From 70b9c9bba770260de2a44fd3705f00f974f1b5d6 Mon Sep 17 00:00:00 2001
From: Joshua Dwire <joshua@joshuadwire.com>
Date: Fri, 6 May 2016 11:21:06 -0400
Subject: [PATCH] Require authorization for ACH

---
 app/Http/Controllers/PaymentController.php           |  5 +++++
 app/Http/Controllers/PublicClientController.php      |  7 ++++++-
 resources/lang/en/texts.php                          |  2 ++
 resources/views/payments/add_paymentmethod.blade.php | 10 +++++++---
 4 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/app/Http/Controllers/PaymentController.php b/app/Http/Controllers/PaymentController.php
index 0139dcd78758..b339689d77d0 100644
--- a/app/Http/Controllers/PaymentController.php
+++ b/app/Http/Controllers/PaymentController.php
@@ -447,6 +447,11 @@ class PaymentController extends BaseController
 
             // check if we're creating/using a billing token
             if ($accountGateway->gateway_id == GATEWAY_STRIPE) {
+                if ($paymentType == PAYMENT_TYPE_STRIPE_ACH && !Input::get('authorize_ach')) {
+                    Session::flash('error', trans('texts.ach_authorization_required'));
+                    return Redirect::to('payment/'.$invitationKey)->withInput(Request::except('cvv'));
+                }
+
                 if ($useToken) {
                     $details['customerReference'] = $client->getGatewayToken();
                     unset($details['token']);
diff --git a/app/Http/Controllers/PublicClientController.php b/app/Http/Controllers/PublicClientController.php
index 4cf6a346db45..3a5dd61e3215 100644
--- a/app/Http/Controllers/PublicClientController.php
+++ b/app/Http/Controllers/PublicClientController.php
@@ -802,11 +802,16 @@ class PublicClientController extends BaseController
             $details = array('plaidPublicToken' => Input::get('plaidPublicToken'), 'plaidAccountId' => Input::get('plaidAccountId'));
         }
 
+        if ($paymentType == PAYMENT_TYPE_STRIPE_ACH && !Input::get('authorize_ach')) {
+            Session::flash('error', trans('texts.ach_authorization_required'));
+            return Redirect::to('client/paymentmethods/add/' . $typeLink)->withInput(Request::except('cvv'));
+        }
+
         if (!empty($details)) {
             $gateway = $this->paymentService->createGateway($accountGateway);
             $sourceId = $this->paymentService->createToken($gateway, $details, $accountGateway, $client, $invitation->contact_id);
         } else {
-            return Redirect::to('payment/'.$invitation->invitation_key)->withInput(Request::except('cvv'));
+            return Redirect::to('client/paymentmethods/add/' . $typeLink)->withInput(Request::except('cvv'));
         }
 
         if(empty($sourceId)) {
diff --git a/resources/lang/en/texts.php b/resources/lang/en/texts.php
index df368f9a59ad..8cb584b396c0 100644
--- a/resources/lang/en/texts.php
+++ b/resources/lang/en/texts.php
@@ -1265,6 +1265,8 @@ $LANG = array(
     'plaid_linked_status' => 'Your bank account at :bank',
     'add_payment_method' => 'Add Payment Method',
     'account_holder_type' => 'Account Holder Type',
+    'ach_authorization' => 'I authorize :company to electronically debit my account and, if necessary, electronically credit my account to correct erroneous debits.',
+    'ach_authorization_required' => 'You must consent to ACH transactions.'
 );
 
 return $LANG;
diff --git a/resources/views/payments/add_paymentmethod.blade.php b/resources/views/payments/add_paymentmethod.blade.php
index dedf80e83860..8eb639300c08 100644
--- a/resources/views/payments/add_paymentmethod.blade.php
+++ b/resources/views/payments/add_paymentmethod.blade.php
@@ -245,7 +245,8 @@
                 'account_number' => 'required',
                 'routing_number' => 'required',
                 'account_holder_name' => 'required',
-                'account_holder_type' => 'required'
+                'account_holder_type' => 'required',
+                'authorize_ach' => 'required',
             )) !!}
     @else
         {!! Former::vertical_open($url)
@@ -457,9 +458,12 @@
                                     {!! Former::text('')
                                             ->id('confirm_account_number')
                                             ->label(trans('texts.confirm_account_number')) !!}
+                                    {!! Former::checkbox('authorize_ach')
+                                            ->text(trans('texts.ach_authorization', ['company'=>$account->getDisplayName()]))
+                                            ->label(' ') !!}
                             </div>
                         </div>
-                        <center>
+                        <div class="col-md-8 col-md-offset-4">
                             {!! Button::success(strtoupper(trans('texts.add_account')))
                                             ->submit()
                                             ->withAttributes(['id'=>'add_account_button'])
@@ -470,7 +474,7 @@
                                             ->withAttributes(['style'=>'display:none', 'id'=>'pay_now_button'])
                                             ->large() !!}
                             @endif
-                        </center>
+                        </div>
                     @else
                         <div class="row">
                             <div class="col-md-9">