1 files changed, 35 insertions, 5 deletions
diff --git a/app/controllers/solidus_subscriptions/api/v1/subscriptions_controller.rb b/app/controllers/solidus_subscriptions/api/v1/subscriptions_controller.rb
index 0ff53ba..0ac694d 100644
--- a/app/controllers/solidus_subscriptions/api/v1/subscriptions_controller.rb
+++ b/app/controllers/solidus_subscriptions/api/v1/subscriptions_controller.rb
@@ -8,13 +8,21 @@ module SolidusSubscriptions
 
         def create
           store = params[:store_id].nil? ? ::Spree::Store.default : ::Spree::Store.find(id: params[:store_id])
-          attributes = subscription_params.merge(user: current_api_user, store: store)
-          subscription = SolidusSubscriptions::Subscription.new(attributes)
+          attributes = create_subscription_params.merge(user: current_api_user, store: store)
+          acceptable_payment_details = update_payment_attributes(attributes)
 
-          if subscription.save
-            render json: subscription.to_json(include: [:line_items, :shipping_address, :billing_address])
+          if acceptable_payment_details
+            subscription = SolidusSubscriptions::Subscription.new(attributes)
+
+            if subscription.save
+              render json: subscription.to_json(include: [:line_items, :shipping_address, :billing_address])
+            else
+              render json: subscription.errors.to_json, status: :unprocessable_entity
+            end
           else
-            render json: subscription.errors.to_json, status: :unprocessable_entity
+            error_message = I18n.t('solidus_subscriptions.subscription.invalid_payment_details')
+
+            render json: { payment_source_type: [error_message] }.to_json, status: :unprocessable_entity
           end
         end
 
@@ -55,6 +63,14 @@ module SolidusSubscriptions
           authorize! action_name.to_sym, @subscription, subscription_guest_token
         end
 
+        def create_subscription_params
+          params.require(:subscription).permit(
+            %i[payment_method_id payment_source_id shipping_address_id billing_address_id] |
+              SolidusSubscriptions.configuration.subscription_attributes |
+              [line_items_attributes: line_item_attributes]
+          )
+        end
+
         def subscription_params
           params.require(:subscription).permit(SolidusSubscriptions.configuration.subscription_attributes | [
             line_items_attributes: line_item_attributes,
@@ -64,6 +80,20 @@ module SolidusSubscriptions
         def line_item_attributes
           SolidusSubscriptions.configuration.subscription_line_item_attributes - [:subscribable_id] + [:id]
         end
+
+        def update_payment_attributes(attributes)
+          return true if attributes[:payment_method_id].blank? && attributes[:payment_source_id].blank?
+
+          payment_method = ::Spree::PaymentMethod.find_by(id: attributes[:payment_method_id])
+          payment_source = payment_method&.payment_source_class&.find_by(id: attributes[:payment_source_id])
+          if payment_method && payment_source
+            attributes[:payment_method] = payment_method
+            attributes[:payment_source] = payment_source
+            true
+          else
+            false
+          end
+        end
       end
     end
   end