spree_admin 5.2.6 → 5.3.0.rc1

data/app/controllers/spree/admin/products_controller.rb

@@ -85,21 +85,11 @@ module Spree
         end
       end
 
-      def bulk_modal
-        if params[:kind] == 'set_status'
-          @title = Spree.t('admin.bulk_ops.products.title.set_status', status: params[:status].titleize)
-          @body = Spree.t("admin.bulk_ops.products.body.set_status.#{params[:status]}")
-        else
-          @title = Spree.t("admin.bulk_ops.products.title.#{params[:kind]}")
-          @body = Spree.t("admin.bulk_ops.products.body.#{params[:kind]}")
-        end
-      end
-
       def bulk_status_update
         if bulk_collection.update_all(status: params[:status], updated_at: Time.current)
           product_ids = bulk_collection.ids
 
-          if Spree::Webhooks::Subscriber.any?
+          if defined?(Spree::Webhooks::Subscriber) && Spree::Webhooks::Subscriber.any?
             ::Spree::Products::QueueStatusChangedWebhook.call(
               ids: product_ids,
               event: Spree::Product::STATUS_TO_WEBHOOK_EVENT[params[:status]]
@@ -114,20 +104,6 @@ module Spree
         end
       end
 
-      def bulk_add_tags
-        Spree::Tags::BulkAdd.call(tag_names: params[:tags], records: bulk_collection)
-        Spree::Product.bulk_auto_match_taxons(current_store, bulk_collection.ids)
-
-        handle_bulk_operation_response
-      end
-
-      def bulk_remove_tags
-        Spree::Tags::BulkRemove.call(tag_names: params[:tags], records: bulk_collection)
-        Spree::Product.bulk_auto_match_taxons(current_store, bulk_collection.ids)
-
-        handle_bulk_operation_response
-      end
-
       def bulk_remove_from_taxons
         taxons = current_store.taxons.accessible_by(current_ability, :manage).where(id: params[:taxon_ids])
         Spree::Taxons::RemoveProducts.call(taxons: taxons, products: bulk_collection)
@@ -196,7 +172,7 @@ module Spree
         end
 
         @product_prices = {}
-        @product.prices.includes(:variant).each do |price|
+        @product.prices.base_prices.includes(:variant).each do |price|
           @product_prices[price.variant.human_name] ||= {}
           @product_prices[price.variant.human_name][price.currency.downcase] = {
             id: price.id.to_s,
@@ -242,40 +218,13 @@ module Spree
         params[:product] = params_service.call
       end
 
-      def collection
-        return @collection if @collection.present?
-
-        params[:q] ||= {}
-        params[:q][:deleted_at_null] ||= '1'
-
-        params[:q][:s] ||= 'name asc'
-        params[:q][:status_eq] == 'archived' ? params[:q].delete(:status_not_eq) : params[:q][:status_not_eq] = 'archived'
-
-        params[:q][:taxons_id_null] = '1' if params.dig(:q, :taxons_id_in)&.include?(' ')
-
-        assign_extra_collection_params if respond_to?(:assign_extra_collection_params)
-
-        @collection = super
-
-        # Don't delete params[:q][:deleted_at_null] here because it is used in view to check the
-        # checkbox for 'q[deleted_at_null]'. This also messed with pagination when deleted_at_null is checked.
-        @collection = @collection.with_deleted if params[:q][:deleted_at_null] == '0'
-
-        # The out_of_stock scope groups products - we also need to group it by name coming from product translations
-        # That's because we sort products by name
-        @collection = @collection.group(:name) if params.dig(:q, :out_of_stock_items) == '1'
-
-        # @search needs to be defined as this is passed to search_form_for
-        # Temporarily remove params[:q][:deleted_at_null] from params[:q] to ransack products.
-        # This is to include all products and not just deleted products.
-        @search = @collection.ransack(params[:q].except(:deleted_at_null))
-        @collection = @search.result(distinct: true).
-                      for_ordering_with_translations(model_class, :name).
-                      includes(product_includes).
-                      page(params[:page]).
-                      per(params[:per_page] || Spree::Admin::RuntimeConfig.admin_products_per_page)
-
-        @collection
+      # These includes are not picked automatically by ar_lazy_preload gem so we need to specify them manually.
+      def collection_includes
+        {
+          stock_items: [],
+          master: [:images, :prices, :stock_items],
+          variants: [:images, :prices, :stock_items]
+        }
       end
 
       def clone_object_url(resource)
@@ -284,6 +233,10 @@ module Spree
 
       private
 
+      def after_bulk_tags_change
+        Spree::Product.bulk_auto_match_taxons(current_store, bulk_collection.ids)
+      end
+
       def variant_stock_includes
         [:images, { stock_items: :stock_location, option_values: :option_type }]
       end
@@ -340,18 +293,6 @@ module Spree
         clear_session_for_uploaded_assets('Spree::Variant')
       end
 
-      def product_includes
-        {
-          tax_category: [],
-          stock_items: [:stock_location],
-          variants_including_master: [],
-          shipping_category: [],
-          master: [:prices, :images, :stock_items, :stock_locations],
-          variants: [:prices, :images, :stock_items, :stock_locations],
-          variant_images: [],
-        }
-      end
-
       def check_slug_availability
         new_slug = permitted_resource_params[:slug]
         permitted_resource_params[:slug] = @product.ensure_slug_is_unique(new_slug)

data/app/controllers/spree/admin/promotion_rules_controller.rb

@@ -40,7 +40,15 @@ module Spree
       end
 
       def permitted_resource_params
-        params.require(:promotion_rule).permit(*permitted_promotion_rule_attributes + @object.preferences.keys.map { |key| "preferred_#{key}" })
+        permitted_preference_keys = @object.preferences.map do |key, value|
+          if value.is_a?(Array)
+            { "preferred_#{key}" => [] }
+          else
+            "preferred_#{key}"
+          end
+        end
+
+        params.require(:promotion_rule).permit(*permitted_promotion_rule_attributes, *permitted_preference_keys)
       end
     end
   end

data/app/controllers/spree/admin/promotions_controller.rb

@@ -5,6 +5,15 @@ module Spree
 
       before_action :load_form_data, except: :index
 
+      # GET /admin/promotions/select_options
+      def select_options
+        q = params[:q]
+        ransack_params = q.is_a?(String) ? { name_i_cont: q } : q
+        promotions = current_store.promotions.applied.accessible_by(current_ability).ransack(ransack_params).result.order(:name).limit(25)
+
+        render json: promotions.pluck(:id, :name).map { |id, name| { id: id, name: name } }
+      end
+
       # POST /admin/promotions/:id/clone
       def clone
         promotion = current_store.promotions.find(params[:id])
@@ -34,29 +43,8 @@ module Spree
         end
       end
 
-      def collection
-        return @collection if defined?(@collection)
-
-        params[:q] ||= {}
-
-        expired = params[:q].delete(:expired) == 'true'
-        active = params[:q].delete(:active) == 'true'
-
-        @collection = super
-
-        @collection = @collection.active if active
-        @collection = @collection.expired if expired
-
-        @search = @collection.ransack(params[:q])
-        @collection = @search.result(distinct: true).
-                      includes(:promotion_actions).
-                      page(params[:page]).
-                      per(params[:per_page])
-
-        params[:q][:expired] = expired
-        params[:q][:active] = active
-
-        @collection
+      def collection_includes
+        [:promotion_actions]
       end
 
       def permitted_resource_params

data/app/controllers/spree/admin/resource_controller.rb

@@ -1,5 +1,7 @@
 class Spree::Admin::ResourceController < Spree::Admin::BaseController
   include Spree::Admin::Callbacks
+  include Spree::Admin::TableConcern
+  include Pagy::Method
 
   helper_method :new_object_url, :edit_object_url, :object_url, :collection_url, :model_class
   before_action :load_resource
@@ -241,16 +243,55 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
   # @return [Ransack::Search]
   def search_collection
     @search ||= begin
-      params[:q] ||= {}
-      params[:q][:s] ||= collection_default_sort if collection_default_sort.present?
-      scope.ransack(params[:q])
+      # Process query_state from table query builder if present
+      process_table_query_state if table_registered?
+
+      scope.ransack(search_params)
     end
   end
 
+  # Override in child controllers to set custom search params
+  # @return [Hash] Ransack search params
+  def search_params
+    # Initialize params[:q] as empty hash if not present, to allow setting default sort
+    params[:q] ||= {}
+
+    return params[:q] unless params[:q].is_a?(ActionController::Parameters) || params[:q].is_a?(Hash)
+
+    params[:q][:s] ||= collection_default_sort if collection_default_sort.present?
+
+    date_range_params = %i[created_at_gt created_at_lt updated_at_gt updated_at_lt]
+    date_range_params.each do |param|
+      if params[:q][param].present?
+        params[:q][param] = begin
+          params[:q][param].to_date&.in_time_zone(current_timezone)&.beginning_of_day
+        rescue StandardError
+          ''
+        end
+      end
+    end
+
+    params[:q]
+  end
+
   # Returns the filtered and paginated ransack results
+  # Uses countish paginator which is faster as it avoids COUNT queries on most pages
+  # Falls back to offset paginator for queries with HAVING or GROUP BY clauses (incompatible with countish)
   # @return [ActiveRecord::Relation]
   def collection
-    @collection ||= search_collection.result(distinct: true).page(params[:page]).per(params[:per_page])
+    @collection ||= begin
+      result = search_collection.result(distinct: true).preload_associations_lazily
+
+      # Apply custom sort scope if configured (e.g., for price sorting)
+      result = apply_table_sort(result) if table_registered? && custom_sort_active?
+
+      limit = params[:per_page] || Spree::Admin::RuntimeConfig.admin_records_per_page
+
+      # Uses countish paginator which is faster as it avoids COUNT queries
+      @pagy, paginated = pagy(:countish, result, limit: limit)
+
+      paginated
+    end
   end
 
   def collection_includes
@@ -375,7 +416,7 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
   def collection_actions
     [:index, :select_options, :bulk_modal, :bulk_status_update,
      :bulk_add_to_taxons, :bulk_remove_from_taxons,
-     :bulk_add_tags, :bulk_remove_tags, :bulk_destroy]
+     :bulk_add_tags, :bulk_remove_tags, :bulk_destroy, :select_options]
   end
 
   # Returns true if the current action is a member action

data/app/controllers/spree/admin/stock_items_controller.rb

@@ -2,6 +2,7 @@ module Spree
   module Admin
     class StockItemsController < ResourceController
       include ProductsBreadcrumbConcern
+      include TableConcern
 
       before_action :add_breadcrumbs
 
@@ -18,7 +19,7 @@ module Spree
       def collection_includes
         {
           stock_location: [],
-          variant: [option_values: :option_type, product: [variant_images: [], variants: [:images], master: [:images]], images: []]
+          variant: [option_values: :option_type, product: [variants: [:images], master: [:images]], images: []]
         }
       end
 

data/app/controllers/spree/admin/stock_locations_controller.rb

@@ -13,6 +13,15 @@ module Spree
         redirect_to spree.admin_stock_locations_path
       end
 
+      # GET /admin/stock_locations/select_options
+      def select_options
+        q = params[:q]
+        ransack_params = q.is_a?(String) ? { name_i_cont: q } : q
+        stock_locations = Spree::StockLocation.active.accessible_by(current_ability).ransack(ransack_params).result.order(:name).limit(50)
+
+        render json: stock_locations.map { |sl| { id: sl.id, name: sl.display_name } }
+      end
+
       private
 
       def scope

data/app/controllers/spree/admin/table_columns_controller.rb

@@ -0,0 +1,38 @@
+module Spree
+  module Admin
+    class TableColumnsController < Spree::Admin::BaseController
+      # POST /admin/table_columns
+      # Updates the selected columns for a table in the session
+      def update
+        session_key = table_session_key
+        columns = params[:columns]
+
+        if session_key.present?
+          if columns.present?
+            # Filter to only include valid column keys
+            column_keys = Array(columns).map(&:to_sym)
+            session[session_key] = column_keys.join(',')
+          else
+            # Clear selection to use defaults
+            session.delete(session_key)
+          end
+        end
+
+        # Use url_from to validate redirect URL is same-origin
+        redirect_url = url_from(params[:redirect_url]) || url_from(request.referer) || spree.admin_path
+        redirect_to redirect_url, status: :see_other
+      end
+
+      private
+
+      # Returns a validated session key for table columns, or nil if invalid
+      # Only allows registered table keys to prevent session manipulation
+      def table_session_key
+        table_key = params[:table_key].to_s.to_sym
+        return nil unless Spree.admin.tables.registered?(table_key)
+
+        "table_columns_#{table_key}"
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/tags_controller.rb

@@ -0,0 +1,32 @@
+module Spree
+  module Admin
+    class TagsController < Spree::Admin::BaseController
+      def select_options
+        tags = tags_scope
+
+        if params[:q].present?
+          tags = tags.where('LOWER(name) LIKE ?', "%#{params[:q].downcase}%")
+        end
+
+        render json: tags.limit(100).pluck(:id, :name).map { |id, name| { id: id, name: name } }
+      end
+
+      private
+
+      def tags_scope
+        context = params[:context].presence || 'tags'
+        taggable_type = params[:taggable_type].presence
+
+        scope = ActsAsTaggableOn::Tag.for_context(context)
+
+        if taggable_type.present?
+          scope = scope.joins(:taggings)
+                       .where(ActsAsTaggableOn.taggings_table => { taggable_type: taggable_type })
+                       .distinct
+        end
+
+        scope.order(:name)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/users_controller.rb

@@ -13,6 +13,38 @@ module Spree
       add_breadcrumb_icon 'users'
       add_breadcrumb Spree.t(:customers), :admin_users_path
 
+      def select_options
+        q = params[:q]
+        ransack_params = q.is_a?(String) ? { email_cont: q } : q
+        users = model_class.accessible_by(current_ability).ransack(ransack_params).result.order(:email).limit(50)
+
+        render json: users.pluck(:id, :email).map { |id, email| { id: id, name: email } }
+      end
+
+      def search
+        query = params[:q]&.strip
+
+        head :ok and return if query.blank? || query.length < 3
+
+        scope = model_class.accessible_by(current_ability, :index)
+        scope = scope.where.not(id: params[:omit_ids].split(',')) if params[:omit_ids].present?
+        @users = scope.includes(:bill_address, :ship_address, avatar_attachment: :blob)
+                      .multi_search(query)
+                      .limit(params[:limit] || 10)
+
+        respond_to do |format|
+          format.turbo_stream do
+            render turbo_stream: [
+              turbo_stream.replace(
+                'users_search_results',
+                partial: 'spree/admin/users/search_results',
+                locals: { users: @users }
+              )
+            ]
+          end
+        end
+      end
+
       def show
         add_breadcrumb @user.name, spree.admin_user_path(@user)
       end
@@ -30,22 +62,22 @@ module Spree
         end
       end
 
-      def update
-        if @user.update(user_params)
-          flash[:success] = flash_message_for(@user, :successfully_updated)
-          redirect_to spree.admin_user_path(@user)
-        else
-          render :edit, status: :unprocessable_entity
-        end
-      end
-
       def model_class
         Spree.user_class
       end
 
-      def bulk_modal
-        @title = Spree.t("admin.bulk_ops.users.title.#{params[:kind]}")
-        @body = Spree.t("admin.bulk_ops.users.body.#{params[:kind]}")
+      def update_turbo_stream_enabled?
+        true
+      end
+
+      # Skip setting current store for users as they don't need store assignment
+      # and the stores association goes through role_users which requires a role
+      def set_current_store
+        # no-op for users
+      end
+
+      def location_after_save
+        spree.admin_user_path(@user)
       end
 
       protected
@@ -69,6 +101,10 @@ module Spree
 
       private
 
+      def permitted_resource_params
+        user_params
+      end
+
       def user_params
         params.require(:user).permit(permitted_user_attributes | [spree_role_ids: []])
       end
@@ -83,11 +119,19 @@ module Spree
         return if params[:user].blank?
 
         params[:user][:tag_list] = params.dig(:user, :tag_list).present? ? params.dig(:user, :tag_list).reject(&:empty?) : []
+
+        # Remove spree_role_ids if it only contains empty strings to avoid clearing roles
+        role_ids = params[:user][:spree_role_ids]
+        if role_ids.present? && role_ids.reject(&:empty?).empty?
+          params[:user].delete(:spree_role_ids)
+        end
       end
 
       def load_last_order_data
         @last_order = @user.completed_orders.last
-        @last_order_line_items = @last_order.line_items.includes(variant: :product) if @last_order.present?
+        return unless @last_order.present?
+
+        @last_order_line_items = @last_order.line_items.includes(variant: [:images, { option_values: :option_type }, { product: [{ master: :images }, { variants: :images }] }])
       end
     end
   end

data/app/controllers/spree/admin/variants_controller.rb

@@ -74,7 +74,7 @@ module Spree
 
       def build_prices
         current_store.supported_currencies_list.each do |currency|
-          @variant.prices.build(currency: currency) unless @variant.prices.exists?(currency: currency.iso_code)
+          @variant.prices.build(currency: currency) unless @variant.prices.base_prices.exists?(currency: currency.iso_code)
         end
       end
 

data/app/controllers/spree/admin/webhook_deliveries_controller.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class WebhookDeliveriesController < ResourceController
+      include Spree::Admin::SettingsConcern
+      include Spree::Admin::TableConcern
+
+      helper 'spree/admin/webhook_endpoints'
+
+      belongs_to 'spree/webhook_endpoint'
+
+      private
+
+      def collection_default_sort
+        'created_at desc'
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/webhook_endpoints_controller.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class WebhookEndpointsController < ResourceController
+      include Spree::Admin::SettingsConcern
+      include Spree::Admin::TableConcern
+
+      helper 'spree/admin/webhook_endpoints'
+
+      private
+
+      def permitted_resource_params
+        params.require(:webhook_endpoint).permit(permitted_webhook_endpoint_attributes)
+      end
+
+      def location_after_save
+        spree.admin_webhook_endpoint_path(@object)
+      end
+
+      def update_turbo_stream_enabled?
+        true
+      end
+    end
+  end
+end

data/app/helpers/spree/admin/avatars_helper.rb

@@ -0,0 +1,56 @@
+module Spree
+  module Admin
+    module AvatarsHelper
+      include Spree::ImagesHelper
+
+      AVATAR_GRADIENTS = [
+        'bg-gradient-to-br from-indigo-500 to-purple-600',
+        'bg-gradient-to-br from-pink-400 to-rose-500',
+        'bg-gradient-to-br from-blue-400 to-cyan-400',
+        'bg-gradient-to-br from-emerald-400 to-teal-400',
+        'bg-gradient-to-br from-rose-400 to-yellow-300',
+        'bg-gradient-to-br from-teal-200 to-pink-200',
+        'bg-gradient-to-br from-rose-300 to-pink-200',
+        'bg-gradient-to-br from-orange-200 to-orange-400',
+        'bg-gradient-to-br from-violet-500 to-fuchsia-500',
+        'bg-gradient-to-br from-amber-400 to-orange-500',
+      ].freeze
+
+      def avatar_gradient_class(identifier)
+        index = Digest::MD5.hexdigest(identifier.to_s)[0..7].to_i(16) % AVATAR_GRADIENTS.length
+        AVATAR_GRADIENTS[index]
+      end
+
+      # render an avatar for a user
+      # if user doesn't have an avatar, the user's initials will be displayed on a rounded-lg  background
+      # @param user [Spree::User] the user to render the avatar for
+      # @param options [Hash] the options for the avatar
+      # @option options [Integer] :width the width of the avatar, default: 128
+      # @option options [Integer] :height the height of the avatar, default: 128
+      # @option options [String] :class the CSS class(es) of the avatar, default: 'avatar'
+      # @return [String] the avatar
+      def render_avatar(user, options = {})
+        return unless user.present?
+
+        options[:width] ||= 128
+        options[:height] ||= 128
+        options[:class] ||= 'avatar rounded-lg flex items-center justify-center text-white text-lg'
+
+        if user.respond_to?(:avatar) && user.avatar.attached? && user.avatar.variable?
+          spree_image_tag(
+            user.avatar,
+            width: options[:width],
+            height: options[:height],
+            class: options[:class],
+            style: "width: #{options[:width]}px; height: #{options[:height]}px;"
+          )
+        else
+          gradient = avatar_gradient_class(user.email)
+          content_tag :div, user.name&.initials,
+                      class: "#{gradient} #{options[:class]}",
+                      style: "width: #{options[:width]}px; height: #{options[:height]}px;"
+        end
+      end
+    end
+  end
+end