Prevent standing order form from accepting non cash/stripe payment methods

app/forms/standing_order_form.rb

@@ -235,9 +235,15 @@ class StandingOrderForm
   end
 
   def payment_method_allowed?
-    if payment_method && payment_method.distributors.exclude?(shop)
+    return unless payment_method
+
+    if payment_method.distributors.exclude?(shop)
       errors[:payment_method] << "is not available to #{shop.name}"
     end
+
+    if StandingOrder::ALLOWED_PAYMENT_METHOD_TYPES.exclude? payment_method.type
+      errors[:payment_method] << "must be a Cash or Stripe method"
+    end
   end
 
   def shipping_method_allowed?

app/models/spree/payment_method_decorator.rb

@@ -28,7 +28,7 @@ Spree::PaymentMethod.class_eval do
       where('enterprises.id = ?', distributor)
   }
 
-  scope :for_standing_orders, where(type: ["Spree::PaymentMethod::Check", "Spree::Gateway::StripeConnect"])
+  scope :for_standing_orders, where(type: StandingOrder::ALLOWED_PAYMENT_METHOD_TYPES)
 
   scope :by_name, order('spree_payment_methods.name ASC')
 

app/models/standing_order.rb

@@ -1,4 +1,6 @@
 class StandingOrder < ActiveRecord::Base
+  ALLOWED_PAYMENT_METHOD_TYPES = ["Spree::PaymentMethod::Check", "Spree::Gateway::StripeConnect"]
+
   belongs_to :shop, class_name: 'Enterprise'
   belongs_to :customer
   belongs_to :schedule

spec/forms/standing_order_form_spec.rb

@@ -169,6 +169,7 @@ describe StandingOrderForm do
     let(:payment_method) { standing_order.payment_method }
     let(:new_payment_method) { create(:payment_method, distributors: [standing_order.shop]) }
     let(:invalid_payment_method) { create(:payment_method, distributors: [create(:enterprise)]) }
+    let(:bogus_payment_method) { create(:bogus_payment_method, distributors: [standing_order.shop]) }
     let(:form) { StandingOrderForm.new(standing_order, params) }
 
     context "when the payment method on an order is the same as the standing order" do
@@ -198,6 +199,22 @@ describe StandingOrderForm do
           expect(payments.with_state('void').count).to be 0
           expect(payments.with_state('checkout').count).to be 1
           expect(payments.with_state('checkout').first.payment_method).to eq payment_method
+          expect(form.errors[:payment_method]).to include "is not available to #{standing_order.shop.name}"
+        end
+      end
+
+      context "and the submitted shipping method is not associated with the shop" do
+        let(:params) { { payment_method_id: bogus_payment_method.id } }
+
+        it "returns false and does not void existing payments or create a new payment" do
+          expect(order.payments.reload.first.payment_method).to eq payment_method
+          expect(form.save).to be false
+          payments = order.reload.payments
+          expect(payments.count).to be 1
+          expect(payments.with_state('void').count).to be 0
+          expect(payments.with_state('checkout').count).to be 1
+          expect(payments.with_state('checkout').first.payment_method).to eq payment_method
+          expect(form.errors[:payment_method]).to include "must be a Cash or Stripe method"
         end
       end
     end