Bugfix: add better limits on payments & credit mutations

app/models/credit_mutation.rb

@@ -4,7 +4,7 @@ class CreditMutation < ApplicationRecord
   belongs_to :created_by, class_name: 'User'
 
   validates :description, presence: true
-  validates :amount, presence: true, numericality: { less_than_or_equal_to: 1000 }
+  validates :amount, presence: true, numericality: { less_than_or_equal_to: 5000 }
 
   validate :activity_not_locked
 

app/models/payment.rb

@@ -17,6 +17,7 @@
 
   validate :user_xor_invoice
   validate :user_amount
+  validate :invoice_amount
 
   scope :not_completed, -> { where.not(status: COMPLETE_STATUSES) }
 
@@ -74,10 +75,19 @@
     errors.add(:payment, 'must belong to a user xor invoice') unless user.present? ^ invoice.present?
   end
 
   def user_amount
     return unless user
 
     min_amount = Rails.application.config.x.min_payment_amount
-    errors.add(:amount, "must be bigger than or equal to €#{format('%.2f', min_amount)}") unless amount && (amount >= min_amount)
+    max_amount = Rails.application.config.x.max_payment_amount
+    errors.add(:amount, "must be greater than or equal to €#{format('%.2f', min_amount)}") unless amount && (amount >= min_amount)
+    errors.add(:amount, "must be less than or equal to €#{format('%.2f', max_amount)}") unless amount && (amount <= max_amount)
+  end
+
+  def invoice_amount
+    return unless invoice
+
+    min_amount = Rails.application.config.x.min_invoice_amount
+    errors.add(:amount, "must be greater than or equal to €#{format('%.2f', min_amount)}") unless amount && (amount >= min_amount)
   end
 end

config/application.rb

@@ -83,6 +83,8 @@ class Application < Rails::Application
     config.x.deposit_button_enabled = ENV.fetch('DEPOSIT_BUTTON_ENABLED', 'true') == 'true'
 
     config.x.min_payment_amount   = [ENV.fetch('MIN_PAYMENT_AMOUNT', '21.8').to_f, 0.01].max
+    config.x.max_payment_amount   = ENV.fetch('MAX_PAYMENT_AMOUNT', '1000')
+    config.x.min_invoice_amount   = [ENV.fetch('MIN_INVOICE_AMOUNT', '1').to_f, 0.01].max
 
     config.x.codes                = {
       beer: ENV.fetch('CODE_BEER', nil),

spec/models/credit_mutation_spec.rb

@@ -31,11 +31,25 @@
     end
 
     context 'when with too high amount' do
-      subject(:mutation) { build_stubbed(:credit_mutation, amount: 1001) }
+      subject(:mutation) { build_stubbed(:credit_mutation, amount: 5001) }
 
       it { expect(mutation).not_to be_valid }
     end
 
+    context 'when with boundary amounts' do
+      context 'when at maximum amount' do
+        subject(:mutation) { build_stubbed(:credit_mutation, amount: 5000) }
+
+        it { expect(mutation).to be_valid }
+      end
+
+      context 'when just over maximum amount' do
+        subject(:mutation) { build_stubbed(:credit_mutation, amount: 5000.01) }
+
+        it { expect(mutation).not_to be_valid }
+      end
+    end
+
     context 'when with a locked activity' do
       let(:activity) { build(:activity, :locked) }
       let(:mutation) { build(:credit_mutation, activity:) }

spec/models/payment_spec.rb

@@ -38,6 +38,46 @@
       end
     end
 
+    context 'when with too high amount' do
+      context 'when with user' do
+        subject(:payment) { build_stubbed(:payment, amount: 1001) }
+
+        it { expect(payment).not_to be_valid }
+      end
+
+      context 'when with invoice and high amount' do
+        subject(:payment) { build_stubbed(:payment, :invoice, amount: 1001) }
+
+        it { expect(payment).to be_valid }
+      end
+    end
+
+    context 'when with boundary amounts' do
+      context 'when with user at max amount' do
+        subject(:payment) { build_stubbed(:payment, amount: 1000) }
+
+        it { expect(payment).to be_valid }
+      end
+
+      context 'when with user just over max amount' do
+        subject(:payment) { build_stubbed(:payment, amount: 1000.01) }
+
+        it { expect(payment).not_to be_valid }
+      end
+
+      context 'when with invoice below minimum' do
+        subject(:payment) { build_stubbed(:payment, :invoice, amount: 0.99) }
+
+        it { expect(payment).not_to be_valid }
+      end
+
+      context 'when with invoice at minimum' do
+        subject(:payment) { build_stubbed(:payment, :invoice, amount: 1) }
+
+        it { expect(payment).to be_valid }
+      end
+    end
+
     context 'when without a status' do
       subject(:payment) { build_stubbed(:payment, status: nil) }
 
@@ -112,10 +152,10 @@
       subject(:payment) { create(:payment, user:, amount: 22.00, status: 'open') }
 
       it { expect { payment.update(status: 'open') }.not_to change(CreditMutation, :count) }
       it { expect { payment.update(status: 'pending') }.not_to change(CreditMutation, :count) }
       it { expect { payment.update(status: 'failed') }.not_to change(CreditMutation, :count) }
       it { expect { payment.update(status: 'canceled') }.not_to change(CreditMutation, :count) }
       it { expect { payment.update(status: 'expired') }.not_to change(CreditMutation, :count) }
     end
 
     context 'when updating already paid payment' do