spree_core 0.30.0.beta1 → 0.30.0

data/README.md

@@ -1,19 +1,10 @@
 Testing
 =======
 
-Create a test site
+Create the test site
 
-    rails new sandbox -m spec/sandbox_template.rb -J -T
-
-Switch to the test site and run the generator
-
-    cd sandbox
-    rails g spree_core:install
-
-Run the migrations and prepare the test database
-
-    rake db:migrate db:seed db:test:prepare
+    rake test_app
 
 Run the tests
 
-    rspec ../spec
+    rake spec

data/app/controllers/admin/adjustments_controller.rb

@@ -1,25 +1,9 @@
 class Admin::AdjustmentsController < Admin::BaseController
   resource_controller
   belongs_to :order
-  ssl_required
 
   update.wants.html { redirect_to collection_url }
   create.wants.html { redirect_to collection_url }
-  destroy.success.wants.js { render_js_for_destroy }
-
-  # TODO: refactor into Order class
-  # Automatically complete and order where no payment is necessary because adjustments cancel out the total
-  # def set_order_state
-  #   @order.update_totals!
-
-  #   if @order.in_progress? and @order.item_total > 0 and @order.total == 0 and @order.payments.total == 0  #for new orders that are adjusted to zero
-  #     until @order.checkout.complete?
-  #       @order.checkout.next!
-  #     end
-  #     @order.reload.pay!
-  #   elsif @order.item_total > 0 && ((@order.balance_due? && @order.outstanding_balance == 0) || (@order.credit_owed? && @order.outstanding_credit == 0)) #set existing orders back to paid, if adjustment corrects balance
-  #     @order.reload.pay!
-  #   end
-  # end
+  destroy.success.wants.js { @order.reload && render_js_for_destroy }
 
 end

data/app/controllers/admin/base_controller.rb

@@ -1,4 +1,6 @@
 class Admin::BaseController < Spree::BaseController
+  ssl_required
+
   helper :search
   helper 'admin/navigation'
   layout 'admin'
@@ -6,16 +8,20 @@ class Admin::BaseController < Spree::BaseController
   before_filter :parse_date_params
 
   protected
-
-  def ssl_required?
-    ssl_supported?
-  end
-
   def render_js_for_destroy
-    render :js => "$('.flash.notice').html('#{flash.notice}'); $('.flash.notice').show();"
+    render :partial => "/admin/shared/destroy"
     flash.notice = nil
   end
 
+  # Index request for JSON needs to pass a CSRF token in order to prevent JSON Hijacking
+  def check_json_authenticity
+    return unless request.format.js? or request.format.json?
+    auth_token = params[request_forgery_protection_token]
+    unless (auth_token and form_authenticity_token == auth_token.gsub(' ', '+'))
+      raise(ActionController::InvalidAuthenticityToken)
+    end
+  end
+
   # def require_object_editable_by_current_user
   #   return access_denied unless object.editable_by?(current_user)
   #   true

data/app/controllers/admin/line_items_controller.rb

@@ -1,7 +1,7 @@
 class Admin::LineItemsController < Admin::BaseController
   resource_controller
   belongs_to :order
-  ssl_required
+
   actions :all, :except => :index
 
   create.flash nil
@@ -29,41 +29,18 @@ class Admin::LineItemsController < Admin::BaseController
 
   end
 
-  destroy.success.wants.html { render :partial => "admin/orders/form", :locals => {:order => @order}, :layout => false }
-  destroy.failure.wants.html { render :partial => "admin/orders/form", :locals => {:order => @order}, :layout => false }
+  destroy.success.wants.html { render :partial => "admin/orders/form", :locals => {:order => @order.reload}, :layout => false }
+  destroy.failure.wants.html { render :partial => "admin/orders/form", :locals => {:order => @order.reload}, :layout => false }
 
   new_action.response do |wants|
     wants.html {render :action => :new, :layout => false}
   end
 
   create.response do |wants|
-    wants.html { render :partial => "admin/orders/form", :locals => {:order => @order}, :layout => false}
+    wants.html { render :partial => "admin/orders/form", :locals => {:order => @order.reload}, :layout => false}
   end
 
-  update.success.wants.html { render :partial => "admin/orders/form", :locals => {:order => @order}, :layout => false}
-  update.failure.wants.html { render :partial => "admin/orders/form", :locals => {:order => @order}, :layout => false}
-
-  # destroy.after :recalulate_totals
-  # update.after :recalulate_totals
-  # create.after :recalulate_totals
-
-  private
-  # TODO: Order model should look after this
-  # def recalulate_totals
-  #   unless @order.shipping_method.nil?
-  #     @order.shipping_charges.each do |shipping_charge|
-  #       shipping_charge.update_attributes(:amount => @order.shipping_method.calculate_cost(@order.shipment))
-  #     end
-  #   end
-
-  #   @order.tax_charges.each do |tax_charge|
-  #     tax_charge.update_attributes(:amount => tax_charge.calculate_tax_charge)
-  #   end
-
-  #   @order.update_totals!
+  update.success.wants.html { render :partial => "admin/orders/form", :locals => {:order => @order.reload}, :layout => false}
+  update.failure.wants.html { render :partial => "admin/orders/form", :locals => {:order => @order.reload}, :layout => false}
 
-  #   unless @order.in_progress?
-  #     InventoryUnit.adjust_units(@order)
-  #   end
-  # end
 end

data/app/controllers/admin/mail_methods_controller.rb

@@ -0,0 +1,13 @@
+class Admin::MailMethodsController < Admin::BaseController
+  resource_controller
+
+  after_filter :initialize_mail_settings
+
+  update.wants.html { redirect_to collection_url }
+  create.wants.html { redirect_to collection_url }
+
+  private
+  def initialize_mail_settings
+    Spree::MailSettings.init
+  end
+end

data/app/controllers/admin/orders_controller.rb

@@ -3,22 +3,34 @@ class Admin::OrdersController < Admin::BaseController
   resource_controller
   before_filter :initialize_txn_partials
   before_filter :initialize_order_events
-  before_filter :load_object, :only => [:fire, :resend, :history]
+  before_filter :load_object, :only => [:fire, :resend, :history, :user]
   before_filter :ensure_line_items, :only => [:update]
 
   update do
     flash nil
     wants.html do
-      if @order.bill_address.nil? || @order.ship_address.nil?
-        redirect_to edit_admin_order_url(@order)
+      if !@order.line_items.empty?
+        unless @order.complete?
+
+          if params[:order].key?(:use_billing)
+            @order.shipping_method = @order.available_shipping_methods(:front_end).first
+            @order.create_shipment!
+            redirect_to edit_admin_order_shipment_path(@order, @order.shipment)
+          else
+            redirect_to user_admin_order_path(@order)
+          end
+
+        else
+          redirect_to admin_order_path(@order)
+        end
       else
-        redirect_to admin_order_url(@order)
+        render :action => :new
       end
     end
   end
 
   def new
-    @order = Order.create
+    @order = @object = Order.create
   end
 
   def fire
@@ -36,11 +48,16 @@ class Admin::OrdersController < Admin::BaseController
   end
 
   def resend
-    OrderMailer.deliver_confirm(@order, true)
+    OrderMailer.confirm_email(@order, true).deliver
     flash.notice = t('order_email_resent')
     redirect_to :back
   end
 
+  def user
+    @order.build_bill_address(:country_id => Spree::Config[:default_country_id]) if @order.bill_address.nil?
+    @order.build_ship_address(:country_id => Spree::Config[:default_country_id]) if @order.ship_address.nil?
+  end
+
   private
 
   def object
@@ -50,6 +67,15 @@ class Admin::OrdersController < Admin::BaseController
 
   def collection
     params[:search] ||= {}
+
+    if params[:search].present?
+      if params[:search].delete(:completed_at_not_null) == "1"
+        params[:search][:completed_at_not_null] = "1"
+      end
+    else
+      params[:search][:completed_at_not_null] = "1"
+    end
+
     if !params[:search][:created_at_greater_than].blank?
       params[:search][:created_at_greater_than] = Time.zone.parse(params[:search][:created_at_greater_than]).beginning_of_day rescue ""
     end
@@ -58,10 +84,6 @@ class Admin::OrdersController < Admin::BaseController
       params[:search][:created_at_less_than] = Time.zone.parse(params[:search][:created_at_less_than]).end_of_day rescue ""
     end
 
-    if params[:search].delete(:completed_at_not_null) == "1"
-      params[:search][:completed_at_not_null] = true
-    end
-
     params[:search][:order] ||= "descend_by_created_at"
     @search = Order.searchlogic(params[:search])
 

data/app/controllers/admin/payments_controller.rb

@@ -3,27 +3,25 @@ class Admin::PaymentsController < Admin::BaseController
   before_filter :load_amount, :except => :country_changed
   resource_controller
   belongs_to :order
-  ssl_required
 
   def create
     build_object
     load_object
 
-    unless object.save
-      response_for :create_fails
-      return
-    end
-
     begin
+      unless @payment.save
+        response_for :create_fails
+        return
+      end
 
-      if @order.checkout.state == "complete"
-        object.process!
+      if @order.completed?
+        @payment.process!
         set_flash :create
         redirect_to collection_path
       else
         #This is the first payment (admin created order)
-        until @order.checkout.state == "complete"
-          @order.checkout.next!
+        until @order.completed?
+          @order.next!
         end
         flash.notice = t('new_order_completed')
         redirect_to admin_order_url(@order)
@@ -31,30 +29,25 @@ class Admin::PaymentsController < Admin::BaseController
 
     rescue Spree::GatewayError => e
       flash[:error] = "#{e.message}"
-      @payment.destroy
       redirect_to new_object_path
     end
   end
 
   def fire
-    # TODO - possible security check here
+    # TODO: consider finer-grained control for this type of action (right now anyone in admin role can perform)
     load_object
-    return unless event = params[:e] and @payment.source
-    Payment.transaction do
-      @payment.source.send("#{event}", @payment)
+    return unless event = params[:e] and @payment.payment_source
+    if @payment.payment_source.send("#{event}", @payment)
+      flash.notice = t('payment_updated')
+    else
+      flash[:error] = t('cannot_perform_operation')
     end
-    flash.notice = t('payment_updated')
   rescue Spree::GatewayError => ge
     flash[:error] = "#{ge.message}"
   ensure
     redirect_to collection_path
   end
 
-  def finalize
-    object.finalize!
-    redirect_to collection_path
-  end
-
   private
 
   def object
@@ -78,14 +71,6 @@ class Admin::PaymentsController < Admin::BaseController
       @payment_method = @payment_methods.first
     end
     @previous_cards = @order.creditcards.with_payment_profile
-    @countries = Country.find(:all).sort
-    @shipping_countries = Checkout.countries.sort
-    if current_user && current_user.bill_address
-      default_country = current_user.bill_address.country
-    else
-      default_country = Country.find Spree::Config[:default_country_id]
-    end
-    @states = default_country.states.sort
   end
 
   def load_amount
@@ -94,8 +79,7 @@ class Admin::PaymentsController < Admin::BaseController
 
   def build_object
     @object = model.new(object_params)
-    @object.payable = parent_object.checkout
-    @payment = @object
+    @object.order = parent_object
     if @object.payment_method.is_a?(Gateway) and @object.payment_method.payment_profiles_supported? and params[:card].present? and params[:card] != 'new'
       @object.source = Creditcard.find_by_id(params[:card])
     end

data/app/controllers/admin/products_controller.rb

@@ -1,5 +1,6 @@
 class Admin::ProductsController < Admin::BaseController
   resource_controller
+  before_filter :check_json_authenticity, :only => :index
   before_filter :load_data, :except => :index
 
   index.response do |wants|
@@ -60,56 +61,54 @@ class Admin::ProductsController < Admin::BaseController
     redirect_to edit_admin_product_url(@new)
   end
 
-  private
-
-    # Allow different formats of json data to suit different ajax calls
-    def json_data
-      json_format = params[:json_format] or 'default'
-      case json_format
-      when 'basic'
-        collection.map {|p| {'id' => p.id, 'name' => p.name}}.to_json
-      else
-        collection.to_json(:include => {:variants => {:include => {:option_values => {:include => :option_type}, :images => {}}}, :images => {}, :master => {}})
-      end
-    end
-
-    def load_data
-      @tax_categories = TaxCategory.find(:all, :order=>"name")
-      @shipping_categories = ShippingCategory.find(:all, :order=>"name")
+  # Allow different formats of json data to suit different ajax calls
+  def json_data
+    json_format = params[:json_format] or 'default'
+    case json_format
+    when 'basic'
+      collection.map {|p| {'id' => p.id, 'name' => p.name}}.to_json
+    else
+      collection.to_json(:include => {:variants => {:include => {:option_values => {:include => :option_type}, :images => {}}}, :images => {}, :master => {}})
     end
+  end
 
-    def collection
-      return @collection if @collection.present?
-      base_scope = end_of_association_chain
+  def load_data
+    @tax_categories = TaxCategory.find(:all, :order=>"name")
+    @shipping_categories = ShippingCategory.find(:all, :order=>"name")
+  end
 
-      unless request.xhr?
-        # Note: the SL scopes are on/off switches, so we need to select "not_deleted" explicitly if the switch is off
-        # QUERY - better as named scope or as SL scope?
-        if params[:search].nil? || params[:search][:deleted_at_not_null].blank?
-          base_scope = base_scope.not_deleted
-        end
+  def collection
+    return @collection if @collection.present?
+    base_scope = end_of_association_chain
 
-        @search = base_scope.group_by_products_id.searchlogic(params[:search])
-        @search.order ||= "ascend_by_name"
+    unless request.xhr?
+      # Note: the SL scopes are on/off switches, so we need to select "not_deleted" explicitly if the switch is off
+      # QUERY - better as named scope or as SL scope?
+      if params[:search].nil? || params[:search][:deleted_at_not_null].blank?
+        base_scope = base_scope.not_deleted
+      end
 
-        @collection = @search.do_search.paginate(:include   => {:variants => [:images, :option_values]},
-                                       :per_page  => Spree::Config[:admin_products_per_page],
-                                       :page      => params[:page])
-      else
-        includes = [{:variants => [:images,  {:option_values => :option_type}]}, :master, :images]
+      @search = base_scope.group_by_products_id.searchlogic(params[:search])
+      @search.order ||= "ascend_by_name"
 
-        @collection = base_scope.where(["name LIKE ?", "%#{params[:q]}%"]).includes(includes).limit(params[:limit] || 10)
-        @collection.concat base_scope.where(["variants.sku LIKE ?", "%#{params[:q]}%"]).includes(:variants_including_master).limit(params[:limit] || 10)
+      @collection = @search.do_search.paginate(:include   => {:variants => [:images, :option_values]},
+                                     :per_page  => Spree::Config[:admin_products_per_page],
+                                     :page      => params[:page])
+    else
+      includes = [{:variants => [:images,  {:option_values => :option_type}]}, :master, :images]
 
-        @collection.uniq
-      end
+      @collection = base_scope.where(["name LIKE ?", "%#{params[:q]}%"]).includes(includes).limit(params[:limit] || 10)
+      @collection.concat base_scope.where(["variants.sku LIKE ?", "%#{params[:q]}%"]).includes(:variants_including_master).limit(params[:limit] || 10)
 
+      @collection.uniq
     end
 
-    def update_before
-      # note: we only reset the product properties if we're receiving a post from the form on that tab
-      return unless params[:clear_product_properties]
-      params[:product] ||= {}
-    end
+  end
+
+  def update_before
+    # note: we only reset the product properties if we're receiving a post from the form on that tab
+    return unless params[:clear_product_properties]
+    params[:product] ||= {}
+  end
 
 end

data/app/controllers/admin/reports_controller.rb

@@ -12,28 +12,29 @@ class Admin::ReportsController < Admin::BaseController
   def sales_total
     params[:search] = {} unless params[:search]
 
-    if params[:search][:created_at_after].blank?
-      params[:search][:created_at_after] = Time.zone.now.beginning_of_month
+    if params[:search][:created_at_greater_than].blank?
+      params[:search][:created_at_greater_than] = Time.zone.now.beginning_of_month
     else
-      params[:search][:created_at_after] = Time.zone.parse(params[:search][:created_at_after]).beginning_of_day rescue Time.zone.now.beginning_of_month
+      params[:search][:created_at_greater_than] = Time.zone.parse(params[:search][:created_at_greater_than]).beginning_of_day rescue Time.zone.now.beginning_of_month
     end
 
-    if params[:search] && !params[:search][:created_at_before].blank?
-      params[:search][:created_at_before] = Time.zone.parse(params[:search][:created_at_before]).end_of_day rescue ""
+    if params[:search] && !params[:search][:created_at_less_than].blank?
+      params[:search][:created_at_less_than] = Time.zone.parse(params[:search][:created_at_less_than]).end_of_day rescue ""
     end
 
+    params[:search][:completed_at_not_null] ||= "1"
+    if params[:search].delete(:completed_at_not_null) == "1"
+      params[:search][:completed_at_not_null] = true
+    end
 
+    params[:search][:order] ||= "descend_by_created_at"
+    
     @search = Order.searchlogic(params[:search])
-    @search.checkout_complete = true
-    #set order by to default or form result
-    @search.order ||= "descend_by_created_at"
-
-    @orders = @search.find(:all)
+    @orders = @search.do_search
 
-    @item_total = @search.sum(:item_total)
-    @charge_total = @search.sum(:adjustment_total)
-    @credit_total = @search.sum(:credit_total)
-    @sales_total = @search.sum(:total)
+    @item_total = @search.do_search.sum(:item_total)
+    @adjustment_total = @search.do_search.sum(:adjustment_total)
+    @sales_total = @search.do_search.sum(:total)
   end
 
   private