Prevent removing payment method from processing orders and return payment method info even if deleted

server/graphql/loaders/index.js

@@ -710,6 +710,15 @@ export const loaders = req => {
     }).then(results => sortResults(CollectiveIds, results, 'CollectiveId', [])),
   );
 
+  context.loaders.PaymentMethod.byIdIncludeDeleted = new DataLoader(keys => {
+    return models.PaymentMethod.findAll({
+      where: {
+        id: keys,
+      },
+      paranoid: false,
+    }).then(results => sortResultsSimple(keys, results, pm => pm.id, []));
+  });
+
   /** *** Order *****/
   // Order - findByMembership
   context.loaders.Order.findByMembership = new DataLoader(combinedKeys =>

server/graphql/v1/mutations/paymentMethods.js

@@ -184,12 +184,22 @@ export async function removePaymentMethod(paymentMethodId, req) {
 
   // Block the removal if the payment method has subscriptions linked
   const subscriptions = await paymentMethod.getOrders({
-    where: { status: { [Op.or]: [ORDER_STATUS.ACTIVE, ORDER_STATUS.ERROR] } },
+    where: {
+      [Op.or]: [
+        {
+          status: {
+            [Op.or]: [ORDER_STATUS.ACTIVE, ORDER_STATUS.ERROR],
+          },
+          ['$Subscription.id$']: { [Op.ne]: null },
+        },
+        { status: ORDER_STATUS.PROCESSING },
+      ],
+    },
     include: [
       {
         model: models.Subscription,
         where: { isActive: true },
-        required: true,
+        required: false,
       },
     ],
   });

server/graphql/v2/object/Order.js

@@ -202,7 +202,7 @@ export const GraphQLOrder = new GraphQLObjectType({
         type: GraphQLPaymentMethod,
         resolve(order, _, req) {
           if (order.PaymentMethodId) {
-            return req.loaders.PaymentMethod.byId.load(order.PaymentMethodId);
+            return req.loaders.PaymentMethod.byIdIncludeDeleted.load(order.PaymentMethodId);
           }
         },
       },

test/server/graphql/v1/paymentMethods.test.js

@@ -2,11 +2,19 @@ import { expect } from 'chai';
 import gqlV1 from 'fake-tag';
 import { stub } from 'sinon';
 
+import OrderStatuses from '../../../../server/constants/order-status';
 import roles from '../../../../server/constants/roles';
 import models from '../../../../server/models';
 import paypalAdaptive from '../../../../server/paymentProviders/paypal/adaptiveGateway';
 import paypalMock from '../../../mocks/paypal';
-import { fakeOrganization, fakeTransaction } from '../../../test-helpers/fake-data';
+import {
+  fakeCollective,
+  fakeOrder,
+  fakeOrganization,
+  fakePaymentMethod,
+  fakeTransaction,
+  fakeUser,
+} from '../../../test-helpers/fake-data';
 import * as utils from '../../../utils';
 
 let host, admin, user, collective, paypalPaymentMethod;
@@ -101,6 +109,159 @@ describe('server/graphql/v1/paymentMethods', () => {
     }),
   );
 
+  describe('removePaymentMethod', () => {
+    const removePaymentMethodQuery = gqlV1`
+      mutation RemovePaymentMethod($id: Int!) {
+        removePaymentMethod(id: $id) {
+          id
+        }
+      }
+    `;
+
+    it('removes payment method', async () => {
+      const user = await fakeUser();
+      const collective = await fakeCollective({ admin: user });
+      const pm = await fakePaymentMethod({
+        CollectiveId: collective.id,
+      });
+
+      await fakeOrder({
+        PaymentMethodId: pm.id,
+      });
+
+      const res = await utils.graphqlQuery(
+        removePaymentMethodQuery,
+        {
+          id: pm.id,
+        },
+        user,
+      );
+
+      expect(res.errors).to.not.exist;
+      await pm.reload({
+        paranoid: false,
+      });
+      expect(pm.isSoftDeleted()).to.be.true;
+    });
+
+    it('removes payment method from inactive subscription', async () => {
+      const user = await fakeUser();
+      const collective = await fakeCollective({ admin: user });
+      const pm = await fakePaymentMethod({
+        CollectiveId: collective.id,
+      });
+
+      const order = await fakeOrder(
+        {
+          PaymentMethodId: pm.id,
+        },
+        { withSubscription: true },
+      );
+
+      await order.Subscription.update({ isActive: false });
+
+      const res = await utils.graphqlQuery(
+        removePaymentMethodQuery,
+        {
+          id: pm.id,
+        },
+        user,
+      );
+
+      expect(res.errors).to.not.exist;
+      await pm.reload({
+        paranoid: false,
+      });
+      expect(pm.isSoftDeleted()).to.be.true;
+    });
+
+    it('cant remove if is an active subscription payment method', async () => {
+      const user = await fakeUser();
+      const collective = await fakeCollective({ admin: user });
+      const pm = await fakePaymentMethod({
+        CollectiveId: collective.id,
+      });
+
+      await fakeOrder(
+        {
+          PaymentMethodId: pm.id,
+        },
+        { withSubscription: true },
+      );
+
+      const res = await utils.graphqlQuery(
+        removePaymentMethodQuery,
+        {
+          id: pm.id,
+        },
+        user,
+      );
+
+      expect(res.errors).to.exist;
+      await pm.reload({
+        paranoid: false,
+      });
+      expect(pm.isSoftDeleted()).to.be.false;
+    });
+
+    it('cant remove if is an active subscription payment method with order processing', async () => {
+      const user = await fakeUser();
+      const collective = await fakeCollective({ admin: user });
+      const pm = await fakePaymentMethod({
+        CollectiveId: collective.id,
+      });
+
+      await fakeOrder(
+        {
+          PaymentMethodId: pm.id,
+          status: OrderStatuses.PROCESSING,
+        },
+        { withSubscription: true },
+      );
+
+      const res = await utils.graphqlQuery(
+        removePaymentMethodQuery,
+        {
+          id: pm.id,
+        },
+        user,
+      );
+
+      expect(res.errors).to.exist;
+      await pm.reload({
+        paranoid: false,
+      });
+      expect(pm.isSoftDeleted()).to.be.false;
+    });
+
+    it('cant remove if is an payment method with order processing', async () => {
+      const user = await fakeUser();
+      const collective = await fakeCollective({ admin: user });
+      const pm = await fakePaymentMethod({
+        CollectiveId: collective.id,
+      });
+
+      await fakeOrder({
+        PaymentMethodId: pm.id,
+        status: OrderStatuses.PROCESSING,
+      });
+
+      const res = await utils.graphqlQuery(
+        removePaymentMethodQuery,
+        {
+          id: pm.id,
+        },
+        user,
+      );
+
+      expect(res.errors).to.exist;
+      await pm.reload({
+        paranoid: false,
+      });
+      expect(pm.isSoftDeleted()).to.be.false;
+    });
+  });
+
   describe('oauth flow', () => {
     // not implemented
   });