From beac877e44d0bd245d755a9ef9310bac215f7e42 Mon Sep 17 00:00:00 2001 From: Andy Zhao Date: Mon, 2 Jul 2018 17:19:25 -0400 Subject: [PATCH] Add stripe policies and specs (#529) * Add stripe policies and specs, and some refactor * Update moderation test to test for 404 --- .../stripe_active_cards_controller.rb | 10 ++-- .../stripe_subscriptions_controller.rb | 11 ++-- app/policies/stripe_active_card_policy.rb | 13 +++++ app/policies/stripe_subscription_policy.rb | 13 +++++ .../stripe_active_card_policy_spec.rb | 23 +++++++++ .../stripe_subscription_policy_spec.rb | 23 +++++++++ spec/requests/moderations_spec.rb | 50 +++++++++++-------- 7 files changed, 114 insertions(+), 29 deletions(-) create mode 100644 app/policies/stripe_active_card_policy.rb create mode 100644 app/policies/stripe_subscription_policy.rb create mode 100644 spec/policies/stripe_active_card_policy_spec.rb create mode 100644 spec/policies/stripe_subscription_policy_spec.rb diff --git a/app/controllers/stripe_active_cards_controller.rb b/app/controllers/stripe_active_cards_controller.rb index 83a9f17d3..d0b7685d6 100644 --- a/app/controllers/stripe_active_cards_controller.rb +++ b/app/controllers/stripe_active_cards_controller.rb @@ -1,7 +1,9 @@ class StripeActiveCardsController < ApplicationController + before_action :authenticate_user! before_action :touch_current_user def create + authorize :stripe_active_card customer = find_or_create_customer if customer.sources.create(source: stripe_params[:stripe_token]) logger.info("Stripe Add New Card Success - #{current_user.username}") @@ -15,7 +17,8 @@ class StripeActiveCardsController < ApplicationController end def update - customer = find_or_create_customer + authorize :stripe_active_card + customer = Stripe::Customer.retrieve(current_user.stripe_id_code) card = customer.sources.retrieve(params[:id]) customer.default_source = card.id if customer.save @@ -33,7 +36,8 @@ class StripeActiveCardsController < ApplicationController end def destroy - customer = find_or_create_customer + authorize :stripe_active_card + customer = Stripe::Customer.retrieve(current_user.stripe_id_code) if customer.subscriptions.count.zero? || customer.sources.all(object: "card").count > 1 customer.sources.retrieve(params[:id]).delete customer.save @@ -47,7 +51,7 @@ class StripeActiveCardsController < ApplicationController def find_or_create_customer if current_user.stripe_id_code.present? - customer = Stripe::Customer.retrieve(current_user.stripe_id_code) + Stripe::Customer.retrieve(current_user.stripe_id_code) else customer = Stripe::Customer.create( email: current_user.email, diff --git a/app/controllers/stripe_subscriptions_controller.rb b/app/controllers/stripe_subscriptions_controller.rb index 9f57b91c9..836c1724e 100644 --- a/app/controllers/stripe_subscriptions_controller.rb +++ b/app/controllers/stripe_subscriptions_controller.rb @@ -3,6 +3,7 @@ class StripeSubscriptionsController < ApplicationController before_action :touch_current_user def create + authorize :stripe_subscription amount = stripe_params[:amount] customer = find_or_create_customer if customer && @@ -24,8 +25,9 @@ class StripeSubscriptionsController < ApplicationController end def update + authorize :stripe_subscription amount = stripe_params[:amount] - customer = find_or_create_customer + customer = Stripe::Customer.retrieve(current_user.stripe_id_code) if MembershipService.new(customer, current_user, amount).update_subscription logger.info("Stripe Update Subscription Success - #{current_user.username}") redirect_to "/settings/membership", notice: @@ -40,7 +42,8 @@ class StripeSubscriptionsController < ApplicationController end def destroy - customer = find_or_create_customer + authorize :stripe_subscription + customer = Stripe::Customer.retrieve(current_user.stripe_id_code) if MembershipService.new(customer, current_user, nil).unsubscribe_customer logger.info("Stripe Cancel Subscription Success - #{current_user.username}") redirect_to "/settings", notice: @@ -52,6 +55,8 @@ class StripeSubscriptionsController < ApplicationController end end + private + def find_or_create_customer if current_user.stripe_id_code.present? customer = Stripe::Customer.retrieve(current_user.stripe_id_code) @@ -65,8 +70,6 @@ class StripeSubscriptionsController < ApplicationController customer end - private - def stripe_params params[:amount] = convert_amount_to_cent raise custom_error if invalid_amount? diff --git a/app/policies/stripe_active_card_policy.rb b/app/policies/stripe_active_card_policy.rb new file mode 100644 index 000000000..46d2addf1 --- /dev/null +++ b/app/policies/stripe_active_card_policy.rb @@ -0,0 +1,13 @@ +class StripeActiveCardPolicy < ApplicationPolicy + def create? + !user_is_banned? + end + + def update? + !user_is_banned? + end + + def destroy? + true + end +end diff --git a/app/policies/stripe_subscription_policy.rb b/app/policies/stripe_subscription_policy.rb new file mode 100644 index 000000000..8758cf982 --- /dev/null +++ b/app/policies/stripe_subscription_policy.rb @@ -0,0 +1,13 @@ +class StripeSubscriptionPolicy < ApplicationPolicy + def create? + !user_is_banned? + end + + def update? + !user_is_banned? + end + + def destroy? + true + end +end diff --git a/spec/policies/stripe_active_card_policy_spec.rb b/spec/policies/stripe_active_card_policy_spec.rb new file mode 100644 index 000000000..a7b73c095 --- /dev/null +++ b/spec/policies/stripe_active_card_policy_spec.rb @@ -0,0 +1,23 @@ +require "rails_helper" + +RSpec.describe StripeActiveCardPolicy do + subject { described_class.new(user, :stripe_subscription) } + + context "when user is not signed in" do + let(:user) { nil } + + it { within_block_is_expected.to raise_error(Pundit::NotAuthorizedError) } + end + + context "when user is signed in" do + let(:user) { build(:user) } + + it { is_expected.to permit_actions(%i[create update destroy]) } + + context "when user is banned" do + let(:user) { build(:user, :banned) } + + it { is_expected.to forbid_actions(%i[create update]) } + end + end +end diff --git a/spec/policies/stripe_subscription_policy_spec.rb b/spec/policies/stripe_subscription_policy_spec.rb new file mode 100644 index 000000000..457650ad0 --- /dev/null +++ b/spec/policies/stripe_subscription_policy_spec.rb @@ -0,0 +1,23 @@ +require "rails_helper" + +RSpec.describe StripeSubscriptionPolicy do + subject { described_class.new(user, :stripe_subscription) } + + context "when user is not signed in" do + let(:user) { nil } + + it { within_block_is_expected.to raise_error(Pundit::NotAuthorizedError) } + end + + context "when user is signed in" do + let(:user) { build(:user) } + + it { is_expected.to permit_actions(%i[create update destroy]) } + + context "when user is banned" do + let(:user) { build(:user, :banned) } + + it { is_expected.to forbid_actions(%i[create update]) } + end + end +end diff --git a/spec/requests/moderations_spec.rb b/spec/requests/moderations_spec.rb index 842de0da7..cfeba0d74 100644 --- a/spec/requests/moderations_spec.rb +++ b/spec/requests/moderations_spec.rb @@ -10,33 +10,39 @@ RSpec.describe "Moderations", type: :request do user_id: user.id) end - before do - sign_in user - end - - describe "GET moderations article" do - it "returns 200 if user trusted" do - user.add_role :trusted - get article.path + "/mod" - expect(response).to have_http_status(200) - end - it "returns 404 if user trusted not trusted" do - expect do + describe "GET /mod on articles" do + context "when user is trusted" do + it "responds with 200" do + user.add_role :trusted + sign_in user get article.path + "/mod" - end.to raise_error(Pundit::NotAuthorizedError) + expect(response).to have_http_status(200) + end + end + + context "when user is not trusted", proper_status: true do + it "responds with 404" do + get article.path + "/mod" + expect(response).to have_http_status(404) + end end end describe "GET moderations comment" do - it "returns 200 if user trusted" do - user.add_role :trusted - get comment.path + "/mod" - expect(response).to have_http_status(200) - end - it "returns 404 if user trusted not trusted" do - expect do + context "when user is trusted" do + it "responds with 200" do + user.add_role :trusted + sign_in user get comment.path + "/mod" - end.to raise_error(Pundit::NotAuthorizedError) + expect(response).to have_http_status(200) + end + end + + context "when user is not trusted", proper_status: true do + it "responds with 404" do + get comment.path + "/mod" + expect(response).to have_http_status(404) + end end end -end \ No newline at end of file +end