Add CustomWizard class protections and pro feature restrictions

config/locales/server.en.yml

@@ -17,6 +17,7 @@ en:
         name_too_short: "'%{name}' is too short for a custom field name (min length is #{min_length})"
         name_already_taken: "'%{name}' is already taken as a custom field name"
         save_default: "Failed to save custom field '%{name}'"
+        pro_required: "PRO Actions require a PRO Subscription"
     
     field:
       too_short: "%{label} must be at least %{min} characters"

jobs/scheduled/update_pro_status.rb

@@ -1,11 +1,9 @@
 # frozen_string_literal: true
 
-module Jobs
+class CustomWizard::UpdateProSubscription < ::Jobs::Scheduled
-  class UpdateProSubscription < ::Jobs::Scheduled
+  every 10.minutes
-    every 1.days
 
-    def execute(args)
+  def execute(args)
-      CustomWizard::ProSubscription.update
+    CustomWizard::ProSubscription.update
-    end
   end
 end

lib/custom_wizard/action.rb

@@ -14,9 +14,15 @@ class CustomWizard::Action
     @submission = opts[:submission]
     @log = []
     @result = CustomWizard::ActionResult.new
+    @pro = CustomWizard::Pro.new
   end
 
   def perform
+    if pro_actions.include?(action['type']) && !@pro.subscribed?
+      log_error(I18n.t("wizard.custom_field.error.pro_required"))
+      return
+    end
+
     ActiveRecord::Base.transaction do
       self.send(action['type'].to_sym)
     end
@@ -752,4 +758,8 @@ class CustomWizard::Action
 
     CustomWizard::Log.create(log)
   end
+  
+  def pro_actions
+    %w[send_message watch_categories send_to_api create_group create_category]
+  end
 end

lib/custom_wizard/builder.rb

@@ -22,13 +22,6 @@ class CustomWizard::Builder
     @sorted_handlers.sort_by! { |h| -h[:priority] }
   end
 
-  def mapper
-    CustomWizard::Mapper.new(
-      user: @wizard.user,
-      data: @wizard.current_submission&.fields_and_meta
-    )
-  end
-
   def build(build_opts = {}, params = {})
     return nil if !SiteSetting.custom_wizard_enabled || !@wizard
     return @wizard if !@wizard.can_access? && !build_opts[:force]
@@ -80,6 +73,15 @@ class CustomWizard::Builder
     @wizard
   end
 
+  private
+
+  def mapper
+    CustomWizard::Mapper.new(
+      user: @wizard.user,
+      data: @wizard.current_submission&.fields_and_meta
+    )
+  end
+
   def append_field(step, step_template, field_template, build_opts)
     params = {
       id: field_template['id'],
@@ -224,7 +226,10 @@ class CustomWizard::Builder
   end
 
   def check_condition(template)
-    return false unless @pro.subscribed?
+    unless @pro.subscribed?
+      CustomWizard::Log.create(I18n.t("wizard.custom_field.error.pro_required"))
+      return false
+    end
 
     if template['condition'].present?
       result = CustomWizard::Mapper.new(

lib/custom_wizard/pro/subscription.rb

@@ -38,14 +38,15 @@ class CustomWizard::ProSubscription
   end
 
   def self.update
-    @subscribed = nil
     auth = CustomWizard::ProAuthentication.new
     subscription = self.new
 
     if auth.active?
       response = Excon.get(
         "https://#{SUBSCRIPTION_SERVER}/subscription-server/user-subscriptions/#{SUBSCRIPTION_TYPE}/#{CLIENT_NAME}",
-        headers: { "User-Api-Key" => auth.api_key }
+        headers: {
+          "User-Api-Key" => auth.api_key
+        }
       )
 
       if response.status == 200

plugin.rb

@@ -126,6 +126,18 @@ after_initialize do
 
   Liquid::Template.register_filter(::CustomWizard::LiquidFilter::FirstNonEmpty)
 
+  class CustomWizard::UnpermittedOverride < StandardError; end
+
+  CustomWizard.constants.each do |class_name|
+    klass = CustomWizard.const_get(class_name)
+    next if !klass.is_a?(Class) || klass.superclass.name.to_s.split("::").first == 'CustomWizard'
+
+    klass.define_singleton_method(:prepend) { |klass| raise CustomWizard::UnpermittedOverride.new }
+    klass.define_singleton_method(:include) { |klass| raise CustomWizard::UnpermittedOverride.new }
+    klass.define_singleton_method(:define_method) { |name, &block| raise CustomWizard::UnpermittedOverride.new }
+    klass.define_singleton_method(:define_singleton_method) { |name, &block| raise CustomWizard::UnpermittedOverride.new }
+  end
+
   add_class_method(:wizard, :user_requires_completion?) do |user|
     wizard_result = self.new(user).requires_completion?
     return wizard_result if wizard_result