solidus_backend_devise_token_auth 2.8.0.alpha.2

data/spec/controllers/spree/admin/orders_controller_spec.rb

@@ -0,0 +1,408 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'cancan'
+
+describe Spree::Admin::OrdersController, type: :controller do
+  let!(:store) { create(:store) }
+  context "with authorization" do
+    stub_authorization!
+
+    before do
+      request.env["HTTP_REFERER"] = "http://localhost:3000"
+    end
+
+    let(:order) do
+      mock_model(
+        Spree::Order,
+        completed?:      true,
+        total:           100,
+        number:          'R123456789',
+        all_adjustments: adjustments,
+        ship_address: mock_model(Spree::Address)
+      )
+    end
+
+    let(:adjustments) { double('adjustments') }
+
+    before do
+      allow(Spree::Order).to receive_message_chain(:includes, find_by!: order)
+      allow(order).to receive_messages(contents: Spree::OrderContents.new(order))
+    end
+
+    context "#approve" do
+      it "approves an order" do
+        expect(order.contents).to receive(:approve).with(user: controller.try_spree_current_user)
+        put :approve, params: { id: order.number }
+        expect(flash[:success]).to eq I18n.t('spree.order_approved')
+      end
+    end
+
+    context "#cancel" do
+      it "cancels an order" do
+        expect(order).to receive(:canceled_by).with(controller.try_spree_current_user)
+        put :cancel, params: { id: order.number }
+        expect(flash[:success]).to eq I18n.t('spree.order_canceled')
+      end
+    end
+
+    context "#resume" do
+      it "resumes an order" do
+        expect(order).to receive(:resume!)
+        put :resume, params: { id: order.number }
+        expect(flash[:success]).to eq I18n.t('spree.order_resumed')
+      end
+    end
+
+    context "#resend" do
+      let(:order) { create(:completed_order_with_totals) }
+      it "resends order email" do
+        mail_message = double "Mail::Message"
+        expect(Spree::OrderMailer).to receive(:confirm_email).with(order, true).and_return mail_message
+        expect(mail_message).to receive :deliver_later
+        post :resend, params: { id: order.number }
+        expect(flash[:success]).to eq I18n.t('spree.order_email_resent')
+      end
+    end
+
+    context "pagination" do
+      it "can page through the orders" do
+        get :index, params: { page: 2, per_page: 10 }
+        expect(assigns[:orders].offset_value).to eq(10)
+        expect(assigns[:orders].limit_value).to eq(10)
+      end
+    end
+
+    # Test for https://github.com/spree/spree/issues/3346
+    context "#new" do
+      let(:user) { create(:user) }
+      before do
+        allow(controller).to receive_messages spree_current_user: user
+      end
+
+      it "imports a new order and sets the current user as a creator" do
+        expect(Spree::Core::Importer::Order).to receive(:import)
+          .with(nil, hash_including(created_by_id: controller.try_spree_current_user.id))
+          .and_return(order)
+        get :new
+      end
+
+      it "sets frontend_viewable to false" do
+        expect(Spree::Core::Importer::Order).to receive(:import)
+          .with(nil, hash_including(frontend_viewable: false ))
+          .and_return(order)
+        get :new
+      end
+
+      it "should associate the order with a store" do
+        expect(Spree::Core::Importer::Order).to receive(:import)
+          .with(user, hash_including(store_id: controller.current_store.id))
+          .and_return(order)
+        get :new, params: { user_id: user.id }
+      end
+
+      context "when a user_id is passed as a parameter" do
+        let(:user)  { mock_model(Spree.user_class) }
+        before { allow(Spree.user_class).to receive_messages find_by: user }
+
+        it "imports a new order and assigns the user to the order" do
+          expect(Spree::Core::Importer::Order).to receive(:import)
+            .with(user, hash_including(created_by_id: controller.try_spree_current_user.id))
+            .and_return(order)
+          get :new, params: { user_id: user.id }
+        end
+      end
+
+      it "should redirect to cart" do
+        get :new
+        expect(response).to redirect_to(spree.cart_admin_order_path(Spree::Order.last))
+      end
+    end
+
+    # Regression test for https://github.com/spree/spree/issues/3684
+    # Rendering a form should under no circumstance mutate the order
+    context "#edit" do
+      it "does not refresh rates if the order is completed" do
+        allow(order).to receive_messages completed?: true
+        expect(order).not_to receive :refresh_shipment_rates
+        get :edit, params: { id: order.number }
+      end
+
+      it "does not refresh the rates if the order is incomplete" do
+        allow(order).to receive_messages completed?: false
+        expect(order).not_to receive :refresh_shipment_rates
+        get :edit, params: { id: order.number }
+      end
+
+      context "when order does not have a ship address" do
+        before do
+          allow(order).to receive_messages ship_address: nil
+        end
+
+        context 'when order_bill_address_used is true' do
+          before { Spree::Config[:order_bill_address_used] = true }
+
+          it "should redirect to the customer details page" do
+            get :edit, params: { id: order.number }
+            expect(response).to redirect_to(spree.edit_admin_order_customer_path(order))
+          end
+        end
+
+        context 'when order_bill_address_used is false' do
+          before { Spree::Config[:order_bill_address_used] = false }
+
+          it "should redirect to the customer details page" do
+            get :edit, params: { id: order.number }
+            expect(response).to redirect_to(spree.edit_admin_order_customer_path(order))
+          end
+        end
+      end
+    end
+
+    describe '#advance' do
+      subject do
+        put :advance, params: { id: order.number }
+      end
+
+      context 'when incomplete' do
+        before do
+          allow(order).to receive(:completed?).and_return(false, true)
+          allow(order).to receive(:next).and_return(true, false)
+        end
+
+        context 'when successful' do
+          before { allow(order).to receive(:can_complete?).and_return(true) }
+
+          it 'messages and redirects' do
+            subject
+            expect(flash[:success]).to eq I18n.t('spree.order_ready_for_confirm')
+            expect(response).to redirect_to(spree.confirm_admin_order_path(order))
+          end
+        end
+
+        context 'when unsuccessful' do
+          before do
+            allow(order).to receive(:can_complete?).and_return(false)
+            allow(order).to receive(:errors).and_return(double(full_messages: ['failed']))
+          end
+
+          it 'messages and redirects' do
+            subject
+            expect(flash[:error]).to eq order.errors.full_messages
+            expect(response).to redirect_to(spree.confirm_admin_order_path(order))
+          end
+        end
+      end
+
+      context 'when already completed' do
+        before { allow(order).to receive_messages completed?: true }
+
+        it 'messages and redirects' do
+          subject
+          expect(flash[:notice]).to eq I18n.t('spree.order_already_completed')
+          expect(response).to redirect_to(spree.edit_admin_order_path(order))
+        end
+      end
+    end
+
+    context '#confirm' do
+      subject do
+        get :confirm, params: { id: order.number }
+      end
+
+      context 'when in confirm' do
+        before { allow(order).to receive_messages completed?: false, can_complete?: true }
+
+        it 'renders the confirm page' do
+          subject
+          expect(response.status).to eq 200
+          expect(response).to render_template(:confirm)
+        end
+      end
+
+      context 'when before confirm' do
+        before { allow(order).to receive_messages completed?: false, can_complete?: false }
+
+        it 'renders the confirm_advance template (to allow refreshing of the order)' do
+          subject
+          expect(response.status).to eq 200
+          expect(response).to render_template(:confirm_advance)
+        end
+      end
+
+      context 'when already completed' do
+        before { allow(order).to receive_messages completed?: true }
+
+        it 'redirects to edit' do
+          subject
+          expect(response).to redirect_to(spree.edit_admin_order_path(order))
+        end
+      end
+    end
+
+    context "#complete" do
+      subject do
+        put :complete, params: { id: order.number }
+      end
+
+      context 'when successful' do
+        before { allow(order).to receive(:complete!) }
+
+        it 'completes the order' do
+          expect(order).to receive(:complete!)
+          subject
+        end
+
+        it 'messages and redirects' do
+          subject
+          expect(flash[:success]).to eq I18n.t('spree.order_completed')
+          expect(response).to redirect_to(spree.edit_admin_order_path(order))
+        end
+      end
+
+      context 'with an StateMachines::InvalidTransition error' do
+        let(:order) { create(:order) }
+
+        it 'messages and redirects' do
+          subject
+          expect(response).to redirect_to(spree.confirm_admin_order_path(order))
+          expect(flash[:error].to_s).to include("Cannot transition state via :complete from :cart")
+        end
+      end
+
+      context 'insufficient stock to complete the order' do
+        before do
+          expect(order).to receive(:complete!).and_raise Spree::Order::InsufficientStock
+        end
+
+        it 'messages and redirects' do
+          subject
+          expect(response).to redirect_to(spree.cart_admin_order_path(order))
+          expect(flash[:error].to_s).to eq I18n.t('spree.insufficient_stock_for_order')
+        end
+      end
+    end
+
+    # Test for https://github.com/spree/spree/issues/3919
+    context "search" do
+      let(:user) { create(:user) }
+
+      before do
+        allow(controller).to receive_messages spree_current_user: user
+        user.spree_roles << Spree::Role.find_or_create_by(name: 'admin')
+
+        create_list(:completed_order_with_totals, 2)
+        expect(Spree::Order.count).to eq 2
+      end
+
+      context 'by line_items_variant_id_in' do
+        it "does not display duplicated results" do
+          get :index, params: { q: {
+            line_items_variant_id_in: Spree::Order.first.variants.map(&:id)
+            } }
+          expect(assigns[:orders].size).to eq 1
+        end
+      end
+
+      context 'by email' do
+        it "does not display duplicated results" do
+          get :index, params: { q: {
+            email_start: Spree::Order.first.email
+            } }
+          expect(assigns[:orders].size).to eq 1
+          expect(assigns[:orders][0].email).to eq(Spree::Order.first.email)
+        end
+      end
+    end
+
+    context "#not_finalized_adjustments" do
+      let(:order) { create(:order) }
+      let!(:finalized_adjustment) { create(:adjustment, finalized: true, adjustable: order, order: order) }
+
+      it "changes all the finalized adjustments to unfinalized" do
+        post :unfinalize_adjustments, params: { id: order.number }
+        expect(finalized_adjustment.reload.finalized).to eq(false)
+      end
+
+      it "sets the flash success message" do
+        post :unfinalize_adjustments, params: { id: order.number }
+        expect(flash[:success]).to eql('All adjustments successfully unfinalized!')
+      end
+
+      it "redirects back" do
+        post :unfinalize_adjustments, params: { id: order.number }
+        expect(response).to redirect_to(spree.admin_order_adjustments_path(order))
+      end
+    end
+
+    context "#finalize_adjustments" do
+      let(:order) { create(:order) }
+      let!(:not_finalized_adjustment) { create(:adjustment, finalized: false, adjustable: order, order: order) }
+
+      it "changes all the unfinalized adjustments to finalized" do
+        post :finalize_adjustments, params: { id: order.number }
+        expect(not_finalized_adjustment.reload.finalized).to eq(true)
+      end
+
+      it "sets the flash success message" do
+        post :finalize_adjustments, params: { id: order.number }
+        expect(flash[:success]).to eql('All adjustments successfully finalized!')
+      end
+
+      it "redirects back" do
+        post :finalize_adjustments, params: { id: order.number }
+        expect(response).to redirect_to(spree.admin_order_adjustments_path(order))
+      end
+    end
+  end
+
+  context '#authorize_admin' do
+    let!(:user) { create(:user) }
+    let!(:order) { create(:completed_order_with_totals, number: 'R987654321') }
+
+    before do
+      allow(controller).to receive_messages spree_current_user: user
+    end
+
+    it 'should grant access to users with an admin role' do
+      user.spree_roles << Spree::Role.find_or_create_by(name: 'admin')
+      get :index
+      expect(response).to render_template :index
+    end
+
+    it 'should deny access to users without an admin role' do
+      allow(user).to receive_messages has_spree_role?: false
+      get :index
+      expect(response).to redirect_to('/unauthorized')
+    end
+
+    context 'with only permissions on Order' do
+      stub_authorization! do |_ability|
+        can [:admin, :manage], Spree::Order, number: 'R987654321'
+      end
+
+      it 'should restrict returned order(s) on index when using OrderSpecificAbility' do
+        number = order.number
+
+        3.times { create(:completed_order_with_totals) }
+        expect(Spree::Order.complete.count).to eq 4
+
+        allow(user).to receive_messages has_spree_role?: false
+        get :index
+        expect(response).to render_template :index
+        expect(assigns['orders'].size).to eq 1
+        expect(assigns['orders'].first.number).to eq number
+      end
+    end
+  end
+
+  context "order number not given" do
+    stub_authorization!
+
+    it "raise active record not found" do
+      expect {
+        get :edit, params: { id: 0 }
+      }.to raise_error ActiveRecord::RecordNotFound
+    end
+  end
+end

data/spec/controllers/spree/admin/payment_methods_controller_spec.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+module Spree
+  class GatewayWithPassword < PaymentMethod
+    preference :password, :string, default: "password"
+  end
+
+  describe Admin::PaymentMethodsController, type: :controller do
+    stub_authorization!
+
+    let(:payment_method) { GatewayWithPassword.create!(name: "Bogus", preferred_password: "haxme") }
+
+    context "GatewayWithPassword" do
+      before do
+        allow(Rails.application.config.spree).to receive(:payment_methods).and_return([GatewayWithPassword])
+      end
+
+      # regression test for https://github.com/spree/spree/issues/2094
+      it "does not clear password on update" do
+        expect(payment_method.preferred_password).to eq("haxme")
+        put :update, params: { id: payment_method.id, payment_method: { type: payment_method.class.to_s, preferred_password: "" } }
+        expect(response).to redirect_to(spree.edit_admin_payment_method_path(payment_method))
+
+        payment_method.reload
+        expect(payment_method.preferred_password).to eq("haxme")
+      end
+    end
+
+    context "tries to save invalid payment" do
+      it "doesn't break, responds nicely" do
+        post :create, params: { payment_method: { name: "", type: "Spree::PaymentMethod::BogusCreditCard" } }
+      end
+    end
+
+    it "can create a payment method of a valid type" do
+      expect {
+        post :create, params: { payment_method: { name: "Test Method", type: "Spree::PaymentMethod::BogusCreditCard" } }
+      }.to change(Spree::PaymentMethod, :count).by(1)
+
+      expect(response).to be_redirect
+      expect(response).to redirect_to spree.edit_admin_payment_method_path(assigns(:payment_method))
+    end
+
+    it "can not create a payment method of an invalid type" do
+      expect {
+        post :create, params: { payment_method: { name: "Invalid Payment Method", type: "Spree::InvalidType" } }
+      }.to change(Spree::PaymentMethod, :count).by(0)
+
+      expect(response).to be_redirect
+      expect(response).to redirect_to spree.new_admin_payment_method_path
+    end
+
+    describe "#index" do
+      subject { get :index }
+
+      let!(:first_method) { GatewayWithPassword.create! name: "First", preferred_password: "1235" }
+      let!(:second_method) { GatewayWithPassword.create! name: "Second", preferred_password: "1235" }
+
+      before do
+        second_method.move_to_top
+      end
+
+      it { is_expected.to be_successful }
+      it { is_expected.to render_template "index"  }
+
+      it "respects the order of payment methods by position" do
+        subject
+        expect(assigns(:payment_methods).to_a).to eql([second_method, first_method])
+      end
+    end
+
+    describe "#update" do
+      # Regression test for https://github.com/solidusio/solidus/issues/2789
+      let(:params) do
+        {
+          id: payment_method.id,
+          payment_method: {
+            name: 'Check',
+            type: 'Spree::PaymentMethod::Check'
+          }
+        }
+      end
+
+      it 'updates the resource' do
+        put :update, params: params
+
+        expect(response).to redirect_to(spree.edit_admin_payment_method_path(payment_method))
+        response_payment_method = Spree::PaymentMethod.find(payment_method.id)
+        expect(response_payment_method.name).to eql('Check')
+      end
+    end
+  end
+end

data/spec/controllers/spree/admin/payments_controller_spec.rb

@@ -0,0 +1,194 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+module Spree
+  module Admin
+    describe PaymentsController, type: :controller do
+      before do
+        allow(controller).to receive_messages spree_current_user: user
+      end
+
+      let(:user) { create(:user, :admin) }
+      let(:order) { create(:order) }
+
+      describe '#create' do
+        context "with a valid credit card" do
+          let(:order) { create(:order_with_line_items, state: "payment") }
+          let(:payment_method) { create(:credit_card_payment_method, available_to_admin: true, available_to_users: false) }
+          let(:attributes) do
+            {
+              order_id: order.number,
+              card: "new",
+              payment: {
+                amount: order.total,
+                payment_method_id: payment_method.id.to_s,
+                source_attributes: {
+                  name: "Test User",
+                  number: "4111 1111 1111 1111",
+                  expiry: "09 / #{Time.current.year + 1}",
+                verification_value: "123"
+                }
+              }
+            }
+          end
+
+          before do
+            post :create, params: attributes
+          end
+
+          it "should process payment correctly" do
+            expect(order.payments.count).to eq(1)
+            expect(order.payments.last.state).to eq 'checkout'
+            expect(response).to redirect_to(spree.admin_order_payments_path(order))
+            expect(order.reload.state).to eq('confirm')
+          end
+
+          context 'with credit card address fields' do
+            let(:address) { build(:address) }
+
+            let(:attributes) do
+              attrs = super()
+              attrs[:payment][:source_attributes][:address_attributes] = address_attributes
+              attrs
+            end
+
+            let(:address_attributes) do
+              {
+                'firstname' => address.firstname,
+                'address1' => address.address1,
+                'city' => address.city,
+                'country_id' => address.country_id,
+                'state_id' => address.state_id,
+                'zipcode' => address.zipcode,
+                'phone' => address.phone
+              }
+            end
+
+            it 'associates the address' do
+              expect(order.payments.count).to eq(1)
+              credit_card = order.payments.last.source
+              expect(credit_card.address.attributes).to include(address_attributes)
+            end
+          end
+        end
+      end
+
+      describe '#new' do
+        # Regression test for https://github.com/spree/spree/issues/3233
+        context "with a backend payment method" do
+          context "and the payment method is active" do
+            before do
+              @payment_method = create(:check_payment_method, available_to_admin: true)
+            end
+
+            it "loads the payment method" do
+              get :new, params: { order_id: order.number }
+              expect(response.status).to eq(200)
+              expect(assigns[:payment_methods]).to include(@payment_method)
+            end
+          end
+
+          context "and the payment method is inactive" do
+            before do
+              @payment_method = create(:check_payment_method, available_to_admin: true, active: false)
+            end
+
+            it "does not load the payment method" do
+              get :new, params: { order_id: order.number }
+              expect(response.status).to eq(200)
+              expect(assigns[:payment_methods]).to be_empty
+            end
+          end
+        end
+      end
+
+      describe '#index' do
+        context "order has billing address" do
+          before do
+            order.bill_address = create(:address)
+            order.save!
+          end
+
+          context "order does not have payments" do
+            it "redirect to new payments page" do
+              get :index, params: { amount: 100, order_id: order.number }
+              expect(response).to redirect_to(spree.new_admin_order_payment_path(order))
+            end
+          end
+
+          context "order has payments" do
+            before do
+              order.payments << create(:payment, amount: order.total, order: order, state: 'completed')
+            end
+
+            it "shows the payments page" do
+              get :index, params: { amount: 100, order_id: order.number }
+              expect(response.code).to eq "200"
+            end
+          end
+        end
+
+        context "order does not have a billing address" do
+          before do
+            order.bill_address = nil
+            order.save
+          end
+
+          it "should redirect to the customer details page" do
+            get :index, params: { amount: 100, order_id: order.number }
+            expect(response).to redirect_to(spree.edit_admin_order_customer_path(order))
+          end
+        end
+      end
+
+      describe '#fire' do
+        describe 'authorization' do
+          let(:payment) { create(:payment, state: 'checkout') }
+          let(:order) { payment.order }
+
+          context 'the user is authorized' do
+            class CaptureAllowedAbility
+              include CanCan::Ability
+
+              def initialize(_user)
+                can :capture, Spree::Payment
+              end
+            end
+
+            before do
+              Spree::Ability.register_ability(CaptureAllowedAbility)
+            end
+
+            it 'allows the action' do
+              expect {
+                post(:fire, params: { id: payment.to_param, e: 'capture', order_id: order.to_param })
+              }.to change { payment.reload.state }.from('checkout').to('completed')
+            end
+
+            context 'the user is not authorized' do
+              class CaptureNotAllowedAbility
+                include CanCan::Ability
+
+                def initialize(_user)
+                  cannot :capture, Spree::Payment
+                end
+              end
+
+              before do
+                Spree::Ability.register_ability(CaptureNotAllowedAbility)
+              end
+
+              it 'does not allow the action' do
+                expect {
+                  post(:fire, params: { id: payment.to_param, e: 'capture', order_id: order.to_param })
+                }.to_not change { payment.reload.state }
+                expect(flash[:error]).to eq('Authorization Failure')
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end