Fix EPP response code

Fixes #686
internetee · Sep 19, 2019 · e01f412 · e01f412
1 parent 7767868
commit e01f412
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 6 deletions.
diff --git a/app/controllers/epp/domains_controller.rb b/app/controllers/epp/domains_controller.rb
@@ -182,7 +182,7 @@ def renew
     end
 
     def transfer
-      authorize! :transfer, @domain, @password
+      authorize! :transfer, @domain
       action = params[:parsed_frame].css('transfer').first[:op]
 
       if @domain.non_transferable?
@@ -194,6 +194,18 @@ def transfer
         return
       end
 
+      provided_transfer_code = params[:parsed_frame].css('authInfo pw').text
+      wrong_transfer_code = provided_transfer_code != @domain.transfer_code
+
+      if wrong_transfer_code
+        epp_errors << {
+          code: '2202',
+          msg: 'Invalid authorization information',
+        }
+        handle_errors
+        return
+      end
+
       @domain_transfer = @domain.transfer(params[:parsed_frame], action, current_user)
 
       if @domain.errors[:epp_errors].any?

diff --git a/test/integration/epp/domain/transfer/query_test.rb b/test/integration/epp/domain/transfer/query_test.rb
@@ -30,8 +30,7 @@ def test_wrong_transfer_code
 
     post '/epp/command/transfer', { frame: request_xml }, { 'HTTP_COOKIE' => 'session=api_bestnames' }
 
-    # https://github.com/internetee/registry/issues/686
-    assert_epp_response :authorization_error
+    assert_epp_response :invalid_authorization_information
   end
 
   def test_no_domain_transfer

diff --git a/test/integration/epp/domain/transfer/request_test.rb b/test/integration/epp/domain/transfer/request_test.rb
@@ -115,10 +115,9 @@ def test_wrong_transfer_code
 
     post '/epp/command/transfer', { frame: request_xml }, { 'HTTP_COOKIE' => 'session=api_goodnames' }
     @domain.reload
-    refute_equal @new_registrar, @domain.registrar
 
-    # https://github.com/internetee/registry/issues/686
-    assert_epp_response :authorization_error
+    assert_epp_response :invalid_authorization_information
+    refute_equal @new_registrar, @domain.registrar
   end
 
   private