solidus_backend_devise_token_auth 2.8.0.alpha.2

data/app/controllers/spree/admin/refunds_controller.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class RefundsController < ResourceController
+      belongs_to 'spree/payment'
+      before_action :load_order
+
+      helper_method :refund_reasons
+
+      rescue_from Spree::Core::GatewayError, with: :spree_core_gateway_error
+
+      private
+
+      def location_after_save
+        admin_order_payments_path(@payment.order)
+      end
+
+      def load_order
+        # the spree/admin/shared/order_tabs partial expects the @order instance variable to be set
+        @order = @payment.order if @payment
+      end
+
+      def refund_reasons
+        @refund_reasons ||= Spree::RefundReason.active.all
+      end
+
+      def build_resource
+        super.tap do |refund|
+          refund.amount = refund.payment.credit_allowed
+        end
+      end
+
+      def spree_core_gateway_error(error)
+        flash[:error] = error.message
+        render :new
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/reimbursement_types_controller.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class ReimbursementTypesController < ResourceController
+    end
+  end
+end

data/app/controllers/spree/admin/reimbursements_controller.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class ReimbursementsController < ResourceController
+      helper 'spree/admin/reimbursement_type'
+      helper 'spree/admin/customer_returns'
+      belongs_to 'spree/order', find_by: :number
+
+      before_action :load_stock_locations, only: :edit
+      before_action :load_simulated_refunds, only: :edit
+
+      rescue_from Spree::Core::GatewayError, with: :spree_core_gateway_error
+
+      def perform
+        @reimbursement.perform!
+        redirect_to location_after_save
+      end
+
+      private
+
+      def build_resource
+        if params[:build_from_customer_return_id].present?
+          customer_return = Spree::CustomerReturn.find(params[:build_from_customer_return_id])
+
+          Spree::Reimbursement.build_from_customer_return(customer_return)
+        else
+          super
+        end
+      end
+
+      def location_after_save
+        if @reimbursement.reimbursed?
+          admin_order_reimbursement_path(parent, @reimbursement)
+        else
+          edit_admin_order_reimbursement_path(parent, @reimbursement)
+        end
+      end
+
+      # We don't currently have a real Reimbursement "new" page. And the only
+      # built-in way to create reimburesments via Solidus admin is from the
+      # customer returns admin page via a button that supplies the
+      # "build_from_customer_return" parameter. The "edit" page is not
+      # suitable for use here for that reason as well.
+      # Perhaps we should add a reimbursement new page of some sort.
+      def render_after_create_error
+        flash.keep
+        if request.referer
+          redirect_to request.referer
+        else
+          redirect_to admin_url
+        end
+      end
+
+      def load_stock_locations
+        @stock_locations = Spree::StockLocation.active
+      end
+
+      def load_simulated_refunds
+        @reimbursement_objects = @reimbursement.simulate
+      end
+
+      def spree_core_gateway_error(error)
+        flash[:error] = error.message
+        redirect_to edit_admin_order_reimbursement_path(parent, @reimbursement)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/resource_controller.rb

@@ -0,0 +1,292 @@
+# frozen_string_literal: true
+
+class Spree::Admin::ResourceController < Spree::Admin::BaseController
+  include Spree::Backend::Callbacks
+
+  helper_method :new_object_url, :edit_object_url, :object_url, :collection_url
+  before_action :load_resource, except: :update_positions
+  rescue_from ActiveRecord::RecordNotFound, with: :resource_not_found
+
+  respond_to :html
+
+  def new
+    invoke_callbacks(:new_action, :before)
+    respond_with(@object) do |format|
+      format.html { render layout: !request.xhr? }
+      if request.xhr?
+        format.js   { render layout: false }
+      end
+    end
+  end
+
+  def edit
+    respond_with(@object) do |format|
+      format.html { render layout: !request.xhr? }
+      if request.xhr?
+        format.js   { render layout: false }
+      end
+    end
+  end
+
+  def update
+    invoke_callbacks(:update, :before)
+    if @object.update_attributes(permitted_resource_params)
+      invoke_callbacks(:update, :after)
+      respond_with(@object) do |format|
+        format.html do
+          flash[:success] = flash_message_for(@object, :successfully_updated)
+          redirect_to location_after_save
+        end
+        format.js { render layout: false }
+      end
+    else
+      invoke_callbacks(:update, :fails)
+      respond_with(@object) do |format|
+        format.html do
+          flash.now[:error] = @object.errors.full_messages.join(", ")
+          render_after_update_error
+        end
+        format.js { render layout: false }
+      end
+    end
+  end
+
+  def create
+    invoke_callbacks(:create, :before)
+    @object.attributes = permitted_resource_params
+    if @object.save
+      invoke_callbacks(:create, :after)
+      flash[:success] = flash_message_for(@object, :successfully_created)
+      respond_with(@object) do |format|
+        format.html { redirect_to location_after_save }
+        format.js   { render layout: false }
+      end
+    else
+      invoke_callbacks(:create, :fails)
+      respond_with(@object) do |format|
+        format.html do
+          flash.now[:error] = @object.errors.full_messages.join(", ")
+          render_after_create_error
+        end
+        format.js { render layout: false }
+      end
+    end
+  end
+
+  def update_positions
+    ActiveRecord::Base.transaction do
+      params[:positions].each do |id, index|
+        model_class.find(id).set_list_position(index)
+      end
+    end
+
+    respond_to do |format|
+      format.js { head :no_content }
+    end
+  end
+
+  def destroy
+    invoke_callbacks(:destroy, :before)
+
+    destroy_result =
+      if @object.respond_to?(:discard)
+        @object.discard
+      elsif @object.respond_to?(:paranoia_destroy)
+        @object.paranoia_destroy
+      else
+        @object.destroy
+      end
+
+    if destroy_result
+      invoke_callbacks(:destroy, :after)
+      flash[:success] = flash_message_for(@object, :successfully_removed)
+      respond_with(@object) do |format|
+        format.html { redirect_to location_after_destroy }
+        format.js   { render partial: "spree/admin/shared/destroy" }
+      end
+    else
+      invoke_callbacks(:destroy, :fails)
+      respond_with(@object) do |format|
+        format.html { redirect_to location_after_destroy }
+      end
+    end
+  end
+
+  private
+
+  class << self
+    attr_accessor :parent_data
+
+    def belongs_to(model_name, options = {})
+      @parent_data ||= {}
+      @parent_data[:model_name] = model_name
+      @parent_data[:model_class] = (options[:model_class] || model_name.to_s.classify.constantize)
+      @parent_data[:find_by] = options[:find_by] || :id
+    end
+  end
+
+  def resource_not_found
+    flash[:error] = flash_message_for(model_class.new, :not_found)
+    redirect_to collection_url
+  end
+
+  def model_class
+    "Spree::#{controller_name.classify}".constantize
+  end
+
+  def parent_model_name
+    self.class.parent_data[:model_name].gsub('spree/', '')
+  end
+
+  def model_name
+    Spree::Deprecation.warn('model_name is deprecated. Please use parent_model_name instead.', caller)
+    parent_model_name
+  end
+
+  def object_name
+    controller_name.singularize
+  end
+
+  def load_resource
+    if member_action?
+      @object ||= load_resource_instance
+
+      # call authorize! a third time (called twice already in Admin::BaseController)
+      # this time we pass the actual instance so fine-grained abilities can control
+      # access to individual records, not just entire models.
+      authorize! action, @object
+
+      instance_variable_set("@#{object_name}", @object)
+    else
+      @collection ||= collection
+
+      # note: we don't call authorize here as the collection method should use
+      # CanCan's accessible_by method to restrict the actual records returned
+
+      instance_variable_set("@#{controller_name}", @collection)
+    end
+  end
+
+  def load_resource_instance
+    if new_actions.include?(action)
+      build_resource
+    elsif params[:id]
+      find_resource
+    end
+  end
+
+  def parent_data
+    Spree::Deprecation.warn('parent_data is deprecated without replacement.', caller)
+    self.class.parent_data
+  end
+
+  def parent
+    if parent?
+      @parent ||= self.class.parent_data[:model_class].find_by(self.class.parent_data[:find_by] => params["#{parent_model_name}_id"])
+      instance_variable_set("@#{parent_model_name}", @parent)
+    else
+      Spree::Deprecation.warn "Calling #parent is deprecated on a ResourceController which has not defined a belongs_to"
+      nil
+    end
+  end
+
+  def parent?
+    self.class.parent_data.present?
+  end
+
+  def find_resource
+    if parent?
+      parent.send(controller_name).find(params[:id])
+    else
+      model_class.find(params[:id])
+    end
+  end
+
+  def build_resource
+    if parent?
+      parent.send(controller_name).build
+    else
+      model_class.new
+    end
+  end
+
+  def collection
+    return parent.send(controller_name) if parent?
+    if model_class.respond_to?(:accessible_by) && !current_ability.has_block?(params[:action], model_class)
+      model_class.accessible_by(current_ability, action)
+    else
+      model_class.all
+    end
+  end
+
+  def location_after_destroy
+    collection_url
+  end
+
+  def location_after_save
+    collection_url
+  end
+
+  # URL helpers
+
+  def new_object_url(options = {})
+    if parent?
+      spree.new_polymorphic_url([:admin, parent, model_class], options)
+    else
+      spree.new_polymorphic_url([:admin, model_class], options)
+    end
+  end
+
+  def edit_object_url(object, options = {})
+    if parent?
+      spree.polymorphic_url([:edit, :admin, parent, object], options)
+    else
+      spree.polymorphic_url([:edit, :admin, object], options)
+    end
+  end
+
+  def object_url(object = nil, options = {})
+    target = object ? object : @object
+
+    if parent?
+      spree.polymorphic_url([:admin, parent, target], options)
+    else
+      spree.polymorphic_url([:admin, target], options)
+    end
+  end
+
+  def collection_url(options = {})
+    if parent?
+      spree.polymorphic_url([:admin, parent, model_class], options)
+    else
+      spree.polymorphic_url([:admin, model_class], options)
+    end
+  end
+
+  # Allow all attributes to be updatable.
+  #
+  # Other controllers can, should, override it to set custom logic
+  def permitted_resource_params
+    params[object_name].present? ? params.require(object_name).permit! : ActionController::Parameters.new.permit!
+  end
+
+  def collection_actions
+    [:index]
+  end
+
+  def member_action?
+    !collection_actions.include? action
+  end
+
+  def new_actions
+    [:new, :create]
+  end
+
+  def render_after_create_error
+    render action: 'new'
+  end
+
+  def render_after_update_error
+    render action: 'edit'
+  end
+end

data/app/controllers/spree/admin/return_authorizations_controller.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class ReturnAuthorizationsController < ResourceController
+      belongs_to 'spree/order', find_by: :number
+
+      before_action :load_form_data, only: [:new, :edit]
+      create.fails  :load_form_data
+      update.fails  :load_form_data
+
+      def fire
+        action_from_params = "#{params[:e]}!"
+
+        if @return_authorization.state_events.include?(params[:e].to_sym) &&
+           @return_authorization.send(action_from_params)
+
+          flash_message = { success: t('spree.return_authorization_updated') }
+        else
+          flash_message = { error: t('spree.return_authorization_fire_error') }
+        end
+
+        redirect_back(fallback_location: admin_order_return_authorizations_path(@order),
+                      flash: flash_message)
+      end
+
+      private
+
+      def load_form_data
+        load_return_items
+        load_reimbursement_types
+        load_return_reasons
+        load_stock_locations
+      end
+
+      # To satisfy how nested attributes works we want to create placeholder ReturnItems for
+      # any InventoryUnits that have not already been added to the ReturnAuthorization.
+      def load_return_items
+        all_inventory_units = @return_authorization.order.inventory_units
+        associated_inventory_units = @return_authorization.return_items.map(&:inventory_unit)
+        unassociated_inventory_units = all_inventory_units - associated_inventory_units
+
+        new_return_items = unassociated_inventory_units.map do |new_unit|
+          Spree::ReturnItem.new(inventory_unit: new_unit).tap(&:set_default_amount)
+        end
+        @form_return_items = (@return_authorization.return_items + new_return_items).sort_by(&:inventory_unit_id)
+      end
+
+      def load_reimbursement_types
+        @reimbursement_types = Spree::ReimbursementType.accessible_by(current_ability, :read).active
+      end
+
+      def load_return_reasons
+        @reasons = Spree::ReturnReason.reasons_for_return_items(@return_authorization.return_items)
+      end
+
+      def load_stock_locations
+        @stock_locations = Spree::StockLocation.order_default.active
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/return_items_controller.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class ReturnItemsController < ResourceController
+      private
+
+      def location_after_save
+        url_for([:edit, :admin, @return_item.customer_return.order, @return_item.customer_return])
+      end
+
+      def render_after_update_error
+        redirect_back(fallback_location: location_after_save,
+                    flash: { error: @object.errors.full_messages.join(', ') })
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/return_reasons_controller.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class ReturnReasonsController < ResourceController
+    end
+  end
+end

data/app/controllers/spree/admin/root_controller.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class RootController < Spree::Admin::BaseController
+      skip_before_action :authorize_admin
+
+      def index
+        redirect_to admin_root_redirect_path
+      end
+
+      private
+
+      def admin_root_redirect_path
+        if can?(:display, Spree::Order) && can?(:admin, Spree::Order)
+          spree.admin_orders_path
+        elsif can?(:admin, :dashboards) && can?(:home, :dashboards)
+          spree.home_admin_dashboards_path
+        else
+          # Invoke the unauthorized redirect, which will ideally go to the login controller
+          # of the users chosen authorization implimentation. For devise this is /admin/login.
+          #
+          # This is done so devise redirects back to this controller, instead of the one specified
+          # below, so this controller can use the user that is required for the path to
+          # be calculated.
+          raise CanCan::AccessDenied
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/search_controller.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class SearchController < Spree::Admin::BaseController
+      respond_to :json
+      layout false
+
+      # TODO: Clean this up by moving searching out to user_class_extensions
+      # And then JSON building with something like Active Model Serializers
+      def users
+        if params[:ids]
+          # split here may be String#split or Array#split, so we must flatten the results
+          @users = Spree.user_class.where(id: params[:ids].split(',').flatten)
+        else
+          @users = Spree.user_class.ransack({
+            m: 'or',
+            email_start: params[:q],
+            addresses_firstname_start: params[:q],
+            addresses_lastname_start: params[:q]
+          }).result.limit(10)
+        end
+      end
+
+      def products
+        if params[:ids]
+          # split here may be String#split or Array#split, so we must flatten the results
+          @products = Spree::Product.where(id: params[:ids].split(",").flatten)
+        else
+          @products = Spree::Product.ransack(params[:q]).result
+        end
+
+        @products = @products.distinct.page(params[:page]).per(params[:per_page])
+        expires_in 15.minutes, public: true
+        headers['Surrogate-Control'] = "max-age=#{15.minutes}"
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/shipping_categories_controller.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class ShippingCategoriesController < ResourceController
+    end
+  end
+end

data/app/controllers/spree/admin/shipping_methods_controller.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class ShippingMethodsController < ResourceController
+      before_action :load_data, except: :index
+      before_action :set_shipping_category, only: [:create, :update]
+      before_action :set_zones, only: [:create, :update]
+
+      def destroy
+        @object.discard
+
+        flash[:success] = flash_message_for(@object, :successfully_removed)
+
+        respond_with(@object) do |format|
+          format.html { redirect_to collection_url }
+          format.js { render_js_for_destroy }
+        end
+      end
+
+      private
+
+      def set_shipping_category
+        return true if params["shipping_method"][:shipping_categories] == ""
+        @shipping_method.shipping_categories = Spree::ShippingCategory.where(id: params["shipping_method"][:shipping_categories])
+        @shipping_method.save
+        params[:shipping_method].delete(:shipping_categories)
+      end
+
+      def set_zones
+        return true if params["shipping_method"][:zones] == ""
+        @shipping_method.zones = Spree::Zone.where(id: params["shipping_method"][:zones])
+        @shipping_method.save
+        params[:shipping_method].delete(:zones)
+      end
+
+      def location_after_save
+        edit_admin_shipping_method_path(@shipping_method)
+      end
+
+      def load_data
+        @available_zones = Spree::Zone.order(:name)
+        @tax_categories = Spree::TaxCategory.order(:name)
+        @calculators = Rails.application.config.spree.calculators.shipping_methods
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/stock_items_controller.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class StockItemsController < ResourceController
+      class_attribute :variant_display_attributes
+      self.variant_display_attributes = [
+        { translation_key: :sku, attr_name: :sku },
+        { translation_key: :name, attr_name: :name }
+      ]
+
+      update.before :determine_backorderable
+      before_action :load_product, :load_stock_management_data, only: :index
+
+      private
+
+      def build_resource
+        variant = Spree::Variant.accessible_by(current_ability, :read).find(params[:variant_id])
+        stock_location = Spree::StockLocation.accessible_by(current_ability, :read).find(params[:stock_location_id])
+        stock_location.stock_movements.build(stock_movement_params).tap do |stock_movement|
+          stock_movement.originator = try_spree_current_user
+          stock_movement.stock_item = stock_location.set_up_stock_item(variant)
+        end
+      end
+
+      def permitted_resource_params
+        {}
+      end
+
+      def stock_movement_params
+        params.require(:stock_movement).permit(permitted_stock_movement_attributes)
+      end
+
+      def determine_backorderable
+        @stock_item.backorderable = params[:stock_item].present? && params[:stock_item][:backorderable].present?
+      end
+
+      def load_product
+        @product = Spree::Product.accessible_by(current_ability, :read).friendly.find(params[:product_slug]) if params[:product_slug]
+      end
+
+      def load_stock_management_data
+        @stock_locations = Spree::StockLocation.accessible_by(current_ability, :read)
+        @stock_item_stock_locations = params[:stock_location_id].present? ? @stock_locations.where(id: params[:stock_location_id]) : @stock_locations
+        @variant_display_attributes = self.class.variant_display_attributes
+        @variants = Spree::Config.variant_search_class.new(params[:variant_search_term], scope: variant_scope).results
+        @variants = @variants.includes(:images, stock_items: :stock_location, product: :variant_images)
+        @variants = @variants.includes(option_values: :option_type)
+        @variants = @variants.order(id: :desc).page(params[:page]).per(params[:per_page] || Spree::Config[:orders_per_page])
+      end
+
+      def variant_scope
+        scope = Spree::Variant.accessible_by(current_ability, :read)
+        scope = scope.where(product: @product) if @product
+        scope
+      end
+
+      def collection
+        []
+      end
+    end
+  end
+end