentially be exploited for a Denial of Service attack if not properly limited.

Wrong. The body is being read with a limit.

[clD11]

LGTM approved.