forest_liana 9.22.15 → 9.22.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc9e247d2d65125925e14127a256acb70326504b4c1e2fc90daaf3b792736025
-  data.tar.gz: 7039ebbb67be595efd366b94d57a35881448f9747cba39cf2e8e35b1f88a083e
+  metadata.gz: fc453faf72f6b0f7030087482ead90361fe6e3e16c4d2e7b25e2a53cbc1b5fe4
+  data.tar.gz: 6b13ab236bf05d9c5099cc8a987bd1616ecc7ba7097f077ffe3938674a428a75
 SHA512:
-  metadata.gz: 3bf2d66f16eaedc067bfca8422a0274255bc9bc6d86057e251bdb65dd41191859e02344f2712356511c437bf03a525c5ff11b2a7f4ebb972104420baafcd1fbc
-  data.tar.gz: 07b0b79be5105719f3cffbb590717731031d3e1cd0fc81eb6e5d2c72a60f7413e411661f4f301a97294fc08e4cadac9e1d547ceb9c9cec1b9b0bbeadae569b3b
+  metadata.gz: 48fac66a8b958fdf847c8861992d38f1a61efd8ff9df7da04d1254c5470246b684f0f584fd3881c80aff673f69284b115f0d44852f5eb97c62ba438c3f43dad2
+  data.tar.gz: fae68b2cf78f032cfef3a5609f9309631b69e0784b579cfc3dbe772b298c3202d5bd29a74d92796ee5610fa9b57443f80eb9bce2f8c910433a15ec67bdce2106

data/app/controllers/forest_liana/stripe_controller.rb

@@ -1,5 +1,12 @@
 module ForestLiana
   class StripeController < ForestLiana::ApplicationController
+    include ForestLiana::Ability
+
+    rescue_from ForestLiana::Ability::Exceptions::TriggerForbidden, with: :render_error
+    rescue_from ForestLiana::Ability::Exceptions::RequireApproval, with: :render_error
+    rescue_from ForestLiana::Ability::Exceptions::UnsupportedConditionals, with: :render_error
+
+    before_action :authorize_refund, only: :refund
 
     def payments
       getter = StripePaymentsGetter.new(params, request.headers['Stripe-Secret-Key'],
@@ -27,7 +34,7 @@ module ForestLiana
 
     def refund
       begin
-        refunder = StripePaymentRefunder.new(params)
+        refunder = StripePaymentRefunder.new(@refund_parameters)
         refunder.perform
 
         render serializer: nil, json: {}
@@ -137,5 +144,24 @@ module ForestLiana
     def get_serializer_type(suffix)
       "#{params[:collection]}_#{suffix}"
     end
+
+    private
+
+    def authorize_refund
+      raise ForestLiana::Errors::HTTP422Error.new if params.dig(:data, :attributes, :requester_id).present?
+
+      parameters = refund_request_parameters
+      collection_name = parameters.dig(:data, :attributes, :collection_name).to_s
+      is_integration_action_authorized?(forest_user, collection_name, 'Refund', params)
+      @refund_parameters = parameters
+    end
+
+    def refund_request_parameters
+      return params.permit! unless params.dig(:data, :attributes, :signed_approval_request)
+
+      ForestLiana::Ability::Permission::RequestPermission.decodeSignedApprovalRequest(params.permit!)
+    rescue JWT::DecodeError
+      raise ForestLiana::Errors::HTTP400Error.new('Invalid signed action parameters')
+    end
   end
 end

data/app/services/forest_liana/ability/exceptions/unsupported_conditionals.rb

@@ -0,0 +1,17 @@
+module ForestLiana
+  module Ability
+    module Exceptions
+      class UnsupportedConditionals < ForestLiana::Errors::ExpectedError
+        def initialize(backtrace = nil)
+          super(
+            422,
+            :unprocessable_entity,
+            'The roles conditions (conditional smart actions) are not supported with Smart Collection. Please contact an administrator.',
+            'UnsupportedConditionalsFeatureError',
+            backtrace
+          )
+        end
+      end
+    end
+  end
+end

data/app/services/forest_liana/ability/permission/smart_action_checker.rb

@@ -43,7 +43,7 @@ module ForestLiana
           elsif @smart_action['approvalRequired'].include?(@user['roleId'])
             if condition_by_role_id(@smart_action['approvalRequiredConditions']).blank? || match_conditions('approvalRequiredConditions')
               # Global actions target no specific records — never resolve.
-              if @parameters[:data][:attributes][:all_records] && @action_type != 'global'
+              if @parameters[:data][:attributes][:all_records] && @action_type != 'global' && @collection
                 record_ids = select_all_record_ids
               end
 
@@ -83,6 +83,8 @@ module ForestLiana
         end
 
         def match_conditions(condition_name)
+          raise ForestLiana::Ability::Exceptions::UnsupportedConditionals.new unless @collection
+
           begin
             attributes = @parameters[:data][:attributes]
             condition = condition_by_role_id(@smart_action[condition_name])

data/app/services/forest_liana/ability/permission.rb

@@ -53,6 +53,19 @@ module ForestLiana
         end
       end
 
+      # An integration collection (`<Model>_stripe_payments`, …) has no model: a select-all is not
+      # resolved for its approval, and a role condition on its action is refused as unsupported.
+      def is_integration_action_authorized?(user, collection_name, action_name, parameters)
+        return true unless has_permission_system?
+
+        schema_action = find_integration_action(collection_name, action_name)
+        user_data = get_user_data(user['id'])
+        smart_action = schema_action && get_collections_permissions_data.dig(collection_name, :actions, action_name)
+        raise ForestLiana::Ability::Exceptions::TriggerForbidden.new unless user_data && smart_action
+
+        SmartActionChecker.new(parameters, nil, smart_action, user_data, schema_action.type, user).can_execute?
+      end
+
       # +refetch+ drops the cached permissions first. Only a caller about to refuse on a denial asks
       # for it (a stale, up to TTL-old cache may sit behind a permission granted moments ago): the
       # refetch rewrites the cluster-wide `forest.collections` entry and this request's copy, so a
@@ -367,6 +380,12 @@ module ForestLiana
         nil
       end
 
+      def find_integration_action(collection_name, action_name)
+        collection = ForestLiana.apimap.find { |candidate| candidate.name.to_s == collection_name && candidate.integration.present? }
+
+        collection&.actions&.find { |action| action.name == action_name }
+      end
+
       def find_action_from_endpoint(collection_name, endpoint, http_method)
         collection = ForestLiana.apimap.find { |collection| collection.name.to_s == collection_name }
 

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "9.22.15"
+  VERSION = "9.22.16"
 end

data/spec/requests/stripe_refund_spec.rb

@@ -0,0 +1,292 @@
+require 'rails_helper'
+
+describe 'Stripe payments refund', type: :request do
+  let(:rendering_id) { 13 }
+  let(:user_id) { 38 }
+  let(:role_id) { 1 }
+  let(:approver_role_id) { 3 }
+  let(:trigger_roles) { [role_id] }
+  let(:approval_roles) { [] }
+  let(:user_approval_roles) { [] }
+  let(:trigger_conditions) { [] }
+  let(:permissions_users) { [{ 'id' => user_id, 'roleId' => role_id }] }
+  let(:has_permission_system) { true }
+  let(:cache) { ActiveSupport::Cache::MemoryStore.new }
+  let(:refunder) { instance_double(ForestLiana::StripePaymentRefunder, perform: nil) }
+  let(:refund_requests) { [] }
+  let(:payments_collection) do
+    ForestLiana::Model::Collection.new(
+      name: 'Island_stripe_payments',
+      integration: 'stripe',
+      is_virtual: true,
+      actions: [ForestLiana::Model::Action.new(name: 'Refund', endpoint: '/forest/stripe_payments/refunds')]
+    )
+  end
+
+  let(:token) do
+    JWT.encode({
+      id: user_id,
+      email: 'michael.kelso@that70.show',
+      first_name: 'Michael',
+      last_name: 'Kelso',
+      team: 'Operations',
+      rendering_id: rendering_id,
+      exp: Time.now.to_i + 2.weeks.to_i,
+      permission_level: 'user'
+    }, ForestLiana.auth_secret, 'HS256')
+  end
+
+  let(:headers) do
+    {
+      'Accept' => 'application/json',
+      'Content-Type' => 'application/json',
+      'Authorization' => "Bearer #{token}"
+    }
+  end
+
+  let(:attributes) do
+    {
+      collection_name: 'Island_stripe_payments',
+      ids: ['ch_1', 'ch_2'],
+      values: {},
+      all_records: false,
+      smart_action_id: 'Island_stripe_payments-Refund'
+    }
+  end
+
+  let(:params) { { data: { attributes: attributes, type: 'custom-action-requests' }, timezone: 'Europe/Paris' } }
+
+  def environment_permissions
+    enabled = { 'roles' => [role_id, approver_role_id] }
+    crud = %w[browseEnabled readEnabled editEnabled addEnabled deleteEnabled exportEnabled].to_h { |key| [key, enabled] }
+    refund = {
+      'triggerEnabled' => { 'roles' => trigger_roles },
+      'triggerConditions' => trigger_conditions,
+      'approvalRequired' => { 'roles' => approval_roles },
+      'approvalRequiredConditions' => [],
+      'userApprovalEnabled' => { 'roles' => user_approval_roles },
+      'userApprovalConditions' => [],
+      'selfApprovalEnabled' => { 'roles' => [] }
+    }
+
+    { 'collections' => { 'Island_stripe_payments' => { 'collection' => crud, 'actions' => { 'Refund' => refund } } } }
+  end
+
+  def signed_approval_request(ids:, requester_id:)
+    JWT.encode({
+      data: {
+        attributes: attributes.merge(ids: ids, requester_id: requester_id),
+        type: 'custom-action-requests'
+      }
+    }, ForestLiana.env_secret, 'HS256')
+  end
+
+  def refund(request_headers = headers)
+    post '/forest/stripe_payments/refunds', params: JSON.dump(params), headers: request_headers
+  end
+
+  def refunded_ids
+    refund_requests.map { |refund_params| refund_params[:data][:attributes][:ids] }
+  end
+
+  before do
+    ForestLiana.apimap << payments_collection
+
+    allow(Rails).to receive(:cache).and_return(cache)
+    allow_any_instance_of(ForestLiana::Ability::Fetch).to receive(:get_permissions) do |_, path|
+      case path
+      when '/liana/v4/permissions/environment' then has_permission_system ? environment_permissions : true
+      when '/liana/v4/permissions/users' then permissions_users
+      end
+    end
+
+    allow(ForestLiana::StripePaymentRefunder).to receive(:new) do |refund_params|
+      refund_requests << refund_params
+      refunder
+    end
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_whitelist_retrieved) { true }
+    allow(ForestLiana::IpWhitelist).to receive(:is_ip_valid) { true }
+  end
+
+  after { ForestLiana.apimap.delete(payments_collection) }
+
+  context 'when the role is allowed to trigger the Refund action' do
+    it 'responds 200 and refunds each requested charge' do
+      refund
+
+      expect(response.status).to eq(200)
+      expect(refunded_ids).to eq([['ch_1', 'ch_2']])
+      expect(refunder).to have_received(:perform).with(no_args)
+    end
+  end
+
+  context 'when the project has no permission system' do
+    let(:has_permission_system) { false }
+    let(:trigger_roles) { [] }
+
+    it 'responds 200 and refunds each requested charge' do
+      refund
+
+      expect(response.status).to eq(200)
+      expect(refunded_ids).to eq([['ch_1', 'ch_2']])
+    end
+  end
+
+  context 'when the role is not allowed to trigger the Refund action' do
+    let(:trigger_roles) { [approver_role_id] }
+
+    it 'responds 403 and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first['name']).to eq('CustomActionTriggerForbiddenError')
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the user is no longer in the permissions system' do
+    let(:permissions_users) { [] }
+
+    it 'responds 403 and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the Refund action requires approval for the role' do
+    let(:approval_roles) { [role_id] }
+    let(:user_approval_roles) { [approver_role_id] }
+
+    it 'responds 403 with the roles allowed to approve and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      error = JSON.parse(response.body)['errors'].first
+      expect(error['name']).to eq('CustomActionRequiresApprovalError')
+      expect(error['data']).to eq('roleIdsAllowedToApprove' => [approver_role_id])
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when an approver sends a signed approval request' do
+    let(:role_id) { approver_role_id }
+    let(:trigger_roles) { [] }
+    let(:user_approval_roles) { [approver_role_id] }
+    let(:attributes) do
+      super().merge(ids: ['ch_99'], signed_approval_request: signed_approval_request(ids: ['ch_1'], requester_id: 12))
+    end
+
+    it 'responds 200 and refunds the charges of the approved request' do
+      refund
+
+      expect(response.status).to eq(200)
+      expect(refunded_ids).to eq([['ch_1']])
+    end
+  end
+
+  context 'when the approval request is not signed with the environment secret' do
+    let(:role_id) { approver_role_id }
+    let(:trigger_roles) { [] }
+    let(:user_approval_roles) { [approver_role_id] }
+    let(:attributes) do
+      forged = JWT.encode({ data: { attributes: { collection_name: 'Island_stripe_payments', ids: ['ch_1'], requester_id: 12 } } }, 'another-secret', 'HS256')
+      super().merge(signed_approval_request: forged)
+    end
+
+    it 'responds 400 and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(400)
+      expect(JSON.parse(response.body)['errors'].first['detail']).to eq('Invalid signed action parameters')
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the body carries a requester id outside a signed approval request' do
+    let(:attributes) { super().merge(requester_id: 12) }
+
+    it 'responds 422 and refunds nothing, even for a role allowed to trigger the Refund action' do
+      refund
+
+      expect(response.status).to eq(422)
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the role can trigger the Refund action only under a condition' do
+    let(:trigger_conditions) do
+      [{ 'roleId' => role_id, 'filter' => { 'field' => 'amount', 'operator' => 'greater_than', 'value' => 0, 'source' => 'data' } }]
+    end
+
+    it 'responds 422 and refunds nothing, since role conditions are not supported on Stripe payments' do
+      refund
+
+      expect(response.status).to eq(422)
+      expect(JSON.parse(response.body)['errors'].first['name']).to eq('UnsupportedConditionalsFeatureError')
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when a role needing approval selects every payment' do
+    let(:approval_roles) { [role_id] }
+    let(:user_approval_roles) { [approver_role_id] }
+    let(:attributes) { super().merge(all_records: true, all_records_ids_excluded: []) }
+
+    it 'responds 403 with the roles allowed to approve and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      error = JSON.parse(response.body)['errors'].first
+      expect(error['name']).to eq('CustomActionRequiresApprovalError')
+      expect(error['data']).to eq('roleIdsAllowedToApprove' => [approver_role_id])
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the request names a collection without the Stripe Refund action' do
+    let(:attributes) { super().merge(collection_name: 'Island') }
+
+    it 'responds 403 and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first['name']).to eq('CustomActionTriggerForbiddenError')
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the request names no collection' do
+    let(:attributes) { super().except(:collection_name) }
+
+    it 'responds 403 and refunds nothing' do
+      refund
+
+      expect(response.status).to eq(403)
+      expect(JSON.parse(response.body)['errors'].first['name']).to eq('CustomActionTriggerForbiddenError')
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+
+  context 'when the project has no permission system and the request names no collection' do
+    let(:has_permission_system) { false }
+    let(:attributes) { super().except(:collection_name) }
+
+    it 'responds 200 and refunds each requested charge' do
+      refund
+
+      expect(response.status).to eq(200)
+      expect(refunded_ids).to eq([['ch_1', 'ch_2']])
+    end
+  end
+
+  context 'when the request is not authenticated' do
+    it 'responds 401 and refunds nothing' do
+      refund(headers.except('Authorization'))
+
+      expect(response.status).to eq(401)
+      expect(ForestLiana::StripePaymentRefunder).not_to have_received(:new)
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forest_liana
 version: !ruby/object:Gem::Version
-  version: 9.22.15
+  version: 9.22.16
 platform: ruby
 authors:
 - Sandro Munda
@@ -286,6 +286,7 @@ files:
 - app/services/forest_liana/ability/exceptions/unauthorized_query_field_error.rb
 - app/services/forest_liana/ability/exceptions/unexposed_query_collection_error.rb
 - app/services/forest_liana/ability/exceptions/unknown_collection.rb
+- app/services/forest_liana/ability/exceptions/unsupported_conditionals.rb
 - app/services/forest_liana/ability/fetch.rb
 - app/services/forest_liana/ability/permission.rb
 - app/services/forest_liana/ability/permission/request_permission.rb
@@ -498,6 +499,7 @@ files:
 - spec/requests/smart_field_named_like_unexposed_relation_spec.rb
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
+- spec/requests/stripe_refund_spec.rb
 - spec/requests/test.ru
 - spec/requests/unresolved_polymorphic_relation_spec.rb
 - spec/requests/workflow_executions_spec.rb
@@ -863,6 +865,7 @@ test_files:
 - spec/requests/smart_field_named_like_unexposed_relation_spec.rb
 - spec/requests/stats_spec.rb
 - spec/requests/sti_record_conversion_spec.rb
+- spec/requests/stripe_refund_spec.rb
 - spec/requests/test.ru
 - spec/requests/unresolved_polymorphic_relation_spec.rb
 - spec/requests/workflow_executions_spec.rb