spree_admin 5.3.4 → 5.4.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50a1165ee32d40280a53a301cc00059012380a2c0fd27e5ef6933ee074bd50b8
-  data.tar.gz: 4282e3887a4f1a32e13ec9611cf9d02377c5fd98ec153361d0f635bbd25e64b0
+  metadata.gz: 4f57b463a1f1a46360341017872bff19562f612a9f2fd6a040a5a340e8ad04b9
+  data.tar.gz: ab57b308e0087992c563e520a5d3312b1f49f8eaf0d07445700cd374f150f4f6
 SHA512:
-  metadata.gz: 74520ef7ba4d6f284ecf05f024bdfb835ccfa27b91fb564330bd5d45c42c857527d24adc0aa76e54403685d3387280ebfc431205544f59e34cc1318575ad3adc
-  data.tar.gz: d1fc1d04175d7baed961400407b43a9efa040a79f7e94d3902597bce0712258df8418737a4ba9539409350ed73933e9d435c4c65f6339c50a2a68df727a7c660
+  metadata.gz: 38b26c705f3a4445a0fe84f122a04ee8e1f209437573b6e1fad9a7f60cbf943a3cdc6130fbd12dc5af5b0b80cf80c90b7fa9d5b544f518b59a648ff8f91ec89e
+  data.tar.gz: 751ee61e2e785860e87f0677e3d2b3693f5c0c88586f38cd2fbeb38caafb779d0ea2c33129b46315109017da12acc59c39bdca974189e064a282d3610dcbf7cc

data/README.md

@@ -2,7 +2,7 @@
 
 [![Gem Version](https://badge.fury.io/rb/spree_admin.svg)](https://badge.fury.io/rb/spree_admin)
 
-Spree Admin provides a modern, fully-featured admin dashboard for managing your Spree Commerce store.
+Spree Admin provides a modern, fully-featured admin dashboard for managing your Spree application.
 
 ## Overview
 
@@ -147,4 +147,4 @@ end
 
 - [Admin Customization Guide](https://docs.spreecommerce.org/developer/customization/admin)
 - [Navigation Configuration](https://docs.spreecommerce.org/developer/customization/admin-navigation)
-- [Permissions Guide](https://docs.spreecommerce.org/developer/customization/permissions)
+- [Permissions Guide](https://docs.spreecommerce.org/developer/customization/permissions)

data/app/controllers/concerns/spree/admin/order_concern.rb

@@ -10,7 +10,7 @@ module Spree
       protected
 
       def load_order
-        @order = current_store.orders.find_by!(number: params[:order_id])
+        @order = current_store.orders.find_by_prefix_id!(params[:order_id])
         authorize! action, @order
         @order
       end

data/app/controllers/spree/admin/action_text/video_embeds_controller.rb

@@ -20,7 +20,7 @@ module Spree
 
             render json: { sgid: video_embed.attachable_sgid, content: content }, status: :created
           else
-            render json: { error: video_embed.errors.full_messages.to_sentence }, status: :unprocessable_entity
+            render json: { error: video_embed.errors.full_messages.to_sentence }, status: :unprocessable_content
           end
         end
 

data/app/controllers/spree/admin/addresses_controller.rb

@@ -4,7 +4,7 @@ module Spree
       before_action :set_new_address_country, only: :new
 
       def create
-        user = Spree.user_class.find(params[:user_id])
+        user = Spree.user_class.find_by_prefix_id!(params[:user_id])
 
         result = create_service.call(
           address_params: permitted_resource_params,

data/app/controllers/spree/admin/admin_users_controller.rb

@@ -56,7 +56,7 @@ module Spree
           end
           redirect_to spree.admin_path
         else
-          render :new, status: :unprocessable_entity
+          render :new, status: :unprocessable_content
         end
       end
 
@@ -74,7 +74,7 @@ module Spree
         if @admin_user.update(permitted_params)
           redirect_to spree.admin_admin_user_path(@admin_user), status: :see_other, notice: flash_message_for(@admin_user, :successfully_updated)
         else
-          render :edit, status: :unprocessable_entity
+          render :edit, status: :unprocessable_content
         end
       end
 
@@ -110,7 +110,7 @@ module Spree
       end
 
       def load_admin_user
-        @admin_user = Spree.admin_user_class.accessible_by(current_ability).find(params[:id])
+        @admin_user = Spree.admin_user_class.accessible_by(current_ability).find_by_prefix_id!(params[:id])
       end
 
       # for self signup flow, we use the minimal layout

data/app/controllers/spree/admin/api_keys_controller.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    class ApiKeysController < ResourceController
+      include Spree::Admin::SettingsConcern
+      include Spree::Admin::TableConcern
+
+      helper 'spree/admin/api_keys'
+
+      def create
+        invoke_callbacks(:create, :before)
+        set_created_by
+        @object.attributes = permitted_resource_params
+        if @object.save
+          invoke_callbacks(:create, :after)
+          if @object.secret?
+            # Pass plaintext token via flash so the show page can display it once.
+            # Flash is stored in the encrypted session cookie and auto-cleared after one request.
+            # Skip the success flash — the token warning banner is sufficient feedback.
+            flash[:plaintext_token] = @object.plaintext_token
+          else
+            flash[:success] = message_after_create
+          end
+          redirect_to location_after_create, status: :see_other
+        else
+          invoke_callbacks(:create, :fails)
+          render action: :new, status: :unprocessable_content
+        end
+      end
+
+      def revoke
+        @object = scope.find_by_prefix_id!(params[:id])
+        @object.revoke!(try_spree_current_user)
+        flash[:success] = Spree.t('admin.api_keys.revoked')
+        redirect_to spree.admin_api_key_path(@object)
+      end
+
+      private
+
+      def model_class
+        Spree::ApiKey
+      end
+
+      def scope
+        current_store.api_keys
+      end
+
+      def object_name
+        'api_key'
+      end
+
+      def permitted_resource_params
+        permitted = params.require(:api_key).permit(permitted_api_key_attributes)
+        # key_type can only be set on create, not update
+        permitted.delete(:key_type) unless action_name == 'create'
+        permitted
+      end
+
+      def location_after_save
+        spree.admin_api_key_path(@object)
+      end
+
+      def update_turbo_stream_enabled?
+        true
+      end
+
+      def build_resource
+        if params[:api_key].present?
+          scope.new(permitted_resource_params.merge(created_by: try_spree_current_user))
+        else
+          scope.new(created_by: try_spree_current_user)
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/assets_controller.rb

@@ -14,7 +14,7 @@ module Spree
           store_uploaded_asset_in_session(@asset, @asset.viewable_type) if @asset.viewable.nil? || @asset.viewable.new_record?
         else
           flash.now[:error] = @asset.errors.full_messages.to_sentence
-          render :create, status: :unprocessable_entity
+          render :create, status: :unprocessable_content
         end
       end
 
@@ -27,7 +27,7 @@ module Spree
             format.json { render json: @asset }
           end
         else
-          head :unprocessable_entity
+          head :unprocessable_content
         end
       end
 

data/app/controllers/spree/admin/base_controller.rb

@@ -14,7 +14,6 @@ module Spree
       helper 'spree/integrations'
 
       before_action :authorize_admin
-      after_action :set_return_to, only: [:index]
 
       protected
 
@@ -56,7 +55,8 @@ module Spree
 
       def try_spree_current_user
         if Spree.admin_user_class && Spree.admin_user_class != Spree.user_class
-          send("current_#{Spree.admin_user_class.model_name.singular_route_key}")
+          method_name = "current_#{Spree.admin_user_class.model_name.singular_route_key}"
+          respond_to?(method_name, true) ? send(method_name) : nil
         else
           # use Spree::Core::ControllerHelpers::Auth#try_spree_current_user
           super
@@ -80,8 +80,8 @@ module Spree
         Spree.t(event_sym, resource: resource_desc)
       end
 
-      def config_locale
-        I18n.default_locale
+      def default_locale
+        @default_locale ||= current_store&.preferred_admin_locale.presence || super
       end
 
       def current_timezone

data/app/controllers/spree/admin/classifications_controller.rb

@@ -1,7 +1,7 @@
 module Spree
   module Admin
     class ClassificationsController < ResourceController
-      belongs_to 'spree/taxon', find_by: :id
+      belongs_to 'spree/taxon', find_by: :permalink
 
       layout 'turbo_rails/frame'
 
@@ -19,7 +19,7 @@ module Spree
       private
 
       def collection_url
-        spree.admin_taxon_classifications_path(@parent.id)
+        spree.admin_taxon_classifications_path(@parent)
       end
 
       def update_turbo_stream_enabled?
@@ -38,8 +38,9 @@ module Spree
                         includes(
                           :taxon,
                           product: {
-                            master: [:images, :stock_items, :stock_locations],
-                            variants: [:images, :stock_items, :stock_locations]
+                            thumbnail: [attachment_attachment: :blob],
+                            master: [:stock_items, :stock_locations],
+                            variants: [:stock_items, :stock_locations]
                           }
                         ).
                         accessible_by(current_ability)

data/app/controllers/spree/admin/coupon_codes_controller.rb

@@ -1,7 +1,7 @@
 module Spree
   module Admin
     class CouponCodesController < ResourceController
-      belongs_to 'spree/promotion', find_by: :id
+      belongs_to 'spree/promotion', find_by: :prefix_id
 
       include PromotionsBreadcrumbConcern
     end

data/app/controllers/spree/admin/customer_group_users_controller.rb

@@ -33,7 +33,8 @@ module Spree
       end
 
       def destroy
-        deleted_count = @customer_group.remove_customers([params[:id]])
+        user = Spree.user_class.find_by_prefix_id!(params[:id])
+        deleted_count = @customer_group.remove_customers([user.id])
 
         if deleted_count > 0
           flash[:success] = Spree.t(:customer_removed_from_group)
@@ -58,7 +59,7 @@ module Spree
       private
 
       def set_customer_group
-        @customer_group = current_store.customer_groups.find(params[:customer_group_id])
+        @customer_group = current_store.customer_groups.find_by_prefix_id!(params[:customer_group_id])
       end
 
       def model_class

data/app/controllers/spree/admin/dashboard_controller.rb

@@ -146,7 +146,8 @@ module Spree
                   end
 
         @top_landing_pages = @visits_scope.where.not(landing_page: [nil, '']).top(:landing_page, 10)
-        @top_referrers = @visits_scope.where.not(referring_domain: current_store.custom_domains.pluck(:url) << current_store.url).top(
+        excluded_domains = current_store.respond_to?(:custom_domains) ? current_store.custom_domains.pluck(:url) : []
+        @top_referrers = @visits_scope.where.not(referring_domain: excluded_domains << current_store.url).top(
           :referring_domain, 10
         )
         @top_locations = @visits_scope.top(:country, 10)

data/app/controllers/spree/admin/digital_assets_controller.rb

@@ -26,7 +26,7 @@ module Spree
       end
 
       def find_resource
-        parent.digitals.find(params[:id])
+        parent.digitals.find_by_prefix_id!(params[:id])
       end
 
       def create_turbo_stream_enabled?

data/app/controllers/spree/admin/exports_controller.rb

@@ -35,7 +35,8 @@ module Spree
       end
 
       def assign_params
-        @object.type = permitted_resource_params[:type] if available_types.map(&:to_s).include?(permitted_resource_params[:type])
+        available_type =  available_types.map(&:to_s).find { |t| t == permitted_resource_params[:type] }
+        @object = @object.becomes!(available_type.constantize) if available_type.present?
         @object.search_params = permitted_resource_params[:search_params]
       end
 

data/app/controllers/spree/admin/gift_cards_controller.rb

@@ -1,8 +1,8 @@
 module Spree
   module Admin
     class GiftCardsController < ResourceController
-      prepend_before_action :load_user
       prepend_before_action :set_user_id_filter, only: :index
+      prepend_before_action :load_user
       before_action :add_breadcrumbs
       before_action :load_orders, only: :show
 
@@ -27,10 +27,10 @@ module Spree
       end
 
       def set_user_id_filter
-        return if params[:user_id].blank?
+        return if @user.blank?
 
         params[:q] ||= {}
-        params[:q][:user_id_eq] = params[:user_id] if params[:user_id].present?
+        params[:q][:user_id_eq] = @user.id
       end
 
       def location_after_destroy
@@ -42,11 +42,11 @@ module Spree
       end
 
       def location_after_save
-        spree.admin_gift_card_path(@object.id)
+        spree.admin_gift_card_path(@object)
       end
 
       def load_user
-        @user = Spree.user_class.find_by(id: params[:user_id]) if params[:user_id].present?
+        @user = Spree.user_class.find_by_prefix_id(params[:user_id]) if params[:user_id].present?
       end
 
       def gift_cards_filter_dropdown_value

data/app/controllers/spree/admin/import_mappings_controller.rb

@@ -1,7 +1,7 @@
 module Spree
   module Admin
     class ImportMappingsController < ResourceController
-      belongs_to 'spree/import', find_by: :number
+      belongs_to 'spree/import', find_by: :prefix_id
 
       def update_turbo_stream_enabled?
         true

data/app/controllers/spree/admin/import_rows_controller.rb

@@ -1,7 +1,7 @@
 module Spree
   module Admin
     class ImportRowsController < ResourceController
-      belongs_to 'spree/import', find_by: :number
+      belongs_to 'spree/import', find_by: :prefix_id
     end
   end
 end

data/app/controllers/spree/admin/integrations_controller.rb

@@ -49,7 +49,7 @@ module Spree
 
         unless @integration.can_connect?
           @integration.errors.add(:base, :unable_to_connect, error_message: @integration.connection_error_message)
-          render action == :create ? :new : :edit, status: :unprocessable_entity
+          render action == :create ? :new : :edit, status: :unprocessable_content
         end
       end
 

data/app/controllers/spree/admin/invitations_controller.rb

@@ -42,13 +42,14 @@ module Spree
             format.turbo_stream
           end
         else
-          render :new, status: :unprocessable_entity
+          render :new, status: :unprocessable_content
         end
       end
 
       # GET /admin/invitations/:id?token=:token
       def show
-        @invitation = Spree::Invitation.pending.not_expired.find_by!(id: params[:id], token: params[:token])
+        decoded_id = Spree::Invitation.decode_prefixed_id(params[:id])
+        @invitation = Spree::Invitation.pending.not_expired.find_by!(id: decoded_id, token: params[:token])
         @parent = @invitation.resource
 
         if try_spree_current_user.present?
@@ -68,7 +69,7 @@ module Spree
 
       # PUT /admin/invitations/:id/accept
       def accept
-        @invitation = try_spree_current_user.invitations.pending.not_expired.find(params[:id])
+        @invitation = try_spree_current_user.invitations.pending.not_expired.find_by_prefix_id!(params[:id])
 
         authorize! :accept, @invitation
 
@@ -78,7 +79,7 @@ module Spree
 
       # PUT /admin/invitations/:id/resend
       def resend
-        @invitation = scope.find(params[:id])
+        @invitation = scope.find_by_prefix_id!(params[:id])
         @invitation.resend!
         redirect_back fallback_location: spree.admin_invitations_path, notice: Spree.t('invitation_resent')
       end
@@ -94,7 +95,7 @@ module Spree
       private
 
       def load_invitation
-        @invitation = scope.find(params[:id])
+        @invitation = scope.find_by_prefix_id!(params[:id])
       end
 
       def load_parent

data/app/controllers/spree/admin/line_items_controller.rb

@@ -1,7 +1,7 @@
 module Spree
   module Admin
     class LineItemsController < Spree::Admin::ResourceController
-      belongs_to 'spree/order', find_by: :number
+      belongs_to 'spree/order', find_by: :prefix_id
 
       layout 'turbo_rails/frame'
 

data/app/controllers/spree/admin/markets_controller.rb

@@ -0,0 +1,28 @@
+module Spree
+  module Admin
+    class MarketsController < ResourceController
+      include Spree::Admin::SettingsConcern
+
+      before_action :load_data, except: :index
+      before_action :normalize_supported_locales, only: [:create, :update]
+
+      protected
+
+      def load_data
+        @countries = current_store.countries_with_shipping_coverage
+      end
+
+      def permitted_resource_params
+        params.require(:market).permit(permitted_market_attributes)
+      end
+
+      private
+
+      def normalize_supported_locales
+        if params.dig(:market, :supported_locales)&.is_a?(Array)
+          params[:market][:supported_locales] = params[:market][:supported_locales].compact.uniq.reject(&:blank?).join(',')
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/option_values_controller.rb

@@ -1,7 +1,7 @@
 module Spree
   module Admin
     class OptionValuesController < ResourceController
-      belongs_to 'spree/option_type', find_by: :id
+      belongs_to 'spree/option_type', find_by: :prefix_id
 
       def select_options
         render json: @option_type.option_values.accessible_by(current_ability).to_tom_select_json

data/app/controllers/spree/admin/orders/adjustments_controller.rb

@@ -35,7 +35,7 @@ module Spree
             flash.now[:error] = @adjustment.errors.full_messages.to_sentence
             respond_to do |format|
               format.turbo_stream
-              format.html { render :new, status: :unprocessable_entity }
+              format.html { render :new, status: :unprocessable_content }
             end
           end
         end
@@ -58,7 +58,7 @@ module Spree
             end
           else
             flash.now[:error] = @adjustment.errors.full_messages.to_sentence
-            render :edit, status: :unprocessable_entity
+            render :edit, status: :unprocessable_content
           end
         end
 
@@ -102,12 +102,12 @@ module Spree
         end
 
         def load_order
-          @order = current_store.orders.find_by!(number: params[:order_id])
+          @order = current_store.orders.find_by_prefix_id!(params[:order_id])
           authorize! :update, @order
         end
 
         def load_adjustment
-          @adjustment = @order.all_adjustments.find(params[:id])
+          @adjustment = @order.all_adjustments.find_by_prefix_id!(params[:id])
           authorize! action, @adjustment
         end
 

data/app/controllers/spree/admin/orders/billing_address_controller.rb

@@ -20,7 +20,7 @@ module Spree
             @order.clone_shipping_address
 
           elsif params[:billing_address_id].present?
-            @address = Spree::Address.accessible_by(current_ability, :manage).find(params[:billing_address_id])
+            @address = Spree::Address.accessible_by(current_ability, :manage).find_by_prefix_id!(params[:billing_address_id])
             @order.bill_address_id = @address.id
           else
             @order.bill_address_attributes = address_params
@@ -48,7 +48,7 @@ module Spree
             flash[:success] = Spree.t(:successfully_created, resource: Spree.t(:billing_address))
             redirect_to spree.edit_admin_order_path(@order)
           else
-            render :create, status: :unprocessable_entity
+            render :create, status: :unprocessable_content
           end
         end
 
@@ -60,7 +60,7 @@ module Spree
           if params[:billing_address_type] == 'same_as_shipping'
             @order.clone_shipping_address
           elsif params[:billing_address_id].present?
-            @address = Spree::Address.accessible_by(current_ability, :manage).find(params[:billing_address_id])
+            @address = Spree::Address.accessible_by(current_ability, :manage).find_by_prefix_id!(params[:billing_address_id])
             @order.bill_address_id = @address.id
           else
             @order.bill_address_attributes = address_params
@@ -88,7 +88,7 @@ module Spree
             flash[:success] = Spree.t(:successfully_updated, resource: Spree.t(:billing_address))
             redirect_to spree.edit_admin_order_path(@order)
           else
-            render :update, status: :unprocessable_entity
+            render :update, status: :unprocessable_content
           end
         end
 

data/app/controllers/spree/admin/orders/customer_returns_controller.rb

@@ -32,7 +32,7 @@ module Spree
         end
 
         def find_resource
-          current_store.customer_returns.accessible_by(current_ability, :show).find(params[:id])
+          current_store.customer_returns.accessible_by(current_ability, :show).find_by_prefix_id!(params[:id])
         end
 
         def load_form_data

data/app/controllers/spree/admin/orders/shipping_address_controller.rb

@@ -36,7 +36,7 @@ module Spree
 
             redirect_to spree.edit_admin_order_path(@order)
           else
-            render :create, status: :unprocessable_entity
+            render :create, status: :unprocessable_content
           end
         end
 
@@ -46,7 +46,7 @@ module Spree
 
         def update
           if params[:shipping_address_id].present?
-            @address = Spree::Address.accessible_by(current_ability, :manage).find(params[:shipping_address_id])
+            @address = Spree::Address.accessible_by(current_ability, :manage).find_by_prefix_id!(params[:shipping_address_id])
             @order.ship_address_id = @address.id
           else
             @order.ship_address_attributes = address_params
@@ -70,7 +70,7 @@ module Spree
 
             redirect_to spree.edit_admin_order_path(@order)
           else
-            render :update, status: :unprocessable_entity
+            render :update, status: :unprocessable_content
           end
         end
 

data/app/controllers/spree/admin/orders/user_controller.rb

@@ -29,11 +29,11 @@ module Spree
                 redirect_to spree.edit_admin_order_path(@order)
               else
                 flash[:error] = result.error.value.full_messages.to_sentence
-                redirect_to spree.new_admin_order_user_path(@order), status: :unprocessable_entity
+                redirect_to spree.new_admin_order_user_path(@order), status: :unprocessable_content
               end
             else
               flash[:error] = @user.errors.full_messages.to_sentence
-              redirect_to spree.new_admin_order_user_path(@order), status: :unprocessable_entity
+              redirect_to spree.new_admin_order_user_path(@order), status: :unprocessable_content
             end
           else
             @user = @order.build_user(user_params)
@@ -47,13 +47,13 @@ module Spree
               redirect_to spree.edit_admin_order_path(@order)
             else
               flash[:error] = @user.errors.full_messages.to_sentence
-              redirect_to spree.new_admin_order_user_path(@order), status: :unprocessable_entity
+              redirect_to spree.new_admin_order_user_path(@order), status: :unprocessable_content
             end
           end
         end
 
         def update
-          user = Spree.user_class.find(params[:user_id])
+          user = Spree.user_class.find_by_prefix_id!(params[:user_id])
           @order.associate_user!(user)
 
           if !@order.completed? && @order.line_items.any?

data/app/controllers/spree/admin/orders_controller.rb

@@ -24,7 +24,7 @@ module Spree
           flash[:success] = flash_message_for(@order, :successfully_created)
           redirect_to spree.edit_admin_order_path(@order)
         else
-          render :new, status: :unprocessable_entity
+          render :new, status: :unprocessable_content
         end
       end
 
@@ -47,8 +47,12 @@ module Spree
 
       # PUT /admin/orders/:id/cancel
       def cancel
-        @order.canceled_by(try_spree_current_user)
-        flash[:success] = Spree.t(:order_canceled)
+        result = @order.canceled_by(try_spree_current_user)
+        if result.success?
+          flash[:success] = Spree.t(:order_canceled)
+        else
+          flash[:error] = result.error.to_s
+        end
         redirect_back fallback_location: spree.edit_admin_order_url(@order)
       end
 
@@ -102,7 +106,7 @@ module Spree
       end
 
       def load_order
-        @order = scope.includes(:adjustments).find_by!(number: params[:id])
+        @order = scope.includes(:adjustments).find_by_prefix_id!(params[:id])
         authorize! action, @order
       end
 

data/app/controllers/spree/admin/payments_controller.rb

@@ -3,7 +3,7 @@ module Spree
     class PaymentsController < Spree::Admin::ResourceController
       include Spree::Admin::OrderBreadcrumbConcern
 
-      belongs_to 'spree/order', find_by: :number
+      belongs_to 'spree/order', find_by: :prefix_id
 
       before_action :load_data
       before_action :proceed_order_state, only: :new
@@ -48,13 +48,13 @@ module Spree
         invoke_callbacks(:create, :fails)
 
         flash[:error] = e.message.to_s
-        render :new, status: :unprocessable_entity
+        render :new, status: :unprocessable_content
       rescue ActiveRecord::RecordInvalid => _e
         @object.failure if defined?(@object) && @object.persisted?
         invoke_callbacks(:create, :fails)
 
         flash[:error] = @object.errors.full_messages.to_sentence
-        render :new, status: :unprocessable_entity
+        render :new, status: :unprocessable_content
       end
 
       def capture