rooty/fab-manager
1
0
Fork 0
mirror of https://github.com/LaCasemate/fab-manager.git synced 2025-01-29 18:52:22 +01:00
Code Issues Releases Activity

rebase coupon usage on code instead of id (more secure)

Browse Source
This commit is contained in:
Sylvain 2016-08-10 15:34:47 +02:00
parent def5384a38
commit 6a87467f7c
5 changed files with 45 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
app/assets/javascripts/controllers/machines.coffee.erb
View File

@ -316,9 +316,6 @@ Application.Controllers.controller "ReserveMachineController", ["$scope", "$stat
## is the user allowed to change the date of his booking
$scope.enableBookingMove = true
## how many hours before the reservation, the user is still allowed to change his booking
$scope.moveBookingDelay = 24
## list of plans, classified by group
$scope.plansClassifiedByGroup = []
for group in groupsPromise
@ -636,15 +633,16 @@ Application.Controllers.controller "ReserveMachineController", ["$scope", "$stat
##
# Format the parameters expected by /api/prices/compute and return the resulting object
# Format the parameters expected by /api/prices/compute or /api/reservations and return the resulting object
# @param reservation {Object} as returned by mkReservation()
# @param coupon {Object} Coupon as returned from the API
# @return {{reservation:Object, coupon_id:number}}
##
mkComputePriceParams = (reservation, coupon) ->
params = {reservation: reservation}
if coupon
params['coupon_id'] = coupon.id
mkRequestParams = (reservation, coupon) ->
params =
reservation: reservation
coupon_code: (coupon.code if coupon)
params
@ -655,7 +653,7 @@ Application.Controllers.controller "ReserveMachineController", ["$scope", "$stat
updateCartPrice = ->
if Object.keys($scope.ctrl.member).length > 0
r = mkReservation($scope.ctrl.member, $scope.eventsReserved, $scope.selectedPlan)
Price.compute mkComputePriceParams(r, $scope.coupon.applied), (res) ->
Price.compute mkRequestParams(r, $scope.coupon.applied), (res) ->
$scope.amountTotal = res.price
setSlotsDetails(res.details)
else
@ -770,12 +768,15 @@ Application.Controllers.controller "ReserveMachineController", ["$scope", "$stat
reservation: ->
reservation
price: ->
Price.compute(mkComputePriceParams(reservation, $scope.coupon.applied)).$promise
Price.compute(mkRequestParams(reservation, $scope.coupon.applied)).$promise
wallet: ->
Wallet.getWalletByUser({user_id: reservation.user_id}).$promise
cgv: ->
CustomAsset.get({name: 'cgv-file'}).$promise
controller: ['$scope', '$uibModalInstance', '$state', 'reservation', 'price', 'cgv', 'Auth', 'Reservation', 'wallet', 'helpers', '$locale', '$filter', ($scope, $uibModalInstance, $state, reservation, price, cgv, Auth, Reservation, wallet, helpers, $locale, $filter) ->
coupon: ->
$scope.coupon.applied
controller: ['$scope', '$uibModalInstance', '$state', 'reservation', 'price', 'cgv', 'Auth', 'Reservation', 'wallet', 'helpers', '$locale', '$filter', 'coupon',
($scope, $uibModalInstance, $state, reservation, price, cgv, Auth, Reservation, wallet, helpers, $locale, $filter, coupon) ->
# user wallet amount
$scope.walletAmount = wallet.amount
@ -788,8 +789,10 @@ Application.Controllers.controller "ReserveMachineController", ["$scope", "$stat
# Reservation
$scope.reservation = reservation
# Currency symbol or abreviation for the current locale
$scope.currencySymbol = $locale.NUMBER_FORMATS.CURRENCY_SYM
# Used in wallet info template to interpolate some translations
$scope.numberFilter = $filter('number')
##
@ -801,7 +804,7 @@ Application.Controllers.controller "ReserveMachineController", ["$scope", "$stat
else
$scope.attempting = true
$scope.reservation.card_token = response.id
Reservation.save reservation: $scope.reservation, (reservation) ->
Reservation.save mkRequestParams($scope.reservation, coupon), (reservation) ->
$uibModalInstance.close(reservation)
, (response)->
$scope.alerts = []
@ -827,24 +830,30 @@ Application.Controllers.controller "ReserveMachineController", ["$scope", "$stat
reservation: ->
reservation
price: ->
Price.compute(mkComputePriceParams(reservation, $scope.coupon.applied)).$promise
Price.compute(mkRequestParams(reservation, $scope.coupon.applied)).$promise
wallet: ->
Wallet.getWalletByUser({user_id: reservation.user_id}).$promise
controller: ['$scope', '$uibModalInstance', '$state', 'reservation', 'price', 'Auth', 'Reservation', 'wallet', 'helpers', '$filter', '$locale', ($scope, $uibModalInstance, $state, reservation, price, Auth, Reservation, wallet, helpers, $filter, $locale) ->
coupon: ->
$scope.coupon.applied
controller: ['$scope', '$uibModalInstance', '$state', 'reservation', 'price', 'Auth', 'Reservation', 'wallet', 'helpers', '$filter', '$locale', 'coupon',
($scope, $uibModalInstance, $state, reservation, price, Auth, Reservation, wallet, helpers, $filter, $locale, coupon) ->
# user wallet amount
$scope.walletAmount = wallet.amount
# Price
# Global price (total of all items)
$scope.price = price.price
# price to pay
# Price to pay (wallet deducted)
$scope.amount = helpers.getAmountToPay(price.price, wallet.amount)
# Reservation
$scope.reservation = reservation
# Currency symbol or abreviation for the current locale
$scope.currencySymbol = $locale.NUMBER_FORMATS.CURRENCY_SYM
# Used in wallet info template to interpolate some translations
$scope.numberFilter = $filter('number')
# Button label
@ -861,7 +870,7 @@ Application.Controllers.controller "ReserveMachineController", ["$scope", "$stat
##
$scope.ok = ->
$scope.attempting = true
Reservation.save reservation: $scope.reservation, (reservation) ->
Reservation.save mkRequestParams($scope.reservation, coupon), (reservation) ->
$uibModalInstance.close(reservation)
$scope.attempting = true
, (response)->

4
app/controllers/api/prices_controller.rb
View File

@ -44,7 +44,7 @@ class API::PricesController < API::ApiController
@amount = {elements: nil, total: 0}
else
_reservable = _price_params[:reservable_type].constantize.find(_price_params[:reservable_id])
@amount = Price.compute(current_user.is_admin?, _user, _reservable, _price_params[:slots_attributes], _price_params[:plan_id], _price_params[:nb_reserve_places], _price_params[:nb_reserve_reduced_places], coupon_params[:coupon_id])
@amount = Price.compute(current_user.is_admin?, _user, _reservable, _price_params[:slots_attributes], _price_params[:plan_id], _price_params[:nb_reserve_places], _price_params[:nb_reserve_reduced_places], coupon_params[:coupon_code])
end
@ -66,6 +66,6 @@ class API::PricesController < API::ApiController
end
def coupon_params
params.permit(:coupon_id)
params.permit(:coupon_code)
end
end

8
app/controllers/api/reservations_controller.rb
View File

@ -22,10 +22,10 @@ class API::ReservationsController < API::ApiController
def create
if current_user.is_admin?
@reservation = Reservation.new(reservation_params)
is_reserve = @reservation.save_with_local_payment
is_reserve = @reservation.save_with_local_payment(coupon_params[:coupon_code])
else
@reservation = Reservation.new(reservation_params.merge(user_id: current_user.id))
is_reserve = @reservation.save_with_payment
is_reserve = @reservation.save_with_payment(coupon_params[:coupon_code])
end
if is_reserve
SubscriptionExtensionAfterReservation.new(@reservation).extend_subscription_if_eligible
@ -55,4 +55,8 @@ class API::ReservationsController < API::ApiController
:nb_reserve_places, :nb_reserve_reduced_places,
slots_attributes: [:id, :start_at, :end_at, :availability_id, :offered])
end
def coupon_params
params.permit(:coupon_code)
end
end

10
app/models/price.rb
View File

@ -14,10 +14,10 @@ class Price < ActiveRecord::Base
# @param [plan_id] {Number} if the user is subscribing to a plan at the same time of his reservation, specify the plan's ID here
# @param [nb_places] {Number} for _reservable_ of type Event, pass here the number of booked places
# @param [nb_reduced_places] {Number} for _reservable_ of type Event, pass here the number of booked places at reduced price
# @param [coupon_id] {Number} ID of the coupon to apply to the total price
# @param [coupon_code] {String} Code of the coupon to apply to the total price
# @return {Hash} total and price detail
##
def self.compute(admin, user, reservable, slots, plan_id = nil, nb_places = nil, nb_reduced_places = nil, coupon_id = nil)
def self.compute(admin, user, reservable, slots, plan_id = nil, nb_places = nil, nb_reduced_places = nil, coupon_code = nil)
_amount = 0
_elements = Hash.new
_elements[:slots] = Array.new
@ -72,7 +72,7 @@ class Price < ActiveRecord::Base
training_is_creditable = plan.training_credits.select {|credit| credit.creditable_id == reservable.id}.size > 0
# Training reserved by the user is free when :
# |-> the user already has a current subscription and if training_is_creditable is true and has at least one credit available.
if !new_plan_being_bought
if user.training_credits.size < plan.training_credit_nb and training_is_creditable
@ -112,8 +112,8 @@ class Price < ActiveRecord::Base
end
# === apply Coupon if any ===
unless coupon_id.nil?
_coupon = Coupon.find(coupon_id)
unless coupon_code.nil?
_coupon = Coupon.find_by_code(coupon_code)
_amount = _amount - (_amount * _coupon.percent_off / 100)
end

11
app/models/reservation.rb
View File

@ -139,7 +139,7 @@ class Reservation < ActiveRecord::Base
invoice_items
end
def save_with_payment
def save_with_payment(coupon_code = nil)
build_invoice(user: user)
invoice_items = generate_invoice_items
if valid?
@ -259,11 +259,11 @@ class Reservation < ActiveRecord::Base
end
def save_with_local_payment
def save_with_local_payment(coupon_code = nil)
if user.invoicing_disabled?
if valid?
### generate invoice only for calcul price, to refactoring!!
### generate invoice only for calcul price, TODO refactor!!
build_invoice(user: user)
generate_invoice_items(true)
@wallet_amount_debit = get_wallet_amount_debit
@ -353,13 +353,14 @@ class Reservation < ActiveRecord::Base
end
def get_wallet_amount_debit
total = self.invoice.invoice_items.map(&:amount).map(&:to_i).reduce(:+) or 0
total = (self.invoice.invoice_items.map(&:amount).map(&:to_i).reduce(:+) or 0)
if plan_id.present?
plan = Plan.find(plan_id)
total += plan.amount
end
wallet_amount = (user.wallet.amount * 100).to_i
return wallet_amount >= total ? total : wallet_amount
wallet_amount >= total ? total : wallet_amount
end
def debit_user_wallet