Add stripe policies and specs (#529)

* Add stripe policies and specs, and some refactor

* Update moderation test to test for 404

app/controllers/stripe_active_cards_controller.rb

@@ -1,7 +1,9 @@
 class StripeActiveCardsController < ApplicationController
+  before_action :authenticate_user!
   before_action :touch_current_user
 
   def create
+    authorize :stripe_active_card
     customer = find_or_create_customer
     if customer.sources.create(source: stripe_params[:stripe_token])
       logger.info("Stripe Add New Card Success - #{current_user.username}")
@@ -15,7 +17,8 @@ class StripeActiveCardsController < ApplicationController
   end
 
   def update
-    customer = find_or_create_customer
+    authorize :stripe_active_card
+    customer = Stripe::Customer.retrieve(current_user.stripe_id_code)
     card = customer.sources.retrieve(params[:id])
     customer.default_source = card.id
     if customer.save
@@ -33,7 +36,8 @@ class StripeActiveCardsController < ApplicationController
   end
 
   def destroy
-    customer = find_or_create_customer
+    authorize :stripe_active_card
+    customer = Stripe::Customer.retrieve(current_user.stripe_id_code)
     if customer.subscriptions.count.zero? || customer.sources.all(object: "card").count > 1
       customer.sources.retrieve(params[:id]).delete
       customer.save
@@ -47,7 +51,7 @@ class StripeActiveCardsController < ApplicationController
 
   def find_or_create_customer
     if current_user.stripe_id_code.present?
-      customer = Stripe::Customer.retrieve(current_user.stripe_id_code)
+      Stripe::Customer.retrieve(current_user.stripe_id_code)
     else
       customer = Stripe::Customer.create(
         email: current_user.email,

app/controllers/stripe_subscriptions_controller.rb

@@ -3,6 +3,7 @@ class StripeSubscriptionsController < ApplicationController
   before_action :touch_current_user
 
   def create
+    authorize :stripe_subscription
     amount = stripe_params[:amount]
     customer = find_or_create_customer
     if customer &&
@@ -24,8 +25,9 @@ class StripeSubscriptionsController < ApplicationController
   end
 
   def update
+    authorize :stripe_subscription
     amount = stripe_params[:amount]
-    customer = find_or_create_customer
+    customer = Stripe::Customer.retrieve(current_user.stripe_id_code)
     if MembershipService.new(customer, current_user, amount).update_subscription
       logger.info("Stripe Update Subscription Success - #{current_user.username}")
       redirect_to "/settings/membership", notice:
@@ -40,7 +42,8 @@ class StripeSubscriptionsController < ApplicationController
   end
 
   def destroy
-    customer = find_or_create_customer
+    authorize :stripe_subscription
+    customer = Stripe::Customer.retrieve(current_user.stripe_id_code)
     if MembershipService.new(customer, current_user, nil).unsubscribe_customer
       logger.info("Stripe Cancel Subscription Success - #{current_user.username}")
       redirect_to "/settings", notice:
@@ -52,6 +55,8 @@ class StripeSubscriptionsController < ApplicationController
     end
   end
 
+  private
+
   def find_or_create_customer
     if current_user.stripe_id_code.present?
       customer = Stripe::Customer.retrieve(current_user.stripe_id_code)
@@ -65,8 +70,6 @@ class StripeSubscriptionsController < ApplicationController
     customer
   end
 
-  private
-
   def stripe_params
     params[:amount] = convert_amount_to_cent
     raise custom_error if invalid_amount?

app/policies/stripe_active_card_policy.rb

@@ -0,0 +1,13 @@
+class StripeActiveCardPolicy < ApplicationPolicy
+  def create?
+    !user_is_banned?
+  end
+
+  def update?
+    !user_is_banned?
+  end
+
+  def destroy?
+    true
+  end
+end

app/policies/stripe_subscription_policy.rb

@@ -0,0 +1,13 @@
+class StripeSubscriptionPolicy < ApplicationPolicy
+  def create?
+    !user_is_banned?
+  end
+
+  def update?
+    !user_is_banned?
+  end
+
+  def destroy?
+    true
+  end
+end

spec/policies/stripe_active_card_policy_spec.rb

@@ -0,0 +1,23 @@
+require "rails_helper"
+
+RSpec.describe StripeActiveCardPolicy do
+  subject { described_class.new(user, :stripe_subscription) }
+
+  context "when user is not signed in" do
+    let(:user) { nil }
+
+    it { within_block_is_expected.to raise_error(Pundit::NotAuthorizedError) }
+  end
+
+  context "when user is signed in" do
+    let(:user) { build(:user) }
+
+    it { is_expected.to permit_actions(%i[create update destroy]) }
+
+    context "when user is banned" do
+      let(:user) { build(:user, :banned) }
+
+      it { is_expected.to forbid_actions(%i[create update]) }
+    end
+  end
+end

spec/policies/stripe_subscription_policy_spec.rb

@@ -0,0 +1,23 @@
+require "rails_helper"
+
+RSpec.describe StripeSubscriptionPolicy do
+  subject { described_class.new(user, :stripe_subscription) }
+
+  context "when user is not signed in" do
+    let(:user) { nil }
+
+    it { within_block_is_expected.to raise_error(Pundit::NotAuthorizedError) }
+  end
+
+  context "when user is signed in" do
+    let(:user) { build(:user) }
+
+    it { is_expected.to permit_actions(%i[create update destroy]) }
+
+    context "when user is banned" do
+      let(:user) { build(:user, :banned) }
+
+      it { is_expected.to forbid_actions(%i[create update]) }
+    end
+  end
+end

spec/requests/moderations_spec.rb

@@ -10,33 +10,39 @@ RSpec.describe "Moderations", type: :request do
            user_id: user.id)
   end
 
-  before do
-    sign_in user
-  end
-
-  describe "GET moderations article" do
-    it "returns 200 if user trusted" do
-      user.add_role :trusted
-      get article.path + "/mod"
-      expect(response).to have_http_status(200)
-    end
-    it "returns 404 if user trusted not trusted" do
-      expect do
+  describe "GET /mod on articles" do
+    context "when user is trusted" do
+      it "responds with 200" do
+        user.add_role :trusted
+        sign_in user
         get article.path + "/mod"
-      end.to raise_error(Pundit::NotAuthorizedError)
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context "when user is not trusted", proper_status: true do
+      it "responds with 404" do
+        get article.path + "/mod"
+        expect(response).to have_http_status(404)
+      end
     end
   end
 
   describe "GET moderations comment" do
-    it "returns 200 if user trusted" do
-      user.add_role :trusted
-      get comment.path + "/mod"
-      expect(response).to have_http_status(200)
-    end
-    it "returns 404 if user trusted not trusted" do
-      expect do
+    context "when user is trusted" do
+      it "responds with 200" do
+        user.add_role :trusted
+        sign_in user
         get comment.path + "/mod"
-      end.to raise_error(Pundit::NotAuthorizedError)
+        expect(response).to have_http_status(200)
+      end
+    end
+
+    context "when user is not trusted", proper_status: true do
+      it "responds with 404" do
+        get comment.path + "/mod"
+        expect(response).to have_http_status(404)
+      end
     end
   end
-end
+end