spree_backend 4.1.1 → 4.5.0

data/app/controllers/spree/admin/resource_controller.rb

@@ -3,6 +3,8 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
 
   helper_method :new_object_url, :edit_object_url, :object_url, :collection_url
   before_action :load_resource, except: :update_positions
+  before_action :set_currency, :set_current_store, only: [:new, :create]
+
   rescue_from ActiveRecord::RecordNotFound, with: :resource_not_found
 
   respond_to :html
@@ -25,19 +27,21 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
   def update
     invoke_callbacks(:update, :before)
     if @object.update(permitted_resource_params)
+      set_current_store
       invoke_callbacks(:update, :after)
       respond_with(@object) do |format|
+        format.turbo_stream if update_turbo_stream_enabled?
         format.html do
           flash[:success] = flash_message_for(@object, :successfully_updated)
-          redirect_to location_after_save
+          redirect_to location_after_save unless request.xhr?
         end
         format.js { render layout: false }
       end
     else
       invoke_callbacks(:update, :fails)
       respond_with(@object) do |format|
-        format.html { render action: :edit }
-        format.js { render layout: false }
+        format.html { render action: :edit, status: :unprocessable_entity }
+        format.js { render layout: false, status: :unprocessable_entity }
       end
     end
   end
@@ -49,22 +53,25 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
       invoke_callbacks(:create, :after)
       flash[:success] = flash_message_for(@object, :successfully_created)
       respond_with(@object) do |format|
+        format.turbo_stream if create_turbo_stream_enabled?
         format.html { redirect_to location_after_save }
         format.js   { render layout: false }
       end
     else
       invoke_callbacks(:create, :fails)
       respond_with(@object) do |format|
-        format.html { render action: :new }
-        format.js { render layout: false }
+        format.html { render action: :new, status: :unprocessable_entity }
+        format.js { render layout: false, status: :unprocessable_entity }
       end
     end
   end
 
   def update_positions
+    base_scope = model_class.try(:for_store, current_store) || model_class
+
     ApplicationRecord.transaction do
       params[:positions].each do |id, index|
-        model_class.find(id).set_list_position(index)
+        base_scope.find(id).set_list_position(index)
       end
     end
 
@@ -152,10 +159,16 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
 
   def parent
     if parent_data.present?
-      @parent ||= parent_data[:model_class].
+      base_scope = parent_data[:model_class].try(:for_store, current_store) || parent_data[:model_class]
+
+      @parent ||= base_scope.
                   # Don't use `find_by_attribute_name` to workaround globalize/globalize#423 bug
                   send(:find_by, parent_data[:find_by].to_s => params["#{resource.model_name}_id"])
       instance_variable_set("@#{resource.model_name}", @parent)
+
+      raise ActiveRecord::RecordNotFound if @parent.nil?
+
+      @parent
     end
   end
 
@@ -163,7 +176,8 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
     if parent_data.present?
       parent.send(controller_name).find(params[:id])
     else
-      model_class.find(params[:id])
+      base_scope = model_class.try(:for_store, current_store) || model_class
+      base_scope.find(params[:id])
     end
   end
 
@@ -178,11 +192,13 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
   def collection
     return parent.send(controller_name) if parent_data.present?
 
+    base_scope = model_class.try(:for_store, current_store) || model_class
+
     if model_class.respond_to?(:accessible_by) &&
         !current_ability.has_block?(params[:action], model_class)
-      model_class.accessible_by(current_ability, action)
+      base_scope.accessible_by(current_ability, action)
     else
-      model_class.where(nil)
+      base_scope.where(nil)
     end
   end
 
@@ -194,6 +210,19 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
     collection_url
   end
 
+  def set_current_store
+    return if @object.nil?
+
+    ensure_current_store(@object)
+  end
+
+  def set_currency
+    return if @object.nil?
+
+    @object.currency = current_currency if model_class.method_defined?(:currency=)
+    @object.cost_currency = current_currency if model_class.method_defined?(:cost_currency=)
+  end
+
   # URL helpers
 
   def new_object_url(options = {})
@@ -251,4 +280,12 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
   def new_actions
     [:new, :create]
   end
+
+  def create_turbo_stream_enabled?
+    false
+  end
+
+  def update_turbo_stream_enabled?
+    false
+  end
 end

data/app/controllers/spree/admin/return_index_controller.rb

@@ -2,12 +2,12 @@ module Spree
   module Admin
     class ReturnIndexController < BaseController
       def return_authorizations
-        collection(Spree::ReturnAuthorization)
+        collection(Spree::ReturnAuthorization.for_store(current_store).accessible_by(current_ability, :index))
         respond_with(@collection)
       end
 
       def customer_returns
-        collection(Spree::CustomerReturn)
+        collection(current_store.customer_returns.accessible_by(current_ability, :index))
         respond_with(@collection)
       end
 
@@ -18,12 +18,16 @@ module Spree
 
         params[:q] ||= {}
 
-        @collection = resource.all
         # @search needs to be defined as this is passed to search_form_for
-        @search = @collection.ransack(params[:q])
-        per_page = params[:per_page] || Spree::Config[:admin_customer_returns_per_page]
+        @search = resource.ransack(params[:q])
+        per_page = params[:per_page] || Spree::Backend::Config[:admin_customer_returns_per_page]
         @collection = @search.result.order(created_at: :desc).page(params[:page]).per(per_page)
       end
+
+      # this is needed for proper permissions checking
+      def model_class
+        action == :customer_returns ? Spree::CustomerReturn : Spree::ReturnAuthorization
+      end
     end
   end
 end

data/app/controllers/spree/admin/state_changes_controller.rb

@@ -1,18 +1,13 @@
 module Spree
   module Admin
     class StateChangesController < Spree::Admin::BaseController
+      include Spree::Admin::OrderConcern
+
       before_action :load_order, only: [:index]
 
       def index
         @state_changes = @order.state_changes.includes(:user).order(created_at: :desc)
       end
-
-      private
-
-      def load_order
-        @order = Order.find_by!(number: params[:order_id])
-        authorize! action, @order
-      end
     end
   end
 end

data/app/controllers/spree/admin/states_controller.rb

@@ -22,7 +22,7 @@ module Spree
       end
 
       def load_data
-        @countries = Country.order(:name)
+        @countries = Spree::Country.where(states_required: true).order(:name)
       end
     end
   end

data/app/controllers/spree/admin/stock_items_controller.rb

@@ -11,7 +11,7 @@ module Spree
       end
 
       def create
-        variant = Variant.find(params[:variant_id])
+        variant = current_store.variants.find(params[:variant_id])
         stock_location = StockLocation.find(params[:stock_location_id])
         stock_movement = stock_location.stock_movements.build(stock_movement_params)
         stock_movement.stock_item = stock_location.set_up_stock_item(variant)
@@ -41,7 +41,7 @@ module Spree
       end
 
       def stock_item
-        @stock_item ||= StockItem.find(params[:id])
+        @stock_item ||= current_store.stock_items.find(params[:id])
       end
 
       def determine_backorderable

data/app/controllers/spree/admin/stock_locations_controller.rb

@@ -6,10 +6,10 @@ module Spree
       private
 
       def set_country
-        @stock_location.country = Spree::Country.default
+        @stock_location.country = current_store.default_country
         unless @stock_location.country
           flash[:error] = Spree.t(:stock_locations_need_a_default_country)
-          redirect_to admin_stock_locations_path
+          redirect_to spree.admin_stock_locations_path
         end
       end
     end

data/app/controllers/spree/admin/stock_movements_controller.rb

@@ -18,7 +18,7 @@ module Spree
         @stock_movement = stock_location.stock_movements.build(stock_movement_params)
         if @stock_movement.save
           flash[:success] = flash_message_for(@stock_movement, :successfully_created)
-          redirect_to admin_stock_location_stock_movements_path(stock_location)
+          redirect_to spree.admin_stock_location_stock_movements_path(stock_location)
         else
           render :new
         end

data/app/controllers/spree/admin/stock_transfers_controller.rb

@@ -20,8 +20,11 @@ module Spree
 
       def create
         if params[:variant].nil?
-          flash[:error] = Spree.t('stock_transfer.errors.must_have_variant')
-          render :new
+          flash.now[:error] = Spree.t('stock_transfer.errors.must_have_variant')
+          render :new, status: :unprocessable_entity
+        elsif any_missing_variants?(params[:variant])
+          flash.now[:error] = Spree.t('stock_transfer.errors.variants_unavailable', stock: source_location.name)
+          render :new, status: :unprocessable_entity
         else
           variants = Hash.new(0)
           params[:variant].each_with_index do |variant_id, i|
@@ -33,23 +36,30 @@ module Spree
                                   variants)
 
           flash[:success] = Spree.t(:stock_successfully_transferred)
-          redirect_to admin_stock_transfer_path(stock_transfer)
+          redirect_to spree.admin_stock_transfer_path(stock_transfer)
         end
       end
 
       private
 
       def load_stock_locations
-        @stock_locations = Spree::StockLocation.active.order_default
+        @stock_locations = stock_locations_scope.active.order_default
       end
 
       def source_location
-        @source_location ||= params.key?(:transfer_receive_stock) ? nil :
-                               StockLocation.find(params[:transfer_source_location_id])
+        @source_location ||= params.key?(:transfer_receive_stock) ? nil : stock_locations_scope.find(params[:transfer_source_location_id])
       end
 
       def destination_location
-        @destination_location ||= StockLocation.find(params[:transfer_destination_location_id])
+        @destination_location ||= stock_locations_scope.find(params[:transfer_destination_location_id])
+      end
+
+      def any_missing_variants?(variant_ids)
+        source_location&.stock_items&.where(variant_id: variant_ids, count_on_hand: 0)&.any?
+      end
+
+      def stock_locations_scope
+        Spree::StockLocation.accessible_by(current_ability, :update)
       end
     end
   end

data/app/controllers/spree/admin/store_credits_controller.rb

@@ -9,24 +9,25 @@ module Spree
       before_action :ensure_unused_store_credit, only: [:update]
 
       def index
-        @store_credits = @user.store_credits.includes(:credit_type, :category).reverse_order
+        @store_credits = @user.store_credits.for_store(current_store).includes(:category).reverse_order
       end
 
       def create
         @store_credit = @user.store_credits.build(
           permitted_store_credit_params.merge(
             created_by: try_spree_current_user,
-            action_originator: try_spree_current_user
+            action_originator: try_spree_current_user,
+            store: current_store
           )
         )
 
         if @store_credit.save
           flash[:success] = flash_message_for(@store_credit, :successfully_created)
-          redirect_to admin_user_store_credits_path(@user)
+          redirect_to spree.admin_user_store_credits_path(@user)
         else
           load_categories
           flash[:error] = Spree.t('store_credit.errors.unable_to_create')
-          render :new
+          render :new, status: :unprocessable_entity
         end
       end
 
@@ -36,22 +37,22 @@ module Spree
 
         if @store_credit.save
           flash[:success] = flash_message_for(@store_credit, :successfully_updated)
-          redirect_to admin_user_store_credits_path(@user)
+          redirect_to spree.admin_user_store_credits_path(@user)
         else
           load_categories
           flash[:error] = Spree.t('store_credit.errors.unable_to_update')
-          render :edit
+          render :edit, status: :unprocessable_entity
         end
       end
 
       def destroy
-        @store_credit = @user.store_credits.find(params[:id])
+        @store_credit = @user.store_credits.for_store(current_store).find(params[:id])
         ensure_unused_store_credit
 
         if @store_credit.destroy
           flash[:success] = flash_message_for(@store_credit, :successfully_removed)
           respond_with(@store_credit) do |format|
-            format.html { redirect_to admin_user_store_credits_path(@user) }
+            format.html { redirect_to spree.admin_user_store_credits_path(@user) }
             format.js { render_js_for_destroy }
           end
         else
@@ -72,7 +73,7 @@ module Spree
 
         unless @user
           flash[:error] = Spree.t(:user_not_found)
-          redirect_to admin_path
+          redirect_to spree.admin_path
         end
       end
 
@@ -81,7 +82,11 @@ module Spree
       end
 
       def load_store_credit
-        @store_credit = Spree::StoreCredit.find_by(id: params[:id]) || Spree::StoreCredit.new
+        @store_credit = scope.find_by(id: params[:id]) || scope.new
+      end
+
+      def scope
+        current_store.store_credits
       end
 
       def ensure_unused_store_credit

data/app/controllers/spree/admin/stores_controller.rb

@@ -3,20 +3,22 @@ module Spree
     class StoresController < Spree::Admin::BaseController
       before_action :load_store, only: [:new, :edit, :update]
       before_action :set_default_currency, only: :new
-
-      def index
-        @stores = Spree::Store.all
-      end
+      before_action :set_default_locale, only: :new
+      before_action :normalize_supported_currencies, only: [:create, :update]
+      before_action :normalize_supported_locales, only: [:create, :update]
+      before_action :set_default_country_id, only: :new
+      before_action :load_all_countries, only: [:new, :edit, :update, :create]
+      before_action :load_all_zones, only: [:new, :edit, :update, :create]
 
       def create
-        @store = Spree::Store.new(permitted_store_params)
+        @store = stores_scope.new(permitted_store_params)
 
         if @store.save
           flash[:success] = flash_message_for(@store, :successfully_created)
-          redirect_to admin_stores_path
+          redirect_to spree.admin_url(domain: @store.url), allow_other_host: true
         else
           flash[:error] = "#{Spree.t('store_errors.unable_to_create')}: #{@store.errors.full_messages.join(', ')}"
-          render :new
+          render :new, status: :unprocessable_entity
         end
       end
 
@@ -25,45 +27,24 @@ module Spree
 
         if @store.save
           flash[:success] = flash_message_for(@store, :successfully_updated)
-          redirect_to admin_stores_path
         else
           flash[:error] = "#{Spree.t('store_errors.unable_to_update')}: #{@store.errors.full_messages.join(', ')}"
-          render :edit
         end
+
+        redirect_to spree.edit_admin_store_path(@store)
       end
 
       def destroy
-        @store = Spree::Store.find(params[:id])
+        @store = stores_scope.find(params[:id])
 
         if @store.destroy
           flash[:success] = flash_message_for(@store, :successfully_removed)
-          respond_with(@store) do |format|
-            format.html { redirect_to admin_stores_path }
-            format.js { render_js_for_destroy }
-          end
+          redirect_to spree.admin_url(domain: Spree::Store.default.url), allow_other_host: true
         else
           render plain: "#{Spree.t('store_errors.unable_to_delete')}: #{@store.errors.full_messages.join(', ')}", status: :unprocessable_entity
         end
       end
 
-      def set_default
-        store = Spree::Store.find(params[:id])
-        stores = Spree::Store.where.not(id: params[:id])
-
-        ApplicationRecord.transaction do
-          store.update(default: true)
-          stores.update_all(default: false)
-        end
-
-        if store.errors.empty?
-          flash[:success] = Spree.t(:store_set_as_default, store: store.name)
-        else
-          flash[:error] = "#{Spree.t(:store_not_set_as_default, store: store.name)} #{store.errors.full_messages.join(', ')}"
-        end
-
-        redirect_to admin_stores_path
-      end
-
       protected
 
       def permitted_store_params
@@ -73,11 +54,39 @@ module Spree
       private
 
       def load_store
-        @store = Spree::Store.find_by(id: params[:id]) || Spree::Store.new
+        @store = stores_scope.find_by(id: params[:id]) || stores_scope.new
+      end
+
+      def load_all_countries
+        @countries = Spree::Country.pluck(:name, :id)
+      end
+
+      def load_all_zones
+        @zones = Spree::Zone.pluck(:name, :id)
       end
 
       def set_default_currency
-        @store.default_currency = Spree::Config[:currency]
+        @store.default_currency = Spree::Store.default.default_currency
+      end
+
+      def set_default_locale
+        @store.default_locale = I18n.locale
+      end
+
+      def normalize_supported_currencies
+        if params[:store][:supported_currencies]&.is_a?(Array)
+          params[:store][:supported_currencies] = params[:store][:supported_currencies].compact.uniq.reject(&:blank?).join(',')
+        end
+      end
+
+      def normalize_supported_locales
+        if params[:store][:supported_locales]&.is_a?(Array)
+          params[:store][:supported_locales] = params[:store][:supported_locales].compact.uniq.reject(&:blank?).join(',')
+        end
+      end
+
+      def set_default_country_id
+        @store.default_country_id ||= Spree::Store.default.default_country_id || Spree::Country.find_by(iso: "US")&.id
       end
     end
   end

data/app/controllers/spree/admin/taxonomies_controller.rb

@@ -4,7 +4,7 @@ module Spree
       private
 
       def location_after_save
-        if @taxonomy.created_at == @taxonomy.updated_at
+        if @taxonomy.previously_new_record?
           edit_admin_taxonomy_url(@taxonomy)
         else
           admin_taxonomies_url

data/app/controllers/spree/admin/taxons_controller.rb

@@ -1,30 +1,13 @@
 module Spree
   module Admin
-    class TaxonsController < Spree::Admin::BaseController
-      before_action :load_taxonomy, only: [:create, :edit, :update]
-      before_action :load_taxon, only: [:edit, :update]
-      before_action :set_permalink_part, only: [:edit, :update]
+    class TaxonsController < ResourceController
+      belongs_to 'spree/taxonomy'
+
+      before_action :set_permalink_part, only: [:edit]
       respond_to :html, :js
 
       def index; end
 
-      def create
-        @taxon = @taxonomy.taxons.build(params[:taxon].except(:icon))
-        @taxon.build_icon(attachment: taxon_params[:icon])
-        if @taxon.save
-          respond_with(@taxon) do |format|
-            format.json { render json: @taxon.to_json }
-          end
-        else
-          flash[:error] = Spree.t('errors.messages.could_not_create_taxon')
-          respond_with(@taxon) do |format|
-            format.html { redirect_to @taxonomy ? edit_admin_taxonomy_url(@taxonomy) : admin_taxonomies_url }
-          end
-        end
-      end
-
-      def edit; end
-
       def update
         successful = @taxon.transaction do
           parent_id = params[:taxon][:parent_id]
@@ -51,33 +34,49 @@ module Spree
           rename_child_taxons if @update_children
 
           respond_with(@taxon) do |format|
-            format.html { redirect_to edit_admin_taxonomy_url(@taxonomy) }
+            format.html { redirect_to spree.edit_admin_taxonomy_taxon_path(@taxonomy.id, @taxon.id) }
             format.json { render json: @taxon.to_json }
           end
         else
           respond_with(@taxon) do |format|
-            format.html { render :edit }
-            format.json { render json: @taxon.errors.full_messages.to_sentence, status: 422 }
+            format.html { render :edit, status: :unprocessable_entity }
+            format.json { render json: @taxon.errors.full_messages.to_sentence, status: :unprocessable_entity }
           end
         end
       end
 
+      def remove_icon
+        if @taxon.icon.destroy
+          flash[:success] = Spree.t('notice_messages.icon_removed')
+          redirect_to spree.edit_admin_taxonomy_taxon_url(@taxonomy.id, @taxon.id)
+        else
+          flash[:error] = Spree.t('errors.messages.cannot_remove_icon')
+          render :edit, status: :unprocessable_entity
+        end
+      end
+
       private
 
-      def set_permalink_part
-        @permalink_part = @taxon.permalink.split('/').last
+      def location_after_save
+        spree.edit_admin_taxonomy_taxon_path(@taxonomy.id, @taxon.id)
       end
 
-      def taxon_params
-        params.require(:taxon).permit(permitted_taxon_attributes)
+      def parent_data
+        if action_name == 'index'
+          nil
+        else
+          super
+        end
       end
 
-      def load_taxon
-        @taxon = @taxonomy.taxons.find(params[:id])
+      def set_permalink_part
+        @permalink_part = @taxon.permalink.split('/').last
+        @parent_permalink = @taxon.permalink.split('/')[0...-1].join('/')
+        @parent_permalink += '/' unless @parent_permalink.blank?
       end
 
-      def load_taxonomy
-        @taxonomy = Taxonomy.find(params[:taxonomy_id])
+      def taxon_params
+        params.require(:taxon).permit(permitted_taxon_attributes)
       end
 
       def set_position
@@ -86,14 +85,14 @@ module Spree
       end
 
       def set_parent(parent_id)
-        @taxon.parent = Taxon.find(parent_id.to_i) if parent_id
+        @taxon.parent = current_store.taxons.find(parent_id) if parent_id
       end
 
       def set_permalink_params
+        set_permalink_part
+
         if params.key? 'permalink_part'
-          parent_permalink = @taxon.permalink.split('/')[0...-1].join('/')
-          parent_permalink += '/' unless parent_permalink.blank?
-          params[:taxon][:permalink] = parent_permalink + params[:permalink_part]
+          params[:taxon][:permalink] = @parent_permalink + params[:permalink_part]
         end
       end
 
@@ -113,6 +112,10 @@ module Spree
         taxon.set_permalink
         taxon.save!
       end
+
+      def scope
+        current_store.taxonomies
+      end
     end
   end
 end