solidus_backend 2.9.6 → 2.11.0

data/app/controllers/spree/admin/adjustments_controller.rb

@@ -40,7 +40,7 @@ module Spree
         [
           Spree::AdjustmentReason.active.to_a,
           @adjustment.adjustment_reason
-        ].flatten.compact.uniq.sort_by { |r| r.name.downcase }
+        ].flatten.compact.uniq.sort_by { |reason| reason.name.downcase }
       end
     end
   end

data/app/controllers/spree/admin/base_controller.rb

@@ -4,7 +4,7 @@ module Spree
   module Admin
     class BaseController < Spree::BaseController
       helper 'spree/admin/navigation'
-      layout '/spree/layouts/admin'
+      layout 'spree/layouts/admin'
 
       before_action :authorize_admin
 
@@ -62,6 +62,12 @@ module Spree
       def order_mutex_redirect_path
         edit_admin_order_path(@order)
       end
+
+      def resource_not_found(flash_class:, redirect_url:)
+        flash[:error] = flash_message_for(flash_class.new, :not_found)
+        redirect_to redirect_url
+        nil
+      end
     end
   end
 end

data/app/controllers/spree/admin/cancellations_controller.rb

@@ -36,6 +36,8 @@ module Spree
       def load_order
         @order = Spree::Order.find_by!(number: params[:order_id])
         authorize! action, @order
+      rescue ActiveRecord::RecordNotFound
+        resource_not_found(flash_class: Spree::Order, redirect_url: admin_orders_path)
       end
 
       def model_class

data/app/controllers/spree/admin/customer_returns_controller.rb

@@ -37,13 +37,15 @@ module Spree
       end
 
       def find_resource
-        Spree::CustomerReturn.accessible_by(current_ability, :read).find(params[:id])
+        Spree::CustomerReturn.accessible_by(current_ability, :show).find(params[:id])
       end
 
       def collection
         parent # trigger loading the order
+        return unless @order
+
         @collection ||= Spree::ReturnItem
-          .accessible_by(current_ability, :read)
+          .accessible_by(current_ability)
           .where(inventory_unit_id: @order.inventory_units.pluck(:id))
           .map(&:customer_return).uniq.compact
         @customer_returns = @collection
@@ -70,8 +72,6 @@ module Spree
           return_item = item_params[:id] ? Spree::ReturnItem.find(item_params[:id]) : Spree::ReturnItem.new
           return_item.assign_attributes(item_params)
 
-          return_item.skip_customer_return_processing = true
-
           if item_params[:reception_status_event].blank?
             return redirect_to(new_object_url, flash: { error: 'Reception status choice required' })
           end

data/app/controllers/spree/admin/images_controller.rb

@@ -4,7 +4,6 @@ module Spree
   module Admin
     class ImagesController < ResourceController
       before_action :load_data
-
       create.before :set_viewable
       update.before :set_viewable
 
@@ -24,6 +23,8 @@ module Spree
           [variant.sku_and_options_text, variant.id]
         end
         @variants.insert(0, [t('spree.all'), @product.master.id])
+      rescue ActiveRecord::RecordNotFound
+        resource_not_found(flash_class: Spree::Product, redirect_url: admin_products_path)
       end
 
       def set_viewable

data/app/controllers/spree/admin/orders/customer_details_controller.rb

@@ -61,6 +61,8 @@ module Spree
 
         def load_order
           @order = Spree::Order.includes(:adjustments).find_by!(number: params[:order_id])
+        rescue ActiveRecord::RecordNotFound
+          resource_not_found(flash_class: Spree::Order, redirect_url: admin_orders_path)
         end
 
         def model_class

data/app/controllers/spree/admin/orders_controller.rb

@@ -10,7 +10,6 @@ module Spree
       around_action :lock_order, only: [:update, :advance, :complete, :confirm, :cancel, :resume, :approve, :resend]
 
       rescue_from Spree::Order::InsufficientStock, with: :insufficient_stock_error
-
       respond_to :html
 
       def index
@@ -61,7 +60,11 @@ module Spree
 
       def new
         user = Spree.user_class.find_by(id: params[:user_id]) if params[:user_id]
-        @order = Spree::Core::Importer::Order.import(user, order_params)
+        order_importer_params = order_params
+        order_importer_params[:bill_address] = user&.bill_address
+        order_importer_params[:ship_address] = user&.ship_address
+
+        @order = Spree::Core::Importer::Order.import(user, order_importer_params)
         redirect_to cart_admin_order_url(@order)
       end
 
@@ -105,8 +108,8 @@ module Spree
         @order.complete!
         flash[:success] = t('spree.order_completed')
         redirect_to edit_admin_order_url(@order)
-      rescue StateMachines::InvalidTransition => e
-        flash[:error] = e.message
+      rescue StateMachines::InvalidTransition => error
+        flash[:error] = error.message
         redirect_to confirm_admin_order_url(@order)
       end
 
@@ -164,6 +167,8 @@ module Spree
       def load_order
         @order = Spree::Order.includes(:adjustments).find_by!(number: params[:id])
         authorize! action, @order
+      rescue ActiveRecord::RecordNotFound
+        resource_not_found(flash_class: Spree::Order, redirect_url: admin_orders_path)
       end
 
       # Used for extensions which need to provide their own custom event links on the order details view.

data/app/controllers/spree/admin/payment_methods_controller.rb

@@ -28,13 +28,13 @@ module Spree
         invoke_callbacks(:update, :before)
 
         attributes = payment_method_params
-        attributes.each do |k, _v|
-          if k.include?("password") && attributes[k].blank?
-            attributes.delete(k)
+        attributes.each do |key, _value|
+          if key.include?("password") && attributes[key].blank?
+            attributes.delete(key)
           end
         end
 
-        if @payment_method.update_attributes(attributes)
+        if @payment_method.update(attributes)
           invoke_callbacks(:update, :after)
           flash[:success] = t('spree.successfully_updated', resource: t('spree.payment_method'))
           redirect_to edit_admin_payment_method_path(@payment_method)

data/app/controllers/spree/admin/payments_controller.rb

@@ -46,8 +46,8 @@ module Spree
             flash[:error] = t('spree.payment_could_not_be_created')
             render :new
           end
-        rescue Spree::Core::GatewayError => e
-          flash[:error] = e.message.to_s
+        rescue Spree::Core::GatewayError => error
+          flash[:error] = error.message.to_s
           redirect_to new_admin_order_payment_path(@order)
         end
       end
@@ -80,7 +80,7 @@ module Spree
 
       def load_data
         @amount = params[:amount] || load_order.total
-        @payment_methods = Spree::PaymentMethod.active.available_to_admin
+        @payment_methods = Spree::PaymentMethod.active.available_to_admin.ordered_by_position
         if @payment && @payment.payment_method
           @payment_method = @payment.payment_method
         else
@@ -92,6 +92,8 @@ module Spree
         @order = Spree::Order.find_by!(number: params[:order_id])
         authorize! action, @order
         @order
+      rescue ActiveRecord::RecordNotFound
+        resource_not_found(flash_class: Spree::Order, redirect_url: admin_orders_path)
       end
 
       def load_payment

data/app/controllers/spree/admin/product_properties_controller.rb

@@ -3,7 +3,7 @@
 module Spree
   module Admin
     class ProductPropertiesController < ResourceController
-      belongs_to 'spree/product', find_by: :slug
+      belongs_to 'spree/product', find_by: :slug, includes: { product_properties: :property }
       before_action :find_properties
       before_action :setup_property, only: :index, if: -> { can?(:create, model_class) }
       before_action :setup_variant_property_rules, only: :index
@@ -15,7 +15,7 @@ module Spree
       end
 
       def setup_property
-        @product.product_properties.build
+        @product.product_properties.build if @product.product_properties.empty?
       end
 
       def setup_variant_property_rules

data/app/controllers/spree/admin/products_controller.rb

@@ -9,6 +9,7 @@ module Spree
       update.before :update_before
       helper_method :clone_object_url
       before_action :split_params, only: [:create, :update]
+      before_action :normalize_variant_property_rules, only: [:update]
 
       def show
         redirect_to action: :edit
@@ -19,29 +20,6 @@ module Spree
         respond_with(@collection)
       end
 
-      def update
-        if updating_variant_property_rules?
-          params[:product][:variant_property_rules_attributes].each do |_index, param_attrs|
-            param_attrs[:option_value_ids] = param_attrs[:option_value_ids].split(',')
-          end
-        end
-        invoke_callbacks(:update, :before)
-        if @object.update_attributes(permitted_resource_params)
-          invoke_callbacks(:update, :after)
-          flash[:success] = flash_message_for(@object, :successfully_updated)
-          respond_with(@object) do |format|
-            format.html { redirect_to location_after_save }
-            format.js   { render layout: false }
-          end
-        else
-          # Stops people submitting blank slugs, causing errors when they try to
-          # update the product again
-          @product.slug = @product.slug_was if @product.slug.blank?
-          invoke_callbacks(:update, :fails)
-          respond_with(@object)
-        end
-      end
-
       def destroy
         @product = Spree::Product.friendly.find(params[:id])
         @product.discard
@@ -78,7 +56,7 @@ module Spree
       end
 
       def find_resource
-        Spree::Product.with_deleted.friendly.find(params[:id])
+        Spree::Product.with_discarded.friendly.find(params[:id])
       end
 
       def location_after_save
@@ -96,6 +74,7 @@ module Spree
 
       def load_data
         @tax_categories = Spree::TaxCategory.order(:name)
+        @default_tax_category = @tax_categories.detect(&:is_default)
         @shipping_categories = Spree::ShippingCategory.order(:name)
       end
 
@@ -120,7 +99,7 @@ module Spree
       end
 
       def product_includes
-        [{ variants: [:images], master: [:images, :default_price] }]
+        [:variant_images, { variants: [:images], master: [:images, :default_price] }]
       end
 
       def clone_object_url(resource)
@@ -138,6 +117,21 @@ module Spree
       def updating_variant_property_rules?
         params[:product][:variant_property_rules_attributes].present?
       end
+
+      def render_after_update_error
+        # Stops people submitting blank slugs, causing errors when they try to
+        # update the product again
+        @product.slug = @product.slug_was if @product.slug.blank?
+        render action: 'edit'
+      end
+
+      def normalize_variant_property_rules
+        return unless updating_variant_property_rules?
+
+        params[:product][:variant_property_rules_attributes].each do |_index, param_attrs|
+          param_attrs[:option_value_ids] = param_attrs[:option_value_ids].split(',')
+        end
+      end
     end
   end
 end

data/app/controllers/spree/admin/promotion_codes_controller.rb

@@ -6,7 +6,7 @@ module Spree
   module Admin
     class PromotionCodesController < Spree::Admin::ResourceController
       def index
-        @promotion = Spree::Promotion.accessible_by(current_ability, :read).find(params[:promotion_id])
+        @promotion = Spree::Promotion.accessible_by(current_ability, :show).find(params[:promotion_id])
         @promotion_codes = @promotion.promotion_codes.order(:value)
 
         respond_to do |format|
@@ -22,12 +22,17 @@ module Spree
       end
 
       def new
-        @promotion = Spree::Promotion.accessible_by(current_ability, :read).find(params[:promotion_id])
-        @promotion_code = @promotion.promotion_codes.build
+        @promotion = Spree::Promotion.accessible_by(current_ability, :show).find(params[:promotion_id])
+        if @promotion.apply_automatically
+          flash[:error] = t('activerecord.errors.models.spree/promotion_code.attributes.base.disallowed_with_apply_automatically')
+          redirect_to admin_promotion_promotion_codes_url(@promotion)
+        else
+          @promotion_code = @promotion.promotion_codes.build
+        end
       end
 
       def create
-        @promotion = Spree::Promotion.accessible_by(current_ability, :read).find(params[:promotion_id])
+        @promotion = Spree::Promotion.accessible_by(current_ability, :show).find(params[:promotion_id])
         @promotion_code = @promotion.promotion_codes.build(value: params[:promotion_code][:value])
 
         if @promotion_code.save

data/app/controllers/spree/admin/refunds_controller.rb

@@ -10,6 +10,21 @@ module Spree
 
       rescue_from Spree::Core::GatewayError, with: :spree_core_gateway_error
 
+      def create
+        @refund.attributes = refund_params.merge(perform_after_create: false)
+        if @refund.save && @refund.perform!
+          flash[:success] = flash_message_for(@refund, :successfully_created)
+          respond_with(@refund) do |format|
+            format.html { redirect_to location_after_save }
+          end
+        else
+          flash.now[:error] = @refund.errors.full_messages.join(", ")
+          respond_with(@refund) do |format|
+            format.html { render action: 'new' }
+          end
+        end
+      end
+
       private
 
       def location_after_save
@@ -25,6 +40,10 @@ module Spree
         @refund_reasons ||= Spree::RefundReason.active.all
       end
 
+      def refund_params
+        params.require(:refund).permit!
+      end
+
       def build_resource
         super.tap do |refund|
           refund.amount = refund.payment.credit_allowed

data/app/controllers/spree/admin/resource_controller.rb

@@ -5,7 +5,10 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
 
   helper_method :new_object_url, :edit_object_url, :object_url, :collection_url
   before_action :load_resource, except: :update_positions
-  rescue_from ActiveRecord::RecordNotFound, with: :resource_not_found
+  rescue_from ActiveRecord::RecordNotFound do |exception|
+    resource_not_found(flash_class: exception.model.constantize)
+  end
+  rescue_from ActiveRecord::RecordInvalid, with: :resource_invalid
 
   respond_to :html
 
@@ -30,7 +33,7 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
 
   def update
     invoke_callbacks(:update, :before)
-    if @object.update_attributes(permitted_resource_params)
+    if @object.update(permitted_resource_params)
       invoke_callbacks(:update, :after)
       respond_with(@object) do |format|
         format.html do
@@ -76,7 +79,7 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
   def update_positions
     ActiveRecord::Base.transaction do
       params[:positions].each do |id, index|
-        model_class.find(id).set_list_position(index)
+        model_class.find_by(id: id)&.set_list_position(index)
       end
     end
 
@@ -107,8 +110,14 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
     else
       invoke_callbacks(:destroy, :fails)
       respond_with(@object) do |format|
-        format.html { redirect_to location_after_destroy }
-        format.js { render status: :unprocessable_entity, plain: @object.errors.full_messages.join(', ') }
+        message = @object.errors.full_messages.to_sentence
+        format.html do
+          flash[:error] = message
+          redirect_to location_after_destroy
+        end
+        format.js do
+          render status: :unprocessable_entity, plain: message
+        end
       end
     end
   end
@@ -123,12 +132,12 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
       @parent_data[:model_name] = model_name
       @parent_data[:model_class] = (options[:model_class] || model_name.to_s.classify.constantize)
       @parent_data[:find_by] = options[:find_by] || :id
+      @parent_data[:includes] = options[:includes]
     end
   end
 
-  def resource_not_found
-    flash[:error] = flash_message_for(model_class.new, :not_found)
-    redirect_to collection_url
+  def resource_not_found(flash_class: model_class, redirect_url: collection_url)
+    super
   end
 
   def model_class
@@ -183,12 +192,16 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
 
   def parent
     if parent?
-      @parent ||= self.class.parent_data[:model_class].find_by(self.class.parent_data[:find_by] => params["#{parent_model_name}_id"])
+      @parent ||= self.class.parent_data[:model_class]
+                    .includes(self.class.parent_data[:includes])
+                    .find_by!(self.class.parent_data[:find_by] => params["#{parent_model_name}_id"])
       instance_variable_set("@#{parent_model_name}", @parent)
     else
       Spree::Deprecation.warn "Calling #parent is deprecated on a ResourceController which has not defined a belongs_to"
       nil
     end
+  rescue ActiveRecord::RecordNotFound => e
+    resource_not_found(flash_class: e.model.constantize, redirect_url: spree.polymorphic_url([:admin, parent_model_name.pluralize]))
   end
 
   def parent?
@@ -212,7 +225,8 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
   end
 
   def collection
-    return parent.send(controller_name) if parent?
+    return parent.send(controller_name) if parent? && parent
+
     if model_class.respond_to?(:accessible_by) && !current_ability.has_block?(params[:action], model_class)
       model_class.accessible_by(current_ability, action)
     else
@@ -290,4 +304,19 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
   def render_after_update_error
     render action: 'edit'
   end
+
+  def resource_invalid(exception)
+    invoke_callbacks(action, :fails)
+    respond_with(@object) do |format|
+      format.html do
+        flash.now[:error] = exception.message
+        if @object.new_record?
+          render_after_create_error
+        else
+          render_after_update_error
+        end
+      end
+      format.js { render layout: false }
+    end
+  end
 end