diff --git a/Gemfile b/Gemfile index 0e1dbade..6edef993 100644 --- a/Gemfile +++ b/Gemfile @@ -103,6 +103,8 @@ group :development do gem 'asciidoctor' gem 'capistrano' # gem 'rack-mini-profiler' + gem 'better_errors' + gem 'binding_of_caller' gem 'web-console' end diff --git a/Gemfile.lock b/Gemfile.lock index 67a2b7f9..ce28fb36 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -91,8 +91,14 @@ GEM awesome_print (1.9.2) base64 (0.2.0) bcrypt (3.1.20) + better_errors (2.10.1) + erubi (>= 1.0.0) + rack (>= 0.9.0) + rouge (>= 1.0.0) bigdecimal (3.1.7) bindex (0.8.1) + binding_of_caller (1.0.1) + debug_inspector (>= 1.2.0) bootsnap (1.18.3) msgpack (~> 1.2) brakeman (6.1.2) @@ -129,6 +135,7 @@ GEM debug (1.9.2) irb (~> 1.10) reline (>= 0.3.8) + debug_inspector (1.2.0) devise (4.9.4) bcrypt (~> 3.0) orm_adapter (~> 0.1) @@ -314,6 +321,7 @@ GEM actionpack (>= 5.2) railties (>= 5.2) rexml (3.2.6) + rouge (4.2.1) rspec (3.13.0) rspec-core (~> 3.13.0) rspec-expectations (~> 3.13.0) @@ -450,6 +458,8 @@ DEPENDENCIES attribute_normalizer awesome_print bcrypt (~> 3.1.7) + better_errors + binding_of_caller bootsnap brakeman capistrano diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 39b292e0..73b86468 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -1,5 +1,7 @@ # frozen_string_literal: true +require 'colorize' + # General controller configuration and helpers. class ApplicationController < ActionController::Base protect_from_forgery with: :exception @@ -11,20 +13,24 @@ class ApplicationController < ActionController::Base before_action :configure_permitted_parameters, if: :devise_controller? # By default, enable friendly forwarding if user is logged in - before_action :set_redirect_path, unless: :user_signed_in? + before_action :redirect_path, unless: :user_signed_in? add_flash_types :info, :error, :warning protected - def set_redirect_path - @redirect_path = request.path + def stripe_publishable_api_key + @stripe_publishable_api_key ||= ::Rails.application.credentials[Rails.env.to_sym].stripe.publishable_api_key + end + + def stripe_secret_api_key + @stripe_secret_api_key ||= ::Rails.application.credentials[Rails.env.to_sym].stripe.secret_api_key end # Override a Devise method def after_sign_in_path_for(resource) - if params[:redirect_to].present? - store_location_for(resource, params[:redirect_to]) + if redirect_to_param.present? + store_location_for(resource, redirect_to_param) elsif request.referer == Routing.routes.new_user_session_url super else @@ -32,6 +38,14 @@ def after_sign_in_path_for(resource) end end + def redirect_path + @redirect_path = redirect_to_param || request.path + end + + def redirect_to_param + @redirect_to_param ||= params.permit(:redirect_to)[:redirect_to] + end + def require_site_admin redirect_to root_path unless current_user.site_admin? end @@ -71,9 +85,19 @@ def alert_log_level(alert_type) end end + def alert_log_color(alert_type) + case alert_type + when 'notice' then :blue + when 'error', 'alert' then :red + when 'warning' then :yellow + end + end + def render_flash(flash) flash.each do |type, msg| log_level = alert_log_level(type) || :error + color = alert_log_color(type) + msg = msg.colorize(color).colorize(:bold) if color Rails.logger.send(log_level, msg) end diff --git a/app/controllers/payments_controller.rb b/app/controllers/payments_controller.rb index 91487aac..cd8a2ead 100644 --- a/app/controllers/payments_controller.rb +++ b/app/controllers/payments_controller.rb @@ -4,7 +4,7 @@ class PaymentsController < ApplicationController before_action :authenticate_user! def show - @payment = Payment.find(params[:id]) + @payment = Payment.find(permit_params[:id]) @charge = Stripe::Charge.retrieve(@payment.stripe_charge_id) if @payment.stripe_charge_id @ticket_request = @payment.ticket_request @event = @ticket_request.event @@ -12,9 +12,8 @@ def show end def new - @ticket_request = TicketRequest.find(params[:ticket_request_id]) + @ticket_request = TicketRequest.find(permit_params[:ticket_request_id]) return redirect_to root_path unless @ticket_request.can_view?(current_user) - return redirect_to payment_path(@ticket_request.payment) if @ticket_request.payment @event = @ticket_request.event @@ -33,7 +32,7 @@ def new end def create - @payment = Payment.new(params[:payment]) + @payment = Payment.new(permit_params[:payment]) return redirect_to root_path unless @payment.can_view?(current_user) if @payment.save_and_charge! @@ -49,7 +48,7 @@ def create end def other - @ticket_request = TicketRequest.find(params[:ticket_request_id]) + @ticket_request = TicketRequest.find(permit_params[:ticket_request_id]) return redirect_to root_path unless @ticket_request.can_view?(current_user) return redirect_to payment_path(@ticket_request.payment) if @ticket_request.payment @@ -57,11 +56,11 @@ def other end def sent - @ticket_request = TicketRequest.find(params[:ticket_request_id]) + @ticket_request = TicketRequest.find(permit_params[:ticket_request_id]) return redirect_to root_path unless @ticket_request.can_view?(current_user) @payment = Payment.new(ticket_request_id: @ticket_request.id, - explanation: params[:explanation], + explanation: permit_params[:explanation], status: Payment::STATUS_IN_PROGRESS) if @payment.save flash[:notice] = "We've recorded that your payment is en route" @@ -73,7 +72,7 @@ def sent end def mark_received - @ticket_request = TicketRequest.find(params[:ticket_request_id]) + @ticket_request = TicketRequest.find(permit_params[:ticket_request_id]) return redirect_to root_path unless @ticket_request.can_view?(current_user) @payment = Payment.where(ticket_request_id: @ticket_request.id, @@ -87,4 +86,22 @@ def mark_received redirect_to :back end end + + private + + def permit_params + params.permit( + :id, + :ticket_request_id, + payment: %i[ + ticket_request_id + ticket_request_attributes + status + stripe_card_token + explanation + ] + ) + .to_hash + .with_indifferent_access + end end diff --git a/app/controllers/ticket_requests_controller.rb b/app/controllers/ticket_requests_controller.rb index 04250a2f..106391f4 100644 --- a/app/controllers/ticket_requests_controller.rb +++ b/app/controllers/ticket_requests_controller.rb @@ -153,8 +153,10 @@ def create redirect_to new_payment_url(ticket_request_id: @ticket_request) end rescue StandardError => e - Rails.logger.error("Error saving request: #{e.message}\n\n#{@ticket_request.errors.full_messages.join(', ')}") - flash.now[:error] = "Error saving request: #{e.message}