spree_admin 5.1.8 → 5.2.0.rc2

data/app/controllers/spree/admin/base_controller.rb

@@ -4,6 +4,7 @@ module Spree
       include Spree::Admin::BreadcrumbConcern
 
       layout :choose_layout
+      default_form_builder Spree::Admin::FormBuilder
 
       helper 'spree/base'
       helper 'spree/admin/navigation'
@@ -13,6 +14,7 @@ module Spree
       helper 'spree/integrations'
 
       before_action :authorize_admin
+      after_action :set_return_to, only: [:index]
 
       protected
 
@@ -33,7 +35,7 @@ module Spree
       def redirect_unauthorized_access
         if try_spree_current_user
           flash[:error] = Spree.t(:authorization_failure)
-          redirect_to spree.admin_forbidden_path, allow_other_host: true
+          redirect_back(fallback_location: spree.admin_forbidden_path)
         else
           store_location
           try_to_redirect_to_login_path

data/app/controllers/spree/admin/custom_domains_controller.rb

@@ -1,7 +1,7 @@
 module Spree
   module Admin
     class CustomDomainsController < ResourceController
-      add_breadcrumb Spree.t(:domains), :admin_custom_domains_path
+      include Spree::Admin::SettingsConcern
 
       protected
 

data/app/controllers/spree/admin/errors_controller.rb

@@ -1,10 +1,24 @@
 module Spree
   module Admin
-    class ErrorsController < BaseController
+    class ErrorsController < Spree::Admin::BaseController
       skip_before_action :authorize_admin
 
-      def forbidden
-        render status: 403
+      def show
+        render "spree/admin/errors/#{status_code}", status: status_code
+      end
+
+      private
+
+      def status_code
+        # Extract a 3‑digit code from params or path, default to “500”
+        code_str = params[:code].presence ||
+                   request.path.match(%r{/(\d{3})$})&.[](1) ||
+                   '500'
+        code = code_str.to_i
+
+        # Only allow valid 4xx/5xx error codes, fallback to 500
+        valid_errors = Rack::Utils::HTTP_STATUS_CODES.keys.select { |c| c >= 400 }
+        valid_errors.include?(code) ? code : 500
       end
     end
   end

data/app/controllers/spree/admin/exports_controller.rb

@@ -3,6 +3,8 @@ module Spree
     class ExportsController < ResourceController
       include ActiveStorage::SetCurrent # Needed for ActiveStorage to work on development env
 
+      include Spree::Admin::SettingsConcern
+
       new_action.before :assign_params
       create.before :set_user
 
@@ -40,13 +42,17 @@ module Spree
       end
 
       def assign_params
-        @object.type = permitted_resource_params[:type] if Spree::Export.available_types.map(&:to_s).include?(permitted_resource_params[:type])
+        @object.type = permitted_resource_params[:type] if available_types.map(&:to_s).include?(permitted_resource_params[:type])
         @object.search_params = permitted_resource_params[:search_params]
       end
 
       def permitted_resource_params
         params.require(:export).permit(permitted_export_attributes)
       end
+
+      def available_types
+        Spree::Export.available_types + ['Spree::Exports::Customers']
+      end
     end
   end
 end

data/app/controllers/spree/admin/gift_cards_controller.rb

@@ -31,16 +31,11 @@ module Spree
         params[:q][:user_id_eq] = params[:user_id] if params[:user_id].present?
 
         @search = @collection
-
-        @search = @search.expired if params[:q][:status_eq] == 'expired'
-        @search = @search.active if params[:q][:status_eq] == 'active'
-        @search = @search.redeemed if params[:q][:status_eq] == 'redeemed'
-
         @search = @search.ransack(params[:q])
 
         @collection = @search.result.includes(:user, :created_by)
 
-        @collection = @collection.page(params[:page]).per(params[:per_page]) if params[:format] != 'csv'
+        @collection = @collection.page(params[:page]).per(params[:per_page])
 
         @collection
       end
@@ -62,15 +57,14 @@ module Spree
       end
 
       def gift_cards_filter_dropdown_value
-        case params.dig(:q, :status_eq)
-        when 'active'
+        if params.dig(:q, :active).present?
           Spree.t('admin.gift_cards.active')
-        when 'expired'
+        elsif params.dig(:q, :expired).present?
           Spree.t(:expired)
-        when 'redeemed'
+        elsif params.dig(:q, :redeemed).present?
           Spree.t('admin.gift_cards.redeemed')
         else
-          Spree.t('admin.gift_cards.all')
+          Spree.t('admin.gift_cards.all_statuses')
         end
       end
 

data/app/controllers/spree/admin/import_mappings_controller.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Admin
+    class ImportMappingsController < ResourceController
+      belongs_to 'spree/import', find_by: :number
+
+      def update_turbo_stream_enabled?
+        true
+      end
+
+      def permitted_resource_params
+        params.require(:import_mapping).permit(permitted_import_mapping_attributes)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/import_rows_controller.rb

@@ -0,0 +1,7 @@
+module Spree
+  module Admin
+    class ImportRowsController < ResourceController
+      belongs_to 'spree/import', find_by: :number
+    end
+  end
+end

data/app/controllers/spree/admin/imports_controller.rb

@@ -0,0 +1,66 @@
+module Spree
+  module Admin
+    class ImportsController < ResourceController
+      include ActiveStorage::SetCurrent # Needed for ActiveStorage to work on development env
+
+      new_action.before :assign_params
+      create.before :assign_params
+      create.before :set_user
+      create.before :set_owner
+      create.after :start_mapping
+
+      # GET /admin/imports/:id
+      def show
+        if @object.status == 'mapping'
+          @mappings = @object.mappings
+          @mappings_options = @object.unmapped_file_columns.map { |file_column| [file_column, file_column] }
+        else
+          @rows = @object.rows.processed.includes(:item)
+        end
+      end
+
+      # PUT /admin/imports/:id/complete_mapping
+      def complete_mapping
+        @object.complete_mapping! if @object.mapping_done?
+
+        redirect_to spree.admin_import_path(@object)
+      end
+
+      protected
+
+      def set_user
+        @object.user = try_spree_current_user
+      end
+
+      def set_owner
+        @object.owner = current_store
+      end
+
+      def start_mapping
+        @object.start_mapping!
+      end
+
+      def location_after_save
+        spree.admin_import_path(@object)
+      end
+
+      def assign_params
+        @object.type = available_types.map(&:to_s).find { |type| type == params.dig(:import, :type) } || available_types.first.to_s
+      end
+
+      def available_types
+        Spree::Import.available_types
+      end
+
+      def permitted_resource_params
+        params.require(:import).permit(permitted_import_attributes + @object.preferences.keys.map { |key| "preferred_#{key}" })
+      end
+
+      def choose_layout
+        return 'turbo_rails/frame' if turbo_frame_request? && action_name != 'show'
+
+        'spree/admin_wizard'
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/invitations_controller.rb

@@ -1,10 +1,9 @@
 module Spree
   module Admin
     class InvitationsController < BaseController
-      skip_before_action :authorize_admin, only: [:show, :accept]
+      include Spree::Admin::SettingsConcern
 
-      add_breadcrumb Spree.t(:users), :admin_admin_users_path
-      add_breadcrumb Spree.t(:invitations), :admin_invitations_path
+      skip_before_action :authorize_admin, only: [:show, :accept]
 
       before_action :load_parent, except: [:show]
       before_action :load_invitation, only: [:destroy]
@@ -117,7 +116,7 @@ module Spree
       end
 
       def choose_layout
-        action_name == 'show' ? 'spree/minimal' : 'spree/admin'
+        action_name == 'show' ? 'spree/minimal' : 'spree/admin_settings'
       end
 
       def model_class

data/app/controllers/spree/admin/json_previews_controller.rb

@@ -0,0 +1,24 @@
+module Spree
+  module Admin
+    class JsonPreviewsController < ResourceController
+      private
+
+      def model_class
+        @model_class ||= begin
+          klass_name = params[:resource_type]
+          # Ensure all Spree models are loaded so that descendants is complete
+          Rails.application.eager_load! unless Rails.application.config.eager_load
+          klass = Spree.base_class.descendants.find { |spree_klass| spree_klass.name.to_s == klass_name }
+          klass ||= Spree.user_class if klass_name == Spree.user_class.to_s
+          klass ||= Spree.admin_user_class if klass_name == Spree.admin_user_class.to_s
+
+          raise ActiveRecord::RecordNotFound if klass.blank?
+
+          klass
+        rescue NameError
+          raise ActiveRecord::RecordNotFound
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/metafield_definitions_controller.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Admin
+    class MetafieldDefinitionsController < ResourceController
+      include Spree::Admin::SettingsConcern
+
+      new_action.before :set_resource_type_from_params
+
+      private
+
+      def update_turbo_stream_enabled?
+        true
+      end
+
+      def set_resource_type_from_params
+        @object.resource_type = Spree::MetafieldDefinition.available_resources.find { |type| type.name.to_s == params[:resource_type] }
+      end
+
+      def location_after_save
+        collection_url
+      end
+
+      def permitted_resource_params
+        params.require(:metafield_definition).permit(permitted_metafield_definition_attributes)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/metafields_controller.rb

@@ -0,0 +1,39 @@
+module Spree
+  module Admin
+    class MetafieldsController < ResourceController
+      edit_action.before :build_metafields
+
+      def build_metafields
+        @metafields = @object.metafields
+        @metafield_definitions = Spree::MetafieldDefinition.where(resource_type: model_class.name)
+
+        @metafield_definitions.each do |metafield_definition|
+          @object.metafields.build(type: metafield_definition.metafield_type, metafield_definition: metafield_definition) unless @object.has_metafield?(metafield_definition)
+        end
+      end
+
+      private
+
+      def permitted_resource_params
+        params.require(@object.model_name.param_key).permit(metafields_attributes: permitted_metafield_attributes)
+      end
+
+      # eg. Spree::Product
+      def model_class
+        @model_class ||= begin
+          klass = params[:resource_type]
+          allowed_model_classes.find { |allowed_class| allowed_class.to_s == klass } ||
+            raise(ActiveRecord::RecordNotFound, "Resource type not found")
+        end
+      end
+
+      def allowed_model_classes
+        @allowed_model_classes ||= Rails.application.config.spree.metafield_enabled_resources
+      end
+
+      def update_turbo_stream_enabled?
+        true
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/newsletter_subscribers_controller.rb

@@ -0,0 +1,8 @@
+module Spree
+  module Admin
+    class NewsletterSubscribersController < ResourceController
+      add_breadcrumb_icon 'users'
+      add_breadcrumb Spree.t(:customers), :admin_users_path
+    end
+  end
+end

data/app/controllers/spree/admin/oauth_applications_controller.rb

@@ -1,9 +1,9 @@
 module Spree
   module Admin
     class OauthApplicationsController < ResourceController
-      before_action :set_default_scopes, only: [:new, :edit]
+      include Spree::Admin::SettingsConcern
 
-      add_breadcrumb Spree.t(:developers), :admin_oauth_applications_path
+      before_action :set_default_scopes, only: [:new, :edit]
 
       private
 

data/app/controllers/spree/admin/orders/user_controller.rb

@@ -4,7 +4,6 @@ module Spree
       class UserController < Spree::Admin::BaseController
         include Spree::Admin::OrderConcern
         before_action :load_order
-        before_action :check_authorization
 
         def new
           @user = @order.build_user
@@ -25,11 +24,16 @@ module Spree
 
               result = Spree::Dependencies.checkout_advance_service.constantize.call(order: @order, state: max_state)
 
-              flash[:error] = result.error.value.full_messages.to_sentence unless result.success?
-
-              render :create, status: :ok
+              if result.success?
+                flash[:success] = flash_message_for(@order, :successfully_updated)
+                redirect_to spree.edit_admin_order_path(@order)
+              else
+                flash[:error] = result.error.value.full_messages.to_sentence
+                redirect_to spree.new_admin_order_user_path(@order), status: :unprocessable_entity
+              end
             else
-              render :create, status: :unprocessable_entity
+              flash[:error] = @user.errors.full_messages.to_sentence
+              redirect_to spree.new_admin_order_user_path(@order), status: :unprocessable_entity
             end
           else
             @user = @order.build_user(user_params)
@@ -39,9 +43,11 @@ module Spree
             if @user.save
               @order.associate_user!(@user)
 
-              render :create, status: :ok
+              flash[:success] = flash_message_for(@order, :successfully_updated)
+              redirect_to spree.edit_admin_order_path(@order)
             else
-              render :create, status: :unprocessable_entity
+              flash[:error] = @user.errors.full_messages.to_sentence
+              redirect_to spree.new_admin_order_user_path(@order), status: :unprocessable_entity
             end
           end
         end
@@ -66,7 +72,8 @@ module Spree
             end
           end
 
-          render :update, status: :ok
+          flash[:success] = flash_message_for(@order, :successfully_updated)
+          redirect_to spree.edit_admin_order_path(@order)
         end
 
         def destroy
@@ -75,7 +82,6 @@ module Spree
           @order.save
 
           flash[:error] = @order.errors.full_messages.to_sentence if @order.invalid?
-
           redirect_to spree.edit_admin_order_path(@order)
         end
 
@@ -85,7 +91,7 @@ module Spree
           params.require(:user).permit(permitted_user_attributes)
         end
 
-        def check_authorization
+        def authorize_admin
           authorize! :update_customer, @order
         end
       end

data/app/controllers/spree/admin/orders_controller.rb

@@ -12,11 +12,21 @@ module Spree
 
       helper_method :model_class, :object_url
 
+      # GET /admin/orders/new
+      def new
+        @order = current_store.orders.new
+      end
+
       # POST /admin/orders
       def create
-        @order = Spree::Order.create(created_by: try_spree_current_user, store: current_store)
-
-        redirect_to spree.edit_admin_order_path(@order)
+        @order = current_store.orders.new(permitted_resource_params)
+        @order.created_by = try_spree_current_user
+        if @order.save
+          flash[:success] = flash_message_for(@order, :successfully_created)
+          redirect_to spree.edit_admin_order_path(@order)
+        else
+          render :new, status: :unprocessable_entity
+        end
       end
 
       # GET /admin/orders/:id/edit
@@ -113,6 +123,10 @@ module Spree
       def object_url
         spree.admin_order_path(@order)
       end
+
+      def permitted_resource_params
+        params.require(:order).permit(permitted_order_attributes)
+      end
     end
   end
 end

data/app/controllers/spree/admin/page_blocks_controller.rb

@@ -49,7 +49,8 @@ module Spree
         params.require(:page_block).permit(
           permitted_page_block_attributes +
           [link_attributes: permitted_page_link_attributes + [:id]] +
-          @object.preferences.keys.map { |key| "preferred_#{key}" }
+          @object.preferences.keys.map { |key| "preferred_#{key}" } +
+          [preferred_metafield_definition_ids: []]
         )
       end
     end

data/app/controllers/spree/admin/page_links_controller.rb

@@ -13,11 +13,17 @@ module Spree
 
       private
 
+      def find_resource
+        model_class.accessible_by(current_ability, :manage).find(params[:id])
+      end
+
       def collection_url
         @collection_url ||= if @parent.is_a?(Spree::PageSection)
                               spree.edit_admin_page_section_path(@parent)
                             elsif @parent.is_a?(Spree::PageBlock)
                               spree.edit_admin_page_section_block_path(@parent.section, @parent)
+                            elsif @parent.is_a?(Spree::Store)
+                              spree.edit_admin_store_path(section: :checkout)
                             end
       end
 
@@ -28,6 +34,8 @@ module Spree
                       Spree::PageBlock.find(params[:block_id])
                     elsif params[:page_section_id].present?
                       Spree::PageSection.find(params[:page_section_id])
+                    elsif params[:store_id].present?
+                      current_store
                     end
       end
 
@@ -39,7 +47,7 @@ module Spree
         @page_link.linkable ||= @parent.default_linkable_resource
       end
 
-      # for create action we don't pass the page_link at all
+      # for create action we don't pass    page_link at all
       def permitted_resource_params
         if params[:page_link].present?
           params.require(:page_link).permit(permitted_page_link_attributes)

data/app/controllers/spree/admin/pages_controller.rb

@@ -28,15 +28,7 @@ module Spree
       end
 
       def collection
-        return @collection if @collection.present?
-
-        @collection = current_store.pages.custom
-
-        params[:q] ||= {}
-        params[:q][:s] ||= 'created_at desc'
-
-        @search = @collection.ransack(params[:q])
-        @collection = @search.result.page(params[:page]).per(params[:per_page])
+        super.custom.without_previews
       end
 
       def permitted_resource_params

data/app/controllers/spree/admin/payment_methods_controller.rb

@@ -2,7 +2,7 @@ module Spree
   module Admin
     class PaymentMethodsController < ResourceController
       include Spree::Admin::PreferencesConcern
-      add_breadcrumb Spree.t(:payment_methods), :admin_payment_methods_path
+      include Spree::Admin::SettingsConcern
 
       prepend_before_action :require_payment_type, only: [:new, :create]
       before_action -> { clear_empty_password_preferences(:payment_method) }, only: :update

data/app/controllers/spree/admin/policies_controller.rb

@@ -0,0 +1,28 @@
+module Spree
+  module Admin
+    class PoliciesController < ResourceController
+      include Spree::Admin::SettingsConcern
+
+      before_action :set_policy_owner, only: %i[create update]
+
+      private
+
+      def permitted_resource_params
+        params.require(:policy).permit(permitted_policy_attributes)
+      end
+
+      def update_turbo_stream_enabled?
+        true
+      end
+
+      def set_policy_owner
+        @policy.owner ||= current_store
+      end
+
+      def object_url(object = nil, options = {})
+        target = object || @object
+        spree.admin_policy_url(target&.id, options)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/products_controller.rb

@@ -3,7 +3,7 @@ module Spree
     class ProductsController < ResourceController
       include Spree::Admin::StockLocationsHelper
       include Spree::Admin::BulkOperationsConcern
-      include Spree::Admin::SessionAssetsHelper
+      include Spree::Admin::AssetsHelper
       include Spree::Admin::ProductsBreadcrumbConcern
 
       helper 'spree/admin/products'
@@ -15,7 +15,6 @@ module Spree
 
       before_action :prepare_product_params, only: [:create, :update]
       before_action :strip_stock_items_param, only: [:create, :update]
-      before_action :ensure_session_uploaded_assets_uuid, only: :new
       before_action :check_slug_availability, only: [:create, :update]
 
       new_action.before :build_master_prices
@@ -323,6 +322,8 @@ module Spree
       end
 
       def build_product_properties
+        return unless Spree::Config[:product_properties_enabled]
+
         Spree::Property.all.each do |property|
           @product.product_properties.build(property: property) unless @product.product_properties.find { |product_property| product_property.property_id == property.id }
         end
@@ -331,10 +332,12 @@ module Spree
       def assign_master_images
         return unless @product.master.persisted?
 
-        return if session_uploaded_assets.empty?
+        uploaded_assets = session_uploaded_assets('Spree::Variant')
+
+        return if uploaded_assets.empty?
 
-        session_uploaded_assets.update_all(viewable_id: @product.master.id, viewable_type: 'Spree::Variant', updated_at: Time.current)
-        clear_session_for_uploaded_assets
+        uploaded_assets.update_all(viewable_id: @product.master.id, viewable_type: 'Spree::Variant', updated_at: Time.current)
+        clear_session_for_uploaded_assets('Spree::Variant')
       end
 
       def product_includes

data/app/controllers/spree/admin/profile_controller.rb

@@ -1,6 +1,8 @@
 module Spree
   module Admin
     class ProfileController < BaseController
+      include Spree::Admin::SettingsConcern
+
       def edit
         @user = try_spree_current_user
       end

data/app/controllers/spree/admin/refund_reasons_controller.rb

@@ -1,7 +1,7 @@
 module Spree
   module Admin
     class RefundReasonsController < ResourceController
-      add_breadcrumb Spree.t(:refund_reasons), :admin_refund_reasons_path
+      include Spree::Admin::SettingsConcern
 
       private
 

data/app/controllers/spree/admin/reimbursement_types_controller.rb

@@ -1,7 +1,7 @@
 module Spree
   module Admin
     class ReimbursementTypesController < ResourceController
-      add_breadcrumb Spree.t(:reimbursement_types), :admin_reimbursement_types_path
+      include Spree::Admin::SettingsConcern
 
       private