Files
sure/app/controllers/subscriptions_controller.rb
Juan José Mata e0fb585bda Hide contribution payments from demo user(s) (#738)
* Hide payment contribution options from demo and manually created users

Demo data users and manually created users don't have stripe_customer_id
set on their family, so they should not see payment/contribution options.

Changes:
- Add can_manage_subscription? method to Family::Subscribeable that checks
  for presence of stripe_customer_id
- Guard Settings::PaymentsController to return 403 for users without
  stripe_customer_id
- Guard SubscriptionsController#show action (Stripe portal redirect) for
  users without stripe_customer_id
- Update settings navigation to hide the payment link when
  stripe_customer_id is not present
- Add tests for the new behavior

* Fix broken test

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-01-23 12:35:49 +01:00

72 lines
2.5 KiB
Ruby

class SubscriptionsController < ApplicationController
# Disables subscriptions for self hosted instances
before_action :guard_self_hosted, if: -> { self_hosted? }
# Disables Stripe portal for users without stripe_customer_id (demo users, manually created users)
guard_feature unless: -> { Current.family.can_manage_subscription? }, only: :show
# Upgrade page for unsubscribed users
def upgrade
if Current.family.subscription&.active?
redirect_to root_path, notice: "You are already contributing. Thank you!"
else
@plan = params[:plan] || "annual"
render layout: "onboardings"
end
end
def new
checkout_session = stripe.create_checkout_session(
plan: params[:plan],
family_id: Current.family.id,
family_email: Current.family.payment_email,
success_url: success_subscription_url + "?session_id={CHECKOUT_SESSION_ID}",
cancel_url: upgrade_subscription_url
)
Current.family.update!(stripe_customer_id: checkout_session.customer_id)
redirect_to checkout_session.url, allow_other_host: true, status: :see_other
end
# Only used for managing our "offline" trials. Paid subscriptions are handled in success callback of checkout session
def create
if Current.family.can_start_trial?
Current.family.start_trial_subscription!
redirect_to root_path, notice: "Welcome to Sure!"
else
redirect_to root_path, alert: "You have already started or completed a trial. Please upgrade to continue."
end
end
def show
portal_session_url = stripe.create_payment_portal_session_url(
customer_id: Current.family.stripe_customer_id,
return_url: settings_payment_url
)
redirect_to portal_session_url, allow_other_host: true, status: :see_other
end
# Stripe redirects here after a successful checkout session and passes the session ID in the URL
def success
checkout_result = stripe.get_checkout_result(params[:session_id])
if checkout_result.success?
Current.family.start_subscription!(checkout_result.subscription_id)
redirect_to root_path, notice: "Welcome to Sure! Your contribution is appreciated."
else
redirect_to root_path, alert: "Something went wrong processing your contribution. Please try again."
end
end
private
def guard_self_hosted
render plain: "Feature disabled: subscriptions are not available in self-hosted mode", status: :forbidden
end
def stripe
@stripe ||= Provider::Registry.get_provider(:stripe)
end
end