saeloun · apoorv-mishra · May 16, 2022 · May 13, 2022 · May 13, 2022 · May 13, 2022
diff --git a/app/controllers/concerns/error_handler.rb b/app/controllers/concerns/error_handler.rb
@@ -18,7 +18,7 @@ def handle_not_found_error(exception)
 
       respond_to do |format|
         format.json { render json: { errors: message }, status: :not_found }
-        format.html { render file: "public/401.html", status: :not_found, layout: false, alert: message }
+        format.html { render file: "public/404.html", status: :not_found, layout: false, alert: message }
       end
     end
 

diff --git a/app/controllers/payment_settings_controller.rb b/app/controllers/payment_settings_controller.rb
@@ -6,14 +6,14 @@ def index
   end
 
   def refresh_stripe_connect
-    authorize stripe_connected_account, policy_class: PaymentSettingsPolicy
+    authorize :refresh_stripe_connect, policy_class: PaymentSettingsPolicy
 
     redirect_to stripe_connected_account.url, allow_other_host: true
   end
 
   private
 
     def stripe_connected_account
-      current_company.stripe_connected_account
+      StripeConnectedAccount.find_by!(company: current_company)
     end
 end
diff --git a/app/policies/payment_settings_policy.rb b/app/policies/payment_settings_policy.rb
@@ -10,6 +10,6 @@ def connect_stripe?
   end
 
   def refresh_stripe_connect?
-    user_owner_or_admin? and not record.nil?
+    user_owner_or_admin?
   end
 end
diff --git a/spec/requests/internal_api/v1/payment_settings/connect_stripe_spec.rb b/spec/requests/internal_api/v1/payment_settings/connect_stripe_spec.rb
@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe "InternalApi::V1::PaymentSettings#connect_stripe", type: :request do
+  let(:company) { create(:company) }
+  let(:user) { create(:user, current_workspace_id: company.id) }
+  let(:stripe_connected_account) { build(:stripe_connected_account) }
+
+  context "when user is admin" do
+    before do
+      create(:company_user, company:, user:)
+      user.add_role :admin, company
+      sign_in user
+    end
+
+    it "creates stripe connected account" do
+      allow(Stripe::Account).to receive(:create)
+        .and_return(OpenStruct.new({ id: stripe_connected_account.account_id }))
+      allow(Stripe::Account).to receive(:retrieve)
+        .and_return(OpenStruct.new({ details_submitted: false }))
+      allow(Stripe::AccountLink).to receive(:create)
+        .and_return(OpenStruct.new({ url: "https://connect.stripe.com/setup/s/something" }))
+      send_request :post, internal_api_v1_payments_settings_stripe_connect_path
+      expect(response).to have_http_status(:ok)
+      expect(json_response).to have_key("accountLink")
+      expect(json_response["accountLink"]).to eq("https://connect.stripe.com/setup/s/something")
+    end
+  end
+
+  context "when user is employee" do
+    before do
+      create(:company_user, company:, user:)
+      user.add_role :employee, company
+      sign_in user
+    end
+
+    it "is not be permitted to connect stripe" do
+      send_request :post, internal_api_v1_payments_settings_stripe_connect_path
+      expect(response).to have_http_status(:forbidden)
+    end
+  end
+
+  context "when unauthenticated" do
+    it "is not be permitted to view payment settings" do
+      send_request :post, internal_api_v1_payments_settings_stripe_connect_path
+      expect(response).to have_http_status(:unauthorized)
+      expect(json_response["error"]).to eq("You need to sign in or sign up before continuing.")
+    end
+  end
+end
diff --git a/spec/requests/internal_api/v1/payment_settings/index_spec.rb b/spec/requests/internal_api/v1/payment_settings/index_spec.rb
@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe "InternalApi::V1::PaymentSettings#index", type: :request do
+  let(:company) { create(:company) }
+  let(:user) { create(:user, current_workspace_id: company.id) }
+
+  context "when user is admin" do
+    before do
+      create(:company_user, company:, user:)
+      user.add_role :admin, company
+      sign_in user
+    end
+
+    it "returns connected providers" do
+      send_request :get, internal_api_v1_payments_settings_path
+      expect(response).to have_http_status(:ok)
+      expect(json_response["providers"]).to have_key("stripe")
+      expect(json_response["providers"]).to have_key("paypal")
+      expect(json_response["providers"]["stripe"]).to have_key("connected")
+      expect(json_response["providers"]["paypal"]).to have_key("connected")
+      expect(json_response["providers"]["stripe"]["connected"]).to be(false)
+      expect(json_response["providers"]["paypal"]["connected"]).to be(false)
+    end
+  end
+
+  context "when user is employee" do
+    before do
+      create(:company_user, company:, user:)
+      user.add_role :employee, company
+      sign_in user
+    end
+
+    it "is not be permitted to view payment settings" do
+      send_request :get, internal_api_v1_payments_settings_path
+      expect(response).to have_http_status(:forbidden)
+    end
+  end
+
+  context "when unauthenticated" do
+    it "is not be permitted to view payment settings" do
+      send_request :get, internal_api_v1_payments_settings_path
+      expect(response).to have_http_status(:unauthorized)
+      expect(json_response["error"]).to eq("You need to sign in or sign up before continuing.")
+    end
+  end
+end
diff --git a/spec/requests/payment_settings/refresh_stripe_connect_spec.rb b/spec/requests/payment_settings/refresh_stripe_connect_spec.rb
@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe "PaymentsSetting#refresh_stripe_connect", type: :request do
+  let(:company) { create(:company) }
+  let(:user) { create(:user, current_workspace_id: company.id) }
+  let(:stripe_connected_account) { build(:stripe_connected_account, company:) }
+
+  context "when user is an admin" do
+    before do
+      create(:company_user, company:, user:)
+      user.add_role :admin, company
+      sign_in user
+    end
+
+    context "when stripe connected account doesn't exist" do
+      it "returns 404" do
+        allow(Stripe::AccountLink).to receive(:create)
+          .and_return(OpenStruct.new({ url: "https://connect.stripe.com/setup/s/something" }))
+        allow(Stripe::Account).to receive(:retrieve)
+          .and_return(OpenStruct.new({ details_submitted: false }))
+        send_request :get, payments_settings_stripe_connect_refresh_path
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+
+    context "when stripe connected account exists" do
+      it "is able to refresh stripe connect successfully" do
+        allow(Stripe::Account).to receive(:create)
+          .and_return(OpenStruct.new({ id: stripe_connected_account.account_id }))
+        allow(Stripe::AccountLink).to receive(:create)
+          .and_return(OpenStruct.new({ url: "https://connect.stripe.com/setup/s/something" }))
+        allow(Stripe::Account).to receive(:retrieve)
+          .and_return(OpenStruct.new({ details_submitted: false }))
+        stripe_connected_account.save!
+        send_request :get, payments_settings_stripe_connect_refresh_path
+        expect(response).to have_http_status(:redirect)
+        expect(response).to redirect_to("https://connect.stripe.com/setup/s/something")
+      end
+    end
+  end
+
+  context "when the user is an employee" do
+    before do
+      create(:company_user, company:, user:)
+      user.add_role :employee, company
+      sign_in user
+    end
+
+    it "is not authorized to refresh stripe connect" do
+      send_request :get, payments_settings_stripe_connect_refresh_path
+      expect(response).to have_http_status(:redirect)
+      expect(flash["alert"]).to eq("You are not authorized to perform this action.")
+    end
+  end
+
+  context "when unauthenticated" do
+    it "is not authorized to refresh stripe connect" do
+      send_request :get, payments_settings_stripe_connect_refresh_path
+      expect(response).to have_http_status(:redirect)
+      expect(flash["alert"]).to eq("You need to sign in or sign up before continuing.")
+    end
+  end
+end