rspec: card - step 4

venshop_app/app/controllers/cards_controller.rb

@@ -169,7 +169,7 @@ class CardsController < ApplicationController
       end
       xml_data += '<total>' + total.to_s + '</total>'
       xml_data += '</root>'
-      MyCard.create!(
+      new_card = MyCard.create!(
         full_name: customer_info[:full_name],
         email: customer_info[:email],
         phone: customer_info[:phone],
@@ -178,11 +178,15 @@ class CardsController < ApplicationController
         items: xml_data
       )
       UserMailer.card_send_to_consignee(customer_info[:email], @card_infos).deliver
-      redirect_to url_for(action: 'thankyou')
+      redirect_to url_for(action: 'thankyou', card_id: new_card.id)
     end
   end
 
   def thankyou
+    if params[:card_id].nil? || !MyCard.exists?(params[:card_id])
+      flash[:error] = "Invalid card request"
+      redirect_to root_path and return
+    end
     add_breadcrumb "Thank out", url_for(action: 'thankyou')
     session[:SHOPPING_CARD_SESSION_NAME] = nil
     render :layout => "application_one_col"

venshop_app/spec/requests/card_pages_spec.rb

@@ -372,8 +372,25 @@ describe "CardPages" do
   end
 
   describe "step 4" do
+    describe "when not pass step 3" do
        before { visit url_for(controller: 'cards', action: 'thankyou') }
 
-    it { should have_title('Thank you') }
+      it { should have_selector('.alert.alert-error', text: 'Invalid') }
+    end
+
+    describe "when pass step 3" do
+      before do
+        # step 1
+        click_link "Check out"
+        # step 2
+        fill_in_order_form()
+        click_button "Continue"
+        # step 3
+        click_button "Correct, click here"
+      end
+
+      it { should have_title(full_title('Thank you')) }
+      it { should have_content('Thank you') }
+    end
   end
 end