mirror of
https://github.com/discourse/discourse.git
synced 2026-08-09 21:45:25 +08:00
Previously, `checkout.session.completed` selected the Discourse user from Stripe's checkout email, which could record a subscription against the wrong account. This change sends a signed user reference through Stripe Pricing Tables and uses it as the trusted webhook binding while preserving the existing checkout email validation. --------- Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
45 lines
1.4 KiB
Ruby
Vendored
45 lines
1.4 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
RSpec.describe CurrentUserSerializer do
|
|
fab!(:user)
|
|
|
|
let(:serializer) { described_class.new(user, scope: Guardian.new(user), root: false) }
|
|
|
|
before do
|
|
SiteSetting.discourse_subscriptions_enabled = true
|
|
SiteSetting.discourse_subscriptions_pricing_table_enabled = true
|
|
end
|
|
|
|
it "includes a signed checkout session user reference" do
|
|
user_reference = serializer.discourse_subscriptions_checkout_session_user_reference
|
|
|
|
expect(user_reference.length).to be <= 200
|
|
expect(
|
|
User.find_signed(
|
|
user_reference,
|
|
purpose: DiscourseSubscriptions::CHECKOUT_SESSION_USER_REFERENCE_PURPOSE,
|
|
),
|
|
).to eq(user)
|
|
end
|
|
|
|
it "expires the signed checkout session user reference" do
|
|
user_reference = serializer.discourse_subscriptions_checkout_session_user_reference
|
|
|
|
freeze_time(
|
|
(DiscourseSubscriptions::CHECKOUT_SESSION_USER_REFERENCE_EXPIRES_IN + 1.second).from_now,
|
|
) do
|
|
expect(
|
|
User.find_signed(
|
|
user_reference,
|
|
purpose: DiscourseSubscriptions::CHECKOUT_SESSION_USER_REFERENCE_PURPOSE,
|
|
),
|
|
).to be_nil
|
|
end
|
|
end
|
|
|
|
it "omits the user reference when pricing tables are disabled" do
|
|
SiteSetting.discourse_subscriptions_pricing_table_enabled = false
|
|
|
|
expect(serializer.include_discourse_subscriptions_checkout_session_user_reference?).to eq(false)
|
|
end
|
|
end
|