coordinator of a simple order cycle has permission to add their own variants to outgoing exchanges

lib/open_food_network/permissions.rb

@@ -139,6 +139,12 @@ module OpenFoodNetwork
     def visible_variants_for_outgoing_exchanges_between(coordinator, hub, options={})
       return Spree::Variant.where("1=0") unless options[:order_cycle]
       if managed_enterprises.pluck(:id).include?(hub.id) || managed_enterprises.pluck(:id).include?(coordinator.id)
+        # Any variants produced by the coordinator, for outgoing exchanges with itself
+        coordinator_variants = []
+        if hub == coordinator
+          coordinator_variants = Spree::Variant.joins(:product).where('spree_products.supplier_id = (?)', coordinator)
+        end
+
         # Any variants of any producers that have granted the hub P-OC
         producers = granting(:add_to_order_cycle, to: [hub], scope: Enterprise.is_primary_producer)
         permitted_variants = Spree::Variant.joins(:product).where('spree_products.supplier_id IN (?)', producers)
@@ -150,7 +156,7 @@ module OpenFoodNetwork
           active_variants = exchange.variants
         end
 
-        Spree::Variant.where(id: permitted_variants | active_variants)
+        Spree::Variant.where(id: coordinator_variants | permitted_variants | active_variants)
       else
         # Any variants produced by MY PRODUCERS, where my producer has granted P-OC to the hub
         producers = granting(:add_to_order_cycle, to: [hub], scope: managed_enterprises.is_primary_producer)

spec/lib/open_food_network/permissions_spec.rb

@@ -376,6 +376,22 @@ module OpenFoodNetwork
             expect(visible).to_not include v2
           end
 
+          context "where the coordinator produces products" do
+            let!(:v3) { create(:variant, product: create(:simple_product, supplier: e1)) }
+
+            it "returns any variants produced by the coordinator itself for exchanges with 'self'" do
+              visible = permissions.visible_variants_for_outgoing_exchanges_between(e1, e1, order_cycle: oc)
+              expect(visible).to include v3
+              expect(visible).to_not include v1, v2
+            end
+
+            it "does not return coordinator's variants for exchanges with other hubs, when permission has not been granted" do
+              visible = permissions.visible_variants_for_outgoing_exchanges_between(e1, e2, order_cycle: oc)
+              expect(visible).to include v1
+              expect(visible).to_not include v2, v3
+            end
+          end
+
           # TODO: for backwards compatability, remove later
           context "when an exchange exists between the coordinator and the hub within this order cycle" do
             let!(:ex) { create(:exchange, order_cycle: oc, sender: e1, receiver: e2, incoming: false) }