0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-09 21:45:25 +08:00
discourse/plugins/discourse-subscriptions/spec/serializers/current_user_serializer_spec.rb
Arpit Jalan ec3fbdb7ef
FIX: Use signed checkout user references in discourse-subscriptions (#40058)
Previously, `checkout.session.completed` selected the Discourse user
from Stripe's checkout email, which could record a subscription against
the wrong account.

This change sends a signed user reference through Stripe Pricing Tables
and uses it as the trusted webhook binding while preserving the existing
checkout email validation.

---------

Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-05-28 22:19:56 +05:30

45 lines
1.4 KiB
Ruby
Vendored

# frozen_string_literal: true
RSpec.describe CurrentUserSerializer do
fab!(:user)
let(:serializer) { described_class.new(user, scope: Guardian.new(user), root: false) }
before do
SiteSetting.discourse_subscriptions_enabled = true
SiteSetting.discourse_subscriptions_pricing_table_enabled = true
end
it "includes a signed checkout session user reference" do
user_reference = serializer.discourse_subscriptions_checkout_session_user_reference
expect(user_reference.length).to be <= 200
expect(
User.find_signed(
user_reference,
purpose: DiscourseSubscriptions::CHECKOUT_SESSION_USER_REFERENCE_PURPOSE,
),
).to eq(user)
end
it "expires the signed checkout session user reference" do
user_reference = serializer.discourse_subscriptions_checkout_session_user_reference
freeze_time(
(DiscourseSubscriptions::CHECKOUT_SESSION_USER_REFERENCE_EXPIRES_IN + 1.second).from_now,
) do
expect(
User.find_signed(
user_reference,
purpose: DiscourseSubscriptions::CHECKOUT_SESSION_USER_REFERENCE_PURPOSE,
),
).to be_nil
end
end
it "omits the user reference when pricing tables are disabled" do
SiteSetting.discourse_subscriptions_pricing_table_enabled = false
expect(serializer.include_discourse_subscriptions_checkout_session_user_reference?).to eq(false)
end
end