diff --git a/app/controllers/settings/subscriptions_controller.rb b/app/controllers/settings/subscriptions_controller.rb index 10bbfd51..4e91e108 100644 --- a/app/controllers/settings/subscriptions_controller.rb +++ b/app/controllers/settings/subscriptions_controller.rb @@ -4,4 +4,31 @@ class Settings::SubscriptionsController < ApplicationController before_action :authenticate_user! def index; end + + def subscription_callback + token = params[:token] + + begin + decoded_token = JWT.decode( + token, + ENV['JWT_SECRET_KEY'], + true, + { algorithm: 'HS256' } + ).first.symbolize_keys + + # Verify this is for the current user + unless decoded_token[:user_id] == current_user.id + redirect_to settings_subscriptions_path, alert: 'Invalid subscription update request.' + return + end + + current_user.update!(status: decoded_token[:status]) + + redirect_to settings_subscriptions_path, notice: 'Your subscription has been updated successfully!' + rescue JWT::DecodeError + redirect_to settings_subscriptions_path, alert: 'Failed to verify subscription update.' + rescue ArgumentError + redirect_to settings_subscriptions_path, alert: 'Invalid subscription data received.' + end + end end diff --git a/app/models/user.rb b/app/models/user.rb index b4d4c778..50e9d584 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -99,8 +99,6 @@ class User < ApplicationRecord end end - # Generates a secure token for cross-application authentication with the subscription app - # @return [String] JWT token containing user identity information def generate_subscription_token payload = { user_id: id, diff --git a/config/routes.rb b/config/routes.rb index fda9b13d..d9d25d7c 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -22,7 +22,11 @@ Rails.application.routes.draw do resources :users, only: %i[index create destroy edit update] resources :maps, only: %i[index] patch 'maps', to: 'maps#update' - resources :subscriptions, only: %i[index] + resources :subscriptions, only: %i[index] do + collection do + get :subscription_callback + end + end end patch 'settings', to: 'settings#update'