solidus_core_devise_token_auth 2.8.0.alpha.0

data/lib/spree/money.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+require 'money'
+require 'monetize'
+require 'active_support/core_ext/string/output_safety'
+
+module Spree
+  # Spree::Money is a relatively thin wrapper around Monetize which handles
+  # formatting via Spree::Config.
+  class Money
+    include Comparable
+    DifferentCurrencyError = Class.new(StandardError)
+    RUBY_NUMERIC_STRING = /\A-?\d+(\.\d+)?\z/
+
+    class <<self
+      attr_accessor :default_formatting_rules
+
+      def parse(amount, currency = Spree::Config[:currency])
+        new(parse_to_money(amount, currency))
+      end
+
+      # @api private
+      def parse_to_money(amount, currency)
+        ::Monetize.parse(amount, currency)
+      end
+    end
+    self.default_formatting_rules = {
+      # Ruby money currently has this as false, which is wrong for the vast
+      # majority of locales.
+      sign_before_symbol: true
+    }
+
+    attr_reader :money
+
+    delegate :cents, :currency, :to_d, :zero?, to: :money
+
+    # @param amount [Money, #to_s] the value of the money object
+    # @param options [Hash] the default options for formatting the money object See #format
+    def initialize(amount, options = {})
+      if amount.is_a?(::Money)
+        @money = amount
+      else
+        currency = (options[:currency] || Spree::Config[:currency])
+        if amount.to_s =~ RUBY_NUMERIC_STRING
+          @money = Monetize.from_string(amount, currency)
+        else
+          @money = Spree::Money.parse_to_money(amount, currency)
+          Spree::Deprecation.warn <<-WARN.squish, caller
+            Spree::Money was initialized with #{amount.inspect}, which will not be supported in the future.
+            Instead use Spree::Money.new(#{@money.to_s.inspect}, options) or Spree::Money.parse(#{amount.inspect})
+          WARN
+        end
+      end
+      @options = Spree::Money.default_formatting_rules.merge(options)
+    end
+
+    # @return [String] the value of this money object formatted according to
+    #   its options
+    def to_s
+      format
+    end
+
+    # @param options [Hash, String] the options for formatting the money object
+    # @option options [Boolean] with_currency when true, show the currency
+    # @option options [Boolean] no_cents when true, round to the closest dollar
+    # @option options [String] decimal_mark the mark for delimiting the
+    #   decimals
+    # @option options [String, false, nil] thousands_separator the character to
+    #   delimit powers of 1000, if one is desired, otherwise false or nil
+    # @option options [Boolean] sign_before_symbol when true the sign of the
+    #   value comes before the currency symbol
+    # @option options [:before, :after] symbol_position the position of the
+    #   currency symbol
+    # @return [String] the value of this money object formatted according to
+    #   its options
+    def format(options = {})
+      @money.format(@options.merge(options))
+    end
+
+    # @note If you pass in options, ensure you pass in the html: true as well.
+    # @param options [Hash] additional formatting options
+    # @return [String] the value of this money object formatted according to
+    #   its options and any additional options, by default as html.
+    def to_html(options = { html: true })
+      output = format(options)
+      if options[:html]
+        # 1) prevent blank, breaking spaces
+        # 2) prevent escaping of HTML character entities
+        output = output.sub(" ", "&nbsp;").html_safe
+      end
+      output
+    end
+
+    # (see #to_s)
+    def as_json(*)
+      to_s
+    end
+
+    def <=>(other)
+      if !other.respond_to?(:money)
+        raise TypeError, "Can't compare #{other.class} to Spree::Money"
+      end
+      if currency != other.currency
+        # By default, ::Money will try to run a conversion on `other.money` and
+        # try a comparison on that. We do not want any currency conversion to
+        # take place so we'll catch this here and raise an error.
+        raise(
+          DifferentCurrencyError,
+          "Can't compare #{currency} with #{other.currency}"
+        )
+      end
+      @money <=> other.money
+    end
+
+    # Delegates comparison to the internal ruby money instance.
+    #
+    # @see http://www.rubydoc.info/gems/money/Money/Arithmetic#%3D%3D-instance_method
+    def ==(other)
+      raise TypeError, "Can't compare #{other.class} to Spree::Money" if !other.respond_to?(:money)
+      @money == other.money
+    end
+
+    def -(other)
+      raise TypeError, "Can't subtract #{other.class} to Spree::Money" if !other.respond_to?(:money)
+      self.class.new(@money - other.money)
+    end
+
+    def +(other)
+      raise TypeError, "Can't add #{other.class} to Spree::Money" if !other.respond_to?(:money)
+      self.class.new(@money + other.money)
+    end
+  end
+end

data/lib/spree/paranoia_deprecations.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Spree
+  module ParanoiaDeprecations
+    def paranoia_destroy
+      Spree::Deprecation.warn <<-WARN.strip_heredoc, caller
+        Calling #destroy (or #paranoia_destroy) on a #{self.class} currently performs a soft-destroy using the paranoia gem.
+        In Solidus 3.0, paranoia will be removed, and this will perform a HARD destroy instead. To continue soft-deleting, use #discard instead.
+      WARN
+      super
+    end
+
+    def paranoia_delete
+      Spree::Deprecation.warn <<-WARN.strip_heredoc, caller
+        Calling #delete (or #paranoia_delete) on a #{self.class} currently performs a soft-destroy using the paranoia gem.
+        In Solidus 3.0, paranoia will be removed, and this will perform a HARD destroy instead. To continue soft-deleting, use #discard instead.
+      WARN
+      super
+    end
+  end
+end

data/lib/spree/permission_sets/base.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # This is the base class used for crafting permission sets.
+    #
+    # This is used by {Spree::RoleConfiguration} when adding custom behavior to {Spree::Ability}.
+    # See one of the subclasses for example structure such as {Spree::PermissionSets::UserDisplay}
+    #
+    # @see Spree::RoleConfiguration
+    # @see Spree::PermissionSets
+    class Base
+      # @param ability [CanCan::Ability]
+      #   The ability that will be extended with the current permission set.
+      #   The ability passed in must respond to #user
+      def initialize(ability)
+        @ability = ability
+      end
+
+      # Activate permissions on the ability. Put your can and cannot statements here.
+      # Must be overriden by subclasses
+      def activate!
+        raise NotImplementedError.new
+      end
+
+      private
+
+      attr_reader :ability
+      delegate :can, :cannot, :user, to: :ability
+    end
+  end
+end

data/lib/spree/permission_sets/configuration_display.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class ConfigurationDisplay < PermissionSets::Base
+      def activate!
+          can [:edit, :admin], :general_settings
+          can [:display, :admin], Spree::TaxCategory
+          can [:display, :admin], Spree::TaxRate
+          can [:display, :admin], Spree::Zone
+          can [:display, :admin], Spree::Country
+          can [:display, :admin], Spree::State
+          can [:display, :admin], Spree::PaymentMethod
+          can [:display, :admin], Spree::Taxonomy
+          can [:display, :admin], Spree::ShippingMethod
+          can [:display, :admin], Spree::ShippingCategory
+          can [:display, :admin], Spree::StockLocation
+          can [:display, :admin], Spree::StockMovement
+          can [:display, :admin], Spree::RefundReason
+          can [:display, :admin], Spree::ReimbursementType
+          can [:display, :admin], Spree::ReturnReason
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/configuration_management.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class ConfigurationManagement < PermissionSets::Base
+      def activate!
+        can :manage, :general_settings
+        can :manage, Spree::TaxCategory
+        can :manage, Spree::TaxRate
+        can :manage, Spree::Zone
+        can :manage, Spree::Country
+        can :manage, Spree::State
+        can :manage, Spree::PaymentMethod
+        can :manage, Spree::Taxonomy
+        can :manage, Spree::ShippingMethod
+        can :manage, Spree::ShippingCategory
+        can :manage, Spree::StockLocation
+        can :manage, Spree::StockMovement
+        can :manage, Spree::RefundReason
+        can :manage, Spree::ReimbursementType
+        can :manage, Spree::ReturnReason
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/dashboard_display.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class DashboardDisplay < PermissionSets::Base
+      def activate!
+          can [:admin, :home], :dashboards
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/default_customer.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class DefaultCustomer < PermissionSets::Base
+      def activate!
+        can :display, Country
+        can :display, OptionType
+        can :display, OptionValue
+        can :create, Order
+        can [:read, :update], Order do |order, token|
+          order.user == user || (order.guest_token.present? && token == order.guest_token)
+        end
+        cannot :update, Order do |order|
+          order.completed?
+        end
+        can :create, ReturnAuthorization do |return_authorization|
+          return_authorization.order.user == user
+        end
+        can [:display, :update], CreditCard, user_id: user.id
+        can :display, Product
+        can :display, ProductProperty
+        can :display, Property
+        can :create, Spree.user_class
+        can [:read, :update, :update_email], Spree.user_class, id: user.id
+        can :display, State
+        can :display, StockItem, stock_location: { active: true }
+        can :display, StockLocation, active: true
+        can :display, Taxon
+        can :display, Taxonomy
+        can [:save_in_address_book, :remove_from_address_book], Spree.user_class, id: user.id
+        can [:display, :view_out_of_stock], Variant
+        can :display, Zone
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/order_display.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class OrderDisplay < PermissionSets::Base
+      def activate!
+        can [:display, :admin, :edit, :cart], Spree::Order
+        can [:display, :admin], Spree::Payment
+        can [:display, :admin], Spree::Shipment
+        can [:display, :admin], Spree::Adjustment
+        can [:display, :admin], Spree::LineItem
+        can [:display, :admin], Spree::ReturnAuthorization
+        can [:display, :admin], Spree::CustomerReturn
+        can [:display, :admin], Spree::OrderCancellations
+        can [:display, :admin], Spree::Reimbursement
+        can [:display, :admin], Spree::ReturnItem
+        can [:display, :admin], Spree::Refund
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/order_management.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class OrderManagement < PermissionSets::Base
+      def activate!
+        can :display, Spree::ReimbursementType
+        can :manage, Spree::Order
+        can :manage, Spree::Payment
+        can :manage, Spree::Shipment
+        can :manage, Spree::Adjustment
+        can :manage, Spree::LineItem
+        can :manage, Spree::ReturnAuthorization
+        can :manage, Spree::CustomerReturn
+        can :manage, Spree::OrderCancellations
+        can :manage, Spree::Reimbursement
+        can :manage, Spree::ReturnItem
+        can :manage, Spree::Refund
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/product_display.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class ProductDisplay < PermissionSets::Base
+      def activate!
+        can [:display, :admin, :edit], Spree::Product
+        can [:display, :admin], Spree::Image
+        can [:display, :admin], Spree::Variant
+        can [:display, :admin], Spree::OptionValue
+        can [:display, :admin], Spree::ProductProperty
+        can [:display, :admin], Spree::OptionType
+        can [:display, :admin], Spree::Property
+        can [:display, :admin], Spree::Taxonomy
+        can [:display, :admin], Spree::Taxon
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/product_management.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class ProductManagement < PermissionSets::Base
+      def activate!
+        can :manage, Spree::Classification
+        can :manage, Spree::Image
+        can :manage, Spree::OptionType
+        can :manage, Spree::OptionValue
+        can :manage, Spree::Price
+        can :manage, Spree::Product
+        can :manage, Spree::ProductProperty
+        can :manage, Spree::Property
+        can :manage, Spree::Taxon
+        can :manage, Spree::Taxonomy
+        can :manage, Spree::Variant
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/promotion_display.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class PromotionDisplay < PermissionSets::Base
+      def activate!
+        can [:display, :admin, :edit], Spree::Promotion
+        can [:display, :admin], Spree::PromotionRule
+        can [:display, :admin], Spree::PromotionAction
+        can [:display, :admin], Spree::PromotionCategory
+        can [:display, :admin], Spree::PromotionCode
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/promotion_management.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class PromotionManagement < PermissionSets::Base
+      def activate!
+        can :manage, Spree::Promotion
+        can :manage, Spree::PromotionRule
+        can :manage, Spree::PromotionAction
+        can :manage, Spree::PromotionCategory
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/restricted_stock_display.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class RestrictedStockDisplay < PermissionSets::Base
+      def activate!
+        can [:display, :admin], Spree::StockItem, stock_location_id: location_ids
+        can :display, Spree::StockLocation, id: location_ids
+      end
+
+      private
+
+      def location_ids
+        @ids ||= user.stock_locations.pluck(:id)
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/restricted_stock_management.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class RestrictedStockManagement < PermissionSets::Base
+      def activate!
+        can :manage, Spree::StockItem, stock_location_id: location_ids
+        can :display, Spree::StockLocation, id: location_ids
+      end
+
+      private
+
+      def location_ids
+        @ids ||= user.stock_locations.pluck(:id)
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/stock_display.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class StockDisplay < PermissionSets::Base
+      def activate!
+        can [:display, :admin], Spree::StockItem
+        can :display, Spree::StockLocation
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/stock_management.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class StockManagement < PermissionSets::Base
+      def activate!
+        can :manage, Spree::StockItem
+        can :display, Spree::StockLocation
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/super_user.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class SuperUser < PermissionSets::Base
+      def activate!
+        can :manage, :all
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/user_display.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class UserDisplay < PermissionSets::Base
+      def activate!
+        can [:display, :admin, :edit, :addresses, :orders, :items], Spree.user_class
+        can [:display, :admin], Spree::StoreCredit
+        can :display, Spree::Role
+      end
+    end
+  end
+end

data/lib/spree/permission_sets/user_management.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    class UserManagement < PermissionSets::Base
+      def activate!
+        can [:admin, :display, :create, :update, :save_in_address_book, :remove_from_address_book, :addresses, :orders, :items], Spree.user_class
+
+        # Note: This does not work with accessible_by.
+        # See https://github.com/solidusio/solidus/pull/1263
+        can :update_email, Spree.user_class do |user|
+          user.spree_roles.none?
+        end
+
+        cannot [:delete, :destroy], Spree.user_class
+        can :manage, Spree::StoreCredit
+        can :display, Spree::Role
+      end
+    end
+  end
+end

data/lib/spree/permission_sets.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require 'spree/permission_sets/base'
+require 'spree/permission_sets/configuration_display'
+require 'spree/permission_sets/configuration_management'
+require 'spree/permission_sets/dashboard_display'
+require 'spree/permission_sets/default_customer'
+require 'spree/permission_sets/order_display'
+require 'spree/permission_sets/order_management'
+require 'spree/permission_sets/product_display'
+require 'spree/permission_sets/product_management'
+require 'spree/permission_sets/promotion_display'
+require 'spree/permission_sets/promotion_management'
+require 'spree/permission_sets/restricted_stock_display'
+require 'spree/permission_sets/restricted_stock_management'
+require 'spree/permission_sets/stock_display'
+require 'spree/permission_sets/stock_management'
+require 'spree/permission_sets/super_user'
+require 'spree/permission_sets/user_display'
+require 'spree/permission_sets/user_management'

data/lib/spree/permitted_attributes.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+module Spree
+  # Spree::PermittedAttributes contains the attributes permitted through strong
+  # params in various controllers in the frontend. Extensions and stores that
+  # need additional params to be accepted can mutate these arrays to add them.
+  module PermittedAttributes
+    ATTRIBUTES = [
+      :address_attributes,
+      :address_book_attributes,
+      :checkout_attributes,
+      :credit_card_update_attributes,
+      :customer_return_attributes,
+      :image_attributes,
+      :inventory_unit_attributes,
+      :line_item_attributes,
+      :option_type_attributes,
+      :option_value_attributes,
+      :payment_attributes,
+      :product_attributes,
+      :product_properties_attributes,
+      :property_attributes,
+      :return_authorization_attributes,
+      :shipment_attributes,
+      :source_attributes,
+      :stock_item_attributes,
+      :stock_location_attributes,
+      :stock_movement_attributes,
+      :store_attributes,
+      :taxon_attributes,
+      :taxonomy_attributes,
+      :user_attributes,
+      :variant_attributes
+    ]
+
+    mattr_reader(*ATTRIBUTES)
+
+    @@address_attributes = [
+      :id, :firstname, :lastname, :first_name, :last_name,
+      :address1, :address2, :city, :country_id, :state_id,
+      :zipcode, :phone, :state_name, :country_iso, :alternative_phone, :company,
+      country: [:iso, :name, :iso3, :iso_name],
+      state: [:name, :abbr]
+    ]
+
+    @@address_book_attributes = address_attributes + [:default]
+
+    @@checkout_attributes = [
+      :coupon_code, :email, :special_instructions, :use_billing
+    ]
+
+    @@credit_card_update_attributes = [
+      :month, :year, :expiry, :first_name, :last_name, :name
+    ]
+
+    @@customer_return_attributes = [:stock_location_id, return_items_attributes: [:id, :inventory_unit_id, :return_authorization_id, :returned, :amount, :reception_status_event, :acceptance_status, :exchange_variant_id, :resellable]]
+
+    @@image_attributes = [:alt, :attachment, :position, :viewable_type, :viewable_id]
+
+    @@inventory_unit_attributes = [:shipment, :variant_id]
+
+    @@line_item_attributes = [:id, :variant_id, :quantity]
+
+    @@option_type_attributes = [:name, :presentation, :option_values_attributes]
+
+    @@option_value_attributes = [:name, :presentation]
+
+    @@payment_attributes = [:amount, :payment_method_id, :payment_method]
+
+    @@product_properties_attributes = [:property_name, :value, :position]
+
+    @@product_attributes = [
+      :name, :description, :available_on, :permalink, :meta_description,
+      :meta_keywords, :price, :sku, :deleted_at,
+      :option_values_hash, :weight, :height, :width, :depth,
+      :shipping_category_id, :tax_category_id,
+      :taxon_ids, :option_type_ids, :cost_currency, :cost_price
+    ]
+
+    @@property_attributes = [:name, :presentation]
+
+    @@return_authorization_attributes = [:memo, :stock_location_id, :return_reason_id, return_items_attributes: [:inventory_unit_id, :exchange_variant_id, :return_reason_id]]
+
+    @@shipment_attributes = [
+      :special_instructions, :stock_location_id, :id, :tracking,
+      :selected_shipping_rate_id
+    ]
+
+    # month / year may be provided by some sources, or others may elect to use one field
+    @@source_attributes = [
+      :number, :month, :year, :expiry, :verification_value,
+      :first_name, :last_name, :cc_type, :gateway_customer_profile_id,
+      :gateway_payment_profile_id, :last_digits, :name, :encrypted_data,
+      :existing_card_id, :wallet_payment_source_id
+    ]
+
+    @@stock_item_attributes = [:variant, :stock_location, :backorderable, :variant_id]
+
+    @@stock_location_attributes = [
+      :name, :active, :address1, :address2, :city, :zipcode,
+      :backorderable_default, :state_name, :state_id, :country_id, :phone,
+      :propagate_all_variants
+    ]
+
+    @@stock_movement_attributes = [
+      :quantity, :stock_item, :stock_item_id, :originator, :action
+    ]
+
+    @@store_attributes = [:name, :url, :seo_title, :meta_keywords,
+                          :meta_description, :default_currency,
+                          :mail_from_address, :cart_tax_country_iso]
+
+    @@taxonomy_attributes = [:name]
+
+    @@taxon_attributes = [
+      :name, :parent_id, :position, :icon, :description, :permalink, :taxonomy_id,
+      :meta_description, :meta_keywords, :meta_title, :child_index
+    ]
+
+    # intentionally leaving off email here to prevent privilege escalation
+    # by changing a user with higher priveleges' email to one a lower-priveleged
+    # admin owns. creating a user with an email is handled separate at the
+    # controller level
+    @@user_attributes = [:password, :password_confirmation]
+
+    @@variant_attributes = [
+      :name, :presentation, :cost_price, :lock_version,
+      :position, :track_inventory,
+      :product_id, :product, :option_values_attributes, :price,
+      :weight, :height, :width, :depth, :sku, :cost_currency, option_value_ids: [], options: [:name, :value]
+    ]
+  end
+end