Commit Graph

1129 Commits

Author SHA1 Message Date
David Cook
72327a352e Merge pull request #13685 from deivid-rodriguez/no-raw-credit-card-data
Change CreditCardRemover specs to not send raw credit card data
2025-11-11 13:46:45 +11:00
David Rodríguez
915d03a66a Change CreditCardRemover specs to not send raw credit card data
If I re-record cassettes for these specs using my test API key, I get
the following errors:

```
1) Stripe::CreditCardRemover#remove Stripe customer exists and is not deleted deletes the credit card clone and the customer
   Failure/Error:
     Stripe::PaymentMethod.create(
       {
         type: 'card',
         card: {
           number: '4242424242424242',
           exp_month: 8,
           exp_year: Time.zone.now.year.next,
           cvc: '314',
         },
       },

   Stripe::CardError:
     Sending credit card numbers directly to the Stripe API is generally unsafe. We suggest you use test tokens that map to the test card you are using, see https://stripe.com/docs/testing. To enable testing raw card data APIs, see https://support.stripe.com/questions/enabling-access-to-raw-card-data-apis.
   # ./spec/lib/stripe/credit_card_remover_spec.rb:16:in `block (3 levels) in <main>'
   # ./spec/lib/stripe/credit_card_remover_spec.rb:44:in `block (4 levels) in <main>'
   # ./spec/lib/stripe/credit_card_remover_spec.rb:56:in `block (4 levels) in <main>'
   # ./spec/base_spec_helper.rb:208:in `block (2 levels) in <main>'
   # ./spec/base_spec_helper.rb:155:in `block (3 levels) in <main>'
   # ./spec/base_spec_helper.rb:155:in `block (2 levels) in <main>'
   # -e:1:in `<main>'
```

Use test payment methods instead as suggested by the error.
2025-11-06 18:30:45 +01:00
filipefurtad0
8e5404a268 Replaces negative assertion with a positive assertion
Adds test case on white spece

Refactors to have tests as shared_examples
2025-11-05 11:12:55 +00:00
filipefurtad0
04fc729a5a Changes tests not to trigger error
after https://github.com/openfoodfoundation/openfoodnetwork/pull/13571 was merged
2025-11-05 10:34:52 +00:00
filipefurtad0
8818a98230 Catches exceptions on final_weight_volume inputs 2025-11-05 10:34:52 +00:00
David Rodríguez
27975252f5 Rename pm_card to payment_method_id
And also remove a couple of now unused `let`'s that were already using
this terminology.

Co-authored-by: David Cook <david@openfoodnetwork.org.au>
2025-10-27 10:52:36 +01:00
David Rodríguez
9fc82776ec Move Stripe test payment method handling to a single place
And comment a bit on them.

Co-authored-by: David Cook <david@openfoodnetwork.org.au>
2025-10-27 10:45:45 +01:00
David Rodríguez
2c8bf82426 Migrate some spec to not send raw card numbers to Stripe API
If I regenerate the VCR cassetes for
spec/lib/stripe/payment_intent_validator_spec.rb, I get a lot of errors
like this:

```
Stripe::CardError:

Sending credit card numbers directly to the Stripe API is generally
unsafe. We suggest you use test tokens that map to the test card you are
using, see https://stripe.com/docs/testing. To enable testing raw card
data APIs, see
https://support.stripe.com/questions/enabling-access-to-raw-card-data-apis.
```

It seems the sandbox environment associated to my developer API keys is
not allowed to send raw credit card data.

Instead of requesting Stripe support to enable that, or regenerate
cassettes with the API keys in Bitwarden, I figured we could migrate the
tests to not use raw credit card data.
2025-10-27 09:08:30 +01:00
David Rodríguez
121019411c Fix spec instantiating payment method with wrong source
Previous error is fixed, which allows the spec to proceed further, and
reveals that the current cassettes are missing some requests:

```
  1) Stripe::PaymentIntentValidator#call as a guest when payment intent is valid valid non-3D credit cards are correctly handled behaves like payments intents from Visa returns payment intent id and does not raise
     Failure/Error:
       payment_intent_response = Stripe::PaymentIntent.retrieve(
         payment_intent_id,
         stripe_account: stripe_account_id
       )

     VCR::Errors::UnhandledHTTPRequestError:

       ================================================================================
       An HTTP request has been made that VCR does not know how to handle:
         GET https://api.stripe.com/v1/payment_intents/pi_3P8hNGKuuB1fWySn0dvhu9lG

       VCR is currently using the following cassette:

       (...)
```
2025-10-27 09:08:29 +01:00
David Rodríguez
1a5eb5b39a Remove raise_error negative block to fix RSpec warnings
Currently RSpec warns these specs like this:

```
WARNING: Using `expect { }.not_to raise_error(SpecificErrorClass)` risks false positives, since literally any other error would cause the
expectation to pass, including those raised by Ruby (e.g. `NoMethodError`, `NameError` and `ArgumentError`), meaning the code you are intending
to test may not even get reached. Instead consider using `expect { }.not_to raise_error` or `expect { }.to raise_error(DifferentSpecificErrorClass)`.
This message can be suppressed by setting: `RSpec::Expectations.configuration.on_potential_false_positives = :nothing`.
Called from /path/to/spec/lib/stripe/payment_intent_validator_spec.rb:53:in `block (7 levels) in <main>'.
```

The warnings are super accurate in this particular case: the inner
assertion is not actually getting reached due to a previous unrelated
error.

Since there's an inner assertion already, I think it's best to
completely remove to `raise_error` negative block, since it just hides
errors and buys us nothing.

By removing it, the underlying error surfaces:

```
  1) Stripe::PaymentIntentValidator#call as a guest when payment intent is valid valid non-3D credit cards are correctly handled behaves like payments intents from Visa returns payment intent id and does not raise
     Failure/Error:
       create(:payment, amount: payment_intent.amount, payment_method:,
                        response_code: payment_intent.id, source: pm_card)

     NoMethodError:
       undefined method `has_query_constraints?' for Stripe::PaymentMethod:Class

               elsif (klass || self.klass).has_query_constraints? || options[:query_constraints]
                                          ^^^^^^^^^^^^^^^^^^^^^^^
     Shared Example Group: "payments intents" called from ./spec/lib/stripe/payment_intent_validator_spec.rb:75
     # ./spec/lib/stripe/payment_intent_validator_spec.rb:16:in `block (3 levels) in <main>'
     # ./spec/lib/stripe/payment_intent_validator_spec.rb:19:in `block (3 levels) in <main>'
     # ./spec/lib/stripe/payment_intent_validator_spec.rb:53:in `block (7 levels) in <main>'
     # ./spec/base_spec_helper.rb:208:in `block (2 levels) in <main>'
     # ./spec/base_spec_helper.rb:155:in `block (3 levels) in <main>'
     # ./spec/base_spec_helper.rb:155:in `block (2 levels) in <main>'
     # -e:1:in `<main>'
```
2025-10-27 09:08:29 +01:00
David Rodríguez
2bd536298b Showcase the problem with some specs
They're always passing because an error (different from `StripeError`),
is actually making them pass.
2025-10-27 09:08:29 +01:00
David Rodríguez
98889365f1 Fix RSpec warning when running Reporting::ReportRenderer.render_as unit spec
Before:

```
$ bundle exec rspec -e ".render_as"

(...)

Run options: include {:full_description=>/\.render_as/}
WARNING: Using the `raise_error` matcher without providing a specific error or message risks false positives, since `raise_error` will match when Ruby raises a `NoMethodError`, `NameError` or `ArgumentError`, potentially allowing the expectation to pass without even executing the method you are intending to call. Actual error raised was #<ActionController::BadRequest: report_format should be in [:csv, :json, :html, :xlsx, :pdf]>. Instead consider providing a specific error class or message. This message can be suppressed by setting: `RSpec::Expectations.configuration.on_potential_false_positives = :nothing`. Called from /path/to/spec/lib/reports/report_renderer_spec.rb:34:in `block (3 levels) in <main>'.
.

Finished in 0.02544 seconds (files took 4.08 seconds to load)
1 example, 0 failures
```

After this patch:

```
$ bundle exec rspec -e ".render_as"

(...)

Run options: include {:full_description=>/\.render_as/}
.

Finished in 0.02488 seconds (files took 4.09 seconds to load)
1 example, 0 failures
```
2025-10-13 20:46:15 +02:00
Gareth
b956d6f21b Added test coverage, converted instance_double to double as we do not need the actual method 2025-10-08 17:17:04 -04:00
Gareth Rogers
585073a326 Merge branch 'master' into add-report-name-and-details 2025-10-07 11:02:56 -04:00
Gareth
c3189892af Removed other rows for now. Can be added in future PRs 2025-10-07 11:01:55 -04:00
David Cook
037030cf60 Merge pull request #13548 from mkllnk/test_rake
Configure rake specs in one place
2025-10-07 09:31:02 +11:00
Gareth Rogers
f414e04dea Merge branch 'master' into add-report-name-and-details 2025-10-01 09:54:51 -04:00
Gareth Rogers
0a9eb173ea Add report name and details to CSV files 2025-10-01 13:59:43 +10:00
Maikel Linke
6d284023fe Configure rake specs in one place
So we don't have to add it to every rake spec file.
2025-09-22 17:27:58 +10:00
Ahmed Ejaz
6bb709e85e update test description to reflect patching of redirect_auth_url in cvv_result 2025-09-22 11:57:37 +05:00
Ahmed Ejaz
ac06126f59 replace cvv_response_message usage with redirect_auth_url 2025-09-22 11:55:43 +05:00
Filipe
bd1d9892a2 Merge pull request #13487 from rioug/security-241-fix-url-sanitization
Fix url sanitization for Stripe authorisation URL
2025-09-16 16:40:11 +01:00
Gaetan Craig-Riou
1f15f094ce Per review, check the URL is from a stripe subdomain 2025-09-08 11:00:11 +10:00
Maikel Linke
94b75540e4 Replace Timecop with Rails' time helpers
Rails 4.1 added time helpers but we never bothered using them. But now
I'm getting rid of the Timecop dependency and use standard helpers.

Beware though that the new helpers always freeze time. When you travel
to a certain date then the clock stops ticking while Timecop maintained
the passing of time.

The freezing of time could cause problems if you are trying to enforce a
timeout. But all current specs don't seem affected.

In most cases, the freezing will make it easier to avoid flaky specs.
2025-08-22 16:57:04 +10:00
Gaetan Craig-Riou
118e18a78e Tighten url validation
Per recommendation from https://github.com/openfoodfoundation/openfoodnetwork/security/code-scanning/241
2025-08-13 22:27:42 +10:00
Gaetan Craig-Riou
cbced144d5 Clean up styling 2025-08-13 22:21:35 +10:00
Maikel Linke
2555a9e710 Ignore breaking code coverage for coverage spec
When we test our code coverage compilation, it breaks the code coverage
report for the current rspec process. By running that code separately,
we gain a correct coverage report for the rest of the code again.

So unfortunately, we can't report on the code coverage of this
particular task and have to ignore it. But at least CI depends on the
correct function of this task and would fail if it didn't work.
2025-08-05 12:45:05 +10:00
Maikel Linke
f532c4712e Load rake tasks only once for code coverage
Apparently, Rake's way of reloading the task code confuses the code
coverage report. Code tested by rake task specs was not recognised as
covered even though it was.
2025-08-05 12:44:13 +10:00
Maikel Linke
c0924fbe5e Use new Undercover formatter for :nocov: support 2025-07-31 14:56:17 +10:00
Gaetan Craig-Riou
7450f8a530 Fix spec, enable inventory when needed 2025-07-09 13:43:18 +10:00
Gaetan Craig-Riou
b7f969eed9 Move the inventory feature check to ScopeVariantToHub
Per review, the check is done on the same enterprise as the one use to
initialize ScopeVariantToHub. So it makes sense to move the actual
feature check to ScopeVariantToHub#scope
2025-07-09 13:43:12 +10:00
Gaetan Craig-Riou
6937a133ae Move inventory enabled check to OpenFoodNetwork::ScopeVariantToHub 2025-07-09 11:35:26 +10:00
Gaetan Craig-Riou
8829f6ad03 Only scope variant when inventory is enabled 2025-07-09 11:35:26 +10:00
Ahmed Ejaz
765ce68c11 Add order_id to order controller, variant autocomplete, and search parameters for improved order management 2025-06-21 16:19:31 +05:00
Ahmed Ejaz
ade35f2fa2 Fixes specs and update code respectively 2025-06-21 16:19:31 +05:00
Ahmed Ejaz
8e8878e43a Add search_variants_as parameter to variant search functionality 2025-06-21 16:19:31 +05:00
cyrillefr
6a44c45699 Style Metrics/ModuleLength in spec file 2025-06-17 14:37:35 +02:00
cyrillefr
bb0a6b7f8d Style Metrics/ModuleLength in spec file 2025-06-17 14:33:15 +02:00
cyrillefr
abaa7c35a7 Style Metrics/ModuleLength in spec file 2025-06-17 14:18:42 +02:00
cyrillefr
97c4cd382b Style Metrics/ModuleLength in spec file 2025-06-17 14:05:21 +02:00
cyrillefr
089caa228f Style Metrics/ModuleLength in spec file 2025-06-17 13:48:22 +02:00
cyrillefr
d9194d3dce Style Metrics/ModuleLength in spec file 2025-06-17 13:44:43 +02:00
cyrillefr
a792a550b3 Style Metrics/ModuleLength in spec file 2025-06-17 13:40:55 +02:00
cyrillefr
8c50ed9a45 Style Metrics/ModuleLength in spec file 2025-06-17 13:38:29 +02:00
cyrillefr
9d09fa9d54 Style Metrics/ModuleLength in spec file 2025-06-17 13:35:23 +02:00
cyrillefr
8234cc580d Style Metrics/ModuleLength in spec file 2025-06-17 13:31:22 +02:00
cyrillefr
88b390dac6 Style Metrics/ModuleLength in spec file 2025-06-17 13:22:05 +02:00
David Cook
0225db6840 Refactor without setter methods
This class was originally built to flexibly accept paramters in any order. It also allowed you to specify multiple of the same type of parameter, with the later one overriding the earlier.

This is too flexible and likely to cause mistakes. And besides, we don't use that feature!
2025-05-05 12:59:27 +10:00
Filipe
d2fa2e612c Merge pull request #13113 from chahmedejaz/task/13031-allow-producers-to-edit-orders
Allow producer to edit their products on hubs' orders
2025-04-21 11:28:36 +01:00
Filipe
cb9db54cd3 Merge pull request #13240 from rioug/13100-do-not-remove-fee-product-removed-from-OC
[Enterprise Fees] Keep fees on product when a product is removed from the order cycle
2025-04-20 21:57:56 +01:00