[Announcement] Add validation for unauthorized HCB code block

app/controllers/announcements/blocks_controller.rb

@@ -9,7 +9,9 @@ def create
 
       authorize block, policy_class: Announcement::BlockPolicy
 
-      block.save!
+      unless block.save
+        return render json: { errors: block.errors.map(&:full_message) }, status: :bad_request
+      end
 
       render json: { id: block.id, html: block.rendered_html }
     end

app/javascript/controllers/tiptap_controller.js

@@ -166,7 +166,10 @@ export default class extends Controller {
 
   async donationGoal() {
     const attrs = await this.createBlock('Announcement::Block::DonationGoal')
-    this.editor.chain().focus().addDonationGoal(attrs).run()
+
+    if (attrs !== null) {
+      this.editor.chain().focus().addDonationGoal(attrs).run()
+    }
   }
 
   async hcbCode() {
@@ -182,12 +185,17 @@ export default class extends Controller {
       hcb_code: hcbCode,
     })
 
-    this.editor.chain().focus().addHcbCode(attrs).run()
+    if (attrs !== null) {
+      this.editor.chain().focus().addHcbCode(attrs).run()
+    }
   }
 
   async donationSummary() {
     const attrs = await this.createBlock('Announcement::Block::DonationSummary')
-    this.editor.chain().focus().addDonationSummary(attrs).run()
+
+    if (attrs !== null) {
+      this.editor.chain().focus().addDonationSummary(attrs).run()
+    }
   }
 
   async createBlock(type, parameters) {
@@ -204,6 +212,14 @@ export default class extends Controller {
       },
     }).then(r => r.json())
 
-    return res
+    if ('errors' in res) {
+      const message = `Could not insert block: ${res.errors.join(', ')}`
+
+      alert(message)
+
+      return null
+    } else {
+      return res
+    }
   }
 }

app/models/announcement/block/hcb_code.rb

@@ -24,6 +24,8 @@
 class Announcement
   class Block
     class HcbCode < ::Announcement::Block
+      validate :hcb_code_in_event
+
       def render_html(is_email: false)
         hcb_code = ::HcbCode.find_by_hashid(parameters["hcb_code"])
 
@@ -34,6 +36,16 @@ def render_html(is_email: false)
         Announcements::BlocksController.renderer.render partial: "announcements/blocks/hcb_code", locals: { hcb_code:, event: announcement.event, is_email:, block: self }
       end
 
+      private
+
+      def hcb_code_in_event
+        hcb_code = ::HcbCode.find_by_hashid(parameters["hcb_code"])
+
+        if hcb_code.nil? || hcb_code.event != announcement.event
+          errors.add(:base, "Transaction can not be found.")
+        end
+      end
+
     end
 
   end