DEV: Refund flag is truthy-parsed, causing unintended refunds (#38223)

The `refund` parameter in the admin subscription destroy action was
truthy-parsed, causing unintended refunds when `refund=false` or
`refund=""` was sent as a string.

extra protection for refunds issued via api

plugins/discourse-subscriptions/app/controllers/discourse_subscriptions/admin/subscriptions_controller.rb

@@ -52,7 +52,7 @@ module DiscourseSubscriptions
       def destroy
         params.require(:id)
         begin
-          refund_subscription(params[:id]) if params[:refund]
+          refund_subscription(params[:id]) if ActiveModel::Type::Boolean.new.cast(params[:refund])
           subscription = ::Stripe::Subscription.cancel(params[:id])
 
           customer =

plugins/discourse-subscriptions/spec/requests/admin/subscriptions_controller_spec.rb

@@ -123,6 +123,17 @@ RSpec.describe DiscourseSubscriptions::Admin::SubscriptionsController do
         }
       end
 
+      it "does not refund when refund param is the string 'false'" do
+        ::Stripe::Subscription
+          .expects(:cancel)
+          .with("sub_12345")
+          .returns(plan: { product: "pr_34578" }, customer: "c_123")
+        ::Stripe::Subscription.expects(:retrieve).with("sub_12345").never
+        ::Stripe::Refund.expects(:create).never
+
+        delete "/s/admin/subscriptions/sub_12345.json", params: { refund: "false" }
+      end
+
       it "refunds if params[:refund] present" do
         ::Stripe::Subscription
           .expects(:cancel)