fix(abonnement): garde active→pending, datetime parse, resolve_handle vide (#90)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DRGb8NAMwaTZxUszSbaj4N

tests/subscriptions/test_db.py

@@ -78,6 +78,34 @@ def test_set_cancelled(users_db_path):
     assert row["current_period_end"] == end
 
 
+def test_has_active_subscription_z_suffix_datetime(users_db_path):
+    """Fix 2 : suffix 'Z' dans current_period_end doit être parsé correctement."""
+    db.init_schema()
+    uid = _make_user()
+    db.create_pending(uid, "decpinfo-1", "simple")
+    # Frisbii peut renvoyer des dates avec 'Z' au lieu de '+00:00'.
+    db.update_from_webhook("decpinfo-1", "sub_42", "cancelled", "2099-12-31T23:59:59Z")
+    assert db.has_active_subscription(uid) is True
+    db.update_from_webhook("decpinfo-1", "sub_42", "cancelled", "2020-01-01T00:00:00Z")
+    assert db.has_active_subscription(uid) is False
+
+
+def test_has_active_subscription_bad_datetime_returns_false(users_db_path):
+    """Fix 2 : une date invalide ne doit pas lever d'exception, juste retourner False."""
+    db.init_schema()
+    uid = _make_user()
+    db.create_pending(uid, "decpinfo-1", "simple")
+    # Injection directe d'une valeur invalide via update bas-niveau.
+    from src.auth.db import get_conn
+
+    get_conn().execute(
+        "UPDATE subscriptions SET status='cancelled', current_period_end='not-a-date' "
+        "WHERE user_id=?",
+        (uid,),
+    )
+    assert db.has_active_subscription(uid) is False
+
+
 def test_trial_used_is_sticky_across_resubscribe(users_db_path):
     db.init_schema()
     uid = _make_user()