Fix EPP response code

Fixes #686

app/controllers/epp/domains_controller.rb

@@ -182,7 +182,7 @@ module Epp
     end
 
     def transfer
-      authorize! :transfer, @domain, @password
+      authorize! :transfer, @domain
       action = params[:parsed_frame].css('transfer').first[:op]
 
       if @domain.non_transferable?
@@ -194,6 +194,18 @@ module Epp
         return
       end
 
+      provided_transfer_code = params[:parsed_frame].css('authInfo pw').text
+      wrong_transfer_code = provided_transfer_code != @domain.transfer_code
+
+      if wrong_transfer_code
+        epp_errors << {
+          code: '2202',
+          msg: 'Invalid authorization information',
+        }
+        handle_errors
+        return
+      end
+
       @domain_transfer = @domain.transfer(params[:parsed_frame], action, current_user)
 
       if @domain.errors[:epp_errors].any?

test/integration/epp/domain/transfer/query_test.rb

@@ -30,8 +30,7 @@ class EppDomainTransferQueryTest < EppTestCase
 
     post '/epp/command/transfer', { frame: request_xml }, { 'HTTP_COOKIE' => 'session=api_bestnames' }
 
-    # https://github.com/internetee/registry/issues/686
+    assert_epp_response :invalid_authorization_information
-    assert_epp_response :authorization_error
   end
 
   def test_no_domain_transfer

test/integration/epp/domain/transfer/request_test.rb

@@ -115,10 +115,9 @@ class EppDomainTransferRequestTest < EppTestCase
 
     post '/epp/command/transfer', { frame: request_xml }, { 'HTTP_COOKIE' => 'session=api_goodnames' }
     @domain.reload
-    refute_equal @new_registrar, @domain.registrar
 
-    # https://github.com/internetee/registry/issues/686
+    assert_epp_response :invalid_authorization_information
-    assert_epp_response :authorization_error
+    refute_equal @new_registrar, @domain.registrar
   end
 
   private