solidus_core 2.10.5 → 3.0.8

data/lib/spree/core/validators/email.rb

@@ -12,11 +12,11 @@ module Spree
   #     end
   #
   class EmailValidator < ActiveModel::EachValidator
-    EMAIL_REGEXP = /\A([^@\.]|[^@\.]([^@\s]*)[^@\.])@([^@\s]+\.)+[^@\s]+\z/
+    EMAIL_REGEXP = URI::MailTo::EMAIL_REGEXP
 
     def validate_each(record, attribute, value)
       unless EMAIL_REGEXP.match? value
-        record.errors.add(attribute, :invalid, { value: value }.merge!(options))
+        record.errors.add(attribute, :invalid, **{ value: value }.merge!(options))
       end
     end
   end

data/lib/spree/core/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Spree
-  VERSION = "2.10.5"
+  VERSION = "3.0.8"
 
   def self.solidus_version
     VERSION

data/lib/spree/core.rb

@@ -1,6 +1,14 @@
 # frozen_string_literal: true
 
-require 'rails/all'
+require "action_controller/railtie"
+require "action_mailer/railtie"
+require "action_view/railtie"
+require "active_job/railtie"
+require "active_model/railtie"
+require "active_record/railtie"
+require "active_storage/engine"
+require "sprockets/railtie"
+
 require 'acts_as_list'
 require 'awesome_nested_set'
 require 'cancan'
@@ -9,12 +17,10 @@ require 'kaminari/activerecord'
 require 'mail'
 require 'monetize'
 require 'paperclip'
-require 'paranoia'
 require 'ransack'
 require 'state_machines-activerecord'
 
 require 'spree/deprecation'
-require 'spree/paranoia_deprecations'
 
 # This is required because ActiveModel::Validations#invalid? conflicts with the
 # invalid state of a Payment. In the future this should be removed.
@@ -47,23 +53,9 @@ module Spree
 
   module Core
     class GatewayError < RuntimeError; end
-
-    include ActiveSupport::Deprecation::DeprecatedConstantAccessor
-    deprecate_constant 'DestroyWithOrdersError', ActiveRecord::DeleteRestrictionError, deprecator: Spree::Deprecation
   end
 end
 
-if Gem::Version.new(Rails.version) < Gem::Version.new('5.2')
-  warn <<~HEREDOC
-    Rails 5.1 (EOL) is deprecated and will not be supported anymore from the next Solidus version.
-    Please, upgrade to a more recent Rails version.
-
-    Read more on upgrading from Rails 5.1 to Rails 5.2 here:
-    https://guides.rubyonrails.org/upgrading_ruby_on_rails.html#upgrading-from-rails-5-1-to-rails-5-2
-
-  HEREDOC
-end
-
 require 'spree/core/version'
 
 require 'spree/core/active_merchant_dependencies'
@@ -72,7 +64,6 @@ require 'spree/core/environment_extension'
 require 'spree/core/environment/calculators'
 require 'spree/core/environment/promotions'
 require 'spree/core/environment'
-require 'spree/promo/environment'
 require 'spree/migrations'
 require 'spree/migration_helpers'
 require 'spree/event'
@@ -86,9 +77,9 @@ require 'spree/permitted_attributes'
 require 'spree/core/importer'
 require 'spree/core/permalinks'
 require 'spree/core/product_duplicator'
-require 'spree/core/current_store'
 require 'spree/core/controller_helpers/auth'
 require 'spree/core/controller_helpers/common'
+require 'spree/core/controller_helpers/current_host'
 require 'spree/core/controller_helpers/order'
 require 'spree/core/controller_helpers/payment_parameters'
 require 'spree/core/controller_helpers/pricing'
@@ -100,6 +91,7 @@ require 'spree/core/state_machines'
 require 'spree/core/stock_configuration'
 require 'spree/core/validators/email'
 require 'spree/permission_sets'
+require 'spree/user_class_handle'
 
 require 'spree/preferences/store'
 require 'spree/preferences/static_model_preferences'

data/lib/spree/deprecation.rb

@@ -3,7 +3,7 @@
 require 'active_support/deprecation'
 
 module Spree
-  Deprecation = ActiveSupport::Deprecation.new('3.0', 'Solidus')
+  Deprecation = ActiveSupport::Deprecation.new('4.0', 'Solidus')
 
   # This DeprecatedInstanceVariableProxy transforms instance variable to
   # deprecated instance variable.

data/lib/spree/encryptor.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Spree
+  # Spree::Encryptor is a thin wrapper around ActiveSupport::MessageEncryptor.
+  class Encryptor
+    # @param key [String] the 256 bits signature key
+    def initialize(key)
+      @crypt = ActiveSupport::MessageEncryptor.new(key)
+    end
+
+    # Encrypt a value
+    # @param value [String] the value to encrypt
+    # @return [String] the encrypted value
+    def encrypt(value)
+      @crypt.encrypt_and_sign(value)
+    end
+
+    # Decrypt an encrypted value
+    # @param encrypted_value [String] the value to decrypt
+    # @return [String] the decrypted value
+    def decrypt(encrypted_value)
+      @crypt.decrypt_and_verify(encrypted_value)
+    end
+  end
+end

data/lib/spree/event/adapters/active_support_notifications.rb

@@ -4,6 +4,8 @@ module Spree
   module Event
     module Adapters
       module ActiveSupportNotifications
+        class InvalidEventNameType < StandardError; end
+
         extend self
 
         def fire(event_name, opts)
@@ -29,6 +31,36 @@ module Spree
             memo[name] = listeners if listeners.present?
           end
         end
+
+        # Normalizes the event name according to this specific adapter rules.
+        #  When the event name is a string or a symbol, if the suffix is missing, then
+        #  it is added automatically.
+        #  When the event name is a regexp, due to the huge variability of regexps, adding
+        #  or not the suffix is developer's responsibility (if you don't, you will subscribe
+        #  to all internal rails events as well).
+        #  When the event type is not supported, an error is raised.
+        #
+        # @param [String, Symbol, Regexp] event_name the event name, with or without the
+        #  suffix (Spree::Config.events.suffix defaults to `.spree`).
+        def normalize_name(event_name)
+          case event_name
+          when Regexp
+            event_name
+          when String, Symbol
+            name = event_name.to_s
+            name.end_with?(suffix) ? name : [name, suffix].join
+          else
+            raise InvalidEventNameType, "Invalid event name type: #{event_name.class}"
+          end
+        end
+
+        # The suffix used for namespacing event names, defaults to
+        # `.spree`
+        #
+        # @see Spree::Event::Configuration#suffix
+        def suffix
+          Spree::Config.events.suffix
+        end
       end
     end
   end

data/lib/spree/event/configuration.rb

@@ -1,17 +1,17 @@
 # frozen_string_literal: true
 
-require 'spree/core/class_constantizer'
-
 module Spree
   module Event
     class Configuration
-      def subscribers
-        @subscribers ||= ::Spree::Core::ClassConstantizer::Set.new.tap do |set|
-          set << 'Spree::MailerSubscriber'
-        end
+      def subscriber_registry
+        @subscriber_registry ||= Spree::Event::SubscriberRegistry.new
       end
 
-      attr_writer :adapter, :suffix
+      attr_writer :adapter, :suffix, :autoload_subscribers
+
+      def autoload_subscribers
+        @autoload_subscribers.nil? ? true : !!@autoload_subscribers
+      end
 
       def adapter
         @adapter ||= Spree::Event::Adapters::ActiveSupportNotifications

data/lib/spree/event/subscriber.rb

@@ -19,13 +19,20 @@ module Spree
     #     end
     #   end
     #
-    #  EmailSender.subscribe!
+    #  # Optional, required only when the subscriber needs to be loaded manually.
+    #  #
+    #  # If Spree::Config.events.autoload_subscribers is set to `true` and the module
+    #  # file matches the pattern `app/subscribers/**/*_subscriber.rb` then it will
+    #  # be loaded automatically at boot and this line can be removed:
+    #  EmailSender.activate
     module Subscriber
       def self.included(base)
         base.extend base
 
         base.mattr_accessor :event_actions
         base.event_actions = {}
+
+        Spree::Event.subscriber_registry.register(base)
       end
 
       # Declares a method name in the including module that can be subscribed/unsubscribed
@@ -52,32 +59,27 @@ module Spree
       #     end
       #   end
       def event_action(method_name, event_name: nil)
-        mattr_accessor "#{method_name}_handler"
         event_actions[method_name] = (event_name || method_name).to_s
       end
 
-      # Subscribes all declared event actions to their events. Only actions that are subscribed
+      # Activates all declared event actions to their events. Only actions that are activated
       # will be called when their event fires.
       #
-      # @example subscribe all event actions for module 'EmailSender'
-      #    EmailSender.subscribe!
-      def subscribe!
-        unsubscribe!
-        event_actions.each do |event_action, event_name|
-          send "#{event_action}_handler=", Spree::Event.subscribe(event_name) { |event|
-            send event_action, event
-          }
-        end
+      # @example activate all event actions for module 'EmailSender'
+      #    EmailSender.activate
+      def activate
+        Spree::Event.subscriber_registry.activate_subscriber(self)
       end
 
-      # Unsubscribes all declared event actions from their events. This means that when an event
-      # fires then none of its unsubscribed event actions will be called.
-      # @example unsubscribe all event actions for module 'EmailSender'
-      #    EmailSender.unsubscribe!
-      def unsubscribe!
-        event_actions.keys.each do |event_action|
-          Spree::Event.unsubscribe send("#{event_action}_handler")
-        end
+      # Deactivates all declared event actions (or a single specific one) from their events.
+      # This means that when an event fires then none of its unsubscribed event actions will
+      # be called.
+      # @example deactivate all event actions for module 'EmailSender'
+      #    EmailSender.deactivate
+      # @example deactivate only order_finalized for module 'EmailSender'
+      #    EmailSender.deactivate(:order_finalized)
+      def deactivate(event_action_name = nil)
+        Spree::Event.subscriber_registry.deactivate_subscriber(self, event_action_name)
       end
     end
   end

data/lib/spree/event/subscriber_registry.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module Spree
+  module Event
+    class SubscriberRegistry
+      def initialize
+        @registry = {}
+        @semaphore = Mutex.new
+      end
+
+      def register(subscriber)
+        registry[subscriber.name] ||= {}
+      end
+
+      def activate_autoloadable_subscribers
+        require_subscriber_files
+        activate_all_subscribers
+      end
+
+      def activate_all_subscribers
+        registry.each_key { |subscriber_name| activate_subscriber(subscriber_name.constantize) }
+      end
+
+      def deactivate_all_subscribers
+        registry.each_key { |subscriber_name| deactivate_subscriber(subscriber_name.constantize) }
+      end
+
+      def activate_subscriber(subscriber)
+        return unless registry[subscriber.name]
+
+        subscriber.event_actions.each do |event_action, event_name|
+          @semaphore.synchronize do
+            unsafe_deactivate_subscriber(subscriber, event_action)
+
+            subscription = Spree::Event.subscribe(event_name) { |event| subscriber.send(event_action, event) }
+
+            # deprecated mappings, to be removed when Solidus 2.10 is not supported anymore:
+            if subscriber.respond_to?("#{event_action}_handler=")
+              subscriber.send("#{event_action}_handler=", subscription)
+            end
+
+            registry[subscriber.name][event_action] = subscription
+          end
+        end
+      end
+
+      def deactivate_subscriber(subscriber, event_action_name = nil)
+        @semaphore.synchronize do
+          unsafe_deactivate_subscriber(subscriber, event_action_name)
+        end
+      end
+
+      private
+
+      attr_reader :registry
+
+      # Loads all Solidus' core and application's event subscribers files.
+      # The latter are loaded automatically only when the preference
+      # Spree::Config.events.autoload_subscribers is set to a truthy value.
+      #
+      # Files must be placed under the directory `app/subscribers` and their
+      # name must end with `_subscriber.rb`.
+      #
+      # Loading the files has the side effect of adding their module to the
+      # list in Spree::Event.subscribers.
+      def require_subscriber_files
+        pattern = "app/subscribers/**/*_subscriber.rb"
+
+        # Load Solidus subscribers
+        # rubocop:disable Rails/DynamicFindBy
+        solidus_core_dir = Gem::Specification.find_by_name('solidus_core').gem_dir
+        # rubocop:enable Rails/DynamicFindBy
+        Dir.glob(File.join(solidus_core_dir, pattern)) { |c| require_dependency(c.to_s) }
+
+        # Load application subscribers, only when the flag is set to true:
+        if Spree::Config.events.autoload_subscribers
+          Rails.root.glob(pattern) { |c| require_dependency(c.to_s) }
+        end
+      end
+
+      def unsafe_deactivate_subscriber(subscriber, event_action_name = nil)
+        to_unsubscribe = Array.wrap(event_action_name || subscriber.event_actions.keys)
+
+        to_unsubscribe.each do |event_action|
+          if (subscription = registry.dig(subscriber.name, event_action))
+            Spree::Event.unsubscribe(subscription)
+
+            registry[subscriber.name].delete(event_action)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/spree/event.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative 'event/adapters/active_support_notifications'
+require_relative 'event/subscriber_registry'
 require_relative 'event/configuration'
 require_relative 'event/subscriber'
 
@@ -8,6 +9,8 @@ module Spree
   module Event
     extend self
 
+    delegate :activate_autoloadable_subscribers, :activate_all_subscribers, :deactivate_all_subscribers, to: :subscriber_registry
+
     # Allows to trigger events that can be subscribed using #subscribe. An
     # optional block can be passed that will be executed immediately. The
     # actual code implementation is delegated to the adapter.
@@ -21,7 +24,7 @@ module Spree
     #     @order.finalize!
     #   end
     def fire(event_name, opts = {})
-      adapter.fire name_with_suffix(event_name.to_s), opts do
+      adapter.fire normalize_name(event_name), opts do
         yield opts if block_given?
       end
     end
@@ -29,8 +32,15 @@ module Spree
     # Subscribe to an event with the given name. The provided block is executed
     # every time the subscribed event is fired.
     #
-    # @param [String] event_name the name of the event. The suffix ".spree"
-    #  will be added automatically if not present
+    # @param [String, Regexp] event_name the name of the event.
+    #  When String, the suffix ".spree" will be added automatically if not present,
+    #  when using the default adapter for ActiveSupportNotifications.
+    #  When Regexp, due to the unpredictability of all possible regexp combinations,
+    #  adding the suffix is developer's responsibility (if you don't, you will
+    #  subscribe to all notifications, including internal Rails notifications
+    #  as well).
+    #
+    # @see Spree::Event::Adapters::ActiveSupportNotifications#normalize_name
     #
     # @return a subscription object that can be used as reference in order
     #  to remove the subscription
@@ -43,7 +53,7 @@ module Spree
     #
     # @see Spree::Event#unsubscribe
     def subscribe(event_name, &block)
-      name = name_with_suffix(event_name)
+      name = normalize_name(event_name)
       listener_names << name
       adapter.subscribe(name, &block)
     end
@@ -61,7 +71,7 @@ module Spree
     # @example Unsubscribe an event by name with explicit prefix
     #   Spree::Event.unsubscribe('order_finalized.spree')
     def unsubscribe(subscriber)
-      name_or_subscriber = subscriber.is_a?(String) ? name_with_suffix(subscriber) : subscriber
+      name_or_subscriber = subscriber.is_a?(String) ? normalize_name(subscriber) : subscriber
       adapter.unsubscribe(name_or_subscriber)
     end
 
@@ -90,24 +100,16 @@ module Spree
       Spree::Config.events.adapter
     end
 
-    # The suffix used for namespacing Solidus events, defaults to
-    # `.spree`
-    #
-    # @see Spree::Event::Configuration#suffix
-    def suffix
-      Spree::Config.events.suffix
-    end
-
     # @!attribute [r] subscribers
-    #   @return [Array<Spree::Event::Subscriber>] A list of subscribers used to support class reloading for Spree::Event::Subscriber instances
-    def subscribers
-      Spree::Config.events.subscribers
+    #   @return <Spree::Event::SubscriberRegistry> The registry for supporting class reloading for Spree::Event::Subscriber instances
+    def subscriber_registry
+      Spree::Config.events.subscriber_registry
     end
 
     private
 
-    def name_with_suffix(name)
-      name.end_with?(suffix) ? name : [name, suffix].join
+    def normalize_name(name)
+     adapter.normalize_name(name)
     end
 
     def listener_names

data/lib/spree/i18n.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
 require 'i18n'
-require 'active_support/core_ext/array/extract_options'
-require 'action_view'
 
 module Spree
   def self.i18n_available_locales
@@ -11,29 +9,9 @@ module Spree
     end
   end
 
-  class TranslationHelperWrapper # :nodoc:
-    include ActionView::Helpers::TranslationHelper
-  end
-
   # This value is used as a count for the pluralization helpers related to I18n
   # ex: Spree::Order.model_name.human(count: Spree::I18N_GENERIC_PLURAL)
   # Related to Solidus issue #1164, this is needed to avoid problems with
   # some pluralization calculators
   I18N_GENERIC_PLURAL = 2.1
-
-  class << self
-    # Add spree namespace and delegate to Rails TranslationHelper for some nice
-    # extra functionality. e.g return reasonable strings for missing translations
-
-    def translate(key, options = {})
-      Spree::Deprecation.warn <<-WARN.squish
-        Spree.t & Spree.translate have been deprecated.
-        Instead use I18n.t('spree.your_translation_key')
-      WARN
-      options[:scope] = [:spree, *options[:scope]]
-      TranslationHelperWrapper.new.translate(key, options)
-    end
-
-    alias_method :t, :translate
-  end
 end

data/lib/spree/mailer_previews/carton_preview.rb

@@ -5,7 +5,8 @@ module Spree
     class CartonPreview < ActionMailer::Preview
       def shipped
         carton = Carton.joins(:orders).last
-        raise "Your database needs at one shipped order with a carton to render this preview" unless carton
+        raise "Your database needs at least one shipped order with a carton to render this preview" unless carton
+
         Spree::Config.carton_shipped_email_class.shipped_email(order: carton.orders.first, carton: carton)
       end
     end

data/lib/spree/money.rb

@@ -6,7 +6,6 @@ module Spree
   class Money
     include Comparable
     DifferentCurrencyError = Class.new(StandardError)
-    RUBY_NUMERIC_STRING = /\A-?\d+(\.\d+)?\z/
 
     class <<self
       attr_accessor :default_formatting_rules
@@ -37,15 +36,8 @@ module Spree
         @money = amount
       else
         currency = (options[:currency] || Spree::Config[:currency])
-        if amount.to_s =~ RUBY_NUMERIC_STRING
-          @money = Monetize.from_string(amount, currency)
-        else
-          @money = Spree::Money.parse_to_money(amount, currency)
-          Spree::Deprecation.warn <<-WARN.squish, caller
-            Spree::Money was initialized with #{amount.inspect}, which will not be supported in the future.
-            Instead use Spree::Money.new(#{@money.to_s.inspect}, options) or Spree::Money.parse(#{amount.inspect})
-          WARN
-        end
+
+        @money = Monetize.from_string(amount, currency)
       end
       @options = Spree::Money.default_formatting_rules.merge(options)
     end
@@ -80,14 +72,7 @@ module Spree
     def to_html(options = { html_wrap: true })
       output = format(options)
       # Maintain compatibility by checking html option renamed to html_wrap.
-      if options[:html] || options[:html] == false
-        Spree::Deprecation.warn <<-WARN.squish, caller
-          Spree::Money#to_html called with Spree::Money#to_html(html: #{options[:html].inspect}),
-          which will not be supported in the future.
-          Instead use :html_wrap e.g. Spree::Money#to_html(html_wrap: #{options[:html].inspect})
-        WARN
-      end
-      if options[:html_wrap] || options[:html]
+      if options[:html_wrap]
         output = output.html_safe
       end
       output

data/lib/spree/permission_sets/configuration_display.rb

@@ -5,20 +5,20 @@ module Spree
     class ConfigurationDisplay < PermissionSets::Base
       def activate!
           can [:edit, :admin], :general_settings
-          can [:display, :admin], Spree::TaxCategory
-          can [:display, :admin], Spree::TaxRate
-          can [:display, :admin], Spree::Zone
-          can [:display, :admin], Spree::Country
-          can [:display, :admin], Spree::State
-          can [:display, :admin], Spree::PaymentMethod
-          can [:display, :admin], Spree::Taxonomy
-          can [:display, :admin], Spree::ShippingMethod
-          can [:display, :admin], Spree::ShippingCategory
-          can [:display, :admin], Spree::StockLocation
-          can [:display, :admin], Spree::StockMovement
-          can [:display, :admin], Spree::RefundReason
-          can [:display, :admin], Spree::ReimbursementType
-          can [:display, :admin], Spree::ReturnReason
+          can [:read, :admin], Spree::TaxCategory
+          can [:read, :admin], Spree::TaxRate
+          can [:read, :admin], Spree::Zone
+          can [:read, :admin], Spree::Country
+          can [:read, :admin], Spree::State
+          can [:read, :admin], Spree::PaymentMethod
+          can [:read, :admin], Spree::Taxonomy
+          can [:read, :admin], Spree::ShippingMethod
+          can [:read, :admin], Spree::ShippingCategory
+          can [:read, :admin], Spree::StockLocation
+          can [:read, :admin], Spree::StockMovement
+          can [:read, :admin], Spree::RefundReason
+          can [:read, :admin], Spree::ReimbursementType
+          can [:read, :admin], Spree::ReturnReason
       end
     end
   end

data/lib/spree/permission_sets/default_customer.rb

@@ -4,11 +4,11 @@ module Spree
   module PermissionSets
     class DefaultCustomer < PermissionSets::Base
       def activate!
-        can :display, Country
-        can :display, OptionType
-        can :display, OptionValue
+        can :read, Country
+        can :read, OptionType
+        can :read, OptionValue
         can :create, Order
-        can [:read, :update], Order, Order.where(user: user) do |order, token|
+        can [:show, :update], Order, Order.where(user: user) do |order, token|
           order.user == user || (order.guest_token.present? && token == order.guest_token)
         end
         cannot :update, Order do |order|
@@ -17,20 +17,20 @@ module Spree
         can :create, ReturnAuthorization do |return_authorization|
           return_authorization.order.user == user
         end
-        can [:display, :update], CreditCard, user_id: user.id
-        can :display, Product
-        can :display, ProductProperty
-        can :display, Property
+        can [:read, :update], CreditCard, user_id: user.id
+        can :read, Product
+        can :read, ProductProperty
+        can :read, Property
         can :create, Spree.user_class
-        can [:read, :update, :update_email], Spree.user_class, id: user.id
-        can :display, State
-        can :display, StockItem, stock_location: { active: true }
-        can :display, StockLocation, active: true
-        can :display, Taxon
-        can :display, Taxonomy
+        can [:show, :update, :update_email], Spree.user_class, id: user.id
+        can :read, State
+        can :read, StockItem, stock_location: { active: true }
+        can :read, StockLocation, active: true
+        can :read, Taxon
+        can :read, Taxonomy
         can [:save_in_address_book, :remove_from_address_book], Spree.user_class, id: user.id
-        can [:display, :view_out_of_stock], Variant
-        can :display, Zone
+        can [:read, :view_out_of_stock], Variant
+        can :read, Zone
       end
     end
   end

data/lib/spree/permission_sets/order_display.rb

@@ -4,17 +4,17 @@ module Spree
   module PermissionSets
     class OrderDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin, :edit, :cart], Spree::Order
-        can [:display, :admin], Spree::Payment
-        can [:display, :admin], Spree::Shipment
-        can [:display, :admin], Spree::Adjustment
-        can [:display, :admin], Spree::LineItem
-        can [:display, :admin], Spree::ReturnAuthorization
-        can [:display, :admin], Spree::CustomerReturn
-        can [:display, :admin], Spree::OrderCancellations
-        can [:display, :admin], Spree::Reimbursement
-        can [:display, :admin], Spree::ReturnItem
-        can [:display, :admin], Spree::Refund
+        can [:read, :admin, :edit, :cart], Spree::Order
+        can [:read, :admin], Spree::Payment
+        can [:read, :admin], Spree::Shipment
+        can [:read, :admin], Spree::Adjustment
+        can [:read, :admin], Spree::LineItem
+        can [:read, :admin], Spree::ReturnAuthorization
+        can [:read, :admin], Spree::CustomerReturn
+        can [:read, :admin], Spree::OrderCancellations
+        can [:read, :admin], Spree::Reimbursement
+        can [:read, :admin], Spree::ReturnItem
+        can [:read, :admin], Spree::Refund
       end
     end
   end