From 0755b515d1cbe2d4ca17d85e237ded38e53f9236 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Thu, 7 Nov 2013 11:56:45 +1100
Subject: [PATCH] Only show shipping methods that enterprise user has access to

---
 .../shipping_methods_controller_decorator.rb      |  4 ++--
 app/models/spree/shipping_method_decorator.rb     | 10 ++++++++++
 spec/features/admin/shipping_methods_spec.rb      | 15 ++++++++++++++-
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/app/controllers/spree/admin/shipping_methods_controller_decorator.rb b/app/controllers/spree/admin/shipping_methods_controller_decorator.rb
index 064e021da2..025157dee3 100644
--- a/app/controllers/spree/admin/shipping_methods_controller_decorator.rb
+++ b/app/controllers/spree/admin/shipping_methods_controller_decorator.rb
@@ -12,11 +12,11 @@ module Spree
                          !current_ability.has_block?(params[:action], model_class)
 
                        model_class.accessible_by(current_ability, action).
-                         by_distributor # This line added
+                         managed_by(spree_current_user).by_distributor # This line added
 
                      else
                        model_class.scoped.
-                         by_distributor # This line added
+                         managed_by(spree_current_user).by_distributor # This line added
                      end
 
         # This block added
diff --git a/app/models/spree/shipping_method_decorator.rb b/app/models/spree/shipping_method_decorator.rb
index bbc774a42e..6d6c4280dc 100644
--- a/app/models/spree/shipping_method_decorator.rb
+++ b/app/models/spree/shipping_method_decorator.rb
@@ -2,6 +2,16 @@ Spree::ShippingMethod.class_eval do
   has_and_belongs_to_many :distributors, join_table: 'distributors_shipping_methods', :class_name => 'Enterprise', association_foreign_key: 'distributor_id'
   attr_accessible :distributor_ids
 
+  scope :managed_by, lambda { |user|
+    if user.has_spree_role?('admin')
+      scoped
+    else
+      joins(:distributors).
+      where('distributors_shipping_methods.distributor_id IN (?)', user.enterprises).
+      select('DISTINCT spree_shipping_methods.*')
+    end
+  }
+
   scope :for_distributor, lambda { |distributor|
     joins(:distributors).
     where('enterprises.id = ?', distributor)
diff --git a/spec/features/admin/shipping_methods_spec.rb b/spec/features/admin/shipping_methods_spec.rb
index 9727cd1ece..15e95eca82 100644
--- a/spec/features/admin/shipping_methods_spec.rb
+++ b/spec/features/admin/shipping_methods_spec.rb
@@ -59,8 +59,10 @@ feature 'shipping methods' do
     let(:enterprise_user) { create_enterprise_user }
     let(:distributor1) { create(:distributor_enterprise, name: 'First Distributor') }
     let(:distributor2) { create(:distributor_enterprise, name: 'Second Distributor') }
+    let(:distributor3) { create(:distributor_enterprise, name: 'Third Distributor') }
     let(:sm1) { create(:shipping_method, name: 'One', distributors: [distributor1]) }
     let(:sm2) { create(:shipping_method, name: 'Two', distributors: [distributor2]) }
+    let(:sm3) { create(:shipping_method, name: 'Three', distributors: [distributor3]) }
 
     before(:each) do
       enterprise_user.enterprise_roles.build(enterprise: distributor1).save
@@ -84,7 +86,18 @@ feature 'shipping methods' do
       shipping_method.distributors.should == [distributor1]
     end
 
-    it "shows me only payment methods for the enterprise I select" do
+    it "shows me only shipping methods I have access to" do
+      sm1
+      sm2
+      sm3
+
+      visit spree.admin_shipping_methods_path
+      page.should     have_content sm1.name
+      page.should     have_content sm2.name
+      page.should_not have_content sm3.name
+    end
+
+    it "shows me only shipping methods for the enterprise I select" do
       sm1
       sm2