Merge pull request #1099 from travis-ci/sb-billing-permission

Billing Admin Only Security Settings

Author: Shairyar Baig

lib/travis/api/v3/billing_client.rb

@@ -90,6 +90,11 @@ def get_coupon(code)
       handle_coupon_response(response)
     end
 
+    def update_organization_billing_permission(organization_id, billing_admin_only)
+      response = connection.patch("/organization/permission_update/#{organization_id}", billing_admin_only)
+      handle_subscription_response(response)
+    end
+
     private
 
     def handle_subscription_response(response)

lib/travis/api/v3/queries/organization.rb

@@ -13,6 +13,12 @@ def find
       raise WrongParams, 'missing organization.id or organization.login'.freeze
     end
 
+    def update_billing_permission(user_id)
+      data = params.dup.tap { |h| h.delete('organization.id') }
+      client = BillingClient.new(user_id)
+      client.update_organization_billing_permission(params['organization.id'], data)
+    end
+
     private
 
     def provider

lib/travis/api/v3/routes.rb

@@ -83,6 +83,7 @@ module Routes
       capture id: :digit
       route '/org/{organization.id}'
       get :find
+      patch :update_billing_permission, '/update_billing_permission'
 
       resource :preferences do
         route '/preferences'

lib/travis/api/v3/services/organization/update_billing_permission.rb

@@ -0,0 +1,11 @@
+module Travis::API::V3
+  class Services::Organization::UpdateBillingPermission < Service
+    params :billing_admin_only
+
+    def run!
+      raise LoginRequired unless access_control.full_access_or_logged_in?
+      query.update_billing_permission(access_control.user.id)
+      no_content
+    end
+  end
+end

spec/v3/billing_client_spec.rb

@@ -230,4 +230,18 @@
       end
     end
   end
+
+  describe '#update_organization_billing_permission' do
+    let(:billing_admin_only) { { billing_admin_only: true } }
+    subject { billing.update_organization_billing_permission(organization.id, billing_admin_only) }
+
+    it 'requests the update' do
+      stubbed_request = stub_billing_request(:patch, "/organization/permission_update/#{organization.id}", auth_key: auth_key, user_id: user_id)
+                            .with(body: JSON.dump(billing_admin_only))
+                            .to_return(status: 204)
+
+      expect { subject }.to_not raise_error
+      expect(stubbed_request).to have_been_made
+    end
+  end
 end

spec/v3/services/organization/update_billing_permission_spec.rb

@@ -0,0 +1,40 @@
+describe Travis::API::V3::Services::Organization::UpdateBillingPermission, set_app: true, billing_spec_helper: true do
+  let(:billing_url) { 'http://billingfake.travis-ci.com' }
+  let(:billing_auth_key) { 'secret' }
+  let(:organization_id) { rand(999) }
+
+  before do
+    Travis.config.billing.url = billing_url
+    Travis.config.billing.auth_key = billing_auth_key
+  end
+
+  context 'unauthenticated' do
+    it 'responds 403' do
+      patch("/v3/org/#{organization_id}/update_billing_permission", { })
+
+      expect(last_response.status).to eq(403)
+    end
+  end
+
+  context 'authenticated' do
+    let(:user) { FactoryBot.create(:user) }
+    let(:token) { Travis::Api::App::AccessToken.create(user: user, app_id: 1) }
+    let(:headers) {{ 'HTTP_AUTHORIZATION' => "token #{token}",
+                     'CONTENT_TYPE' => 'application/json' }}
+    let(:billing_admin_only) { { billing_admin_only: true } }
+
+
+    let!(:stubbed_request) do
+      stub_billing_request(:patch, "/organization/permission_update/#{organization_id}", auth_key: billing_auth_key, user_id: user.id)
+        .with(body: JSON.dump(billing_admin_only))
+        .to_return(status: 204)
+    end
+
+    it 'updates the billing permission on organization' do
+      patch("/v3/org/#{organization_id}/update_billing_permission", JSON.generate(billing_admin_only), headers)
+
+      expect(last_response.status).to eq(204)
+      expect(stubbed_request).to have_been_made.once
+    end
+  end
+end