goca-spree-backend 3.1.14.rails.5.0

data/app/controllers/spree/admin/resource_controller.rb

@@ -0,0 +1,260 @@
+class Spree::Admin::ResourceController < Spree::Admin::BaseController
+  include Spree::Backend::Callbacks
+
+  helper_method :new_object_url, :edit_object_url, :object_url, :collection_url
+  before_action :load_resource, except: :update_positions
+  rescue_from ActiveRecord::RecordNotFound, :with => :resource_not_found
+
+  respond_to :html
+
+  def new
+    invoke_callbacks(:new_action, :before)
+    respond_with(@object) do |format|
+      format.html { render :layout => !request.xhr? }
+      if request.xhr?
+        format.js   { render :layout => false }
+      end
+    end
+  end
+
+  def edit
+    respond_with(@object) do |format|
+      format.html { render :layout => !request.xhr? }
+      if request.xhr?
+        format.js   { render :layout => false }
+      end
+    end
+  end
+
+  def update
+    invoke_callbacks(:update, :before)
+    if @object.update_attributes(permitted_resource_params)
+      invoke_callbacks(:update, :after)
+      respond_with(@object) do |format|
+        format.html do
+          flash[:success] = flash_message_for(@object, :successfully_updated)
+          redirect_to location_after_save
+        end
+        format.js { render layout: false }
+      end
+    else
+      invoke_callbacks(:update, :fails)
+      respond_with(@object) do |format|
+        format.html { render action: :edit }
+        format.js { render layout: false }
+      end
+    end
+  end
+
+  def create
+    invoke_callbacks(:create, :before)
+    @object.attributes = permitted_resource_params
+    if @object.save
+      invoke_callbacks(:create, :after)
+      flash[:success] = flash_message_for(@object, :successfully_created)
+      respond_with(@object) do |format|
+        format.html { redirect_to location_after_save }
+        format.js   { render :layout => false }
+      end
+    else
+      invoke_callbacks(:create, :fails)
+      respond_with(@object) do |format|
+        format.html { render action: :new }
+        format.js { render layout: false }
+      end
+    end
+  end
+
+  def update_positions
+    ActiveRecord::Base.transaction do
+      params[:positions].each do |id, index|
+        model_class.find(id).set_list_position(index)
+      end
+    end
+
+    respond_to do |format|
+      format.js { render text: 'Ok' }
+    end
+  end
+
+  def destroy
+    invoke_callbacks(:destroy, :before)
+    if @object.destroy
+      invoke_callbacks(:destroy, :after)
+      flash[:success] = flash_message_for(@object, :successfully_removed)
+    else
+      invoke_callbacks(:destroy, :fails)
+      flash[:error] = @object.errors.full_messages.join(', ')
+    end
+
+    respond_with(@object) do |format|
+      format.html { redirect_to location_after_destroy }
+      format.js   { render_js_for_destroy }
+    end
+  end
+
+  protected
+
+  class << self
+    attr_accessor :parent_data
+
+    def belongs_to(model_name, options = {})
+      @parent_data ||= {}
+      @parent_data[:model_name] = model_name
+      @parent_data[:model_class] = model_name.to_s.classify.constantize
+      @parent_data[:find_by] = options[:find_by] || :id
+    end
+  end
+
+  def model_class
+    @model_class ||= resource.model_class
+  end
+
+  def resource_not_found
+    flash[:error] = flash_message_for(model_class.new, :not_found)
+    redirect_to collection_url
+  end
+
+  def resource
+    return @resource if @resource
+    if parent_data
+      parent_model_name = parent_data[:model_name]
+    end
+    @resource = Spree::Admin::Resource.new controller_path, controller_name, parent_model_name, object_name
+  end
+
+  def load_resource
+    if member_action?
+      @object ||= load_resource_instance
+
+      # call authorize! a third time (called twice already in Admin::BaseController)
+      # this time we pass the actual instance so fine-grained abilities can control
+      # access to individual records, not just entire models.
+      authorize! action, @object
+
+      instance_variable_set("@#{resource.object_name}", @object)
+    else
+      @collection ||= collection
+
+      # note: we don't call authorize here as the collection method should use
+      # CanCan's accessible_by method to restrict the actual records returned
+
+      instance_variable_set("@#{controller_name}", @collection)
+    end
+  end
+
+  def load_resource_instance
+    if new_actions.include?(action)
+      build_resource
+    elsif params[:id]
+      find_resource
+    end
+  end
+
+  def parent_data
+    self.class.parent_data
+  end
+
+  def parent
+    if parent_data.present?
+      @parent ||= parent_data[:model_class].
+          send("find_by_#{parent_data[:find_by]}", params["#{resource.model_name}_id"])
+      instance_variable_set("@#{resource.model_name}", @parent)
+    else
+      nil
+    end
+  end
+
+  def find_resource
+    if parent_data.present?
+      parent.send(controller_name).find(params[:id])
+    else
+      model_class.find(params[:id])
+    end
+  end
+
+  def build_resource
+    if parent_data.present?
+      parent.send(controller_name).build
+    else
+      model_class.new
+    end
+  end
+
+  def collection
+    return parent.send(controller_name) if parent_data.present?
+    if model_class.respond_to?(:accessible_by) &&
+        !current_ability.has_block?(params[:action], model_class)
+      model_class.accessible_by(current_ability, action)
+    else
+      model_class.where(nil)
+    end
+  end
+
+  def location_after_destroy
+    collection_url
+  end
+
+  def location_after_save
+    collection_url
+  end
+
+  # URL helpers
+
+  def new_object_url(options = {})
+    if parent_data.present?
+      spree.new_polymorphic_url([:admin, parent, model_class], options)
+    else
+      spree.new_polymorphic_url([:admin, model_class], options)
+    end
+  end
+
+  def edit_object_url(object, options = {})
+    if parent_data.present?
+      spree.send "edit_admin_#{resource.model_name}_#{resource.object_name}_url",
+                 parent, object, options
+    else
+      spree.send "edit_admin_#{resource.object_name}_url", object, options
+    end
+  end
+
+  def object_url(object = nil, options = {})
+    target = object ? object : @object
+    if parent_data.present?
+      spree.send "admin_#{resource.model_name}_#{resource.object_name}_url", parent, target, options
+    else
+      spree.send "admin_#{resource.object_name}_url", target, options
+    end
+  end
+
+  def collection_url(options = {})
+    if parent_data.present?
+      spree.polymorphic_url([:admin, parent, model_class], options)
+    else
+      spree.polymorphic_url([:admin, model_class], options)
+    end
+  end
+
+  # This method should be overridden when object_name does not match the controller name
+  def object_name
+  end
+
+  # Allow all attributes to be updatable.
+  #
+  # Other controllers can, should, override it to set custom logic
+  def permitted_resource_params
+    params[resource.object_name].present? ? params.require(resource.object_name).permit! : ActionController::Parameters.new
+  end
+
+  def collection_actions
+    [:index]
+  end
+
+  def member_action?
+    !collection_actions.include? action
+  end
+
+  def new_actions
+    [:new, :create]
+  end
+end

data/app/controllers/spree/admin/return_authorization_reasons_controller.rb

@@ -0,0 +1,6 @@
+module Spree
+  module Admin
+    class ReturnAuthorizationReasonsController < ResourceController
+    end
+  end
+end

data/app/controllers/spree/admin/return_authorizations_controller.rb

@@ -0,0 +1,51 @@
+module Spree
+  module Admin
+    class ReturnAuthorizationsController < ResourceController
+      belongs_to 'spree/order', :find_by => :number
+
+      before_action :load_form_data, only: [:new, :edit]
+      create.fails  :load_form_data
+      update.fails  :load_form_data
+
+      def fire
+        @return_authorization.send("#{params[:e]}!")
+        flash[:success] = Spree.t(:return_authorization_updated)
+        redirect_to :back
+      end
+
+      private
+
+      def load_form_data
+        load_return_items
+        load_reimbursement_types
+        load_return_authorization_reasons
+      end
+
+      # To satisfy how nested attributes works we want to create placeholder ReturnItems for
+      # any InventoryUnits that have not already been added to the ReturnAuthorization.
+      def load_return_items
+        all_inventory_units = @return_authorization.order.inventory_units
+        associated_inventory_units = @return_authorization.return_items.map(&:inventory_unit)
+        unassociated_inventory_units = all_inventory_units - associated_inventory_units
+
+        new_return_items = unassociated_inventory_units.map do |new_unit|
+          Spree::ReturnItem.new(inventory_unit: new_unit).tap(&:set_default_pre_tax_amount)
+        end
+
+        @form_return_items = (@return_authorization.return_items + new_return_items).sort_by(&:inventory_unit_id)
+      end
+
+      def load_reimbursement_types
+        @reimbursement_types = Spree::ReimbursementType.accessible_by(current_ability, :read).active
+      end
+
+      def load_return_authorization_reasons
+        @reasons = Spree::ReturnAuthorizationReason.active
+        # Only allow an inactive reason if it's already associated to the RMA
+        if @return_authorization.reason && !@return_authorization.reason.active?
+          @reasons << @return_authorization.reason
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/return_index_controller.rb

@@ -0,0 +1,28 @@
+module Spree
+  module Admin
+    class ReturnIndexController < BaseController
+      def return_authorizations
+        collection(Spree::ReturnAuthorization)
+        respond_with(@collection)
+      end
+
+      def customer_returns
+        collection(Spree::CustomerReturn)
+        respond_with(@collection)
+      end
+
+      private
+
+      def collection(resource)
+        return @collection if @collection.present?
+        params[:q] ||= {}
+
+        @collection = resource.all
+        # @search needs to be defined as this is passed to search_form_for
+        @search = @collection.ransack(params[:q])
+        per_page = params[:per_page] || Spree::Config[:admin_products_per_page]
+        @collection = @search.result.order(created_at: :desc).page(params[:page]).per(per_page)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/return_items_controller.rb

@@ -0,0 +1,9 @@
+module Spree
+  module Admin
+    class ReturnItemsController < ResourceController
+      def location_after_save
+        url_for([:edit, :admin, @return_item.customer_return.order, @return_item.customer_return])
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/roles_controller.rb

@@ -0,0 +1,6 @@
+module Spree
+  module Admin
+    class RolesController < ResourceController
+    end
+  end
+end

data/app/controllers/spree/admin/root_controller.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Admin
+    class RootController < Spree::Admin::BaseController
+
+      skip_before_action :authorize_admin
+
+      def index
+        redirect_to admin_root_redirect_path
+      end
+
+      protected
+
+      def admin_root_redirect_path
+        spree.admin_orders_path
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/search_controller.rb

@@ -0,0 +1,41 @@
+module Spree
+  module Admin
+    class SearchController < Spree::Admin::BaseController
+      respond_to :json
+      layout false
+
+      # http://spreecommerce.com/blog/2010/11/02/json-hijacking-vulnerability/
+      before_action :check_json_authenticity, only: :index
+
+      # TODO: Clean this up by moving searching out to user_class_extensions
+      # And then JSON building with something like Active Model Serializers
+      def users
+        if params[:ids]
+          @users = Spree.user_class.where(id: params[:ids].split(',').flatten)
+        else
+          @users = Spree.user_class.ransack({
+            m: 'or',
+            email_start: params[:q],
+            ship_address_firstname_start: params[:q],
+            ship_address_lastname_start: params[:q],
+            bill_address_firstname_start: params[:q],
+            bill_address_lastname_start: params[:q]
+          }).result.limit(10)
+        end
+      end
+
+      def products
+        if params[:ids]
+          @products = Product.where(id: params[:ids].split(",").flatten)
+        else
+          @products = Product.ransack(params[:q]).result
+        end
+
+        @products = @products.distinct.page(params[:page]).per(params[:per_page])
+        expires_in 15.minutes, public: true
+        headers['Surrogate-Control'] = "max-age=#{15.minutes}"
+      end
+    end
+  end
+end
+

data/app/controllers/spree/admin/shipping_categories_controller.rb

@@ -0,0 +1,6 @@
+module Spree
+  module Admin
+    class ShippingCategoriesController < ResourceController
+    end
+  end
+end

data/app/controllers/spree/admin/shipping_methods_controller.rb

@@ -0,0 +1,46 @@
+module Spree
+  module Admin
+    class ShippingMethodsController < ResourceController
+      before_action :load_data, except: :index
+      before_action :set_shipping_category, only: [:create, :update]
+      before_action :set_zones, only: [:create, :update]
+
+      def destroy
+        @object.destroy
+
+        flash[:success] = flash_message_for(@object, :successfully_removed)
+
+        respond_with(@object) do |format|
+          format.html { redirect_to collection_url }
+          format.js  { render_js_for_destroy }
+        end
+      end
+
+      private
+
+      def set_shipping_category
+        return true if params["shipping_method"][:shipping_categories] == ""
+        @shipping_method.shipping_categories = Spree::ShippingCategory.where(:id => params["shipping_method"][:shipping_categories])
+        @shipping_method.save
+        params[:shipping_method].delete(:shipping_categories)
+      end
+
+      def set_zones
+        return true if params["shipping_method"][:zones] == ""
+        @shipping_method.zones = Spree::Zone.where(:id => params["shipping_method"][:zones])
+        @shipping_method.save
+        params[:shipping_method].delete(:zones)
+      end
+
+      def location_after_save
+        edit_admin_shipping_method_path(@shipping_method)
+      end
+
+      def load_data
+        @available_zones = Zone.order(:name)
+        @tax_categories = Spree::TaxCategory.order(:name)
+        @calculators = ShippingMethod.calculators.sort_by(&:name)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/state_changes_controller.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Admin
+    class StateChangesController < Spree::Admin::BaseController
+      before_action :load_order, only: [:index]
+
+      def index
+        @state_changes = @order.state_changes.includes(:user)
+      end
+
+      private
+
+      def load_order
+        @order = Order.find_by_number!(params[:order_id])
+        authorize! action, @order
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/states_controller.rb

@@ -0,0 +1,29 @@
+module Spree
+  module Admin
+    class StatesController < ResourceController
+      belongs_to 'spree/country'
+      before_action :load_data
+
+      def index
+        respond_with(@collection) do |format|
+          format.html
+          format.js { render :partial => 'state_list' }
+        end
+      end
+
+      protected
+
+        def location_after_save
+          admin_country_states_url(@country)
+        end
+
+        def collection
+          super.order(:name)
+        end
+
+        def load_data
+          @countries = Country.order(:name)
+        end
+    end
+  end
+end

data/app/controllers/spree/admin/stock_items_controller.rb

@@ -0,0 +1,51 @@
+module Spree
+  module Admin
+    class StockItemsController < Spree::Admin::BaseController
+      before_action :determine_backorderable, only: :update
+
+      def update
+        stock_item.save
+        respond_to do |format|
+          format.js { head :ok }
+        end
+      end
+
+      def create
+        variant = Variant.find(params[:variant_id])
+        stock_location = StockLocation.find(params[:stock_location_id])
+        stock_movement = stock_location.stock_movements.build(stock_movement_params)
+        stock_movement.stock_item = stock_location.set_up_stock_item(variant)
+
+        if stock_movement.save
+          flash[:success] = flash_message_for(stock_movement, :successfully_created)
+        else
+          flash[:error] = Spree.t(:could_not_create_stock_movement)
+        end
+
+        redirect_to :back
+      end
+
+      def destroy
+        stock_item.destroy
+
+        respond_with(@stock_item) do |format|
+          format.html { redirect_to :back }
+          format.js
+        end
+      end
+
+      private
+        def stock_movement_params
+          params.require(:stock_movement).permit(permitted_stock_movement_attributes)
+        end
+
+        def stock_item
+          @stock_item ||= StockItem.find(params[:id])
+        end
+
+        def determine_backorderable
+          stock_item.backorderable = params[:stock_item].present? && params[:stock_item][:backorderable].present?
+        end
+    end
+  end
+end

data/app/controllers/spree/admin/stock_locations_controller.rb

@@ -0,0 +1,16 @@
+module Spree
+  module Admin
+    class StockLocationsController < ResourceController
+      before_action :set_country, only: :new
+
+      private
+
+      def set_country
+        @stock_location.country = Spree::Country.default
+      rescue ActiveRecord::RecordNotFound
+        flash[:error] = Spree.t(:stock_locations_need_a_default_country)
+        redirect_to admin_stock_locations_path
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/stock_movements_controller.rb

@@ -0,0 +1,39 @@
+module Spree
+  module Admin
+    class StockMovementsController < Spree::Admin::BaseController
+      respond_to :html
+      helper_method :stock_location
+
+      def index
+        @stock_movements = stock_location.stock_movements.recent.
+          includes(:stock_item => { :variant => :product }).
+          page(params[:page])
+      end
+
+      def new
+        @stock_movement = stock_location.stock_movements.build
+      end
+
+      def create
+        @stock_movement = stock_location.stock_movements.build(stock_movement_params)
+        @stock_movement.save
+        flash[:success] = flash_message_for(@stock_movement, :successfully_created)
+        redirect_to admin_stock_location_stock_movements_path(stock_location)
+      end
+
+      def edit
+        @stock_movement = StockMovement.find(params[:id])
+      end
+
+      private
+
+      def stock_location
+        @stock_location ||= StockLocation.find(params[:stock_location_id])
+      end
+
+      def stock_movement_params
+        params.require(:stock_movement).permit(:quantity, :stock_item_id, :action)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/stock_transfers_controller.rb

@@ -0,0 +1,51 @@
+module Spree
+  module Admin
+    class StockTransfersController < Admin::BaseController
+      before_action :load_stock_locations, only: :index
+
+      def index
+        @q = StockTransfer.ransack(params[:q])
+
+        @stock_transfers = @q.result.
+                             includes(stock_movements: { stock_item: :stock_location }).
+                             order(created_at: :desc).
+                             page(params[:page])
+      end
+
+      def show
+        @stock_transfer = StockTransfer.friendly.find(params[:id])
+      end
+
+      def new; end
+
+      def create
+        variants = Hash.new(0)
+        params[:variant].each_with_index do |variant_id, i|
+          variants[variant_id] += params[:quantity][i].to_i
+        end
+
+        stock_transfer = StockTransfer.create(reference: params[:reference])
+        stock_transfer.transfer(source_location,
+                                destination_location,
+                                variants)
+
+        flash[:success] = Spree.t(:stock_successfully_transferred)
+        redirect_to admin_stock_transfer_path(stock_transfer)
+      end
+
+      private
+      def load_stock_locations
+        @stock_locations = Spree::StockLocation.active.order_default
+      end
+
+      def source_location
+        @source_location ||= params.has_key?(:transfer_receive_stock) ? nil :
+                               StockLocation.find(params[:transfer_source_location_id])
+      end
+
+      def destination_location
+        @destination_location ||= StockLocation.find(params[:transfer_destination_location_id])
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/store_credit_categories_controller.rb

@@ -0,0 +1,6 @@
+module Spree
+  module Admin
+    class StoreCreditCategoriesController < ResourceController
+    end
+  end
+end