From 43cd3b4dfe03b08715e331e1d3b459c6f063f335 Mon Sep 17 00:00:00 2001 From: Horacio Tellez Date: Tue, 2 Nov 2021 10:48:34 +0000 Subject: [PATCH] [IMP] payment: customer is no longer able to see tokens for disabled acquirers. Saved payments methods for disabled acquirers are no longer visible on the customer portal. It was fustrating for the customer to see saved payment methods that he was no longer able to use as they are disabled. Now the use should only be able to see payment methods that he can indeed use. Task - 2679695 closes odoo/odoo#79253 Signed-off-by: Victor Feyens (vfe) --- addons/payment/controllers/portal.py | 12 +++++++++--- addons/payment/tests/http_common.py | 4 ++-- addons/payment/tests/test_flows.py | 27 +++++++++++++++++++++++++++ 3 files changed, 38 insertions(+), 5 deletions(-) diff --git a/addons/payment/controllers/portal.py b/addons/payment/controllers/portal.py index 0afb35cda7d..620778b9c5c 100644 --- a/addons/payment/controllers/portal.py +++ b/addons/payment/controllers/portal.py @@ -159,9 +159,15 @@ class PaymentPortal(portal.CustomerPortal): acquirers_sudo = request.env['payment.acquirer'].sudo()._get_compatible_acquirers( request.env.company.id, partner.id, force_tokenization=True, is_validation=True ) - tokens = set(partner.payment_token_ids).union( - partner.commercial_partner_id.sudo().payment_token_ids - ) # Show all partner's tokens, regardless of which acquirer is available + + # Get all partner's tokens for which acquirers are not disabled. + tokens = request.env['payment.token'].search([ + ('partner_id', 'in', [partner.id, partner.commercial_partner_id.id]), + ('acquirer_id', 'in', request.env['payment.acquirer'].sudo()._search([ + ('state', 'in', ['enabled', 'test']) + ]) + )]) + access_token = payment_utils.generate_access_token(partner.id, None, None) rendering_context = { 'acquirers': acquirers_sudo, diff --git a/addons/payment/tests/http_common.py b/addons/payment/tests/http_common.py index 0ad85463c9e..23c7efbc370 100644 --- a/addons/payment/tests/http_common.py +++ b/addons/payment/tests/http_common.py @@ -151,8 +151,8 @@ class PaymentHttpCommon(PaymentTestUtils, HttpCase): url = self._build_url(uri) return self._make_http_get_request(url, {}) - def get_tx_manage_context(self, **route_kwargs): - response = self.portal_payment_method(**route_kwargs) + def get_tx_manage_context(self): + response = self.portal_payment_method() self.assertEqual(response.status_code, 200) diff --git a/addons/payment/tests/test_flows.py b/addons/payment/tests/test_flows.py index 5f04126d6b6..fb46711c91d 100644 --- a/addons/payment/tests/test_flows.py +++ b/addons/payment/tests/test_flows.py @@ -347,3 +347,30 @@ class TestFlows(PaymentCommon, PaymentHttpCommon): self.assertIn( "odoo.exceptions.ValidationError: The access token is invalid.", response.text) + + def test_access_disabled_acquirers_tokens(self): + self.partner = self.portal_partner + + # Log in as user from Company A + self.authenticate(self.portal_user.login, self.portal_user.login) + + token = self.create_token() + acquirer_b = self.acquirer.copy() + acquirer_b.state = 'test' + token_b = self.create_token(acquirer_id=acquirer_b.id) + + # A partner should see all his tokens on the /my/payment_method route, + # even if they are in other companies otherwise he won't ever see them. + manage_context = self.get_tx_manage_context() + self.assertEqual(manage_context['partner_id'], self.partner.id) + self.assertIn(self.acquirer.id, manage_context['acquirer_ids']) + self.assertIn(acquirer_b.id, manage_context['acquirer_ids']) + self.assertIn(token.id, manage_context['token_ids']) + self.assertIn(token_b.id, manage_context['token_ids']) + + # Token of disabled acquirer(s) & disabled acquirers should not be shown + self.acquirer.state = 'disabled' + manage_context = self.get_tx_manage_context() + self.assertEqual(manage_context['partner_id'], self.partner.id) + self.assertEqual(manage_context['acquirer_ids'], [acquirer_b.id]) + self.assertEqual(manage_context['token_ids'], [token_b.id])