solidus_core 3.0.0 → 4.5.1

data/app/models/spree/payment_method.rb

@@ -13,6 +13,7 @@ module Spree
   #
   class PaymentMethod < Spree::Base
     include Spree::Preferences::Persistable
+    class UnsupportedPaymentMethod < StandardError; end
 
     preference :server, :string, default: 'test'
     preference :test_mode, :boolean, default: true
@@ -41,6 +42,8 @@ module Spree
 
     include Spree::Preferences::StaticallyConfigurable
 
+    self.allowed_ransackable_attributes = %w[name description]
+
     # Custom ModelName#human implementation to ensure we don't refer to
     # subclasses as just "PaymentMethod"
     class ModelName < ActiveModel::Name
@@ -60,6 +63,16 @@ module Spree
       def model_name
         ModelName.new(self, Spree)
       end
+
+      def find_sti_class(type_name)
+        super(type_name)
+      rescue ActiveRecord::SubclassNotFound
+        raise UnsupportedPaymentMethod, "Found invalid payment type '#{type_name}'.\n"\
+          "This may happen after switching payment service provider, when payment methods "\
+          "reference old types that are not supported any more.\n"\
+          "If that is the case, consider running 'rake payment_method:deactivate_unsupported_payment_methods' "\
+          "to fix the issue."
+      end
     end
 
     # Represents the gateway of this payment method
@@ -162,16 +175,22 @@ module Spree
     # Return +false+ or +nil+ if the void is not possible anymore - because it was already processed by the bank.
     # Solidus will refund the amount of the payment in this case.
     #
-    # @return [ActiveMerchant::Billing::Response] with +true+ if the void succeeded
-    # @return [ActiveMerchant::Billing::Response] with +false+ if the void failed
-    # @return [false] if it can't be voided at this time
-    #
-    def try_void(_payment)
-      raise ::NotImplementedError,
-        "You need to implement `try_void` for #{self.class.name}. In that " \
-        'return a ActiveMerchant::Billing::Response object if the void succeeds '\
-        'or `false|nil` if the void is not possible anymore. ' \
-        'Solidus will refund the amount of the payment then.'
+    # This default implementation will void the payment if void succeeds,
+    # otherwise it returns false.
+    #
+    # @api public
+    # @param payment [Spree::Payment] the payment to void
+    # @return [ActiveMerchant::Billing::Response|FalseClass]
+    def try_void(payment)
+      void_attempt = if payment.payment_method.payment_profiles_supported?
+        void(payment.transaction_id, payment.source, { originator: payment })
+      else
+        void(payment.transaction_id, { originator: payment })
+      end
+
+      return void_attempt if void_attempt.success?
+
+      false
     end
 
     def store_credit?

data/app/models/spree/payment_source.rb

@@ -7,7 +7,11 @@ module Spree
     belongs_to :payment_method, optional: true
 
     has_many :payments, as: :source
-    has_many :wallet_payment_sources, class_name: 'Spree::WalletPaymentSource', as: :payment_source, inverse_of: :payment_source
+    has_many :wallet_payment_sources,
+      class_name: 'Spree::WalletPaymentSource',
+      as: :payment_source,
+      inverse_of: :payment_source,
+      dependent: :destroy
 
     attr_accessor :imported
 

data/app/models/spree/permission_set.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Spree
+  class PermissionSet < Spree::Base
+    has_many :role_permissions
+    has_many :roles, through: :role_permissions
+    validates :name, :set, :privilege, :category, presence: true
+    scope :display_permissions, -> { where(privilege: "display") }
+    scope :management_permissions, -> { where(privilege: "management") }
+  end
+end

data/app/models/spree/permission_sets/base.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # This is the base class used for crafting permission sets.
+    #
+    # This is used by {Spree::RoleConfiguration} when adding custom behavior to {Spree::Ability}.
+    # See one of the subclasses for example structure such as {Spree::PermissionSets::UserDisplay}
+    #
+    # @see Spree::RoleConfiguration
+    # @see Spree::PermissionSets
+    class Base
+      # @param ability [CanCan::Ability]
+      #   The ability that will be extended with the current permission set.
+      #   The ability passed in must respond to #user
+      def initialize(ability)
+        @ability = ability
+      end
+
+      # Activate permissions on the ability. Put your can and cannot statements here.
+      # Must be overridden by subclasses
+      def activate!
+        raise NotImplementedError.new
+      end
+
+      # Provide the permission set privilege in the form of a :symbol.
+      # Must be overridden by subclasses.
+      def self.privilege
+        raise NotImplementedError, "Subclass #{name} must define a privilege using `self.privilege :symbol`"
+      end
+
+      # Provide the permission set category in the form of a :symbol.
+      # Must be overridden by subclasses.
+      def self.category
+        raise NotImplementedError, "Subclass #{name} must define a category using `self.category :symbol`"
+      end
+
+      private
+
+      attr_reader :ability
+
+      delegate :can, :cannot, :user, to: :ability
+    end
+  end
+end

data/app/models/spree/permission_sets/configuration_display.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Read-only permissions for e-commerce settings.
+    #
+    # Roles with this permission will be able to view information, also from the admin
+    # panel, about:
+    #
+    # - Tax categories
+    # - Tax rates
+    # - Zones
+    # - Countries
+    # - States
+    # - Payment methods
+    # - Taxonomies
+    # - Shipping methods
+    # - Shipping categories
+    # - Stock locations
+    # - Stock movements
+    # - Refund reasons
+    # - Reimbursement types
+    # - Return reasons
+    class ConfigurationDisplay < PermissionSets::Base
+      class << self
+        def privilege
+          :display
+        end
+
+        def category
+          :configuration
+        end
+      end
+
+      def activate!
+        can [:read, :admin], Spree::TaxCategory
+        can [:read, :admin], Spree::TaxRate
+        can [:read, :admin], Spree::Zone
+        can [:read, :admin], Spree::Country
+        can [:read, :admin], Spree::State
+        can [:read, :admin], Spree::PaymentMethod
+        can [:read, :admin], Spree::Taxonomy
+        can [:read, :admin], Spree::ShippingMethod
+        can [:read, :admin], Spree::ShippingCategory
+        can [:read, :admin], Spree::StockLocation
+        can [:read, :admin], Spree::StockMovement
+        can [:read, :admin], Spree::RefundReason
+        can [:read, :admin], Spree::ReimbursementType
+        can [:read, :admin], Spree::ReturnReason
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/configuration_management.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Read and write permissions for e-commerce settings.
+    #
+    # Roles with this permission set will have full control over:
+    #
+    # - Tax categories
+    # - Tax rates
+    # - Zones
+    # - Countries
+    # - States
+    # - Payment methods
+    # - Taxonomies
+    # - Shipping methods
+    # - Shipping categories
+    # - Stock locations
+    # - Stock movements
+    # - Refund reasons
+    # - Reimbursement types
+    # - Return reasons
+    class ConfigurationManagement < PermissionSets::Base
+      class << self
+        def privilege
+          :management
+        end
+
+        def category
+          :configuration
+        end
+      end
+
+      def activate!
+        can :manage, Spree::TaxCategory
+        can :manage, Spree::TaxRate
+        can :manage, Spree::Zone
+        can :manage, Spree::Country
+        can :manage, Spree::State
+        can :manage, Spree::PaymentMethod
+        can :manage, Spree::Taxonomy
+        can :manage, Spree::ShippingMethod
+        can :manage, Spree::ShippingCategory
+        can :manage, Spree::StockLocation
+        can :manage, Spree::StockMovement
+        can :manage, Spree::RefundReason
+        can :manage, Spree::ReimbursementType
+        can :manage, Spree::ReturnReason
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/dashboard_display.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Permissions for viewing the admin dashboard.
+    #
+    # Roles with this permission set will be able to view the admin dashboard,
+    # which may or not contain sensitive information depending on
+    # customizations.
+    class DashboardDisplay < PermissionSets::Base
+      class << self
+        def privilege
+          :other
+        end
+
+        def category
+          :dashboard_display
+        end
+      end
+
+      def activate!
+          Spree.deprecator.warn "The #{self.class.name} module is deprecated. " \
+            "If you still use dashboards, please copy all controllers and views from #{self.class.name} to your application."
+          can [:admin, :home], :dashboards
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/default_customer.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Permissions for e-commerce customers.
+    #
+    # This permission set is always added to the `:default` role, which in turn
+    # is the default role for all users without any explicit roles.
+    #
+    # Permissions include reading and updating orders when the ability's user
+    # has been assigned as the order's user, unless the order is already
+    # completed. Same is true for guest checkout orders.
+    #
+    # It grants read-only permissions for the following resources typically used
+    # during a checkout process:
+    #
+    # - Zones
+    # - Countries
+    # - States
+    # - Taxons
+    # - Taxonomies
+    # - Products
+    # - Properties
+    # - Product properties
+    # - Variants
+    # - Option types
+    # - Option values
+    # - Stock items
+    # - Stock locations
+    #
+    # Abilities with this role can also create refund authorizations for orders
+    # with the same user, as well as reading and updating the user record and
+    # their associated cards.
+    class DefaultCustomer < PermissionSets::Base
+      class << self
+        def privilege
+          :other
+        end
+
+        def category
+          :default_customer
+        end
+      end
+
+      def activate!
+        can :read, Country
+        can :read, OptionType
+        can :read, OptionValue
+        can :create, Order do |order, token|
+          # same user, or both nil
+          order.user == user ||
+            # guest checkout order
+            order.email.present? ||
+            # via API, just like with show and update
+            (order.guest_token.present? && token == order.guest_token)
+        end
+        can [:show, :update], Order, Order.where(user:) do |order, token|
+          order.user == user || (order.guest_token.present? && token == order.guest_token)
+        end
+        cannot :update, Order do |order|
+          order.completed?
+        end
+        can :create, ReturnAuthorization do |return_authorization|
+          return_authorization.order.user == user
+        end
+        can [:read, :update], CreditCard, user_id: user.id
+        can :read, Product
+        can :read, ProductProperty
+        can :read, Property
+        can :create, Spree.user_class
+        can [:show, :update, :update_email], Spree.user_class, id: user.id
+        can :read, State
+        can :read, StockItem, stock_location: { active: true }
+        can :read, StockLocation, active: true
+        can :read, Taxon
+        can :read, Taxonomy
+        can [:save_in_address_book, :remove_from_address_book], Spree.user_class, id: user.id
+        can [:read, :view_out_of_stock], Variant
+        can :read, Zone
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/order_display.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Read permissions for orders.
+    #
+    # This permission set allows users to view all related information about
+    # orders, also from the admin panel, including:
+    #
+    # - Orders
+    # - Payments
+    # - Shipments
+    # - Adjustments
+    # - Line items
+    # - Return authorizations
+    # - Customer returns
+    # - Order cancellations
+    # - Reimbursements
+    # - Return items
+    # - Refunds
+    #
+    # However, it does not allow any modifications to be made to any of these
+    # resources.
+    class OrderDisplay < PermissionSets::Base
+      class << self
+        def privilege
+          :display
+        end
+
+        def category
+          :order
+        end
+      end
+
+      def activate!
+        can [:read, :admin, :edit, :cart], Spree::Order
+        can [:read, :admin], Spree::Payment
+        can [:read, :admin], Spree::Shipment
+        can [:read, :admin], Spree::Adjustment
+        can [:read, :admin], Spree::LineItem
+        can [:read, :admin], Spree::ReturnAuthorization
+        can [:read, :admin], Spree::CustomerReturn
+        can [:read, :admin], Spree::OrderCancellations
+        can [:read, :admin], Spree::Reimbursement
+        can [:read, :admin], Spree::ReturnItem
+        can [:read, :admin], Spree::Refund
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/order_management.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Full permissions for order management.
+    #
+    # This permission set grants full control over all order and related resources,
+    # including:
+    #
+    # - Orders
+    # - Payments
+    # - Shipments
+    # - Adjustments
+    # - Line items
+    # - Return authorizations
+    # - Customer returns
+    # - Order cancellations
+    # - Reimbursements
+    # - Return items
+    # - Refunds
+    #
+    # It also allows reading reimbursement types, but not modifying them.
+    class OrderManagement < PermissionSets::Base
+      class << self
+        def privilege
+          :management
+        end
+
+        def category
+          :order
+        end
+      end
+
+      def activate!
+        can :read, Spree::ReimbursementType
+        can :manage, Spree::Order
+        can :manage, Spree::Payment
+        can :manage, Spree::Shipment
+        can :manage, Spree::Adjustment
+        can :manage, Spree::LineItem
+        can :manage, Spree::ReturnAuthorization
+        can :manage, Spree::CustomerReturn
+        can :manage, Spree::OrderCancellations
+        can :manage, Spree::Reimbursement
+        can :manage, Spree::ReturnItem
+        can :manage, Spree::Refund
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/product_display.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Read-only permissions for products.
+    #
+    # This permission set allows users to view all related information about
+    # products, also from the admin panel, including:
+    #
+    # - Products
+    # - Images
+    # - Variants
+    # - Option values
+    # - Product properties
+    # - Option types
+    # - Properties
+    # - Taxonomies
+    # - Taxons
+    class ProductDisplay < PermissionSets::Base
+      class << self
+        def privilege
+          :display
+        end
+
+        def category
+          :product
+        end
+      end
+
+      def activate!
+        can [:read, :admin, :edit], Spree::Product
+        can [:read, :admin], Spree::Image
+        can [:read, :admin], Spree::Variant
+        can [:read, :admin], Spree::OptionValue
+        can [:read, :admin], Spree::ProductProperty
+        can [:read, :admin], Spree::OptionType
+        can [:read, :admin], Spree::Property
+        can [:read, :admin], Spree::Taxonomy
+        can [:read, :admin], Spree::Taxon
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/product_management.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Full permissions for product management.
+    #
+    # This permission set grants full control over all product and related resources,
+    # including:
+    #
+    # - Products
+    # - Images
+    # - Variants
+    # - Option values
+    # - Product properties
+    # - Option types
+    # - Properties
+    # - Taxonomies
+    # - Taxons
+    # - Classifications
+    # - Prices
+    class ProductManagement < PermissionSets::Base
+      class << self
+        def privilege
+          :management
+        end
+
+        def category
+          :product
+        end
+      end
+
+      def activate!
+        can :manage, Spree::Classification
+        can :manage, Spree::Image
+        can :manage, Spree::OptionType
+        can :manage, Spree::OptionValue
+        can :manage, Spree::Price
+        can :manage, Spree::Product
+        can :manage, Spree::ProductProperty
+        can :manage, Spree::Property
+        can :manage, Spree::Taxon
+        can :manage, Spree::Taxonomy
+        can :manage, Spree::Variant
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/restricted_stock_display.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Read permissions for stock limited to allowed locations.
+    #
+    # This permission set allows users to view information about stock items and
+    # locations, both of them limited to locations they have access to.
+    # Permissions are also granted for the admin panel for items.
+    class RestrictedStockDisplay < PermissionSets::Base
+      class << self
+        def privilege
+          :display
+        end
+
+        def category
+          :restricted_stock
+        end
+      end
+
+      def activate!
+        can [:read, :admin], Spree::StockItem, stock_location_id: location_ids
+        can :read, Spree::StockLocation, id: location_ids
+      end
+
+      private
+
+      def location_ids
+        @ids ||= user.stock_locations.pluck(:id)
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/restricted_stock_management.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Full permissions for stock management limited to allowed locations.
+    #
+    # This permission set grants full control over all stock items a user has
+    # access to their locations. Those locations are also readable by the
+    # corresponding ability.
+    class RestrictedStockManagement < PermissionSets::Base
+      class << self
+        def privilege
+          :management
+        end
+
+        def category
+          :restricted_stock
+        end
+      end
+
+      def activate!
+        can :manage, Spree::StockItem, stock_location_id: location_ids
+        can :read, Spree::StockLocation, id: location_ids
+      end
+
+      private
+
+      def location_ids
+        @ids ||= user.stock_locations.pluck(:id)
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/stock_display.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Read-only permissions for stock.
+    #
+    # This permission set allows users to view information about stock items
+    # (also from the admin panel) and stock locations.
+    class StockDisplay < PermissionSets::Base
+      class << self
+        def privilege
+          :display
+        end
+
+        def category
+          :stock
+        end
+      end
+
+      def activate!
+        can [:read, :admin], Spree::StockItem
+        can :read, Spree::StockLocation
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/stock_management.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Full permissions for stock management.
+    #
+    # This permission set grants full control over all stock items and read
+    # access to locations.
+    class StockManagement < PermissionSets::Base
+      class << self
+        def privilege
+          :management
+        end
+
+        def category
+          :stock
+        end
+      end
+
+      def activate!
+        can :manage, Spree::StockItem
+        can :read, Spree::StockLocation
+      end
+    end
+  end
+end