Some more tweaks to have billing code work, and allow admins to view but not edit for other users.

1 files changed, 16 insertions, 17 deletions

diff --git a/billing/app/controllers/customer_controller.rb b/billing/app/controllers/customer_controller.rb
index f38f77e..0120e91 100644
--- a/billing/app/controllers/customer_controller.rb
+++ b/billing/app/controllers/customer_controller.rb
@@ -1,18 +1,18 @@
 class CustomerController < BillingBaseController
-  before_filter :authorize
+  before_filter :authorize, :fetch_customer
 
   def show
-    if customer = fetch_customer
-      customer.with_braintree_data!
-      @default_cc = customer.default_credit_card #TODO not actually right way
-      @active_subscription = customer.subscriptions
-      @transactions = customer.braintree_customer.transactions
+    if @customer
+      @customer.with_braintree_data!
+      @default_cc = @customer.default_credit_card #TODO not actually right way
+      @active_subscription = @customer.subscriptions
+      @transactions = @customer.braintree_customer.transactions
     end
   end
 
   def new
-    if customer.has_payment_info?
-      redirect_to edit_customer_path(customer), :notice => 'Here is your saved customer data'
+    if @customer.has_payment_info?
+      redirect_to edit_customer_path(@user), :notice => 'Here is your saved customer data'
     else
       fetch_new_transparent_redirect_data
     end
@@ -24,12 +24,11 @@ class CustomerController < BillingBaseController
 
   def confirm
     @result = Braintree::TransparentRedirect.confirm(request.query_string)
-
     if @result.success?
-      customer.braintree_customer =  @result.customer
-      customer.save
+      @customer.braintree_customer =  @result.customer
+      @customer.save
       render :action => "confirm"
-    elsif customer.has_payment_info?
+    elsif @customer.has_payment_info?
       fetch_edit_transparent_redirect_data
       render :action => "edit"
     else
@@ -41,16 +40,18 @@ class CustomerController < BillingBaseController
   protected
 
   def fetch_new_transparent_redirect_data
+    access_denied unless @user == current_user # admins cannot do this for others
     @tr_data = Braintree::TransparentRedirect.
       create_customer_data(:redirect_url => confirm_customer_url)
   end
 
   def fetch_edit_transparent_redirect_data
-    customer.with_braintree_data!
-    @default_cc = customer.default_credit_card
+    access_denied unless @user == current_user # admins cannot do this for others
+    @customer.with_braintree_data!
+    @default_cc = @customer.default_credit_card
     @tr_data = Braintree::TransparentRedirect.
       update_customer_data(:redirect_url => confirm_customer_url,
-                           :customer_id => customer.braintree_customer_id) ##??
+                           :customer_id => @customer.braintree_customer_id) ##??
   end
 
   def fetch_customer
@@ -58,8 +59,6 @@ class CustomerController < BillingBaseController
     if @user == current_user
       @customer ||= Customer.new(user: @user)
     end
-    # TODO will want case for admins, presumably
     access_denied unless (@customer and (@customer.user == current_user)) or admin?
-    return @customer
   end
 end