Commit Graph

88 Commits

Author SHA1 Message Date
David Rodríguez
915d03a66a Change CreditCardRemover specs to not send raw credit card data
If I re-record cassettes for these specs using my test API key, I get
the following errors:

```
1) Stripe::CreditCardRemover#remove Stripe customer exists and is not deleted deletes the credit card clone and the customer
   Failure/Error:
     Stripe::PaymentMethod.create(
       {
         type: 'card',
         card: {
           number: '4242424242424242',
           exp_month: 8,
           exp_year: Time.zone.now.year.next,
           cvc: '314',
         },
       },

   Stripe::CardError:
     Sending credit card numbers directly to the Stripe API is generally unsafe. We suggest you use test tokens that map to the test card you are using, see https://stripe.com/docs/testing. To enable testing raw card data APIs, see https://support.stripe.com/questions/enabling-access-to-raw-card-data-apis.
   # ./spec/lib/stripe/credit_card_remover_spec.rb:16:in `block (3 levels) in <main>'
   # ./spec/lib/stripe/credit_card_remover_spec.rb:44:in `block (4 levels) in <main>'
   # ./spec/lib/stripe/credit_card_remover_spec.rb:56:in `block (4 levels) in <main>'
   # ./spec/base_spec_helper.rb:208:in `block (2 levels) in <main>'
   # ./spec/base_spec_helper.rb:155:in `block (3 levels) in <main>'
   # ./spec/base_spec_helper.rb:155:in `block (2 levels) in <main>'
   # -e:1:in `<main>'
```

Use test payment methods instead as suggested by the error.
2025-11-06 18:30:45 +01:00
David Rodríguez
27975252f5 Rename pm_card to payment_method_id
And also remove a couple of now unused `let`'s that were already using
this terminology.

Co-authored-by: David Cook <david@openfoodnetwork.org.au>
2025-10-27 10:52:36 +01:00
David Rodríguez
9fc82776ec Move Stripe test payment method handling to a single place
And comment a bit on them.

Co-authored-by: David Cook <david@openfoodnetwork.org.au>
2025-10-27 10:45:45 +01:00
David Rodríguez
2c8bf82426 Migrate some spec to not send raw card numbers to Stripe API
If I regenerate the VCR cassetes for
spec/lib/stripe/payment_intent_validator_spec.rb, I get a lot of errors
like this:

```
Stripe::CardError:

Sending credit card numbers directly to the Stripe API is generally
unsafe. We suggest you use test tokens that map to the test card you are
using, see https://stripe.com/docs/testing. To enable testing raw card
data APIs, see
https://support.stripe.com/questions/enabling-access-to-raw-card-data-apis.
```

It seems the sandbox environment associated to my developer API keys is
not allowed to send raw credit card data.

Instead of requesting Stripe support to enable that, or regenerate
cassettes with the API keys in Bitwarden, I figured we could migrate the
tests to not use raw credit card data.
2025-10-27 09:08:30 +01:00
David Rodríguez
121019411c Fix spec instantiating payment method with wrong source
Previous error is fixed, which allows the spec to proceed further, and
reveals that the current cassettes are missing some requests:

```
  1) Stripe::PaymentIntentValidator#call as a guest when payment intent is valid valid non-3D credit cards are correctly handled behaves like payments intents from Visa returns payment intent id and does not raise
     Failure/Error:
       payment_intent_response = Stripe::PaymentIntent.retrieve(
         payment_intent_id,
         stripe_account: stripe_account_id
       )

     VCR::Errors::UnhandledHTTPRequestError:

       ================================================================================
       An HTTP request has been made that VCR does not know how to handle:
         GET https://api.stripe.com/v1/payment_intents/pi_3P8hNGKuuB1fWySn0dvhu9lG

       VCR is currently using the following cassette:

       (...)
```
2025-10-27 09:08:29 +01:00
David Rodríguez
1a5eb5b39a Remove raise_error negative block to fix RSpec warnings
Currently RSpec warns these specs like this:

```
WARNING: Using `expect { }.not_to raise_error(SpecificErrorClass)` risks false positives, since literally any other error would cause the
expectation to pass, including those raised by Ruby (e.g. `NoMethodError`, `NameError` and `ArgumentError`), meaning the code you are intending
to test may not even get reached. Instead consider using `expect { }.not_to raise_error` or `expect { }.to raise_error(DifferentSpecificErrorClass)`.
This message can be suppressed by setting: `RSpec::Expectations.configuration.on_potential_false_positives = :nothing`.
Called from /path/to/spec/lib/stripe/payment_intent_validator_spec.rb:53:in `block (7 levels) in <main>'.
```

The warnings are super accurate in this particular case: the inner
assertion is not actually getting reached due to a previous unrelated
error.

Since there's an inner assertion already, I think it's best to
completely remove to `raise_error` negative block, since it just hides
errors and buys us nothing.

By removing it, the underlying error surfaces:

```
  1) Stripe::PaymentIntentValidator#call as a guest when payment intent is valid valid non-3D credit cards are correctly handled behaves like payments intents from Visa returns payment intent id and does not raise
     Failure/Error:
       create(:payment, amount: payment_intent.amount, payment_method:,
                        response_code: payment_intent.id, source: pm_card)

     NoMethodError:
       undefined method `has_query_constraints?' for Stripe::PaymentMethod:Class

               elsif (klass || self.klass).has_query_constraints? || options[:query_constraints]
                                          ^^^^^^^^^^^^^^^^^^^^^^^
     Shared Example Group: "payments intents" called from ./spec/lib/stripe/payment_intent_validator_spec.rb:75
     # ./spec/lib/stripe/payment_intent_validator_spec.rb:16:in `block (3 levels) in <main>'
     # ./spec/lib/stripe/payment_intent_validator_spec.rb:19:in `block (3 levels) in <main>'
     # ./spec/lib/stripe/payment_intent_validator_spec.rb:53:in `block (7 levels) in <main>'
     # ./spec/base_spec_helper.rb:208:in `block (2 levels) in <main>'
     # ./spec/base_spec_helper.rb:155:in `block (3 levels) in <main>'
     # ./spec/base_spec_helper.rb:155:in `block (2 levels) in <main>'
     # -e:1:in `<main>'
```
2025-10-27 09:08:29 +01:00
David Rodríguez
2bd536298b Showcase the problem with some specs
They're always passing because an error (different from `StripeError`),
is actually making them pass.
2025-10-27 09:08:29 +01:00
Ahmed Ejaz
6bb709e85e update test description to reflect patching of redirect_auth_url in cvv_result 2025-09-22 11:57:37 +05:00
Ahmed Ejaz
ac06126f59 replace cvv_response_message usage with redirect_auth_url 2025-09-22 11:55:43 +05:00
Gaetan Craig-Riou
1f15f094ce Per review, check the URL is from a stripe subdomain 2025-09-08 11:00:11 +10:00
Gaetan Craig-Riou
118e18a78e Tighten url validation
Per recommendation from https://github.com/openfoodfoundation/openfoodnetwork/security/code-scanning/241
2025-08-13 22:27:42 +10:00
Gaetan Craig-Riou
cbced144d5 Clean up styling 2025-08-13 22:21:35 +10:00
Joseph Johansen
5086f2d8b5 Fix rubocop Style/Send group 2024-07-23 14:18:26 +01:00
Maikel Linke
6317fe1b71 Disable RSpec monkey patching 2024-05-09 12:24:41 +10:00
filipefurtad0
85e3d5d858 Tests payment intents for offline payments
Moves let variables outside shared examples block

Re-records cassettes
2024-04-23 12:24:00 +01:00
filipefurtad0
a3b646a500 Removes connected account
Re-records relevant VCR-cassettes for CreditCardCloner examples
2024-04-01 11:37:17 +01:00
filipefurtad0
01cbcf79fa Removes connected account
Re-records relevant VCR-cassettes for CreditCardRemover examples
2024-04-01 11:37:17 +01:00
Maikel Linke
bd6b0ddbf3 Enforce RSpec expect(..).not_to over to_not 2024-03-07 16:57:54 +11:00
David Cook
2107aeded1 Un-safely autocorrect RSpec/ExpectChange 2024-02-23 12:17:09 +11:00
David Cook
68cc9ed2fe Safely autocorrect Layout/EmptyLinesAroundBlockBody
Inspecting 1540 files
.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................C.............................................................................................................................................................................................................................................................................................................................................................C............................................................................

Offenses:

spec/lib/stripe/payment_intent_validator_spec.rb:7:1: C: [Corrected] Layout/EmptyLinesAroundBlockBody: Extra empty line detected at block body beginning.
spec/system/admin/products_v3/products_spec.rb:219:1: C: [Corrected] Layout/EmptyLinesAroundBlockBody: Extra empty line detected at block body end.

1540 files inspected, 2 offenses detected, 2 offenses corrected
2024-02-23 10:02:23 +11:00
filipefurtad0
89848efd23 Replaces stubs for VCR calls
Remove calling StripeStubs helper
2024-02-21 10:48:53 +00:00
filipefurtad0
b91719d63c Removes reference to STRIPE_ACCOUNT
THe connected account is created a few lines below, and this env variable is not needed
2024-02-20 15:15:54 +00:00
Gaetan Craig-Riou
8a0c32eec0 Improve Stripe::ProfileStorer specs
* Use `with_stripe_setup` helper
* add the request failing scenario
2024-02-19 10:53:53 +11:00
filipefurtad0
edae56345b Removes unnecessary Stripe api key / secret declaration 2024-02-08 14:53:48 +00:00
filipefurtad0
5b738476e4 Replaces double with instance_double 2024-02-08 14:50:42 +00:00
filipefurtad0
ecc5bbd0ed Adds condition to set Stripe.api key
Updates spec accordingly
2024-02-08 14:50:42 +00:00
filipefurtad0
949f7ef4d4 Removes unecessary braces - Ruby magic ;-) 2024-02-08 14:50:42 +00:00
filipefurtad0
9cad866fb6 Renames test case and VCR cassette
deletes previous cassette
2024-02-08 14:50:42 +00:00
filipefurtad0
949b515bfb Replaces stubs for non-existing customer test case 2024-02-08 14:50:42 +00:00
filipefurtad0
57f55d7585 Replaces stubs for existing customer test case 2024-02-08 14:50:42 +00:00
filipefurtad0
94168a3586 Encompasses test cases in describe block
Maybe not needed but, brings perhaps some structure to the spec, an creates a place holder for the required setup
2024-02-08 14:50:42 +00:00
David Cook
c4ea343a47 Merge pull request #12127 from filipefurtad0/corrects_setup_in_credit_card_cloner_spec
Corrects setup for setup in credit card cloner spec
2024-02-08 09:14:35 +11:00
filipefurtad0
6c9556f2db Removes UnionPay (debit) from non-3DS card list
Rubocop fixes
2024-02-07 16:32:34 +00:00
filipefurtad0
769ccfd6ef Corrects setup for setup in credit card cloner spec
We should not need additional hard coded keys other than the API key and the CLIENT_ID; this PR removes hard coded customer ID - creates one instead

Undoes Stripe.api_key deletion

This was a mixup with an ongoing PR in which we remove the need to call api_key in each individual spec.
2024-02-07 12:20:43 +00:00
filipefurtad0
d2bb53da5b Removes assertion on bogus_customer
When running the CI we actually assert on the bogus credentials, which breaks the spec

Removes unecessary StripeStubs inclusion
2024-01-29 20:04:38 +00:00
filipefurtad0
3e734f1e6b Attaches customer to payment method and clones payment method
Improves naming of actors; improves assertions
2024-01-25 18:43:05 +00:00
filipefurtad0
baef7de663 Replaces stubs with real accounts and card ids
The second example on this sepec is commented out, and will be addressed on the following commit

Sets user email

We need to set an email for the user we're creating; if we don't, then each time we run the spec, a new user will be created with a random email - as per user factory. This will translate in a (slightly) different HTTP request each time the spec is ran, and will cause a VCR recording error as new cassettes cannot be recorded in under the CI.

Re-recordes cassette after rebase
2024-01-25 18:43:03 +00:00
filipefurtad0
0a5982bb8f Update all locales with the latest Transifex translations 2024-01-12 12:12:17 +00:00
filipefurtad0
6eb56fa79b Update all locales with the latest Transifex translations 2024-01-12 11:59:48 +00:00
filipefurtad0
3802447bfe Removes credit card mock, pointing to real Stripe object
Re-records cassettes after source change
2023-12-07 18:30:23 +00:00
filipefurtad0
e50baa9a18 Adds payment capture scenario 2023-12-05 15:27:46 +00:00
filipefurtad0
f3f59ed6ad Adds valid credid card types (non-3D) 2023-12-04 20:48:53 +00:00
filipefurtad0
beb47f03c0 Removes Stripe module
...and calls it within the describe block
2023-11-16 14:46:25 +00:00
filipefurtad0
9d00b7dc43 Re-records relevant cassettes 2023-11-15 13:05:15 +00:00
filipefurtad0
4c3f87f047 Adds payment intent tests with invalid cards 2023-11-15 13:05:15 +00:00
filipefurtad0
9d50b11090 Adds re-recorded Stripe cassettes within Stripe gem folder name 2023-11-08 14:25:19 +11:00
filipefurtad0
a88919299f Replaces mocks with VCR calls 2023-10-31 19:06:40 +00:00
Neal Chambers
7ecd4a149b Fix Style/HashSyntax 2023-09-21 22:58:42 +09:00
Maikel Linke
178d296c9f Adapt specs to use stripe_sca_payment_method
There are still some specs directly related to StripeConnect and I left
them for now.
2021-12-20 15:00:14 +11:00
Maikel
a3c31f7d86 Revert "Kill stripe connect" 2021-09-20 08:39:34 +10:00