raggedstaff/openfoodnetwork
1
0
Fork 0
mirror of https://github.com/openfoodfoundation/openfoodnetwork synced 2026-01-24 20:36:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

As participating Hub, I cannot edit incoming exchanges despite being granted P-OC by the producer

Browse Source
This commit is contained in:
Rob Harrington
2015-04-09 13:41:43 +10:00
parent 69004ac477
commit c28ebf63ab
2 changed files with 10 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
lib/open_food_network/permissions.rb
View File

@@ -152,7 +152,13 @@ module OpenFoodNetwork
# Find the variants that a user can edit within incoming exchanges
def editable_variants_for_incoming_exchanges_between(producer, coordinator, options={})
visible_variants_for_incoming_exchanges_between(producer, coordinator, options)
return Spree::Variant.where("1=0") unless options[:order_cycle]
if managed_enterprises.pluck(:id).include?(producer.id) || managed_enterprises.pluck(:id).include?(coordinator.id)
# All variants belonging to the producer
Spree::Variant.joins(:product).where('spree_products.supplier_id = (?)', producer)
else
Spree::Variant.where("1=0")
end
end
# Find the variants that a user is permitted see within outgoing exchanges

20
spec/lib/open_food_network/permissions_spec.rb
View File

@@ -756,23 +756,9 @@ module OpenFoodNetwork
create(:enterprise_relationship, parent: producer1, child: e2, permissions_list: [:add_to_order_cycle])
end
context "where the hub is in the order cycle" do
let!(:ex) { create(:exchange, order_cycle: oc, sender: e1, receiver: e2, incoming: false) }
it "returns variants produced by that producer only" do
visible = permissions.visible_variants_for_incoming_exchanges_between(producer1, e1, order_cycle: oc)
expect(visible).to include v1
expect(visible).to_not include v2
end
end
context "where the hub is not in the order cycle" do
# No outgoing exchange
it "does not return variants produced by that producer" do
visible = permissions.visible_variants_for_incoming_exchanges_between(producer1, e1, order_cycle: oc)
expect(visible).to_not include v1, v2
end
it "does not return variants produced by that producer" do
visible = permissions.editable_variants_for_incoming_exchanges_between(producer1, e1, order_cycle: oc)
expect(visible).to_not include v1, v2
end
end
end