Fix bug: When there are variant overrides not owned by the current user, user is unable to make any changes to VOs

app/controllers/admin/variant_overrides_controller.rb

@@ -6,23 +6,15 @@ module Admin
     include OpenFoodNetwork::SpreeApiKeyLoader
 
     before_filter :load_spree_api_key, only: :index
+    before_filter :load_data
 
     def index
-      @hubs = order_cycle_hub_enterprises
-
-      # Used in JS to look up the name of the producer of each product
-      @producers = OpenFoodNetwork::Permissions.new(spree_current_user).
-        variant_override_producers
-
-      @hub_permissions = OpenFoodNetwork::Permissions.new(spree_current_user).
-        variant_override_enterprises_per_hub
-      @variant_overrides = VariantOverride.for_hubs(@hubs)
     end
 
 
     def bulk_update
       collection_hash = Hash[params[:variant_overrides].each_with_index.map { |vo, i| [i, vo] }]
-      vo_set = VariantOverrideSet.new collection_attributes: collection_hash
+      vo_set = VariantOverrideSet.new @variant_overrides, collection_attributes: collection_hash
 
       # Ensure we're authorised to update all variant overrides
       vo_set.collection.each { |vo| authorize! :update, vo }
@@ -40,6 +32,20 @@ module Admin
     end
 
 
+    private
+
+    def load_data
+      @hubs = order_cycle_hub_enterprises
+
+      # Used in JS to look up the name of the producer of each product
+      @producers = OpenFoodNetwork::Permissions.new(spree_current_user).
+        variant_override_producers
+
+      @hub_permissions = OpenFoodNetwork::Permissions.new(spree_current_user).
+        variant_override_enterprises_per_hub
+      @variant_overrides = VariantOverride.for_hubs(@hubs)
+    end
+
     def collection
     end
   end

app/models/variant_override_set.rb

@@ -1,6 +1,6 @@
 class VariantOverrideSet < ModelSet
-  def initialize(attributes={})
-    super(VariantOverride, VariantOverride.all, attributes, nil,
+  def initialize(collection, attributes={})
+    super(VariantOverride, collection, attributes, nil,
           proc { |attrs| attrs['price'].blank? && attrs['count_on_hand'].blank? } )
   end
 end

spec/features/admin/variant_overrides_spec.rb

@@ -11,6 +11,7 @@ feature %q{
 
   let!(:hub) { create(:distributor_enterprise) }
   let!(:hub2) { create(:distributor_enterprise) }
+  let!(:hub3) { create(:distributor_enterprise) }
   let!(:producer) { create(:supplier_enterprise) }
   let!(:er1) { create(:enterprise_relationship, parent: hub, child: producer,
                       permissions_list: [:add_to_order_cycle]) }
@@ -156,6 +157,7 @@ feature %q{
 
       context "with overrides" do
         let!(:vo) { create(:variant_override, variant: variant, hub: hub, price: 77.77, count_on_hand: 11111) }
+        let!(:vo_no_auth) { create(:variant_override, variant: variant, hub: hub3, price: 1, count_on_hand: 2) }
 
         before do
           visit '/admin/variant_overrides'