Mfl/fix manual payment

.rubocop_todo.yml

@@ -111,6 +111,7 @@ Rails/BulkChangeTable:
     - 'db/migrate/20240728211432_remove_ea_ld.rb'
     - 'db/migrate/20240728223048_event_prices_as_integers.rb'
     - 'db/migrate/20240729210234_ticket_requests_cleanup.rb'
+    - 'db/migrate/20240806011401_payment_provider.rb'
 
 # Offense count: 3
 # Configuration parameters: Include.

.version

@@ -1 +1 @@
-1.3.5
+1.3.6

app/controllers/application_controller.rb

@@ -32,8 +32,10 @@ def stripe_publishable_api_key
   end
 
   def set_event
+    Rails.logger.debug { "#set_event() permitted params: #{permitted_params.inspect}" }
+
     event_id = permitted_params[:event_id].to_i
-    event_slug = permitted_params[:event_id].delete("#{event_id}-")
+    event_slug = permitted_params[:event_id].sub("#{event_id}-", '')
 
     Rails.logger.debug { "#set_event() => event_id = #{event_id}, event_slug = #{event_slug} params[:event_id] => #{permitted_params[:event_id]}" }
 
@@ -43,8 +45,7 @@ def set_event
     end
 
     @event = Event.where(id: event_id).first
-
-    if @event.slug != event_slug
+    if @event&.slug != event_slug
       Rails.logger.warn("Event slug mismatch: [#{event_slug}] != [#{@event&.slug}]")
     end
 
@@ -59,7 +60,13 @@ def set_ticket_request
     Rails.logger.debug { "#set_ticket_request() => ticket_request_id = #{ticket_request_id}" }
     return unless ticket_request_id
 
-    @ticket_request = TicketRequest.find(ticket_request_id)
+    # check if ticket request exists
+    @ticket_request = TicketRequest.find_by(id: ticket_request_id)
+    if @ticket_request.blank?
+      Rails.logger.info { "#set_ticket_request() => unknown ticket_request_id: #{ticket_request_id}" }
+      return redirect_to root_path
+    end
+
     Rails.logger.debug { "#set_ticket_request() => @ticket_request = #{@ticket_request&.inspect}" }
 
     redirect_to @event unless @ticket_request.event == @event

app/controllers/payments_controller.rb

@@ -6,7 +6,8 @@ class PaymentsController < ApplicationController
   before_action :set_event
   before_action :set_ticket_request
   before_action :set_payment
-  before_action :validate_payment, except: [:confirm]
+  before_action :initialize_payment, except: %i[show confirm other]
+  before_action :validate_payment, except: %i[confirm]
 
   def show
     Rails.logger.debug { "#show() => @ticket_request = #{@ticket_request&.inspect} params: #{params}" }
@@ -15,17 +16,13 @@ def show
 
   def new
     Rails.logger.debug { "#new() => @ticket_request = #{@ticket_request&.inspect}" }
-    initialize_payment
   end
 
   # Creates new Payment
   # Create Payment Intent and save PaymentIntentId in Payment
   def create
     Rails.logger.debug { "#create() => @ticket_request = #{@ticket_request&.inspect} params: #{params}" }
 
-    # init the payment, user from ticket request
-    initialize_payment
-
     # check to see if we have an existing stripe payment intent. retrieve or save
     @payment.retrieve_or_save_payment_intent
 
@@ -62,14 +59,19 @@ def confirm
     mark_payment_completed
   end
 
-  # init and mark the payment as completed.
+  # human has marked the payment as confirmed received and completed.
   # Annotate that manual was set
   def manual_confirmation
-    initialize_payment
-    @payment.update(explanation: 'manual confirm')
-    @payment.reload
-    Rails.logger.info("#manual_confirm() => @payment #{@payment.inspect}")
+    # cancel any stripe payment intent, so there is no orphaned intent
+    @payment.cancel_payment_intent
+
+    # update payment with explanation.
+    @payment.update(explanation: 'Marked Received', provider: :other)
+
+    # mark payment and ticket request completed
     mark_payment_completed
+    Rails.logger.info("#manual_confirmation() => @payment #{@payment.inspect}")
+
     redirect_to event_ticket_requests_path(@event, @ticket_request)
   end
 
@@ -78,9 +80,13 @@ def other
   end
 
   # handle other forms of payment than credit card / stripe
+  # set payment provider and cancel the Stripe PaymentIntent
   def sent
-    initialize_payment
-    @payment.update(explanation: permitted_params[:explanation], status: Payment::STATUS_IN_PROGRESS)
+    # set explanation, provider, status.
+    @payment.update(explanation: permitted_params[:explanation],
+                    status: :in_progress,
+                    provider: :other)
+    @payment.cancel_payment_intent
     @payment.reload
 
     Rails.logger.info("#sent() => @payment #{@payment.inspect}")
@@ -93,6 +99,7 @@ def sent
 
   def mark_payment_completed
     Payment.transaction do
+      # if we have a payment explanation, mark as other. else mark received
       @payment.mark_received
       @payment.ticket_request.mark_complete
       @payment.reload
@@ -128,16 +135,6 @@ def set_payment
     end
   end
 
-  # initialize payment and save stripe payment intent
-  def save_payment_intent
-    initialize_payment
-    return redirect_to root_path unless @payment.present? && @payment.can_view?(current_user)
-
-    @payment.save_with_payment_intent.tap do |result|
-      flash.now[:error] = @payment.errors.full_messages.to_sentence unless result
-    end
-  end
-
   def initialize_payment
     @stripe_publishable_api_key ||= Rails.configuration.stripe[:publishable_api_key]
 
@@ -186,7 +183,7 @@ def validate_payment_confirmation
     # has to have a stripe payment id and payment must not already be received
     unless @payment.stripe_payment?
       Rails.logger.error("Invalid payment confirmation id: #{@payment.id} missing stripe_payment_id")
-      return root_path, alert: 'This payment request is missing the stripe payment.'
+      return root_path, alert: 'This payment request is not a valid stripe payment.'
     end
 
     nil
@@ -199,6 +196,7 @@ def permitted_params
       :ticket_request_id,
       :stripe_payment_id,
       :payment_intent,
+      :provider,
       :explanation,
       payment: %i[
         ticket_request

app/controllers/ticket_requests_controller.rb

@@ -24,14 +24,15 @@ def index
         requests:      requests.count,
         adults:        requests.sum(&:adults),
         kids:          requests.sum(&:kids),
+        donations:     requests.sum(&:donation),
         addon_passes:  requests.sum(&:active_addon_pass_sum),
         addon_camping: requests.sum(&:active_addon_camp_sum),
-        raised:        requests.sum(&:price)
+        raised:        requests.sum(&:cost)
       }
     end
 
     @stats[:total] ||= Hash.new { |h, k| h[k] = 0 }
-    %i[requests adults kids addon_passes addon_camping raised].each do |measure|
+    %i[requests adults kids donations addon_passes addon_camping raised].each do |measure|
       %i[pending awaiting_payment completed].each do |status|
         @stats[:total][measure] += @stats[status][measure]
       end
@@ -182,19 +183,13 @@ def update
   def destroy
     Rails.logger.error("destroy# params: #{permitted_params}".colorize(:yellow))
 
-    unless @event.admin?(current_user) || current_user == @ticket_request.user
-      Rails.logger.error("ATTEMPT TO DELETE TICKET REQUEST #{@ticket_request} by #{current_user}".colorize(:red))
-      flash.now[:error] = 'You do not have sufficient privileges to delete this request.'
-      return render_flash(flash)
-    end
-
-    if @ticket_request.payment_received?
-      flash.now[:error] = 'Can not delete request when payment has been received. It must be refunded instead.'
+    unless @event.admin?(current_user) || @ticket_request.can_be_cancelled?(by_user: current_user)
+      Rails.logger.warn("Failed to delete ticket request #{@ticket_request} status: #{@ticket_request.status_name} by #{current_user}".colorize(:red))
+      flash.now[:error] = 'You do not have permission to delete this ticket'
       return render_flash(flash)
     end
 
     @ticket_request.destroy! if @ticket_request&.persisted?
-
     redirect_to new_event_ticket_request_path(@event), notice: 'Ticket Request was successfully cancelled.'
   end
 

app/mailers/payment_mailer.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
 class PaymentMailer < ApplicationMailer
-  include PaymentsHelper
-
   def payment_received(payment)
     self.payment = payment