Allowing only one update for specific param? - ruby-on-rails

Question

How can I make it so once a param is filled, it can't be updated or edited again?
Issue: I have a param, :video, that once filled it will charge the customer. I want to make it so once it's filled, it can't be updated or edited again.
I have taken preventative measures on the views side that once a video is uploaded the edit/update form is hidden and can't be created again but one thing i noticed that if an update fails for any reason, the page can be went back to and the update form can be filled out again (even if the video is uploaded), thus again charging the customer twice.
How it works:
A customer creates an order, a stripe id is created, once the seller fulfills the order (by uploading a file or video), the charge is captured.
def charge_update
respond_to do |format|
#amount = (#order.order_price).to_i * 100
#amount_seller = (#order.order_price).to_i * 75
if #order.update(order_charge)
begin
charge = Stripe::Charge.create({
:amount => (#order.order_price).to_i * 100,
:description => 'Rails Stripe customer',
:currency => 'usd',
:customer => #order.stripe_customer_token,
:destination => {
:amount => #amount_seller ,
:account => (#order.seller.stripe_token),
}
})
rescue Stripe::CardError => e
charge_error = e.message
end
#order.update_column(:order_status, 2)
format.html { redirect_to ([#user, #order]), notice: 'Order was successfully uploaded.' }
format.json { render :show, status: :ok, location: #order }
elsif
if charge_error
flash[:error] = charge_error
redirect_to user_order_path([#user, #order])
else
format.html { render :edit }
format.json { render json: #order.errors, status: :unprocessable_entity }
end
end
end
end
private
def order_charge
params.require(:order).permit(:video, :order_status)
end
Feel free to let me know if there is a better way to go about validating the charge on the customer. My biggest concern is a customer being charged more than once because a seller either messes up, is malicious, etc. I want to guarantee a customer will only be charged once. The only way I can think of is to only allow one update to the video column.
Either that or creating a separate table for videos with order_id being unique to each video table ID.
UPDATE
I ended up doing the following which works... If any has any ideas of a better way, I am open to suggestions!
def charge_update
respond_to do |format|
if #order.video.present?
format.html { redirect_to ([#user, #order]), notice: 'Order already completed!.' }
format.json { render :show, status: :ok, location: #order }
else
#amount = (#order.order_price).to_i * 100
#amount_seller = (#order.order_price).to_i * 75
if #order.update(order_charge)
begin
...
...
...
end

Answer 1

The better way is to make a table that has these values
order_id
video_id
user_id
charged (Boolean Value )
once the customer made an order and charged it , you can fill these values and make charged value as true .
you can check if he made an order for that video before or not before making a new payment for it again .
here is an example for the model you can make for that
class CustomerOrder < ActiveRecord::Base
belongs_to :customer
belongs_to :order
belongs_to :video
end
before the customer make a new order , you can check if there is any relation
#customerorder =CustomerOrder.where(video_id: #video.id , user_id: #user.id , charged :true )

Answer 2

I would implement a callback with ActiveModel::Dirty to initiate a rollback on any change after changing the column value to anything not from empty or nil.
class Amount < ActiveRecord::Base
include ActiveModel::Dirty
before_save :check_video
attr_accessor :video # or whatever your video attribute is
private
def check_video
false if video_changed? && !video_was.nil? # or empty or whatever
true
end
end

Answer 3

I would ensure in the model layer that a record cannot be updated anymore once it was successfully created.
One simple way might be to override the readonly? method that is used by Rails to check for read-only records internally:
# in your model
def readonly?
super || video.present? && persisted?
end
Calling save on a read-only instance will raise an ActiveRecord::ReadOnlyRecord exception.
With this method, you can write if #order.readonly? in your controller and view to check if the #order is still updatedable.

Answer 4

I ended up creating a controller only for uploading the video files.
This way I can create the upload with the charges code in the create, and then allow updating without the need to separate the updates...
This is the gist of the controller so far:
def create
#video_order = VideoOrder.new(video_order_params)
#order = Order.find(params[:order_id])
#video_order.order_id = #order.id
respond_to do |format|
if #order.video_order.present?
format.html { redirect_to #order, notice: 'Already complete dog!.' }
format.json { render :show, status: :created, location: #video_order }
else
if #video_order.valid?
begin
charge = Stripe::Charge.create({
:amount => (#order.order_price).to_i * 100,
:description => 'Rails Stripe customer',
:currency => 'usd',
:customer => #order.stripe_customer_token,
:destination => {
:amount => #amount_seller ,
:account => (#order.seller.stripe_token),
}
})
rescue Stripe::CardError => e
charge_error = e.message
end
if charge_error
flash[:error] = charge_error
redirect_to '/'
else
if #video_order.save
#order.update_column(:order_status, 2)
format.html { redirect_to #order, notice: 'Video order was successfully created.' }
format.json { render :show, status: :created, location: #video_order }
else
format.html { render :new }
format.json { render json: #video_order.errors, status: :unprocessable_entity }
end
end
end
end
end
end
# PATCH/PUT /video_orders/1
# PATCH/PUT /video_orders/1.json
def update
respond_to do |format|
if #video_order.update(video_order_params)
format.html { redirect_to user_order_path([#user, #order]), notice: 'Video order was successfully updated.' }
format.json { render :show, status: :ok, location: #video_order }
else
format.html { render :edit }
format.json { render json: #video_order.errors, status: :unprocessable_entity }
end
end
end
I also have preventative measures in the create method just in case.