On customer reports, do not show orders through a hub that the current user does not manage

lib/open_food_network/customers_report.rb

@@ -38,7 +38,7 @@ module OpenFoodNetwork
     end
 
     def orders
-      filter Spree::Order.managed_by(@user).complete.not_state(:canceled)
+      filter Spree::Order.managed_by(@user).distributed_by_user(@user).complete.not_state(:canceled)
     end
 
     def filter(orders)

spec/lib/open_food_network/customers_report_spec.rb

@@ -84,6 +84,10 @@ module OpenFoodNetwork
       subject { CustomersReport.new user }
 
       describe "fetching orders" do
+        let(:supplier) { create(:supplier_enterprise) }
+        let(:product) { create(:simple_product, supplier: supplier) }
+        let(:order) { create(:order, completed_at: 1.day.ago) }
+
         it "only shows orders managed by the current user" do
           d1 = create(:distributor_enterprise)
           d1.enterprise_roles.build(user: user).save
@@ -96,6 +100,16 @@ module OpenFoodNetwork
           subject.should_receive(:filter).with([o1]).and_return([o1])
           subject.orders.should == [o1]
         end
+
+        it "does not show orders through a hub that the current user does not manage" do
+          # Given a supplier enterprise with an order for one of its products
+          supplier.enterprise_roles.build(user: user).save
+          order.line_items << create(:line_item, product: product)
+
+          # When I fetch orders, I should see no orders
+          subject.should_receive(:filter).with([]).and_return([])
+          subject.orders.should == []
+        end
       end
 
       describe "filtering orders" do