solidus_core 2.10.1 → 2.11.2

data/lib/spree/permission_sets/configuration_display.rb

@@ -5,20 +5,20 @@ module Spree
     class ConfigurationDisplay < PermissionSets::Base
       def activate!
           can [:edit, :admin], :general_settings
-          can [:display, :admin], Spree::TaxCategory
-          can [:display, :admin], Spree::TaxRate
-          can [:display, :admin], Spree::Zone
-          can [:display, :admin], Spree::Country
-          can [:display, :admin], Spree::State
-          can [:display, :admin], Spree::PaymentMethod
-          can [:display, :admin], Spree::Taxonomy
-          can [:display, :admin], Spree::ShippingMethod
-          can [:display, :admin], Spree::ShippingCategory
-          can [:display, :admin], Spree::StockLocation
-          can [:display, :admin], Spree::StockMovement
-          can [:display, :admin], Spree::RefundReason
-          can [:display, :admin], Spree::ReimbursementType
-          can [:display, :admin], Spree::ReturnReason
+          can [:read, :admin], Spree::TaxCategory
+          can [:read, :admin], Spree::TaxRate
+          can [:read, :admin], Spree::Zone
+          can [:read, :admin], Spree::Country
+          can [:read, :admin], Spree::State
+          can [:read, :admin], Spree::PaymentMethod
+          can [:read, :admin], Spree::Taxonomy
+          can [:read, :admin], Spree::ShippingMethod
+          can [:read, :admin], Spree::ShippingCategory
+          can [:read, :admin], Spree::StockLocation
+          can [:read, :admin], Spree::StockMovement
+          can [:read, :admin], Spree::RefundReason
+          can [:read, :admin], Spree::ReimbursementType
+          can [:read, :admin], Spree::ReturnReason
       end
     end
   end

data/lib/spree/permission_sets/default_customer.rb

@@ -4,11 +4,11 @@ module Spree
   module PermissionSets
     class DefaultCustomer < PermissionSets::Base
       def activate!
-        can :display, Country
-        can :display, OptionType
-        can :display, OptionValue
+        can :read, Country
+        can :read, OptionType
+        can :read, OptionValue
         can :create, Order
-        can [:read, :update], Order, Order.where(user: user) do |order, token|
+        can [:show, :update], Order, Order.where(user: user) do |order, token|
           order.user == user || (order.guest_token.present? && token == order.guest_token)
         end
         cannot :update, Order do |order|
@@ -17,20 +17,20 @@ module Spree
         can :create, ReturnAuthorization do |return_authorization|
           return_authorization.order.user == user
         end
-        can [:display, :update], CreditCard, user_id: user.id
-        can :display, Product
-        can :display, ProductProperty
-        can :display, Property
+        can [:read, :update], CreditCard, user_id: user.id
+        can :read, Product
+        can :read, ProductProperty
+        can :read, Property
         can :create, Spree.user_class
-        can [:read, :update, :update_email], Spree.user_class, id: user.id
-        can :display, State
-        can :display, StockItem, stock_location: { active: true }
-        can :display, StockLocation, active: true
-        can :display, Taxon
-        can :display, Taxonomy
+        can [:show, :update, :update_email], Spree.user_class, id: user.id
+        can :read, State
+        can :read, StockItem, stock_location: { active: true }
+        can :read, StockLocation, active: true
+        can :read, Taxon
+        can :read, Taxonomy
         can [:save_in_address_book, :remove_from_address_book], Spree.user_class, id: user.id
-        can [:display, :view_out_of_stock], Variant
-        can :display, Zone
+        can [:read, :view_out_of_stock], Variant
+        can :read, Zone
       end
     end
   end

data/lib/spree/permission_sets/order_display.rb

@@ -4,17 +4,17 @@ module Spree
   module PermissionSets
     class OrderDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin, :edit, :cart], Spree::Order
-        can [:display, :admin], Spree::Payment
-        can [:display, :admin], Spree::Shipment
-        can [:display, :admin], Spree::Adjustment
-        can [:display, :admin], Spree::LineItem
-        can [:display, :admin], Spree::ReturnAuthorization
-        can [:display, :admin], Spree::CustomerReturn
-        can [:display, :admin], Spree::OrderCancellations
-        can [:display, :admin], Spree::Reimbursement
-        can [:display, :admin], Spree::ReturnItem
-        can [:display, :admin], Spree::Refund
+        can [:read, :admin, :edit, :cart], Spree::Order
+        can [:read, :admin], Spree::Payment
+        can [:read, :admin], Spree::Shipment
+        can [:read, :admin], Spree::Adjustment
+        can [:read, :admin], Spree::LineItem
+        can [:read, :admin], Spree::ReturnAuthorization
+        can [:read, :admin], Spree::CustomerReturn
+        can [:read, :admin], Spree::OrderCancellations
+        can [:read, :admin], Spree::Reimbursement
+        can [:read, :admin], Spree::ReturnItem
+        can [:read, :admin], Spree::Refund
       end
     end
   end

data/lib/spree/permission_sets/order_management.rb

@@ -4,7 +4,7 @@ module Spree
   module PermissionSets
     class OrderManagement < PermissionSets::Base
       def activate!
-        can :display, Spree::ReimbursementType
+        can :read, Spree::ReimbursementType
         can :manage, Spree::Order
         can :manage, Spree::Payment
         can :manage, Spree::Shipment

data/lib/spree/permission_sets/product_display.rb

@@ -4,15 +4,15 @@ module Spree
   module PermissionSets
     class ProductDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin, :edit], Spree::Product
-        can [:display, :admin], Spree::Image
-        can [:display, :admin], Spree::Variant
-        can [:display, :admin], Spree::OptionValue
-        can [:display, :admin], Spree::ProductProperty
-        can [:display, :admin], Spree::OptionType
-        can [:display, :admin], Spree::Property
-        can [:display, :admin], Spree::Taxonomy
-        can [:display, :admin], Spree::Taxon
+        can [:read, :admin, :edit], Spree::Product
+        can [:read, :admin], Spree::Image
+        can [:read, :admin], Spree::Variant
+        can [:read, :admin], Spree::OptionValue
+        can [:read, :admin], Spree::ProductProperty
+        can [:read, :admin], Spree::OptionType
+        can [:read, :admin], Spree::Property
+        can [:read, :admin], Spree::Taxonomy
+        can [:read, :admin], Spree::Taxon
       end
     end
   end

data/lib/spree/permission_sets/promotion_display.rb

@@ -4,11 +4,11 @@ module Spree
   module PermissionSets
     class PromotionDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin, :edit], Spree::Promotion
-        can [:display, :admin], Spree::PromotionRule
-        can [:display, :admin], Spree::PromotionAction
-        can [:display, :admin], Spree::PromotionCategory
-        can [:display, :admin], Spree::PromotionCode
+        can [:read, :admin, :edit], Spree::Promotion
+        can [:read, :admin], Spree::PromotionRule
+        can [:read, :admin], Spree::PromotionAction
+        can [:read, :admin], Spree::PromotionCategory
+        can [:read, :admin], Spree::PromotionCode
       end
     end
   end

data/lib/spree/permission_sets/restricted_stock_display.rb

@@ -4,8 +4,8 @@ module Spree
   module PermissionSets
     class RestrictedStockDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin], Spree::StockItem, stock_location_id: location_ids
-        can :display, Spree::StockLocation, id: location_ids
+        can [:read, :admin], Spree::StockItem, stock_location_id: location_ids
+        can :read, Spree::StockLocation, id: location_ids
       end
 
       private

data/lib/spree/permission_sets/restricted_stock_management.rb

@@ -5,7 +5,7 @@ module Spree
     class RestrictedStockManagement < PermissionSets::Base
       def activate!
         can :manage, Spree::StockItem, stock_location_id: location_ids
-        can :display, Spree::StockLocation, id: location_ids
+        can :read, Spree::StockLocation, id: location_ids
       end
 
       private

data/lib/spree/permission_sets/stock_display.rb

@@ -4,8 +4,8 @@ module Spree
   module PermissionSets
     class StockDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin], Spree::StockItem
-        can :display, Spree::StockLocation
+        can [:read, :admin], Spree::StockItem
+        can :read, Spree::StockLocation
       end
     end
   end

data/lib/spree/permission_sets/stock_management.rb

@@ -5,7 +5,7 @@ module Spree
     class StockManagement < PermissionSets::Base
       def activate!
         can :manage, Spree::StockItem
-        can :display, Spree::StockLocation
+        can :read, Spree::StockLocation
       end
     end
   end

data/lib/spree/permission_sets/user_display.rb

@@ -4,9 +4,9 @@ module Spree
   module PermissionSets
     class UserDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin, :edit, :addresses, :orders, :items], Spree.user_class
-        can [:display, :admin], Spree::StoreCredit
-        can :display, Spree::Role
+        can [:read, :admin, :edit, :addresses, :orders, :items], Spree.user_class
+        can [:read, :admin], Spree::StoreCredit
+        can :read, Spree::Role
       end
     end
   end

data/lib/spree/permission_sets/user_management.rb

@@ -4,7 +4,7 @@ module Spree
   module PermissionSets
     class UserManagement < PermissionSets::Base
       def activate!
-        can [:admin, :display, :create, :update, :save_in_address_book, :remove_from_address_book, :addresses, :orders, :items], Spree.user_class
+        can [:admin, :read, :create, :update, :save_in_address_book, :remove_from_address_book, :addresses, :orders, :items], Spree.user_class
 
         # Note: This does not work with accessible_by.
         # See https://github.com/solidusio/solidus/pull/1263
@@ -15,9 +15,10 @@ module Spree
           user.spree_roles.none?
         end
 
-        cannot [:delete, :destroy], Spree.user_class
+        cannot :destroy, Spree.user_class
         can :manage, Spree::StoreCredit
-        can :display, Spree::Role
+        can :manage, :api_key
+        can :read, Spree::Role
       end
     end
   end

data/lib/spree/permitted_attributes.rb

@@ -8,7 +8,10 @@ module Spree
     ATTRIBUTES = [
       :address_attributes,
       :address_book_attributes,
-      :checkout_attributes,
+      :checkout_address_attributes,
+      :checkout_delivery_attributes,
+      :checkout_payment_attributes,
+      :checkout_confirm_attributes,
       :credit_card_update_attributes,
       :customer_return_attributes,
       :image_attributes,
@@ -36,7 +39,7 @@ module Spree
     mattr_reader(*ATTRIBUTES)
 
     @@address_attributes = [
-      :id, :firstname, :lastname, :first_name, :last_name,
+      :id, :name, :firstname, :lastname, :first_name, :last_name,
       :address1, :address2, :city, :country_id, :state_id,
       :zipcode, :phone, :state_name, :country_iso, :alternative_phone, :company,
       country: [:iso, :name, :iso3, :iso_name],
@@ -45,10 +48,6 @@ module Spree
 
     @@address_book_attributes = address_attributes + [:default]
 
-    @@checkout_attributes = [
-      :coupon_code, :email, :special_instructions, :use_billing
-    ]
-
     @@credit_card_update_attributes = [
       :month, :year, :expiry, :first_name, :last_name, :name
     ]
@@ -70,7 +69,7 @@ module Spree
     @@product_properties_attributes = [:property_name, :value, :position]
 
     @@product_attributes = [
-      :name, :description, :available_on, :permalink, :meta_description,
+      :name, :description, :available_on, :discontinue_on, :permalink, :meta_description,
       :meta_keywords, :price, :sku, :deleted_at,
       :option_values_hash, :weight, :height, :width, :depth,
       :shipping_category_id, :tax_category_id,
@@ -91,7 +90,7 @@ module Spree
       :number, :month, :year, :expiry, :verification_value,
       :first_name, :last_name, :cc_type, :gateway_customer_profile_id,
       :gateway_payment_profile_id, :last_digits, :name, :encrypted_data,
-      :existing_card_id, :wallet_payment_source_id
+      :existing_card_id, :wallet_payment_source_id, address_attributes: address_attributes
     ]
 
     @@stock_item_attributes = [:variant, :stock_location, :backorderable, :variant_id]
@@ -108,7 +107,8 @@ module Spree
 
     @@store_attributes = [:name, :url, :seo_title, :meta_keywords,
                           :meta_description, :default_currency,
-                          :mail_from_address, :cart_tax_country_iso]
+                          :mail_from_address, :cart_tax_country_iso,
+                          :bcc_email]
 
     @@taxonomy_attributes = [:name]
 
@@ -129,5 +129,75 @@ module Spree
       :product_id, :product, :option_values_attributes, :price,
       :weight, :height, :width, :depth, :sku, :cost_currency, option_value_ids: [], options: [:name, :value]
     ]
+
+    @@checkout_address_attributes = [
+      :use_billing,
+      :email,
+      bill_address_attributes: address_attributes,
+      ship_address_attributes: address_attributes
+    ]
+
+    @@checkout_delivery_attributes = [
+      :special_instructions,
+      shipments_attributes: shipment_attributes
+    ]
+
+    @@checkout_payment_attributes = [
+      :coupon_code,
+      payments_attributes: payment_attributes + [
+        source_attributes: source_attributes
+      ]
+    ]
+
+    @@checkout_confirm_attributes = []
+
+    def self.checkout_attributes
+      Spree::Deprecation.warn <<-WARN.squish, caller
+        checkout_attributes is deprecated, please use the permitted
+        attributes set for the specific step that needs to be updated.
+
+        E.g. permitted_checkout_address_attributes
+      WARN
+
+      CheckoutAdditionalAttributes.new(
+        checkout_address_attributes +
+        checkout_delivery_attributes +
+        checkout_payment_attributes +
+        checkout_confirm_attributes
+      )
+    end
+  end
+
+  class CheckoutAdditionalAttributes < Array
+    def <<(*attributes)
+      super
+
+      inject_attributes_to_all_steps(attributes, :<<)
+    end
+
+    def push(*attributes)
+      super
+
+      inject_attributes_to_all_steps(attributes, :push)
+    end
+    alias append push
+
+    def prepend(*attributes)
+      super
+
+      inject_attributes_to_all_steps(attributes, :prepend)
+    end
+    alias unshift prepend
+
+    private
+
+    def inject_attributes_to_all_steps(attributes, method)
+      attributes.each do |attribute|
+        PermittedAttributes.checkout_address_attributes.send(method, attribute)
+        PermittedAttributes.checkout_delivery_attributes.send(method, attribute)
+        PermittedAttributes.checkout_payment_attributes.send(method, attribute)
+        PermittedAttributes.checkout_confirm_attributes.send(method, attribute)
+      end
+    end
   end
 end

data/lib/spree/preferences/preferable.rb

@@ -141,11 +141,13 @@ module Spree
 
       private
 
-      def convert_preference_value(value, type)
+      def convert_preference_value(value, type, preference_encryptor = nil)
         return nil if value.nil?
         case type
         when :string, :text
           value.to_s
+        when :encrypted_string
+          preference_encryptor.encrypt(value.to_s)
         when :password
           value.to_s
         when :decimal
@@ -158,8 +160,7 @@ module Spree
           value.to_i
         when :boolean
           if !value ||
-             value == 0 ||
-             value =~ /\A(f|false|0)\Z/i ||
+             value.to_s =~ /\A(f|false|0|^)\Z/i ||
              (value.respond_to?(:empty?) && value.empty?)
             false
           else

data/lib/spree/preferences/preferable_class_methods.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'spree/encryptor'
+
 module Spree::Preferences
   module PreferableClassMethods
     DEFAULT_ADMIN_FORM_PREFERENCE_TYPES = %i(
@@ -9,6 +11,7 @@ module Spree::Preferences
       password
       string
       text
+      encrypted_string
     )
 
     def defined_preferences
@@ -16,7 +19,13 @@ module Spree::Preferences
     end
 
     def preference(name, type, options = {})
-      options.assert_valid_keys(:default)
+      options.assert_valid_keys(:default, :encryption_key)
+
+      if type == :encrypted_string
+        preference_encryptor = preference_encryptor(options)
+        options[:default] = preference_encryptor.encrypt(options[:default])
+      end
+
       default = options[:default]
       default = ->{ options[:default] } unless default.is_a?(Proc)
 
@@ -34,13 +43,15 @@ module Spree::Preferences
       # cache_key will be nil for new objects, then if we check if there
       # is a pending preference before going to default
       define_method preference_getter_method(name) do
-        preferences.fetch(name) do
+        value = preferences.fetch(name) do
           default.call
         end
+        value = preference_encryptor.decrypt(value) if preference_encryptor.present?
+        value
       end
 
       define_method preference_setter_method(name) do |value|
-        value = convert_preference_value(value, type)
+        value = convert_preference_value(value, type, preference_encryptor)
         preferences[name] = value
 
         # If this is an activerecord object, we need to inform
@@ -72,6 +83,14 @@ module Spree::Preferences
       "preferred_#{name}_type".to_sym
     end
 
+    def preference_encryptor(options)
+      key = options[:encryption_key] ||
+            ENV['SOLIDUS_PREFERENCES_MASTER_KEY'] ||
+            Rails.application.credentials.secret_key_base
+
+      Spree::Encryptor.new(key)
+    end
+
     # List of preference types allowed as form fields in the Solidus admin
     #
     # Overwrite this method in your class that includes +Spree::Preferable+