Create new variant overrides

app/assets/javascripts/admin/services/status_message.js.coffee

@@ -2,9 +2,9 @@ angular.module("ofn.admin").factory "StatusMessage", ($timeout) ->
   new class StatusMessage
     types:
       progress: {timeout: false, style: {color: '#ff9906'}}
-      alert:    {timeout: 3000,  style: {color: 'grey'}}
+      alert:    {timeout: 5000,  style: {color: 'grey'}}
       notice:   {timeout: false, style: {color: 'grey'}}
-      success:  {timeout: 3000,  style: {color: '#9fc820'}}
+      success:  {timeout: 5000,  style: {color: '#9fc820'}}
       failure:  {timeout: false, style: {color: '#da5354'}}
 
     statusMessage:

app/controllers/admin/variant_overrides_controller.rb

@@ -13,5 +13,28 @@ module Admin
         order_cycle_enterprises_per_hub
       @variant_overrides = VariantOverride.for_hubs(@hubs)
     end
+
+
+    def bulk_update
+      collection_hash = Hash[params[:variant_overrides].each_with_index.map { |vo, i| [i, vo] }]
+      vo_set = VariantOverrideSet.new collection_attributes: collection_hash
+
+      # Ensure we're authorised to update all variant overrides
+      vo_set.collection.each { |vo| authorize! :update, vo }
+
+      if vo_set.save
+        render json: {}
+      else
+        if vo_set.errors.present?
+          render json: { errors: vo_set.errors }, status: 400
+        else
+          render nothing: true, status: 500
+        end
+      end
+    end
+
+
+    def collection
+    end
   end
 end

app/models/spree/ability_decorator.rb

@@ -74,7 +74,11 @@ class AbilityDecorator
       OpenFoodNetwork::Permissions.new(user).managed_product_enterprises.include? variant.product.supplier
     end
 
-    can [:admin, :index], VariantOverride
+    can [:admin, :index, :read, :update, :bulk_update], VariantOverride do |vo|
+      OpenFoodNetwork::Permissions.new(user).
+        order_cycle_enterprises.is_distributor.
+        include? vo.hub
+    end
 
     can [:admin, :index, :read, :create, :edit, :update_positions, :destroy], Spree::ProductProperty
     can [:admin, :index, :read, :create, :edit, :update, :destroy], Spree::Image

app/models/variant_override_set.rb

@@ -0,0 +1,5 @@
+class VariantOverrideSet < ModelSet
+  def initialize(attributes={})
+    super(VariantOverride, VariantOverride.all, nil, attributes)
+  end
+end

config/routes.rb

@@ -69,7 +69,9 @@ Openfoodnetwork::Application.routes.draw do
       get :move_down
     end
 
-    resources :variant_overrides
+    resources :variant_overrides do
+      post :bulk_update, on: :collection
+    end
   end
 
   namespace :api do

spec/features/admin/variant_overrides_spec.rb

@@ -67,6 +67,23 @@ feature %q{
           page.should_not have_content producer2.name
           page.should_not have_content product2.name
         end
+
+        it "creates new overrides" do
+          fill_in "variant-overrides-#{variant.id}-price", with: '777.77'
+          fill_in "variant-overrides-#{variant.id}-count-on-hand", with: '123'
+          page.should have_content "Changes to one override remain unsaved."
+
+          expect do
+            click_button 'Save Changes'
+            page.should have_content "Changes saved."
+          end.to change(VariantOverride, :count).by(1)
+
+          vo = VariantOverride.last
+          vo.variant_id.should == variant.id
+          vo.hub_id.should == hub.id
+          vo.price.should == 777.77
+          vo.count_on_hand.should == 123
+        end
       end
 
       context "with overrides" do

spec/models/spree/ability_spec.rb

@@ -155,10 +155,6 @@ module Spree
           should_not have_ability([:admin, :index, :read, :edit, :update, :search, :destroy], for: p2.master)
         end
 
-        it "should be able to read/write variant overrides" do
-          should have_ability([:admin, :index], for: VariantOverride)
-        end
-
         it "should not be able to access admin actions on orders" do
           should_not have_ability([:admin], for: Spree::Order)
         end
@@ -243,6 +239,23 @@ module Spree
           o
         end
 
+        let(:vo1) { create(:variant_override, hub: d1, variant: p1.master) }
+        let(:vo2) { create(:variant_override, hub: d2, variant: p2.master) }
+
+        describe "variant overrides" do
+          it "should be able to access variant overrides page" do
+            should have_ability([:admin, :index, :bulk_update], for: VariantOverride)
+          end
+
+          it "should be able to read/write their own variant overrides" do
+            should have_ability([:admin, :index, :read, :update], for: vo1)
+          end
+
+          it "should not be able to read/write other enterprises' variant overrides" do
+            should_not have_ability([:admin, :index, :read, :update], for: vo2)
+          end
+        end
+
         it "should be able to read/write their enterprises' orders" do
           should have_ability([:admin, :index, :read, :edit], for: o1)
         end