summaryrefslogtreecommitdiff
path: root/billing/app/controllers
diff options
context:
space:
mode:
Diffstat (limited to 'billing/app/controllers')
-rw-r--r--billing/app/controllers/billing_base_controller.rb10
-rw-r--r--billing/app/controllers/credit_card_info_controller.rb5
-rw-r--r--billing/app/controllers/customer_controller.rb33
-rw-r--r--billing/app/controllers/payments_controller.rb3
-rw-r--r--billing/app/controllers/subscriptions_controller.rb4
5 files changed, 29 insertions, 26 deletions
diff --git a/billing/app/controllers/billing_base_controller.rb b/billing/app/controllers/billing_base_controller.rb
index 67dff72..f6e233b 100644
--- a/billing/app/controllers/billing_base_controller.rb
+++ b/billing/app/controllers/billing_base_controller.rb
@@ -4,12 +4,14 @@ class BillingBaseController < ApplicationController
helper 'billing'
# required for navigation to work.
- #TODO doesn't work for admins
def assign_user
- if params[:id]
+ if params[:user_id]
+ @user = User.find_by_param(params[:user_id])
+ elsif params[:action] == "confirm" # confirms will come back with different ID set, so check for this first
+ # This is only for cases where an admin cannot apply action for customer, but should be all confirms
+ @user = current_user
+ elsif params[:id]
@user = User.find_by_param(params[:id])
- else
- @user = current_user #TODO not always correct for admins viewing another user!
end
end
diff --git a/billing/app/controllers/credit_card_info_controller.rb b/billing/app/controllers/credit_card_info_controller.rb
index 75865fe..717fa18 100644
--- a/billing/app/controllers/credit_card_info_controller.rb
+++ b/billing/app/controllers/credit_card_info_controller.rb
@@ -3,7 +3,7 @@ class CreditCardInfoController < ApplicationController
def edit
@credit_card = Braintree::CreditCard.find(params[:id])
- customer = Customer.find_by_user_id(current_user.id)
+ customer = Customer.find_by_user_id(@user.id)
if customer and customer.braintree_customer_id == @credit_card.customer_id
@tr_data = Braintree::TransparentRedirect.
update_credit_card_data(:redirect_url => confirm_credit_card_info_url,
@@ -27,7 +27,8 @@ class CreditCardInfoController < ApplicationController
private
- def set_user
+ def set_user
+ # this assumes anybody, even an admin, will not access for another user.
@user = current_user
end
diff --git a/billing/app/controllers/customer_controller.rb b/billing/app/controllers/customer_controller.rb
index f38f77e..0120e91 100644
--- a/billing/app/controllers/customer_controller.rb
+++ b/billing/app/controllers/customer_controller.rb
@@ -1,18 +1,18 @@
class CustomerController < BillingBaseController
- before_filter :authorize
+ before_filter :authorize, :fetch_customer
def show
- if customer = fetch_customer
- customer.with_braintree_data!
- @default_cc = customer.default_credit_card #TODO not actually right way
- @active_subscription = customer.subscriptions
- @transactions = customer.braintree_customer.transactions
+ if @customer
+ @customer.with_braintree_data!
+ @default_cc = @customer.default_credit_card #TODO not actually right way
+ @active_subscription = @customer.subscriptions
+ @transactions = @customer.braintree_customer.transactions
end
end
def new
- if customer.has_payment_info?
- redirect_to edit_customer_path(customer), :notice => 'Here is your saved customer data'
+ if @customer.has_payment_info?
+ redirect_to edit_customer_path(@user), :notice => 'Here is your saved customer data'
else
fetch_new_transparent_redirect_data
end
@@ -24,12 +24,11 @@ class CustomerController < BillingBaseController
def confirm
@result = Braintree::TransparentRedirect.confirm(request.query_string)
-
if @result.success?
- customer.braintree_customer = @result.customer
- customer.save
+ @customer.braintree_customer = @result.customer
+ @customer.save
render :action => "confirm"
- elsif customer.has_payment_info?
+ elsif @customer.has_payment_info?
fetch_edit_transparent_redirect_data
render :action => "edit"
else
@@ -41,16 +40,18 @@ class CustomerController < BillingBaseController
protected
def fetch_new_transparent_redirect_data
+ access_denied unless @user == current_user # admins cannot do this for others
@tr_data = Braintree::TransparentRedirect.
create_customer_data(:redirect_url => confirm_customer_url)
end
def fetch_edit_transparent_redirect_data
- customer.with_braintree_data!
- @default_cc = customer.default_credit_card
+ access_denied unless @user == current_user # admins cannot do this for others
+ @customer.with_braintree_data!
+ @default_cc = @customer.default_credit_card
@tr_data = Braintree::TransparentRedirect.
update_customer_data(:redirect_url => confirm_customer_url,
- :customer_id => customer.braintree_customer_id) ##??
+ :customer_id => @customer.braintree_customer_id) ##??
end
def fetch_customer
@@ -58,8 +59,6 @@ class CustomerController < BillingBaseController
if @user == current_user
@customer ||= Customer.new(user: @user)
end
- # TODO will want case for admins, presumably
access_denied unless (@customer and (@customer.user == current_user)) or admin?
- return @customer
end
end
diff --git a/billing/app/controllers/payments_controller.rb b/billing/app/controllers/payments_controller.rb
index 224b78e..3ffc5a3 100644
--- a/billing/app/controllers/payments_controller.rb
+++ b/billing/app/controllers/payments_controller.rb
@@ -16,9 +16,10 @@ class PaymentsController < BillingBaseController
end
def index
- customer = Customer.find_by_user_id(current_user.id)
+ customer = Customer.find_by_user_id(@user.id)
braintree_data = Braintree::Customer.find(customer.braintree_customer_id)
# these will be ordered by created_at descending, per http://stackoverflow.com/questions/16425475/
+ # TODO permissions
@transactions = braintree_data.transactions
end
diff --git a/billing/app/controllers/subscriptions_controller.rb b/billing/app/controllers/subscriptions_controller.rb
index 38dbff1..8030c88 100644
--- a/billing/app/controllers/subscriptions_controller.rb
+++ b/billing/app/controllers/subscriptions_controller.rb
@@ -21,7 +21,7 @@ class SubscriptionsController < BillingBaseController
end
def index
- customer = Customer.find_by_user_id(current_user.id)
+ customer = Customer.find_by_user_id(@user.id)
@subscriptions = customer.subscriptions(nil, false)
end
@@ -31,7 +31,7 @@ class SubscriptionsController < BillingBaseController
@subscription = Braintree::Subscription.find params[:id]
@subscription_customer_id = @subscription.transactions.first.customer_details.id #all of subscriptions transactions should have same customer
@customer = Customer.find_by_user_id(current_user.id)
- access_denied unless @customer and @customer.braintree_customer_id == @subscription_customer_id
+ access_denied unless admin? or (@customer and @customer.braintree_customer_id == @subscription_customer_id)
# TODO: will presumably want to allow admins to view/cancel subscriptions for all users
end