solidus_backend 2.9.6 → 2.11.0

data/app/controllers/spree/admin/return_authorizations_controller.rb

@@ -47,7 +47,7 @@ module Spree
       end
 
       def load_reimbursement_types
-        @reimbursement_types = Spree::ReimbursementType.accessible_by(current_ability, :read).active
+        @reimbursement_types = Spree::ReimbursementType.accessible_by(current_ability).active
       end
 
       def load_return_reasons

data/app/controllers/spree/admin/root_controller.rb

@@ -12,7 +12,7 @@ module Spree
       private
 
       def admin_root_redirect_path
-        if can?(:display, Spree::Order) && can?(:admin, Spree::Order)
+        if can?(:show, Spree::Order) && can?(:admin, Spree::Order)
           spree.admin_orders_path
         elsif can?(:admin, :dashboards) && can?(:home, :dashboards)
           spree.home_admin_dashboards_path

data/app/controllers/spree/admin/search_controller.rb

@@ -16,8 +16,7 @@ module Spree
           @users = Spree.user_class.ransack({
             m: 'or',
             email_start: params[:q],
-            addresses_firstname_start: params[:q],
-            addresses_lastname_start: params[:q]
+            firstname_or_lastname_start: params[:q]
           }).result.limit(10)
         end
       end

data/app/controllers/spree/admin/stock_items_controller.rb

@@ -15,8 +15,8 @@ module Spree
       private
 
       def build_resource
-        variant = Spree::Variant.accessible_by(current_ability, :read).find(params[:variant_id])
-        stock_location = Spree::StockLocation.accessible_by(current_ability, :read).find(params[:stock_location_id])
+        variant = Spree::Variant.accessible_by(current_ability, :show).find(params[:variant_id])
+        stock_location = Spree::StockLocation.accessible_by(current_ability, :show).find(params[:stock_location_id])
         stock_location.stock_movements.build(stock_movement_params).tap do |stock_movement|
           stock_movement.originator = try_spree_current_user
           stock_movement.stock_item = stock_location.set_up_stock_item(variant)
@@ -36,11 +36,11 @@ module Spree
       end
 
       def load_product
-        @product = Spree::Product.accessible_by(current_ability, :read).friendly.find(params[:product_slug]) if params[:product_slug]
+        @product = Spree::Product.accessible_by(current_ability, :show).friendly.find(params[:product_slug]) if params[:product_slug]
       end
 
       def load_stock_management_data
-        @stock_locations = Spree::StockLocation.accessible_by(current_ability, :read)
+        @stock_locations = Spree::StockLocation.accessible_by(current_ability)
         @stock_item_stock_locations = params[:stock_location_id].present? ? @stock_locations.where(id: params[:stock_location_id]) : @stock_locations
         @variant_display_attributes = self.class.variant_display_attributes
         @variants = Spree::Config.variant_search_class.new(params[:variant_search_term], scope: variant_scope).results
@@ -50,8 +50,9 @@ module Spree
       end
 
       def variant_scope
-        scope = Spree::Variant.accessible_by(current_ability, :read)
+        scope = Spree::Variant.accessible_by(current_ability)
         scope = scope.where(product: @product) if @product
+        scope = scope.order(:sku)
         scope
       end
 

data/app/controllers/spree/admin/stock_locations_controller.rb

@@ -13,6 +13,10 @@ module Spree
         flash[:error] = t('spree.stock_locations_need_a_default_country')
         redirect_to(admin_stock_locations_path) && return
       end
+
+      def collection
+        super.page(params[:page]).per(Spree::Config[:admin_products_per_page])
+      end
     end
   end
 end

data/app/controllers/spree/admin/stock_movements_controller.rb

@@ -6,6 +6,13 @@ module Spree
       belongs_to 'spree/stock_location'
       before_action :parent
 
+      def index
+        params[:q] ||= {}
+
+        @search = collection.ransack(params[:q])
+        @stock_movements = @search.result.page(params[:page])
+      end
+
       private
 
       def permitted_resource_params

data/app/controllers/spree/admin/style_guide_controller.rb

@@ -4,7 +4,7 @@ module Spree
   module Admin
     class StyleGuideController < Spree::Admin::BaseController
       respond_to :html
-      layout '/spree/layouts/admin_style_guide'
+      layout 'spree/layouts/admin_style_guide'
 
       def index
         @topics = {

data/app/controllers/spree/admin/taxons/attachment_controller.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    module Taxons
+      class AttachmentController < Spree::Admin::BaseController
+        def destroy
+          taxonomy = Spree::Taxonomy.find(params[:taxonomy_id])
+          taxon = taxonomy.taxons.find(params[:taxon_id])
+          if taxon.destroy_attachment(params[:attachment_definition])
+            flash[:success] = t('spree.successfully_removed', resource: params[:attachment_definition].titleize)
+          else
+            flash[:error] = t('spree.taxon_attachment_removal_error')
+          end
+          redirect_to edit_admin_taxonomy_taxon_path(taxonomy, taxon.id)
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/taxons_controller.rb

@@ -3,6 +3,7 @@
 module Spree
   module Admin
     class TaxonsController < Spree::Admin::BaseController
+      rescue_from ActiveRecord::RecordNotFound, with: :resource_not_found
       respond_to :html, :json, :js
 
       def index
@@ -62,7 +63,13 @@ module Spree
         end
 
         respond_with(@taxon) do |format|
-          format.html { redirect_to edit_admin_taxonomy_url(@taxonomy) }
+          format.html do
+            if @taxon.valid?
+              redirect_to edit_admin_taxonomy_url(@taxonomy)
+            else
+              render :edit
+            end
+          end
         end
       end
 
@@ -77,6 +84,10 @@ module Spree
       def taxon_params
         params.require(:taxon).permit(permitted_taxon_attributes)
       end
+
+      def resource_not_found
+        super(flash_class: Taxon, redirect_url: admin_taxonomies_path)
+      end
     end
   end
 end

data/app/controllers/spree/admin/users/api_key_controller.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    module Users
+      class ApiKeyController < Spree::Admin::BaseController
+        def create
+          if user.generate_spree_api_key!
+            flash[:success] = t('spree.admin.api.key_generated')
+          end
+          redirect_to edit_admin_user_path(user)
+        end
+
+        def destroy
+          if user.clear_spree_api_key!
+            flash[:success] = t('spree.admin.api.key_cleared')
+          end
+          redirect_to edit_admin_user_path(user)
+        end
+
+        private
+
+        def user
+          @user ||= Spree.user_class.find(params[:user_id])
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/users_controller.rb

@@ -38,7 +38,7 @@ module Spree
       end
 
       def update
-        if @user.update_attributes(user_params)
+        if @user.update(user_params)
           set_roles
           set_stock_locations
 
@@ -55,7 +55,7 @@ module Spree
 
       def addresses
         if request.put?
-          if @user.update_attributes(user_params)
+          if @user.update(user_params)
             flash.now[:success] = t('spree.account_updated')
           end
 
@@ -82,6 +82,16 @@ module Spree
       end
 
       def generate_api_key
+        Spree::Deprecation.warn <<-WARN.strip_heredoc, caller
+          The route or controller action you are using is deprecated.
+
+          Instead of:
+          generate_api_key_admin_user PUT    /admin/users/:id/generate_api_key
+
+          Please use:
+          admin_user_api_key          POST   /admin/users/:user_id/api_key
+        WARN
+
         if @user.generate_spree_api_key!
           flash[:success] = t('spree.admin.api.key_generated')
         end
@@ -89,6 +99,16 @@ module Spree
       end
 
       def clear_api_key
+        Spree::Deprecation.warn <<-WARN.strip_heredoc, caller
+          The route or controller action you are using is deprecated.
+
+          Instead of:
+          clear_api_key_admin_user PUT    /admin/users/:id/clear_api_key
+
+          Please use:
+          admin_user_api_key       DELETE /admin/users/:user_id/api_key
+        WARN
+
         if @user.clear_spree_api_key!
           flash[:success] = t('spree.admin.api.key_cleared')
         end
@@ -103,21 +123,11 @@ module Spree
 
       def collection
         return @collection if @collection
-        if request.xhr? && params[:q].present?
-          @collection = Spree.user_class.includes(:bill_address, :ship_address)
-                            .where("#{Spree.user_class.table_name}.email #{LIKE} :search
-                                   OR (spree_addresses.firstname #{LIKE} :search AND spree_addresses.id = #{Spree.user_class.table_name}.bill_address_id)
-                                   OR (spree_addresses.lastname  #{LIKE} :search AND spree_addresses.id = #{Spree.user_class.table_name}.bill_address_id)
-                                   OR (spree_addresses.firstname #{LIKE} :search AND spree_addresses.id = #{Spree.user_class.table_name}.ship_address_id)
-                                   OR (spree_addresses.lastname  #{LIKE} :search AND spree_addresses.id = #{Spree.user_class.table_name}.ship_address_id)",
-                                  { search: "#{params[:q].strip}%" })
-                            .limit(params[:limit] || 100)
-        else
-          @search = Spree.user_class.ransack(params[:q])
-          @collection = @search.result.includes(:spree_roles)
-          @collection = @collection.includes(:spree_orders)
-          @collection = @collection.page(params[:page]).per(Spree::Config[:admin_products_per_page])
-        end
+
+        @search = super.ransack(params[:q])
+        @collection = @search.result.includes(:spree_roles)
+        @collection = @collection.includes(:spree_orders)
+        @collection = @collection.page(params[:page]).per(Spree::Config[:admin_products_per_page])
       end
 
       def user_params
@@ -131,6 +141,14 @@ module Spree
           attributes += [{ spree_role_ids: [] }]
         end
 
+        if can? :manage, Spree::StockLocation
+          attributes += [{ stock_location_ids: [] }]
+        end
+
+        unless can? :update_password, @user
+          attributes -= [:password, :password_confirmation]
+        end
+
         params.require(:user).permit(attributes)
       end
 
@@ -147,24 +165,27 @@ module Spree
       end
 
       def load_roles
-        @roles = Spree::Role.all
+        @roles = Spree::Role.accessible_by(current_ability)
         if @user
           @user_roles = @user.spree_roles
         end
       end
 
       def load_stock_locations
-        @stock_locations = Spree::StockLocation.all
+        @stock_locations = Spree::StockLocation.accessible_by(current_ability)
       end
 
       def set_roles
-        if user_params[:spree_role_ids] && can?(:manage, Spree::Role)
-          @user.spree_roles = Spree::Role.where(id: user_params[:spree_role_ids])
+        if user_params[:spree_role_ids]
+          @user.spree_roles = Spree::Role.accessible_by(current_ability).where(id: user_params[:spree_role_ids])
         end
       end
 
       def set_stock_locations
-        @user.stock_locations = Spree::StockLocation.where(id: (params[:user][:stock_location_ids] || []))
+        if user_params[:stock_location_ids]
+          @user.stock_locations =
+            Spree::StockLocation.accessible_by(current_ability).where(id: user_params[:stock_location_ids])
+        end
       end
     end
   end

data/app/controllers/spree/admin/variants_controller.rb

@@ -21,7 +21,7 @@ module Spree
 
       def collection
         if params[:deleted] == "on"
-          base_variant_scope ||= super.with_deleted
+          base_variant_scope ||= super.with_discarded
         else
           base_variant_scope ||= super
         end
@@ -43,8 +43,10 @@ module Spree
       end
 
       def parent
-        @parent ||= Spree::Product.with_deleted.find_by(slug: params[:product_id])
+        @parent ||= Spree::Product.with_discarded.find_by!(slug: params[:product_id])
         @product = @parent
+      rescue ActiveRecord::RecordNotFound
+        resource_not_found(flash_class: Spree::Product, redirect_url: admin_products_path)
       end
     end
   end

data/app/controllers/spree/admin/zones_controller.rb

@@ -20,7 +20,7 @@ module Spree
 
       def load_data
         @countries = Spree::Country.order(:name)
-        @states = Spree::State.order(:name)
+        @states = Spree::State.includes(:country).order(:name)
         @zones = Spree::Zone.order(:name)
       end
     end

data/app/helpers/spree/admin/base_helper.rb

@@ -120,6 +120,8 @@ module Spree
         css_classes = options[:class] ? options[:class] + " spree_add_fields" : "spree_add_fields"
         link_to_with_icon('plus', name, 'javascript:', data: { target: target }, class: css_classes)
       end
+      deprecate link_to_add_fields: "Please use button_tag instead, Example: \n" \
+        "button_tag \"Name\", type: \"button\", data: { target: \"tbody#div\" }", deprecator: Spree::Deprecation
 
       # renders hidden field and link to remove record using nested_attributes
       def link_to_remove_fields(name, form, options = {})
@@ -130,6 +132,8 @@ module Spree
         link_to_with_icon('trash', name, url, class: "spree_remove_fields #{options[:class]}", data: { action: 'remove' }, title: t('spree.actions.remove')) +
           form.hidden_field(:_destroy)
       end
+      deprecate link_to_remove_fields: "Please use link_to_delete instead, Example: \n" \
+        "link_to_delete \"form.object\"", deprecator: Spree::Deprecation
 
       def spree_dom_id(record)
         dom_id(record, 'spree')

data/app/helpers/spree/admin/customer_returns_helper.rb

@@ -4,7 +4,7 @@ module Spree
   module Admin
     module CustomerReturnsHelper
       def reimbursement_types
-        @reimbursement_types ||= Spree::ReimbursementType.accessible_by(current_ability, :read).active
+        @reimbursement_types ||= Spree::ReimbursementType.accessible_by(current_ability).active
       end
     end
   end

data/app/helpers/spree/admin/navigation_helper.rb

@@ -7,7 +7,7 @@ module Spree
         @admin_breadcrumbs ||= []
       end
 
-      # Add items to current page breadcrumb heirarchy
+      # Add items to current page breadcrumb hierarchy
       def admin_breadcrumb(*ancestors, &block)
         admin_breadcrumbs.concat(ancestors) if ancestors.present?
         admin_breadcrumbs.push(capture(&block)) if block_given?
@@ -33,7 +33,7 @@ module Spree
         elsif content_for?(:page_title)
           content_for(:page_title)
         elsif admin_breadcrumbs.any?
-          admin_breadcrumbs.map{ |x| strip_tags(x) }.reverse.join(' - ')
+          admin_breadcrumbs.map { |breadcrumb| strip_tags(breadcrumb) }.reverse.join(' - ')
         else
           t(controller.controller_name, default: controller.controller_name.titleize, scope: 'spree')
         end
@@ -181,7 +181,8 @@ module Spree
                     url.ends_with?("#{controller.controller_name.singularize}/edit")
         options[:class] = 'fa'
         options[:class] += ' active' if is_active
-        options[:datahook] = "admin_settings_#{link_text.downcase.tr(' ', '_')}"
+        options[:data] ||= {}
+        options[:data][:hook] = "admin_settings_#{link_text.downcase.tr(' ', '_')}"
         content_tag(:li, options) do
           link_to(link_text, url)
         end

data/app/helpers/spree/admin/orders_helper.rb

@@ -8,11 +8,15 @@ module Spree
         links = []
         @order_events.sort.each do |event|
           next unless @order.send("can_#{event}?")
-          links << button_to(t(event, scope: 'spree'), [event, :admin, @order],
-                             method: :put,
-                             data: { confirm: t('spree.order_sure_want_to', event: t(event, scope: 'spree')) })
+          translated_event = t(event, scope: [:spree, :admin, :order, :events])
+          links << button_to(
+            translated_event,
+            [event, :admin, @order],
+            method: :put,
+            data: { confirm: t(:order_sure_want_to, event: translated_event, scope: :spree) }
+          )
         end
-        safe_join(links, '&nbsp;'.html_safe)
+        safe_join(links, "&nbsp;".html_safe)
       end
 
       def line_item_shipment_price(line_item, quantity)

data/app/helpers/spree/admin/stock_movements_helper.rb

@@ -4,12 +4,16 @@ module Spree
   module Admin
     module StockMovementsHelper
       def pretty_originator(stock_movement)
-        if stock_movement.originator.respond_to?(:number)
-          if stock_movement.originator.respond_to?(:order)
-            link_to stock_movement.originator.number, [:edit, :admin, stock_movement.originator.order]
+        originator = stock_movement.originator
+
+        if originator.respond_to?(:number)
+          if originator.respond_to?(:order)
+            link_to originator.number, [:edit, :admin, originator.order]
           else
-            stock_movement.originator.number
+            originator.number
           end
+        elsif originator.respond_to?(:email)
+          originator.email
         else
           ""
         end

data/app/helpers/spree/promotion_rules_helper.rb

@@ -4,7 +4,7 @@ module Spree
   module PromotionRulesHelper
     def options_for_promotion_rule_types(promotion)
       existing = promotion.rules.map { |rule| rule.class.name }
-      rules = Rails.application.config.spree.promotions.rules.reject { |r| existing.include? r.name }
+      rules = Rails.application.config.spree.promotions.rules.reject { |rule| existing.include? rule.name }
       options = rules.map { |rule| [rule.model_name.human, rule.name] }
       options_for_select(options)
     end