Improve risky payment check further, improving 'new user' logic

Author: pimterry

src/model/account/account-store.ts

@@ -152,15 +152,19 @@ export class AccountStore {
             const selectedPlan: SubscriptionPlanCode | undefined = yield this.pickPlan();
             if (!selectedPlan) return;
 
-            const alreadyLoggedIn = this.isLoggedIn;
-            if (!alreadyLoggedIn) yield this.logIn();
+            if (!this.isLoggedIn) yield this.logIn();
+
+            // If we cancelled login, or we've already got a plan, we're done.
+            if (!this.isLoggedIn || this.userHasSubscription) {
+                if (this.isPastDueUser) this.goToSettings();
+                return;
+            }
 
             const isRiskyPayment = this.subscriptionPlans[selectedPlan].prices?.currency === 'BRL' &&
                 this.userEmail?.endsWith('@gmail.com'); // So far, all chargebacks have been from gmail accounts
 
-            this.user.subscription
-
-            if (!alreadyLoggedIn && isRiskyPayment) {
+            const newUser = !this.user.subscription; // Even cancelled users will have an expired subscription left
+            if (newUser && isRiskyPayment) {
                 // This is annoying, I wish we didn't have to do this, but fraudulent BRL payments are now 80% of chargebacks,
                 // and we need to tighten this up and block that somehow or payment platforms will eventually block
                 // HTTP Toolkit globally. This error message is left intentionally vague to try and discourage fraudsters
@@ -178,12 +182,6 @@ export class AccountStore {
                 return;
             }
 
-            // If we cancelled login, or we've already got a plan, we're done.
-            if (!this.isLoggedIn || this.userHasSubscription) {
-                if (this.isPastDueUser) this.goToSettings();
-                return;
-            }
-
             // Otherwise, it's checkout time, and the rest is in the hands of Paddle
             yield this.purchasePlan(this.user.email!, selectedPlan);
         } catch (error: any) {