From c28ebf63ab932bb79f5e4ac9669cb6fffc9a795c Mon Sep 17 00:00:00 2001 From: Rob Harrington Date: Thu, 9 Apr 2015 13:41:43 +1000 Subject: [PATCH] As participating Hub, I cannot edit incoming exchanges despite being granted P-OC by the producer --- lib/open_food_network/permissions.rb | 8 +++++++- .../lib/open_food_network/permissions_spec.rb | 20 +++---------------- 2 files changed, 10 insertions(+), 18 deletions(-) diff --git a/lib/open_food_network/permissions.rb b/lib/open_food_network/permissions.rb index 6a42dfcf93..9a98d7a750 100644 --- a/lib/open_food_network/permissions.rb +++ b/lib/open_food_network/permissions.rb @@ -152,7 +152,13 @@ module OpenFoodNetwork # Find the variants that a user can edit within incoming exchanges def editable_variants_for_incoming_exchanges_between(producer, coordinator, options={}) - visible_variants_for_incoming_exchanges_between(producer, coordinator, options) + return Spree::Variant.where("1=0") unless options[:order_cycle] + if managed_enterprises.pluck(:id).include?(producer.id) || managed_enterprises.pluck(:id).include?(coordinator.id) + # All variants belonging to the producer + Spree::Variant.joins(:product).where('spree_products.supplier_id = (?)', producer) + else + Spree::Variant.where("1=0") + end end # Find the variants that a user is permitted see within outgoing exchanges diff --git a/spec/lib/open_food_network/permissions_spec.rb b/spec/lib/open_food_network/permissions_spec.rb index 6da2c87215..ddbdd5a359 100644 --- a/spec/lib/open_food_network/permissions_spec.rb +++ b/spec/lib/open_food_network/permissions_spec.rb @@ -756,23 +756,9 @@ module OpenFoodNetwork create(:enterprise_relationship, parent: producer1, child: e2, permissions_list: [:add_to_order_cycle]) end - context "where the hub is in the order cycle" do - let!(:ex) { create(:exchange, order_cycle: oc, sender: e1, receiver: e2, incoming: false) } - - it "returns variants produced by that producer only" do - visible = permissions.visible_variants_for_incoming_exchanges_between(producer1, e1, order_cycle: oc) - expect(visible).to include v1 - expect(visible).to_not include v2 - end - end - - context "where the hub is not in the order cycle" do - # No outgoing exchange - - it "does not return variants produced by that producer" do - visible = permissions.visible_variants_for_incoming_exchanges_between(producer1, e1, order_cycle: oc) - expect(visible).to_not include v1, v2 - end + it "does not return variants produced by that producer" do + visible = permissions.editable_variants_for_incoming_exchanges_between(producer1, e1, order_cycle: oc) + expect(visible).to_not include v1, v2 end end end