only delete the right subscription

app/controllers/user/subscriptions_controller.rb

@@ -28,9 +28,17 @@ module DiscoursePatrons
 
       def destroy
         begin
-          subscription = ::Stripe::Subscription.delete(params[:id])
+          customer = Customer.find_user(current_user)
 
-          render_json_dump subscription
+          if customer.present?
+            subscription = ::Stripe::Subscription.retrieve(params[:id])
+
+            if subscription[:customer] == customer.customer_id
+              deleted = ::Stripe::Subscription.delete(params[:id])
+            end
+
+            render_json_dump deleted
+          end
 
         rescue ::Stripe::InvalidRequestError => e
           return render_json_error e.message

spec/fabricators/customer_fabricator.rb

@@ -0,0 +1,2 @@
+
+Fabricator(:customer, from: "DiscoursePatrons::Customer")

spec/plugin_helper.rb

@@ -1 +1,3 @@
 # frozen_string_literal: true
+
+Dir[Rails.root.join("plugins/discourse-patrons/spec/fabricators/*.rb")].each { |f| require f }

spec/requests/user/subscriptions_controller_spec.rb

@@ -52,9 +52,27 @@ module DiscoursePatrons
       end
 
       describe "delete" do
-        it "deletes a subscription" do
-          ::Stripe::Subscription.expects(:delete).with('sub_12345')
-          delete "/patrons/user/subscriptions/sub_12345.json"
+        context "no customer record" do
+          it "deletes a subscription" do
+            ::Stripe::Subscription.expects(:delete).never
+            delete "/patrons/user/subscriptions/sub_12345.json"
+          end
+        end
+
+        context "customer exists" do
+          let!(:customer) { Fabricate(:customer, customer_id: 'cus_tmp76543g', user_id: user.id) }
+
+          it "does not delete a subscription" do
+            ::Stripe::Subscription.expects(:retrieve).with('sub_12345').returns({ customer: 'other' })
+            ::Stripe::Subscription.expects(:delete).never
+            delete "/patrons/user/subscriptions/sub_12345.json"
+          end
+
+          it "deletes a subscription" do
+            ::Stripe::Subscription.expects(:retrieve).with('sub_12345').returns({ customer: 'cus_tmp76543g' })
+            ::Stripe::Subscription.expects(:delete).with('sub_12345')
+            delete "/patrons/user/subscriptions/sub_12345.json"
+          end
         end
       end
     end

test/javascripts/helpers/product-pretender.js.es6

@@ -4,14 +4,16 @@ export default function(helpers) {
   this.get("/patrons/products", () => {
     const products = [
       {
-        "id": "prod_23o8I7tU4g56",
-        "name": "Awesome Product",
-        "description": "Subscribe to our awesome product. For only $230.10 per month, you can get access. This is a test site. No real credit card transactions."
+        id: "prod_23o8I7tU4g56",
+        name: "Awesome Product",
+        description:
+          "Subscribe to our awesome product. For only $230.10 per month, you can get access. This is a test site. No real credit card transactions."
       },
       {
-        "id": "prod_B23dc9I7tU4eCy",
-        "name": "Special Product",
-        "description": "This is another subscription product. You can have more than one. From $12 per month."
+        id: "prod_B23dc9I7tU4eCy",
+        name: "Special Product",
+        description:
+          "This is another subscription product. You can have more than one. From $12 per month."
       }
     ];