From 602dfbe0026f299dae966b6ba0b126780f5a40f6 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Thu, 31 Jul 2014 15:20:22 +1000
Subject: [PATCH 01/19] ng_text_field handling options parameter

---
 app/helpers/angular_form_builder.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/helpers/angular_form_builder.rb b/app/helpers/angular_form_builder.rb
index 5d913eb291..56fcab79fa 100644
--- a/app/helpers/angular_form_builder.rb
+++ b/app/helpers/angular_form_builder.rb
@@ -12,8 +12,9 @@ class AngularFormBuilder < ActionView::Helpers::FormBuilder
     # @object.send(@fields_for_record_name).first.class.to_s.underscore --> enterprise_fee
 
     value = "{{ #{@object.send(@fields_for_record_name).first.class.to_s.underscore}.#{method} }}"
+    options.reverse_merge!({'id' => angular_id(method)})
 
-    @template.text_field_tag angular_name(method), value, :id => angular_id(method)
+    @template.text_field_tag angular_name(method), value, options
   end
 
   def ng_hidden_field(method, options = {})

From aaa32528ea21e87a02af457e43d322e1fc95e935 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Thu, 31 Jul 2014 15:21:13 +1000
Subject: [PATCH 02/19] Giving an example name for an enterprise fee.

The example is displayed as input placeholder. See bugherd #439.
---
 app/views/admin/enterprise_fees/index.html.haml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/admin/enterprise_fees/index.html.haml b/app/views/admin/enterprise_fees/index.html.haml
index d3e9a0b88c..48517c5931 100644
--- a/app/views/admin/enterprise_fees/index.html.haml
+++ b/app/views/admin/enterprise_fees/index.html.haml
@@ -27,7 +27,7 @@
             = f.ng_hidden_field :id
             = f.ng_collection_select :enterprise_id, @enterprises, :id, :name, 'enterprise_fee.enterprise_id', :include_blank => true
           %td= f.ng_select :fee_type, enterprise_fee_type_options, 'enterprise_fee.fee_type'
-          %td= f.ng_text_field :name
+          %td= f.ng_text_field :name, { placeholder: 'e.g. packing fee' }
           %td= f.ng_collection_select :calculator_type, @calculators, :name, :description, 'enterprise_fee.calculator_type', {'class' => 'calculator_type', 'ng-model' => 'calculatorType', 'spree-ensure-calculator-preferences-match-type' => "1"}
           %td{'ng-bind-html-unsafe-compiled' => 'enterprise_fee.calculator_settings'}
           %td.actions{'spree-delete-resource' => "1"}

From c5cfda5283455221219f3573b9c372c5f9e5f9c6 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Fri, 22 Aug 2014 16:04:46 +1000
Subject: [PATCH 03/19] Adding login_nav partial from spree_auth_devise

Preparing to change 'Store' link for Bugherd #443.
---
 app/views/spree/layouts/admin/_login_nav.html.erb | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 app/views/spree/layouts/admin/_login_nav.html.erb

diff --git a/app/views/spree/layouts/admin/_login_nav.html.erb b/app/views/spree/layouts/admin/_login_nav.html.erb
new file mode 100644
index 0000000000..a43437c4ab
--- /dev/null
+++ b/app/views/spree/layouts/admin/_login_nav.html.erb
@@ -0,0 +1,8 @@
+<% if spree_current_user %>
+  <ul id="login-nav" class="inline-menu">
+    <li data-hook="user-logged-in-as"><%= t(:logged_in_as) %>: <%= spree_current_user.email %></li>
+    <li data-hook="user-account-link"><i class="icon-user"></i><%= link_to t(:account), spree.edit_user_path(spree_current_user) %></li>
+    <li data-hook="user-logout-link"><i class="icon-signout"></i><%= link_to t(:logout), spree.logout_path %></li>
+    <li data-hook="store-frontend-link"><i class="icon-external-link"></i><%= link_to t(:store), spree.products_path, :target => '_blank' %></li>
+  </ul>
+<% end %>

From 7603ea867f61bbd2dc121ca38b284a0ceb893f6f Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Fri, 22 Aug 2014 16:10:23 +1000
Subject: [PATCH 04/19] Store links to root_path instead of product_path

---
 app/views/spree/layouts/admin/_login_nav.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/spree/layouts/admin/_login_nav.html.erb b/app/views/spree/layouts/admin/_login_nav.html.erb
index a43437c4ab..7ab28b3344 100644
--- a/app/views/spree/layouts/admin/_login_nav.html.erb
+++ b/app/views/spree/layouts/admin/_login_nav.html.erb
@@ -3,6 +3,6 @@
     <li data-hook="user-logged-in-as"><%= t(:logged_in_as) %>: <%= spree_current_user.email %></li>
     <li data-hook="user-account-link"><i class="icon-user"></i><%= link_to t(:account), spree.edit_user_path(spree_current_user) %></li>
     <li data-hook="user-logout-link"><i class="icon-signout"></i><%= link_to t(:logout), spree.logout_path %></li>
-    <li data-hook="store-frontend-link"><i class="icon-external-link"></i><%= link_to t(:store), spree.products_path, :target => '_blank' %></li>
+    <li data-hook="store-frontend-link"><i class="icon-external-link"></i><%= link_to t(:store), spree.root_path, :target => '_blank' %></li>
   </ul>
 <% end %>

From 913c167fdf0591a9ba193441c56efb443a153907 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 29 Aug 2014 16:38:10 +1000
Subject: [PATCH 05/19] Revert 5ede8d1, reinstating a4be0ff..7b89e6a

---
 .../enterprise_relationships.js.coffee        |   6 +-
 .../admin/order_cycles_controller.rb          |   7 +-
 app/helpers/order_cycles_helper.rb            |  14 ++-
 app/models/enterprise_relationship.rb         |  10 +-
 .../_enterprise_relationship.html.haml        |   4 +-
 .../enterprise_relationships/_form.html.haml  |  15 ++-
 .../order_cycles/_exchange_form.html.haml     |   2 +-
 app/views/admin/order_cycles/_form.html.haml  |   4 +-
 app/views/admin/order_cycles/show.rep         |   2 +-
 lib/open_food_network/permissions.rb          |  37 ++++++
 .../admin/enterprise_relationships_spec.rb    |  21 ++--
 spec/features/admin/order_cycles_spec.rb      | 113 ++++++++++++------
 .../enterprise_relationships_spec.js.coffee   |   2 +-
 .../lib/open_food_network/permissions_spec.rb |  74 ++++++++++++
 spec/models/enterprise_relationship_spec.rb   |  27 ++++-
 15 files changed, 263 insertions(+), 75 deletions(-)
 create mode 100644 lib/open_food_network/permissions.rb
 create mode 100644 spec/lib/open_food_network/permissions_spec.rb

diff --git a/app/assets/javascripts/admin/services/enterprise_relationships.js.coffee b/app/assets/javascripts/admin/services/enterprise_relationships.js.coffee
index 7a799f2f28..cad556efd8 100644
--- a/app/assets/javascripts/admin/services/enterprise_relationships.js.coffee
+++ b/app/assets/javascripts/admin/services/enterprise_relationships.js.coffee
@@ -2,7 +2,7 @@ angular.module("ofn.admin").factory 'EnterpriseRelationships', ($http, enterpris
   new class EnterpriseRelationships
     create_errors: ""
     all_permissions: [
-      'add_products_to_order_cycle'
+      'add_to_order_cycle'
       'manage_products'
     ]
 
@@ -24,5 +24,5 @@ angular.module("ofn.admin").factory 'EnterpriseRelationships', ($http, enterpris
 
     permission_presentation: (permission) ->
       switch permission
-        when "add_products_to_order_cycle" then "can add products to order cycle from"
-        when "manage_products" then "can manage the products of"
\ No newline at end of file
+        when "add_to_order_cycle" then "can add to order cycle"
+        when "manage_products" then "can manage the products of"
diff --git a/app/controllers/admin/order_cycles_controller.rb b/app/controllers/admin/order_cycles_controller.rb
index 566c660112..63daf918de 100644
--- a/app/controllers/admin/order_cycles_controller.rb
+++ b/app/controllers/admin/order_cycles_controller.rb
@@ -1,7 +1,10 @@
+require 'open_food_network/permissions'
 require 'open_food_network/order_cycle_form_applicator'
 
 module Admin
   class OrderCyclesController < ResourceController
+    include OrderCyclesHelper
+
     before_filter :load_order_cycle_set, :only => :index
 
     def show
@@ -23,7 +26,7 @@ module Admin
 
       respond_to do |format|
         if @order_cycle.save
-          OpenFoodNetwork::OrderCycleFormApplicator.new(@order_cycle, managed_enterprises).go!
+          OpenFoodNetwork::OrderCycleFormApplicator.new(@order_cycle, order_cycle_permitted_enterprises).go!
 
           flash[:notice] = 'Your order cycle has been created.'
           format.html { redirect_to admin_order_cycles_path }
@@ -40,7 +43,7 @@ module Admin
 
       respond_to do |format|
         if @order_cycle.update_attributes(params[:order_cycle])
-          OpenFoodNetwork::OrderCycleFormApplicator.new(@order_cycle, managed_enterprises).go!
+          OpenFoodNetwork::OrderCycleFormApplicator.new(@order_cycle, order_cycle_permitted_enterprises).go!
 
           flash[:notice] = 'Your order cycle has been updated.'
           format.html { redirect_to admin_order_cycles_path }
diff --git a/app/helpers/order_cycles_helper.rb b/app/helpers/order_cycles_helper.rb
index 92cd968e0b..dfd957a143 100644
--- a/app/helpers/order_cycles_helper.rb
+++ b/app/helpers/order_cycles_helper.rb
@@ -3,8 +3,20 @@ module OrderCyclesHelper
     @current_order_cycle ||= current_order(false).andand.order_cycle
   end
 
+  def order_cycle_permitted_enterprises
+    OpenFoodNetwork::Permissions.new(spree_current_user).order_cycle_enterprises
+  end
+
+  def order_cycle_producer_enterprises
+    order_cycle_permitted_enterprises.is_primary_producer.by_name
+  end
+
   def coordinating_enterprises
-    Enterprise.is_distributor.managed_by(spree_current_user).order('name')
+    order_cycle_hub_enterprises
+  end
+
+  def order_cycle_hub_enterprises
+    order_cycle_permitted_enterprises.is_distributor.by_name
   end
 
   def order_cycle_local_remote_class(distributor, order_cycle)
diff --git a/app/models/enterprise_relationship.rb b/app/models/enterprise_relationship.rb
index 5c10aafbbf..dba99cc7b3 100644
--- a/app/models/enterprise_relationship.rb
+++ b/app/models/enterprise_relationship.rb
@@ -9,12 +9,20 @@ class EnterpriseRelationship < ActiveRecord::Base
   scope :with_enterprises,
     joins('LEFT JOIN enterprises AS parent_enterprises ON parent_enterprises.id = enterprise_relationships.parent_id').
     joins('LEFT JOIN enterprises AS child_enterprises ON child_enterprises.id = enterprise_relationships.child_id')
-  scope :by_name, with_enterprises.order('parent_enterprises.name, child_enterprises.name')
 
   scope :involving_enterprises, ->(enterprises) {
     where('parent_id IN (?) OR child_id IN (?)', enterprises, enterprises)
   }
 
+  scope :permitting, ->(enterprises) { where('child_id IN (?)', enterprises) }
+
+  scope :with_permission, ->(permission) {
+    joins(:permissions).
+    where('enterprise_relationship_permissions.name = ?', permission)
+  }
+
+  scope :by_name, with_enterprises.order('child_enterprises.name, parent_enterprises.name')
+
 
   def permissions_list=(perms)
     perms.andand.each { |name| permissions.build name: name }
diff --git a/app/views/admin/enterprise_relationships/_enterprise_relationship.html.haml b/app/views/admin/enterprise_relationships/_enterprise_relationship.html.haml
index 56f0d46c01..6a7dcdc7f4 100644
--- a/app/views/admin/enterprise_relationships/_enterprise_relationship.html.haml
+++ b/app/views/admin/enterprise_relationships/_enterprise_relationship.html.haml
@@ -1,8 +1,8 @@
-%td {{ enterprise_relationship.parent_name }}
+%td {{ enterprise_relationship.child_name }}
 %td
   %ul
     %li{"ng-repeat" => "permission in enterprise_relationship.permissions"}
       {{ EnterpriseRelationships.permission_presentation(permission.name) }}
-%td {{ enterprise_relationship.child_name }}
+%td {{ enterprise_relationship.parent_name }}
 %td.actions
   %a.delete-enterprise-relationship.icon-trash.no-text{'ng-click' => 'delete(enterprise_relationship)'}
diff --git a/app/views/admin/enterprise_relationships/_form.html.haml b/app/views/admin/enterprise_relationships/_form.html.haml
index b9c2f265cd..86086c8781 100644
--- a/app/views/admin/enterprise_relationships/_form.html.haml
+++ b/app/views/admin/enterprise_relationships/_form.html.haml
@@ -1,14 +1,13 @@
 %tr
-  %td
-    %select{name: "enterprise_relationship_parent_id", "ng-model" => "parent_id", "ng-options" => "e.id as e.name for e in Enterprises.my_enterprises"}
-  %td
-    permits
-    / %div{"ng-repeat" => "permission in EnterpriseRelationships.all_permissions"}
-    /   %label
-    /     %input{type: "checkbox", "ng-model" => "permissions[permission]"}
-    /     {{ EnterpriseRelationships.permission_presentation(permission) }}
   %td
     %select{name: "enterprise_relationship_child_id", "ng-model" => "child_id", "ng-options" => "e.id as e.name for e in Enterprises.all_enterprises"}
+  %td
+    %div{"ng-repeat" => "permission in EnterpriseRelationships.all_permissions"}
+      %label
+        %input{type: "checkbox", "ng-model" => "permissions[permission]"}
+        {{ EnterpriseRelationships.permission_presentation(permission) }}
+  %td
+    %select{name: "enterprise_relationship_parent_id", "ng-model" => "parent_id", "ng-options" => "e.id as e.name for e in Enterprises.my_enterprises"}
   %td.actions
     %input{type: "button", value: "Create", "ng-click" => "create()"}
     .errors {{ EnterpriseRelationships.create_errors }}
diff --git a/app/views/admin/order_cycles/_exchange_form.html.haml b/app/views/admin/order_cycles/_exchange_form.html.haml
index 3539892034..8f81b9f03f 100644
--- a/app/views/admin/order_cycles/_exchange_form.html.haml
+++ b/app/views/admin/order_cycles/_exchange_form.html.haml
@@ -23,4 +23,4 @@
 
   = f.submit 'Add fee', 'ng-click' => 'addExchangeFee($event, exchange)'
 %td.actions
-  %a{'ng-click' => 'removeExchange($event, exchange)', :class => "icon-trash no-text"}
+  %a{'ng-click' => 'removeExchange($event, exchange)', :class => "icon-trash no-text remove-exchange"}
diff --git a/app/views/admin/order_cycles/_form.html.haml b/app/views/admin/order_cycles/_form.html.haml
index 68dfed9f1a..e859374a3b 100644
--- a/app/views/admin/order_cycles/_form.html.haml
+++ b/app/views/admin/order_cycles/_form.html.haml
@@ -25,7 +25,7 @@
     %tr.products{'ng-show' => 'exchange.showProducts'}
       = render 'exchange_supplied_products_form'
 
-= select_tag :new_supplier_id, options_from_collection_for_select(Enterprise.is_primary_producer.managed_by(spree_current_user).by_name, :id, :name), {'ng-model' => 'new_supplier_id'}
+= select_tag :new_supplier_id, options_from_collection_for_select(order_cycle_producer_enterprises, :id, :name), {'ng-model' => 'new_supplier_id'}
 = f.submit 'Add supplier', 'ng-click' => 'addSupplier($event)'
 
 
@@ -50,7 +50,7 @@
     %tr.products{'ng-show' => 'exchange.showProducts'}
       = render 'exchange_distributed_products_form'
 
-= select_tag :new_distributor_id, options_from_collection_for_select(Enterprise.is_distributor.managed_by(spree_current_user).by_name, :id, :name), {'ng-model' => 'new_distributor_id'}
+= select_tag :new_distributor_id, options_from_collection_for_select(order_cycle_hub_enterprises, :id, :name), {'ng-model' => 'new_distributor_id'}
 = f.submit 'Add distributor', 'ng-click' => 'addDistributor($event)'
 
 .actions
diff --git a/app/views/admin/order_cycles/show.rep b/app/views/admin/order_cycles/show.rep
index 04fc659813..fb71602eb6 100644
--- a/app/views/admin/order_cycles/show.rep
+++ b/app/views/admin/order_cycles/show.rep
@@ -9,7 +9,7 @@ r.element :order_cycle, @order_cycle do
     r.element :id
   end
 
-  r.list_of :exchanges, @order_cycle.exchanges.managed_by(spree_current_user).order('id ASC') do |exchange|
+  r.list_of :exchanges, OpenFoodNetwork::Permissions.new(spree_current_user).order_cycle_exchanges(@order_cycle).order('id ASC') do |exchange|
     r.element :id
     r.element :sender_id
     r.element :receiver_id
diff --git a/lib/open_food_network/permissions.rb b/lib/open_food_network/permissions.rb
new file mode 100644
index 0000000000..99c0aa0c15
--- /dev/null
+++ b/lib/open_food_network/permissions.rb
@@ -0,0 +1,37 @@
+module OpenFoodNetwork
+  class Permissions
+    def initialize(user)
+      @user = user
+    end
+
+    # Find enterprises that an admin is allowed to add to an order cycle
+    def order_cycle_enterprises
+      managed_enterprise_ids = managed_enterprises.pluck :id
+      permitted_enterprise_ids = related_enterprises_with(:add_to_order_cycle).pluck :id
+
+      Enterprise.where('id IN (?)', managed_enterprise_ids + permitted_enterprise_ids)
+    end
+
+    # Find the exchanges of an order cycle that an admin can manage
+    def order_cycle_exchanges(order_cycle)
+      enterprises = managed_enterprises + related_enterprises_with(:add_to_order_cycle)
+      order_cycle.exchanges.to_enterprises(enterprises).from_enterprises(enterprises)
+    end
+
+
+    private
+
+    def managed_enterprises
+      Enterprise.managed_by(@user)
+    end
+
+    def related_enterprises_with(permission)
+      parent_ids = EnterpriseRelationship.
+        permitting(managed_enterprises).
+        with_permission(permission).
+        pluck(:parent_id)
+
+      Enterprise.where('id IN (?)', parent_ids)
+    end
+  end
+end
diff --git a/spec/features/admin/enterprise_relationships_spec.rb b/spec/features/admin/enterprise_relationships_spec.rb
index 757f8bc2e6..7317f44066 100644
--- a/spec/features/admin/enterprise_relationships_spec.rb
+++ b/spec/features/admin/enterprise_relationships_spec.rb
@@ -14,9 +14,9 @@ feature %q{
     scenario "listing relationships" do
       # Given some enterprises with relationships
       e1, e2, e3, e4 = create(:enterprise), create(:enterprise), create(:enterprise), create(:enterprise)
-      create(:enterprise_relationship, parent: e1, child: e2, permissions_list: [:add_products_to_order_cycle])
+      create(:enterprise_relationship, parent: e1, child: e2, permissions_list: [:add_to_order_cycle])
       create(:enterprise_relationship, parent: e2, child: e3, permissions_list: [:manage_products])
-      create(:enterprise_relationship, parent: e3, child: e4, permissions_list: [:add_products_to_order_cycle, :manage_products])
+      create(:enterprise_relationship, parent: e3, child: e4, permissions_list: [:add_to_order_cycle, :manage_products])
 
       # When I go to the relationships page
       click_link 'Enterprises'
@@ -24,10 +24,10 @@ feature %q{
 
       # Then I should see the relationships
       within('table#enterprise-relationships') do
-        page.should have_relationship e1, e2, ['can add products to order cycle from']
+        page.should have_relationship e1, e2, ['can add to order cycle']
         page.should have_relationship e2, e3, ['can manage the products of']
         page.should have_relationship e3, e4,
-          ['can add products to order cycle from', 'can manage the products of']
+          ['can add to order cycle', 'can manage the products of']
       end
     end
 
@@ -38,16 +38,17 @@ feature %q{
 
       visit admin_enterprise_relationships_path
       select 'One', from: 'enterprise_relationship_parent_id'
-      #check 'can add products to order cycle from'
-      #check 'can manage the products of'
-      #uncheck 'can manage the products of'
+
+      check 'can add to order cycle'
+      check 'can manage the products of'
+      uncheck 'can manage the products of'
       select 'Two', from: 'enterprise_relationship_child_id'
       click_button 'Create'
 
-      page.should have_relationship e1, e2 #, ['can add products to order cycle from']
+      page.should have_relationship e1, e2, ['can add to order cycle']
       er = EnterpriseRelationship.where(parent_id: e1, child_id: e2).first
       er.should be_present
-      #er.permissions.map(&:name).should == ['add_products_to_order_cycle']
+      er.permissions.map(&:name).should == ['add_to_order_cycle']
     end
 
 
@@ -119,6 +120,6 @@ feature %q{
   def have_relationship(parent, child, perms=[])
     perms = perms.join(' ') || 'permits'
 
-    have_table_row [parent.name, perms, child.name, '']
+    have_table_row [child.name, perms, parent.name, '']
   end
 end
diff --git a/spec/features/admin/order_cycles_spec.rb b/spec/features/admin/order_cycles_spec.rb
index 2423a6dc05..76ee3bdfc2 100644
--- a/spec/features/admin/order_cycles_spec.rb
+++ b/spec/features/admin/order_cycles_spec.rb
@@ -436,26 +436,37 @@ feature %q{
 
   context "as an enterprise user" do
 
-    let(:supplier1) { create(:supplier_enterprise, name: 'First Supplier') }
-    let(:supplier2) { create(:supplier_enterprise, name: 'Another Supplier') }
-    let(:distributor1) { create(:distributor_enterprise, name: 'First Distributor') }
-    let(:distributor2) { create(:distributor_enterprise, name: 'Another Distributor') }
-    let!(:distributor1_fee) { create(:enterprise_fee, enterprise: distributor1, name: 'First Distributor Fee') }
-    before(:each) do
-      product = create(:product, supplier: supplier1)
-      product.distributors << distributor1
+    let!(:supplier_managed) { create(:supplier_enterprise, name: 'Managed supplier') }
+    let!(:supplier_unmanaged) { create(:supplier_enterprise, name: 'Unmanaged supplier') }
+    let!(:supplier_permitted) { create(:supplier_enterprise, name: 'Permitted supplier') }
+    let!(:distributor_managed) { create(:distributor_enterprise, name: 'Managed distributor') }
+    let!(:distributor_unmanaged) { create(:distributor_enterprise, name: 'Unmanaged Distributor') }
+    let!(:distributor_permitted) { create(:distributor_enterprise, name: 'Permitted distributor') }
+    let!(:distributor_managed_fee) { create(:enterprise_fee, enterprise: distributor_managed, name: 'Managed distributor fee') }
+    let!(:supplier_permitted_relationship) do
+      create(:enterprise_relationship, parent: supplier_permitted, child: supplier_managed,
+             permissions_list: [:add_to_order_cycle])
+    end
+    let!(:distributor_permitted_relationship) do
+      create(:enterprise_relationship, parent: distributor_permitted, child: distributor_managed,
+             permissions_list: [:add_to_order_cycle])
+    end
+
+    before do
+      product = create(:product, supplier: supplier_managed)
+      product.distributors << distributor_managed
       product.save!
 
       @new_user = create_enterprise_user
-      @new_user.enterprise_roles.build(enterprise: supplier1).save
-      @new_user.enterprise_roles.build(enterprise: distributor1).save
+      @new_user.enterprise_roles.build(enterprise: supplier_managed).save
+      @new_user.enterprise_roles.build(enterprise: distributor_managed).save
 
       login_to_admin_as @new_user
     end
 
     scenario "viewing a list of order cycles I am coordinating" do
-      oc_user_coordinating = create(:simple_order_cycle, { suppliers: [supplier1, supplier2], coordinator: supplier1, distributors: [distributor1, distributor2], name: 'Order Cycle 1' } )
-      oc_for_other_user = create(:simple_order_cycle, { coordinator: supplier2, name: 'Order Cycle 2' } )
+      oc_user_coordinating = create(:simple_order_cycle, { suppliers: [supplier_managed, supplier_unmanaged], coordinator: supplier_managed, distributors: [distributor_managed, distributor_unmanaged], name: 'Order Cycle 1' } )
+      oc_for_other_user = create(:simple_order_cycle, { coordinator: supplier_unmanaged, name: 'Order Cycle 2' } )
 
       click_link "Order Cycles"
 
@@ -464,8 +475,8 @@ feature %q{
       page.should_not have_content oc_for_other_user.name
 
       # The order cycle should not show enterprises that I don't manage
-      page.should_not have_selector 'td.suppliers',    text: supplier2.name
-      page.should_not have_selector 'td.distributors', text: distributor2.name
+      page.should_not have_selector 'td.suppliers',    text: supplier_unmanaged.name
+      page.should_not have_selector 'td.distributors', text: distributor_unmanaged.name
     end
 
     scenario "creating a new order cycle" do
@@ -476,57 +487,81 @@ feature %q{
       fill_in 'order_cycle_orders_open_at', with: '2012-11-06 06:00:00'
       fill_in 'order_cycle_orders_close_at', with: '2012-11-13 17:00:00'
 
-      select 'First Supplier', from: 'new_supplier_id'
+      select 'Managed supplier', from: 'new_supplier_id'
+      click_button 'Add supplier'
+      select 'Permitted supplier', from: 'new_supplier_id'
       click_button 'Add supplier'
 
-      select 'First Distributor', from: 'order_cycle_coordinator_id'
+      select 'Managed distributor', from: 'order_cycle_coordinator_id'
       click_button 'Add coordinator fee'
-      select 'First Distributor Fee', from: 'order_cycle_coordinator_fee_0_id'
+      select 'Managed distributor fee', from: 'order_cycle_coordinator_fee_0_id'
 
-      select 'First Distributor', from: 'new_distributor_id'
+      select 'Managed distributor', from: 'new_distributor_id'
+      click_button 'Add distributor'
+      select 'Permitted distributor', from: 'new_distributor_id'
       click_button 'Add distributor'
 
-      # Should only have suppliers / distributors listed which the user can manage
-      within "#new_supplier_id" do
-        page.should_not have_content supplier2.name
-      end
-      within "#new_distributor_id" do
-        page.should_not have_content distributor2.name
-      end
-      within "#order_cycle_coordinator_id" do
-        page.should_not have_content distributor2.name
-        page.should_not have_content supplier1.name
-        page.should_not have_content supplier2.name
+      # Should only have suppliers / distributors listed which the user is managing or
+      # has E2E permission to add products to order cycles
+      page.should_not have_select 'new_supplier_id', with_options: [supplier_unmanaged.name]
+      page.should_not have_select 'new_distributor_id', with_options: [distributor_unmanaged.name]
+
+      [distributor_unmanaged.name, supplier_managed.name, supplier_unmanaged.name].each do |enterprise_name|
+        page.should_not have_select 'order_cycle_coordinator_id', with_options: [enterprise_name]
       end
 
       click_button 'Create'
 
       flash_message.should == "Your order cycle has been created."
       order_cycle = OrderCycle.find_by_name('My order cycle')
-      order_cycle.coordinator.should == distributor1
+      order_cycle.suppliers.sort.should == [supplier_managed, supplier_permitted].sort
+      order_cycle.coordinator.should == distributor_managed
+      order_cycle.distributors.sort.should == [distributor_managed, distributor_permitted].sort
     end
 
-    scenario "editing an order cycle" do
-      oc = create(:simple_order_cycle, { suppliers: [supplier1, supplier2], coordinator: supplier1, distributors: [distributor1, distributor2], name: 'Order Cycle 1' } )
+    scenario "editing an order cycle does not affect exchanges we don't manage" do
+      oc = create(:simple_order_cycle, { suppliers: [supplier_managed, supplier_permitted, supplier_unmanaged], coordinator: supplier_managed, distributors: [distributor_managed, distributor_permitted, distributor_unmanaged], name: 'Order Cycle 1' } )
 
       visit edit_admin_order_cycle_path(oc)
 
-      # I should not see exchanges for supplier2 or distributor2
-      page.all('tr.supplier').count.should == 1
-      page.all('tr.distributor').count.should == 1
+      # I should not see exchanges for supplier_unmanaged or distributor_unmanaged
+      page.all('tr.supplier').count.should == 2
+      page.all('tr.distributor').count.should == 2
 
       # When I save, then those exchanges should remain
       click_button 'Update'
       page.should have_content "Your order cycle has been updated."
 
       oc.reload
-      oc.suppliers.sort.should == [supplier1, supplier2]
-      oc.coordinator.should == supplier1
-      oc.distributors.sort.should == [distributor1, distributor2]
+      oc.suppliers.sort.should == [supplier_managed, supplier_permitted, supplier_unmanaged].sort
+      oc.coordinator.should == supplier_managed
+      oc.distributors.sort.should == [distributor_managed, distributor_permitted, distributor_unmanaged].sort
     end
 
+    scenario "editing an order cycle" do
+      oc = create(:simple_order_cycle, { suppliers: [supplier_managed, supplier_permitted, supplier_unmanaged], coordinator: supplier_managed, distributors: [distributor_managed, distributor_permitted, distributor_unmanaged], name: 'Order Cycle 1' } )
+
+      visit edit_admin_order_cycle_path(oc)
+
+      # When I remove all the exchanges and save
+      page.find("tr.supplier-#{supplier_managed.id} a.remove-exchange").click
+      page.find("tr.supplier-#{supplier_permitted.id} a.remove-exchange").click
+      page.find("tr.distributor-#{distributor_managed.id} a.remove-exchange").click
+      page.find("tr.distributor-#{distributor_permitted.id} a.remove-exchange").click
+      click_button 'Update'
+
+      # Then the exchanges should be removed
+      page.should have_content "Your order cycle has been updated."
+
+      oc.reload
+      oc.suppliers.should == [supplier_unmanaged]
+      oc.coordinator.should == supplier_managed
+      oc.distributors.should == [distributor_unmanaged]
+    end
+
+
     scenario "cloning an order cycle" do
-      oc = create(:simple_order_cycle)
+      oc = create(:simple_order_cycle, coordinator: distributor_managed)
 
       click_link "Order Cycles"
       first('a.clone-order-cycle').click
diff --git a/spec/javascripts/unit/admin/services/enterprise_relationships_spec.js.coffee b/spec/javascripts/unit/admin/services/enterprise_relationships_spec.js.coffee
index 4e90f65335..9701377a73 100644
--- a/spec/javascripts/unit/admin/services/enterprise_relationships_spec.js.coffee
+++ b/spec/javascripts/unit/admin/services/enterprise_relationships_spec.js.coffee
@@ -12,5 +12,5 @@ describe "enterprise relationships", ->
     EnterpriseRelationships = _EnterpriseRelationships_
 
   it "presents permission names", ->
-    expect(EnterpriseRelationships.permission_presentation("add_products_to_order_cycle")).toEqual "can add products to order cycle from"
+    expect(EnterpriseRelationships.permission_presentation("add_to_order_cycle")).toEqual "can add to order cycle"
     expect(EnterpriseRelationships.permission_presentation("manage_products")).toEqual "can manage the products of"
diff --git a/spec/lib/open_food_network/permissions_spec.rb b/spec/lib/open_food_network/permissions_spec.rb
new file mode 100644
index 0000000000..b0a004cbf1
--- /dev/null
+++ b/spec/lib/open_food_network/permissions_spec.rb
@@ -0,0 +1,74 @@
+require 'open_food_network/permissions'
+
+module OpenFoodNetwork
+  describe Permissions do
+    let(:user) { double(:user) }
+    let(:permissions) { Permissions.new(user) }
+    let(:permission) { 'one' }
+    let(:e1) { create(:enterprise) }
+    let(:e2) { create(:enterprise) }
+
+    describe "finding enterprises that can be added to an order cycle" do
+      before do
+        permissions.stub(:managed_enterprises) { Enterprise.where('1=0') }
+        permissions.stub(:related_enterprises_with) { Enterprise.where('1=0') }
+      end
+
+      it "returns managed enterprises" do
+        permissions.stub(:managed_enterprises) { Enterprise.where(id: e1) }
+        permissions.order_cycle_enterprises.should == [e1]
+      end
+
+      it "returns permitted enterprises" do
+        permissions.stub(:related_enterprises_with) { Enterprise.where(id: e2) }
+        permissions.order_cycle_enterprises.should == [e2]
+      end
+    end
+
+    describe "finding exchanges of an order cycle that an admin can manage" do
+      let(:oc) { create(:simple_order_cycle) }
+      let!(:ex) { create(:exchange, order_cycle: oc, sender: e1, receiver: e2) }
+
+      before do
+        permissions.stub(:managed_enterprises) { [] }
+        permissions.stub(:related_enterprises_with) { [] }
+      end
+
+      it "returns exchanges involving enterprises managed by the user" do
+        permissions.stub(:managed_enterprises) { [e1, e2] }
+        permissions.order_cycle_exchanges(oc).should == [ex]
+      end
+
+      it "returns exchanges involving enterprises with E2E permission" do
+        permissions.stub(:related_enterprises_with) { [e1, e2] }
+        permissions.order_cycle_exchanges(oc).should == [ex]
+      end
+
+      it "does not return exchanges involving only the sender" do
+        permissions.stub(:managed_enterprises) { [e1] }
+        permissions.order_cycle_exchanges(oc).should == []
+      end
+
+      it "does not return exchanges involving only the receiver" do
+        permissions.stub(:managed_enterprises) { [e2] }
+        permissions.order_cycle_exchanges(oc).should == []
+      end
+    end
+
+    ########################################
+
+    describe "finding related enterprises with a particular permission" do
+      let!(:er) { create(:enterprise_relationship, parent: e1, child: e2, permissions_list: [permission]) }
+
+      it "returns the enterprises" do
+        permissions.stub(:managed_enterprises) { e2 }
+        permissions.send(:related_enterprises_with, permission).should == [e1]
+      end
+
+      it "returns an empty array when there are none" do
+        permissions.stub(:managed_enterprises) { e1 }
+        permissions.send(:related_enterprises_with, permission).should == []
+      end
+    end
+  end
+end
diff --git a/spec/models/enterprise_relationship_spec.rb b/spec/models/enterprise_relationship_spec.rb
index 6cdf3db657..3a6c48e891 100644
--- a/spec/models/enterprise_relationship_spec.rb
+++ b/spec/models/enterprise_relationship_spec.rb
@@ -6,10 +6,10 @@ describe EnterpriseRelationship do
     let(:e2)  { create(:enterprise, name: 'B') }
     let(:e3)  { create(:enterprise, name: 'C') }
 
-    it "sorts by parent, child enterprise name" do
-      er1 = create(:enterprise_relationship, parent: e1, child: e3)
-      er2 = create(:enterprise_relationship, parent: e2, child: e1)
-      er3 = create(:enterprise_relationship, parent: e1, child: e2)
+    it "sorts by child, parent enterprise name" do
+      er1 = create(:enterprise_relationship, parent: e3, child: e1)
+      er2 = create(:enterprise_relationship, parent: e1, child: e2)
+      er3 = create(:enterprise_relationship, parent: e2, child: e1)
 
       EnterpriseRelationship.by_name.should == [er3, er1, er2]
     end
@@ -43,5 +43,24 @@ describe EnterpriseRelationship do
         er.permissions.should be_empty
       end
     end
+
+    it "finds relationships that grant permissions to some enterprises" do
+      er1 = create(:enterprise_relationship, parent: e2, child: e1)
+      er2 = create(:enterprise_relationship, parent: e3, child: e2)
+      er3 = create(:enterprise_relationship, parent: e1, child: e3)
+
+      EnterpriseRelationship.permitting([e1, e2]).sort.should == [er1, er2]
+    end
+
+    it "finds relationships that grant a particular permission" do
+      er1 = create(:enterprise_relationship, parent: e1, child: e2,
+                   permissions_list: ['one', 'two'])
+      er2 = create(:enterprise_relationship, parent: e2, child: e3,
+                   permissions_list: ['two', 'three'])
+      er3 = create(:enterprise_relationship, parent: e3, child: e1,
+                   permissions_list: ['three', 'four'])
+
+      EnterpriseRelationship.with_permission('two').sort.should == [er1, er2].sort
+    end
   end
 end

From 57af658e7c2dba603159c0f6d008aabbbaafd324 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Thu, 28 Aug 2014 15:06:55 +1000
Subject: [PATCH 06/19] For OC, fetch all enterprises we have access to,
 including those via E2E relationships

---
 .../javascripts/admin/order_cycle.js.erb.coffee  |  2 +-
 app/controllers/admin/enterprises_controller.rb  |  7 ++++++-
 app/models/spree/ability_decorator.rb            |  1 +
 .../{index.rabl => for_order_cycle.rabl}         |  0
 config/routes.rb                                 |  7 +++++--
 spec/features/admin/order_cycles_spec.rb         | 16 ++++++++++++----
 spec/javascripts/unit/order_cycle_spec.js.coffee |  2 +-
 spec/models/spree/ability_spec.rb                |  2 +-
 8 files changed, 27 insertions(+), 10 deletions(-)
 rename app/views/admin/enterprises/{index.rabl => for_order_cycle.rabl} (100%)

diff --git a/app/assets/javascripts/admin/order_cycle.js.erb.coffee b/app/assets/javascripts/admin/order_cycle.js.erb.coffee
index aadf66af60..b8068681ca 100644
--- a/app/assets/javascripts/admin/order_cycle.js.erb.coffee
+++ b/app/assets/javascripts/admin/order_cycle.js.erb.coffee
@@ -330,7 +330,7 @@ angular.module('order_cycle', ['ngResource'])
     }])
 
   .factory('Enterprise', ['$resource', ($resource) ->
-    Enterprise = $resource('/admin/enterprises/:enterprise_id.json', {}, {'index': {method: 'GET', isArray: true}})
+    Enterprise = $resource('/admin/enterprises/for_order_cycle/:enterprise_id.json', {}, {'index': {method: 'GET', isArray: true}})
 
     {
       Enterprise: Enterprise
diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index 53e58d110b..85fe6831fb 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -6,6 +6,11 @@ module Admin
     create.after :grant_management
 
     helper 'spree/products'
+    include OrderCyclesHelper
+
+    def for_order_cycle
+      @collection = order_cycle_permitted_enterprises
+    end
 
 
     def bulk_update
@@ -53,7 +58,7 @@ module Admin
     end
 
     def collection_actions
-      [:index, :bulk_update]
+      [:index, :for_order_cycle, :bulk_update]
     end
 
     def load_methods_and_fees
diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb
index b29aa6d5b3..68d98bd568 100644
--- a/app/models/spree/ability_decorator.rb
+++ b/app/models/spree/ability_decorator.rb
@@ -76,6 +76,7 @@ class AbilityDecorator
     can [:admin, :index, :read, :edit, :update, :bulk_update, :clone], OrderCycle do |order_cycle|
       user.enterprises.include? order_cycle.coordinator
     end
+    can [:for_order_cycle], Enterprise
 
     can [:index, :create], EnterpriseFee
     can [:admin, :read, :edit, :bulk_update, :destroy], EnterpriseFee do |enterprise_fee|
diff --git a/app/views/admin/enterprises/index.rabl b/app/views/admin/enterprises/for_order_cycle.rabl
similarity index 100%
rename from app/views/admin/enterprises/index.rabl
rename to app/views/admin/enterprises/for_order_cycle.rabl
diff --git a/config/routes.rb b/config/routes.rb
index 36213b2622..5230e798cc 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -33,12 +33,15 @@ Openfoodnetwork::Application.routes.draw do
 
   namespace :admin do
     resources :order_cycles do
-      post :bulk_update, :on => :collection, :as => :bulk_update
+      post :bulk_update, on: :collection, as: :bulk_update
       get :clone, on: :member
     end
 
     resources :enterprises do
-      post :bulk_update, :on => :collection, :as => :bulk_update
+      collection do
+        get :for_order_cycle
+        post :bulk_update, as: :bulk_update
+      end
 
       resources :producer_properties do
         post :update_positions, on: :collection
diff --git a/spec/features/admin/order_cycles_spec.rb b/spec/features/admin/order_cycles_spec.rb
index 76ee3bdfc2..febd966109 100644
--- a/spec/features/admin/order_cycles_spec.rb
+++ b/spec/features/admin/order_cycles_spec.rb
@@ -451,12 +451,10 @@ feature %q{
       create(:enterprise_relationship, parent: distributor_permitted, child: distributor_managed,
              permissions_list: [:add_to_order_cycle])
     end
+    let!(:product_managed) { create(:product, supplier: supplier_managed) }
+    let!(:product_permitted) { create(:product, supplier: supplier_permitted) }
 
     before do
-      product = create(:product, supplier: supplier_managed)
-      product.distributors << distributor_managed
-      product.save!
-
       @new_user = create_enterprise_user
       @new_user.enterprise_roles.build(enterprise: supplier_managed).save
       @new_user.enterprise_roles.build(enterprise: distributor_managed).save
@@ -492,6 +490,9 @@ feature %q{
       select 'Permitted supplier', from: 'new_supplier_id'
       click_button 'Add supplier'
 
+      select_incoming_variant supplier_managed, 0, product_managed.master
+      select_incoming_variant supplier_permitted, 1, product_permitted.master
+
       select 'Managed distributor', from: 'order_cycle_coordinator_id'
       click_button 'Add coordinator fee'
       select 'Managed distributor fee', from: 'order_cycle_coordinator_fee_0_id'
@@ -574,4 +575,11 @@ feature %q{
 
   end
 
+
+  private
+
+  def select_incoming_variant(supplier, exchange_no, variant)
+    page.find("table.exchanges tr.supplier-#{supplier.id} td.products input").click
+    check "order_cycle_incoming_exchange_#{exchange_no}_variants_#{variant.id}"
+  end
 end
diff --git a/spec/javascripts/unit/order_cycle_spec.js.coffee b/spec/javascripts/unit/order_cycle_spec.js.coffee
index 172b2cdb1a..0d5127314a 100644
--- a/spec/javascripts/unit/order_cycle_spec.js.coffee
+++ b/spec/javascripts/unit/order_cycle_spec.js.coffee
@@ -327,7 +327,7 @@ describe 'OrderCycle services', ->
       inject ($injector, _$httpBackend_)->
         Enterprise = $injector.get('Enterprise')
         $httpBackend = _$httpBackend_
-        $httpBackend.whenGET('/admin/enterprises.json').respond [
+        $httpBackend.whenGET('/admin/enterprises/for_order_cycle.json').respond [
           {id: 1, name: 'One', supplied_products: [1, 2]}
           {id: 2, name: 'Two', supplied_products: [3, 4]}
           {id: 3, name: 'Three', supplied_products: [5, 6]}
diff --git a/spec/models/spree/ability_spec.rb b/spec/models/spree/ability_spec.rb
index a2d1fb5bdf..9e5ae49780 100644
--- a/spec/models/spree/ability_spec.rb
+++ b/spec/models/spree/ability_spec.rb
@@ -264,7 +264,7 @@ module Spree
         end
 
         it 'should have the ability administrate and create enterpises' do
-          should have_ability([:admin, :index, :create], for: Enterprise)
+          should have_ability([:admin, :index, :for_order_cycle, :create], for: Enterprise)
         end
       end
     end

From 6ff6e4248c407937e5bd6fcbba2e60f45266130a Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 29 Aug 2014 17:37:56 +1000
Subject: [PATCH 07/19] Rename spec to match view name change

---
 .../{index.rabl_spec.rb => for_order_cycle.rabl_spec.rb}      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename spec/views/admin/enterprises/{index.rabl_spec.rb => for_order_cycle.rabl_spec.rb} (79%)

diff --git a/spec/views/admin/enterprises/index.rabl_spec.rb b/spec/views/admin/enterprises/for_order_cycle.rabl_spec.rb
similarity index 79%
rename from spec/views/admin/enterprises/index.rabl_spec.rb
rename to spec/views/admin/enterprises/for_order_cycle.rabl_spec.rb
index 91463c2212..1585d08e43 100644
--- a/spec/views/admin/enterprises/index.rabl_spec.rb
+++ b/spec/views/admin/enterprises/for_order_cycle.rabl_spec.rb
@@ -1,10 +1,10 @@
 require 'spec_helper'
 
-describe "admin/enterprises/index.rabl" do
+describe "admin/enterprises/for_order_cycle.rabl" do
   let(:enterprise)       { create(:distributor_enterprise) }
   let!(:product)         { create(:simple_product, supplier: enterprise) }
   let!(:deleted_product) { create(:simple_product, supplier: enterprise, deleted_at: 1.day.ago) }
-  let(:render)           { Rabl.render([enterprise], 'admin/enterprises/index', view_path: 'app/views', scope: RablHelper::FakeContext.instance) }
+  let(:render)           { Rabl.render([enterprise], 'admin/enterprises/for_order_cycle', view_path: 'app/views', scope: RablHelper::FakeContext.instance) }
 
   describe "supplied products" do
     it "does not render deleted products" do

From 503fb537500a40a249c05c51fccb91355985044e Mon Sep 17 00:00:00 2001
From: digital dreamer <digitaldreamer@email.cz>
Date: Fri, 29 Aug 2014 13:42:27 +0200
Subject: [PATCH 08/19] Fix #242 - foreign key constraint error on
 load_sample_data

---
 lib/tasks/dev.rake | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/tasks/dev.rake b/lib/tasks/dev.rake
index 8479b08ba5..bfa57a07dd 100644
--- a/lib/tasks/dev.rake
+++ b/lib/tasks/dev.rake
@@ -32,7 +32,6 @@ namespace :openfoodnetwork do
       # -- Addresses
       unless Spree::Address.find_by_zipcode "3160"
         puts "[#{task_name}] Seeding addresses"
-        Spree::Address.delete_all
 
         FactoryGirl.create(:address, :address1 => "25 Myrtle Street", :zipcode => "3153", :city => "Bayswater")
         FactoryGirl.create(:address, :address1 => "6 Rollings Road", :zipcode => "3156", :city => "Upper Ferntree Gully")

From 1ea63bca6e14e033d05aef64894df480436385ac Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Mon, 1 Sep 2014 09:17:38 +1000
Subject: [PATCH 09/19] Name test enterprises semantically

---
 .../admin/bulk_product_update_spec.rb         | 34 +++++++++----------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/spec/features/admin/bulk_product_update_spec.rb b/spec/features/admin/bulk_product_update_spec.rb
index ccddba5508..d1dfc2b129 100644
--- a/spec/features/admin/bulk_product_update_spec.rb
+++ b/spec/features/admin/bulk_product_update_spec.rb
@@ -729,20 +729,20 @@ feature %q{
   end
 
   context "as an enterprise manager" do
-    let(:s1) { create(:supplier_enterprise, name: 'First Supplier') }
-    let(:s2) { create(:supplier_enterprise, name: 'Another Supplier') }
-    let(:s3) { create(:supplier_enterprise, name: 'Yet Another Supplier') }
-    let(:d1) { create(:distributor_enterprise, name: 'First Distributor') }
-    let(:d2) { create(:distributor_enterprise, name: 'Another Distributor') }
-    let!(:product_supplied) { create(:product, supplier: s1, price: 10.0, on_hand: 6) }
-    let!(:product_not_supplied) { create(:product, supplier: s3) }
-    let(:product_supplied_inactive) { create(:product, supplier: s1, price: 10.0, on_hand: 6, available_on: 1.week.from_now) }
+    let(:supplier_managed1) { create(:supplier_enterprise, name: 'Supplier Managed 1') }
+    let(:supplier_managed2) { create(:supplier_enterprise, name: 'Supplier Managed 2') }
+    let(:supplier_unmanaged) { create(:supplier_enterprise, name: 'Supplier Unmanaged') }
+    let(:distributor_managed) { create(:distributor_enterprise, name: 'Distributor Managed') }
+    let(:distributor_unmanaged) { create(:distributor_enterprise, name: 'Distributor Unmanaged') }
+    let!(:product_supplied) { create(:product, supplier: supplier_managed1, price: 10.0, on_hand: 6) }
+    let!(:product_not_supplied) { create(:product, supplier: supplier_unmanaged) }
+    let(:product_supplied_inactive) { create(:product, supplier: supplier_managed1, price: 10.0, on_hand: 6, available_on: 1.week.from_now) }
 
-    before(:each) do
+    before do
       @enterprise_user = create_enterprise_user
-      @enterprise_user.enterprise_roles.build(enterprise: s1).save
-      @enterprise_user.enterprise_roles.build(enterprise: s2).save
-      @enterprise_user.enterprise_roles.build(enterprise: d1).save
+      @enterprise_user.enterprise_roles.build(enterprise: supplier_managed1).save
+      @enterprise_user.enterprise_roles.build(enterprise: supplier_managed2).save
+      @enterprise_user.enterprise_roles.build(enterprise: distributor_managed).save
 
       login_to_admin_as @enterprise_user
     end
@@ -757,8 +757,8 @@ feature %q{
     it "shows only suppliers that I manage" do
       visit '/admin/products/bulk_edit'
 
-      expect(page).to have_select 'producer', with_options: [s1.name, s2.name], selected: s1.name
-      expect(page).to have_no_select 'producer', with_options: [s3.name]
+      expect(page).to have_select 'producer', with_options: [supplier_managed1.name, supplier_managed2.name], selected: supplier_managed1.name
+      expect(page).to have_no_select 'producer', with_options: [supplier_unmanaged.name]
     end
 
     it "shows inactive products that I supply" do
@@ -777,13 +777,13 @@ feature %q{
       first("div#columns_dropdown div.menu div.menu_item", text: "Available On").click
 
       expect(page).to have_field "product_name", with: p.name
-      expect(page).to have_select "producer", selected: s1.name
+      expect(page).to have_select "producer", selected: supplier_managed1.name
       expect(page).to have_field "available_on", with: p.available_on.strftime("%F %T")
       expect(page).to have_field "price", with: "10.0"
       expect(page).to have_field "on_hand", with: "6"
 
       fill_in "product_name", with: "Big Bag Of Potatoes"
-      select(s2.name, :from => 'producer')
+      select(supplier_managed2.name, :from => 'producer')
       fill_in "available_on", with: (Date.today-3).strftime("%F %T")
       fill_in "price", with: "20"
       select "Weight (kg)", from: "variant_unit_with_scale"
@@ -795,7 +795,7 @@ feature %q{
 
       p.reload
       expect(p.name).to eq "Big Bag Of Potatoes"
-      expect(p.supplier).to eq s2
+      expect(p.supplier).to eq supplier_managed2
       expect(p.variant_unit).to eq "weight"
       expect(p.variant_unit_scale).to eq 1000 # Kg
       expect(p.available_on).to eq 3.days.ago.beginning_of_day

From 4af704b1d0d63e69f9241b0907ff559d5655191b Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Mon, 1 Sep 2014 09:42:50 +1000
Subject: [PATCH 10/19] Fetch managed products via OpenFoodNetwork::Permissions

---
 .../spree/api/products_controller_decorator.rb            | 8 +++++++-
 lib/open_food_network/permissions.rb                      | 4 ++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/app/controllers/spree/api/products_controller_decorator.rb b/app/controllers/spree/api/products_controller_decorator.rb
index 7e81e1f789..65765e03ca 100644
--- a/app/controllers/spree/api/products_controller_decorator.rb
+++ b/app/controllers/spree/api/products_controller_decorator.rb
@@ -1,3 +1,5 @@
+require 'open_food_network/permissions'
+
 Spree::Api::ProductsController.class_eval do
   def managed
     authorize! :admin, Spree::Product
@@ -8,7 +10,11 @@ Spree::Api::ProductsController.class_eval do
   end
 
   def bulk_products
-    @products = product_scope.ransack(params[:q]).result.managed_by(current_api_user).page(params[:page]).per(params[:per_page])
+    @products = OpenFoodNetwork::Permissions.new(current_api_user).managed_products.
+      merge(product_scope).
+      ransack(params[:q]).result.
+      page(params[:page]).per(params[:per_page])
+
     render text: { products: ActiveModel::ArraySerializer.new(@products, each_serializer: Spree::Api::ProductSerializer), pages: @products.num_pages }.to_json
   end
 
diff --git a/lib/open_food_network/permissions.rb b/lib/open_food_network/permissions.rb
index 99c0aa0c15..fbd85d933b 100644
--- a/lib/open_food_network/permissions.rb
+++ b/lib/open_food_network/permissions.rb
@@ -18,6 +18,10 @@ module OpenFoodNetwork
       order_cycle.exchanges.to_enterprises(enterprises).from_enterprises(enterprises)
     end
 
+    def managed_products
+      Spree::Product.managed_by(@user)
+    end
+
 
     private
 

From e023a6616763c958bb5325e7d965251bc0be1ad4 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Mon, 1 Sep 2014 10:13:59 +1000
Subject: [PATCH 11/19] Bulk product edit lists managed products

---
 lib/open_food_network/permissions.rb          | 12 ++++++-
 .../admin/bulk_product_update_spec.rb         | 26 +++++++++++-----
 .../lib/open_food_network/permissions_spec.rb | 31 +++++++++++++++++++
 3 files changed, 61 insertions(+), 8 deletions(-)

diff --git a/lib/open_food_network/permissions.rb b/lib/open_food_network/permissions.rb
index fbd85d933b..f35a7db602 100644
--- a/lib/open_food_network/permissions.rb
+++ b/lib/open_food_network/permissions.rb
@@ -19,7 +19,9 @@ module OpenFoodNetwork
     end
 
     def managed_products
-      Spree::Product.managed_by(@user)
+      managed_enterprise_products_ids = managed_enterprise_products.pluck :id
+      permitted_enterprise_products_ids = related_enterprise_products.pluck :id
+      Spree::Product.where('id IN (?)', managed_enterprise_products_ids + permitted_enterprise_products_ids)
     end
 
 
@@ -37,5 +39,13 @@ module OpenFoodNetwork
 
       Enterprise.where('id IN (?)', parent_ids)
     end
+
+    def managed_enterprise_products
+      Spree::Product.managed_by(@user)
+    end
+
+    def related_enterprise_products
+      Spree::Product.where('supplier_id IN (?)', related_enterprises_with(:manage_products))
+    end
   end
 end
diff --git a/spec/features/admin/bulk_product_update_spec.rb b/spec/features/admin/bulk_product_update_spec.rb
index d1dfc2b129..90f83bb26d 100644
--- a/spec/features/admin/bulk_product_update_spec.rb
+++ b/spec/features/admin/bulk_product_update_spec.rb
@@ -732,12 +732,21 @@ feature %q{
     let(:supplier_managed1) { create(:supplier_enterprise, name: 'Supplier Managed 1') }
     let(:supplier_managed2) { create(:supplier_enterprise, name: 'Supplier Managed 2') }
     let(:supplier_unmanaged) { create(:supplier_enterprise, name: 'Supplier Unmanaged') }
+    let(:supplier_permitted) { create(:supplier_enterprise, name: 'Supplier Permitted') }
     let(:distributor_managed) { create(:distributor_enterprise, name: 'Distributor Managed') }
     let(:distributor_unmanaged) { create(:distributor_enterprise, name: 'Distributor Unmanaged') }
     let!(:product_supplied) { create(:product, supplier: supplier_managed1, price: 10.0, on_hand: 6) }
     let!(:product_not_supplied) { create(:product, supplier: supplier_unmanaged) }
+    let!(:product_supplied_permitted) { create(:product, name: 'Product Permitted', supplier: supplier_permitted, price: 10.0, on_hand: 6) }
     let(:product_supplied_inactive) { create(:product, supplier: supplier_managed1, price: 10.0, on_hand: 6, available_on: 1.week.from_now) }
 
+    let!(:supplier_permitted_relationship) do
+      create(:enterprise_relationship, parent: supplier_permitted, child: supplier_managed1,
+             permissions_list: [:manage_products])
+    end
+
+    use_short_wait
+
     before do
       @enterprise_user = create_enterprise_user
       @enterprise_user.enterprise_roles.build(enterprise: supplier_managed1).save
@@ -751,6 +760,7 @@ feature %q{
       visit '/admin/products/bulk_edit'
 
       expect(page).to have_field 'product_name', with: product_supplied.name
+      expect(page).to have_field 'product_name', with: product_supplied_permitted.name
       expect(page).to have_no_field 'product_name', with: product_not_supplied.name
     end
 
@@ -782,13 +792,15 @@ feature %q{
       expect(page).to have_field "price", with: "10.0"
       expect(page).to have_field "on_hand", with: "6"
 
-      fill_in "product_name", with: "Big Bag Of Potatoes"
-      select(supplier_managed2.name, :from => 'producer')
-      fill_in "available_on", with: (Date.today-3).strftime("%F %T")
-      fill_in "price", with: "20"
-      select "Weight (kg)", from: "variant_unit_with_scale"
-      fill_in "on_hand", with: "18"
-      fill_in "display_as", with: "Big Bag"
+      within("tr#p_#{product_supplied.id}") do
+        fill_in "product_name", with: "Big Bag Of Potatoes"
+        select(supplier_managed2.name, :from => 'producer')
+        fill_in "available_on", with: (Date.today-3).strftime("%F %T")
+        fill_in "price", with: "20"
+        select "Weight (kg)", from: "variant_unit_with_scale"
+        fill_in "on_hand", with: "18"
+        fill_in "display_as", with: "Big Bag"
+      end
 
       click_button 'Save Changes'
       expect(page.find("#update-status-message")).to have_content "Changes saved."
diff --git a/spec/lib/open_food_network/permissions_spec.rb b/spec/lib/open_food_network/permissions_spec.rb
index b0a004cbf1..bbab0d7175 100644
--- a/spec/lib/open_food_network/permissions_spec.rb
+++ b/spec/lib/open_food_network/permissions_spec.rb
@@ -55,6 +55,26 @@ module OpenFoodNetwork
       end
     end
 
+    describe "finding managed products" do
+      let!(:p1) { create(:simple_product) }
+      let!(:p2) { create(:simple_product) }
+
+      before do
+        permissions.stub(:managed_enterprise_products) { Spree::Product.where('1=0') }
+        permissions.stub(:related_enterprise_products) { Spree::Product.where('1=0') }
+      end
+
+      it "returns products produced by managed enterprises" do
+        permissions.stub(:managed_enterprise_products) { Spree::Product.where(id: p1) }
+        permissions.managed_products.should == [p1]
+      end
+
+      it "returns products produced by permitted enterprises" do
+        permissions.stub(:related_enterprise_products) { Spree::Product.where(id: p2) }
+        permissions.managed_products.should == [p2]
+      end
+    end
+
     ########################################
 
     describe "finding related enterprises with a particular permission" do
@@ -70,5 +90,16 @@ module OpenFoodNetwork
         permissions.send(:related_enterprises_with, permission).should == []
       end
     end
+
+    describe "finding the supplied products of related enterprises" do
+      let!(:e) { create(:enterprise) }
+      let!(:p) { create(:simple_product, supplier: e) }
+
+      it "returns supplied products" do
+        permissions.should_receive(:related_enterprises_with).with(:manage_products) { [e] }
+
+        permissions.send(:related_enterprise_products).should == [p]
+      end
+    end
   end
 end

From 9ec5dc6466930e14f446cf9003c6e9be24f33c27 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Mon, 1 Sep 2014 10:36:59 +1000
Subject: [PATCH 12/19] Find enterprises that we manage products for

---
 lib/open_food_network/permissions.rb          | 17 +++++--
 .../lib/open_food_network/permissions_spec.rb | 49 ++++++++++++++-----
 2 files changed, 51 insertions(+), 15 deletions(-)

diff --git a/lib/open_food_network/permissions.rb b/lib/open_food_network/permissions.rb
index f35a7db602..3d5df1e804 100644
--- a/lib/open_food_network/permissions.rb
+++ b/lib/open_food_network/permissions.rb
@@ -6,10 +6,7 @@ module OpenFoodNetwork
 
     # Find enterprises that an admin is allowed to add to an order cycle
     def order_cycle_enterprises
-      managed_enterprise_ids = managed_enterprises.pluck :id
-      permitted_enterprise_ids = related_enterprises_with(:add_to_order_cycle).pluck :id
-
-      Enterprise.where('id IN (?)', managed_enterprise_ids + permitted_enterprise_ids)
+      managed_and_related_enterprises_with :add_to_order_cycle
     end
 
     # Find the exchanges of an order cycle that an admin can manage
@@ -24,6 +21,10 @@ module OpenFoodNetwork
       Spree::Product.where('id IN (?)', managed_enterprise_products_ids + permitted_enterprise_products_ids)
     end
 
+    def managed_product_enterprises
+      managed_and_related_enterprises_with :manage_products
+    end
+
 
     private
 
@@ -40,6 +41,14 @@ module OpenFoodNetwork
       Enterprise.where('id IN (?)', parent_ids)
     end
 
+    def managed_and_related_enterprises_with(permission)
+      managed_enterprise_ids = managed_enterprises.pluck :id
+      permitted_enterprise_ids = related_enterprises_with(permission).pluck :id
+
+      Enterprise.where('id IN (?)', managed_enterprise_ids + permitted_enterprise_ids)
+    end
+
+
     def managed_enterprise_products
       Spree::Product.managed_by(@user)
     end
diff --git a/spec/lib/open_food_network/permissions_spec.rb b/spec/lib/open_food_network/permissions_spec.rb
index bbab0d7175..bcd1f8b742 100644
--- a/spec/lib/open_food_network/permissions_spec.rb
+++ b/spec/lib/open_food_network/permissions_spec.rb
@@ -9,19 +9,15 @@ module OpenFoodNetwork
     let(:e2) { create(:enterprise) }
 
     describe "finding enterprises that can be added to an order cycle" do
-      before do
-        permissions.stub(:managed_enterprises) { Enterprise.where('1=0') }
-        permissions.stub(:related_enterprises_with) { Enterprise.where('1=0') }
-      end
+      let(:e) { double(:enterprise) }
 
-      it "returns managed enterprises" do
-        permissions.stub(:managed_enterprises) { Enterprise.where(id: e1) }
-        permissions.order_cycle_enterprises.should == [e1]
-      end
+      it "returns managed and related enterprises with add_to_order_cycle permission" do
+        permissions.
+          should_receive(:managed_and_related_enterprises_with).
+          with(:add_to_order_cycle).
+          and_return([e])
 
-      it "returns permitted enterprises" do
-        permissions.stub(:related_enterprises_with) { Enterprise.where(id: e2) }
-        permissions.order_cycle_enterprises.should == [e2]
+        permissions.order_cycle_enterprises.should == [e]
       end
     end
 
@@ -75,6 +71,19 @@ module OpenFoodNetwork
       end
     end
 
+    describe "finding enterprises that we manage products for" do
+      let(:e) { double(:enterprise) }
+
+      it "returns managed and related enterprises with manage_products permission" do
+        permissions.
+          should_receive(:managed_and_related_enterprises_with).
+          with(:manage_products).
+          and_return([e])
+
+        permissions.managed_product_enterprises.should == [e]
+      end
+    end
+
     ########################################
 
     describe "finding related enterprises with a particular permission" do
@@ -91,6 +100,24 @@ module OpenFoodNetwork
       end
     end
 
+    describe "finding enterprises that are managed or with a particular permission" do
+      before do
+        permissions.stub(:managed_enterprises) { Enterprise.where('1=0') }
+        permissions.stub(:related_enterprises_with) { Enterprise.where('1=0') }
+      end
+
+      it "returns managed enterprises" do
+        permissions.should_receive(:managed_enterprises) { Enterprise.where(id: e1) }
+        permissions.send(:managed_and_related_enterprises_with, permission).should == [e1]
+      end
+
+      it "returns permitted enterprises" do
+        permissions.should_receive(:related_enterprises_with).with(permission).
+          and_return(Enterprise.where(id: e2))
+        permissions.send(:managed_and_related_enterprises_with, permission).should == [e2]
+      end
+    end
+
     describe "finding the supplied products of related enterprises" do
       let!(:e) { create(:enterprise) }
       let!(:p) { create(:simple_product, supplier: e) }

From fbd4f98fa9daa68a8ce99fe8046ac5ae29bb8582 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Mon, 1 Sep 2014 10:44:09 +1000
Subject: [PATCH 13/19] Include producers I have permission to in BPE producers
 choice

---
 app/controllers/spree/admin/products_controller_decorator.rb | 2 +-
 spec/features/admin/bulk_product_update_spec.rb              | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/controllers/spree/admin/products_controller_decorator.rb b/app/controllers/spree/admin/products_controller_decorator.rb
index 9f4fdbe46b..7fc9984241 100644
--- a/app/controllers/spree/admin/products_controller_decorator.rb
+++ b/app/controllers/spree/admin/products_controller_decorator.rb
@@ -85,7 +85,7 @@ Spree::Admin::ProductsController.class_eval do
   def load_bpe_data
     current_user.generate_spree_api_key! unless spree_current_user.spree_api_key
     @spree_api_key = spree_current_user.spree_api_key
-    @producers = Enterprise.managed_by(spree_current_user).is_primary_producer.order(:name)
+    @producers = OpenFoodNetwork::Permissions.new(spree_current_user).managed_product_enterprises.is_primary_producer.by_name
     @taxons = Spree::Taxon.order(:name)
   end
 end
diff --git a/spec/features/admin/bulk_product_update_spec.rb b/spec/features/admin/bulk_product_update_spec.rb
index 90f83bb26d..c4dbba32fd 100644
--- a/spec/features/admin/bulk_product_update_spec.rb
+++ b/spec/features/admin/bulk_product_update_spec.rb
@@ -764,10 +764,10 @@ feature %q{
       expect(page).to have_no_field 'product_name', with: product_not_supplied.name
     end
 
-    it "shows only suppliers that I manage" do
+    it "shows only suppliers that I manage or have permission to" do
       visit '/admin/products/bulk_edit'
 
-      expect(page).to have_select 'producer', with_options: [supplier_managed1.name, supplier_managed2.name], selected: supplier_managed1.name
+      expect(page).to have_select 'producer', with_options: [supplier_managed1.name, supplier_managed2.name, supplier_permitted.name], selected: supplier_managed1.name
       expect(page).to have_no_select 'producer', with_options: [supplier_unmanaged.name]
     end
 

From b7708d750b5a4108af17cd4d101fa8e71a7f5a54 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Mon, 1 Sep 2014 11:15:00 +1000
Subject: [PATCH 14/19] Check authorisation for bulk update products

---
 .../admin/products_controller_decorator.rb    |  3 +++
 .../spree/admin/products_controller_spec.rb   | 21 +++++++++++++++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/app/controllers/spree/admin/products_controller_decorator.rb b/app/controllers/spree/admin/products_controller_decorator.rb
index 7fc9984241..a5b38126e5 100644
--- a/app/controllers/spree/admin/products_controller_decorator.rb
+++ b/app/controllers/spree/admin/products_controller_decorator.rb
@@ -30,6 +30,9 @@ Spree::Admin::ProductsController.class_eval do
       "#{string}q[#{filter[:property][:db_column]}_#{filter[:predicate][:predicate]}]=#{filter[:value]};"
     end
 
+    # Ensure we're authorised to update all products
+    product_set.collection.each { |p| authorize! :update, p }
+
     if product_set.save
       redirect_to "/api/products/bulk_products?page=1;per_page=500;#{bulk_index_query}"
     else
diff --git a/spec/controllers/spree/admin/products_controller_spec.rb b/spec/controllers/spree/admin/products_controller_spec.rb
index f05be2bb69..9746ffa0e2 100644
--- a/spec/controllers/spree/admin/products_controller_spec.rb
+++ b/spec/controllers/spree/admin/products_controller_spec.rb
@@ -1,11 +1,28 @@
 require 'spec_helper'
 
 describe Spree::Admin::ProductsController do
-  context "Creating a new product" do
+  describe "updating a product we do not have access to" do
+    let(:s_managed) { create(:enterprise) }
+    let(:s_unmanaged) { create(:enterprise) }
+    let(:p) { create(:simple_product, supplier: s_unmanaged, name: 'Peas') }
+
     before do
-      login_as_admin
+      login_as_enterprise_user [s_managed]
+      spree_post :bulk_update, {"products" => [{"id" => p.id, "name" => "Pine nuts"}]}
     end
 
+    it "denies access" do
+      response.should redirect_to "http://test.host/unauthorized"
+    end
+
+    it "does not update any product" do
+      p.reload.name.should_not == "Pine nuts"
+    end
+  end
+
+  context "creating a new product" do
+    before { login_as_admin }
+
     it "redirects to bulk_edit when the user hits 'create'" do
       s = create(:supplier_enterprise)
       t = create(:taxon)

From fe1c60ba4709352b2f47610f6eaeb7e1eaffb72f Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Mon, 1 Sep 2014 11:49:09 +1000
Subject: [PATCH 15/19] Enterprise manager can edit products from enterprises
 it has manage_products permission on

---
 app/models/spree/ability_decorator.rb           |  4 ++--
 spec/features/admin/bulk_product_update_spec.rb | 14 +++++++-------
 spec/models/spree/ability_spec.rb               | 17 ++++++++++++++---
 3 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb
index 68d98bd568..9f9c96cb15 100644
--- a/app/models/spree/ability_decorator.rb
+++ b/app/models/spree/ability_decorator.rb
@@ -43,12 +43,12 @@ class AbilityDecorator
     # Enterprise User can only access products that they are a supplier for
     can [:create], Spree::Product
     can [:admin, :read, :update, :product_distributions, :bulk_edit, :bulk_update, :clone, :destroy], Spree::Product do |product|
-      user.enterprises.include? product.supplier
+      OpenFoodNetwork::Permissions.new(user).managed_product_enterprises.include? product.supplier
     end
 
     can [:create], Spree::Variant
     can [:admin, :index, :read, :edit, :update, :search, :destroy], Spree::Variant do |variant|
-      user.enterprises.include? variant.product.supplier
+      OpenFoodNetwork::Permissions.new(user).managed_product_enterprises.include? variant.product.supplier
     end
 
     can [:admin, :index, :read, :create, :edit, :update_positions, :destroy], Spree::ProductProperty
diff --git a/spec/features/admin/bulk_product_update_spec.rb b/spec/features/admin/bulk_product_update_spec.rb
index c4dbba32fd..9f530f860c 100644
--- a/spec/features/admin/bulk_product_update_spec.rb
+++ b/spec/features/admin/bulk_product_update_spec.rb
@@ -780,19 +780,19 @@ feature %q{
     end
 
     it "allows me to update a product" do
-      p = product_supplied
+      p = product_supplied_permitted
 
       visit '/admin/products/bulk_edit'
       first("div#columns_dropdown", :text => "COLUMNS").click
       first("div#columns_dropdown div.menu div.menu_item", text: "Available On").click
 
-      expect(page).to have_field "product_name", with: p.name
-      expect(page).to have_select "producer", selected: supplier_managed1.name
-      expect(page).to have_field "available_on", with: p.available_on.strftime("%F %T")
-      expect(page).to have_field "price", with: "10.0"
-      expect(page).to have_field "on_hand", with: "6"
+      within "tr#p_#{p.id}" do
+        expect(page).to have_field "product_name", with: p.name
+        expect(page).to have_select "producer", selected: supplier_permitted.name
+        expect(page).to have_field "available_on", with: p.available_on.strftime("%F %T")
+        expect(page).to have_field "price", with: "10.0"
+        expect(page).to have_field "on_hand", with: "6"
 
-      within("tr#p_#{product_supplied.id}") do
         fill_in "product_name", with: "Big Bag Of Potatoes"
         select(supplier_managed2.name, :from => 'producer')
         fill_in "available_on", with: (Date.today-3).strftime("%F %T")
diff --git a/spec/models/spree/ability_spec.rb b/spec/models/spree/ability_spec.rb
index 9e5ae49780..cf17d7fe3a 100644
--- a/spec/models/spree/ability_spec.rb
+++ b/spec/models/spree/ability_spec.rb
@@ -51,14 +51,17 @@ module Spree
       # create enterprises
       let(:s1) { create(:supplier_enterprise) }
       let(:s2) { create(:supplier_enterprise) }
+      let(:s_related) { create(:supplier_enterprise) }
       let(:d1) { create(:distributor_enterprise) }
       let(:d2) { create(:distributor_enterprise) }
 
       let(:p1) { create(:product, supplier: s1, distributors:[d1, d2]) }
       let(:p2) { create(:product, supplier: s2, distributors:[d1, d2]) }
+      let(:p_related) { create(:product, supplier: s_related) }
 
       let(:er1) { create(:enterprise_relationship, parent: s1, child: d1) }
       let(:er2) { create(:enterprise_relationship, parent: d1, child: s1) }
+      let(:er_p) { create(:enterprise_relationship, parent: s_related, child: s1, permissions_list: [:manage_products]) }
 
       subject { user }
       let(:user) { nil }
@@ -74,12 +77,20 @@ module Spree
 
         let(:order) {create(:order)}
 
-        it "should be able to read/write their enterprises' products" do
+        it "should be able to read/write their enterprises' products and variants" do
           should have_ability([:admin, :read, :update, :product_distributions, :bulk_edit, :bulk_update, :clone, :destroy], for: p1)
+          should have_ability([:admin, :index, :read, :edit, :update, :search, :destroy], for: p1.master)
         end
 
-        it "should not be able to read/write other enterprises' products" do
+        it "should be able to read/write related enterprises' products and variants with manage_products permission" do
+          er_p
+          should have_ability([:admin, :read, :update, :product_distributions, :bulk_edit, :bulk_update, :clone, :destroy], for: p_related)
+          should have_ability([:admin, :index, :read, :edit, :update, :search, :destroy], for: p_related.master)
+        end
+
+        it "should not be able to read/write other enterprises' products and variants" do
           should_not have_ability([:admin, :read, :update, :product_distributions, :bulk_edit, :bulk_update, :clone, :destroy], for: p2)
+          should_not have_ability([:admin, :index, :read, :edit, :update, :search, :destroy], for: p2.master)
         end
 
         it "should not be able to access admin actions on orders" do
@@ -247,7 +258,7 @@ module Spree
         end
       end
 
-      context 'Enterprise manager' do
+      context 'enterprise manager' do
         let (:user) do
           user = create(:user)
           user.spree_roles = []

From c43c35601bf319fb018c21fa7f5e7fd33faf716f Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Mon, 1 Sep 2014 16:21:23 +1000
Subject: [PATCH 16/19] Set product.largeImage in JS, use for product modal

---
 .../darkswarm/services/products.js.coffee          |  1 +
 .../javascripts/templates/product_modal.html.haml  |  2 +-
 .../unit/darkswarm/services/product_spec.js.coffee | 14 ++++++++++++++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/darkswarm/services/products.js.coffee b/app/assets/javascripts/darkswarm/services/products.js.coffee
index 5819c7b661..9da3187f82 100644
--- a/app/assets/javascripts/darkswarm/services/products.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/products.js.coffee
@@ -48,3 +48,4 @@ Darkswarm.factory 'Products', ($resource, Enterprises, Dereferencer, Taxons, Car
         
         product.primaryImage = product.images[0]?.small_url if product.images
         product.primaryImageOrMissing = product.primaryImage || "/assets/noimage/small.png"
+        product.largeImage = product.images[0]?.large_url if product.images
diff --git a/app/assets/javascripts/templates/product_modal.html.haml b/app/assets/javascripts/templates/product_modal.html.haml
index 31f51c6655..82cda0a371 100644
--- a/app/assets/javascripts/templates/product_modal.html.haml
+++ b/app/assets/javascripts/templates/product_modal.html.haml
@@ -1,6 +1,6 @@
 .row
   .columns.small-12.large-6
-    %img.product-img{"ng-src" => "{{product.primaryImage}}", "ng-if" => "product.primaryImage"} 
+    %img.product-img{"ng-src" => "{{product.largeImage}}", "ng-if" => "product.largeImage"}
   .columns.small-12.large-6.product-header
     %h2 
       / %render-svg{path: "{{product.primary_taxon.icon}}"}
diff --git a/spec/javascripts/unit/darkswarm/services/product_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/product_spec.js.coffee
index d7c5a20b91..27e3f5aff6 100644
--- a/spec/javascripts/unit/darkswarm/services/product_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/services/product_spec.js.coffee
@@ -7,6 +7,7 @@ describe 'Products service', ->
   CurrentHubMock = {} 
   currentOrder = null
   product = null
+  productWithImage = null
 
   beforeEach ->
     product =  
@@ -16,6 +17,14 @@ describe 'Products service', ->
       price: 11
       master: {}
       variants: []
+    productWithImage =
+      supplier:
+        id: 9
+      master: {}
+      variants: []
+      images: [
+        large_url: 'foo.png'
+      ]
     currentOrder =
       line_items: []
 
@@ -62,6 +71,11 @@ describe 'Products service', ->
     expect(Products.products[0].primaryImage).toBeUndefined()
     expect(Products.products[0].primaryImageOrMissing).toEqual "/assets/noimage/small.png"
 
+  it "sets largeImage", ->
+    $httpBackend.expectGET("/shop/products").respond([productWithImage])
+    $httpBackend.flush()
+    expect(Products.products[0].largeImage).toEqual("foo.png")
+
   describe "determining the price to display for a product", ->
     it "displays the product price when the product does not have variants", ->
       $httpBackend.expectGET("/shop/products").respond([product])

From 4d766a29ab5f7fb1dc483b583965b20db6ff8cb8 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Tue, 2 Sep 2014 13:45:11 +1000
Subject: [PATCH 17/19] Convert admin login nav to haml

---
 app/views/spree/layouts/admin/_login_nav.html.erb  |  8 --------
 app/views/spree/layouts/admin/_login_nav.html.haml | 14 ++++++++++++++
 2 files changed, 14 insertions(+), 8 deletions(-)
 delete mode 100644 app/views/spree/layouts/admin/_login_nav.html.erb
 create mode 100644 app/views/spree/layouts/admin/_login_nav.html.haml

diff --git a/app/views/spree/layouts/admin/_login_nav.html.erb b/app/views/spree/layouts/admin/_login_nav.html.erb
deleted file mode 100644
index 7ab28b3344..0000000000
--- a/app/views/spree/layouts/admin/_login_nav.html.erb
+++ /dev/null
@@ -1,8 +0,0 @@
-<% if spree_current_user %>
-  <ul id="login-nav" class="inline-menu">
-    <li data-hook="user-logged-in-as"><%= t(:logged_in_as) %>: <%= spree_current_user.email %></li>
-    <li data-hook="user-account-link"><i class="icon-user"></i><%= link_to t(:account), spree.edit_user_path(spree_current_user) %></li>
-    <li data-hook="user-logout-link"><i class="icon-signout"></i><%= link_to t(:logout), spree.logout_path %></li>
-    <li data-hook="store-frontend-link"><i class="icon-external-link"></i><%= link_to t(:store), spree.root_path, :target => '_blank' %></li>
-  </ul>
-<% end %>
diff --git a/app/views/spree/layouts/admin/_login_nav.html.haml b/app/views/spree/layouts/admin/_login_nav.html.haml
new file mode 100644
index 0000000000..4ecb72d148
--- /dev/null
+++ b/app/views/spree/layouts/admin/_login_nav.html.haml
@@ -0,0 +1,14 @@
+- if spree_current_user
+  %ul#login-nav.inline-menu
+    %li{"data-hook" => "user-logged-in-as"}
+      = t(:logged_in_as)
+      \: #{spree_current_user.email}
+    %li{"data-hook" => "user-account-link"}
+      %i.icon-user
+      = link_to t(:account), spree.edit_user_path(spree_current_user)
+    %li{"data-hook" => "user-logout-link"}
+      %i.icon-signout
+      = link_to t(:logout), spree.logout_path
+    %li{"data-hook" => "store-frontend-link"}
+      %i.icon-external-link
+      = link_to t(:store), spree.root_path, :target => '_blank'

From 3a12f9a7c8bc4d2246f42a4fe00b42789d27f745 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Tue, 2 Sep 2014 15:27:33 +1000
Subject: [PATCH 18/19] Extract bulk product edit interface into partials

---
 .../spree/admin/products/bulk_edit.html.haml  | 145 +-----------------
 .../products/bulk_edit/_actions.html.haml     |  14 ++
 .../admin/products/bulk_edit/_data.html.haml  |   2 +
 .../products/bulk_edit/_filters.html.haml     |  18 +++
 .../products/bulk_edit/_header.html.haml      |  12 ++
 .../products/bulk_edit/_indicators.html.haml  |   9 ++
 .../products/bulk_edit/_products.html.haml    |   9 ++
 .../bulk_edit/_products_head.html.haml        |  28 ++++
 .../bulk_edit/_products_product.html.haml     |  30 ++++
 .../bulk_edit/_products_variant.html.haml     |  23 +++
 10 files changed, 152 insertions(+), 138 deletions(-)
 create mode 100644 app/views/spree/admin/products/bulk_edit/_actions.html.haml
 create mode 100644 app/views/spree/admin/products/bulk_edit/_data.html.haml
 create mode 100644 app/views/spree/admin/products/bulk_edit/_filters.html.haml
 create mode 100644 app/views/spree/admin/products/bulk_edit/_header.html.haml
 create mode 100644 app/views/spree/admin/products/bulk_edit/_indicators.html.haml
 create mode 100644 app/views/spree/admin/products/bulk_edit/_products.html.haml
 create mode 100644 app/views/spree/admin/products/bulk_edit/_products_head.html.haml
 create mode 100644 app/views/spree/admin/products/bulk_edit/_products_product.html.haml
 create mode 100644 app/views/spree/admin/products/bulk_edit/_products_variant.html.haml

diff --git a/app/views/spree/admin/products/bulk_edit.html.haml b/app/views/spree/admin/products/bulk_edit.html.haml
index 206a336a5e..fa322931cd 100644
--- a/app/views/spree/admin/products/bulk_edit.html.haml
+++ b/app/views/spree/admin/products/bulk_edit.html.haml
@@ -1,141 +1,10 @@
-- content_for :page_title do
-  = "Bulk Edit Products"
+= render 'spree/admin/products/bulk_edit/header'
+= render 'spree/admin/products/bulk_edit/data'
 
-- content_for :page_actions do
-  %div{ :class => "toolbar", 'data-hook' => "toolbar" }
-    %ul{ :class => "actions header-action-links inline-menu" }
-      %li#new_product_link
-        = button_link_to t(:new_product), new_object_url, { :remote => true, :icon => 'icon-plus', :id => 'admin_new_product' }
-
-= render :partial => 'spree/admin/shared/product_sub_menu'
-
-%div#new_product(data-hook)
-
-
-=admin_inject_producers
-=admin_inject_taxons
 %div{ 'ng-app' => 'ofn.admin', 'ng-controller' => 'AdminProductEditCtrl', 'ng-init' => "initialise('#{@spree_api_key}');loading=true;" }
-  %div.sixteen.columns.alpha
-    %div.quick_search{ :class => "four columns alpha" }
-      %label{ :for => 'quick_filter' }
-      %br
-      %input.search{ :class => "four columns alpha", 'ng-model' => 'query', :name => "quick_filter", :type => 'text', 'placeholder' => 'Quick Search' }
-    .filter_select{ :class => "four columns" }
-      %label{ :for => 'producer_filter' }Producer
-      %br
-      %select{ :class => "four columns alpha", :id => 'producer_filter', 'ofn-select2-min-search' => 5, 'ng-model' => 'producerFilter', 'ng-options' => 'producer.id as producer.name for producer in filterProducers' }
-    .filter_select{ :class => "four columns" }
-      %label{ :for => 'category_filter' }Category
-      %br
-      %select{ :class => "four columns alpha", :id => 'category_filter', 'ofn-select2-min-search' => 5, 'ng-model' => 'categoryFilter', 'ng-options' => 'taxon.id as taxon.name for taxon in filterTaxons'}
-    %div{ :class => "one column" } &nbsp;
-    .filter_clear{ :class => "three columns omega" }
-      %label{ :for => 'clear_all_filters' }
-      %br
-      %input.fullwidth{ :type => 'button', :id => 'clear_all_filters', :value => "Clear Filters", 'ng-click' => "resetSelectFilters()" }
-  %hr.sixteen.columns.alpha
-  %div.sixteen.columns.alpha{ 'ng-hide' => 'loading || products.length == 0', style: "margin-bottom: 10px" }
-    %div.four.columns.alpha
-      %input.four.columns.alpha{ :type => 'button', :value => 'Save Changes', 'ng-click' => 'submitProducts()'}
-    %div.nine.columns
-      %h6{ id: "update-status-message", ng: { style: 'updateStatusMessage.style' } }
-        {{ updateStatusMessage.text || "&nbsp;" }}
-    %div.three.columns.omega
-      %div.ofn_drop_down.three.columns.omega{ 'ng-controller' => "DropDownCtrl", :id => "columns_dropdown", 'ofn-drop-down' => true, :style => 'float:right;' }
-        %span{ :class => 'icon-reorder' } &nbsp; Columns
-        %span{ 'ng-class' => "expanded && 'icon-caret-up' || !expanded && 'icon-caret-down'" }
-        %div.menu{ 'ng-show' => "expanded" }
-          %div.menu_item{ :class => "three columns alpha", 'ng-repeat' => "column in columns",  'ofn-toggle-column' => true }
-            %span{ :class => 'one column alpha', :style => 'text-align: center'} {{ column.visible && "&#10003;" || !column.visible && "&nbsp;" }}
-            %span{ :class => 'two columns omega' } {{column.name }}
-  %div{ 'ng-show' => '!spree_api_key_ok' }
-    {{ api_error_msg }}
-  %div.sixteen.columns.alpha#loading{ 'ng-if' => 'loading' }
-    %img.spinner{ src: "/assets/loading.gif" }
-    %h1 LOADING PRODUCTS
-  %div.sixteen.columns.alpha{ 'ng-show' => '!loading && filteredProducts.length == 0' }
-    %h1#no_results No products found.
-  %div.sixteen.columns.alpha{ 'ng-hide' => 'loading || filteredProducts.length == 0' }
-    %table.index#listing_products.bulk{ "infinite-scroll" => "incrementLimit()", "infinite-scroll-distance" => "1" }
-      %colgroup
-        %col.actions
-        %col.producer{ ng: { show: 'columns.producer.visible' } }
-        %col.name{ ng: { show: 'columns.name.visible' } }
-        %col.unit{ ng: { show: 'columns.unit.visible' } }
-        %col.display_as{ ng: { show: 'columns.unit.visible' } }
-        %col.price{ ng: { show: 'columns.price.visible'} }
-        %col.on_hand{ ng: { show: 'columns.on_hand.visible' } }
-        %col.category{ ng: { show: 'columns.category.visible' } }
-        %col.available_on{ ng: { show: 'columns.available_on.visible' } }
-        %col.actions
-        %col.actions
-        %col.actions
 
-      %thead
-        %tr
-          %th.left-actions
-          %th.producer{ 'ng-show' => 'columns.producer.visible' } Producer
-          %th.name{ 'ng-show' => 'columns.name.visible' } Name
-          %th.unit{ 'ng-show' => 'columns.unit.visible' } Unit / Value
-          %th.display_as{ 'ng-show' => 'columns.unit.visible' } Display As
-          %th.price{ 'ng-show' => 'columns.price.visible' } Price
-          %th.on_hand{ 'ng-show' => 'columns.on_hand.visible' } On Hand
-          %th.category{ 'ng-show' => 'columns.category.visible' } Category
-          %th.available_on{ 'ng-show' => 'columns.available_on.visible' } Av. On
-          %th.actions
-          %th.actions
-          %th.actions
-      %tbody{ 'ng-repeat' => 'product in filteredProducts = ( products | filter:query | producer: producerFilter | category: categoryFilter | limitTo:limit )', 'ng-class-even' => "'even'", 'ng-class-odd' => "'odd'" }
-        %tr.product{ :id => "p_{{product.id}}" }
-          %td.left-actions
-            %a{ 'ofn-toggle-variants' => 'true', :class => "view-variants icon-chevron-right", 'ng-show' => 'hasVariants(product)' }
-            %a{ :class => "add-variant icon-plus-sign", 'ng-click' => "addVariant(product)", 'ng-show' => "!hasVariants(product) && hasUnit(product)" }
-          %td.producer{ 'ng-show' => 'columns.producer.visible' }
-            %select.select2.fullwidth{ 'ng-model' => 'product.producer', :name => 'producer', 'ofn-track-product' => 'producer', 'ng-options' => 'producer.id as producer.name for producer in producers' }
-          %td.name{ 'ng-show' => 'columns.name.visible' }
-            %input{ 'ng-model' => "product.name", :name => 'product_name', 'ofn-track-product' => 'name', :type => 'text' }
-          %td.unit{ 'ng-show' => 'columns.unit.visible' }
-            %select.select2{ 'ng-model' => 'product.variant_unit_with_scale', :name => 'variant_unit_with_scale', 'ofn-track-product' => 'variant_unit_with_scale', 'ng-options' => 'unit[1] as unit[0] for unit in variant_unit_options' }
-              %option{'value' => '', 'ng-hide' => "hasVariants(product) && hasUnit(product)"}
-            %input{ 'ng-model' => 'product.master.unit_value_with_description', :name => 'master_unit_value_with_description', 'ofn-track-master' => 'unit_value_with_description', :type => 'text', :placeholder => 'value', 'ng-show' => "!hasVariants(product) && hasUnit(product)", 'ofn-maintain-unit-scale' => true }
-            %input{ 'ng-model' => 'product.variant_unit_name', :name => 'variant_unit_name', 'ofn-track-product' => 'variant_unit_name', :placeholder => 'unit', 'ng-show' => "product.variant_unit_with_scale == 'items'", :type => 'text' }
-          %td.display_as{ 'ng-show' => 'columns.unit.visible' }
-            %input{ 'ofn-display-as' => 'product.master', name: 'display_as', 'ofn-track-master' => 'display_as', type: 'text', placeholder: '{{ placeholder_text }}', ng: { hide: 'hasVariants(product)', model: 'product.master.display_as' } }
-          %td.price{ 'ng-show' => 'columns.price.visible' }
-            %input{ 'ng-model' => 'product.price', 'ofn-decimal' => :true, :name => 'price', 'ofn-track-product' => 'price', :type => 'text', 'ng-hide' => 'hasVariants(product)' }
-          %td.on_hand{ 'ng-show' => 'columns.on_hand.visible' }
-            %span{ 'ng-bind' => 'product.on_hand', :name => 'on_hand', 'ng-show' => '!hasOnDemandVariants(product) && (hasVariants(product) || product.on_demand)' }
-            %input.field{ 'ng-model' => 'product.on_hand', :name => 'on_hand', 'ofn-track-product' => 'on_hand', 'ng-hide' => 'hasVariants(product) || product.on_demand', :type => 'number' }
-          %td.category{ 'ng-if' => 'columns.category.visible' }
-            %input.fullwidth{ :type => 'text', id: "p{{product.id}}_category", 'ng-model' => 'product.category', 'ofn-taxon-autocomplete' => '', 'ofn-track-product' => 'category' }
-          %td.available_on{ 'ng-show' => 'columns.available_on.visible' }
-            %input{ 'ng-model' => 'product.available_on', :name => 'available_on', 'ofn-track-product' => 'available_on', 'datetimepicker' => 'product.available_on', type: "text" }
-          %td.actions
-            %a{ 'ng-click' => 'editWarn(product)', :class => "edit-product icon-edit no-text" }
-          %td.actions
-            %a{ 'ng-click' => 'cloneProduct(product)', :class => "clone-product icon-copy no-text" }
-          %td.actions
-            %a{ 'ng-click' => 'deleteProduct(product)', :class => "delete-product icon-trash no-text" }
-        %tr.variant{ :id => "v_{{variant.id}}", 'ng-repeat' => 'variant in product.variants', 'ng-show' => 'displayProperties[product.id].showVariants', 'ng-class-even' => "'even'", 'ng-class-odd' => "'odd'" }
-          %td.left-actions
-            %a{ :class => "variant-item icon-caret-right", 'ng-hide' => "$last" }
-            %a{ :class => "add-variant icon-plus-sign", 'ng-click' => "addVariant(product)", 'ng-show' => "$last" }
-          %td{ 'ng-show' => 'columns.producer.visible' }
-          %td{ 'ng-show' => 'columns.name.visible' }
-            %input{ 'ng-model' => 'variant.display_name', :name => 'variant_display_name', 'ofn-track-variant' => 'display_name', :type => 'text', placeholder: "{{ product.name }}" }
-          %td.unit_value{ 'ng-show' => 'columns.unit.visible' }
-            %input{ 'ng-model' => 'variant.unit_value_with_description', :name => 'variant_unit_value_with_description', 'ofn-track-variant' => 'unit_value_with_description', :type => 'text', 'ofn-maintain-unit-scale' => true }
-          %td.display_as{ 'ng-show' => 'columns.unit.visible' }
-            %input{ 'ofn-display-as' => 'variant', 'ng-model' => 'variant.display_as', name: 'variant_display_as', 'ofn-track-variant' => 'display_as', type: 'text', placeholder: '{{ placeholder_text }}' }
-          %td{ 'ng-show' => 'columns.price.visible' }
-            %input{ 'ng-model' => 'variant.price', 'ofn-decimal' => :true, :name => 'variant_price', 'ofn-track-variant' => 'price', :type => 'text' }
-          %td{ 'ng-show' => 'columns.on_hand.visible' }
-            %input.field{ 'ng-model' => 'variant.on_hand', 'ng-change' => 'updateOnHand(product)', :name => 'variant_on_hand', 'ng-hide' => 'variant.on_demand', 'ofn-track-variant' => 'on_hand', :type => 'number' }
-            %span{ 'ng-bind' => 'variant.on_hand', :name => 'variant_on_hand', 'ng-show' => 'variant.on_demand' }
-          %td{ 'ng-show' => 'columns.category.visible' }
-          %td{ 'ng-show' => 'columns.available_on.visible' }
-          %td.actions
-            %a{ 'ng-click' => 'editWarn(product,variant)', :class => "edit-variant icon-edit no-text", 'ng-show' => "variantSaved(variant)" }
-          %td.actions
-          %td.actions
-            %a{ 'ng-click' => 'deleteVariant(product,variant)', :class => "delete-variant icon-trash no-text" }
+  = render 'spree/admin/products/bulk_edit/filters'
+  %hr.sixteen.columns.alpha
+  = render 'spree/admin/products/bulk_edit/actions'
+  = render 'spree/admin/products/bulk_edit/indicators'
+  = render 'spree/admin/products/bulk_edit/products'
diff --git a/app/views/spree/admin/products/bulk_edit/_actions.html.haml b/app/views/spree/admin/products/bulk_edit/_actions.html.haml
new file mode 100644
index 0000000000..d86f16bc09
--- /dev/null
+++ b/app/views/spree/admin/products/bulk_edit/_actions.html.haml
@@ -0,0 +1,14 @@
+%div.sixteen.columns.alpha{ 'ng-hide' => 'loading || products.length == 0', style: "margin-bottom: 10px" }
+  %div.four.columns.alpha
+    %input.four.columns.alpha{ :type => 'button', :value => 'Save Changes', 'ng-click' => 'submitProducts()'}
+  %div.nine.columns
+    %h6{ id: "update-status-message", ng: { style: 'updateStatusMessage.style' } }
+      {{ updateStatusMessage.text || "&nbsp;" }}
+  %div.three.columns.omega
+    %div.ofn_drop_down.three.columns.omega{ 'ng-controller' => "DropDownCtrl", :id => "columns_dropdown", 'ofn-drop-down' => true, :style => 'float:right;' }
+      %span{ :class => 'icon-reorder' } &nbsp; Columns
+      %span{ 'ng-class' => "expanded && 'icon-caret-up' || !expanded && 'icon-caret-down'" }
+      %div.menu{ 'ng-show' => "expanded" }
+        %div.menu_item{ :class => "three columns alpha", 'ng-repeat' => "column in columns",  'ofn-toggle-column' => true }
+          %span{ :class => 'one column alpha', :style => 'text-align: center'} {{ column.visible && "&#10003;" || !column.visible && "&nbsp;" }}
+          %span{ :class => 'two columns omega' } {{column.name }}
diff --git a/app/views/spree/admin/products/bulk_edit/_data.html.haml b/app/views/spree/admin/products/bulk_edit/_data.html.haml
new file mode 100644
index 0000000000..25d595bda1
--- /dev/null
+++ b/app/views/spree/admin/products/bulk_edit/_data.html.haml
@@ -0,0 +1,2 @@
+= admin_inject_producers
+= admin_inject_taxons
diff --git a/app/views/spree/admin/products/bulk_edit/_filters.html.haml b/app/views/spree/admin/products/bulk_edit/_filters.html.haml
new file mode 100644
index 0000000000..beee7d0a6a
--- /dev/null
+++ b/app/views/spree/admin/products/bulk_edit/_filters.html.haml
@@ -0,0 +1,18 @@
+%div.sixteen.columns.alpha
+  %div.quick_search{ :class => "four columns alpha" }
+    %label{ :for => 'quick_filter' }
+    %br
+    %input.search{ :class => "four columns alpha", 'ng-model' => 'query', :name => "quick_filter", :type => 'text', 'placeholder' => 'Quick Search' }
+  .filter_select{ :class => "four columns" }
+    %label{ :for => 'producer_filter' }Producer
+    %br
+    %select{ :class => "four columns alpha", :id => 'producer_filter', 'ofn-select2-min-search' => 5, 'ng-model' => 'producerFilter', 'ng-options' => 'producer.id as producer.name for producer in filterProducers' }
+  .filter_select{ :class => "four columns" }
+    %label{ :for => 'category_filter' }Category
+    %br
+    %select{ :class => "four columns alpha", :id => 'category_filter', 'ofn-select2-min-search' => 5, 'ng-model' => 'categoryFilter', 'ng-options' => 'taxon.id as taxon.name for taxon in filterTaxons'}
+  %div{ :class => "one column" } &nbsp;
+  .filter_clear{ :class => "three columns omega" }
+    %label{ :for => 'clear_all_filters' }
+    %br
+    %input.fullwidth{ :type => 'button', :id => 'clear_all_filters', :value => "Clear Filters", 'ng-click' => "resetSelectFilters()" }
diff --git a/app/views/spree/admin/products/bulk_edit/_header.html.haml b/app/views/spree/admin/products/bulk_edit/_header.html.haml
new file mode 100644
index 0000000000..09586b3e7c
--- /dev/null
+++ b/app/views/spree/admin/products/bulk_edit/_header.html.haml
@@ -0,0 +1,12 @@
+- content_for :page_title do
+  = "Bulk Edit Products"
+
+- content_for :page_actions do
+  %div{ :class => "toolbar", 'data-hook' => "toolbar" }
+    %ul{ :class => "actions header-action-links inline-menu" }
+      %li#new_product_link
+        = button_link_to t(:new_product), new_object_url, { :remote => true, :icon => 'icon-plus', :id => 'admin_new_product' }
+
+= render :partial => 'spree/admin/shared/product_sub_menu'
+
+%div#new_product(data-hook)
diff --git a/app/views/spree/admin/products/bulk_edit/_indicators.html.haml b/app/views/spree/admin/products/bulk_edit/_indicators.html.haml
new file mode 100644
index 0000000000..97c8a45aa2
--- /dev/null
+++ b/app/views/spree/admin/products/bulk_edit/_indicators.html.haml
@@ -0,0 +1,9 @@
+%div{ 'ng-show' => '!spree_api_key_ok' }
+  {{ api_error_msg }}
+
+%div.sixteen.columns.alpha#loading{ 'ng-if' => 'loading' }
+  %img.spinner{ src: "/assets/loading.gif" }
+  %h1 LOADING PRODUCTS
+
+%div.sixteen.columns.alpha{ 'ng-show' => '!loading && filteredProducts.length == 0' }
+  %h1#no_results No products found.
diff --git a/app/views/spree/admin/products/bulk_edit/_products.html.haml b/app/views/spree/admin/products/bulk_edit/_products.html.haml
new file mode 100644
index 0000000000..81fb31573b
--- /dev/null
+++ b/app/views/spree/admin/products/bulk_edit/_products.html.haml
@@ -0,0 +1,9 @@
+%div.sixteen.columns.alpha{ 'ng-hide' => 'loading || filteredProducts.length == 0' }
+  %table.index#listing_products.bulk{ "infinite-scroll" => "incrementLimit()", "infinite-scroll-distance" => "1" }
+
+    = render 'spree/admin/products/bulk_edit/products_head'
+
+    %tbody{ 'ng-repeat' => 'product in filteredProducts = ( products | filter:query | producer: producerFilter | category: categoryFilter | limitTo:limit )', 'ng-class-even' => "'even'", 'ng-class-odd' => "'odd'" }
+
+      = render 'spree/admin/products/bulk_edit/products_product'
+      = render 'spree/admin/products/bulk_edit/products_variant'
diff --git a/app/views/spree/admin/products/bulk_edit/_products_head.html.haml b/app/views/spree/admin/products/bulk_edit/_products_head.html.haml
new file mode 100644
index 0000000000..d6be2a88e0
--- /dev/null
+++ b/app/views/spree/admin/products/bulk_edit/_products_head.html.haml
@@ -0,0 +1,28 @@
+%colgroup
+  %col.actions
+  %col.producer{ ng: { show: 'columns.producer.visible' } }
+  %col.name{ ng: { show: 'columns.name.visible' } }
+  %col.unit{ ng: { show: 'columns.unit.visible' } }
+  %col.display_as{ ng: { show: 'columns.unit.visible' } }
+  %col.price{ ng: { show: 'columns.price.visible'} }
+  %col.on_hand{ ng: { show: 'columns.on_hand.visible' } }
+  %col.category{ ng: { show: 'columns.category.visible' } }
+  %col.available_on{ ng: { show: 'columns.available_on.visible' } }
+  %col.actions
+  %col.actions
+  %col.actions
+
+%thead
+  %tr
+    %th.left-actions
+    %th.producer{ 'ng-show' => 'columns.producer.visible' } Producer
+    %th.name{ 'ng-show' => 'columns.name.visible' } Name
+    %th.unit{ 'ng-show' => 'columns.unit.visible' } Unit / Value
+    %th.display_as{ 'ng-show' => 'columns.unit.visible' } Display As
+    %th.price{ 'ng-show' => 'columns.price.visible' } Price
+    %th.on_hand{ 'ng-show' => 'columns.on_hand.visible' } On Hand
+    %th.category{ 'ng-show' => 'columns.category.visible' } Category
+    %th.available_on{ 'ng-show' => 'columns.available_on.visible' } Av. On
+    %th.actions
+    %th.actions
+    %th.actions
diff --git a/app/views/spree/admin/products/bulk_edit/_products_product.html.haml b/app/views/spree/admin/products/bulk_edit/_products_product.html.haml
new file mode 100644
index 0000000000..ee2c1dc136
--- /dev/null
+++ b/app/views/spree/admin/products/bulk_edit/_products_product.html.haml
@@ -0,0 +1,30 @@
+%tr.product{ :id => "p_{{product.id}}" }
+  %td.left-actions
+    %a{ 'ofn-toggle-variants' => 'true', :class => "view-variants icon-chevron-right", 'ng-show' => 'hasVariants(product)' }
+    %a{ :class => "add-variant icon-plus-sign", 'ng-click' => "addVariant(product)", 'ng-show' => "!hasVariants(product) && hasUnit(product)" }
+  %td.producer{ 'ng-show' => 'columns.producer.visible' }
+    %select.select2.fullwidth{ 'ng-model' => 'product.producer', :name => 'producer', 'ofn-track-product' => 'producer', 'ng-options' => 'producer.id as producer.name for producer in producers' }
+  %td.name{ 'ng-show' => 'columns.name.visible' }
+    %input{ 'ng-model' => "product.name", :name => 'product_name', 'ofn-track-product' => 'name', :type => 'text' }
+  %td.unit{ 'ng-show' => 'columns.unit.visible' }
+    %select.select2{ 'ng-model' => 'product.variant_unit_with_scale', :name => 'variant_unit_with_scale', 'ofn-track-product' => 'variant_unit_with_scale', 'ng-options' => 'unit[1] as unit[0] for unit in variant_unit_options' }
+      %option{'value' => '', 'ng-hide' => "hasVariants(product) && hasUnit(product)"}
+    %input{ 'ng-model' => 'product.master.unit_value_with_description', :name => 'master_unit_value_with_description', 'ofn-track-master' => 'unit_value_with_description', :type => 'text', :placeholder => 'value', 'ng-show' => "!hasVariants(product) && hasUnit(product)", 'ofn-maintain-unit-scale' => true }
+    %input{ 'ng-model' => 'product.variant_unit_name', :name => 'variant_unit_name', 'ofn-track-product' => 'variant_unit_name', :placeholder => 'unit', 'ng-show' => "product.variant_unit_with_scale == 'items'", :type => 'text' }
+  %td.display_as{ 'ng-show' => 'columns.unit.visible' }
+    %input{ 'ofn-display-as' => 'product.master', name: 'display_as', 'ofn-track-master' => 'display_as', type: 'text', placeholder: '{{ placeholder_text }}', ng: { hide: 'hasVariants(product)', model: 'product.master.display_as' } }
+  %td.price{ 'ng-show' => 'columns.price.visible' }
+    %input{ 'ng-model' => 'product.price', 'ofn-decimal' => :true, :name => 'price', 'ofn-track-product' => 'price', :type => 'text', 'ng-hide' => 'hasVariants(product)' }
+  %td.on_hand{ 'ng-show' => 'columns.on_hand.visible' }
+    %span{ 'ng-bind' => 'product.on_hand', :name => 'on_hand', 'ng-show' => '!hasOnDemandVariants(product) && (hasVariants(product) || product.on_demand)' }
+    %input.field{ 'ng-model' => 'product.on_hand', :name => 'on_hand', 'ofn-track-product' => 'on_hand', 'ng-hide' => 'hasVariants(product) || product.on_demand', :type => 'number' }
+  %td.category{ 'ng-if' => 'columns.category.visible' }
+    %input.fullwidth{ :type => 'text', id: "p{{product.id}}_category", 'ng-model' => 'product.category', 'ofn-taxon-autocomplete' => '', 'ofn-track-product' => 'category' }
+  %td.available_on{ 'ng-show' => 'columns.available_on.visible' }
+    %input{ 'ng-model' => 'product.available_on', :name => 'available_on', 'ofn-track-product' => 'available_on', 'datetimepicker' => 'product.available_on', type: "text" }
+  %td.actions
+    %a{ 'ng-click' => 'editWarn(product)', :class => "edit-product icon-edit no-text" }
+  %td.actions
+    %a{ 'ng-click' => 'cloneProduct(product)', :class => "clone-product icon-copy no-text" }
+  %td.actions
+    %a{ 'ng-click' => 'deleteProduct(product)', :class => "delete-product icon-trash no-text" }
diff --git a/app/views/spree/admin/products/bulk_edit/_products_variant.html.haml b/app/views/spree/admin/products/bulk_edit/_products_variant.html.haml
new file mode 100644
index 0000000000..6369da0d99
--- /dev/null
+++ b/app/views/spree/admin/products/bulk_edit/_products_variant.html.haml
@@ -0,0 +1,23 @@
+%tr.variant{ :id => "v_{{variant.id}}", 'ng-repeat' => 'variant in product.variants', 'ng-show' => 'displayProperties[product.id].showVariants', 'ng-class-even' => "'even'", 'ng-class-odd' => "'odd'" }
+  %td.left-actions
+    %a{ :class => "variant-item icon-caret-right", 'ng-hide' => "$last" }
+    %a{ :class => "add-variant icon-plus-sign", 'ng-click' => "addVariant(product)", 'ng-show' => "$last" }
+  %td{ 'ng-show' => 'columns.producer.visible' }
+  %td{ 'ng-show' => 'columns.name.visible' }
+    %input{ 'ng-model' => 'variant.display_name', :name => 'variant_display_name', 'ofn-track-variant' => 'display_name', :type => 'text', placeholder: "{{ product.name }}" }
+  %td.unit_value{ 'ng-show' => 'columns.unit.visible' }
+    %input{ 'ng-model' => 'variant.unit_value_with_description', :name => 'variant_unit_value_with_description', 'ofn-track-variant' => 'unit_value_with_description', :type => 'text', 'ofn-maintain-unit-scale' => true }
+  %td.display_as{ 'ng-show' => 'columns.unit.visible' }
+    %input{ 'ofn-display-as' => 'variant', 'ng-model' => 'variant.display_as', name: 'variant_display_as', 'ofn-track-variant' => 'display_as', type: 'text', placeholder: '{{ placeholder_text }}' }
+  %td{ 'ng-show' => 'columns.price.visible' }
+    %input{ 'ng-model' => 'variant.price', 'ofn-decimal' => :true, :name => 'variant_price', 'ofn-track-variant' => 'price', :type => 'text' }
+  %td{ 'ng-show' => 'columns.on_hand.visible' }
+    %input.field{ 'ng-model' => 'variant.on_hand', 'ng-change' => 'updateOnHand(product)', :name => 'variant_on_hand', 'ng-hide' => 'variant.on_demand', 'ofn-track-variant' => 'on_hand', :type => 'number' }
+    %span{ 'ng-bind' => 'variant.on_hand', :name => 'variant_on_hand', 'ng-show' => 'variant.on_demand' }
+  %td{ 'ng-show' => 'columns.category.visible' }
+  %td{ 'ng-show' => 'columns.available_on.visible' }
+  %td.actions
+    %a{ 'ng-click' => 'editWarn(product,variant)', :class => "edit-variant icon-edit no-text", 'ng-show' => "variantSaved(variant)" }
+  %td.actions
+  %td.actions
+    %a{ 'ng-click' => 'deleteVariant(product,variant)', :class => "delete-variant icon-trash no-text" }

From 99fb9c19669dd2ed792baa34222bdb5b87250000 Mon Sep 17 00:00:00 2001
From: summerscope <summerscope@gmail.com>
Date: Fri, 5 Sep 2014 15:09:44 +1000
Subject: [PATCH 19/19] Adding in markup and styling for new layout of hubs
 list view

---
 .../stylesheets/darkswarm/hub_node.css.sass   | 86 ++++++++++---------
 app/views/home/_skinny.html.haml              | 14 +--
 2 files changed, 54 insertions(+), 46 deletions(-)

diff --git a/app/assets/stylesheets/darkswarm/hub_node.css.sass b/app/assets/stylesheets/darkswarm/hub_node.css.sass
index 8906d2cfa2..d2a0de4383 100644
--- a/app/assets/stylesheets/darkswarm/hub_node.css.sass
+++ b/app/assets/stylesheets/darkswarm/hub_node.css.sass
@@ -10,23 +10,33 @@
       overflow-x: hidden
       overflow-y: visible
 
-    //Hub icon styline
+    //Generic text link style
+    a:hover, a:active, a:focus
+      color: $clr-brick-bright
+
+    //Hub and Producer icons
     // i.ofn-i_040-hub
-    i.ofn-i_063-hub
+    i.ofn-i_063-hub, i.ofn-i_064-hub-reversed, i.ofn-i_059-producer, i.ofn-i_060-producer-reversed
       font-size: 2rem
       display: inline-block
       margin-right: 0.25rem
       float: left
       @media all and (max-width: 768px) 
-        font-size: 1rem
+        // font-size: 1rem
     
-    //Generic text link style
-    a:hover, a:active, a:focus
-      color: $clr-brick-bright
+    //Closed & Open column
+    .open_closed
+      i
+        font-size: 2rem
+        float: right
+        margin-left: 0.5rem
 
-    .hub span.hub-name-listing
-      margin-top: 0.5rem
+    span.margin-top
+      margin-top: 0.5rem    
       display: inline-block
+
+    //Hub Name 
+    span.hub-name-listing
       float: left
       font-weight: 700
 
@@ -42,38 +52,35 @@
         &.closed, &.open
           .active_table_row:first-child .skinny-head
             background-color: white
-    
+      &.current
+        &.closed, &.open
+          .active_table_row:first-child .skinny-head
+            background-color: $clr-brick-bright
+      &.current
+        &.inactive
+          &.closed, &.open
+            .active_table_row:first-child .skinny-head
+              background-color: #555
+
     //Inactive row
     &.inactive, &.inactive strong
       color: $disabled-dark
-
       &, & *
         color: $disabled-dark
 
       a i.ofn-i_040-hub
         color: $disabled-dark
-
-      &.current
+    &.current
+      &.inactive
         &.closed, &.open
-          
-          a, a strong, a span, a i
-            color: $disabled-dark
-            &:hover, &:focus, &:active
-              color: $disabled-dark
-
-          a i.ofn-i_040-hub
-            color: white
+          .active_table_row:first-child
             background-color: $disabled-dark
-          a:hover, a:focus, a:active
-            color: $disabled-dark
-            i.ofn-i_040-hub
-              background-color: $disabled-dark
-      
+            &, & *
+              color: white
       &.closed
         &:hover, &:active, &:focus
           border: none
           color: $disabled-dark
-
       &.open
         .active_table_row:first-child
           color: $disabled-dark
@@ -86,7 +93,7 @@
         .active_table_row:nth-child(2)
           background-color: rgba(255, 255, 255, 0)
 
-    //Open row
+    //Padding second row
     &.open
       .active_table_row:nth-child(2)
         padding-bottom: 0.75rem
@@ -94,18 +101,19 @@
     //Current selected row
     &.current
       //overwrites active_table
-      &.closed
-        &, & *
-          color: white
-
       &.closed, &.open
-        div.active_table_row
+        .active_table_row:first-child
           background-color: $clr-brick
-        a:hover, a:focus, a:active
-          strong, span
-            color: $clr-brick-light
-
-
-
-
+          opacity: 1
+          &:hover, &:focus, &:active
+            opacity: 0.9
+          &, & *
+            color: white
+      &.open, &.closed
+        .active_table_row
+          border-color: $clr-brick
+      &.inactive
+        &.open, &.closed
+          .active_table_row
+            border-color: $disabled-dark
 
diff --git a/app/views/home/_skinny.html.haml b/app/views/home/_skinny.html.haml
index 36e3f7fc08..fa822e5358 100644
--- a/app/views/home/_skinny.html.haml
+++ b/app/views/home/_skinny.html.haml
@@ -3,21 +3,21 @@
     %a.hub{"bo-href" => "hub.path", "ng-class" => "{primary: hub.active, secondary: !hub.active}", "ofn-empties-cart" => "hub"}
       %i{ ng: { class: "{'ofn-i_063-hub': hub.can_aggregate, 'ofn-i_059-producer': !hub.can_aggregate}" } }
       / %i.ofn-i_063-hub
-      %span.hub-name-listing {{ hub.name | truncate:40}}
+      %span.margin-top.hub-name-listing {{ hub.name | truncate:40}}
   .columns.small-4.medium-2.large-2
-    {{ hub.address.city }}
+    %span.margin-top {{ hub.address.city }}
   .columns.small-2.medium-1.large-1
-    {{ hub.address.state_name | uppercase }}
+    %span.margin-top {{ hub.address.state_name | uppercase }}
 
   .columns.small-6.medium-3.large-4.text-right{"bo-if" => "hub.active"}
-    %a.hub{"bo-href" => "hub.path", "ng-class" => "{primary: hub.active, secondary: !hub.active}", "ofn-empties-cart" => "hub"}
+    %a.hub.open_closed{"bo-href" => "hub.path", "ng-class" => "{primary: hub.active, secondary: !hub.active}", "ofn-empties-cart" => "hub"}
       %i.ofn-i_033-open-sign
-      %span {{ hub.orders_close_at | sensible_timeframe }} 
+      %span.margin-top {{ hub.orders_close_at | sensible_timeframe }} 
 
   .columns.small-6.medium-3.large-4.text-right{"bo-if" => "!hub.active"}
-    %a.hub{"bo-href" => "hub.path", "ng-class" => "{primary: hub.active, secondary: !hub.active}", "ofn-empties-cart" => "hub"}
+    %a.hub.open_closed{"bo-href" => "hub.path", "ng-class" => "{primary: hub.active, secondary: !hub.active}", "ofn-empties-cart" => "hub"}
       %i.ofn-i_032-closed-sign
-      %span Orders closed
+      %span.margin-top Orders closed