solidus_backend 2.10.2 → 2.11.3

data/app/assets/stylesheets/spree/backend/shared/_forms.scss

@@ -3,6 +3,7 @@ input[type="password"],
 input[type="email"],
 input[type="date"],
 input[type="datetime"],
+input[type="datetime-local"],
 input[type="time"],
 input[type="url"],
 input[type="number"],

data/app/controllers/spree/admin/base_controller.rb

@@ -62,6 +62,12 @@ module Spree
       def order_mutex_redirect_path
         edit_admin_order_path(@order)
       end
+
+      def resource_not_found(flash_class:, redirect_url:)
+        flash[:error] = flash_message_for(flash_class.new, :not_found)
+        redirect_to redirect_url
+        nil
+      end
     end
   end
 end

data/app/controllers/spree/admin/cancellations_controller.rb

@@ -36,6 +36,8 @@ module Spree
       def load_order
         @order = Spree::Order.find_by!(number: params[:order_id])
         authorize! action, @order
+      rescue ActiveRecord::RecordNotFound
+        resource_not_found(flash_class: Spree::Order, redirect_url: admin_orders_path)
       end
 
       def model_class

data/app/controllers/spree/admin/customer_returns_controller.rb

@@ -37,13 +37,15 @@ module Spree
       end
 
       def find_resource
-        Spree::CustomerReturn.accessible_by(current_ability, :read).find(params[:id])
+        Spree::CustomerReturn.accessible_by(current_ability, :show).find(params[:id])
       end
 
       def collection
         parent # trigger loading the order
+        return unless @order
+
         @collection ||= Spree::ReturnItem
-          .accessible_by(current_ability, :read)
+          .accessible_by(current_ability)
           .where(inventory_unit_id: @order.inventory_units.pluck(:id))
           .map(&:customer_return).uniq.compact
         @customer_returns = @collection
@@ -70,8 +72,6 @@ module Spree
           return_item = item_params[:id] ? Spree::ReturnItem.find(item_params[:id]) : Spree::ReturnItem.new
           return_item.assign_attributes(item_params)
 
-          return_item.skip_customer_return_processing = true
-
           if item_params[:reception_status_event].blank?
             return redirect_to(new_object_url, flash: { error: 'Reception status choice required' })
           end

data/app/controllers/spree/admin/images_controller.rb

@@ -4,7 +4,6 @@ module Spree
   module Admin
     class ImagesController < ResourceController
       before_action :load_data
-
       create.before :set_viewable
       update.before :set_viewable
 
@@ -24,6 +23,8 @@ module Spree
           [variant.sku_and_options_text, variant.id]
         end
         @variants.insert(0, [t('spree.all'), @product.master.id])
+      rescue ActiveRecord::RecordNotFound
+        resource_not_found(flash_class: Spree::Product, redirect_url: admin_products_path)
       end
 
       def set_viewable

data/app/controllers/spree/admin/orders/customer_details_controller.rb

@@ -61,6 +61,8 @@ module Spree
 
         def load_order
           @order = Spree::Order.includes(:adjustments).find_by!(number: params[:order_id])
+        rescue ActiveRecord::RecordNotFound
+          resource_not_found(flash_class: Spree::Order, redirect_url: admin_orders_path)
         end
 
         def model_class

data/app/controllers/spree/admin/orders_controller.rb

@@ -10,7 +10,6 @@ module Spree
       around_action :lock_order, only: [:update, :advance, :complete, :confirm, :cancel, :resume, :approve, :resend]
 
       rescue_from Spree::Order::InsufficientStock, with: :insufficient_stock_error
-
       respond_to :html
 
       def index
@@ -61,7 +60,11 @@ module Spree
 
       def new
         user = Spree.user_class.find_by(id: params[:user_id]) if params[:user_id]
-        @order = Spree::Core::Importer::Order.import(user, order_params)
+        order_importer_params = order_params
+        order_importer_params[:bill_address] = user&.bill_address
+        order_importer_params[:ship_address] = user&.ship_address
+
+        @order = Spree::Core::Importer::Order.import(user, order_importer_params)
         redirect_to cart_admin_order_url(@order)
       end
 
@@ -164,6 +167,8 @@ module Spree
       def load_order
         @order = Spree::Order.includes(:adjustments).find_by!(number: params[:id])
         authorize! action, @order
+      rescue ActiveRecord::RecordNotFound
+        resource_not_found(flash_class: Spree::Order, redirect_url: admin_orders_path)
       end
 
       # Used for extensions which need to provide their own custom event links on the order details view.

data/app/controllers/spree/admin/payments_controller.rb

@@ -80,7 +80,7 @@ module Spree
 
       def load_data
         @amount = params[:amount] || load_order.total
-        @payment_methods = Spree::PaymentMethod.active.available_to_admin
+        @payment_methods = Spree::PaymentMethod.active.available_to_admin.ordered_by_position
         if @payment && @payment.payment_method
           @payment_method = @payment.payment_method
         else
@@ -92,6 +92,8 @@ module Spree
         @order = Spree::Order.find_by!(number: params[:order_id])
         authorize! action, @order
         @order
+      rescue ActiveRecord::RecordNotFound
+        resource_not_found(flash_class: Spree::Order, redirect_url: admin_orders_path)
       end
 
       def load_payment

data/app/controllers/spree/admin/product_properties_controller.rb

@@ -15,7 +15,7 @@ module Spree
       end
 
       def setup_property
-        @product.product_properties.build
+        @product.product_properties.build if @product.product_properties.empty?
       end
 
       def setup_variant_property_rules

data/app/controllers/spree/admin/products_controller.rb

@@ -9,6 +9,7 @@ module Spree
       update.before :update_before
       helper_method :clone_object_url
       before_action :split_params, only: [:create, :update]
+      before_action :normalize_variant_property_rules, only: [:update]
 
       def show
         redirect_to action: :edit
@@ -19,29 +20,6 @@ module Spree
         respond_with(@collection)
       end
 
-      def update
-        if updating_variant_property_rules?
-          params[:product][:variant_property_rules_attributes].each do |_index, param_attrs|
-            param_attrs[:option_value_ids] = param_attrs[:option_value_ids].split(',')
-          end
-        end
-        invoke_callbacks(:update, :before)
-        if @object.update(permitted_resource_params)
-          invoke_callbacks(:update, :after)
-          flash[:success] = flash_message_for(@object, :successfully_updated)
-          respond_with(@object) do |format|
-            format.html { redirect_to location_after_save }
-            format.js   { render layout: false }
-          end
-        else
-          # Stops people submitting blank slugs, causing errors when they try to
-          # update the product again
-          @product.slug = @product.slug_was if @product.slug.blank?
-          invoke_callbacks(:update, :fails)
-          respond_with(@object)
-        end
-      end
-
       def destroy
         @product = Spree::Product.friendly.find(params[:id])
         @product.discard
@@ -78,7 +56,7 @@ module Spree
       end
 
       def find_resource
-        Spree::Product.with_deleted.friendly.find(params[:id])
+        Spree::Product.with_discarded.friendly.find(params[:id])
       end
 
       def location_after_save
@@ -96,6 +74,7 @@ module Spree
 
       def load_data
         @tax_categories = Spree::TaxCategory.order(:name)
+        @default_tax_category = @tax_categories.detect(&:is_default)
         @shipping_categories = Spree::ShippingCategory.order(:name)
       end
 
@@ -138,6 +117,21 @@ module Spree
       def updating_variant_property_rules?
         params[:product][:variant_property_rules_attributes].present?
       end
+
+      def render_after_update_error
+        # Stops people submitting blank slugs, causing errors when they try to
+        # update the product again
+        @product.slug = @product.slug_was if @product.slug.blank?
+        render action: 'edit'
+      end
+
+      def normalize_variant_property_rules
+        return unless updating_variant_property_rules?
+
+        params[:product][:variant_property_rules_attributes].each do |_index, param_attrs|
+          param_attrs[:option_value_ids] = param_attrs[:option_value_ids].split(',')
+        end
+      end
     end
   end
 end

data/app/controllers/spree/admin/promotion_codes_controller.rb

@@ -6,7 +6,7 @@ module Spree
   module Admin
     class PromotionCodesController < Spree::Admin::ResourceController
       def index
-        @promotion = Spree::Promotion.accessible_by(current_ability, :read).find(params[:promotion_id])
+        @promotion = Spree::Promotion.accessible_by(current_ability, :show).find(params[:promotion_id])
         @promotion_codes = @promotion.promotion_codes.order(:value)
 
         respond_to do |format|
@@ -22,12 +22,17 @@ module Spree
       end
 
       def new
-        @promotion = Spree::Promotion.accessible_by(current_ability, :read).find(params[:promotion_id])
-        @promotion_code = @promotion.promotion_codes.build
+        @promotion = Spree::Promotion.accessible_by(current_ability, :show).find(params[:promotion_id])
+        if @promotion.apply_automatically
+          flash[:error] = t('activerecord.errors.models.spree/promotion_code.attributes.base.disallowed_with_apply_automatically')
+          redirect_to admin_promotion_promotion_codes_url(@promotion)
+        else
+          @promotion_code = @promotion.promotion_codes.build
+        end
       end
 
       def create
-        @promotion = Spree::Promotion.accessible_by(current_ability, :read).find(params[:promotion_id])
+        @promotion = Spree::Promotion.accessible_by(current_ability, :show).find(params[:promotion_id])
         @promotion_code = @promotion.promotion_codes.build(value: params[:promotion_code][:value])
 
         if @promotion_code.save

data/app/controllers/spree/admin/refunds_controller.rb

@@ -10,6 +10,22 @@ module Spree
 
       rescue_from Spree::Core::GatewayError, with: :spree_core_gateway_error
 
+      def create
+        @refund.attributes = refund_params
+
+        if @refund.valid? && @refund.perform!
+          flash[:success] = flash_message_for(@refund, :successfully_created)
+          respond_with(@refund) do |format|
+            format.html { redirect_to location_after_save }
+          end
+        else
+          flash.now[:error] = @refund.errors.full_messages.join(", ")
+          respond_with(@refund) do |format|
+            format.html { render action: 'new' }
+          end
+        end
+      end
+
       private
 
       def location_after_save
@@ -25,6 +41,10 @@ module Spree
         @refund_reasons ||= Spree::RefundReason.active.all
       end
 
+      def refund_params
+        params.require(:refund).permit!
+      end
+
       def build_resource
         super.tap do |refund|
           refund.amount = refund.payment.credit_allowed

data/app/controllers/spree/admin/resource_controller.rb

@@ -5,7 +5,10 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
 
   helper_method :new_object_url, :edit_object_url, :object_url, :collection_url
   before_action :load_resource, except: :update_positions
-  rescue_from ActiveRecord::RecordNotFound, with: :resource_not_found
+  rescue_from ActiveRecord::RecordNotFound do |exception|
+    resource_not_found(flash_class: exception.model.constantize)
+  end
+  rescue_from ActiveRecord::RecordInvalid, with: :resource_invalid
 
   respond_to :html
 
@@ -76,7 +79,7 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
   def update_positions
     ActiveRecord::Base.transaction do
       params[:positions].each do |id, index|
-        model_class.find(id).set_list_position(index)
+        model_class.find_by(id: id)&.set_list_position(index)
       end
     end
 
@@ -133,9 +136,8 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
     end
   end
 
-  def resource_not_found
-    flash[:error] = flash_message_for(model_class.new, :not_found)
-    redirect_to collection_url
+  def resource_not_found(flash_class: model_class, redirect_url: collection_url)
+    super
   end
 
   def model_class
@@ -192,12 +194,14 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
     if parent?
       @parent ||= self.class.parent_data[:model_class]
                     .includes(self.class.parent_data[:includes])
-                    .find_by(self.class.parent_data[:find_by] => params["#{parent_model_name}_id"])
+                    .find_by!(self.class.parent_data[:find_by] => params["#{parent_model_name}_id"])
       instance_variable_set("@#{parent_model_name}", @parent)
     else
       Spree::Deprecation.warn "Calling #parent is deprecated on a ResourceController which has not defined a belongs_to"
       nil
     end
+  rescue ActiveRecord::RecordNotFound => e
+    resource_not_found(flash_class: e.model.constantize, redirect_url: spree.polymorphic_url([:admin, parent_model_name.pluralize]))
   end
 
   def parent?
@@ -221,7 +225,8 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
   end
 
   def collection
-    return parent.send(controller_name) if parent?
+    return parent.send(controller_name) if parent? && parent
+
     if model_class.respond_to?(:accessible_by) && !current_ability.has_block?(params[:action], model_class)
       model_class.accessible_by(current_ability, action)
     else
@@ -299,4 +304,19 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
   def render_after_update_error
     render action: 'edit'
   end
+
+  def resource_invalid(exception)
+    invoke_callbacks(action, :fails)
+    respond_with(@object) do |format|
+      format.html do
+        flash.now[:error] = exception.message
+        if @object.new_record?
+          render_after_create_error
+        else
+          render_after_update_error
+        end
+      end
+      format.js { render layout: false }
+    end
+  end
 end

data/app/controllers/spree/admin/return_authorizations_controller.rb

@@ -47,7 +47,7 @@ module Spree
       end
 
       def load_reimbursement_types
-        @reimbursement_types = Spree::ReimbursementType.accessible_by(current_ability, :read).active
+        @reimbursement_types = Spree::ReimbursementType.accessible_by(current_ability).active
       end
 
       def load_return_reasons

data/app/controllers/spree/admin/root_controller.rb

@@ -12,7 +12,7 @@ module Spree
       private
 
       def admin_root_redirect_path
-        if can?(:display, Spree::Order) && can?(:admin, Spree::Order)
+        if can?(:show, Spree::Order) && can?(:admin, Spree::Order)
           spree.admin_orders_path
         elsif can?(:admin, :dashboards) && can?(:home, :dashboards)
           spree.home_admin_dashboards_path

data/app/controllers/spree/admin/search_controller.rb

@@ -16,8 +16,7 @@ module Spree
           @users = Spree.user_class.ransack({
             m: 'or',
             email_start: params[:q],
-            addresses_firstname_start: params[:q],
-            addresses_lastname_start: params[:q]
+            firstname_or_lastname_start: params[:q]
           }).result.limit(10)
         end
       end

data/app/controllers/spree/admin/stock_items_controller.rb

@@ -15,8 +15,8 @@ module Spree
       private
 
       def build_resource
-        variant = Spree::Variant.accessible_by(current_ability, :read).find(params[:variant_id])
-        stock_location = Spree::StockLocation.accessible_by(current_ability, :read).find(params[:stock_location_id])
+        variant = Spree::Variant.accessible_by(current_ability, :show).find(params[:variant_id])
+        stock_location = Spree::StockLocation.accessible_by(current_ability, :show).find(params[:stock_location_id])
         stock_location.stock_movements.build(stock_movement_params).tap do |stock_movement|
           stock_movement.originator = try_spree_current_user
           stock_movement.stock_item = stock_location.set_up_stock_item(variant)
@@ -36,11 +36,11 @@ module Spree
       end
 
       def load_product
-        @product = Spree::Product.accessible_by(current_ability, :read).friendly.find(params[:product_slug]) if params[:product_slug]
+        @product = Spree::Product.accessible_by(current_ability, :show).friendly.find(params[:product_slug]) if params[:product_slug]
       end
 
       def load_stock_management_data
-        @stock_locations = Spree::StockLocation.accessible_by(current_ability, :read)
+        @stock_locations = Spree::StockLocation.accessible_by(current_ability)
         @stock_item_stock_locations = params[:stock_location_id].present? ? @stock_locations.where(id: params[:stock_location_id]) : @stock_locations
         @variant_display_attributes = self.class.variant_display_attributes
         @variants = Spree::Config.variant_search_class.new(params[:variant_search_term], scope: variant_scope).results
@@ -50,8 +50,9 @@ module Spree
       end
 
       def variant_scope
-        scope = Spree::Variant.accessible_by(current_ability, :read)
+        scope = Spree::Variant.accessible_by(current_ability)
         scope = scope.where(product: @product) if @product
+        scope = scope.order(:sku)
         scope
       end
 

data/app/controllers/spree/admin/stock_locations_controller.rb

@@ -13,6 +13,10 @@ module Spree
         flash[:error] = t('spree.stock_locations_need_a_default_country')
         redirect_to(admin_stock_locations_path) && return
       end
+
+      def collection
+        super.page(params[:page]).per(Spree::Config[:admin_products_per_page])
+      end
     end
   end
 end

data/app/controllers/spree/admin/stock_movements_controller.rb

@@ -6,6 +6,13 @@ module Spree
       belongs_to 'spree/stock_location'
       before_action :parent
 
+      def index
+        params[:q] ||= {}
+
+        @search = collection.ransack(params[:q])
+        @stock_movements = @search.result.page(params[:page])
+      end
+
       private
 
       def permitted_resource_params