1 files changed, 15 insertions, 4 deletions
diff --git a/billing/app/controllers/subscriptions_controller.rb b/billing/app/controllers/subscriptions_controller.rb
index 7689f35..01aaab4 100644
--- a/billing/app/controllers/subscriptions_controller.rb
+++ b/billing/app/controllers/subscriptions_controller.rb
@@ -1,7 +1,9 @@
 class SubscriptionsController < BillingBaseController
   before_filter :authorize
   before_filter :fetch_subscription, :only => [:show, :destroy]
-  before_filter :confirm_no_active_subscription, :only => [:new, :create]
+  before_filter :confirm_cancel_subscription, :only => [:destroy]
+  before_filter :confirm_self_or_admin, :only => [:index]
+  before_filter :confirm_no_pending_active_pastdue_subscription, :only => [:new, :create]
   # for now, admins cannot create or destroy subscriptions for others:
   before_filter :confirm_self, :only => [:new, :create]
 
@@ -16,6 +18,7 @@ class SubscriptionsController < BillingBaseController
 
   def create
     @result = Braintree::Subscription.create( :payment_method_token => params[:payment_method_token], :plan_id => params[:plan_id] )
+    #if you want to test pastdue, can add :price => '2001', :trial_period => true,:trial_duration => 1,:trial_duration_unit => "day" and then wait a day
   end
 
   def destroy
@@ -38,10 +41,14 @@ class SubscriptionsController < BillingBaseController
 
   end
 
-  def confirm_no_active_subscription
+  def confirm_cancel_subscription
+    access_denied unless view_context.allow_cancel_subscription(@subscription)
+  end
+
+  def confirm_no_pending_active_pastdue_subscription
     @customer = Customer.find_by_user_id(@user.id)
-    if subscription = @customer.subscriptions # will return active subscription, if it exists
-      redirect_to subscription_path(subscription.id), :notice => 'You already have an active subscription'
+    if subscription = @customer.subscriptions # will return pending, active or pastdue subscription, if it exists
+      redirect_to user_subscription_path(@user, subscription.id), :notice => 'You already have a subscription'
     end
   end
 
@@ -49,4 +56,8 @@ class SubscriptionsController < BillingBaseController
     @user == current_user
   end
 
+  def confirm_self_or_admin
+    access_denied unless confirm_self or admin?
+  end
+
 end