user upgrades: fix checkout form leaking recipient's email.

The checkout form should be prefilled with the purchaser's email
address, not the recipient's.

app/models/user_upgrade.rb

@@ -166,7 +166,7 @@ class UserUpgrade < ApplicationRecord
         success_url: Routes.user_upgrade_url(self),
         cancel_url: Routes.new_user_upgrade_url(user_id: recipient.id),
         client_reference_id: "user_upgrade_#{id}",
-        customer_email: recipient.email_address&.address,
+        customer_email: purchaser.email_address&.address,
         payment_method_types: ["card"],
         line_items: [{
           price_data: {

test/unit/user_upgrade_test.rb

@@ -45,5 +45,19 @@ class UserUpgradeTest < ActiveSupport::TestCase
         end
       end
     end
+
+    context "the #create_checkout! method" do
+      context "for a gifted upgrade" do
+        context "to Gold" do
+          should "prefill the Stripe checkout page with the purchaser's email address" do
+            @user = create(:user, email_address: build(:email_address))
+            @user_upgrade = create(:gift_gold_upgrade, purchaser: @user)
+            @checkout = @user_upgrade.create_checkout!
+
+            assert_equal(@user.email_address.address, @checkout.customer_email)
+          end
+        end
+      end
+    end
   end
 end