Validate Apple config key account

Author: svevang

app/models/apple/config.rb

@@ -10,6 +10,7 @@ class Config < ApplicationRecord
     validate :podcast_has_one_apple_config
     validate :not_default_feed
     validate :show_feed_binding_matches_podcast
+    validate :key_belongs_to_podcast_account
 
     # backwards-compatible "key" getters
     delegate :provider_id, to: :key
@@ -90,6 +91,13 @@ def show_feed_binding_matches_podcast
       errors.add(:show_feed_binding, "must belong to the same podcast as feed")
     end
 
+    def key_belongs_to_podcast_account
+      return unless key && podcast
+      return if key.account_id == podcast.account_id
+
+      errors.add(:key, "must belong to the podcast's PRX account")
+    end
+
     def assign_key_account
       key.account_id = podcast&.account_id if key&.new_record?
     end

test/models/apple/config_test.rb

@@ -58,6 +58,15 @@
       refute c1.valid?
       assert_equal ["cannot use default feed"], c1.errors[:feed]
     end
+
+    it "requires a persisted key to belong to the podcast account" do
+      podcast = create(:podcast, prx_account_uri: "/api/v1/accounts/456")
+      key = create(:apple_key, account_id: 123)
+      config = build(:apple_config, feed: create(:private_feed, podcast: podcast), key: key)
+
+      refute config.valid?
+      assert_equal ["must belong to the podcast's PRX account"], config.errors[:key]
+    end
   end
 
   it "assigns a new key to the podcast account" do