Adding controller action and route for cancelling a standing order

app/controllers/admin/standing_orders_controller.rb

@@ -42,6 +42,14 @@ module Admin
       end
     end
 
+    def cancel
+      @standing_order.cancel
+
+      respond_with(@standing_order) do |format|
+        format.json { render_as_json @standing_order, fee_calculator: fee_calculator }
+      end
+    end
+
     private
 
     def permissions

app/models/spree/ability_decorator.rb

@@ -253,7 +253,7 @@ class AbilityDecorator
     can [:create], Customer
     can [:admin, :index, :update, :destroy], Customer, enterprise_id: Enterprise.managed_by(user).pluck(:id)
     can [:admin, :new, :index], StandingOrder
-    can [:create, :edit, :update], StandingOrder do |standing_order|
+    can [:create, :edit, :update, :cancel], StandingOrder do |standing_order|
       user.enterprises.include?(standing_order.shop)
     end
     can [:admin, :build], StandingLineItem

app/serializers/api/admin/standing_order_serializer.rb

@@ -1,6 +1,6 @@
 class Api::Admin::StandingOrderSerializer < ActiveModel::Serializer
   attributes :id, :shop_id, :customer_id, :schedule_id, :payment_method_id, :shipping_method_id, :begins_at, :ends_at
-  attributes :customer_email, :schedule_name, :edit_path
+  attributes :customer_email, :schedule_name, :edit_path, :canceled_at
 
   has_many :standing_line_items, serializer: Api::Admin::StandingLineItemSerializer
   has_many :closed_standing_order_orders, serializer: Api::Admin::StandingOrderOrderSerializer
@@ -16,6 +16,10 @@ class Api::Admin::StandingOrderSerializer < ActiveModel::Serializer
     object.ends_at.andand.strftime('%F')
   end
 
+  def canceled_at
+    object.canceled_at.andand.strftime('%F')
+  end
+
   def customer_email
     object.customer.andand.email
   end

config/routes.rb

@@ -177,7 +177,9 @@ Openfoodnetwork::Application.routes.draw do
 
     resources :schedules, only: [:index, :create, :update, :destroy], format: :json
 
-    resources :standing_orders, only: [:index, :new, :create, :edit, :update]
+    resources :standing_orders, only: [:index, :new, :create, :edit, :update] do
+      put :cancel, on: :member
+    end
 
     resources :standing_line_items, only: [], format: :json do
       post :build, on: :collection

spec/controllers/admin/standing_orders_controller_spec.rb

@@ -372,4 +372,52 @@ describe Admin::StandingOrdersController, type: :controller do
       end
     end
   end
+
+  describe 'cancel' do
+    let!(:user) { create(:user, enterprise_limit: 10) }
+    let!(:shop) { create(:distributor_enterprise) }
+    let!(:order_cycle) { create(:simple_order_cycle, orders_close_at: 1.day.from_now) }
+    let!(:order) { create(:order, order_cycle: order_cycle) }
+    let!(:standing_order) { create(:standing_order_with_items, shop: shop, orders: [order]) }
+    let!(:standing_order_order) { standing_order.standing_order_orders.first }
+
+    before do
+      allow(controller).to receive(:spree_current_user) { user }
+    end
+
+    context 'json' do
+      let(:params) { { format: :json, id: standing_order.id } }
+
+      context 'as a regular user' do
+        it 'redirects to unauthorized' do
+          spree_put :cancel, params
+          expect(response).to redirect_to spree.unauthorized_path
+        end
+      end
+
+      context 'as an enterprise user' do
+        context "without authorisation" do
+          let!(:shop2) { create(:distributor_enterprise) }
+          before { shop2.update_attributes(owner: user) }
+
+          it 'redirects to unauthorized' do
+            spree_put :cancel, params
+            expect(response).to redirect_to spree.unauthorized_path
+          end
+        end
+
+        context "with authorisation" do
+          before { shop.update_attributes(owner: user) }
+
+          it 'renders the cancelled standing_order as json' do
+            spree_get :cancel, params
+            json_response = JSON.parse(response.body)
+            expect(json_response['canceled_at']).to_not be nil
+            expect(json_response['id']).to eq standing_order.id
+            expect(standing_order.reload.canceled_at).to be_within(5.seconds).of Time.now
+          end
+        end
+      end
+    end
+  end
 end