0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-14 13:58:53 +08:00
discourse/plugins/discourse-subscriptions/spec/system/pricing_table_spec.rb
Arpit Jalan ec3fbdb7ef
FIX: Use signed checkout user references in discourse-subscriptions (#40058)
Previously, `checkout.session.completed` selected the Discourse user
from Stripe's checkout email, which could record a subscription against
the wrong account.

This change sends a signed user reference through Stripe Pricing Tables
and uses it as the trusted webhook binding while preserving the existing
checkout email validation.

---------

Co-authored-by: discourse-patch-triage[bot] <272280883+discourse-patch-triage[bot]@users.noreply.github.com>
2026-05-28 22:19:56 +05:30

138 lines
3.9 KiB
Ruby
Vendored

# frozen_string_literal: true
RSpec.describe "Pricing Table" do
fab!(:admin)
fab!(:product) { Fabricate(:product, external_id: "prod_OiK") }
let(:dialog) { PageObjects::Components::Dialog.new }
let(:product_subscriptions_page) { PageObjects::Pages::AdminSubscriptionProduct.new }
before do
SiteSetting.discourse_subscriptions_enabled = true
SiteSetting.discourse_subscriptions_extra_nav_subscribe = true
SiteSetting.discourse_subscriptions_secret_key = "sk_test_51xuu"
SiteSetting.discourse_subscriptions_public_key = "pk_test_51xuu"
SiteSetting.discourse_subscriptions_pricing_table_enabled = true
# this needs to be stubbed or it will try to make a request to stripe
one_product = {
id: "prod_OiK",
active: true,
name: "Tomtom",
metadata: {
description: "Photos of tomtom",
repurchaseable: true,
},
}
::Stripe::Product.stubs(:list).returns({ data: [one_product] })
::Stripe::Product.stubs(:delete).returns({ id: "prod_OiK" })
::Stripe::Product.stubs(:retrieve).returns(one_product)
::Stripe::Price.stubs(:list).returns({ data: [] })
end
it "Links to the pricing table page" do
sign_in(admin)
visit("/")
link = find("li.nav-item_subscribe a")
uri = URI.parse(link[:href])
expect(uri.path).to eq("/s/subscriptions")
end
it "Links to the pricing table page from the campaign banner" do
sign_in(admin)
SiteSetting.discourse_subscriptions_campaign_enabled = true
visit("/")
link = find(".campaign-banner-info-button")
uri = URI.parse(link[:href])
expect(uri.path).to eq("/s/subscriptions")
end
it "Links to the old page when disabled" do
sign_in(admin)
SiteSetting.discourse_subscriptions_pricing_table_enabled = false
visit("/")
link = find("li.nav-item_subscribe a")
uri = URI.parse(link[:href])
expect(uri.path).to eq("/s")
end
it "Links to the old page from the campaign banner when disabled" do
sign_in(admin)
SiteSetting.discourse_subscriptions_pricing_table_enabled = false
SiteSetting.discourse_subscriptions_campaign_enabled = true
visit("/")
link = find(".campaign-banner-info-button")
uri = URI.parse(link[:href])
expect(uri.path).to eq("/s")
end
it "Old subscribe page still works when disabled" do
sign_in(admin)
SiteSetting.discourse_subscriptions_pricing_table_enabled = false
visit("/")
find("li.nav-item_subscribe a").click
expect(page).to have_selector("div.title-wrapper h1", text: "Subscribe")
end
it "Shows a message when not setup yet" do
sign_in(admin)
visit("/")
find("li.nav-item_subscribe a").click
expect(page).to have_selector(
"div.container",
text: "There are currently no products available.",
)
end
it "Passes a signed user reference to Stripe" do
sign_in(admin)
SiteSetting.discourse_subscriptions_pricing_table_id = "prctbl_123"
visit("/s/subscriptions")
pricing_table = find("stripe-pricing-table", visible: :all)
client_reference_id = pricing_table["client-reference-id"]
expect(client_reference_id).to be_present
expect(
User.find_signed(
client_reference_id,
purpose: DiscourseSubscriptions::CHECKOUT_SESSION_USER_REFERENCE_PURPOSE,
),
).to eq(admin)
end
it "Shows a log in message if not signed in" do
visit("/")
find("li.nav-item_subscribe a").click
expect(page).to have_selector(
"div.container",
text: "Log in or create an account to subscribe.",
)
end
it "Redirects to the pricing table page if enabled" do
sign_in(admin)
visit("/s")
expect(page).to have_current_path("/s/subscriptions")
end
it "Redirects to first product subscribe route if pricing table is not enabled" do
sign_in(admin)
SiteSetting.discourse_subscriptions_pricing_table_enabled = false
visit("/s/subscriptions")
expect(page).to have_current_path("/s/prod_OiK")
end
end