Verify ownership of payment_source when creating WalletPaymentSource #3007

ericsaupe · 2018-12-18T20:20:18Z

This merge request takes care of these things:

It's currently possible for payment sources created by one user to be added to the wallet of another user. This potentially allows one user to use payments stored for other users.
Cleans up data by restricting payment sources being added to a user's wallet if that payment source has already been added to the wallet.
Matches namespacing and inheritance for the Spree::WalletPaymentSource class to be the same as the other models in spree_core inheriting from Spree::Base

core/app/models/spree/wallet_payment_source.rb

skukx · 2018-12-18T20:33:52Z

core/app/models/spree/wallet_payment_source.rb


-  validates_presence_of :user
-  validates_presence_of :payment_source
+    validates_presence_of :user


I would prefer validates :user, presence: true. Not a big deal though

skukx · 2018-12-18T20:36:07Z

core/app/models/spree/wallet_payment_source.rb

-  validates_presence_of :payment_source
+    validates_presence_of :user
+    validates_presence_of :payment_source
+    validates :user_id, uniqueness: { scope: [:payment_source_type, :payment_source_id] }


It may be worth adding a custom message here. I found the default message on this is going to be User id has already been taken. That message doesn't really denote that the violation is due to the tuple key

Also, can we please document why this change is needed in this PR?

skukx · 2018-12-18T20:38:46Z

core/app/models/spree/wallet_payment_source.rb

+    validates_presence_of :user
+    validates_presence_of :payment_source
+    validates :user_id, uniqueness: { scope: [:payment_source_type, :payment_source_id] }
+    validate :check_for_payment_source_class


I'm guessing the reasoning for this is to mimic what happens in the Spree::Wallet#add method? I'm a fan prepending validation methods with validate so you know the purpose of that method is to validate and if called will add to the object errors. validate_payment_source_class

@skukx agree but these validations were already there, they have just been indented due to the module change. I think that if we want to change them we need to open another PR and deprecate existing methods.

kennyadsl

Thanks @ericsaupe, I left some comments to improve PR documentation and also notice the build to fail on something that should be related to this, can you please take a look?

kennyadsl · 2018-12-19T16:10:59Z

core/app/models/spree/wallet_payment_source.rb

-class Spree::WalletPaymentSource < ActiveRecord::Base
-  belongs_to :user, class_name: Spree::UserClassHandle.new, foreign_key: 'user_id', inverse_of: :wallet_payment_sources
-  belongs_to :payment_source, polymorphic: true, inverse_of: :wallet_payment_sources
+module Spree


can you please change the namespace/inheritance stuff into one or more other commits, so they are independently documented? Also, why are these change needed?

It's to follow the format used in the other model files.

kennyadsl · 2018-12-19T16:14:40Z

core/app/models/spree/wallet_payment_source.rb

-  validates_presence_of :payment_source
+    validates_presence_of :user
+    validates_presence_of :payment_source
+    validates :user_id, uniqueness: { scope: [:payment_source_type, :payment_source_id] }


Also, can we please document why this change is needed in this PR?

Without this validation it's possible for a user to add the same PaymentSource to their wallet multiple times causing dirty data and additional code in places where the wallet is displayed to remove duplicates.

This fixes the possibility of a User gaining access to a PaymentSource that isn't theirs by validating the WalletPaymentSource user_id is the same as the PaymentSource user_id if one is present.

skukx · 2018-12-19T20:07:13Z

To clarify some of these changes (each change should probably be documented in it's own commit):

validates :user_id, uniqueness: { scope: [:payment_source_type, :payment_source_id] }

This change is due to a unique tuple key on the database. Adding the validation mirrors what is enforced at the database layer and allows activerecord to handle it. What was a PG::UniqueViolation error becomes an ActiveRecord::RecordInvalid error.

For

validate :validate_payment_source_ownership

It is possible that a user's wallet can have a payment source added to it which does not belong to the user. This means a user could make transactions on a payment source that does not belong to them.

With the changes made to validate users cannot add payment sources from other users to their wallet. Some of our specs were using and adding payment sources created for other users to the wallet of the user being tested.

kennyadsl

@ericsaupe left a question, WDYT?

core/app/models/spree/wallet_payment_source.rb

spaghetticode

👏 thank you @ericsaupe

tvdeyen

This is a very good change. The error message could be improved, though.

tvdeyen · 2019-03-01T21:51:45Z

core/config/locales/en.yml

@@ -488,6 +488,9 @@ en:
          attributes:
            payment_source:
              has_to_be_payment_source_class: has to be a Spree::PaymentSource
+              not_owned_by_user: does not belong to user
+            user_id:
+              payment_source_already_exists: already has the Spree::PaymentSource in their wallet


This is not a very human friendly error message. Could we use

"already has this payment source in their wallet"?

I'm assuming @ericsaupe took inspiration from the message above. I think we could fix both in this PR.

jacobherrington

I am happy with this! 👍 Good work @ericsaupe!

houndci-bot reviewed Dec 18, 2018

View reviewed changes

core/app/models/spree/wallet_payment_source.rb Outdated Show resolved Hide resolved

core/app/models/spree/wallet_payment_source.rb Outdated Show resolved Hide resolved

ericsaupe force-pushed the wallet-payment-source-protection branch from b66a8a6 to 749f9c5 Compare December 18, 2018 20:25

skukx approved these changes Dec 18, 2018

View reviewed changes

kennyadsl requested changes Dec 19, 2018

View reviewed changes

ericsaupe added 3 commits December 19, 2018 11:18

Match namespacing convention and inheritance of other core models

4a8fa76

Validate user has payment source already in their wallet

efd9f5f

Without this validation it's possible for a user to add the same PaymentSource to their wallet multiple times causing dirty data and additional code in places where the wallet is displayed to remove duplicates.

Validate user owns the payment source before it is added to their wallet

3835f9d

This fixes the possibility of a User gaining access to a PaymentSource that isn't theirs by validating the WalletPaymentSource user_id is the same as the PaymentSource user_id if one is present.

ericsaupe force-pushed the wallet-payment-source-protection branch from 749f9c5 to f4df47b Compare December 19, 2018 23:46

Updated specs to respect payment owners

28c66c8

With the changes made to validate users cannot add payment sources from other users to their wallet. Some of our specs were using and adding payment sources created for other users to the wallet of the user being tested.

ericsaupe force-pushed the wallet-payment-source-protection branch from f4df47b to 28c66c8 Compare January 10, 2019 22:58

kennyadsl reviewed Jan 23, 2019

View reviewed changes

core/app/models/spree/wallet_payment_source.rb Show resolved Hide resolved

kennyadsl approved these changes Jan 23, 2019

View reviewed changes

spaghetticode approved these changes Jan 28, 2019

View reviewed changes

kennyadsl added the Code review needed label Feb 25, 2019

tvdeyen approved these changes Mar 1, 2019

View reviewed changes

jacobherrington approved these changes Mar 2, 2019

View reviewed changes

kennyadsl merged commit b5b2d06 into solidusio:master May 2, 2019

kennyadsl mentioned this pull request May 2, 2019

Improve error messages for wallet payment source #3196

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Verify ownership of payment_source when creating WalletPaymentSource #3007

Verify ownership of payment_source when creating WalletPaymentSource #3007

ericsaupe commented Dec 18, 2018 •

edited

Loading

skukx Dec 18, 2018

skukx Dec 18, 2018

kennyadsl Dec 19, 2018

skukx Dec 18, 2018

kennyadsl Jan 23, 2019

kennyadsl left a comment

kennyadsl Dec 19, 2018

ericsaupe Jan 10, 2019

kennyadsl Dec 19, 2018

skukx commented Dec 19, 2018 •

edited

Loading

kennyadsl left a comment

spaghetticode left a comment

tvdeyen left a comment

tvdeyen Mar 1, 2019

aitbw Mar 4, 2019

jacobherrington left a comment

Verify ownership of payment_source when creating WalletPaymentSource #3007

Verify ownership of payment_source when creating WalletPaymentSource #3007

Conversation

ericsaupe commented Dec 18, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kennyadsl left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

skukx commented Dec 19, 2018 • edited Loading

kennyadsl left a comment

Choose a reason for hiding this comment

spaghetticode left a comment

Choose a reason for hiding this comment

tvdeyen left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jacobherrington left a comment

Choose a reason for hiding this comment

ericsaupe commented Dec 18, 2018 •

edited

Loading

skukx commented Dec 19, 2018 •

edited

Loading