FIX: Restrict mods from seeing Subscriptions admin features

config/routes.rb

@@ -8,7 +8,7 @@
     post '/create-campaign' => 'admin#create_campaign'
   end
 
-  namespace :admin do
+  namespace :admin, constraints: AdminConstraint.new do
     resources :plans
     resources :subscriptions, only: [:index, :destroy]
     resources :products

spec/requests/admin/coupons_controller_spec.rb

@@ -12,7 +12,7 @@ module DiscourseSubscriptions
       it "does nothing" do
         ::Stripe::PromotionCode.expects(:list).never
         get "/s/admin/coupons.json"
-        expect(response.status).to eq(403)
+        expect(response.status).to eq(404)
       end
     end
 

spec/requests/admin/plans_controller_spec.rb

@@ -18,7 +18,7 @@ module Admin
 
           it "not ok" do
             get "/s/admin/plans.json"
-            expect(response.status).to eq 403
+            expect(response.status).to eq 404
           end
         end
 
@@ -30,7 +30,7 @@ module Admin
 
           it "is not ok" do
             post "/s/admin/plans.json", params: { name: 'Rick Astley', amount: 1, interval: 'week' }
-            expect(response.status).to eq 403
+            expect(response.status).to eq 404
           end
         end
 
@@ -42,7 +42,7 @@ module Admin
 
           it "is not ok" do
             get "/s/admin/plans/plan_12345.json"
-            expect(response.status).to eq 403
+            expect(response.status).to eq 404
           end
         end
 

spec/requests/admin/products_controller_spec.rb

@@ -13,31 +13,31 @@ module Admin
         it "does not list the products" do
           ::Stripe::Product.expects(:list).never
           get "/s/admin/products.json"
-          expect(response.status).to eq(403)
+          expect(response.status).to eq(404)
         end
 
         it "does not create the product" do
           ::Stripe::Product.expects(:create).never
           post "/s/admin/products.json"
-          expect(response.status).to eq(403)
+          expect(response.status).to eq(404)
         end
 
         it "does not show the product" do
           ::Stripe::Product.expects(:retrieve).never
           get "/s/admin/products/prod_qwerty123.json"
-          expect(response.status).to eq(403)
+          expect(response.status).to eq(404)
         end
 
         it "does not update the product" do
           ::Stripe::Product.expects(:update).never
           put "/s/admin/products/prod_qwerty123.json"
-          expect(response.status).to eq(403)
+          expect(response.status).to eq(404)
         end
 
         it "does not delete the product" do
           ::Stripe::Product.expects(:delete).never
           delete "/s/admin/products/u2.json"
-          expect(response.status).to eq(403)
+          expect(response.status).to eq(404)
         end
       end
 

spec/requests/admin/subscriptions_controller_spec.rb

@@ -20,7 +20,7 @@ module DiscourseSubscriptions
       it "does nothing" do
         ::Stripe::Subscription.expects(:list).never
         get "/s/admin/subscriptions.json"
-        expect(response.status).to eq(403)
+        expect(response.status).to eq(404)
       end
 
       it "does not destroy a subscription" do