spree_backend 4.2.5 → 4.3.0

data/app/controllers/concerns/spree/admin/order_concern.rb

@@ -0,0 +1,24 @@
+module Spree
+  module Admin
+    module OrderConcern
+      extend ActiveSupport::Concern
+
+      included do
+        rescue_from ActiveRecord::RecordNotFound, with: :resource_not_found
+      end
+
+      protected
+
+      def load_order
+        @order = current_store.orders.find_by!(number: params[:order_id])
+        authorize! action, @order
+        @order
+      end
+
+      def resource_not_found
+        flash[:error] = flash_message_for(model_class.new, :not_found)
+        redirect_to spree.admin_orders_path
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/admin/product_concern.rb

@@ -0,0 +1,11 @@
+module Spree
+  module Admin
+    module ProductConcern
+      extend ActiveSupport::Concern
+
+      def product_scope
+        current_store.products.accessible_by(current_ability, :index)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/base_controller.rb

@@ -1,6 +1,16 @@
 module Spree
   module Admin
-    class BaseController < Spree::BaseController
+    class BaseController < ApplicationController
+      include Spree::Core::ControllerHelpers::Auth
+      include Spree::Core::ControllerHelpers::Search
+      include Spree::Core::ControllerHelpers::Store
+      include Spree::Core::ControllerHelpers::StrongParameters
+      include Spree::Core::ControllerHelpers::Locale
+      include Spree::Core::ControllerHelpers::Currency
+
+      respond_to :html
+
+      helper 'spree/base'
       helper 'spree/admin/navigation'
       helper 'spree/locale'
       helper 'spree/currency'
@@ -8,6 +18,9 @@ module Spree
 
       before_action :authorize_admin
       before_action :generate_admin_api_key
+      before_action :load_stores
+
+      helper_method :admin_oauth_token
 
       protected
 
@@ -25,6 +38,24 @@ module Spree
         authorize! action, record
       end
 
+      def redirect_unauthorized_access
+        if try_spree_current_user
+          flash[:error] = Spree.t(:authorization_failure)
+          redirect_to spree.admin_forbidden_path
+        else
+          store_location
+          if defined?(spree.admin_login_path)
+            redirect_to spree.admin_login_path
+          elsif respond_to?(:spree_login_path)
+            redirect_to spree_login_path
+          elsif spree.respond_to?(:root_path)
+            redirect_to spree.root_path
+          else
+            redirect_to main_app.respond_to?(:root_path) ? main_app.root_path : '/'
+          end
+        end
+      end
+
       # Need to generate an API key for a user due to some backend actions
       # requiring authentication to the Spree API
       def generate_admin_api_key
@@ -35,7 +66,7 @@ module Spree
 
       def flash_message_for(object, event_sym)
         resource_desc  = object.class.model_name.human
-        resource_desc += " \"#{object.name}\"" if object.respond_to?(:name) && object.name.present?
+        resource_desc += " \"#{object.name}\"" if (object.persisted? || object.destroyed?) && object.respond_to?(:name) && object.name.present? && !object.is_a?(Spree::Order)
         Spree.t(event_sym, resource: resource_desc)
       end
 
@@ -47,12 +78,41 @@ module Spree
         Spree::Backend::Config[:locale]
       end
 
+      def stores_scope
+        Spree::Store.accessible_by(current_ability, :show)
+      end
+
+      def load_stores
+        @stores = stores_scope.order(default: :desc)
+      end
+
       def can_not_transition_without_customer_info
         unless @order.billing_address.present?
           flash[:notice] = Spree.t(:fill_in_customer_info)
-          redirect_to edit_admin_order_customer_url(@order)
+          redirect_to spree.edit_admin_order_customer_url(@order)
+        end
+      end
+
+      def admin_oauth_application
+        @admin_oauth_application ||= begin
+          Doorkeeper::Application.find_or_create_by!(name: 'Admin Panel', scopes: 'admin', redirect_uri: '')
         end
       end
+
+      # FIXME: auto-expire this token
+      def admin_oauth_token
+        user = try_spree_current_user
+        return unless user
+
+        @admin_oauth_token ||= begin
+          Doorkeeper::AccessToken.active_for(user).where(application_id: admin_oauth_application.id).last ||
+            Doorkeeper::AccessToken.create!(
+              resource_owner_id: user.id,
+              application_id: admin_oauth_application.id,
+              scopes: admin_oauth_application.scopes
+            )
+        end.token
+      end
     end
   end
 end

data/app/controllers/spree/admin/cms_pages_controller.rb

@@ -0,0 +1,29 @@
+module Spree
+  module Admin
+    class CmsPagesController < ResourceController
+      private
+
+      def scope
+        current_store.cms_pages
+      end
+
+      def find_resource
+        scope.find(params[:id])
+      end
+
+      def collection
+        return @collection if @collection.present?
+
+        params[:q] ||= {}
+        @collection = scope
+
+        @search = @collection.ransack(params[:q])
+        @collection = @search.result.page(params[:page]).per(params[:per_page])
+      end
+
+      def location_after_save
+        spree.edit_admin_cms_page_path(@cms_page)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/cms_sections_controller.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Admin
+    class CmsSectionsController < ResourceController
+      belongs_to 'spree/cms_page'
+
+      def collection_url
+        spree.edit_admin_cms_page_path(@cms_page)
+      end
+
+      def location_after_save
+        spree.edit_admin_cms_page_cms_section_path(@cms_page, @cms_section)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/customer_returns_controller.rb

@@ -31,15 +31,14 @@ module Spree
       end
 
       def find_resource
-        Spree::CustomerReturn.accessible_by(current_ability, :show).find(params[:id])
+        current_store.customer_returns.accessible_by(current_ability, :show).find(params[:id])
       end
 
       def collection
         parent # trigger loading the order
-        @collection ||= Spree::ReturnItem.
-                        accessible_by(current_ability).
-                        where(inventory_unit_id: @order.inventory_units.pluck(:id)).
-                        map(&:customer_return).uniq.compact
+
+        order_customer_return_ids = @order.return_items.accessible_by(current_ability).pluck(:customer_return_id).uniq.compact
+        @collection ||= current_store.customer_returns.where(id: order_customer_return_ids)
         @customer_returns = @collection
       end
 

data/app/controllers/spree/admin/errors_controller.rb

@@ -0,0 +1,11 @@
+module Spree
+  module Admin
+    class ErrorsController < BaseController
+      skip_before_action :authorize_admin
+
+      def forbidden
+        render status: 403
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/general_settings_controller.rb

@@ -17,7 +17,7 @@ module Spree
         end
 
         flash[:success] = Spree.t(:successfully_updated, resource: Spree.t(:general_settings))
-        redirect_to edit_admin_general_settings_path
+        redirect_to spree.edit_admin_general_settings_path
       end
 
       def clear_cache

data/app/controllers/spree/admin/images_controller.rb

@@ -1,8 +1,8 @@
 module Spree
   module Admin
     class ImagesController < ResourceController
+      before_action :load_product
       before_action :load_edit_data, except: :index
-      before_action :load_index_data, only: :index
 
       create.before :set_viewable
       update.before :set_viewable
@@ -10,19 +10,14 @@ module Spree
       private
 
       def location_after_destroy
-        admin_product_images_url(@product)
+        spree.admin_product_images_url(@product)
       end
 
       def location_after_save
-        admin_product_images_url(@product)
-      end
-
-      def load_index_data
-        @product = Product.friendly.preload(*variant_index_includes).find(params[:product_id])
+        spree.admin_product_images_url(@product)
       end
 
       def load_edit_data
-        @product = Product.friendly.preload(*variant_edit_includes).find(params[:product_id])
         @variants = @product.variants.map do |variant|
           [variant.sku_and_options_text, variant.id]
         end
@@ -34,16 +29,24 @@ module Spree
         @image.viewable_id = params[:image][:viewable_id]
       end
 
-      def variant_index_includes
-        [
-          variant_images: [viewable: { option_values: :option_type }]
-        ]
+      def load_product
+        @product = scope.friendly.find(params[:product_id])
+      end
+
+      def scope
+        current_store.products
+      end
+
+      def collection_url
+        spree.admin_product_images_url
+      end
+
+      def modle_class
+        Spree::Image
       end
 
-      def variant_edit_includes
-        [
-          variants_including_master: { option_values: :option_type, images: :viewable }
-        ]
+      def collection
+        @collection ||= load_product.variant_images
       end
     end
   end

data/app/controllers/spree/admin/log_entries_controller.rb

@@ -1,7 +1,9 @@
 module Spree
   module Admin
     class LogEntriesController < Spree::Admin::BaseController
-      before_action :find_order_and_payment
+      include Spree::Admin::OrderConcern
+      before_action :load_order
+      before_action :load_payment
 
       def index
         @log_entries = @payment.log_entries
@@ -9,8 +11,7 @@ module Spree
 
       private
 
-      def find_order_and_payment
-        @order = Spree::Order.find_by!(number: params[:order_id])
+      def load_payment
         @payment = @order.payments.find_by!(number: params[:payment_id])
       end
     end

data/app/controllers/spree/admin/menu_items_controller.rb

@@ -0,0 +1,33 @@
+module Spree
+  module Admin
+    class MenuItemsController < ResourceController
+      belongs_to 'spree/menu'
+
+      before_action :load_data
+
+      def collection_url
+        spree.edit_admin_menu_path(@menu)
+      end
+
+      def location_after_save
+        spree.edit_admin_menu_menu_item_path(@menu, @menu_item)
+      end
+
+      def remove_icon
+        if @menu_item.icon&.destroy
+          flash[:success] = Spree.t('notice_messages.icon_removed')
+          redirect_to spree.edit_admin_menu_menu_item_path(@menu, @menu_item)
+        else
+          flash[:error] = Spree.t('errors.messages.cannot_remove_icon')
+          render :edit
+        end
+      end
+
+      private
+
+      def load_data
+        @menu_item_types = Spree::MenuItem::ITEM_TYPE
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/menus_controller.rb

@@ -0,0 +1,32 @@
+module Spree
+  module Admin
+    class MenusController < ResourceController
+      def index; end
+
+      private
+
+      def scope
+        current_store.menus
+      end
+
+      def find_resource
+        scope.find(params[:id])
+      end
+
+      def collection
+        return @collection if @collection.present?
+
+        params[:q] ||= {}
+        @collection = scope
+
+        @search = @collection.ransack(params[:q])
+        @collection = @search.result.page(params[:page]).
+                      per(params[:per_page] || Spree::Backend::Config[:menus_per_page])
+      end
+
+      def location_after_save
+        spree.edit_admin_menu_path(@menu)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/option_types_controller.rb

@@ -11,7 +11,7 @@ module Spree
         end
 
         respond_to do |format|
-          format.html { redirect_to admin_product_variants_url(params[:product_id]) }
+          format.html { redirect_to spree.admin_product_variants_url(params[:product_id]) }
           format.js { render plain: 'Ok' }
         end
       end

data/app/controllers/spree/admin/orders/customer_details_controller.rb

@@ -2,6 +2,8 @@ module Spree
   module Admin
     module Orders
       class CustomerDetailsController < Spree::Admin::BaseController
+        include Spree::Admin::OrderConcern
+
         before_action :load_order
         before_action :load_user, only: :update, unless: :guest_checkout?
 
@@ -11,15 +13,12 @@ module Spree
         end
 
         def edit
-          country_id = Address.default.country_id
-          @order.build_bill_address(country_id: country_id) if @order.bill_address.nil?
-          @order.build_ship_address(country_id: country_id) if @order.ship_address.nil?
-
-          @order.bill_address.country_id = country_id if @order.bill_address.country.nil?
-          @order.ship_address.country_id = country_id if @order.ship_address.country.nil?
+          @order.build_bill_address(country: current_store.default_country) if @order.bill_address.nil?
+          @order.build_ship_address(country: current_store.default_country) if @order.ship_address.nil?
         end
 
         def update
+          params[:order][:user_id] = nil if guest_checkout?
           if @order.update(order_params)
             @order.associate_user!(@user, @order.email.blank?) unless guest_checkout?
             @order.next if @order.address?
@@ -27,7 +26,7 @@ module Spree
 
             if @order.errors.empty?
               flash[:success] = Spree.t('customer_details_updated')
-              redirect_to edit_admin_order_url(@order)
+              redirect_to spree.edit_admin_order_url(@order)
             else
               render action: :edit
             end
@@ -46,10 +45,6 @@ module Spree
           )
         end
 
-        def load_order
-          @order = Order.includes(:adjustments).find_by!(number: params[:order_id])
-        end
-
         def model_class
           Spree::Order
         end