From f9c0edf4b92255cb109b72836d99a9ee016898d9 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Wed, 9 Aug 2017 18:21:25 +0200
Subject: [PATCH 001/353] Always execute local karma

This ensure the dev will run the version specified in the package.json.
Besides, makes the rake task work as all rails tests, allowing you to
pass a RAILS_ENV.
---
 lib/tasks/karma.rake | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/lib/tasks/karma.rake b/lib/tasks/karma.rake
index 3755dacc63..7cc245cfa4 100644
--- a/lib/tasks/karma.rake
+++ b/lib/tasks/karma.rake
@@ -1,28 +1,22 @@
+ENV["RAILS_ENV"] ||= 'test'
+
 namespace :karma  do
-  task :start => :environment do |task|
-    continue_only_in_test_env task
+  task :start => :environment do |_task|
     with_tmp_config :start
   end
 
-  task :run => :environment do |task|
-    continue_only_in_test_env task
+  task :run => :environment do |_task|
     with_tmp_config :start, "--single-run"
   end
 
   private
 
-  def continue_only_in_test_env task
-    if Rails.env != 'test'
-      raise "Task must be called in test environment:\n  bundle exec rake #{task.name} RAILS_ENV=test"
-    end
-  end
-
   def with_tmp_config(command, args = nil)
     Tempfile.open('karma_unit.js', Rails.root.join('tmp') ) do |f|
       f.write unit_js(application_spec_files << i18n_file)
       f.flush
       trap('SIGINT') { puts "Killing Karma"; exit }
-      exec "karma #{command} #{f.path} #{args}"
+      exec "node_modules/.bin/karma #{command} #{f.path} #{args}"
     end
   end
 

From 1b151ee015e401313c5fb6502ccc8ff00ece0a07 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Fri, 1 Sep 2017 14:57:16 +0200
Subject: [PATCH 002/353] Add missing translations in registration wizard

---
 app/views/registration/steps/_contact.html.haml | 6 +++---
 config/locales/en.yml                           | 4 ++++
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/app/views/registration/steps/_contact.html.haml b/app/views/registration/steps/_contact.html.haml
index 3b7d43ae72..169e98cc85 100644
--- a/app/views/registration/steps/_contact.html.haml
+++ b/app/views/registration/steps/_contact.html.haml
@@ -13,17 +13,17 @@
           .row
             .small-12.columns.field
               %label{ for: 'enterprise_contact' } {{'enterprise_contact' | t}}:
-              %input.chunky.small-12.columns{ id: 'enterprise_contact', name: 'contact', required: true, placeholder: "Contact Name", ng: { model: 'enterprise.contact' } }
+              %input.chunky.small-12.columns{ id: 'enterprise_contact', name: 'contact', required: true, placeholder: t(:enterprise_contact_placeholder), ng: { model: 'enterprise.contact' } }
               %span.error.small-12.columns{ ng: { show: "contact.contact.$error.required && submitted" } }
                 {{'enterprise_contact_required' | t}}
           .row
             .small-12.columns.field
               %label{ for: 'enterprise_email_address' } {{'enterprise_email_address' | t}}:
-              %input.chunky.small-12.columns{ id: 'enterprise_email_address', name: 'email_address', type: 'email', placeholder: "eg. charlie@thefarm.com", ng: { model: 'enterprise.email_address' } }
+              %input.chunky.small-12.columns{ id: 'enterprise_email_address', name: 'email_address', type: 'email', placeholder: t(:enterprise_email_placeholder), ng: { model: 'enterprise.email_address' } }
           .row
             .small-12.columns.field
               %label{ for: 'enterprise_phone' } {{'enterprise_phone' | t}}:
-              %input.chunky.small-12.columns{ id: 'enterprise_phone', name: 'phone', placeholder: "eg. (03) 1234 5678", ng: { model: 'enterprise.phone' } }
+              %input.chunky.small-12.columns{ id: 'enterprise_phone', name: 'phone', placeholder: t(:enterprise_phone_placeholder), ng: { model: 'enterprise.phone' } }
         .small-12.medium-12.large-5.hide-for-small-only
 
       .row.buttons
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 8ce260fb77..af7953a339 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -1312,9 +1312,12 @@ See the %{link} to find out more about %{sitename}'s features and to start using
   registration_greeting: "Greetings!"
   who_is_managing_enterprise: "Who is responsible for managing %{enterprise}?"
   enterprise_contact: "Primary Contact"
+  enterprise_contact_placeholder: "Contact Name"
   enterprise_contact_required: "You need to enter a primary contact."
   enterprise_email_address: "Email address"
+  enterprise_email_placeholder: "eg. charlie@thefarm.com"
   enterprise_phone: "Phone number"
+  enterprise_phone_placeholder: "eg. (03) 1234 5678"
   back: "Back"
   continue: "Continue"
   limit_reached_headline: "Oh no!"
@@ -1385,6 +1388,7 @@ See the %{link} to find out more about %{sitename}'s features and to start using
   registration_finished_activate_instruction_html: "We've sent a confirmation email to <strong>%{email}</strong> if it hasn't been activated before.<br/>
 Please follow the instructions there to make your enterprise visible on the Open Food Network."
   registration_finished_action: "Open Food Network home"
+  registration_contact_name: 'Contact Name'
   registration_type_headline: "Last step to add %{enterprise}!"
   registration_type_question: "Are you a producer?"
   registration_type_producer: "Yes, I'm a producer"

From 90d1d5400ac3a71f420da0fa188890609677a6d8 Mon Sep 17 00:00:00 2001
From: Leandro C <leandro.costantini@gmail.com>
Date: Sat, 2 Sep 2017 20:07:59 +0100
Subject: [PATCH 003/353] Fix i18n translation keys for New Product Page

---
 .../admin/products/new/replace_form.html.haml.deface |  6 +++---
 app/views/spree/admin/products/_display_as.html.haml |  4 ++--
 .../admin/products/_primary_taxon_form.html.haml     |  2 +-
 config/locales/en.yml                                | 12 +++++++++++-
 4 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/app/overrides/spree/admin/products/new/replace_form.html.haml.deface b/app/overrides/spree/admin/products/new/replace_form.html.haml.deface
index e9dc6f13c5..efcd0f1d3d 100644
--- a/app/overrides/spree/admin/products/new/replace_form.html.haml.deface
+++ b/app/overrides/spree/admin/products/new/replace_form.html.haml.deface
@@ -19,14 +19,14 @@
     .twelve.columns.alpha{ 'ng-controller' => 'unitsCtrl' }
       .six.columns.alpha
         = f.field_container :units do
-          = f.label :variant_unit_with_scale, :units
+          = f.label :variant_unit_with_scale, t(:units)
           %select.select2.fullwidth{ id: 'product_variant_unit_with_scale', 'ng-model' => 'product.variant_unit_with_scale', 'ng-options' => 'unit[1] as unit[0] for unit in variant_unit_options' }
             %option{'value' => '', 'ng-hide' => "hasUnit(product)"}
           %input{ type: 'hidden', 'ng-value' => 'product.variant_unit', name: 'product[variant_unit]' }
           %input{ type: 'hidden', 'ng-value' => 'product.variant_unit_scale', name: 'product[variant_unit_scale]' }
       .three.columns
         = f.field_container :unit_value do
-          = f.label :product_unit_value_with_description, :value, 'ng-disabled' => "!hasUnit(product)"
+          = f.label :product_unit_value_with_description, t(:value), 'ng-disabled' => "!hasUnit(product)"
           %input.fullwidth{ id: 'product_unit_value_with_description', 'ng-model' => 'product.master.unit_value_with_description', :type => 'text', placeholder: "eg. 2", 'ng-disabled' => "!hasUnit(product)" }
           %input{ type: 'hidden', 'ng-value' => 'product.master.unit_value', name: 'product[unit_value]' }
           %input{ type: 'hidden', 'ng-value' => 'product.master.unit_description', name: 'product[unit_description]' }
@@ -87,7 +87,7 @@
     = button t('actions.create'), 'icon-ok', :submit, value: "create"
     %span.or
       = t(:or)
-    = button "Create And Add Another", 'icon-repeat', :submit, value: 'add_another'
+    = button t('actions.create_and_add_another'), 'icon-repeat', :submit, value: 'add_another'
     %span.or
       = t(:or)
     = link_to_with_icon 'icon-remove', t('actions.cancel'), bulk_edit_admin_products_path, :class => 'button'
diff --git a/app/views/spree/admin/products/_display_as.html.haml b/app/views/spree/admin/products/_display_as.html.haml
index 33beec2b86..04af12bdce 100644
--- a/app/views/spree/admin/products/_display_as.html.haml
+++ b/app/views/spree/admin/products/_display_as.html.haml
@@ -1,4 +1,4 @@
 .three.columns.omega{ "ng-if" => "product.variant_unit_with_scale != 'items'" }
   = f.field_container :display_as do
-    = f.label :product_display_as, t(:display_as)
-    %input#product_display_as.fullwidth{name: "product[display_as]", placeholder: "{{ placeholder_text }}", type: "text"}
\ No newline at end of file
+    = f.label :product_display_as, t('.display_as')
+    %input#product_display_as.fullwidth{name: "product[display_as]", placeholder: "{{ placeholder_text }}", type: "text"}
diff --git a/app/views/spree/admin/products/_primary_taxon_form.html.haml b/app/views/spree/admin/products/_primary_taxon_form.html.haml
index 8ffe5887a7..51da47f0f4 100644
--- a/app/views/spree/admin/products/_primary_taxon_form.html.haml
+++ b/app/views/spree/admin/products/_primary_taxon_form.html.haml
@@ -1,5 +1,5 @@
 = f.field_container :primary_taxon_id do
-  = f.label :primary_taxon_id, t(:product_category)
+  = f.label :primary_taxon_id, t('.product_category')
   %span.required *
   %br
   = f.collection_select(:primary_taxon_id, Spree::Taxon.all, :id, :name, {:include_blank => true}, {:class => "select2 fullwidth"})
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 8ce260fb77..0f3cc3aeb0 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -161,7 +161,8 @@ en:
   powered_by: Powered by
   blocked_cookies_alert: "Your browser may be blocking cookies needed to use this shopfront. Click below to allow cookies and reload the page."
   allow_cookies: "Allow Cookies"
-
+  actions:
+      create_and_add_another: "Create and Add Another"
   admin:
     # Common properties / models
     date: Date
@@ -1484,6 +1485,9 @@ Please follow the instructions there to make your enterprise visible on the Open
   create: "Create"
   search: "Search"
   supplier: "Supplier"
+  product_name: "Product Name"
+  product_description: "Product Description"
+  units: "Unit Size"
   coordinator: "Coordinator"
   distributor: "Distributor"
   enterprise_fees: "Enterprise Fees"
@@ -2037,6 +2041,7 @@ Please follow the instructions there to make your enterprise visible on the Open
             other: "You have %{count} active order cycles."
           manage_order_cycles: "MANAGE ORDER CYCLES"
       products:
+        unit_name_placeholder: 'eg. bunches'
         bulk_edit:
           header:
             title: Bulk Edit Products
@@ -2044,6 +2049,11 @@ Please follow the instructions there to make your enterprise visible on the Open
             title: LOADING PRODUCTS
             no_products: "No products yet. Why don't you add some?"
             no_results: "Sorry, no results match"
+          product_name: Product Name
+        primary_taxon_form:
+          product_category: Product Category
+        display_as:
+          display_as: Display As
       reports:
         bulk_coop:
           bulk_coop_supplier_report: 'Bulk Co-op - Totals by Supplier'

From 942ab55ddce2001d48f0f86251d0738f3917e8ec Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Thu, 7 Sep 2017 15:59:07 +0200
Subject: [PATCH 004/353] Disable create profile from signup when submitting

This prevents people re-submitting the form multiple times. Although the
backend validates it, we show an ugly alert message that is hard for
users to understand.
---
 .../registration_form_controller.js.coffee             | 10 +++++++++-
 .../services/enterprise_registration_service.js.coffee |  5 ++++-
 app/views/registration/steps/_type.html.haml           |  2 +-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/controllers/registration/registration_form_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/registration/registration_form_controller.js.coffee
index fabc2c382a..546186f53d 100644
--- a/app/assets/javascripts/darkswarm/controllers/registration/registration_form_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/registration/registration_form_controller.js.coffee
@@ -1,15 +1,23 @@
 Darkswarm.controller "RegistrationFormCtrl", ($scope, RegistrationService, EnterpriseRegistrationService) ->
   $scope.submitted = false
+  $scope.isDisabled = false
 
   $scope.valid = (form) ->
     $scope.submitted = !form.$valid
     form.$valid
 
   $scope.create = (form) ->
-    EnterpriseRegistrationService.create() if $scope.valid(form)
+    $scope.disableButton()
+    EnterpriseRegistrationService.create($scope.enableButton) if $scope.valid(form)
 
   $scope.update = (nextStep, form) ->
     EnterpriseRegistrationService.update(nextStep) if $scope.valid(form)
 
   $scope.selectIfValid = (nextStep, form) ->
     RegistrationService.select(nextStep) if $scope.valid(form)
+
+  $scope.disableButton = ->
+    $scope.isDisabled = true
+
+  $scope.enableButton = ->
+    $scope.isDisabled = false
diff --git a/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee b/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee
index 1434ffa44f..de8d643711 100644
--- a/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee
@@ -11,7 +11,7 @@ Darkswarm.factory "EnterpriseRegistrationService", ($http, RegistrationService,
       for key, value of enterpriseAttributes
         @enterprise[key] = value
 
-    create: =>
+    create: (callback) =>
       Loading.message = t('creating') + " " + @enterprise.name
       $http(
         method: "POST"
@@ -25,6 +25,7 @@ Darkswarm.factory "EnterpriseRegistrationService", ($http, RegistrationService,
         @enterprise.id = data
         EnterpriseImageService.configure(@enterprise)
         RegistrationService.select('about')
+        callback.call()
       ).error((data) =>
         Loading.clear()
         if data?.errors?
@@ -32,6 +33,8 @@ Darkswarm.factory "EnterpriseRegistrationService", ($http, RegistrationService,
           alert t('failed_to_create_enterprise') + "\n" + errors.join('\n')
         else
           alert(t('failed_to_create_enterprise_unknown'))
+
+        callback.call()
       )
 
     update: (step) =>
diff --git a/app/views/registration/steps/_type.html.haml b/app/views/registration/steps/_type.html.haml
index 4c93c441f4..5fcf6391b9 100644
--- a/app/views/registration/steps/_type.html.haml
+++ b/app/views/registration/steps/_type.html.haml
@@ -45,4 +45,4 @@
       .row.buttons
         .small-12.columns
           %input.button.secondary{ type: "button", value: "{{'back' | t}}", ng: { click: "select('contact')" } }
-          %input.button.primary.right{ type: "submit", value: "{{'create_profile' | t}}" }
+          %input.button.primary.right{ ng: { disabled: 'isDisabled' }, type: "submit", value: "{{'create_profile' | t}}" }

From d3d4628e297f8685ebe8178dfdc2cea1f68dcd2b Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Fri, 8 Sep 2017 09:51:06 +0200
Subject: [PATCH 005/353] Add doc

---
 .../services/enterprise_registration_service.js.coffee        | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee b/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee
index de8d643711..7e81d53d70 100644
--- a/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee
@@ -11,6 +11,10 @@ Darkswarm.factory "EnterpriseRegistrationService", ($http, RegistrationService,
       for key, value of enterpriseAttributes
         @enterprise[key] = value
 
+    # Creates the enterprise and redirects to the about step on success.
+    #
+    # @param callback [Function] executed at the end of the operation both in
+    #   case of success or failure.
     create: (callback) =>
       Loading.message = t('creating') + " " + @enterprise.name
       $http(

From c70de9f73c23f74c5db243c44d4b645a8ba86b5c Mon Sep 17 00:00:00 2001
From: leandroalemao <leandro.costantini@gmail.com>
Date: Wed, 6 Sep 2017 18:32:33 +0100
Subject: [PATCH 006/353] Fix i18n translation keys for Edit Product Page

---
 .../products/_form/add_supplier.html.haml.deface     |  2 +-
 .../products/_form/add_units_form.html.haml.deface   |  2 +-
 .../spree/admin/products/_group_buy_form.html.haml   | 12 ++++++------
 .../admin/products/_tax_category_form.html.haml      |  2 +-
 config/locales/en.yml                                | 10 +++++++++-
 spec/features/admin/products_spec.rb                 |  2 +-
 6 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/app/overrides/spree/admin/products/_form/add_supplier.html.haml.deface b/app/overrides/spree/admin/products/_form/add_supplier.html.haml.deface
index 1cc609bef4..deba9ff633 100644
--- a/app/overrides/spree/admin/products/_form/add_supplier.html.haml.deface
+++ b/app/overrides/spree/admin/products/_form/add_supplier.html.haml.deface
@@ -1,7 +1,7 @@
 / insert_top "[data-hook='admin_product_form_right']"
 
 = f.field_container :supplier do
-  = f.label :supplier
+  = f.label :supplier, t(:spree_admin_supplier)
   %br
   = f.collection_select(:supplier_id, @producers, :id, :name, {:include_blank => true}, {:class => "select2"})
   = f.error_message_on :supplier
diff --git a/app/overrides/spree/admin/products/_form/add_units_form.html.haml.deface b/app/overrides/spree/admin/products/_form/add_units_form.html.haml.deface
index d20afcca61..6571fb3ab6 100644
--- a/app/overrides/spree/admin/products/_form/add_units_form.html.haml.deface
+++ b/app/overrides/spree/admin/products/_form/add_units_form.html.haml.deface
@@ -3,7 +3,7 @@
 .variant_units_form{ 'ng-app' => 'admin.products', 'ng-controller' => 'editUnitsCtrl' }
 
   = f.field_container :units do
-    = f.label :variant_unit_with_scale, :units
+    = f.label :variant_unit_with_scale, t(:spree_admin_variant_unit_scale)
     %select.select2.fullwidth{ id: 'product_variant_unit_with_scale', 'ng-model' => 'variant_unit_with_scale', 'ng-change' => 'setFields()', 'ng-options' => 'unit[1] as unit[0] for unit in variant_unit_options' }
       %option{'value' => ''}
 
diff --git a/app/views/spree/admin/products/_group_buy_form.html.haml b/app/views/spree/admin/products/_group_buy_form.html.haml
index 8f1de2a884..f61fc7b38d 100644
--- a/app/views/spree/admin/products/_group_buy_form.html.haml
+++ b/app/views/spree/admin/products/_group_buy_form.html.haml
@@ -1,14 +1,14 @@
 = f.field_container :group_buy do
-  = f.label :group_buy, 'Group buy?'
+  = f.label :group_buy, t('.group_buy')
   %br
   .alpha.two.columns
-    = f.radio_button :group_buy, '1', :checked => f.object.group_buy
-    = f.label :group_buy_1, 'Yes'
+    = f.radio_button :group_buy, '1', checked: f.object.group_buy
+    = f.label :group_buy_1, t(:yes)
   .alpha.two.columns
-    = f.radio_button :group_buy, '0', :checked => !f.object.group_buy
-    = f.label :group_buy_0, 'No'
+    = f.radio_button :group_buy, '0', checked: !f.object.group_buy
+    = f.label :group_buy_0, t(:no)
 %br.clear
 = f.field_container :group_buy_unit_size do
-  = f.label :group_buy_unit_size, "Bulk unit size"
+  = f.label :group_buy_unit_size, t('.bulk_unit_size')
   %br
   = f.text_field :group_buy_unit_size
diff --git a/app/views/spree/admin/products/_tax_category_form.html.haml b/app/views/spree/admin/products/_tax_category_form.html.haml
index 3d529e6562..250ba8c832 100644
--- a/app/views/spree/admin/products/_tax_category_form.html.haml
+++ b/app/views/spree/admin/products/_tax_category_form.html.haml
@@ -2,5 +2,5 @@
   = f.label :tax_category_id, t(:tax_category)
   %span.required *
   %br
-  = f.collection_select(:tax_category_id, Spree::TaxCategory.all, :id, :name, {:include_blank => Spree::Config.products_require_tax_category ? false : 'None'}, {:class => "select2 fullwidth"})
+  = f.collection_select(:tax_category_id, Spree::TaxCategory.all, :id, :name, {:include_blank => Spree::Config.products_require_tax_category ? false : t(:none)}, {:class => "select2 fullwidth"})
   = f.error_message_on :tax_category_id
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 0f3cc3aeb0..104999525b 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -161,8 +161,10 @@ en:
   powered_by: Powered by
   blocked_cookies_alert: "Your browser may be blocking cookies needed to use this shopfront. Click below to allow cookies and reload the page."
   allow_cookies: "Allow Cookies"
+  none: None
+  notes: Notes
   actions:
-      create_and_add_another: "Create and Add Another"
+    create_and_add_another: "Create and Add Another"
   admin:
     # Common properties / models
     date: Date
@@ -937,6 +939,7 @@ en:
   checkout_shipping_price: Shipping
   checkout_total_price: Total
   checkout_back_to_cart: "Back to Cart"
+  cost_currency: "Cost Currency"
 
   order_paid: PAID
   order_not_paid: NOT PAID
@@ -1549,6 +1552,8 @@ Please follow the instructions there to make your enterprise visible on the Open
   spree_admin_unit_description: Unit Description
   spree_admin_variant_unit: Variant unit
   spree_admin_variant_unit_scale: Variant unit scale
+  spree_admin_supplier: Supplier
+  spree_admin_product_category: Product Category
   spree_admin_variant_unit_name: Variant unit name
   change_package: "Change Package"
   spree_admin_single_enterprise_hint: "Hint: To allow people to find you, turn on your visibility under"
@@ -2052,6 +2057,9 @@ Please follow the instructions there to make your enterprise visible on the Open
           product_name: Product Name
         primary_taxon_form:
           product_category: Product Category
+        group_buy_form:
+          group_buy: "Group Buy?"
+          bulk_unit_size: Bulk unit size
         display_as:
           display_as: Display As
       reports:
diff --git a/spec/features/admin/products_spec.rb b/spec/features/admin/products_spec.rb
index 2cebd58dce..cc11e5853d 100644
--- a/spec/features/admin/products_spec.rb
+++ b/spec/features/admin/products_spec.rb
@@ -95,7 +95,7 @@ feature %q{
       visit spree.edit_admin_product_path(product)
 
       choose 'product_group_buy_1'
-      fill_in 'Bulk unit size', :with => '10'
+      fill_in 'product_group_buy_unit_size', with: '10'
 
       click_button 'Update'
 

From a1aac7643ac55acb1d1bea8ee48b73c7e10a1d03 Mon Sep 17 00:00:00 2001
From: Saimon Moore <saimonmoore@gmail.com>
Date: Fri, 8 Sep 2017 12:47:53 +0200
Subject: [PATCH 007/353] Translate Entp registration modal tab titles

- Add proper namespaced translations for Details and Contact tabs
---
 app/views/registration/steps/_steps.html.haml |  3 +-
 config/locales/en.yml                         | 44 +++++++++++++++++++
 2 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/app/views/registration/steps/_steps.html.haml b/app/views/registration/steps/_steps.html.haml
index 7ea0412929..3538d5ff48 100644
--- a/app/views/registration/steps/_steps.html.haml
+++ b/app/views/registration/steps/_steps.html.haml
@@ -1,4 +1,5 @@
 %script{ type: "text/ng-template", id: "registration/steps.html" }
   .row#progress-bar
     .small-12.medium-2.columns.item{ ng: { repeat: 'step in steps', class: "{active: (currentStep() == step),'show-for-medium-up': (currentStep() != step)}" } }
-      {{ $index+1 + ". " + step }}
+      {{ $index+1 + ". " + ('enterprise.registration.modal.steps.' + step + '.title' | t) }}
+
diff --git a/config/locales/en.yml b/config/locales/en.yml
index af7953a339..f047b059be 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -1311,6 +1311,50 @@ See the %{link} to find out more about %{sitename}'s features and to start using
   reset_password: "Reset password"
   registration_greeting: "Greetings!"
   who_is_managing_enterprise: "Who is responsible for managing %{enterprise}?"
+  enterprise:
+    registration:
+      modal:
+        steps:
+          details:
+            title: 'Details'
+            headline: "Let's Get Started"
+            enterprise: "Woot! First we need to know a little bit about your enterprise:"
+            producer: "Woot! First we need to know a little bit about your farm:"
+            enterprise_name_field: "Enterprise Name:"
+            producer_name_field: "Farm Name:"
+            producer_name_field_placeholder: "e.g. Charlie's Awesome Farm"
+            producer_name_field_error: "Please choose a unique name for your enterprise"
+            address1_field: "Address line 1:"
+            address1_field_placeholder: "e.g. 123 Cranberry Drive"
+            address1_field_error: "Please enter an address"
+            address2_field: "Address line 2:"
+            suburb_field: "Suburb:"
+            suburb_field_placeholder: "e.g. Northcote"
+            suburb_field_error: "Please enter a suburb"
+            postcode_field: "Postcode:"
+            postcode_field_placeholder: "e.g. 3070"
+            postcode_field_error: "Postcode required"
+            state_field: "State:"
+            state_field_error: "State required"
+            country_field: "Country:"
+            country_field_error: "Please select a country"
+          contact:
+            title: 'Contact'
+            contact_field: 'Primary Contact'
+            contact_field_placeholder: 'Contact Name'
+            contact_field_required: "You need to enter a primary contact."
+            email_field: 'Email address'
+            email_field_placeholder: 'eg. charlie@thefarm.com'
+            phone_field: 'Phone number'
+            phone_field_placeholder: 'eg. (03) 1234 5678'
+          type:
+            title: 'Type'
+          about:
+            title: 'About'
+          images:
+            title: 'Images'
+          social:
+            title: 'Social'
   enterprise_contact: "Primary Contact"
   enterprise_contact_placeholder: "Contact Name"
   enterprise_contact_required: "You need to enter a primary contact."

From d4f7efd08a15e57a699b2bea1a4c1a4cfb2f303f Mon Sep 17 00:00:00 2001
From: Saimon Moore <saimonmoore@gmail.com>
Date: Fri, 8 Sep 2017 12:49:08 +0200
Subject: [PATCH 008/353] Use proper namespaced translations

... in enterprise registration wizard Contact step
---
 app/views/registration/steps/_contact.html.haml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/app/views/registration/steps/_contact.html.haml b/app/views/registration/steps/_contact.html.haml
index 169e98cc85..dd282f4ca3 100644
--- a/app/views/registration/steps/_contact.html.haml
+++ b/app/views/registration/steps/_contact.html.haml
@@ -12,18 +12,18 @@
         .small-12.medium-12.large-7.columns
           .row
             .small-12.columns.field
-              %label{ for: 'enterprise_contact' } {{'enterprise_contact' | t}}:
-              %input.chunky.small-12.columns{ id: 'enterprise_contact', name: 'contact', required: true, placeholder: t(:enterprise_contact_placeholder), ng: { model: 'enterprise.contact' } }
+              %label{ for: 'enterprise_contact' } {{'enterprise.registration.modal.steps.contact.contact_field' | t}}:
+              %input.chunky.small-12.columns{ id: 'enterprise_contact', name: 'contact', required: true, placeholder: "{{'enterprise.registration.modal.steps.contact.contact_field_placeholder' | t}}", ng: { model: 'enterprise.contact' } }
               %span.error.small-12.columns{ ng: { show: "contact.contact.$error.required && submitted" } }
-                {{'enterprise_contact_required' | t}}
+                {{'enterprise.registration.modal.steps.contact.contact_field_required' | t}}
           .row
             .small-12.columns.field
-              %label{ for: 'enterprise_email_address' } {{'enterprise_email_address' | t}}:
-              %input.chunky.small-12.columns{ id: 'enterprise_email_address', name: 'email_address', type: 'email', placeholder: t(:enterprise_email_placeholder), ng: { model: 'enterprise.email_address' } }
+              %label{ for: 'enterprise_email_address' } {{'enterprise.registration.modal.steps.contact.email_field' | t}}:
+              %input.chunky.small-12.columns{ id: 'enterprise_email_address', name: 'email_address', type: 'email', placeholder: "{{'enterprise.registration.modal.steps.contact.email_field_placeholder' | t}}", ng: { model: 'enterprise.email_address' } }
           .row
             .small-12.columns.field
-              %label{ for: 'enterprise_phone' } {{'enterprise_phone' | t}}:
-              %input.chunky.small-12.columns{ id: 'enterprise_phone', name: 'phone', placeholder: t(:enterprise_phone_placeholder), ng: { model: 'enterprise.phone' } }
+              %label{ for: 'enterprise_phone' } {{'enterprise.registration.modal.steps.contact.phone_field' | t}}:
+              %input.chunky.small-12.columns{ id: 'enterprise_phone', name: 'phone', placeholder: "{{'enterprise.registration.modal.steps.contact.phone_field_placeholder' | t}}", ng: { model: 'enterprise.phone' } }
         .small-12.medium-12.large-5.hide-for-small-only
 
       .row.buttons

From f73f0d4bf929d749f676b4a49a07a74624b32e03 Mon Sep 17 00:00:00 2001
From: Saimon Moore <saimonmoore@gmail.com>
Date: Fri, 8 Sep 2017 12:50:54 +0200
Subject: [PATCH 009/353] Use proper namespaced translations

... in enterprise registration wizard Details step
---
 .../registration/steps/_details.html.haml     | 42 +++++++++----------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/app/views/registration/steps/_details.html.haml b/app/views/registration/steps/_details.html.haml
index 4a01d92385..4fce6a4319 100644
--- a/app/views/registration/steps/_details.html.haml
+++ b/app/views/registration/steps/_details.html.haml
@@ -4,59 +4,59 @@
     .row
       .small-12.columns
         %header
-          %h2 {{'registration_detail_headline' | t}}
-          %h5{ ng: { if: "::enterprise.type != 'own'" } } {{'registration_detail_enterprise' | t}}
-          %h5{ ng: { if: "::enterprise.type == 'own'" } } {{'registration_detail_producer' | t}}
+          %h2 {{'enterprise.registration.modal.steps.details.headline' | t}}
+          %h5{ ng: { if: "::enterprise.type != 'own'" } } {{'enterprise.registration.modal.steps.details.enterprise' | t}}
+          %h5{ ng: { if: "::enterprise.type == 'own'" } } {{'enterprise.registration.modal.steps.details.producer' | t}}
 
     %form{ name: 'details', novalidate: true, ng: { controller: "RegistrationFormCtrl", submit: "selectIfValid('contact',details)" } }
 
       .row
         .small-12.medium-9.large-12.columns.end
           .field
-            %label{ for: 'enterprise_name', ng: { if: "::enterprise.type != 'own'" } } {{'registration_detail_name_enterprise' | t}}
-            %label{ for: 'enterprise_name', ng: { if: "::enterprise.type == 'own'" } } {{'registration_detail_name_producer' | t}}
-            %input.chunky{ id: 'enterprise_name', name: 'name', placeholder: "{{'registration_detail_name_placeholder' | t}}", required: true, ng: { model: 'enterprise.name' } }
+            %label{ for: 'enterprise_name', ng: { if: "::enterprise.type != 'own'" } } {{'enterprise.registration.modal.steps.details.enterprise_name_field' | t}}
+            %label{ for: 'enterprise_name', ng: { if: "::enterprise.type == 'own'" } } {{'enterprise.registration.modal.steps.details.producer_name_field' | t}}
+            %input.chunky{ id: 'enterprise_name', name: 'name', placeholder: "{{'enterprise.registration.modal.steps.details.producer_name_field_placeholder' | t}}", required: true, ng: { model: 'enterprise.name' } }
             %span.error{ ng: { show: "details.name.$error.required && submitted" } }
-              {{'registration_detail_name_error' | t}}
+              {{'enterprise.registration.modal.steps.details.producer_name_field_error' | t}}
 
       .row
         .small-12.medium-9.large-6.columns
           .field
-            %label{ for: 'enterprise_address' } {{'registration_detail_address1' | t}}
-            %input.chunky{ id: 'enterprise_address', name: 'address1', required: true, placeholder: "{{'registration_detail_address1_placeholder' | t}}", required: true, ng: { model: 'enterprise.address.address1' } }
+            %label{ for: 'enterprise_address' } {{'enterprise.registration.modal.steps.details.address1_field' | t}}
+            %input.chunky{ id: 'enterprise_address', name: 'address1', required: true, placeholder: "{{'enterprise.registration.modal.steps.details.address1_field_placeholder' | t}}", required: true, ng: { model: 'enterprise.address.address1' } }
             %span.error{ ng: { show: "details.address1.$error.required && submitted" } }
-              {{'registration_detail_address1_error' | t}}
+              {{'enterprise.registration.modal.steps.details.address1_field_error' | t}}
           .field
-            %label{ for: 'enterprise_address2' } {{'registration_detail_address2' | t}}
+            %label{ for: 'enterprise_address2' } {{'enterprise.registration.modal.steps.details.address2_field' | t}}
             %input.chunky{ id: 'enterprise_address2', name: 'address2', required: false, placeholder: "", required: false, ng: { model: 'enterprise.address.address2' } }
 
         .small-12.medium-9.large-6.columns.end
           .row
             .small-12.medium-8.large-8.columns
               .field
-                %label{ for: 'enterprise_city' } {{'registration_detail_suburb' | t}}
-                %input.chunky{ id: 'enterprise_city', name: 'city', required: true, placeholder: "{{'registration_detail_suburb_placeholder' | t}}", ng: { model: 'enterprise.address.city' } }
+                %label{ for: 'enterprise_city' } {{'enterprise.registration.modal.steps.details.suburb_field' | t}}
+                %input.chunky{ id: 'enterprise_city', name: 'city', required: true, placeholder: "{{'enterprise.registration.modal.steps.details.suburb_field_placeholder' | t}}", ng: { model: 'enterprise.address.city' } }
                 %span.error{ ng: { show: "details.city.$error.required && submitted" } }
-                  {{'registration_detail_suburb_error' | t}}
+                  {{'enterprise.registration.modal.steps.details.suburb_field_error' | t}}
             .small-12.medium-4.large-4.columns
               .field
-                %label{ for: 'enterprise_zipcode' } {{'registration_detail_postcode' | t}}
-                %input.chunky{ id: 'enterprise_zipcode', name: 'zipcode', required: true, placeholder: "{{'registration_detail_postcode_placeholder' | t}}", ng: { model: 'enterprise.address.zipcode' } }
+                %label{ for: 'enterprise_zipcode' } {{'enterprise.registration.modal.steps.details.postcode_field' | t}}
+                %input.chunky{ id: 'enterprise_zipcode', name: 'zipcode', required: true, placeholder: "{{'enterprise.registration.modal.steps.details.postcode_field_placeholder' | t}}", ng: { model: 'enterprise.address.zipcode' } }
                 %span.error{ ng: { show: "details.zipcode.$error.required && submitted" } }
-                  {{'registration_detail_postcode_error' | t}}
+                  {{'enterprise.registration.modal.steps.details.postcode_field_error' | t}}
           .row
             .small-12.medium-4.large-4.columns
               .field
-                %label{ for: 'enterprise_state' } {{'registration_detail_state' | t}}
+                %label{ for: 'enterprise_state' } {{'enterprise.registration.modal.steps.details.state_field' | t}}
                 %select.chunky{ id: 'enterprise_state', name: 'state', ng: { model: 'enterprise.address.state_id', options: 's.id as s.abbr for s in enterprise.country.states', show: 'countryHasStates()', required: 'countryHasStates()' } }
                 %span.error{ ng: { show: "details.state.$error.required && submitted" } }
-                  {{'registration_detail_state_error' | t}}
+                  {{'enterprise.registration.modal.steps.details.state_field_error' | t}}
             .small-12.medium-8.large-8.columns
               .field
-                %label{ for: 'enterprise_country' } {{'registration_detail_country' | t}}
+                %label{ for: 'enterprise_country' } {{'enterprise.registration.modal.steps.details.country_field' | t}}
                 %select.chunky{ id: 'enterprise_country', name: 'country', required: true, ng: { init: "setDefaultCountry(#{Spree::Config[:default_country_id]})", model: 'enterprise.country', options: 'c as c.name for c in countries' } }
                 %span.error{ ng: { show: "details.country.$error.required && submitted" } }
-                  {{'registration_detail_country_error' | t}}
+                  {{'enterprise.registration.modal.steps.details.country_field_error' | t}}
 
 
       .row.buttons

From 757f886af535d4e949f83cf14774fd6f81f28c28 Mon Sep 17 00:00:00 2001
From: Saimon Moore <saimonmoore@gmail.com>
Date: Fri, 8 Sep 2017 13:35:19 +0200
Subject: [PATCH 010/353] Use proper namespaced translations

... in enterprise registration wizard Type step
---
 app/views/registration/steps/_type.html.haml | 14 +++++++-------
 config/locales/en.yml                        |  8 ++++++++
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/app/views/registration/steps/_type.html.haml b/app/views/registration/steps/_type.html.haml
index 4c93c441f4..0a98d851ed 100644
--- a/app/views/registration/steps/_type.html.haml
+++ b/app/views/registration/steps/_type.html.haml
@@ -6,9 +6,9 @@
     .row
       .small-12.columns
         %header
-          %h2{ "ng-bind" => "'registration_type_headline' | t:{enterprise: enterprise.name}" }
+          %h2{ "ng-bind" => "'enterprise.registration.modal.steps.type.headline' | t:{enterprise: enterprise.name}" }
           %h4
-            {{'registration_type_question' | t}}
+            {{'enterprise.registration.modal.steps.type.question' | t}}
 
     %form{ name: 'type', novalidate: true, ng: { controller: "RegistrationFormCtrl", submit: "create(type)" } }
       .row#enterprise-types{ 'data-equalizer' => true, ng: { if: "::enterprise.type != 'own'" } }
@@ -17,30 +17,30 @@
             .small-12.medium-6.large-6.columns{ 'data-equalizer-watch' => true }
               %a.btnpanel#producer-panel{ href: "#", ng: { click: "enterprise.is_primary_producer = true", class: "{selected: enterprise.is_primary_producer}" } }
                 %i.ofn-i_059-producer
-                %h4 {{'registration_type_producer' | t}}
+                %h4 {{'enterprise.registration.modal.steps.type.yes_producer' | t}}
 
             .small-12.medium-6.large-6.columns{ 'data-equalizer-watch' => true }
               %a.btnpanel#hub-panel{ href: "#", ng: { click: "enterprise.is_primary_producer = false", class: "{selected: enterprise.is_primary_producer == false}" } }
                 %i.ofn-i_063-hub
-                %h4 {{'registration_type_no_producer' | t}}
+                %h4 {{'enterprise.registration.modal.steps.type.no_producer' | t}}
 
           .row
             .small-12.columns
               %input.chunky{ id: 'enterprise_is_primary_producer', name: 'is_primary_producer', hidden: true, required: true, ng: { model: 'enterprise.is_primary_producer' } }
               %span.error{ ng: { show: "type.is_primary_producer.$error.required && submitted" } }
-                {{'registration_type_error' | t}}
+                {{'enterprise.registration.modal.steps.type.producer_field_error' | t}}
           .row
             .small-12.columns
               .panel.callout
                 .left
                   %i.ofn-i_013-help
                   &nbsp;
-                %p {{'registration_type_producer_help' | t}}
+                %p {{'enterprise.registration.modal.steps.type.yes_producer_help' | t}}
               .panel.callout
                 .left
                   %i.ofn-i_013-help
                   &nbsp;
-                %p {{'registration_type_no_producer_help' | t}}
+                %p {{'enterprise.registration.modal.steps.type.no_producer_help' | t}}
 
       .row.buttons
         .small-12.columns
diff --git a/config/locales/en.yml b/config/locales/en.yml
index f047b059be..8b5193659b 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -1349,6 +1349,14 @@ See the %{link} to find out more about %{sitename}'s features and to start using
             phone_field_placeholder: 'eg. (03) 1234 5678'
           type:
             title: 'Type'
+            headline: "Last step to add %{enterprise}!"
+            question: "Are you a producer?"
+            yes_producer: "Yes, I'm a producer"
+            no_producer: "No, I'm not a producer"
+            producer_field_error: "Please choose one. Are you are producer?"
+            yes_producer_help: "Producers make yummy things to eat and/or drink. You're a producer if you grow it, raise it, brew it, bake it, ferment it, milk it or mould it."
+            no_producer_help: "If you’re not a producer, you’re probably someone who sells and distributes food. You might be a hub, coop, buying group, retailer, wholesaler or other."
+
           about:
             title: 'About'
           images:

From 09aed63cd40ccc5bb43c625b0c9b197e9d8d169a Mon Sep 17 00:00:00 2001
From: Saimon Moore <saimonmoore@gmail.com>
Date: Fri, 8 Sep 2017 13:57:50 +0200
Subject: [PATCH 011/353] Add todos to remove redundant i18n keys

---
 config/locales/en.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/config/locales/en.yml b/config/locales/en.yml
index 8b5193659b..28261cf103 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -1363,6 +1363,7 @@ See the %{link} to find out more about %{sitename}'s features and to start using
             title: 'Images'
           social:
             title: 'Social'
+  # TODO: Remove these once the enterprise.registration.modal keys are translated
   enterprise_contact: "Primary Contact"
   enterprise_contact_placeholder: "Contact Name"
   enterprise_contact_required: "You need to enter a primary contact."
@@ -1370,6 +1371,7 @@ See the %{link} to find out more about %{sitename}'s features and to start using
   enterprise_email_placeholder: "eg. charlie@thefarm.com"
   enterprise_phone: "Phone number"
   enterprise_phone_placeholder: "eg. (03) 1234 5678"
+  # END
   back: "Back"
   continue: "Continue"
   limit_reached_headline: "Oh no!"
@@ -1441,6 +1443,8 @@ See the %{link} to find out more about %{sitename}'s features and to start using
 Please follow the instructions there to make your enterprise visible on the Open Food Network."
   registration_finished_action: "Open Food Network home"
   registration_contact_name: 'Contact Name'
+
+  # TODO: Remove these once the enterprise.registration.modal keys are translated
   registration_type_headline: "Last step to add %{enterprise}!"
   registration_type_question: "Are you a producer?"
   registration_type_producer: "Yes, I'm a producer"
@@ -1448,9 +1452,13 @@ Please follow the instructions there to make your enterprise visible on the Open
   registration_type_error: "Please choose one. Are you are producer?"
   registration_type_producer_help: "Producers make yummy things to eat and/or drink. You're a producer if you grow it, raise it, brew it, bake it, ferment it, milk it or mould it."
   registration_type_no_producer_help: "If you’re not a producer, you’re probably someone who sells and distributes food. You might be a hub, coop, buying group, retailer, wholesaler or other."
+  # END
   create_profile: "Create Profile"
   registration_images_headline: "Thanks!"
   registration_images_description: "Let's upload some pretty pictures so your profile looks great! :)"
+
+
+  # TODO: Remove these once the enterprise.registration.modal keys are translated
   registration_detail_headline: "Let's Get Started"
   registration_detail_enterprise: "Woot! First we need to know a little bit about your enterprise:"
   registration_detail_producer: "Woot! First we need to know a little bit about your farm:"
@@ -1472,6 +1480,7 @@ Please follow the instructions there to make your enterprise visible on the Open
   registration_detail_state_error: "State required"
   registration_detail_country: "Country:"
   registration_detail_country_error: "Please select a country"
+  # END
   shipping_method_destroy_error: "That shipping method cannot be deleted as it is referenced by an order: %{number}."
   accounts_and_billing_task_already_running_error: "A task is already running, please wait until it has finished"
   accounts_and_billing_start_task_notice: "Task Queued"

From f5c4537afa49e4ed484d4d24cbe8c3c5833bc92a Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 16 Sep 2016 12:33:53 +1000
Subject: [PATCH 012/353] Start Spree upgrade step 2

---
 Gemfile      | 2 +-
 Gemfile.lock | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Gemfile b/Gemfile
index d4c55bb63f..31092561ec 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'openfoodfoundation/spree', branch: 'spree-upgrade-step1c'
+gem 'spree', github: 'openfoodfoundation/spree', branch: 'spree-upgrade-step-2'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'spree/spree_auth_devise', branch: '1-3-stable'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index fcb7283ef9..f8a6b604c3 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -30,8 +30,8 @@ GIT
 
 GIT
   remote: git://github.com/openfoodfoundation/spree.git
-  revision: a4c439570b77afa50f9e36299811f293232bd281
-  branch: spree-upgrade-step1c
+  revision: ba444ace4de81626ef0a69a44123e25084874b4a
+  branch: spree-upgrade-step-2
   specs:
     spree (1.3.99)
       spree_api (= 1.3.99)
@@ -54,7 +54,7 @@ GIT
       deface (>= 0.9.0)
       ffaker (~> 1.15.0)
       highline (= 1.6.11)
-      jquery-rails (~> 2.0)
+      jquery-rails (~> 2.1.4)
       json (>= 1.5.5)
       kaminari (= 0.13.0)
       money (= 5.0.0)
@@ -426,7 +426,7 @@ GEM
     ipaddress (0.8.0)
     journey (1.0.4)
     jquery-migrate-rails (1.2.1)
-    jquery-rails (2.3.0)
+    jquery-rails (2.1.4)
       railties (>= 3.0, < 5.0)
       thor (>= 0.14, < 2.0)
     json (1.8.3)

From b5d33fc4b586eb8a8314f66453de65dad4c82ec0 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 16 Sep 2016 12:46:46 +1000
Subject: [PATCH 013/353] Add migrations from Spree

---
 .../20160916024535_add_state_to_spree_adjustments.spree.rb | 7 +++++++
 db/schema.rb                                               | 4 ++--
 2 files changed, 9 insertions(+), 2 deletions(-)
 create mode 100644 db/migrate/20160916024535_add_state_to_spree_adjustments.spree.rb

diff --git a/db/migrate/20160916024535_add_state_to_spree_adjustments.spree.rb b/db/migrate/20160916024535_add_state_to_spree_adjustments.spree.rb
new file mode 100644
index 0000000000..a4224678df
--- /dev/null
+++ b/db/migrate/20160916024535_add_state_to_spree_adjustments.spree.rb
@@ -0,0 +1,7 @@
+# This migration comes from spree (originally 20121213162028)
+class AddStateToSpreeAdjustments < ActiveRecord::Migration
+  def change
+    add_column :spree_adjustments, :state, :string
+    remove_column :spree_adjustments, :locked
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 75c43b1d72..c0583e5f54 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -401,12 +401,12 @@ ActiveRecord::Schema.define(:version => 20161215230219) do
     t.datetime "created_at",                                                       :null => false
     t.datetime "updated_at",                                                       :null => false
     t.boolean  "mandatory"
-    t.boolean  "locked"
     t.integer  "originator_id"
     t.string   "originator_type"
     t.boolean  "eligible",                                       :default => true
     t.string   "adjustable_type"
     t.decimal  "included_tax",    :precision => 10, :scale => 2, :default => 0.0,  :null => false
+    t.string   "state"
   end
 
   add_index "spree_adjustments", ["adjustable_id"], :name => "index_adjustments_on_order_id"
@@ -586,9 +586,9 @@ ActiveRecord::Schema.define(:version => 20161215230219) do
     t.string   "email"
     t.text     "special_instructions"
     t.integer  "distributor_id"
-    t.integer  "order_cycle_id"
     t.string   "currency"
     t.string   "last_ip_address"
+    t.integer  "order_cycle_id"
     t.integer  "cart_id"
     t.integer  "customer_id"
   end

From 38da4c8e12aab943a23cc8c28b5607be9de1e22d Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 16 Sep 2016 15:02:55 +1000
Subject: [PATCH 014/353] Adjustments now have state instead of locked/unlocked

---
 app/models/billable_period.rb                      |  2 +-
 app/models/enterprise_fee.rb                       | 13 -------------
 app/models/product_distribution.rb                 |  2 +-
 app/models/spree/line_item_decorator.rb            |  2 +-
 lib/open_food_network/enterprise_fee_applicator.rb |  4 ++--
 spec/models/enterprise_fee_spec.rb                 |  2 +-
 spec/models/product_distribution_spec.rb           |  6 +++---
 spec/models/spree/order_spec.rb                    |  4 ++--
 8 files changed, 11 insertions(+), 24 deletions(-)

diff --git a/app/models/billable_period.rb b/app/models/billable_period.rb
index d3a58e3745..d2ca41b0a9 100644
--- a/app/models/billable_period.rb
+++ b/app/models/billable_period.rb
@@ -71,7 +71,7 @@ class BillablePeriod < ActiveRecord::Base
       source: self,
       originator: nil, # enterprise.package
       mandatory: true,
-      locked: false
+      state: 'closed'
     }
   end
 end
diff --git a/app/models/enterprise_fee.rb b/app/models/enterprise_fee.rb
index ff118cf0aa..e7e8ee0513 100644
--- a/app/models/enterprise_fee.rb
+++ b/app/models/enterprise_fee.rb
@@ -54,19 +54,6 @@ class EnterpriseFee < ActiveRecord::Base
     order.adjustments.where(originator_type: 'EnterpriseFee').destroy_all
   end
 
-  # Create an adjustment that starts as locked. Preferable to making an adjustment and locking it since
-  # the unlocked adjustment tends to get hit by callbacks before we have a chance to lock it.
-  def create_locked_adjustment(label, target, calculable, mandatory=false)
-    amount = compute_amount(calculable)
-    return if amount == 0 && !mandatory
-    target.adjustments.create({ :amount => amount,
-                                :source => calculable,
-                                :originator => self,
-                                :label => label,
-                                :mandatory => mandatory,
-                                :locked => true}, :without_protection => true)
-  end
-
 
   private
 
diff --git a/app/models/product_distribution.rb b/app/models/product_distribution.rb
index e866d3860b..a18d9d638c 100644
--- a/app/models/product_distribution.rb
+++ b/app/models/product_distribution.rb
@@ -17,7 +17,7 @@ class ProductDistribution < ActiveRecord::Base
   end
 
   def create_adjustment_for(line_item)
-    a = enterprise_fee.create_locked_adjustment(adjustment_label_for(line_item), line_item.order, line_item, true)
+    a = enterprise_fee.create_adjustment(adjustment_label_for(line_item), line_item.order, line_item, true)
     AdjustmentMetadata.create! adjustment: a, enterprise: enterprise_fee.enterprise, fee_name: enterprise_fee.name, fee_type: enterprise_fee.fee_type, enterprise_role: 'distributor'
   end
 
diff --git a/app/models/spree/line_item_decorator.rb b/app/models/spree/line_item_decorator.rb
index 9c80df8bb4..4985d059b0 100644
--- a/app/models/spree/line_item_decorator.rb
+++ b/app/models/spree/line_item_decorator.rb
@@ -60,7 +60,7 @@ Spree::LineItem.class_eval do
   end
 
   def price_with_adjustments
-    # EnterpriseFee#create_locked_adjustment applies adjustments on line items to their parent order,
+    # EnterpriseFee#create_adjustment applies adjustments on line items to their parent order,
     # so line_item.adjustments returns an empty array
     return 0 if quantity == 0
     (price + order.adjustments.where(source_id: id).sum(&:amount) / quantity).round(2)
diff --git a/lib/open_food_network/enterprise_fee_applicator.rb b/lib/open_food_network/enterprise_fee_applicator.rb
index e6d52e1749..e213204047 100644
--- a/lib/open_food_network/enterprise_fee_applicator.rb
+++ b/lib/open_food_network/enterprise_fee_applicator.rb
@@ -1,7 +1,7 @@
 module OpenFoodNetwork
   class EnterpriseFeeApplicator < Struct.new(:enterprise_fee, :variant, :role)
     def create_line_item_adjustment(line_item)
-      a = enterprise_fee.create_locked_adjustment(line_item_adjustment_label, line_item.order, line_item, true)
+      a = enterprise_fee.create_adjustment(line_item_adjustment_label, line_item.order, line_item, true)
 
       AdjustmentMetadata.create! adjustment: a, enterprise: enterprise_fee.enterprise, fee_name: enterprise_fee.name, fee_type: enterprise_fee.fee_type, enterprise_role: role
 
@@ -9,7 +9,7 @@ module OpenFoodNetwork
     end
 
     def create_order_adjustment(order)
-      a = enterprise_fee.create_locked_adjustment(order_adjustment_label, order, order, true)
+      a = enterprise_fee.create_adjustment(order_adjustment_label, order, order, true)
 
       AdjustmentMetadata.create! adjustment: a, enterprise: enterprise_fee.enterprise, fee_name: enterprise_fee.name, fee_type: enterprise_fee.fee_type, enterprise_role: role
 
diff --git a/spec/models/enterprise_fee_spec.rb b/spec/models/enterprise_fee_spec.rb
index e0df4ce5d0..6c4245c875 100644
--- a/spec/models/enterprise_fee_spec.rb
+++ b/spec/models/enterprise_fee_spec.rb
@@ -170,7 +170,7 @@ describe EnterpriseFee do
       order.adjustments.create({:amount => 12.34,
                                 :source => order,
                                 :originator => tax_rate,
-                                :locked => true,
+                                :state => 'closed',
                                 :label => 'hello' }, :without_protection => true)
 
       expect do
diff --git a/spec/models/product_distribution_spec.rb b/spec/models/product_distribution_spec.rb
index 7e1a6933bc..2fa2bab427 100644
--- a/spec/models/product_distribution_spec.rb
+++ b/spec/models/product_distribution_spec.rb
@@ -78,7 +78,7 @@ describe ProductDistribution do
       it "returns the adjustment when present" do
         pd = create(:product_distribution)
         line_item = create(:line_item)
-        adjustment = pd.enterprise_fee.create_locked_adjustment('foo', line_item.order, line_item, true)
+        adjustment = pd.enterprise_fee.create_adjustment('foo', line_item.order, line_item, true)
 
         pd.send(:adjustment_for, line_item).should == adjustment
       end
@@ -86,8 +86,8 @@ describe ProductDistribution do
       it "raises an error when there are multiple adjustments for this enterprise fee" do
         pd = create(:product_distribution)
         line_item = create(:line_item)
-        pd.enterprise_fee.create_locked_adjustment('one', line_item.order, line_item, true)
-        pd.enterprise_fee.create_locked_adjustment('two', line_item.order, line_item, true)
+        pd.enterprise_fee.create_adjustment('one', line_item.order, line_item, true)
+        pd.enterprise_fee.create_adjustment('two', line_item.order, line_item, true)
 
         expect do
           pd.send(:adjustment_for, line_item)
diff --git a/spec/models/spree/order_spec.rb b/spec/models/spree/order_spec.rb
index e7c46c27cb..392d9664fa 100644
--- a/spec/models/spree/order_spec.rb
+++ b/spec/models/spree/order_spec.rb
@@ -140,7 +140,7 @@ describe Spree::Order do
     it "returns the sum of eligible enterprise fee adjustments" do
       ef = create(:enterprise_fee, calculator: Spree::Calculator::FlatRate.new )
       ef.calculator.set_preference :amount, 123.45
-      a = ef.create_locked_adjustment("adjustment", o, o, true)
+      a = ef.create_adjustment("adjustment", o, o, true)
 
       o.admin_and_handling_total.should == 123.45
     end
@@ -148,7 +148,7 @@ describe Spree::Order do
     it "does not include ineligible adjustments" do
       ef = create(:enterprise_fee, calculator: Spree::Calculator::FlatRate.new )
       ef.calculator.set_preference :amount, 123.45
-      a = ef.create_locked_adjustment("adjustment", o, o, true)
+      a = ef.create_adjustment("adjustment", o, o, true)
 
       a.update_column :eligible, false
 

From bfd54ef62159061edd7bba718c6ef228c5a6a08c Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 4 Nov 2016 10:43:46 +1100
Subject: [PATCH 015/353] Update Spree: Fix admin authorization errors

---
 Gemfile.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index f8a6b604c3..383caa2bab 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -30,7 +30,7 @@ GIT
 
 GIT
   remote: git://github.com/openfoodfoundation/spree.git
-  revision: ba444ace4de81626ef0a69a44123e25084874b4a
+  revision: 4a0013618dbd5bae254e921565bf51d3dd5ccd24
   branch: spree-upgrade-step-2
   specs:
     spree (1.3.99)
@@ -208,7 +208,7 @@ GEM
       coffee-script-source
       execjs
     coffee-script-source (1.10.0)
-    colorize (0.7.7)
+    colorize (0.8.1)
     columnize (0.9.0)
     compass (1.0.3)
       chunky_png (~> 1.2)
@@ -456,7 +456,7 @@ GEM
       treetop (~> 1.4.8)
     method_source (0.8.2)
     mime-types (1.25.1)
-    mini_portile2 (2.0.0)
+    mini_portile2 (2.1.0)
     momentjs-rails (2.5.1)
       railties (>= 3.1)
     money (5.0.0)
@@ -465,8 +465,8 @@ GEM
     multi_json (1.12.1)
     multi_xml (0.5.5)
     newrelic_rpm (3.12.0.288)
-    nokogiri (1.6.7.2)
-      mini_portile2 (~> 2.0.0.rc2)
+    nokogiri (1.6.8.1)
+      mini_portile2 (~> 2.1.0)
     oj (2.1.2)
     orm_adapter (0.5.0)
     paper_trail (3.0.8)
@@ -628,7 +628,7 @@ GEM
       sprockets (>= 2.0.0)
     turn (0.8.3)
       ansi
-    tzinfo (0.3.49)
+    tzinfo (0.3.52)
     uglifier (2.7.1)
       execjs (>= 0.3.0)
       json (>= 1.8.0)

From efe0d3ab22e1cef3148a98bc7c9d250ab083befd Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 4 Nov 2016 11:18:05 +1100
Subject: [PATCH 016/353] Update spree, upgrading jquery-rails to provide
 jquery 1.9. Fixes ng-tags-input.

---
 Gemfile.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 383caa2bab..119ebe48f9 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -30,7 +30,7 @@ GIT
 
 GIT
   remote: git://github.com/openfoodfoundation/spree.git
-  revision: 4a0013618dbd5bae254e921565bf51d3dd5ccd24
+  revision: f799d0fd62760e59ac097143dcac0ea35a76f001
   branch: spree-upgrade-step-2
   specs:
     spree (1.3.99)
@@ -54,7 +54,7 @@ GIT
       deface (>= 0.9.0)
       ffaker (~> 1.15.0)
       highline (= 1.6.11)
-      jquery-rails (~> 2.1.4)
+      jquery-rails (~> 2.2.0)
       json (>= 1.5.5)
       kaminari (= 0.13.0)
       money (= 5.0.0)
@@ -426,7 +426,7 @@ GEM
     ipaddress (0.8.0)
     journey (1.0.4)
     jquery-migrate-rails (1.2.1)
-    jquery-rails (2.1.4)
+    jquery-rails (2.2.2)
       railties (>= 3.0, < 5.0)
       thor (>= 0.14, < 2.0)
     json (1.8.3)

From 017b63fa71fdf784f681f649b3bbc5b8d21da980 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 4 Nov 2016 12:08:48 +1100
Subject: [PATCH 017/353] Update Spree: Fix further admin authorization errors

---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 119ebe48f9..999596fd14 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -30,7 +30,7 @@ GIT
 
 GIT
   remote: git://github.com/openfoodfoundation/spree.git
-  revision: f799d0fd62760e59ac097143dcac0ea35a76f001
+  revision: 36326940a9c6edd6a76fc83a211c87f4869ae017
   branch: spree-upgrade-step-2
   specs:
     spree (1.3.99)

From 8eca2602970b2387ce1c18a700188b39b385ab11 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 4 Nov 2016 12:44:07 +1100
Subject: [PATCH 018/353] Update Spree: Prevent duplicate copies of images
 appearing

---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 999596fd14..94175bc1d7 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -30,7 +30,7 @@ GIT
 
 GIT
   remote: git://github.com/openfoodfoundation/spree.git
-  revision: 36326940a9c6edd6a76fc83a211c87f4869ae017
+  revision: 7e17ccea6aea10da3105ecc5d1efb0afe1acf8f2
   branch: spree-upgrade-step-2
   specs:
     spree (1.3.99)

From 48e50540db68e67560490ce0a61bb6b038438278 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 4 Nov 2016 14:06:07 +1100
Subject: [PATCH 019/353] Start Spree upgrade step 3

---
 Gemfile      |  2 +-
 Gemfile.lock | 55 +++++++++++++++++++++++++++++++++++-----------------
 2 files changed, 38 insertions(+), 19 deletions(-)

diff --git a/Gemfile b/Gemfile
index 31092561ec..2a1b1bcf05 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'openfoodfoundation/spree', branch: 'spree-upgrade-step-2'
+gem 'spree', github: 'openfoodfoundation/spree', branch: 'spree-upgrade-step-3'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'spree/spree_auth_devise', branch: '1-3-stable'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 94175bc1d7..fd3f28abc2 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -30,46 +30,65 @@ GIT
 
 GIT
   remote: git://github.com/openfoodfoundation/spree.git
-  revision: 7e17ccea6aea10da3105ecc5d1efb0afe1acf8f2
-  branch: spree-upgrade-step-2
+  revision: ad9733e00935dab3f92aa37113a2472d38bd0574
+  branch: spree-upgrade-step-3
   specs:
     spree (1.3.99)
       spree_api (= 1.3.99)
+      spree_backend (= 1.3.99)
       spree_cmd (= 1.3.99)
       spree_core (= 1.3.99)
       spree_dash (= 1.3.99)
-      spree_promo (= 1.3.99)
+      spree_frontend (= 1.3.99)
       spree_sample (= 1.3.99)
     spree_api (1.3.99)
+      rabl (= 0.7.2)
       spree_core (= 1.3.99)
       versioncake (= 0.4.0)
+    spree_backend (1.3.99)
+      deface (>= 0.9.0)
+      jquery-rails (~> 2.0)
+      rails (~> 3.2.8)
+      select2-rails (~> 3.2)
+      spree_api (= 1.3.99)
+      spree_core (= 1.3.99)
+      stringex (~> 1.3.2)
     spree_cmd (1.3.99)
       thor (>= 0.14.6)
     spree_core (1.3.99)
+      actionmailer (~> 3.2.9)
       activemerchant (~> 1.50.0)
+      activerecord (~> 3.2.9)
       acts_as_list (= 0.1.4)
-      awesome_nested_set (= 2.1.5)
+      awesome_nested_set (= 2.1.4)
       aws-sdk (~> 1.11.1)
       cancan (= 1.6.8)
       deface (>= 0.9.0)
       ffaker (~> 1.15.0)
       highline (= 1.6.11)
-      jquery-rails (~> 2.2.0)
+      httparty (= 0.9.0)
       json (>= 1.5.5)
       kaminari (= 0.13.0)
       money (= 5.0.0)
       paperclip (~> 3.0)
-      rabl (= 0.7.2)
       rails (~> 3.2.13)
+      railties (~> 3.2.9)
       ransack (= 0.7.2)
-      select2-rails (~> 3.2)
       state_machine (= 1.2.0)
       stringex (~> 1.3.2)
+      truncate_html (= 0.9.2)
     spree_dash (1.3.99)
-      httparty (~> 0.8.1)
-      spree_core (= 1.3.99)
-    spree_promo (1.3.99)
+      httparty (~> 0.9.0)
+      spree_backend (= 1.3.99)
+      spree_frontend (= 1.3.99)
+    spree_frontend (1.3.99)
+      deface (>= 0.9.0)
+      jquery-rails (~> 2.2.0)
+      rails (~> 3.2.8)
+      select2-rails (~> 3.2)
+      spree_api (= 1.3.99)
       spree_core (= 1.3.99)
+      stringex (~> 1.3.2)
     spree_sample (1.3.99)
       spree_core (= 1.3.99)
 
@@ -155,7 +174,7 @@ GEM
     acts-as-taggable-on (3.5.0)
       activerecord (>= 3.2, < 5)
     acts_as_list (0.1.4)
-    addressable (2.3.3)
+    addressable (2.4.0)
     andand (1.3.3)
     angular-rails-templates (0.2.0)
       railties (>= 3.1)
@@ -167,7 +186,7 @@ GEM
     arel (3.0.3)
     ast (2.3.0)
     atomic (1.1.99)
-    awesome_nested_set (2.1.5)
+    awesome_nested_set (2.1.4)
       activerecord (>= 3.0.0)
     awesome_print (1.0.2)
     aws-sdk (1.11.1)
@@ -226,8 +245,8 @@ GEM
       compass (~> 1.0.0)
       sass-rails (<= 5.0.1)
       sprockets (< 2.13)
-    crack (0.4.1)
-      safe_yaml (~> 0.9.0)
+    crack (0.4.3)
+      safe_yaml (~> 1.0.0)
     css_parser (1.3.5)
       addressable
     css_splitter (0.4.5)
@@ -413,7 +432,7 @@ GEM
     highline (1.6.11)
     hike (1.2.3)
     http_parser.rb (0.5.3)
-    httparty (0.8.3)
+    httparty (0.9.0)
       multi_json (~> 1.0)
       multi_xml
     i18n (0.6.11)
@@ -622,7 +641,7 @@ GEM
     treetop (1.4.15)
       polyglot
       polyglot (>= 0.3.1)
-    truncate_html (0.5.5)
+    truncate_html (0.9.2)
     turbo-sprockets-rails3 (0.3.6)
       railties (> 3.2.8, < 4.0.0)
       sprockets (>= 2.0.0)
@@ -647,9 +666,9 @@ GEM
       railties (>= 3.0)
     warden (1.2.3)
       rack (>= 1.0)
-    webmock (1.13.0)
+    webmock (1.8.11)
       addressable (>= 2.2.7)
-      crack (>= 0.3.2)
+      crack (>= 0.1.7)
     websocket-driver (0.6.3)
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.2)

From 858576d870b14e0b270d55d94cf80ea002594ea9 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 4 Nov 2016 15:30:22 +1100
Subject: [PATCH 020/353] CalculatedAdjustments requires include first

---
 app/models/enterprise_fee.rb                  |  5 ++--
 app/models/spree/payment_method_decorator.rb  |  9 ++++--
 app/models/tag_rule/discount_order.rb         |  2 +-
 .../core/calculated_adjustments_decorator.rb  | 30 ++++++++++---------
 4 files changed, 25 insertions(+), 21 deletions(-)

diff --git a/app/models/enterprise_fee.rb b/app/models/enterprise_fee.rb
index e7e8ee0513..3b32ad0901 100644
--- a/app/models/enterprise_fee.rb
+++ b/app/models/enterprise_fee.rb
@@ -1,4 +1,6 @@
 class EnterpriseFee < ActiveRecord::Base
+  include Spree::Core::CalculatedAdjustments
+
   belongs_to :enterprise
   belongs_to :tax_category, class_name: 'Spree::TaxCategory', foreign_key: 'tax_category_id'
 
@@ -14,9 +16,6 @@ class EnterpriseFee < ActiveRecord::Base
   # coordinator_fees and exchange_fees
 
 
-  calculated_adjustments
-
-
   attr_accessible :enterprise_id, :fee_type, :name, :tax_category_id, :calculator_type, :inherits_tax_category
 
   FEE_TYPES = %w(packing transport admin sales fundraising)
diff --git a/app/models/spree/payment_method_decorator.rb b/app/models/spree/payment_method_decorator.rb
index bdbbc9a8fe..32819544ed 100644
--- a/app/models/spree/payment_method_decorator.rb
+++ b/app/models/spree/payment_method_decorator.rb
@@ -1,4 +1,6 @@
 Spree::PaymentMethod.class_eval do
+  include Spree::Core::CalculatedAdjustments
+
   Spree::PaymentMethod::DISPLAY = [:both, :front_end, :back_end]
 
   acts_as_taggable
@@ -7,8 +9,6 @@ Spree::PaymentMethod.class_eval do
 
   attr_accessible :distributor_ids, :tag_list
 
-  calculated_adjustments
-
   after_initialize :init
 
   validates_with DistributorsValidator
@@ -39,7 +39,10 @@ Spree::PaymentMethod.class_eval do
   }
 
   def init
-    self.class.calculated_adjustments unless reflections.keys.include? :calculator
+    unless reflections.keys.include? :calculator
+      include Spree::Core::CalculatedAdjustments
+    end
+
     self.calculator ||= Spree::Calculator::FlatRate.new(preferred_amount: 0)
   end
 
diff --git a/app/models/tag_rule/discount_order.rb b/app/models/tag_rule/discount_order.rb
index 5984814289..8b4a780cbd 100644
--- a/app/models/tag_rule/discount_order.rb
+++ b/app/models/tag_rule/discount_order.rb
@@ -1,5 +1,5 @@
 class TagRule::DiscountOrder < TagRule
-  calculated_adjustments
+  include Spree::Core::CalculatedAdjustments
 
   private
 
diff --git a/lib/spree/core/calculated_adjustments_decorator.rb b/lib/spree/core/calculated_adjustments_decorator.rb
index 6a42eb68c5..6b12b4a64d 100644
--- a/lib/spree/core/calculated_adjustments_decorator.rb
+++ b/lib/spree/core/calculated_adjustments_decorator.rb
@@ -1,14 +1,16 @@
-module Spree
-  module Core
-    module CalculatedAdjustments
-      module ClassMethods
-        def calculated_adjustments_with_explicit_class_name
-          calculated_adjustments_without_explicit_class_name
-          # Class name is mis-inferred outside of Spree namespace
-          has_one :calculator, as: :calculable, dependent: :destroy, class_name: 'Spree::Calculator'
-        end
-        alias_method_chain :calculated_adjustments, :explicit_class_name
-      end
-    end
-  end
-end
+# Maybe we don't need this any more? Commenting out during upgrade process
+
+# module Spree
+#   module Core
+#     module CalculatedAdjustments
+#       module ClassMethods
+#         def calculated_adjustments_with_explicit_class_name
+#           calculated_adjustments_without_explicit_class_name
+#           # Class name is mis-inferred outside of Spree namespace
+#           has_one :calculator, as: :calculable, dependent: :destroy, class_name: 'Spree::Calculator'
+#         end
+#         alias_method_chain :calculated_adjustments, :explicit_class_name
+#       end
+#     end
+#   end
+# end

From 0446b8d72f88fc7817b3550a49e908768b87eb2d Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 4 Nov 2016 15:30:46 +1100
Subject: [PATCH 021/353] TestingSupport moved out of Core namespace

---
 lib/open_food_network/enterprise_issue_validator.rb | 2 +-
 spec/factories.rb                                   | 2 +-
 spec/spec_helper.rb                                 | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/open_food_network/enterprise_issue_validator.rb b/lib/open_food_network/enterprise_issue_validator.rb
index f755a6faf1..eccc5a4a68 100644
--- a/lib/open_food_network/enterprise_issue_validator.rb
+++ b/lib/open_food_network/enterprise_issue_validator.rb
@@ -1,7 +1,7 @@
 module OpenFoodNetwork
   class EnterpriseIssueValidator
     include Rails.application.routes.url_helpers
-    include Spree::Core::UrlHelpers
+    include Spree::TestingSupport::UrlHelpers
 
     def initialize(enterprise)
       @enterprise = enterprise
diff --git a/spec/factories.rb b/spec/factories.rb
index 3b2f67e531..1faf730017 100644
--- a/spec/factories.rb
+++ b/spec/factories.rb
@@ -1,5 +1,5 @@
 require 'ffaker'
-require 'spree/core/testing_support/factories'
+require 'spree/testing_support/factories'
 
 # http://www.rubydoc.info/gems/factory_girl/file/GETTING_STARTED.md
 #
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 00e0b152ba..22c4a026ff 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -23,8 +23,8 @@ WebMock.disable_net_connect!(:allow_localhost => true)
 # Requires supporting ruby files with custom matchers and macros, etc,
 # in spec/support/ and its subdirectories.
 Dir[Rails.root.join("spec/support/**/*.rb")].each {|f| require f}
-require 'spree/core/testing_support/controller_requests'
-require 'spree/core/testing_support/capybara_ext'
+require 'spree/testing_support/controller_requests'
+require 'spree/testing_support/capybara_ext'
 require 'spree/api/testing_support/setup'
 require 'spree/api/testing_support/helpers'
 require 'spree/api/testing_support/helpers_decorator'
@@ -98,7 +98,7 @@ RSpec.configure do |config|
   config.include Spree::UrlHelpers
   config.include Spree::CheckoutHelpers
   config.include Spree::MoneyHelper
-  config.include Spree::Core::TestingSupport::ControllerRequests, :type => :controller
+  config.include Spree::TestingSupport::ControllerRequests, :type => :controller
   config.include Devise::TestHelpers, :type => :controller
   config.extend  Spree::Api::TestingSupport::Setup, :type => :controller
   config.include Spree::Api::TestingSupport::Helpers, :type => :controller

From 3135ef6b7fa9ab38e441b4cfa58872b51da0c53b Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Wed, 9 Nov 2016 12:47:57 +1100
Subject: [PATCH 022/353] Reinstate explicit class name Spree::Calculator on
 calculated_adjustments association

---
 .../core/calculated_adjustments_decorator.rb  | 30 +++++++++----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/lib/spree/core/calculated_adjustments_decorator.rb b/lib/spree/core/calculated_adjustments_decorator.rb
index 6b12b4a64d..592bf59854 100644
--- a/lib/spree/core/calculated_adjustments_decorator.rb
+++ b/lib/spree/core/calculated_adjustments_decorator.rb
@@ -1,16 +1,16 @@
-# Maybe we don't need this any more? Commenting out during upgrade process
+module Spree
+  module Core
+    module CalculatedAdjustments
+      class << self
+        def included_with_explicit_class_name(klass)
+          included_without_explicit_class_name(klass)
 
-# module Spree
-#   module Core
-#     module CalculatedAdjustments
-#       module ClassMethods
-#         def calculated_adjustments_with_explicit_class_name
-#           calculated_adjustments_without_explicit_class_name
-#           # Class name is mis-inferred outside of Spree namespace
-#           has_one :calculator, as: :calculable, dependent: :destroy, class_name: 'Spree::Calculator'
-#         end
-#         alias_method_chain :calculated_adjustments, :explicit_class_name
-#       end
-#     end
-#   end
-# end
+          klass.class_eval do
+            has_one :calculator, as: :calculable, dependent: :destroy, class_name: 'Spree::Calculator'
+          end
+        end
+        alias_method_chain :included, :explicit_class_name
+      end
+    end
+  end
+end

From 5ad197278c71daf5b0fedf9633facfa7a8e9ac4d Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Wed, 9 Nov 2016 14:04:09 +1100
Subject: [PATCH 023/353] Fix rendering of order form for JSON requests

---
 .../spree/admin/line_items_controller_decorator.rb          | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/app/controllers/spree/admin/line_items_controller_decorator.rb b/app/controllers/spree/admin/line_items_controller_decorator.rb
index 5e95681f95..2d78fe6a1c 100644
--- a/app/controllers/spree/admin/line_items_controller_decorator.rb
+++ b/app/controllers/spree/admin/line_items_controller_decorator.rb
@@ -37,6 +37,12 @@ Spree::Admin::LineItemsController.class_eval do
 
   private
 
+  def render_order_form
+    respond_to do |format|
+      format.html { render 'spree/admin/orders/form', order: @order.reload }
+    end
+  end
+
   def load_order
     @order = Spree::Order.find_by_number!(params[:order_id])
     authorize! :update, @order

From 0219118e19727d7ea5bcf809c122f30fd2915a53 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Wed, 9 Nov 2016 14:37:04 +1100
Subject: [PATCH 024/353] Admin JS/CSS now in spree_backend

---
 app/assets/javascripts/admin/all.js  | 3 +--
 app/assets/stylesheets/admin/all.css | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/app/assets/javascripts/admin/all.js b/app/assets/javascripts/admin/all.js
index 1524268900..34fab997a7 100644
--- a/app/assets/javascripts/admin/all.js
+++ b/app/assets/javascripts/admin/all.js
@@ -14,9 +14,8 @@
 //= require angular-resource
 //= require angular-animate
 //= require angular-sanitize
-//= require admin/spree_core
+//= require admin/spree_backend
 //= require admin/spree_auth
-//= require admin/spree_promo
 //= require admin/spree_paypal_express
 //= require ../shared/ng-infinite-scroll.min.js
 //= require ../shared/ng-tags-input.min.js
diff --git a/app/assets/stylesheets/admin/all.css b/app/assets/stylesheets/admin/all.css
index e913e9e710..47bf928477 100644
--- a/app/assets/stylesheets/admin/all.css
+++ b/app/assets/stylesheets/admin/all.css
@@ -4,9 +4,8 @@
  * the top of the compiled file, but it's generally better to create a new file per style scope.
  *
 
- *= require admin/spree_core
+ *= require admin/spree_backend
  *= require admin/spree_auth
- *= require admin/spree_promo
 
  *= require shared/jquery-ui-timepicker-addon
  *= require shared/textAngular

From 3605b610fe8a7e5af06289dd2cde2b502e5eee3d Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Wed, 9 Nov 2016 14:37:49 +1100
Subject: [PATCH 025/353] Use spree_auth_devise 2-0-stable pretending to be 1.3

---
 Gemfile      |  2 +-
 Gemfile.lock | 27 ++++++++++++++-------------
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/Gemfile b/Gemfile
index 2a1b1bcf05..b526c0f07e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -12,7 +12,7 @@ gem 'nokogiri', '>= 1.6.7.1'
 gem 'pg'
 gem 'spree', github: 'openfoodfoundation/spree', branch: 'spree-upgrade-step-3'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
-gem 'spree_auth_devise', github: 'spree/spree_auth_devise', branch: '1-3-stable'
+gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
 # Our branch contains two changes
 # - Pass customer email and phone number to PayPal (merged to upstream master)
diff --git a/Gemfile.lock b/Gemfile.lock
index fd3f28abc2..2b7e656337 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -92,6 +92,18 @@ GIT
     spree_sample (1.3.99)
       spree_core (= 1.3.99)
 
+GIT
+  remote: git://github.com/openfoodfoundation/spree_auth_devise.git
+  revision: da9eecefc6fe13dedf4c6f3febec79caad839ec3
+  branch: spree-upgrade-intermediate
+  specs:
+    spree_auth_devise (2.0.0)
+      devise (~> 2.2.5)
+      devise-encryptable (= 0.1.2)
+      spree_backend (~> 1.3.6)
+      spree_core (~> 1.3.6)
+      spree_frontend (~> 1.3.6)
+
 GIT
   remote: git://github.com/spree/deface.git
   revision: 1110a1336252109bce7f98f9182042e0bc2930ae
@@ -102,17 +114,6 @@ GIT
       nokogiri (~> 1.6.0)
       rails (>= 3.1)
 
-GIT
-  remote: git://github.com/spree/spree_auth_devise.git
-  revision: ba95589a85368297c844f096c2a0c121e5b08138
-  branch: 1-3-stable
-  specs:
-    spree_auth_devise (1.3.0)
-      cancan (~> 1.6.7)
-      devise (~> 2.2.3)
-      devise-encryptable (= 0.1.2)
-      spree_core
-
 GIT
   remote: git://github.com/spree/spree_i18n.git
   revision: 752eb67204e9c5a4e22b62591a8fd55fe2285e43
@@ -193,7 +194,7 @@ GEM
       json (~> 1.4)
       nokogiri (>= 1.4.4)
       uuidtools (~> 2.1)
-    bcrypt (3.1.7)
+    bcrypt (3.1.11)
     bcrypt-ruby (3.1.5)
       bcrypt (>= 3.1.3)
     blockenspiel (0.4.5)
@@ -664,7 +665,7 @@ GEM
       actionpack (>= 3.0)
       activesupport (>= 3.0)
       railties (>= 3.0)
-    warden (1.2.3)
+    warden (1.2.6)
       rack (>= 1.0)
     webmock (1.8.11)
       addressable (>= 2.2.7)

From 2a44b190fe2420b242627e38a206f1001df82f01 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Wed, 9 Nov 2016 14:46:34 +1100
Subject: [PATCH 026/353] Use spree_paypal_express 2-0-stable pretending to be
 1.3

---
 Gemfile      | 2 +-
 Gemfile.lock | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Gemfile b/Gemfile
index b526c0f07e..9d951f292b 100644
--- a/Gemfile
+++ b/Gemfile
@@ -17,7 +17,7 @@ gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch:
 # Our branch contains two changes
 # - Pass customer email and phone number to PayPal (merged to upstream master)
 # - Change type of password from string to password to hide it in the form
-gem 'spree_paypal_express', :github => "openfoodfoundation/better_spree_paypal_express", :branch => "hide-password"
+gem 'spree_paypal_express', :github => "openfoodfoundation/better_spree_paypal_express", :branch => "spree-upgrade-intermediate"
 #gem 'spree_paypal_express', :github => "spree-contrib/better_spree_paypal_express", :branch => "1-3-stable"
 
 gem 'delayed_job_active_record'
diff --git a/Gemfile.lock b/Gemfile.lock
index 2b7e656337..ca96139ae2 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -14,12 +14,12 @@ GIT
 
 GIT
   remote: git://github.com/openfoodfoundation/better_spree_paypal_express.git
-  revision: 840d973cd5bd3250b17674a624dad494aeb09eb3
-  branch: hide-password
+  revision: 8d95f4544c682634812becaf50999fba0cd04df0
+  branch: spree-upgrade-intermediate
   specs:
     spree_paypal_express (2.0.3)
       paypal-sdk-merchant (= 1.106.1)
-      spree_core (~> 1.3.4)
+      spree_core (~> 1.3.99)
 
 GIT
   remote: git://github.com/openfoodfoundation/ofn-qz.git
@@ -678,7 +678,7 @@ GEM
       chronic (>= 0.6.3)
     wicked_pdf (1.1.0)
     wkhtmltopdf-binary (0.12.3.1)
-    xml-simple (1.1.4)
+    xml-simple (1.1.5)
     xpath (2.0.0)
       nokogiri (~> 1.3)
 

From 2c374b448ae2dd17df1065aeefb8db4bd9a91727 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 18 Nov 2016 12:00:11 +1100
Subject: [PATCH 027/353] check_authorization removed in Spree. Add load_order
 before_filter to cover our custom actions.

---
 app/controllers/spree/admin/orders_controller_decorator.rb | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/app/controllers/spree/admin/orders_controller_decorator.rb b/app/controllers/spree/admin/orders_controller_decorator.rb
index 443eda0538..e84f7217bf 100644
--- a/app/controllers/spree/admin/orders_controller_decorator.rb
+++ b/app/controllers/spree/admin/orders_controller_decorator.rb
@@ -4,11 +4,7 @@ Spree::Admin::OrdersController.class_eval do
   include OpenFoodNetwork::SpreeApiKeyLoader
   helper CheckoutHelper
   before_filter :load_spree_api_key, :only => :bulk_management
-
-  # We need to add expections for collection actions other than :index here
-  # because spree_auth_devise causes load_order to be called, which results
-  # in an auth failure as the @order object is nil for collection actions
-  before_filter :check_authorization, except: [:bulk_management, :managed]
+  before_filter :load_order, only: %i[show edit update fire resend invoice print]
 
   before_filter :load_distribution_choices, only: [:new, :edit, :update]
 

From 0a043a6919bef46313bb0b4cc704c6bdfada44e3 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 18 Nov 2016 12:13:39 +1100
Subject: [PATCH 028/353] Add permissions to :line_item resource, now called by
 Spree

---
 app/models/spree/ability_decorator.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb
index 6263c4ee51..44a8bc0961 100644
--- a/app/models/spree/ability_decorator.rb
+++ b/app/models/spree/ability_decorator.rb
@@ -1,7 +1,7 @@
 class AbilityDecorator
   include CanCan::Ability
 
-  # All abilites are allocated from this initialiser, currently in 5 chunks.
+  # All abilites are allocated from this initialiser.
   # Spree also defines other abilities.
   def initialize(user)
     add_shopping_abilities user
@@ -193,6 +193,7 @@ class AbilityDecorator
     end
     can [:admin, :bulk_management, :managed], Spree::Order if user.admin? || user.enterprises.any?(&:is_distributor)
     can [:admin , :for_line_items], Enterprise
+    can [:admin, :index, :create, :update, :destroy], :line_item
     can [:admin, :index, :create], Spree::LineItem
     can [:destroy, :update], Spree::LineItem do |item|
       order = item.order

From 73abb93737bf19b9b8a3e6dc4d74c09c4aceaec5 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 18 Nov 2016 15:46:47 +1100
Subject: [PATCH 029/353] Update Spree: Bring forward simplified version of
 Spree.t for spree_auth_devise

---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index ca96139ae2..79716ac250 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -30,7 +30,7 @@ GIT
 
 GIT
   remote: git://github.com/openfoodfoundation/spree.git
-  revision: ad9733e00935dab3f92aa37113a2472d38bd0574
+  revision: 9e40af3a3e2fe4d9a62b85e99b6fc4e2e1f67581
   branch: spree-upgrade-step-3
   specs:
     spree (1.3.99)

From 1170897587980ca1a7dd08104bcacd7de2ef680f Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 25 Nov 2016 12:55:12 +1100
Subject: [PATCH 030/353] Add our own JSON handling actions for update and
 delete. Spree no longer does this for us.

---
 .../admin/line_items_controller_decorator.rb  | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/app/controllers/spree/admin/line_items_controller_decorator.rb b/app/controllers/spree/admin/line_items_controller_decorator.rb
index 2d78fe6a1c..039b95e3c2 100644
--- a/app/controllers/spree/admin/line_items_controller_decorator.rb
+++ b/app/controllers/spree/admin/line_items_controller_decorator.rb
@@ -34,6 +34,27 @@ Spree::Admin::LineItemsController.class_eval do
     end
   end
 
+  def update
+    respond_to do |format|
+      format.html { render_order_form }
+      format.json {
+        if @line_item.update_attributes(params[:line_item])
+          render nothing: true, status: 204 # No Content, does not trigger ng resource auto-update
+        else
+          render json: {errors: @line_item.errors}, status: 412
+        end
+      }
+    end
+  end
+
+  def destroy
+    @line_item.destroy
+
+    respond_to do |format|
+      format.html { render_order_form }
+      format.json { render nothing: true, status: 204 } # No Content
+    end
+  end
 
   private
 

From 0a8e8dfbbb5db0393524fb267a09b81f4c9ac37b Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Thu, 8 Dec 2016 11:10:19 +1100
Subject: [PATCH 031/353] Add specs and fix line items HTML response

---
 .../admin/line_items_controller_decorator.rb  |  2 +-
 .../spree/admin/line_items_controller_spec.rb | 50 +++++++++++++++++--
 2 files changed, 48 insertions(+), 4 deletions(-)

diff --git a/app/controllers/spree/admin/line_items_controller_decorator.rb b/app/controllers/spree/admin/line_items_controller_decorator.rb
index 039b95e3c2..511ab1b4f6 100644
--- a/app/controllers/spree/admin/line_items_controller_decorator.rb
+++ b/app/controllers/spree/admin/line_items_controller_decorator.rb
@@ -60,7 +60,7 @@ Spree::Admin::LineItemsController.class_eval do
 
   def render_order_form
     respond_to do |format|
-      format.html { render 'spree/admin/orders/form', order: @order.reload }
+      format.html { render partial: 'spree/admin/orders/form', locals: {order: @order.reload} }
     end
   end
 
diff --git a/spec/controllers/spree/admin/line_items_controller_spec.rb b/spec/controllers/spree/admin/line_items_controller_spec.rb
index 907bec2bbb..0838e83b64 100644
--- a/spec/controllers/spree/admin/line_items_controller_spec.rb
+++ b/spec/controllers/spree/admin/line_items_controller_spec.rb
@@ -165,17 +165,29 @@ describe Spree::Admin::LineItemsController do
       end
 
       context "coordinator enterprise" do
+        render_views
+
         before do
           controller.stub spree_current_user: coordinator.owner
-          spree_put :update, params
         end
 
-        it "updates the line_item" do
+        it "updates the line item" do
+          spree_put :update, params
           line_item1.reload
           expect(line_item1.quantity).to eq 3
           expect(line_item1.final_weight_volume).to eq 3000
           expect(line_item1.price).to eq 3.00
         end
+
+        it "returns an empty JSON response" do
+          spree_put :update, params.merge(format: :json)
+          expect(response.body).to eq ' '
+        end
+
+        it "returns an HTML response with the order form" do
+          spree_put :update, params.merge(format: :html)
+          expect(response.body).to match /admin_order_form_fields/
+        end
       end
 
       context "hub enterprise" do
@@ -184,7 +196,7 @@ describe Spree::Admin::LineItemsController do
           spree_put :update, params
         end
 
-        it "retrieves a list of line_items" do
+        it "updates the line item" do
           line_item1.reload
           expect(line_item1.quantity).to eq 3
           expect(line_item1.final_weight_volume).to eq 3000
@@ -193,4 +205,36 @@ describe Spree::Admin::LineItemsController do
       end
     end
   end
+
+  describe "#destroy" do
+    render_views
+
+    let(:supplier) { create(:supplier_enterprise) }
+    let(:distributor1) { create(:distributor_enterprise) }
+    let(:coordinator) { create(:distributor_enterprise) }
+    let(:order_cycle) { create(:simple_order_cycle, coordinator: coordinator) }
+    let!(:order1) { FactoryGirl.create(:order, order_cycle: order_cycle, state: 'complete', completed_at: Time.zone.now, distributor: distributor1, billing_address: FactoryGirl.create(:address) ) }
+    let!(:line_item1) { FactoryGirl.create(:line_item, order: order1, product: FactoryGirl.create(:product, supplier: supplier)) }
+    let(:params) { { format: :json, id: line_item1.id, order_id: order1.number } }
+
+    before do
+      controller.stub spree_current_user: coordinator.owner
+    end
+
+    it "destroys the line item" do
+      expect {
+        spree_delete :destroy, params
+      }.to change { Spree::LineItem.where(id: line_item1).count }.from(1).to(0)
+    end
+
+    it "returns an empty JSON response" do
+      spree_delete :destroy, params.merge(format: :json)
+      expect(response.body).to eq ' '
+    end
+
+    it "returns an HTML response with the order form" do
+      spree_delete :destroy, params.merge(format: :html)
+      expect(response.body).to match /admin_order_form_fields/
+    end
+  end
 end

From 3ff051f238989cc1f279b1c0c1af7eb33076d52c Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Thu, 8 Dec 2016 12:59:53 +1100
Subject: [PATCH 032/353] Restore route for variant search. Fixes admin order
 product selection.

---
 app/views/spree/admin/shared/_routes.html.erb | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 app/views/spree/admin/shared/_routes.html.erb

diff --git a/app/views/spree/admin/shared/_routes.html.erb b/app/views/spree/admin/shared/_routes.html.erb
new file mode 100644
index 0000000000..b0e64466ad
--- /dev/null
+++ b/app/views/spree/admin/shared/_routes.html.erb
@@ -0,0 +1,10 @@
+<script>
+  Spree.routes = <%== {
+    :variants_search       => admin_search_variants_path(:format => 'json'),
+    :taxon_search          => spree.api_taxons_path(:format => 'json'),
+    :user_search           => spree.admin_search_users_path(:format => 'json'),
+    :product_search        => spree.search_admin_products_path(:format => 'json'),
+    :option_type_search    => spree.api_option_types_path(:format => 'json'),
+    :states_search         => spree.api_states_path(:format => 'json')
+  }.to_json %>;
+</script>

From c47af55bb966e2465499bb587212d4d46fcd9260 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Thu, 8 Dec 2016 13:08:30 +1100
Subject: [PATCH 033/353] Fix: When a user fires an event (eg. capture
 payment), take them back to where they came from

---
 .../admin/payments_controller_decorator.rb    | 34 ++++++++++++-------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/app/controllers/spree/admin/payments_controller_decorator.rb b/app/controllers/spree/admin/payments_controller_decorator.rb
index 23db5eca09..c608f8930c 100644
--- a/app/controllers/spree/admin/payments_controller_decorator.rb
+++ b/app/controllers/spree/admin/payments_controller_decorator.rb
@@ -1,21 +1,31 @@
 Spree::Admin::PaymentsController.class_eval do
-  # When a user fires an event, take them back to where they came from
-  # Responder: http://guides.spreecommerce.com/developer/logic.html#overriding-controller-action-responses
-
-  # For some strange reason, adding PaymentsController.class_eval will cause gems/spree/app/controllers/spree/admin/payments_controller.rb:37 to error:
-  #   payments_url not defined.
-  # This could be fixed by replacing line 37 with:
-  #   respond_with(@payment, location: admin_order_payments_url) { |format| format.html { redirect_to admin_order_payments_path(@order) } }
-  respond_override :fire => { :html => { :success => lambda {
-    redirect_to request.referer  # Keeps any filter and sort prefs
-  } } }
-
   append_before_filter :filter_payment_methods
 
+
+  # When a user fires an event, take them back to where they came from
+  # (we can't use respond_override because Spree no longer uses respond_with)
+  def fire
+    return unless event = params[:e] and @payment.payment_source
+
+    # Because we have a transition method also called void, we do this to avoid conflicts.
+    event = "void_transaction" if event == "void"
+    if @payment.send("#{event}!")
+      flash[:success] = t(:payment_updated)
+    else
+      flash[:error] = t(:cannot_perform_operation)
+    end
+  rescue Spree::Core::GatewayError => ge
+    flash[:error] = "#{ge.message}"
+  ensure
+    redirect_to request.referer
+  end
+
+
+  private
+
   # Only show payments for the order's distributor
   def filter_payment_methods
     @payment_methods = @payment_methods.select{ |pm| pm.has_distributor? @order.distributor}
     @payment_method ||= @payment_methods.first
   end
-
 end

From bfaaf16030dd52e37b279934d4108e693744db60 Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 23 Dec 2016 15:08:12 +1100
Subject: [PATCH 034/353] Fix spree adjustments fix that maybe never worked?

---
 app/models/spree/payment_method_decorator.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/models/spree/payment_method_decorator.rb b/app/models/spree/payment_method_decorator.rb
index 32819544ed..3b9eff2cab 100644
--- a/app/models/spree/payment_method_decorator.rb
+++ b/app/models/spree/payment_method_decorator.rb
@@ -40,7 +40,7 @@ Spree::PaymentMethod.class_eval do
 
   def init
     unless reflections.keys.include? :calculator
-      include Spree::Core::CalculatedAdjustments
+      self.class.include Spree::Core::CalculatedAdjustments
     end
 
     self.calculator ||= Spree::Calculator::FlatRate.new(preferred_amount: 0)

From ac8cfe24e64e612feab2a4f13b40bd8b5093179d Mon Sep 17 00:00:00 2001
From: Rohan Mitchell <rohan@rohanmitchell.com>
Date: Fri, 23 Dec 2016 15:10:36 +1100
Subject: [PATCH 035/353] Fix removal of producer properties - remove href attr
 so Spree doesn't attempt an XHR

---
 app/helpers/spree/admin/base_helper_decorator.rb      | 11 +++++++++++
 .../_producer_property_fields.html.haml               |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/app/helpers/spree/admin/base_helper_decorator.rb b/app/helpers/spree/admin/base_helper_decorator.rb
index 5398cee35f..c1fd1ab223 100644
--- a/app/helpers/spree/admin/base_helper_decorator.rb
+++ b/app/helpers/spree/admin/base_helper_decorator.rb
@@ -23,6 +23,17 @@ module Spree
         link_to_with_icon('icon-trash', name, '#', html_options) + f.hidden_field(:_destroy)
       end
 
+      def link_to_remove_fields_without_url(name, f, options = {})
+        name = '' if options[:no_text]
+        options[:class] = '' unless options[:class]
+        options[:class] += 'no-text with-tip' if options[:no_text]
+
+        html_options = {class: "remove_fields #{options[:class]}", data: {action: 'remove'}, title: t(:remove)}
+        html_options.merge!(options[:html]) if options.key? :html
+
+        link_to_with_icon('icon-trash', name, '#', html_options).gsub('href="#" ', '').html_safe +
+          f.hidden_field(:_destroy)
+      end
     end
   end
 end
diff --git a/app/views/admin/producer_properties/_producer_property_fields.html.haml b/app/views/admin/producer_properties/_producer_property_fields.html.haml
index 6fe0b1d7ad..65e6f1a15b 100644
--- a/app/views/admin/producer_properties/_producer_property_fields.html.haml
+++ b/app/views/admin/producer_properties/_producer_property_fields.html.haml
@@ -12,4 +12,4 @@
     = f.text_field :value, :class => 'autocomplete'
   %td.actions
     - unless @enterprise.producer_properties.empty?
-      = link_to_remove_fields t(:remove), f, no_text: true, url: (f.object.persisted? && main_app.admin_enterprise_producer_property_path(@enterprise, f.object)), html: {"onclick" => "if(typeof(enterprise_form) != 'undefined') { angular.element(enterprise_form).scope().setFormDirty() }".html_safe}
+      = link_to_remove_fields_without_url t(:remove), f, no_text: true, html: {"onclick" => "if(typeof(enterprise_form) != 'undefined') { angular.element(enterprise_form).scope().setFormDirty() }".html_safe}

From 5eb42eac3c067e2c3e18801508a31c0d58135a36 Mon Sep 17 00:00:00 2001
From: Em-AK <emilien.ak@gmail.com>
Date: Mon, 3 Apr 2017 18:06:29 +0200
Subject: [PATCH 036/353] Delete the override of a deleted field

https://github.com/openfoodfoundation/spree/compare/spree-upgrade-step1c...spree-upgrade-step-3#diff-a63d9d7f4c1375ca141931651f799956
---
 .../orders/edit/promo_cart_coupon_code_field.html.haml.deface    | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 app/overrides/spree/orders/edit/promo_cart_coupon_code_field.html.haml.deface

diff --git a/app/overrides/spree/orders/edit/promo_cart_coupon_code_field.html.haml.deface b/app/overrides/spree/orders/edit/promo_cart_coupon_code_field.html.haml.deface
deleted file mode 100644
index dca5725b49..0000000000
--- a/app/overrides/spree/orders/edit/promo_cart_coupon_code_field.html.haml.deface
+++ /dev/null
@@ -1 +0,0 @@
-/ disabled

From d68104cecb5ddf456a7e1f36158b6ffc28c9ebce Mon Sep 17 00:00:00 2001
From: Em-AK <emilien.ak@gmail.com>
Date: Mon, 3 Apr 2017 20:16:29 +0200
Subject: [PATCH 037/353] Update a dependency to run the specs

---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 79716ac250..49c003ee9b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -612,7 +612,7 @@ GEM
       unicode-display_width (~> 1.0, >= 1.0.1)
     ruby-progressbar (1.8.1)
     rubyzip (1.2.0)
-    safe_yaml (0.9.5)
+    safe_yaml (1.0.4)
     sass (3.3.14)
     sass-rails (3.2.6)
       railties (~> 3.2.0)

From f22a12d6573b1c7959994abd0180c8ccd0b4cc8f Mon Sep 17 00:00:00 2001
From: Em-AK <emilien.ak@gmail.com>
Date: Tue, 4 Apr 2017 11:41:23 +0200
Subject: [PATCH 038/353] Revert later: depend on our spree fork

---
 Gemfile      |  2 +-
 Gemfile.lock | 50 +++++++++++++++++++++++++-------------------------
 2 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/Gemfile b/Gemfile
index 9d951f292b..16c51b37b7 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'openfoodfoundation/spree', branch: 'spree-upgrade-step-3'
+gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-3'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 49c003ee9b..b25de07c89 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -7,30 +7,8 @@ GIT
       activemodel (~> 3.0)
 
 GIT
-  remote: git://github.com/jeremydurham/custom-err-msg.git
-  revision: 3a8ec9dddc7a5b0aab7c69a6060596de300c68f4
-  specs:
-    custom_error_message (1.1.1)
-
-GIT
-  remote: git://github.com/openfoodfoundation/better_spree_paypal_express.git
-  revision: 8d95f4544c682634812becaf50999fba0cd04df0
-  branch: spree-upgrade-intermediate
-  specs:
-    spree_paypal_express (2.0.3)
-      paypal-sdk-merchant (= 1.106.1)
-      spree_core (~> 1.3.99)
-
-GIT
-  remote: git://github.com/openfoodfoundation/ofn-qz.git
-  revision: 024680ccea429b2e5428d7b964fa67c52add34ec
-  specs:
-    ofn-qz (0.1.0)
-      railties (~> 3.1)
-
-GIT
-  remote: git://github.com/openfoodfoundation/spree.git
-  revision: 9e40af3a3e2fe4d9a62b85e99b6fc4e2e1f67581
+  remote: git://github.com/coopdevs/spree.git
+  revision: 60bfa21ffecafa37f9ae0e27dbb005e0f20162a6
   branch: spree-upgrade-step-3
   specs:
     spree (1.3.99)
@@ -92,6 +70,28 @@ GIT
     spree_sample (1.3.99)
       spree_core (= 1.3.99)
 
+GIT
+  remote: git://github.com/jeremydurham/custom-err-msg.git
+  revision: 3a8ec9dddc7a5b0aab7c69a6060596de300c68f4
+  specs:
+    custom_error_message (1.1.1)
+
+GIT
+  remote: git://github.com/openfoodfoundation/better_spree_paypal_express.git
+  revision: 8d95f4544c682634812becaf50999fba0cd04df0
+  branch: spree-upgrade-intermediate
+  specs:
+    spree_paypal_express (2.0.3)
+      paypal-sdk-merchant (= 1.106.1)
+      spree_core (~> 1.3.99)
+
+GIT
+  remote: git://github.com/openfoodfoundation/ofn-qz.git
+  revision: 024680ccea429b2e5428d7b964fa67c52add34ec
+  specs:
+    ofn-qz (0.1.0)
+      railties (~> 3.1)
+
 GIT
   remote: git://github.com/openfoodfoundation/spree_auth_devise.git
   revision: da9eecefc6fe13dedf4c6f3febec79caad839ec3
@@ -483,7 +483,7 @@ GEM
       i18n (~> 0.4)
       json
     multi_json (1.12.1)
-    multi_xml (0.5.5)
+    multi_xml (0.6.0)
     newrelic_rpm (3.12.0.288)
     nokogiri (1.6.8.1)
       mini_portile2 (~> 2.1.0)

From e73330d59793216f64068c8c84105ca6562dd1c8 Mon Sep 17 00:00:00 2001
From: Em-AK <emilien.ak@gmail.com>
Date: Tue, 4 Apr 2017 16:55:36 +0200
Subject: [PATCH 039/353] Fix removal of product properties

Prevent spree to make a post request on deletion of a property
The data should be updated on the server by clicking on the Update
button
---
 .../replace_link_to_remove_fields.html.haml.deface            | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 app/overrides/spree/admin/product_properties/_product_property_fields/replace_link_to_remove_fields.html.haml.deface

diff --git a/app/overrides/spree/admin/product_properties/_product_property_fields/replace_link_to_remove_fields.html.haml.deface b/app/overrides/spree/admin/product_properties/_product_property_fields/replace_link_to_remove_fields.html.haml.deface
new file mode 100644
index 0000000000..b59f15ce72
--- /dev/null
+++ b/app/overrides/spree/admin/product_properties/_product_property_fields/replace_link_to_remove_fields.html.haml.deface
@@ -0,0 +1,4 @@
+/ replace_contents "[data-hook='product_property'] .actions"
+
+- unless @product.properties.empty?
+  = link_to_remove_fields_without_url t(:remove), f, no_text: true

From 1136cb40a92cb288445d56c41e322395ae7b465a Mon Sep 17 00:00:00 2001
From: Em-AK <emilien.ak@gmail.com>
Date: Wed, 5 Apr 2017 11:13:17 +0200
Subject: [PATCH 040/353] Revert to OFN spree fork

This reverts commit 92f50d96803f9d0f302be51aad085c9a68ec4c32.
And bundle update to the last commit of openfoodfoundation/spree, branch: spree-upgrade-step-3
---
 Gemfile      |  2 +-
 Gemfile.lock | 61 ++++++++++++++++++++++++++--------------------------
 2 files changed, 31 insertions(+), 32 deletions(-)

diff --git a/Gemfile b/Gemfile
index 16c51b37b7..9d951f292b 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-3'
+gem 'spree', github: 'openfoodfoundation/spree', branch: 'spree-upgrade-step-3'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index b25de07c89..d95c210710 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -7,8 +7,30 @@ GIT
       activemodel (~> 3.0)
 
 GIT
-  remote: git://github.com/coopdevs/spree.git
-  revision: 60bfa21ffecafa37f9ae0e27dbb005e0f20162a6
+  remote: git://github.com/jeremydurham/custom-err-msg.git
+  revision: 3a8ec9dddc7a5b0aab7c69a6060596de300c68f4
+  specs:
+    custom_error_message (1.1.1)
+
+GIT
+  remote: git://github.com/openfoodfoundation/better_spree_paypal_express.git
+  revision: 8d95f4544c682634812becaf50999fba0cd04df0
+  branch: spree-upgrade-intermediate
+  specs:
+    spree_paypal_express (2.0.3)
+      paypal-sdk-merchant (= 1.106.1)
+      spree_core (~> 1.3.99)
+
+GIT
+  remote: git://github.com/openfoodfoundation/ofn-qz.git
+  revision: 024680ccea429b2e5428d7b964fa67c52add34ec
+  specs:
+    ofn-qz (0.1.0)
+      railties (~> 3.1)
+
+GIT
+  remote: git://github.com/openfoodfoundation/spree.git
+  revision: 20915c4dc9738392a236265f2e571b709e2d1c9f
   branch: spree-upgrade-step-3
   specs:
     spree (1.3.99)
@@ -70,28 +92,6 @@ GIT
     spree_sample (1.3.99)
       spree_core (= 1.3.99)
 
-GIT
-  remote: git://github.com/jeremydurham/custom-err-msg.git
-  revision: 3a8ec9dddc7a5b0aab7c69a6060596de300c68f4
-  specs:
-    custom_error_message (1.1.1)
-
-GIT
-  remote: git://github.com/openfoodfoundation/better_spree_paypal_express.git
-  revision: 8d95f4544c682634812becaf50999fba0cd04df0
-  branch: spree-upgrade-intermediate
-  specs:
-    spree_paypal_express (2.0.3)
-      paypal-sdk-merchant (= 1.106.1)
-      spree_core (~> 1.3.99)
-
-GIT
-  remote: git://github.com/openfoodfoundation/ofn-qz.git
-  revision: 024680ccea429b2e5428d7b964fa67c52add34ec
-  specs:
-    ofn-qz (0.1.0)
-      railties (~> 3.1)
-
 GIT
   remote: git://github.com/openfoodfoundation/spree_auth_devise.git
   revision: da9eecefc6fe13dedf4c6f3febec79caad839ec3
@@ -215,8 +215,7 @@ GEM
       timers (~> 1.1.0)
     chronic (0.10.2)
     chunky_png (1.3.4)
-    climate_control (0.0.3)
-      activesupport (>= 3.0)
+    climate_control (0.1.0)
     cliver (0.3.2)
     cocaine (0.5.8)
       climate_control (>= 0.0.3, < 1.0)
@@ -449,7 +448,7 @@ GEM
     jquery-rails (2.2.2)
       railties (>= 3.0, < 5.0)
       thor (>= 0.14, < 2.0)
-    json (1.8.3)
+    json (1.8.6)
     json_spec (1.1.1)
       multi_json (~> 1.0)
       rspec (~> 2.0)
@@ -528,7 +527,7 @@ GEM
       activesupport (>= 2.3.14)
       multi_json (~> 1.0)
     rack (1.4.7)
-    rack-cache (1.6.1)
+    rack-cache (1.7.0)
       rack (>= 0.4)
     rack-livereload (0.3.15)
       rack
@@ -557,7 +556,7 @@ GEM
     rainbow (2.2.2)
       rake
     raindrops (0.13.0)
-    rake (11.3.0)
+    rake (12.0.0)
     ransack (0.7.2)
       actionpack (~> 3.0)
       activerecord (~> 3.0)
@@ -635,7 +634,7 @@ GEM
     therubyracer (0.12.0)
       libv8 (~> 3.16.14.0)
       ref
-    thor (0.19.1)
+    thor (0.19.4)
     tilt (1.4.1)
     timecop (0.8.1)
     timers (1.1.0)
@@ -648,7 +647,7 @@ GEM
       sprockets (>= 2.0.0)
     turn (0.8.3)
       ansi
-    tzinfo (0.3.52)
+    tzinfo (0.3.53)
     uglifier (2.7.1)
       execjs (>= 0.3.0)
       json (>= 1.8.0)

From 513330cfffc5fa6ce48c78961e8fed72b3519979 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Wed, 5 Apr 2017 14:23:18 +0200
Subject: [PATCH 041/353] Add JSON api for products clone

---
 .../admin/products_controller_decorator.rb    |  4 --
 .../api/products_controller_decorator.rb      | 11 ++++++
 config/routes.rb                              |  1 +
 .../spree/api/products_controller_spec.rb     | 38 +++++++++++++++++++
 4 files changed, 50 insertions(+), 4 deletions(-)

diff --git a/app/controllers/spree/admin/products_controller_decorator.rb b/app/controllers/spree/admin/products_controller_decorator.rb
index 7929aa1df6..59c4cd3069 100644
--- a/app/controllers/spree/admin/products_controller_decorator.rb
+++ b/app/controllers/spree/admin/products_controller_decorator.rb
@@ -8,9 +8,6 @@ Spree::Admin::ProductsController.class_eval do
   before_filter :load_spree_api_key, :only => [:bulk_edit, :variant_overrides]
   before_filter :strip_new_properties, only: [:create, :update]
 
-
-  respond_to :json, :only => :clone
-
   respond_override create: { html: {
     success: lambda {
       if params[:button] == "add_another"
@@ -22,7 +19,6 @@ Spree::Admin::ProductsController.class_eval do
     failure: lambda {
       render :new
     } } }
-  #respond_override :clone => { :json => {:success => lambda { redirect_to bulk_index_admin_products_url+"?q[id_eq]=#{@new.id}" } } }
 
   def product_distributions
   end
diff --git a/app/controllers/spree/api/products_controller_decorator.rb b/app/controllers/spree/api/products_controller_decorator.rb
index e809dbc23e..ee3cc9e70b 100644
--- a/app/controllers/spree/api/products_controller_decorator.rb
+++ b/app/controllers/spree/api/products_controller_decorator.rb
@@ -37,6 +37,17 @@ Spree::Api::ProductsController.class_eval do
     respond_with(@product, :status => 204)
   end
 
+  # POST /api/products/:product_id/clone
+  #
+  def clone
+    authorize! :create, Spree::Product
+    original_product = find_product(params[:product_id])
+    authorize! :update, original_product
+
+    @product = original_product.duplicate
+
+    respond_with(@product, status: 201, default_template: :show)
+  end
 
   private
 
diff --git a/config/routes.rb b/config/routes.rb
index 52b23758ab..02c459cea0 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -237,6 +237,7 @@ Spree::Core::Engine.routes.prepend do
         get :overridable
       end
       delete :soft_delete
+      post :clone
 
       resources :variants do
         delete :soft_delete
diff --git a/spec/controllers/spree/api/products_controller_spec.rb b/spec/controllers/spree/api/products_controller_spec.rb
index 312c6a29b4..1969a0abaf 100644
--- a/spec/controllers/spree/api/products_controller_spec.rb
+++ b/spec/controllers/spree/api/products_controller_spec.rb
@@ -107,5 +107,43 @@ module Spree
         product1.deleted_at.should_not be_nil
       end
     end
+
+    describe '#clone' do
+      before do
+        spree_post :clone, product_id: product1.id, format: :json
+      end
+
+      context 'as a normal user' do
+        sign_in_as_user!
+
+        it 'denies access' do
+          assert_unauthorized!
+        end
+      end
+
+      context 'as an enterprise user' do
+        sign_in_as_enterprise_user! [:supplier]
+
+        it 'responds with a successful response' do
+          expect(response.status).to eq(201)
+        end
+
+        it 'clones the product' do
+          expect(json_response['name']).to eq("COPY OF #{product1.name}")
+        end
+      end
+
+      context 'as an administrator' do
+        sign_in_as_admin!
+
+        it 'responds with a successful response' do
+          expect(response.status).to eq(201)
+        end
+
+        it 'clones the product' do
+          expect(json_response['name']).to eq("COPY OF #{product1.name}")
+        end
+      end
+    end
   end
 end

From c9920959597d02473ff6491967b39e82867aecb3 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Wed, 5 Apr 2017 14:23:47 +0200
Subject: [PATCH 042/353] Use new /clone JSON endpoint

---
 .../admin/services/bulk_products.js.coffee           | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/app/assets/javascripts/admin/services/bulk_products.js.coffee b/app/assets/javascripts/admin/services/bulk_products.js.coffee
index 4e06a87bd2..0d2de5ce77 100644
--- a/app/assets/javascripts/admin/services/bulk_products.js.coffee
+++ b/app/assets/javascripts/admin/services/bulk_products.js.coffee
@@ -1,4 +1,4 @@
-angular.module("ofn.admin").factory "BulkProducts", (PagedFetcher, dataFetcher) ->
+angular.module("ofn.admin").factory "BulkProducts", (PagedFetcher, dataFetcher, $http) ->
   new class BulkProducts
     products: []
 
@@ -11,14 +11,8 @@ angular.module("ofn.admin").factory "BulkProducts", (PagedFetcher, dataFetcher)
       PagedFetcher.fetch url, (data) => @addProducts data.products
 
     cloneProduct: (product) ->
-      dataFetcher("/admin/products/" + product.permalink_live + "/clone.json").then (data) =>
-        # Ideally we would use Spree's built in respond_override helper here to redirect the
-        # user after a successful clone with .json in the accept headers
-        # However, at the time of writing there appears to be an issue which causes the
-        # respond_with block in the destroy action of Spree::Admin::Product to break
-        # when a respond_overrride for the clone action is used.
-        id = data.product.id
-        dataFetcher("/api/products/" + id + "?template=bulk_show").then (newProduct) =>
+      $http.post("/api/products/" + product.id + "/clone").success (data) =>
+        dataFetcher("/api/products/" + data.id + "?template=bulk_show").then (newProduct) =>
           @unpackProduct newProduct
           @insertProductAfter(product, newProduct)
 

From 31f2551116d50c69304905ab05817a551bea5e82 Mon Sep 17 00:00:00 2001
From: Em-AK <emilien.ak@gmail.com>
Date: Thu, 6 Apr 2017 12:23:14 +0200
Subject: [PATCH 043/353] Update the JS unit spec to the new endpoint

---
 Gemfile.lock                                       |  2 +-
 .../admin/services/bulk_products_spec.js.coffee    | 14 ++++----------
 2 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index d95c210710..f9181e6a0a 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -556,7 +556,7 @@ GEM
     rainbow (2.2.2)
       rake
     raindrops (0.13.0)
-    rake (12.0.0)
+    rake (10.5.0)
     ransack (0.7.2)
       actionpack (~> 3.0)
       activerecord (~> 3.0)
diff --git a/spec/javascripts/unit/admin/services/bulk_products_spec.js.coffee b/spec/javascripts/unit/admin/services/bulk_products_spec.js.coffee
index 7d4c5d1d7c..fc46c2a30d 100644
--- a/spec/javascripts/unit/admin/services/bulk_products_spec.js.coffee
+++ b/spec/javascripts/unit/admin/services/bulk_products_spec.js.coffee
@@ -38,18 +38,14 @@ describe "BulkProducts service", ->
 
 
   describe "cloning products", ->
-    it "clones products using a http get request to /admin/products/(permalink)/clone.json", ->
+    it "clones products using a http post request to /api/products/(id)/clone", ->
       BulkProducts.products = [
         id: 13
-        permalink_live: "oranges"
       ]
-      $httpBackend.expectGET("/admin/products/oranges/clone.json").respond 200,
-        product:
-          id: 17
-          name: "new_product"
+      $httpBackend.expectPOST("/api/products/13/clone").respond 201,
+        id: 17
       $httpBackend.expectGET("/api/products/17?template=bulk_show").respond 200, [
         id: 17
-        name: "new_product"
       ]
       BulkProducts.cloneProduct BulkProducts.products[0]
       $httpBackend.flush()
@@ -57,15 +53,13 @@ describe "BulkProducts service", ->
     it "adds the product", ->
       originalProduct =
         id: 16
-        permalink_live: "oranges"
       clonedProduct =
         id: 17
 
       spyOn(BulkProducts, "insertProductAfter")
       spyOn(BulkProducts, "unpackProduct")
       BulkProducts.products = [originalProduct]
-      $httpBackend.expectGET("/admin/products/oranges/clone.json").respond 200,
-        product: clonedProduct
+      $httpBackend.expectPOST("/api/products/16/clone").respond 201, clonedProduct
       $httpBackend.expectGET("/api/products/17?template=bulk_show").respond 200, clonedProduct
       BulkProducts.cloneProduct BulkProducts.products[0]
       $httpBackend.flush()

From 8a42b606eb61b3c08235fcabdff84865afab101b Mon Sep 17 00:00:00 2001
From: Em-AK <emilien.ak@gmail.com>
Date: Thu, 6 Apr 2017 10:48:03 +0200
Subject: [PATCH 044/353] Start spree upgrade step 4

---
 Gemfile      |  2 +-
 Gemfile.lock | 74 ++++++++++++++++++++++++++--------------------------
 2 files changed, 38 insertions(+), 38 deletions(-)

diff --git a/Gemfile b/Gemfile
index 9d951f292b..0aa2a2fbe9 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'openfoodfoundation/spree', branch: 'spree-upgrade-step-3'
+gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-4'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index f9181e6a0a..674487c6c7 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -7,31 +7,9 @@ GIT
       activemodel (~> 3.0)
 
 GIT
-  remote: git://github.com/jeremydurham/custom-err-msg.git
-  revision: 3a8ec9dddc7a5b0aab7c69a6060596de300c68f4
-  specs:
-    custom_error_message (1.1.1)
-
-GIT
-  remote: git://github.com/openfoodfoundation/better_spree_paypal_express.git
-  revision: 8d95f4544c682634812becaf50999fba0cd04df0
-  branch: spree-upgrade-intermediate
-  specs:
-    spree_paypal_express (2.0.3)
-      paypal-sdk-merchant (= 1.106.1)
-      spree_core (~> 1.3.99)
-
-GIT
-  remote: git://github.com/openfoodfoundation/ofn-qz.git
-  revision: 024680ccea429b2e5428d7b964fa67c52add34ec
-  specs:
-    ofn-qz (0.1.0)
-      railties (~> 3.1)
-
-GIT
-  remote: git://github.com/openfoodfoundation/spree.git
-  revision: 20915c4dc9738392a236265f2e571b709e2d1c9f
-  branch: spree-upgrade-step-3
+  remote: git://github.com/coopdevs/spree.git
+  revision: f60e40a5f148f669dedd63e17812290d38b45a48
+  branch: spree-upgrade-step-4
   specs:
     spree (1.3.99)
       spree_api (= 1.3.99)
@@ -59,17 +37,17 @@ GIT
       actionmailer (~> 3.2.9)
       activemerchant (~> 1.50.0)
       activerecord (~> 3.2.9)
-      acts_as_list (= 0.1.4)
-      awesome_nested_set (= 2.1.4)
+      acts_as_list (= 0.1.9)
+      awesome_nested_set (= 2.1.5)
       aws-sdk (~> 1.11.1)
       cancan (= 1.6.8)
       deface (>= 0.9.0)
       ffaker (~> 1.15.0)
-      highline (= 1.6.11)
+      highline (= 1.6.15)
       httparty (= 0.9.0)
       json (>= 1.5.5)
       kaminari (= 0.13.0)
-      money (= 5.0.0)
+      money (= 5.1.0)
       paperclip (~> 3.0)
       rails (~> 3.2.13)
       railties (~> 3.2.9)
@@ -83,7 +61,7 @@ GIT
       spree_frontend (= 1.3.99)
     spree_frontend (1.3.99)
       deface (>= 0.9.0)
-      jquery-rails (~> 2.2.0)
+      jquery-rails (~> 2.2.1)
       rails (~> 3.2.8)
       select2-rails (~> 3.2)
       spree_api (= 1.3.99)
@@ -92,6 +70,28 @@ GIT
     spree_sample (1.3.99)
       spree_core (= 1.3.99)
 
+GIT
+  remote: git://github.com/jeremydurham/custom-err-msg.git
+  revision: 3a8ec9dddc7a5b0aab7c69a6060596de300c68f4
+  specs:
+    custom_error_message (1.1.1)
+
+GIT
+  remote: git://github.com/openfoodfoundation/better_spree_paypal_express.git
+  revision: 8d95f4544c682634812becaf50999fba0cd04df0
+  branch: spree-upgrade-intermediate
+  specs:
+    spree_paypal_express (2.0.3)
+      paypal-sdk-merchant (= 1.106.1)
+      spree_core (~> 1.3.99)
+
+GIT
+  remote: git://github.com/openfoodfoundation/ofn-qz.git
+  revision: 024680ccea429b2e5428d7b964fa67c52add34ec
+  specs:
+    ofn-qz (0.1.0)
+      railties (~> 3.1)
+
 GIT
   remote: git://github.com/openfoodfoundation/spree_auth_devise.git
   revision: da9eecefc6fe13dedf4c6f3febec79caad839ec3
@@ -174,7 +174,7 @@ GEM
       multi_json (~> 1.0)
     acts-as-taggable-on (3.5.0)
       activerecord (>= 3.2, < 5)
-    acts_as_list (0.1.4)
+    acts_as_list (0.1.9)
     addressable (2.4.0)
     andand (1.3.3)
     angular-rails-templates (0.2.0)
@@ -187,7 +187,7 @@ GEM
     arel (3.0.3)
     ast (2.3.0)
     atomic (1.1.99)
-    awesome_nested_set (2.1.4)
+    awesome_nested_set (2.1.5)
       activerecord (>= 3.0.0)
     awesome_print (1.0.2)
     aws-sdk (1.11.1)
@@ -429,7 +429,7 @@ GEM
       rspec (~> 2.14)
     haml (4.0.4)
       tilt
-    highline (1.6.11)
+    highline (1.6.15)
     hike (1.2.3)
     http_parser.rb (0.5.3)
     httparty (0.9.0)
@@ -478,9 +478,8 @@ GEM
     mini_portile2 (2.1.0)
     momentjs-rails (2.5.1)
       railties (>= 3.1)
-    money (5.0.0)
-      i18n (~> 0.4)
-      json
+    money (5.1.0)
+      i18n (~> 0.6.0)
     multi_json (1.12.1)
     multi_xml (0.6.0)
     newrelic_rpm (3.12.0.288)
@@ -593,8 +592,9 @@ GEM
     rspec-expectations (2.14.0)
       diff-lcs (>= 1.1.3, < 2.0)
     rspec-mocks (2.14.2)
-    rspec-rails (2.14.0)
+    rspec-rails (2.14.2)
       actionpack (>= 3.0)
+      activemodel (>= 3.0)
       activesupport (>= 3.0)
       railties (>= 3.0)
       rspec-core (~> 2.14.0)

From b5bac722cadd1cb66bf349656885ec650d6570a9 Mon Sep 17 00:00:00 2001
From: Em-AK <emilien.ak@gmail.com>
Date: Thu, 6 Apr 2017 11:13:25 +0200
Subject: [PATCH 045/353] Fix: make rspec run

---
 spec/spec_helper.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 22c4a026ff..e24d2a7cf7 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -28,7 +28,7 @@ require 'spree/testing_support/capybara_ext'
 require 'spree/api/testing_support/setup'
 require 'spree/api/testing_support/helpers'
 require 'spree/api/testing_support/helpers_decorator'
-require 'spree/core/testing_support/authorization_helpers'
+require 'spree/testing_support/authorization_helpers'
 
 # Capybara config
 require 'capybara/poltergeist'

From a9966f48af28a0b859bf14c7d4272919c2068618 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Thu, 6 Apr 2017 11:48:39 +0200
Subject: [PATCH 046/353] Use new product_search method

---
 app/views/spree/admin/shared/_routes.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/spree/admin/shared/_routes.html.erb b/app/views/spree/admin/shared/_routes.html.erb
index b0e64466ad..e4d1cf1502 100644
--- a/app/views/spree/admin/shared/_routes.html.erb
+++ b/app/views/spree/admin/shared/_routes.html.erb
@@ -3,7 +3,7 @@
     :variants_search       => admin_search_variants_path(:format => 'json'),
     :taxon_search          => spree.api_taxons_path(:format => 'json'),
     :user_search           => spree.admin_search_users_path(:format => 'json'),
-    :product_search        => spree.search_admin_products_path(:format => 'json'),
+    :product_search        => spree.api_products_path(:format => 'json'),
     :option_type_search    => spree.api_option_types_path(:format => 'json'),
     :states_search         => spree.api_states_path(:format => 'json')
   }.to_json %>;

From 5ad0f8bb2e7cfc6e21e07ed50fbd36afdd9abaf5 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Thu, 6 Apr 2017 11:57:52 +0200
Subject: [PATCH 047/353] Fix module namespace

---
 spec/features/admin/overview_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/features/admin/overview_spec.rb b/spec/features/admin/overview_spec.rb
index 30f2cc0336..31591349c7 100644
--- a/spec/features/admin/overview_spec.rb
+++ b/spec/features/admin/overview_spec.rb
@@ -5,8 +5,8 @@ feature %q{
   I want to be given information about the state of my enterprises, products and order cycles
 }, js: true do
   include AuthenticationWorkflow
-  include AuthorizationHelpers
   include WebHelper
+  include ::Spree::TestingSupport::AuthorizationHelpers
 
   context "as an enterprise user" do
     before do

From d2b6a47ae48c45443956e9a1b8851927822da139 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Thu, 6 Apr 2017 12:13:54 +0200
Subject: [PATCH 048/353] Use new #available_to_order API

---
 app/models/spree/shipping_method_decorator.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/models/spree/shipping_method_decorator.rb b/app/models/spree/shipping_method_decorator.rb
index 29e6e2c46a..453c1fadf2 100644
--- a/app/models/spree/shipping_method_decorator.rb
+++ b/app/models/spree/shipping_method_decorator.rb
@@ -42,8 +42,8 @@ Spree::ShippingMethod.class_eval do
     ]
   end
 
-  def available_to_order_with_distributor_check?(order, display_on=nil)
-    available_to_order_without_distributor_check?(order, display_on) &&
+  def available_to_order_with_distributor_check?(order)
+    available_to_order_without_distributor_check?(order) &&
       self.distributors.include?(order.distributor)
   end
   alias_method_chain :available_to_order?, :distributor_check

From a80d75e7e2d33eef1f1ab788fdf196e95d3b2331 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Thu, 6 Apr 2017 13:09:54 +0200
Subject: [PATCH 049/353] Fix Spree taxons route reference

---
 app/views/spree/admin/shared/_routes.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/spree/admin/shared/_routes.html.erb b/app/views/spree/admin/shared/_routes.html.erb
index e4d1cf1502..27957a3466 100644
--- a/app/views/spree/admin/shared/_routes.html.erb
+++ b/app/views/spree/admin/shared/_routes.html.erb
@@ -1,7 +1,7 @@
 <script>
   Spree.routes = <%== {
     :variants_search       => admin_search_variants_path(:format => 'json'),
-    :taxon_search          => spree.api_taxons_path(:format => 'json'),
+    :taxons_search         => spree.api_taxons_path(:format => 'json'),
     :user_search           => spree.admin_search_users_path(:format => 'json'),
     :product_search        => spree.api_products_path(:format => 'json'),
     :option_type_search    => spree.api_option_types_path(:format => 'json'),

From c439a23ef9d21d6022d31d0ee803e6cd0db244c0 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Thu, 6 Apr 2017 14:23:01 +0200
Subject: [PATCH 050/353] Adapt CheckoutController to new Spree changes

Freely inspired by https://github.com/openfoodfoundation/spree/commit/ad5551bf846e94d641f5620d15bf7b28cb835d24
---
 app/controllers/checkout_controller.rb | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index e002a7c723..62b8608409 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -26,9 +26,7 @@ class CheckoutController < Spree::CheckoutController
           return if redirect_to_paypal_express_form_if_needed
         end
 
-        if advance_order_state(@order)
-          state_callback(:after)
-        else
+        unless advance_order_state(@order)
           if @order.errors.present?
             flash[:error] = @order.errors.full_messages.to_sentence
           else
@@ -154,7 +152,7 @@ class CheckoutController < Spree::CheckoutController
     raise_insufficient_quantity and return if @order.insufficient_stock_lines.present?
     redirect_to main_app.shop_path and return if @order.completed?
     before_address
-    state_callback(:before)
+    setup_for_current_state
   end
 
   def before_address

From 6817ac0d79b71a3a3430b655282abfd475e37f87 Mon Sep 17 00:00:00 2001
From: Em-AK <emilien.ak@gmail.com>
Date: Fri, 7 Apr 2017 06:33:00 +0200
Subject: [PATCH 051/353] Regenerate knapsack report on my slow machine

---
 knapsack_rspec_report.json | 430 +++++++++++++++++++------------------
 1 file changed, 219 insertions(+), 211 deletions(-)

diff --git a/knapsack_rspec_report.json b/knapsack_rspec_report.json
index 5d71fa12e2..8b7e7a0084 100644
--- a/knapsack_rspec_report.json
+++ b/knapsack_rspec_report.json
@@ -1,213 +1,221 @@
 {
-  "spec/controllers/admin/accounts_and_billing_settings_controller_spec.rb": 4.729289770126343,
-  "spec/controllers/admin/business_model_configuration_controller_spec.rb": 0.3204472064971924,
-  "spec/controllers/admin/column_preferences_controller_spec.rb": 0.21457862854003906,
-  "spec/controllers/admin/customers_controller_spec.rb": 1.2570579051971436,
-  "spec/controllers/admin/enterprises_controller_spec.rb": 6.453823804855347,
-  "spec/controllers/admin/inventory_items_controller_spec.rb": 3.3494999408721924,
-  "spec/controllers/admin/order_cycles_controller_spec.rb": 3.2418012619018555,
-  "spec/controllers/admin/tag_rules_controller_spec.rb": 0.278639554977417,
-  "spec/controllers/admin/variant_overrides_controller_spec.rb": 4.334253549575806,
-  "spec/controllers/api/enterprises_controller_spec.rb": 0.4233386516571045,
-  "spec/controllers/api/order_cycles_controller_spec.rb": 1.9799659252166748,
-  "spec/controllers/api/statuses_controller_spec.rb": 0.0580599308013916,
-  "spec/controllers/base_controller_spec.rb": 0.025392770767211914,
-  "spec/controllers/cart_controller_spec.rb": 1.188997507095337,
-  "spec/controllers/checkout_controller_spec.rb": 1.7111992835998535,
-  "spec/controllers/enterprise_confirmations_controller_spec.rb": 1.057147741317749,
-  "spec/controllers/enterprises_controller_spec.rb": 3.9115149974823,
-  "spec/controllers/groups_controller_spec.rb": 0.4256296157836914,
-  "spec/controllers/registration_controller_spec.rb": 0.1444110870361328,
-  "spec/controllers/shop_controller_spec.rb": 2.8928422927856445,
-  "spec/controllers/shops_controller_spec.rb": 0.23369908332824707,
-  "spec/controllers/spree/admin/adjustments_controller_spec.rb": 1.0890753269195557,
-  "spec/controllers/spree/admin/base_controller_spec.rb": 0.1624138355255127,
-  "spec/controllers/spree/admin/line_items_controller_spec.rb": 16.208045721054077,
-  "spec/controllers/spree/admin/orders_controller_spec.rb": 15.907819509506226,
-  "spec/controllers/spree/admin/overview_controller_spec.rb": 0.8662476539611816,
-  "spec/controllers/spree/admin/payment_methods_controller_spec.rb": 0.4896993637084961,
-  "spec/controllers/spree/admin/products_controller_spec.rb": 2.074070930480957,
-  "spec/controllers/spree/admin/reports_controller_spec.rb": 55.07741975784302,
-  "spec/controllers/spree/admin/search_controller_spec.rb": 0.5158224105834961,
-  "spec/controllers/spree/admin/variants_controller_spec.rb": 1.990790605545044,
-  "spec/controllers/spree/api/line_items_controller_spec.rb": 0.3319206237792969,
-  "spec/controllers/spree/api/products_controller_spec.rb": 6.679011106491089,
-  "spec/controllers/spree/api/variants_controller_spec.rb": 3.7782905101776123,
-  "spec/controllers/spree/checkout_controller_spec.rb": 0.9790353775024414,
-  "spec/controllers/spree/orders_controller_spec.rb": 4.158925294876099,
-  "spec/controllers/spree/paypal_controller_spec.rb": 0.020407676696777344,
-  "spec/controllers/spree/store_controller_spec.rb": 0.03319215774536133,
-  "spec/controllers/spree/user_sessions_controller_spec.rb": 0.07898402214050293,
-  "spec/controllers/user_passwords_controller_spec.rb": 0.717381477355957,
-  "spec/controllers/user_registrations_controller_spec.rb": 0.2160170078277588,
-  "spec/features/admin/account_spec.rb": 0.2934560775756836,
-  "spec/features/admin/accounts_and_billing_settings_spec.rb": 15.889720678329468,
-  "spec/features/admin/adjustments_spec.rb": 5.175323009490967,
-  "spec/features/admin/authentication_spec.rb": 18.345781087875366,
-  "spec/features/admin/bulk_order_management_spec.rb": 111.50722217559814,
-  "spec/features/admin/bulk_product_update_spec.rb": 63.564337730407715,
-  "spec/features/admin/business_model_configuration_spec.rb": 2.1073272228240967,
-  "spec/features/admin/caching_spec.rb": 0.8505651950836182,
-  "spec/features/admin/content_spec.rb": 1.1712932586669922,
-  "spec/features/admin/customers_spec.rb": 71.91736245155334,
-  "spec/features/admin/enterprise_fees_spec.rb": 15.482876300811768,
-  "spec/features/admin/enterprise_groups_spec.rb": 8.615704774856567,
-  "spec/features/admin/enterprise_relationships_spec.rb": 11.908889293670654,
-  "spec/features/admin/enterprise_roles_spec.rb": 5.027954578399658,
-  "spec/features/admin/enterprise_user_spec.rb": 2.158304214477539,
-  "spec/features/admin/enterprises/index_spec.rb": 5.7792346477508545,
-  "spec/features/admin/enterprises_spec.rb": 39.01360893249512,
-  "spec/features/admin/external_services_spec.rb": 0.41648149490356445,
-  "spec/features/admin/image_settings_spec.rb": 0.4291551113128662,
-  "spec/features/admin/order_cycles_spec.rb": 66.84531092643738,
-  "spec/features/admin/orders_spec.rb": 50.86089587211609,
-  "spec/features/admin/overview_spec.rb": 4.884965896606445,
-  "spec/features/admin/payment_method_spec.rb": 14.099174499511719,
-  "spec/features/admin/products_spec.rb": 17.05465793609619,
-  "spec/features/admin/reports_spec.rb": 142.85665917396545,
-  "spec/features/admin/shipping_methods_spec.rb": 6.785600900650024,
-  "spec/features/admin/tag_rules_spec.rb": 21.80374526977539,
-  "spec/features/admin/tax_settings_spec.rb": 0.5856199264526367,
-  "spec/features/admin/variant_overrides_spec.rb": 54.87969517707825,
-  "spec/features/admin/variants_spec.rb": 4.425906658172607,
-  "spec/features/consumer/account_spec.rb": 14.138294458389282,
-  "spec/features/consumer/authentication_spec.rb": 15.800535440444946,
-  "spec/features/consumer/external_services_spec.rb": 0.47263646125793457,
-  "spec/features/consumer/groups_spec.rb": 2.167065143585205,
-  "spec/features/consumer/producers_spec.rb": 8.219613790512085,
-  "spec/features/consumer/registration_spec.rb": 3.2899246215820312,
-  "spec/features/consumer/shopping/cart_spec.rb": 7.931907653808594,
-  "spec/features/consumer/shopping/checkout_auth_spec.rb": 10.027384042739868,
-  "spec/features/consumer/shopping/checkout_spec.rb": 60.93560552597046,
-  "spec/features/consumer/shopping/shopping_spec.rb": 64.26991128921509,
-  "spec/features/consumer/shopping/variant_overrides_spec.rb": 71.18549585342407,
-  "spec/features/consumer/shops_spec.rb": 12.581299543380737,
-  "spec/helpers/admin/business_model_configuration_helper_spec.rb": 0.4121088981628418,
-  "spec/helpers/checkout_helper_spec.rb": 0.017447471618652344,
-  "spec/helpers/enterprises_helper_spec.rb": 3.16050124168396,
-  "spec/helpers/groups_helper_spec.rb": 0.008687734603881836,
-  "spec/helpers/html_helper_spec.rb": 0.12075495719909668,
-  "spec/helpers/injection_helper_spec.rb": 13.099636316299438,
-  "spec/helpers/navigation_helper_spec.rb": 0.037546634674072266,
-  "spec/helpers/order_cycles_helper_spec.rb": 0.5602025985717773,
-  "spec/helpers/products_helper_spec.rb": 0.009445667266845703,
-  "spec/helpers/shared_helper_spec.rb": 0.021656036376953125,
-  "spec/helpers/shop_helper_spec.rb": 0.06465697288513184,
-  "spec/jobs/confirm_order_job_spec.rb": 0.04894542694091797,
-  "spec/jobs/confirm_signup_job_spec.rb": 0.15027284622192383,
-  "spec/jobs/finalize_account_invoices_spec.rb": 4.740641832351685,
-  "spec/jobs/heartbeat_job_spec.rb": 0.020777225494384766,
-  "spec/jobs/order_cycle_notification_job_spec.rb": 2.3326029777526855,
-  "spec/jobs/products_cache_integrity_checker_job_spec.rb": 2.176734685897827,
-  "spec/jobs/refresh_products_cache_job_spec.rb": 0.14060688018798828,
-  "spec/jobs/update_account_invoices_spec.rb": 18.77696418762207,
-  "spec/jobs/update_billable_periods_spec.rb": 5.19831395149231,
-  "spec/jobs/welcome_enterprise_job_spec.rb": 0.05716228485107422,
-  "spec/lib/open_food_network/bulk_coop_report_spec.rb": 5.522400140762329,
-  "spec/lib/open_food_network/cached_products_renderer_spec.rb": 0.0779104232788086,
-  "spec/lib/open_food_network/customers_report_spec.rb": 2.789498805999756,
-  "spec/lib/open_food_network/distribution_change_validator_spec.rb": 0.12454366683959961,
-  "spec/lib/open_food_network/enterprise_fee_applicator_spec.rb": 1.0582823753356934,
-  "spec/lib/open_food_network/enterprise_fee_calculator_spec.rb": 9.390950918197632,
-  "spec/lib/open_food_network/enterprise_injection_data_spec.rb": 0.30153727531433105,
-  "spec/lib/open_food_network/enterprise_issue_validator_spec.rb": 0.09757637977600098,
-  "spec/lib/open_food_network/feature_toggle_spec.rb": 0.011552810668945312,
-  "spec/lib/open_food_network/group_buy_report_spec.rb": 4.40512228012085,
-  "spec/lib/open_food_network/last_used_address_spec.rb": 0.4271695613861084,
-  "spec/lib/open_food_network/lettuce_share_report_spec.rb": 2.5144362449645996,
-  "spec/lib/open_food_network/option_value_namer_spec.rb": 0.47345566749572754,
-  "spec/lib/open_food_network/order_and_distributor_report_spec.rb": 1.1131298542022705,
-  "spec/lib/open_food_network/order_cycle_form_applicator_spec.rb": 7.482408761978149,
-  "spec/lib/open_food_network/order_cycle_management_report_spec.rb": 2.9279346466064453,
-  "spec/lib/open_food_network/order_cycle_permissions_spec.rb": 27.034855365753174,
-  "spec/lib/open_food_network/order_grouper_spec.rb": 0.0347137451171875,
-  "spec/lib/open_food_network/orders_and_fulfillments_report_spec.rb": 6.190460443496704,
-  "spec/lib/open_food_network/packing_report_spec.rb": 5.795913934707642,
-  "spec/lib/open_food_network/permissions_spec.rb": 9.981389284133911,
-  "spec/lib/open_food_network/products_and_inventory_report_spec.rb": 4.536849737167358,
-  "spec/lib/open_food_network/products_cache_refreshment_spec.rb": 0.3400561809539795,
-  "spec/lib/open_food_network/products_cache_spec.rb": 13.676804304122925,
-  "spec/lib/open_food_network/products_renderer_spec.rb": 5.883910894393921,
-  "spec/lib/open_food_network/property_merge_spec.rb": 0.28261804580688477,
-  "spec/lib/open_food_network/referer_parser_spec.rb": 0.016553640365600586,
-  "spec/lib/open_food_network/reports/report_spec.rb": 0.027279138565063477,
-  "spec/lib/open_food_network/reports/row_spec.rb": 0.004057884216308594,
-  "spec/lib/open_food_network/reports/rule_spec.rb": 0.018927812576293945,
-  "spec/lib/open_food_network/sales_tax_report_spec.rb": 0.1267712116241455,
-  "spec/lib/open_food_network/scope_variant_to_hub_spec.rb": 5.346986532211304,
-  "spec/lib/open_food_network/tag_rule_applicator_spec.rb": 2.972744941711426,
-  "spec/lib/open_food_network/user_balance_calculator_spec.rb": 6.290127754211426,
-  "spec/lib/open_food_network/users_and_enterprises_report_spec.rb": 0.435042142868042,
-  "spec/lib/open_food_network/xero_invoices_report_spec.rb": 1.327892780303955,
-  "spec/lib/spree/product_filters_spec.rb": 0.14480209350585938,
-  "spec/mailers/enterprise_mailer_spec.rb": 1.2255680561065674,
-  "spec/mailers/order_mailer_spec.rb": 1.9922146797180176,
-  "spec/mailers/producer_mailer_spec.rb": 28.504019021987915,
-  "spec/mailers/user_mailer_spec.rb": 0.06116366386413574,
-  "spec/models/adjustment_metadata_spec.rb": 0.22940421104431152,
-  "spec/models/billable_period_spec.rb": 5.919523477554321,
-  "spec/models/calculator/weight_spec.rb": 0.011056900024414062,
-  "spec/models/cart_spec.rb": 4.7867491245269775,
-  "spec/models/column_preference_spec.rb": 0.12476158142089844,
-  "spec/models/content_configuration_spec.rb": 0.0069255828857421875,
-  "spec/models/coordinator_fee_spec.rb": 0.1413099765777588,
-  "spec/models/customer_spec.rb": 0.9213364124298096,
-  "spec/models/enterprise_caching_spec.rb": 0.8015868663787842,
-  "spec/models/enterprise_fee_spec.rb": 3.8326468467712402,
-  "spec/models/enterprise_group_spec.rb": 0.35931992530822754,
-  "spec/models/enterprise_relationship_spec.rb": 7.324019908905029,
-  "spec/models/enterprise_spec.rb": 20.723163843154907,
-  "spec/models/exchange_fee_spec.rb": 0.24502134323120117,
-  "spec/models/exchange_spec.rb": 15.133025646209717,
-  "spec/models/inventory_item_spec.rb": 0.2637319564819336,
-  "spec/models/model_set_spec.rb": 0.2381300926208496,
-  "spec/models/order_cycle_spec.rb": 19.834176540374756,
-  "spec/models/producer_property_spec.rb": 0.12196111679077148,
-  "spec/models/product_distribution_spec.rb": 2.8120880126953125,
-  "spec/models/spree/ability_spec.rb": 16.657139778137207,
-  "spec/models/spree/addresses_spec.rb": 0.06702327728271484,
-  "spec/models/spree/adjustment_spec.rb": 13.998104333877563,
-  "spec/models/spree/classification_spec.rb": 0.7607810497283936,
-  "spec/models/spree/image_spec.rb": 2.1546812057495117,
-  "spec/models/spree/line_item_spec.rb": 18.319732189178467,
-  "spec/models/spree/option_type_spec.rb": 0.38923072814941406,
-  "spec/models/spree/option_value_spec.rb": 0.4280354976654053,
-  "spec/models/spree/order_populator_spec.rb": 1.4095511436462402,
-  "spec/models/spree/order_spec.rb": 9.809221029281616,
-  "spec/models/spree/payment_method_spec.rb": 0.5280671119689941,
-  "spec/models/spree/payment_spec.rb": 2.4764130115509033,
-  "spec/models/spree/preference_spec.rb": 0.059625864028930664,
-  "spec/models/spree/preferences/file_configuration_spec.rb": 0.038376808166503906,
-  "spec/models/spree/price_spec.rb": 0.5022625923156738,
-  "spec/models/spree/product_property_spec.rb": 0.3601999282836914,
-  "spec/models/spree/product_spec.rb": 16.564993381500244,
-  "spec/models/spree/property_spec.rb": 1.6884117126464844,
-  "spec/models/spree/shipping_method_spec.rb": 2.2080821990966797,
-  "spec/models/spree/tax_rate_spec.rb": 0.37114739418029785,
-  "spec/models/spree/taxon_spec.rb": 1.0655884742736816,
-  "spec/models/spree/user_spec.rb": 16.094335317611694,
-  "spec/models/spree/variant_spec.rb": 14.885905027389526,
-  "spec/models/tag_rule/filter_order_cycles_spec.rb": 0.21634840965270996,
-  "spec/models/tag_rule/filter_payment_methods_spec.rb": 0.4332749843597412,
-  "spec/models/tag_rule/filter_products_spec.rb": 0.21471834182739258,
-  "spec/models/tag_rule/filter_shipping_methods_spec.rb": 0.3680458068847656,
-  "spec/models/tag_rule_spec.rb": 0.05348682403564453,
-  "spec/models/variant_override_spec.rb": 5.598196029663086,
-  "spec/performance/injection_helper_spec.rb": 4.83400297164917,
-  "spec/performance/orders_controller_spec.rb": 0.028135061264038086,
-  "spec/performance/shop_controller_spec.rb": 14.35703420639038,
-  "spec/requests/large_request_spec.rb": 0.024456262588500977,
-  "spec/requests/shop_spec.rb": 1.0987565517425537,
-  "spec/serializers/admin/customer_serializer_spec.rb": 0.0909874439239502,
-  "spec/serializers/admin/enterprise_serializer_spec.rb": 0.06178736686706543,
-  "spec/serializers/admin/exchange_serializer_spec.rb": 2.586963653564453,
-  "spec/serializers/admin/for_order_cycle/enterprise_serializer_spec.rb": 0.8507771492004395,
-  "spec/serializers/admin/for_order_cycle/supplied_product_serializer_spec.rb": 0.6380510330200195,
-  "spec/serializers/admin/index_enterprise_serializer_spec.rb": 0.19609999656677246,
-  "spec/serializers/admin/variant_override_serializer_spec.rb": 0.27136850357055664,
-  "spec/serializers/enterprise_serializer_spec.rb": 0.22696876525878906,
-  "spec/serializers/order_serializer_spec.rb": 1.3858006000518799,
-  "spec/serializers/orders_by_distributor_serializer_spec.rb": 3.6581554412841797,
-  "spec/serializers/spree/product_serializer_spec.rb": 0.17654776573181152,
-  "spec/serializers/spree/variant_serializer_spec.rb": 0.2116224765777588
+  "spec/controllers/admin/accounts_and_billing_settings_controller_spec.rb": 8.00712776184082,
+  "spec/controllers/admin/business_model_configuration_controller_spec.rb": 0.6013796329498291,
+  "spec/controllers/admin/column_preferences_controller_spec.rb": 0.6397809982299805,
+  "spec/controllers/admin/customers_controller_spec.rb": 1.770902156829834,
+  "spec/controllers/admin/enterprises_controller_spec.rb": 12.199191331863403,
+  "spec/controllers/admin/inventory_items_controller_spec.rb": 6.397810935974121,
+  "spec/controllers/admin/order_cycles_controller_spec.rb": 5.024861812591553,
+  "spec/controllers/admin/tag_rules_controller_spec.rb": 0.5270967483520508,
+  "spec/controllers/admin/variant_overrides_controller_spec.rb": 7.399488925933838,
+  "spec/controllers/api/enterprises_controller_spec.rb": 0.42368054389953613,
+  "spec/controllers/api/order_cycles_controller_spec.rb": 3.215219259262085,
+  "spec/controllers/api/statuses_controller_spec.rb": 0.06884050369262695,
+  "spec/controllers/base_controller_spec.rb": 0.03565478324890137,
+  "spec/controllers/cart_controller_spec.rb": 1.8274929523468018,
+  "spec/controllers/checkout_controller_spec.rb": 2.7706351280212402,
+  "spec/controllers/enterprise_confirmations_controller_spec.rb": 1.4932606220245361,
+  "spec/controllers/enterprises_controller_spec.rb": 6.069838762283325,
+  "spec/controllers/groups_controller_spec.rb": 0.6966016292572021,
+  "spec/controllers/registration_controller_spec.rb": 0.16758990287780762,
+  "spec/controllers/shop_controller_spec.rb": 5.656877517700195,
+  "spec/controllers/shops_controller_spec.rb": 0.9992175102233887,
+  "spec/controllers/spree/admin/adjustments_controller_spec.rb": 1.6936447620391846,
+  "spec/controllers/spree/admin/base_controller_spec.rb": 0.27201366424560547,
+  "spec/controllers/spree/admin/line_items_controller_spec.rb": 32.69303798675537,
+  "spec/controllers/spree/admin/orders_controller_spec.rb": 23.98875856399536,
+  "spec/controllers/spree/admin/overview_controller_spec.rb": 1.6584975719451904,
+  "spec/controllers/spree/admin/payment_methods_controller_spec.rb": 0.6059751510620117,
+  "spec/controllers/spree/admin/products_controller_spec.rb": 2.822031021118164,
+  "spec/controllers/spree/admin/reports_controller_spec.rb": 97.03786563873291,
+  "spec/controllers/spree/admin/search_controller_spec.rb": 2.2991843223571777,
+  "spec/controllers/spree/admin/variants_controller_spec.rb": 2.7615997791290283,
+  "spec/controllers/spree/api/line_items_controller_spec.rb": 0.519737720489502,
+  "spec/controllers/spree/api/products_controller_spec.rb": 15.634222030639648,
+  "spec/controllers/spree/api/variants_controller_spec.rb": 6.291322231292725,
+  "spec/controllers/spree/checkout_controller_spec.rb": 0.7929987907409668,
+  "spec/controllers/spree/orders_controller_spec.rb": 7.134824752807617,
+  "spec/controllers/spree/paypal_controller_spec.rb": 0.03331351280212402,
+  "spec/controllers/spree/store_controller_spec.rb": 0.05157065391540527,
+  "spec/controllers/spree/user_sessions_controller_spec.rb": 0.1207573413848877,
+  "spec/controllers/user_passwords_controller_spec.rb": 0.5991458892822266,
+  "spec/controllers/user_registrations_controller_spec.rb": 0.378939151763916,
+  "spec/features/admin/account_spec.rb": 0.9386508464813232,
+  "spec/features/admin/accounts_and_billing_settings_spec.rb": 21.184889793395996,
+  "spec/features/admin/adjustments_spec.rb": 8.66775107383728,
+  "spec/features/admin/authentication_spec.rb": 25.82377004623413,
+  "spec/features/admin/bulk_order_management_spec.rb": 164.24249410629272,
+  "spec/features/admin/bulk_product_update_spec.rb": 90.47183227539062,
+  "spec/features/admin/business_model_configuration_spec.rb": 2.6363422870635986,
+  "spec/features/admin/caching_spec.rb": 1.2790143489837646,
+  "spec/features/admin/content_spec.rb": 1.8612418174743652,
+  "spec/features/admin/customers_spec.rb": 56.48403525352478,
+  "spec/features/admin/enterprise_fees_spec.rb": 20.162436962127686,
+  "spec/features/admin/enterprise_groups_spec.rb": 11.802961111068726,
+  "spec/features/admin/enterprise_relationships_spec.rb": 15.264024496078491,
+  "spec/features/admin/enterprise_roles_spec.rb": 6.748473167419434,
+  "spec/features/admin/enterprise_user_spec.rb": 3.581881523132324,
+  "spec/features/admin/enterprises/index_spec.rb": 8.482917070388794,
+  "spec/features/admin/enterprises_spec.rb": 49.892003297805786,
+  "spec/features/admin/external_services_spec.rb": 0.6888332366943359,
+  "spec/features/admin/image_settings_spec.rb": 0.7543714046478271,
+  "spec/features/admin/order_cycles_spec.rb": 96.08795166015625,
+  "spec/features/admin/orders_spec.rb": 68.66088509559631,
+  "spec/features/admin/overview_spec.rb": 5.806450366973877,
+  "spec/features/admin/payment_method_spec.rb": 16.470131158828735,
+  "spec/features/admin/product_import_spec.rb": 35.73773694038391,
+  "spec/features/admin/products_spec.rb": 22.878377199172974,
+  "spec/features/admin/reports_spec.rb": 156.537535905838,
+  "spec/features/admin/shipping_methods_spec.rb": 9.275840759277344,
+  "spec/features/admin/tag_rules_spec.rb": 28.019567728042603,
+  "spec/features/admin/tax_settings_spec.rb": 0.8582248687744141,
+  "spec/features/admin/variant_overrides_spec.rb": 68.96011137962341,
+  "spec/features/admin/variants_spec.rb": 7.299575567245483,
+  "spec/features/consumer/account_spec.rb": 17.58187508583069,
+  "spec/features/consumer/authentication_spec.rb": 16.81424307823181,
+  "spec/features/consumer/external_services_spec.rb": 0.6560425758361816,
+  "spec/features/consumer/groups_spec.rb": 8.783919095993042,
+  "spec/features/consumer/producers_spec.rb": 13.732691049575806,
+  "spec/features/consumer/registration_spec.rb": 39.105244636535645,
+  "spec/features/consumer/shopping/cart_spec.rb": 10.158715724945068,
+  "spec/features/consumer/shopping/checkout_auth_spec.rb": 11.223945617675781,
+  "spec/features/consumer/shopping/checkout_spec.rb": 90.94879722595215,
+  "spec/features/consumer/shopping/shopping_spec.rb": 78.30096817016602,
+  "spec/features/consumer/shopping/variant_overrides_spec.rb": 83.33234310150146,
+  "spec/features/consumer/shops_spec.rb": 25.136919498443604,
+  "spec/features/consumer/sitemap_spec.rb": 0.12806296348571777,
+  "spec/helpers/admin/business_model_configuration_helper_spec.rb": 2.4084229469299316,
+  "spec/helpers/checkout_helper_spec.rb": 0.11321282386779785,
+  "spec/helpers/enterprises_helper_spec.rb": 4.312507390975952,
+  "spec/helpers/groups_helper_spec.rb": 0.012323379516601562,
+  "spec/helpers/html_helper_spec.rb": 0.06277966499328613,
+  "spec/helpers/injection_helper_spec.rb": 18.53943371772766,
+  "spec/helpers/navigation_helper_spec.rb": 0.06260061264038086,
+  "spec/helpers/order_cycles_helper_spec.rb": 0.7225909233093262,
+  "spec/helpers/products_helper_spec.rb": 0.010187149047851562,
+  "spec/helpers/shared_helper_spec.rb": 0.027238845825195312,
+  "spec/helpers/shop_helper_spec.rb": 0.08263945579528809,
+  "spec/jobs/confirm_order_job_spec.rb": 0.054292917251586914,
+  "spec/jobs/confirm_signup_job_spec.rb": 0.025557994842529297,
+  "spec/jobs/finalize_account_invoices_spec.rb": 6.124559640884399,
+  "spec/jobs/heartbeat_job_spec.rb": 0.025922060012817383,
+  "spec/jobs/order_cycle_notification_job_spec.rb": 3.4907965660095215,
+  "spec/jobs/products_cache_integrity_checker_job_spec.rb": 0.7591326236724854,
+  "spec/jobs/refresh_products_cache_job_spec.rb": 0.14359831809997559,
+  "spec/jobs/update_account_invoices_spec.rb": 25.14212441444397,
+  "spec/jobs/update_billable_periods_spec.rb": 7.548252820968628,
+  "spec/jobs/welcome_enterprise_job_spec.rb": 0.07267236709594727,
+  "spec/lib/open_food_network/bulk_coop_report_spec.rb": 6.935410737991333,
+  "spec/lib/open_food_network/cached_products_renderer_spec.rb": 0.1050572395324707,
+  "spec/lib/open_food_network/customers_report_spec.rb": 3.6295740604400635,
+  "spec/lib/open_food_network/distribution_change_validator_spec.rb": 0.16306090354919434,
+  "spec/lib/open_food_network/enterprise_fee_applicator_spec.rb": 1.435694932937622,
+  "spec/lib/open_food_network/enterprise_fee_calculator_spec.rb": 13.101191759109497,
+  "spec/lib/open_food_network/enterprise_injection_data_spec.rb": 0.5890538692474365,
+  "spec/lib/open_food_network/enterprise_issue_validator_spec.rb": 0.12314796447753906,
+  "spec/lib/open_food_network/feature_toggle_spec.rb": 0.01638960838317871,
+  "spec/lib/open_food_network/group_buy_report_spec.rb": 7.850870132446289,
+  "spec/lib/open_food_network/last_used_address_spec.rb": 0.03868246078491211,
+  "spec/lib/open_food_network/lettuce_share_report_spec.rb": 4.304181098937988,
+  "spec/lib/open_food_network/option_value_namer_spec.rb": 0.09165167808532715,
+  "spec/lib/open_food_network/order_and_distributor_report_spec.rb": 1.9102568626403809,
+  "spec/lib/open_food_network/order_cycle_form_applicator_spec.rb": 10.645771026611328,
+  "spec/lib/open_food_network/order_cycle_management_report_spec.rb": 3.786757469177246,
+  "spec/lib/open_food_network/order_cycle_permissions_spec.rb": 37.860092639923096,
+  "spec/lib/open_food_network/order_grouper_spec.rb": 0.046637773513793945,
+  "spec/lib/open_food_network/orders_and_fulfillments_report_spec.rb": 8.23448920249939,
+  "spec/lib/open_food_network/packing_report_spec.rb": 7.166008949279785,
+  "spec/lib/open_food_network/permissions_spec.rb": 14.218589782714844,
+  "spec/lib/open_food_network/products_and_inventory_report_spec.rb": 6.037408828735352,
+  "spec/lib/open_food_network/products_cache_refreshment_spec.rb": 0.43891096115112305,
+  "spec/lib/open_food_network/products_cache_spec.rb": 20.597163438796997,
+  "spec/lib/open_food_network/products_renderer_spec.rb": 8.173654317855835,
+  "spec/lib/open_food_network/property_merge_spec.rb": 0.4074442386627197,
+  "spec/lib/open_food_network/referer_parser_spec.rb": 0.0202939510345459,
+  "spec/lib/open_food_network/reports/report_spec.rb": 0.03491067886352539,
+  "spec/lib/open_food_network/reports/row_spec.rb": 0.00494694709777832,
+  "spec/lib/open_food_network/reports/rule_spec.rb": 0.02185201644897461,
+  "spec/lib/open_food_network/sales_tax_report_spec.rb": 0.2910194396972656,
+  "spec/lib/open_food_network/scope_variant_to_hub_spec.rb": 7.502454519271851,
+  "spec/lib/open_food_network/tag_rule_applicator_spec.rb": 3.9437036514282227,
+  "spec/lib/open_food_network/user_balance_calculator_spec.rb": 10.744928121566772,
+  "spec/lib/open_food_network/users_and_enterprises_report_spec.rb": 0.5333633422851562,
+  "spec/lib/open_food_network/xero_invoices_report_spec.rb": 1.6665534973144531,
+  "spec/lib/spree/product_filters_spec.rb": 0.17748093605041504,
+  "spec/mailers/enterprise_mailer_spec.rb": 0.44661855697631836,
+  "spec/mailers/order_mailer_spec.rb": 2.8625006675720215,
+  "spec/mailers/producer_mailer_spec.rb": 38.360108375549316,
+  "spec/mailers/user_mailer_spec.rb": 0.07233500480651855,
+  "spec/models/adjustment_metadata_spec.rb": 0.2955667972564697,
+  "spec/models/billable_period_spec.rb": 7.409304141998291,
+  "spec/models/calculator/flat_percent_per_item_spec.rb": 0.011715412139892578,
+  "spec/models/calculator/weight_spec.rb": 0.013759613037109375,
+  "spec/models/cart_spec.rb": 7.489097833633423,
+  "spec/models/column_preference_spec.rb": 0.12457847595214844,
+  "spec/models/content_configuration_spec.rb": 0.005526542663574219,
+  "spec/models/coordinator_fee_spec.rb": 0.1765611171722412,
+  "spec/models/customer_spec.rb": 0.7244162559509277,
+  "spec/models/enterprise_caching_spec.rb": 5.130070209503174,
+  "spec/models/enterprise_fee_spec.rb": 5.398890018463135,
+  "spec/models/enterprise_group_spec.rb": 0.4309041500091553,
+  "spec/models/enterprise_relationship_spec.rb": 11.179081439971924,
+  "spec/models/enterprise_spec.rb": 28.993456602096558,
+  "spec/models/exchange_fee_spec.rb": 0.31769680976867676,
+  "spec/models/exchange_spec.rb": 23.51863121986389,
+  "spec/models/inventory_item_spec.rb": 0.35733699798583984,
+  "spec/models/model_set_spec.rb": 1.2280616760253906,
+  "spec/models/order_cycle_spec.rb": 28.214235305786133,
+  "spec/models/producer_property_spec.rb": 3.207193613052368,
+  "spec/models/product_distribution_spec.rb": 4.137674570083618,
+  "spec/models/product_importer_spec.rb": 0.1319897174835205,
+  "spec/models/spree/ability_spec.rb": 23.034581184387207,
+  "spec/models/spree/addresses_spec.rb": 0.08480358123779297,
+  "spec/models/spree/adjustment_spec.rb": 19.734310150146484,
+  "spec/models/spree/calculator/flat_percent_item_total_spec.rb": 0.011153221130371094,
+  "spec/models/spree/calculator/flexi_rate_spec.rb": 0.016460657119750977,
+  "spec/models/spree/calculator/per_item_spec.rb": 0.006463527679443359,
+  "spec/models/spree/calculator/price_sack_spec.rb": 0.006432294845581055,
+  "spec/models/spree/classification_spec.rb": 0.8814013004302979,
+  "spec/models/spree/image_spec.rb": 3.7731142044067383,
+  "spec/models/spree/line_item_spec.rb": 24.783292293548584,
+  "spec/models/spree/option_type_spec.rb": 1.5399932861328125,
+  "spec/models/spree/option_value_spec.rb": 0.6168241500854492,
+  "spec/models/spree/order_populator_spec.rb": 1.8702630996704102,
+  "spec/models/spree/order_spec.rb": 13.248756647109985,
+  "spec/models/spree/payment_method_spec.rb": 0.5306015014648438,
+  "spec/models/spree/payment_spec.rb": 2.695707082748413,
+  "spec/models/spree/preference_spec.rb": 0.07149314880371094,
+  "spec/models/spree/preferences/file_configuration_spec.rb": 0.04694247245788574,
+  "spec/models/spree/price_spec.rb": 0.9263966083526611,
+  "spec/models/spree/product_property_spec.rb": 0.5712625980377197,
+  "spec/models/spree/product_spec.rb": 24.63173007965088,
+  "spec/models/spree/property_spec.rb": 9.745300054550171,
+  "spec/models/spree/shipping_method_spec.rb": 2.9844515323638916,
+  "spec/models/spree/tax_rate_spec.rb": 0.4417886734008789,
+  "spec/models/spree/taxon_spec.rb": 2.0731396675109863,
+  "spec/models/spree/user_spec.rb": 22.796449184417725,
+  "spec/models/spree/variant_spec.rb": 22.682554483413696,
+  "spec/models/tag_rule/filter_order_cycles_spec.rb": 0.2527964115142822,
+  "spec/models/tag_rule/filter_payment_methods_spec.rb": 0.36441707611083984,
+  "spec/models/tag_rule/filter_products_spec.rb": 0.249955415725708,
+  "spec/models/tag_rule/filter_shipping_methods_spec.rb": 1.038332462310791,
+  "spec/models/tag_rule_spec.rb": 0.06748843193054199,
+  "spec/models/variant_override_spec.rb": 7.998929977416992,
+  "spec/performance/injection_helper_spec.rb": 10.3869309425354,
+  "spec/performance/orders_controller_spec.rb": 0.029515743255615234,
+  "spec/performance/shop_controller_spec.rb": 20.927804470062256,
+  "spec/requests/large_request_spec.rb": 0.026319265365600586,
+  "spec/requests/shop_spec.rb": 1.9282338619232178,
+  "spec/serializers/admin/customer_serializer_spec.rb": 0.25053882598876953,
+  "spec/serializers/admin/enterprise_serializer_spec.rb": 0.07662534713745117,
+  "spec/serializers/admin/exchange_serializer_spec.rb": 4.449889421463013,
+  "spec/serializers/admin/for_order_cycle/enterprise_serializer_spec.rb": 1.3775944709777832,
+  "spec/serializers/admin/for_order_cycle/supplied_product_serializer_spec.rb": 0.6928744316101074,
+  "spec/serializers/admin/index_enterprise_serializer_spec.rb": 0.22203683853149414,
+  "spec/serializers/admin/variant_override_serializer_spec.rb": 0.3394124507904053,
+  "spec/serializers/enterprise_serializer_spec.rb": 0.8813695907592773,
+  "spec/serializers/order_serializer_spec.rb": 1.798943281173706,
+  "spec/serializers/orders_by_distributor_serializer_spec.rb": 5.19302225112915,
+  "spec/serializers/spree/product_serializer_spec.rb": 0.24654531478881836,
+  "spec/serializers/spree/variant_serializer_spec.rb": 0.8831884860992432
 }
\ No newline at end of file

From a87c89c83db9e54c58ea43e5b273d2906669c624 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Wed, 12 Apr 2017 15:41:10 +0200
Subject: [PATCH 052/353] Require authentication for API endpoints

Authentication and authorization layers (cancan) should not be mixed
https://github.com/openfoodfoundation/spree/commit/c594d6111b0c7e4fafe03b548748049bf5a7b28a
---
 config/initializers/spree.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/config/initializers/spree.rb b/config/initializers/spree.rb
index f439e779cf..af5d7f8245 100644
--- a/config/initializers/spree.rb
+++ b/config/initializers/spree.rb
@@ -13,6 +13,8 @@ require 'spree/core/calculated_adjustments_decorator'
 require "#{Rails.root}/app/models/spree/payment_method_decorator"
 require "#{Rails.root}/app/models/spree/gateway_decorator"
 
+Spree::Api::Config[:requires_authentication] = true
+
 Spree.config do |config|
   config.shipping_instructions = true
   config.address_requires_state = true

From d8c227c43fc6a3fb06256cc919562616f74afc61 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Thu, 13 Apr 2017 10:17:20 +0200
Subject: [PATCH 053/353] Import data migration from latest
 spree_paypal_express gem

---
 ..._rename_payment_methods.spree_paypal_express.rb | 14 ++++++++++++++
 db/schema.rb                                       |  2 +-
 2 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 db/migrate/20170413074528_rename_payment_methods.spree_paypal_express.rb

diff --git a/db/migrate/20170413074528_rename_payment_methods.spree_paypal_express.rb b/db/migrate/20170413074528_rename_payment_methods.spree_paypal_express.rb
new file mode 100644
index 0000000000..2c426824d8
--- /dev/null
+++ b/db/migrate/20170413074528_rename_payment_methods.spree_paypal_express.rb
@@ -0,0 +1,14 @@
+# This migration comes from spree_paypal_express (originally 20140117051315)
+class RenamePaymentMethods < ActiveRecord::Migration
+  def up
+    execute <<-SQL
+      update spree_payment_methods set type = 'Spree::Gateway::PayPalExpress' WHERE type = 'Spree::BillingIntegration::PaypalExpress'
+    SQL
+  end
+
+  def down
+    execute <<-SQL
+      update spree_payment_methods set type = 'Spree::BillingIntegration::PaypalExpress' WHERE type = 'Spree::Gateway::PayPalExpress'
+    SQL
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index c0583e5f54..4ed6d5f342 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended to check this file into your version control system.
 
-ActiveRecord::Schema.define(:version => 20161215230219) do
+ActiveRecord::Schema.define(:version => 20170413074528) do
 
   create_table "account_invoices", :force => true do |t|
     t.integer  "user_id",    :null => false

From a70cdaadb699e1da7c87f0e8f4e7a0093ef76fac Mon Sep 17 00:00:00 2001
From: Em-AK <emilien.ak@gmail.com>
Date: Wed, 12 Apr 2017 17:39:46 +0200
Subject: [PATCH 054/353] Start spree upgrade step 5

---
 Gemfile      | 2 +-
 Gemfile.lock | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile b/Gemfile
index 0aa2a2fbe9..b714a91050 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-4'
+gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-5'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 674487c6c7..ebb9980dd1 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,8 +8,8 @@ GIT
 
 GIT
   remote: git://github.com/coopdevs/spree.git
-  revision: f60e40a5f148f669dedd63e17812290d38b45a48
-  branch: spree-upgrade-step-4
+  revision: e3c6244684310d0096a84c1b5ff1a3f53a47a58d
+  branch: spree-upgrade-step-5
   specs:
     spree (1.3.99)
       spree_api (= 1.3.99)

From e7ecdcc25136da7180c9f5409eaf3f252692bbd1 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Thu, 13 Apr 2017 10:35:25 +0200
Subject: [PATCH 055/353] Import schema migration for spree gem upgrade step 5

---
 ...3148_add_tracking_url_to_spree_shipping_methods.spree.rb | 6 ++++++
 db/schema.rb                                                | 3 ++-
 2 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 db/migrate/20170413083148_add_tracking_url_to_spree_shipping_methods.spree.rb

diff --git a/db/migrate/20170413083148_add_tracking_url_to_spree_shipping_methods.spree.rb b/db/migrate/20170413083148_add_tracking_url_to_spree_shipping_methods.spree.rb
new file mode 100644
index 0000000000..28a9807184
--- /dev/null
+++ b/db/migrate/20170413083148_add_tracking_url_to_spree_shipping_methods.spree.rb
@@ -0,0 +1,6 @@
+# This migration comes from spree (originally 20130301205200)
+class AddTrackingUrlToSpreeShippingMethods < ActiveRecord::Migration
+  def change
+    add_column :spree_shipping_methods, :tracking_url, :string
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 4ed6d5f342..b62bd45c04 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended to check this file into your version control system.
 
-ActiveRecord::Schema.define(:version => 20170413074528) do
+ActiveRecord::Schema.define(:version => 20170413083148) do
 
   create_table "account_invoices", :force => true do |t|
     t.integer  "user_id",    :null => false
@@ -870,6 +870,7 @@ ActiveRecord::Schema.define(:version => 20170413074528) do
     t.datetime "deleted_at"
     t.boolean  "require_ship_address", :default => true
     t.text     "description"
+    t.string   "tracking_url"
   end
 
   create_table "spree_skrill_transactions", :force => true do |t|

From fd259e0a63d81a62530a13e0869d26b05263361a Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Thu, 13 Apr 2017 15:56:50 +0200
Subject: [PATCH 056/353] Use cherry-picked commit in spree fork from the
 future :rocket:

https://github.com/openfoodfoundation/spree/commit/2aee282d6d73e32f84392846a5edbec006621e65
---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index ebb9980dd1..54b7e9f204 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,7 +8,7 @@ GIT
 
 GIT
   remote: git://github.com/coopdevs/spree.git
-  revision: e3c6244684310d0096a84c1b5ff1a3f53a47a58d
+  revision: ff96a88494c0f0d13e06cc620a2b90372f52c8d7
   branch: spree-upgrade-step-5
   specs:
     spree (1.3.99)

From 4e35c0448b77d0395192b0d918badec45cde5ae2 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Wed, 19 Apr 2017 14:09:14 +0200
Subject: [PATCH 057/353] Use the state machine API to add state transition
 callbacks

See the following links for more context:
http://guides.spreecommerce.org/release_notes/spree_2_0_0.html#removal-of-checkoutcontrollerstatecallback
https://github.com/Em-AK/openfoodnetwork/commit/1d9581c884055e1557cd847d6403759379fb0d73
---
 app/controllers/checkout_controller.rb |  8 --------
 app/models/spree/order_decorator.rb    | 11 +++++++++++
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 62b8608409..5432ef8b2a 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -170,14 +170,6 @@ class CheckoutController < Spree::CheckoutController
     @order.ship_address ||= customer_preferred_ship_address || preferred_ship_address || last_used_ship_address || Spree::Address.default
   end
 
-  def after_payment
-    # object_params sets the payment amount to the order total, but it does this before
-    # the shipping method is set. This results in the customer not being charged for their
-    # order's shipping. To fix this, we refresh the payment amount here.
-    @order.update_totals
-    @order.payments.first.update_attribute :amount, @order.total
-  end
-
   # Overriding Spree's methods
   def raise_insufficient_quantity
     respond_to do |format|
diff --git a/app/models/spree/order_decorator.rb b/app/models/spree/order_decorator.rb
index 2eff1faa54..9ed6c30733 100644
--- a/app/models/spree/order_decorator.rb
+++ b/app/models/spree/order_decorator.rb
@@ -349,4 +349,15 @@ Spree::Order.class_eval do
     adjustment.update!(self)
     adjustment.locked = locked
   end
+
+  # object_params sets the payment amount to the order total, but it does this before
+  # the shipping method is set. This results in the customer not being charged for their
+  # order's shipping. To fix this, we refresh the payment amount here.
+  def charge_shipping!
+    update_totals
+    return unless payments.any?
+    payments.first.update_attribute :amount, total
+  end
 end
+
+Spree::Order.state_machine.after_transition to: :payment, do: :charge_shipping!

From 22b54312797a7869e7e554c20c7bcb017ab14e2f Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Wed, 19 Apr 2017 15:46:38 +0200
Subject: [PATCH 058/353] Start spree upgrade step 6

---
 Gemfile      | 2 +-
 Gemfile.lock | 7 ++-----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/Gemfile b/Gemfile
index b714a91050..32983d2b8e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-5'
+gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-6'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 54b7e9f204..e430414f2d 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,8 +8,8 @@ GIT
 
 GIT
   remote: git://github.com/coopdevs/spree.git
-  revision: ff96a88494c0f0d13e06cc620a2b90372f52c8d7
-  branch: spree-upgrade-step-5
+  revision: 93337acbee00dd3f5702c6dd1f668112f3809400
+  branch: spree-upgrade-step-6
   specs:
     spree (1.3.99)
       spree_api (= 1.3.99)
@@ -34,9 +34,7 @@ GIT
     spree_cmd (1.3.99)
       thor (>= 0.14.6)
     spree_core (1.3.99)
-      actionmailer (~> 3.2.9)
       activemerchant (~> 1.50.0)
-      activerecord (~> 3.2.9)
       acts_as_list (= 0.1.9)
       awesome_nested_set (= 2.1.5)
       aws-sdk (~> 1.11.1)
@@ -50,7 +48,6 @@ GIT
       money (= 5.1.0)
       paperclip (~> 3.0)
       rails (~> 3.2.13)
-      railties (~> 3.2.9)
       ransack (= 0.7.2)
       state_machine (= 1.2.0)
       stringex (~> 1.3.2)

From cf4bd8d7551ade7eecf76445d9ce2de6deebb001 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Wed, 19 Apr 2017 17:31:14 +0200
Subject: [PATCH 059/353] WIP Preparing to get rid of MailMethod model

Please give a look at the following links:
 - http://guides.spreecommerce.org/release_notes/spree_2_0_0.html#mailmethod-model-no-longer-exists
 - https://github.com/spree/spree/pull/2643
---
 spec/controllers/spree/admin/orders_controller_spec.rb | 6 ++++++
 spec/mailers/order_mailer_spec.rb                      | 4 ++++
 spec/mailers/producer_mailer_spec.rb                   | 6 ++++++
 spec/models/spree/order_spec.rb                        | 7 +++++++
 4 files changed, 23 insertions(+)

diff --git a/spec/controllers/spree/admin/orders_controller_spec.rb b/spec/controllers/spree/admin/orders_controller_spec.rb
index 5ecc393dab..60bdf9a3d9 100644
--- a/spec/controllers/spree/admin/orders_controller_spec.rb
+++ b/spec/controllers/spree/admin/orders_controller_spec.rb
@@ -179,6 +179,12 @@ describe Spree::Admin::OrdersController do
 
         context "when the distributor's ABN has been set" do
           before { distributor.update_attribute(:abn, "123") }
+          before do
+            Spree::MailMethod.create!(
+              environment: Rails.env,
+              preferred_mails_from: 'spree@example.com'
+            )
+          end
           it "should allow me to send order invoices" do
             expect do
               spree_get :invoice, params
diff --git a/spec/mailers/order_mailer_spec.rb b/spec/mailers/order_mailer_spec.rb
index 6e88742fe7..18e864f7cd 100644
--- a/spec/mailers/order_mailer_spec.rb
+++ b/spec/mailers/order_mailer_spec.rb
@@ -19,6 +19,10 @@ describe Spree::OrderMailer do
     ship_address = create(:address, :address1 => "distributor address", :city => 'The Shire', :zipcode => "1234")
     @order1 = create(:order, :distributor => @distributor, :bill_address => @bill_address, ship_address: ship_address, :special_instructions => @shipping_instructions)
     ActionMailer::Base.deliveries = []
+    Spree::MailMethod.create!(
+      environment: Rails.env,
+      preferred_mails_from: 'spree@example.com'
+    )
   end
 
   describe "order confirmation for customers" do
diff --git a/spec/mailers/producer_mailer_spec.rb b/spec/mailers/producer_mailer_spec.rb
index c964342073..0ae398dd27 100644
--- a/spec/mailers/producer_mailer_spec.rb
+++ b/spec/mailers/producer_mailer_spec.rb
@@ -2,6 +2,12 @@ require 'spec_helper'
 require 'yaml'
 
 describe ProducerMailer do
+  before do
+    Spree::MailMethod.create!(
+      environment: Rails.env,
+      preferred_mails_from: 'spree@example.com'
+    )
+  end
   let!(:zone) { create(:zone_with_member) }
   let!(:tax_rate) { create(:tax_rate, included_in_price: true, calculator: Spree::Calculator::DefaultTax.new, zone: zone, amount: 0.1) }
   let!(:tax_category) { create(:tax_category, tax_rates: [tax_rate]) }
diff --git a/spec/models/spree/order_spec.rb b/spec/models/spree/order_spec.rb
index 392d9664fa..89f3dcae78 100644
--- a/spec/models/spree/order_spec.rb
+++ b/spec/models/spree/order_spec.rb
@@ -487,6 +487,13 @@ describe Spree::Order do
 
   describe "scopes" do
     describe "not_state" do
+      before do
+        Spree::MailMethod.create!(
+          environment: Rails.env,
+          preferred_mails_from: 'spree@example.com'
+        )
+      end
+
       it "finds only orders not in specified state" do
         o = FactoryGirl.create(:completed_order_with_totals)
         o.cancel!

From 23585e6ea8c9e22f5146b4c54dcdb403bfecda25 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Tue, 25 Apr 2017 16:51:35 +0200
Subject: [PATCH 060/353] Initialize custom calculators using Spree API

Freely inspired by https://github.com/coopdevs/spree/blob/2-0-stable/core/lib/spree/core/engine.rb#L78
---
 config/application.rb        | 31 ++++++++++++++++++-------------
 config/initializers/spree.rb | 12 ------------
 2 files changed, 18 insertions(+), 25 deletions(-)

diff --git a/config/application.rb b/config/application.rb
index cc402859da..4793ee07f4 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -25,20 +25,25 @@ module Openfoodnetwork
     end
 
     # Register Spree calculators
-    initializer "spree.register.calculators" do |app|
+    initializer 'spree.register.calculators' do |app|
       app.config.spree.calculators.shipping_methods << OpenFoodNetwork::Calculator::Weight
-
-      app.config.spree.calculators.enterprise_fees = [Calculator::FlatPercentPerItem,
-                                                      Spree::Calculator::FlatRate,
-                                                      Spree::Calculator::FlexiRate,
-                                                      Spree::Calculator::PerItem,
-                                                      Spree::Calculator::PriceSack,
-                                                      OpenFoodNetwork::Calculator::Weight]
-      app.config.spree.calculators.payment_methods = [Spree::Calculator::FlatPercentItemTotal,
-                                                      Spree::Calculator::FlatRate,
-                                                      Spree::Calculator::FlexiRate,
-                                                      Spree::Calculator::PerItem,
-                                                      Spree::Calculator::PriceSack]
+      app.config.spree.calculators.add_class('enterprise_fees')
+      config.spree.calculators.enterprise_fees = [
+        Calculator::FlatPercentPerItem,
+        Spree::Calculator::FlatRate,
+        Spree::Calculator::FlexiRate,
+        Spree::Calculator::PerItem,
+        Spree::Calculator::PriceSack,
+        OpenFoodNetwork::Calculator::Weight
+      ]
+      app.config.spree.calculators.add_class('payment_methods')
+      config.spree.calculators.payment_methods = [
+        Spree::Calculator::FlatPercentItemTotal,
+        Spree::Calculator::FlatRate,
+        Spree::Calculator::FlexiRate,
+        Spree::Calculator::PerItem,
+        Spree::Calculator::PriceSack
+      ]
     end
 
     # Register Spree payment methods
diff --git a/config/initializers/spree.rb b/config/initializers/spree.rb
index af5d7f8245..15ccc8c1e7 100644
--- a/config/initializers/spree.rb
+++ b/config/initializers/spree.rb
@@ -6,7 +6,6 @@
 # In order to initialize a setting do:
 # config.setting_name = 'new value'
 
-
 require 'spree/product_filters'
 require 'spree/core/calculated_adjustments_decorator'
 
@@ -41,17 +40,6 @@ end
 module OpenFoodNetwork
 end
 
-# Add calculators category for enterprise fees
-module Spree
-  module Core
-    class Environment
-      class Calculators
-        attr_accessor :enterprise_fees, :payment_methods
-      end
-    end
-  end
-end
-
 # Forcing spree to always allow SSL connections
 # Since we are using config.force_ssl = true
 # Without this we get a redirect loop: see https://groups.google.com/forum/#!topic/spree-user/NwpqGxJ4klk

From 6816061915a28365cbfcf06d0c70dc086981d159 Mon Sep 17 00:00:00 2001
From: enricostano <ocirne.onats@gmail.com>
Date: Tue, 9 May 2017 16:01:35 +0200
Subject: [PATCH 061/353] Fix confirmation email subject

https://github.com/openfoodfoundation/spree_auth_devise/commit/c38537173feed4b9c1ac6582648fc03cfdd57239
---
 spec/mailers/user_mailer_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/mailers/user_mailer_spec.rb b/spec/mailers/user_mailer_spec.rb
index 5e389b71bf..d5044449de 100644
--- a/spec/mailers/user_mailer_spec.rb
+++ b/spec/mailers/user_mailer_spec.rb
@@ -27,7 +27,7 @@ describe Spree::UserMailer do
 
       context 'subject includes' do
         it 'translated devise instructions' do
-          expect(@message.subject).to include "Password Reset Instructions"
+          expect(@message.subject).to include "Reset password instructions"
         end
 
         it 'Spree site name' do

From 72292b1dd31f0ebc3e220fcd5a7dbb182254d4f7 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Thu, 18 May 2017 16:05:22 +0200
Subject: [PATCH 062/353] Use new `state` API instead of `locked`

https://github.com/Em-AK/openfoodnetwork/commit/be554fde9f3e7850a1da346e2b17e40b183fb3df
---
 app/models/spree/order_decorator.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/models/spree/order_decorator.rb b/app/models/spree/order_decorator.rb
index 9ed6c30733..d0c38e8753 100644
--- a/app/models/spree/order_decorator.rb
+++ b/app/models/spree/order_decorator.rb
@@ -344,10 +344,10 @@ Spree::Order.class_eval do
   end
 
   def update_adjustment!(adjustment)
-    locked = adjustment.locked
-    adjustment.locked = false
+    state = adjustment.state
+    adjustment.state = 'open'
     adjustment.update!(self)
-    adjustment.locked = locked
+    adjustment.state = state
   end
 
   # object_params sets the payment amount to the order total, but it does this before

From 3e6e3173ee8aa1b2f139d64314ac1ec1ba2aa237 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 25 May 2017 21:48:43 +1000
Subject: [PATCH 063/353] Fixing line item controller issue by setting data up
 correctly

---
 .../controllers/line_items_controller_spec.rb | 35 ++++++++-----------
 1 file changed, 14 insertions(+), 21 deletions(-)

diff --git a/spec/controllers/line_items_controller_spec.rb b/spec/controllers/line_items_controller_spec.rb
index 49c7a15742..35891dcdb7 100644
--- a/spec/controllers/line_items_controller_spec.rb
+++ b/spec/controllers/line_items_controller_spec.rb
@@ -35,6 +35,9 @@ describe LineItemsController do
       item
     end
 
+    let(:order) { item.order }
+    let(:order_cycle) { create(:simple_order_cycle, distributors: [distributor], variants: [order.line_item_variants]) }
+
     before { controller.stub spree_current_user: item.order.user }
 
     context "without a line item id" do
@@ -55,42 +58,32 @@ describe LineItemsController do
       end
 
       context "where the item's order is associated with the current user" do
-        before { item.order.update_attributes(user_id: user.id) }
+        before { order.update_attributes!(user_id: user.id) }
 
-        context "without an order cycle" do
+        context "without an order cycle or distributor" do
           it "denies deletion" do
             delete :destroy, params
             expect(response.status).to eq 403
           end
         end
 
-        context "with an order cycle" do
-          before { item.order.update_attributes(order_cycle_id: order_cycle.id) }
+        context "with an order cycle and distributor" do
+          before { order.update_attributes!(order_cycle_id: order_cycle.id, distributor_id: distributor.id) }
 
-          context "without a distributor" do
+          context "where changes are not allowed" do
             it "denies deletion" do
               delete :destroy, params
               expect(response.status).to eq 403
             end
           end
 
-          context "where the item's order has a distributor" do
-            before { item.order.update_attributes(distributor_id: distributor.id) }
-            context "where changes are not allowed" do
-              it "denies deletion" do
-                delete :destroy, params
-                expect(response.status).to eq 403
-              end
-            end
+          context "where changes are allowed" do
+            before { distributor.update_attributes!(allow_order_changes: true) }
 
-            context "where changes are allowed" do
-              before { distributor.update_attributes(allow_order_changes: true) }
-
-              it "deletes the line item" do
-                delete :destroy, params
-                expect(response.status).to eq 204
-                expect { item.reload }.to raise_error ActiveRecord::RecordNotFound
-              end
+            it "deletes the line item" do
+              delete :destroy, params
+              expect(response.status).to eq 204
+              expect { item.reload }.to raise_error ActiveRecord::RecordNotFound
             end
           end
         end

From 4a989f705b46567592901fee2538edbedd4a0947 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Thu, 25 May 2017 14:13:40 +0200
Subject: [PATCH 064/353] No more order.payment

---
 spec/controllers/line_items_controller_spec.rb | 2 +-
 spec/models/spree/order_spec.rb                | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/spec/controllers/line_items_controller_spec.rb b/spec/controllers/line_items_controller_spec.rb
index 35891dcdb7..db9ebabe8e 100644
--- a/spec/controllers/line_items_controller_spec.rb
+++ b/spec/controllers/line_items_controller_spec.rb
@@ -120,7 +120,7 @@ describe LineItemsController do
         order.shipments.last.reload
         expect(order.adjustment_total).to eq initial_fees - shipping_fee - payment_fee
         expect(order.shipments.last.adjustment.amount).to eq shipping_fee
-        expect(order.payment.adjustment.amount).to eq payment_fee
+        expect(order.payments.first.adjustment.amount).to eq payment_fee
         expect(order.shipments.last.adjustment.included_tax).to eq 0.6
       end
     end
diff --git a/spec/models/spree/order_spec.rb b/spec/models/spree/order_spec.rb
index 89f3dcae78..8ed03ff0f7 100644
--- a/spec/models/spree/order_spec.rb
+++ b/spec/models/spree/order_spec.rb
@@ -709,7 +709,7 @@ describe Spree::Order do
 
       it "removes transaction fees" do
         # Change the payment method
-        order.payment.update_attributes(payment_method_id: payment_method.id)
+        order.payments.first.update_attributes(payment_method_id: payment_method.id)
         order.save
 
         # Check if fees got updated

From 8e5b94b5caa0b3a7f1877f6affe55c46068549e0 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Thu, 25 May 2017 19:15:30 +0200
Subject: [PATCH 065/353] Fixing orders controller issue by setting data up
 correctly

---
 spec/controllers/spree/orders_controller_spec.rb | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/spec/controllers/spree/orders_controller_spec.rb b/spec/controllers/spree/orders_controller_spec.rb
index e7b5a7e12a..512cbac5fd 100644
--- a/spec/controllers/spree/orders_controller_spec.rb
+++ b/spec/controllers/spree/orders_controller_spec.rb
@@ -350,11 +350,17 @@ describe Spree::OrdersController do
           end
 
           context "and the order is editable" do
-            let(:order_cycle) { create(:simple_order_cycle) }
             let(:distributor) { create(:enterprise, allow_order_changes: true) }
+            let(:order_cycle) do
+              create(
+                :simple_order_cycle,
+                distributors: [distributor],
+                variants: order.line_item_variants
+              )
+            end
 
             before do
-              order.update_attributes(order_cycle_id: order_cycle.id, distributor_id: distributor.id)
+              order.update_attributes!(order_cycle_id: order_cycle.id, distributor_id: distributor.id)
             end
 
             it "returns the order" do

From 7874d96003fb5e85edac43942c951ad9bbed5d46 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Thu, 25 May 2017 19:17:42 +0200
Subject: [PATCH 066/353] Set MailMethod for test environment when needed

---
 spec/controllers/spree/orders_controller_spec.rb | 7 +++++++
 spec/features/consumer/shopping/orders_spec.rb   | 6 ++++++
 spec/models/order_cycle_spec.rb                  | 6 ++++++
 3 files changed, 19 insertions(+)

diff --git a/spec/controllers/spree/orders_controller_spec.rb b/spec/controllers/spree/orders_controller_spec.rb
index 512cbac5fd..e3a625784c 100644
--- a/spec/controllers/spree/orders_controller_spec.rb
+++ b/spec/controllers/spree/orders_controller_spec.rb
@@ -398,6 +398,13 @@ describe Spree::OrdersController do
       context "when the order is complete" do
         let(:order) { create(:completed_order_with_totals, user: user) }
 
+        before do
+          Spree::MailMethod.create!(
+            environment: Rails.env,
+            preferred_mails_from: 'spree@example.com'
+          )
+        end
+
         it "responds with success" do
           spree_put :cancel, params
           expect(response.status).to redirect_to spree.order_path(order)
diff --git a/spec/features/consumer/shopping/orders_spec.rb b/spec/features/consumer/shopping/orders_spec.rb
index 379f1b5197..66f2bcf4ce 100644
--- a/spec/features/consumer/shopping/orders_spec.rb
+++ b/spec/features/consumer/shopping/orders_spec.rb
@@ -36,6 +36,12 @@ feature "Order Management", js: true do
     end
 
     context "when the distributor allows changes to be made to orders" do
+      before do
+        Spree::MailMethod.create!(
+          environment: Rails.env,
+          preferred_mails_from: 'spree@example.com'
+        )
+      end
       before do
         order.distributor.update_attributes(allow_order_changes: true)
       end
diff --git a/spec/models/order_cycle_spec.rb b/spec/models/order_cycle_spec.rb
index 8715e1ef5c..59d71c59ef 100644
--- a/spec/models/order_cycle_spec.rb
+++ b/spec/models/order_cycle_spec.rb
@@ -516,6 +516,12 @@ describe OrderCycle do
     let!(:order4) { create(:completed_order_with_totals, distributor: shop, user: user, order_cycle: create(:order_cycle))  }
     let!(:order5) { create(:completed_order_with_totals, distributor: shop, user: user, order_cycle: oc)  }
 
+    before do
+      Spree::MailMethod.create!(
+        environment: Rails.env,
+        preferred_mails_from: 'spree@example.com'
+      )
+    end
     before { order5.cancel }
 
     it "only returns items from non-cancelled orders in the OC, placed by the user at the shop" do

From 5a2c3f5c5c6af5f11b21f34e1948c988639000df Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Tue, 6 Jun 2017 16:25:09 +0200
Subject: [PATCH 067/353] Set Spree configuration related to locales before the
 promo environment gets initialized

---
 config/application.rb        | 21 +++++++++++++++++++++
 config/initializers/spree.rb | 10 ----------
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/config/application.rb b/config/application.rb
index 4793ee07f4..91472fdf3c 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -24,6 +24,27 @@ module Openfoodnetwork
       end
     end
 
+    # Settings dependent on locale
+    #
+    # We need to set this config before the promo environment gets loaded and
+    # after the spree environment gets loaded...
+    # This is because Spree uses `Spree::Config` while evaluating classes :scream:
+    #
+    # https://github.com/spree/spree/blob/2-0-stable/core/app/models/spree/calculator/per_item.rb#L6
+    #
+    # TODO: move back to spree initializer once we upgrade to a more recent version
+    #       of Spree
+    initializer 'ofn.spree_locale_settings', before: 'spree.promo.environment' do |app|
+      Spree::Config['checkout_zone'] = ENV['CHECKOUT_ZONE']
+      Spree::Config['currency'] = ENV['CURRENCY']
+      if Spree::Country.table_exists?
+        country = Spree::Country.find_by_iso(ENV['DEFAULT_COUNTRY_CODE'])
+        Spree::Config['default_country_id'] = country.id if country.present?
+      else
+        Spree::Config['default_country_id'] = 12  # Australia
+      end
+    end
+
     # Register Spree calculators
     initializer 'spree.register.calculators' do |app|
       app.config.spree.calculators.shipping_methods << OpenFoodNetwork::Calculator::Weight
diff --git a/config/initializers/spree.rb b/config/initializers/spree.rb
index 15ccc8c1e7..dc41aa9258 100644
--- a/config/initializers/spree.rb
+++ b/config/initializers/spree.rb
@@ -18,16 +18,6 @@ Spree.config do |config|
   config.shipping_instructions = true
   config.address_requires_state = true
 
-  # Settings dependent on locale
-  config.checkout_zone = ENV["CHECKOUT_ZONE"]
-  config.currency = ENV['CURRENCY']
-  if Spree::Country.table_exists?
-    country = Spree::Country.find_by_iso(ENV['DEFAULT_COUNTRY_CODE'])
-    config.default_country_id = country.id if country.present?
-  else
-    config.default_country_id = 12  # Australia
-  end
-
   # -- spree_paypal_express
   # Auto-capture payments. Without this option, payments must be manually captured in the paypal interface.
   config.auto_capture = true

From ce562889a9826ededa76f6cbc14267a0df3d7dd0 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Thu, 15 Jun 2017 13:54:25 +0200
Subject: [PATCH 068/353] Update js and css assets

---
 app/assets/javascripts/store/all.js  | 3 +--
 app/assets/stylesheets/store/all.css | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/app/assets/javascripts/store/all.js b/app/assets/javascripts/store/all.js
index 723f03af31..a8386e4b7f 100644
--- a/app/assets/javascripts/store/all.js
+++ b/app/assets/javascripts/store/all.js
@@ -6,8 +6,7 @@
 //
 
 //= require 'jquery'
-//= require store/spree_core
+//= require store/spree_frontend
 //= require store/spree_auth
-//= require store/spree_promo
 
 //= require_tree .
diff --git a/app/assets/stylesheets/store/all.css b/app/assets/stylesheets/store/all.css
index c1d3d851bc..ea25eaeefc 100644
--- a/app/assets/stylesheets/store/all.css
+++ b/app/assets/stylesheets/store/all.css
@@ -4,9 +4,8 @@
  * the top of the compiled file, but it's generally better to create a new file per style scope.
  *
 
- *= require store/spree_core
+ *= require store/spree_frontend
  *= require store/spree_auth
- *= require store/spree_promo
 
  *= require_self
  *= require_tree .

From 49d96206e1d037bd660b77886caab75cb08236d8 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Mon, 3 Jul 2017 16:02:10 +0200
Subject: [PATCH 069/353] Add missing `email` i18n key

---
 config/locales/en.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/config/locales/en.yml b/config/locales/en.yml
index 104999525b..7048b53ee1 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2023,6 +2023,8 @@ Please follow the instructions there to make your enterprise visible on the Open
       start_free_profile: "Start with a free profile, and expand when you're ready!"
 
   spree:
+    # TODO: remove `email` key once we get to Spree 2.0
+    email: Email
     admin:
       orders:
         invoice:

From 6254dfde111ef55b4a111917e3a9facbe48e7730 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Mon, 3 Jul 2017 16:52:14 +0200
Subject: [PATCH 070/353] Backport Spree commit to fix PaymentMethodsController
 #create

---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index e430414f2d..69b6b83ece 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,7 +8,7 @@ GIT
 
 GIT
   remote: git://github.com/coopdevs/spree.git
-  revision: 93337acbee00dd3f5702c6dd1f668112f3809400
+  revision: 3337e6b2a894a086b416be0d4c0fdf6c9bf5e701
   branch: spree-upgrade-step-6
   specs:
     spree (1.3.99)

From 8c56bd23fcdfe379edf41a35e76bfa6ece19cc41 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Wed, 12 Jul 2017 18:38:08 +0200
Subject: [PATCH 071/353] Add missing translation

---
 app/controllers/spree/admin/orders_controller_decorator.rb | 2 +-
 config/locales/en.yml                                      | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/controllers/spree/admin/orders_controller_decorator.rb b/app/controllers/spree/admin/orders_controller_decorator.rb
index e84f7217bf..e99b91638b 100644
--- a/app/controllers/spree/admin/orders_controller_decorator.rb
+++ b/app/controllers/spree/admin/orders_controller_decorator.rb
@@ -79,7 +79,7 @@ Spree::Admin::OrdersController.class_eval do
     template = if Spree::Config.invoice_style2? then "spree/admin/orders/invoice2" else "spree/admin/orders/invoice" end
     pdf = render_to_string pdf: "invoice-#{@order.number}.pdf", template: template, formats: [:html], encoding: "UTF-8"
     Spree::OrderMailer.invoice_email(@order.id, pdf).deliver
-    flash[:success] = t(:invoice_email_sent)
+    flash[:success] = t('admin.orders.invoice_email_sent')
 
     respond_with(@order) { |format| format.html { redirect_to edit_admin_order_path(@order) } }
   end
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 7048b53ee1..9519b207b3 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -378,6 +378,7 @@ en:
       index:
         capture: "Capture"
         ship: "Ship"
+      invoice_email_sent: 'Invoice sent'
       bulk_management:
         tip: "Use this page to alter product quantities across multiple orders. Products may also be removed from orders entirely, if required."
         shared: "Shared Resource?"

From f0e2d426c3c0a8c754adefb472b5feb0b0cb6a6c Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Wed, 12 Jul 2017 19:23:15 +0200
Subject: [PATCH 072/353] Fix getting HTML when deleting line item in admin

In the step 6 of the spree upgrade, when deleting an order's line item
from /admin we get an HTML response (the whole edit form) that gets
inserted into the flash error.

It's not 100% clear why we added a respond_to block for JSON but since
juery-rails sends ajax requests with application/javascript, */* in
the ACCEPTS request header, Rails falls back to the first specified respond_to
block, which is HTML. We don't hit the JSON block.

In order for this to work, this commit replaces the JSON respond_to
block with one for JS with the exact same behaviour; returning a 204.
This is also the format the spree controller action we duplicated originally
has besides HTML.
---
 .../spree/admin/line_items_controller_decorator.rb            | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/app/controllers/spree/admin/line_items_controller_decorator.rb b/app/controllers/spree/admin/line_items_controller_decorator.rb
index 511ab1b4f6..ed81c8ae54 100644
--- a/app/controllers/spree/admin/line_items_controller_decorator.rb
+++ b/app/controllers/spree/admin/line_items_controller_decorator.rb
@@ -2,8 +2,6 @@ Spree::Admin::LineItemsController.class_eval do
   prepend_before_filter :load_order, except: :index
   around_filter :apply_enterprise_fees_with_lock, only: :update
 
-  respond_to :json
-
   # TODO make updating line items faster by creating a bulk update method
 
   def index
@@ -52,7 +50,7 @@ Spree::Admin::LineItemsController.class_eval do
 
     respond_to do |format|
       format.html { render_order_form }
-      format.json { render nothing: true, status: 204 } # No Content
+      format.js { render nothing: true, status: 204 } # No Content
     end
   end
 

From 790bc5b18779668876f9bff608acb622ef9e999a Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Fri, 14 Jul 2017 10:06:09 +0200
Subject: [PATCH 073/353] Use JS format for #update

---
 .../spree/admin/line_items_controller_decorator.rb            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/controllers/spree/admin/line_items_controller_decorator.rb b/app/controllers/spree/admin/line_items_controller_decorator.rb
index ed81c8ae54..4b31f4d749 100644
--- a/app/controllers/spree/admin/line_items_controller_decorator.rb
+++ b/app/controllers/spree/admin/line_items_controller_decorator.rb
@@ -35,11 +35,11 @@ Spree::Admin::LineItemsController.class_eval do
   def update
     respond_to do |format|
       format.html { render_order_form }
-      format.json {
+      format.js {
         if @line_item.update_attributes(params[:line_item])
           render nothing: true, status: 204 # No Content, does not trigger ng resource auto-update
         else
-          render json: {errors: @line_item.errors}, status: 412
+          render json: { errors: @line_item.errors }, status: 412
         end
       }
     end

From d581fc4863aa76e988809806a53a1ee23b29a126 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Fri, 14 Jul 2017 10:06:51 +0200
Subject: [PATCH 074/353] Fix specs to contemplate XHR requests and more
 coverage

---
 .../spree/admin/line_items_controller_spec.rb | 68 ++++++++++++++-----
 1 file changed, 51 insertions(+), 17 deletions(-)

diff --git a/spec/controllers/spree/admin/line_items_controller_spec.rb b/spec/controllers/spree/admin/line_items_controller_spec.rb
index 0838e83b64..dc82b005b5 100644
--- a/spec/controllers/spree/admin/line_items_controller_spec.rb
+++ b/spec/controllers/spree/admin/line_items_controller_spec.rb
@@ -143,14 +143,15 @@ describe Spree::Admin::LineItemsController do
     end
   end
 
-  describe "#update" do
+  describe '#update' do
     let(:supplier) { create(:supplier_enterprise) }
     let(:distributor1) { create(:distributor_enterprise) }
     let(:coordinator) { create(:distributor_enterprise) }
     let(:order_cycle) { create(:simple_order_cycle, coordinator: coordinator) }
     let!(:order1) { FactoryGirl.create(:order, order_cycle: order_cycle, state: 'complete', completed_at: Time.zone.now, distributor: distributor1, billing_address: FactoryGirl.create(:address) ) }
     let!(:line_item1) { FactoryGirl.create(:line_item, order: order1, product: FactoryGirl.create(:product, supplier: supplier)) }
-    let(:params) { { format: :json, id: line_item1.id, order_id: order1.number, line_item: { quantity: 3, final_weight_volume: 3000, price: 3.00 } } }
+    let(:line_item_params) { { quantity: 3, final_weight_volume: 3000, price: 3.00 } }
+    let(:params) { { id: line_item1.id, order_id: order1.number, line_item: line_item_params } }
 
     context "as an enterprise user" do
       context "producer enterprise" do
@@ -172,7 +173,7 @@ describe Spree::Admin::LineItemsController do
         end
 
         it "updates the line item" do
-          spree_put :update, params
+          xhr :put, :update, params
           line_item1.reload
           expect(line_item1.quantity).to eq 3
           expect(line_item1.final_weight_volume).to eq 3000
@@ -180,20 +181,44 @@ describe Spree::Admin::LineItemsController do
         end
 
         it "returns an empty JSON response" do
-          spree_put :update, params.merge(format: :json)
+          xhr :put, :update, params
           expect(response.body).to eq ' '
         end
 
-        it "returns an HTML response with the order form" do
-          spree_put :update, params.merge(format: :html)
-          expect(response.body).to match /admin_order_form_fields/
+        it 'returns a 204 response' do
+          xhr :put, :update, params
+          expect(response.status).to eq 204
+        end
+
+        context 'when the line item params are not correct' do
+          let(:line_item_params) { { price: 'hola' } }
+          let(:errors) { { 'price' => ['is not a number'] } }
+
+          it 'returns a JSON with the errors' do
+            xhr :put, :update, params
+            expect(JSON.parse(response.body)['errors']).to eq(errors)
+          end
+
+          it 'returns a 412 response' do
+            xhr :put, :update, params
+            expect(response.status).to eq 412
+          end
+        end
+
+        context 'when the request is HTML' do
+          before { params.merge(format: :html) }
+
+          it 'returns an HTML response with the order form' do
+            spree_put :update, params
+            expect(response.body).to match /admin_order_form_fields/
+          end
         end
       end
 
       context "hub enterprise" do
         before do
           controller.stub spree_current_user: distributor1.owner
-          spree_put :update, params
+          xhr :put, :update, params
         end
 
         it "updates the line item" do
@@ -206,7 +231,7 @@ describe Spree::Admin::LineItemsController do
     end
   end
 
-  describe "#destroy" do
+  describe '#destroy' do
     render_views
 
     let(:supplier) { create(:supplier_enterprise) }
@@ -215,26 +240,35 @@ describe Spree::Admin::LineItemsController do
     let(:order_cycle) { create(:simple_order_cycle, coordinator: coordinator) }
     let!(:order1) { FactoryGirl.create(:order, order_cycle: order_cycle, state: 'complete', completed_at: Time.zone.now, distributor: distributor1, billing_address: FactoryGirl.create(:address) ) }
     let!(:line_item1) { FactoryGirl.create(:line_item, order: order1, product: FactoryGirl.create(:product, supplier: supplier)) }
-    let(:params) { { format: :json, id: line_item1.id, order_id: order1.number } }
+    let(:params) { { id: line_item1.id, order_id: order1.number } }
 
     before do
       controller.stub spree_current_user: coordinator.owner
     end
 
-    it "destroys the line item" do
+    it 'destroys the line item' do
       expect {
-        spree_delete :destroy, params
+        xhr :delete, :destroy, params
       }.to change { Spree::LineItem.where(id: line_item1).count }.from(1).to(0)
     end
 
-    it "returns an empty JSON response" do
-      spree_delete :destroy, params.merge(format: :json)
+    it 'returns an empty JSON response' do
+      xhr :delete, :destroy, params
       expect(response.body).to eq ' '
     end
 
-    it "returns an HTML response with the order form" do
-      spree_delete :destroy, params.merge(format: :html)
-      expect(response.body).to match /admin_order_form_fields/
+    it 'returns a 204 response' do
+      xhr :delete, :destroy, params
+      expect(response.status).to eq 204
+    end
+
+    context 'when the request is HTML' do
+      before { params.merge(format: :html) }
+
+      it 'returns an HTML response with the order form' do
+        spree_delete :destroy, params
+        expect(response.body).to match /admin_order_form_fields/
+      end
     end
   end
 end

From d09e0cd44ac448975a13cd8909a16e49a097cde8 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Fri, 14 Jul 2017 12:30:34 +0200
Subject: [PATCH 075/353] Deal with both JS and JSON format

---
 .../admin/line_items_controller_decorator.rb  |  16 ++
 .../spree/admin/line_items_controller_spec.rb | 139 +++++++++++++-----
 2 files changed, 118 insertions(+), 37 deletions(-)

diff --git a/app/controllers/spree/admin/line_items_controller_decorator.rb b/app/controllers/spree/admin/line_items_controller_decorator.rb
index 4b31f4d749..7d76cda245 100644
--- a/app/controllers/spree/admin/line_items_controller_decorator.rb
+++ b/app/controllers/spree/admin/line_items_controller_decorator.rb
@@ -32,6 +32,10 @@ Spree::Admin::LineItemsController.class_eval do
     end
   end
 
+  # TODO: simplify this, 3 formats per action is too much
+  #       we need `js` format for admin/orders/edit (jquery-rails gem)
+  #       we need `json` format for admin/orders/bulk_management (angular)
+  #       we don't know if `html` format is needed
   def update
     respond_to do |format|
       format.html { render_order_form }
@@ -42,15 +46,27 @@ Spree::Admin::LineItemsController.class_eval do
           render json: { errors: @line_item.errors }, status: 412
         end
       }
+      format.json {
+        if @line_item.update_attributes(params[:line_item])
+          render nothing: true, status: 204 # No Content, does not trigger ng resource auto-update
+        else
+          render json: { errors: @line_item.errors }, status: 412
+        end
+      }
     end
   end
 
+  # TODO: simplify this, 3 formats per action is too much:
+  #       we need `js` format for admin/orders/edit (jquery-rails gem)
+  #       we need `json` format for admin/orders/bulk_management (angular)
+  #       we don't know if `html` format is needed
   def destroy
     @line_item.destroy
 
     respond_to do |format|
       format.html { render_order_form }
       format.js { render nothing: true, status: 204 } # No Content
+      format.json { render nothing: true, status: 204 } # No Content
     end
   end
 
diff --git a/spec/controllers/spree/admin/line_items_controller_spec.rb b/spec/controllers/spree/admin/line_items_controller_spec.rb
index dc82b005b5..2aced0ad0c 100644
--- a/spec/controllers/spree/admin/line_items_controller_spec.rb
+++ b/spec/controllers/spree/admin/line_items_controller_spec.rb
@@ -172,41 +172,82 @@ describe Spree::Admin::LineItemsController do
           controller.stub spree_current_user: coordinator.owner
         end
 
-        it "updates the line item" do
-          xhr :put, :update, params
-          line_item1.reload
-          expect(line_item1.quantity).to eq 3
-          expect(line_item1.final_weight_volume).to eq 3000
-          expect(line_item1.price).to eq 3.00
-        end
-
-        it "returns an empty JSON response" do
-          xhr :put, :update, params
-          expect(response.body).to eq ' '
-        end
-
-        it 'returns a 204 response' do
-          xhr :put, :update, params
-          expect(response.status).to eq 204
-        end
-
-        context 'when the line item params are not correct' do
-          let(:line_item_params) { { price: 'hola' } }
-          let(:errors) { { 'price' => ['is not a number'] } }
-
-          it 'returns a JSON with the errors' do
+        # Used in admin/orders/edit
+        context 'when the request is JS/XHR (jquery-rails gem)' do
+          it "updates the line item" do
             xhr :put, :update, params
-            expect(JSON.parse(response.body)['errors']).to eq(errors)
+            line_item1.reload
+            expect(line_item1.quantity).to eq 3
+            expect(line_item1.final_weight_volume).to eq 3000
+            expect(line_item1.price).to eq 3.00
           end
 
-          it 'returns a 412 response' do
+          it "returns an empty JSON response" do
             xhr :put, :update, params
-            expect(response.status).to eq 412
+            expect(response.body).to eq ' '
+          end
+
+          it 'returns a 204 response' do
+            xhr :put, :update, params
+            expect(response.status).to eq 204
+          end
+
+          context 'when the line item params are not correct' do
+            let(:line_item_params) { { price: 'hola' } }
+            let(:errors) { { 'price' => ['is not a number'] } }
+
+            it 'returns a JSON with the errors' do
+              xhr :put, :update, params
+              expect(JSON.parse(response.body)['errors']).to eq(errors)
+            end
+
+            it 'returns a 412 response' do
+              xhr :put, :update, params
+              expect(response.status).to eq 412
+            end
+          end
+        end
+
+        # Used in admin/orders/bulk_management
+        context 'when the request is JSON (angular)' do
+          before { params[:format] = :json }
+
+          it "updates the line item" do
+            spree_put :update, params
+            line_item1.reload
+            expect(line_item1.quantity).to eq 3
+            expect(line_item1.final_weight_volume).to eq 3000
+            expect(line_item1.price).to eq 3.00
+          end
+
+          it "returns an empty JSON response" do
+            spree_put :update, params
+            expect(response.body).to eq ' '
+          end
+
+          it 'returns a 204 response' do
+            spree_put :update, params
+            expect(response.status).to eq 204
+          end
+
+          context 'when the line item params are not correct' do
+            let(:line_item_params) { { price: 'hola' } }
+            let(:errors) { { 'price' => ['is not a number'] } }
+
+            it 'returns a JSON with the errors' do
+              spree_put :update, params
+              expect(JSON.parse(response.body)['errors']).to eq(errors)
+            end
+
+            it 'returns a 412 response' do
+              spree_put :update, params
+              expect(response.status).to eq 412
+            end
           end
         end
 
         context 'when the request is HTML' do
-          before { params.merge(format: :html) }
+          before { params[:format] = :html }
 
           it 'returns an HTML response with the order form' do
             spree_put :update, params
@@ -246,20 +287,44 @@ describe Spree::Admin::LineItemsController do
       controller.stub spree_current_user: coordinator.owner
     end
 
-    it 'destroys the line item' do
-      expect {
+    # Used in admin/orders/edit
+    context 'when the request is JS/XHR (jquery-rails gem)' do
+      it 'destroys the line item' do
+        expect {
+          xhr :delete, :destroy, params
+        }.to change { Spree::LineItem.where(id: line_item1).count }.from(1).to(0)
+      end
+
+      it 'returns an empty JSON response' do
         xhr :delete, :destroy, params
-      }.to change { Spree::LineItem.where(id: line_item1).count }.from(1).to(0)
+        expect(response.body).to eq ' '
+      end
+
+      it 'returns a 204 response' do
+        xhr :delete, :destroy, params
+        expect(response.status).to eq 204
+      end
     end
 
-    it 'returns an empty JSON response' do
-      xhr :delete, :destroy, params
-      expect(response.body).to eq ' '
-    end
+    # Used in admin/orders/bulk_management
+    context 'when the request is JSON (angular)' do
+      before { params[:format] = :json }
 
-    it 'returns a 204 response' do
-      xhr :delete, :destroy, params
-      expect(response.status).to eq 204
+      it 'destroys the line item' do
+        expect {
+          spree_delete :destroy, params
+        }.to change { Spree::LineItem.where(id: line_item1).count }.from(1).to(0)
+      end
+
+      it 'returns an empty JSON response' do
+        spree_delete :destroy, params
+        expect(response.body).to eq ' '
+      end
+
+      it 'returns a 204 response' do
+        spree_delete :destroy, params
+        expect(response.status).to eq 204
+      end
     end
 
     context 'when the request is HTML' do

From 3c73282d575ff55199e6977036a2bbeb0cac01cd Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Wed, 12 Jul 2017 16:20:34 +0200
Subject: [PATCH 076/353] Manually reset the order once completed

Spree does not call after_<order.state> methods any more as of
https://github.com/spree/spree/pull/2557, so our #after_complete method
is never triggered and thus the order never reset.

This makes the condition:

```ruby
if current_order.andand.distributor == @order.distributor
```

in app/views/spree/orders/form/_update_buttons.html.haml return false
and as a result the "Back To Cart" button is not shown.

This commit resets the order (emptying the session[:order_id] and
creating a new order, aka. cart) right from the
CheckoutController#update rather than relying on infernal callbacks (of
what the Spree core team itself was unhappy about since long ago
https://github.com/spree/spree/issues/2488). There is the first place
where we know the order has been successfully completed.
---
 app/controllers/checkout_controller.rb        |  2 +
 .../spree/checkout_controller_decorator.rb    |  4 --
 app/helpers/checkout_helper.rb                | 12 +-----
 app/models/reset_order_service.rb             | 15 ++++++++
 spec/controllers/checkout_controller_spec.rb  |  4 ++
 .../spree/checkout_controller_spec.rb         | 37 ++++++++-----------
 .../consumer/shopping/checkout_spec.rb        | 20 +++++++---
 7 files changed, 52 insertions(+), 42 deletions(-)
 create mode 100644 app/models/reset_order_service.rb

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 5432ef8b2a..15d4058909 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -40,6 +40,8 @@ class CheckoutController < Spree::CheckoutController
         set_default_bill_address
         set_default_ship_address
 
+        reset_order
+
         flash[:success] = t(:order_processed_successfully)
         respond_to do |format|
           format.html do
diff --git a/app/controllers/spree/checkout_controller_decorator.rb b/app/controllers/spree/checkout_controller_decorator.rb
index 7841c86c36..e5146394d5 100644
--- a/app/controllers/spree/checkout_controller_decorator.rb
+++ b/app/controllers/spree/checkout_controller_decorator.rb
@@ -32,8 +32,4 @@ Spree::CheckoutController.class_eval do
     @order.bill_address ||= preferred_bill_address || last_used_bill_address || Spree::Address.default
     @order.ship_address ||= preferred_ship_address || last_used_ship_address || nil
   end
-
-  def after_complete
-    reset_order
-  end
 end
diff --git a/app/helpers/checkout_helper.rb b/app/helpers/checkout_helper.rb
index 278422edbb..37b84040b6 100644
--- a/app/helpers/checkout_helper.rb
+++ b/app/helpers/checkout_helper.rb
@@ -105,17 +105,7 @@ module CheckoutHelper
   end
 
   def reset_order
-    distributor = current_order.distributor
-    token = current_order.token
-
-    session[:order_id] = nil
-    @current_order = nil
-    current_order(true)
-
-    current_order.set_distributor!(distributor)
-    current_order.tokenized_permission.token = token
-    current_order.tokenized_permission.save!
-    session[:access_token] = token
+    ResetOrderService.new(self).call
   end
 
   def payment_method_price(method, order)
diff --git a/app/models/reset_order_service.rb b/app/models/reset_order_service.rb
new file mode 100644
index 0000000000..faef5bff63
--- /dev/null
+++ b/app/models/reset_order_service.rb
@@ -0,0 +1,15 @@
+class ResetOrderService < SimpleDelegator
+  def call
+    distributor = current_order.distributor
+    token = current_order.token
+
+    session[:order_id] = nil
+    __getobj__.instance_variable_set(:@current_order, nil)
+    current_order(true)
+
+    current_order.set_distributor!(distributor)
+    current_order.tokenized_permission.token = token
+    current_order.tokenized_permission.save!
+    session[:access_token] = token
+  end
+end
diff --git a/spec/controllers/checkout_controller_spec.rb b/spec/controllers/checkout_controller_spec.rb
index 1f5e40a841..c4f770cb6c 100644
--- a/spec/controllers/checkout_controller_spec.rb
+++ b/spec/controllers/checkout_controller_spec.rb
@@ -106,6 +106,8 @@ describe CheckoutController do
     end
 
     it "returns order confirmation url on success" do
+      expect(controller).to receive(:reset_order)
+
       order.stub(:update_attributes).and_return true
       order.stub(:state).and_return "complete"
 
@@ -116,6 +118,8 @@ describe CheckoutController do
 
     describe "stale object handling" do
       it "retries when a stale object error is encountered" do
+        expect(controller).to receive(:reset_order)
+
         order.stub(:update_attributes).and_return true
         controller.stub(:state_callback)
 
diff --git a/spec/controllers/spree/checkout_controller_spec.rb b/spec/controllers/spree/checkout_controller_spec.rb
index b9b85c92fa..e8840c8bad 100644
--- a/spec/controllers/spree/checkout_controller_spec.rb
+++ b/spec/controllers/spree/checkout_controller_spec.rb
@@ -4,45 +4,40 @@ require 'support/request/authentication_workflow'
 
 
 describe Spree::CheckoutController do
-  include AuthenticationWorkflow
-
   context "After completing an order" do
-    it "should create a new empty order" do
-      controller.current_order(true)
-      controller.send(:after_complete)
-      session[:order_id].should_not be_nil
+    let!(:order) { controller.current_order(true) }
+
+    it "creates a new empty order" do
+      controller.reset_order
+      expect(controller.session[:order_id]).not_to be_nil
     end
 
-    it "should clear the current order cache" do
-      order = controller.current_order(true)
-      controller.send(:after_complete)
-      controller.current_order.should_not == order
+    it "clears the current order cache" do
+      controller.reset_order
+      expect(controller.current_order).not_to eq order
     end
 
-    it "should set the new order's distributor to the same as the old order" do
-      order = controller.current_order(true)
+    it "sets the new order's distributor to the same as the old order" do
       distributor = create(:distributor_enterprise)
       order.set_distributor!(distributor)
 
-      controller.send(:after_complete)
+      controller.reset_order
 
-      controller.current_order.distributor.should == distributor
+      expect(controller.current_order.distributor).to eq distributor
     end
 
-    it "should set the new order's token to the same as the old order, and preserve the access token in the session" do
-      order = controller.current_order(true)
+    it "sets the new order's token to the same as the old order, and preserve the access token in the session" do
+      controller.reset_order
 
-      controller.send(:after_complete)
-
-      controller.current_order.token.should == order.token
-      session[:access_token].should == order.token
+      expect(controller.current_order.token).to eq order.token
+      expect(session[:access_token]).to eq order.token
     end
   end
 
   context "rendering edit from within spree for the current checkout state" do
     let!(:order) { controller.current_order(true) }
     let!(:line_item) { create(:line_item, order: order) }
-    let!(:user) { create_enterprise_user }
+    let!(:user) { create(:user) }
 
     it "redirects to the OFN checkout page" do
       controller.stub(:skip_state_validation?) { true }
diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index 220fdcb89b..6f8cd59de1 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -245,13 +245,16 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
       describe "purchasing" do
         it "takes us to the order confirmation page when we submit a complete form" do
           toggle_details
+
           within "#details" do
             fill_in "First Name", with: "Will"
             fill_in "Last Name", with: "Marshall"
             fill_in "Email", with: "test@test.com"
             fill_in "Phone", with: "0468363090"
           end
+
           toggle_billing
+
           within "#billing" do
             fill_in "Address", with: "123 Your Face"
             select "Australia", from: "Country"
@@ -259,35 +262,40 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
             fill_in "City", with: "Melbourne"
             fill_in "Postcode", with: "3066"
           end
+
           toggle_shipping
+
           within "#shipping" do
             choose sm2.name
             fill_in 'Any comments or special instructions?', with: "SpEcIaL NoTeS"
           end
+
           toggle_payment
+
           within "#payment" do
             choose pm1.name
           end
 
           expect do
             place_order
-            page.should have_content "Your order has been processed successfully"
+            expect(page).to have_content "Your order has been processed successfully"
           end.to enqueue_job ConfirmOrderJob
 
           # And the order's special instructions should be set
-          o = Spree::Order.complete.first
-          expect(o.special_instructions).to eq "SpEcIaL NoTeS"
+          order = Spree::Order.complete.first
+          expect(order.special_instructions).to eq "SpEcIaL NoTeS"
 
           # And the Spree tax summary should not be displayed
-          page.should_not have_content product.tax_category.name
+          expect(page).not_to have_content product.tax_category.name
 
           # And the total tax for the order, including shipping and fee tax, should be displayed
           # product tax    ($10.00 @ 10% = $0.91)
           # + fee tax      ($ 1.23 @ 10% = $0.11)
           # + shipping tax ($ 4.56 @ 25% = $0.91)
           #                              = $1.93
-          page.should have_content "(includes tax)"
-          page.should have_content with_currency(1.93)
+          expect(page).to have_content '(includes tax)'
+          expect(page).to have_content with_currency(1.93)
+          expect(page).to have_content 'Back To Store'
         end
 
         context "with basic details filled" do

From bdfd718c51c4fab8122cb7eb00ab41a13ff47912 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Tue, 18 Jul 2017 10:55:58 +0200
Subject: [PATCH 077/353] Use service object directly from controller

---
 app/controllers/checkout_controller.rb       | 2 +-
 spec/controllers/checkout_controller_spec.rb | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 15d4058909..c21a9def25 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -40,7 +40,7 @@ class CheckoutController < Spree::CheckoutController
         set_default_bill_address
         set_default_ship_address
 
-        reset_order
+        ResetOrderService.new(self).call
 
         flash[:success] = t(:order_processed_successfully)
         respond_to do |format|
diff --git a/spec/controllers/checkout_controller_spec.rb b/spec/controllers/checkout_controller_spec.rb
index c4f770cb6c..f7775ba931 100644
--- a/spec/controllers/checkout_controller_spec.rb
+++ b/spec/controllers/checkout_controller_spec.rb
@@ -4,6 +4,8 @@ describe CheckoutController do
   let(:distributor) { double(:distributor) }
   let(:order_cycle) { create(:simple_order_cycle) }
   let(:order) { create(:order) }
+  let(:reset_order_service) { double(ResetOrderService) }
+
   before do
     order.stub(:checkout_allowed?).and_return true
     controller.stub(:check_authorization).and_return true
@@ -106,7 +108,8 @@ describe CheckoutController do
     end
 
     it "returns order confirmation url on success" do
-      expect(controller).to receive(:reset_order)
+      allow(ResetOrderService).to receive(:new).with(controller) { reset_order_service }
+      expect(reset_order_service).to receive(:call)
 
       order.stub(:update_attributes).and_return true
       order.stub(:state).and_return "complete"
@@ -118,7 +121,8 @@ describe CheckoutController do
 
     describe "stale object handling" do
       it "retries when a stale object error is encountered" do
-        expect(controller).to receive(:reset_order)
+        allow(ResetOrderService).to receive(:new).with(controller) { reset_order_service }
+        expect(reset_order_service).to receive(:call)
 
         order.stub(:update_attributes).and_return true
         controller.stub(:state_callback)

From a18bf4b666892305061fca38e136b8262c5bf005 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Tue, 18 Jul 2017 10:56:41 +0200
Subject: [PATCH 078/353] Add unit tests for service object

---
 spec/models/reset_order_service_spec.rb | 69 +++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 spec/models/reset_order_service_spec.rb

diff --git a/spec/models/reset_order_service_spec.rb b/spec/models/reset_order_service_spec.rb
new file mode 100644
index 0000000000..5bcc05e8ea
--- /dev/null
+++ b/spec/models/reset_order_service_spec.rb
@@ -0,0 +1,69 @@
+require 'spec_helper'
+
+describe ResetOrderService do
+  let(:current_distributor) { double(:distributor) }
+  let(:current_token) { double(:current_token) }
+  let(:current_order) { double(:current_order) }
+  let(:tokenized_permission) { double(:tokenized_permission, save!: true) }
+  let(:new_order) do
+    double(
+      :new_order,
+      distributor: current_distributor,
+      token: current_token,
+      set_distributor!: true,
+      tokenized_permission: tokenized_permission,
+    )
+  end
+  let(:session) { double(:session) }
+  let(:controller) { double(:controller, current_order: new_order, session: session) }
+  let(:reset_order_service) { described_class.new(controller) }
+
+  before do
+    allow(current_order).to receive(:tokenized_permission).and_return(tokenized_permission)
+    allow(tokenized_permission).to receive(:token=)
+    allow(session).to receive(:[]=).with(:order_id, nil)
+    allow(session).to receive(:[]=).with(:access_token, current_token)
+  end
+
+  describe '#call' do
+    it 'creates a new order' do
+      reset_order_service.call
+      expect(controller).to have_received(:current_order).once.with(true)
+    end
+
+    it 'empties the order_id of the session' do
+      reset_order_service.call
+      expect(session).to have_received(:[]=).with(:order_id, nil)
+    end
+
+    it 'resets the @current_order var' do
+      reset_order_service.call
+      expect(controller.instance_variable_get(:@current_order)).to be_nil
+    end
+
+    it 'sets the distributor of the order' do
+      reset_order_service.call
+
+      expect(new_order)
+        .to have_received(:set_distributor!)
+        .with(current_distributor)
+    end
+
+    it 'sets the token of the tokenized permissions' do
+      reset_order_service.call
+
+      expect(current_order.tokenized_permission)
+        .to have_received(:token=).with(current_token)
+    end
+
+    it 'persists the tokenized permissions' do
+      reset_order_service.call
+      expect(tokenized_permission).to have_received(:save!)
+    end
+
+    it 'sets the access_token of the session' do
+      reset_order_service.call
+      expect(session).to have_received(:[]=).with(:access_token, current_token)
+    end
+  end
+end

From 1ef4bf5da0097bfdbebfe50348b03fa1dabf9ec4 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Tue, 18 Jul 2017 12:12:46 +0200
Subject: [PATCH 079/353] Refactor tests and remove duplicated ones

---
 spec/controllers/checkout_controller_spec.rb  |  6 +++
 .../spree/checkout_controller_spec.rb         | 45 ++++---------------
 spec/models/reset_order_service_spec.rb       |  2 +-
 3 files changed, 16 insertions(+), 37 deletions(-)

diff --git a/spec/controllers/checkout_controller_spec.rb b/spec/controllers/checkout_controller_spec.rb
index f7775ba931..ca0d67ab52 100644
--- a/spec/controllers/checkout_controller_spec.rb
+++ b/spec/controllers/checkout_controller_spec.rb
@@ -84,6 +84,12 @@ describe CheckoutController do
       order.should_receive(:ship_address=)
       controller.send(:clear_ship_address)
     end
+
+    it "sets the new order's token to the same as the old order" do
+      order = controller.current_order(true)
+      spree_post :update, order: {}
+      expect(controller.current_order.token).to eq order.token
+    end
   end
 
   context "via xhr" do
diff --git a/spec/controllers/spree/checkout_controller_spec.rb b/spec/controllers/spree/checkout_controller_spec.rb
index e8840c8bad..116c18955b 100644
--- a/spec/controllers/spree/checkout_controller_spec.rb
+++ b/spec/controllers/spree/checkout_controller_spec.rb
@@ -4,46 +4,19 @@ require 'support/request/authentication_workflow'
 
 
 describe Spree::CheckoutController do
-  context "After completing an order" do
-    let!(:order) { controller.current_order(true) }
+  context 'rendering edit from within spree for the current checkout state' do
+    let(:order) { controller.current_order(true) }
+    let(:user) { create(:user) }
 
-    it "creates a new empty order" do
-      controller.reset_order
-      expect(controller.session[:order_id]).not_to be_nil
+    before do
+      create(:line_item, order: order)
+
+      allow(controller).to receive(:skip_state_validation?) { true }
+      allow(controller).to receive(:spree_current_user) { user }
     end
 
-    it "clears the current order cache" do
-      controller.reset_order
-      expect(controller.current_order).not_to eq order
-    end
-
-    it "sets the new order's distributor to the same as the old order" do
-      distributor = create(:distributor_enterprise)
-      order.set_distributor!(distributor)
-
-      controller.reset_order
-
-      expect(controller.current_order.distributor).to eq distributor
-    end
-
-    it "sets the new order's token to the same as the old order, and preserve the access token in the session" do
-      controller.reset_order
-
-      expect(controller.current_order.token).to eq order.token
-      expect(session[:access_token]).to eq order.token
-    end
-  end
-
-  context "rendering edit from within spree for the current checkout state" do
-    let!(:order) { controller.current_order(true) }
-    let!(:line_item) { create(:line_item, order: order) }
-    let!(:user) { create(:user) }
-
     it "redirects to the OFN checkout page" do
-      controller.stub(:skip_state_validation?) { true }
-      controller.stub(:spree_current_user) { user }
-      spree_get :edit
-      response.should redirect_to checkout_path
+      expect(spree_get(:edit)).to redirect_to checkout_path
     end
   end
 end
diff --git a/spec/models/reset_order_service_spec.rb b/spec/models/reset_order_service_spec.rb
index 5bcc05e8ea..8577069013 100644
--- a/spec/models/reset_order_service_spec.rb
+++ b/spec/models/reset_order_service_spec.rb
@@ -41,7 +41,7 @@ describe ResetOrderService do
       expect(controller.instance_variable_get(:@current_order)).to be_nil
     end
 
-    it 'sets the distributor of the order' do
+    it 'sets the new order\'s distributor to the same as the old order' do
       reset_order_service.call
 
       expect(new_order)

From f6c8a11b7b00e2aa1a76c3fb73a6e327de055eb7 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Tue, 18 Jul 2017 12:15:45 +0200
Subject: [PATCH 080/353] Move ResetOrderService to new app/services

---
 app/{models => services}/reset_order_service.rb       | 0
 spec/{models => services}/reset_order_service_spec.rb | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename app/{models => services}/reset_order_service.rb (100%)
 rename spec/{models => services}/reset_order_service_spec.rb (100%)

diff --git a/app/models/reset_order_service.rb b/app/services/reset_order_service.rb
similarity index 100%
rename from app/models/reset_order_service.rb
rename to app/services/reset_order_service.rb
diff --git a/spec/models/reset_order_service_spec.rb b/spec/services/reset_order_service_spec.rb
similarity index 100%
rename from spec/models/reset_order_service_spec.rb
rename to spec/services/reset_order_service_spec.rb

From 4c4969e86b39d3eb088c8e8fbc11ab2e6824243b Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Tue, 18 Jul 2017 13:21:29 +0200
Subject: [PATCH 081/353] Do not couple with controller's ivar and session

---
 app/controllers/checkout_controller.rb       |  5 +++
 app/services/reset_order_service.rb          | 15 ++++++--
 spec/controllers/checkout_controller_spec.rb | 40 ++++++++++++++++++--
 spec/services/reset_order_service_spec.rb    | 31 ++++++---------
 4 files changed, 63 insertions(+), 28 deletions(-)

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index c21a9def25..49c4b61ec7 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -41,6 +41,7 @@ class CheckoutController < Spree::CheckoutController
         set_default_ship_address
 
         ResetOrderService.new(self).call
+        session[:access_token] = current_order.token
 
         flash[:success] = t(:order_processed_successfully)
         respond_to do |format|
@@ -59,6 +60,10 @@ class CheckoutController < Spree::CheckoutController
     end
   end
 
+  def expire_current_order
+    session[:order_id] = nil
+    @current_order = nil
+  end
 
   private
 
diff --git a/app/services/reset_order_service.rb b/app/services/reset_order_service.rb
index faef5bff63..28eb8ff64b 100644
--- a/app/services/reset_order_service.rb
+++ b/app/services/reset_order_service.rb
@@ -3,13 +3,20 @@ class ResetOrderService < SimpleDelegator
     distributor = current_order.distributor
     token = current_order.token
 
-    session[:order_id] = nil
-    __getobj__.instance_variable_set(:@current_order, nil)
-    current_order(true)
+    controller.expire_current_order
+    build_new_order(distributor, token)
+  end
 
+  private
+
+  def build_new_order(distributor, token)
+    current_order(true)
     current_order.set_distributor!(distributor)
     current_order.tokenized_permission.token = token
     current_order.tokenized_permission.save!
-    session[:access_token] = token
+  end
+
+  def controller
+    __getobj__
   end
 end
diff --git a/spec/controllers/checkout_controller_spec.rb b/spec/controllers/checkout_controller_spec.rb
index ca0d67ab52..1b90541d86 100644
--- a/spec/controllers/checkout_controller_spec.rb
+++ b/spec/controllers/checkout_controller_spec.rb
@@ -85,10 +85,42 @@ describe CheckoutController do
       controller.send(:clear_ship_address)
     end
 
-    it "sets the new order's token to the same as the old order" do
-      order = controller.current_order(true)
-      spree_post :update, order: {}
-      expect(controller.current_order.token).to eq order.token
+    context 'when completing the order' do
+      before do
+        order.state = 'complete'
+        allow(order).to receive(:update_attributes).and_return(true)
+        allow(order).to receive(:next).and_return(true)
+        allow(order).to receive(:set_distributor!).and_return(true)
+      end
+
+      it "sets the new order's token to the same as the old order" do
+        order = controller.current_order(true)
+        spree_post :update, order: {}
+        expect(controller.current_order.token).to eq order.token
+      end
+
+      it 'expires the current order' do
+        allow(controller).to receive(:expire_current_order)
+        put :update, order: {}
+        expect(controller).to have_received(:expire_current_order)
+      end
+
+      it 'sets the access_token of the session' do
+        put :update, order: {}
+        expect(session[:access_token]).to eq(controller.current_order.token)
+      end
+    end
+  end
+
+  describe '#expire_current_order' do
+    it 'empties the order_id of the session' do
+      expect(session).to receive(:[]=).with(:order_id, nil)
+      controller.expire_current_order
+    end
+
+    it 'resets the @current_order ivar' do
+      controller.expire_current_order
+      expect(controller.instance_variable_get(:@current_order)).to be_nil
     end
   end
 
diff --git a/spec/services/reset_order_service_spec.rb b/spec/services/reset_order_service_spec.rb
index 8577069013..30ffca82ad 100644
--- a/spec/services/reset_order_service_spec.rb
+++ b/spec/services/reset_order_service_spec.rb
@@ -14,15 +14,21 @@ describe ResetOrderService do
       tokenized_permission: tokenized_permission,
     )
   end
-  let(:session) { double(:session) }
-  let(:controller) { double(:controller, current_order: new_order, session: session) }
+  let(:controller) do
+    double(
+      :controller,
+      current_order: new_order,
+      expire_current_order: true
+    )
+  end
   let(:reset_order_service) { described_class.new(controller) }
 
   before do
-    allow(current_order).to receive(:tokenized_permission).and_return(tokenized_permission)
+    allow(current_order)
+      .to receive(:tokenized_permission)
+      .and_return(tokenized_permission)
+
     allow(tokenized_permission).to receive(:token=)
-    allow(session).to receive(:[]=).with(:order_id, nil)
-    allow(session).to receive(:[]=).with(:access_token, current_token)
   end
 
   describe '#call' do
@@ -31,16 +37,6 @@ describe ResetOrderService do
       expect(controller).to have_received(:current_order).once.with(true)
     end
 
-    it 'empties the order_id of the session' do
-      reset_order_service.call
-      expect(session).to have_received(:[]=).with(:order_id, nil)
-    end
-
-    it 'resets the @current_order var' do
-      reset_order_service.call
-      expect(controller.instance_variable_get(:@current_order)).to be_nil
-    end
-
     it 'sets the new order\'s distributor to the same as the old order' do
       reset_order_service.call
 
@@ -60,10 +56,5 @@ describe ResetOrderService do
       reset_order_service.call
       expect(tokenized_permission).to have_received(:save!)
     end
-
-    it 'sets the access_token of the session' do
-      reset_order_service.call
-      expect(session).to have_received(:[]=).with(:access_token, current_token)
-    end
   end
 end

From e087a008c23a0d643b4fd97a33eb05739aeea816 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Tue, 18 Jul 2017 13:45:22 +0200
Subject: [PATCH 082/353] Reduce coupling from controller

---
 app/controllers/checkout_controller.rb       |  2 +-
 app/helpers/checkout_helper.rb               |  2 +-
 app/services/reset_order_service.rb          | 27 ++++++++++----------
 spec/controllers/checkout_controller_spec.rb |  4 +--
 spec/services/reset_order_service_spec.rb    | 18 ++++++++-----
 5 files changed, 29 insertions(+), 24 deletions(-)

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 49c4b61ec7..8de59d36f6 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -40,7 +40,7 @@ class CheckoutController < Spree::CheckoutController
         set_default_bill_address
         set_default_ship_address
 
-        ResetOrderService.new(self).call
+        ResetOrderService.new(self, current_order).call
         session[:access_token] = current_order.token
 
         flash[:success] = t(:order_processed_successfully)
diff --git a/app/helpers/checkout_helper.rb b/app/helpers/checkout_helper.rb
index 37b84040b6..428173511a 100644
--- a/app/helpers/checkout_helper.rb
+++ b/app/helpers/checkout_helper.rb
@@ -105,7 +105,7 @@ module CheckoutHelper
   end
 
   def reset_order
-    ResetOrderService.new(self).call
+    ResetOrderService.new(self, current_order).call
   end
 
   def payment_method_price(method, order)
diff --git a/app/services/reset_order_service.rb b/app/services/reset_order_service.rb
index 28eb8ff64b..18e53272ec 100644
--- a/app/services/reset_order_service.rb
+++ b/app/services/reset_order_service.rb
@@ -1,22 +1,23 @@
-class ResetOrderService < SimpleDelegator
-  def call
-    distributor = current_order.distributor
-    token = current_order.token
+class ResetOrderService
+  def initialize(controller, order)
+    @controller = controller
+    @distributor = order.distributor
+    @token = order.token
+  end
 
+  def call
     controller.expire_current_order
-    build_new_order(distributor, token)
+    build_new_order
   end
 
   private
 
-  def build_new_order(distributor, token)
-    current_order(true)
-    current_order.set_distributor!(distributor)
-    current_order.tokenized_permission.token = token
-    current_order.tokenized_permission.save!
-  end
+  attr_reader :controller, :distributor, :token
 
-  def controller
-    __getobj__
+  def build_new_order
+    new_order = controller.current_order(true)
+    new_order.set_distributor!(distributor)
+    new_order.tokenized_permission.token = token
+    new_order.tokenized_permission.save!
   end
 end
diff --git a/spec/controllers/checkout_controller_spec.rb b/spec/controllers/checkout_controller_spec.rb
index 1b90541d86..8833a1bd9f 100644
--- a/spec/controllers/checkout_controller_spec.rb
+++ b/spec/controllers/checkout_controller_spec.rb
@@ -146,7 +146,7 @@ describe CheckoutController do
     end
 
     it "returns order confirmation url on success" do
-      allow(ResetOrderService).to receive(:new).with(controller) { reset_order_service }
+      allow(ResetOrderService).to receive(:new).with(controller, order) { reset_order_service }
       expect(reset_order_service).to receive(:call)
 
       order.stub(:update_attributes).and_return true
@@ -159,7 +159,7 @@ describe CheckoutController do
 
     describe "stale object handling" do
       it "retries when a stale object error is encountered" do
-        allow(ResetOrderService).to receive(:new).with(controller) { reset_order_service }
+        allow(ResetOrderService).to receive(:new).with(controller, order) { reset_order_service }
         expect(reset_order_service).to receive(:call)
 
         order.stub(:update_attributes).and_return true
diff --git a/spec/services/reset_order_service_spec.rb b/spec/services/reset_order_service_spec.rb
index 30ffca82ad..e02cdb25e3 100644
--- a/spec/services/reset_order_service_spec.rb
+++ b/spec/services/reset_order_service_spec.rb
@@ -1,15 +1,19 @@
 require 'spec_helper'
 
 describe ResetOrderService do
-  let(:current_distributor) { double(:distributor) }
   let(:current_token) { double(:current_token) }
-  let(:current_order) { double(:current_order) }
+  let(:current_distributor) { double(:distributor) }
+  let(:current_order) do
+    double(
+      :current_order,
+      token: current_token,
+      distributor: current_distributor
+    )
+  end
   let(:tokenized_permission) { double(:tokenized_permission, save!: true) }
   let(:new_order) do
     double(
       :new_order,
-      distributor: current_distributor,
-      token: current_token,
       set_distributor!: true,
       tokenized_permission: tokenized_permission,
     )
@@ -21,10 +25,10 @@ describe ResetOrderService do
       expire_current_order: true
     )
   end
-  let(:reset_order_service) { described_class.new(controller) }
+  let(:reset_order_service) { described_class.new(controller, current_order) }
 
   before do
-    allow(current_order)
+    allow(new_order)
       .to receive(:tokenized_permission)
       .and_return(tokenized_permission)
 
@@ -48,7 +52,7 @@ describe ResetOrderService do
     it 'sets the token of the tokenized permissions' do
       reset_order_service.call
 
-      expect(current_order.tokenized_permission)
+      expect(new_order.tokenized_permission)
         .to have_received(:token=).with(current_token)
     end
 

From 85fefcd946a540c5fb69958b0501e22ab6e4f1c3 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Tue, 18 Jul 2017 13:50:38 +0200
Subject: [PATCH 083/353] Replace helper with service object

---
 .../spree/paypal_controller_decorator.rb      | 10 +++--
 app/helpers/checkout_helper.rb                |  4 --
 .../spree/paypal_controller_spec.rb           | 38 +++++++++++++++++--
 3 files changed, 42 insertions(+), 10 deletions(-)

diff --git a/app/controllers/spree/paypal_controller_decorator.rb b/app/controllers/spree/paypal_controller_decorator.rb
index 74da22557f..3c63d2e763 100644
--- a/app/controllers/spree/paypal_controller_decorator.rb
+++ b/app/controllers/spree/paypal_controller_decorator.rb
@@ -1,6 +1,4 @@
 Spree::PaypalController.class_eval do
-  include CheckoutHelper
-
   after_filter :reset_order_when_complete, only: :confirm
   before_filter :enable_embedded_shopfront
 
@@ -9,13 +7,19 @@ Spree::PaypalController.class_eval do
     redirect_to main_app.checkout_path
   end
 
+  def expire_current_order
+    session[:order_id] = nil
+    @current_order = nil
+  end
 
   private
 
   def reset_order_when_complete
     if current_order.complete?
       flash[:success] = t(:order_processed_successfully)
-      reset_order
+
+      ResetOrderService.new(self, current_order).call
+      session[:access_token] = current_order.token
     end
   end
 end
diff --git a/app/helpers/checkout_helper.rb b/app/helpers/checkout_helper.rb
index 428173511a..bd63882da3 100644
--- a/app/helpers/checkout_helper.rb
+++ b/app/helpers/checkout_helper.rb
@@ -104,10 +104,6 @@ module CheckoutHelper
     render "shared/validated_select", name: name, path: path, options: options, attributes: attributes
   end
 
-  def reset_order
-    ResetOrderService.new(self, current_order).call
-  end
-
   def payment_method_price(method, order)
     price = method.compute_amount(order)
     if price == 0
diff --git a/spec/controllers/spree/paypal_controller_spec.rb b/spec/controllers/spree/paypal_controller_spec.rb
index 200f4a9ff1..ff5f539e2d 100644
--- a/spec/controllers/spree/paypal_controller_spec.rb
+++ b/spec/controllers/spree/paypal_controller_spec.rb
@@ -2,9 +2,41 @@ require 'spec_helper'
 
 module Spree
   describe PaypalController do
-    it "should redirect back to checkout after cancel" do
-      spree_get :cancel
-      response.should redirect_to checkout_path
+    context 'when cancelling' do
+      it 'redirects back to checkout' do
+        expect(spree_get(:cancel)).to redirect_to checkout_path
+      end
+    end
+
+    context 'when confirming' do
+      let(:previous_order) { controller.current_order(true) }
+      let(:payment_method) { create(:payment_method) }
+
+      before do
+        allow(previous_order).to receive(:complete?).and_return(true)
+      end
+
+      it 'resets the order' do
+        spree_post :confirm, payment_method_id: payment_method.id
+        expect(controller.current_order).not_to eq(previous_order)
+      end
+
+      it 'sets the access token of the session' do
+        spree_post :confirm, payment_method_id: payment_method.id
+        expect(session[:access_token]).to eq(controller.current_order.token)
+      end
+    end
+
+    describe '#expire_current_order' do
+      it 'empties the order_id of the session' do
+        expect(session).to receive(:[]=).with(:order_id, nil)
+        controller.expire_current_order
+      end
+
+      it 'resets the @current_order ivar' do
+        controller.expire_current_order
+        expect(controller.instance_variable_get(:@current_order)).to be_nil
+      end
     end
   end
 end

From 2f3f20e43389750f460b1f08643eae028cb2d0fb Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Tue, 18 Jul 2017 18:16:35 +0200
Subject: [PATCH 084/353] Remove html_safe and add spec

---
 app/helpers/spree/admin/base_helper_decorator.rb |  3 +--
 spec/helpers/spree/admin/base_helper_spec.rb     | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)
 create mode 100644 spec/helpers/spree/admin/base_helper_spec.rb

diff --git a/app/helpers/spree/admin/base_helper_decorator.rb b/app/helpers/spree/admin/base_helper_decorator.rb
index c1fd1ab223..85e2f83781 100644
--- a/app/helpers/spree/admin/base_helper_decorator.rb
+++ b/app/helpers/spree/admin/base_helper_decorator.rb
@@ -31,8 +31,7 @@ module Spree
         html_options = {class: "remove_fields #{options[:class]}", data: {action: 'remove'}, title: t(:remove)}
         html_options.merge!(options[:html]) if options.key? :html
 
-        link_to_with_icon('icon-trash', name, '#', html_options).gsub('href="#" ', '').html_safe +
-          f.hidden_field(:_destroy)
+        link_to_with_icon('icon-trash', name, '#', html_options).gsub('href="#" ', '') + f.hidden_field(:_destroy)
       end
     end
   end
diff --git a/spec/helpers/spree/admin/base_helper_spec.rb b/spec/helpers/spree/admin/base_helper_spec.rb
new file mode 100644
index 0000000000..5daaaf8c28
--- /dev/null
+++ b/spec/helpers/spree/admin/base_helper_spec.rb
@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe Spree::BaseHelper, type: :helper do
+  describe "#link_to_remove_fields_without_url" do
+    let(:name) { 'Hola' }
+    let(:form) { double('form_for', hidden_field: '<input type="hidden" name="_method" value="destroy">') }
+    let(:options) { {} }
+
+    subject { helper.link_to_remove_fields_without_url(name, form, options) }
+
+    it 'returns an `a` tag followed by a hidden `input` tag' do
+      expect(subject).to eq("<a class=\"remove_fields  icon_link with-tip icon-trash\" data-action=\"remove\" title=\"Remove\"><span class='text'>Hola</span></a><input type=\"hidden\" name=\"_method\" value=\"destroy\">")
+    end
+  end
+end

From 62c5ccf90470f0982383543a851993d7f91ddd8a Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Tue, 18 Jul 2017 18:33:42 +0200
Subject: [PATCH 085/353] Address CodeClimate complains

---
 app/controllers/checkout_controller.rb           | 16 ++++++++--------
 .../spree/admin/payments_controller_decorator.rb |  4 ++--
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 8de59d36f6..cfb8b33f45 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -26,15 +26,15 @@ class CheckoutController < Spree::CheckoutController
           return if redirect_to_paypal_express_form_if_needed
         end
 
-        unless advance_order_state(@order)
-          if @order.errors.present?
-            flash[:error] = @order.errors.full_messages.to_sentence
-          else
-            flash[:error] = t(:payment_processing_failed)
-          end
-          update_failed
-          return
+        next if advance_order_state(@order)
+
+        if @order.errors.present?
+          flash[:error] = @order.errors.full_messages.to_sentence
+        else
+          flash[:error] = t(:payment_processing_failed)
         end
+        update_failed
+        return
       end
       if @order.state == "complete" ||  @order.completed?
         set_default_bill_address
diff --git a/app/controllers/spree/admin/payments_controller_decorator.rb b/app/controllers/spree/admin/payments_controller_decorator.rb
index c608f8930c..cbcecd852f 100644
--- a/app/controllers/spree/admin/payments_controller_decorator.rb
+++ b/app/controllers/spree/admin/payments_controller_decorator.rb
@@ -5,7 +5,7 @@ Spree::Admin::PaymentsController.class_eval do
   # When a user fires an event, take them back to where they came from
   # (we can't use respond_override because Spree no longer uses respond_with)
   def fire
-    return unless event = params[:e] and @payment.payment_source
+    return unless event = params[:e] && @payment.payment_source
 
     # Because we have a transition method also called void, we do this to avoid conflicts.
     event = "void_transaction" if event == "void"
@@ -15,7 +15,7 @@ Spree::Admin::PaymentsController.class_eval do
       flash[:error] = t(:cannot_perform_operation)
     end
   rescue Spree::Core::GatewayError => ge
-    flash[:error] = "#{ge.message}"
+    flash[:error] = ge.message
   ensure
     redirect_to request.referer
   end

From 3a9b71bd1f70e79d8f5f03f395f787e57ec6c077 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Wed, 19 Jul 2017 11:18:20 +0200
Subject: [PATCH 086/353] Add doc to methods and classes [skip ci]

---
 app/controllers/checkout_controller.rb               | 3 +++
 app/controllers/spree/paypal_controller_decorator.rb | 3 +++
 app/services/reset_order_service.rb                  | 9 +++++++++
 3 files changed, 15 insertions(+)

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index cfb8b33f45..13d9e71d51 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -60,6 +60,9 @@ class CheckoutController < Spree::CheckoutController
     end
   end
 
+  # Clears the cached order. Required for #current_order to return a new order
+  # to serve as cart. See https://github.com/spree/spree/blob/1-3-stable/core/lib/spree/core/controller_helpers/order.rb#L14
+  # for details.
   def expire_current_order
     session[:order_id] = nil
     @current_order = nil
diff --git a/app/controllers/spree/paypal_controller_decorator.rb b/app/controllers/spree/paypal_controller_decorator.rb
index 3c63d2e763..9ad11927ab 100644
--- a/app/controllers/spree/paypal_controller_decorator.rb
+++ b/app/controllers/spree/paypal_controller_decorator.rb
@@ -7,6 +7,9 @@ Spree::PaypalController.class_eval do
     redirect_to main_app.checkout_path
   end
 
+  # Clears the cached order. Required for #current_order to return a new order
+  # to serve as cart. See https://github.com/spree/spree/blob/1-3-stable/core/lib/spree/core/controller_helpers/order.rb#L14
+  # for details.
   def expire_current_order
     session[:order_id] = nil
     @current_order = nil
diff --git a/app/services/reset_order_service.rb b/app/services/reset_order_service.rb
index 18e53272ec..10bd4cd740 100644
--- a/app/services/reset_order_service.rb
+++ b/app/services/reset_order_service.rb
@@ -1,10 +1,18 @@
+# Builds a new order based on the one specified. This implements the "continue
+# shopping" feature once an order is completed.
 class ResetOrderService
+
+  # Constructor
+  #
+  # @param controller [#expire_current_order, #current_order]
+  # @param order [Spree::Order]
   def initialize(controller, order)
     @controller = controller
     @distributor = order.distributor
     @token = order.token
   end
 
+  # Expires the order currently in use and builds a new one based on it
   def call
     controller.expire_current_order
     build_new_order
@@ -14,6 +22,7 @@ class ResetOrderService
 
   attr_reader :controller, :distributor, :token
 
+  # Builds an order setting the token and distributor of the one specified
   def build_new_order
     new_order = controller.current_order(true)
     new_order.set_distributor!(distributor)

From 819a003f26e4ab94a513da8a4488159b2bc9616f Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Wed, 19 Jul 2017 18:23:59 +0200
Subject: [PATCH 087/353] Backport Spree fix for product properties delete icon

https://github.com/spree/spree/commit/fea76b907bebe0b8c8a572f23491aba54b1e5180
---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 69b6b83ece..133ecbd1c1 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,7 +8,7 @@ GIT
 
 GIT
   remote: git://github.com/coopdevs/spree.git
-  revision: 3337e6b2a894a086b416be0d4c0fdf6c9bf5e701
+  revision: 94e020de3e88cef106d6bf94f10edb7959b36dd1
   branch: spree-upgrade-step-6
   specs:
     spree (1.3.99)

From 9aca5459b70192a01ecce1a0150ca0f874b828a2 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Wed, 19 Jul 2017 18:25:58 +0200
Subject: [PATCH 088/353] Revert "Fix removal of product properties"

This reverts commit 3b94e12f8db0d4d2b2e48c085fab8231ec8e86e8.
---
 .../replace_link_to_remove_fields.html.haml.deface            | 4 ----
 1 file changed, 4 deletions(-)
 delete mode 100644 app/overrides/spree/admin/product_properties/_product_property_fields/replace_link_to_remove_fields.html.haml.deface

diff --git a/app/overrides/spree/admin/product_properties/_product_property_fields/replace_link_to_remove_fields.html.haml.deface b/app/overrides/spree/admin/product_properties/_product_property_fields/replace_link_to_remove_fields.html.haml.deface
deleted file mode 100644
index b59f15ce72..0000000000
--- a/app/overrides/spree/admin/product_properties/_product_property_fields/replace_link_to_remove_fields.html.haml.deface
+++ /dev/null
@@ -1,4 +0,0 @@
-/ replace_contents "[data-hook='product_property'] .actions"
-
-- unless @product.properties.empty?
-  = link_to_remove_fields_without_url t(:remove), f, no_text: true

From 3b8cab9392f9f9c3ecf7ac59ce5b06d81f0e3c29 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Wed, 19 Jul 2017 18:27:33 +0200
Subject: [PATCH 089/353] Revert "Fix removal of producer properties - remove
 href attr so Spree doesn't attempt an XHR"

This reverts commit 8126161df2b96f9cec5c34ffaefa093fe5aed858.
---
 app/helpers/spree/admin/base_helper_decorator.rb      | 11 -----------
 .../_producer_property_fields.html.haml               |  2 +-
 2 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/app/helpers/spree/admin/base_helper_decorator.rb b/app/helpers/spree/admin/base_helper_decorator.rb
index 85e2f83781..99fde70676 100644
--- a/app/helpers/spree/admin/base_helper_decorator.rb
+++ b/app/helpers/spree/admin/base_helper_decorator.rb
@@ -22,17 +22,6 @@ module Spree
 
         link_to_with_icon('icon-trash', name, '#', html_options) + f.hidden_field(:_destroy)
       end
-
-      def link_to_remove_fields_without_url(name, f, options = {})
-        name = '' if options[:no_text]
-        options[:class] = '' unless options[:class]
-        options[:class] += 'no-text with-tip' if options[:no_text]
-
-        html_options = {class: "remove_fields #{options[:class]}", data: {action: 'remove'}, title: t(:remove)}
-        html_options.merge!(options[:html]) if options.key? :html
-
-        link_to_with_icon('icon-trash', name, '#', html_options).gsub('href="#" ', '') + f.hidden_field(:_destroy)
-      end
     end
   end
 end
diff --git a/app/views/admin/producer_properties/_producer_property_fields.html.haml b/app/views/admin/producer_properties/_producer_property_fields.html.haml
index 65e6f1a15b..6fe0b1d7ad 100644
--- a/app/views/admin/producer_properties/_producer_property_fields.html.haml
+++ b/app/views/admin/producer_properties/_producer_property_fields.html.haml
@@ -12,4 +12,4 @@
     = f.text_field :value, :class => 'autocomplete'
   %td.actions
     - unless @enterprise.producer_properties.empty?
-      = link_to_remove_fields_without_url t(:remove), f, no_text: true, html: {"onclick" => "if(typeof(enterprise_form) != 'undefined') { angular.element(enterprise_form).scope().setFormDirty() }".html_safe}
+      = link_to_remove_fields t(:remove), f, no_text: true, url: (f.object.persisted? && main_app.admin_enterprise_producer_property_path(@enterprise, f.object)), html: {"onclick" => "if(typeof(enterprise_form) != 'undefined') { angular.element(enterprise_form).scope().setFormDirty() }".html_safe}

From bc62ad5797f939c06d89dc9d233abdf16039d8f9 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Wed, 19 Jul 2017 18:32:23 +0200
Subject: [PATCH 090/353] Fix spec

---
 spec/helpers/spree/admin/base_helper_spec.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/spec/helpers/spree/admin/base_helper_spec.rb b/spec/helpers/spree/admin/base_helper_spec.rb
index 5daaaf8c28..a47b04113f 100644
--- a/spec/helpers/spree/admin/base_helper_spec.rb
+++ b/spec/helpers/spree/admin/base_helper_spec.rb
@@ -1,15 +1,15 @@
 require 'spec_helper'
 
 describe Spree::BaseHelper, type: :helper do
-  describe "#link_to_remove_fields_without_url" do
+  describe "#link_to_remove_fields" do
     let(:name) { 'Hola' }
     let(:form) { double('form_for', hidden_field: '<input type="hidden" name="_method" value="destroy">') }
     let(:options) { {} }
 
-    subject { helper.link_to_remove_fields_without_url(name, form, options) }
+    subject { helper.link_to_remove_fields(name, form, options) }
 
     it 'returns an `a` tag followed by a hidden `input` tag' do
-      expect(subject).to eq("<a class=\"remove_fields  icon_link with-tip icon-trash\" data-action=\"remove\" title=\"Remove\"><span class='text'>Hola</span></a><input type=\"hidden\" name=\"_method\" value=\"destroy\">")
+      expect(subject).to eq("<a href=\"#\" class=\"remove_fields  icon_link with-tip icon-trash\" data-action=\"remove\" title=\"Remove\"><span class='text'>Hola</span></a>&lt;input type=&quot;hidden&quot; name=&quot;_method&quot; value=&quot;destroy&quot;&gt;")
     end
   end
 end

From 595d7b55942b8ebdeb375dd1048765c3588f1fea Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 20 Jul 2017 15:47:14 +1000
Subject: [PATCH 091/353] Remove conditional assignment from
 PaymentsController#fire decorator

---
 app/controllers/spree/admin/payments_controller_decorator.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/controllers/spree/admin/payments_controller_decorator.rb b/app/controllers/spree/admin/payments_controller_decorator.rb
index cbcecd852f..92faeb093d 100644
--- a/app/controllers/spree/admin/payments_controller_decorator.rb
+++ b/app/controllers/spree/admin/payments_controller_decorator.rb
@@ -5,7 +5,8 @@ Spree::Admin::PaymentsController.class_eval do
   # When a user fires an event, take them back to where they came from
   # (we can't use respond_override because Spree no longer uses respond_with)
   def fire
-    return unless event = params[:e] && @payment.payment_source
+    event = params[:e]
+    return unless event && @payment.payment_source
 
     # Because we have a transition method also called void, we do this to avoid conflicts.
     event = "void_transaction" if event == "void"

From 4b89a1d736755af995551192e2eb624a2ddc3e88 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 20 Jul 2017 16:10:36 +1000
Subject: [PATCH 092/353] Fix Layout/EmptyLinesAroundClassBody offence in
 ResetOrderService

---
 app/services/reset_order_service.rb | 1 -
 1 file changed, 1 deletion(-)

diff --git a/app/services/reset_order_service.rb b/app/services/reset_order_service.rb
index 10bd4cd740..402c377eb7 100644
--- a/app/services/reset_order_service.rb
+++ b/app/services/reset_order_service.rb
@@ -1,7 +1,6 @@
 # Builds a new order based on the one specified. This implements the "continue
 # shopping" feature once an order is completed.
 class ResetOrderService
-
   # Constructor
   #
   # @param controller [#expire_current_order, #current_order]

From ff2b2e17d9cadd0d5bfe4a20d1fcf1ac2824489a Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Thu, 20 Jul 2017 17:39:22 +0200
Subject: [PATCH 093/353] Order email translation keys

---
 app/controllers/spree/admin/orders_controller_decorator.rb | 2 +-
 config/locales/en.yml                                      | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/controllers/spree/admin/orders_controller_decorator.rb b/app/controllers/spree/admin/orders_controller_decorator.rb
index e99b91638b..19a1223946 100644
--- a/app/controllers/spree/admin/orders_controller_decorator.rb
+++ b/app/controllers/spree/admin/orders_controller_decorator.rb
@@ -70,7 +70,7 @@ Spree::Admin::OrdersController.class_eval do
   # This uses a new template. See mailers/spree/order_mailer_decorator.rb.
   def resend
     Spree::OrderMailer.confirm_email_for_customer(@order.id, true).deliver
-    flash[:success] = t(:order_email_resent)
+    flash[:success] = t('admin.orders.order_email_resent')
 
     respond_with(@order) { |format| format.html { redirect_to :back } }
   end
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 9519b207b3..9c1d7e538a 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -378,7 +378,8 @@ en:
       index:
         capture: "Capture"
         ship: "Ship"
-      invoice_email_sent: 'Invoice sent'
+      invoice_email_sent: 'Invoice email has been sent'
+      order_email_resent: 'Order email has been resent'
       bulk_management:
         tip: "Use this page to alter product quantities across multiple orders. Products may also be removed from orders entirely, if required."
         shared: "Shared Resource?"

From d8e17231ec39860099b0986eaeca2c2926376984 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Thu, 20 Jul 2017 17:42:40 +0200
Subject: [PATCH 094/353] Revert "Order email translation keys"

This reverts commit dc30e0b1042602ed8f03fe97444ccce8526e51b3.
---
 app/controllers/spree/admin/orders_controller_decorator.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/spree/admin/orders_controller_decorator.rb b/app/controllers/spree/admin/orders_controller_decorator.rb
index 19a1223946..e99b91638b 100644
--- a/app/controllers/spree/admin/orders_controller_decorator.rb
+++ b/app/controllers/spree/admin/orders_controller_decorator.rb
@@ -70,7 +70,7 @@ Spree::Admin::OrdersController.class_eval do
   # This uses a new template. See mailers/spree/order_mailer_decorator.rb.
   def resend
     Spree::OrderMailer.confirm_email_for_customer(@order.id, true).deliver
-    flash[:success] = t('admin.orders.order_email_resent')
+    flash[:success] = t(:order_email_resent)
 
     respond_with(@order) { |format| format.html { redirect_to :back } }
   end

From 665acdef8fc2768efe3f31778762e9aa05afa766 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Wed, 2 Aug 2017 11:48:50 +0200
Subject: [PATCH 095/353] Backport fix for hidden input tag

https://github.com/coopdevs/spree/pull/1
---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 133ecbd1c1..993d7a9a47 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,7 +8,7 @@ GIT
 
 GIT
   remote: git://github.com/coopdevs/spree.git
-  revision: 94e020de3e88cef106d6bf94f10edb7959b36dd1
+  revision: 5cc88578255b42ed710c91fc014a21d86561c74e
   branch: spree-upgrade-step-6
   specs:
     spree (1.3.99)

From 7e5e167215e81c599eabcd6870b0012cea502bc3 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Thu, 27 Jul 2017 15:56:21 +0200
Subject: [PATCH 096/353] Create a mail method when inserting seed data

---
 lib/tasks/dev.rake | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/tasks/dev.rake b/lib/tasks/dev.rake
index db5c2bad0c..cbbdc9d66a 100644
--- a/lib/tasks/dev.rake
+++ b/lib/tasks/dev.rake
@@ -9,6 +9,13 @@ namespace :openfoodnetwork do
       require_relative '../../spec/support/spree/init'
       task_name = "openfoodnetwork:dev:load_sample_data"
 
+      # -- MailMethod
+      # TODO: Remove me when in Spree 2.0. See http://guides.spreecommerce.org/release_notes/spree_2_0_0.html#mailmethod-model-no-longer-exists
+      Spree::MailMethod.create!(
+        environment: Rails.env,
+        preferred_mails_from: 'spree@example.com'
+      )
+
       # -- Shipping / payment information
       unless Spree::Zone.find_by_name 'Australia'
         puts "[#{task_name}] Seeding shipping / payment information"

From 318f89f9a20a042e8b8b891d098a20b2cdf22407 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Thu, 3 Aug 2017 18:40:42 +0200
Subject: [PATCH 097/353] Use older spree_auth_devise

---
 Gemfile      |  2 +-
 Gemfile.lock | 31 ++++++++++++++++---------------
 2 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/Gemfile b/Gemfile
index 32983d2b8e..61315e33ac 100644
--- a/Gemfile
+++ b/Gemfile
@@ -12,7 +12,7 @@ gem 'nokogiri', '>= 1.6.7.1'
 gem 'pg'
 gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-6'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
-gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
+gem 'spree_auth_devise', github: 'coopdevs/spree_auth_devise', branch: 'spree-upgrade-trying-to-fix-capture-button'
 
 # Our branch contains two changes
 # - Pass customer email and phone number to PayPal (merged to upstream master)
diff --git a/Gemfile.lock b/Gemfile.lock
index 993d7a9a47..7b251087c1 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -67,6 +67,19 @@ GIT
     spree_sample (1.3.99)
       spree_core (= 1.3.99)
 
+GIT
+  remote: git://github.com/coopdevs/spree_auth_devise.git
+  revision: e93d21f2f0d808178d07e066ce802d95722c4c95
+  branch: spree-upgrade-trying-to-fix-capture-button
+  specs:
+    spree_auth_devise (1.0.0)
+      cancan (~> 1.6.7)
+      devise (~> 2.2.3)
+      devise-encryptable (= 0.1.1)
+      spree_backend (~> 1.3.6)
+      spree_core (~> 1.3.6)
+      spree_frontend (~> 1.3.6)
+
 GIT
   remote: git://github.com/jeremydurham/custom-err-msg.git
   revision: 3a8ec9dddc7a5b0aab7c69a6060596de300c68f4
@@ -89,18 +102,6 @@ GIT
     ofn-qz (0.1.0)
       railties (~> 3.1)
 
-GIT
-  remote: git://github.com/openfoodfoundation/spree_auth_devise.git
-  revision: da9eecefc6fe13dedf4c6f3febec79caad839ec3
-  branch: spree-upgrade-intermediate
-  specs:
-    spree_auth_devise (2.0.0)
-      devise (~> 2.2.5)
-      devise-encryptable (= 0.1.2)
-      spree_backend (~> 1.3.6)
-      spree_core (~> 1.3.6)
-      spree_frontend (~> 1.3.6)
-
 GIT
   remote: git://github.com/spree/deface.git
   revision: 1110a1336252109bce7f98f9182042e0bc2930ae
@@ -266,8 +267,8 @@ GEM
       orm_adapter (~> 0.1)
       railties (~> 3.1)
       warden (~> 1.2.1)
-    devise-encryptable (0.1.2)
-      devise (>= 2.1.0)
+    devise-encryptable (0.1.1)
+      devise (>= 2.1.0.rc)
     diff-lcs (1.2.4)
     diffy (3.1.0)
     em-websocket (0.5.0)
@@ -661,7 +662,7 @@ GEM
       actionpack (>= 3.0)
       activesupport (>= 3.0)
       railties (>= 3.0)
-    warden (1.2.6)
+    warden (1.2.7)
       rack (>= 1.0)
     webmock (1.8.11)
       addressable (>= 2.2.7)

From fe7d3b0d583c11de2451178608e06541a01ce4f9 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Thu, 3 Aug 2017 18:58:09 +0200
Subject: [PATCH 098/353] Revert "Use older spree_auth_devise"

This reverts commit 2f63fb16f36c96c793d5aba1889a274315ccdf00.
---
 Gemfile      |  2 +-
 Gemfile.lock | 31 +++++++++++++++----------------
 2 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/Gemfile b/Gemfile
index 61315e33ac..32983d2b8e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -12,7 +12,7 @@ gem 'nokogiri', '>= 1.6.7.1'
 gem 'pg'
 gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-6'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
-gem 'spree_auth_devise', github: 'coopdevs/spree_auth_devise', branch: 'spree-upgrade-trying-to-fix-capture-button'
+gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
 # Our branch contains two changes
 # - Pass customer email and phone number to PayPal (merged to upstream master)
diff --git a/Gemfile.lock b/Gemfile.lock
index 7b251087c1..993d7a9a47 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -67,19 +67,6 @@ GIT
     spree_sample (1.3.99)
       spree_core (= 1.3.99)
 
-GIT
-  remote: git://github.com/coopdevs/spree_auth_devise.git
-  revision: e93d21f2f0d808178d07e066ce802d95722c4c95
-  branch: spree-upgrade-trying-to-fix-capture-button
-  specs:
-    spree_auth_devise (1.0.0)
-      cancan (~> 1.6.7)
-      devise (~> 2.2.3)
-      devise-encryptable (= 0.1.1)
-      spree_backend (~> 1.3.6)
-      spree_core (~> 1.3.6)
-      spree_frontend (~> 1.3.6)
-
 GIT
   remote: git://github.com/jeremydurham/custom-err-msg.git
   revision: 3a8ec9dddc7a5b0aab7c69a6060596de300c68f4
@@ -102,6 +89,18 @@ GIT
     ofn-qz (0.1.0)
       railties (~> 3.1)
 
+GIT
+  remote: git://github.com/openfoodfoundation/spree_auth_devise.git
+  revision: da9eecefc6fe13dedf4c6f3febec79caad839ec3
+  branch: spree-upgrade-intermediate
+  specs:
+    spree_auth_devise (2.0.0)
+      devise (~> 2.2.5)
+      devise-encryptable (= 0.1.2)
+      spree_backend (~> 1.3.6)
+      spree_core (~> 1.3.6)
+      spree_frontend (~> 1.3.6)
+
 GIT
   remote: git://github.com/spree/deface.git
   revision: 1110a1336252109bce7f98f9182042e0bc2930ae
@@ -267,8 +266,8 @@ GEM
       orm_adapter (~> 0.1)
       railties (~> 3.1)
       warden (~> 1.2.1)
-    devise-encryptable (0.1.1)
-      devise (>= 2.1.0.rc)
+    devise-encryptable (0.1.2)
+      devise (>= 2.1.0)
     diff-lcs (1.2.4)
     diffy (3.1.0)
     em-websocket (0.5.0)
@@ -662,7 +661,7 @@ GEM
       actionpack (>= 3.0)
       activesupport (>= 3.0)
       railties (>= 3.0)
-    warden (1.2.7)
+    warden (1.2.6)
       rack (>= 1.0)
     webmock (1.8.11)
       addressable (>= 2.2.7)

From d27b8f8fcb65d72ca124c84f2840c1e00eadf9a9 Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Thu, 3 Aug 2017 19:23:49 +0200
Subject: [PATCH 099/353] Add spree_auth_devise initializer

---
 config/initializers/spree_auth_devise.rb | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 config/initializers/spree_auth_devise.rb

diff --git a/config/initializers/spree_auth_devise.rb b/config/initializers/spree_auth_devise.rb
new file mode 100644
index 0000000000..a59badf636
--- /dev/null
+++ b/config/initializers/spree_auth_devise.rb
@@ -0,0 +1,16 @@
+# `spree_auth_devise` gem decorators get loaded in a `to_prepare` callback
+# referring to Spree classes that have not been loaded yet
+#
+# When this initializer is loaded we're sure that those Spree classes have been
+# loaded and we load again the `spree_auth_devise` decorators to effectively
+# apply them.
+#
+# Give a look at `if defined?(Spree::Admin::BaseController)` in the following file
+# to get an example:
+# https://github.com/openfoodfoundation/spree_auth_devise/blob/spree-upgrade-intermediate/app/controllers/spree/admin/admin_controller_decorator.rb#L1
+#
+# TODO: remove this hack once we get to Spree 3.0
+gem_dir = Gem::Specification.find_by_name("spree_auth_devise").gem_dir
+Dir.glob(File.join(gem_dir, 'app/**/*_decorator*.rb')) do |c|
+  load c
+end

From 4d94b65d254099a1e0816485a341600ab4bc6593 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Thu, 27 Jul 2017 16:51:14 +0200
Subject: [PATCH 100/353] Load order also on open and close adjustments

@order is not loaded by Spree because we overrode the :before_filter in
spree/admin/orders_controller_decorator.rb. We need to also specify so in the
decorator.
---
 app/controllers/spree/admin/orders_controller_decorator.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/spree/admin/orders_controller_decorator.rb b/app/controllers/spree/admin/orders_controller_decorator.rb
index e99b91638b..18a2bcc118 100644
--- a/app/controllers/spree/admin/orders_controller_decorator.rb
+++ b/app/controllers/spree/admin/orders_controller_decorator.rb
@@ -4,7 +4,7 @@ Spree::Admin::OrdersController.class_eval do
   include OpenFoodNetwork::SpreeApiKeyLoader
   helper CheckoutHelper
   before_filter :load_spree_api_key, :only => :bulk_management
-  before_filter :load_order, only: %i[show edit update fire resend invoice print]
+  before_filter :load_order, only: %i[show edit update fire resend invoice print open_adjustments close_adjustments]
 
   before_filter :load_distribution_choices, only: [:new, :edit, :update]
 

From 7a33b9cea752ba2ea5d9fae6ad294033847ded7b Mon Sep 17 00:00:00 2001
From: Enrico Stano <ocirne.onats@gmail.com>
Date: Thu, 10 Aug 2017 13:17:47 +0200
Subject: [PATCH 101/353] Backport latest Spree changes from coopdevs/spree

---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 993d7a9a47..6457fd280e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,7 +8,7 @@ GIT
 
 GIT
   remote: git://github.com/coopdevs/spree.git
-  revision: 5cc88578255b42ed710c91fc014a21d86561c74e
+  revision: 62f1ae8a9a9e36960ddf0213857dd89f9f052c60
   branch: spree-upgrade-step-6
   specs:
     spree (1.3.99)

From b3c94fd68893da2ac24e44c87830cfe55b4ed06f Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Thu, 10 Aug 2017 17:45:22 +0200
Subject: [PATCH 102/353] Revert "Load order also on open and close
 adjustments"

This reverts commit d77588431aa26422e2956fd3510a20b35dab1b1c.
---
 app/controllers/spree/admin/orders_controller_decorator.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/spree/admin/orders_controller_decorator.rb b/app/controllers/spree/admin/orders_controller_decorator.rb
index 18a2bcc118..e99b91638b 100644
--- a/app/controllers/spree/admin/orders_controller_decorator.rb
+++ b/app/controllers/spree/admin/orders_controller_decorator.rb
@@ -4,7 +4,7 @@ Spree::Admin::OrdersController.class_eval do
   include OpenFoodNetwork::SpreeApiKeyLoader
   helper CheckoutHelper
   before_filter :load_spree_api_key, :only => :bulk_management
-  before_filter :load_order, only: %i[show edit update fire resend invoice print open_adjustments close_adjustments]
+  before_filter :load_order, only: %i[show edit update fire resend invoice print]
 
   before_filter :load_distribution_choices, only: [:new, :edit, :update]
 

From 8db1fa4e77b31f786b0d4b7d04aeb05ac811296c Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Wed, 9 Aug 2017 14:14:10 +0200
Subject: [PATCH 103/353] Move JSON line items responses to a new controller

Extracts the JSON response from the admin's line item controller which
are only used by the bulk management feature into its own controller.

This decouples spree from an OFN-only feature and allows to remove
unnecessary code. Furthermore, Admin::LineItemsController is gone in
Spree 2.4.0.beta. See: https://github.com/spree/spree/pull/5280
---
 .../resources/line_item_resource.js.coffee    |   2 +-
 .../resources/services/line_items.js.coffee   |   4 +-
 .../admin/bulk_line_items_controller.rb       |  53 ++++
 .../admin/line_items_controller_decorator.rb  |  23 --
 config/routes.rb                              |   6 +-
 .../admin/bulk_line_items_controller_spec.rb  | 249 ++++++++++++++++++
 .../spree/admin/line_items_controller_spec.rb | 123 ---------
 7 files changed, 309 insertions(+), 151 deletions(-)
 create mode 100644 app/controllers/admin/bulk_line_items_controller.rb
 create mode 100644 spec/controllers/admin/bulk_line_items_controller_spec.rb

diff --git a/app/assets/javascripts/admin/resources/resources/line_item_resource.js.coffee b/app/assets/javascripts/admin/resources/resources/line_item_resource.js.coffee
index 4301f8df82..2ec5703c82 100644
--- a/app/assets/javascripts/admin/resources/resources/line_item_resource.js.coffee
+++ b/app/assets/javascripts/admin/resources/resources/line_item_resource.js.coffee
@@ -1,5 +1,5 @@
 angular.module("admin.resources").factory 'LineItemResource', ($resource) ->
-  $resource('/admin/:orders/:order_number/line_items/:id.json', {}, {
+  $resource('/admin/bulk_line_items/:id.json', {}, {
     'index':
       method: 'GET'
       isArray: true
diff --git a/app/assets/javascripts/admin/resources/services/line_items.js.coffee b/app/assets/javascripts/admin/resources/services/line_items.js.coffee
index 182ef81e6a..7c96caecd8 100644
--- a/app/assets/javascripts/admin/resources/services/line_items.js.coffee
+++ b/app/assets/javascripts/admin/resources/services/line_items.js.coffee
@@ -26,7 +26,7 @@ angular.module("admin.resources").factory 'LineItems', ($q, LineItemResource) ->
     save: (lineItem) ->
       deferred = $q.defer()
       lineItem.errors = {}
-      lineItem.$update({id: lineItem.id, orders: "orders", order_number: lineItem.order.number})
+      lineItem.$update({id: lineItem.id})
       .then( (data) =>
         @pristineByID[lineItem.id] = angular.copy(lineItem)
         deferred.resolve(data)
@@ -54,7 +54,7 @@ angular.module("admin.resources").factory 'LineItems', ($q, LineItemResource) ->
 
     delete: (lineItem, callback=null) ->
       deferred = $q.defer()
-      lineItem.$delete({id: lineItem.id, orders: "orders", order_number: lineItem.order.number})
+      lineItem.$delete({id: lineItem.id})
       .then( (data) =>
         delete @byID[lineItem.id]
         delete @pristineByID[lineItem.id]
diff --git a/app/controllers/admin/bulk_line_items_controller.rb b/app/controllers/admin/bulk_line_items_controller.rb
new file mode 100644
index 0000000000..044038bbfb
--- /dev/null
+++ b/app/controllers/admin/bulk_line_items_controller.rb
@@ -0,0 +1,53 @@
+module Admin
+  class BulkLineItemsController < Spree::Admin::BaseController
+
+    # GET /admin/bulk_line_items.json
+    #
+    def index
+      order_params = params[:q].andand.delete :order
+      orders = OpenFoodNetwork::Permissions.new(spree_current_user).editable_orders.ransack(order_params).result
+      line_items = OpenFoodNetwork::Permissions.new(spree_current_user).editable_line_items.where(order_id: orders).ransack(params[:q])
+      render_as_json line_items.result.reorder('order_id ASC, id ASC')
+    end
+
+    # PUT /admin/bulk_line_items/:id.json
+    #
+    def update
+      load_line_item
+      authorize! :update, @line_item.order
+
+      if @line_item.update_attributes(params[:line_item])
+        render nothing: true, status: 204 # No Content, does not trigger ng resource auto-update
+      else
+        render json: { errors: @line_item.errors }, status: 412
+      end
+    end
+
+    # DELETE /admin/bulk_line_items/:id.json
+    #
+    def destroy
+      load_line_item
+      authorize! :update, @line_item.order
+
+      @line_item.destroy
+      render nothing: true, status: 204 # No Content, does not trigger ng resource auto-update
+    end
+
+    private
+
+    def load_line_item
+      @line_item = Spree::LineItem.find(params[:id])
+    end
+
+    def model_class
+      Spree::LineItem
+    end
+
+    # Returns the appropriate serializer for this controller
+    #
+    # @return [Api::Admin::LineItemSerializer]
+    def serializer(_ams_prefix)
+      Api::Admin::LineItemSerializer
+    end
+  end
+end
diff --git a/app/controllers/spree/admin/line_items_controller_decorator.rb b/app/controllers/spree/admin/line_items_controller_decorator.rb
index 7d76cda245..637fc82a11 100644
--- a/app/controllers/spree/admin/line_items_controller_decorator.rb
+++ b/app/controllers/spree/admin/line_items_controller_decorator.rb
@@ -2,19 +2,6 @@ Spree::Admin::LineItemsController.class_eval do
   prepend_before_filter :load_order, except: :index
   around_filter :apply_enterprise_fees_with_lock, only: :update
 
-  # TODO make updating line items faster by creating a bulk update method
-
-  def index
-    respond_to do |format|
-      format.json do
-        order_params = params[:q].andand.delete :order
-        orders = OpenFoodNetwork::Permissions.new(spree_current_user).editable_orders.ransack(order_params).result
-        line_items = OpenFoodNetwork::Permissions.new(spree_current_user).editable_line_items.where(order_id: orders).ransack(params[:q])
-        render_as_json line_items.result.reorder('order_id ASC, id ASC')
-      end
-    end
-  end
-
   def create
     variant = Spree::Variant.find(params[:line_item][:variant_id])
     OpenFoodNetwork::ScopeVariantToHub.new(@order.distributor).scope(variant)
@@ -34,7 +21,6 @@ Spree::Admin::LineItemsController.class_eval do
 
   # TODO: simplify this, 3 formats per action is too much
   #       we need `js` format for admin/orders/edit (jquery-rails gem)
-  #       we need `json` format for admin/orders/bulk_management (angular)
   #       we don't know if `html` format is needed
   def update
     respond_to do |format|
@@ -46,19 +32,11 @@ Spree::Admin::LineItemsController.class_eval do
           render json: { errors: @line_item.errors }, status: 412
         end
       }
-      format.json {
-        if @line_item.update_attributes(params[:line_item])
-          render nothing: true, status: 204 # No Content, does not trigger ng resource auto-update
-        else
-          render json: { errors: @line_item.errors }, status: 412
-        end
-      }
     end
   end
 
   # TODO: simplify this, 3 formats per action is too much:
   #       we need `js` format for admin/orders/edit (jquery-rails gem)
-  #       we need `json` format for admin/orders/bulk_management (angular)
   #       we don't know if `html` format is needed
   def destroy
     @line_item.destroy
@@ -66,7 +44,6 @@ Spree::Admin::LineItemsController.class_eval do
     respond_to do |format|
       format.html { render_order_form }
       format.js { render nothing: true, status: 204 } # No Content
-      format.json { render nothing: true, status: 204 } # No Content
     end
   end
 
diff --git a/config/routes.rb b/config/routes.rb
index 02c459cea0..b91779166c 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -53,6 +53,10 @@ Openfoodnetwork::Application.routes.draw do
     end
   end
 
+  namespace :admin do
+    resources :bulk_line_items
+  end
+
   get '/checkout', :to => 'checkout#edit' , :as => :checkout
   put '/checkout', :to => 'checkout#update' , :as => :update_checkout
   get '/checkout/paypal_payment/:order_id', to: 'checkout#paypal_payment', as: :paypal_payment
@@ -265,8 +269,6 @@ Spree::Core::Engine.routes.prepend do
       get :print_ticket, on: :member
       get :managed, on: :collection
     end
-
-    resources :line_items, only: [:index], format: :json
   end
 
   resources :orders do
diff --git a/spec/controllers/admin/bulk_line_items_controller_spec.rb b/spec/controllers/admin/bulk_line_items_controller_spec.rb
new file mode 100644
index 0000000000..a993285c59
--- /dev/null
+++ b/spec/controllers/admin/bulk_line_items_controller_spec.rb
@@ -0,0 +1,249 @@
+require 'spec_helper'
+
+describe Admin::BulkLineItemsController do
+  include AuthenticationWorkflow
+
+  describe '#index' do
+    render_views
+
+    let(:line_item_attributes) { [:id, :quantity, :max_quantity, :price, :supplier, :final_weight_volume, :units_product, :units_variant, :order] }
+    let!(:dist1) { FactoryGirl.create(:distributor_enterprise) }
+    let!(:order1) { FactoryGirl.create(:order, state: 'complete', completed_at: 1.day.ago, distributor: dist1, billing_address: FactoryGirl.create(:address) ) }
+    let!(:order2) { FactoryGirl.create(:order, state: 'complete', completed_at: Time.zone.now, distributor: dist1, billing_address: FactoryGirl.create(:address) ) }
+    let!(:order3) { FactoryGirl.create(:order, state: 'complete', completed_at: Time.zone.now, distributor: dist1, billing_address: FactoryGirl.create(:address) ) }
+    let!(:line_item1) { FactoryGirl.create(:line_item, order: order1) }
+    let!(:line_item2) { FactoryGirl.create(:line_item, order: order2) }
+    let!(:line_item3) { FactoryGirl.create(:line_item, order: order2) }
+    let!(:line_item4) { FactoryGirl.create(:line_item, order: order3) }
+
+    context "as a normal user" do
+      before { controller.stub spree_current_user: create_enterprise_user }
+
+      it "should deny me access to the index action" do
+        spree_get :index, :format => :json
+        expect(response).to redirect_to spree.unauthorized_path
+      end
+    end
+
+    context "as an administrator" do
+
+      before do
+        controller.stub spree_current_user: quick_login_as_admin
+      end
+
+      context "when no ransack params are passed in" do
+        before do
+          spree_get :index, :format => :json
+        end
+
+        it "retrieves a list of line_items with appropriate attributes, including line items with appropriate attributes" do
+          keys = json_response.first.keys.map{ |key| key.to_sym }
+          line_item_attributes.all?{ |attr| keys.include? attr }.should == true
+        end
+
+        it "sorts line_items in ascending id line_item" do
+          ids = json_response.map{ |line_item| line_item['id'] }
+          ids[0].should < ids[1]
+          ids[1].should < ids[2]
+        end
+
+        it "formats final_weight_volume as a float" do
+          json_response.map{ |line_item| line_item['final_weight_volume'] }.all?{ |fwv| fwv.is_a?(Float) }.should == true
+        end
+
+        it "returns distributor object with id key" do
+          json_response.map{ |line_item| line_item['supplier'] }.all?{ |d| d.has_key?('id') }.should == true
+        end
+      end
+
+      context "when ransack params are passed in for line items" do
+        before do
+          spree_get :index, :format => :json, q: { order_id_eq: order2.id }
+        end
+
+        it "retrives a list of line items which match the criteria" do
+          expect(json_response.map{ |line_item| line_item['id'] }).to eq [line_item2.id, line_item3.id]
+        end
+      end
+
+      context "when ransack params are passed in for orders" do
+        before do
+          spree_get :index, :format => :json, q: { order: { completed_at_gt: 2.hours.ago } }
+        end
+
+        it "retrives a list of line items whose orders match the criteria" do
+          expect(json_response.map{ |line_item| line_item['id'] }).to eq [line_item2.id, line_item3.id, line_item4.id]
+        end
+      end
+    end
+
+    context "as an enterprise user" do
+      let(:supplier) { create(:supplier_enterprise) }
+      let(:distributor1) { create(:distributor_enterprise) }
+      let(:distributor2) { create(:distributor_enterprise) }
+      let(:coordinator) { create(:distributor_enterprise) }
+      let(:order_cycle) { create(:simple_order_cycle, coordinator: coordinator) }
+      let!(:order1) { FactoryGirl.create(:order, order_cycle: order_cycle, state: 'complete', completed_at: Time.zone.now, distributor: distributor1, billing_address: FactoryGirl.create(:address) ) }
+      let!(:line_item1) { FactoryGirl.create(:line_item, order: order1, product: FactoryGirl.create(:product, supplier: supplier)) }
+      let!(:line_item2) { FactoryGirl.create(:line_item, order: order1, product: FactoryGirl.create(:product, supplier: supplier)) }
+      let!(:order2) { FactoryGirl.create(:order, order_cycle: order_cycle, state: 'complete', completed_at: Time.zone.now, distributor: distributor2, billing_address: FactoryGirl.create(:address) ) }
+      let!(:line_item3) { FactoryGirl.create(:line_item, order: order2, product: FactoryGirl.create(:product, supplier: supplier)) }
+
+      context "producer enterprise" do
+        before do
+          controller.stub spree_current_user: supplier.owner
+          spree_get :index, :format => :json
+        end
+
+        it "does not display line items for which my enterprise is a supplier" do
+          expect(response).to redirect_to spree.unauthorized_path
+        end
+      end
+
+      context "coordinator enterprise" do
+        before do
+          controller.stub spree_current_user: coordinator.owner
+          spree_get :index, :format => :json
+        end
+
+        it "retrieves a list of line_items" do
+          keys = json_response.first.keys.map{ |key| key.to_sym }
+          line_item_attributes.all?{ |attr| keys.include? attr }.should == true
+        end
+      end
+
+      context "hub enterprise" do
+        before do
+          controller.stub spree_current_user: distributor1.owner
+          spree_get :index, :format => :json
+        end
+
+        it "retrieves a list of line_items" do
+          keys = json_response.first.keys.map{ |key| key.to_sym }
+          line_item_attributes.all?{ |attr| keys.include? attr }.should == true
+        end
+      end
+    end
+  end
+
+  describe '#update' do
+    let(:supplier) { create(:supplier_enterprise) }
+    let(:distributor1) { create(:distributor_enterprise) }
+    let(:coordinator) { create(:distributor_enterprise) }
+    let(:order_cycle) { create(:simple_order_cycle, coordinator: coordinator) }
+    let!(:order1) { FactoryGirl.create(:order, order_cycle: order_cycle, state: 'complete', completed_at: Time.zone.now, distributor: distributor1, billing_address: FactoryGirl.create(:address) ) }
+    let!(:line_item1) { FactoryGirl.create(:line_item, order: order1, product: FactoryGirl.create(:product, supplier: supplier)) }
+    let(:line_item_params) { { quantity: 3, final_weight_volume: 3000, price: 3.00 } }
+    let(:params) { { id: line_item1.id, order_id: order1.number, line_item: line_item_params } }
+
+    context "as an enterprise user" do
+      context "producer enterprise" do
+        before do
+          controller.stub spree_current_user: supplier.owner
+          spree_put :update, params
+        end
+
+        it "does not allow access" do
+          expect(response).to redirect_to spree.unauthorized_path
+        end
+      end
+
+      context "coordinator enterprise" do
+        render_views
+
+        before do
+          controller.stub spree_current_user: coordinator.owner
+        end
+
+        # Used in admin/orders/bulk_management
+        context 'when the request is JSON (angular)' do
+          before { params[:format] = :json }
+
+          it "updates the line item" do
+            spree_put :update, params
+            line_item1.reload
+            expect(line_item1.quantity).to eq 3
+            expect(line_item1.final_weight_volume).to eq 3000
+            expect(line_item1.price).to eq 3.00
+          end
+
+          it "returns an empty JSON response" do
+            spree_put :update, params
+            expect(response.body).to eq ' '
+          end
+
+          it 'returns a 204 response' do
+            spree_put :update, params
+            expect(response.status).to eq 204
+          end
+
+          context 'when the line item params are not correct' do
+            let(:line_item_params) { { price: 'hola' } }
+            let(:errors) { { 'price' => ['is not a number'] } }
+
+            it 'returns a JSON with the errors' do
+              spree_put :update, params
+              expect(JSON.parse(response.body)['errors']).to eq(errors)
+            end
+
+            it 'returns a 412 response' do
+              spree_put :update, params
+              expect(response.status).to eq 412
+            end
+          end
+        end
+      end
+
+      context "hub enterprise" do
+        before do
+          controller.stub spree_current_user: distributor1.owner
+          xhr :put, :update, params
+        end
+
+        it "updates the line item" do
+          line_item1.reload
+          expect(line_item1.quantity).to eq 3
+          expect(line_item1.final_weight_volume).to eq 3000
+          expect(line_item1.price).to eq 3.00
+        end
+      end
+    end
+  end
+
+  describe '#destroy' do
+    render_views
+
+    let(:supplier) { create(:supplier_enterprise) }
+    let(:distributor1) { create(:distributor_enterprise) }
+    let(:coordinator) { create(:distributor_enterprise) }
+    let(:order_cycle) { create(:simple_order_cycle, coordinator: coordinator) }
+    let!(:order1) { FactoryGirl.create(:order, order_cycle: order_cycle, state: 'complete', completed_at: Time.zone.now, distributor: distributor1, billing_address: FactoryGirl.create(:address) ) }
+    let!(:line_item1) { FactoryGirl.create(:line_item, order: order1, product: FactoryGirl.create(:product, supplier: supplier)) }
+    let(:params) { { id: line_item1.id, order_id: order1.number } }
+
+    before do
+      controller.stub spree_current_user: coordinator.owner
+    end
+
+    # Used in admin/orders/bulk_management
+    context 'when the request is JSON (angular)' do
+      before { params[:format] = :json }
+
+      it 'destroys the line item' do
+        expect {
+          spree_delete :destroy, params
+        }.to change { Spree::LineItem.where(id: line_item1).count }.from(1).to(0)
+      end
+
+      it 'returns an empty JSON response' do
+        spree_delete :destroy, params
+        expect(response.body).to eq ' '
+      end
+
+      it 'returns a 204 response' do
+        spree_delete :destroy, params
+        expect(response.status).to eq 204
+      end
+    end
+  end
+end
diff --git a/spec/controllers/spree/admin/line_items_controller_spec.rb b/spec/controllers/spree/admin/line_items_controller_spec.rb
index 2aced0ad0c..0c9a4e4835 100644
--- a/spec/controllers/spree/admin/line_items_controller_spec.rb
+++ b/spec/controllers/spree/admin/line_items_controller_spec.rb
@@ -3,129 +3,6 @@ require 'spec_helper'
 describe Spree::Admin::LineItemsController do
   include AuthenticationWorkflow
 
-  describe "#index" do
-    render_views
-
-    let(:line_item_attributes) { [:id, :quantity, :max_quantity, :price, :supplier, :final_weight_volume, :units_product, :units_variant, :order] }
-    let!(:dist1) { FactoryGirl.create(:distributor_enterprise) }
-    let!(:order1) { FactoryGirl.create(:order, state: 'complete', completed_at: 1.day.ago, distributor: dist1, billing_address: FactoryGirl.create(:address) ) }
-    let!(:order2) { FactoryGirl.create(:order, state: 'complete', completed_at: Time.zone.now, distributor: dist1, billing_address: FactoryGirl.create(:address) ) }
-    let!(:order3) { FactoryGirl.create(:order, state: 'complete', completed_at: Time.zone.now, distributor: dist1, billing_address: FactoryGirl.create(:address) ) }
-    let!(:line_item1) { FactoryGirl.create(:line_item, order: order1) }
-    let!(:line_item2) { FactoryGirl.create(:line_item, order: order2) }
-    let!(:line_item3) { FactoryGirl.create(:line_item, order: order2) }
-    let!(:line_item4) { FactoryGirl.create(:line_item, order: order3) }
-
-    context "as a normal user" do
-      before { controller.stub spree_current_user: create_enterprise_user }
-
-      it "should deny me access to the index action" do
-        spree_get :index, :format => :json
-        expect(response).to redirect_to spree.unauthorized_path
-      end
-    end
-
-    context "as an administrator" do
-
-      before do
-        controller.stub spree_current_user: quick_login_as_admin
-      end
-
-      context "when no ransack params are passed in" do
-        before do
-          spree_get :index, :format => :json
-        end
-
-        it "retrieves a list of line_items with appropriate attributes, including line items with appropriate attributes" do
-          keys = json_response.first.keys.map{ |key| key.to_sym }
-          line_item_attributes.all?{ |attr| keys.include? attr }.should == true
-        end
-
-        it "sorts line_items in ascending id line_item" do
-          ids = json_response.map{ |line_item| line_item['id'] }
-          ids[0].should < ids[1]
-          ids[1].should < ids[2]
-        end
-
-        it "formats final_weight_volume as a float" do
-          json_response.map{ |line_item| line_item['final_weight_volume'] }.all?{ |fwv| fwv.is_a?(Float) }.should == true
-        end
-
-        it "returns distributor object with id key" do
-          json_response.map{ |line_item| line_item['supplier'] }.all?{ |d| d.has_key?('id') }.should == true
-        end
-      end
-
-      context "when ransack params are passed in for line items" do
-        before do
-          spree_get :index, :format => :json, q: { order_id_eq: order2.id }
-        end
-
-        it "retrives a list of line items which match the criteria" do
-          expect(json_response.map{ |line_item| line_item['id'] }).to eq [line_item2.id, line_item3.id]
-        end
-      end
-
-      context "when ransack params are passed in for orders" do
-        before do
-          spree_get :index, :format => :json, q: { order: { completed_at_gt: 2.hours.ago } }
-        end
-
-        it "retrives a list of line items whose orders match the criteria" do
-          expect(json_response.map{ |line_item| line_item['id'] }).to eq [line_item2.id, line_item3.id, line_item4.id]
-        end
-      end
-    end
-
-    context "as an enterprise user" do
-      let(:supplier) { create(:supplier_enterprise) }
-      let(:distributor1) { create(:distributor_enterprise) }
-      let(:distributor2) { create(:distributor_enterprise) }
-      let(:coordinator) { create(:distributor_enterprise) }
-      let(:order_cycle) { create(:simple_order_cycle, coordinator: coordinator) }
-      let!(:order1) { FactoryGirl.create(:order, order_cycle: order_cycle, state: 'complete', completed_at: Time.zone.now, distributor: distributor1, billing_address: FactoryGirl.create(:address) ) }
-      let!(:line_item1) { FactoryGirl.create(:line_item, order: order1, product: FactoryGirl.create(:product, supplier: supplier)) }
-      let!(:line_item2) { FactoryGirl.create(:line_item, order: order1, product: FactoryGirl.create(:product, supplier: supplier)) }
-      let!(:order2) { FactoryGirl.create(:order, order_cycle: order_cycle, state: 'complete', completed_at: Time.zone.now, distributor: distributor2, billing_address: FactoryGirl.create(:address) ) }
-      let!(:line_item3) { FactoryGirl.create(:line_item, order: order2, product: FactoryGirl.create(:product, supplier: supplier)) }
-
-      context "producer enterprise" do
-        before do
-          controller.stub spree_current_user: supplier.owner
-          spree_get :index, :format => :json
-        end
-
-        it "does not display line items for which my enterprise is a supplier" do
-          expect(response).to redirect_to spree.unauthorized_path
-        end
-      end
-
-      context "coordinator enterprise" do
-        before do
-          controller.stub spree_current_user: coordinator.owner
-          spree_get :index, :format => :json
-        end
-
-        it "retrieves a list of line_items" do
-          keys = json_response.first.keys.map{ |key| key.to_sym }
-          line_item_attributes.all?{ |attr| keys.include? attr }.should == true
-        end
-      end
-
-      context "hub enterprise" do
-        before do
-          controller.stub spree_current_user: distributor1.owner
-          spree_get :index, :format => :json
-        end
-
-        it "retrieves a list of line_items" do
-          keys = json_response.first.keys.map{ |key| key.to_sym }
-          line_item_attributes.all?{ |attr| keys.include? attr }.should == true
-        end
-      end
-    end
-  end
-
   describe "#create" do
     let!(:variant) { create(:variant, price: 88) }
     let!(:vo) { create(:variant_override, hub: distributor, variant: variant, price: 11.11) }

From 5b1947429ed1632fec4438d5b6f5c799a6df360f Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Wed, 9 Aug 2017 14:30:25 +0200
Subject: [PATCH 104/353] Fix odd-even background by relying on Spree

This removes unnecessary duplication of #destroy. We can make it work by
adding a simple fix in Spree.
---
 Gemfile                                       |   2 +-
 Gemfile.lock                                  |   4 +-
 .../admin/line_items_controller_decorator.rb  |  12 --
 .../spree/admin/line_items_controller_spec.rb | 105 +-----------------
 4 files changed, 4 insertions(+), 119 deletions(-)

diff --git a/Gemfile b/Gemfile
index 32983d2b8e..a38aaa1110 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-6'
+gem 'spree', github: 'coopdevs/spree', branch: 'fix-odd-even'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 6457fd280e..66aaca9410 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,8 +8,8 @@ GIT
 
 GIT
   remote: git://github.com/coopdevs/spree.git
-  revision: 62f1ae8a9a9e36960ddf0213857dd89f9f052c60
-  branch: spree-upgrade-step-6
+  revision: 3cd52439c3f78fb4fd6e5d72a4623bc8ff96d32b
+  branch: fix-odd-even
   specs:
     spree (1.3.99)
       spree_api (= 1.3.99)
diff --git a/app/controllers/spree/admin/line_items_controller_decorator.rb b/app/controllers/spree/admin/line_items_controller_decorator.rb
index 637fc82a11..7210a6abb1 100644
--- a/app/controllers/spree/admin/line_items_controller_decorator.rb
+++ b/app/controllers/spree/admin/line_items_controller_decorator.rb
@@ -35,18 +35,6 @@ Spree::Admin::LineItemsController.class_eval do
     end
   end
 
-  # TODO: simplify this, 3 formats per action is too much:
-  #       we need `js` format for admin/orders/edit (jquery-rails gem)
-  #       we don't know if `html` format is needed
-  def destroy
-    @line_item.destroy
-
-    respond_to do |format|
-      format.html { render_order_form }
-      format.js { render nothing: true, status: 204 } # No Content
-    end
-  end
-
   private
 
   def render_order_form
diff --git a/spec/controllers/spree/admin/line_items_controller_spec.rb b/spec/controllers/spree/admin/line_items_controller_spec.rb
index 0c9a4e4835..b8b6cd2785 100644
--- a/spec/controllers/spree/admin/line_items_controller_spec.rb
+++ b/spec/controllers/spree/admin/line_items_controller_spec.rb
@@ -85,50 +85,12 @@ describe Spree::Admin::LineItemsController do
           end
         end
 
-        # Used in admin/orders/bulk_management
-        context 'when the request is JSON (angular)' do
-          before { params[:format] = :json }
-
-          it "updates the line item" do
-            spree_put :update, params
-            line_item1.reload
-            expect(line_item1.quantity).to eq 3
-            expect(line_item1.final_weight_volume).to eq 3000
-            expect(line_item1.price).to eq 3.00
-          end
-
-          it "returns an empty JSON response" do
-            spree_put :update, params
-            expect(response.body).to eq ' '
-          end
-
-          it 'returns a 204 response' do
-            spree_put :update, params
-            expect(response.status).to eq 204
-          end
-
-          context 'when the line item params are not correct' do
-            let(:line_item_params) { { price: 'hola' } }
-            let(:errors) { { 'price' => ['is not a number'] } }
-
-            it 'returns a JSON with the errors' do
-              spree_put :update, params
-              expect(JSON.parse(response.body)['errors']).to eq(errors)
-            end
-
-            it 'returns a 412 response' do
-              spree_put :update, params
-              expect(response.status).to eq 412
-            end
-          end
-        end
-
         context 'when the request is HTML' do
           before { params[:format] = :html }
 
           it 'returns an HTML response with the order form' do
             spree_put :update, params
-            expect(response.body).to match /admin_order_form_fields/
+            expect(response.body).to match(/admin_order_form_fields/)
           end
         end
       end
@@ -148,69 +110,4 @@ describe Spree::Admin::LineItemsController do
       end
     end
   end
-
-  describe '#destroy' do
-    render_views
-
-    let(:supplier) { create(:supplier_enterprise) }
-    let(:distributor1) { create(:distributor_enterprise) }
-    let(:coordinator) { create(:distributor_enterprise) }
-    let(:order_cycle) { create(:simple_order_cycle, coordinator: coordinator) }
-    let!(:order1) { FactoryGirl.create(:order, order_cycle: order_cycle, state: 'complete', completed_at: Time.zone.now, distributor: distributor1, billing_address: FactoryGirl.create(:address) ) }
-    let!(:line_item1) { FactoryGirl.create(:line_item, order: order1, product: FactoryGirl.create(:product, supplier: supplier)) }
-    let(:params) { { id: line_item1.id, order_id: order1.number } }
-
-    before do
-      controller.stub spree_current_user: coordinator.owner
-    end
-
-    # Used in admin/orders/edit
-    context 'when the request is JS/XHR (jquery-rails gem)' do
-      it 'destroys the line item' do
-        expect {
-          xhr :delete, :destroy, params
-        }.to change { Spree::LineItem.where(id: line_item1).count }.from(1).to(0)
-      end
-
-      it 'returns an empty JSON response' do
-        xhr :delete, :destroy, params
-        expect(response.body).to eq ' '
-      end
-
-      it 'returns a 204 response' do
-        xhr :delete, :destroy, params
-        expect(response.status).to eq 204
-      end
-    end
-
-    # Used in admin/orders/bulk_management
-    context 'when the request is JSON (angular)' do
-      before { params[:format] = :json }
-
-      it 'destroys the line item' do
-        expect {
-          spree_delete :destroy, params
-        }.to change { Spree::LineItem.where(id: line_item1).count }.from(1).to(0)
-      end
-
-      it 'returns an empty JSON response' do
-        spree_delete :destroy, params
-        expect(response.body).to eq ' '
-      end
-
-      it 'returns a 204 response' do
-        spree_delete :destroy, params
-        expect(response.status).to eq 204
-      end
-    end
-
-    context 'when the request is HTML' do
-      before { params.merge(format: :html) }
-
-      it 'returns an HTML response with the order form' do
-        spree_delete :destroy, params
-        expect(response.body).to match /admin_order_form_fields/
-      end
-    end
-  end
 end

From 47468df2a5672677a1dc9f2d5fdb2ed0ec60223c Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Wed, 9 Aug 2017 18:30:54 +0200
Subject: [PATCH 105/353] Fix js unit tests

---
 .../controllers/line_items_controller_spec.js.coffee   |  6 +++---
 .../line_items/services/line_items_spec.js.coffee      | 10 +++++-----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/spec/javascripts/unit/admin/line_items/controllers/line_items_controller_spec.js.coffee b/spec/javascripts/unit/admin/line_items/controllers/line_items_controller_spec.js.coffee
index 23c42efde0..16a70c8abd 100644
--- a/spec/javascripts/unit/admin/line_items/controllers/line_items_controller_spec.js.coffee
+++ b/spec/javascripts/unit/admin/line_items/controllers/line_items_controller_spec.js.coffee
@@ -34,7 +34,7 @@ describe "LineItemsCtrl", ->
     lineItem = { id: 7, quantity: 3, order: { id: 9 }, supplier: { id: 1 } }
 
     httpBackend.expectGET("/admin/orders.json?q%5Bcompleted_at_gt%5D=SomeDate&q%5Bcompleted_at_lt%5D=SomeDate&q%5Bcompleted_at_not_null%5D=true&q%5Bstate_not_eq%5D=canceled").respond [order]
-    httpBackend.expectGET("/admin/line_items.json?q%5Border%5D%5Bcompleted_at_gt%5D=SomeDate&q%5Border%5D%5Bcompleted_at_lt%5D=SomeDate&q%5Border%5D%5Bcompleted_at_not_null%5D=true&q%5Border%5D%5Bstate_not_eq%5D=canceled").respond [lineItem]
+    httpBackend.expectGET("/admin/bulk_line_items.json?q%5Border%5D%5Bcompleted_at_gt%5D=SomeDate&q%5Border%5D%5Bcompleted_at_lt%5D=SomeDate&q%5Border%5D%5Bcompleted_at_not_null%5D=true&q%5Border%5D%5Bstate_not_eq%5D=canceled").respond [lineItem]
     httpBackend.expectGET("/admin/enterprises/for_line_items.json?ams_prefix=basic&q%5Bsells_in%5D%5B%5D=own&q%5Bsells_in%5D%5B%5D=any").respond [distributor]
     httpBackend.expectGET("/admin/order_cycles.json?ams_prefix=basic&as=distributor&q%5Borders_close_at_gt%5D=SomeDate").respond [orderCycle]
     httpBackend.expectGET("/admin/enterprises/for_line_items.json?ams_prefix=basic&q%5Bis_primary_producer_eq%5D=true").respond [supplier]
@@ -106,7 +106,7 @@ describe "LineItemsCtrl", ->
 
       describe "where the request is successful", ->
         beforeEach ->
-          httpBackend.expectDELETE("/admin/orders/R12345678/line_items/1.json").respond "nothing"
+          httpBackend.expectDELETE("/admin/bulk_line_items/1.json").respond "nothing"
           scope.deleteLineItem line_item1
           httpBackend.flush()
 
@@ -115,7 +115,7 @@ describe "LineItemsCtrl", ->
 
       describe "where the request is unsuccessful", ->
         beforeEach ->
-          httpBackend.expectDELETE("/admin/orders/R12345678/line_items/1.json").respond 404, "NO CONTENT"
+          httpBackend.expectDELETE("/admin/bulk_line_items/1.json").respond 404, "NO CONTENT"
           scope.deleteLineItem line_item1
           httpBackend.flush()
 
diff --git a/spec/javascripts/unit/admin/line_items/services/line_items_spec.js.coffee b/spec/javascripts/unit/admin/line_items/services/line_items_spec.js.coffee
index 3de04003e5..7367e06d88 100644
--- a/spec/javascripts/unit/admin/line_items/services/line_items_spec.js.coffee
+++ b/spec/javascripts/unit/admin/line_items/services/line_items_spec.js.coffee
@@ -19,7 +19,7 @@ describe "LineItems service", ->
 
     beforeEach ->
       response = [{ id: 5, name: 'LineItem 1'}]
-      $httpBackend.expectGET('/admin/line_items.json').respond 200, response
+      $httpBackend.expectGET('/admin/bulk_line_items.json').respond 200, response
       result = LineItems.index()
       $httpBackend.flush()
 
@@ -41,7 +41,7 @@ describe "LineItems service", ->
 
       beforeEach ->
         lineItem = new LineItemResource({ id: 15, order: { number: '12345678'} })
-        $httpBackend.expectPUT('/admin/orders/12345678/line_items/15.json').respond 200, { id: 15, name: 'LineItem 1'}
+        $httpBackend.expectPUT('/admin/bulk_line_items/15.json').respond 200, { id: 15, name: 'LineItem 1'}
         LineItems.save(lineItem).then( -> resolved = true)
         $httpBackend.flush()
 
@@ -60,7 +60,7 @@ describe "LineItems service", ->
 
       beforeEach ->
         lineItem = new LineItemResource( { id: 15, order: { number: '12345678'} } )
-        $httpBackend.expectPUT('/admin/orders/12345678/line_items/15.json').respond 422, { error: 'obj' }
+        $httpBackend.expectPUT('/admin/bulk_line_items/15.json').respond 422, { error: 'obj' }
         LineItems.save(lineItem).catch( -> rejected = true)
         $httpBackend.flush()
 
@@ -115,7 +115,7 @@ describe "LineItems service", ->
         lineItem = new LineItemResource({ id: 15, order: { number: '12345678'} })
         LineItems.pristineByID[15] = lineItem
         LineItems.byID[15] = lineItem
-        $httpBackend.expectDELETE('/admin/orders/12345678/line_items/15.json').respond 200, { id: 15, name: 'LineItem 1'}
+        $httpBackend.expectDELETE('/admin/bulk_line_items/15.json').respond 200, { id: 15, name: 'LineItem 1'}
         LineItems.delete(lineItem, callback).then( -> resolved = true).catch( -> rejected = true)
         $httpBackend.flush()
 
@@ -140,7 +140,7 @@ describe "LineItems service", ->
         lineItem = new LineItemResource({ id: 15, order: { number: '12345678'} })
         LineItems.pristineByID[15] = lineItem
         LineItems.byID[15] = lineItem
-        $httpBackend.expectDELETE('/admin/orders/12345678/line_items/15.json').respond 422, { error: 'obj' }
+        $httpBackend.expectDELETE('/admin/bulk_line_items/15.json').respond 422, { error: 'obj' }
         LineItems.delete(lineItem, callback).then( -> resolved = true).catch( -> rejected = true)
         $httpBackend.flush()
 

From 630e61ee5a986ab02a0b8da9bd4483cd088a74de Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Thu, 10 Aug 2017 12:17:56 +0200
Subject: [PATCH 106/353] Go back to the Spree's branch we use for step6

The fix introduced with https://github.com/coopdevs/spree/pull/2 was
already merged so we can point back to the `spree-upgrade-step-6`
branch.
---
 Gemfile      | 2 +-
 Gemfile.lock | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Gemfile b/Gemfile
index a38aaa1110..32983d2b8e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'coopdevs/spree', branch: 'fix-odd-even'
+gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-6'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 66aaca9410..9d5300b5e1 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,8 +8,8 @@ GIT
 
 GIT
   remote: git://github.com/coopdevs/spree.git
-  revision: 3cd52439c3f78fb4fd6e5d72a4623bc8ff96d32b
-  branch: fix-odd-even
+  revision: 598cae8456260073cc0bcf85004b67fb02b8724c
+  branch: spree-upgrade-step-6
   specs:
     spree (1.3.99)
       spree_api (= 1.3.99)
@@ -778,4 +778,4 @@ RUBY VERSION
    ruby 2.1.5p273
 
 BUNDLED WITH
-   1.15.2
+   1.15.3

From 1faa1579f36012920b41838cc9529d4e584bdc3e Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Thu, 10 Aug 2017 13:57:47 +0200
Subject: [PATCH 107/353] Update enterprise fees while locking the order

---
 .../admin/bulk_line_items_controller.rb       | 24 ++++++++++++++-----
 .../admin/bulk_line_items_controller_spec.rb  |  7 ++++++
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/app/controllers/admin/bulk_line_items_controller.rb b/app/controllers/admin/bulk_line_items_controller.rb
index 044038bbfb..3faf8151e6 100644
--- a/app/controllers/admin/bulk_line_items_controller.rb
+++ b/app/controllers/admin/bulk_line_items_controller.rb
@@ -14,12 +14,15 @@ module Admin
     #
     def update
       load_line_item
-      authorize! :update, @line_item.order
+      authorize_update!
 
-      if @line_item.update_attributes(params[:line_item])
-        render nothing: true, status: 204 # No Content, does not trigger ng resource auto-update
-      else
-        render json: { errors: @line_item.errors }, status: 412
+      order.with_lock do
+        if @line_item.update_attributes(params[:line_item])
+          order.update_distribution_charge!
+          render nothing: true, status: 204 # No Content, does not trigger ng resource auto-update
+        else
+          render json: { errors: @line_item.errors }, status: 412
+        end
       end
     end
 
@@ -27,7 +30,7 @@ module Admin
     #
     def destroy
       load_line_item
-      authorize! :update, @line_item.order
+      authorize! :update, order
 
       @line_item.destroy
       render nothing: true, status: 204 # No Content, does not trigger ng resource auto-update
@@ -49,5 +52,14 @@ module Admin
     def serializer(_ams_prefix)
       Api::Admin::LineItemSerializer
     end
+
+    def authorize_update!
+      authorize! :update, order
+      authorize! :read, order
+    end
+
+    def order
+      @line_item.order
+    end
   end
 end
diff --git a/spec/controllers/admin/bulk_line_items_controller_spec.rb b/spec/controllers/admin/bulk_line_items_controller_spec.rb
index a993285c59..eceddc918f 100644
--- a/spec/controllers/admin/bulk_line_items_controller_spec.rb
+++ b/spec/controllers/admin/bulk_line_items_controller_spec.rb
@@ -177,6 +177,13 @@ describe Admin::BulkLineItemsController do
             expect(response.status).to eq 204
           end
 
+          it 'applies enterprise fees locking the order with an exclusive row lock' do
+            expect_any_instance_of(Spree::Order).to receive(:reload).with(lock: true)
+            expect_any_instance_of(Spree::Order).to receive(:update_distribution_charge!)
+
+            spree_put :update, params
+          end
+
           context 'when the line item params are not correct' do
             let(:line_item_params) { { price: 'hola' } }
             let(:errors) { { 'price' => ['is not a number'] } }

From a763c24f3c61b6faa14749ae5dc8bd81cc416751 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Thu, 10 Aug 2017 16:35:28 +0200
Subject: [PATCH 108/353] Doc what `with_lock` does

---
 app/controllers/admin/bulk_line_items_controller.rb | 4 ++++
 app/models/spree/order_decorator.rb                 | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/app/controllers/admin/bulk_line_items_controller.rb b/app/controllers/admin/bulk_line_items_controller.rb
index 3faf8151e6..9f521f1c52 100644
--- a/app/controllers/admin/bulk_line_items_controller.rb
+++ b/app/controllers/admin/bulk_line_items_controller.rb
@@ -16,6 +16,10 @@ module Admin
       load_line_item
       authorize_update!
 
+      # `with_lock` acquires an exclusive row lock on order so no other
+      # requests can update it until the transaction is commited.
+      # See https://github.com/rails/rails/blob/3-2-stable/activerecord/lib/active_record/locking/pessimistic.rb#L69
+      # and https://www.postgresql.org/docs/current/static/sql-select.html#SQL-FOR-UPDATE-SHARE
       order.with_lock do
         if @line_item.update_attributes(params[:line_item])
           order.update_distribution_charge!
diff --git a/app/models/spree/order_decorator.rb b/app/models/spree/order_decorator.rb
index d0c38e8753..8c0eddfea0 100644
--- a/app/models/spree/order_decorator.rb
+++ b/app/models/spree/order_decorator.rb
@@ -181,6 +181,10 @@ Spree::Order.class_eval do
   end
 
   def update_distribution_charge!
+    # `with_lock` acquires an exclusive row lock on order so no other
+    # requests can update it until the transaction is commited.
+    # See https://github.com/rails/rails/blob/3-2-stable/activerecord/lib/active_record/locking/pessimistic.rb#L69
+    # and https://www.postgresql.org/docs/current/static/sql-select.html#SQL-FOR-UPDATE-SHARE
     with_lock do
       EnterpriseFee.clear_all_adjustments_on_order self
 

From 0349e2026b88a39c30c70cb7c2bd791ccbcbc00f Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Fri, 11 Aug 2017 12:40:42 +0200
Subject: [PATCH 109/353] Upgrade spree sha

---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 9d5300b5e1..0c5b08d510 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,7 +8,7 @@ GIT
 
 GIT
   remote: git://github.com/coopdevs/spree.git
-  revision: 598cae8456260073cc0bcf85004b67fb02b8724c
+  revision: eaca0c4351383515abcb4aa613838ef773905a96
   branch: spree-upgrade-step-6
   specs:
     spree (1.3.99)

From c7608c6f4451331edad7176d8c4c72552599934d Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Mon, 14 Aug 2017 11:13:55 +0200
Subject: [PATCH 110/353] Fix flaky integration test

This removes a pointless expectation in a before block and refactors the
test in expect-style.
---
 spec/features/admin/variant_overrides_spec.rb | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/spec/features/admin/variant_overrides_spec.rb b/spec/features/admin/variant_overrides_spec.rb
index 44fa258eb3..c78ae11ad9 100644
--- a/spec/features/admin/variant_overrides_spec.rb
+++ b/spec/features/admin/variant_overrides_spec.rb
@@ -320,24 +320,24 @@ feature %q{
 
     describe "when manually placing an order" do
       let!(:order_cycle) { create(:order_cycle_with_overrides, name: "Overidden") }
+      let(:distributor) { order_cycle.distributors.first }
+      let(:product) { order_cycle.products.first }
 
       before do
-        dist = order_cycle.distributors.first
         login_to_admin_section
+
         visit 'admin/orders/new'
-        select2_select dist.name, from: 'order_distributor_id'
-        page.should have_select2 'order_order_cycle_id', with_options: ['Overidden (open)']
+        select2_select distributor.name, from: 'order_distributor_id'
         select2_select order_cycle.name, from: 'order_order_cycle_id'
         click_button 'Next'
       end
 
       # Reproducing a bug, issue #1446
       it "shows the overridden price" do
-        product = order_cycle.products.first
         targetted_select2_search product.name, from: '#add_variant_id', dropdown_css: '.select2-drop'
         click_link 'Add'
-        page.has_selector? "table.index tbody[data-hook='admin_order_form_line_items'] tr"  # Wait for JS
-        page.should have_content product.variants.first.variant_overrides.first.price
+        expect(page).to have_selector("table.index tbody[data-hook='admin_order_form_line_items'] tr") # Wait for JS
+        expect(page).to have_content(product.variants.first.variant_overrides.first.price)
       end
     end
 

From 1899e2fa980db55d0322d509f1c920ec3f7fdae2 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Mon, 14 Aug 2017 12:56:54 +0200
Subject: [PATCH 111/353] Fix rubocop failures

---
 app/controllers/admin/bulk_line_items_controller.rb   |  1 -
 .../admin/bulk_line_items_controller_spec.rb          | 11 +++++------
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/app/controllers/admin/bulk_line_items_controller.rb b/app/controllers/admin/bulk_line_items_controller.rb
index 9f521f1c52..c0c1b60b91 100644
--- a/app/controllers/admin/bulk_line_items_controller.rb
+++ b/app/controllers/admin/bulk_line_items_controller.rb
@@ -1,6 +1,5 @@
 module Admin
   class BulkLineItemsController < Spree::Admin::BaseController
-
     # GET /admin/bulk_line_items.json
     #
     def index
diff --git a/spec/controllers/admin/bulk_line_items_controller_spec.rb b/spec/controllers/admin/bulk_line_items_controller_spec.rb
index eceddc918f..78f33e9cf8 100644
--- a/spec/controllers/admin/bulk_line_items_controller_spec.rb
+++ b/spec/controllers/admin/bulk_line_items_controller_spec.rb
@@ -6,7 +6,7 @@ describe Admin::BulkLineItemsController do
   describe '#index' do
     render_views
 
-    let(:line_item_attributes) { [:id, :quantity, :max_quantity, :price, :supplier, :final_weight_volume, :units_product, :units_variant, :order] }
+    let(:line_item_attributes) { %i[id quantity max_quantity price supplier final_weight_volume units_product units_variant order] }
     let!(:dist1) { FactoryGirl.create(:distributor_enterprise) }
     let!(:order1) { FactoryGirl.create(:order, state: 'complete', completed_at: 1.day.ago, distributor: dist1, billing_address: FactoryGirl.create(:address) ) }
     let!(:order2) { FactoryGirl.create(:order, state: 'complete', completed_at: Time.zone.now, distributor: dist1, billing_address: FactoryGirl.create(:address) ) }
@@ -26,7 +26,6 @@ describe Admin::BulkLineItemsController do
     end
 
     context "as an administrator" do
-
       before do
         controller.stub spree_current_user: quick_login_as_admin
       end
@@ -37,7 +36,7 @@ describe Admin::BulkLineItemsController do
         end
 
         it "retrieves a list of line_items with appropriate attributes, including line items with appropriate attributes" do
-          keys = json_response.first.keys.map{ |key| key.to_sym }
+          keys = json_response.first.keys.map(&:to_sym)
           line_item_attributes.all?{ |attr| keys.include? attr }.should == true
         end
 
@@ -52,7 +51,7 @@ describe Admin::BulkLineItemsController do
         end
 
         it "returns distributor object with id key" do
-          json_response.map{ |line_item| line_item['supplier'] }.all?{ |d| d.has_key?('id') }.should == true
+          json_response.map{ |line_item| line_item['supplier'] }.all?{ |d| d.key?('id') }.should == true
         end
       end
 
@@ -107,7 +106,7 @@ describe Admin::BulkLineItemsController do
         end
 
         it "retrieves a list of line_items" do
-          keys = json_response.first.keys.map{ |key| key.to_sym }
+          keys = json_response.first.keys.map(&:to_sym)
           line_item_attributes.all?{ |attr| keys.include? attr }.should == true
         end
       end
@@ -119,7 +118,7 @@ describe Admin::BulkLineItemsController do
         end
 
         it "retrieves a list of line_items" do
-          keys = json_response.first.keys.map{ |key| key.to_sym }
+          keys = json_response.first.keys.map(&:to_sym)
           line_item_attributes.all?{ |attr| keys.include? attr }.should == true
         end
       end

From 613016a6cfc1214afd4416ec3de0adc49a7fe004 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Mon, 14 Aug 2017 16:35:40 +0200
Subject: [PATCH 112/353] Refactor spec using `expect_any_instance`

---
 spec/controllers/admin/bulk_line_items_controller_spec.rb | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/spec/controllers/admin/bulk_line_items_controller_spec.rb b/spec/controllers/admin/bulk_line_items_controller_spec.rb
index 78f33e9cf8..da1f753dce 100644
--- a/spec/controllers/admin/bulk_line_items_controller_spec.rb
+++ b/spec/controllers/admin/bulk_line_items_controller_spec.rb
@@ -177,8 +177,11 @@ describe Admin::BulkLineItemsController do
           end
 
           it 'applies enterprise fees locking the order with an exclusive row lock' do
-            expect_any_instance_of(Spree::Order).to receive(:reload).with(lock: true)
-            expect_any_instance_of(Spree::Order).to receive(:update_distribution_charge!)
+            allow(Spree::LineItem)
+              .to receive(:find).with(line_item1.id.to_s).and_return(line_item1)
+
+            expect(line_item1.order).to receive(:reload).with(lock: true)
+            expect(line_item1.order).to receive(:update_distribution_charge!)
 
             spree_put :update, params
           end

From 2c65218ce3b372cdb78fde8d0bf9204162893f81 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sat, 9 Sep 2017 00:40:15 +1000
Subject: [PATCH 113/353] Bumping spree version to remove kaminari duplicate
 from gemspec

---
 Gemfile      | 2 +-
 Gemfile.lock | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/Gemfile b/Gemfile
index 32983d2b8e..442ce60701 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-6'
+gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-6', ref: '6705667'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 0c5b08d510..449d8fb67b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,7 +8,8 @@ GIT
 
 GIT
   remote: git://github.com/coopdevs/spree.git
-  revision: eaca0c4351383515abcb4aa613838ef773905a96
+  revision: 6705667ac8acd9f5f4add580a7679bc5b524325c
+  ref: 6705667
   branch: spree-upgrade-step-6
   specs:
     spree (1.3.99)
@@ -778,4 +779,4 @@ RUBY VERSION
    ruby 2.1.5p273
 
 BUNDLED WITH
-   1.15.3
+   1.15.4

From 4c238748c622fa760b53a587d0e91bcadb1b3ab9 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 11:07:27 +1000
Subject: [PATCH 114/353] Prevent accordion controllers from showing missing
 nextPanel

Resolves this issue:
https://travis-ci.org/oeoeaio/openfoodnetwork/jobs/273323915
---
 .../controllers/checkout/accordion_controller.js.coffee      | 5 +++--
 .../javascripts/darkswarm/mixins/fieldset_mixin.js.coffee    | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/controllers/checkout/accordion_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/checkout/accordion_controller.js.coffee
index 91161c6f8c..e85f9e5cee 100644
--- a/app/assets/javascripts/darkswarm/controllers/checkout/accordion_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/checkout/accordion_controller.js.coffee
@@ -13,8 +13,9 @@ Darkswarm.controller "AccordionCtrl", ($scope, localStorageService, $timeout, $d
     # scroll location is closed by show(), scrollTo() will scroll to the old location of
     # the element. Putting this in a 50 ms timeout is enough delay for the DOM to
     # have updated.
-    $timeout (->
-      $document.scrollTo $("##{section}"), offset_height, 500), 50
+    $timeout ->
+      $document.scrollTo($("##{section}"), offset_height, 500)
+    , 50
 
   $scope.$on 'purchaseFormInvalid', (event, form) ->
     # Scroll to first invalid section
diff --git a/app/assets/javascripts/darkswarm/mixins/fieldset_mixin.js.coffee b/app/assets/javascripts/darkswarm/mixins/fieldset_mixin.js.coffee
index e5aa1375c0..739d2de9bd 100644
--- a/app/assets/javascripts/darkswarm/mixins/fieldset_mixin.js.coffee
+++ b/app/assets/javascripts/darkswarm/mixins/fieldset_mixin.js.coffee
@@ -1,6 +1,7 @@
 window.FieldsetMixin = ($scope)->
   $scope.next = (event = false)->
     event.preventDefault() if event
+    return unless $scope.nextPanel
     $scope.show $scope.nextPanel
 
   $scope.onTimeout = ->

From d7de7d462fef56b486da20d7982876e63ba881a7 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 14 Sep 2017 13:20:46 +1000
Subject: [PATCH 115/353] Fix for #1826, ensure that adjustment states are
 initialized prior to validation

---
 app/models/spree/adjustment_decorator.rb | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/app/models/spree/adjustment_decorator.rb b/app/models/spree/adjustment_decorator.rb
index 71a166aa56..bb4498c825 100644
--- a/app/models/spree/adjustment_decorator.rb
+++ b/app/models/spree/adjustment_decorator.rb
@@ -6,6 +6,8 @@ module Spree
     has_one :metadata, class_name: 'AdjustmentMetadata'
     belongs_to :tax_rate, foreign_key: 'originator_id', conditions: "spree_adjustments.originator_type = 'Spree::TaxRate'"
 
+    before_validation :initialize_state
+
     scope :enterprise_fee,  where(originator_type: 'EnterpriseFee')
     scope :billable_period, where(source_type: 'BillablePeriod')
     scope :admin,           where(source_type: nil, originator_type: nil)
@@ -74,5 +76,15 @@ module Spree
       result
     end
 
+    private
+
+    # Required after Spree Upgrade Step 6, as existing adjustments did not have
+    # a state, and so failed validation. New adjustments are not affected.
+    def initialize_state
+      return unless state.nil?
+      # (static: true) only updates state when not already set
+      # use (static: :force) to force initialization
+      initialize_state_machines(static: true)
+    end
   end
 end

From 3aa50ed38f5301639c134e1ad5fe4e8652269514 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 14 Sep 2017 11:29:05 +1000
Subject: [PATCH 116/353] Attempt to fix intermittent fail in
 product_import_spec

---
 spec/features/admin/product_import_spec.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/spec/features/admin/product_import_spec.rb b/spec/features/admin/product_import_spec.rb
index 82e1c6e91a..3ab66ca237 100644
--- a/spec/features/admin/product_import_spec.rb
+++ b/spec/features/admin/product_import_spec.rb
@@ -193,9 +193,10 @@ feature "Product Import", js: true do
 
     it "returns and error if nothing was uploaded" do
       visit main_app.admin_product_import_path
+      expect(page).to have_content  'Select a spreadsheet to upload'
       click_button 'Import'
 
-      expect(page).to have_content "File not found or could not be opened"
+      expect(flash_message).to eq I18n.t(:product_import_file_not_found_notice)
     end
 
     it "handles cases where no meaningful data can be read from the file" do

From e217f964549b92ddc9c594cf33f286f96db01530 Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Thu, 31 Aug 2017 13:39:37 +0200
Subject: [PATCH 117/353] Use Rails lazy lookup for translation keys

See "lazy" lookup in
http://guides.rubyonrails.org/i18n.html#abstracting-localized-code
---
 app/views/admin/order_cycles/_exchange_form.html.haml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/admin/order_cycles/_exchange_form.html.haml b/app/views/admin/order_cycles/_exchange_form.html.haml
index 1275103a50..c8fbf28cc1 100644
--- a/app/views/admin/order_cycles/_exchange_form.html.haml
+++ b/app/views/admin/order_cycles/_exchange_form.html.haml
@@ -15,10 +15,10 @@
       {{ exchange.tags.length }}
     %td.collection-details
       = text_field_tag 'order_cycle_outgoing_exchange_{{ $index }}_pickup_time', '', 'id' => 'order_cycle_outgoing_exchange_{{ $index }}_pickup_time', 'required' => 'required', 'placeholder' => t('.pickup_time_placeholder'), 'ng-model' => 'exchange.pickup_time', 'ng-disabled' => '!enterprises[exchange.enterprise_id].managed && !order_cycle.viewing_as_coordinator', 'maxlength' => 35
-      %span.icon-question-sign{'ofn-with-tip' => t('admin.order_cycles.edit.pickup_time_tip')}
+      %span.icon-question-sign{'ofn-with-tip' => t('.pickup_time_tip')}
       %br/
       = text_field_tag 'order_cycle_outgoing_exchange_{{ $index }}_pickup_instructions', '', 'id' => 'order_cycle_outgoing_exchange_{{ $index }}_pickup_instructions', 'placeholder' => t('.pickup_instructions_placeholder'), 'ng-model' => 'exchange.pickup_instructions', 'ng-disabled' => '!enterprises[exchange.enterprise_id].managed && !order_cycle.viewing_as_coordinator'
-      %span.icon-question-sign{'ofn-with-tip' => t('admin.order_cycles.edit.pickup_instructions_tip')}
+      %span.icon-question-sign{'ofn-with-tip' => t('.pickup_instructions_tip')}
   %td.fees
     %ol{ ng: { show: 'enterprises[exchange.enterprise_id].managed || order_cycle.viewing_as_coordinator' } }
       %li{'ng-repeat' => 'enterprise_fee in exchange.enterprise_fees'}

From 96e31235da3b3fdf20e5e6d0f9fe909b6f664b5c Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Thu, 31 Aug 2017 13:40:53 +0200
Subject: [PATCH 118/353] Replace hardcoded strings with i18n keys

---
 .../admin/order_cycles/_add_exchange_form.html.haml    |  2 +-
 app/views/admin/order_cycles/_exchange_form.html.haml  |  4 ++--
 app/views/admin/order_cycles/edit.html.haml            |  4 ++--
 config/locales/en.yml                                  | 10 ++++++++--
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/app/views/admin/order_cycles/_add_exchange_form.html.haml b/app/views/admin/order_cycles/_add_exchange_form.html.haml
index f9f64ab631..36c8e804af 100644
--- a/app/views/admin/order_cycles/_add_exchange_form.html.haml
+++ b/app/views/admin/order_cycles/_add_exchange_form.html.haml
@@ -3,4 +3,4 @@
     {{ enterprise.name }}
     = "{{ enterprise.issues_summary_#{type} ? '('+enterprise.issues_summary_#{type}+')' : '' }}"
 
-= f.submit "Add #{type}", 'ng-click' => "add#{type.capitalize}($event)", 'ng-disabled' => "!new_#{type}_id || !OrderCycle.novel#{type.capitalize}(new_#{type}_id)"
+= f.submit t(".add_#{type}"), 'ng-click' => "add#{type.capitalize}($event)", 'ng-disabled' => "!new_#{type}_id || !OrderCycle.novel#{type.capitalize}(new_#{type}_id)"
diff --git a/app/views/admin/order_cycles/_exchange_form.html.haml b/app/views/admin/order_cycles/_exchange_form.html.haml
index c8fbf28cc1..9209c4cf77 100644
--- a/app/views/admin/order_cycles/_exchange_form.html.haml
+++ b/app/views/admin/order_cycles/_exchange_form.html.haml
@@ -6,7 +6,7 @@
       {{ enterpriseTotalVariants(enterprises[exchange.enterprise_id]) }}
     - else
       {{ (incomingExchangeVariantsFor(exchange.enterprise_id)).length }}
-    selected
+    = t('.selected')
   - if type == 'supplier'
     %td.receival-details
       = text_field_tag 'order_cycle_incoming_exchange_{{ $index }}_receival_instructions', '', 'id' => 'order_cycle_incoming_exchange_{{ $index }}_receival_instructions', 'placeholder' => t('.receival_instructions_placeholder'), 'ng-model' => 'exchange.receival_instructions'
@@ -28,7 +28,7 @@
 
         = link_to 'Remove', '#', {'id' => 'order_cycle_{{ exchangeDirection(exchange) }}_exchange_{{ $parent.$index }}_enterprise_fees_{{ $index }}_remove', 'ng-click' => 'removeExchangeFee($event, exchange, $index)'}
 
-    = f.submit 'Add fee', 'ng-click' => 'addExchangeFee($event, exchange)', 'ng-hide' => '!enterprises[exchange.enterprise_id].managed && !order_cycle.viewing_as_coordinator'
+    = f.submit t('.add_fee'), 'ng-click' => 'addExchangeFee($event, exchange)', 'ng-hide' => '!enterprises[exchange.enterprise_id].managed && !order_cycle.viewing_as_coordinator'
   %td.actions
     %a{'ng-click' => 'removeExchange($event, exchange)', :class => "icon-trash no-text remove-exchange"}
 
diff --git a/app/views/admin/order_cycles/edit.html.haml b/app/views/admin/order_cycles/edit.html.haml
index ddfd10b38a..ed7b93571a 100644
--- a/app/views/admin/order_cycles/edit.html.haml
+++ b/app/views/admin/order_cycles/edit.html.haml
@@ -12,7 +12,7 @@
 
   - if can? :notify_producers, @order_cycle
     %li
-      = button_to "Notify producers", main_app.notify_producers_admin_order_cycle_path, :id => 'admin_notify_producers', :confirm => t(:are_you_sure)
+      = button_to t(:notify_producers), main_app.notify_producers_admin_order_cycle_path, :id => 'admin_notify_producers', :confirm => t(:are_you_sure)
   %li
     %button#toggle_settings{ onClick: 'toggleSettings()' }
       = t('.advanced_settings')
@@ -30,7 +30,7 @@
   %save-bar{ dirty: "order_cycle_form.$dirty", persist: "true" }
     %input.red{ type: "button", value: t(:update), ng: { click: "submit($event, null)", disabled: "!order_cycle_form.$dirty || order_cycle_form.$invalid" } }
     %input.red{ type: "button", value: t('.update_and_close'), ng: { click: "submit($event, '#{main_app.admin_order_cycles_path}')", disabled: "!order_cycle_form.$dirty || order_cycle_form.$invalid" } }
-    %input{ type: "button", ng: { value: "order_cycle_form.$dirty ? 'Cancel' : 'Close'", click: "cancel('#{main_app.admin_order_cycles_path}')" } }
+    %input{ type: "button", ng: { value: "order_cycle_form.$dirty ? '#{t(:cancel)}' : '#{t(:close)}'", click: "cancel('#{main_app.admin_order_cycles_path}')" } }
 
   - if order_cycles_simple_form
     = render 'simple_form', f: f
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 9c1d7e538a..18db5812dc 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -602,12 +602,17 @@ en:
         advanced_settings: Advanced Settings
         update_and_close: Update and Close
         choose_products_from: 'Choose Products From:'
-        pickup_time_tip: When orders from this OC will be ready for the customer
-        pickup_instructions_tip: These instructions are shown to customers after they complete an order
       exchange_form:
+        pickup_time_tip: When orders from this OC will be ready for the customer
         pickup_instructions_placeholder: "Pick-up instructions"
+        pickup_instructions_tip: These instructions are shown to customers after they complete an order
         pickup_time_placeholder: "Ready for (ie. Date / Time)"
         receival_instructions_placeholder: "Receival instructions"
+        add_fee: 'Add fee'
+        selected: 'selected'
+      add_exchange_form:
+        add_supplier: 'Add supplier'
+        add_distributor: 'Add distributor'
       advanced_settings:
         title: Advanced Settings
         choose_product_tip: You can opt to restrict all available products (both incoming and outgoing), to only those in %{inventory}'s inventory.
@@ -1507,6 +1512,7 @@ Please follow the instructions there to make your enterprise visible on the Open
   new_order_cycles: "New Order Cycles"
   new_order_cycle: "New Order Cycle"
   select_a_coordinator_for_your_order_cycle: "Select a coordinator for your order cycle"
+  notify_producers: 'Notify producers'
   edit_order_cycle: "Edit Order Cycle"
   roles: "Roles"
   update: "Update"

From f50e745826b52b5d40bbde640a982f2b208aa9ae Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Wed, 6 Sep 2017 18:30:17 +0200
Subject: [PATCH 119/353] Change title when navigating to new product page

We navigate to it by replacing the content of the page through an ajax
call, so we also need change the section title with JS.
---
 app/views/spree/admin/products/new.js.erb | 12 ++++++++++++
 config/locales/en.yml                     |  2 ++
 2 files changed, 14 insertions(+)
 create mode 100644 app/views/spree/admin/products/new.js.erb

diff --git a/app/views/spree/admin/products/new.js.erb b/app/views/spree/admin/products/new.js.erb
new file mode 100644
index 0000000000..0a3711620d
--- /dev/null
+++ b/app/views/spree/admin/products/new.js.erb
@@ -0,0 +1,12 @@
+<%# This chunk is just a copy of Spree's core/app/views/spree/admin/products/new.js.erb %>
+$("#new_product").html('<%= escape_javascript(render :template => "spree/admin/products/new", :formats => [:html], :handlers => [:erb]) %>');
+handle_date_picker_fields();
+<% unless Rails.env.test? %>
+  $('.select2').select2();
+<% end %>
+$("#table-filter").hide();
+$("#admin_new_product").parent().hide();
+
+<%# We need to replace the page's title as well. We're navigating to a new page
+  although through ajax %>
+$('#content-header .page-title').html('<%= t('.title') %>');
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 18db5812dc..d84550df35 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2056,6 +2056,8 @@ Please follow the instructions there to make your enterprise visible on the Open
             other: "You have %{count} active order cycles."
           manage_order_cycles: "MANAGE ORDER CYCLES"
       products:
+        new:
+          title: 'New Product'
         unit_name_placeholder: 'eg. bunches'
         bulk_edit:
           header:

From 72d264fab9301435ac4ed9b3efa0d09fd96451f0 Mon Sep 17 00:00:00 2001
From: Pierre de Lacroix <pierre@pdelacroix.com>
Date: Thu, 7 Sep 2017 18:03:37 +0200
Subject: [PATCH 120/353] Make "on demand" columns visible by default

on admin "bulk product edit" and "inventory" (variant overrides) tables
---
 lib/open_food_network/column_preference_defaults.rb | 4 ++--
 spec/features/admin/variant_overrides_spec.rb       | 7 +++----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/lib/open_food_network/column_preference_defaults.rb b/lib/open_food_network/column_preference_defaults.rb
index 41eef63c09..6972fa3785 100644
--- a/lib/open_food_network/column_preference_defaults.rb
+++ b/lib/open_food_network/column_preference_defaults.rb
@@ -16,7 +16,7 @@ module OpenFoodNetwork
         sku:          { name: I18n.t("admin.sku"),              visible: false },
         price:        { name: I18n.t("admin.price"),            visible: true },
         on_hand:      { name: I18n.t("admin.on_hand"),          visible: true },
-        on_demand:    { name: I18n.t("admin.on_demand?"),       visible: false },
+        on_demand:    { name: I18n.t("admin.on_demand?"),       visible: true },
         reset:        { name: I18n.t("#{node}.enable_reset?"),  visible: false },
         inheritance:  { name: I18n.t("#{node}.inherit?"),       visible: false },
         tags:         { name: I18n.t("admin.tags"),             visible: false },
@@ -64,7 +64,7 @@ module OpenFoodNetwork
         unit:                 { name: I18n.t("#{node}.unit"),                  visible: true },
         price:                { name: I18n.t("admin.price"),                   visible: true },
         on_hand:              { name: I18n.t("admin.on_hand"),                 visible: true },
-        on_demand:            { name: I18n.t("admin.on_demand"),               visible: false },
+        on_demand:            { name: I18n.t("admin.on_demand"),               visible: true },
         category:             { name: I18n.t("#{node}.category"),              visible: false },
         tax_category:         { name: I18n.t("#{node}.tax_category"),          visible: false },
         inherits_properties:  { name: I18n.t("#{node}.inherits_properties?"),  visible: false },
diff --git a/spec/features/admin/variant_overrides_spec.rb b/spec/features/admin/variant_overrides_spec.rb
index c78ae11ad9..9064913868 100644
--- a/spec/features/admin/variant_overrides_spec.rb
+++ b/spec/features/admin/variant_overrides_spec.rb
@@ -66,12 +66,12 @@ feature %q{
 
         context "with no overrides" do
           it "displays the list of products with variants" do
-            page.should have_table_row ['PRODUCER', 'PRODUCT', 'PRICE', 'ON HAND']
-            page.should have_table_row [producer.name, product.name, '', '']
+            page.should have_table_row ['PRODUCER', 'PRODUCT', 'PRICE', 'ON HAND', 'ON DEMAND?']
+            page.should have_table_row [producer.name, product.name, '', '', '']
             page.should have_input "variant-overrides-#{variant.id}-price", placeholder: '1.23'
             page.should have_input "variant-overrides-#{variant.id}-count_on_hand", placeholder: '12'
 
-            page.should have_table_row [producer_related.name, product_related.name, '', '']
+            page.should have_table_row [producer_related.name, product_related.name, '', '', '']
             page.should have_input "variant-overrides-#{variant_related.id}-price", placeholder: '2.34'
             page.should have_input "variant-overrides-#{variant_related.id}-count_on_hand", placeholder: '23'
 
@@ -133,7 +133,6 @@ feature %q{
           it "creates new overrides" do
             first("div#columns-dropdown", :text => "COLUMNS").click
             first("div#columns-dropdown div.menu div.menu_item", text: "SKU").click
-            first("div#columns-dropdown div.menu div.menu_item", text: "On Demand").click
             first("div#columns-dropdown", :text => "COLUMNS").click
 
             fill_in "variant-overrides-#{variant.id}-sku", with: 'NEWSKU'

From 1fe20eba45d0bde2ae8c457e73cb5376ac6f630f Mon Sep 17 00:00:00 2001
From: Julius Pabrinkis <julius@cannon.lt>
Date: Fri, 12 May 2017 16:42:47 +0100
Subject: [PATCH 121/353] Add backend to be able to switch language by param
 and persist in cookies and user db

---
 app/helpers/i18n_helper.rb                    | 12 ++++-
 app/models/spree/user_decorator.rb            |  2 +-
 ...0170512115519_add_locale_to_spree_users.rb |  5 ++
 db/schema.rb                                  |  3 +-
 spec/features/admin/multilingual_spec.rb      | 10 +++-
 spec/features/consumer/multilingual_spec.rb   | 49 +++++++++++++++++--
 spec/support/request/web_helper.rb            |  4 ++
 7 files changed, 76 insertions(+), 9 deletions(-)
 create mode 100644 db/migrate/20170512115519_add_locale_to_spree_users.rb

diff --git a/app/helpers/i18n_helper.rb b/app/helpers/i18n_helper.rb
index 527429b530..827260404e 100644
--- a/app/helpers/i18n_helper.rb
+++ b/app/helpers/i18n_helper.rb
@@ -2,6 +2,16 @@ module I18nHelper
   private
 
   def set_locale
-    I18n.locale = params[:locale] || I18n.default_locale
+    # update spree_current_user locale if logged in and set cookie locale if params
+    if params[:locale] && Rails.application.config.i18n.available_locales.include?(params[:locale])
+      spree_current_user.update_attributes!(locale: params[:locale]) if spree_current_user
+      cookies[:locale] = params[:locale]
+    end
+
+    if spree_current_user && spree_current_user.locale.nil? && cookies[:locale]
+      spree_current_user.update_attributes!(locale: params[:locale])
+    end
+
+    I18n.locale = spree_current_user.andand.locale || cookies[:locale] || I18n.default_locale
   end
 end
diff --git a/app/models/spree/user_decorator.rb b/app/models/spree/user_decorator.rb
index 5007134bd6..d631387fa4 100644
--- a/app/models/spree/user_decorator.rb
+++ b/app/models/spree/user_decorator.rb
@@ -17,7 +17,7 @@ Spree.user_class.class_eval do
   accepts_nested_attributes_for :bill_address
   accepts_nested_attributes_for :ship_address
 
-  attr_accessible :enterprise_ids, :enterprise_roles_attributes, :enterprise_limit, :bill_address_attributes, :ship_address_attributes
+  attr_accessible :enterprise_ids, :enterprise_roles_attributes, :enterprise_limit, :locale, :bill_address_attributes, :ship_address_attributes
   after_create :send_signup_confirmation
 
   validate :limit_owned_enterprises
diff --git a/db/migrate/20170512115519_add_locale_to_spree_users.rb b/db/migrate/20170512115519_add_locale_to_spree_users.rb
new file mode 100644
index 0000000000..f694bff1f7
--- /dev/null
+++ b/db/migrate/20170512115519_add_locale_to_spree_users.rb
@@ -0,0 +1,5 @@
+class AddLocaleToSpreeUsers < ActiveRecord::Migration
+  def change
+    add_column :spree_users, :locale, :string, limit: 5
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index b62bd45c04..5c70c8e6f9 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended to check this file into your version control system.
 
-ActiveRecord::Schema.define(:version => 20170413083148) do
+ActiveRecord::Schema.define(:version => 20170512115519) do
 
   create_table "account_invoices", :force => true do |t|
     t.integer  "user_id",    :null => false
@@ -998,6 +998,7 @@ ActiveRecord::Schema.define(:version => 20170413083148) do
     t.datetime "reset_password_sent_at"
     t.string   "api_key",                :limit => 40
     t.integer  "enterprise_limit",                     :default => 1, :null => false
+    t.string   "locale",                 :limit => 5
   end
 
   add_index "spree_users", ["email"], :name => "email_idx_unique", :unique => true
diff --git a/spec/features/admin/multilingual_spec.rb b/spec/features/admin/multilingual_spec.rb
index bfad7c39a6..0f98e8bbde 100644
--- a/spec/features/admin/multilingual_spec.rb
+++ b/spec/features/admin/multilingual_spec.rb
@@ -3,9 +3,13 @@ require 'spec_helper'
 feature 'Multilingual', js: true do
   include AuthenticationWorkflow
   include WebHelper
+  let(:admin_role) { Spree::Role.find_or_create_by_name!('admin') }
+  let(:admin_user) { create(:user) }
 
   background do
-    login_to_admin_section
+    admin_user.spree_roles << admin_role
+    quick_login_as admin_user
+    visit spree.admin_path
   end
 
   it 'has two locales available' do
@@ -18,11 +22,14 @@ feature 'Multilingual', js: true do
     expect(get_i18n_locale).to eq 'en'
     expect(get_i18n_translation('spree_admin_overview_enterprises_header')).to eq 'My Enterprises'
     expect(page).to have_content 'My Enterprises'
+    expect(admin_user.locale).to be_nil
 
     visit spree.admin_path(locale: 'es')
     expect(get_i18n_locale).to eq 'es'
     expect(get_i18n_translation('spree_admin_overview_enterprises_header')).to eq 'Mis Organizaciones'
     expect(page).to have_content 'Mis Organizaciones'
+    admin_user.reload
+    expect(admin_user.locale).to eq 'es'
   end
 
   it 'fallbacks to default_locale' do
@@ -34,6 +41,7 @@ feature 'Multilingual', js: true do
     visit spree.admin_path(locale: 'it')
     expect(get_i18n_locale).to eq 'it'
     expect(get_i18n_translation('spree_admin_overview_enterprises_header')).to eq 'My Enterprises'
+    expect(admin_user.locale).to be_nil
     # This still is italian until we change enforce_available_locales to `true`
     expect(page).to have_content 'Le Mie Aziende'
   end
diff --git a/spec/features/consumer/multilingual_spec.rb b/spec/features/consumer/multilingual_spec.rb
index 59858875e2..4f163dee01 100644
--- a/spec/features/consumer/multilingual_spec.rb
+++ b/spec/features/consumer/multilingual_spec.rb
@@ -1,6 +1,7 @@
 require 'spec_helper'
 
 feature 'Multilingual', js: true do
+  include AuthenticationWorkflow
   include WebHelper
 
   it 'has two locales available' do
@@ -9,24 +10,62 @@ feature 'Multilingual', js: true do
     expect(Rails.application.config.i18n[:available_locales]).to eq ['en', 'es']
   end
 
+  it '18n-js fallsback to default language' do # in backend it doesn't until we change enforce_available_locales to `true`
+    visit root_path
+    set_i18n_locale('it')
+    expect(get_i18n_translation('label_shops')).to eq 'Shops'
+  end
+
   it 'can switch language by params' do
     visit root_path
     expect(get_i18n_locale).to eq 'en'
     expect(get_i18n_translation('label_shops')).to eq 'Shops'
+    expect(page.driver.browser.cookies['locale']).to be_nil
     expect(page).to have_content 'Interested in getting on the Open Food Network?'
     expect(page).to have_content 'SHOPS'
 
     visit root_path(locale: 'es')
     expect(get_i18n_locale).to eq 'es'
     expect(get_i18n_translation('label_shops')).to eq 'Tiendas'
+    expect(page.driver.browser.cookies['locale'].value).to eq 'es'
     expect(page).to have_content '¿Estás interesada en entrar en Open Food Network?'
     expect(page).to have_content 'TIENDAS'
 
-    # I18n-js fallsback to 'en'
+    # it is not in the list of available of available_locales
     visit root_path(locale: 'it')
-    expect(get_i18n_locale).to eq 'it'
-    expect(get_i18n_translation('label_shops')).to eq 'Shops'
-    # This still is italian until we change enforce_available_locales to `true`
-    expect(page).to have_content 'NEGOZI'
+    expect(get_i18n_locale).to eq 'es'
+    expect(get_i18n_translation('label_shops')).to eq 'Tiendas'
+    expect(page.driver.browser.cookies['locale'].value).to eq 'es'
+    expect(page).to have_content '¿Estás interesada en entrar en Open Food Network?'
+    expect(page).to have_content 'TIENDAS'
+  end
+
+  context 'with user' do
+    let(:user) { create(:user) }
+
+    it 'updates user locale from cookie if it is empty' do
+      visit root_path(locale: 'es')
+
+      expect(page.driver.browser.cookies['locale'].value).to eq 'es'
+      expect(user.locale).to be_nil
+      quick_login_as user
+      visit root_path
+
+      expect(page.driver.browser.cookies['locale'].value).to eq 'es'
+    end
+
+    it 'updates user locale and stays in cookie after logout' do
+      quick_login_as user
+      visit root_path(locale: 'es')
+      user.reload
+
+      expect(user.locale).to eq 'es'
+
+      logout
+
+      expect(page.driver.browser.cookies['locale'].value).to eq 'es'
+      expect(page).to have_content '¿Estás interesada en entrar en Open Food Network?'
+      expect(page).to have_content 'TIENDAS'
+    end
   end
 end
diff --git a/spec/support/request/web_helper.rb b/spec/support/request/web_helper.rb
index 1bd22b010c..8d9c66c148 100644
--- a/spec/support/request/web_helper.rb
+++ b/spec/support/request/web_helper.rb
@@ -113,6 +113,10 @@ module WebHelper
     DirtyFormDialog.new(page)
   end
 
+  def set_i18n_locale(locale = 'en')
+    page.evaluate_script("I18n.locale = '#{locale}'")
+  end
+
   def get_i18n_locale
     page.evaluate_script("I18n.locale;")
   end

From 39dc765c63bf0e47a3526aa0b189533040d4f6e1 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Wed, 23 Aug 2017 18:30:08 +1000
Subject: [PATCH 122/353] Add/replace comments and remove useless

---
 app/helpers/i18n_helper.rb | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/app/helpers/i18n_helper.rb b/app/helpers/i18n_helper.rb
index 827260404e..4c93bdc0bc 100644
--- a/app/helpers/i18n_helper.rb
+++ b/app/helpers/i18n_helper.rb
@@ -1,13 +1,12 @@
 module I18nHelper
-  private
-
   def set_locale
-    # update spree_current_user locale if logged in and set cookie locale if params
+    # Save a given locale
     if params[:locale] && Rails.application.config.i18n.available_locales.include?(params[:locale])
       spree_current_user.update_attributes!(locale: params[:locale]) if spree_current_user
       cookies[:locale] = params[:locale]
     end
 
+    # After logging in, check if the user chose a locale before
     if spree_current_user && spree_current_user.locale.nil? && cookies[:locale]
       spree_current_user.update_attributes!(locale: params[:locale])
     end

From 4cdd0831e8c8fa7271482dbfec1f70e188dc4ee9 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Fri, 8 Sep 2017 17:22:51 +1000
Subject: [PATCH 123/353] Spec the I18n helper on its own

---
 spec/helpers/i18n_helper_spec.rb | 135 +++++++++++++++++++++++++++++++
 1 file changed, 135 insertions(+)
 create mode 100644 spec/helpers/i18n_helper_spec.rb

diff --git a/spec/helpers/i18n_helper_spec.rb b/spec/helpers/i18n_helper_spec.rb
new file mode 100644
index 0000000000..86e236a261
--- /dev/null
+++ b/spec/helpers/i18n_helper_spec.rb
@@ -0,0 +1,135 @@
+require 'spec_helper'
+
+describe I18nHelper do
+  let(:user) { create(:user) }
+
+  context "as guest" do
+    before do
+      allow(helper).to receive(:spree_current_user) { nil }
+    end
+
+    it "sets the default locale" do
+      helper.set_locale
+      expect(I18n.locale).to eq :en
+    end
+
+    it "sets the chosen locale" do
+      allow(helper).to receive(:params) { {locale: "es"} }
+      helper.set_locale
+      expect(I18n.locale).to eq :es
+    end
+
+    it "remembers the chosen locale" do
+      allow(helper).to receive(:params) { {locale: "es"} }
+      helper.set_locale
+
+      allow(helper).to receive(:params) { {} }
+      helper.set_locale
+      expect(I18n.locale).to eq :es
+    end
+
+    it "ignores unavailable locales" do
+      allow(helper).to receive(:params) { {locale: "xx"} }
+      helper.set_locale
+      expect(I18n.locale).to eq :en
+    end
+
+    it "remembers the last chosen locale" do
+      allow(helper).to receive(:params) { {locale: "en"} }
+      helper.set_locale
+
+      allow(helper).to receive(:params) { {locale: "es"} }
+      helper.set_locale
+
+      allow(helper).to receive(:params) { {} }
+      helper.set_locale
+      expect(I18n.locale).to eq :es
+    end
+
+    it "remembers the chosen locale after logging in" do
+      allow(helper).to receive(:params) { {locale: "es"} }
+      helper.set_locale
+
+      # log in
+      allow(helper).to receive(:spree_current_user) { user }
+      allow(helper).to receive(:params) { {} }
+      helper.set_locale
+      expect(I18n.locale).to eq :es
+    end
+
+    it "forgets the chosen locale without cookies" do
+      allow(helper).to receive(:params) { {locale: "es"} }
+      helper.set_locale
+
+      # clean up cookies
+      cookies.delete :locale
+
+      allow(helper).to receive(:params) { {} }
+      helper.set_locale
+      expect(I18n.locale).to eq :en
+    end
+  end
+
+  context "logged in" do
+    before do
+      allow(helper).to receive(:spree_current_user) { user }
+    end
+
+    it "sets the default locale" do
+      helper.set_locale
+      expect(I18n.locale).to eq :en
+    end
+
+    it "sets the chosen locale" do
+      allow(helper).to receive(:params) { {locale: "es"} }
+      helper.set_locale
+      expect(I18n.locale).to eq :es
+      expect(user.locale).to eq "es"
+    end
+
+    it "remembers the chosen locale" do
+      allow(helper).to receive(:params) { {locale: "es"} }
+      helper.set_locale
+
+      allow(helper).to receive(:params) { {} }
+      helper.set_locale
+      expect(I18n.locale).to eq :es
+    end
+
+    it "remembers the last chosen locale" do
+      allow(helper).to receive(:params) { {locale: "en"} }
+      helper.set_locale
+
+      allow(helper).to receive(:params) { {locale: "es"} }
+      helper.set_locale
+
+      allow(helper).to receive(:params) { {} }
+      helper.set_locale
+      expect(I18n.locale).to eq :es
+    end
+
+    it "remembers the chosen locale after logging out" do
+      allow(helper).to receive(:params) { {locale: "es"} }
+      helper.set_locale
+
+      # log out
+      allow(helper).to receive(:spree_current_user) { nil }
+      allow(helper).to receive(:params) { {} }
+      helper.set_locale
+      expect(I18n.locale).to eq :es
+    end
+
+    it "remembers the chosen locale on another computer" do
+      allow(helper).to receive(:params) { {locale: "es"} }
+      helper.set_locale
+      expect(cookies[:locale]).to eq "es"
+
+      # switch computer / browser or loose cookies
+      cookies.delete :locale
+
+      allow(helper).to receive(:params) { {} }
+      helper.set_locale
+      expect(I18n.locale).to eq :es
+    end
+  end
+end

From ca677a3ccd3a10b351f886885b4132331fae788f Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Wed, 13 Sep 2017 17:53:16 +1000
Subject: [PATCH 124/353] Reset I18n.locale to not affect other specs

Otherwise spec/models/enterprise_spec.rb fails if run after this.
---
 spec/helpers/i18n_helper_spec.rb | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/spec/helpers/i18n_helper_spec.rb b/spec/helpers/i18n_helper_spec.rb
index 86e236a261..4e044b3ca2 100644
--- a/spec/helpers/i18n_helper_spec.rb
+++ b/spec/helpers/i18n_helper_spec.rb
@@ -3,6 +3,16 @@ require 'spec_helper'
 describe I18nHelper do
   let(:user) { create(:user) }
 
+  # In the real world, the helper is called in every request and sets
+  # I18n.locale to the chosen locale or the default. For testing purposes we
+  # have to restore I18n.locale for unit tests that don't call the helper, but
+  # rely on translated strings.
+  around do |example|
+    locale = I18n.locale
+    example.run
+    I18n.locale = locale
+  end
+
   context "as guest" do
     before do
       allow(helper).to receive(:spree_current_user) { nil }

From f4b1c5de9cb966d62d37c6f142e07fcc5bee11fa Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 20 Sep 2017 13:29:36 +1000
Subject: [PATCH 125/353] Remove orphaned PayPalExpress payments when
 processing actual PayPalExpress payment

Fixes both #1074 and #1837
---
 app/models/spree/payment_decorator.rb |  6 ++
 spec/models/spree/payment_spec.rb     | 88 +++++++++++++++++++++++++++
 spec/requests/paypal_confirm_spec.rb  | 68 +++++++++++++++++++++
 3 files changed, 162 insertions(+)
 create mode 100644 spec/requests/paypal_confirm_spec.rb

diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index 98b996cce7..576f2f764e 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -5,6 +5,7 @@ module Spree
     after_save :ensure_correct_adjustment, :update_order
 
     def ensure_correct_adjustment
+      destroy_orphaned_paypal_payments if payment_method.is_a?(Spree::Gateway::PayPalExpress)
       # Don't charge for invalid payments.
       # PayPalExpress always creates a payment that is invalidated later.
       # Unknown: What about failed payments?
@@ -81,5 +82,10 @@ module Spree
       refund_amount.to_f
     end
 
+    def destroy_orphaned_paypal_payments
+      return unless source_type == "Spree::PaypalExpressCheckout"
+      orphaned_payments = order.payments.where(payment_method_id: payment_method_id, source_id: nil)
+      orphaned_payments.each(&:destroy)
+    end
   end
 end
diff --git a/spec/models/spree/payment_spec.rb b/spec/models/spree/payment_spec.rb
index 0877959cbb..07f6bb94be 100644
--- a/spec/models/spree/payment_spec.rb
+++ b/spec/models/spree/payment_spec.rb
@@ -124,5 +124,93 @@ module Spree
         payment.refund!
       end
     end
+
+    describe "applying transaction fees" do
+      let!(:order) { create(:order) }
+      let!(:line_item) { create(:line_item, order: order, quantity: 3, price: 5.00) }
+
+      # Mimicing call from PayPalController#confirm in spree_paypal_express
+      def create_new_paypal_express_payment(order, payment_method)
+        order.payments.create!({
+          :source => Spree::PaypalExpressCheckout.create({
+            :token => "123",
+            :payer_id => "456"
+          }, :without_protection => true),
+          :amount => order.total,
+          :payment_method => payment_method
+        }, :without_protection => true)
+      end
+
+      before do
+        order.update_totals
+      end
+
+      context "for paypal express payments with transaction fees" do
+        let!(:payment_method) { Spree::Gateway::PayPalExpress.create!(name: "PayPalExpress", distributor_ids: [create(:distributor_enterprise).id], environment: Rails.env) }
+        let(:calculator) { Spree::Calculator::FlatPercentItemTotal.new(preferred_flat_percent: 10) }
+
+        before do
+          payment_method.calculator = calculator
+          payment_method.save!
+        end
+
+        context "when a payment already exists on the order" do
+          let!(:existing_payment) do
+            order.payments.create!(payment_method_id: payment_method.id, amount: order.total)
+          end
+
+          context "and the existing payment uses the same payment method" do
+            context "and the existing payment does not have a source" do
+              it "removes the existing payment (and associated fees)" do
+                new_payment = create_new_paypal_express_payment(order, payment_method)
+
+                order.reload
+                expect(order.payments.count).to eq 1
+                expect(order.payments).to include new_payment
+                expect(order.payments).to_not include existing_payment
+                expect(order.adjustments.payment_fee.count).to eq 1
+                expect(order.adjustments.payment_fee.first.amount).to eq 1.5
+              end
+            end
+
+            context "and the existing payment has a source" do
+              let!(:source) { Spree::PaypalExpressCheckout.create(token: "123") }
+
+              before do
+                existing_payment.source = source
+                existing_payment.save!
+              end
+
+              it "does not remove or invalidate the existing payment" do
+                new_payment = create_new_paypal_express_payment(order, payment_method)
+
+                order.reload
+                expect(order.payments.count).to eq 2
+                expect(order.payments).to include new_payment, existing_payment
+                expect(new_payment.state).to eq "checkout"
+                expect(existing_payment.state).to eq "checkout"
+              end
+            end
+          end
+
+          context "and the existing payment uses a different method" do
+            let!(:another_payment_method) { Spree::Gateway::PayPalExpress.create!(name: "PayPalExpress", distributor_ids: [create(:distributor_enterprise).id], environment: Rails.env) }
+
+            before do
+              existing_payment.update_attributes(payment_method_id: another_payment_method.id)
+            end
+
+            it "does not remove or invalidate the existing payment" do
+              new_payment = create_new_paypal_express_payment(order, payment_method)
+
+              order.reload
+              expect(order.payments).to include new_payment, existing_payment
+              expect(new_payment.state).to eq "checkout"
+              expect(existing_payment.state).to eq "checkout"
+            end
+          end
+        end
+      end
+    end
   end
 end
diff --git a/spec/requests/paypal_confirm_spec.rb b/spec/requests/paypal_confirm_spec.rb
new file mode 100644
index 0000000000..2f36d3a612
--- /dev/null
+++ b/spec/requests/paypal_confirm_spec.rb
@@ -0,0 +1,68 @@
+require 'spec_helper'
+
+describe "confirming an order with paypal express payment method", type: :request do
+  include ShopWorkflow
+
+  let!(:address) { create(:address) }
+  let!(:shop) { create(:enterprise) }
+  let!(:shipping_method) { create(:shipping_method, distributor_ids: [shop.id]) }
+  let!(:order) { create(:order, distributor: shop, ship_address: address.dup, bill_address: address.dup) }
+  let!(:shipment) { create(:shipment, order: order, shipping_method: shipping_method) }
+  let!(:line_item) { create(:line_item, order: order, quantity: 3, price: 5.00) }
+  let!(:payment_method) { Spree::Gateway::PayPalExpress.create!(name: "PayPalExpress", distributor_ids: [create(:distributor_enterprise).id], environment: Rails.env) }
+  let(:params) { { token: 'lalalala', PayerID: 'payer1', payment_method_id: payment_method.id } }
+  let(:mocked_xml_response) {
+    "<?xml version=\"1.0\" encoding=\"UTF-8\"?>
+    <Envelope><Body>
+      <GetExpressCheckoutDetailsResponse>
+        <Ack>Success</Ack>
+        <PaymentDetails>Something</PaymentDetails>
+        <DoExpressCheckoutPaymentResponseDetails>
+          <PaymentInfo><TransactionID>s0metran$act10n</TransactionID></PaymentInfo>
+        </DoExpressCheckoutPaymentResponseDetails>
+      </GetExpressCheckoutDetailsResponse>
+    </Body></Envelope>"
+  }
+
+  before do
+    order.reload.update_totals
+    order.shipping_method = shipping_method
+    expect(order.next).to be true # => address
+    expect(order.next).to be true # => delivery
+    expect(order.next).to be true # => payment
+    set_order order
+
+    stub_request(:post, "https://api-3t.sandbox.paypal.com/2.0/")
+    .to_return(:status => 200, :body => mocked_xml_response )
+  end
+
+  context "with a flat percent calculator" do
+    let(:calculator) { Spree::Calculator::FlatPercentItemTotal.new(preferred_flat_percent: 10) }
+
+    before do
+      payment_method.calculator = calculator
+      payment_method.save!
+      order.payments.create!(payment_method_id: payment_method.id, amount: order.total)
+    end
+
+    it "destroys the old payment and processes the order" do
+      # Sanity check to condition of the order before we confirm the payment
+      expect(order.payments.count).to eq 1
+      expect(order.payments.first.state).to eq "checkout"
+      expect(order.adjustments.payment_fee.count).to eq 1
+      expect(order.adjustments.payment_fee.first.amount).to eq 1.5
+
+      get spree.confirm_paypal_path, params
+
+      # Processing was successful, order is complete
+      expect(response).to redirect_to spree.order_path(order, :token => order.token)
+      expect(order.reload.complete?).to be true
+
+      # We have only one payment, and one transaction fee
+      expect(order.payments.count).to eq 1
+      expect(order.payments.first.state).to eq "completed"
+      expect(order.adjustments.payment_fee.count).to eq 1
+      expect(order.adjustments.payment_fee.first.amount).to eq 1.5
+    end
+  end
+end

From 3f3085c66b8aec1bf290c8e46785f7aaf91a0eda Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 20 Sep 2017 18:12:28 +1000
Subject: [PATCH 126/353] Add detailed explanation of why
 #destroy_orphaned_paypal_payments is required

---
 app/models/spree/payment_decorator.rb | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index 576f2f764e..1e61883b1c 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -82,6 +82,15 @@ module Spree
       refund_amount.to_f
     end
 
+    # See #1074 and #1837 for more detail on why we need this
+    # An 'orphaned' Spree::Payment is created for every call to CheckoutController#update
+    # for orders that are processed using a Spree::Gateway::PayPalExpress payment method
+    # These payments are 'orphaned' because they are never used by the spree_paypal_express gem
+    # which creates a brand new Spree::Payment from scratch in PayPalController#confirm
+    # However, the 'orphaned' payments are useful when applying a transaction fee, because the fees
+    # need to be calculated before the order details are sent to PayPal for confirmation
+    # This is our best hook for removing the orphaned payments at an appropriate time. ie. after
+    # the payment details have been confirmed, but before any payments have been processed
     def destroy_orphaned_paypal_payments
       return unless source_type == "Spree::PaypalExpressCheckout"
       orphaned_payments = order.payments.where(payment_method_id: payment_method_id, source_id: nil)

From 386972db3b14caec25f038c366b2e7230ae4a36a Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 21 Sep 2017 16:54:46 +1000
Subject: [PATCH 127/353] Update spree gem reference

---
 Gemfile      |  2 +-
 Gemfile.lock | 52 ++++++++++++++++++++++++++--------------------------
 2 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/Gemfile b/Gemfile
index 442ce60701..cdb29cbbd3 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'coopdevs/spree', branch: 'spree-upgrade-step-6', ref: '6705667'
+gem 'spree', github: 'openfoodfoundation/spree', branch: 'step-6-adjustment-state-migration', ref: '48febb2'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 449d8fb67b..b02f75d716 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -7,10 +7,32 @@ GIT
       activemodel (~> 3.0)
 
 GIT
-  remote: git://github.com/coopdevs/spree.git
-  revision: 6705667ac8acd9f5f4add580a7679bc5b524325c
-  ref: 6705667
-  branch: spree-upgrade-step-6
+  remote: git://github.com/jeremydurham/custom-err-msg.git
+  revision: 3a8ec9dddc7a5b0aab7c69a6060596de300c68f4
+  specs:
+    custom_error_message (1.1.1)
+
+GIT
+  remote: git://github.com/openfoodfoundation/better_spree_paypal_express.git
+  revision: 8d95f4544c682634812becaf50999fba0cd04df0
+  branch: spree-upgrade-intermediate
+  specs:
+    spree_paypal_express (2.0.3)
+      paypal-sdk-merchant (= 1.106.1)
+      spree_core (~> 1.3.99)
+
+GIT
+  remote: git://github.com/openfoodfoundation/ofn-qz.git
+  revision: 024680ccea429b2e5428d7b964fa67c52add34ec
+  specs:
+    ofn-qz (0.1.0)
+      railties (~> 3.1)
+
+GIT
+  remote: git://github.com/openfoodfoundation/spree.git
+  revision: 48febb250a3b1eb2d42812b27b93457e89cde589
+  ref: 48febb2
+  branch: step-6-adjustment-state-migration
   specs:
     spree (1.3.99)
       spree_api (= 1.3.99)
@@ -68,28 +90,6 @@ GIT
     spree_sample (1.3.99)
       spree_core (= 1.3.99)
 
-GIT
-  remote: git://github.com/jeremydurham/custom-err-msg.git
-  revision: 3a8ec9dddc7a5b0aab7c69a6060596de300c68f4
-  specs:
-    custom_error_message (1.1.1)
-
-GIT
-  remote: git://github.com/openfoodfoundation/better_spree_paypal_express.git
-  revision: 8d95f4544c682634812becaf50999fba0cd04df0
-  branch: spree-upgrade-intermediate
-  specs:
-    spree_paypal_express (2.0.3)
-      paypal-sdk-merchant (= 1.106.1)
-      spree_core (~> 1.3.99)
-
-GIT
-  remote: git://github.com/openfoodfoundation/ofn-qz.git
-  revision: 024680ccea429b2e5428d7b964fa67c52add34ec
-  specs:
-    ofn-qz (0.1.0)
-      railties (~> 3.1)
-
 GIT
   remote: git://github.com/openfoodfoundation/spree_auth_devise.git
   revision: da9eecefc6fe13dedf4c6f3febec79caad839ec3

From 074018d2a6c52da8255962fc4d7a49e4b352eab6 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 21 Sep 2017 16:59:28 +1000
Subject: [PATCH 128/353] Copy and run adjustment states migration from updated
 version of spree

Note: this migration took 28.7571s to run against Aus production data on my local machine
---
 ...0921065259_update_adjustment_states.spree.rb | 17 +++++++++++++++++
 db/schema.rb                                    |  2 +-
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 db/migrate/20170921065259_update_adjustment_states.spree.rb

diff --git a/db/migrate/20170921065259_update_adjustment_states.spree.rb b/db/migrate/20170921065259_update_adjustment_states.spree.rb
new file mode 100644
index 0000000000..9040709751
--- /dev/null
+++ b/db/migrate/20170921065259_update_adjustment_states.spree.rb
@@ -0,0 +1,17 @@
+# This migration comes from spree (originally 20130417120035)
+class UpdateAdjustmentStates < ActiveRecord::Migration
+  def up
+    Spree::Order.complete.find_each do |order|
+      order.adjustments.update_all(:state => 'closed')
+    end
+
+    Spree::Shipment.shipped.includes(:adjustment).find_each do |shipment|
+      shipment.adjustment.update_column(:state, 'finalized') if shipment.adjustment
+    end
+
+    Spree::Adjustment.where(:state => nil).update_all(:state => 'open')
+  end
+
+  def down
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 5c70c8e6f9..77459f7d73 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended to check this file into your version control system.
 
-ActiveRecord::Schema.define(:version => 20170512115519) do
+ActiveRecord::Schema.define(:version => 20170921065259) do
 
   create_table "account_invoices", :force => true do |t|
     t.integer  "user_id",    :null => false

From 11ccb9a6d2fcae68e367441a5aa2e7c24ae6398f Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 21 Sep 2017 17:02:04 +1000
Subject: [PATCH 129/353] Revert "Fix for #1826, ensure that adjustment states
 are initialized prior to validation"

This reverts commit d7de7d462fef56b486da20d7982876e63ba881a7.

No longer required after we pulled in the correct migrations from Spree
---
 app/models/spree/adjustment_decorator.rb | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/app/models/spree/adjustment_decorator.rb b/app/models/spree/adjustment_decorator.rb
index bb4498c825..71a166aa56 100644
--- a/app/models/spree/adjustment_decorator.rb
+++ b/app/models/spree/adjustment_decorator.rb
@@ -6,8 +6,6 @@ module Spree
     has_one :metadata, class_name: 'AdjustmentMetadata'
     belongs_to :tax_rate, foreign_key: 'originator_id', conditions: "spree_adjustments.originator_type = 'Spree::TaxRate'"
 
-    before_validation :initialize_state
-
     scope :enterprise_fee,  where(originator_type: 'EnterpriseFee')
     scope :billable_period, where(source_type: 'BillablePeriod')
     scope :admin,           where(source_type: nil, originator_type: nil)
@@ -76,15 +74,5 @@ module Spree
       result
     end
 
-    private
-
-    # Required after Spree Upgrade Step 6, as existing adjustments did not have
-    # a state, and so failed validation. New adjustments are not affected.
-    def initialize_state
-      return unless state.nil?
-      # (static: true) only updates state when not already set
-      # use (static: :force) to force initialization
-      initialize_state_machines(static: true)
-    end
   end
 end

From 20b2e831e9fb38368cfa537a05bd4f64acaea310 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Fri, 18 Aug 2017 16:19:07 +1000
Subject: [PATCH 130/353] Convert specs to RSpec 2.14.4 syntax with Transpec

This conversion is done by Transpec 3.3.0 with the following command:
    transpec spec/features/consumer/shops_spec.rb

* 6 conversions
    from: obj.should
      to: expect(obj).to

* 3 conversions
    from: obj.should_not
      to: expect(obj).not_to

For more details: https://github.com/yujinakayama/transpec#supported-conversions
---
 spec/features/consumer/shops_spec.rb | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/spec/features/consumer/shops_spec.rb b/spec/features/consumer/shops_spec.rb
index 1ed7cd3615..192ed4bff8 100644
--- a/spec/features/consumer/shops_spec.rb
+++ b/spec/features/consumer/shops_spec.rb
@@ -28,27 +28,27 @@ feature 'Shops', js: true do
     end
 
     it "shows hubs" do
-      page.should have_content distributor.name
+      expect(page).to have_content distributor.name
       expand_active_table_node distributor.name
-      page.should have_content "OUR PRODUCERS"
+      expect(page).to have_content "OUR PRODUCERS"
     end
 
     it "does not show invisible hubs" do
-      page.should_not have_content invisible_distributor.name
+      expect(page).not_to have_content invisible_distributor.name
     end
 
     it "should not show hubs that are not in an order cycle" do
       create(:simple_product, distributors: [d1, d2])
       visit shops_path
-      page.should have_no_selector 'hub.inactive'
-      page.should have_no_selector 'hub',   text: d2.name
+      expect(page).to have_no_selector 'hub.inactive'
+      expect(page).to have_no_selector 'hub',   text: d2.name
     end
 
     it "should show closed shops after clicking the button" do
       create(:simple_product, distributors: [d1, d2])
       visit shops_path
       click_link_and_ensure("Show closed shops", -> { page.has_selector? 'hub.inactive' })
-      page.should have_selector 'hub.inactive', text: d2.name
+      expect(page).to have_selector 'hub.inactive', text: d2.name
     end
 
     it "should link to the hub page" do
@@ -66,8 +66,8 @@ feature 'Shops', js: true do
     it "does not show hubs that are not ready for checkout" do
       visit shops_path
 
-      Enterprise.ready_for_checkout.should_not include hub
-      page.should_not have_content hub.name
+      expect(Enterprise.ready_for_checkout).not_to include hub
+      expect(page).not_to have_content hub.name
     end
   end
 
@@ -184,7 +184,7 @@ feature 'Shops', js: true do
 
     it "shows closed shops" do
       #click_link_and_ensure("Show closed shops", -> { page.has_selector? 'hub.inactive' })
-      page.should have_selector 'hub.inactive', text: d2.name
+      expect(page).to have_selector 'hub.inactive', text: d2.name
     end
   end
 

From 0f1fb68ee809575c9dfe19b575049d3f38417bbc Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Sat, 19 Aug 2017 11:01:36 +1000
Subject: [PATCH 131/353] Simplify specs

---
 .rubocop_todo.yml                    |  1 -
 spec/features/consumer/shops_spec.rb | 13 ++++---------
 2 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
index ee8e61e8a2..dd05d120e6 100644
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@@ -455,7 +455,6 @@ Layout/LeadingCommentSpace:
     - 'spec/factories.rb'
     - 'spec/features/admin/products_spec.rb'
     - 'spec/features/admin/reports_spec.rb'
-    - 'spec/features/consumer/shops_spec.rb'
     - 'spec/jobs/finalize_account_invoices_spec.rb'
     - 'spec/lib/open_food_network/order_and_distributor_report_spec.rb'
     - 'spec/lib/open_food_network/order_grouper_spec.rb'
diff --git a/spec/features/consumer/shops_spec.rb b/spec/features/consumer/shops_spec.rb
index 192ed4bff8..95b2e59af5 100644
--- a/spec/features/consumer/shops_spec.rb
+++ b/spec/features/consumer/shops_spec.rb
@@ -22,7 +22,7 @@ feature 'Shops', js: true do
   end
 
 
-  context "on the shops path" do
+  describe "listing shops" do
     before do
       visit shops_path
     end
@@ -37,21 +37,17 @@ feature 'Shops', js: true do
       expect(page).not_to have_content invisible_distributor.name
     end
 
-    it "should not show hubs that are not in an order cycle" do
-      create(:simple_product, distributors: [d1, d2])
-      visit shops_path
+    it "does not show hubs that are not in an order cycle" do
       expect(page).to have_no_selector 'hub.inactive'
       expect(page).to have_no_selector 'hub',   text: d2.name
     end
 
-    it "should show closed shops after clicking the button" do
-      create(:simple_product, distributors: [d1, d2])
-      visit shops_path
+    it "shows closed shops after clicking the button" do
       click_link_and_ensure("Show closed shops", -> { page.has_selector? 'hub.inactive' })
       expect(page).to have_selector 'hub.inactive', text: d2.name
     end
 
-    it "should link to the hub page" do
+    it "links to the hub page" do
       follow_active_table_node distributor.name
       expect(page).to have_current_path enterprise_shop_path(distributor)
     end
@@ -183,7 +179,6 @@ feature 'Shops', js: true do
     end
 
     it "shows closed shops" do
-      #click_link_and_ensure("Show closed shops", -> { page.has_selector? 'hub.inactive' })
       expect(page).to have_selector 'hub.inactive', text: d2.name
     end
   end

From e6006218834049b19d9c0c80c647f25a36df1370 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Sat, 19 Aug 2017 11:08:30 +1000
Subject: [PATCH 132/353] Spec issue 1718

---
 spec/features/consumer/shops_spec.rb | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/spec/features/consumer/shops_spec.rb b/spec/features/consumer/shops_spec.rb
index 95b2e59af5..881343146f 100644
--- a/spec/features/consumer/shops_spec.rb
+++ b/spec/features/consumer/shops_spec.rb
@@ -6,6 +6,7 @@ feature 'Shops', js: true do
 
   let!(:distributor) { create(:distributor_enterprise, with_payment_and_shipping: true) }
   let!(:invisible_distributor) { create(:distributor_enterprise, visible: false) }
+  let!(:profile) { create(:distributor_enterprise, sells: 'none') }
   let!(:d1) { create(:distributor_enterprise, with_payment_and_shipping: true) }
   let!(:d2) { create(:distributor_enterprise, with_payment_and_shipping: true) }
   let!(:order_cycle) { create(:simple_order_cycle, distributors: [distributor], coordinator: create(:distributor_enterprise)) }
@@ -42,6 +43,10 @@ feature 'Shops', js: true do
       expect(page).to have_no_selector 'hub',   text: d2.name
     end
 
+    it "does not show profiles" do
+      expect(page).not_to have_content profile.name
+    end
+
     it "shows closed shops after clicking the button" do
       click_link_and_ensure("Show closed shops", -> { page.has_selector? 'hub.inactive' })
       expect(page).to have_selector 'hub.inactive', text: d2.name
@@ -51,6 +56,21 @@ feature 'Shops', js: true do
       follow_active_table_node distributor.name
       expect(page).to have_current_path enterprise_shop_path(distributor)
     end
+
+    describe "showing profiles" do
+      before do
+        check "Show profiles"
+      end
+
+      it "still shows hubs" do
+        expect(page).to have_content distributor.name
+      end
+
+      # https://github.com/openfoodfoundation/openfoodnetwork/issues/1718
+      xit "shows profiles" do
+        expect(page).to have_content profile.name
+      end
+    end
   end
 
   describe "showing available hubs" do

From 73041e9263588a7371f01a015d77c7a1ad19d62c Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Fri, 15 Sep 2017 15:51:38 +1000
Subject: [PATCH 133/353] Show shop profiles without closed shops

The filter for closed shops was filtering profiles as well. That made it
impossible to show profiles without showing closed shops as well.

Replacing the filter for closed shops fixes the "show profiles" feature.

Fixes https://github.com/openfoodfoundation/openfoodnetwork/issues/1718
---
 .../enterprises_controller.js.coffee          |  9 +++---
 .../darkswarm/filters/closed_shops.js.coffee  |  7 +++++
 app/views/shops/_filters.html.haml            |  2 +-
 app/views/shops/_hubs.html.haml               |  4 +--
 app/views/shops/_hubs_table.html.haml         |  2 +-
 spec/features/consumer/shops_spec.rb          |  2 +-
 .../filters/closed_shops_spec.js.coffee       | 30 +++++++++++++++++++
 7 files changed, 46 insertions(+), 10 deletions(-)
 create mode 100644 app/assets/javascripts/darkswarm/filters/closed_shops.js.coffee
 create mode 100644 spec/javascripts/unit/darkswarm/filters/closed_shops_spec.js.coffee

diff --git a/app/assets/javascripts/darkswarm/controllers/enterprises_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/enterprises_controller.js.coffee
index f0a174a47c..4f85093df5 100644
--- a/app/assets/javascripts/darkswarm/controllers/enterprises_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/enterprises_controller.js.coffee
@@ -6,10 +6,9 @@ Darkswarm.controller "EnterprisesCtrl", ($scope, $rootScope, $timeout, $location
   $scope.openModal = EnterpriseModal.open
   $scope.activeTaxons = []
   $scope.show_profiles = false
+  $scope.show_closed = false
   $scope.filtersActive = false
   $scope.distanceMatchesShown = false
-  $scope.filterExpression = {active: true}
-
 
   $scope.$watch "query", (query)->
     Enterprises.flagMatching query
@@ -36,7 +35,7 @@ Darkswarm.controller "EnterprisesCtrl", ($scope, $rootScope, $timeout, $location
   # When filter settings change, this could change which name match is at the top, or even
   # result in no matches. This affects the reference point that the distance matches are
   # calculated from, so we need to recalculate distances.
-  $scope.$watch '[activeTaxons, activeProperties, shippingTypes, show_profiles]', ->
+  $scope.$watch '[activeTaxons, activeProperties, shippingTypes, show_profiles, show_closed]', ->
     $timeout ->
       Enterprises.calculateDistance $scope.query, $scope.firstNameMatch()
       $rootScope.$broadcast 'enterprisesChanged'
@@ -74,9 +73,9 @@ Darkswarm.controller "EnterprisesCtrl", ($scope, $rootScope, $timeout, $location
       undefined
 
   $scope.showClosedShops = ->
-    delete $scope.filterExpression['active']
+    $scope.show_closed = true
     $location.search('show_closed', '1')
 
   $scope.hideClosedShops = ->
-    $scope.filterExpression['active'] = true
+    $scope.show_closed = false
     $location.search('show_closed', null)
diff --git a/app/assets/javascripts/darkswarm/filters/closed_shops.js.coffee b/app/assets/javascripts/darkswarm/filters/closed_shops.js.coffee
new file mode 100644
index 0000000000..23d5de8255
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/filters/closed_shops.js.coffee
@@ -0,0 +1,7 @@
+Darkswarm.filter 'closedShops', ->
+  (enterprises, show_closed) ->
+    enterprises ||= []
+    show_closed ?= false
+
+    enterprises.filter (enterprise) =>
+      show_closed or enterprise.active or !enterprise.is_distributor
diff --git a/app/views/shops/_filters.html.haml b/app/views/shops/_filters.html.haml
index 42e2b2ec28..dedc473808 100644
--- a/app/views/shops/_filters.html.haml
+++ b/app/views/shops/_filters.html.haml
@@ -1,5 +1,5 @@
 - resource ||= "visibleMatches"
-- property_filters ||= "| filter:filterExpression | taxons:activeTaxons | shipping:shippingTypes | showHubProfiles:show_profiles"
+- property_filters ||= "| closedShops:show_closed | taxons:activeTaxons | shipping:shippingTypes | showHubProfiles:show_profiles"
 
 .row
   = render 'shared/components/filter_controls'
diff --git a/app/views/shops/_hubs.html.haml b/app/views/shops/_hubs.html.haml
index 6087d2330c..3e477b9551 100644
--- a/app/views/shops/_hubs.html.haml
+++ b/app/views/shops/_hubs.html.haml
@@ -28,8 +28,8 @@
         %a{href: "", "ng-click" => "showDistanceMatches()"}
           = t :hubs_distance_filter, location: "{{ nameMatchesFiltered[0].name }}"
   .more-controls
-    %a.button{href: "", ng: {click: "showClosedShops()", show: "filterExpression.active"}}
+    %a.button{href: "", ng: {click: "showClosedShops()", show: "!show_closed"}}
       = t '.show_closed_shops'
-    %a.button{href: "", ng: {click: "hideClosedShops()", show: "!filterExpression.active"}}
+    %a.button{href: "", ng: {click: "hideClosedShops()", show: "show_closed"}}
       = t '.hide_closed_shops'
     %a.button{href: main_app.map_path}= t '.show_on_map'
diff --git a/app/views/shops/_hubs_table.html.haml b/app/views/shops/_hubs_table.html.haml
index 6d5803b477..0c0b1a4442 100644
--- a/app/views/shops/_hubs_table.html.haml
+++ b/app/views/shops/_hubs_table.html.haml
@@ -1,5 +1,5 @@
 .active_table
-  %hub.active_table_node.row{"ng-repeat" => "hub in #{enterprises}Filtered = (#{enterprises} | filter:filterExpression | taxons:activeTaxons | properties:activeProperties:'distributed_properties' | shipping:shippingTypes | showHubProfiles:show_profiles | orderBy:['-active', '+distance', '+orders_close_at'])",
+  %hub.active_table_node.row{"ng-repeat" => "hub in #{enterprises}Filtered = (#{enterprises} | closedShops:show_closed | taxons:activeTaxons | properties:activeProperties:'distributed_properties' | shipping:shippingTypes | showHubProfiles:show_profiles | orderBy:['-active', '+distance', '+orders_close_at'])",
   "ng-class" => "{'is_profile' : hub.category == 'hub_profile', 'closed' : !open(), 'open' : open(), 'inactive' : !hub.active, 'current' : current()}",
   "ng-controller" => "HubNodeCtrl",
   id: "{{hub.hash}}"}
diff --git a/spec/features/consumer/shops_spec.rb b/spec/features/consumer/shops_spec.rb
index 881343146f..5e28f8ae50 100644
--- a/spec/features/consumer/shops_spec.rb
+++ b/spec/features/consumer/shops_spec.rb
@@ -67,7 +67,7 @@ feature 'Shops', js: true do
       end
 
       # https://github.com/openfoodfoundation/openfoodnetwork/issues/1718
-      xit "shows profiles" do
+      it "shows profiles" do
         expect(page).to have_content profile.name
       end
     end
diff --git a/spec/javascripts/unit/darkswarm/filters/closed_shops_spec.js.coffee b/spec/javascripts/unit/darkswarm/filters/closed_shops_spec.js.coffee
new file mode 100644
index 0000000000..8580ba7f3d
--- /dev/null
+++ b/spec/javascripts/unit/darkswarm/filters/closed_shops_spec.js.coffee
@@ -0,0 +1,30 @@
+describe "filtering closed shops", ->
+  enterprises = [{
+    name: "open shop"
+    active: true
+    is_distributor: true
+    }, {
+    name: "closed shop"
+    active: false
+    is_distributor: true
+    }, {
+    name: "profile"
+    active: false
+    is_distributor: false
+    }, {
+    name: "errornous entry"
+    does_not_have: "required attributes"
+    }
+  ]
+  closedShops = null
+
+  beforeEach ->
+    module 'Darkswarm'
+    inject ($filter) ->
+      closedShops = $filter('closedShops')
+
+  it "filters closed shops, but ignores profiles and invalid entries", ->
+    expect(closedShops(enterprises, false)).toEqual [enterprises[0], enterprises[2], enterprises[3]]
+
+  it "does not filter closed shops", ->
+    expect(closedShops(enterprises, true)).toEqual enterprises

From 7beb6e624c14dcadb1d63c8ce55e95b71fa2635c Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 31 May 2017 12:05:00 +1000
Subject: [PATCH 134/353] Darkswarm flash loader works with :notice flash
 messages

---
 .../darkswarm/services/rails_flash_loader.js.coffee   | 11 +++++++++++
 app/views/json/_flash.rabl                            |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/darkswarm/services/rails_flash_loader.js.coffee b/app/assets/javascripts/darkswarm/services/rails_flash_loader.js.coffee
index 9398b5f5cc..4ef72122a7 100644
--- a/app/assets/javascripts/darkswarm/services/rails_flash_loader.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/rails_flash_loader.js.coffee
@@ -1,7 +1,18 @@
 Darkswarm.factory 'RailsFlashLoader', (flash, railsFlash)->
   new class RailsFlashLoader
+    # The 'flash' service requires type key to
+    # be one of: success, info, warn, error
+    typePairings:
+      success: 'success'
+      error: 'error'
+      notice: 'success'
+      info: 'info'
+      warn: 'warn'
+
     initFlash: ->
       @loadFlash railsFlash
+
     loadFlash: (rails_flash)->
       for type, message of rails_flash
+        type = @typePairings[type]
         flash[type] = message
diff --git a/app/views/json/_flash.rabl b/app/views/json/_flash.rabl
index 2900b2b948..5a90e00f02 100644
--- a/app/views/json/_flash.rabl
+++ b/app/views/json/_flash.rabl
@@ -1,2 +1,2 @@
 object OpenStruct.new(flash.to_hash)
-attributes :info, :success, :error
+attributes :info, :success, :error, :notice

From 131d9384c21d08090392e06f33afbc7cc0f8c406 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sat, 23 Sep 2017 12:50:32 +1000
Subject: [PATCH 135/353] Use flash.notice instead of flash.success to display
 order confirmation message

This way it overwrites any message that is set from spree, rather than displaying duplicate messages
---
 app/controllers/checkout_controller.rb               | 2 +-
 app/controllers/spree/paypal_controller_decorator.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 13d9e71d51..be35682a7b 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -43,7 +43,7 @@ class CheckoutController < Spree::CheckoutController
         ResetOrderService.new(self, current_order).call
         session[:access_token] = current_order.token
 
-        flash[:success] = t(:order_processed_successfully)
+        flash[:notice] = t(:order_processed_successfully)
         respond_to do |format|
           format.html do
             respond_with(@order, :location => order_path(@order))
diff --git a/app/controllers/spree/paypal_controller_decorator.rb b/app/controllers/spree/paypal_controller_decorator.rb
index 9ad11927ab..40c0aa46a9 100644
--- a/app/controllers/spree/paypal_controller_decorator.rb
+++ b/app/controllers/spree/paypal_controller_decorator.rb
@@ -19,7 +19,7 @@ Spree::PaypalController.class_eval do
 
   def reset_order_when_complete
     if current_order.complete?
-      flash[:success] = t(:order_processed_successfully)
+      flash[:notice] = t(:order_processed_successfully)
 
       ResetOrderService.new(self, current_order).call
       session[:access_token] = current_order.token

From d2d07f03621788394299be90dfc86f9887af4e96 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sat, 23 Sep 2017 12:51:01 +1000
Subject: [PATCH 136/353] Update translation scope for PayPal checkout
 cancellation message

---
 app/controllers/spree/paypal_controller_decorator.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/spree/paypal_controller_decorator.rb b/app/controllers/spree/paypal_controller_decorator.rb
index 40c0aa46a9..8bab56acdf 100644
--- a/app/controllers/spree/paypal_controller_decorator.rb
+++ b/app/controllers/spree/paypal_controller_decorator.rb
@@ -3,7 +3,7 @@ Spree::PaypalController.class_eval do
   before_filter :enable_embedded_shopfront
 
   def cancel
-    flash[:notice] = t('flash.cancel', :scope => 'paypal')
+    flash[:notice] = Spree.t('flash.cancel', :scope => 'paypal')
     redirect_to main_app.checkout_path
   end
 

From f3322dd82e9e22e6c34521558328c96806720a09 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sat, 23 Sep 2017 13:02:28 +1000
Subject: [PATCH 137/353] Transfer responsibility for checking for orphaned
 PayPal payments from Payment model to Spree::PayPalController

---
 .../spree/paypal_controller_decorator.rb      | 18 +++-
 app/models/spree/payment_decorator.rb         | 16 ----
 spec/models/spree/payment_spec.rb             | 88 -------------------
 3 files changed, 17 insertions(+), 105 deletions(-)

diff --git a/app/controllers/spree/paypal_controller_decorator.rb b/app/controllers/spree/paypal_controller_decorator.rb
index 8bab56acdf..cc18c9fc7d 100644
--- a/app/controllers/spree/paypal_controller_decorator.rb
+++ b/app/controllers/spree/paypal_controller_decorator.rb
@@ -1,6 +1,7 @@
 Spree::PaypalController.class_eval do
-  after_filter :reset_order_when_complete, only: :confirm
   before_filter :enable_embedded_shopfront
+  before_filter :destroy_orphaned_paypal_payments, only: :confirm
+  after_filter :reset_order_when_complete, only: :confirm
 
   def cancel
     flash[:notice] = Spree.t('flash.cancel', :scope => 'paypal')
@@ -25,4 +26,19 @@ Spree::PaypalController.class_eval do
       session[:access_token] = current_order.token
     end
   end
+
+  # See #1074 and #1837 for more detail on why we need this
+  # An 'orphaned' Spree::Payment is created for every call to CheckoutController#update
+  # for orders that are processed using a Spree::Gateway::PayPalExpress payment method
+  # These payments are 'orphaned' because they are never used by the spree_paypal_express gem
+  # which creates a brand new Spree::Payment from scratch in PayPalController#confirm
+  # However, the 'orphaned' payments are useful when applying a transaction fee, because the fees
+  # need to be calculated before the order details are sent to PayPal for confirmation
+  # This is our best hook for removing the orphaned payments at an appropriate time. ie. after
+  # the payment details have been confirmed, but before any payments have been processed
+  def destroy_orphaned_paypal_payments
+    return unless payment_method.is_a?(Spree::Gateway::PayPalExpress)
+    orphaned_payments = current_order.payments.where(payment_method_id: payment_method.id, source_id: nil)
+    orphaned_payments.each(&:destroy)
+  end
 end
diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index 1e61883b1c..0c87468034 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -5,7 +5,6 @@ module Spree
     after_save :ensure_correct_adjustment, :update_order
 
     def ensure_correct_adjustment
-      destroy_orphaned_paypal_payments if payment_method.is_a?(Spree::Gateway::PayPalExpress)
       # Don't charge for invalid payments.
       # PayPalExpress always creates a payment that is invalidated later.
       # Unknown: What about failed payments?
@@ -81,20 +80,5 @@ module Spree
       refund_amount ||= credit_allowed >= order.outstanding_balance.abs ? order.outstanding_balance.abs : credit_allowed.abs
       refund_amount.to_f
     end
-
-    # See #1074 and #1837 for more detail on why we need this
-    # An 'orphaned' Spree::Payment is created for every call to CheckoutController#update
-    # for orders that are processed using a Spree::Gateway::PayPalExpress payment method
-    # These payments are 'orphaned' because they are never used by the spree_paypal_express gem
-    # which creates a brand new Spree::Payment from scratch in PayPalController#confirm
-    # However, the 'orphaned' payments are useful when applying a transaction fee, because the fees
-    # need to be calculated before the order details are sent to PayPal for confirmation
-    # This is our best hook for removing the orphaned payments at an appropriate time. ie. after
-    # the payment details have been confirmed, but before any payments have been processed
-    def destroy_orphaned_paypal_payments
-      return unless source_type == "Spree::PaypalExpressCheckout"
-      orphaned_payments = order.payments.where(payment_method_id: payment_method_id, source_id: nil)
-      orphaned_payments.each(&:destroy)
-    end
   end
 end
diff --git a/spec/models/spree/payment_spec.rb b/spec/models/spree/payment_spec.rb
index 07f6bb94be..0877959cbb 100644
--- a/spec/models/spree/payment_spec.rb
+++ b/spec/models/spree/payment_spec.rb
@@ -124,93 +124,5 @@ module Spree
         payment.refund!
       end
     end
-
-    describe "applying transaction fees" do
-      let!(:order) { create(:order) }
-      let!(:line_item) { create(:line_item, order: order, quantity: 3, price: 5.00) }
-
-      # Mimicing call from PayPalController#confirm in spree_paypal_express
-      def create_new_paypal_express_payment(order, payment_method)
-        order.payments.create!({
-          :source => Spree::PaypalExpressCheckout.create({
-            :token => "123",
-            :payer_id => "456"
-          }, :without_protection => true),
-          :amount => order.total,
-          :payment_method => payment_method
-        }, :without_protection => true)
-      end
-
-      before do
-        order.update_totals
-      end
-
-      context "for paypal express payments with transaction fees" do
-        let!(:payment_method) { Spree::Gateway::PayPalExpress.create!(name: "PayPalExpress", distributor_ids: [create(:distributor_enterprise).id], environment: Rails.env) }
-        let(:calculator) { Spree::Calculator::FlatPercentItemTotal.new(preferred_flat_percent: 10) }
-
-        before do
-          payment_method.calculator = calculator
-          payment_method.save!
-        end
-
-        context "when a payment already exists on the order" do
-          let!(:existing_payment) do
-            order.payments.create!(payment_method_id: payment_method.id, amount: order.total)
-          end
-
-          context "and the existing payment uses the same payment method" do
-            context "and the existing payment does not have a source" do
-              it "removes the existing payment (and associated fees)" do
-                new_payment = create_new_paypal_express_payment(order, payment_method)
-
-                order.reload
-                expect(order.payments.count).to eq 1
-                expect(order.payments).to include new_payment
-                expect(order.payments).to_not include existing_payment
-                expect(order.adjustments.payment_fee.count).to eq 1
-                expect(order.adjustments.payment_fee.first.amount).to eq 1.5
-              end
-            end
-
-            context "and the existing payment has a source" do
-              let!(:source) { Spree::PaypalExpressCheckout.create(token: "123") }
-
-              before do
-                existing_payment.source = source
-                existing_payment.save!
-              end
-
-              it "does not remove or invalidate the existing payment" do
-                new_payment = create_new_paypal_express_payment(order, payment_method)
-
-                order.reload
-                expect(order.payments.count).to eq 2
-                expect(order.payments).to include new_payment, existing_payment
-                expect(new_payment.state).to eq "checkout"
-                expect(existing_payment.state).to eq "checkout"
-              end
-            end
-          end
-
-          context "and the existing payment uses a different method" do
-            let!(:another_payment_method) { Spree::Gateway::PayPalExpress.create!(name: "PayPalExpress", distributor_ids: [create(:distributor_enterprise).id], environment: Rails.env) }
-
-            before do
-              existing_payment.update_attributes(payment_method_id: another_payment_method.id)
-            end
-
-            it "does not remove or invalidate the existing payment" do
-              new_payment = create_new_paypal_express_payment(order, payment_method)
-
-              order.reload
-              expect(order.payments).to include new_payment, existing_payment
-              expect(new_payment.state).to eq "checkout"
-              expect(existing_payment.state).to eq "checkout"
-            end
-          end
-        end
-      end
-    end
   end
 end

From 1db0bbef0934f666b226e319f8148514996fc932 Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Sun, 28 Aug 2016 13:20:21 +0100
Subject: [PATCH 138/353] Create table for stripe accounts

---
 Gemfile                                           |  1 +
 Gemfile.lock                                      | 15 +++++++++++++++
 .../20160828115018_create_stripe_accounts.rb      | 12 ++++++++++++
 db/schema.rb                                      | 10 ++++++++++
 4 files changed, 38 insertions(+)
 create mode 100644 db/migrate/20160828115018_create_stripe_accounts.rb

diff --git a/Gemfile b/Gemfile
index cdb29cbbd3..f0d5362f66 100644
--- a/Gemfile
+++ b/Gemfile
@@ -19,6 +19,7 @@ gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch:
 # - Change type of password from string to password to hide it in the form
 gem 'spree_paypal_express', :github => "openfoodfoundation/better_spree_paypal_express", :branch => "spree-upgrade-intermediate"
 #gem 'spree_paypal_express', :github => "spree-contrib/better_spree_paypal_express", :branch => "1-3-stable"
+gem 'stripe', '~>1.51.0'
 
 gem 'delayed_job_active_record'
 gem 'daemons'
diff --git a/Gemfile.lock b/Gemfile.lock
index b02f75d716..46c2224f26 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -271,6 +271,8 @@ GEM
       devise (>= 2.1.0)
     diff-lcs (1.2.4)
     diffy (3.1.0)
+    domain_name (0.5.20160615)
+      unf (>= 0.0.5, < 1.0.0)
     em-websocket (0.5.0)
       eventmachine (>= 0.12.9)
       http_parser.rb (~> 0.5.3)
@@ -429,6 +431,8 @@ GEM
       tilt
     highline (1.6.15)
     hike (1.2.3)
+    http-cookie (1.0.2)
+      domain_name (~> 0.5)
     http_parser.rb (0.5.3)
     httparty (0.9.0)
       multi_json (~> 1.0)
@@ -480,6 +484,7 @@ GEM
       i18n (~> 0.6.0)
     multi_json (1.12.1)
     multi_xml (0.6.0)
+    netrc (0.11.0)
     newrelic_rpm (3.12.0.288)
     nokogiri (1.6.8.1)
       mini_portile2 (~> 2.1.0)
@@ -573,6 +578,10 @@ GEM
     representative_view (1.2.2)
       actionpack (> 2.3.0, < 4.0.0)
       representative (~> 1.0.2)
+    rest-client (2.0.0)
+      http-cookie (>= 1.0.2, < 2.0)
+      mime-types (>= 1.16, < 4.0)
+      netrc (~> 0.8)
     roadie (3.0.1)
       css_parser (~> 1.3.4)
       nokogiri (~> 1.6.0)
@@ -629,6 +638,8 @@ GEM
       tilt (~> 1.1, != 1.3.0)
     state_machine (1.2.0)
     stringex (1.3.3)
+    stripe (1.51.0)
+      rest-client (>= 1.4, < 3.0)
     therubyracer (0.12.0)
       libv8 (~> 3.16.14.0)
       ref
@@ -650,6 +661,9 @@ GEM
       execjs (>= 0.3.0)
       json (>= 1.8.0)
     unicode-display_width (1.3.0)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.7.2)
     unicorn (4.9.0)
       kgio (~> 2.6)
       rack
@@ -762,6 +776,7 @@ DEPENDENCIES
   spree_auth_devise!
   spree_i18n!
   spree_paypal_express!
+  stripe (~> 1.51.0)
   therubyracer
   timecop
   truncate_html
diff --git a/db/migrate/20160828115018_create_stripe_accounts.rb b/db/migrate/20160828115018_create_stripe_accounts.rb
new file mode 100644
index 0000000000..56ab206540
--- /dev/null
+++ b/db/migrate/20160828115018_create_stripe_accounts.rb
@@ -0,0 +1,12 @@
+class CreateStripeAccounts < ActiveRecord::Migration
+  def change
+    create_table :stripe_accounts do |t|
+      t.string :stripe_user_id
+      t.string :stripe_publishable_key
+      t.timestamps
+      t.belongs_to :enterprise
+    end
+
+    add_index :stripe_accounts, :enterprise_id, unique: true
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 77459f7d73..24eb666244 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -1044,6 +1044,16 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "zone_members_count", :default => 0
   end
 
+  create_table "stripe_accounts", :force => true do |t|
+    t.string   "stripe_user_id"
+    t.string   "stripe_publishable_key"
+    t.datetime "created_at",             :null => false
+    t.datetime "updated_at",             :null => false
+    t.integer  "enterprise_id"
+  end
+
+  add_index "stripe_accounts", ["enterprise_id"], :name => "index_stripe_accounts_on_enterprise_id", :unique => true
+
   create_table "suburbs", :force => true do |t|
     t.string  "name"
     t.string  "postcode"

From df183292331a0b43b2dae3da4e70992c72165ca7 Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Mon, 5 Sep 2016 19:21:23 +0100
Subject: [PATCH 139/353] Starting Stripe integration

---
 Gemfile                                   |  2 ++
 Gemfile.lock                              | 13 ++++++++++++-
 app/controllers/enterprises_controller.rb | 16 ++++++++++++++++
 app/models/enterprise.rb                  |  2 ++
 config/routes.rb                          |  2 ++
 5 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/Gemfile b/Gemfile
index f0d5362f66..ade5fa6951 100644
--- a/Gemfile
+++ b/Gemfile
@@ -14,6 +14,8 @@ gem 'spree', github: 'openfoodfoundation/spree', branch: 'step-6-adjustment-stat
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
+gem 'oauth2', '~> 1.2.0' # Used for Stripe Connect
+
 # Our branch contains two changes
 # - Pass customer email and phone number to PayPal (merged to upstream master)
 # - Change type of password from string to password to hide it in the form
diff --git a/Gemfile.lock b/Gemfile.lock
index 46c2224f26..822e0e400c 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -285,6 +285,8 @@ GEM
     factory_girl_rails (3.3.0)
       factory_girl (~> 3.3.0)
       railties (>= 3.0.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
     ffaker (1.15.0)
     ffi (1.9.3)
     figaro (0.7.0)
@@ -454,7 +456,8 @@ GEM
     json_spec (1.1.1)
       multi_json (~> 1.0)
       rspec (~> 2.0)
-    kaminari (0.13.0)
+    jwt (1.5.4)
+    kaminari (0.14.1)
       actionpack (>= 3.0.0)
       activesupport (>= 3.0.0)
       railties (>= 3.0.0)
@@ -484,10 +487,17 @@ GEM
       i18n (~> 0.6.0)
     multi_json (1.12.1)
     multi_xml (0.6.0)
+    multipart-post (2.0.0)
     netrc (0.11.0)
     newrelic_rpm (3.12.0.288)
     nokogiri (1.6.8.1)
       mini_portile2 (~> 2.1.0)
+    oauth2 (1.2.0)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
     oj (2.1.2)
     orm_adapter (0.5.0)
     paper_trail (3.0.8)
@@ -747,6 +757,7 @@ DEPENDENCIES
   momentjs-rails
   newrelic_rpm
   nokogiri (>= 1.6.7.1)
+  oauth2 (~> 1.2.0)
   ofn-qz!
   oj
   paper_trail (~> 3.0.8)
diff --git a/app/controllers/enterprises_controller.rb b/app/controllers/enterprises_controller.rb
index 126e2bdeed..d913cb4c57 100644
--- a/app/controllers/enterprises_controller.rb
+++ b/app/controllers/enterprises_controller.rb
@@ -38,6 +38,22 @@ class EnterprisesController < BaseController
     end
   end
 
+
+  def stripe_connect
+    if params["code"]
+      # Get the deets from Stripe
+
+      stripe_account = StripeAccount.new(stripe_user_id: params["stripe_user_id"], stripe_publishable_key: params["stripe_publishable_key"], enterprise: self) 
+      if stripe_account.save
+        render_json stripe_account
+      else
+        render text "Failed to save Stripe token", status: 500
+      end
+    else
+      render text params["error_description"], status: 500
+    end
+  end
+
   private
 
   def clean_permalink
diff --git a/app/models/enterprise.rb b/app/models/enterprise.rb
index 9a4f2c6c80..9856c75b93 100644
--- a/app/models/enterprise.rb
+++ b/app/models/enterprise.rb
@@ -42,6 +42,7 @@ class Enterprise < ActiveRecord::Base
   has_many :billable_periods
   has_many :inventory_items
   has_many :tag_rules
+  has_many :stripe_accounts
 
   delegate :latitude, :longitude, :city, :state_name, :to => :address
 
@@ -365,6 +366,7 @@ class Enterprise < ActiveRecord::Base
     abn.present?
   end
 
+
   protected
 
   def devise_mailer
diff --git a/config/routes.rb b/config/routes.rb
index b91779166c..32500d9a1b 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -65,6 +65,8 @@ Openfoodnetwork::Application.routes.draw do
   post 'embedded_shopfront/enable', to: 'application#enable_embedded_styles'
   post 'embedded_shopfront/disable', to: 'application#disable_embedded_styles'
 
+  get '/stripe/callback', :to => 'enterprise#stripe_connect'
+
   resources :enterprises do
     collection do
       post :search

From 3623325cab81a342a7a9056183840e680755fb30 Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Mon, 5 Sep 2016 19:31:40 +0100
Subject: [PATCH 140/353] Add missing files

---
 app/helpers/admin/stripe_helper.rb | 19 +++++++++++++++++++
 app/models/stripe_account.rb       |  5 +++++
 2 files changed, 24 insertions(+)
 create mode 100644 app/helpers/admin/stripe_helper.rb
 create mode 100644 app/models/stripe_account.rb

diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
new file mode 100644
index 0000000000..1ec28e7bf0
--- /dev/null
+++ b/app/helpers/admin/stripe_helper.rb
@@ -0,0 +1,19 @@
+module StripeHelper
+  class << self
+    attr_accessor :client, :options
+  end
+  @options = {
+    :site => 'https://connect.stripe.com',
+    :authorize_url => '/oauth/authorize',
+    :token_url => '/oauth/token'
+  }
+  @client = OAuth2::Client.new(
+    ENV['STRIPE_CLIENT_ID'],
+    ENV['STRIPE_INSTANCE_SECRET_KEY'],
+    options
+  )
+
+  def get_token(code, options={params: {scope: 'read_write'}})
+    @client.get_token(code, options)
+  end
+end
diff --git a/app/models/stripe_account.rb b/app/models/stripe_account.rb
new file mode 100644
index 0000000000..b97e8f632f
--- /dev/null
+++ b/app/models/stripe_account.rb
@@ -0,0 +1,5 @@
+class StripeAccount < ActiveRecord::Base
+  belongs_to :enterprise
+  valdates_presence_of :stripe_user_id, :stripe_publishable_key
+  validates_uniqueness_of :stripe_user_id
+end

From 06279848c685e484fdefd356ebcade9e67f0cd51 Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Sat, 17 Sep 2016 23:19:28 +0100
Subject: [PATCH 141/353] Stripe auth and callback working. Still need to
 process callback.

---
 .../admin/enterprises_controller.rb           | 20 ++++++++++
 app/controllers/enterprises_controller.rb     | 20 +++-------
 app/helpers/admin/stripe_helper.rb            | 40 +++++++++++--------
 app/models/enterprise.rb                      |  2 +-
 app/models/stripe_account.rb                  |  4 +-
 .../form/_payment_methods.html.haml           |  2 +
 config/routes.rb                              |  4 +-
 7 files changed, 57 insertions(+), 35 deletions(-)

diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index 1e8a4f0968..86be4b58f0 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -23,6 +23,7 @@ module Admin
     helper 'spree/products'
     include ActionView::Helpers::TextHelper
     include OrderCyclesHelper
+    include Admin::StripeHelper
 
     def index
       respond_to do |format|
@@ -113,6 +114,25 @@ module Admin
       end
     end
 
+    def stripe_connect
+      redirect_to authorize_stripe(params[:enterprise_id]) # csrf: form_authenticity_token)
+    end
+
+    def stripe_connect_callback
+      if params["code"]
+        # Get the deets from Stripe
+
+        stripe_account = StripeAccount.new(stripe_user_id: params["stripe_user_id"], stripe_publishable_key: params["stripe_publishable_key"], enterprise: enterprise)
+        if stripe_account.save
+          render json: stripe_account
+        else
+          render text: "Failed to save Stripe token", status: 500
+        end
+      else
+        render text: params["error_description"], status: 500
+      end
+    end
+
     protected
 
     def build_resource_with_address
diff --git a/app/controllers/enterprises_controller.rb b/app/controllers/enterprises_controller.rb
index d913cb4c57..3bbfa6cce2 100644
--- a/app/controllers/enterprises_controller.rb
+++ b/app/controllers/enterprises_controller.rb
@@ -11,13 +11,13 @@ class EnterprisesController < BaseController
 
   before_filter :clean_permalink, only: :check_permalink
   before_filter :enable_embedded_shopfront
+  before_filter :set_enterprise, only: :relatives
 
   respond_to :js, only: :permalink_checker
 
   def relatives
     respond_to do |format|
       format.json do
-        enterprise = Enterprise.find(params[:id])
         enterprises = enterprise.andand.relatives.andand.activated
         render(json: enterprises,
                each_serializer: Api::EnterpriseSerializer,
@@ -39,23 +39,13 @@ class EnterprisesController < BaseController
   end
 
 
-  def stripe_connect
-    if params["code"]
-      # Get the deets from Stripe
-
-      stripe_account = StripeAccount.new(stripe_user_id: params["stripe_user_id"], stripe_publishable_key: params["stripe_publishable_key"], enterprise: self) 
-      if stripe_account.save
-        render_json stripe_account
-      else
-        render text "Failed to save Stripe token", status: 500
-      end
-    else
-      render text params["error_description"], status: 500
-    end
-  end
 
   private
 
+  def set_enterprise
+    enterprise = Enterprise.find(params[:id])
+  end
+
   def clean_permalink
     params[:permalink] = params[:permalink].parameterize
   end
diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index 1ec28e7bf0..0109b7ba2b 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -1,19 +1,27 @@
-module StripeHelper
-  class << self
-    attr_accessor :client, :options
-  end
-  @options = {
-    :site => 'https://connect.stripe.com',
-    :authorize_url => '/oauth/authorize',
-    :token_url => '/oauth/token'
-  }
-  @client = OAuth2::Client.new(
-    ENV['STRIPE_CLIENT_ID'],
-    ENV['STRIPE_INSTANCE_SECRET_KEY'],
-    options
-  )
+module Admin
+  module StripeHelper
+    class << self
+      attr_accessor :client, :options
+    end
+    @options = {
+      :site => 'https://connect.stripe.com',
+      :authorize_url => '/oauth/authorize',
+      :token_url => '/oauth/token'
+    }
+    @client = OAuth2::Client.new(
+      ENV['STRIPE_CLIENT_ID'],
+      ENV['STRIPE_INSTANCE_SECRET_KEY'],
+      options
+    )
 
-  def get_token(code, options={params: {scope: 'read_write'}})
-    @client.get_token(code, options)
+    def get_stripe_token(code, options={params: {scope: 'read_write'}})
+      StripeHelper.client.get_token(code, options)
+    end
+
+    def authorize_stripe(enterprise_id, options={})
+      options = options.merge({enterprise_id: enterprise_id})
+      # State param will be passed back after auth
+      StripeHelper.client.auth_code.authorize_url(state: options)
+    end
   end
 end
diff --git a/app/models/enterprise.rb b/app/models/enterprise.rb
index 9856c75b93..edf1fe9a7d 100644
--- a/app/models/enterprise.rb
+++ b/app/models/enterprise.rb
@@ -42,7 +42,7 @@ class Enterprise < ActiveRecord::Base
   has_many :billable_periods
   has_many :inventory_items
   has_many :tag_rules
-  has_many :stripe_accounts
+  has_one :stripe_account, dependent: :destroy
 
   delegate :latitude, :longitude, :city, :state_name, :to => :address
 
diff --git a/app/models/stripe_account.rb b/app/models/stripe_account.rb
index b97e8f632f..d84f875df0 100644
--- a/app/models/stripe_account.rb
+++ b/app/models/stripe_account.rb
@@ -1,5 +1,5 @@
 class StripeAccount < ActiveRecord::Base
   belongs_to :enterprise
-  valdates_presence_of :stripe_user_id, :stripe_publishable_key
-  validates_uniqueness_of :stripe_user_id
+  validates_presence_of :stripe_user_id, :stripe_publishable_key
+  validates_uniqueness_of :stripe_user_id, :enterprise_id
 end
diff --git a/app/views/admin/enterprises/form/_payment_methods.html.haml b/app/views/admin/enterprises/form/_payment_methods.html.haml
index efcde16dc0..261fa33bcc 100644
--- a/app/views/admin/enterprises/form/_payment_methods.html.haml
+++ b/app/views/admin/enterprises/form/_payment_methods.html.haml
@@ -1,3 +1,5 @@
+= render 'admin/enterprises/form/stripe_connect'
+
 - if @payment_methods.count > 0
   %table
     %thead
diff --git a/config/routes.rb b/config/routes.rb
index 32500d9a1b..404214f2f2 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -65,7 +65,7 @@ Openfoodnetwork::Application.routes.draw do
   post 'embedded_shopfront/enable', to: 'application#enable_embedded_styles'
   post 'embedded_shopfront/disable', to: 'application#disable_embedded_styles'
 
-  get '/stripe/callback', :to => 'enterprise#stripe_connect'
+  get '/stripe/callback', :to => 'admin/enterprises#stripe_connect_callback'
 
   resources :enterprises do
     collection do
@@ -100,6 +100,8 @@ Openfoodnetwork::Application.routes.draw do
         post :bulk_update, as: :bulk_update
       end
 
+      get "/stripe_connect", to: "enterprises#stripe_connect"
+
       member do
         get :welcome
         put :register

From 03f590ccc47a297d86c814d4e8db3a0c2ce2e60c Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Sat, 17 Sep 2016 23:59:36 +0100
Subject: [PATCH 142/353] Callback creates a new StripeAccount with id and
 publishable key.

---
 app/controllers/admin/enterprises_controller.rb | 12 ++++++++++--
 app/helpers/admin/stripe_helper.rb              |  4 ++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index 86be4b58f0..c3d515649e 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -119,12 +119,20 @@ module Admin
     end
 
     def stripe_connect_callback
+      # Check CSRF?
       if params["code"]
         # Get the deets from Stripe
+        response_params = get_stripe_token(params["code"]).params
+        # Get the Enterprise
+        state = JSON.parse(params["state"].gsub("=>",":"))
+        @enterprise = Enterprise.find_by_permalink(state["enterprise_id"])
 
-        stripe_account = StripeAccount.new(stripe_user_id: params["stripe_user_id"], stripe_publishable_key: params["stripe_publishable_key"], enterprise: enterprise)
+        stripe_account = StripeAccount.new(stripe_user_id: response_params["stripe_user_id"], stripe_publishable_key: response_params["stripe_publishable_key"], enterprise: @enterprise)
         if stripe_account.save
-          render json: stripe_account
+          respond_to do |format|
+            format.html { redirect_to main_app.edit_admin_enterprise_path(@enterprise), notice: "Stripe account connected successfully."}
+            format.json { render json: stripe_account }
+          end
         else
           render text: "Failed to save Stripe token", status: 500
         end
diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index 0109b7ba2b..babcaec14f 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -14,8 +14,8 @@ module Admin
       options
     )
 
-    def get_stripe_token(code, options={params: {scope: 'read_write'}})
-      StripeHelper.client.get_token(code, options)
+    def get_stripe_token(code, options={scope: 'read_write'})
+      StripeHelper.client.auth_code.get_token(code, options)
     end
 
     def authorize_stripe(enterprise_id, options={})

From 8bdf57d0d9ec7464dbb6dd8d4f1cf7b922590b0f Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Sun, 18 Sep 2016 09:24:57 +0100
Subject: [PATCH 143/353] Add Stripe Connect button (CSS) in
 admin/enterprises/:id/edit#payment_methods

---
 .../components/stripe_connect_button.css.scss | 73 +++++++++++++++++++
 .../form/_stripe_connect.html.haml            |  6 ++
 2 files changed, 79 insertions(+)
 create mode 100644 app/assets/stylesheets/admin/components/stripe_connect_button.css.scss
 create mode 100644 app/views/admin/enterprises/form/_stripe_connect.html.haml

diff --git a/app/assets/stylesheets/admin/components/stripe_connect_button.css.scss b/app/assets/stylesheets/admin/components/stripe_connect_button.css.scss
new file mode 100644
index 0000000000..5dcc8d8cdd
--- /dev/null
+++ b/app/assets/stylesheets/admin/components/stripe_connect_button.css.scss
@@ -0,0 +1,73 @@
+a.stripe-connect {
+  display: inline-block;
+  margin-bottom: 1px;
+  background-image: linear-gradient(#28a0e5, #015e94);
+  border: 0;
+  padding: 1px;
+  height: 30px;
+  text-decoration: none;
+  border-radius: 4px;
+  box-shadow: 0 1px 0 rgba(0, 0, 0, 0.2);
+  cursor: pointer;
+  user-select: none;
+  span {
+    display: block;
+    position: relative;
+    padding: 0 12px 0 44px;
+    height: 30px;
+    background: #1275ff;
+    background-image: linear-gradient(#7dc5ee, #008cdd 85%, #30a2e4);
+    font-size: 14px;
+    line-height: 30px;
+    color: white;
+    font-weight: bold;
+    font-family: Helvetica Neue, Helvetica, Arial, sans-serif;
+    text-shadow: 0 -1px 0 rgba(0, 0, 0, 0.2);
+    box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.25);
+    border-radius: 3px;
+    &:before {
+      content: '';
+      display: block;
+      position: absolute;
+      left: 11px;
+      top: 50%;
+      width: 23px;
+      height: 24px;
+      margin-top: -12px;
+      background-repeat: no-repeat;
+      background-size: 23px 24px;
+      background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABcAAAAYCAYAAAARfGZ1AAAKRGlDQ1BJQ0MgUHJvZmlsZQAASA2dlndUFNcXx9/MbC+0XZYiZem9twWkLr1IlSYKy+4CS1nWZRewN0QFIoqICFYkKGLAaCgSK6JYCAgW7AEJIkoMRhEVlczGHPX3Oyf5/U7eH3c+8333nnfn3vvOGQAoASECYQ6sAEC2UCKO9PdmxsUnMPG9AAZEgAM2AHC4uaLQKL9ogK5AXzYzF3WS8V8LAuD1LYBaAK5bBIQzmX/p/+9DkSsSSwCAwtEAOx4/l4tyIcpZ+RKRTJ9EmZ6SKWMYI2MxmiDKqjJO+8Tmf/p8Yk8Z87KFPNRHlrOIl82TcRfKG/OkfJSREJSL8gT8fJRvoKyfJc0WoPwGZXo2n5MLAIYi0yV8bjrK1ihTxNGRbJTnAkCgpH3FKV+xhF+A5gkAO0e0RCxIS5cwjbkmTBtnZxYzgJ+fxZdILMI53EyOmMdk52SLOMIlAHz6ZlkUUJLVlokW2dHG2dHRwtYSLf/n9Y+bn73+GWS9/eTxMuLPnkGMni/al9gvWk4tAKwptDZbvmgpOwFoWw+A6t0vmv4+AOQLAWjt++p7GLJ5SZdIRC5WVvn5+ZYCPtdSVtDP6386fPb8e/jqPEvZeZ9rx/Thp3KkWRKmrKjcnKwcqZiZK+Jw+UyL/x7ifx34VVpf5WEeyU/li/lC9KgYdMoEwjS03UKeQCLIETIFwr/r8L8M+yoHGX6aaxRodR8BPckSKPTRAfJrD8DQyABJ3IPuQJ/7FkKMAbKbF6s99mnuUUb3/7T/YeAy9BXOFaQxZTI7MprJlYrzZIzeCZnBAhKQB3SgBrSAHjAGFsAWOAFX4Al8QRAIA9EgHiwCXJAOsoEY5IPlYA0oAiVgC9gOqsFeUAcaQBM4BtrASXAOXARXwTVwE9wDQ2AUPAOT4DWYgSAID1EhGqQGaUMGkBlkC7Egd8gXCoEioXgoGUqDhJAUWg6tg0qgcqga2g81QN9DJ6Bz0GWoH7oDDUPj0O/QOxiBKTAd1oQNYSuYBXvBwXA0vBBOgxfDS+FCeDNcBdfCR+BW+Bx8Fb4JD8HP4CkEIGSEgeggFggLYSNhSAKSioiRlUgxUonUIk1IB9KNXEeGkAnkLQaHoWGYGAuMKyYAMx/DxSzGrMSUYqoxhzCtmC7MdcwwZhLzEUvFamDNsC7YQGwcNg2bjy3CVmLrsS3YC9ib2FHsaxwOx8AZ4ZxwAbh4XAZuGa4UtxvXjDuL68eN4KbweLwa3gzvhg/Dc/ASfBF+J/4I/gx+AD+Kf0MgE7QJtgQ/QgJBSFhLqCQcJpwmDBDGCDNEBaIB0YUYRuQRlxDLiHXEDmIfcZQ4Q1IkGZHcSNGkDNIaUhWpiXSBdJ/0kkwm65KdyRFkAXk1uYp8lHyJPEx+S1GimFLYlESKlLKZcpBylnKH8pJKpRpSPakJVAl1M7WBep76kPpGjiZnKRcox5NbJVcj1yo3IPdcnihvIO8lv0h+qXyl/HH5PvkJBaKCoQJbgaOwUqFG4YTCoMKUIk3RRjFMMVuxVPGw4mXFJ0p4JUMlXyWeUqHSAaXzSiM0hKZHY9O4tHW0OtoF2igdRzeiB9Iz6CX07+i99EllJWV75RjlAuUa5VPKQwyEYcgIZGQxyhjHGLcY71Q0VbxU+CqbVJpUBlSmVeeoeqryVYtVm1Vvqr5TY6r5qmWqbVVrU3ugjlE3VY9Qz1ffo35BfWIOfY7rHO6c4jnH5tzVgDVMNSI1lmkc0OjRmNLU0vTXFGnu1DyvOaHF0PLUytCq0DqtNa5N03bXFmhXaJ/RfspUZnoxs5hVzC7mpI6GToCOVGe/Tq/OjK6R7nzdtbrNug/0SHosvVS9Cr1OvUl9bf1Q/eX6jfp3DYgGLIN0gx0G3QbThkaGsYYbDNsMnxipGgUaLTVqNLpvTDX2MF5sXGt8wwRnwjLJNNltcs0UNnUwTTetMe0zg80czQRmu836zbHmzuZC81rzQQuKhZdFnkWjxbAlwzLEcq1lm+VzK32rBKutVt1WH60drLOs66zv2SjZBNmstemw+d3W1JZrW2N7w45q52e3yq7d7oW9mT3ffo/9bQeaQ6jDBodOhw+OTo5ixybHcSd9p2SnXU6DLDornFXKuuSMdfZ2XuV80vmti6OLxOWYy2+uFq6Zroddn8w1msufWzd3xE3XjeO2323Ineme7L7PfchDx4PjUevxyFPPk+dZ7znmZeKV4XXE67m3tbfYu8V7mu3CXsE+64P4+PsU+/T6KvnO9632fein65fm1+g36e/gv8z/bAA2IDhga8BgoGYgN7AhcDLIKWhFUFcwJTgquDr4UYhpiDikIxQODQrdFnp/nsE84by2MBAWGLYt7EG4Ufji8B8jcBHhETURjyNtIpdHdkfRopKiDke9jvaOLou+N994vnR+Z4x8TGJMQ8x0rE9seexQnFXcirir8erxgvj2BHxCTEJ9wtQC3wXbF4wmOiQWJd5aaLSwYOHlReqLshadSpJP4iQdT8YmxyYfTn7PCePUcqZSAlN2pUxy2dwd3Gc8T14Fb5zvxi/nj6W6pZanPklzS9uWNp7ukV6ZPiFgC6oFLzICMvZmTGeGZR7MnM2KzWrOJmQnZ58QKgkzhV05WjkFOf0iM1GRaGixy+LtiyfFweL6XCh3YW67hI7+TPVIjaXrpcN57nk1eW/yY/KPFygWCAt6lpgu2bRkbKnf0m+XYZZxl3Uu11m+ZvnwCq8V+1dCK1NWdq7SW1W4anS1/+pDa0hrMtf8tNZ6bfnaV+ti13UUahauLhxZ77++sUiuSFw0uMF1w96NmI2Cjb2b7Dbt3PSxmFd8pcS6pLLkfSm39Mo3Nt9UfTO7OXVzb5lj2Z4tuC3CLbe2emw9VK5YvrR8ZFvottYKZkVxxavtSdsvV9pX7t1B2iHdMVQVUtW+U3/nlp3vq9Orb9Z41zTv0ti1adf0bt7ugT2ee5r2au4t2ftun2Df7f3++1trDWsrD+AO5B14XBdT1/0t69uGevX6kvoPB4UHhw5FHupqcGpoOKxxuKwRbpQ2jh9JPHLtO5/v2pssmvY3M5pLjoKj0qNPv0/+/tax4GOdx1nHm34w+GFXC62luBVqXdI62ZbeNtQe395/IuhEZ4drR8uPlj8ePKlzsuaU8qmy06TThadnzyw9M3VWdHbiXNq5kc6kznvn487f6Iro6r0QfOHSRb+L57u9us9ccrt08rLL5RNXWFfarjpebe1x6Gn5yeGnll7H3tY+p772a87XOvrn9p8e8Bg4d93n+sUbgTeu3px3s//W/Fu3BxMHh27zbj+5k3Xnxd28uzP3Vt/H3i9+oPCg8qHGw9qfTX5uHnIcOjXsM9zzKOrRvRHuyLNfcn95P1r4mPq4ckx7rOGJ7ZOT437j154ueDr6TPRsZqLoV8Vfdz03fv7Db56/9UzGTY6+EL+Y/b30pdrLg6/sX3VOhU89fJ39ema6+I3am0NvWW+738W+G5vJf49/X/XB5EPHx+CP92ezZ2f/AAOY8/wRDtFgAAADQklEQVRIDbWVaUiUQRjHZ96dXY/d1fYQj1U03dJSw9YkFgy6DIkILRArQSSC7PjQjQQqVH7oQ0GHQUWgpQhKHzoNSqiUwpXcsrwIjzVtPVrzbPV9Z6bZhYV3N3WXYAeGmWeeZ37z8J95GEgpBf5oeXn1Es4fYAdzPDlM6je4RBYhR+LMU89UxiCBGiCgkUwsBYSA+SlPKLQBQAYEAZm+3j42K96z3NyOF7VOeMrp62opRcacjPW5+43rDTpNSKQ8QKZAEg7xmPCTs/O27uGJgXuNbW0pxyvLfTmAEBzthEsFZLxRvPdi5rpYo2cmUiQJDA4IVeo0obGdlvGfXUPj0Sym2zPuHxvzcWjDyVupJ/YYizKTGNjLw/HiduNTAqIRIUJ6Vpp+ky8bCSFgwQ2xgkGxFi1ioNWEBGuJB31gbLIv/2pd7SpFoGxtpCYkLSEq4ptlzIYFO7tc7w0TKkeEYg5ADnrWkkYhD8s26GPq3nW0WKxTptftPYBI4Mj3O2fHvKNZBMVSDmMwarXNjDkSF3d5kExZeiCr8M2VI+VFu9IvsPcYtzAvkfoEZkEEE45jMppq3ppbCNPFIY1nD1cpo07lbMmvOXeoDCF8BLKy9uUAAjDkBh+c6bz78mNtVVP7MwET7JBnqb4xXpdWVpC1OVzWn+ELHLCsneX/s7rkRWl1463cy1U3WroG21jhCGKJXPOtKQnpAuENvsAppgDB3TcDVIrpDHbK5Kd+y7W8iodNybHh22rOHyxUK+UaMYjZaoyp25rYL54TSihSKmwZ14v3lc3ZFxdbeywjn/tGJnkmzrydX1ApxOEACKymmXLYfXVpi1JMEOGxPi1ep18doY4r2J7uFumQQ9yGf01bMcZW8dpyc0oIjxxpuC5wuUDX+ovWrnYeg3aXvdLIqnmOvXPsfH6uA5YbTb1DX8ofvTLzTy6ZV4K6fAw+gXiATfdffmjeaUgc1UdpdWplsCooQBrEnqUw82dhdnjit/Vxc4f59tP3DRjzJvYteqrl4rmNlJIfrOwpgNklesDRNQBCHYtQAQqD2CgACNjHAJnG1EyfV/S67fZiJB5t2OGEe4n7L3fS4fpEv/2hUEATfoPbuam5v8N7nps70YTbAAAAAElFTkSuQmCC");
+    }
+  }
+  &:active {
+    background: #005d93;
+    span {
+      color: #eee;
+      background: #008cdd;
+      background-image: linear-gradient(#008cdd, #008cdd 85%, #239adf);
+      //Instead of the line below you could use @include box-shadow($shadow-1, $shadow-2, $shadow-3, $shadow-4, $shadow-5, $shadow-6, $shadow-7, $shadow-8, $shadow-9, $shadow-10)
+      box-shadow: inset 0 1px 0 rgba(0, 0, 0, 0.1);
+      &:before {
+      }
+    }
+  }
+  &.blue span:before {
+    background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABcAAAAYCAYAAAARfGZ1AAAKRGlDQ1BJQ0MgUHJvZmlsZQAASA2dlndUFNcXx9/MbC+0XZYiZem9twWkLr1IlSYKy+4CS1nWZRewN0QFIoqICFYkKGLAaCgSK6JYCAgW7AEJIkoMRhEVlczGHPX3Oyf5/U7eH3c+8333nnfn3vvOGQAoASECYQ6sAEC2UCKO9PdmxsUnMPG9AAZEgAM2AHC4uaLQKL9ogK5AXzYzF3WS8V8LAuD1LYBaAK5bBIQzmX/p/+9DkSsSSwCAwtEAOx4/l4tyIcpZ+RKRTJ9EmZ6SKWMYI2MxmiDKqjJO+8Tmf/p8Yk8Z87KFPNRHlrOIl82TcRfKG/OkfJSREJSL8gT8fJRvoKyfJc0WoPwGZXo2n5MLAIYi0yV8bjrK1ihTxNGRbJTnAkCgpH3FKV+xhF+A5gkAO0e0RCxIS5cwjbkmTBtnZxYzgJ+fxZdILMI53EyOmMdk52SLOMIlAHz6ZlkUUJLVlokW2dHG2dHRwtYSLf/n9Y+bn73+GWS9/eTxMuLPnkGMni/al9gvWk4tAKwptDZbvmgpOwFoWw+A6t0vmv4+AOQLAWjt++p7GLJ5SZdIRC5WVvn5+ZYCPtdSVtDP6386fPb8e/jqPEvZeZ9rx/Thp3KkWRKmrKjcnKwcqZiZK+Jw+UyL/x7ifx34VVpf5WEeyU/li/lC9KgYdMoEwjS03UKeQCLIETIFwr/r8L8M+yoHGX6aaxRodR8BPckSKPTRAfJrD8DQyABJ3IPuQJ/7FkKMAbKbF6s99mnuUUb3/7T/YeAy9BXOFaQxZTI7MprJlYrzZIzeCZnBAhKQB3SgBrSAHjAGFsAWOAFX4Al8QRAIA9EgHiwCXJAOsoEY5IPlYA0oAiVgC9gOqsFeUAcaQBM4BtrASXAOXARXwTVwE9wDQ2AUPAOT4DWYgSAID1EhGqQGaUMGkBlkC7Egd8gXCoEioXgoGUqDhJAUWg6tg0qgcqga2g81QN9DJ6Bz0GWoH7oDDUPj0O/QOxiBKTAd1oQNYSuYBXvBwXA0vBBOgxfDS+FCeDNcBdfCR+BW+Bx8Fb4JD8HP4CkEIGSEgeggFggLYSNhSAKSioiRlUgxUonUIk1IB9KNXEeGkAnkLQaHoWGYGAuMKyYAMx/DxSzGrMSUYqoxhzCtmC7MdcwwZhLzEUvFamDNsC7YQGwcNg2bjy3CVmLrsS3YC9ib2FHsaxwOx8AZ4ZxwAbh4XAZuGa4UtxvXjDuL68eN4KbweLwa3gzvhg/Dc/ASfBF+J/4I/gx+AD+Kf0MgE7QJtgQ/QgJBSFhLqCQcJpwmDBDGCDNEBaIB0YUYRuQRlxDLiHXEDmIfcZQ4Q1IkGZHcSNGkDNIaUhWpiXSBdJ/0kkwm65KdyRFkAXk1uYp8lHyJPEx+S1GimFLYlESKlLKZcpBylnKH8pJKpRpSPakJVAl1M7WBep76kPpGjiZnKRcox5NbJVcj1yo3IPdcnihvIO8lv0h+qXyl/HH5PvkJBaKCoQJbgaOwUqFG4YTCoMKUIk3RRjFMMVuxVPGw4mXFJ0p4JUMlXyWeUqHSAaXzSiM0hKZHY9O4tHW0OtoF2igdRzeiB9Iz6CX07+i99EllJWV75RjlAuUa5VPKQwyEYcgIZGQxyhjHGLcY71Q0VbxU+CqbVJpUBlSmVeeoeqryVYtVm1Vvqr5TY6r5qmWqbVVrU3ugjlE3VY9Qz1ffo35BfWIOfY7rHO6c4jnH5tzVgDVMNSI1lmkc0OjRmNLU0vTXFGnu1DyvOaHF0PLUytCq0DqtNa5N03bXFmhXaJ/RfspUZnoxs5hVzC7mpI6GToCOVGe/Tq/OjK6R7nzdtbrNug/0SHosvVS9Cr1OvUl9bf1Q/eX6jfp3DYgGLIN0gx0G3QbThkaGsYYbDNsMnxipGgUaLTVqNLpvTDX2MF5sXGt8wwRnwjLJNNltcs0UNnUwTTetMe0zg80czQRmu836zbHmzuZC81rzQQuKhZdFnkWjxbAlwzLEcq1lm+VzK32rBKutVt1WH60drLOs66zv2SjZBNmstemw+d3W1JZrW2N7w45q52e3yq7d7oW9mT3ffo/9bQeaQ6jDBodOhw+OTo5ixybHcSd9p2SnXU6DLDornFXKuuSMdfZ2XuV80vmti6OLxOWYy2+uFq6Zroddn8w1msufWzd3xE3XjeO2323Ineme7L7PfchDx4PjUevxyFPPk+dZ7znmZeKV4XXE67m3tbfYu8V7mu3CXsE+64P4+PsU+/T6KvnO9632fein65fm1+g36e/gv8z/bAA2IDhga8BgoGYgN7AhcDLIKWhFUFcwJTgquDr4UYhpiDikIxQODQrdFnp/nsE84by2MBAWGLYt7EG4Ufji8B8jcBHhETURjyNtIpdHdkfRopKiDke9jvaOLou+N994vnR+Z4x8TGJMQ8x0rE9seexQnFXcirir8erxgvj2BHxCTEJ9wtQC3wXbF4wmOiQWJd5aaLSwYOHlReqLshadSpJP4iQdT8YmxyYfTn7PCePUcqZSAlN2pUxy2dwd3Gc8T14Fb5zvxi/nj6W6pZanPklzS9uWNp7ukV6ZPiFgC6oFLzICMvZmTGeGZR7MnM2KzWrOJmQnZ58QKgkzhV05WjkFOf0iM1GRaGixy+LtiyfFweL6XCh3YW67hI7+TPVIjaXrpcN57nk1eW/yY/KPFygWCAt6lpgu2bRkbKnf0m+XYZZxl3Uu11m+ZvnwCq8V+1dCK1NWdq7SW1W4anS1/+pDa0hrMtf8tNZ6bfnaV+ti13UUahauLhxZ77++sUiuSFw0uMF1w96NmI2Cjb2b7Dbt3PSxmFd8pcS6pLLkfSm39Mo3Nt9UfTO7OXVzb5lj2Z4tuC3CLbe2emw9VK5YvrR8ZFvottYKZkVxxavtSdsvV9pX7t1B2iHdMVQVUtW+U3/nlp3vq9Orb9Z41zTv0ti1adf0bt7ugT2ee5r2au4t2ftun2Df7f3++1trDWsrD+AO5B14XBdT1/0t69uGevX6kvoPB4UHhw5FHupqcGpoOKxxuKwRbpQ2jh9JPHLtO5/v2pssmvY3M5pLjoKj0qNPv0/+/tax4GOdx1nHm34w+GFXC62luBVqXdI62ZbeNtQe395/IuhEZ4drR8uPlj8ePKlzsuaU8qmy06TThadnzyw9M3VWdHbiXNq5kc6kznvn487f6Iro6r0QfOHSRb+L57u9us9ccrt08rLL5RNXWFfarjpebe1x6Gn5yeGnll7H3tY+p772a87XOvrn9p8e8Bg4d93n+sUbgTeu3px3s//W/Fu3BxMHh27zbj+5k3Xnxd28uzP3Vt/H3i9+oPCg8qHGw9qfTX5uHnIcOjXsM9zzKOrRvRHuyLNfcn95P1r4mPq4ckx7rOGJ7ZOT437j154ueDr6TPRsZqLoV8Vfdz03fv7Db56/9UzGTY6+EL+Y/b30pdrLg6/sX3VOhU89fJ39ema6+I3am0NvWW+738W+G5vJf49/X/XB5EPHx+CP92ezZ2f/AAOY8/wRDtFgAAADQklEQVRIDbWVaUiUQRjHZ96dXY/d1fYQj1U03dJSw9YkFgy6DIkILRArQSSC7PjQjQQqVH7oQ0GHQUWgpQhKHzoNSqiUwpXcsrwIjzVtPVrzbPV9Z6bZhYV3N3WXYAeGmWeeZ37z8J95GEgpBf5oeXn1Es4fYAdzPDlM6je4RBYhR+LMU89UxiCBGiCgkUwsBYSA+SlPKLQBQAYEAZm+3j42K96z3NyOF7VOeMrp62opRcacjPW5+43rDTpNSKQ8QKZAEg7xmPCTs/O27uGJgXuNbW0pxyvLfTmAEBzthEsFZLxRvPdi5rpYo2cmUiQJDA4IVeo0obGdlvGfXUPj0Sym2zPuHxvzcWjDyVupJ/YYizKTGNjLw/HiduNTAqIRIUJ6Vpp+ky8bCSFgwQ2xgkGxFi1ioNWEBGuJB31gbLIv/2pd7SpFoGxtpCYkLSEq4ptlzIYFO7tc7w0TKkeEYg5ADnrWkkYhD8s26GPq3nW0WKxTptftPYBI4Mj3O2fHvKNZBMVSDmMwarXNjDkSF3d5kExZeiCr8M2VI+VFu9IvsPcYtzAvkfoEZkEEE45jMppq3ppbCNPFIY1nD1cpo07lbMmvOXeoDCF8BLKy9uUAAjDkBh+c6bz78mNtVVP7MwET7JBnqb4xXpdWVpC1OVzWn+ELHLCsneX/s7rkRWl1463cy1U3WroG21jhCGKJXPOtKQnpAuENvsAppgDB3TcDVIrpDHbK5Kd+y7W8iodNybHh22rOHyxUK+UaMYjZaoyp25rYL54TSihSKmwZ14v3lc3ZFxdbeywjn/tGJnkmzrydX1ApxOEACKymmXLYfXVpi1JMEOGxPi1ep18doY4r2J7uFumQQ9yGf01bMcZW8dpyc0oIjxxpuC5wuUDX+ovWrnYeg3aXvdLIqnmOvXPsfH6uA5YbTb1DX8ofvTLzTy6ZV4K6fAw+gXiATfdffmjeaUgc1UdpdWplsCooQBrEnqUw82dhdnjit/Vxc4f59tP3DRjzJvYteqrl4rmNlJIfrOwpgNklesDRNQBCHYtQAQqD2CgACNjHAJnG1EyfV/S67fZiJB5t2OGEe4n7L3fS4fpEv/2hUEATfoPbuam5v8N7nps70YTbAAAAAElFTkSuQmCC");
+  }
+  &.light-blue span:before {
+    background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABcAAAAYCAYAAAARfGZ1AAAKRGlDQ1BJQ0MgUHJvZmlsZQAASA2dlndUFNcXx9/MbC+0XZYiZem9twWkLr1IlSYKy+4CS1nWZRewN0QFIoqICFYkKGLAaCgSK6JYCAgW7AEJIkoMRhEVlczGHPX3Oyf5/U7eH3c+8333nnfn3vvOGQAoASECYQ6sAEC2UCKO9PdmxsUnMPG9AAZEgAM2AHC4uaLQKL9ogK5AXzYzF3WS8V8LAuD1LYBaAK5bBIQzmX/p/+9DkSsSSwCAwtEAOx4/l4tyIcpZ+RKRTJ9EmZ6SKWMYI2MxmiDKqjJO+8Tmf/p8Yk8Z87KFPNRHlrOIl82TcRfKG/OkfJSREJSL8gT8fJRvoKyfJc0WoPwGZXo2n5MLAIYi0yV8bjrK1ihTxNGRbJTnAkCgpH3FKV+xhF+A5gkAO0e0RCxIS5cwjbkmTBtnZxYzgJ+fxZdILMI53EyOmMdk52SLOMIlAHz6ZlkUUJLVlokW2dHG2dHRwtYSLf/n9Y+bn73+GWS9/eTxMuLPnkGMni/al9gvWk4tAKwptDZbvmgpOwFoWw+A6t0vmv4+AOQLAWjt++p7GLJ5SZdIRC5WVvn5+ZYCPtdSVtDP6386fPb8e/jqPEvZeZ9rx/Thp3KkWRKmrKjcnKwcqZiZK+Jw+UyL/x7ifx34VVpf5WEeyU/li/lC9KgYdMoEwjS03UKeQCLIETIFwr/r8L8M+yoHGX6aaxRodR8BPckSKPTRAfJrD8DQyABJ3IPuQJ/7FkKMAbKbF6s99mnuUUb3/7T/YeAy9BXOFaQxZTI7MprJlYrzZIzeCZnBAhKQB3SgBrSAHjAGFsAWOAFX4Al8QRAIA9EgHiwCXJAOsoEY5IPlYA0oAiVgC9gOqsFeUAcaQBM4BtrASXAOXARXwTVwE9wDQ2AUPAOT4DWYgSAID1EhGqQGaUMGkBlkC7Egd8gXCoEioXgoGUqDhJAUWg6tg0qgcqga2g81QN9DJ6Bz0GWoH7oDDUPj0O/QOxiBKTAd1oQNYSuYBXvBwXA0vBBOgxfDS+FCeDNcBdfCR+BW+Bx8Fb4JD8HP4CkEIGSEgeggFggLYSNhSAKSioiRlUgxUonUIk1IB9KNXEeGkAnkLQaHoWGYGAuMKyYAMx/DxSzGrMSUYqoxhzCtmC7MdcwwZhLzEUvFamDNsC7YQGwcNg2bjy3CVmLrsS3YC9ib2FHsaxwOx8AZ4ZxwAbh4XAZuGa4UtxvXjDuL68eN4KbweLwa3gzvhg/Dc/ASfBF+J/4I/gx+AD+Kf0MgE7QJtgQ/QgJBSFhLqCQcJpwmDBDGCDNEBaIB0YUYRuQRlxDLiHXEDmIfcZQ4Q1IkGZHcSNGkDNIaUhWpiXSBdJ/0kkwm65KdyRFkAXk1uYp8lHyJPEx+S1GimFLYlESKlLKZcpBylnKH8pJKpRpSPakJVAl1M7WBep76kPpGjiZnKRcox5NbJVcj1yo3IPdcnihvIO8lv0h+qXyl/HH5PvkJBaKCoQJbgaOwUqFG4YTCoMKUIk3RRjFMMVuxVPGw4mXFJ0p4JUMlXyWeUqHSAaXzSiM0hKZHY9O4tHW0OtoF2igdRzeiB9Iz6CX07+i99EllJWV75RjlAuUa5VPKQwyEYcgIZGQxyhjHGLcY71Q0VbxU+CqbVJpUBlSmVeeoeqryVYtVm1Vvqr5TY6r5qmWqbVVrU3ugjlE3VY9Qz1ffo35BfWIOfY7rHO6c4jnH5tzVgDVMNSI1lmkc0OjRmNLU0vTXFGnu1DyvOaHF0PLUytCq0DqtNa5N03bXFmhXaJ/RfspUZnoxs5hVzC7mpI6GToCOVGe/Tq/OjK6R7nzdtbrNug/0SHosvVS9Cr1OvUl9bf1Q/eX6jfp3DYgGLIN0gx0G3QbThkaGsYYbDNsMnxipGgUaLTVqNLpvTDX2MF5sXGt8wwRnwjLJNNltcs0UNnUwTTetMe0zg80czQRmu836zbHmzuZC81rzQQuKhZdFnkWjxbAlwzLEcq1lm+VzK32rBKutVt1WH60drLOs66zv2SjZBNmstemw+d3W1JZrW2N7w45q52e3yq7d7oW9mT3ffo/9bQeaQ6jDBodOhw+OTo5ixybHcSd9p2SnXU6DLDornFXKuuSMdfZ2XuV80vmti6OLxOWYy2+uFq6Zroddn8w1msufWzd3xE3XjeO2323Ineme7L7PfchDx4PjUevxyFPPk+dZ7znmZeKV4XXE67m3tbfYu8V7mu3CXsE+64P4+PsU+/T6KvnO9632fein65fm1+g36e/gv8z/bAA2IDhga8BgoGYgN7AhcDLIKWhFUFcwJTgquDr4UYhpiDikIxQODQrdFnp/nsE84by2MBAWGLYt7EG4Ufji8B8jcBHhETURjyNtIpdHdkfRopKiDke9jvaOLou+N994vnR+Z4x8TGJMQ8x0rE9seexQnFXcirir8erxgvj2BHxCTEJ9wtQC3wXbF4wmOiQWJd5aaLSwYOHlReqLshadSpJP4iQdT8YmxyYfTn7PCePUcqZSAlN2pUxy2dwd3Gc8T14Fb5zvxi/nj6W6pZanPklzS9uWNp7ukV6ZPiFgC6oFLzICMvZmTGeGZR7MnM2KzWrOJmQnZ58QKgkzhV05WjkFOf0iM1GRaGixy+LtiyfFweL6XCh3YW67hI7+TPVIjaXrpcN57nk1eW/yY/KPFygWCAt6lpgu2bRkbKnf0m+XYZZxl3Uu11m+ZvnwCq8V+1dCK1NWdq7SW1W4anS1/+pDa0hrMtf8tNZ6bfnaV+ti13UUahauLhxZ77++sUiuSFw0uMF1w96NmI2Cjb2b7Dbt3PSxmFd8pcS6pLLkfSm39Mo3Nt9UfTO7OXVzb5lj2Z4tuC3CLbe2emw9VK5YvrR8ZFvottYKZkVxxavtSdsvV9pX7t1B2iHdMVQVUtW+U3/nlp3vq9Orb9Z41zTv0ti1adf0bt7ugT2ee5r2au4t2ftun2Df7f3++1trDWsrD+AO5B14XBdT1/0t69uGevX6kvoPB4UHhw5FHupqcGpoOKxxuKwRbpQ2jh9JPHLtO5/v2pssmvY3M5pLjoKj0qNPv0/+/tax4GOdx1nHm34w+GFXC62luBVqXdI62ZbeNtQe395/IuhEZ4drR8uPlj8ePKlzsuaU8qmy06TThadnzyw9M3VWdHbiXNq5kc6kznvn487f6Iro6r0QfOHSRb+L57u9us9ccrt08rLL5RNXWFfarjpebe1x6Gn5yeGnll7H3tY+p772a87XOvrn9p8e8Bg4d93n+sUbgTeu3px3s//W/Fu3BxMHh27zbj+5k3Xnxd28uzP3Vt/H3i9+oPCg8qHGw9qfTX5uHnIcOjXsM9zzKOrRvRHuyLNfcn95P1r4mPq4ckx7rOGJ7ZOT437j154ueDr6TPRsZqLoV8Vfdz03fv7Db56/9UzGTY6+EL+Y/b30pdrLg6/sX3VOhU89fJ39ema6+I3am0NvWW+738W+G5vJf49/X/XB5EPHx+CP92ezZ2f/AAOY8/wRDtFgAAADIElEQVRIDbWVTWgTQRTHZ2Z3s5vdpsm2aZp+iKKNCgZsK4iWik0tClqwHozS9iYo4nfw0KNU8ebBm+JNESktBfEgWg+KB0FbiqhFMS1SKyk0lTY1zcd+jG82TSkNoXtoXngk+2bm92b/780EU0pRKWxwcJAjpQAzZrKqSigZ3G3ISsnguka8/FpZWrrOtwi8cI4jpJkiuodgTKAkhqbrC9lM5ms6o936/ObJ+7Vriv3GHFe/Cm8LX76nejwR2elEgsOBOI5DGD6UmpyuG750OtWuZbNLALMFp4axzYK3h690V6oVkXJ3ORJF0QITDIphQMHWTdNEqZSE3IroK7bT9XFMSG7n1T7vDaXMhWRZRhBcPw8ReAuHYVhJCwaLBGBPOc1FSdopSU4Lwuay3ve45FTfhdMfE8ll4U8srkxMTquLC4s/irAKwvDSiiWLw+HgeB40xkyHHHwu/lfouXZ7ePjhnafVlWptczAQhKFfbNyWYZTrc9XtikFjIOiOFSfIoAjyCfeP9kR+tp662AXAZ+AfbIFhEqUrAu8LNjw32SMksJLAwWVd4/V6UW1Njeqv9vW3n7n6JRQKrXbXRkkwMrE1OXyi7YFJcWDs29RxaBGetSDhCQKtkCiJVqHhOzhLyGOAdm8Ezo/ndxI923m4f3/jru8v346GpmPzTXCd5ZJA9/AcD8W2ZGPy2LY8nC0Y217vj17q7Xw3HZs79Gjg9c2sbkACMA4jSZJQRnJK7NGOUUSoBT/WG+mDWv4jFI8ih/ip4+DeqK5p16HpeVYDZjwkYBLZNYypacHravzhjKY3GXBQTPDxiSnkUVWkyMpqe0L9kbtMztiFw3TNgleoHqdOWRmhxtREBHR2CIKlM4sxM0yKAlv9UbtwqFnSggsAEggPx9t6LFgPlxfyV7oTvSc77hYMFgmAzHGLdqBp94vZ+aWFxUSyPpXRVN0wnHAEsMARw6VI6WBgS6yjpXEIOANFWAVhapozeOU/dAeMNoDXgXvAneCt4Anw3+CvwEfAbdvQyPiRvA6TsIr5phnc5zOF9+sm4XnBjJcMvsgtJ/8DyYLwNvinaNYAAAAASUVORK5CYII=");
+  }
+}
+@media only screen and(-webkit-min-device-pixel-ratio: 1.5), only screen and(min--moz-device-pixel-ratio: 1.5), only screen and(min-device-pixel-ratio: 1.5) {
+  .stripe-connect {
+    span:before {
+      background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAC4AAAAwCAYAAABuZUjcAAAKRGlDQ1BJQ0MgUHJvZmlsZQAASA2dlndUFNcXx9/MbC+0XZYiZem9twWkLr1IlSYKy+4CS1nWZRewN0QFIoqICFYkKGLAaCgSK6JYCAgW7AEJIkoMRhEVlczGHPX3Oyf5/U7eH3c+8333nnfn3vvOGQAoASECYQ6sAEC2UCKO9PdmxsUnMPG9AAZEgAM2AHC4uaLQKL9ogK5AXzYzF3WS8V8LAuD1LYBaAK5bBIQzmX/p/+9DkSsSSwCAwtEAOx4/l4tyIcpZ+RKRTJ9EmZ6SKWMYI2MxmiDKqjJO+8Tmf/p8Yk8Z87KFPNRHlrOIl82TcRfKG/OkfJSREJSL8gT8fJRvoKyfJc0WoPwGZXo2n5MLAIYi0yV8bjrK1ihTxNGRbJTnAkCgpH3FKV+xhF+A5gkAO0e0RCxIS5cwjbkmTBtnZxYzgJ+fxZdILMI53EyOmMdk52SLOMIlAHz6ZlkUUJLVlokW2dHG2dHRwtYSLf/n9Y+bn73+GWS9/eTxMuLPnkGMni/al9gvWk4tAKwptDZbvmgpOwFoWw+A6t0vmv4+AOQLAWjt++p7GLJ5SZdIRC5WVvn5+ZYCPtdSVtDP6386fPb8e/jqPEvZeZ9rx/Thp3KkWRKmrKjcnKwcqZiZK+Jw+UyL/x7ifx34VVpf5WEeyU/li/lC9KgYdMoEwjS03UKeQCLIETIFwr/r8L8M+yoHGX6aaxRodR8BPckSKPTRAfJrD8DQyABJ3IPuQJ/7FkKMAbKbF6s99mnuUUb3/7T/YeAy9BXOFaQxZTI7MprJlYrzZIzeCZnBAhKQB3SgBrSAHjAGFsAWOAFX4Al8QRAIA9EgHiwCXJAOsoEY5IPlYA0oAiVgC9gOqsFeUAcaQBM4BtrASXAOXARXwTVwE9wDQ2AUPAOT4DWYgSAID1EhGqQGaUMGkBlkC7Egd8gXCoEioXgoGUqDhJAUWg6tg0qgcqga2g81QN9DJ6Bz0GWoH7oDDUPj0O/QOxiBKTAd1oQNYSuYBXvBwXA0vBBOgxfDS+FCeDNcBdfCR+BW+Bx8Fb4JD8HP4CkEIGSEgeggFggLYSNhSAKSioiRlUgxUonUIk1IB9KNXEeGkAnkLQaHoWGYGAuMKyYAMx/DxSzGrMSUYqoxhzCtmC7MdcwwZhLzEUvFamDNsC7YQGwcNg2bjy3CVmLrsS3YC9ib2FHsaxwOx8AZ4ZxwAbh4XAZuGa4UtxvXjDuL68eN4KbweLwa3gzvhg/Dc/ASfBF+J/4I/gx+AD+Kf0MgE7QJtgQ/QgJBSFhLqCQcJpwmDBDGCDNEBaIB0YUYRuQRlxDLiHXEDmIfcZQ4Q1IkGZHcSNGkDNIaUhWpiXSBdJ/0kkwm65KdyRFkAXk1uYp8lHyJPEx+S1GimFLYlESKlLKZcpBylnKH8pJKpRpSPakJVAl1M7WBep76kPpGjiZnKRcox5NbJVcj1yo3IPdcnihvIO8lv0h+qXyl/HH5PvkJBaKCoQJbgaOwUqFG4YTCoMKUIk3RRjFMMVuxVPGw4mXFJ0p4JUMlXyWeUqHSAaXzSiM0hKZHY9O4tHW0OtoF2igdRzeiB9Iz6CX07+i99EllJWV75RjlAuUa5VPKQwyEYcgIZGQxyhjHGLcY71Q0VbxU+CqbVJpUBlSmVeeoeqryVYtVm1Vvqr5TY6r5qmWqbVVrU3ugjlE3VY9Qz1ffo35BfWIOfY7rHO6c4jnH5tzVgDVMNSI1lmkc0OjRmNLU0vTXFGnu1DyvOaHF0PLUytCq0DqtNa5N03bXFmhXaJ/RfspUZnoxs5hVzC7mpI6GToCOVGe/Tq/OjK6R7nzdtbrNug/0SHosvVS9Cr1OvUl9bf1Q/eX6jfp3DYgGLIN0gx0G3QbThkaGsYYbDNsMnxipGgUaLTVqNLpvTDX2MF5sXGt8wwRnwjLJNNltcs0UNnUwTTetMe0zg80czQRmu836zbHmzuZC81rzQQuKhZdFnkWjxbAlwzLEcq1lm+VzK32rBKutVt1WH60drLOs66zv2SjZBNmstemw+d3W1JZrW2N7w45q52e3yq7d7oW9mT3ffo/9bQeaQ6jDBodOhw+OTo5ixybHcSd9p2SnXU6DLDornFXKuuSMdfZ2XuV80vmti6OLxOWYy2+uFq6Zroddn8w1msufWzd3xE3XjeO2323Ineme7L7PfchDx4PjUevxyFPPk+dZ7znmZeKV4XXE67m3tbfYu8V7mu3CXsE+64P4+PsU+/T6KvnO9632fein65fm1+g36e/gv8z/bAA2IDhga8BgoGYgN7AhcDLIKWhFUFcwJTgquDr4UYhpiDikIxQODQrdFnp/nsE84by2MBAWGLYt7EG4Ufji8B8jcBHhETURjyNtIpdHdkfRopKiDke9jvaOLou+N994vnR+Z4x8TGJMQ8x0rE9seexQnFXcirir8erxgvj2BHxCTEJ9wtQC3wXbF4wmOiQWJd5aaLSwYOHlReqLshadSpJP4iQdT8YmxyYfTn7PCePUcqZSAlN2pUxy2dwd3Gc8T14Fb5zvxi/nj6W6pZanPklzS9uWNp7ukV6ZPiFgC6oFLzICMvZmTGeGZR7MnM2KzWrOJmQnZ58QKgkzhV05WjkFOf0iM1GRaGixy+LtiyfFweL6XCh3YW67hI7+TPVIjaXrpcN57nk1eW/yY/KPFygWCAt6lpgu2bRkbKnf0m+XYZZxl3Uu11m+ZvnwCq8V+1dCK1NWdq7SW1W4anS1/+pDa0hrMtf8tNZ6bfnaV+ti13UUahauLhxZ77++sUiuSFw0uMF1w96NmI2Cjb2b7Dbt3PSxmFd8pcS6pLLkfSm39Mo3Nt9UfTO7OXVzb5lj2Z4tuC3CLbe2emw9VK5YvrR8ZFvottYKZkVxxavtSdsvV9pX7t1B2iHdMVQVUtW+U3/nlp3vq9Orb9Z41zTv0ti1adf0bt7ugT2ee5r2au4t2ftun2Df7f3++1trDWsrD+AO5B14XBdT1/0t69uGevX6kvoPB4UHhw5FHupqcGpoOKxxuKwRbpQ2jh9JPHLtO5/v2pssmvY3M5pLjoKj0qNPv0/+/tax4GOdx1nHm34w+GFXC62luBVqXdI62ZbeNtQe395/IuhEZ4drR8uPlj8ePKlzsuaU8qmy06TThadnzyw9M3VWdHbiXNq5kc6kznvn487f6Iro6r0QfOHSRb+L57u9us9ccrt08rLL5RNXWFfarjpebe1x6Gn5yeGnll7H3tY+p772a87XOvrn9p8e8Bg4d93n+sUbgTeu3px3s//W/Fu3BxMHh27zbj+5k3Xnxd28uzP3Vt/H3i9+oPCg8qHGw9qfTX5uHnIcOjXsM9zzKOrRvRHuyLNfcn95P1r4mPq4ckx7rOGJ7ZOT437j154ueDr6TPRsZqLoV8Vfdz03fv7Db56/9UzGTY6+EL+Y/b30pdrLg6/sX3VOhU89fJ39ema6+I3am0NvWW+738W+G5vJf49/X/XB5EPHx+CP92ezZ2f/AAOY8/wRDtFgAAAIbklEQVRoBdVZa5BURxU+fZ9z57mzs7PvF4i7srAQSCifMVDERC0jYlzUlJalKeGPlCnL/NEfywpWacoiVZRVJIYfGjGUu5bxj5qHFSAYyQOBEsJzYSHDvnd2dp535j66PX1vNgsULDPs1cr2Vs+9e7v79NfnnnP663MJYwwWYxEWI2iOedEClxabxgkBwjEvOuA9PQOOlSw64JMr4vK8GidYYMcOES4tVSEAAZ8FAUqon1GiAJEEEG0CjFB8cTaxZUMAo1gEqQA0UABprAjPbrUwXnkesgqKP8CBk5vDIenrE+BKmwI+MawA1MbCkdV10cBDflXuVmSxQRbFkCAQZ9U2ZTaONyxKcyXDHjMs83ImV3rz6njmDRPMUZB80zAJOuvvsflkXpTP7DrWyeXcYCqk75AEieawrEoty1vrvlcV0ja3VQdb1rVUQVd9EFqqNIj5ZfDJooPBsCnohq2ldDMynC42XZnW7z09lu25lMxDMl34y0gyvTsBwyewc84Z4MEPpWIzF/MBcLLtNzJISmxZU+PmWETbtqGzfvVja5uguyF02+kCIEJUk6Ex4oMV9XP9ZnQT/nZ24it7XrtoJ5LZ7SjAM+Bg2+0ckAOcbBkQIaZFVzY1bGurjezYfn87PNQZ5+13ZaQRXMzH26Lg8ymfUokQdAR59INOc53GQ6q/Jiiua6oJ7+h9uAPua47cHeLrwHEmQRmTGLHV6x4v+JYwWsOFCGRDn6RKem1rPPrkN9Y0uqAXLN4VwCgjYGEE8rBgMAjwKsF9S9WgLa9qjYcf+Po9jXdlGrfC5Wj8Vg0Lf+ZENAFmpGB9TWTLhmUxUD1UDg/gtudRnK+a4RtkgqQyO+RT5LVrmiLgJcN19gcGNojUWriS5yRQm7pcBTc/vyCKdW1RrWwzOTiYhGf+dRUmcgZosgDVfgWaMCS2V2tO+OzG0MiVjdUwiFiYm9a7O4kJAoZEooV9H4T0O0ofODkKr5+6+nY6V3heVZQpv6ZWaz55qSJJnXjtUBW5pT7k8xeK5u+B0PQdBVbQgTLq9HbQYthyNVSmTT6A/nB0aGpF0K99+trY1F7TNI9PZGXkKUVRtYjGZCIOV1dHR4Ynz8FSLV8BrjK6uiAlpLcmco1ipmgpAaU8rfesboCuumBg31uJbx6+qH0uX9D/em0i85xFhaslKZKA8/82RtYDhd/1MkCuBnjxrLgKB0EQSb5oWO+9O1bZrsy3+Kc3dcH+b99b07NuyXe6P9r8z/am+C9lkuqCjo4qGGkQES76qJcuz/2GOlUoFuVsQS+98frlaSeq8Gkqqctrg7Dz853wwrfugUfXtj3W3tJ8oCletRUEXy1SCSSYHhdu41gFqILcZCrzwkvnJmE0U3JtHefiL7eS2l7th11f7IQ9j65aVh+r+nlzbd2TELJrHPLmIXZX3wyBX8MTQMm8PJ0u9Pe9chGQYy9omvXouHu/thJqI+Ef1sZDm0AMBmfPiQsSPDuY2zhWwSH5ISU5Pjm98x9nRo7+7JVBB3wl5nJz35Vo/z/esBQUVf2+QlkD9Aw42/Ts3Au7ushdAhQ5UzJoOjE+OrV9/1tDR7cNnIax7N2bDX9nm1bUQXdz9Rp/MLwRoqAtDOzcaO7rvDrAWW8vhcatWVNjF6cmJre9embkz1947h3YfXgIUgVzblQldxgFH0ZOr/qULwM15k4Zlci4Vd9ZU5ltY71oObHBnBFQBidmUk8kEsOP7Hntwqsb974NfS8PAh7LKoo23Hw+2R4FQcSzKlDPgFOEyf8kx3HW94kQ7xJgRRdAJG7CyIWxgiXNUN0+k5nJLN83k3n8D8eHN3+1ux5+8uBHIKiWt1G1Rn3IJkiUCcQzU3G0h9qWHMeJdoSrwtr9dl6I6DNjFwRRyxiKnStSqkPJPsGSmZ+mp1P9z2dzOy3Klj31yMdmX9S8V75APEsomMZwT9fz9i6vkW9AvEgQyqrBQM2Dq9rrD0gCgXfHA0jpjIRm2Zcw+3CR2tZl27SnMZFSZ1lWcRwZITeDckresAEXaoKwwBh7/WQubgTOQj5BVjdv7KiBJz7bztMNcHIk03JiONNyfiK/ntv2VMHAMx6BjpoA/Gj9Emdjul7W7e6TeQNDK9WJLRm361P5c1drEmAaymaYoXpfjZoiOk7FHWuh5dxEHmzLHiXM9oyTz9FawRZw65f5yyzXBMpd0JGhFKB5nSwRMVvumDv2cxm4m1f5X4AuWhRePDUOtqEPQJVVGfWcBz1ahmPlTlxzqaJLquYZU1HTvjcTMD6dOULM0n+g5nKposHzdWbo7FgEkDBviWlYx++53XtQ33kvDU8dHAJm6L8usdwEZn09S3qiPed5lcCSLUpI0eEA8620zLbDl6bh8T+egkI+/7Rl6kegcTSPst1QUKaM+brhrjnF2yUQJNxnrGMnR7KbTw5nYFVjyAl98w2+VdvVlA67Dw3BgROjAKa+yyrpz0BKTbJnez1NT6AKrrnA1bEi1av2v3xaiL90dnxL2Kc0rsXc4WpcQEc8AEtiGrRiejmK6WWeMDIxtVwwKExijB5KFuBYIg1cy8dx0dTQ/yQVc78yBXMIqJ5i/VvvkqHdSjXuM/THKy7w2LQJ6fpJms38QiHGvlzBt+RwJv2JQ2elbjyRtjIi1AIRMAsKPuQduHVzr2YW+kIBE5BTwOzzxLKOiMX8QVuWh00IpqD+S0WHtLlzefpLBOZo/IYvEqQPnTX5dxmy4xookqaCjRuT4mMi8g3bxs2KCkj3GFj4+QSzA0RkeskU8iCJeUiBDv09Jt8OPEV6k7DlP3gxxh/dAPymPh/Kf5d897dIOd9P7H8oEd4G1JV8wPGbRadx52sgLmrRAZ99EZ5+LZgV+v+4Llrg/wX6HRCxgvzAAwAAAABJRU5ErkJggg==");
+    }
+    &.blue span:before {
+      background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAC4AAAAwCAYAAABuZUjcAAAKRGlDQ1BJQ0MgUHJvZmlsZQAASA2dlndUFNcXx9/MbC+0XZYiZem9twWkLr1IlSYKy+4CS1nWZRewN0QFIoqICFYkKGLAaCgSK6JYCAgW7AEJIkoMRhEVlczGHPX3Oyf5/U7eH3c+8333nnfn3vvOGQAoASECYQ6sAEC2UCKO9PdmxsUnMPG9AAZEgAM2AHC4uaLQKL9ogK5AXzYzF3WS8V8LAuD1LYBaAK5bBIQzmX/p/+9DkSsSSwCAwtEAOx4/l4tyIcpZ+RKRTJ9EmZ6SKWMYI2MxmiDKqjJO+8Tmf/p8Yk8Z87KFPNRHlrOIl82TcRfKG/OkfJSREJSL8gT8fJRvoKyfJc0WoPwGZXo2n5MLAIYi0yV8bjrK1ihTxNGRbJTnAkCgpH3FKV+xhF+A5gkAO0e0RCxIS5cwjbkmTBtnZxYzgJ+fxZdILMI53EyOmMdk52SLOMIlAHz6ZlkUUJLVlokW2dHG2dHRwtYSLf/n9Y+bn73+GWS9/eTxMuLPnkGMni/al9gvWk4tAKwptDZbvmgpOwFoWw+A6t0vmv4+AOQLAWjt++p7GLJ5SZdIRC5WVvn5+ZYCPtdSVtDP6386fPb8e/jqPEvZeZ9rx/Thp3KkWRKmrKjcnKwcqZiZK+Jw+UyL/x7ifx34VVpf5WEeyU/li/lC9KgYdMoEwjS03UKeQCLIETIFwr/r8L8M+yoHGX6aaxRodR8BPckSKPTRAfJrD8DQyABJ3IPuQJ/7FkKMAbKbF6s99mnuUUb3/7T/YeAy9BXOFaQxZTI7MprJlYrzZIzeCZnBAhKQB3SgBrSAHjAGFsAWOAFX4Al8QRAIA9EgHiwCXJAOsoEY5IPlYA0oAiVgC9gOqsFeUAcaQBM4BtrASXAOXARXwTVwE9wDQ2AUPAOT4DWYgSAID1EhGqQGaUMGkBlkC7Egd8gXCoEioXgoGUqDhJAUWg6tg0qgcqga2g81QN9DJ6Bz0GWoH7oDDUPj0O/QOxiBKTAd1oQNYSuYBXvBwXA0vBBOgxfDS+FCeDNcBdfCR+BW+Bx8Fb4JD8HP4CkEIGSEgeggFggLYSNhSAKSioiRlUgxUonUIk1IB9KNXEeGkAnkLQaHoWGYGAuMKyYAMx/DxSzGrMSUYqoxhzCtmC7MdcwwZhLzEUvFamDNsC7YQGwcNg2bjy3CVmLrsS3YC9ib2FHsaxwOx8AZ4ZxwAbh4XAZuGa4UtxvXjDuL68eN4KbweLwa3gzvhg/Dc/ASfBF+J/4I/gx+AD+Kf0MgE7QJtgQ/QgJBSFhLqCQcJpwmDBDGCDNEBaIB0YUYRuQRlxDLiHXEDmIfcZQ4Q1IkGZHcSNGkDNIaUhWpiXSBdJ/0kkwm65KdyRFkAXk1uYp8lHyJPEx+S1GimFLYlESKlLKZcpBylnKH8pJKpRpSPakJVAl1M7WBep76kPpGjiZnKRcox5NbJVcj1yo3IPdcnihvIO8lv0h+qXyl/HH5PvkJBaKCoQJbgaOwUqFG4YTCoMKUIk3RRjFMMVuxVPGw4mXFJ0p4JUMlXyWeUqHSAaXzSiM0hKZHY9O4tHW0OtoF2igdRzeiB9Iz6CX07+i99EllJWV75RjlAuUa5VPKQwyEYcgIZGQxyhjHGLcY71Q0VbxU+CqbVJpUBlSmVeeoeqryVYtVm1Vvqr5TY6r5qmWqbVVrU3ugjlE3VY9Qz1ffo35BfWIOfY7rHO6c4jnH5tzVgDVMNSI1lmkc0OjRmNLU0vTXFGnu1DyvOaHF0PLUytCq0DqtNa5N03bXFmhXaJ/RfspUZnoxs5hVzC7mpI6GToCOVGe/Tq/OjK6R7nzdtbrNug/0SHosvVS9Cr1OvUl9bf1Q/eX6jfp3DYgGLIN0gx0G3QbThkaGsYYbDNsMnxipGgUaLTVqNLpvTDX2MF5sXGt8wwRnwjLJNNltcs0UNnUwTTetMe0zg80czQRmu836zbHmzuZC81rzQQuKhZdFnkWjxbAlwzLEcq1lm+VzK32rBKutVt1WH60drLOs66zv2SjZBNmstemw+d3W1JZrW2N7w45q52e3yq7d7oW9mT3ffo/9bQeaQ6jDBodOhw+OTo5ixybHcSd9p2SnXU6DLDornFXKuuSMdfZ2XuV80vmti6OLxOWYy2+uFq6Zroddn8w1msufWzd3xE3XjeO2323Ineme7L7PfchDx4PjUevxyFPPk+dZ7znmZeKV4XXE67m3tbfYu8V7mu3CXsE+64P4+PsU+/T6KvnO9632fein65fm1+g36e/gv8z/bAA2IDhga8BgoGYgN7AhcDLIKWhFUFcwJTgquDr4UYhpiDikIxQODQrdFnp/nsE84by2MBAWGLYt7EG4Ufji8B8jcBHhETURjyNtIpdHdkfRopKiDke9jvaOLou+N994vnR+Z4x8TGJMQ8x0rE9seexQnFXcirir8erxgvj2BHxCTEJ9wtQC3wXbF4wmOiQWJd5aaLSwYOHlReqLshadSpJP4iQdT8YmxyYfTn7PCePUcqZSAlN2pUxy2dwd3Gc8T14Fb5zvxi/nj6W6pZanPklzS9uWNp7ukV6ZPiFgC6oFLzICMvZmTGeGZR7MnM2KzWrOJmQnZ58QKgkzhV05WjkFOf0iM1GRaGixy+LtiyfFweL6XCh3YW67hI7+TPVIjaXrpcN57nk1eW/yY/KPFygWCAt6lpgu2bRkbKnf0m+XYZZxl3Uu11m+ZvnwCq8V+1dCK1NWdq7SW1W4anS1/+pDa0hrMtf8tNZ6bfnaV+ti13UUahauLhxZ77++sUiuSFw0uMF1w96NmI2Cjb2b7Dbt3PSxmFd8pcS6pLLkfSm39Mo3Nt9UfTO7OXVzb5lj2Z4tuC3CLbe2emw9VK5YvrR8ZFvottYKZkVxxavtSdsvV9pX7t1B2iHdMVQVUtW+U3/nlp3vq9Orb9Z41zTv0ti1adf0bt7ugT2ee5r2au4t2ftun2Df7f3++1trDWsrD+AO5B14XBdT1/0t69uGevX6kvoPB4UHhw5FHupqcGpoOKxxuKwRbpQ2jh9JPHLtO5/v2pssmvY3M5pLjoKj0qNPv0/+/tax4GOdx1nHm34w+GFXC62luBVqXdI62ZbeNtQe395/IuhEZ4drR8uPlj8ePKlzsuaU8qmy06TThadnzyw9M3VWdHbiXNq5kc6kznvn487f6Iro6r0QfOHSRb+L57u9us9ccrt08rLL5RNXWFfarjpebe1x6Gn5yeGnll7H3tY+p772a87XOvrn9p8e8Bg4d93n+sUbgTeu3px3s//W/Fu3BxMHh27zbj+5k3Xnxd28uzP3Vt/H3i9+oPCg8qHGw9qfTX5uHnIcOjXsM9zzKOrRvRHuyLNfcn95P1r4mPq4ckx7rOGJ7ZOT437j154ueDr6TPRsZqLoV8Vfdz03fv7Db56/9UzGTY6+EL+Y/b30pdrLg6/sX3VOhU89fJ39ema6+I3am0NvWW+738W+G5vJf49/X/XB5EPHx+CP92ezZ2f/AAOY8/wRDtFgAAAIbklEQVRoBdVZa5BURxU+fZ9z57mzs7PvF4i7srAQSCifMVDERC0jYlzUlJalKeGPlCnL/NEfywpWacoiVZRVJIYfGjGUu5bxj5qHFSAYyQOBEsJzYSHDvnd2dp535j66PX1vNgsULDPs1cr2Vs+9e7v79NfnnnP663MJYwwWYxEWI2iOedEClxabxgkBwjEvOuA9PQOOlSw64JMr4vK8GidYYMcOES4tVSEAAZ8FAUqon1GiAJEEEG0CjFB8cTaxZUMAo1gEqQA0UABprAjPbrUwXnkesgqKP8CBk5vDIenrE+BKmwI+MawA1MbCkdV10cBDflXuVmSxQRbFkCAQZ9U2ZTaONyxKcyXDHjMs83ImV3rz6njmDRPMUZB80zAJOuvvsflkXpTP7DrWyeXcYCqk75AEieawrEoty1vrvlcV0ja3VQdb1rVUQVd9EFqqNIj5ZfDJooPBsCnohq2ldDMynC42XZnW7z09lu25lMxDMl34y0gyvTsBwyewc84Z4MEPpWIzF/MBcLLtNzJISmxZU+PmWETbtqGzfvVja5uguyF02+kCIEJUk6Ex4oMV9XP9ZnQT/nZ24it7XrtoJ5LZ7SjAM+Bg2+0ckAOcbBkQIaZFVzY1bGurjezYfn87PNQZ5+13ZaQRXMzH26Lg8ymfUokQdAR59INOc53GQ6q/Jiiua6oJ7+h9uAPua47cHeLrwHEmQRmTGLHV6x4v+JYwWsOFCGRDn6RKem1rPPrkN9Y0uqAXLN4VwCgjYGEE8rBgMAjwKsF9S9WgLa9qjYcf+Po9jXdlGrfC5Wj8Vg0Lf+ZENAFmpGB9TWTLhmUxUD1UDg/gtudRnK+a4RtkgqQyO+RT5LVrmiLgJcN19gcGNojUWriS5yRQm7pcBTc/vyCKdW1RrWwzOTiYhGf+dRUmcgZosgDVfgWaMCS2V2tO+OzG0MiVjdUwiFiYm9a7O4kJAoZEooV9H4T0O0ofODkKr5+6+nY6V3heVZQpv6ZWaz55qSJJnXjtUBW5pT7k8xeK5u+B0PQdBVbQgTLq9HbQYthyNVSmTT6A/nB0aGpF0K99+trY1F7TNI9PZGXkKUVRtYjGZCIOV1dHR4Ynz8FSLV8BrjK6uiAlpLcmco1ipmgpAaU8rfesboCuumBg31uJbx6+qH0uX9D/em0i85xFhaslKZKA8/82RtYDhd/1MkCuBnjxrLgKB0EQSb5oWO+9O1bZrsy3+Kc3dcH+b99b07NuyXe6P9r8z/am+C9lkuqCjo4qGGkQES76qJcuz/2GOlUoFuVsQS+98frlaSeq8Gkqqctrg7Dz853wwrfugUfXtj3W3tJ8oCletRUEXy1SCSSYHhdu41gFqILcZCrzwkvnJmE0U3JtHefiL7eS2l7th11f7IQ9j65aVh+r+nlzbd2TELJrHPLmIXZX3wyBX8MTQMm8PJ0u9Pe9chGQYy9omvXouHu/thJqI+Ef1sZDm0AMBmfPiQsSPDuY2zhWwSH5ISU5Pjm98x9nRo7+7JVBB3wl5nJz35Vo/z/esBQUVf2+QlkD9Aw42/Ts3Au7ushdAhQ5UzJoOjE+OrV9/1tDR7cNnIax7N2bDX9nm1bUQXdz9Rp/MLwRoqAtDOzcaO7rvDrAWW8vhcatWVNjF6cmJre9embkz1947h3YfXgIUgVzblQldxgFH0ZOr/qULwM15k4Zlci4Vd9ZU5ltY71oObHBnBFQBidmUk8kEsOP7Hntwqsb974NfS8PAh7LKoo23Hw+2R4FQcSzKlDPgFOEyf8kx3HW94kQ7xJgRRdAJG7CyIWxgiXNUN0+k5nJLN83k3n8D8eHN3+1ux5+8uBHIKiWt1G1Rn3IJkiUCcQzU3G0h9qWHMeJdoSrwtr9dl6I6DNjFwRRyxiKnStSqkPJPsGSmZ+mp1P9z2dzOy3Klj31yMdmX9S8V75APEsomMZwT9fz9i6vkW9AvEgQyqrBQM2Dq9rrD0gCgXfHA0jpjIRm2Zcw+3CR2tZl27SnMZFSZ1lWcRwZITeDckresAEXaoKwwBh7/WQubgTOQj5BVjdv7KiBJz7bztMNcHIk03JiONNyfiK/ntv2VMHAMx6BjpoA/Gj9Emdjul7W7e6TeQNDK9WJLRm361P5c1drEmAaymaYoXpfjZoiOk7FHWuh5dxEHmzLHiXM9oyTz9FawRZw65f5yyzXBMpd0JGhFKB5nSwRMVvumDv2cxm4m1f5X4AuWhRePDUOtqEPQJVVGfWcBz1ahmPlTlxzqaJLquYZU1HTvjcTMD6dOULM0n+g5nKposHzdWbo7FgEkDBviWlYx++53XtQ33kvDU8dHAJm6L8usdwEZn09S3qiPed5lcCSLUpI0eEA8620zLbDl6bh8T+egkI+/7Rl6kegcTSPst1QUKaM+brhrjnF2yUQJNxnrGMnR7KbTw5nYFVjyAl98w2+VdvVlA67Dw3BgROjAKa+yyrpz0BKTbJnez1NT6AKrrnA1bEi1av2v3xaiL90dnxL2Kc0rsXc4WpcQEc8AEtiGrRiejmK6WWeMDIxtVwwKExijB5KFuBYIg1cy8dx0dTQ/yQVc78yBXMIqJ5i/VvvkqHdSjXuM/THKy7w2LQJ6fpJms38QiHGvlzBt+RwJv2JQ2elbjyRtjIi1AIRMAsKPuQduHVzr2YW+kIBE5BTwOzzxLKOiMX8QVuWh00IpqD+S0WHtLlzefpLBOZo/IYvEqQPnTX5dxmy4xookqaCjRuT4mMi8g3bxs2KCkj3GFj4+QSzA0RkeskU8iCJeUiBDv09Jt8OPEV6k7DlP3gxxh/dAPymPh/Kf5d897dIOd9P7H8oEd4G1JV8wPGbRadx52sgLmrRAZ99EZ5+LZgV+v+4Llrg/wX6HRCxgvzAAwAAAABJRU5ErkJggg==");
+    }
+    &.light-blue span:before {
+      background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAC4AAAAwCAYAAABuZUjcAAAKRGlDQ1BJQ0MgUHJvZmlsZQAASA2dlndUFNcXx9/MbC+0XZYiZem9twWkLr1IlSYKy+4CS1nWZRewN0QFIoqICFYkKGLAaCgSK6JYCAgW7AEJIkoMRhEVlczGHPX3Oyf5/U7eH3c+8333nnfn3vvOGQAoASECYQ6sAEC2UCKO9PdmxsUnMPG9AAZEgAM2AHC4uaLQKL9ogK5AXzYzF3WS8V8LAuD1LYBaAK5bBIQzmX/p/+9DkSsSSwCAwtEAOx4/l4tyIcpZ+RKRTJ9EmZ6SKWMYI2MxmiDKqjJO+8Tmf/p8Yk8Z87KFPNRHlrOIl82TcRfKG/OkfJSREJSL8gT8fJRvoKyfJc0WoPwGZXo2n5MLAIYi0yV8bjrK1ihTxNGRbJTnAkCgpH3FKV+xhF+A5gkAO0e0RCxIS5cwjbkmTBtnZxYzgJ+fxZdILMI53EyOmMdk52SLOMIlAHz6ZlkUUJLVlokW2dHG2dHRwtYSLf/n9Y+bn73+GWS9/eTxMuLPnkGMni/al9gvWk4tAKwptDZbvmgpOwFoWw+A6t0vmv4+AOQLAWjt++p7GLJ5SZdIRC5WVvn5+ZYCPtdSVtDP6386fPb8e/jqPEvZeZ9rx/Thp3KkWRKmrKjcnKwcqZiZK+Jw+UyL/x7ifx34VVpf5WEeyU/li/lC9KgYdMoEwjS03UKeQCLIETIFwr/r8L8M+yoHGX6aaxRodR8BPckSKPTRAfJrD8DQyABJ3IPuQJ/7FkKMAbKbF6s99mnuUUb3/7T/YeAy9BXOFaQxZTI7MprJlYrzZIzeCZnBAhKQB3SgBrSAHjAGFsAWOAFX4Al8QRAIA9EgHiwCXJAOsoEY5IPlYA0oAiVgC9gOqsFeUAcaQBM4BtrASXAOXARXwTVwE9wDQ2AUPAOT4DWYgSAID1EhGqQGaUMGkBlkC7Egd8gXCoEioXgoGUqDhJAUWg6tg0qgcqga2g81QN9DJ6Bz0GWoH7oDDUPj0O/QOxiBKTAd1oQNYSuYBXvBwXA0vBBOgxfDS+FCeDNcBdfCR+BW+Bx8Fb4JD8HP4CkEIGSEgeggFggLYSNhSAKSioiRlUgxUonUIk1IB9KNXEeGkAnkLQaHoWGYGAuMKyYAMx/DxSzGrMSUYqoxhzCtmC7MdcwwZhLzEUvFamDNsC7YQGwcNg2bjy3CVmLrsS3YC9ib2FHsaxwOx8AZ4ZxwAbh4XAZuGa4UtxvXjDuL68eN4KbweLwa3gzvhg/Dc/ASfBF+J/4I/gx+AD+Kf0MgE7QJtgQ/QgJBSFhLqCQcJpwmDBDGCDNEBaIB0YUYRuQRlxDLiHXEDmIfcZQ4Q1IkGZHcSNGkDNIaUhWpiXSBdJ/0kkwm65KdyRFkAXk1uYp8lHyJPEx+S1GimFLYlESKlLKZcpBylnKH8pJKpRpSPakJVAl1M7WBep76kPpGjiZnKRcox5NbJVcj1yo3IPdcnihvIO8lv0h+qXyl/HH5PvkJBaKCoQJbgaOwUqFG4YTCoMKUIk3RRjFMMVuxVPGw4mXFJ0p4JUMlXyWeUqHSAaXzSiM0hKZHY9O4tHW0OtoF2igdRzeiB9Iz6CX07+i99EllJWV75RjlAuUa5VPKQwyEYcgIZGQxyhjHGLcY71Q0VbxU+CqbVJpUBlSmVeeoeqryVYtVm1Vvqr5TY6r5qmWqbVVrU3ugjlE3VY9Qz1ffo35BfWIOfY7rHO6c4jnH5tzVgDVMNSI1lmkc0OjRmNLU0vTXFGnu1DyvOaHF0PLUytCq0DqtNa5N03bXFmhXaJ/RfspUZnoxs5hVzC7mpI6GToCOVGe/Tq/OjK6R7nzdtbrNug/0SHosvVS9Cr1OvUl9bf1Q/eX6jfp3DYgGLIN0gx0G3QbThkaGsYYbDNsMnxipGgUaLTVqNLpvTDX2MF5sXGt8wwRnwjLJNNltcs0UNnUwTTetMe0zg80czQRmu836zbHmzuZC81rzQQuKhZdFnkWjxbAlwzLEcq1lm+VzK32rBKutVt1WH60drLOs66zv2SjZBNmstemw+d3W1JZrW2N7w45q52e3yq7d7oW9mT3ffo/9bQeaQ6jDBodOhw+OTo5ixybHcSd9p2SnXU6DLDornFXKuuSMdfZ2XuV80vmti6OLxOWYy2+uFq6Zroddn8w1msufWzd3xE3XjeO2323Ineme7L7PfchDx4PjUevxyFPPk+dZ7znmZeKV4XXE67m3tbfYu8V7mu3CXsE+64P4+PsU+/T6KvnO9632fein65fm1+g36e/gv8z/bAA2IDhga8BgoGYgN7AhcDLIKWhFUFcwJTgquDr4UYhpiDikIxQODQrdFnp/nsE84by2MBAWGLYt7EG4Ufji8B8jcBHhETURjyNtIpdHdkfRopKiDke9jvaOLou+N994vnR+Z4x8TGJMQ8x0rE9seexQnFXcirir8erxgvj2BHxCTEJ9wtQC3wXbF4wmOiQWJd5aaLSwYOHlReqLshadSpJP4iQdT8YmxyYfTn7PCePUcqZSAlN2pUxy2dwd3Gc8T14Fb5zvxi/nj6W6pZanPklzS9uWNp7ukV6ZPiFgC6oFLzICMvZmTGeGZR7MnM2KzWrOJmQnZ58QKgkzhV05WjkFOf0iM1GRaGixy+LtiyfFweL6XCh3YW67hI7+TPVIjaXrpcN57nk1eW/yY/KPFygWCAt6lpgu2bRkbKnf0m+XYZZxl3Uu11m+ZvnwCq8V+1dCK1NWdq7SW1W4anS1/+pDa0hrMtf8tNZ6bfnaV+ti13UUahauLhxZ77++sUiuSFw0uMF1w96NmI2Cjb2b7Dbt3PSxmFd8pcS6pLLkfSm39Mo3Nt9UfTO7OXVzb5lj2Z4tuC3CLbe2emw9VK5YvrR8ZFvottYKZkVxxavtSdsvV9pX7t1B2iHdMVQVUtW+U3/nlp3vq9Orb9Z41zTv0ti1adf0bt7ugT2ee5r2au4t2ftun2Df7f3++1trDWsrD+AO5B14XBdT1/0t69uGevX6kvoPB4UHhw5FHupqcGpoOKxxuKwRbpQ2jh9JPHLtO5/v2pssmvY3M5pLjoKj0qNPv0/+/tax4GOdx1nHm34w+GFXC62luBVqXdI62ZbeNtQe395/IuhEZ4drR8uPlj8ePKlzsuaU8qmy06TThadnzyw9M3VWdHbiXNq5kc6kznvn487f6Iro6r0QfOHSRb+L57u9us9ccrt08rLL5RNXWFfarjpebe1x6Gn5yeGnll7H3tY+p772a87XOvrn9p8e8Bg4d93n+sUbgTeu3px3s//W/Fu3BxMHh27zbj+5k3Xnxd28uzP3Vt/H3i9+oPCg8qHGw9qfTX5uHnIcOjXsM9zzKOrRvRHuyLNfcn95P1r4mPq4ckx7rOGJ7ZOT437j154ueDr6TPRsZqLoV8Vfdz03fv7Db56/9UzGTY6+EL+Y/b30pdrLg6/sX3VOhU89fJ39ema6+I3am0NvWW+738W+G5vJf49/X/XB5EPHx+CP92ezZ2f/AAOY8/wRDtFgAAAHH0lEQVRoBdVZ628UVRS/857dme3strvblpaXCiI+WkCkpFAoECAgr0oqxASjiAZMiF9MiI80/AfqB+WD3/xABOMrKCgRJCBSLCACQUEIEai8ywJ97GNm/J3ZbizM7C7trpG9m7N39t5z7/2dM+eec+5dzrZtVoqFL0XQhLlkgYulpnGOYxxhLjngW7Zsdayk5IB3RyJSSWrcMP1aSQJPJfnwoIA3LFhTy3hrAdx+IzbIOMbsGkQAR3pM1Icdcxv1ZZtxf+D5OGPm3vbJo4/YbW0WLVSswglCLc3F5QtAzyx6ZbbA7Hc5jp8hCAIj4nmecTy2NyRwCqShOEZzWZbFTMtkpmky27Ku2Da36cC2j9vSjIV/b93RsZpmybo5n2htlct6yz6SReFlWZaZIitMURRGz6IkMoEXHPAOFAewnQacSrFkMsUSiTgoEU0kk4vBUzTgHM87GvcE3traKgTjxleyT5mvaTrTdY2pqo9JBNjReBp0v0sFLtI4tA2ClqFtIpPF43EIEdcd4Yr0hSWy23hnIvi2T/PPDwaDLBAIMFVRmSACbMY0XCDSImTCsOOvYDr0hqxUQnGxF9AA4/T2Ks2LXwsD9Iby8nIWNIJMVmTGZwWcAwFW4AWIYmfEycE7mC6OZfHjqviCYZT5gobhaIw24VALjRz6aO9Vsdm9I6eu6XN1mIcC8+ALAO0sS28qvY43iiG0csxydOHanJqm1ZFNk8vLp67hVeHjLfMbvx9ZHY7Fbvco17pi2vlL1youXemKXLh8Y8SV610jelPJIcDLP8QFXJHlELm77BsxPaltW6xx4vgDo2uiN6klZOh9RGNG1VzHz1Ogn6j99LkLcaqLXVzA4acRnIS82k6lTLbjx/aqhgmPvglQMZAMItcXAkVAw4nGjKq9hbroxQVcVeVenuN9//po7zUpQp44ffbZOSvWb48nEhv3fr5pBzhJu6TxP0E/g6iUpavifrt8VUXIuEC27eyrHDVFTtoLiqo2SKK4vem5tQebWl5dwW3ceO+c/4nG712EwUaPIhDmRU5RtMwoY5FwhIXg83VNmyxJ6uamY5ePNbWsXVFc/bpncwFfMnvqN4oi3iRTyfXh+zVO0bUyGmXRykpWXkEC6ONlWdo8c/m6L+atWpXJHt0rF9jiAq7rvpPzGuu/hqlYjjskr5mFKDiRB/Ijtw8FQywaibJKCEBvwOf3L032lf0wbcnqQIEYPYe7gIPrRPPU+kONk8Z/jVAPb38fH0gpiiLA+lgwaDgCRMJhJGf6FFXV3vNcucBGL+Am5ty2dM6UjkWzp3ziU+Vb+TZqpp9yGhLADwFCoXKYTgVD3vPSrBXr6wrE6RruBZyYzoK+nT7psdMb1rS8P+Hxh3bKstiT19X0S4CcGSmDzAzkO9gDHHL5510rF9jg8uMD5juC55jfry5aubBpb+xOz8Fd+3+rO3bqr6ndvX0VA/i8HyEEHT4CeoAl4/GFYHrLm3Fordk0npmNNP8haJeh+7uWzW04+M665R9MmzT+S0kU+jImkq2mJE1RFab6fA9nJixWnUvjmTUoS6K84xfQU0i+piya9fRhjrftfR2/L3M8TobToxYFEScnqehu0QW8ufX1eoGXJPNy6Mju3W2pAVgSeO4AHQLV+SR5pIVES+CQ1+QolPeoqlr0RMsFXJTkpXDbbVxVV/eclW+04wjTDod4HGe907aQuiImOV7RfbXVVdWNeqCMCUpu4ORM4Zl6csg2pC4X8GHRsNbdl6BrBs1MpWbh4DuLrhvoEGzZODVJHA7GPOuLJ5iG0ELAchUcn5mh63/n4hlKnwt4bW11uCvW65x+cLXAkgkQDgMpXDtQRkhAydXRKQnJVTqq5liZTv/V0dDJHCyD6rIZT5mU+15Fgk36/X7n/oQ0beGawQTgtMZxT4UP2a1zt4I6n8bxPlLNU+u+GxS6HMwch43lBZzu+tHpXPaIPDRKWi2gPDKi6sDo2sqjBUxx91CbOWdBN6r+hCqfJu+ezfuXEfCdX7lw+k70nvDmGHwr7KSbRrmA9+POa7v5lgwHA2debJn5KSIvxQBnsXxj7qcfwe4a8bmAD4tWnLp6s7uzN2lWw33kdhkeK/lUpat+3Kg9C2ZMPIzuC6A9HmxDbsJeozndwNesXLCf2mO376gnz3TW4Jph2I3Y7cidnr7ynt54MJky/ZZli8jFTZHnE7Ikdmt+9Ua0wjg/bvSwM0+OHXER0ZV2PqULn4EGBjH8LKzgJH+OZnBpHG3kczuNgF7dUD/2DJ6JBlO6wLwP9OtgBt0vr22a3hrHBHQnQkSXlTWgahBlg+WgIMgHIoEpb6cdTvZ7A3QRRFruBDm+FnXRiyhZ3jY+YCXKLwgI0QNTYkKPt1d5YBBmAaJdver48bx/pWQZ/781wx06nq7kgGc0lu8ElOF74OqSBf4P9hj31KSAw4AAAAAASUVORK5CYII=");
+    }
+  }
+}
diff --git a/app/views/admin/enterprises/form/_stripe_connect.html.haml b/app/views/admin/enterprises/form/_stripe_connect.html.haml
new file mode 100644
index 0000000000..2ced1eeff3
--- /dev/null
+++ b/app/views/admin/enterprises/form/_stripe_connect.html.haml
@@ -0,0 +1,6 @@
+-# if @enterprise.has_stripe_connection?
+    -# Display Stripe account details
+-# else
+
+%a.stripe-connect{href: 'stripe_connect'}
+    .span= t :connect_with_stripe

From b6292e2723e94fc1c6d310722ec313bbfc759b03 Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Sun, 18 Sep 2016 10:26:31 +0100
Subject: [PATCH 144/353] Add some logic to check for a connected Stripe
 Account in form

---
 .../admin/enterprises/form/_stripe_connect.html.haml  | 11 ++++++-----
 config/routes.rb                                      |  2 ++
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/app/views/admin/enterprises/form/_stripe_connect.html.haml b/app/views/admin/enterprises/form/_stripe_connect.html.haml
index 2ced1eeff3..acc36ff87d 100644
--- a/app/views/admin/enterprises/form/_stripe_connect.html.haml
+++ b/app/views/admin/enterprises/form/_stripe_connect.html.haml
@@ -1,6 +1,7 @@
--# if @enterprise.has_stripe_connection?
-    -# Display Stripe account details
--# else
-
-%a.stripe-connect{href: 'stripe_connect'}
+- if stripe_account = @enterprise.stripe_account
+  = t :stripe_account_connected
+  = stripe_account.inspect
+  .span (Link to disconnect Stripe Acct)
+- else
+  %a.stripe-connect{href: 'stripe_connect'}
     .span= t :connect_with_stripe
diff --git a/config/routes.rb b/config/routes.rb
index 404214f2f2..1e6f681f8b 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -72,6 +72,7 @@ Openfoodnetwork::Application.routes.draw do
       post :search
       get :check_permalink
     end
+    
 
     member do
       get :shop
@@ -102,6 +103,7 @@ Openfoodnetwork::Application.routes.draw do
 
       get "/stripe_connect", to: "enterprises#stripe_connect"
 
+
       member do
         get :welcome
         put :register

From 8ed983cf0343383584c65fb53a7956ba7030d741 Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Sun, 18 Sep 2016 10:55:34 +0100
Subject: [PATCH 145/353] Correct spelling :)

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index b6843b41d5..b010b880e4 100644
--- a/README.md
+++ b/README.md
@@ -123,7 +123,7 @@ Do not forget to run `rake tmp:cache:clear` after locales are updated to reload
 * Maikel Linke (https://github.com/mkllnk)
 * Lynne Davis (https://github.com/lin-d-hop)
 * Paul Mackay (https://github.com/pmackay)
-* Steve Petitt (https://github.com/stveep)
+* Steve Pettitt (https://github.com/stveep)
 
 
 ## Licence

From 7fd8c5956dafc18e833c2f89dadaf9531f460e9c Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Wed, 28 Sep 2016 17:26:08 +0100
Subject: [PATCH 146/353] Check CSRF, allow a Stripe account to be connected to
 more than one enterprise (but not vice versa)

---
 .../admin/enterprises_controller.rb           | 33 +++++++++++--------
 app/models/stripe_account.rb                  |  2 +-
 spec/features/admin/stripe_connect_spec.rb    | 13 ++++++++
 3 files changed, 33 insertions(+), 15 deletions(-)
 create mode 100644 spec/features/admin/stripe_connect_spec.rb

diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index c3d515649e..c33a68c1e7 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -115,26 +115,31 @@ module Admin
     end
 
     def stripe_connect
-      redirect_to authorize_stripe(params[:enterprise_id]) # csrf: form_authenticity_token)
+      redirect_to authorize_stripe(params[:enterprise_id], csrf: form_authenticity_token)
     end
 
     def stripe_connect_callback
-      # Check CSRF?
       if params["code"]
-        # Get the deets from Stripe
-        response_params = get_stripe_token(params["code"]).params
-        # Get the Enterprise
         state = JSON.parse(params["state"].gsub("=>",":"))
-        @enterprise = Enterprise.find_by_permalink(state["enterprise_id"])
-
-        stripe_account = StripeAccount.new(stripe_user_id: response_params["stripe_user_id"], stripe_publishable_key: response_params["stripe_publishable_key"], enterprise: @enterprise)
-        if stripe_account.save
-          respond_to do |format|
-            format.html { redirect_to main_app.edit_admin_enterprise_path(@enterprise), notice: "Stripe account connected successfully."}
-            format.json { render json: stripe_account }
-          end
+        # Check csrf
+        if state["csrf"] != form_authenticity_token
+          redirect_to '/unauthorized'
         else
-          render text: "Failed to save Stripe token", status: 500
+          # Get the Enterprise
+          @enterprise = Enterprise.find_by_permalink(state["enterprise_id"])
+
+          # Get the deets from Stripe
+          response_params = get_stripe_token(params["code"]).params
+
+          stripe_account = StripeAccount.new(stripe_user_id: response_params["stripe_user_id"], stripe_publishable_key: response_params["stripe_publishable_key"], enterprise: @enterprise)
+          if stripe_account.save
+            respond_to do |format|
+              format.html { redirect_to main_app.edit_admin_enterprise_path(@enterprise), notice: "Stripe account connected successfully."}
+              format.json { render json: stripe_account }
+            end
+          else
+            render text: "Failed to save Stripe token", status: 500
+          end
         end
       else
         render text: params["error_description"], status: 500
diff --git a/app/models/stripe_account.rb b/app/models/stripe_account.rb
index d84f875df0..dd263a6b37 100644
--- a/app/models/stripe_account.rb
+++ b/app/models/stripe_account.rb
@@ -1,5 +1,5 @@
 class StripeAccount < ActiveRecord::Base
   belongs_to :enterprise
   validates_presence_of :stripe_user_id, :stripe_publishable_key
-  validates_uniqueness_of :stripe_user_id, :enterprise_id
+  validates_uniqueness_of :enterprise_id
 end
diff --git a/spec/features/admin/stripe_connect_spec.rb b/spec/features/admin/stripe_connect_spec.rb
new file mode 100644
index 0000000000..3a7dae2a88
--- /dev/null
+++ b/spec/features/admin/stripe_connect_spec.rb
@@ -0,0 +1,13 @@
+require 'spec_helper'
+
+feature "Connecting a Stripe Account" do
+  include AuthenticationWorkflow
+  include WebHelper
+  before(:each) { login_to_admin_section }
+  let!(:enterprise) { create :enterprise }
+
+  scenario "Passing an invalid CSRF token" do
+    visit "/stripe/callback?state=%7B%22csrf%22%3D%3E%22ByQF3~~~nonsense~~~4hwwmhAek4u4AEo0%3D%22%2C+%22enterprise_id%22%3D%3E%22#{enterprise.permalink}%22%7D&scope=read_only&code=ac_9HJF2pynjz5vlRWGXtpnGvL3yT9y01DY"
+    page.should have_content "Unauthorized" 
+  end
+end

From eed11faa623aac2fa5864e3b9b946cccf6b0ec13 Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Thu, 29 Sep 2016 21:32:27 +0100
Subject: [PATCH 147/353] Monkey patching OAuth2 gem to include Stripe
 disconnection method

---
 app/helpers/admin/stripe_helper.rb | 13 +++++++++++++
 lib/oauth2/client.rb               | 21 +++++++++++++++++++++
 lib/oauth2/strategy/deauthorize.rb | 24 ++++++++++++++++++++++++
 3 files changed, 58 insertions(+)
 create mode 100644 lib/oauth2/client.rb
 create mode 100644 lib/oauth2/strategy/deauthorize.rb

diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index babcaec14f..2e54158b83 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -1,13 +1,19 @@
+require File.join(Rails.root, '/lib/oauth2/strategy/deauthorize')
+require File.join(Rails.root, '/lib/oauth2/client')
+require 'oauth2'
 module Admin
   module StripeHelper
     class << self
       attr_accessor :client, :options
     end
+
     @options = {
       :site => 'https://connect.stripe.com',
       :authorize_url => '/oauth/authorize',
+      :deauthorize_url => '/oauth/deauthorize',
       :token_url => '/oauth/token'
     }
+
     @client = OAuth2::Client.new(
       ENV['STRIPE_CLIENT_ID'],
       ENV['STRIPE_INSTANCE_SECRET_KEY'],
@@ -23,5 +29,12 @@ module Admin
       # State param will be passed back after auth
       StripeHelper.client.auth_code.authorize_url(state: options)
     end
+
+    def deauthorize_stripe(account_id)
+      stripe_account = StripeAccount.find(account_id)
+      if stripe_account
+        response = StripeHelper.client.deauthorize(stripe_account.stripe_user_id).deauthorize_request
+      end
+    end
   end
 end
diff --git a/lib/oauth2/client.rb b/lib/oauth2/client.rb
new file mode 100644
index 0000000000..6790a1f425
--- /dev/null
+++ b/lib/oauth2/client.rb
@@ -0,0 +1,21 @@
+require 'oauth2'
+OAuth2::Client.class_eval do
+  def deauthorize_url(params = nil)
+   connection.build_url(options[:deauthorize_url]).to_s
+  end
+
+  def deauthorize(account)
+    client_object = self.dup
+    client_object.options[:stripe_user_id] = account
+    @deauthorize ||= OAuth2::Strategy::Deauthorize.new(client_object)
+  end
+
+  def deauthorize_request(params)
+    headers = params.delete(:headers)
+    opts = {}
+    opts[:body] = params
+    opts[:headers] = {'Content-Type' => 'application/x-www-form-urlencoded'}
+    opts[:headers].merge!(headers) if headers
+    request(:post, deauthorize_url, opts)
+  end
+end
diff --git a/lib/oauth2/strategy/deauthorize.rb b/lib/oauth2/strategy/deauthorize.rb
new file mode 100644
index 0000000000..5d4970e4e2
--- /dev/null
+++ b/lib/oauth2/strategy/deauthorize.rb
@@ -0,0 +1,24 @@
+module OAuth2
+  module Strategy
+    # Deauthorization Strategy -- for Stripe
+    class Deauthorize < Base
+      # The required query parameters for the authorize URL
+      #
+      def deauthorize_params(params = {})
+        params.merge({  'client_id' => @client.id,
+                        'stripe_user_id' => @client.options[:stripe_user_id]
+                    })
+      end
+
+      def deauthorize_url(params = {})
+       @client.deauthorize_url(deauthorize_params.merge(params))
+      end
+
+      def deauthorize_request(params = {})
+        params = params.merge(deauthorize_params).merge(client_params)
+        @client.deauthorize_request(params)
+      end
+
+    end
+  end
+end

From 758f57a889dfcdd61a61be43279d2190fc448905 Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Sat, 1 Oct 2016 10:31:49 +0100
Subject: [PATCH 148/353] Remove CSRF check - doesn't work properly as
 implemented, but connect request should probably be changed to POST

---
 .../admin/enterprises_controller.rb           | 29 ++++++++-----------
 spec/features/admin/stripe_connect_spec.rb    |  4 ---
 2 files changed, 12 insertions(+), 21 deletions(-)

diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index c33a68c1e7..971a080863 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -115,31 +115,26 @@ module Admin
     end
 
     def stripe_connect
-      redirect_to authorize_stripe(params[:enterprise_id], csrf: form_authenticity_token)
+      redirect_to authorize_stripe(params[:enterprise_id])
     end
 
     def stripe_connect_callback
       if params["code"]
         state = JSON.parse(params["state"].gsub("=>",":"))
-        # Check csrf
-        if state["csrf"] != form_authenticity_token
-          redirect_to '/unauthorized'
-        else
-          # Get the Enterprise
-          @enterprise = Enterprise.find_by_permalink(state["enterprise_id"])
+        # Get the Enterprise
+        @enterprise = Enterprise.find_by_permalink(state["enterprise_id"])
 
-          # Get the deets from Stripe
-          response_params = get_stripe_token(params["code"]).params
+        # Get the deets from Stripe
+        response_params = get_stripe_token(params["code"]).params
 
-          stripe_account = StripeAccount.new(stripe_user_id: response_params["stripe_user_id"], stripe_publishable_key: response_params["stripe_publishable_key"], enterprise: @enterprise)
-          if stripe_account.save
-            respond_to do |format|
-              format.html { redirect_to main_app.edit_admin_enterprise_path(@enterprise), notice: "Stripe account connected successfully."}
-              format.json { render json: stripe_account }
-            end
-          else
-            render text: "Failed to save Stripe token", status: 500
+        stripe_account = StripeAccount.new(stripe_user_id: response_params["stripe_user_id"], stripe_publishable_key: response_params["stripe_publishable_key"], enterprise: @enterprise)
+        if stripe_account.save
+          respond_to do |format|
+            format.html { redirect_to main_app.edit_admin_enterprise_path(@enterprise), notice: "Stripe account connected successfully."}
+            format.json { render json: stripe_account }
           end
+        else
+          render text: "Failed to save Stripe token", status: 500
         end
       else
         render text: params["error_description"], status: 500
diff --git a/spec/features/admin/stripe_connect_spec.rb b/spec/features/admin/stripe_connect_spec.rb
index 3a7dae2a88..dd9150c3ad 100644
--- a/spec/features/admin/stripe_connect_spec.rb
+++ b/spec/features/admin/stripe_connect_spec.rb
@@ -6,8 +6,4 @@ feature "Connecting a Stripe Account" do
   before(:each) { login_to_admin_section }
   let!(:enterprise) { create :enterprise }
 
-  scenario "Passing an invalid CSRF token" do
-    visit "/stripe/callback?state=%7B%22csrf%22%3D%3E%22ByQF3~~~nonsense~~~4hwwmhAek4u4AEo0%3D%22%2C+%22enterprise_id%22%3D%3E%22#{enterprise.permalink}%22%7D&scope=read_only&code=ac_9HJF2pynjz5vlRWGXtpnGvL3yT9y01DY"
-    page.should have_content "Unauthorized" 
-  end
 end

From 05a69ff0c63e3226f8a4690bed6340a13b1dd6dc Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Sat, 1 Oct 2016 11:43:54 +0100
Subject: [PATCH 149/353] Worklow to disconnect Stripe from OFN admin interface

---
 app/controllers/admin/enterprises_controller.rb          | 9 +++++++++
 app/helpers/admin/stripe_helper.rb                       | 5 +++++
 .../admin/enterprises/form/_stripe_connect.html.haml     | 5 ++---
 config/routes.rb                                         | 3 +--
 4 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index 971a080863..e795645261 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -141,6 +141,15 @@ module Admin
       end
     end
 
+    def stripe_disconnect
+      if deauthorize_stripe(params[:account_id])
+        respond_to do |format|
+          format.html { redirect_to main_app.edit_admin_enterprise_path(@enterprise), notice: "Stripe account disconnected."}
+          format.json { render json: "Disconnected" }
+        end
+      end
+    end
+
     protected
 
     def build_resource_with_address
diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index 2e54158b83..f7400dd9e3 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -3,6 +3,7 @@ require File.join(Rails.root, '/lib/oauth2/client')
 require 'oauth2'
 module Admin
   module StripeHelper
+
     class << self
       attr_accessor :client, :options
     end
@@ -34,7 +35,11 @@ module Admin
       stripe_account = StripeAccount.find(account_id)
       if stripe_account
         response = StripeHelper.client.deauthorize(stripe_account.stripe_user_id).deauthorize_request
+        if response # Response from OAuth2 only returned if successful
+          stripe_account.destroy
+        end
       end
     end
+
   end
 end
diff --git a/app/views/admin/enterprises/form/_stripe_connect.html.haml b/app/views/admin/enterprises/form/_stripe_connect.html.haml
index acc36ff87d..eb84e97ad9 100644
--- a/app/views/admin/enterprises/form/_stripe_connect.html.haml
+++ b/app/views/admin/enterprises/form/_stripe_connect.html.haml
@@ -1,7 +1,6 @@
-- if stripe_account = @enterprise.stripe_account
+- if @stripe_account = @enterprise.stripe_account
   = t :stripe_account_connected
-  = stripe_account.inspect
-  .span (Link to disconnect Stripe Acct)
+  = link_to 'Delete', main_app.admin_enterprise_stripe_account_path(@enterprise,@stripe_account), method: :delete
 - else
   %a.stripe-connect{href: 'stripe_connect'}
     .span= t :connect_with_stripe
diff --git a/config/routes.rb b/config/routes.rb
index 1e6f681f8b..a369de8051 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -72,7 +72,6 @@ Openfoodnetwork::Application.routes.draw do
       post :search
       get :check_permalink
     end
-    
 
     member do
       get :shop
@@ -102,7 +101,7 @@ Openfoodnetwork::Application.routes.draw do
       end
 
       get "/stripe_connect", to: "enterprises#stripe_connect"
-
+      resources :stripe_accounts
 
       member do
         get :welcome

From 1c69f2c670e5c352349e3057bf49125cce136bf5 Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Sat, 1 Oct 2016 19:34:39 +0100
Subject: [PATCH 150/353] Stripe Helper specs

---
 spec/factories.rb                        |  6 ++++
 spec/helpers/admin/stripe_helper_spec.rb | 37 ++++++++++++++++++++++++
 2 files changed, 43 insertions(+)
 create mode 100644 spec/helpers/admin/stripe_helper_spec.rb

diff --git a/spec/factories.rb b/spec/factories.rb
index 1faf730017..6592dc2940 100644
--- a/spec/factories.rb
+++ b/spec/factories.rb
@@ -362,6 +362,12 @@ FactoryGirl.define do
       tr.calculator = Spree::Calculator::FlatPercentItemTotal.new(calculable: tr)
     end
   end
+
+  factory :stripe_account do
+    enterprise { FactoryGirl.create :distributor_enterprise }
+    stripe_user_id "abc123"
+    stripe_publishable_key "xyz456"
+  end
 end
 
 
diff --git a/spec/helpers/admin/stripe_helper_spec.rb b/spec/helpers/admin/stripe_helper_spec.rb
new file mode 100644
index 0000000000..12e2feef7e
--- /dev/null
+++ b/spec/helpers/admin/stripe_helper_spec.rb
@@ -0,0 +1,37 @@
+require 'spec_helper'
+
+describe Admin::StripeHelper do
+  let!(:enterprise) { create(:enterprise) }
+  let!(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
+  it "calls the Stripe API to get a token" do
+    expect(Admin::StripeHelper.client.auth_code).to receive(:get_token).with("abc",{scope: "read_write"})
+    helper.get_stripe_token("abc")
+  end
+
+  it "calls the Stripe API for authorization, passing the enterprise in the state param" do
+    expect(Admin::StripeHelper.client.auth_code).to receive(:authorize_url).with({state: {enterprise_id: "enterprise-permalink"}})
+    helper.authorize_stripe("enterprise-permalink")
+  end
+
+  context "Disconnecting an account" do
+    it "doesn't destroy the database record if the Stripe API disconnect failed" do
+      disconnection = Admin::StripeHelper.client
+        .deauthorize(stripe_account.stripe_user_id)
+        .stub(:deauthorize_request)
+        .and_return(nil)
+
+      deauthorize_stripe(stripe_account.id)
+      StripeAccount.last.should eq stripe_account
+    end
+
+    it "destroys the record if the Stripe API disconnect succeeds" do
+      disconnection = Admin::StripeHelper.client
+        .deauthorize(stripe_account.stripe_user_id)
+        .stub(:deauthorize_request)
+        .and_return("something truthy")
+
+      deauthorize_stripe(stripe_account.id)
+      expect(StripeAccount.all).not_to include(stripe_account)
+    end
+  end
+end

From 41607c584638cc2681047b160fd6ea75be10072e Mon Sep 17 00:00:00 2001
From: Steve Pettitt <spettitt@gmail.com>
Date: Sat, 1 Oct 2016 20:50:56 +0100
Subject: [PATCH 151/353] De-associate accounts in response to webhook (not
 tested with a real deauth request yet)

---
 .../admin/stripe_accounts_controller.rb       | 30 +++++++++++++++++++
 app/helpers/admin/stripe_helper.rb            |  6 ++++
 config/routes.rb                              |  1 +
 .../admin/stripe_account_controller_spec.rb   | 24 +++++++++++++++
 spec/helpers/admin/stripe_helper_spec.rb      |  7 +++--
 5 files changed, 65 insertions(+), 3 deletions(-)
 create mode 100644 app/controllers/admin/stripe_accounts_controller.rb
 create mode 100644 spec/controllers/admin/stripe_account_controller_spec.rb

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
new file mode 100644
index 0000000000..bdc7758cbb
--- /dev/null
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -0,0 +1,30 @@
+module Admin
+  class StripeAccountsController < BaseController
+    include Admin::StripeHelper
+    protect_from_forgery except: :destroy_from_webhook
+    def destroy
+      if deauthorize_stripe(params[:id])
+        respond_to do |format|
+          format.html { redirect_to main_app.edit_admin_enterprise_path(params[:enterprise_id]), notice: "Stripe account disconnected."}
+          format.json { render json: stripe_account }
+        end
+      else
+        respond_to do |format|
+          format.html { redirect_to main_app.edit_admin_enterprise_path(params[:enterprise_id]), notice: "Failed to disconnect Stripe."}
+          format.json { render json: stripe_account }
+        end
+      end
+    end
+
+    def destroy_from_webhook
+      event = fetch_event_from_stripe(request)
+      if event["type"] == "account.application.deauthorized"
+        StripeAccount.where(stripe_user_id: event["data"]["id"]).map{ |account| account.destroy }
+        render json: nil, status: 200
+      else
+        render json: nil, status: 501
+      end
+    end
+
+  end
+end
diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index f7400dd9e3..9b542dff99 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -20,6 +20,8 @@ module Admin
       ENV['STRIPE_INSTANCE_SECRET_KEY'],
       options
     )
+    # Stripe ruby bindings used for non-Connect functionality
+    Stripe.api_key = ENV['STRIPE_INSTANCE_SECRET_KEY']
 
     def get_stripe_token(code, options={scope: 'read_write'})
       StripeHelper.client.auth_code.get_token(code, options)
@@ -41,5 +43,9 @@ module Admin
       end
     end
 
+    def fetch_event_from_stripe(request)
+      event_json = JSON.parse(request.body.read)
+      JSON.parse(Stripe::Event.retrieve(event_json["id"]))
+    end
   end
 end
diff --git a/config/routes.rb b/config/routes.rb
index a369de8051..0b0627e413 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -66,6 +66,7 @@ Openfoodnetwork::Application.routes.draw do
   post 'embedded_shopfront/disable', to: 'application#disable_embedded_styles'
 
   get '/stripe/callback', :to => 'admin/enterprises#stripe_connect_callback'
+  get '/stripe/webhook', :to => 'admin/stripe_accounts#destroy_from_webhook'
 
   resources :enterprises do
     collection do
diff --git a/spec/controllers/admin/stripe_account_controller_spec.rb b/spec/controllers/admin/stripe_account_controller_spec.rb
new file mode 100644
index 0000000000..9f6768eaa4
--- /dev/null
+++ b/spec/controllers/admin/stripe_account_controller_spec.rb
@@ -0,0 +1,24 @@
+require 'spec_helper'
+
+describe Admin::StripeAccountsController, type: :controller do
+  it "deletes Stripe accounts in response to a webhook" do
+    # https://stripe.com/docs/api#retrieve_event
+    allow(controller).to receive(:fetch_event_from_stripe)
+      .and_return({
+      "id" => "evt_18zt9YFBE7f7kItLg9f343bn",
+      "object" => "event",
+      "created" => 1475350088,
+      "data" => {
+          "id" => "webhook_id",
+          "name" => "OFN",
+          "object" => "application"
+      },
+      "type" => "account.application.deauthorized"
+    })
+    account = create(:stripe_account, stripe_user_id: "webhook_id")
+    post 'destroy_from_webhook'
+    expect(StripeAccount.all).not_to include account
+
+  end
+
+end
diff --git a/spec/helpers/admin/stripe_helper_spec.rb b/spec/helpers/admin/stripe_helper_spec.rb
index 12e2feef7e..e80364a788 100644
--- a/spec/helpers/admin/stripe_helper_spec.rb
+++ b/spec/helpers/admin/stripe_helper_spec.rb
@@ -15,17 +15,17 @@ describe Admin::StripeHelper do
 
   context "Disconnecting an account" do
     it "doesn't destroy the database record if the Stripe API disconnect failed" do
-      disconnection = Admin::StripeHelper.client
+      Admin::StripeHelper.client
         .deauthorize(stripe_account.stripe_user_id)
         .stub(:deauthorize_request)
         .and_return(nil)
 
       deauthorize_stripe(stripe_account.id)
-      StripeAccount.last.should eq stripe_account
+      expect(StripeAccount.all).to include(stripe_account)
     end
 
     it "destroys the record if the Stripe API disconnect succeeds" do
-      disconnection = Admin::StripeHelper.client
+      Admin::StripeHelper.client
         .deauthorize(stripe_account.stripe_user_id)
         .stub(:deauthorize_request)
         .and_return("something truthy")
@@ -33,5 +33,6 @@ describe Admin::StripeHelper do
       deauthorize_stripe(stripe_account.id)
       expect(StripeAccount.all).not_to include(stripe_account)
     end
+
   end
 end

From 0280e04008b47bed61ecf25c48b585c0c426115e Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 2 Oct 2016 14:28:07 +0100
Subject: [PATCH 152/353] Move OAuth2 patching to an initializer

---
 app/helpers/admin/stripe_helper.rb |  6 ++--
 config/initializers/oauth2.rb      | 47 ++++++++++++++++++++++++++++++
 lib/oauth2/client.rb               | 21 -------------
 lib/oauth2/strategy/deauthorize.rb | 24 ---------------
 4 files changed, 50 insertions(+), 48 deletions(-)
 create mode 100644 config/initializers/oauth2.rb
 delete mode 100644 lib/oauth2/client.rb
 delete mode 100644 lib/oauth2/strategy/deauthorize.rb

diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index 9b542dff99..757132aa71 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -1,6 +1,6 @@
-require File.join(Rails.root, '/lib/oauth2/strategy/deauthorize')
-require File.join(Rails.root, '/lib/oauth2/client')
-require 'oauth2'
+# require File.join(Rails.root, '/lib/oauth2/strategy/deauthorize')
+# require File.join(Rails.root, '/lib/oauth2/client')
+# require 'oauth2'
 module Admin
   module StripeHelper
 
diff --git a/config/initializers/oauth2.rb b/config/initializers/oauth2.rb
new file mode 100644
index 0000000000..2b46cb0e1e
--- /dev/null
+++ b/config/initializers/oauth2.rb
@@ -0,0 +1,47 @@
+Rails.application.config.to_prepare do
+  OAuth2::Client.class_eval do
+    def deauthorize_url(params = nil)
+     connection.build_url(options[:deauthorize_url]).to_s
+    end
+
+    def deauthorize(account)
+      client_object = self.dup
+      client_object.options[:stripe_user_id] = account
+      @deauthorize ||= OAuth2::Strategy::Deauthorize.new(client_object)
+    end
+
+    def deauthorize_request(params)
+      headers = params.delete(:headers)
+      opts = {}
+      opts[:body] = params
+      opts[:headers] = {'Content-Type' => 'application/x-www-form-urlencoded'}
+      opts[:headers].merge!(headers) if headers
+      request(:post, deauthorize_url, opts)
+    end
+  end
+
+  module OAuth2
+    module Strategy
+      # Deauthorization Strategy -- for Stripe
+      class Deauthorize < Base
+        # The required query parameters for the authorize URL
+        #
+        def deauthorize_params(params = {})
+          params.merge({  'client_id' => @client.id,
+                          'stripe_user_id' => @client.options[:stripe_user_id]
+                      })
+        end
+
+        def deauthorize_url(params = {})
+         @client.deauthorize_url(deauthorize_params.merge(params))
+        end
+
+        def deauthorize_request(params = {})
+          params = params.merge(deauthorize_params).merge(client_params)
+          @client.deauthorize_request(params)
+        end
+
+      end
+    end
+  end
+end
diff --git a/lib/oauth2/client.rb b/lib/oauth2/client.rb
deleted file mode 100644
index 6790a1f425..0000000000
--- a/lib/oauth2/client.rb
+++ /dev/null
@@ -1,21 +0,0 @@
-require 'oauth2'
-OAuth2::Client.class_eval do
-  def deauthorize_url(params = nil)
-   connection.build_url(options[:deauthorize_url]).to_s
-  end
-
-  def deauthorize(account)
-    client_object = self.dup
-    client_object.options[:stripe_user_id] = account
-    @deauthorize ||= OAuth2::Strategy::Deauthorize.new(client_object)
-  end
-
-  def deauthorize_request(params)
-    headers = params.delete(:headers)
-    opts = {}
-    opts[:body] = params
-    opts[:headers] = {'Content-Type' => 'application/x-www-form-urlencoded'}
-    opts[:headers].merge!(headers) if headers
-    request(:post, deauthorize_url, opts)
-  end
-end
diff --git a/lib/oauth2/strategy/deauthorize.rb b/lib/oauth2/strategy/deauthorize.rb
deleted file mode 100644
index 5d4970e4e2..0000000000
--- a/lib/oauth2/strategy/deauthorize.rb
+++ /dev/null
@@ -1,24 +0,0 @@
-module OAuth2
-  module Strategy
-    # Deauthorization Strategy -- for Stripe
-    class Deauthorize < Base
-      # The required query parameters for the authorize URL
-      #
-      def deauthorize_params(params = {})
-        params.merge({  'client_id' => @client.id,
-                        'stripe_user_id' => @client.options[:stripe_user_id]
-                    })
-      end
-
-      def deauthorize_url(params = {})
-       @client.deauthorize_url(deauthorize_params.merge(params))
-      end
-
-      def deauthorize_request(params = {})
-        params = params.merge(deauthorize_params).merge(client_params)
-        @client.deauthorize_request(params)
-      end
-
-    end
-  end
-end

From f22278db5153b19be9f2779c835063b490826213 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 2 Oct 2016 15:00:16 +0100
Subject: [PATCH 153/353] Don't disconnect if the same Stripe account is
 connected to multiple Enterprises

---
 app/helpers/admin/stripe_helper.rb       | 9 +++++++--
 spec/helpers/admin/stripe_helper_spec.rb | 8 ++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index 757132aa71..a2eef84662 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -36,8 +36,13 @@ module Admin
     def deauthorize_stripe(account_id)
       stripe_account = StripeAccount.find(account_id)
       if stripe_account
-        response = StripeHelper.client.deauthorize(stripe_account.stripe_user_id).deauthorize_request
-        if response # Response from OAuth2 only returned if successful
+        # If the account is only connected to one Enterprise, make a request to remove it on the Stripe side
+        if StripeAccount.where(stripe_user_id: stripe_account.stripe_user_id).size == 1
+          response = StripeHelper.client.deauthorize(stripe_account.stripe_user_id).deauthorize_request
+          if response # Response from OAuth2 only returned if successful
+            stripe_account.destroy
+          end
+        else
           stripe_account.destroy
         end
       end
diff --git a/spec/helpers/admin/stripe_helper_spec.rb b/spec/helpers/admin/stripe_helper_spec.rb
index e80364a788..a401f8ff46 100644
--- a/spec/helpers/admin/stripe_helper_spec.rb
+++ b/spec/helpers/admin/stripe_helper_spec.rb
@@ -2,7 +2,9 @@ require 'spec_helper'
 
 describe Admin::StripeHelper do
   let!(:enterprise) { create(:enterprise) }
+  let!(:enterprise2) { create(:enterprise) }
   let!(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
+
   it "calls the Stripe API to get a token" do
     expect(Admin::StripeHelper.client.auth_code).to receive(:get_token).with("abc",{scope: "read_write"})
     helper.get_stripe_token("abc")
@@ -34,5 +36,11 @@ describe Admin::StripeHelper do
       expect(StripeAccount.all).not_to include(stripe_account)
     end
 
+    it "Doesn't make a Stripe API disconnection request if the account is also associated with another Enterprise" do
+      another_stripe_account = create(:stripe_account, enterprise: enterprise2, stripe_user_id: stripe_account.stripe_user_id)
+      expect(Admin::StripeHelper.client.deauthorize(stripe_account.stripe_user_id)).not_to receive(:deauthorize_request)
+      deauthorize_stripe(stripe_account.id)
+    end
+
   end
 end

From 1dcffa790d4847e53d9e64045c5f30fa9307a055 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 23 Oct 2016 08:20:45 +0100
Subject: [PATCH 154/353] Add JWT encoding to state param

---
 Gemfile                                         |  5 +++--
 Gemfile.lock                                    |  1 +
 app/controllers/admin/enterprises_controller.rb |  4 +++-
 app/helpers/admin/stripe_helper.rb              | 12 +++++++++++-
 spec/helpers/admin/stripe_helper_spec.rb        | 10 ++++++++--
 5 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/Gemfile b/Gemfile
index ade5fa6951..aae6e31e35 100644
--- a/Gemfile
+++ b/Gemfile
@@ -14,8 +14,6 @@ gem 'spree', github: 'openfoodfoundation/spree', branch: 'step-6-adjustment-stat
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
-gem 'oauth2', '~> 1.2.0' # Used for Stripe Connect
-
 # Our branch contains two changes
 # - Pass customer email and phone number to PayPal (merged to upstream master)
 # - Change type of password from string to password to hide it in the form
@@ -23,6 +21,9 @@ gem 'spree_paypal_express', :github => "openfoodfoundation/better_spree_paypal_e
 #gem 'spree_paypal_express', :github => "spree-contrib/better_spree_paypal_express", :branch => "1-3-stable"
 gem 'stripe', '~>1.51.0'
 
+gem 'oauth2', '~> 1.2.0' # Used for Stripe Connect
+gem 'jwt', '~> 1.5'
+
 gem 'delayed_job_active_record'
 gem 'daemons'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 822e0e400c..00e57d42c3 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -752,6 +752,7 @@ DEPENDENCIES
   jquery-migrate-rails
   jquery-rails
   json_spec
+  jwt (~> 1.5)
   knapsack
   letter_opener
   momentjs-rails
diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index e795645261..045a67a24b 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -120,7 +120,9 @@ module Admin
 
     def stripe_connect_callback
       if params["code"]
-        state = JSON.parse(params["state"].gsub("=>",":"))
+        state = jwt_decode(params["state"])
+        redirect_to unauthorized unless state.keys.include? "enterprise_id"
+        
         # Get the Enterprise
         @enterprise = Enterprise.find_by_permalink(state["enterprise_id"])
 
diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index a2eef84662..09f8fefdd1 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -29,8 +29,9 @@ module Admin
 
     def authorize_stripe(enterprise_id, options={})
       options = options.merge({enterprise_id: enterprise_id})
+      jwt = jwt_encode options
       # State param will be passed back after auth
-      StripeHelper.client.auth_code.authorize_url(state: options)
+      StripeHelper.client.auth_code.authorize_url(state: jwt)
     end
 
     def deauthorize_stripe(account_id)
@@ -52,5 +53,14 @@ module Admin
       event_json = JSON.parse(request.body.read)
       JSON.parse(Stripe::Event.retrieve(event_json["id"]))
     end
+
+    private
+    def jwt_encode payload
+      JWT.encode(payload, Openfoodnetwork::Application.config.secret_token)
+    end
+
+    def jwt_decode token
+      JWT.decode(token, Openfoodnetwork::Application.config.secret_token)[0] # only returns the original payload
+    end
   end
 end
diff --git a/spec/helpers/admin/stripe_helper_spec.rb b/spec/helpers/admin/stripe_helper_spec.rb
index a401f8ff46..a2d4cfce9f 100644
--- a/spec/helpers/admin/stripe_helper_spec.rb
+++ b/spec/helpers/admin/stripe_helper_spec.rb
@@ -10,8 +10,10 @@ describe Admin::StripeHelper do
     helper.get_stripe_token("abc")
   end
 
-  it "calls the Stripe API for authorization, passing the enterprise in the state param" do
-    expect(Admin::StripeHelper.client.auth_code).to receive(:authorize_url).with({state: {enterprise_id: "enterprise-permalink"}})
+  it "calls the Stripe API for authorization, passing appropriate JWT in the state param" do
+    expect(Admin::StripeHelper.client.auth_code).to receive(:authorize_url).with({
+      state: JWT.encode({enterprise_id: "enterprise-permalink"}, Openfoodnetwork::Application.config.secret_token)
+    })
     helper.authorize_stripe("enterprise-permalink")
   end
 
@@ -42,5 +44,9 @@ describe Admin::StripeHelper do
       deauthorize_stripe(stripe_account.id)
     end
 
+    it "encodes and decodes JWT" do
+      jwt_decode(jwt_encode({test: "string"})).should eq({"test" => "string"})
+    end
+
   end
 end

From e52e04ba29ed4b103073d13495d4eeb1d5f15ce9 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Mon, 24 Oct 2016 21:30:18 +0100
Subject: [PATCH 155/353] Adding Stripe Connect information so we don't forget
 it later

---
 .../admin/enterprises/form/_stripe_connect.html.haml   | 10 +++++++++-
 config/locales/en.yml                                  |  5 +++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/views/admin/enterprises/form/_stripe_connect.html.haml b/app/views/admin/enterprises/form/_stripe_connect.html.haml
index eb84e97ad9..d6cd5ecb53 100644
--- a/app/views/admin/enterprises/form/_stripe_connect.html.haml
+++ b/app/views/admin/enterprises/form/_stripe_connect.html.haml
@@ -3,4 +3,12 @@
   = link_to 'Delete', main_app.admin_enterprise_stripe_account_path(@enterprise,@stripe_account), method: :delete
 - else
   %a.stripe-connect{href: 'stripe_connect'}
-    .span= t :connect_with_stripe
+    .stripe-info
+      -# Recommended info to impart (from Stripe Connect docs):
+      -# indicate to the user what you’re responsible for and what they’ll be expected to do. It’s particularly important to communicate:
+      -# That they’ll need to create and maintain their Stripe account.
+      -# That they’ll need to handle chargebacks and all customer service issues.
+      -# Who is responsible for paying the Stripe fees.
+      -# What, if any, fees the platform charges.
+      =t :stripe_connect_info
+      %span= t :connect_with_stripe
diff --git a/config/locales/en.yml b/config/locales/en.yml
index d84550df35..b4581f6236 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -519,6 +519,11 @@ en:
           close_date: Close Date
         social:
           twitter_placeholder: eg. @the_prof
+        stripe_connect:
+          connect_with_stripe: "Connect with Stripe"
+          stripe_connect_info: "Connect your Stripe account by clicking the button below. This will allow Open Food Network to charge your customers on your behalf. You will need to maintain your Stripe account, pay Stripe fees and handle any chargebacks and customer service."
+          stripe_account_connected: "Stripe account connected."
+          disconnect: "Disconnect account"
         tag_rules:
           default_rules:
             by_default: By Default

From e69b27a3c47dc3ec9363d13b116ca7720782b0b7 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Mon, 24 Oct 2016 22:06:52 +0100
Subject: [PATCH 156/353] Tidy up (temp) UI a bit

---
 .../enterprises/form/_stripe_connect.html.haml | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/app/views/admin/enterprises/form/_stripe_connect.html.haml b/app/views/admin/enterprises/form/_stripe_connect.html.haml
index d6cd5ecb53..068330ce8b 100644
--- a/app/views/admin/enterprises/form/_stripe_connect.html.haml
+++ b/app/views/admin/enterprises/form/_stripe_connect.html.haml
@@ -1,14 +1,20 @@
 - if @stripe_account = @enterprise.stripe_account
-  = t :stripe_account_connected
-  = link_to 'Delete', main_app.admin_enterprise_stripe_account_path(@enterprise,@stripe_account), method: :delete
+  .stripe-info
+    .row
+      = t('.stripe_account_connected')
+    .row
+      %a.button{href: "#{link_to t('.disconnect'), main_app.admin_enterprise_stripe_account_path(@enterprise,@stripe_account), method: :delete}"}
+        =t('.disconnect')
 - else
-  %a.stripe-connect{href: 'stripe_connect'}
-    .stripe-info
+  .row.stripe-info
+    .six.columns.alpha
       -# Recommended info to impart (from Stripe Connect docs):
       -# indicate to the user what you’re responsible for and what they’ll be expected to do. It’s particularly important to communicate:
       -# That they’ll need to create and maintain their Stripe account.
       -# That they’ll need to handle chargebacks and all customer service issues.
       -# Who is responsible for paying the Stripe fees.
       -# What, if any, fees the platform charges.
-      =t :stripe_connect_info
-      %span= t :connect_with_stripe
+      =t('.stripe_connect_info')
+    .five.columns.omega.text-right
+      %a.stripe-connect{href: 'stripe_connect'}
+        %span= t('.connect_with_stripe')

From 5ae473e07fc7a13aa8f19753816034cc270e519f Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 29 Oct 2016 20:17:22 +0100
Subject: [PATCH 157/353] Add specs, fix redirect after requring relogin

---
 .../admin/enterprises_controller.rb           | 12 +++--
 .../spree/admin/base_controller_decorator.rb  |  2 +-
 app/helpers/admin/stripe_helper.rb            |  6 ++-
 app/models/spree/ability_decorator.rb         |  3 ++
 .../admin/enterprises_controller_spec.rb      | 52 +++++++++++++++++++
 .../admin/stripe_account_controller_spec.rb   |  1 +
 spec/features/admin/stripe_connect_spec.rb    |  7 ++-
 7 files changed, 76 insertions(+), 7 deletions(-)

diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index 045a67a24b..d844e2f364 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -121,14 +121,20 @@ module Admin
     def stripe_connect_callback
       if params["code"]
         state = jwt_decode(params["state"])
-        redirect_to unauthorized unless state.keys.include? "enterprise_id"
-        
+        unless state.keys.include? "enterprise_id"
+          redirect_to '/unauthorized' and return
+        end
+
         # Get the Enterprise
         @enterprise = Enterprise.find_by_permalink(state["enterprise_id"])
-
         # Get the deets from Stripe
         response_params = get_stripe_token(params["code"]).params
 
+        unless spree_current_user.enterprises.include? @enterprise
+          deauthorize_request_for_stripe_id(response_params["stripe_user_id"])
+          redirect_to '/unauthorized' and return
+        end
+
         stripe_account = StripeAccount.new(stripe_user_id: response_params["stripe_user_id"], stripe_publishable_key: response_params["stripe_publishable_key"], enterprise: @enterprise)
         if stripe_account.save
           respond_to do |format|
diff --git a/app/controllers/spree/admin/base_controller_decorator.rb b/app/controllers/spree/admin/base_controller_decorator.rb
index 716f4ef50f..1511a88bdc 100644
--- a/app/controllers/spree/admin/base_controller_decorator.rb
+++ b/app/controllers/spree/admin/base_controller_decorator.rb
@@ -37,7 +37,7 @@ Spree::Admin::BaseController.class_eval do
       redirect_to '/unauthorized'
     else
       store_location
-      redirect_to root_path(anchor: "login?after_login=#{request.env['PATH_INFO']}")
+      redirect_to root_path(anchor: "login?after_login=#{request.env.fullpath}")
     end
   end
 
diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index 09f8fefdd1..23009fc1b0 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -39,7 +39,7 @@ module Admin
       if stripe_account
         # If the account is only connected to one Enterprise, make a request to remove it on the Stripe side
         if StripeAccount.where(stripe_user_id: stripe_account.stripe_user_id).size == 1
-          response = StripeHelper.client.deauthorize(stripe_account.stripe_user_id).deauthorize_request
+          response = deauthorize_request_for_stripe_id(stripe_account.stripe_user_id)
           if response # Response from OAuth2 only returned if successful
             stripe_account.destroy
           end
@@ -54,6 +54,10 @@ module Admin
       JSON.parse(Stripe::Event.retrieve(event_json["id"]))
     end
 
+    def deauthorize_request_for_stripe_id(id)
+      StripeHelper.client.deauthorize(id).deauthorize_request
+    end
+
     private
     def jwt_encode payload
       JWT.encode(payload, Openfoodnetwork::Application.config.secret_token)
diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb
index 44a8bc0961..457350fef0 100644
--- a/app/models/spree/ability_decorator.rb
+++ b/app/models/spree/ability_decorator.rb
@@ -118,6 +118,9 @@ class AbilityDecorator
     can [:admin, :bulk_update], ColumnPreference do |column_preference|
       column_preference.user == user
     end
+
+    # Not sure how to restrict these methods to a non-resource Controller
+    can [:stripe_connect, :stripe_connect_callback, :stripe_disconnect], :all
   end
 
   def add_product_management_abilities(user)
diff --git a/spec/controllers/admin/enterprises_controller_spec.rb b/spec/controllers/admin/enterprises_controller_spec.rb
index 94282e6c2c..888bc02ab3 100644
--- a/spec/controllers/admin/enterprises_controller_spec.rb
+++ b/spec/controllers/admin/enterprises_controller_spec.rb
@@ -144,6 +144,58 @@ module Admin
           expect(distributor.users).to_not include user
         end
 
+        describe "stripe connect" do
+          it "redirects to Stripe" do
+            controller.stub spree_current_user: distributor_manager
+            spree_get :stripe_connect
+            ['https://connect.stripe.com/oauth/authorize',
+              'response_type=code',
+              'state=',
+              'client_id='].each{|element| response.location.should match element}
+          end
+
+          it "returns 500 on callback if the response code is not provided" do
+            controller.stub spree_current_user: distributor_manager
+            spree_get :stripe_connect_callback
+            response.status.should be 500
+          end
+
+          it "redirects to unauthorized if the callback state param is invalid" do
+             controller.stub spree_current_user: distributor_manager
+             payload = {junk: "Ssfs"}
+             params = {state: JWT.encode(payload, Openfoodnetwork::Application.config.secret_token),
+                        code: "code"}
+             spree_get :stripe_connect_callback, params
+             response.should redirect_to '/unauthorized'
+          end
+
+          # TODO: This should probably also include managers/coordinators as well as owners?
+          it "makes a request to cancel the Stripe connection if the user does not own the enterprise" do
+            controller.stub spree_current_user: distributor_manager
+            controller.stub(:deauthorize_request_for_stripe_id)
+            controller.stub_chain(:get_stripe_token, :params).and_return({stripe_user_id: "xyz123", stripe_publishable_key: "abc456"}.to_json)
+            payload = {enterprise_id: supplier.permalink} # Request is not for the current user's Enterprise
+            params = {state: JWT.encode(payload, Openfoodnetwork::Application.config.secret_token),
+                        code: "code"}
+            spree_get :stripe_connect_callback, params
+
+            controller.should have_received(:deauthorize_request_for_stripe_id)
+          end
+
+          it "makes a new Stripe Account from the callback params" do
+            controller.stub spree_current_user: distributor_manager
+            controller.stub_chain(:get_stripe_token, :params).and_return({stripe_user_id: "xyz123", stripe_publishable_key: "abc456"}.to_json)
+            payload = {enterprise_id: distributor.permalink}
+            params = {state: JWT.encode(payload, Openfoodnetwork::Application.config.secret_token),
+                        code: "code"}
+
+            expect{spree_get :stripe_connect_callback, params}.to change{StripeAccount.all.length}.by 1
+            StripeAccount.last.enterprise_id.should eq distributor.id
+
+          end
+
+        end
+
 
         describe "enterprise properties" do
           let(:producer) { create(:enterprise) }
diff --git a/spec/controllers/admin/stripe_account_controller_spec.rb b/spec/controllers/admin/stripe_account_controller_spec.rb
index 9f6768eaa4..08ab508019 100644
--- a/spec/controllers/admin/stripe_account_controller_spec.rb
+++ b/spec/controllers/admin/stripe_account_controller_spec.rb
@@ -1,6 +1,7 @@
 require 'spec_helper'
 
 describe Admin::StripeAccountsController, type: :controller do
+
   it "deletes Stripe accounts in response to a webhook" do
     # https://stripe.com/docs/api#retrieve_event
     allow(controller).to receive(:fetch_event_from_stripe)
diff --git a/spec/features/admin/stripe_connect_spec.rb b/spec/features/admin/stripe_connect_spec.rb
index dd9150c3ad..f68280c710 100644
--- a/spec/features/admin/stripe_connect_spec.rb
+++ b/spec/features/admin/stripe_connect_spec.rb
@@ -3,7 +3,10 @@ require 'spec_helper'
 feature "Connecting a Stripe Account" do
   include AuthenticationWorkflow
   include WebHelper
-  before(:each) { login_to_admin_section }
-  let!(:enterprise) { create :enterprise }
+
+  let!(:enterprise_user) { create :enterprise_user }
+  before(:each) do
+    login_to_admin_as enterprise_user
+  end
 
 end

From f83c7a88df599dbc6eef6b9953a7c01fbe569d5d Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 30 Oct 2016 08:52:28 +0000
Subject: [PATCH 158/353] Specify SHA-256 algorithm for JWT

---
 app/helpers/admin/stripe_helper.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index 23009fc1b0..60b1d8adc5 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -60,11 +60,11 @@ module Admin
 
     private
     def jwt_encode payload
-      JWT.encode(payload, Openfoodnetwork::Application.config.secret_token)
+      JWT.encode(payload, Openfoodnetwork::Application.config.secret_token, 'HS256')
     end
 
     def jwt_decode token
-      JWT.decode(token, Openfoodnetwork::Application.config.secret_token)[0] # only returns the original payload
+      JWT.decode(token, Openfoodnetwork::Application.config.secret_token, 'HS256')[0] # only returns the original payload
     end
   end
 end

From 5c43c75b00292380934c57aeb92a25b39ca876e9 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 30 Oct 2016 08:57:04 +0000
Subject: [PATCH 159/353] Specify SHA-256 algorithm for JWT in spec fixture

---
 app/helpers/admin/stripe_helper.rb       | 2 +-
 spec/helpers/admin/stripe_helper_spec.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index 60b1d8adc5..9067d004af 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -64,7 +64,7 @@ module Admin
     end
 
     def jwt_decode token
-      JWT.decode(token, Openfoodnetwork::Application.config.secret_token, 'HS256')[0] # only returns the original payload
+      JWT.decode(token, Openfoodnetwork::Application.config.secret_token, true, algorithm: 'HS256')[0] # only returns the original payload
     end
   end
 end
diff --git a/spec/helpers/admin/stripe_helper_spec.rb b/spec/helpers/admin/stripe_helper_spec.rb
index a2d4cfce9f..27591d2705 100644
--- a/spec/helpers/admin/stripe_helper_spec.rb
+++ b/spec/helpers/admin/stripe_helper_spec.rb
@@ -12,7 +12,7 @@ describe Admin::StripeHelper do
 
   it "calls the Stripe API for authorization, passing appropriate JWT in the state param" do
     expect(Admin::StripeHelper.client.auth_code).to receive(:authorize_url).with({
-      state: JWT.encode({enterprise_id: "enterprise-permalink"}, Openfoodnetwork::Application.config.secret_token)
+      state: JWT.encode({enterprise_id: "enterprise-permalink"}, Openfoodnetwork::Application.config.secret_token, 'HS256')
     })
     helper.authorize_stripe("enterprise-permalink")
   end

From 47df2dc20b2210777e1524177862577244f227d5 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 30 Oct 2016 21:16:51 +0000
Subject: [PATCH 160/353] Tweaking redirects and links

---
 app/controllers/admin/enterprises_controller.rb       |  3 ++-
 .../spree/admin/base_controller_decorator.rb          |  2 +-
 .../admin/enterprises/form/_stripe_connect.html.haml  |  4 ++--
 spec/controllers/admin/enterprises_controller_spec.rb | 11 ++++++++++-
 4 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index d844e2f364..1c6b93247c 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -130,7 +130,8 @@ module Admin
         # Get the deets from Stripe
         response_params = get_stripe_token(params["code"]).params
 
-        unless spree_current_user.enterprises.include? @enterprise
+        # In case of a problem, need to also issue a request to disconnect the account from Stripe
+        if !(spree_current_user.owned_enterprises.include? @enterprise) && !(spree_current_user.admin?)
           deauthorize_request_for_stripe_id(response_params["stripe_user_id"])
           redirect_to '/unauthorized' and return
         end
diff --git a/app/controllers/spree/admin/base_controller_decorator.rb b/app/controllers/spree/admin/base_controller_decorator.rb
index 1511a88bdc..dcf83915de 100644
--- a/app/controllers/spree/admin/base_controller_decorator.rb
+++ b/app/controllers/spree/admin/base_controller_decorator.rb
@@ -37,7 +37,7 @@ Spree::Admin::BaseController.class_eval do
       redirect_to '/unauthorized'
     else
       store_location
-      redirect_to root_path(anchor: "login?after_login=#{request.env.fullpath}")
+      redirect_to root_path(anchor: "login?after_login=#{request.fullpath || request.env['PATH_INFO']}")
     end
   end
 
diff --git a/app/views/admin/enterprises/form/_stripe_connect.html.haml b/app/views/admin/enterprises/form/_stripe_connect.html.haml
index 068330ce8b..c817fa85e2 100644
--- a/app/views/admin/enterprises/form/_stripe_connect.html.haml
+++ b/app/views/admin/enterprises/form/_stripe_connect.html.haml
@@ -3,8 +3,8 @@
     .row
       = t('.stripe_account_connected')
     .row
-      %a.button{href: "#{link_to t('.disconnect'), main_app.admin_enterprise_stripe_account_path(@enterprise,@stripe_account), method: :delete}"}
-        =t('.disconnect')
+      .button
+        =link_to t('.disconnect'), main_app.admin_enterprise_stripe_account_path(@enterprise,@stripe_account), method: :delete
 - else
   .row.stripe-info
     .six.columns.alpha
diff --git a/spec/controllers/admin/enterprises_controller_spec.rb b/spec/controllers/admin/enterprises_controller_spec.rb
index 888bc02ab3..7807837b60 100644
--- a/spec/controllers/admin/enterprises_controller_spec.rb
+++ b/spec/controllers/admin/enterprises_controller_spec.rb
@@ -160,6 +160,16 @@ module Admin
             response.status.should be 500
           end
 
+          it "redirects to login with the query params in case of session problems" do
+            controller.stub spree_current_user: nil
+            params = {this: "that"}
+            spree_get :stripe_connect_callback, params
+            # This is the correct redirect - but not sure it actually works since the redirect
+            # is ultimately handled in Angular, which presumably doesn't know which controller to
+            # use for the action
+            response.should redirect_to root_path(anchor: "login?after_login=/?action=stripe_connect&this=that")
+          end
+
           it "redirects to unauthorized if the callback state param is invalid" do
              controller.stub spree_current_user: distributor_manager
              payload = {junk: "Ssfs"}
@@ -191,7 +201,6 @@ module Admin
 
             expect{spree_get :stripe_connect_callback, params}.to change{StripeAccount.all.length}.by 1
             StripeAccount.last.enterprise_id.should eq distributor.id
-
           end
 
         end

From d374ab569d48e535b728d1caf5f09bc2d2513f63 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 12 Nov 2016 12:07:00 +0000
Subject: [PATCH 161/353] Undo dodgy redirect changes and set spec to pending

---
 app/controllers/spree/admin/base_controller_decorator.rb | 2 +-
 spec/controllers/admin/enterprises_controller_spec.rb    | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/app/controllers/spree/admin/base_controller_decorator.rb b/app/controllers/spree/admin/base_controller_decorator.rb
index dcf83915de..58102e20eb 100644
--- a/app/controllers/spree/admin/base_controller_decorator.rb
+++ b/app/controllers/spree/admin/base_controller_decorator.rb
@@ -37,7 +37,7 @@ Spree::Admin::BaseController.class_eval do
       redirect_to '/unauthorized'
     else
       store_location
-      redirect_to root_path(anchor: "login?after_login=#{request.fullpath || request.env['PATH_INFO']}")
+      redirect_to root_path(anchor: "login?after_login=#{ request.env['PATH_INFO'] }")
     end
   end
 
diff --git a/spec/controllers/admin/enterprises_controller_spec.rb b/spec/controllers/admin/enterprises_controller_spec.rb
index 7807837b60..f14f5f6f4b 100644
--- a/spec/controllers/admin/enterprises_controller_spec.rb
+++ b/spec/controllers/admin/enterprises_controller_spec.rb
@@ -161,12 +161,14 @@ module Admin
           end
 
           it "redirects to login with the query params in case of session problems" do
+            pending("Difficult to reproduce: sometimes get logged out of OFN during Stripe connect
+            redirect/callback process. After logging in again, it doesn't redirect to the callback URL.")
             controller.stub spree_current_user: nil
             params = {this: "that"}
             spree_get :stripe_connect_callback, params
-            # This is the correct redirect - but not sure it actually works since the redirect
+            # This is the idea - but even if generated correctly not sure it actually works since the redirect
             # is ultimately handled in Angular, which presumably doesn't know which controller to
-            # use for the action
+            # use for the action?
             response.should redirect_to root_path(anchor: "login?after_login=/?action=stripe_connect&this=that")
           end
 

From da335703b40920d78537baf5d23cd315c1334f5e Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 12 Nov 2016 12:57:52 +0000
Subject: [PATCH 162/353] Fix specs for travis

---
 app/controllers/admin/enterprises_controller.rb       | 2 +-
 spec/controllers/admin/enterprises_controller_spec.rb | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index 1c6b93247c..672e1ce178 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -131,7 +131,7 @@ module Admin
         response_params = get_stripe_token(params["code"]).params
 
         # In case of a problem, need to also issue a request to disconnect the account from Stripe
-        if !(spree_current_user.owned_enterprises.include? @enterprise) && !(spree_current_user.admin?)
+        if !(spree_current_user.enterprises.include? @enterprise) && !(spree_current_user.admin?)
           deauthorize_request_for_stripe_id(response_params["stripe_user_id"])
           redirect_to '/unauthorized' and return
         end
diff --git a/spec/controllers/admin/enterprises_controller_spec.rb b/spec/controllers/admin/enterprises_controller_spec.rb
index f14f5f6f4b..836f3e0de0 100644
--- a/spec/controllers/admin/enterprises_controller_spec.rb
+++ b/spec/controllers/admin/enterprises_controller_spec.rb
@@ -147,11 +147,12 @@ module Admin
         describe "stripe connect" do
           it "redirects to Stripe" do
             controller.stub spree_current_user: distributor_manager
+            Admin::StripeHelper.client.stub id: "abc"
             spree_get :stripe_connect
             ['https://connect.stripe.com/oauth/authorize',
               'response_type=code',
               'state=',
-              'client_id='].each{|element| response.location.should match element}
+              'client_id=abc'].each{|element| response.location.should match element}
           end
 
           it "returns 500 on callback if the response code is not provided" do
@@ -200,7 +201,6 @@ module Admin
             payload = {enterprise_id: distributor.permalink}
             params = {state: JWT.encode(payload, Openfoodnetwork::Application.config.secret_token),
                         code: "code"}
-
             expect{spree_get :stripe_connect_callback, params}.to change{StripeAccount.all.length}.by 1
             StripeAccount.last.enterprise_id.should eq distributor.id
           end

From 9ac638f8bae1d6aee9a1e841a75da007c95db460 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 12 Nov 2016 13:07:26 +0000
Subject: [PATCH 163/353] Fix some leftover refactoring from an earlier
 modification to enterprises controller (now not needed as moved to
 admin/enterprises)

---
 app/controllers/enterprises_controller.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/controllers/enterprises_controller.rb b/app/controllers/enterprises_controller.rb
index 3bbfa6cce2..53e52415e5 100644
--- a/app/controllers/enterprises_controller.rb
+++ b/app/controllers/enterprises_controller.rb
@@ -18,7 +18,7 @@ class EnterprisesController < BaseController
   def relatives
     respond_to do |format|
       format.json do
-        enterprises = enterprise.andand.relatives.andand.activated
+        enterprises = @enterprise.andand.relatives.andand.activated
         render(json: enterprises,
                each_serializer: Api::EnterpriseSerializer,
                data: OpenFoodNetwork::EnterpriseInjectionData.new)
@@ -43,7 +43,7 @@ class EnterprisesController < BaseController
   private
 
   def set_enterprise
-    enterprise = Enterprise.find(params[:id])
+    @enterprise = Enterprise.find(params[:id])
   end
 
   def clean_permalink

From a039286240526809a4de491f8f5c8ec3bf933c77 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 21 Jan 2017 09:43:34 +0000
Subject: [PATCH 164/353] Webhook processing changes: fix expected request data
 formatting

---
 .../admin/stripe_accounts_controller.rb       |  7 ++--
 app/helpers/admin/stripe_helper.rb            |  3 +-
 .../admin/stripe_account_controller_spec.rb   | 40 +++++++++++++------
 3 files changed, 34 insertions(+), 16 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index bdc7758cbb..a8b28b49cd 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -17,10 +17,11 @@ module Admin
     end
 
     def destroy_from_webhook
+      # Fetch the event again direct from stripe for extra security
       event = fetch_event_from_stripe(request)
-      if event["type"] == "account.application.deauthorized"
-        StripeAccount.where(stripe_user_id: event["data"]["id"]).map{ |account| account.destroy }
-        render json: nil, status: 200
+      if event.type == "account.application.deauthorized"
+        StripeAccount.where(stripe_user_id: event.user_id).map{ |account| account.destroy }
+        render text: "Account #{event.user_id} deauthorized", status: 200
       else
         render json: nil, status: 501
       end
diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index 9067d004af..9e930857dd 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -51,7 +51,8 @@ module Admin
 
     def fetch_event_from_stripe(request)
       event_json = JSON.parse(request.body.read)
-      JSON.parse(Stripe::Event.retrieve(event_json["id"]))
+      acct_param = event_json["user_id"] ? {"Stripe-Account" => event_json["user_id"]} : nil
+      Stripe::Event.retrieve(event_json["id"],acct_param)
     end
 
     def deauthorize_request_for_stripe_id(id)
diff --git a/spec/controllers/admin/stripe_account_controller_spec.rb b/spec/controllers/admin/stripe_account_controller_spec.rb
index 08ab508019..f4c4682f69 100644
--- a/spec/controllers/admin/stripe_account_controller_spec.rb
+++ b/spec/controllers/admin/stripe_account_controller_spec.rb
@@ -5,19 +5,35 @@ describe Admin::StripeAccountsController, type: :controller do
   it "deletes Stripe accounts in response to a webhook" do
     # https://stripe.com/docs/api#retrieve_event
     allow(controller).to receive(:fetch_event_from_stripe)
-      .and_return({
-      "id" => "evt_18zt9YFBE7f7kItLg9f343bn",
-      "object" => "event",
-      "created" => 1475350088,
-      "data" => {
-          "id" => "webhook_id",
-          "name" => "OFN",
-          "object" => "application"
-      },
-      "type" => "account.application.deauthorized"
-    })
+      .and_return(Stripe::Event.construct_from({"id"=>"evt_wrfwg4323fw",
+                   "object"=>"event",
+                   "api_version"=>nil,
+                   "created"=>1484870684,
+                   "data"=>
+                    {"object"=>
+                      {"id"=>"application_id",
+                       "object"=>"application",
+                       "name"=>"Open Food Network UK"}},
+                   "livemode"=>false,
+                   "pending_webhooks"=>1,
+                   "request"=>nil,
+                   "type"=>"account.application.deauthorized",
+                   "user_id"=>"webhook_id"}))
     account = create(:stripe_account, stripe_user_id: "webhook_id")
-    post 'destroy_from_webhook'
+    post 'destroy_from_webhook', {"id"=>"evt_wrfwg4323fw",
+                                   "object"=>"event",
+                                   "api_version"=>nil,
+                                   "created"=>1484870684,
+                                   "data"=>
+                                    {"object"=>
+                                      {"id"=>"ca_9ByaSyyyXj5O73DWisU0KLluf0870Vro",
+                                       "object"=>"application",
+                                       "name"=>"Open Food Network UK"}},
+                                   "livemode"=>false,
+                                   "pending_webhooks"=>1,
+                                   "request"=>nil,
+                                   "type"=>"account.application.deauthorized",
+                                   "user_id"=>"webhook_id"}
     expect(StripeAccount.all).not_to include account
 
   end

From 22e4a50807aff520ffd0c116e4b6cb51306a6fe4 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 21 Jan 2017 10:27:25 +0000
Subject: [PATCH 165/353] Change Stripe webhook handling to post request

---
 config/routes.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/routes.rb b/config/routes.rb
index 0b0627e413..7df975544d 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -66,7 +66,7 @@ Openfoodnetwork::Application.routes.draw do
   post 'embedded_shopfront/disable', to: 'application#disable_embedded_styles'
 
   get '/stripe/callback', :to => 'admin/enterprises#stripe_connect_callback'
-  get '/stripe/webhook', :to => 'admin/stripe_accounts#destroy_from_webhook'
+  post '/stripe/webhook', :to => 'admin/stripe_accounts#destroy_from_webhook'
 
   resources :enterprises do
     collection do

From 1450bfd7262eb903428c1ca3e081bbc24957b22d Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 21 Jan 2017 10:57:13 +0000
Subject: [PATCH 166/353] Don't retrieve event from Stripe for a
 deauthorisation

---
 app/helpers/admin/stripe_helper.rb                     | 10 ++++++++--
 .../admin/stripe_account_controller_spec.rb            |  1 +
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index 9e930857dd..efe3df2eb3 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -51,8 +51,14 @@ module Admin
 
     def fetch_event_from_stripe(request)
       event_json = JSON.parse(request.body.read)
-      acct_param = event_json["user_id"] ? {"Stripe-Account" => event_json["user_id"]} : nil
-      Stripe::Event.retrieve(event_json["id"],acct_param)
+      # If the application has been deauthorised, we are no longer authorised to retrieve events for that account
+      # Left here in case it's useful for other webhooks
+      unless event_json["type"] == "account.application.deauthorized"
+        acct_param = event_json["user_id"] ? {"Stripe-Account" => event_json["user_id"]} : nil
+        Stripe::Event.retrieve(event_json["id"],acct_param)
+      else
+        Stripe::Event.construct_from(event_json)
+      end
     end
 
     def deauthorize_request_for_stripe_id(id)
diff --git a/spec/controllers/admin/stripe_account_controller_spec.rb b/spec/controllers/admin/stripe_account_controller_spec.rb
index f4c4682f69..85deee5273 100644
--- a/spec/controllers/admin/stripe_account_controller_spec.rb
+++ b/spec/controllers/admin/stripe_account_controller_spec.rb
@@ -20,6 +20,7 @@ describe Admin::StripeAccountsController, type: :controller do
                    "type"=>"account.application.deauthorized",
                    "user_id"=>"webhook_id"}))
     account = create(:stripe_account, stripe_user_id: "webhook_id")
+    expect(Stripe::Event).not_to receive(:retrieve) # should not retrieve direct for a deauth event
     post 'destroy_from_webhook', {"id"=>"evt_wrfwg4323fw",
                                    "object"=>"event",
                                    "api_version"=>nil,

From ae72ebef5e7ca557d93dbf895a922f2a73dd324b Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 21 Jan 2017 13:00:41 +0000
Subject: [PATCH 167/353] Fix disconnect button formatting

---
 app/views/admin/enterprises/form/_stripe_connect.html.haml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/app/views/admin/enterprises/form/_stripe_connect.html.haml b/app/views/admin/enterprises/form/_stripe_connect.html.haml
index c817fa85e2..4b13fca017 100644
--- a/app/views/admin/enterprises/form/_stripe_connect.html.haml
+++ b/app/views/admin/enterprises/form/_stripe_connect.html.haml
@@ -3,8 +3,7 @@
     .row
       = t('.stripe_account_connected')
     .row
-      .button
-        =link_to t('.disconnect'), main_app.admin_enterprise_stripe_account_path(@enterprise,@stripe_account), method: :delete
+      =link_to t('.disconnect'), main_app.admin_enterprise_stripe_account_path(@enterprise,@stripe_account), method: :delete, class: 'button'
 - else
   .row.stripe-info
     .six.columns.alpha

From 858852123df322025c3acacf5801c196d478e154 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 21 Jan 2017 14:55:23 +0000
Subject: [PATCH 168/353] Add configuration example

---
 config/application.yml.example | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/config/application.yml.example b/config/application.yml.example
index e39f23fb59..73b9a9c67b 100644
--- a/config/application.yml.example
+++ b/config/application.yml.example
@@ -26,3 +26,10 @@ CURRENCY: AUD
 
 # see: https://developers.google.com/maps/documentation/javascript/get-api-key
 # GOOGLE_MAPS_API_KEY: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+# Stripe Connect details for instance account
+# Find these under 'API keys' and 'Connect' in your Stripe account dashboard -> Account Settings 
+# Under 'Connect', the Redirect URI should be set to https://YOUR_SERVER_URL/stripe/callback (e.g. https://openfoodnetwork.org.uk/stripe/connect)
+# Under 'Webhooks', you should set up a Connect endpoint pointing to https://YOUR_SERVER_URL/stripe/webhook e.g. (https://openfoodnetwork.org.uk/stripe/webhook)
+# STRIPE_INSTANCE_SECRET_KEY: yyyyy
+# STRIPE_CLIENT_ID: xxxx

From b5a6bcdf9d540fa0cec7c88911267f3e678e5228 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 23 Feb 2017 12:20:20 +1100
Subject: [PATCH 169/353] Opening up restriction on activemerchant version by
 updating Spree ref

Allows use of v > 1.57 which includes support for Stripe Connect
---
 Gemfile      |  3 ++-
 Gemfile.lock | 17 +++++++++--------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/Gemfile b/Gemfile
index aae6e31e35..45763bebcf 100644
--- a/Gemfile
+++ b/Gemfile
@@ -10,7 +10,7 @@ gem 'i18n-js', '~> 3.0.0'
 gem 'nokogiri', '>= 1.6.7.1'
 
 gem 'pg'
-gem 'spree', github: 'openfoodfoundation/spree', branch: 'step-6-adjustment-state-migration', ref: '48febb2'
+gem 'spree', github: 'openfoodfoundation/spree', branch: 'step-6a', ref: '5a76d45'
 gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
 gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch: 'spree-upgrade-intermediate'
 
@@ -20,6 +20,7 @@ gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch:
 gem 'spree_paypal_express', :github => "openfoodfoundation/better_spree_paypal_express", :branch => "spree-upgrade-intermediate"
 #gem 'spree_paypal_express', :github => "spree-contrib/better_spree_paypal_express", :branch => "1-3-stable"
 gem 'stripe', '~>1.51.0'
+gem 'activemerchant', '~> 1.71.0'
 
 gem 'oauth2', '~> 1.2.0' # Used for Stripe Connect
 gem 'jwt', '~> 1.5'
diff --git a/Gemfile.lock b/Gemfile.lock
index 00e57d42c3..50ba18ebb6 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -30,9 +30,9 @@ GIT
 
 GIT
   remote: git://github.com/openfoodfoundation/spree.git
-  revision: 48febb250a3b1eb2d42812b27b93457e89cde589
-  ref: 48febb2
-  branch: step-6-adjustment-state-migration
+  revision: 5a76d456ff70aea7aae3d25156558d71eb7febf2
+  ref: 5a76d45
+  branch: step-6a
   specs:
     spree (1.3.99)
       spree_api (= 1.3.99)
@@ -57,7 +57,7 @@ GIT
     spree_cmd (1.3.99)
       thor (>= 0.14.6)
     spree_core (1.3.99)
-      activemerchant (~> 1.50.0)
+      activemerchant (~> 1.50)
       acts_as_list (= 0.1.9)
       awesome_nested_set (= 2.1.5)
       aws-sdk (~> 1.11.1)
@@ -151,8 +151,8 @@ GEM
       sprockets (~> 2.2.1)
     active_model_serializers (0.8.3)
       activemodel (>= 3.0)
-    activemerchant (1.50.0)
-      activesupport (>= 3.2.14, < 5.0.0)
+    activemerchant (1.71.0)
+      activesupport (>= 3.2.14, < 6.x)
       builder (>= 2.1.2, < 4.0.0)
       i18n (>= 0.6.9)
       nokogiri (~> 1.4)
@@ -457,7 +457,7 @@ GEM
       multi_json (~> 1.0)
       rspec (~> 2.0)
     jwt (1.5.4)
-    kaminari (0.14.1)
+    kaminari (0.13.0)
       actionpack (>= 3.0.0)
       activesupport (>= 3.0.0)
       railties (>= 3.0.0)
@@ -670,10 +670,10 @@ GEM
     uglifier (2.7.1)
       execjs (>= 0.3.0)
       json (>= 1.8.0)
-    unicode-display_width (1.3.0)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.7.2)
+    unicode-display_width (1.3.0)
     unicorn (4.9.0)
       kgio (~> 2.6)
       rack
@@ -708,6 +708,7 @@ PLATFORMS
 
 DEPENDENCIES
   active_model_serializers
+  activemerchant (~> 1.71.0)
   acts-as-taggable-on (~> 3.4)
   andand
   angular-rails-templates (~> 0.2.0)

From 37f60bf7a1408a8e933cd1f18ab8591521c5c01b Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 22 Feb 2017 11:19:03 +1100
Subject: [PATCH 170/353] Setting Stripe.api_key in an initializer rather than
 helper

---
 app/helpers/admin/stripe_helper.rb | 2 --
 config/initializers/stripe.rb      | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)
 create mode 100644 config/initializers/stripe.rb

diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index efe3df2eb3..a78ebf8e55 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -20,8 +20,6 @@ module Admin
       ENV['STRIPE_INSTANCE_SECRET_KEY'],
       options
     )
-    # Stripe ruby bindings used for non-Connect functionality
-    Stripe.api_key = ENV['STRIPE_INSTANCE_SECRET_KEY']
 
     def get_stripe_token(code, options={scope: 'read_write'})
       StripeHelper.client.auth_code.get_token(code, options)
diff --git a/config/initializers/stripe.rb b/config/initializers/stripe.rb
new file mode 100644
index 0000000000..2dc4035a49
--- /dev/null
+++ b/config/initializers/stripe.rb
@@ -0,0 +1 @@
+Stripe.api_key = ENV['STRIPE_INSTANCE_SECRET_KEY']

From 99a7665edc5b155aea5a0f135e9b2aa0ec107940 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 17 Feb 2017 12:22:32 +1100
Subject: [PATCH 171/353] Requesting read_write permission when authorizing
 Stripe standalone account

---
 app/helpers/admin/stripe_helper.rb       | 4 ++--
 spec/helpers/admin/stripe_helper_spec.rb | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
index a78ebf8e55..4fdc16355c 100644
--- a/app/helpers/admin/stripe_helper.rb
+++ b/app/helpers/admin/stripe_helper.rb
@@ -21,7 +21,7 @@ module Admin
       options
     )
 
-    def get_stripe_token(code, options={scope: 'read_write'})
+    def get_stripe_token(code, options={})
       StripeHelper.client.auth_code.get_token(code, options)
     end
 
@@ -29,7 +29,7 @@ module Admin
       options = options.merge({enterprise_id: enterprise_id})
       jwt = jwt_encode options
       # State param will be passed back after auth
-      StripeHelper.client.auth_code.authorize_url(state: jwt)
+      StripeHelper.client.auth_code.authorize_url(state: jwt, scope: 'read_write')
     end
 
     def deauthorize_stripe(account_id)
diff --git a/spec/helpers/admin/stripe_helper_spec.rb b/spec/helpers/admin/stripe_helper_spec.rb
index 27591d2705..c15ca4a59f 100644
--- a/spec/helpers/admin/stripe_helper_spec.rb
+++ b/spec/helpers/admin/stripe_helper_spec.rb
@@ -6,13 +6,14 @@ describe Admin::StripeHelper do
   let!(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
 
   it "calls the Stripe API to get a token" do
-    expect(Admin::StripeHelper.client.auth_code).to receive(:get_token).with("abc",{scope: "read_write"})
+    expect(Admin::StripeHelper.client.auth_code).to receive(:get_token).with("abc", {})
     helper.get_stripe_token("abc")
   end
 
-  it "calls the Stripe API for authorization, passing appropriate JWT in the state param" do
+  it "calls the Stripe API for authorization with read_write permission, passing appropriate JWT in the state param" do
     expect(Admin::StripeHelper.client.auth_code).to receive(:authorize_url).with({
-      state: JWT.encode({enterprise_id: "enterprise-permalink"}, Openfoodnetwork::Application.config.secret_token, 'HS256')
+      state: JWT.encode({enterprise_id: "enterprise-permalink"}, Openfoodnetwork::Application.config.secret_token, 'HS256'),
+      scope: "read_write"
     })
     helper.authorize_stripe("enterprise-permalink")
   end
@@ -47,6 +48,5 @@ describe Admin::StripeHelper do
     it "encodes and decodes JWT" do
       jwt_decode(jwt_encode({test: "string"})).should eq({"test" => "string"})
     end
-
   end
 end

From d500c20d3fcb81fda6af919ea01a07e1ddc689c4 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 17 Feb 2017 12:24:21 +1100
Subject: [PATCH 172/353] Adding new StripeConnect payment gateway

---
 app/models/spree/gateway/stripe_connect.rb   | 132 +++++++++++++++++++
 app/models/spree/payment_method_decorator.rb |   2 +
 config/application.rb                        |   1 +
 spec/models/spree/payment_method_spec.rb     |   1 +
 4 files changed, 136 insertions(+)
 create mode 100644 app/models/spree/gateway/stripe_connect.rb

diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
new file mode 100644
index 0000000000..2e5104e346
--- /dev/null
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -0,0 +1,132 @@
+module Spree
+  class Gateway::StripeConnect < Gateway
+    preference :enterprise_id, :integer
+
+    attr_accessible :preferred_enterprise_id
+
+    CARD_TYPE_MAPPING = {
+      'American Express' => 'american_express',
+      'Diners Club' => 'diners_club',
+      'Visa' => 'visa'
+    }
+
+    def method_type
+      'stripe'
+    end
+
+    def provider_class
+      ActiveMerchant::Billing::StripeGateway
+    end
+
+    def payment_profiles_supported?
+      true
+    end
+
+    def stripe_account_id
+      StripeAccount.find_by_enterprise_id(preferred_enterprise_id).andand.stripe_user_id
+    end
+
+    def purchase(money, creditcard, gateway_options)
+      provider.purchase(*options_for_purchase_or_auth(money, creditcard, gateway_options))
+    end
+
+    def authorize(money, creditcard, gateway_options)
+      provider.authorize(*options_for_purchase_or_auth(money, creditcard, gateway_options))
+    end
+
+    def capture(money, response_code, gateway_options)
+      provider.capture(money, response_code, gateway_options)
+    end
+
+    def credit(money, creditcard, response_code, gateway_options)
+      provider.refund(money, response_code, {})
+    end
+
+    def void(response_code, creditcard, gateway_options)
+      provider.void(response_code, {})
+    end
+
+    def cancel(response_code)
+      provider.void(response_code, {})
+    end
+
+    def create_profile(payment)
+      return unless payment.source.gateway_customer_profile_id.nil?
+      options = {
+        email: payment.order.email,
+        login: Stripe.api_key,
+      }.merge! address_for(payment)
+
+      source = update_source!(payment.source)
+      if source.number.blank? && source.gateway_payment_profile_id.present?
+        creditcard = source.gateway_payment_profile_id
+      else
+        creditcard = source
+      end
+
+      response = provider.store(creditcard, options)
+      if response.success?
+        payment.source.update_attributes!({
+          cc_type: payment.source.cc_type, # side-effect of update_source!
+          gateway_customer_profile_id: response.params['id'],
+          gateway_payment_profile_id: response.params['default_source'] || response.params['default_card']
+        })
+
+      else
+        payment.send(:gateway_error, response.message)
+      end
+    end
+
+    private
+
+    # In this gateway, what we call 'secret_key' is the 'login'
+    def options
+      options = super
+      options.merge(:login => Stripe.api_key)
+    end
+
+    def options_for_purchase_or_auth(money, creditcard, gateway_options)
+      options = {}
+      options[:description] = "Spree Order ID: #{gateway_options[:order_id]}"
+      options[:currency] = gateway_options[:currency]
+      options[:stripe_account] = stripe_account_id
+
+      if customer = creditcard.gateway_customer_profile_id
+        options[:customer] = customer
+      end
+      if token_or_card_id = creditcard.gateway_payment_profile_id
+        # The Stripe ActiveMerchant gateway supports passing the token directly as the creditcard parameter
+        # The Stripe ActiveMerchant gateway supports passing the customer_id and credit_card id
+        # https://github.com/Shopify/active_merchant/issues/770
+        creditcard = token_or_card_id
+      end
+      return money, creditcard, options
+    end
+
+    def address_for(payment)
+      {}.tap do |options|
+        if address = payment.order.bill_address
+          options.merge!(address: {
+            address1: address.address1,
+            address2: address.address2,
+            city: address.city,
+            zip: address.zipcode
+          })
+
+          if country = address.country
+            options[:address].merge!(country: country.name)
+          end
+
+          if state = address.state
+            options[:address].merge!(state: state.name)
+          end
+        end
+      end
+    end
+
+    def update_source!(source)
+      source.cc_type = CARD_TYPE_MAPPING[source.cc_type] if CARD_TYPE_MAPPING.include?(source.cc_type)
+      source
+    end
+  end
+end
diff --git a/app/models/spree/payment_method_decorator.rb b/app/models/spree/payment_method_decorator.rb
index 3b9eff2cab..07395f22de 100644
--- a/app/models/spree/payment_method_decorator.rb
+++ b/app/models/spree/payment_method_decorator.rb
@@ -58,6 +58,8 @@ Spree::PaymentMethod.class_eval do
       "MasterCard Internet Gateway Service (MIGS)"
     when "Spree::Gateway::Pin"
       "Pin Payments"
+    when "Spree::Gateway::StripeConnect"
+      "Stripe"
     when "Spree::Gateway::PayPalExpress"
       "PayPal Express"
     else
diff --git a/config/application.rb b/config/application.rb
index 91472fdf3c..e58c7e8115 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -71,6 +71,7 @@ module Openfoodnetwork
     initializer "spree.gateway.payment_methods", :after => "spree.register.payment_methods" do |app|
       app.config.spree.payment_methods << Spree::Gateway::Migs
       app.config.spree.payment_methods << Spree::Gateway::Pin
+      app.config.spree.payment_methods << Spree::Gateway::StripeConnect
     end
 
     # Settings in config/environments/* take precedence over those specified here.
diff --git a/spec/models/spree/payment_method_spec.rb b/spec/models/spree/payment_method_spec.rb
index 70808c231e..28707876d3 100644
--- a/spec/models/spree/payment_method_spec.rb
+++ b/spec/models/spree/payment_method_spec.rb
@@ -21,6 +21,7 @@ module Spree
       Spree::Gateway::Migs.clean_name.should == "MasterCard Internet Gateway Service (MIGS)"
       Spree::Gateway::Pin.clean_name.should == "Pin Payments"
       Spree::Gateway::PayPalExpress.clean_name.should == "PayPal Express"
+      Spree::Gateway::StripeConnect.clean_name.should == "Stripe"
 
       # Testing else condition
       Spree::Gateway::BogusSimple.clean_name.should == "BogusSimple"

From 987ad0df6c72eb887a87891e746c96e1c18f4e46 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 17 Feb 2017 18:10:17 +1100
Subject: [PATCH 173/353] Very basic Stripe Connect payment method interface

---
 .../controllers/stripe_controller.js.coffee   |  2 ++
 .../directives/ofn-select2.js.coffee          |  2 +-
 .../replace_form_fields.html.haml.deface      |  1 +
 .../api/admin/payment_method_serializer.rb    | 32 +++++++++++++++----
 .../_provider_settings.html.haml              | 18 +++++++----
 .../payment_methods/_stripe_connect.html.haml | 11 +++++++
 6 files changed, 52 insertions(+), 14 deletions(-)
 create mode 100644 app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
 rename app/assets/javascripts/admin/{index_utils => utils}/directives/ofn-select2.js.coffee (93%)
 create mode 100644 app/views/spree/admin/payment_methods/_stripe_connect.html.haml

diff --git a/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee b/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
new file mode 100644
index 0000000000..c9f6c3ffe0
--- /dev/null
+++ b/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
@@ -0,0 +1,2 @@
+angular.module("admin.paymentMethods").controller "StripeController", ($scope, shops) ->
+  $scope.shops = shops
diff --git a/app/assets/javascripts/admin/index_utils/directives/ofn-select2.js.coffee b/app/assets/javascripts/admin/utils/directives/ofn-select2.js.coffee
similarity index 93%
rename from app/assets/javascripts/admin/index_utils/directives/ofn-select2.js.coffee
rename to app/assets/javascripts/admin/utils/directives/ofn-select2.js.coffee
index 6890589b9d..b0afdc46e5 100644
--- a/app/assets/javascripts/admin/index_utils/directives/ofn-select2.js.coffee
+++ b/app/assets/javascripts/admin/utils/directives/ofn-select2.js.coffee
@@ -1,4 +1,4 @@
-angular.module("admin.indexUtils").directive "ofnSelect2", ($sanitize, $timeout, $filter) ->
+angular.module("admin.utils").directive "ofnSelect2", ($sanitize, $timeout, $filter) ->
   require: 'ngModel'
   restrict: 'C'
   scope:
diff --git a/app/overrides/spree/admin/payment_methods/_form/replace_form_fields.html.haml.deface b/app/overrides/spree/admin/payment_methods/_form/replace_form_fields.html.haml.deface
index aa9ead7a0f..16164c5137 100644
--- a/app/overrides/spree/admin/payment_methods/_form/replace_form_fields.html.haml.deface
+++ b/app/overrides/spree/admin/payment_methods/_form/replace_form_fields.html.haml.deface
@@ -1,6 +1,7 @@
 / replace "div[data-hook='admin_payment_method_form_fields']"
 
 = admin_inject_payment_method
+= admin_inject_json_ams_array "admin.paymentMethods", "shops", @hubs, Api::Admin::IdNameSerializer
 %div.alpha.eleven.columns{ "ng-app" => "admin.paymentMethods", "ng-controller" => "paymentMethodCtrl" }
   .row
     .alpha.three.columns
diff --git a/app/serializers/api/admin/payment_method_serializer.rb b/app/serializers/api/admin/payment_method_serializer.rb
index 42c11a6953..edcf482915 100644
--- a/app/serializers/api/admin/payment_method_serializer.rb
+++ b/app/serializers/api/admin/payment_method_serializer.rb
@@ -1,11 +1,31 @@
 class Api::Admin::PaymentMethodSerializer < ActiveModel::Serializer
-  attributes :id, :name, :type, :tag_list, :tags
-
-  def tag_list
-    object.tag_list.join(",")
+  def serializable_hash
+    method_serializer.serializable_hash
   end
 
-  def tags
-    object.tag_list.map{ |t| { text: t } }
+  def method_serializer
+    if object.type == 'Spree::Gateway::StripeConnect'
+      Api::Admin::PaymentMethod::StripeSerializer.new(object)
+    else
+      Api::Admin::PaymentMethod::BaseSerializer.new(object)
+    end
+  end
+end
+
+module Api::Admin::PaymentMethod
+  class BaseSerializer < ActiveModel::Serializer
+    attributes :id, :name, :type, :tag_list, :tags
+
+    def tag_list
+      object.tag_list.join(",")
+    end
+
+    def tags
+      object.tag_list.map{ |t| { text: t } }
+    end
+  end
+
+  class StripeSerializer < BaseSerializer
+    attributes :preferred_enterprise_id
   end
 end
diff --git a/app/views/spree/admin/payment_methods/_provider_settings.html.haml b/app/views/spree/admin/payment_methods/_provider_settings.html.haml
index e227180fc3..c64ad9f1d2 100644
--- a/app/views/spree/admin/payment_methods/_provider_settings.html.haml
+++ b/app/views/spree/admin/payment_methods/_provider_settings.html.haml
@@ -1,7 +1,11 @@
-- if @payment_method.preferences.present?
-  %fieldset.alpha.eleven.columns.no-border-bottom#gateway_fields
-    %legend{ align: "center"}
-      = t(:provider_settings)
-    .preference-settings
-      = fields_for :payment_method, @payment_method do |payment_method_form|
-        = preference_fields(@payment_method, payment_method_form)
\ No newline at end of file
+- case @payment_method
+- when Spree::Gateway::StripeConnect
+  = render 'stripe_connect'
+- else
+  - if @payment_method.preferences.present?
+    %fieldset.alpha.eleven.columns.no-border-bottom#gateway_fields
+      %legend{ align: "center"}
+        = t(:provider_settings)
+      .preference-settings
+        = fields_for :payment_method, @payment_method do |payment_method_form|
+          = preference_fields(@payment_method, payment_method_form)
diff --git a/app/views/spree/admin/payment_methods/_stripe_connect.html.haml b/app/views/spree/admin/payment_methods/_stripe_connect.html.haml
new file mode 100644
index 0000000000..28c039c009
--- /dev/null
+++ b/app/views/spree/admin/payment_methods/_stripe_connect.html.haml
@@ -0,0 +1,11 @@
+%fieldset.alpha.eleven.columns.no-border-bottom#gateway_fields
+  %legend{ align: "center"}
+    = t(:provider_settings)
+  .preference-settings{ ng: { controller: "StripeController" } }
+    = fields_for :payment_method, @payment_method do |payment_method_form|
+      = payment_method_form.label :stripe_account_owner
+      %br
+      -# = payment_method_form.collection_select(:preferred_enterprise_id, @hubs, :id, :name, {:include_blank => true}, {:class => "select2 fullwidth"})
+      %input.ofn-select2.fullwidth#payment_method_preferred_enterprise_id{ type: 'number',
+        name: 'payment_method[preferred_enterprise_id]',
+        data: 'shops', ng: { model: 'paymentMethod.preferred_enterprise_id' } }

From f87f4310f0583ed771dd54fbe32da0b09a560c30 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 20 Feb 2017 12:36:23 +1100
Subject: [PATCH 174/353] Adding #status controller action for stripe accounts
 to fetch current info direct from Stripe

---
 .../admin/stripe_accounts_controller.rb       |  14 ++
 app/models/spree/ability_decorator.rb         |   2 +-
 config/routes.rb                              |   3 +-
 .../admin/stripe_account_controller_spec.rb   | 148 +++++++++++++-----
 4 files changed, 130 insertions(+), 37 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index a8b28b49cd..93afa8a92d 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -2,6 +2,7 @@ module Admin
   class StripeAccountsController < BaseController
     include Admin::StripeHelper
     protect_from_forgery except: :destroy_from_webhook
+
     def destroy
       if deauthorize_stripe(params[:id])
         respond_to do |format|
@@ -27,5 +28,18 @@ module Admin
       end
     end
 
+    def status
+      authorize! :stripe_account, Enterprise.find_by_id(params[:enterprise_id])
+      stripe_account = StripeAccount.find_by_enterprise_id(params[:enterprise_id])
+      return render json: { status: :account_missing } unless stripe_account
+
+      begin
+        status = Stripe::Account.retrieve(stripe_account.stripe_user_id)
+        attrs = [:id, :business_name, :charges_enabled]
+        render json: status.to_hash.slice(*attrs).merge( status: :connected)
+      rescue Stripe::APIError => e
+        render json: { status: :access_revoked }
+      end
+    end
   end
 end
diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb
index 457350fef0..a56f233434 100644
--- a/app/models/spree/ability_decorator.rb
+++ b/app/models/spree/ability_decorator.rb
@@ -96,7 +96,7 @@ class AbilityDecorator
     can [:welcome, :register], Enterprise do |enterprise|
       enterprise.owner == user
     end
-    can [:manage_payment_methods, :manage_shipping_methods, :manage_enterprise_fees], Enterprise do |enterprise|
+    can [:manage_payment_methods, :manage_shipping_methods, :manage_enterprise_fees, :stripe_account], Enterprise do |enterprise|
       user.enterprises.include? enterprise
     end
 
diff --git a/config/routes.rb b/config/routes.rb
index 7df975544d..d6c4c7330c 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -102,7 +102,8 @@ Openfoodnetwork::Application.routes.draw do
       end
 
       get "/stripe_connect", to: "enterprises#stripe_connect"
-      resources :stripe_accounts
+      get "/stripe_account", to: "stripe_accounts#status"
+      resources :stripe_accounts, only: [:destroy]
 
       member do
         get :welcome
diff --git a/spec/controllers/admin/stripe_account_controller_spec.rb b/spec/controllers/admin/stripe_account_controller_spec.rb
index 85deee5273..44e41eb6e6 100644
--- a/spec/controllers/admin/stripe_account_controller_spec.rb
+++ b/spec/controllers/admin/stripe_account_controller_spec.rb
@@ -2,41 +2,119 @@ require 'spec_helper'
 
 describe Admin::StripeAccountsController, type: :controller do
 
-  it "deletes Stripe accounts in response to a webhook" do
-    # https://stripe.com/docs/api#retrieve_event
-    allow(controller).to receive(:fetch_event_from_stripe)
-      .and_return(Stripe::Event.construct_from({"id"=>"evt_wrfwg4323fw",
-                   "object"=>"event",
-                   "api_version"=>nil,
-                   "created"=>1484870684,
-                   "data"=>
-                    {"object"=>
-                      {"id"=>"application_id",
-                       "object"=>"application",
-                       "name"=>"Open Food Network UK"}},
-                   "livemode"=>false,
-                   "pending_webhooks"=>1,
-                   "request"=>nil,
-                   "type"=>"account.application.deauthorized",
-                   "user_id"=>"webhook_id"}))
-    account = create(:stripe_account, stripe_user_id: "webhook_id")
-    expect(Stripe::Event).not_to receive(:retrieve) # should not retrieve direct for a deauth event
-    post 'destroy_from_webhook', {"id"=>"evt_wrfwg4323fw",
-                                   "object"=>"event",
-                                   "api_version"=>nil,
-                                   "created"=>1484870684,
-                                   "data"=>
-                                    {"object"=>
-                                      {"id"=>"ca_9ByaSyyyXj5O73DWisU0KLluf0870Vro",
-                                       "object"=>"application",
-                                       "name"=>"Open Food Network UK"}},
-                                   "livemode"=>false,
-                                   "pending_webhooks"=>1,
-                                   "request"=>nil,
-                                   "type"=>"account.application.deauthorized",
-                                   "user_id"=>"webhook_id"}
-    expect(StripeAccount.all).not_to include account
-
+  describe "destroy_from_webhook" do
+    it "deletes Stripe accounts in response to a webhook" do
+      # https://stripe.com/docs/api#retrieve_event
+      allow(controller).to receive(:fetch_event_from_stripe)
+        .and_return(Stripe::Event.construct_from({"id"=>"evt_wrfwg4323fw",
+                     "object"=>"event",
+                     "api_version"=>nil,
+                     "created"=>1484870684,
+                     "data"=>
+                      {"object"=>
+                        {"id"=>"application_id",
+                         "object"=>"application",
+                         "name"=>"Open Food Network UK"}},
+                     "livemode"=>false,
+                     "pending_webhooks"=>1,
+                     "request"=>nil,
+                     "type"=>"account.application.deauthorized",
+                     "user_id"=>"webhook_id"}))
+      account = create(:stripe_account, stripe_user_id: "webhook_id")
+      expect(Stripe::Event).not_to receive(:retrieve) # should not retrieve direct for a deauth event
+      post 'destroy_from_webhook', {"id"=>"evt_wrfwg4323fw",
+                                     "object"=>"event",
+                                     "api_version"=>nil,
+                                     "created"=>1484870684,
+                                     "data"=>
+                                      {"object"=>
+                                        {"id"=>"ca_9ByaSyyyXj5O73DWisU0KLluf0870Vro",
+                                         "object"=>"application",
+                                         "name"=>"Open Food Network UK"}},
+                                     "livemode"=>false,
+                                     "pending_webhooks"=>1,
+                                     "request"=>nil,
+                                     "type"=>"account.application.deauthorized",
+                                     "user_id"=>"webhook_id"}
+      expect(StripeAccount.all).not_to include account
+    end
   end
 
+  describe "verifying stripe account status with Stripe" do
+    let(:enterprise) { create(:distributor_enterprise) }
+    let(:params) { { format: :json } }
+
+    before do
+      Stripe.api_key = "sk_test_12345"
+    end
+
+    context "where I don't manage the specified enterprise" do
+      let(:user) { create(:user) }
+      let(:enterprise2) { create(:enterprise) }
+      before do
+        user.owned_enterprises << enterprise2
+        params.merge!({enterprise_id: enterprise.id})
+        allow(controller).to receive(:spree_current_user) { user }
+      end
+
+      it "redirects to unauthorized" do
+        spree_get :status, params
+        expect(response).to redirect_to spree.unauthorized_path
+      end
+    end
+
+    context "where I manage the specified enterprise" do
+      before do
+        params.merge!({enterprise_id: enterprise.id})
+        allow(controller).to receive(:spree_current_user) { enterprise.owner }
+      end
+
+      context "but it has no associated stripe account" do
+        it "returns with a status of 'account_missing'" do
+          spree_get :status, params
+          json_response = JSON.parse(response.body)
+          expect(json_response["status"]).to eq "account_missing"
+        end
+      end
+
+      context "and it has an associated stripe account" do
+        let!(:account) { create(:stripe_account, stripe_user_id: "acc_123", enterprise: enterprise) }
+
+        context "which has been revoked or does not exist" do
+          before do
+            stub_request(:get, "https://api.stripe.com/v1/accounts/acc_123").to_return(status: 404)
+          end
+
+          it "returns with a status of 'access_revoked'" do
+            spree_get :status, params
+            json_response = JSON.parse(response.body)
+            expect(json_response["status"]).to eq "access_revoked"
+          end
+        end
+
+        context "which is connected" do
+          let(:stripe_account_mock) { {
+            id: "acc_123",
+            business_name: "My Org",
+            charges_enabled: true,
+            some_other_attr: "something"
+          } }
+
+          before do
+            stub_request(:get, "https://api.stripe.com/v1/accounts/acc_123").to_return(body: JSON.generate(stripe_account_mock))
+          end
+
+          it "returns with a status of 'connected'" do
+            spree_get :status, params
+            json_response = JSON.parse(response.body)
+            expect(json_response["status"]).to eq "connected"
+            # serializes required attrs
+            expect(json_response["business_name"]).to eq "My Org"
+            # ignores other attrs
+            expect(json_response["some_other_attr"]).to be nil
+          end
+        end
+      end
+    end
+  end
 end

From 5ad88f992cf0f54941c34ddf6dccc52597f1ae5d Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 20 Feb 2017 13:34:27 +1100
Subject: [PATCH 175/353] Adding live stripe account status display to payment
 method create/edit interface

---
 .../controllers/stripe_controller.js.coffee   | 18 ++++-
 .../admin/components/alert-box.css.scss       | 80 +++++++++++++++++++
 .../admin/dashboard-single-ent.css.scss       | 22 -----
 .../replace_form_fields.html.haml.deface      |  2 +-
 .../api/admin/basic_enterprise_serializer.rb  |  2 +-
 .../payment_methods/_stripe_connect.html.haml | 33 +++++++-
 config/locales/en.yml                         | 14 ++++
 spec/features/admin/payment_method_spec.rb    | 35 ++++++++
 8 files changed, 180 insertions(+), 26 deletions(-)
 create mode 100644 app/assets/stylesheets/admin/components/alert-box.css.scss

diff --git a/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee b/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
index c9f6c3ffe0..c8a1b6a019 100644
--- a/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
+++ b/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
@@ -1,2 +1,18 @@
-angular.module("admin.paymentMethods").controller "StripeController", ($scope, shops) ->
+angular.module("admin.paymentMethods").controller "StripeController", ($scope, $http, shops) ->
   $scope.shops = shops
+  $scope.stripe_account = {}
+
+  $scope.$watch "paymentMethod.preferred_enterprise_id", (newID, oldID) ->
+    return unless newID?
+    $scope.stripe_account = {}
+    $http.get("/admin/enterprises/#{newID}/stripe_account.json").success (data) ->
+      angular.extend($scope.stripe_account, data)
+    .error (response) ->
+      $scope.stripe_account.status = "request_failed"
+
+  $scope.current_enterprise_stripe_path = ->
+    return unless $scope.paymentMethod.preferred_enterprise_id?
+    permalink = shops.filter((shop) ->
+      shop.id == $scope.paymentMethod.preferred_enterprise_id
+    )[0].permalink
+    "/admin/enterprises/#{permalink}/edit#stripe"
diff --git a/app/assets/stylesheets/admin/components/alert-box.css.scss b/app/assets/stylesheets/admin/components/alert-box.css.scss
new file mode 100644
index 0000000000..dcd89adf25
--- /dev/null
+++ b/app/assets/stylesheets/admin/components/alert-box.css.scss
@@ -0,0 +1,80 @@
+@import "../../darkswarm/mixins";
+
+.alert-box {
+  position: relative;
+  display: block;
+  background-color: #eff5dc;
+  border: 1px solid #9fc820;
+  color: #666;
+  margin-top: 1em;
+  margin-bottom: 1em;
+
+  @include border-radius(3px);
+
+  transition: opacity 300ms ease-out;
+  padding: 0.77778em 1.33333em 0.77778em 0.77778em;
+
+  a.close {
+    position: absolute;
+    right: 5px;
+    top: 5px;
+    font-size: 1.5em;
+  }
+
+  &.ok {
+    border: 1px solid #9fc820;
+    background-color: #fbffee;
+    color: #9fc820;
+    font-weight: bold;
+
+    a.button {
+      padding: 3px 10px;
+      background-color: #a7c44d;
+      &:hover {
+        background-color: #9fc820;
+      }
+    }
+
+    a.close {
+      color: #9fc820;
+    }
+  }
+
+  &.error {
+    border: 1px solid #c82020;
+    background-color: #f5dcdc;
+    color: #c82020;
+    font-weight: bold;
+
+    a.button {
+      padding: 3px 10px;
+      background-color: #c85252;
+      &:hover {
+        background-color: #c82020;
+      }
+    }
+
+    a.close {
+      color: #c82020;
+    }
+  }
+
+  &.warning {
+    border: 1px solid #e6912e;
+    background-color: #fff4e6;
+    color: #e6912e;
+    font-weight: bold;
+
+    a.button {
+      padding: 3px 10px;
+      background-color: #db9350;
+      &:hover {
+        background-color: #e6912e;
+      }
+    }
+
+    a.close {
+      color: #e6912e;
+    }
+  }
+}
diff --git a/app/assets/stylesheets/admin/dashboard-single-ent.css.scss b/app/assets/stylesheets/admin/dashboard-single-ent.css.scss
index b9aca09481..e2f1926c6e 100644
--- a/app/assets/stylesheets/admin/dashboard-single-ent.css.scss
+++ b/app/assets/stylesheets/admin/dashboard-single-ent.css.scss
@@ -1,27 +1,5 @@
 @import "../darkswarm/mixins";
 
-.alert-box {
-  position: relative;
-  display: block;
-  background-color: #eff5dc;
-  border: 1px solid #9fc820;
-  color: #666;
-  margin-top: 1em;
-  margin-bottom: 1em;
-
-  @include border-radius(3px);
-
-  transition: opacity 300ms ease-out;
-  padding: 0.77778em 1.33333em 0.77778em 0.77778em;
-
-  a.close {
-    position: absolute;
-    right: 5px;
-    top: 0px;
-    font-size: 1.5em;
-  }
-}
-
 .dashboard_item.single-ent {
   .header {
     padding: 0.77778em 1.33333em 0.77778em 0.77778em;
diff --git a/app/overrides/spree/admin/payment_methods/_form/replace_form_fields.html.haml.deface b/app/overrides/spree/admin/payment_methods/_form/replace_form_fields.html.haml.deface
index 16164c5137..0201278e0e 100644
--- a/app/overrides/spree/admin/payment_methods/_form/replace_form_fields.html.haml.deface
+++ b/app/overrides/spree/admin/payment_methods/_form/replace_form_fields.html.haml.deface
@@ -1,7 +1,7 @@
 / replace "div[data-hook='admin_payment_method_form_fields']"
 
 = admin_inject_payment_method
-= admin_inject_json_ams_array "admin.paymentMethods", "shops", @hubs, Api::Admin::IdNameSerializer
+= admin_inject_json_ams_array "admin.paymentMethods", "shops", @hubs, Api::Admin::BasicEnterpriseSerializer
 %div.alpha.eleven.columns{ "ng-app" => "admin.paymentMethods", "ng-controller" => "paymentMethodCtrl" }
   .row
     .alpha.three.columns
diff --git a/app/serializers/api/admin/basic_enterprise_serializer.rb b/app/serializers/api/admin/basic_enterprise_serializer.rb
index f060dc4166..854b9b4019 100644
--- a/app/serializers/api/admin/basic_enterprise_serializer.rb
+++ b/app/serializers/api/admin/basic_enterprise_serializer.rb
@@ -1,4 +1,4 @@
 class Api::Admin::BasicEnterpriseSerializer < ActiveModel::Serializer
   attributes :name, :id, :is_primary_producer, :is_distributor, :sells, :category, :payment_method_ids, :shipping_method_ids
-  attributes :producer_profile_only
+  attributes :producer_profile_only, :permalink
 end
diff --git a/app/views/spree/admin/payment_methods/_stripe_connect.html.haml b/app/views/spree/admin/payment_methods/_stripe_connect.html.haml
index 28c039c009..6eb55b50d8 100644
--- a/app/views/spree/admin/payment_methods/_stripe_connect.html.haml
+++ b/app/views/spree/admin/payment_methods/_stripe_connect.html.haml
@@ -5,7 +5,38 @@
     = fields_for :payment_method, @payment_method do |payment_method_form|
       = payment_method_form.label :stripe_account_owner
       %br
-      -# = payment_method_form.collection_select(:preferred_enterprise_id, @hubs, :id, :name, {:include_blank => true}, {:class => "select2 fullwidth"})
       %input.ofn-select2.fullwidth#payment_method_preferred_enterprise_id{ type: 'number',
         name: 'payment_method[preferred_enterprise_id]',
+        placeholder: t(".enterprise_select_placeholder"),
         data: 'shops', ng: { model: 'paymentMethod.preferred_enterprise_id' } }
+
+    #stripe-account-status{ ng: { show: "paymentMethod.preferred_enterprise_id" } }
+      .alert-box.warning{ ng: { hide: "stripe_account.status" } }
+        = t(".loading_account_information_msg")
+
+      .alert-box.error{ ng: { show: "stripe_account.status == 'request_failed'" } }
+        = t(".request_failed_msg")
+
+      .alert-box.error{ ng: { show: "stripe_account.status == 'account_missing'" } }
+        = t(".account_missing_msg")
+        %a.button{ ng: { href: "{{current_enterprise_stripe_path()}}" }, target: 'blank' }
+          = t(".connect_one")
+          %i.icon-chevron-right
+
+      .alert-box.error{ ng: { show: "stripe_account.status == 'access_revoked'" } }
+        = t(".access_revoked_msg")
+
+      .alert-box.ok{ ng: { show: "stripe_account.status == 'connected'" } }
+        .status
+          %strong= t(".status") + ":"
+          = t(".connected")
+          %i.icon-ok
+        .account_id
+          %strong= t(".account_id") + ":"
+          {{ stripe_account.id }}
+        .business_name
+          %strong= t(".business_name") + ":"
+          {{ stripe_account.business_name }}
+        .charges_enabled
+          %strong= t(".charges_enabled") + ":"
+          {{ stripe_account.charges_enabled ? "say_yes" : "say_no" | t }}
diff --git a/config/locales/en.yml b/config/locales/en.yml
index b4581f6236..c36dabec76 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -657,6 +657,7 @@ en:
     producer_properties:
       index:
         title: Producer Properties
+
     shared:
       user_guide_link:
         user_guide: User Guide
@@ -2060,6 +2061,19 @@ Please follow the instructions there to make your enterprise visible on the Open
             one: "You have one active order cycle."
             other: "You have %{count} active order cycles."
           manage_order_cycles: "MANAGE ORDER CYCLES"
+      payment_methods:
+        stripe_connect:
+          enterprise_select_placeholder: Choose...
+          loading_account_information_msg: Loading account information from stripe, please wait...
+          request_failed_msg: Sorry. Something went wrong when trying to verify account details with Stripe...
+          account_missing_msg: No Stripe account exists for this enterprise.
+          connect_one: Connect One
+          access_revoked_msg: Access to this Stripe account has been revoked, please reconnect your account.
+          status: Status
+          connected: Connected
+          account_id: Account ID
+          business_name: Business Name
+          charges_enabled: Charges Enabled
       products:
         new:
           title: 'New Product'
diff --git a/spec/features/admin/payment_method_spec.rb b/spec/features/admin/payment_method_spec.rb
index 45703a4d07..68f1d0035c 100644
--- a/spec/features/admin/payment_method_spec.rb
+++ b/spec/features/admin/payment_method_spec.rb
@@ -29,6 +29,41 @@ feature %q{
       payment_method = Spree::PaymentMethod.find_by_name('Cheque payment method')
       payment_method.distributors.should == [@distributors[0]]
     end
+
+    context "using stripe connect" do
+      let(:user) { create(:user, enterprise_limit: 5) }
+      let!(:connected_enterprise) { create(:distributor_enterprise, name: "Connected", owner: user) }
+      let!(:revoked_account_enterprise) { create(:distributor_enterprise, name: "Revoked", owner: user) }
+      let!(:missing_account_enterprise) { create(:distributor_enterprise, name: "Missing", owner: user) }
+      let!(:valid_stripe_account) { create(:stripe_account, enterprise: connected_enterprise, stripe_user_id: "acc_connected123") }
+      let!(:disconnected_stripe_account) { create(:stripe_account, enterprise: revoked_account_enterprise, stripe_user_id: "acc_revoked123") }
+      let!(:stripe_account_mock) { { id: "acc_connected123", business_name: "My Org", charges_enabled: true } }
+
+      before do
+        Stripe.api_key = "sk_test_12345"
+        stub_request(:get, "https://api.stripe.com/v1/accounts/acc_connected123").to_return(body: JSON.generate(stripe_account_mock))
+        stub_request(:get, "https://api.stripe.com/v1/accounts/acc_revoked123").to_return(status: 404)
+      end
+
+      it "communicates the status of the stripe connection to the user" do
+        login_as user
+        visit spree.new_admin_payment_method_path
+
+        select2_select "Stripe", from: "payment_method_type"
+
+        select2_select "Missing", from: "payment_method_preferred_enterprise_id"
+        expect(page).to have_selector "#stripe-account-status .alert-box.error", text: I18n.t("spree.admin.payment_methods.stripe_connect.account_missing_msg")
+
+        select2_select "Revoked", from: "payment_method_preferred_enterprise_id"
+        expect(page).to have_selector "#stripe-account-status .alert-box.error", text: I18n.t("spree.admin.payment_methods.stripe_connect.access_revoked_msg")
+
+        select2_select "Connected", from: "payment_method_preferred_enterprise_id"
+        expect(page).to have_selector "#stripe-account-status .status", text: "Status: Connected"
+        expect(page).to have_selector "#stripe-account-status .account_id", text: "Account ID: acc_connected123"
+        expect(page).to have_selector "#stripe-account-status .business_name", text: "Business Name: My Org"
+        expect(page).to have_selector "#stripe-account-status .charges_enabled", text: "Charges Enabled: Yes"
+      end
+    end
   end
 
   scenario "updating a payment method", js: true do

From 5c16fefe41afa758f56f77f75ade2d0f2be36e2f Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Tue, 21 Feb 2017 12:25:51 +1100
Subject: [PATCH 176/353] Creating basic angular StripeJS wrapper service for
 requesting tokens

---
 .../checkout/checkout_controller.js.coffee    |  2 +-
 .../darkswarm/services/checkout.js.coffee     | 20 ++++-
 .../darkswarm/services/stripe.js.coffee       | 36 +++++++++
 .../checkout_controller_spec.js.coffee        |  7 +-
 .../services/checkout_spec.js.coffee          | 76 ++++++++++++++-----
 .../darkswarm/services/stripe_spec.js.coffee  | 47 ++++++++++++
 6 files changed, 162 insertions(+), 26 deletions(-)
 create mode 100644 app/assets/javascripts/darkswarm/services/stripe.js.coffee
 create mode 100644 spec/javascripts/unit/darkswarm/services/stripe_spec.js.coffee

diff --git a/app/assets/javascripts/darkswarm/controllers/checkout/checkout_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/checkout/checkout_controller.js.coffee
index 8a4f187773..3397077a00 100644
--- a/app/assets/javascripts/darkswarm/controllers/checkout/checkout_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/checkout/checkout_controller.js.coffee
@@ -22,6 +22,6 @@ Darkswarm.controller "CheckoutCtrl", ($scope, localStorageService, Checkout, Cur
     event.preventDefault()
     $scope.submitted = true
     if form.$valid
-      $scope.Checkout.submit()
+      $scope.Checkout.purchase()
     else
       $scope.$broadcast 'purchaseFormInvalid', form
diff --git a/app/assets/javascripts/darkswarm/services/checkout.js.coffee b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
index 8f43b783a2..8df1caf754 100644
--- a/app/assets/javascripts/darkswarm/services/checkout.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
@@ -1,10 +1,16 @@
-Darkswarm.factory 'Checkout', (CurrentOrder, ShippingMethods, PaymentMethods, $http, Navigation, CurrentHub, RailsFlashLoader, Loading)->
+Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeJS, PaymentMethods, $http, Navigation, CurrentHub, RailsFlashLoader, Loading)->
   new class Checkout
     errors: {}
     secrets: {}
     order: CurrentOrder.order
 
-    submit: ->
+    purchase: ->
+      if @paymentMethod()?.method_type == 'stripe'
+        StripeJS.requestToken(@secrets, @submit)
+      else
+        @submit()
+
+    submit: =>
       Loading.message = t 'submitting_order'
       $http.put('/checkout', {order: @preprocess()}).success (data, status)=>
         Navigation.go data.path
@@ -53,6 +59,16 @@ Darkswarm.factory 'Checkout', (CurrentOrder, ShippingMethods, PaymentMethods, $h
             last_name: @order.bill_address.lastname
         }
 
+      if @paymentMethod()?.method_type == 'stripe'
+        angular.extend munged_order.payments_attributes[0], {
+          source_attributes:
+            gateway_payment_profile_id: @secrets.token
+            cc_type: @secrets.cc_type
+            last_digits: @secrets.card.last4
+            month: @secrets.card.exp_month
+            year: @secrets.card.exp_year
+        }
+
       munged_order
 
     shippingMethod: ->
diff --git a/app/assets/javascripts/darkswarm/services/stripe.js.coffee b/app/assets/javascripts/darkswarm/services/stripe.js.coffee
new file mode 100644
index 0000000000..706be74300
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/services/stripe.js.coffee
@@ -0,0 +1,36 @@
+Darkswarm.factory 'StripeJS', ($rootScope, Loading, RailsFlashLoader) ->
+  new class StripeJS
+    requestToken: (secrets, submit) ->
+      Loading.message = "Processing Payment..."
+      params =
+        number: secrets.card_number
+        cvc: secrets.card_verification_value
+        exp_month: secrets.card_month or 0
+        exp_year: secrets.card_year or 0
+
+      # This is the global Stripe object created by Stripe.js, included in the _stripe partial
+      Stripe.card.createToken params, (status, response) =>
+        if response.error
+          $rootScope.$apply ->
+            Loading.clear()
+            RailsFlashLoader.loadFlash({error: "Error: #{response.error.message}"})
+        else
+          secrets.token = response['id']
+          secrets.cc_type = @mapCC(response.card.brand)
+          secrets.card = response.card
+          submit()
+
+    mapCC: (ccType) ->
+      if ccType == 'MasterCard'
+        return 'mastercard'
+      else if ccType == 'Visa'
+        return 'visa'
+      else if ccType == 'American Express'
+        return 'amex'
+      else if ccType == 'Discover'
+        return 'discover'
+      else if ccType == 'Diners Club'
+        return 'dinersclub'
+      else if ccType == 'JCB'
+        return 'jcb'
+      return
diff --git a/spec/javascripts/unit/darkswarm/controllers/checkout/checkout_controller_spec.js.coffee b/spec/javascripts/unit/darkswarm/controllers/checkout/checkout_controller_spec.js.coffee
index f3ad508c4d..75d6fd8d36 100644
--- a/spec/javascripts/unit/darkswarm/controllers/checkout/checkout_controller_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/controllers/checkout/checkout_controller_spec.js.coffee
@@ -16,6 +16,7 @@ describe "CheckoutCtrl", ->
       $provide.value "CurrentHub", CurrentHubMock
       null
     Checkout =
+      purchase: ->
       submit: ->
       navigate: ->
       bindFieldsToLocalStorage: ->
@@ -42,17 +43,17 @@ describe "CheckoutCtrl", ->
         preventDefault: ->
 
       beforeEach ->
-        spyOn(Checkout, "submit")
+        spyOn(Checkout, "purchase")
         scope.submitted = false
 
       it "delegates to the service when valid", ->
         scope.purchase(event, {$valid: true})
-        expect(Checkout.submit).toHaveBeenCalled()
+        expect(Checkout.purchase).toHaveBeenCalled()
         expect(scope.submitted).toBe(true)
 
       it "does nothing when invalid", ->
         scope.purchase(event, {$valid: false})
-        expect(Checkout.submit).not.toHaveBeenCalled()
+        expect(Checkout.purchase).not.toHaveBeenCalled()
         expect(scope.submitted).toBe(true)
 
     it "is enabled", ->
diff --git a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
index 78fd10f054..95ee9e8416 100644
--- a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
@@ -15,6 +15,11 @@ describe 'Checkout service', ->
       id: 123
       test: "bar"
       method_type: "check"
+    },
+    {
+      id: 666
+      test: "qux"
+      method_type: "stripe"
     }]
   shippingMethods = [
     {
@@ -46,6 +51,7 @@ describe 'Checkout service', ->
       $provide.value "currentOrder", orderData
       $provide.value "shippingMethods", shippingMethods
       $provide.value "paymentMethods", paymentMethods
+      $provide.value "StripeInstancePublishableKey", "instance_publishable_key"
       null
 
     inject ($injector, _$httpBackend_, $rootScope)->
@@ -83,31 +89,41 @@ describe 'Checkout service', ->
     Checkout.order.payment_method_id = 99
     expect(Checkout.paymentMethod()).toEqual paymentMethods[0]
 
-  it "Posts the Checkout to the server", ->
-    $httpBackend.expectPUT("/checkout", {order: Checkout.preprocess()}).respond 200, {path: "test"}
-    Checkout.submit()
-    $httpBackend.flush()
-
-  describe "when there is an error", ->
-    it "redirects when a redirect is given", ->
-      $httpBackend.expectPUT("/checkout").respond 400, {path: 'path'}
+  describe "submitting", ->
+    it "Posts the Checkout to the server", ->
+      $httpBackend.expectPUT("/checkout", {order: Checkout.preprocess()}).respond 200, {path: "test"}
       Checkout.submit()
       $httpBackend.flush()
-      expect(Navigation.go).toHaveBeenCalledWith 'path'
 
-    it "sends flash messages to the flash service", ->
-      spyOn(FlashLoaderMock, "loadFlash") # Stubbing out writes to window.location
-      $httpBackend.expectPUT("/checkout").respond 400, {flash: {error: "frogs"}}
-      Checkout.submit()
+    describe "when there is an error", ->
+      it "redirects when a redirect is given", ->
+        $httpBackend.expectPUT("/checkout").respond 400, {path: 'path'}
+        Checkout.submit()
+        $httpBackend.flush()
+        expect(Navigation.go).toHaveBeenCalledWith 'path'
 
-      $httpBackend.flush()
-      expect(FlashLoaderMock.loadFlash).toHaveBeenCalledWith {error: "frogs"}
+      it "sends flash messages to the flash service", ->
+        spyOn(FlashLoaderMock, "loadFlash") # Stubbing out writes to window.location
+        $httpBackend.expectPUT("/checkout").respond 400, {flash: {error: "frogs"}}
+        Checkout.submit()
 
-    it "puts errors into the scope", ->
-      $httpBackend.expectPUT("/checkout").respond 400, {errors: {error: "frogs"}}
-      Checkout.submit()
-      $httpBackend.flush()
-      expect(Checkout.errors).toEqual {error: "frogs"}
+        $httpBackend.flush()
+        expect(FlashLoaderMock.loadFlash).toHaveBeenCalledWith {error: "frogs"}
+
+      it "puts errors into the scope", ->
+        $httpBackend.expectPUT("/checkout").respond 400, {errors: {error: "frogs"}}
+        Checkout.submit()
+        $httpBackend.flush()
+        expect(Checkout.errors).toEqual {error: "frogs"}
+
+    describe "when using the Stripe Connect gateway", ->
+      beforeEach inject ($injector, StripeJS) ->
+        Checkout.order.payment_method_id = 666
+
+      it "requests a Stripe token before submitting", inject (StripeJS) ->
+        spyOn(StripeJS, "requestToken")
+        Checkout.purchase()
+        expect(StripeJS.requestToken).toHaveBeenCalled()
 
   describe "data preprocessing", ->
     beforeEach ->
@@ -155,3 +171,23 @@ describe 'Checkout service', ->
       Checkout.order.payment_method_id = 123
       source_attributes = Checkout.preprocess().payments_attributes[0].source_attributes
       expect(source_attributes).not.toBeDefined()
+
+    describe "when the payment method is the Stripe Connect gateway", ->
+      beforeEach ->
+        Checkout.order.payment_method_id = 666
+        Checkout.secrets =
+          token: "stripe_token"
+          cc_type: "mastercard"
+          card:
+            last4: "1234"
+            exp_year: "2099"
+            exp_month: "10"
+
+      it "creates source attributes for the submitted card", ->
+        source_attributes = Checkout.preprocess().payments_attributes[0].source_attributes
+        expect(source_attributes).toBeDefined()
+        expect(source_attributes.gateway_payment_profile_id).toBe "stripe_token"
+        expect(source_attributes.cc_type).toBe "mastercard"
+        expect(source_attributes.last_digits).toBe "1234"
+        expect(source_attributes.year).toBe "2099"
+        expect(source_attributes.month).toBe "10"
diff --git a/spec/javascripts/unit/darkswarm/services/stripe_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/stripe_spec.js.coffee
new file mode 100644
index 0000000000..1cf883b316
--- /dev/null
+++ b/spec/javascripts/unit/darkswarm/services/stripe_spec.js.coffee
@@ -0,0 +1,47 @@
+describe 'StripeJS Service', ->
+  $httpBackend = StripeJS = null
+  StripeMock = { card: {} }
+
+  beforeEach ->
+    module 'Darkswarm'
+    module ($provide) ->
+      $provide.value "railsFlash", null
+      null
+
+    inject (_StripeJS_, _$httpBackend_) ->
+      $httpBackend = _$httpBackend_
+      StripeJS = _StripeJS_
+
+  describe "requestToken", ->
+    secrets = {}
+    submit = null
+    response = null
+
+    beforeEach inject ($window) ->
+      $window.Stripe = StripeMock
+
+    describe "with satifactory data", ->
+      beforeEach ->
+        submit = jasmine.createSpy()
+        response = { id: "token", card: { brand: 'MasterCard', last4: "5678", exp_month: 10, exp_year: 2099 } }
+        StripeMock.card.createToken = (params, callback) => callback(200, response)
+
+      it "saves the response data to secrets, and submits the form", ->
+        StripeJS.requestToken(secrets, submit)
+        expect(secrets.token).toEqual "token"
+        expect(secrets.cc_type).toEqual "mastercard"
+        expect(submit).toHaveBeenCalled()
+
+    describe "with unsatifactory data", ->
+      beforeEach ->
+        submit = jasmine.createSpy()
+        response = { id: "token", error: { message: 'There was a problem' } }
+        StripeMock.card.createToken = (params, callback) => callback(400, response)
+
+      it "doesn't submit the form, shows an error message instead", inject (Loading, RailsFlashLoader) ->
+        spyOn(Loading, "clear")
+        spyOn(RailsFlashLoader, "loadFlash")
+        StripeJS.requestToken(secrets, submit)
+        expect(submit).not.toHaveBeenCalled()
+        expect(Loading.clear).toHaveBeenCalled()
+        expect(RailsFlashLoader.loadFlash).toHaveBeenCalledWith({error: "Error: There was a problem"})

From 7c831c9844be72841647683d9c582b1090037161 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 22 Feb 2017 10:47:31 +1100
Subject: [PATCH 177/353] Adding StripeJS to checkout page

Allow tokens to be request and passed through as payment source_attributes
---
 app/models/spree/credit_card_decorator.rb     |  9 +++
 app/views/layouts/darkswarm.html.haml         |  1 +
 .../spree/checkout/payment/_stripe.html.haml  |  4 ++
 spec/requests/stripe_connect_checkout_spec.rb | 61 +++++++++++++++++++
 4 files changed, 75 insertions(+)
 create mode 100644 app/models/spree/credit_card_decorator.rb
 create mode 100644 app/views/spree/checkout/payment/_stripe.html.haml
 create mode 100644 spec/requests/stripe_connect_checkout_spec.rb

diff --git a/app/models/spree/credit_card_decorator.rb b/app/models/spree/credit_card_decorator.rb
new file mode 100644
index 0000000000..6826aaeebe
--- /dev/null
+++ b/app/models/spree/credit_card_decorator.rb
@@ -0,0 +1,9 @@
+Spree::CreditCard.class_eval do
+  # Allows us to use a gateway_payment_profile_id to store Stripe Tokens
+  # Should be able to remove once we reach Spree v2.2.0
+  # Commit: https://github.com/spree/spree/commit/5a4d690ebc64b264bf12904a70187e7a8735ef3f
+  # See also: https://github.com/spree/spree_gateway/issues/111
+  def has_payment_profile?
+    gateway_customer_profile_id.present? || gateway_payment_profile_id.present?
+  end
+end
diff --git a/app/views/layouts/darkswarm.html.haml b/app/views/layouts/darkswarm.html.haml
index 298083425c..29019fb848 100644
--- a/app/views/layouts/darkswarm.html.haml
+++ b/app/views/layouts/darkswarm.html.haml
@@ -13,6 +13,7 @@
     %link{href: "https://fonts.googleapis.com/css?family=Roboto:400,300italic,400italic,300,700,700italic|Oswald:300,400,700", rel: "stylesheet", type: "text/css"}
 
     = yield :scripts
+    %script{:src => "https://js.stripe.com/v2/", :type => "text/javascript"}
     %script{src: "//maps.googleapis.com/maps/api/js?libraries=places,geometry#{ ENV['GOOGLE_MAPS_API_KEY'] ? '&key=' + ENV['GOOGLE_MAPS_API_KEY'] : ''} "}
     = split_stylesheet_link_tag "darkswarm/all"
     = javascript_include_tag "darkswarm/all"
diff --git a/app/views/spree/checkout/payment/_stripe.html.haml b/app/views/spree/checkout/payment/_stripe.html.haml
new file mode 100644
index 0000000000..ed69bdb1cd
--- /dev/null
+++ b/app/views/spree/checkout/payment/_stripe.html.haml
@@ -0,0 +1,4 @@
+= render "spree/checkout/payment/gateway", payment_method: payment_method
+
+:javascript
+  Stripe.setPublishableKey("#{ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']}")
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
new file mode 100644
index 0000000000..cd4ff0ed19
--- /dev/null
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -0,0 +1,61 @@
+require 'spec_helper'
+
+describe "Submitting Stripe Connect charge requests", type: :request do
+  include ShopWorkflow
+
+  let!(:order_cycle) { create(:simple_order_cycle) }
+  let!(:enterprise) { create(:distributor_enterprise) }
+  let!(:exchange) { create(:exchange, order_cycle: order_cycle, sender: order_cycle.coordinator, receiver: enterprise, incoming: false, pickup_time: "Monday")}
+  let!(:shipping_method) { create(:shipping_method, distributors: [enterprise] ) }
+  let!(:payment_method) { create(:payment_method, type: "Spree::Gateway::StripeConnect", distributors: [enterprise]) }
+  let!(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
+  let!(:line_item) { create(:line_item, price: 12.34) }
+  let!(:order) { line_item.order }
+  let(:address) { create(:address) }
+  let(:token) { "token123" }
+  let(:params) { { order: {
+      shipping_method_id: shipping_method.id,
+      payments_attributes: [{payment_method_id: payment_method.id, source_attributes: { gateway_payment_profile_id: token, cc_type: "visa", last_digits: "4242", month: 7, year:2017 }}],
+      bill_address_attributes: address.attributes.slice("firstname","lastname","address1","address2","phone","city","zipcode","state_id","country_id"),
+      ship_address_attributes: address.attributes.slice("firstname","lastname","address1","address2","phone","city","zipcode","state_id","country_id")
+  } } }
+
+  before do
+    Stripe.api_key = "sk_test_123456"
+    order.update_attributes(distributor_id: enterprise.id, order_cycle_id: order_cycle.id)
+    order.reload.update_totals
+    set_order order
+  end
+
+  context "when the charge request is accepted" do
+    let(:response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
+
+    before do
+      stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+      .with { |request| request.body.starts_with?("card=#{token}") }
+      .to_return(body: JSON.generate(response_mock))
+    end
+
+    it "should process the payment" do
+      put update_checkout_path, params
+      expect(response).to redirect_to(spree.order_path(order))
+      expect(order.payments.completed.count).to be 1
+    end
+  end
+
+  context "when the charge request returns an error message" do
+    let(:response_mock) { { error: { message: "Bup-bow..."} } }
+
+    before do
+      stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+      .with { |request| request.body.starts_with?("card=#{token}") }
+      .to_return(body: JSON.generate(response_mock))
+    end
+
+    it "should not process the payment" do
+      put update_checkout_path, params
+      expect(response).to render_template(:edit)
+      expect(order.payments.completed.count).to be 0
+    end
+  end
+end

From c97a14047184d7ca4cd8f7df156f9558efba9b36 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 23 Feb 2017 17:53:33 +1100
Subject: [PATCH 178/353] WIP: Storing Stripe card details for later use

NOTE: No interface for actually selecting a stored card to use yet
---
 app/models/spree/gateway/stripe_connect.rb    | 33 ++++++---
 app/models/spree/payment_decorator.rb         |  9 +++
 .../spree/gateway/stripe_connect_spec.rb      | 69 +++++++++++++++++++
 3 files changed, 102 insertions(+), 9 deletions(-)
 create mode 100644 spec/models/spree/gateway/stripe_connect_spec.rb

diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index 2e5104e346..ca62c4a8fe 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -91,15 +91,8 @@ module Spree
       options[:currency] = gateway_options[:currency]
       options[:stripe_account] = stripe_account_id
 
-      if customer = creditcard.gateway_customer_profile_id
-        options[:customer] = customer
-      end
-      if token_or_card_id = creditcard.gateway_payment_profile_id
-        # The Stripe ActiveMerchant gateway supports passing the token directly as the creditcard parameter
-        # The Stripe ActiveMerchant gateway supports passing the customer_id and credit_card id
-        # https://github.com/Shopify/active_merchant/issues/770
-        creditcard = token_or_card_id
-      end
+      creditcard = token_from_card_profile_ids(creditcard)
+
       return money, creditcard, options
     end
 
@@ -128,5 +121,27 @@ module Spree
       source.cc_type = CARD_TYPE_MAPPING[source.cc_type] if CARD_TYPE_MAPPING.include?(source.cc_type)
       source
     end
+
+    def token_from_card_profile_ids(creditcard)
+      if token_or_card_id = creditcard.gateway_payment_profile_id
+        if customer = creditcard.gateway_customer_profile_id
+          # Assume the gateway_payment_profile_id is a Stripe card_id
+          # So generate a new token, using the customer_id and card_id
+          return tokenize_instance_customer_card(customer, token_or_card_id)
+        end
+
+        # Assume the gateway_payment_profile_id is a token generated by StripeJS
+        return token_or_card_id
+      end
+    end
+
+    def tokenize_instance_customer_card(customer, card)
+      begin
+        token = Stripe::Token.create({card: card, customer: customer}, { stripe_account: stripe_account_id})
+        token.id
+      rescue Stripe::InvalidRequestError
+        # Not really sure what to do here....
+      end
+    end
   end
 end
diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index 0c87468034..715be6e670 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -80,5 +80,14 @@ module Spree
       refund_amount ||= credit_allowed >= order.outstanding_balance.abs ? order.outstanding_balance.abs : credit_allowed.abs
       refund_amount.to_f
     end
+
+    def create_payment_profile
+      return unless source.is_a?(CreditCard) &&
+        (source.number || source.gateway_payment_profile_id) &&
+          source.gateway_customer_profile_id.nil?
+      payment_method.create_profile(self)
+    rescue ActiveMerchant::ConnectionError => e
+      gateway_error e
+    end
   end
 end
diff --git a/spec/models/spree/gateway/stripe_connect_spec.rb b/spec/models/spree/gateway/stripe_connect_spec.rb
new file mode 100644
index 0000000000..56cd7e6e41
--- /dev/null
+++ b/spec/models/spree/gateway/stripe_connect_spec.rb
@@ -0,0 +1,69 @@
+require 'spec_helper'
+
+describe Spree::Gateway::StripeConnect, type: :model do
+  let(:provider) do
+    double('provider').tap do |p|
+      p.stub(:purchase)
+      p.stub(:authorize)
+      p.stub(:capture)
+    end
+  end
+
+  before do
+    Stripe.api_key = "sk_test_123456"
+    subject.stub(:options_for_purchase_or_auth).and_return(['money','cc','opts'])
+    subject.stub(:provider).and_return provider
+  end
+
+  describe "#token_from_card_profile_ids" do
+    let(:creditcard) { double(:creditcard) }
+    context "when the credit card provided has a gateway_payment_profile_id" do
+      before do
+        allow(creditcard).to receive(:gateway_payment_profile_id) { "token_or_card_id123" }
+        allow(subject).to receive(:tokenize_instance_customer_card) { "tokenized" }
+      end
+
+      context "when the credit card provided has a gateway_customer_profile_id" do
+        before { allow(creditcard).to receive(:gateway_customer_profile_id) { "customer_id123" } }
+
+        it "requests a new token via tokenize_instance_customer_card" do
+          result = subject.send(:token_from_card_profile_ids, creditcard)
+          expect(result).to eq "tokenized"
+        end
+      end
+
+      context "when the credit card provided does not have a gateway_customer_profile_id" do
+        before { allow(creditcard).to receive(:gateway_customer_profile_id) { nil } }
+        it "returns the gateway_payment_profile_id (assumed to be a token already)" do
+          result = subject.send(:token_from_card_profile_ids, creditcard)
+          expect(result).to eq "token_or_card_id123"
+        end
+      end
+    end
+
+    context "when the credit card provided does not have a gateway_payment_profile_id" do
+      before { allow(creditcard).to receive(:gateway_payment_profile_id) { nil } }
+
+      it "returns nil....?" do
+        result = subject.send(:token_from_card_profile_ids, creditcard)
+        expect(result).to be nil
+      end
+    end
+  end
+
+  describe "#tokenize_instance_customer_card" do
+    let(:customer_id) { "customer123" }
+    let(:card_id) { "card123" }
+    let(:token_mock) { { id: "test_token123" } }
+
+    before do
+      stub_request(:post, "https://api.stripe.com/v1/tokens")
+      .with(body: { "card"=>"card123", "customer"=>"customer123"})
+      .to_return(body: JSON.generate(token_mock))
+    end
+
+    it "requests a new token for the customer and card from Stripe, and returns the id of the response" do
+      expect(subject.send(:tokenize_instance_customer_card, customer_id, card_id)).to eq token_mock[:id]
+    end
+  end
+end

From 3b05b76b80ba47044a6f456add2e57bea14f8aa4 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 26 Feb 2017 21:52:12 +0000
Subject: [PATCH 179/353] Bring in ability to store CreditCards against Users
 from Spree 2.3 (spree commit d470b31798f3).

---
 app/models/spree/credit_card_decorator.rb     |   3 +
 app/models/spree/payment_decorator.rb         |   9 ++
 app/models/spree/payment_method_decorator.rb  |   1 +
 ...03658_add_user_id_to_spree_credit_cards.rb |  13 ++
 db/schema.rb                                  | 121 +++++++++---------
 5 files changed, 89 insertions(+), 58 deletions(-)
 create mode 100644 db/migrate/20170225203658_add_user_id_to_spree_credit_cards.rb

diff --git a/app/models/spree/credit_card_decorator.rb b/app/models/spree/credit_card_decorator.rb
index 6826aaeebe..ee3c8aca60 100644
--- a/app/models/spree/credit_card_decorator.rb
+++ b/app/models/spree/credit_card_decorator.rb
@@ -3,6 +3,9 @@ Spree::CreditCard.class_eval do
   # Should be able to remove once we reach Spree v2.2.0
   # Commit: https://github.com/spree/spree/commit/5a4d690ebc64b264bf12904a70187e7a8735ef3f
   # See also: https://github.com/spree/spree_gateway/issues/111
+
+  belongs_to :payment_method
+
   def has_payment_profile?
     gateway_customer_profile_id.present? || gateway_payment_profile_id.present?
   end
diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index 715be6e670..d9b421573f 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -73,6 +73,15 @@ module Spree
       end
     end
 
+    # Import from future Spree
+    def build_source
+      return if source_attributes.nil?
+      if payment_method and payment_method.payment_source_class
+        self.source = payment_method.payment_source_class.new(source_attributes)
+        self.source.payment_method_id = payment_method.id
+        self.source.user_id = self.order.user_id if self.order
+      end
+    end
 
     private
 
diff --git a/app/models/spree/payment_method_decorator.rb b/app/models/spree/payment_method_decorator.rb
index 07395f22de..2d65797d29 100644
--- a/app/models/spree/payment_method_decorator.rb
+++ b/app/models/spree/payment_method_decorator.rb
@@ -6,6 +6,7 @@ Spree::PaymentMethod.class_eval do
   acts_as_taggable
 
   has_and_belongs_to_many :distributors, join_table: 'distributors_payment_methods', :class_name => 'Enterprise', association_foreign_key: 'distributor_id'
+  has_many :credit_cards, class_name: "Spree::CreditCard" # from future Spree version
 
   attr_accessible :distributor_ids, :tag_list
 
diff --git a/db/migrate/20170225203658_add_user_id_to_spree_credit_cards.rb b/db/migrate/20170225203658_add_user_id_to_spree_credit_cards.rb
new file mode 100644
index 0000000000..837343be7d
--- /dev/null
+++ b/db/migrate/20170225203658_add_user_id_to_spree_credit_cards.rb
@@ -0,0 +1,13 @@
+class AddUserIdToSpreeCreditCards < ActiveRecord::Migration
+  def change
+    unless Spree::CreditCard.column_names.include? "user_id"
+      add_column :spree_credit_cards, :user_id, :integer
+      add_index :spree_credit_cards, :user_id
+    end
+
+    unless Spree::CreditCard.column_names.include? "payment_method_id"
+      add_column :spree_credit_cards, :payment_method_id, :integer
+      add_index :spree_credit_cards, :payment_method_id
+    end
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 24eb666244..96afbe1b59 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -123,8 +123,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "distributors_shipping_methods", :force => true do |t|
     t.integer  "distributor_id"
     t.integer  "shipping_method_id"
-    t.datetime "created_at",         :null => false
-    t.datetime "updated_at",         :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   add_index "distributors_shipping_methods", ["distributor_id"], :name => "index_distributors_shipping_methods_on_distributor_id"
@@ -134,8 +134,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "enterprise_id"
     t.string   "fee_type"
     t.string   "name"
-    t.datetime "created_at",                               :null => false
-    t.datetime "updated_at",                               :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.integer  "tax_category_id"
     t.boolean  "inherits_tax_category", :default => false, :null => false
   end
@@ -221,8 +221,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "address_id"
     t.string   "pickup_times"
     t.string   "next_collection_at"
-    t.datetime "created_at",                                   :null => false
-    t.datetime "updated_at",                                   :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.text     "distributor_info"
     t.string   "logo_file_name"
     t.string   "logo_content_type"
@@ -265,8 +265,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "exchange_fees", :force => true do |t|
     t.integer  "exchange_id"
     t.integer  "enterprise_fee_id"
-    t.datetime "created_at",        :null => false
-    t.datetime "updated_at",        :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   add_index "exchange_fees", ["enterprise_fee_id"], :name => "index_exchange_fees_on_enterprise_fee_id"
@@ -275,8 +275,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "exchange_variants", :force => true do |t|
     t.integer  "exchange_id"
     t.integer  "variant_id"
-    t.datetime "created_at",  :null => false
-    t.datetime "updated_at",  :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   add_index "exchange_variants", ["exchange_id"], :name => "index_exchange_variants_on_exchange_id"
@@ -289,8 +289,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "payment_enterprise_id"
     t.string   "pickup_time"
     t.string   "pickup_instructions"
-    t.datetime "created_at",                               :null => false
-    t.datetime "updated_at",                               :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.boolean  "incoming",              :default => false, :null => false
     t.string   "receival_instructions"
   end
@@ -315,8 +315,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.datetime "orders_open_at"
     t.datetime "orders_close_at"
     t.integer  "coordinator_id"
-    t.datetime "created_at",      :null => false
-    t.datetime "updated_at",      :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   create_table "producer_properties", :force => true do |t|
@@ -382,8 +382,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "alternative_phone"
     t.integer  "state_id"
     t.integer  "country_id"
-    t.datetime "created_at",        :null => false
-    t.datetime "updated_at",        :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.string   "company"
     t.float    "latitude"
     t.float    "longitude"
@@ -398,8 +398,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "label"
     t.string   "source_type"
     t.integer  "adjustable_id"
-    t.datetime "created_at",                                                       :null => false
-    t.datetime "updated_at",                                                       :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.boolean  "mandatory"
     t.integer  "originator_id"
     t.string   "originator_type"
@@ -432,8 +432,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "type"
     t.integer  "calculable_id",   :null => false
     t.string   "calculable_type", :null => false
-    t.datetime "created_at",      :null => false
-    t.datetime "updated_at",      :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   create_table "spree_configurations", :force => true do |t|
@@ -469,8 +469,13 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.datetime "updated_at",                  :null => false
     t.string   "gateway_customer_profile_id"
     t.string   "gateway_payment_profile_id"
+    t.integer  "user_id"
+    t.integer  "payment_method_id"
   end
 
+  add_index "spree_credit_cards", ["payment_method_id"], :name => "index_spree_credit_cards_on_payment_method_id"
+  add_index "spree_credit_cards", ["user_id"], :name => "index_spree_credit_cards_on_user_id"
+
   create_table "spree_gateways", :force => true do |t|
     t.string   "type"
     t.string   "name"
@@ -488,8 +493,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "state"
     t.integer  "variant_id"
     t.integer  "order_id"
-    t.datetime "created_at",                             :null => false
-    t.datetime "updated_at",                             :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.integer  "shipment_id"
     t.integer  "return_authorization_id"
   end
@@ -503,8 +508,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "variant_id"
     t.integer  "quantity",                                            :null => false
     t.decimal  "price",                :precision => 8,  :scale => 2, :null => false
-    t.datetime "created_at",                                          :null => false
-    t.datetime "updated_at",                                          :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.integer  "max_quantity"
     t.string   "currency"
     t.decimal  "distribution_fee",     :precision => 10, :scale => 2
@@ -519,8 +524,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "source_id"
     t.string   "source_type"
     t.text     "details"
-    t.datetime "created_at",  :null => false
-    t.datetime "updated_at",  :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   create_table "spree_mail_methods", :force => true do |t|
@@ -533,8 +538,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "spree_option_types", :force => true do |t|
     t.string   "name",         :limit => 100
     t.string   "presentation", :limit => 100
-    t.datetime "created_at",                                 :null => false
-    t.datetime "updated_at",                                 :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.integer  "position",                    :default => 0, :null => false
   end
 
@@ -548,8 +553,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "name"
     t.string   "presentation"
     t.integer  "option_type_id"
-    t.datetime "created_at",     :null => false
-    t.datetime "updated_at",     :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   create_table "spree_option_values_line_items", :id => false, :force => true do |t|
@@ -574,8 +579,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "state"
     t.decimal  "adjustment_total",                   :precision => 10, :scale => 2, :default => 0.0, :null => false
     t.integer  "user_id"
-    t.datetime "created_at",                                                                         :null => false
-    t.datetime "updated_at",                                                                         :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.datetime "completed_at"
     t.integer  "bill_address_id"
     t.integer  "ship_address_id"
@@ -602,8 +607,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.text     "description"
     t.boolean  "active",      :default => true
     t.string   "environment", :default => "development"
-    t.datetime "created_at",                             :null => false
-    t.datetime "updated_at",                             :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.datetime "deleted_at"
     t.string   "display_on"
   end
@@ -611,8 +616,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "spree_payments", :force => true do |t|
     t.decimal  "amount",               :precision => 10, :scale => 2, :default => 0.0, :null => false
     t.integer  "order_id"
-    t.datetime "created_at",                                                           :null => false
-    t.datetime "updated_at",                                                           :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.integer  "source_id"
     t.string   "source_type"
     t.integer  "payment_method_id"
@@ -656,8 +661,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
 
   create_table "spree_preferences", :force => true do |t|
     t.text     "value"
-    t.datetime "created_at", :null => false
-    t.datetime "updated_at", :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.string   "key"
     t.string   "value_type"
   end
@@ -690,8 +695,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "position"
     t.integer  "product_id"
     t.integer  "option_type_id"
-    t.datetime "created_at",     :null => false
-    t.datetime "updated_at",     :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   create_table "spree_product_properties", :force => true do |t|
@@ -724,8 +729,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "meta_keywords"
     t.integer  "tax_category_id"
     t.integer  "shipping_category_id"
-    t.datetime "created_at",                              :null => false
-    t.datetime "updated_at",                              :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.integer  "count_on_hand",        :default => 0
     t.integer  "supplier_id"
     t.boolean  "group_buy"
@@ -842,8 +847,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "order_id"
     t.integer  "shipping_method_id"
     t.integer  "address_id"
-    t.datetime "created_at",                                       :null => false
-    t.datetime "updated_at",                                       :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.string   "state"
   end
 
@@ -860,8 +865,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "spree_shipping_methods", :force => true do |t|
     t.string   "name"
     t.integer  "zone_id"
-    t.datetime "created_at",                             :null => false
-    t.datetime "updated_at",                             :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.string   "display_on"
     t.integer  "shipping_category_id"
     t.boolean  "match_none"
@@ -889,8 +894,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "previous_state"
     t.integer  "stateful_id"
     t.integer  "user_id"
-    t.datetime "created_at",     :null => false
-    t.datetime "updated_at",     :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.string   "stateful_type"
     t.string   "next_state"
   end
@@ -923,8 +928,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
 
   create_table "spree_taxonomies", :force => true do |t|
     t.string   "name",                      :null => false
-    t.datetime "created_at",                :null => false
-    t.datetime "updated_at",                :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.integer  "position",   :default => 0
   end
 
@@ -934,8 +939,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "name",                             :null => false
     t.string   "permalink"
     t.integer  "taxonomy_id"
-    t.datetime "created_at",                       :null => false
-    t.datetime "updated_at",                       :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.integer  "lft"
     t.integer  "rgt"
     t.string   "icon_file_name"
@@ -956,8 +961,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "permissable_id"
     t.string   "permissable_type"
     t.string   "token"
-    t.datetime "created_at",       :null => false
-    t.datetime "updated_at",       :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   add_index "spree_tokenized_permissions", ["permissable_id", "permissable_type"], :name => "index_tokenized_name_and_type"
@@ -988,8 +993,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "login"
     t.integer  "ship_address_id"
     t.integer  "bill_address_id"
-    t.datetime "created_at",                                          :null => false
-    t.datetime "updated_at",                                          :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.string   "authentication_token"
     t.string   "unlock_token"
     t.datetime "locked_at"
@@ -1031,8 +1036,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "zoneable_id"
     t.string   "zoneable_type"
     t.integer  "zone_id"
-    t.datetime "created_at",    :null => false
-    t.datetime "updated_at",    :null => false
+    t.datetime "created_at"
+    t.datetime "updated_at"
   end
 
   create_table "spree_zones", :force => true do |t|

From 33b570b117d8f3173074449270fa16d93f9011e5 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Mon, 27 Feb 2017 19:00:51 +0000
Subject: [PATCH 180/353] Inject cards for current user into checkout and add
 selector dropdown to gateway partial.

---
 .../checkout/payment_controller.js.coffee        |  5 ++++-
 app/helpers/injection_helper.rb                  |  4 ++++
 app/models/spree/user_decorator.rb               |  1 +
 app/serializers/api/credit_card_serializer.rb    | 15 +++++++++++++++
 app/views/checkout/_form.html.haml               |  1 +
 .../spree/checkout/payment/_gateway.html.haml    |  7 +++++++
 config/locales/en.yml                            |  2 ++
 spec/serializers/credit_card_serializer_spec.rb  | 16 ++++++++++++++++
 8 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 app/serializers/api/credit_card_serializer.rb
 create mode 100644 spec/serializers/credit_card_serializer_spec.rb

diff --git a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
index 924df3c447..91c7760663 100644
--- a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
@@ -1,5 +1,8 @@
-Darkswarm.controller "PaymentCtrl", ($scope, $timeout) ->
+Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards) ->
   angular.extend(this, new FieldsetMixin($scope))
+  $scope.savedCreditCards = savedCreditCards
+  $scope.selected_card = null
+
   $scope.name = "payment"
 
   $scope.months = [
diff --git a/app/helpers/injection_helper.rb b/app/helpers/injection_helper.rb
index dad9cf11f9..0aa5f65f7a 100644
--- a/app/helpers/injection_helper.rb
+++ b/app/helpers/injection_helper.rb
@@ -69,6 +69,10 @@ module InjectionHelper
     inject_json_ams "orders_by_distributor", data_array, Api::OrdersByDistributorSerializer
   end
 
+  def inject_saved_credit_cards
+    inject_json_ams "savedCreditCards", spree_current_user.credit_cards, Api::CreditCardSerializer
+  end
+
   def inject_json(name, partial, opts = {})
     render partial: "json/injection", locals: {name: name, partial: partial}.merge(opts)
   end
diff --git a/app/models/spree/user_decorator.rb b/app/models/spree/user_decorator.rb
index d631387fa4..efbaf82f97 100644
--- a/app/models/spree/user_decorator.rb
+++ b/app/models/spree/user_decorator.rb
@@ -11,6 +11,7 @@ Spree.user_class.class_eval do
   has_many :billable_periods, foreign_key: :owner_id, inverse_of: :owner
   has_one :cart
   has_many :customers
+  has_many :credit_cards
 
   accepts_nested_attributes_for :enterprise_roles, :allow_destroy => true
 
diff --git a/app/serializers/api/credit_card_serializer.rb b/app/serializers/api/credit_card_serializer.rb
new file mode 100644
index 0000000000..855f62c81d
--- /dev/null
+++ b/app/serializers/api/credit_card_serializer.rb
@@ -0,0 +1,15 @@
+class Api::CreditCardSerializer < ActiveModel::Serializer
+  attributes :id, :month, :year, :cc_type, :last_digits, :first_name, :last_name, :formatted
+
+  def formatted
+    elements = []
+    elements << cc_type.capitalize if cc_type
+    if last_digits
+      3.times { elements << I18n.t(:card_masked_digit) * 4 }
+    end
+    elements << last_digits if last_digits
+    elements << I18n.t(:card_expiry_abbreviation)
+    elements << month.to_s + "/" + year.to_s if month # TODO: I18n
+    elements.join(" ")
+  end
+end
diff --git a/app/views/checkout/_form.html.haml b/app/views/checkout/_form.html.haml
index 42f31f4a35..0fdfe267b8 100644
--- a/app/views/checkout/_form.html.haml
+++ b/app/views/checkout/_form.html.haml
@@ -6,6 +6,7 @@
 
   = inject_available_shipping_methods
   = inject_available_payment_methods
+  = inject_saved_credit_cards
 
   = render "checkout/details", f: f
   = render "checkout/billing", f: f
diff --git a/app/views/spree/checkout/payment/_gateway.html.haml b/app/views/spree/checkout/payment/_gateway.html.haml
index 33dcbda8fc..0a1cd913e6 100644
--- a/app/views/spree/checkout/payment/_gateway.html.haml
+++ b/app/views/spree/checkout/payment/_gateway.html.haml
@@ -1,3 +1,10 @@
+.row
+  .small-12.columns
+    %label
+      = t :previously_used_credit_cards
+    %select{"ng-model" => "selected_card", "ng-options" => "card.id as card.formatted for card in savedCreditCards", name: "secrets.card_year", required: true}
+
+
 .row
   .small-6.columns
     %label
diff --git a/config/locales/en.yml b/config/locales/en.yml
index c36dabec76..e547a0fc42 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -860,6 +860,8 @@ en:
   card_number: Card Number
   card_securitycode: "Security Code"
   card_expiry_date: Expiry Date
+  card_masked_digit: "X"
+  card_expiry_abbreviation: "Exp"
 
   ie_warning_headline: "Your browser is out of date :-("
   ie_warning_text: "For the best Open Food Network experience, we strongly recommend upgrading your browser:"
diff --git a/spec/serializers/credit_card_serializer_spec.rb b/spec/serializers/credit_card_serializer_spec.rb
new file mode 100644
index 0000000000..146055de05
--- /dev/null
+++ b/spec/serializers/credit_card_serializer_spec.rb
@@ -0,0 +1,16 @@
+require 'spec_helper'
+
+describe Api::CreditCardSerializer do
+  let(:card) { create(:credit_card) }
+  let(:serializer) { Api::CreditCardSerializer.new card }
+
+
+  it "serializes a credit card" do
+    expect(serializer.to_json).to match card.last_digits.to_s
+  end
+
+  it "formats an identifying string with the card number masked" do
+    expect(serializer.formatted).to eq "Visa XXXX XXXX XXXX 1111 Exp 12/2013"
+  end
+
+end

From 298fd057f5701861af33963229ff4424bf1f9a75 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 4 Mar 2017 14:33:49 +0000
Subject: [PATCH 181/353] Check for current user before injecting credit cards

---
 app/helpers/injection_helper.rb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/helpers/injection_helper.rb b/app/helpers/injection_helper.rb
index 0aa5f65f7a..27e074fa18 100644
--- a/app/helpers/injection_helper.rb
+++ b/app/helpers/injection_helper.rb
@@ -70,7 +70,9 @@ module InjectionHelper
   end
 
   def inject_saved_credit_cards
-    inject_json_ams "savedCreditCards", spree_current_user.credit_cards, Api::CreditCardSerializer
+    if spree_current_user
+      inject_json_ams "savedCreditCards", spree_current_user.credit_cards, Api::CreditCardSerializer
+    end
   end
 
   def inject_json(name, partial, opts = {})

From a1cad82564528446ba31e65606cc9f35d2cf2e8b Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 4 Mar 2017 15:14:38 +0000
Subject: [PATCH 182/353] Only show credit cards if previously saved, split
 credit card db migrations and tidy up serializer

---
 app/serializers/api/credit_card_serializer.rb          | 10 +++++-----
 app/views/spree/checkout/payment/_gateway.html.haml    |  7 -------
 app/views/spree/checkout/payment/_stripe.html.haml     |  6 ++++++
 ...20170225203658_add_user_id_to_spree_credit_cards.rb |  5 -----
 ...4151129_add_payment_method_to_spree_credit_cards.rb |  8 ++++++++
 5 files changed, 19 insertions(+), 17 deletions(-)
 create mode 100644 db/migrate/20170304151129_add_payment_method_to_spree_credit_cards.rb

diff --git a/app/serializers/api/credit_card_serializer.rb b/app/serializers/api/credit_card_serializer.rb
index 855f62c81d..60e17c0fe6 100644
--- a/app/serializers/api/credit_card_serializer.rb
+++ b/app/serializers/api/credit_card_serializer.rb
@@ -1,15 +1,15 @@
 class Api::CreditCardSerializer < ActiveModel::Serializer
-  attributes :id, :month, :year, :cc_type, :last_digits, :first_name, :last_name, :formatted
+  attributes :id, :formatted
 
   def formatted
     elements = []
-    elements << cc_type.capitalize if cc_type
-    if last_digits
+    elements << object.cc_type.capitalize if object.cc_type
+    if object.last_digits
       3.times { elements << I18n.t(:card_masked_digit) * 4 }
+      elements << object.last_digits
     end
-    elements << last_digits if last_digits
     elements << I18n.t(:card_expiry_abbreviation)
-    elements << month.to_s + "/" + year.to_s if month # TODO: I18n
+    elements << object.month.to_s + "/" + object.year.to_s if object.month # TODO: I18n
     elements.join(" ")
   end
 end
diff --git a/app/views/spree/checkout/payment/_gateway.html.haml b/app/views/spree/checkout/payment/_gateway.html.haml
index 0a1cd913e6..33dcbda8fc 100644
--- a/app/views/spree/checkout/payment/_gateway.html.haml
+++ b/app/views/spree/checkout/payment/_gateway.html.haml
@@ -1,10 +1,3 @@
-.row
-  .small-12.columns
-    %label
-      = t :previously_used_credit_cards
-    %select{"ng-model" => "selected_card", "ng-options" => "card.id as card.formatted for card in savedCreditCards", name: "secrets.card_year", required: true}
-
-
 .row
   .small-6.columns
     %label
diff --git a/app/views/spree/checkout/payment/_stripe.html.haml b/app/views/spree/checkout/payment/_stripe.html.haml
index ed69bdb1cd..8564f91744 100644
--- a/app/views/spree/checkout/payment/_stripe.html.haml
+++ b/app/views/spree/checkout/payment/_stripe.html.haml
@@ -1,3 +1,9 @@
+.row{ "ng-show" => "savedCreditCards != null && savedCreditCards.length > 0" }
+  .small-12.columns
+    %label
+      = t :previously_used_credit_cards
+    %select{"ng-model" => "selected_card", "ng-options" => "card.id as card.formatted for card in savedCreditCards", name: "secrets.card_year", required: true}
+
 = render "spree/checkout/payment/gateway", payment_method: payment_method
 
 :javascript
diff --git a/db/migrate/20170225203658_add_user_id_to_spree_credit_cards.rb b/db/migrate/20170225203658_add_user_id_to_spree_credit_cards.rb
index 837343be7d..29e50e0c1a 100644
--- a/db/migrate/20170225203658_add_user_id_to_spree_credit_cards.rb
+++ b/db/migrate/20170225203658_add_user_id_to_spree_credit_cards.rb
@@ -4,10 +4,5 @@ class AddUserIdToSpreeCreditCards < ActiveRecord::Migration
       add_column :spree_credit_cards, :user_id, :integer
       add_index :spree_credit_cards, :user_id
     end
-
-    unless Spree::CreditCard.column_names.include? "payment_method_id"
-      add_column :spree_credit_cards, :payment_method_id, :integer
-      add_index :spree_credit_cards, :payment_method_id
-    end
   end
 end
diff --git a/db/migrate/20170304151129_add_payment_method_to_spree_credit_cards.rb b/db/migrate/20170304151129_add_payment_method_to_spree_credit_cards.rb
new file mode 100644
index 0000000000..76c1cab805
--- /dev/null
+++ b/db/migrate/20170304151129_add_payment_method_to_spree_credit_cards.rb
@@ -0,0 +1,8 @@
+class AddPaymentMethodToSpreeCreditCards < ActiveRecord::Migration
+  def change
+    unless Spree::CreditCard.column_names.include? "payment_method_id"
+      add_column :spree_credit_cards, :payment_method_id, :integer
+      add_index :spree_credit_cards, :payment_method_id
+    end
+  end
+end

From 50c3d1367dc460b6fd7754ba005780e97e5dd377 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 5 Mar 2017 08:26:44 +0000
Subject: [PATCH 183/353] Tidy up comment

---
 app/models/spree/credit_card_decorator.rb | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/app/models/spree/credit_card_decorator.rb b/app/models/spree/credit_card_decorator.rb
index ee3c8aca60..0744bf5da5 100644
--- a/app/models/spree/credit_card_decorator.rb
+++ b/app/models/spree/credit_card_decorator.rb
@@ -1,11 +1,12 @@
 Spree::CreditCard.class_eval do
+  # Should be able to remove once we reach Spree v2.2.0
+  # https://github.com/spree/spree/commit/411010f3975c919ab298cb63962ee492455b415c
+  belongs_to :payment_method
+
   # Allows us to use a gateway_payment_profile_id to store Stripe Tokens
   # Should be able to remove once we reach Spree v2.2.0
   # Commit: https://github.com/spree/spree/commit/5a4d690ebc64b264bf12904a70187e7a8735ef3f
   # See also: https://github.com/spree/spree_gateway/issues/111
-
-  belongs_to :payment_method
-
   def has_payment_profile?
     gateway_customer_profile_id.present? || gateway_payment_profile_id.present?
   end

From 300dc3084ce697f5c24e4f412e45ace1eda59120 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 12 Mar 2017 21:22:59 +0000
Subject: [PATCH 184/353] Add default card, disable inputs when a card is
 selected

---
 .../checkout/payment_controller.js.coffee     |   4 +-
 app/helpers/injection_helper.rb               |   5 +-
 .../spree/checkout/payment/_gateway.html.haml |  10 +-
 .../spree/checkout/payment/_stripe.html.haml  |   4 +-
 config/locales/en.yml                         |   1 +
 spec/factories.rb                             |   1 +
 .../consumer/shopping/checkout_spec.rb        | 120 +++++++++++-------
 7 files changed, 92 insertions(+), 53 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
index 91c7760663..bf062cbb83 100644
--- a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
@@ -1,8 +1,10 @@
 Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards) ->
   angular.extend(this, new FieldsetMixin($scope))
-  $scope.savedCreditCards = savedCreditCards
+  defaultCard = [ {id: null, formatted: t("new_credit_card")} ]
+  $scope.savedCreditCards = defaultCard.concat savedCreditCards if savedCreditCards
   $scope.selected_card = null
 
+
   $scope.name = "payment"
 
   $scope.months = [
diff --git a/app/helpers/injection_helper.rb b/app/helpers/injection_helper.rb
index 27e074fa18..89609c7b04 100644
--- a/app/helpers/injection_helper.rb
+++ b/app/helpers/injection_helper.rb
@@ -71,8 +71,11 @@ module InjectionHelper
 
   def inject_saved_credit_cards
     if spree_current_user
-      inject_json_ams "savedCreditCards", spree_current_user.credit_cards, Api::CreditCardSerializer
+      data = spree_current_user.credit_cards
+    else
+      data = nil
     end
+    inject_json_ams "savedCreditCards", data, Api::CreditCardSerializer
   end
 
   def inject_json(name, partial, opts = {})
diff --git a/app/views/spree/checkout/payment/_gateway.html.haml b/app/views/spree/checkout/payment/_gateway.html.haml
index 33dcbda8fc..72775e36db 100644
--- a/app/views/spree/checkout/payment/_gateway.html.haml
+++ b/app/views/spree/checkout/payment/_gateway.html.haml
@@ -10,17 +10,17 @@
     %input{type: :text, disabled: true, "ng-value" => "order.bill_address.lastname"}
 
   .small-6.columns
-    = validated_input t(:card_number), "secrets.card_number", required: true, maxlength: 19, autocomplete: "off"
+    = validated_input t(:card_number), "secrets.card_number", "ng-required" => "!selected_card", maxlength: 19, autocomplete: "off", "ng-disabled" => "!!selected_card"
   .small-6.columns
-    = validated_input t(:card_securitycode), "secrets.card_verification_value", required: true
+    = validated_input t(:card_securitycode), "secrets.card_verification_value", "ng-required" => "!selected_card", "ng-disabled" => "!!selected_card"
 
 .row
   .small-12.columns
     %label{for: "secrets.card_month"}
-      = t :card_expiry_date
+      = t :card_expiry_date, "ng-disabled" => "!!selected_card"
 
 .row
   .small-6.columns
-    %select{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month", required: true}
+    %select{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month", "ng-required" => "!selected_card", "ng-disabled" => "!!selected_card"}
   .small-6.columns
-    %select{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", required: true}
+    %select{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", "ng-required" => "!selected_card", "ng-disabled" => "!!selected_card"}
diff --git a/app/views/spree/checkout/payment/_stripe.html.haml b/app/views/spree/checkout/payment/_stripe.html.haml
index 8564f91744..153262c43b 100644
--- a/app/views/spree/checkout/payment/_stripe.html.haml
+++ b/app/views/spree/checkout/payment/_stripe.html.haml
@@ -1,8 +1,8 @@
-.row{ "ng-show" => "savedCreditCards != null && savedCreditCards.length > 0" }
+.row{ "ng-show" => "savedCreditCards != null && savedCreditCards.length > 1" }
   .small-12.columns
     %label
       = t :previously_used_credit_cards
-    %select{"ng-model" => "selected_card", "ng-options" => "card.id as card.formatted for card in savedCreditCards", name: "secrets.card_year", required: true}
+    %select{"ng-model" => "selected_card", "ng-options" => "card.id as card.formatted for card in savedCreditCards", name: "selected_card", required: false}
 
 = render "spree/checkout/payment/gateway", payment_method: payment_method
 
diff --git a/config/locales/en.yml b/config/locales/en.yml
index e547a0fc42..bee42d8fee 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -862,6 +862,7 @@ en:
   card_expiry_date: Expiry Date
   card_masked_digit: "X"
   card_expiry_abbreviation: "Exp"
+  new_credit_card: "New credit card"
 
   ie_warning_headline: "Your browser is out of date :-("
   ie_warning_text: "For the best Open Food Network experience, we strongly recommend upgrading your browser:"
diff --git a/spec/factories.rb b/spec/factories.rb
index 6592dc2940..a574d88edf 100644
--- a/spec/factories.rb
+++ b/spec/factories.rb
@@ -368,6 +368,7 @@ FactoryGirl.define do
     stripe_user_id "abc123"
     stripe_publishable_key "xyz456"
   end
+
 end
 
 
diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index 6f8cd59de1..11f0eae004 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -39,7 +39,6 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
       end
     end
 
-
     before do
       distributor.shipping_methods << sm1
       distributor.shipping_methods << sm2
@@ -61,61 +60,66 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
         page.should have_content "An item in your cart has become unavailable"
       end
     end
+
     context 'login in as user' do
       let(:user) { create(:user) }
 
       before do
         quick_login_as(user)
-        visit checkout_path
-
-        toggle_shipping
-        choose sm1.name
-        toggle_payment
-        choose pm1.name
-        toggle_details
-        within "#details" do
-          fill_in "First Name", with: "Will"
-          fill_in "Last Name", with: "Marshall"
-          fill_in "Email", with: "test@test.com"
-          fill_in "Phone", with: "0468363090"
-        end
-        toggle_billing
-        check "Save as default billing address"
-        within "#billing" do
-          fill_in "City", with: "Melbourne"
-          fill_in "Postcode", with: "3066"
-          fill_in "Address", with: "123 Your Head"
-          select "Australia", from: "Country"
-          select "Victoria", from: "State"
-        end
-
-        toggle_shipping
-        check "Shipping address same as billing address?"
-        check "Save as default shipping address"
       end
 
-      it "sets user's default billing address and shipping address" do
-        user.bill_address.should be_nil
-        user.ship_address.should be_nil
+      context "with details filled out" do
+        before do
+          visit checkout_path
+          toggle_shipping
+          choose sm1.name
+          toggle_payment
+          choose pm1.name
+          toggle_details
+          within "#details" do
+            fill_in "First Name", with: "Will"
+            fill_in "Last Name", with: "Marshall"
+            fill_in "Email", with: "test@test.com"
+            fill_in "Phone", with: "0468363090"
+          end
+          toggle_billing
+          check "Save as default billing address"
+          within "#billing" do
+            fill_in "City", with: "Melbourne"
+            fill_in "Postcode", with: "3066"
+            fill_in "Address", with: "123 Your Head"
+            select "Australia", from: "Country"
+            select "Victoria", from: "State"
+          end
 
-        order.bill_address.should be_nil
-        order.ship_address.should be_nil
+          toggle_shipping
+          check "Shipping address same as billing address?"
+          check "Save as default shipping address"
+        end
 
-        place_order
-        page.should have_content "Your order has been processed successfully"
+        it "sets user's default billing address and shipping address" do
+          user.bill_address.should be_nil
+          user.ship_address.should be_nil
 
-        order.reload.bill_address.address1.should eq '123 Your Head'
-        order.reload.ship_address.address1.should eq '123 Your Head'
+          order.bill_address.should be_nil
+          order.ship_address.should be_nil
 
-        order.customer.bill_address.address1.should eq '123 Your Head'
-        order.customer.ship_address.address1.should eq '123 Your Head'
+          place_order
+          page.should have_content "Your order has been processed successfully"
 
-        user.reload.bill_address.address1.should eq '123 Your Head'
-        user.reload.ship_address.address1.should eq '123 Your Head'
-      end
+          order.reload.bill_address.address1.should eq '123 Your Head'
+          order.reload.ship_address.address1.should eq '123 Your Head'
 
-      it "it doesn't tell about previous orders" do
-        expect(page).to_not have_content("You have an order for this order cycle already.")
+          order.customer.bill_address.address1.should eq '123 Your Head'
+          order.customer.ship_address.address1.should eq '123 Your Head'
+
+          user.reload.bill_address.address1.should eq '123 Your Head'
+          user.reload.ship_address.address1.should eq '123 Your Head'
+        end
+
+        it "it doesn't tell about previous orders" do
+          expect(page).to_not have_content("You have an order for this order cycle already.")
+        end
       end
 
       context "with previous orders" do
@@ -124,13 +128,41 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
         before do
           order.distributor.allow_order_changes = true
           order.distributor.save
+          visit checkout_path
         end
 
         it "informs about previous orders" do
-          visit checkout_path
           expect(page).to have_content("You have an order for this order cycle already.")
         end
       end
+
+      context "with Stripe" do
+        let!(:stripe_pm) { create(:payment_method, distributors: [distributor], name: "Stripe", type: "Spree::Gateway::StripeConnect") }
+
+        let!(:saved_card) {
+          create(:credit_card,
+          user_id: user.id,
+          month: "01",
+          year: "2025",
+          cc_type: "Visa",
+          number: "1111111111111111")
+        }
+
+        before do
+          visit checkout_path
+          toggle_payment
+          choose stripe_pm.name
+        end
+
+        it "shows the saved credit card dropdown" do
+          page.should have_content "Previously Used Credit Cards"
+        end
+
+        it "disables the input fields when a saved card is selected" do
+          select "Visa XXXX XXXX XXXX 1111 Exp 01/2025", from: "selected_card"
+          page.should have_css "#secrets\\.card_number[disabled]"
+        end
+      end
     end
 
     context "on the checkout page" do

From 12f4f2d17a0bc9399e551fcc80cf7c1eaf6bd99f Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 19 Mar 2017 22:09:16 +0000
Subject: [PATCH 185/353] Add some logic to check whether a saved card has been
 selected before making a request from Stripe

---
 .../darkswarm/services/checkout.js.coffee     | 25 ++++++++++++-------
 .../spree/checkout/payment/_gateway.html.haml | 10 ++++----
 .../spree/checkout/payment/_stripe.html.haml  |  2 +-
 .../services/checkout_spec.js.coffee          |  7 ++++++
 4 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/services/checkout.js.coffee b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
index 8df1caf754..3c1ebcf773 100644
--- a/app/assets/javascripts/darkswarm/services/checkout.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
@@ -5,7 +5,7 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeJ
     order: CurrentOrder.order
 
     purchase: ->
-      if @paymentMethod()?.method_type == 'stripe'
+      if @paymentMethod()?.method_type == 'stripe' && !@secrets.selected_card
         StripeJS.requestToken(@secrets, @submit)
       else
         @submit()
@@ -60,14 +60,21 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeJ
         }
 
       if @paymentMethod()?.method_type == 'stripe'
-        angular.extend munged_order.payments_attributes[0], {
-          source_attributes:
-            gateway_payment_profile_id: @secrets.token
-            cc_type: @secrets.cc_type
-            last_digits: @secrets.card.last4
-            month: @secrets.card.exp_month
-            year: @secrets.card.exp_year
-        }
+        if @secrets.selected_card
+          angular.extend munged_order.payments_attributes[0], {
+            source_attributes:
+              id: @secrets.selected_card
+              type: 'Spree::CreditCard'
+          }
+        else
+          angular.extend munged_order.payments_attributes[0], {
+            source_attributes:
+              gateway_payment_profile_id: @secrets.token
+              cc_type: @secrets.cc_type
+              last_digits: @secrets.card.last4
+              month: @secrets.card.exp_month
+              year: @secrets.card.exp_year
+          }
 
       munged_order
 
diff --git a/app/views/spree/checkout/payment/_gateway.html.haml b/app/views/spree/checkout/payment/_gateway.html.haml
index 72775e36db..8fbf7dc052 100644
--- a/app/views/spree/checkout/payment/_gateway.html.haml
+++ b/app/views/spree/checkout/payment/_gateway.html.haml
@@ -10,17 +10,17 @@
     %input{type: :text, disabled: true, "ng-value" => "order.bill_address.lastname"}
 
   .small-6.columns
-    = validated_input t(:card_number), "secrets.card_number", "ng-required" => "!selected_card", maxlength: 19, autocomplete: "off", "ng-disabled" => "!!selected_card"
+    = validated_input t(:card_number), "secrets.card_number", "ng-required" => "!secrets.selected_card", maxlength: 19, autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"
   .small-6.columns
-    = validated_input t(:card_securitycode), "secrets.card_verification_value", "ng-required" => "!selected_card", "ng-disabled" => "!!selected_card"
+    = validated_input t(:card_securitycode), "secrets.card_verification_value", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"
 
 .row
   .small-12.columns
     %label{for: "secrets.card_month"}
-      = t :card_expiry_date, "ng-disabled" => "!!selected_card"
+      = t :card_expiry_date, "ng-disabled" => "!!secrets.selected_card"
 
 .row
   .small-6.columns
-    %select{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month", "ng-required" => "!selected_card", "ng-disabled" => "!!selected_card"}
+    %select{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
   .small-6.columns
-    %select{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", "ng-required" => "!selected_card", "ng-disabled" => "!!selected_card"}
+    %select{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
diff --git a/app/views/spree/checkout/payment/_stripe.html.haml b/app/views/spree/checkout/payment/_stripe.html.haml
index 153262c43b..ad94b03e1b 100644
--- a/app/views/spree/checkout/payment/_stripe.html.haml
+++ b/app/views/spree/checkout/payment/_stripe.html.haml
@@ -2,7 +2,7 @@
   .small-12.columns
     %label
       = t :previously_used_credit_cards
-    %select{"ng-model" => "selected_card", "ng-options" => "card.id as card.formatted for card in savedCreditCards", name: "selected_card", required: false}
+    %select{"ng-model" => "secrets.selected_card", "ng-options" => "card.id as card.formatted for card in savedCreditCards", name: "selected_card", required: false}
 
 = render "spree/checkout/payment/gateway", payment_method: payment_method
 
diff --git a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
index 95ee9e8416..67a93f44d1 100644
--- a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
@@ -125,6 +125,13 @@ describe 'Checkout service', ->
         Checkout.purchase()
         expect(StripeJS.requestToken).toHaveBeenCalled()
 
+      it "doesn't hit Stripe when reusing a credit card", inject (StripeJS) ->
+        spyOn(StripeJS, "requestToken")
+        Checkout.secrets.selected_card = 1
+        Checkout.purchase()
+        expect(StripeJS.requestToken).not.toHaveBeenCalled()
+
+
   describe "data preprocessing", ->
     beforeEach ->
       Checkout.order.payment_method_id = 99

From 627899bbd4e7ac87c5d4c3eb14f8fe00dbb259a8 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Mon, 20 Mar 2017 19:35:11 +0000
Subject: [PATCH 186/353] spec for source attributes to pass for saved card

---
 .../darkswarm/services/checkout.js.coffee           |  2 +-
 .../unit/darkswarm/services/checkout_spec.js.coffee | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/services/checkout.js.coffee b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
index 3c1ebcf773..94c871a482 100644
--- a/app/assets/javascripts/darkswarm/services/checkout.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
@@ -63,7 +63,7 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeJ
         if @secrets.selected_card
           angular.extend munged_order.payments_attributes[0], {
             source_attributes:
-              id: @secrets.selected_card
+              credit_card_id: @secrets.selected_card
               type: 'Spree::CreditCard'
           }
         else
diff --git a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
index 67a93f44d1..cb0d99f8b2 100644
--- a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
@@ -131,7 +131,6 @@ describe 'Checkout service', ->
         Checkout.purchase()
         expect(StripeJS.requestToken).not.toHaveBeenCalled()
 
-
   describe "data preprocessing", ->
     beforeEach ->
       Checkout.order.payment_method_id = 99
@@ -198,3 +197,15 @@ describe 'Checkout service', ->
         expect(source_attributes.last_digits).toBe "1234"
         expect(source_attributes.year).toBe "2099"
         expect(source_attributes.month).toBe "10"
+
+    describe "when a saved card from Stripe is used", ->
+      beforeEach ->
+        Checkout.order.payment_method_id = 666
+
+      it "passes the card ID in source attributes if a saved card is selected", ->
+        Checkout.secrets.selected_card = 1
+        source_attributes = Checkout.preprocess().payments_attributes[0].source_attributes
+        expect(source_attributes).toBeDefined()
+        expect(source_attributes.credit_card_id).toBe 1
+        expect(source_attributes.type).toBe "Spree::CreditCard"
+        expect(source_attributes.year).toBeUndefined()

From c4f9a5a234be5edc171194e0607728a3e3af3410 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Thu, 23 Mar 2017 22:42:08 +0000
Subject: [PATCH 187/353] Add code to CheckoutController to construct card
 attributes when using an existing card (via
 https://github.com/spree/spree/blob/a818fbbecd1a2f0065771aa6055024549accfb47/core/app/models/spree/order/checkout.rb:212)

---
 .../darkswarm/services/checkout.js.coffee     |  7 ++-----
 app/controllers/checkout_controller.rb        | 20 +++++++++++++++++++
 .../services/checkout_spec.js.coffee          |  6 ++----
 3 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/services/checkout.js.coffee b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
index 94c871a482..85e5e8ae94 100644
--- a/app/assets/javascripts/darkswarm/services/checkout.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
@@ -61,10 +61,8 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeJ
 
       if @paymentMethod()?.method_type == 'stripe'
         if @secrets.selected_card
-          angular.extend munged_order.payments_attributes[0], {
-            source_attributes:
-              credit_card_id: @secrets.selected_card
-              type: 'Spree::CreditCard'
+          angular.extend munged_order, {
+            existing_card: @secrets.selected_card
           }
         else
           angular.extend munged_order.payments_attributes[0], {
@@ -75,7 +73,6 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeJ
               month: @secrets.card.exp_month
               year: @secrets.card.exp_year
           }
-
       munged_order
 
     shippingMethod: ->
diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index be35682a7b..d06eb1f1c2 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -119,6 +119,9 @@ class CheckoutController < Spree::CheckoutController
     if (params[:order][:payments_attributes])
       params[:order][:payments_attributes].first[:amount] = @order.total
     end
+    if params[:order][:existing_card]
+      construct_saved_card_attributes
+    end
     params[:order]
   end
 
@@ -202,4 +205,21 @@ class CheckoutController < Spree::CheckoutController
     render json: {path: spree.paypal_express_url(payment_method_id: payment_method.id)}, status: 200
     true
   end
+
+  def construct_saved_card_attributes
+    existing_card_id = params[:order].delete(:existing_card)
+    if existing_card_id.present?
+      credit_card = Spree::CreditCard.find(existing_card_id)
+      if credit_card.user_id != spree_current_user.id || credit_card.user_id.blank?
+        raise Core::GatewayError.new Spree.t(:invalid_credit_card)
+      end
+
+      # Not currently supported but maybe we should add it...?
+      credit_card.verification_value = params[:cvc_confirm] if params[:cvc_confirm].present?
+
+      params[:order][:payments_attributes].first[:source] = credit_card
+      params[:order][:payments_attributes].first[:payment_method_id] = credit_card.payment_method_id
+      params[:order][:payments_attributes].first.delete :source_attributes
+    end
+  end
 end
diff --git a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
index cb0d99f8b2..d21f10fb15 100644
--- a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
@@ -204,8 +204,6 @@ describe 'Checkout service', ->
 
       it "passes the card ID in source attributes if a saved card is selected", ->
         Checkout.secrets.selected_card = 1
-        source_attributes = Checkout.preprocess().payments_attributes[0].source_attributes
+        source_attributes = Checkout.preprocess()
         expect(source_attributes).toBeDefined()
-        expect(source_attributes.credit_card_id).toBe 1
-        expect(source_attributes.type).toBe "Spree::CreditCard"
-        expect(source_attributes.year).toBeUndefined()
+        expect(source_attributes.existing_card).toBe 1

From 33a3db86983360835941cc5ad58990c8a504739e Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 29 Mar 2017 14:45:11 +1100
Subject: [PATCH 188/353] Making :source attr_accessible for Spree::Payment

---
 app/models/spree/payment_decorator.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index d9b421573f..c7cd8aa409 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -4,6 +4,8 @@ module Spree
 
     after_save :ensure_correct_adjustment, :update_order
 
+    attr_accessible :source
+
     def ensure_correct_adjustment
       # Don't charge for invalid payments.
       # PayPalExpress always creates a payment that is invalidated later.

From 56295e5ffb3a66e8c9369b9390773ff5d53ddcdf Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 2 Apr 2017 18:14:49 +0100
Subject: [PATCH 189/353] Fix request and feature specs

---
 .../consumer/shopping/checkout_spec.rb        | 62 +++++++++++--------
 spec/requests/stripe_connect_checkout_spec.rb | 14 ++++-
 2 files changed, 48 insertions(+), 28 deletions(-)

diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index 11f0eae004..375c49c2d3 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -64,6 +64,33 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
     context 'login in as user' do
       let(:user) { create(:user) }
 
+      def fill_out_form
+        toggle_shipping
+        choose sm1.name
+        toggle_payment
+        choose pm1.name
+        toggle_details
+        within "#details" do
+          fill_in "First Name", with: "Will"
+          fill_in "Last Name", with: "Marshall"
+          fill_in "Email", with: "test@test.com"
+          fill_in "Phone", with: "0468363090"
+        end
+        toggle_billing
+        check "Save as default billing address"
+        within "#billing" do
+          fill_in "City", with: "Melbourne"
+          fill_in "Postcode", with: "3066"
+          fill_in "Address", with: "123 Your Head"
+          select "Australia", from: "Country"
+          select "Victoria", from: "State"
+        end
+
+        toggle_shipping
+        check "Shipping address same as billing address?"
+        check "Save as default shipping address"
+      end
+
       before do
         quick_login_as(user)
       end
@@ -71,30 +98,7 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
       context "with details filled out" do
         before do
           visit checkout_path
-          toggle_shipping
-          choose sm1.name
-          toggle_payment
-          choose pm1.name
-          toggle_details
-          within "#details" do
-            fill_in "First Name", with: "Will"
-            fill_in "Last Name", with: "Marshall"
-            fill_in "Email", with: "test@test.com"
-            fill_in "Phone", with: "0468363090"
-          end
-          toggle_billing
-          check "Save as default billing address"
-          within "#billing" do
-            fill_in "City", with: "Melbourne"
-            fill_in "Postcode", with: "3066"
-            fill_in "Address", with: "123 Your Head"
-            select "Australia", from: "Country"
-            select "Victoria", from: "State"
-          end
-
-          toggle_shipping
-          check "Shipping address same as billing address?"
-          check "Save as default shipping address"
+          fill_out_form
         end
 
         it "sets user's default billing address and shipping address" do
@@ -145,11 +149,13 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
           month: "01",
           year: "2025",
           cc_type: "Visa",
-          number: "1111111111111111")
+          number: "1111111111111111",
+          payment_method_id: stripe_pm.id)
         }
 
         before do
           visit checkout_path
+          fill_out_form
           toggle_payment
           choose stripe_pm.name
         end
@@ -162,6 +168,12 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
           select "Visa XXXX XXXX XXXX 1111 Exp 01/2025", from: "selected_card"
           page.should have_css "#secrets\\.card_number[disabled]"
         end
+
+        it "allows use of a saved card" do
+          select "Visa XXXX XXXX XXXX 1111 Exp 01/2025", from: "selected_card"
+          place_order
+          page.should have_content "Your order has been processed successfully"
+        end
       end
     end
 
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index cd4ff0ed19..10ebfd1c90 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -25,6 +25,16 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     order.update_attributes(distributor_id: enterprise.id, order_cycle_id: order_cycle.id)
     order.reload.update_totals
     set_order order
+
+    stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/customers")
+      .to_return(status: 200, body: JSON.generate({ id: "cus_A123", default_card: "card_XyZ456", sources: { data: [{id: "1"}] } }), headers: {})
+
+    stub_request(:post, "https://api.stripe.com/v1/tokens")
+      .to_return(status: 200, body: JSON.generate({id: "tok_123"}), headers: {})
+
+#    stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+#      .to_return(status: 200, body: JSON.generate({id: "ch_123"}), headers: {})
+
   end
 
   context "when the charge request is accepted" do
@@ -32,7 +42,6 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
     before do
       stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
-      .with { |request| request.body.starts_with?("card=#{token}") }
       .to_return(body: JSON.generate(response_mock))
     end
 
@@ -48,8 +57,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
     before do
       stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
-      .with { |request| request.body.starts_with?("card=#{token}") }
-      .to_return(body: JSON.generate(response_mock))
+        .to_return(body: JSON.generate(response_mock))
     end
 
     it "should not process the payment" do

From c6e50a3f7ff290597db419415e25041a1e6923a8 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 2 Apr 2017 19:10:38 +0100
Subject: [PATCH 190/353] Stub Stripe requests in feature spec

---
 spec/features/consumer/shopping/checkout_spec.rb | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index 375c49c2d3..fb128714f7 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -153,7 +153,13 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
           payment_method_id: stripe_pm.id)
         }
 
+        let(:response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
+
         before do
+          Stripe.api_key = "sk_test_123456"
+          stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+            .to_return(body: JSON.generate(response_mock))
+
           visit checkout_path
           fill_out_form
           toggle_payment

From 1449169b16b862ef84fc7c4ec49b4e1490cf78c1 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Mon, 1 May 2017 11:03:23 +0100
Subject: [PATCH 191/353] Basic UI for adding credit card details and getting a
 Stripe token without making a payment

---
 .../checkout/payment_controller.js.coffee     | 19 +------
 .../credit_cards_controller.js.coffee         | 25 ++++++++
 .../darkswarm/services/credit_card.js.coffee  | 16 ++++++
 .../darkswarm/services/dates.js.coffee        | 18 ++++++
 .../darkswarm/services/stripe.js.coffee       |  6 +-
 .../spree/users_controller_decorator.rb       |  7 +++
 app/models/spree/credit_card_decorator.rb     |  2 +
 .../spree/checkout/payment/_gateway.html.haml |  5 +-
 app/views/spree/users/show.html.haml          | 57 +++++++++++++++++++
 9 files changed, 134 insertions(+), 21 deletions(-)
 create mode 100644 app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
 create mode 100644 app/assets/javascripts/darkswarm/services/credit_card.js.coffee
 create mode 100644 app/assets/javascripts/darkswarm/services/dates.js.coffee

diff --git a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
index bf062cbb83..236bf5fb14 100644
--- a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
@@ -1,4 +1,4 @@
-Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards) ->
+Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards, Dates) ->
   angular.extend(this, new FieldsetMixin($scope))
   defaultCard = [ {id: null, formatted: t("new_credit_card")} ]
   $scope.savedCreditCards = defaultCard.concat savedCreditCards if savedCreditCards
@@ -7,22 +7,9 @@ Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards) ->
 
   $scope.name = "payment"
 
-  $scope.months = [
-    {key: t("january"), value: "1"},
-    {key: t("february"), value: "2"},
-    {key: t("march"), value: "3"},
-    {key: t("april"), value: "4"},
-    {key: t("may"), value: "5"},
-    {key: t("june"), value: "6"},
-    {key: t("july"), value: "7"},
-    {key: t("august"), value: "8"},
-    {key: t("september"), value: "9"},
-    {key: t("october"), value: "10"},
-    {key: t("november"), value: "11"},
-    {key: t("december"), value: "12"},
-  ]
+  $scope.months = Dates.months
 
-  $scope.years = [moment().year()..(moment().year()+15)]
+  $scope.years = Dates.years
   $scope.secrets.card_month = "1"
   $scope.secrets.card_year = moment().year()
 
diff --git a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
new file mode 100644
index 0000000000..17193cfd5a
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
@@ -0,0 +1,25 @@
+Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, savedCreditCards, StripeJS, Dates, Loading) ->
+  angular.extend(this, new FieldsetMixin($scope))
+  $scope.savedCreditCards = savedCreditCards
+  $scope.CreditCard = CreditCard
+  $scope.allow_name_change = true
+  $scope.disable_fields = false
+
+  $scope.months = Dates.months
+  $scope.years = Dates.years
+
+  $scope.secrets = CreditCard.secrets
+
+
+
+  $scope.storeCard = =>
+    Loading.message = "Saving"
+    CreditCard.requestToken($scope.secrets)
+
+
+
+
+
+    # Need to call Spree::Gateway::StripeConnect#provider.store(creditcard)
+    # creditcard should be formatted as for a payment
+    # The token then needs to be associated with the Customer (in Stripe) - can be done in Ruby.
diff --git a/app/assets/javascripts/darkswarm/services/credit_card.js.coffee b/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
new file mode 100644
index 0000000000..e5aeec61fc
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
@@ -0,0 +1,16 @@
+Darkswarm.factory 'CreditCard', ($injector, $rootScope, StripeJS, Navigation, $http, RailsFlashLoader, Loading)->
+  new class CreditCard
+    errors: {}
+
+    requestToken: (secrets) ->
+      #$scope.secrets.name = $scope.secrets.first_name + " " + $scope.secrets.last_name
+      secrets.name = @full_name(secrets)
+      StripeJS.requestToken(secrets, @submit)
+
+    submit: =>
+      $rootScope.$apply ->
+        Loading.clear()
+      Navigation.go '/account'
+
+    full_name: (secrets) ->
+      secrets.first_name + " " + secrets.last_name
diff --git a/app/assets/javascripts/darkswarm/services/dates.js.coffee b/app/assets/javascripts/darkswarm/services/dates.js.coffee
new file mode 100644
index 0000000000..d9a0b6e8c4
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/services/dates.js.coffee
@@ -0,0 +1,18 @@
+Darkswarm.factory "Dates", ->
+  new class Dates
+    months: [
+      {key: t("january"), value: "1"},
+      {key: t("february"), value: "2"},
+      {key: t("march"), value: "3"},
+      {key: t("april"), value: "4"},
+      {key: t("may"), value: "5"},
+      {key: t("june"), value: "6"},
+      {key: t("july"), value: "7"},
+      {key: t("august"), value: "8"},
+      {key: t("september"), value: "9"},
+      {key: t("october"), value: "10"},
+      {key: t("november"), value: "11"},
+      {key: t("december"), value: "12"},
+    ]
+
+    years: [moment().year()..(moment().year()+15)]
diff --git a/app/assets/javascripts/darkswarm/services/stripe.js.coffee b/app/assets/javascripts/darkswarm/services/stripe.js.coffee
index 706be74300..01fc54a30f 100644
--- a/app/assets/javascripts/darkswarm/services/stripe.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/stripe.js.coffee
@@ -1,7 +1,7 @@
 Darkswarm.factory 'StripeJS', ($rootScope, Loading, RailsFlashLoader) ->
   new class StripeJS
-    requestToken: (secrets, submit) ->
-      Loading.message = "Processing Payment..."
+    requestToken: (secrets, submit, loading_message = t("processing_payment")) ->
+      Loading.message = loading_message
       params =
         number: secrets.card_number
         cvc: secrets.card_verification_value
@@ -13,7 +13,7 @@ Darkswarm.factory 'StripeJS', ($rootScope, Loading, RailsFlashLoader) ->
         if response.error
           $rootScope.$apply ->
             Loading.clear()
-            RailsFlashLoader.loadFlash({error: "Error: #{response.error.message}"})
+            RailsFlashLoader.loadFlash({error: t("error") + ": #{response.error.message}"})
         else
           secrets.token = response['id']
           secrets.cc_type = @mapCC(response.card.brand)
diff --git a/app/controllers/spree/users_controller_decorator.rb b/app/controllers/spree/users_controller_decorator.rb
index a56c59d6fa..d31ad77715 100644
--- a/app/controllers/spree/users_controller_decorator.rb
+++ b/app/controllers/spree/users_controller_decorator.rb
@@ -2,4 +2,11 @@ Spree::UsersController.class_eval do
   layout 'darkswarm'
 
   before_filter :enable_embedded_shopfront
+  before_filter :set_credit_card, only: :show
+
+  private
+
+  def set_credit_card
+    @credit_card = Spree::CreditCard.new(user: @user)
+  end
 end
diff --git a/app/models/spree/credit_card_decorator.rb b/app/models/spree/credit_card_decorator.rb
index 0744bf5da5..32c14a1285 100644
--- a/app/models/spree/credit_card_decorator.rb
+++ b/app/models/spree/credit_card_decorator.rb
@@ -10,4 +10,6 @@ Spree::CreditCard.class_eval do
   def has_payment_profile?
     gateway_customer_profile_id.present? || gateway_payment_profile_id.present?
   end
+
+  
 end
diff --git a/app/views/spree/checkout/payment/_gateway.html.haml b/app/views/spree/checkout/payment/_gateway.html.haml
index 8fbf7dc052..b78733ee01 100644
--- a/app/views/spree/checkout/payment/_gateway.html.haml
+++ b/app/views/spree/checkout/payment/_gateway.html.haml
@@ -2,12 +2,13 @@
   .small-6.columns
     %label
       = t :first_name
-    %input{type: :text, disabled: true, "ng-value" => "order.bill_address.firstname"}
+      -# Changing name not permitted by default (in checkout) - can be enabled by setting an allow_name_change variable in $scope
+    %input{type: :text, "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.firstname"}
 
   .small-6.columns
     %label
       = t :last_name
-    %input{type: :text, disabled: true, "ng-value" => "order.bill_address.lastname"}
+    %input{type: :text, "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.lastname"}
 
   .small-6.columns
     = validated_input t(:card_number), "secrets.card_number", "ng-required" => "!secrets.selected_card", maxlength: 19, autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"
diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index 8272cc9eeb..304813f9c7 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -1,5 +1,9 @@
 .darkswarm
   = inject_orders_by_distributor
+  = inject_saved_credit_cards
+
+  :javascript
+    Stripe.setPublishableKey("#{ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']}")
 
   .row.pad-top
     .small-12.columns.pad-top
@@ -9,6 +13,59 @@
           = @user.email
           (#{link_to t(:edit), spree.edit_account_path})
 
+      %h3
+        = t(:my_credit_cards)
+        .credit_cards{"ng-controller" => "CreditCardsCtrl"}
+          %h4
+            = t(:saved_cards)
+          .row
+            .card_list.small-12.columns
+              %span{"ng-repeat" => "card in savedCreditCards"}
+                %span{"ng-bind" => "card.formatted"}
+          %h4
+            = t(:add_new_credit_card)
+          .row
+            .new_card.small-12.columns
+              %form{novalidate: true, "ng-submit" => "storeCard()"}
+                -# render "spree/checkout/payment/gateway"
+                .row
+                  .small-6.columns
+                    %label
+                      = t :first_name
+                      -# Changing name not permitted by default (in checkout) - can be enabled by setting an allow_name_change variable in $scope
+                    %input{type: :text,  "ng-model" => "secrets.first_name","ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.firstname"}
+
+                  .small-6.columns
+                    %label
+                      = t :last_name
+                    %input{type: :text, "ng-model" => "secrets.last_name", "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.lastname"}
+
+                  .small-6.columns
+                    %label
+                      = t(:card_number)
+                    %input{type: :text, "ng-model" => "secrets.card_number", "ng-required" => "!secrets.selected_card", maxlength: 19, autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
+                  .small-6.columns
+                    %label
+                      = t(:card_securitycode)
+                    %input{type: :text, "ng-model" => "secrets.card_verification_value", "ng-required" => "!secrets.selected_card", autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
+
+                .row
+                  .small-12.columns
+                    %label{for: "secrets.card_month"}
+                      = t :card_expiry_date, "ng-disabled" => "!!secrets.selected_card"
+
+                .row
+                  .small-6.columns
+                    %select{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
+                  .small-6.columns
+                    %select{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
+
+
+                %p
+                  %button.button.primary{type: :submit}
+                    = t :add_card
+
+      %h3= t(:my_orders)
       .orders{"ng-controller" => "OrdersCtrl", "ng-cloak" => true}
         .my-open-orders{ ng: { show: 'Orders.changeable_orders.length > 0' } }
           %h3= t(:open_orders)

From c9c4680ef61c43e2ee8ebc87125ea74dc986a6be Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Mon, 1 May 2017 20:21:30 +0100
Subject: [PATCH 192/353] Backend code to create Stripe customers and store
 their IDs in CreditCards. Page refresh not working

---
 .../credit_cards_controller.js.coffee         | 11 -----
 .../darkswarm/services/credit_card.js.coffee  | 27 +++++++++--
 .../spree/credit_cards_controller.rb          | 47 +++++++++++++++++++
 config/routes.rb                              |  1 +
 .../spree/credit_cards_controller_spec.rb     | 31 ++++++++++++
 5 files changed, 101 insertions(+), 16 deletions(-)
 create mode 100644 app/controllers/spree/credit_cards_controller.rb
 create mode 100644 spec/controllers/spree/credit_cards_controller_spec.rb

diff --git a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
index 17193cfd5a..6fd7fa314c 100644
--- a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
@@ -10,16 +10,5 @@ Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, savedCred
 
   $scope.secrets = CreditCard.secrets
 
-
-
   $scope.storeCard = =>
-    Loading.message = "Saving"
     CreditCard.requestToken($scope.secrets)
-
-
-
-
-
-    # Need to call Spree::Gateway::StripeConnect#provider.store(creditcard)
-    # creditcard should be formatted as for a payment
-    # The token then needs to be associated with the Customer (in Stripe) - can be done in Ruby.
diff --git a/app/assets/javascripts/darkswarm/services/credit_card.js.coffee b/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
index e5aeec61fc..00c3d8212e 100644
--- a/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
@@ -1,16 +1,33 @@
 Darkswarm.factory 'CreditCard', ($injector, $rootScope, StripeJS, Navigation, $http, RailsFlashLoader, Loading)->
   new class CreditCard
     errors: {}
+    secrets: {}
 
     requestToken: (secrets) ->
-      #$scope.secrets.name = $scope.secrets.first_name + " " + $scope.secrets.last_name
       secrets.name = @full_name(secrets)
-      StripeJS.requestToken(secrets, @submit)
+      StripeJS.requestToken(secrets, @submit, t("saving_credit_card"))
 
     submit: =>
-      $rootScope.$apply ->
-        Loading.clear()
-      Navigation.go '/account'
+      params = @process_params()
+      $http.put('/credit_cards/new_from_token', params )
+        .success (data, status) ->
+          $rootScope.$apply ->
+            Loading.clear()
+          Navigation.go '/account'
+        .error (response, status) ->
+          if response.path
+            Navigation.go response.path
+          else
+            Loading.clear()
+            @errors = response.errors
+            RailsFlashLoader.loadFlash(response.flash)
 
     full_name: (secrets) ->
       secrets.first_name + " " + secrets.last_name
+
+    process_params: ->
+      {"exp_month": @secrets.card.exp_month,
+      "exp_year": @secrets.card.exp_year,
+      "last4": @secrets.card.last4,
+      "token": @secrets.token,
+      "cc_type": @secrets.card.brand}
diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
new file mode 100644
index 0000000000..b49c93ec1c
--- /dev/null
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -0,0 +1,47 @@
+module Spree
+  class CreditCardsController < BaseController
+
+    def new_from_token
+      set_user
+      # At the moment a new Customer is created for every credit card (even via ActiveMerchant),
+      # so doing the same here (for now).
+      if @customer = create_customer(params[:token])
+      # Since it's a new customer, the default_source is the card that our original token represented
+        credit_card_params = format_credit_card_params(params)
+                                .merge({gateway_payment_profile_id: @customer.default_source,
+                                        gateway_customer_profile_id: @customer.id,
+                                        cc_type: params[:cc_type]
+                                        })
+
+        @credit_card = Spree::CreditCard.new(credit_card_params)
+        # Can't mass assign these:
+        @credit_card.cc_type = credit_card_params[:cc_type]
+        @credit_card.last_digits = credit_card_params[:last_digits]
+        @credit_card.user_id = @user.id
+        if @credit_card.save
+          render json: @credit_card, status: :ok
+        else
+          render json: "error saving credit card", status: 500
+        end
+      else
+        render json: "error creating Stripe customer", status: 500
+      end
+    end
+
+  private
+    def create_customer(token)
+      Stripe::Customer.create(email: @user.email, source: token)
+    end
+
+    def format_credit_card_params(params_hash)
+      { month: params_hash[:exp_month],
+        year: params_hash[:exp_year],
+        last_digits: params_hash[:last4]
+      }
+    end
+
+    def set_user
+      @user = spree_current_user
+    end
+  end
+end
diff --git a/config/routes.rb b/config/routes.rb
index d6c4c7330c..90c6534a91 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -234,6 +234,7 @@ Spree::Core::Engine.routes.prepend do
   match '/admin/reports/xero_invoices' => 'admin/reports#xero_invoices', :as => "xero_invoices_admin_reports",  :via  => [:get, :post]
   match '/admin', :to => 'admin/overview#index', :as => :admin
   match '/admin/payment_methods/show_provider_preferences' => 'admin/payment_methods#show_provider_preferences', :via => :get
+  put 'credit_cards/new_from_token', to: 'credit_cards#new_from_token'
 
 
   namespace :api, :defaults => { :format => 'json' } do
diff --git a/spec/controllers/spree/credit_cards_controller_spec.rb b/spec/controllers/spree/credit_cards_controller_spec.rb
new file mode 100644
index 0000000000..dc543f061b
--- /dev/null
+++ b/spec/controllers/spree/credit_cards_controller_spec.rb
@@ -0,0 +1,31 @@
+require 'spec_helper'
+require 'support/request/authentication_workflow'
+
+describe Spree::CreditCardsController do
+  include AuthenticationWorkflow
+  let(:user) { create_enterprise_user }
+
+  it "Creates a credit card from token + params" do
+    controller.stub(:spree_current_user) { user }
+    controller.stub(:create_customer) {
+      sc = Stripe::Customer.new
+      sc.default_source = "card_1AEEbN2eZvKYlo2CMk6QwrN7"
+      sc.email = nil
+      sc.stub(:id) {"cus_AZNMJzuACN3Sgt"}
+      sc }
+
+    token = "tok_234bd2c22"
+    expect{ post :new_from_token, {
+      "exp_month" => 12,
+      "exp_year" => 2020,
+      "last4" => 4242,
+      "token" => token,
+      "cc_type" => "visa"
+    } }.to change(Spree::CreditCard, :count).by(1)
+
+    Spree::CreditCard.last.gateway_payment_profile_id.should eq "card_1AEEbN2eZvKYlo2CMk6QwrN7"
+    Spree::CreditCard.last.gateway_customer_profile_id.should eq "cus_AZNMJzuACN3Sgt"
+    Spree::CreditCard.last.user_id.should eq user.id
+    Spree::CreditCard.last.last_digits.should eq "4242"
+  end
+end

From 25f48d944c9b1e5f21e0b3873abfb1ad797ca91b Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Mon, 1 May 2017 22:18:33 +0100
Subject: [PATCH 193/353] Add delete links, tidy up UI a bit (WIP), page
 refresh after adding still doesn't work

---
 .../credit_cards_controller.js.coffee         |  4 ++++
 .../stylesheets/darkswarm/account.css.scss    |  3 +++
 .../spree/credit_cards_controller.rb          | 20 +++++++++++++++++++
 app/serializers/api/credit_card_serializer.rb |  6 +++++-
 app/views/spree/users/show.html.haml          | 19 +++++++++++-------
 config/routes.rb                              |  3 +++
 6 files changed, 47 insertions(+), 8 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
index 6fd7fa314c..d1d1833610 100644
--- a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
@@ -9,6 +9,10 @@ Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, savedCred
   $scope.years = Dates.years
 
   $scope.secrets = CreditCard.secrets
+  $scope.add_card_visible = false
 
   $scope.storeCard = =>
     CreditCard.requestToken($scope.secrets)
+
+  $scope.toggle = ->
+    $scope.add_card_visible = !($scope.add_card_visible)
diff --git a/app/assets/stylesheets/darkswarm/account.css.scss b/app/assets/stylesheets/darkswarm/account.css.scss
index 4c60033a2a..25b71afb70 100644
--- a/app/assets/stylesheets/darkswarm/account.css.scss
+++ b/app/assets/stylesheets/darkswarm/account.css.scss
@@ -5,6 +5,9 @@
   color: #4a4a4a;
 }
 
+.card {
+
+}
 
 .orders {
   margin-top: 50px;
diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
index b49c93ec1c..037455cc89 100644
--- a/app/controllers/spree/credit_cards_controller.rb
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -1,6 +1,9 @@
 module Spree
   class CreditCardsController < BaseController
 
+    before_filter :set_credit_card, only: [:destroy]
+    before_filter :destroy_at_stripe, only: [:destroy]
+
     def new_from_token
       set_user
       # At the moment a new Customer is created for every credit card (even via ActiveMerchant),
@@ -28,6 +31,19 @@ module Spree
       end
     end
 
+    def destroy
+      if @credit_card.destroy
+        redirect_to "/account"
+      end
+    end
+
+    # Currently can only destroy the whole customer object
+    def destroy_at_stripe
+      if stripe_customer = Stripe::Customer.retrieve( @credit_card.gateway_customer_profile_id )
+        stripe_customer.delete
+      end
+    end
+
   private
     def create_customer(token)
       Stripe::Customer.create(email: @user.email, source: token)
@@ -43,5 +59,9 @@ module Spree
     def set_user
       @user = spree_current_user
     end
+
+    def set_credit_card
+      @credit_card = Spree::CreditCard.find(params[:id])
+    end
   end
 end
diff --git a/app/serializers/api/credit_card_serializer.rb b/app/serializers/api/credit_card_serializer.rb
index 60e17c0fe6..44791b404a 100644
--- a/app/serializers/api/credit_card_serializer.rb
+++ b/app/serializers/api/credit_card_serializer.rb
@@ -1,5 +1,5 @@
 class Api::CreditCardSerializer < ActiveModel::Serializer
-  attributes :id, :formatted
+  attributes :id, :formatted, :delete_link
 
   def formatted
     elements = []
@@ -12,4 +12,8 @@ class Api::CreditCardSerializer < ActiveModel::Serializer
     elements << object.month.to_s + "/" + object.year.to_s if object.month # TODO: I18n
     elements.join(" ")
   end
+
+  def delete_link
+    Spree::Core::Engine.routes.url_helpers.credit_card_path(object.id)
+  end
 end
diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index 304813f9c7..7424672dba 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -19,15 +19,21 @@
           %h4
             = t(:saved_cards)
           .row
-            .card_list.small-12.columns
-              %span{"ng-repeat" => "card in savedCreditCards"}
+            .card_list.small-12.columns{"ng-repeat" => "card in savedCreditCards"}
+              %p.card
                 %span{"ng-bind" => "card.formatted"}
-          %h4
-            = t(:add_new_credit_card)
+                %a{"rel" => "nofollow", "data-method" => "delete", "ng-href" => "{{card.delete_link}}" }
+                  Delete
           .row
-            .new_card.small-12.columns
+            %h4{"ng-click" => "toggle()"}
+              .columns.small-10.medium-10
+                = t(:add_new_credit_card)
+              .columns.small-2.medium-2.text-right
+                %span.margin-top
+                  %i{"ng-class" => "{'ofn-i_005-caret-down' : !add_card_visible, 'ofn-i_006-caret-up' : add_card_visible}"}
+          .row
+            .new_card.small-12.columns{"ng-if" => 'add_card_visible', "ng-class" => "{'closed' : !add_card_visible, 'open' : add_card_visible}"}
               %form{novalidate: true, "ng-submit" => "storeCard()"}
-                -# render "spree/checkout/payment/gateway"
                 .row
                   .small-6.columns
                     %label
@@ -60,7 +66,6 @@
                   .small-6.columns
                     %select{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
 
-
                 %p
                   %button.button.primary{type: :submit}
                     = t :add_card
diff --git a/config/routes.rb b/config/routes.rb
index 90c6534a91..cf6f6bda4f 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -236,6 +236,8 @@ Spree::Core::Engine.routes.prepend do
   match '/admin/payment_methods/show_provider_preferences' => 'admin/payment_methods#show_provider_preferences', :via => :get
   put 'credit_cards/new_from_token', to: 'credit_cards#new_from_token'
 
+  resources :credit_cards
+
 
   namespace :api, :defaults => { :format => 'json' } do
     resources :users do
@@ -259,6 +261,7 @@ Spree::Core::Engine.routes.prepend do
     resources :orders do
       get :managed, on: :collection
     end
+
   end
 
   namespace :admin do

From ddac179f9ba7bdce0e353db315fa7e5a6abc4f00 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Mon, 1 May 2017 22:46:28 +0100
Subject: [PATCH 194/353] Add translations

---
 config/locales/en.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/config/locales/en.yml b/config/locales/en.yml
index bee42d8fee..4fe7a745e3 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -163,6 +163,15 @@ en:
   allow_cookies: "Allow Cookies"
   none: None
   notes: Notes
+  error: Error
+  processing_payment: Processing payment...
+  my_credit_cards: My credit cards
+  add_new_credit_card: Add new credit card
+  saved_cards: Saved cards
+  add_card: Add card
+  saving_credit_card: Saving credit card...
+
+
   actions:
     create_and_add_another: "Create and Add Another"
   admin:

From d1779b9457aa1745bc6a2382209f603c30df226f Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 11 May 2017 11:51:33 +1000
Subject: [PATCH 195/353] Keep timestamps as :null => false in schema

---
 db/schema.rb | 118 +++++++++++++++++++++++++--------------------------
 1 file changed, 59 insertions(+), 59 deletions(-)

diff --git a/db/schema.rb b/db/schema.rb
index 96afbe1b59..061c97e920 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -123,8 +123,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "distributors_shipping_methods", :force => true do |t|
     t.integer  "distributor_id"
     t.integer  "shipping_method_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",         :null => false
+    t.datetime "updated_at",         :null => false
   end
 
   add_index "distributors_shipping_methods", ["distributor_id"], :name => "index_distributors_shipping_methods_on_distributor_id"
@@ -134,8 +134,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "enterprise_id"
     t.string   "fee_type"
     t.string   "name"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                               :null => false
+    t.datetime "updated_at",                               :null => false
     t.integer  "tax_category_id"
     t.boolean  "inherits_tax_category", :default => false, :null => false
   end
@@ -221,8 +221,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "address_id"
     t.string   "pickup_times"
     t.string   "next_collection_at"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                                   :null => false
+    t.datetime "updated_at",                                   :null => false
     t.text     "distributor_info"
     t.string   "logo_file_name"
     t.string   "logo_content_type"
@@ -265,8 +265,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "exchange_fees", :force => true do |t|
     t.integer  "exchange_id"
     t.integer  "enterprise_fee_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",        :null => false
+    t.datetime "updated_at",        :null => false
   end
 
   add_index "exchange_fees", ["enterprise_fee_id"], :name => "index_exchange_fees_on_enterprise_fee_id"
@@ -275,8 +275,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "exchange_variants", :force => true do |t|
     t.integer  "exchange_id"
     t.integer  "variant_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",  :null => false
+    t.datetime "updated_at",  :null => false
   end
 
   add_index "exchange_variants", ["exchange_id"], :name => "index_exchange_variants_on_exchange_id"
@@ -289,8 +289,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "payment_enterprise_id"
     t.string   "pickup_time"
     t.string   "pickup_instructions"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                               :null => false
+    t.datetime "updated_at",                               :null => false
     t.boolean  "incoming",              :default => false, :null => false
     t.string   "receival_instructions"
   end
@@ -315,8 +315,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.datetime "orders_open_at"
     t.datetime "orders_close_at"
     t.integer  "coordinator_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",      :null => false
+    t.datetime "updated_at",      :null => false
   end
 
   create_table "producer_properties", :force => true do |t|
@@ -382,8 +382,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "alternative_phone"
     t.integer  "state_id"
     t.integer  "country_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",        :null => false
+    t.datetime "updated_at",        :null => false
     t.string   "company"
     t.float    "latitude"
     t.float    "longitude"
@@ -398,8 +398,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "label"
     t.string   "source_type"
     t.integer  "adjustable_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                                                       :null => false
+    t.datetime "updated_at",                                                       :null => false
     t.boolean  "mandatory"
     t.integer  "originator_id"
     t.string   "originator_type"
@@ -432,8 +432,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "type"
     t.integer  "calculable_id",   :null => false
     t.string   "calculable_type", :null => false
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",      :null => false
+    t.datetime "updated_at",      :null => false
   end
 
   create_table "spree_configurations", :force => true do |t|
@@ -493,8 +493,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "state"
     t.integer  "variant_id"
     t.integer  "order_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                             :null => false
+    t.datetime "updated_at",                             :null => false
     t.integer  "shipment_id"
     t.integer  "return_authorization_id"
   end
@@ -508,8 +508,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "variant_id"
     t.integer  "quantity",                                            :null => false
     t.decimal  "price",                :precision => 8,  :scale => 2, :null => false
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                                          :null => false
+    t.datetime "updated_at",                                          :null => false
     t.integer  "max_quantity"
     t.string   "currency"
     t.decimal  "distribution_fee",     :precision => 10, :scale => 2
@@ -524,8 +524,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "source_id"
     t.string   "source_type"
     t.text     "details"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",  :null => false
+    t.datetime "updated_at",  :null => false
   end
 
   create_table "spree_mail_methods", :force => true do |t|
@@ -538,8 +538,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "spree_option_types", :force => true do |t|
     t.string   "name",         :limit => 100
     t.string   "presentation", :limit => 100
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                                 :null => false
+    t.datetime "updated_at",                                 :null => false
     t.integer  "position",                    :default => 0, :null => false
   end
 
@@ -553,8 +553,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "name"
     t.string   "presentation"
     t.integer  "option_type_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",     :null => false
+    t.datetime "updated_at",     :null => false
   end
 
   create_table "spree_option_values_line_items", :id => false, :force => true do |t|
@@ -579,8 +579,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "state"
     t.decimal  "adjustment_total",                   :precision => 10, :scale => 2, :default => 0.0, :null => false
     t.integer  "user_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                                                                         :null => false
+    t.datetime "updated_at",                                                                         :null => false
     t.datetime "completed_at"
     t.integer  "bill_address_id"
     t.integer  "ship_address_id"
@@ -591,9 +591,9 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "email"
     t.text     "special_instructions"
     t.integer  "distributor_id"
+    t.integer  "order_cycle_id"
     t.string   "currency"
     t.string   "last_ip_address"
-    t.integer  "order_cycle_id"
     t.integer  "cart_id"
     t.integer  "customer_id"
   end
@@ -607,8 +607,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.text     "description"
     t.boolean  "active",      :default => true
     t.string   "environment", :default => "development"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                             :null => false
+    t.datetime "updated_at",                             :null => false
     t.datetime "deleted_at"
     t.string   "display_on"
   end
@@ -616,8 +616,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "spree_payments", :force => true do |t|
     t.decimal  "amount",               :precision => 10, :scale => 2, :default => 0.0, :null => false
     t.integer  "order_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                                                           :null => false
+    t.datetime "updated_at",                                                           :null => false
     t.integer  "source_id"
     t.string   "source_type"
     t.integer  "payment_method_id"
@@ -661,8 +661,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
 
   create_table "spree_preferences", :force => true do |t|
     t.text     "value"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at", :null => false
+    t.datetime "updated_at", :null => false
     t.string   "key"
     t.string   "value_type"
   end
@@ -695,8 +695,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "position"
     t.integer  "product_id"
     t.integer  "option_type_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",     :null => false
+    t.datetime "updated_at",     :null => false
   end
 
   create_table "spree_product_properties", :force => true do |t|
@@ -729,8 +729,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "meta_keywords"
     t.integer  "tax_category_id"
     t.integer  "shipping_category_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                              :null => false
+    t.datetime "updated_at",                              :null => false
     t.integer  "count_on_hand",        :default => 0
     t.integer  "supplier_id"
     t.boolean  "group_buy"
@@ -847,8 +847,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "order_id"
     t.integer  "shipping_method_id"
     t.integer  "address_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                                       :null => false
+    t.datetime "updated_at",                                       :null => false
     t.string   "state"
   end
 
@@ -865,8 +865,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
   create_table "spree_shipping_methods", :force => true do |t|
     t.string   "name"
     t.integer  "zone_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                             :null => false
+    t.datetime "updated_at",                             :null => false
     t.string   "display_on"
     t.integer  "shipping_category_id"
     t.boolean  "match_none"
@@ -894,8 +894,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "previous_state"
     t.integer  "stateful_id"
     t.integer  "user_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",     :null => false
+    t.datetime "updated_at",     :null => false
     t.string   "stateful_type"
     t.string   "next_state"
   end
@@ -928,8 +928,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
 
   create_table "spree_taxonomies", :force => true do |t|
     t.string   "name",                      :null => false
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                :null => false
+    t.datetime "updated_at",                :null => false
     t.integer  "position",   :default => 0
   end
 
@@ -939,8 +939,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "name",                             :null => false
     t.string   "permalink"
     t.integer  "taxonomy_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                       :null => false
+    t.datetime "updated_at",                       :null => false
     t.integer  "lft"
     t.integer  "rgt"
     t.string   "icon_file_name"
@@ -961,8 +961,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "permissable_id"
     t.string   "permissable_type"
     t.string   "token"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",       :null => false
+    t.datetime "updated_at",       :null => false
   end
 
   add_index "spree_tokenized_permissions", ["permissable_id", "permissable_type"], :name => "index_tokenized_name_and_type"
@@ -993,8 +993,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.string   "login"
     t.integer  "ship_address_id"
     t.integer  "bill_address_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                                          :null => false
+    t.datetime "updated_at",                                          :null => false
     t.string   "authentication_token"
     t.string   "unlock_token"
     t.datetime "locked_at"
@@ -1036,8 +1036,8 @@ ActiveRecord::Schema.define(:version => 20170921065259) do
     t.integer  "zoneable_id"
     t.string   "zoneable_type"
     t.integer  "zone_id"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",    :null => false
+    t.datetime "updated_at",    :null => false
   end
 
   create_table "spree_zones", :force => true do |t|

From 25907f97a8c5d3f3a01aea85da9e98d44a0eabe3 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 11 May 2017 11:52:13 +1000
Subject: [PATCH 196/353] Cleaning up Stripe Connect request spec

---
 spec/requests/stripe_connect_checkout_spec.rb | 27 +++++++------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index 10ebfd1c90..0c4d8de701 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -6,7 +6,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
   let!(:order_cycle) { create(:simple_order_cycle) }
   let!(:enterprise) { create(:distributor_enterprise) }
   let!(:exchange) { create(:exchange, order_cycle: order_cycle, sender: order_cycle.coordinator, receiver: enterprise, incoming: false, pickup_time: "Monday")}
-  let!(:shipping_method) { create(:shipping_method, distributors: [enterprise] ) }
+  let!(:shipping_method) { create(:free_shipping_method, distributors: [enterprise]) }
   let!(:payment_method) { create(:payment_method, type: "Spree::Gateway::StripeConnect", distributors: [enterprise]) }
   let!(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
   let!(:line_item) { create(:line_item, price: 12.34) }
@@ -15,7 +15,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
   let(:token) { "token123" }
   let(:params) { { order: {
       shipping_method_id: shipping_method.id,
-      payments_attributes: [{payment_method_id: payment_method.id, source_attributes: { gateway_payment_profile_id: token, cc_type: "visa", last_digits: "4242", month: 7, year:2017 }}],
+      payments_attributes: [{payment_method_id: payment_method.id, source_attributes: { gateway_payment_profile_id: token, cc_type: "visa", last_digits: "4242", month: 10, year: 2025 }}],
       bill_address_attributes: address.attributes.slice("firstname","lastname","address1","address2","phone","city","zipcode","state_id","country_id"),
       ship_address_attributes: address.attributes.slice("firstname","lastname","address1","address2","phone","city","zipcode","state_id","country_id")
   } } }
@@ -26,24 +26,22 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     order.reload.update_totals
     set_order order
 
+    # Storing the card against the user
     stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/customers")
+      .with(:body => { card: token, email: order.email})
       .to_return(status: 200, body: JSON.generate({ id: "cus_A123", default_card: "card_XyZ456", sources: { data: [{id: "1"}] } }), headers: {})
 
     stub_request(:post, "https://api.stripe.com/v1/tokens")
+      .with(:body => { card: "card_XyZ456", customer: "cus_A123"})
       .to_return(status: 200, body: JSON.generate({id: "tok_123"}), headers: {})
 
-#    stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
-#      .to_return(status: 200, body: JSON.generate({id: "ch_123"}), headers: {})
-
+    stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+      .with(:body => {"amount"=>"1234", "card"=>{"exp_month"=>"10", "exp_year"=>"2025"}, "currency"=>"aud", "description"=>"Spree Order ID: #{order.number}", "payment_user_agent"=>"Stripe/v1 ActiveMerchantBindings/1.63.0"})
+      .to_return(body: JSON.generate(charge_response_mock))
   end
 
   context "when the charge request is accepted" do
-    let(:response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
-
-    before do
-      stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
-      .to_return(body: JSON.generate(response_mock))
-    end
+    let(:charge_response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
 
     it "should process the payment" do
       put update_checkout_path, params
@@ -53,12 +51,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
   end
 
   context "when the charge request returns an error message" do
-    let(:response_mock) { { error: { message: "Bup-bow..."} } }
-
-    before do
-      stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
-        .to_return(body: JSON.generate(response_mock))
-    end
+    let(:charge_response_mock) { { error: { message: "Bup-bow..."} } }
 
     it "should not process the payment" do
       put update_checkout_path, params

From 269a60b36f8bb14caccb78c77178077bc49f68da Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 11 May 2017 16:47:58 +1000
Subject: [PATCH 197/353] Adding request specs for case when using an existing
 card stored by Stripe for payment

---
 app/controllers/checkout_controller.rb        |  4 +-
 app/models/spree/payment_decorator.rb         |  6 +-
 spec/requests/stripe_connect_checkout_spec.rb | 99 ++++++++++++++-----
 3 files changed, 78 insertions(+), 31 deletions(-)

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index d06eb1f1c2..39fccfb075 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -210,8 +210,8 @@ class CheckoutController < Spree::CheckoutController
     existing_card_id = params[:order].delete(:existing_card)
     if existing_card_id.present?
       credit_card = Spree::CreditCard.find(existing_card_id)
-      if credit_card.user_id != spree_current_user.id || credit_card.user_id.blank?
-        raise Core::GatewayError.new Spree.t(:invalid_credit_card)
+      if credit_card.try(:user_id).blank? || credit_card.user_id != spree_current_user.try(:id)
+        raise Spree::Core::GatewayError.new I18n.t(:invalid_credit_card)
       end
 
       # Not currently supported but maybe we should add it...?
diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index c7cd8aa409..bede38dbe7 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -93,9 +93,9 @@ module Spree
     end
 
     def create_payment_profile
-      return unless source.is_a?(CreditCard) &&
-        (source.number || source.gateway_payment_profile_id) &&
-          source.gateway_customer_profile_id.nil?
+      return unless source.is_a?(CreditCard)
+      return unless source.number || source.gateway_payment_profile_id
+      return unless source.gateway_customer_profile_id.nil?
       payment_method.create_profile(self)
     rescue ActiveMerchant::ConnectionError => e
       gateway_error e
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index 0c4d8de701..1be74260ce 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -2,11 +2,12 @@ require 'spec_helper'
 
 describe "Submitting Stripe Connect charge requests", type: :request do
   include ShopWorkflow
+  include AuthenticationWorkflow
 
   let!(:order_cycle) { create(:simple_order_cycle) }
   let!(:enterprise) { create(:distributor_enterprise) }
   let!(:exchange) { create(:exchange, order_cycle: order_cycle, sender: order_cycle.coordinator, receiver: enterprise, incoming: false, pickup_time: "Monday")}
-  let!(:shipping_method) { create(:free_shipping_method, distributors: [enterprise]) }
+  let!(:shipping_method) { create(:shipping_method, calculator: Spree::Calculator::FlatRate.new(preferred_amount: 0), distributors: [enterprise]) }
   let!(:payment_method) { create(:payment_method, type: "Spree::Gateway::StripeConnect", distributors: [enterprise]) }
   let!(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
   let!(:line_item) { create(:line_item, price: 12.34) }
@@ -25,38 +26,84 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     order.update_attributes(distributor_id: enterprise.id, order_cycle_id: order_cycle.id)
     order.reload.update_totals
     set_order order
-
-    # Storing the card against the user
-    stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/customers")
-      .with(:body => { card: token, email: order.email})
-      .to_return(status: 200, body: JSON.generate({ id: "cus_A123", default_card: "card_XyZ456", sources: { data: [{id: "1"}] } }), headers: {})
-
-    stub_request(:post, "https://api.stripe.com/v1/tokens")
-      .with(:body => { card: "card_XyZ456", customer: "cus_A123"})
-      .to_return(status: 200, body: JSON.generate({id: "tok_123"}), headers: {})
-
-    stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
-      .with(:body => {"amount"=>"1234", "card"=>{"exp_month"=>"10", "exp_year"=>"2025"}, "currency"=>"aud", "description"=>"Spree Order ID: #{order.number}", "payment_user_agent"=>"Stripe/v1 ActiveMerchantBindings/1.63.0"})
-      .to_return(body: JSON.generate(charge_response_mock))
   end
 
-  context "when the charge request is accepted" do
-    let(:charge_response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
+  context "when a new card is submitted" do
+    before do
+      # Saves the card against the user
+      stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/customers")
+        .with(:body => { card: token, email: order.email})
+        .to_return(status: 200, body: JSON.generate({ id: "cus_A123", default_card: "card_XyZ456", sources: { data: [{id: "1"}] } }), headers: {})
 
-    it "should process the payment" do
-      put update_checkout_path, params
-      expect(response).to redirect_to(spree.order_path(order))
-      expect(order.payments.completed.count).to be 1
+      # Requests a token from the newly saved card
+      stub_request(:post, "https://api.stripe.com/v1/tokens")
+        .with(:body => { card: "card_XyZ456", customer: "cus_A123"})
+        .to_return(status: 200, body: JSON.generate({id: "newtoken_123"}), headers: {})
+
+      # Charges the card
+      stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+        .with(:body => {"amount"=>"1234", "card"=>"newtoken_123", "currency"=>"aud", "description"=>"Spree Order ID: #{order.number}", "payment_user_agent"=>"Stripe/v1 ActiveMerchantBindings/1.63.0"})
+        .to_return(body: JSON.generate(charge_response_mock))
+    end
+
+    context "and the charge request is accepted" do
+      let(:charge_response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
+
+      it "should process the payment, and stores the card/customer details" do
+        put update_checkout_path, params
+        expect(response).to redirect_to(spree.order_path(order))
+        expect(order.payments.completed.count).to be 1
+        card = order.payments.completed.first.source
+        expect(card.gateway_customer_profile_id).to eq "cus_A123"
+        expect(card.gateway_payment_profile_id).to eq "card_XyZ456"
+      end
+    end
+
+    context "when the charge request returns an error message" do
+      let(:charge_response_mock) { { error: { message: "Bup-bow..."} } }
+
+      it "should not process the payment" do
+        put update_checkout_path, params
+        expect(response).to render_template(:edit)
+        expect(order.payments.completed.count).to be 0
+      end
     end
   end
 
-  context "when the charge request returns an error message" do
-    let(:charge_response_mock) { { error: { message: "Bup-bow..."} } }
+  context "when an existing card is submitted" do
+    let(:credit_card) { create(:credit_card,
+      payment_method_id: payment_method.id,
+      user_id: order.user_id,
+      gateway_payment_profile_id: "card_AbC123",
+      gateway_customer_profile_id: "cus_Z456",
+      month: 11, year: 2026) }
 
-    it "should not process the payment" do
-      put update_checkout_path, params
-      expect(response).to render_template(:edit)
-      expect(order.payments.completed.count).to be 0
+    before do
+      params[:order][:existing_card] = credit_card.id
+      quick_login_as(order.user)
+
+      # Requests a token
+      stub_request(:post, "https://api.stripe.com/v1/tokens")
+        .with(:body => {"card"=>"card_AbC123", "customer"=>"cus_Z456"})
+        .to_return(status: 200, body: JSON.generate({id: "newtoken_123"}), headers: {})
+
+      # Charges the card
+      stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+        .with(:body => {"amount"=>"1234", "card"=>"newtoken_123", "currency"=>"aud", "description"=>"Spree Order ID: #{order.number}", "payment_user_agent"=>"Stripe/v1 ActiveMerchantBindings/1.63.0"})
+        .to_return(body: JSON.generate(charge_response_mock))
+    end
+
+    context "and the charge request is accepted" do
+      let(:charge_response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
+
+      it "should process the payment, and keep the profile ids" do
+        put update_checkout_path, params
+        expect(response).to redirect_to(spree.order_path(order))
+        expect(order.payments.completed.count).to be 1
+        card = order.payments.completed.first.source
+        expect(card.gateway_customer_profile_id).to eq "cus_Z456"
+        expect(card.gateway_payment_profile_id).to eq "card_AbC123"
+      end
     end
   end
 end

From b8c6da301cf83e217890a9491352f4d9e0ddef9c Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 18 May 2017 19:13:12 +1000
Subject: [PATCH 198/353] Removing unnecessary dependencies from OrdersCtrl

---
 .../darkswarm/controllers/orders_controller.js.coffee           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/assets/javascripts/darkswarm/controllers/orders_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/orders_controller.js.coffee
index 116a2b6fd8..63e28f77a8 100644
--- a/app/assets/javascripts/darkswarm/controllers/orders_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/orders_controller.js.coffee
@@ -1,2 +1,2 @@
-Darkswarm.controller "OrdersCtrl", ($scope, $rootScope, $timeout, Orders, Search, $document, HashNavigation, FilterSelectorsService, EnterpriseModal, enterpriseMatchesNameQueryFilter, distanceWithinKmFilter) ->
+Darkswarm.controller "OrdersCtrl", ($scope, Orders) ->
   $scope.Orders = Orders

From ed5c6504561cb0e063eed5387187b2338a85e09d Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 18 May 2017 19:14:33 +1000
Subject: [PATCH 199/353] Writing a new tabset component for front-end tabs

Modeled on back-end 'panels' infrastructure
---
 .../darkswarm/directives/tab.js.coffee        | 12 ++++++++
 .../darkswarm/directives/tab_view.coffee      | 15 ++++++++++
 .../directives/tabset_ctrl.js.coffee          | 28 +++++++++++++++++++
 .../darkswarm/services/tabsets.js.coffee      | 22 +++++++++++++++
 4 files changed, 77 insertions(+)
 create mode 100644 app/assets/javascripts/darkswarm/directives/tab.js.coffee
 create mode 100644 app/assets/javascripts/darkswarm/directives/tab_view.coffee
 create mode 100644 app/assets/javascripts/darkswarm/directives/tabset_ctrl.js.coffee
 create mode 100644 app/assets/javascripts/darkswarm/services/tabsets.js.coffee

diff --git a/app/assets/javascripts/darkswarm/directives/tab.js.coffee b/app/assets/javascripts/darkswarm/directives/tab.js.coffee
new file mode 100644
index 0000000000..0265f9fb6e
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/directives/tab.js.coffee
@@ -0,0 +1,12 @@
+Darkswarm.directive "tab", ->
+  restrict: "C"
+  require: "^^tabsetCtrl"
+  scope:
+    name: "@"
+  link: (scope, element, attrs, ctrl) ->
+    element.on "click", ->
+      scope.$apply ->
+        ctrl.toggle(scope.name)
+
+    ctrl.registerSelectionListener (selection) ->
+      element.toggleClass('selected', selection == scope.name)
diff --git a/app/assets/javascripts/darkswarm/directives/tab_view.coffee b/app/assets/javascripts/darkswarm/directives/tab_view.coffee
new file mode 100644
index 0000000000..b9b35317b8
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/directives/tab_view.coffee
@@ -0,0 +1,15 @@
+Darkswarm.directive "tabView", ->
+  restrict: "C"
+  require: "^^tabsetCtrl"
+  template: "<div ng-include='template'></div>"
+  scope:
+    templates: "="
+  link: (scope, element, attrs, ctrl) ->
+    scope.template = null
+
+    ctrl.registerSelectionListener (prefix, selection) ->
+      if selection?
+        selection = "#{prefix}/#{selection}" if prefix?
+        scope.template = "#{selection}.html"
+      else
+        scope.template = null
diff --git a/app/assets/javascripts/darkswarm/directives/tabset_ctrl.js.coffee b/app/assets/javascripts/darkswarm/directives/tabset_ctrl.js.coffee
new file mode 100644
index 0000000000..dd8d9a279b
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/directives/tabset_ctrl.js.coffee
@@ -0,0 +1,28 @@
+Darkswarm.directive "tabsetCtrl", (Tabsets, $location) ->
+  restrict: "C"
+  scope:
+    id: "@"
+    selected: "@"
+    navigate: "="
+    prefix: "@?"
+  controller: ($scope, $element) ->
+    if $scope.navigate
+      path = $location.path()?.match(/^\/\w+$/)?[0]
+      $scope.selected = path[1..] if path
+
+    this.toggle = (name) ->
+      Tabsets.toggle($scope.id, name)
+
+    this.select = (selection) ->
+      $scope.$broadcast("selection:changed", selection)
+      $element.toggleClass("expanded", selection?)
+      $location.path(selection) if $scope.navigate
+
+    this.registerSelectionListener = (callback) ->
+      $scope.$on "selection:changed", (event, selection) ->
+        callback($scope.prefix, selection)
+
+    this
+
+  link: (scope, element, attrs, ctrl) ->
+    Tabsets.register(ctrl, scope.id, scope.selected)
diff --git a/app/assets/javascripts/darkswarm/services/tabsets.js.coffee b/app/assets/javascripts/darkswarm/services/tabsets.js.coffee
new file mode 100644
index 0000000000..9c24c48485
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/services/tabsets.js.coffee
@@ -0,0 +1,22 @@
+Darkswarm.factory 'Tabsets', ->
+  new class Tabsets
+    tabsets: []
+
+    register: (ctrl, id, selected=null) ->
+      if ctrl? && id?
+        @tabsets.push { ctrl: ctrl, id: id, selected: selected }
+        ctrl.select(selected) if selected?
+
+    toggle: (id, name, state=null) ->
+      tabset = @findTabsetByObject(id)
+      if tabset.selected == name
+        @select(tabset, null) unless state == "open"
+      else
+        @select(tabset, name) unless state == "closed"
+
+    select: (tabset, name) ->
+      tabset.selected = name
+      tabset.ctrl.select(name)
+
+    findTabsetByObject: (id) ->
+      (tabset for tabset in @tabsets when tabset.id == id)[0]

From 1aebee05839ee639061b69bd13868944878d6e99 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 18 May 2017 19:15:22 +1000
Subject: [PATCH 200/353] WIP: rebuilding accounts page using tabs
 infrastructure

---
 .../darkswarm/directives/tab.js.coffee        |  2 +-
 app/views/spree/users/_cards.html.haml        | 56 +++++++++++++
 app/views/spree/users/_details.html.haml      |  2 +
 app/views/spree/users/_history.html.haml      | 12 +++
 app/views/spree/users/_orders.html.haml       | 10 +++
 app/views/spree/users/show.html.haml          | 82 +++----------------
 6 files changed, 91 insertions(+), 73 deletions(-)
 create mode 100644 app/views/spree/users/_cards.html.haml
 create mode 100644 app/views/spree/users/_details.html.haml
 create mode 100644 app/views/spree/users/_history.html.haml
 create mode 100644 app/views/spree/users/_orders.html.haml

diff --git a/app/assets/javascripts/darkswarm/directives/tab.js.coffee b/app/assets/javascripts/darkswarm/directives/tab.js.coffee
index 0265f9fb6e..d68e629688 100644
--- a/app/assets/javascripts/darkswarm/directives/tab.js.coffee
+++ b/app/assets/javascripts/darkswarm/directives/tab.js.coffee
@@ -8,5 +8,5 @@ Darkswarm.directive "tab", ->
       scope.$apply ->
         ctrl.toggle(scope.name)
 
-    ctrl.registerSelectionListener (selection) ->
+    ctrl.registerSelectionListener (prefix, selection) ->
       element.toggleClass('selected', selection == scope.name)
diff --git a/app/views/spree/users/_cards.html.haml b/app/views/spree/users/_cards.html.haml
new file mode 100644
index 0000000000..a887f0e8df
--- /dev/null
+++ b/app/views/spree/users/_cards.html.haml
@@ -0,0 +1,56 @@
+%script{ type: "text/ng-template", id: "account/cards.html" }
+  %h3= t(:my_credit_cards)
+  .credit_cards{"ng-controller" => "CreditCardsCtrl"}
+    %h4
+      = t(:saved_cards)
+    .row
+      .card_list.small-12.columns{"ng-repeat" => "card in savedCreditCards"}
+        %p.card
+          %span{"ng-bind" => "card.formatted"}
+          %a{"rel" => "nofollow", "data-method" => "delete", "ng-href" => "{{card.delete_link}}" }
+            Delete
+    .row
+      %h4{"ng-click" => "toggle()"}
+        .columns.small-10.medium-10
+          = t(:add_new_credit_card)
+        .columns.small-2.medium-2.text-right
+          %span.margin-top
+            %i{"ng-class" => "{'ofn-i_005-caret-down' : !add_card_visible, 'ofn-i_006-caret-up' : add_card_visible}"}
+    .row
+      .new_card.small-12.columns{"ng-if" => 'add_card_visible', "ng-class" => "{'closed' : !add_card_visible, 'open' : add_card_visible}"}
+        %form{novalidate: true, "ng-submit" => "storeCard()"}
+          .row
+            .small-6.columns
+              %label
+                = t :first_name
+                -# Changing name not permitted by default (in checkout) - can be enabled by setting an allow_name_change variable in $scope
+              %input{type: :text,  "ng-model" => "secrets.first_name","ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.firstname"}
+
+            .small-6.columns
+              %label
+                = t :last_name
+              %input{type: :text, "ng-model" => "secrets.last_name", "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.lastname"}
+
+            .small-6.columns
+              %label
+                = t(:card_number)
+              %input{type: :text, "ng-model" => "secrets.card_number", "ng-required" => "!secrets.selected_card", maxlength: 19, autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
+            .small-6.columns
+              %label
+                = t(:card_securitycode)
+              %input{type: :text, "ng-model" => "secrets.card_verification_value", "ng-required" => "!secrets.selected_card", autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
+
+          .row
+            .small-12.columns
+              %label{for: "secrets.card_month"}
+                = t :card_expiry_date, "ng-disabled" => "!!secrets.selected_card"
+
+          .row
+            .small-6.columns
+              %select{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
+            .small-6.columns
+              %select{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
+
+          %p
+            %button.button.primary{type: :submit}
+              = t :add_card
diff --git a/app/views/spree/users/_details.html.haml b/app/views/spree/users/_details.html.haml
new file mode 100644
index 0000000000..fe804d2e18
--- /dev/null
+++ b/app/views/spree/users/_details.html.haml
@@ -0,0 +1,2 @@
+%script{ type: "text/ng-template", id: "account/details.html" }
+  Details
diff --git a/app/views/spree/users/_history.html.haml b/app/views/spree/users/_history.html.haml
new file mode 100644
index 0000000000..1c15525d4c
--- /dev/null
+++ b/app/views/spree/users/_history.html.haml
@@ -0,0 +1,12 @@
+%script{ type: "text/ng-template", id: "account/history.html" }
+  .orders{"ng-controller" => "OrdersCtrl", "ng-cloak" => true}
+    .active_table
+      %h3.my-orders= t(:transaction_history)
+      %distributor.active_table_node.row.animate-repeat{"ng-if" => "Orders.orders_by_distributor.length > 0", "ng-repeat" => "(key, distributor) in Orders.orders_by_distributor",
+      "ng-controller" => "DistributorNodeCtrl",
+      "ng-class" => "{'closed' : !open(), 'open' : open(), 'inactive' : !distributor.active}",
+      id: "{{distributor.hash}}"}
+        .small-12.columns
+          = render partial: "spree/users/skinny"
+          = render partial: "spree/users/fat"
+    .message{"ng-if" => "Orders.orders_by_distributor.length == 0", "ng-bind" => "::'you_have_no_orders_yet' | t"}
diff --git a/app/views/spree/users/_orders.html.haml b/app/views/spree/users/_orders.html.haml
new file mode 100644
index 0000000000..0be5f800fe
--- /dev/null
+++ b/app/views/spree/users/_orders.html.haml
@@ -0,0 +1,10 @@
+%script{ type: "text/ng-template", id: "account/orders.html" }
+  .orders{"ng-controller" => "OrdersCtrl", "ng-cloak" => true}
+    .my-open-orders{ ng: { show: 'Orders.changeable_orders.length > 0' } }
+      %h3= t(:open_orders)
+      = render 'open_orders'
+
+    .past-orders
+      %h3= t(:past_orders)
+      -# = render 'past_orders'
+    .message{"ng-if" => "Orders.changeable_orders.length == 0", "ng-bind" => "::'you_have_no_orders_yet' | t"}
diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index 7424672dba..f5f91349b3 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -13,78 +13,16 @@
           = @user.email
           (#{link_to t(:edit), spree.edit_account_path})
 
-      %h3
-        = t(:my_credit_cards)
-        .credit_cards{"ng-controller" => "CreditCardsCtrl"}
-          %h4
-            = t(:saved_cards)
-          .row
-            .card_list.small-12.columns{"ng-repeat" => "card in savedCreditCards"}
-              %p.card
-                %span{"ng-bind" => "card.formatted"}
-                %a{"rel" => "nofollow", "data-method" => "delete", "ng-href" => "{{card.delete_link}}" }
-                  Delete
-          .row
-            %h4{"ng-click" => "toggle()"}
-              .columns.small-10.medium-10
-                = t(:add_new_credit_card)
-              .columns.small-2.medium-2.text-right
-                %span.margin-top
-                  %i{"ng-class" => "{'ofn-i_005-caret-down' : !add_card_visible, 'ofn-i_006-caret-up' : add_card_visible}"}
-          .row
-            .new_card.small-12.columns{"ng-if" => 'add_card_visible', "ng-class" => "{'closed' : !add_card_visible, 'open' : add_card_visible}"}
-              %form{novalidate: true, "ng-submit" => "storeCard()"}
-                .row
-                  .small-6.columns
-                    %label
-                      = t :first_name
-                      -# Changing name not permitted by default (in checkout) - can be enabled by setting an allow_name_change variable in $scope
-                    %input{type: :text,  "ng-model" => "secrets.first_name","ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.firstname"}
+    = render 'orders'
+    = render 'cards'
+    = render 'history'
+    = render 'cards'
 
-                  .small-6.columns
-                    %label
-                      = t :last_name
-                    %input{type: :text, "ng-model" => "secrets.last_name", "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.lastname"}
-
-                  .small-6.columns
-                    %label
-                      = t(:card_number)
-                    %input{type: :text, "ng-model" => "secrets.card_number", "ng-required" => "!secrets.selected_card", maxlength: 19, autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
-                  .small-6.columns
-                    %label
-                      = t(:card_securitycode)
-                    %input{type: :text, "ng-model" => "secrets.card_verification_value", "ng-required" => "!secrets.selected_card", autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
-
-                .row
-                  .small-12.columns
-                    %label{for: "secrets.card_month"}
-                      = t :card_expiry_date, "ng-disabled" => "!!secrets.selected_card"
-
-                .row
-                  .small-6.columns
-                    %select{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
-                  .small-6.columns
-                    %select{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
-
-                %p
-                  %button.button.primary{type: :submit}
-                    = t :add_card
-
-      %h3= t(:my_orders)
-      .orders{"ng-controller" => "OrdersCtrl", "ng-cloak" => true}
-        .my-open-orders{ ng: { show: 'Orders.changeable_orders.length > 0' } }
-          %h3= t(:open_orders)
-          = render 'open_orders'
-
-        .active_table
-          %h3.my-orders= t(:transaction_history)
-          %distributor.active_table_node.row.animate-repeat{"ng-if" => "Orders.orders_by_distributor.length > 0", "ng-repeat" => "(key, distributor) in Orders.orders_by_distributor",
-          "ng-controller" => "DistributorNodeCtrl",
-          "ng-class" => "{'closed' : !open(), 'open' : open(), 'inactive' : !distributor.active}",
-          id: "{{distributor.hash}}"}
-            .small-12.columns
-              = render partial: "spree/users/skinny"
-              = render partial: "spree/users/fat"
-        .message{"ng-if" => "Orders.orders_by_distributor.length == 0", "ng-bind" => "::'you_have_no_orders_yet' | t"}
+  .row.tabset-ctrl#account-tabs{ style: 'margin-bottom: 100px', navigate: 'true', selected: 'orders', prefix: 'account' }
+    .small.12.medium-3.columns.tab{ name: "orders" } Orders
+    .small.12.medium-3.columns.tab{ name: "cards" } Cards
+    .small.12.medium-3.columns.tab{ name: "history" } History
+    .small.12.medium-3.columns.tab{ name: "details" } Details
+    .small-12.columns.tab-view
 
   = render partial: "shared/footer"

From 778526af2e09df5bed66e27c33e09a7729a4b41a Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 25 May 2017 16:22:04 +1000
Subject: [PATCH 201/353] Rewriting styling for new tabs components

---
 .../stylesheets/darkswarm/account.css.scss    |  5 +-
 .../stylesheets/darkswarm/tabset.css.scss     | 71 +++++++++++++++++++
 app/views/spree/users/_history.html.haml      | 21 +++---
 app/views/spree/users/show.html.haml          | 12 ++--
 4 files changed, 93 insertions(+), 16 deletions(-)
 create mode 100644 app/assets/stylesheets/darkswarm/tabset.css.scss

diff --git a/app/assets/stylesheets/darkswarm/account.css.scss b/app/assets/stylesheets/darkswarm/account.css.scss
index 25b71afb70..3b5050f66c 100644
--- a/app/assets/stylesheets/darkswarm/account.css.scss
+++ b/app/assets/stylesheets/darkswarm/account.css.scss
@@ -10,7 +10,6 @@
 }
 
 .orders {
-  margin-top: 50px;
   margin-bottom: 100px;
 
   a {
@@ -27,6 +26,10 @@
     height: auto;
   }
 
+  &.active_table {
+    margin: 0px;
+  }
+
   .active_table_row {
     h3 {
       margin-top: 0.5em;
diff --git a/app/assets/stylesheets/darkswarm/tabset.css.scss b/app/assets/stylesheets/darkswarm/tabset.css.scss
new file mode 100644
index 0000000000..eaefe188a8
--- /dev/null
+++ b/app/assets/stylesheets/darkswarm/tabset.css.scss
@@ -0,0 +1,71 @@
+@import "typography";
+@import "mixins";
+@import "branding";
+
+.tabset-ctrl {
+  .tab-view {
+    padding-top: 30px;
+  }
+
+  .tab {
+    text-align: center;
+
+    @media all and (max-width: 640px) {
+      text-align: left;
+    }
+
+    a {
+      @include headingFont;
+
+      background: transparent;
+      text-transform: uppercase;
+      font-size: 1.5em;
+      text-shadow: 0 -1px 1px #ffffff;
+      padding: 1em;
+      border: none;
+
+      @media all and (max-width: 640px) {
+        padding: 0.35em 0 0.65em 0;
+        text-shadow: none;
+      }
+    }
+
+    border-bottom: 4px solid transparent;
+
+    &:hover, &:focus, &:active {
+      transition: all 0.4s ease-in-out;
+      border-bottom: 4px solid $clr-brick-bright;
+      cursor: pointer;
+
+      @media all and (max-width: 640px) {
+        transition: none;
+        color: white;
+        background-color: $clr-brick-bright;
+      }
+
+      a {
+        color: $clr-brick-bright;
+
+        @media all and (max-width: 640px) {
+          color: #ffffff;
+        }
+      }
+    }
+
+    &.selected {
+      border-bottom: 4px solid $clr-brick;
+
+      @media all and (max-width: 640px) {
+        background-color: $clr-brick;
+      }
+
+      a {
+        color: $clr-brick;
+
+        @media all and (max-width: 640px) {
+          color: #ffffff;
+        }
+      }
+    }
+  }
+}
diff --git a/app/views/spree/users/_history.html.haml b/app/views/spree/users/_history.html.haml
index 1c15525d4c..77ab67e74f 100644
--- a/app/views/spree/users/_history.html.haml
+++ b/app/views/spree/users/_history.html.haml
@@ -1,12 +1,11 @@
 %script{ type: "text/ng-template", id: "account/history.html" }
-  .orders{"ng-controller" => "OrdersCtrl", "ng-cloak" => true}
-    .active_table
-      %h3.my-orders= t(:transaction_history)
-      %distributor.active_table_node.row.animate-repeat{"ng-if" => "Orders.orders_by_distributor.length > 0", "ng-repeat" => "(key, distributor) in Orders.orders_by_distributor",
-      "ng-controller" => "DistributorNodeCtrl",
-      "ng-class" => "{'closed' : !open(), 'open' : open(), 'inactive' : !distributor.active}",
-      id: "{{distributor.hash}}"}
-        .small-12.columns
-          = render partial: "spree/users/skinny"
-          = render partial: "spree/users/fat"
-    .message{"ng-if" => "Orders.orders_by_distributor.length == 0", "ng-bind" => "::'you_have_no_orders_yet' | t"}
+  .active_table.orders{"ng-controller" => "OrdersCtrl", "ng-cloak" => true}
+    %h3.my-orders= t(:transaction_history)
+    %distributor.active_table_node.row.animate-repeat{"ng-if" => "Orders.orders_by_distributor.length > 0", "ng-repeat" => "(key, distributor) in Orders.orders_by_distributor",
+    "ng-controller" => "DistributorNodeCtrl",
+    "ng-class" => "{'closed' : !open(), 'open' : open(), 'inactive' : !distributor.active}",
+    id: "{{distributor.hash}}"}
+      .small-12.columns
+        = render partial: "spree/users/skinny"
+        = render partial: "spree/users/fat"
+  .message{"ng-if" => "Orders.orders_by_distributor.length == 0", "ng-bind" => "::'you_have_no_orders_yet' | t"}
diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index f5f91349b3..ecf06885cd 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -19,10 +19,14 @@
     = render 'cards'
 
   .row.tabset-ctrl#account-tabs{ style: 'margin-bottom: 100px', navigate: 'true', selected: 'orders', prefix: 'account' }
-    .small.12.medium-3.columns.tab{ name: "orders" } Orders
-    .small.12.medium-3.columns.tab{ name: "cards" } Cards
-    .small.12.medium-3.columns.tab{ name: "history" } History
-    .small.12.medium-3.columns.tab{ name: "details" } Details
+    .small.12.medium-3.columns.tab{ name: "orders" }
+      %a{ href: 'javascript:void(0)' } My Orders
+    .small.12.medium-3.columns.tab{ name: "cards" }
+      %a{ href: 'javascript:void(0)' } My Credit Cards
+    .small.12.medium-3.columns.tab{ name: "history" }
+      %a{ href: 'javascript:void(0)' } Transactions
+    .small.12.medium-3.columns.tab{ name: "details" }
+      %a{ href: 'javascript:void(0)' }My Details
     .small-12.columns.tab-view
 
   = render partial: "shared/footer"

From f4c3fbf8bc5000bd4de074877215d4ae8a8e8590 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 26 May 2017 17:16:07 +1000
Subject: [PATCH 202/353] Refactoring credit cards interface, and backend logic

---
 .../credit_cards_controller.js.coffee         | 18 ++----
 .../darkswarm/services/credit_card.js.coffee  | 30 +++++----
 .../darkswarm/services/credit_cards.js.coffee |  6 ++
 .../darkswarm/services/navigation.js.coffee   |  3 +
 .../stylesheets/darkswarm/account.css.scss    | 15 ++++-
 .../spree/credit_cards_controller.rb          |  2 +-
 app/helpers/injection_helper.rb               |  6 +-
 app/models/spree/credit_card_decorator.rb     |  2 -
 app/serializers/api/credit_card_serializer.rb | 26 +++++---
 app/serializers/api/payment_serializer.rb     |  2 +-
 app/views/spree/users/_cards.html.haml        | 63 ++++---------------
 .../spree/users/_new_card_form.html.haml      | 35 +++++++++++
 app/views/spree/users/_saved_cards.html.haml  | 13 ++++
 config/locales/en.yml                         |  3 +-
 .../spree/credit_cards_controller_spec.rb     | 16 +++--
 spec/features/consumer/account/cards_spec.rb  | 31 +++++++++
 .../consumer/shopping/checkout_spec.rb        |  4 +-
 .../credit_card_serializer_spec.rb            |  2 +-
 18 files changed, 169 insertions(+), 108 deletions(-)
 create mode 100644 app/assets/javascripts/darkswarm/services/credit_cards.js.coffee
 create mode 100644 app/views/spree/users/_new_card_form.html.haml
 create mode 100644 app/views/spree/users/_saved_cards.html.haml
 create mode 100644 spec/features/consumer/account/cards_spec.rb

diff --git a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
index d1d1833610..1ddfc45d16 100644
--- a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
@@ -1,18 +1,12 @@
-Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, savedCreditCards, StripeJS, Dates, Loading) ->
+Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, CreditCards, StripeJS, Dates) ->
   angular.extend(this, new FieldsetMixin($scope))
-  $scope.savedCreditCards = savedCreditCards
+  $scope.savedCreditCards = CreditCards.saved
   $scope.CreditCard = CreditCard
+  $scope.secrets = CreditCard.secrets
+  $scope.showForm = CreditCard.show
+  $scope.storeCard = CreditCard.requestToken
+
   $scope.allow_name_change = true
   $scope.disable_fields = false
-
   $scope.months = Dates.months
   $scope.years = Dates.years
-
-  $scope.secrets = CreditCard.secrets
-  $scope.add_card_visible = false
-
-  $scope.storeCard = =>
-    CreditCard.requestToken($scope.secrets)
-
-  $scope.toggle = ->
-    $scope.add_card_visible = !($scope.add_card_visible)
diff --git a/app/assets/javascripts/darkswarm/services/credit_card.js.coffee b/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
index 00c3d8212e..4f0488ad17 100644
--- a/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
@@ -1,20 +1,21 @@
-Darkswarm.factory 'CreditCard', ($injector, $rootScope, StripeJS, Navigation, $http, RailsFlashLoader, Loading)->
+Darkswarm.factory 'CreditCard', ($injector, $rootScope, CreditCards, StripeJS, Navigation, $http, RailsFlashLoader, Loading)->
   new class CreditCard
+    visible: false
     errors: {}
     secrets: {}
 
-    requestToken: (secrets) ->
-      secrets.name = @full_name(secrets)
-      StripeJS.requestToken(secrets, @submit, t("saving_credit_card"))
+    requestToken: =>
+      @setFullName()
+      StripeJS.requestToken(@secrets, @submit, t("saving_credit_card"))
 
     submit: =>
       params = @process_params()
       $http.put('/credit_cards/new_from_token', params )
-        .success (data, status) ->
-          $rootScope.$apply ->
-            Loading.clear()
-          Navigation.go '/account'
-        .error (response, status) ->
+        .success (data, status) =>
+          Loading.clear()
+          @reset()
+          CreditCards.add(data)
+        .error (response, status) =>
           if response.path
             Navigation.go response.path
           else
@@ -22,8 +23,8 @@ Darkswarm.factory 'CreditCard', ($injector, $rootScope, StripeJS, Navigation, $h
             @errors = response.errors
             RailsFlashLoader.loadFlash(response.flash)
 
-    full_name: (secrets) ->
-      secrets.first_name + " " + secrets.last_name
+    setFullName: ->
+      @secrets.name = "#{@secrets.first_name} #{@secrets.last_name}"
 
     process_params: ->
       {"exp_month": @secrets.card.exp_month,
@@ -31,3 +32,10 @@ Darkswarm.factory 'CreditCard', ($injector, $rootScope, StripeJS, Navigation, $h
       "last4": @secrets.card.last4,
       "token": @secrets.token,
       "cc_type": @secrets.card.brand}
+
+    show: => @visible = true
+
+    reset: =>
+      @visible = false
+      delete @secrets[k] for k, v of @secrets
+      delete @errors[k] for k, v of @errors
diff --git a/app/assets/javascripts/darkswarm/services/credit_cards.js.coffee b/app/assets/javascripts/darkswarm/services/credit_cards.js.coffee
new file mode 100644
index 0000000000..c588ef681c
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/services/credit_cards.js.coffee
@@ -0,0 +1,6 @@
+Darkswarm.factory 'CreditCards', (savedCreditCards)->
+  new class CreditCard
+    saved: savedCreditCards
+
+    add: (card) ->
+      @saved.push card
diff --git a/app/assets/javascripts/darkswarm/services/navigation.js.coffee b/app/assets/javascripts/darkswarm/services/navigation.js.coffee
index e2b04f3ad1..f511e29e0c 100644
--- a/app/assets/javascripts/darkswarm/services/navigation.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/navigation.js.coffee
@@ -21,3 +21,6 @@ Darkswarm.factory 'Navigation', ($location, $window) ->
         $window.location.href = path
       else
         $window.location.pathname = path
+
+    reload: ->
+      $window.location.reload()
diff --git a/app/assets/stylesheets/darkswarm/account.css.scss b/app/assets/stylesheets/darkswarm/account.css.scss
index 3b5050f66c..78f8c0dfd9 100644
--- a/app/assets/stylesheets/darkswarm/account.css.scss
+++ b/app/assets/stylesheets/darkswarm/account.css.scss
@@ -5,8 +5,21 @@
   color: #4a4a4a;
 }
 
-.card {
+.credit_cards {
+  .saved_cards {
+    table {
+      width: 100%;
+    }
+  }
 
+  .new_card {
+    opacity: 0;
+    -webkit-transition: opacity 0.4s linear;
+    transition: opacity 0.4s linear;
+    &.visible {
+      opacity: 1;
+    }
+  }
 }
 
 .orders {
diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
index 037455cc89..ea9f1890f5 100644
--- a/app/controllers/spree/credit_cards_controller.rb
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -22,7 +22,7 @@ module Spree
         @credit_card.last_digits = credit_card_params[:last_digits]
         @credit_card.user_id = @user.id
         if @credit_card.save
-          render json: @credit_card, status: :ok
+          render json: @credit_card, serializer: ::Api::CreditCardSerializer, status: :ok
         else
           render json: "error saving credit card", status: 500
         end
diff --git a/app/helpers/injection_helper.rb b/app/helpers/injection_helper.rb
index 89609c7b04..447bc5241f 100644
--- a/app/helpers/injection_helper.rb
+++ b/app/helpers/injection_helper.rb
@@ -70,11 +70,7 @@ module InjectionHelper
   end
 
   def inject_saved_credit_cards
-    if spree_current_user
-      data = spree_current_user.credit_cards
-    else
-      data = nil
-    end
+    data = spree_current_user.try(:credit_cards)
     inject_json_ams "savedCreditCards", data, Api::CreditCardSerializer
   end
 
diff --git a/app/models/spree/credit_card_decorator.rb b/app/models/spree/credit_card_decorator.rb
index 32c14a1285..0744bf5da5 100644
--- a/app/models/spree/credit_card_decorator.rb
+++ b/app/models/spree/credit_card_decorator.rb
@@ -10,6 +10,4 @@ Spree::CreditCard.class_eval do
   def has_payment_profile?
     gateway_customer_profile_id.present? || gateway_payment_profile_id.present?
   end
-
-  
 end
diff --git a/app/serializers/api/credit_card_serializer.rb b/app/serializers/api/credit_card_serializer.rb
index 44791b404a..34b3bd124f 100644
--- a/app/serializers/api/credit_card_serializer.rb
+++ b/app/serializers/api/credit_card_serializer.rb
@@ -1,16 +1,22 @@
 class Api::CreditCardSerializer < ActiveModel::Serializer
-  attributes :id, :formatted, :delete_link
+  attributes :id, :brand, :number, :expiry, :formatted, :delete_link
+
+  def brand
+    object.cc_type.capitalize
+  end
+
+  def number
+    'x-' + object.last_digits
+  end
+
+  def expiry
+    m = object.month.to_i
+    m = m < 10 ? "0#{m}" : m.to_s
+    "#{m}/#{object.year}"
+  end
 
   def formatted
-    elements = []
-    elements << object.cc_type.capitalize if object.cc_type
-    if object.last_digits
-      3.times { elements << I18n.t(:card_masked_digit) * 4 }
-      elements << object.last_digits
-    end
-    elements << I18n.t(:card_expiry_abbreviation)
-    elements << object.month.to_s + "/" + object.year.to_s if object.month # TODO: I18n
-    elements.join(" ")
+    "#{brand} #{number} #{I18n.t(:card_expiry_abbreviation)}:#{expiry}"
   end
 
   def delete_link
diff --git a/app/serializers/api/payment_serializer.rb b/app/serializers/api/payment_serializer.rb
index 8465998db6..f610fcdb58 100644
--- a/app/serializers/api/payment_serializer.rb
+++ b/app/serializers/api/payment_serializer.rb
@@ -2,7 +2,7 @@ module Api
   class PaymentSerializer < ActiveModel::Serializer
     attributes :amount, :updated_at, :payment_method, :state
     def payment_method
-      object.payment_method.name
+      object.payment_method.try(:name)
     end
 
     def amount
diff --git a/app/views/spree/users/_cards.html.haml b/app/views/spree/users/_cards.html.haml
index a887f0e8df..108e45cc37 100644
--- a/app/views/spree/users/_cards.html.haml
+++ b/app/views/spree/users/_cards.html.haml
@@ -1,56 +1,15 @@
 %script{ type: "text/ng-template", id: "account/cards.html" }
-  %h3= t(:my_credit_cards)
   .credit_cards{"ng-controller" => "CreditCardsCtrl"}
-    %h4
-      = t(:saved_cards)
     .row
-      .card_list.small-12.columns{"ng-repeat" => "card in savedCreditCards"}
-        %p.card
-          %span{"ng-bind" => "card.formatted"}
-          %a{"rel" => "nofollow", "data-method" => "delete", "ng-href" => "{{card.delete_link}}" }
-            Delete
-    .row
-      %h4{"ng-click" => "toggle()"}
-        .columns.small-10.medium-10
-          = t(:add_new_credit_card)
-        .columns.small-2.medium-2.text-right
-          %span.margin-top
-            %i{"ng-class" => "{'ofn-i_005-caret-down' : !add_card_visible, 'ofn-i_006-caret-up' : add_card_visible}"}
-    .row
-      .new_card.small-12.columns{"ng-if" => 'add_card_visible', "ng-class" => "{'closed' : !add_card_visible, 'open' : add_card_visible}"}
-        %form{novalidate: true, "ng-submit" => "storeCard()"}
-          .row
-            .small-6.columns
-              %label
-                = t :first_name
-                -# Changing name not permitted by default (in checkout) - can be enabled by setting an allow_name_change variable in $scope
-              %input{type: :text,  "ng-model" => "secrets.first_name","ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.firstname"}
+      .small-12.medium-6.columns
+        %span{ ng: { hide: 'savedCreditCards.length > 0' } }
+          &nbsp;
+        .saved_cards{ ng: { show: 'savedCreditCards.length > 0' } }
+          %h3= t(:saved_cards)
+          = render 'saved_cards'
+        %button.button.primary{ ng: { click: 'showForm()', hide: 'CreditCard.visible' } }
+          = t(:add_a_card)
 
-            .small-6.columns
-              %label
-                = t :last_name
-              %input{type: :text, "ng-model" => "secrets.last_name", "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.lastname"}
-
-            .small-6.columns
-              %label
-                = t(:card_number)
-              %input{type: :text, "ng-model" => "secrets.card_number", "ng-required" => "!secrets.selected_card", maxlength: 19, autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
-            .small-6.columns
-              %label
-                = t(:card_securitycode)
-              %input{type: :text, "ng-model" => "secrets.card_verification_value", "ng-required" => "!secrets.selected_card", autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
-
-          .row
-            .small-12.columns
-              %label{for: "secrets.card_month"}
-                = t :card_expiry_date, "ng-disabled" => "!!secrets.selected_card"
-
-          .row
-            .small-6.columns
-              %select{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
-            .small-6.columns
-              %select{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
-
-          %p
-            %button.button.primary{type: :submit}
-              = t :add_card
+      .small-12.medium-6.columns.new_card{ ng: { class: '{visible: CreditCard.visible}' } }
+        %h3= t(:add_a_new_card)
+        = render 'new_card_form'
diff --git a/app/views/spree/users/_new_card_form.html.haml b/app/views/spree/users/_new_card_form.html.haml
new file mode 100644
index 0000000000..03dc9ff1c5
--- /dev/null
+++ b/app/views/spree/users/_new_card_form.html.haml
@@ -0,0 +1,35 @@
+%form{ novalidate: true, "ng-submit" => "storeCard()" }
+  .row
+    .small-6.columns
+      %label
+        = t(:first_name)
+        -# Changing name not permitted by default (in checkout) - can be enabled by setting an allow_name_change variable in $scope
+      %input#first_name{type: :text,  "ng-model" => "secrets.first_name","ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.firstname"}
+
+    .small-6.columns
+      %label
+        = t(:last_name)
+      %input#last_name{type: :text, "ng-model" => "secrets.last_name", "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.lastname"}
+  .row
+    .small-6.columns
+      %label
+        = t(:card_number)
+      %input#card_number{type: :text, "ng-model" => "secrets.card_number", "ng-required" => "!secrets.selected_card", maxlength: 19, autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
+    .small-6.columns
+      %label
+        = t(:card_securitycode)
+      %input#security_code{type: :text, "ng-model" => "secrets.card_verification_value", "ng-required" => "!secrets.selected_card", autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
+
+  .row
+    .small-12.columns
+      %label{for: "secrets.card_month"}
+        = t(:card_expiry_date)
+  .row
+    .small-6.columns
+      %select#card_month{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
+    .small-6.columns
+      %select#card_year{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
+
+  %p
+    %button.button.primary{type: :submit}
+      = t(:add_card)
diff --git a/app/views/spree/users/_saved_cards.html.haml b/app/views/spree/users/_saved_cards.html.haml
new file mode 100644
index 0000000000..8df81eeeca
--- /dev/null
+++ b/app/views/spree/users/_saved_cards.html.haml
@@ -0,0 +1,13 @@
+%table
+  %tr
+    %th= t(:card_type)
+    %th= t(:card_number)
+    %th= t(:card_expiry_date)
+    %th= t(:delete?)
+  %tr.card{ id: "card{{ card.id }}", ng: { repeat: "card in savedCreditCards" } }
+    %td.brand{ ng: { bind: '::card.brand' } }
+    %td.number{ ng: { bind: '::card.number' } }
+    %td.expiry{ ng: { bind: '::card.expiry' } }
+    %td.actions
+      %a{"rel" => "nofollow", "data-method" => "delete", "ng-href" => "{{card.delete_link}}" }
+        Delete
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 4fe7a745e3..e8d5a5f616 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -168,7 +168,8 @@ en:
   my_credit_cards: My credit cards
   add_new_credit_card: Add new credit card
   saved_cards: Saved cards
-  add_card: Add card
+  add_a_card: Add a Card
+  add_card: Add Card
   saving_credit_card: Saving credit card...
 
 
diff --git a/spec/controllers/spree/credit_cards_controller_spec.rb b/spec/controllers/spree/credit_cards_controller_spec.rb
index dc543f061b..e37987b61f 100644
--- a/spec/controllers/spree/credit_cards_controller_spec.rb
+++ b/spec/controllers/spree/credit_cards_controller_spec.rb
@@ -4,17 +4,15 @@ require 'support/request/authentication_workflow'
 describe Spree::CreditCardsController do
   include AuthenticationWorkflow
   let(:user) { create_enterprise_user }
+  let(:token) { "tok_234bd2c22" }
 
   it "Creates a credit card from token + params" do
     controller.stub(:spree_current_user) { user }
-    controller.stub(:create_customer) {
-      sc = Stripe::Customer.new
-      sc.default_source = "card_1AEEbN2eZvKYlo2CMk6QwrN7"
-      sc.email = nil
-      sc.stub(:id) {"cus_AZNMJzuACN3Sgt"}
-      sc }
 
-    token = "tok_234bd2c22"
+    stub_request(:post, "https://api.stripe.com/v1/customers")
+      .with(:body => { email: user.email, source: token })
+      .to_return(status: 200, body: JSON.generate({ id: "cus_AZNMJ", default_source: "card_1AEEb" }))
+
     expect{ post :new_from_token, {
       "exp_month" => 12,
       "exp_year" => 2020,
@@ -23,8 +21,8 @@ describe Spree::CreditCardsController do
       "cc_type" => "visa"
     } }.to change(Spree::CreditCard, :count).by(1)
 
-    Spree::CreditCard.last.gateway_payment_profile_id.should eq "card_1AEEbN2eZvKYlo2CMk6QwrN7"
-    Spree::CreditCard.last.gateway_customer_profile_id.should eq "cus_AZNMJzuACN3Sgt"
+    Spree::CreditCard.last.gateway_payment_profile_id.should eq "card_1AEEb"
+    Spree::CreditCard.last.gateway_customer_profile_id.should eq "cus_AZNMJ"
     Spree::CreditCard.last.user_id.should eq user.id
     Spree::CreditCard.last.last_digits.should eq "4242"
   end
diff --git a/spec/features/consumer/account/cards_spec.rb b/spec/features/consumer/account/cards_spec.rb
new file mode 100644
index 0000000000..0dbf2108dc
--- /dev/null
+++ b/spec/features/consumer/account/cards_spec.rb
@@ -0,0 +1,31 @@
+require 'spec_helper'
+
+feature "Credit Cards", js: true do
+  include AuthenticationWorkflow
+  describe "as a logged in user" do
+    let(:user) { create(:user) }
+    let!(:card) { create(:credit_card, user_id: user.id) }
+
+    before do
+      quick_login_as user
+    end
+
+    it "lists saved cards, shows interface for adding new cards" do
+      visit "/account"
+
+      click_link 'My Credit Cards'
+
+      expect(page).to have_content I18n.t(:saved_cards)
+
+      within(".card#card#{card.id}") do
+        expect(page).to have_content card.cc_type.capitalize
+        expect(page).to have_content card.last_digits
+      end
+
+      click_button I18n.t(:add_a_card)
+      expect(page).to have_field 'first_name'
+      expect(page).to have_field 'card_number'
+      expect(page).to have_field 'card_month'
+    end
+  end
+end
diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index fb128714f7..ae2d0e0f38 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -171,12 +171,12 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
         end
 
         it "disables the input fields when a saved card is selected" do
-          select "Visa XXXX XXXX XXXX 1111 Exp 01/2025", from: "selected_card"
+          select "Visa x-1111 Exp:01/2025", from: "selected_card"
           page.should have_css "#secrets\\.card_number[disabled]"
         end
 
         it "allows use of a saved card" do
-          select "Visa XXXX XXXX XXXX 1111 Exp 01/2025", from: "selected_card"
+          select "Visa x-1111 Exp:01/2025", from: "selected_card"
           place_order
           page.should have_content "Your order has been processed successfully"
         end
diff --git a/spec/serializers/credit_card_serializer_spec.rb b/spec/serializers/credit_card_serializer_spec.rb
index 146055de05..100067b2e5 100644
--- a/spec/serializers/credit_card_serializer_spec.rb
+++ b/spec/serializers/credit_card_serializer_spec.rb
@@ -10,7 +10,7 @@ describe Api::CreditCardSerializer do
   end
 
   it "formats an identifying string with the card number masked" do
-    expect(serializer.formatted).to eq "Visa XXXX XXXX XXXX 1111 Exp 12/2013"
+    expect(serializer.formatted).to eq "Visa x-1111 Exp:12/2013"
   end
 
 end

From 532dc57725c84121d1c3d17679f3d88f361400ee Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 26 May 2017 17:22:53 +1000
Subject: [PATCH 203/353] Adding translations for /account tabs

---
 app/views/spree/users/show.html.haml         | 8 ++++----
 config/locales/en.yml                        | 5 +++++
 spec/features/consumer/account/cards_spec.rb | 2 +-
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index ecf06885cd..c7e685239c 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -20,13 +20,13 @@
 
   .row.tabset-ctrl#account-tabs{ style: 'margin-bottom: 100px', navigate: 'true', selected: 'orders', prefix: 'account' }
     .small.12.medium-3.columns.tab{ name: "orders" }
-      %a{ href: 'javascript:void(0)' } My Orders
+      %a{ href: 'javascript:void(0)' }=t('.tabs.orders')
     .small.12.medium-3.columns.tab{ name: "cards" }
-      %a{ href: 'javascript:void(0)' } My Credit Cards
+      %a{ href: 'javascript:void(0)' }=t('.tabs.cards')
     .small.12.medium-3.columns.tab{ name: "history" }
-      %a{ href: 'javascript:void(0)' } Transactions
+      %a{ href: 'javascript:void(0)' }=t('.tabs.transactions')
     .small.12.medium-3.columns.tab{ name: "details" }
-      %a{ href: 'javascript:void(0)' }My Details
+      %a{ href: 'javascript:void(0)' }=t('.tabs.details')
     .small-12.columns.tab-view
 
   = render partial: "shared/footer"
diff --git a/config/locales/en.yml b/config/locales/en.yml
index e8d5a5f616..ae1cdbebcd 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2190,6 +2190,11 @@ Please follow the instructions there to make your enterprise visible on the Open
       show:
         open_orders: Open Orders
         transaction_history: Transaction History
+        tabs:
+          orders: Orders
+          cards: Credit Cards
+          transactions: Transactions
+          details: Details
       open_orders:
         order: Order
         shop: Shop
diff --git a/spec/features/consumer/account/cards_spec.rb b/spec/features/consumer/account/cards_spec.rb
index 0dbf2108dc..48f9019e34 100644
--- a/spec/features/consumer/account/cards_spec.rb
+++ b/spec/features/consumer/account/cards_spec.rb
@@ -13,7 +13,7 @@ feature "Credit Cards", js: true do
     it "lists saved cards, shows interface for adding new cards" do
       visit "/account"
 
-      click_link 'My Credit Cards'
+      click_link I18n.t('spree.users.show.tabs.cards')
 
       expect(page).to have_content I18n.t(:saved_cards)
 

From 9733bb3a7755ccfd0c52563204a96d8d98b95afd Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 26 May 2017 17:25:10 +1000
Subject: [PATCH 204/353] Renaming account#history to account#transactions

---
 .../users/{_history.html.haml => _transactions.html.haml}     | 2 +-
 app/views/spree/users/show.html.haml                          | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)
 rename app/views/spree/users/{_history.html.haml => _transactions.html.haml} (90%)

diff --git a/app/views/spree/users/_history.html.haml b/app/views/spree/users/_transactions.html.haml
similarity index 90%
rename from app/views/spree/users/_history.html.haml
rename to app/views/spree/users/_transactions.html.haml
index 77ab67e74f..4006a72b50 100644
--- a/app/views/spree/users/_history.html.haml
+++ b/app/views/spree/users/_transactions.html.haml
@@ -1,4 +1,4 @@
-%script{ type: "text/ng-template", id: "account/history.html" }
+%script{ type: "text/ng-template", id: "account/transactions.html" }
   .active_table.orders{"ng-controller" => "OrdersCtrl", "ng-cloak" => true}
     %h3.my-orders= t(:transaction_history)
     %distributor.active_table_node.row.animate-repeat{"ng-if" => "Orders.orders_by_distributor.length > 0", "ng-repeat" => "(key, distributor) in Orders.orders_by_distributor",
diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index c7e685239c..c3e40708b8 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -15,7 +15,7 @@
 
     = render 'orders'
     = render 'cards'
-    = render 'history'
+    = render 'transactions'
     = render 'cards'
 
   .row.tabset-ctrl#account-tabs{ style: 'margin-bottom: 100px', navigate: 'true', selected: 'orders', prefix: 'account' }
@@ -23,7 +23,7 @@
       %a{ href: 'javascript:void(0)' }=t('.tabs.orders')
     .small.12.medium-3.columns.tab{ name: "cards" }
       %a{ href: 'javascript:void(0)' }=t('.tabs.cards')
-    .small.12.medium-3.columns.tab{ name: "history" }
+    .small.12.medium-3.columns.tab{ name: "transactions" }
       %a{ href: 'javascript:void(0)' }=t('.tabs.transactions')
     .small.12.medium-3.columns.tab{ name: "details" }
       %a{ href: 'javascript:void(0)' }=t('.tabs.details')

From b9d72ce4cf3c46a33bf74d4a52259c5526bc1976 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 26 May 2017 21:08:07 +1000
Subject: [PATCH 205/353] Refactoring logic for displaying orders on the
 front-end account page

---
 .../distributor_node_controller.js.coffee     |  9 ----
 .../shop_node_controller.js.coffee            |  9 ++++
 .../darkswarm/services/orders.js.coffee       | 35 +++++++-------
 .../spree/users_controller_decorator.rb       | 10 ++++
 app/helpers/injection_helper.rb               | 10 ++--
 app/models/spree/user_decorator.rb            | 26 ----------
 app/serializers/api/order_serializer.rb       | 13 +++--
 .../api/shop_for_orders_serializer.rb         | 13 +++++
 app/views/spree/users/_fat.html.haml          | 20 ++++----
 app/views/spree/users/_open_orders.html.haml  |  6 +--
 app/views/spree/users/_orders.html.haml       |  4 +-
 app/views/spree/users/_skinny.html.haml       |  6 +--
 app/views/spree/users/_transactions.html.haml | 10 ++--
 app/views/spree/users/show.html.haml          |  3 +-
 .../spree/users_controller_spec.rb            | 48 +++++++++++++++++++
 spec/features/consumer/account_spec.rb        |  2 +
 spec/models/spree/user_spec.rb                | 45 -----------------
 spec/serializers/order_serializer_spec.rb     |  6 +++
 .../orders_by_distributor_serializer_spec.rb  | 28 -----------
 19 files changed, 148 insertions(+), 155 deletions(-)
 delete mode 100644 app/assets/javascripts/darkswarm/controllers/distributor_node_controller.js.coffee
 create mode 100644 app/assets/javascripts/darkswarm/controllers/shop_node_controller.js.coffee
 create mode 100644 app/serializers/api/shop_for_orders_serializer.rb
 create mode 100644 spec/controllers/spree/users_controller_spec.rb
 delete mode 100644 spec/serializers/orders_by_distributor_serializer_spec.rb

diff --git a/app/assets/javascripts/darkswarm/controllers/distributor_node_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/distributor_node_controller.js.coffee
deleted file mode 100644
index 6705634771..0000000000
--- a/app/assets/javascripts/darkswarm/controllers/distributor_node_controller.js.coffee
+++ /dev/null
@@ -1,9 +0,0 @@
-Darkswarm.controller "DistributorNodeCtrl", ($scope, HashNavigation, $anchorScroll) ->
-  $scope.toggle = ->
-    HashNavigation.toggle $scope.distributor.hash
-
-  $scope.open = ->
-    HashNavigation.active($scope.distributor.hash)
-
-  if $scope.open()
-    $anchorScroll()
diff --git a/app/assets/javascripts/darkswarm/controllers/shop_node_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/shop_node_controller.js.coffee
new file mode 100644
index 0000000000..34c72f21b7
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/controllers/shop_node_controller.js.coffee
@@ -0,0 +1,9 @@
+Darkswarm.controller "ShopNodeCtrl", ($scope, HashNavigation, $anchorScroll) ->
+  $scope.toggle = ->
+    HashNavigation.toggle $scope.shop.hash
+
+  $scope.open = ->
+    HashNavigation.active($scope.shop.hash)
+
+  if $scope.open()
+    $anchorScroll()
diff --git a/app/assets/javascripts/darkswarm/services/orders.js.coffee b/app/assets/javascripts/darkswarm/services/orders.js.coffee
index 049c3baa5e..2e44f4010a 100644
--- a/app/assets/javascripts/darkswarm/services/orders.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/orders.js.coffee
@@ -1,22 +1,25 @@
-Darkswarm.factory 'Orders', (orders_by_distributor, currencyConfig, CurrentHub, Taxons, Dereferencer, visibleFilter, Matcher, Geo, $rootScope)->
+Darkswarm.factory 'Orders', (orders, shops, currencyConfig)->
   new class Orders
+    all: orders
+    changeable: []
+    shops: shops
+    shopsByID: {}
+    currencySymbol = currencyConfig.symbol
+
     constructor: ->
-      # Populate Orders.orders from json in page.
-      @orders_by_distributor = orders_by_distributor
-      @changeable_orders = []
-      @currency_symbol = currencyConfig.symbol
+      for shop in @shops
+        shop.orders = []
+        shop.balance = 0.0
+        @shopsByID[shop.id] = shop
 
-      for distributor in @orders_by_distributor
-        @findChangeableOrders(distributor.distributed_orders)
-        @updateRunningBalance(distributor.distributed_orders)
+      for order in @all by -1
+        shop = @shopsByID[order.shop_id]
+        shop.orders.unshift order
 
+        @changeable.unshift(order) if order.changes_allowed
 
-    updateRunningBalance: (orders) ->
-      for order, i in orders
-        balances = orders.slice(i,orders.length).map (o) -> parseFloat(o.outstanding_balance)
-        running_balance = balances.reduce (a,b) -> a+b
-        order.running_balance = running_balance.toFixed(2)
+        @updateRunningBalance(shop, order)
 
-    findChangeableOrders: (orders) ->
-      for order in orders when order.changes_allowed
-        @changeable_orders.push(order)
+    updateRunningBalance: (shop, order) ->
+      shop.balance += parseFloat(order.outstanding_balance)
+      order.runningBalance = shop.balance.toFixed(2)
diff --git a/app/controllers/spree/users_controller_decorator.rb b/app/controllers/spree/users_controller_decorator.rb
index d31ad77715..1657f17727 100644
--- a/app/controllers/spree/users_controller_decorator.rb
+++ b/app/controllers/spree/users_controller_decorator.rb
@@ -4,6 +4,16 @@ Spree::UsersController.class_eval do
   before_filter :enable_embedded_shopfront
   before_filter :set_credit_card, only: :show
 
+  # Override of spree_auth_devise default
+  # Ignores invoice orders, only order where state: 'complete'
+  def show
+    @orders = @user.orders.where(state: 'complete').order('completed_at desc')
+
+    if Spree::Config.accounts_distributor_id
+      @orders = @orders.where('distributor_id != ?', Spree::Config.accounts_distributor_id)
+    end
+  end
+
   private
 
   def set_credit_card
diff --git a/app/helpers/injection_helper.rb b/app/helpers/injection_helper.rb
index 447bc5241f..88309c09d2 100644
--- a/app/helpers/injection_helper.rb
+++ b/app/helpers/injection_helper.rb
@@ -64,9 +64,13 @@ module InjectionHelper
     render partial: "json/injection_ams", locals: {name: 'enterpriseAttributes', json: "#{@enterprise_attributes.to_json}"}
   end
 
-  def inject_orders_by_distributor
-    data_array = spree_current_user.orders_by_distributor
-    inject_json_ams "orders_by_distributor", data_array, Api::OrdersByDistributorSerializer
+  def inject_orders
+    inject_json_ams "orders", @orders.all, Api::OrderSerializer
+  end
+
+  def inject_shops
+    shops = Enterprise.where(id: @orders.pluck(:distributor_id).uniq)
+    inject_json_ams "shops", shops.all, Api::ShopForOrdersSerializer
   end
 
   def inject_saved_credit_cards
diff --git a/app/models/spree/user_decorator.rb b/app/models/spree/user_decorator.rb
index efbaf82f97..ace0c9e165 100644
--- a/app/models/spree/user_decorator.rb
+++ b/app/models/spree/user_decorator.rb
@@ -54,32 +54,6 @@ Spree.user_class.class_eval do
     owned_enterprises(:reload).size < enterprise_limit
   end
 
-  # Returns Enterprise IDs for distributors that the user has shopped at
-  def enterprises_ordered_from
-    enterprise_ids = orders.where(state: :complete).map(&:distributor_id).uniq
-    # Exclude the accounts distributor
-    if Spree::Config.accounts_distributor_id
-      enterprise_ids = enterprise_ids.keep_if { |a| a != Spree::Config.accounts_distributor_id }
-    end
-    enterprise_ids
-  end
-
-  # Returns orders and their associated payments for all distributors that have been ordered from
-  def complete_orders_by_distributor
-    Enterprise
-      .includes(distributed_orders: { payments: :payment_method })
-      .where(enterprises: { id: enterprises_ordered_from },
-             spree_orders: { state: 'complete', user_id: id })
-      .order('spree_orders.completed_at DESC')
-  end
-
-  def orders_by_distributor
-    # Remove uncompleted payments as these will not be reflected in order balance
-    data_array = complete_orders_by_distributor.to_a
-    remove_payments_in_checkout(data_array)
-    data_array.sort! { |a, b| b.distributed_orders.length <=> a.distributed_orders.length }
-  end
-
   private
 
   def limit_owned_enterprises
diff --git a/app/serializers/api/order_serializer.rb b/app/serializers/api/order_serializer.rb
index 7aa53a0d6b..328c1dc11a 100644
--- a/app/serializers/api/order_serializer.rb
+++ b/app/serializers/api/order_serializer.rb
@@ -1,13 +1,18 @@
 module Api
   class OrderSerializer < ActiveModel::Serializer
     attributes :number, :completed_at, :total, :state, :shipment_state, :payment_state
-    attributes :outstanding_balance, :payments, :path, :cancel_path, :changes_allowed, :changes_allowed_until
-    attributes :shop_name, :item_count
+    attributes :outstanding_balance, :payments, :path, :cancel_path
+    attributes :changes_allowed, :changes_allowed_until, :item_count
+    attributes :shop_id
 
     has_many :payments, serializer: Api::PaymentSerializer
 
-    def shop_name
-      object.distributor.andand.name
+    def payments
+      object.payments.joins(:payment_method).completed
+    end
+
+    def shop_id
+      object.distributor_id
     end
 
     def item_count
diff --git a/app/serializers/api/shop_for_orders_serializer.rb b/app/serializers/api/shop_for_orders_serializer.rb
new file mode 100644
index 0000000000..1b8fa51b85
--- /dev/null
+++ b/app/serializers/api/shop_for_orders_serializer.rb
@@ -0,0 +1,13 @@
+module Api
+  class ShopForOrdersSerializer < ActiveModel::Serializer
+    attributes :id, :name, :hash, :logo
+
+    def hash
+      object.to_param
+    end
+
+    def logo
+      object.logo(:small) if object.logo?
+    end
+  end
+end
diff --git a/app/views/spree/users/_fat.html.haml b/app/views/spree/users/_fat.html.haml
index 4ce051e5b8..1a4c74ed3e 100644
--- a/app/views/spree/users/_fat.html.haml
+++ b/app/views/spree/users/_fat.html.haml
@@ -9,16 +9,7 @@
         %th.order5.text-right= t :value
         %th.order6.text-right.show-for-large-up= t :outstanding_balance
         %th.order7.text-right= t :running_balance
-      %tbody.transaction-group{"ng-repeat" => "order in distributor.distributed_orders", "ng-class-odd"=>"'odd'", "ng-class-even"=>"'even'"}
-        %tr.order-row
-          %td.order1
-            %a{"ng-href" => "{{::order.path}}", "ng-bind" => "::('order' | t )+ ' ' + order.number"}
-          %td.order2{"ng-bind" => "::order.completed_at"}
-          %td.order3.show-for-large-up{"ng-bind" => "::'spree.payment_states.' + order.payment_state | t | capitalize"}
-          %td.order4.show-for-large-up{"ng-bind" => "::'spree.shipment_states.' + order.shipment_state | t | capitalize"}
-          %td.order5.text-right{"ng-class" => "{'credit' : order.total < 0, 'debit' : order.total > 0, 'paid' : order.total == 0}","ng-bind" => "::order.total | localizeCurrency"}
-          %td.order6.text-right.show-for-large-up{"ng-class" => "{'credit' : order.outstanding_balance < 0, 'debit' : order.outstanding_balance > 0, 'paid' : order.outstanding_balance == 0}", "ng-bind" => "::order.outstanding_balance | localizeCurrency"}
-          %td.order7.text-right{"ng-class" => "{'credit' : order.running_balance < 0, 'debit' : order.running_balance > 0, 'paid' : order.running_balance == 0}", "ng-bind" => "::order.running_balance | localizeCurrency"}
+      %tbody.transaction-group{"ng-repeat" => "order in shop.orders", "ng-class-odd"=>"'odd'", "ng-class-even"=>"'even'"}
         %tr.payment-row{"ng-repeat" => "payment in order.payments", "ng-class" => "{'invalid': payment.state != 'completed'}"}
           %td.order1{"ng-bind" => "::payment.payment_method"}
           %td.order2{"ng-bind" => "::payment.updated_at"}
@@ -29,3 +20,12 @@
           %td.order5.text-right{"ng-class" => "{'credit' : payment.amount > 0, 'debit' : payment.amount < 0, 'paid' : payment.amount == 0}","ng-bind" => "::payment.amount | localizeCurrency"}
           %td.order6.show-for-large-up
           %td.order7
+        %tr.order-row
+          %td.order1
+            %a{"ng-href" => "{{::order.path}}", "ng-bind" => "::('order' | t )+ ' ' + order.number"}
+          %td.order2{"ng-bind" => "::order.completed_at"}
+          %td.order3.show-for-large-up{"ng-bind" => "::'spree.payment_states.' + order.payment_state | t | capitalize"}
+          %td.order4.show-for-large-up{"ng-bind" => "::'spree.shipment_states.' + order.shipment_state | t | capitalize"}
+          %td.order5.text-right{"ng-class" => "{'credit' : order.total < 0, 'debit' : order.total > 0, 'paid' : order.total == 0}","ng-bind" => "::order.total | localizeCurrency"}
+          %td.order6.text-right.show-for-large-up{"ng-class" => "{'credit' : order.outstanding_balance < 0, 'debit' : order.outstanding_balance > 0, 'paid' : order.outstanding_balance == 0}", "ng-bind" => "::order.outstanding_balance | localizeCurrency"}
+          %td.order7.text-right{"ng-class" => "{'credit' : order.runningBalance < 0, 'debit' : order.runningBalance > 0, 'paid' : order.runningBalance == 0}", "ng-bind" => "::order.runningBalance | localizeCurrency"}
diff --git a/app/views/spree/users/_open_orders.html.haml b/app/views/spree/users/_open_orders.html.haml
index 5f78738e34..ed5e43b9b5 100644
--- a/app/views/spree/users/_open_orders.html.haml
+++ b/app/views/spree/users/_open_orders.html.haml
@@ -9,12 +9,12 @@
         %th.order5.text-right= t('.total')
         %th.order6.text-right.show-for-large-up= t('.edit')
         %th.order7.text-right= t('.cancel')
-      %tbody.transaction-group{"ng-repeat" => "order in Orders.changeable_orders", "ng-class-odd"=>"'odd'", "ng-class-even"=>"'even'"}
+      %tbody.transaction-group{"ng-repeat" => "order in Orders.changeable", "ng-class-odd"=>"'odd'", "ng-class-even"=>"'even'"}
         %tr.order-row
           %td.order1
             %a{"ng-href" => "{{::order.path}}", "ng-bind" => "::order.number"}
-          %td.order2{"ng-bind" => "::order.shop_name"}
-          %td.order3.show-for-large-up{"ng-bind" => "order.changes_allowed_until"}
+          %td.order2{"ng-bind" => "::Orders.shopsByID[order.shop_id].name"}
+          %td.order3.show-for-large-up{"ng-bind" => "::order.changes_allowed_until"}
           %td.order4.show-for-large-up{"ng-bind" => "::order.item_count"}
           %td.order5.text-right{"ng-class" => "{'credit' : order.total < 0, 'debit' : order.total > 0, 'paid' : order.total == 0}","ng-bind" => "::order.total | localizeCurrency"}
           %td.order6.text-right.show-for-large-up.brick
diff --git a/app/views/spree/users/_orders.html.haml b/app/views/spree/users/_orders.html.haml
index 0be5f800fe..e0b5d21066 100644
--- a/app/views/spree/users/_orders.html.haml
+++ b/app/views/spree/users/_orders.html.haml
@@ -1,10 +1,10 @@
 %script{ type: "text/ng-template", id: "account/orders.html" }
   .orders{"ng-controller" => "OrdersCtrl", "ng-cloak" => true}
-    .my-open-orders{ ng: { show: 'Orders.changeable_orders.length > 0' } }
+    .my-open-orders{ ng: { show: 'Orders.changeable.length > 0' } }
       %h3= t(:open_orders)
       = render 'open_orders'
 
     .past-orders
       %h3= t(:past_orders)
       -# = render 'past_orders'
-    .message{"ng-if" => "Orders.changeable_orders.length == 0", "ng-bind" => "::'you_have_no_orders_yet' | t"}
+    .message{"ng-if" => "Orders.all.length == 0", "ng-bind" => "::'you_have_no_orders_yet' | t"}
diff --git a/app/views/spree/users/_skinny.html.haml b/app/views/spree/users/_skinny.html.haml
index 70ba39d335..43bb039c46 100644
--- a/app/views/spree/users/_skinny.html.haml
+++ b/app/views/spree/users/_skinny.html.haml
@@ -1,10 +1,10 @@
 .row.active_table_row.skinny-head.margin-top{"ng-click" => "toggle($event)", "ng-class" => "{'closed' : !open()}"}
   .columns.small-2
-    %img.margin-top.account-logo{"logo-fallback" => true, "ng-src" => "{{distributor.logo}}"}
+    %img.margin-top.account-logo{"logo-fallback" => true, "ng-src" => "{{shop.logo}}"}
   .columns.small-5
-    %h3.margin-top{"ng-bind" => "::distributor.name"}
+    %h3.margin-top{"ng-bind" => "::shop.name"}
   .columns.small-4.text-right
-    %h3.margin-top.distributor-balance{"ng-bind" => "::distributor.balance | formatBalance", "ng-class" => "{'credit' : distributor.balance < 0, 'debit' : distributor.balance > 0, 'paid' : distributor.balance == 0}" }
+    %h3.margin-top.distributor-balance{"ng-bind" => "::shop.balance | formatBalance", "ng-class" => "{'credit' : shop.balance < 0, 'debit' : shop.balance > 0, 'paid' : shop.balance == 0}" }
   .columns.small-1.text-right
     %h3.margin-top
       %i{"ng-class" => "{'ofn-i_005-caret-down' : !open(), 'ofn-i_006-caret-up' : open()}"}
diff --git a/app/views/spree/users/_transactions.html.haml b/app/views/spree/users/_transactions.html.haml
index 4006a72b50..c46fbd38d7 100644
--- a/app/views/spree/users/_transactions.html.haml
+++ b/app/views/spree/users/_transactions.html.haml
@@ -1,11 +1,11 @@
 %script{ type: "text/ng-template", id: "account/transactions.html" }
   .active_table.orders{"ng-controller" => "OrdersCtrl", "ng-cloak" => true}
     %h3.my-orders= t(:transaction_history)
-    %distributor.active_table_node.row.animate-repeat{"ng-if" => "Orders.orders_by_distributor.length > 0", "ng-repeat" => "(key, distributor) in Orders.orders_by_distributor",
-    "ng-controller" => "DistributorNodeCtrl",
-    "ng-class" => "{'closed' : !open(), 'open' : open(), 'inactive' : !distributor.active}",
-    id: "{{distributor.hash}}"}
+    %distributor.active_table_node.row.animate-repeat{"ng-if" => "Orders.shops.length > 0", "ng-repeat" => "shop in Orders.shops",
+    "ng-controller" => "ShopNodeCtrl",
+    "ng-class" => "{'closed' : !open(), 'open' : open(), 'inactive' : !shop.active}",
+    id: "{{shop.hash}}"}
       .small-12.columns
         = render partial: "spree/users/skinny"
         = render partial: "spree/users/fat"
-  .message{"ng-if" => "Orders.orders_by_distributor.length == 0", "ng-bind" => "::'you_have_no_orders_yet' | t"}
+  .message{"ng-if" => "Orders.shops.length == 0", "ng-bind" => "::'you_have_no_orders_yet' | t"}
diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index c3e40708b8..0aeb37a826 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -1,5 +1,6 @@
 .darkswarm
-  = inject_orders_by_distributor
+  = inject_orders
+  = inject_shops
   = inject_saved_credit_cards
 
   :javascript
diff --git a/spec/controllers/spree/users_controller_spec.rb b/spec/controllers/spree/users_controller_spec.rb
new file mode 100644
index 0000000000..cbb08ece20
--- /dev/null
+++ b/spec/controllers/spree/users_controller_spec.rb
@@ -0,0 +1,48 @@
+require 'spec_helper'
+
+describe Spree::UsersController do
+  include AuthenticationWorkflow
+
+  describe "show" do
+    let!(:u1) { create(:user) }
+    let!(:u2) { create(:user) }
+    let!(:distributor1) { create(:distributor_enterprise) }
+    let!(:distributor2) { create(:distributor_enterprise) }
+    let!(:d1o1) { create(:completed_order_with_totals, distributor: distributor1, user_id: u1.id) }
+    let!(:d1o2) { create(:completed_order_with_totals, distributor: distributor1, user_id: u1.id) }
+    let!(:d1_order_for_u2) { create(:completed_order_with_totals, distributor: distributor1, user_id: u2.id) }
+    let!(:d1o3) { create(:order, state: 'cart', distributor: distributor1, user_id: u1.id) }
+    let!(:d2o1) { create(:completed_order_with_totals, distributor: distributor2, user_id: u2.id) }
+    let!(:accounts_distributor) {create :distributor_enterprise}
+    let!(:order_account_invoice) { create(:order, distributor: accounts_distributor, state: 'complete', user: u1) }
+
+    let(:orders) { assigns(:orders) }
+    let(:shops) { Enterprise.where(id: orders.pluck(:distributor_id)) }
+
+    before do
+      Spree::Config.set({ accounts_distributor_id: accounts_distributor.id })
+      allow(controller).to receive(:spree_current_user) { u1 }
+    end
+
+    it "returns orders placed by the user at normal shops" do
+      spree_get :show
+
+      expect(orders).to eq [d1o1, d1o2]
+      expect(shops).to include distributor1
+
+      # Doesn't return orders belonging to the accounts distributor" do
+      expect(orders).to_not include order_account_invoice
+      expect(shops).to_not include accounts_distributor
+
+      # Doesn't return orders for irrelevant distributors" do
+      expect(orders).not_to include d2o1
+      expect(shops).not_to include distributor2
+
+      # Doesn't return other users' orders" do
+      expect(orders).not_to include d1_order_for_u2
+
+      # Doesn't return uncompleted orders" do
+      expect(orders).not_to include d1o3
+    end
+  end
+end
diff --git a/spec/features/consumer/account_spec.rb b/spec/features/consumer/account_spec.rb
index d5c7236b72..8aa2d7b4be 100644
--- a/spec/features/consumer/account_spec.rb
+++ b/spec/features/consumer/account_spec.rb
@@ -40,6 +40,8 @@ feature %q{
         # No distributors allow changes to orders
         expect(page).to_not have_content I18n.t('spree.users.show.open_orders')
 
+        click_link I18n.t('spree.users.show.tabs.transactions')
+
         # It shows all hubs that have been ordered from with balance or credit
         expect(page).to have_content distributor1.name
         expect(page).to have_content distributor2.name
diff --git a/spec/models/spree/user_spec.rb b/spec/models/spree/user_spec.rb
index 0b57414677..fb75264550 100644
--- a/spec/models/spree/user_spec.rb
+++ b/spec/models/spree/user_spec.rb
@@ -102,49 +102,4 @@ describe Spree.user_class do
       end
     end
   end
-
-  describe "retrieving orders for /account page" do
-    let!(:u1) { create(:user) }
-    let!(:u2) { create(:user) }
-    let!(:distributor1) { create(:distributor_enterprise) }
-    let!(:distributor2) { create(:distributor_enterprise) }
-    let!(:d1o1) { create(:completed_order_with_totals, distributor: distributor1, user_id: u1.id) }
-    let!(:d1o2) { create(:completed_order_with_totals, distributor: distributor1, user_id: u1.id) }
-    let!(:d1_order_for_u2) { create(:completed_order_with_totals, distributor: distributor1, user_id: u2.id) }
-    let!(:d1o3) { create(:order, state: 'cart', distributor: distributor1, user_id: u1.id) }
-    let!(:d2o1) { create(:completed_order_with_totals, distributor: distributor2, user_id: u2.id) }
-    let!(:accounts_distributor) {create :distributor_enterprise}
-    let!(:order_account_invoice) { create(:order, distributor: accounts_distributor, state: 'complete', user: u1) }
-
-    let!(:completed_payment) { create(:payment, order: d1o1, state: 'completed') }
-    let!(:payment) { create(:payment, order: d1o2, state: 'checkout') }
-
-    before do
-      Spree::Config.accounts_distributor_id = accounts_distributor.id
-    end
-
-    it "returns enterprises that the user has ordered from, excluding accounts distributor" do
-      expect(u1.enterprises_ordered_from).to eq [distributor1.id]
-    end
-
-    it "returns orders and payments for the user, organised by distributor" do
-      expect(u1.orders_by_distributor).to include distributor1
-      expect(u1.orders_by_distributor.first.distributed_orders).to include d1o1
-    end
-
-    it "doesn't return irrelevant distributors" do
-      expect(u1.orders_by_distributor).not_to include distributor2
-    end
-    it "doesn't return other users' orders" do
-      expect(u1.orders_by_distributor.first.distributed_orders).not_to include d1_order_for_u2
-    end
-
-    it "doesn't return uncompleted orders" do
-      expect(u1.orders_by_distributor.first.distributed_orders).not_to include d1o3
-    end
-
-    it "doesn't return payments that are still at checkout stage" do
-      expect(u1.orders_by_distributor.first.distributed_orders.map{|o| o.payments}.flatten).not_to include payment
-    end
-  end
 end
diff --git a/spec/serializers/order_serializer_spec.rb b/spec/serializers/order_serializer_spec.rb
index 2c327537eb..ed3fbd994d 100644
--- a/spec/serializers/order_serializer_spec.rb
+++ b/spec/serializers/order_serializer_spec.rb
@@ -4,6 +4,8 @@ describe Api::OrderSerializer do
   let(:serializer) { Api::OrderSerializer.new order }
   let(:order) { create(:completed_order_with_totals) }
 
+  let!(:completed_payment) { create(:payment, order: order, state: 'completed', amount: 43.21) }
+  let!(:payment) { create(:payment, order: order, state: 'checkout', amount: 123.45) }
 
   it "serializes an order" do
     expect(serializer.to_json).to match order.number.to_s
@@ -14,4 +16,8 @@ describe Api::OrderSerializer do
     expect(serializer.to_json).to match "balance_due"
   end
 
+  it "only serializes completed payments" do
+    expect(serializer.to_json).to match completed_payment.amount.to_s
+    expect(serializer.to_json).to_not match payment.amount.to_s
+  end
 end
diff --git a/spec/serializers/orders_by_distributor_serializer_spec.rb b/spec/serializers/orders_by_distributor_serializer_spec.rb
deleted file mode 100644
index 5976e9ad48..0000000000
--- a/spec/serializers/orders_by_distributor_serializer_spec.rb
+++ /dev/null
@@ -1,28 +0,0 @@
-require 'spec_helper'
-
-describe Api::OrdersByDistributorSerializer do
-
-  # Banged lets ensure entered into test database
-  let!(:distributor1) { create(:distributor_enterprise) }
-  let!(:distributor2) { create(:distributor_enterprise) }
-  let!(:user) { create(:user)}
-  let!(:d1o1) { create(:completed_order_with_totals, distributor: distributor1, user_id: user.id, total: 10000)}
-  let!(:d1o2) { create(:completed_order_with_totals, distributor: distributor1, user_id: user.id, total: 5000)}
-  let!(:d2o1) { create(:completed_order_with_totals, distributor: distributor2, user_id: user.id)}
-
-  before do
-    @data = Enterprise.includes(:distributed_orders).where(enterprises: {id: user.enterprises_ordered_from }, spree_orders: {state: :complete, user_id: user.id}).to_a
-    @serializer = ActiveModel::ArraySerializer.new(@data, {each_serializer: Api::OrdersByDistributorSerializer})
-  end
-
-  it "serializes orders" do
-    expect(@serializer.to_json).to match "distributed_orders"
-  end
-
-  it "serializes the balance for each distributor" do
-    expect(@serializer.serializable_array[0].keys).to include :balance
-    # Would be good to test adding up balance properly but can't get a non-zero total from the factories...
-    expect(@serializer.serializable_array[0][:balance]).to eq "0.00"
-  end
-
-end

From 4ef97aa418c308ed3fdffe20afbbf67a4480d74a Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sat, 27 May 2017 09:37:25 +1000
Subject: [PATCH 206/353] Showing past orders under the orders tab

---
 app/views/spree/users/_orders.html.haml      |  8 +++----
 app/views/spree/users/_past_orders.html.haml | 22 ++++++++++++++++++++
 config/locales/en.yml                        | 15 +++++++++++--
 spec/features/consumer/account_spec.rb       | 16 ++++++++++++--
 4 files changed, 53 insertions(+), 8 deletions(-)
 create mode 100644 app/views/spree/users/_past_orders.html.haml

diff --git a/app/views/spree/users/_orders.html.haml b/app/views/spree/users/_orders.html.haml
index e0b5d21066..a8c34b22f1 100644
--- a/app/views/spree/users/_orders.html.haml
+++ b/app/views/spree/users/_orders.html.haml
@@ -1,10 +1,10 @@
 %script{ type: "text/ng-template", id: "account/orders.html" }
   .orders{"ng-controller" => "OrdersCtrl", "ng-cloak" => true}
     .my-open-orders{ ng: { show: 'Orders.changeable.length > 0' } }
-      %h3= t(:open_orders)
+      %h3= t('.open_orders')
       = render 'open_orders'
 
-    .past-orders
-      %h3= t(:past_orders)
-      -# = render 'past_orders'
+    .past-orders{ ng: { show: 'pastOrders.length > 0' } }
+      %h3= t('.past_orders')
+      = render 'past_orders'
     .message{"ng-if" => "Orders.all.length == 0", "ng-bind" => "::'you_have_no_orders_yet' | t"}
diff --git a/app/views/spree/users/_past_orders.html.haml b/app/views/spree/users/_past_orders.html.haml
new file mode 100644
index 0000000000..2abf5a273e
--- /dev/null
+++ b/app/views/spree/users/_past_orders.html.haml
@@ -0,0 +1,22 @@
+.row
+  .small-12.columns
+    %table
+      %tr
+        %th.order1= t('.order')
+        %th.order2= t('.shop')
+        %th.order3.show-for-large-up= t('.completed_at')
+        %th.order4.show-for-large-up= t('.items')
+        %th.order5.text-right= t('.total')
+        %th.order6.text-right.show-for-large-up= t('.paid?')
+        %th.order7.text-right= t('.view')
+      %tbody.transaction-group{"ng-repeat" => "order in Orders.all | filter:{changes_allowed:false} as pastOrders", "ng-class-odd"=>"'odd'", "ng-class-even"=>"'even'"}
+        %tr.order-row
+          %td.order1
+            %a{"ng-href" => "{{::order.path}}", "ng-bind" => "::order.number"}
+          %td.order2{"ng-bind" => "::Orders.shopsByID[order.shop_id].name"}
+          %td.order3.show-for-large-up{"ng-bind" => "::order.completed_at"}
+          %td.order4.show-for-large-up{"ng-bind" => "::order.item_count"}
+          %td.order5.text-right{"ng-class" => "{'debit': order.payment_state != 'paid', 'credit': order.payment_state == 'paid'}","ng-bind" => "::order.total | localizeCurrency"}
+          %td.order6.text-right.show-for-large-up{"ng-class" => "{'debit': order.payment_state != 'paid', 'credit': order.payment_state == 'paid'}", "ng-bind" => "::(order.payment_state == 'paid' ? 'say_yes' : 'say_no') | t"}
+          %td.order7.text-right
+            %a{"ng-href" => "{{::order.path}}" }= t('.view')
diff --git a/config/locales/en.yml b/config/locales/en.yml
index ae1cdbebcd..2db4e1b234 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2188,13 +2188,16 @@ Please follow the instructions there to make your enterprise visible on the Open
     zipcode: Postcode
     users:
       show:
-        open_orders: Open Orders
-        transaction_history: Transaction History
         tabs:
           orders: Orders
           cards: Credit Cards
           transactions: Transactions
           details: Details
+      orders:
+        open_orders: Open Orders
+        past_orders: Past Orders
+      transactions:
+        transaction_history: Transaction History
       open_orders:
         order: Order
         shop: Shop
@@ -2205,3 +2208,11 @@ Please follow the instructions there to make your enterprise visible on the Open
         cancel: Cancel
         closed: Closed
         until: Until
+      past_orders:
+        order: Order
+        shop: Shop
+        completed_at: Completed At
+        items: Items
+        total: Total
+        paid?: Paid?
+        view: View
diff --git a/spec/features/consumer/account_spec.rb b/spec/features/consumer/account_spec.rb
index 8aa2d7b4be..3e30bb4cd7 100644
--- a/spec/features/consumer/account_spec.rb
+++ b/spec/features/consumer/account_spec.rb
@@ -38,8 +38,20 @@ feature %q{
         visit "/account"
 
         # No distributors allow changes to orders
-        expect(page).to_not have_content I18n.t('spree.users.show.open_orders')
+        expect(page).to_not have_content I18n.t('spree.users.orders.open_orders')
 
+        expect(page).to have_content I18n.t('spree.users.orders.past_orders')
+
+        # Doesn't show orders from the special Accounts & Billing distributor
+        expect(page).not_to have_content accounts_distributor.name
+
+        # Lists all other orders
+        expect(page).to have_content d1o1.number.to_s
+        expect(page).to have_content d1o2.number.to_s
+        expect(page).to have_content d2o1.number.to_s
+        expect(page).to have_content credit_order.number.to_s
+
+        # Viewing transaction history
         click_link I18n.t('spree.users.show.tabs.transactions')
 
         # It shows all hubs that have been ordered from with balance or credit
@@ -67,7 +79,7 @@ feature %q{
 
         it "shows such orders in a section labelled 'Open Orders'" do
           visit '/account'
-          expect(page).to have_content I18n.t('spree.users.show.open_orders')
+          expect(page).to have_content I18n.t('spree.users.orders.open_orders')
 
           expect(page).to have_link d1o1.number, href: spree.order_path(d1o1)
           expect(page).to have_link d1o2.number, href: spree.order_path(d1o2)

From fb5784fbda03b688622093d5581e97c3bae0b40d Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 31 May 2017 12:36:35 +1000
Subject: [PATCH 207/353] Allow updating of account settings from account tabs
 interface

---
 app/views/spree/users/_details.html.haml      |  2 --
 app/views/spree/users/_form.html.haml         |  6 +++++
 app/views/spree/users/_settings.html.haml     |  2 ++
 app/views/spree/users/edit.html.haml          |  7 +----
 app/views/spree/users/show.html.haml          |  7 +++--
 config/locales/en.yml                         |  4 ++-
 .../consumer/account/settings_spec.rb         | 27 +++++++++++++++++++
 7 files changed, 42 insertions(+), 13 deletions(-)
 delete mode 100644 app/views/spree/users/_details.html.haml
 create mode 100644 app/views/spree/users/_form.html.haml
 create mode 100644 app/views/spree/users/_settings.html.haml
 create mode 100644 spec/features/consumer/account/settings_spec.rb

diff --git a/app/views/spree/users/_details.html.haml b/app/views/spree/users/_details.html.haml
deleted file mode 100644
index fe804d2e18..0000000000
--- a/app/views/spree/users/_details.html.haml
+++ /dev/null
@@ -1,2 +0,0 @@
-%script{ type: "text/ng-template", id: "account/details.html" }
-  Details
diff --git a/app/views/spree/users/_form.html.haml b/app/views/spree/users/_form.html.haml
new file mode 100644
index 0000000000..61f6962abb
--- /dev/null
+++ b/app/views/spree/users/_form.html.haml
@@ -0,0 +1,6 @@
+= render :partial => 'spree/shared/error_messages', :locals => { :target => @user }
+%h3= t('.account_settings')
+= form_for Spree::User.new, :as => @user, :url => spree.user_path(@user), :method => :put do |f|
+  = render :partial => 'spree/shared/user_form', :locals => { :f => f }
+  %p
+    = f.submit t(:update), :class => 'button primary'
diff --git a/app/views/spree/users/_settings.html.haml b/app/views/spree/users/_settings.html.haml
new file mode 100644
index 0000000000..6107172190
--- /dev/null
+++ b/app/views/spree/users/_settings.html.haml
@@ -0,0 +1,2 @@
+%script{ type: "text/ng-template", id: "account/settings.html" }
+  = render 'form'
diff --git a/app/views/spree/users/edit.html.haml b/app/views/spree/users/edit.html.haml
index 9815b5f34d..29e600582c 100644
--- a/app/views/spree/users/edit.html.haml
+++ b/app/views/spree/users/edit.html.haml
@@ -1,8 +1,3 @@
 .darkswarm
   .row
-    = render :partial => 'spree/shared/error_messages', :locals => { :target => @user }
-    %h1= t(:editing_user)
-    = form_for Spree::User.new, :as => @user, :url => spree.user_path(@user), :method => :put do |f|
-      = render :partial => 'spree/shared/user_form', :locals => { :f => f }
-      %p
-        = f.submit t(:update), :class => 'button primary'
+    = render 'form'
diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index 0aeb37a826..43a7e04f64 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -12,12 +12,11 @@
         = accurate_title
         %span.account-summary{"data-hook" => "account_summary"}
           = @user.email
-          (#{link_to t(:edit), spree.edit_account_path})
 
     = render 'orders'
     = render 'cards'
     = render 'transactions'
-    = render 'cards'
+    = render 'settings'
 
   .row.tabset-ctrl#account-tabs{ style: 'margin-bottom: 100px', navigate: 'true', selected: 'orders', prefix: 'account' }
     .small.12.medium-3.columns.tab{ name: "orders" }
@@ -26,8 +25,8 @@
       %a{ href: 'javascript:void(0)' }=t('.tabs.cards')
     .small.12.medium-3.columns.tab{ name: "transactions" }
       %a{ href: 'javascript:void(0)' }=t('.tabs.transactions')
-    .small.12.medium-3.columns.tab{ name: "details" }
-      %a{ href: 'javascript:void(0)' }=t('.tabs.details')
+    .small.12.medium-3.columns.tab{ name: "settings" }
+      %a{ href: 'javascript:void(0)' }=t('.tabs.settings')
     .small-12.columns.tab-view
 
   = render partial: "shared/footer"
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 2db4e1b234..bad3671153 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2187,12 +2187,14 @@ Please follow the instructions there to make your enterprise visible on the Open
     weight: Weight (per kg)
     zipcode: Postcode
     users:
+      form:
+        account_settings: Account Settings
       show:
         tabs:
           orders: Orders
           cards: Credit Cards
           transactions: Transactions
-          details: Details
+          settings: Account Settings
       orders:
         open_orders: Open Orders
         past_orders: Past Orders
diff --git a/spec/features/consumer/account/settings_spec.rb b/spec/features/consumer/account/settings_spec.rb
new file mode 100644
index 0000000000..a7fbf9ce94
--- /dev/null
+++ b/spec/features/consumer/account/settings_spec.rb
@@ -0,0 +1,27 @@
+require 'spec_helper'
+
+feature "Account Settings", js: true do
+  include AuthenticationWorkflow
+
+  describe "as a logged in user" do
+    let(:user) { create(:user) }
+
+    before do
+      quick_login_as user
+    end
+
+    it "allows me to update my account details" do
+      visit "/account"
+
+      click_link I18n.t('spree.users.show.tabs.settings')
+      expect(page).to have_content I18n.t('spree.users.form.account_settings')
+      fill_in 'user_email', with: 'new@email.com'
+
+      click_button I18n.t(:update)
+
+      expect(find(".alert-box.success").text.strip).to eq "#{I18n.t(:account_updated)} ×"
+      user.reload
+      expect(user.email).to eq 'new@email.com'
+    end
+  end
+end

From 356dad73badb1ed8f0c450f58ca3ae72f904813d Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 31 May 2017 12:40:06 +1000
Subject: [PATCH 208/353] Ensure spec has Stripe.api_key set

---
 spec/controllers/spree/credit_cards_controller_spec.rb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/spec/controllers/spree/credit_cards_controller_spec.rb b/spec/controllers/spree/credit_cards_controller_spec.rb
index e37987b61f..4b707c6114 100644
--- a/spec/controllers/spree/credit_cards_controller_spec.rb
+++ b/spec/controllers/spree/credit_cards_controller_spec.rb
@@ -6,6 +6,10 @@ describe Spree::CreditCardsController do
   let(:user) { create_enterprise_user }
   let(:token) { "tok_234bd2c22" }
 
+  before do
+    Stripe.api_key = "sk_test_12345"
+  end
+
   it "Creates a credit card from token + params" do
     controller.stub(:spree_current_user) { user }
 

From 63a15ec392737b56f6c5d4a7ead1c2fe72f119f1 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 31 May 2017 13:56:51 +1000
Subject: [PATCH 209/353] CreditCardController#destroy redirects to
 account#/cards

---
 app/controllers/spree/credit_cards_controller.rb |  3 ++-
 app/views/spree/users/_cards.html.haml           |  2 +-
 config/locales/en.yml                            | 13 +++++++------
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
index ea9f1890f5..bca24fdaad 100644
--- a/app/controllers/spree/credit_cards_controller.rb
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -33,7 +33,8 @@ module Spree
 
     def destroy
       if @credit_card.destroy
-        redirect_to "/account"
+        flash[:success] = I18n.t(:card_has_been_removed, number: "x-#{@credit_card.last_digits}")
+        redirect_to "/account#/cards"
       end
     end
 
diff --git a/app/views/spree/users/_cards.html.haml b/app/views/spree/users/_cards.html.haml
index 108e45cc37..d0aaeb7d5a 100644
--- a/app/views/spree/users/_cards.html.haml
+++ b/app/views/spree/users/_cards.html.haml
@@ -10,6 +10,6 @@
         %button.button.primary{ ng: { click: 'showForm()', hide: 'CreditCard.visible' } }
           = t(:add_a_card)
 
-      .small-12.medium-6.columns.new_card{ ng: { class: '{visible: CreditCard.visible}' } }
+      .small-12.medium-6.columns.new_card{ ng: { show: 'CreditCard.visible', class: '{visible: CreditCard.visible}' } }
         %h3= t(:add_a_new_card)
         = render 'new_card_form'
diff --git a/config/locales/en.yml b/config/locales/en.yml
index bad3671153..84c8f68ecd 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -165,12 +165,6 @@ en:
   notes: Notes
   error: Error
   processing_payment: Processing payment...
-  my_credit_cards: My credit cards
-  add_new_credit_card: Add new credit card
-  saved_cards: Saved cards
-  add_a_card: Add a Card
-  add_card: Add Card
-  saving_credit_card: Saving credit card...
 
 
   actions:
@@ -873,6 +867,13 @@ en:
   card_masked_digit: "X"
   card_expiry_abbreviation: "Exp"
   new_credit_card: "New credit card"
+  my_credit_cards: My credit cards
+  add_new_credit_card: Add new credit card
+  saved_cards: Saved cards
+  add_a_card: Add a Card
+  add_card: Add Card
+  saving_credit_card: Saving credit card...
+  card_has_been_removed: "Your card has been removed (number: %{number})"
 
   ie_warning_headline: "Your browser is out of date :-("
   ie_warning_text: "For the best Open Food Network experience, we strongly recommend upgrading your browser:"

From fdca1f660676fb883472c024c9464be93c055d83 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 31 May 2017 14:40:15 +1000
Subject: [PATCH 210/353] Adding message about having no saved cards to
 account/cards UI

---
 app/assets/stylesheets/darkswarm/account.css.scss |  4 ++++
 app/views/spree/users/_cards.html.haml            |  6 +++---
 app/views/spree/users/_saved_cards.html.haml      |  2 +-
 config/locales/en.yml                             |  2 ++
 spec/features/consumer/account/cards_spec.rb      | 15 ++++++++++++++-
 5 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/app/assets/stylesheets/darkswarm/account.css.scss b/app/assets/stylesheets/darkswarm/account.css.scss
index 78f8c0dfd9..91cd042d28 100644
--- a/app/assets/stylesheets/darkswarm/account.css.scss
+++ b/app/assets/stylesheets/darkswarm/account.css.scss
@@ -12,6 +12,10 @@
     }
   }
 
+  .saved_cards, .no_cards {
+    margin-bottom: 1em;
+  }
+
   .new_card {
     opacity: 0;
     -webkit-transition: opacity 0.4s linear;
diff --git a/app/views/spree/users/_cards.html.haml b/app/views/spree/users/_cards.html.haml
index d0aaeb7d5a..80069c282f 100644
--- a/app/views/spree/users/_cards.html.haml
+++ b/app/views/spree/users/_cards.html.haml
@@ -2,11 +2,11 @@
   .credit_cards{"ng-controller" => "CreditCardsCtrl"}
     .row
       .small-12.medium-6.columns
-        %span{ ng: { hide: 'savedCreditCards.length > 0' } }
-          &nbsp;
+        %h3= t(:saved_cards)
         .saved_cards{ ng: { show: 'savedCreditCards.length > 0' } }
-          %h3= t(:saved_cards)
           = render 'saved_cards'
+        .no_cards{ ng: { hide: 'savedCreditCards.length > 0' } }
+          = t(:you_have_no_saved_cards)
         %button.button.primary{ ng: { click: 'showForm()', hide: 'CreditCard.visible' } }
           = t(:add_a_card)
 
diff --git a/app/views/spree/users/_saved_cards.html.haml b/app/views/spree/users/_saved_cards.html.haml
index 8df81eeeca..d8c710607b 100644
--- a/app/views/spree/users/_saved_cards.html.haml
+++ b/app/views/spree/users/_saved_cards.html.haml
@@ -10,4 +10,4 @@
     %td.expiry{ ng: { bind: '::card.expiry' } }
     %td.actions
       %a{"rel" => "nofollow", "data-method" => "delete", "ng-href" => "{{card.delete_link}}" }
-        Delete
+        = t(:delete)
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 84c8f68ecd..196c130e78 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -872,6 +872,7 @@ en:
   saved_cards: Saved cards
   add_a_card: Add a Card
   add_card: Add Card
+  you_have_no_saved_cards: You haven't saved any cards yet
   saving_credit_card: Saving credit card...
   card_has_been_removed: "Your card has been removed (number: %{number})"
 
@@ -1536,6 +1537,7 @@ Please follow the instructions there to make your enterprise visible on the Open
   edit_order_cycle: "Edit Order Cycle"
   roles: "Roles"
   update: "Update"
+  delete: Delete
   add_producer_property: "Add producer property"
   in_progress: "In Progress"
   started_at: "Started at"
diff --git a/spec/features/consumer/account/cards_spec.rb b/spec/features/consumer/account/cards_spec.rb
index 48f9019e34..56d760c1f3 100644
--- a/spec/features/consumer/account/cards_spec.rb
+++ b/spec/features/consumer/account/cards_spec.rb
@@ -4,10 +4,16 @@ feature "Credit Cards", js: true do
   include AuthenticationWorkflow
   describe "as a logged in user" do
     let(:user) { create(:user) }
-    let!(:card) { create(:credit_card, user_id: user.id) }
+    let!(:card) { create(:credit_card, user_id: user.id, gateway_customer_profile_id: 'cus_AZNMJ') }
 
     before do
       quick_login_as user
+
+      stub_request(:get, "https://api.stripe.com/v1/customers/cus_AZNMJ").
+      to_return(:status => 200, :body => JSON.generate({id: "cus_AZNMJ"}))
+
+      stub_request(:delete, "https://api.stripe.com/v1/customers/cus_AZNMJ").
+      to_return(:status => 200, :body => JSON.generate({deleted: true, id: "cus_AZNMJ"}))
     end
 
     it "lists saved cards, shows interface for adding new cards" do
@@ -22,10 +28,17 @@ feature "Credit Cards", js: true do
         expect(page).to have_content card.last_digits
       end
 
+      # Shows the interface for adding a card
       click_button I18n.t(:add_a_card)
       expect(page).to have_field 'first_name'
       expect(page).to have_field 'card_number'
       expect(page).to have_field 'card_month'
+
+      # Allows deletion of cards
+      click_link I18n.t(:delete)
+
+      expect(page).to have_content I18n.t(:card_has_been_removed, number: "x-#{card.last_digits}")
+      expect(page).to have_content I18n.t(:you_have_no_saved_cards)
     end
   end
 end

From 14f6ea4c01e979710ec5311256995716a95d3a41 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 2 Jun 2017 09:38:35 +1000
Subject: [PATCH 211/353] Adding required Stripe config variables to
 application.yml.example

---
 config/application.yml.example | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/config/application.yml.example b/config/application.yml.example
index 73b9a9c67b..c3882edf4a 100644
--- a/config/application.yml.example
+++ b/config/application.yml.example
@@ -28,8 +28,9 @@ CURRENCY: AUD
 # GOOGLE_MAPS_API_KEY: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 
 # Stripe Connect details for instance account
-# Find these under 'API keys' and 'Connect' in your Stripe account dashboard -> Account Settings 
+# Find these under 'API keys' and 'Connect' in your Stripe account dashboard -> Account Settings
 # Under 'Connect', the Redirect URI should be set to https://YOUR_SERVER_URL/stripe/callback (e.g. https://openfoodnetwork.org.uk/stripe/connect)
 # Under 'Webhooks', you should set up a Connect endpoint pointing to https://YOUR_SERVER_URL/stripe/webhook e.g. (https://openfoodnetwork.org.uk/stripe/webhook)
-# STRIPE_INSTANCE_SECRET_KEY: yyyyy
-# STRIPE_CLIENT_ID: xxxx
+# STRIPE_INSTANCE_SECRET_KEY: "sk_test_xxxxxx" # This can be a test key or a live key
+# STRIPE_INSTANCE_PUBLISHABLE_KEY: "pk_test_xxxx" # This can be a test key or a live key
+# STRIPE_CLIENT_ID: "ca_xxxx" # This can be a development ID or a production ID

From 64009a2c9e5a43d38e04a3a71642601322d89cbf Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 14 Jun 2017 14:30:19 +1000
Subject: [PATCH 212/353] CheckoutController can render payment gateway error
 messages as json

---
 .../darkswarm/services/checkout.js.coffee     |  2 +-
 app/controllers/checkout_controller.rb        | 12 ++++-
 config/locales/en.yml                         |  4 ++
 spec/controllers/checkout_controller_spec.rb  | 14 +++---
 .../services/checkout_spec.js.coffee          |  8 ++--
 spec/requests/stripe_connect_checkout_spec.rb | 45 ++++++++++++++++---
 6 files changed, 64 insertions(+), 21 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/services/checkout.js.coffee b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
index 85e5e8ae94..d8d193b310 100644
--- a/app/assets/javascripts/darkswarm/services/checkout.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
@@ -12,7 +12,7 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeJ
 
     submit: =>
       Loading.message = t 'submitting_order'
-      $http.put('/checkout', {order: @preprocess()}).success (data, status)=>
+      $http.put('/checkout.json', {order: @preprocess()}).success (data, status)=>
         Navigation.go data.path
       .error (response, status)=>
         if response.path
diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 39fccfb075..0233e2c383 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -48,7 +48,7 @@ class CheckoutController < Spree::CheckoutController
           format.html do
             respond_with(@order, :location => order_path(@order))
           end
-          format.js do
+          format.json do
             render json: {path: order_path(@order)}, status: 200
           end
         end
@@ -141,7 +141,7 @@ class CheckoutController < Spree::CheckoutController
       format.html do
         render :edit
       end
-      format.js do
+      format.json do
         render json: {errors: @order.errors, flash: flash.to_hash}.to_json, status: 400
       end
     end
@@ -222,4 +222,12 @@ class CheckoutController < Spree::CheckoutController
       params[:order][:payments_attributes].first.delete :source_attributes
     end
   end
+
+  def rescue_from_spree_gateway_error(error)
+    flash[:error] = t(:spree_gateway_error_flash_for_checkout, error: error.message)
+    respond_to do |format|
+      format.html { render :edit }
+      format.json { render json: { flash: flash.to_hash }, status: 400 }
+    end
+  end
 end
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 196c130e78..03be617bfc 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -766,6 +766,10 @@ en:
       require_login_html: "Please %{login} if you have an account already. Otherwise, %{register} to become a customer."
       require_customer_html: "Please %{contact} %{enterprise} to become a customer."
 
+
+  # Front-end controller translations
+  spree_gateway_error_flash_for_checkout: "There was a problem with your payment information: %{error}"
+
   # Printable Invoice Columns
   invoice_billing_address: "Billing address:"
   invoice_column_tax: "GST"
diff --git a/spec/controllers/checkout_controller_spec.rb b/spec/controllers/checkout_controller_spec.rb
index 8833a1bd9f..38d72d6442 100644
--- a/spec/controllers/checkout_controller_spec.rb
+++ b/spec/controllers/checkout_controller_spec.rb
@@ -69,14 +69,14 @@ describe CheckoutController do
     it "clears the ship address when re-rendering edit" do
       controller.should_receive(:clear_ship_address).and_return true
       order.stub(:update_attributes).and_return false
-      spree_post :update, order: {}
+      spree_post :update, format: :json, order: {}
     end
 
     it "clears the ship address when the order state cannot be advanced" do
       controller.should_receive(:clear_ship_address).and_return true
       order.stub(:update_attributes).and_return true
       order.stub(:next).and_return false
-      spree_post :update, order: {}
+      spree_post :update, format: :json, order: {}
     end
 
     it "only clears the ship address with a pickup shipping method" do
@@ -133,7 +133,7 @@ describe CheckoutController do
     end
 
     it "returns errors" do
-      xhr :post, :update, order: {}, use_route: :spree
+      spree_post :update, format: :json, order: {}
       response.status.should == 400
       response.body.should == {errors: assigns[:order].errors, flash: {}}.to_json
     end
@@ -141,7 +141,7 @@ describe CheckoutController do
     it "returns flash" do
       order.stub(:update_attributes).and_return true
       order.stub(:next).and_return false
-      xhr :post, :update, order: {}, use_route: :spree
+      spree_post :update, format: :json, order: {}
       response.body.should == {errors: assigns[:order].errors, flash: {error: "Payment could not be processed, please check the details you entered"}}.to_json
     end
 
@@ -152,7 +152,7 @@ describe CheckoutController do
       order.stub(:update_attributes).and_return true
       order.stub(:state).and_return "complete"
 
-      xhr :post, :update, order: {}, use_route: :spree
+      spree_post :update, format: :json, order: {}
       response.status.should == 200
       response.body.should == {path: spree.order_path(order)}.to_json
     end
@@ -173,7 +173,7 @@ describe CheckoutController do
           true
         end
 
-        xhr :post, :update, order: {}, use_route: :spree
+        spree_post :update, format: :json, order: {}
         response.status.should == 200
       end
 
@@ -181,7 +181,7 @@ describe CheckoutController do
         order.stub(:update_attributes).and_return true
         order.stub(:next) { raise ActiveRecord::StaleObjectError.new(Spree::Variant.new, 'update') }
 
-        xhr :post, :update, order: {}, use_route: :spree
+        spree_post :update, format: :json, order: {}
         response.status.should == 400
       end
     end
diff --git a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
index d21f10fb15..a137b2f4ac 100644
--- a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
@@ -91,27 +91,27 @@ describe 'Checkout service', ->
 
   describe "submitting", ->
     it "Posts the Checkout to the server", ->
-      $httpBackend.expectPUT("/checkout", {order: Checkout.preprocess()}).respond 200, {path: "test"}
+      $httpBackend.expectPUT("/checkout.json", {order: Checkout.preprocess()}).respond 200, {path: "test"}
       Checkout.submit()
       $httpBackend.flush()
 
     describe "when there is an error", ->
       it "redirects when a redirect is given", ->
-        $httpBackend.expectPUT("/checkout").respond 400, {path: 'path'}
+        $httpBackend.expectPUT("/checkout.json").respond 400, {path: 'path'}
         Checkout.submit()
         $httpBackend.flush()
         expect(Navigation.go).toHaveBeenCalledWith 'path'
 
       it "sends flash messages to the flash service", ->
         spyOn(FlashLoaderMock, "loadFlash") # Stubbing out writes to window.location
-        $httpBackend.expectPUT("/checkout").respond 400, {flash: {error: "frogs"}}
+        $httpBackend.expectPUT("/checkout.json").respond 400, {flash: {error: "frogs"}}
         Checkout.submit()
 
         $httpBackend.flush()
         expect(FlashLoaderMock.loadFlash).toHaveBeenCalledWith {error: "frogs"}
 
       it "puts errors into the scope", ->
-        $httpBackend.expectPUT("/checkout").respond 400, {errors: {error: "frogs"}}
+        $httpBackend.expectPUT("/checkout.json").respond 400, {errors: {error: "frogs"}}
         Checkout.submit()
         $httpBackend.flush()
         expect(Checkout.errors).toEqual {error: "frogs"}
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index 1be74260ce..61eed6c319 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -14,7 +14,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
   let!(:order) { line_item.order }
   let(:address) { create(:address) }
   let(:token) { "token123" }
-  let(:params) { { order: {
+  let(:params) { { format: :json, order: {
       shipping_method_id: shipping_method.id,
       payments_attributes: [{payment_method_id: payment_method.id, source_attributes: { gateway_payment_profile_id: token, cc_type: "visa", last_digits: "4242", month: 10, year: 2025 }}],
       bill_address_attributes: address.attributes.slice("firstname","lastname","address1","address2","phone","city","zipcode","state_id","country_id"),
@@ -33,12 +33,12 @@ describe "Submitting Stripe Connect charge requests", type: :request do
       # Saves the card against the user
       stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/customers")
         .with(:body => { card: token, email: order.email})
-        .to_return(status: 200, body: JSON.generate({ id: "cus_A123", default_card: "card_XyZ456", sources: { data: [{id: "1"}] } }), headers: {})
+        .to_return(status: 200, body: JSON.generate(store_response_mock))
 
       # Requests a token from the newly saved card
       stub_request(:post, "https://api.stripe.com/v1/tokens")
         .with(:body => { card: "card_XyZ456", customer: "cus_A123"})
-        .to_return(status: 200, body: JSON.generate({id: "newtoken_123"}), headers: {})
+        .to_return(status: 200, body: JSON.generate({id: "newtoken_123"}))
 
       # Charges the card
       stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
@@ -46,12 +46,14 @@ describe "Submitting Stripe Connect charge requests", type: :request do
         .to_return(body: JSON.generate(charge_response_mock))
     end
 
-    context "and the charge request is accepted" do
+    context "and the store and charge requests are accepted" do
+      let(:store_response_mock) { { id: "cus_A123", default_card: "card_XyZ456", sources: { data: [{id: "1"}] } } }
       let(:charge_response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
 
       it "should process the payment, and stores the card/customer details" do
         put update_checkout_path, params
-        expect(response).to redirect_to(spree.order_path(order))
+        json_response = JSON.parse(response.body)
+        expect(json_response["path"]).to eq spree.order_path(order)
         expect(order.payments.completed.count).to be 1
         card = order.payments.completed.first.source
         expect(card.gateway_customer_profile_id).to eq "cus_A123"
@@ -59,12 +61,28 @@ describe "Submitting Stripe Connect charge requests", type: :request do
       end
     end
 
+    context "when the store request returns an error message" do
+      let(:store_response_mock) { { error: { message: "Bup-bow..."} } }
+      let(:charge_response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
+
+      it "should not process the payment" do
+        put update_checkout_path, params
+        expect(response.status).to be 400
+        json_response = JSON.parse(response.body)
+        expect(json_response["flash"]["error"]).to eq I18n.t(:spree_gateway_error_flash_for_checkout, error: 'Bup-bow...')
+        expect(order.payments.completed.count).to be 0
+      end
+    end
+
     context "when the charge request returns an error message" do
+      let(:store_response_mock) { { id: "cus_A123", default_card: "card_XyZ456", sources: { data: [{id: "1"}] } } }
       let(:charge_response_mock) { { error: { message: "Bup-bow..."} } }
 
       it "should not process the payment" do
         put update_checkout_path, params
-        expect(response).to render_template(:edit)
+        expect(response.status).to be 400
+        json_response = JSON.parse(response.body)
+        expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
         expect(order.payments.completed.count).to be 0
       end
     end
@@ -98,12 +116,25 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
       it "should process the payment, and keep the profile ids" do
         put update_checkout_path, params
-        expect(response).to redirect_to(spree.order_path(order))
+        json_response = JSON.parse(response.body)
+        expect(json_response["path"]).to eq spree.order_path(order)
         expect(order.payments.completed.count).to be 1
         card = order.payments.completed.first.source
         expect(card.gateway_customer_profile_id).to eq "cus_Z456"
         expect(card.gateway_payment_profile_id).to eq "card_AbC123"
       end
     end
+
+    context "when the charge request returns an error message" do
+      let(:charge_response_mock) { { error: { message: "Bup-bow..."} } }
+
+      it "should not process the payment" do
+        put update_checkout_path, params
+        expect(response.status).to be 400
+        json_response = JSON.parse(response.body)
+        expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
+        expect(order.payments.completed.count).to be 0
+      end
+    end
   end
 end

From 1d1e581c85c22937a808f9873259161eb184db87 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 15 Jun 2017 14:50:52 +1000
Subject: [PATCH 213/353] Refactoring CreditCardController, rendering card
 processing errors as json

---
 .../spree/credit_cards_controller.rb          | 52 +++++++-------
 app/serializers/api/credit_card_serializer.rb |  2 +-
 config/locales/en.yml                         |  1 +
 .../spree/credit_cards_controller_spec.rb     | 70 ++++++++++++++-----
 4 files changed, 80 insertions(+), 45 deletions(-)

diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
index bca24fdaad..53fb641f5c 100644
--- a/app/controllers/spree/credit_cards_controller.rb
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -5,29 +5,19 @@ module Spree
     before_filter :destroy_at_stripe, only: [:destroy]
 
     def new_from_token
-      set_user
-      # At the moment a new Customer is created for every credit card (even via ActiveMerchant),
-      # so doing the same here (for now).
-      if @customer = create_customer(params[:token])
-      # Since it's a new customer, the default_source is the card that our original token represented
-        credit_card_params = format_credit_card_params(params)
-                                .merge({gateway_payment_profile_id: @customer.default_source,
-                                        gateway_customer_profile_id: @customer.id,
-                                        cc_type: params[:cc_type]
-                                        })
-
-        @credit_card = Spree::CreditCard.new(credit_card_params)
-        # Can't mass assign these:
-        @credit_card.cc_type = credit_card_params[:cc_type]
-        @credit_card.last_digits = credit_card_params[:last_digits]
-        @credit_card.user_id = @user.id
+      # A new Customer is created for every credit card (same as via ActiveMerchant)
+      # Note that default_source is the card represented by the token
+      begin
+        @customer = create_customer(params[:token])
+        @credit_card = build_card_from(stored_card_attributes)
         if @credit_card.save
           render json: @credit_card, serializer: ::Api::CreditCardSerializer, status: :ok
         else
-          render json: "error saving credit card", status: 500
+          message = t(:card_could_not_be_saved)
+          render json: { flash: { error: I18n.t(:spree_gateway_error_flash_for_checkout, error: message) } }, status: 400
         end
-      else
-        render json: "error creating Stripe customer", status: 500
+      rescue Stripe::CardError => e
+        return render json: { flash: { error: I18n.t(:spree_gateway_error_flash_for_checkout, error: e.message) } }, status: 400
       end
     end
 
@@ -47,18 +37,28 @@ module Spree
 
   private
     def create_customer(token)
-      Stripe::Customer.create(email: @user.email, source: token)
+      Stripe::Customer.create(email: spree_current_user.email, source: token)
     end
 
-    def format_credit_card_params(params_hash)
-      { month: params_hash[:exp_month],
-        year: params_hash[:exp_year],
-        last_digits: params_hash[:last4]
+    def stored_card_attributes
+      return {} unless @customer.try(:default_source)
+      {
+        month: params[:exp_month],
+        year: params[:exp_year],
+        last_digits: params[:last4],
+        gateway_payment_profile_id: @customer.default_source,
+        gateway_customer_profile_id: @customer.id,
+        cc_type: params[:cc_type]
       }
     end
 
-    def set_user
-      @user = spree_current_user
+    def build_card_from(attrs)
+      card = Spree::CreditCard.new(attrs)
+      # Can't mass assign these:
+      card.cc_type = attrs[:cc_type]
+      card.last_digits = attrs[:last_digits]
+      card.user_id = spree_current_user.id
+      card
     end
 
     def set_credit_card
diff --git a/app/serializers/api/credit_card_serializer.rb b/app/serializers/api/credit_card_serializer.rb
index 34b3bd124f..f53e9f4e23 100644
--- a/app/serializers/api/credit_card_serializer.rb
+++ b/app/serializers/api/credit_card_serializer.rb
@@ -6,7 +6,7 @@ class Api::CreditCardSerializer < ActiveModel::Serializer
   end
 
   def number
-    'x-' + object.last_digits
+    "x-#{object.last_digits}"
   end
 
   def expiry
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 03be617bfc..66be05de9f 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -768,6 +768,7 @@ en:
 
 
   # Front-end controller translations
+  card_could_not_be_saved: card could not be saved
   spree_gateway_error_flash_for_checkout: "There was a problem with your payment information: %{error}"
 
   # Printable Invoice Columns
diff --git a/spec/controllers/spree/credit_cards_controller_spec.rb b/spec/controllers/spree/credit_cards_controller_spec.rb
index 4b707c6114..4c183cb9d1 100644
--- a/spec/controllers/spree/credit_cards_controller_spec.rb
+++ b/spec/controllers/spree/credit_cards_controller_spec.rb
@@ -5,29 +5,63 @@ describe Spree::CreditCardsController do
   include AuthenticationWorkflow
   let(:user) { create_enterprise_user }
   let(:token) { "tok_234bd2c22" }
-
-  before do
-    Stripe.api_key = "sk_test_12345"
-  end
-
-  it "Creates a credit card from token + params" do
-    controller.stub(:spree_current_user) { user }
-
-    stub_request(:post, "https://api.stripe.com/v1/customers")
-      .with(:body => { email: user.email, source: token })
-      .to_return(status: 200, body: JSON.generate({ id: "cus_AZNMJ", default_source: "card_1AEEb" }))
-
-    expect{ post :new_from_token, {
+  let(:params) do
+    {
+      format: :json,
       "exp_month" => 12,
       "exp_year" => 2020,
       "last4" => 4242,
       "token" => token,
       "cc_type" => "visa"
-    } }.to change(Spree::CreditCard, :count).by(1)
+    }
+  end
 
-    Spree::CreditCard.last.gateway_payment_profile_id.should eq "card_1AEEb"
-    Spree::CreditCard.last.gateway_customer_profile_id.should eq "cus_AZNMJ"
-    Spree::CreditCard.last.user_id.should eq user.id
-    Spree::CreditCard.last.last_digits.should eq "4242"
+  before do
+    Stripe.api_key = "sk_test_12345"
+    controller.stub(:spree_current_user) { user }
+    stub_request(:post, "https://api.stripe.com/v1/customers")
+      .with(:body => { email: user.email, source: token })
+      .to_return(response_mock)
+  end
+
+  describe "#new_from_token" do
+    context "when the request to store the customer/card with Stripe is successful" do
+      let(:response_mock) { { status: 200, body: JSON.generate({ id: "cus_AZNMJ", default_source: "card_1AEEb" }) } }
+
+      it "saves the card locally" do
+        expect{ post :new_from_token, params }.to change(Spree::CreditCard, :count).by(1)
+
+        card = Spree::CreditCard.last
+        card.gateway_payment_profile_id.should eq "card_1AEEb"
+        card.gateway_customer_profile_id.should eq "cus_AZNMJ"
+        card.user_id.should eq user.id
+        card.last_digits.should eq "4242"
+      end
+
+      context "when saving the card locally fails" do
+        before do
+          allow(controller).to receive(:stored_card_attributes) { {} }
+        end
+
+        it "renders a flash error" do
+          expect{ post :new_from_token, params }.to_not change(Spree::CreditCard, :count)
+
+          json_response = JSON.parse(response.body)
+          flash_message = I18n.t(:spree_gateway_error_flash_for_checkout, error: I18n.t(:card_could_not_be_saved))
+          expect(json_response["flash"]["error"]).to eq flash_message
+        end
+      end
+    end
+
+    context "when the request to store the customer/card with Stripe fails" do
+      let(:response_mock) { { status: 402, body: JSON.generate({ error: { message: "Bup-bow..." }}) } }
+      it "doesn't save the card locally, and renders a flash error" do
+        expect{ post :new_from_token, params }.to_not change(Spree::CreditCard, :count)
+
+        json_response = JSON.parse(response.body)
+        flash_message = I18n.t(:spree_gateway_error_flash_for_checkout, error: "Bup-bow...")
+        expect(json_response["flash"]["error"]).to eq flash_message
+      end
+    end
   end
 end

From 6499d17cb120248c99997402091bc22434ffdad3 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 16 Jun 2017 11:37:54 +1000
Subject: [PATCH 214/353] Adding feature toggle config variable for Stripe
 Connect

---
 .../stripe_connect_settings_controller.rb     | 39 ++++++++
 .../spree/app_configuration_decorator.rb      |  3 +
 ...d_stripe_connect_settings.html.haml.deface |  4 +
 .../stripe_connect_settings/edit.html.haml    | 50 +++++++++++
 config/locales/en.yml                         | 26 ++++++
 config/routes.rb                              |  2 +
 ...stripe_connect_settings_controller_spec.rb | 89 +++++++++++++++++++
 7 files changed, 213 insertions(+)
 create mode 100644 app/controllers/admin/stripe_connect_settings_controller.rb
 create mode 100644 app/overrides/spree/admin/shared/_configuration_menu/add_stripe_connect_settings.html.haml.deface
 create mode 100644 app/views/admin/stripe_connect_settings/edit.html.haml
 create mode 100644 spec/controllers/admin/stripe_connect_settings_controller_spec.rb

diff --git a/app/controllers/admin/stripe_connect_settings_controller.rb b/app/controllers/admin/stripe_connect_settings_controller.rb
new file mode 100644
index 0000000000..4e81f89e3c
--- /dev/null
+++ b/app/controllers/admin/stripe_connect_settings_controller.rb
@@ -0,0 +1,39 @@
+module Admin
+  class StripeConnectSettingsController < Spree::Admin::BaseController
+    before_filter :load_settings, only: [:edit]
+
+    def edit
+      begin
+        return @stripe_account = { status: :empty_api_key } if Stripe.api_key.blank?
+        attrs = [:id, :business_name, :charges_enabled]
+        @obfuscated_secret_key = obfuscated_secret_key
+        @stripe_account = Stripe::Account.retrieve.to_hash.slice(*attrs).merge(status: :ok)
+      rescue Stripe::AuthenticationError => e
+        @stripe_account = { status: :auth_fail }
+      end
+    end
+
+    def update
+      Spree::Config.set(params[:settings])
+      resource = t('admin.controllers.stripe_connect_settings.resource')
+      flash[:success] = t(:successfully_updated, :resource => resource)
+      redirect_to_edit
+    end
+
+    private
+
+    def load_settings
+      klass = Struct.new(:stripe_connect_enabled)
+      @settings = klass.new(Spree::Config[:stripe_connect_enabled])
+    end
+
+    def redirect_to_edit
+      redirect_to main_app.edit_admin_stripe_connect_settings_path
+    end
+
+    def obfuscated_secret_key
+      key = Stripe.api_key
+      key.first(8) + "****" + key.last(4)
+    end
+  end
+end
diff --git a/app/models/spree/app_configuration_decorator.rb b/app/models/spree/app_configuration_decorator.rb
index 925106f3db..a702cecf15 100644
--- a/app/models/spree/app_configuration_decorator.rb
+++ b/app/models/spree/app_configuration_decorator.rb
@@ -39,4 +39,7 @@ Spree::AppConfiguration.class_eval do
   # Invoices & Receipts
   preference :invoice_style2?, :boolean, default: false
   preference :enable_receipt_printing?, :boolean, default: false
+
+  # Stripe Connect
+  preference :stripe_connect_enabled, :boolean, default: false
 end
diff --git a/app/overrides/spree/admin/shared/_configuration_menu/add_stripe_connect_settings.html.haml.deface b/app/overrides/spree/admin/shared/_configuration_menu/add_stripe_connect_settings.html.haml.deface
new file mode 100644
index 0000000000..c7b3f4789a
--- /dev/null
+++ b/app/overrides/spree/admin/shared/_configuration_menu/add_stripe_connect_settings.html.haml.deface
@@ -0,0 +1,4 @@
+// insert_bottom "[data-hook='admin_configurations_sidebar_menu']"
+
+%li
+  = link_to t('.stripe_connect'), main_app.edit_admin_stripe_connect_settings_path
diff --git a/app/views/admin/stripe_connect_settings/edit.html.haml b/app/views/admin/stripe_connect_settings/edit.html.haml
new file mode 100644
index 0000000000..bd5d32cf6c
--- /dev/null
+++ b/app/views/admin/stripe_connect_settings/edit.html.haml
@@ -0,0 +1,50 @@
+= render :partial => 'spree/admin/shared/configuration_menu'
+
+- content_for :page_title do
+  = t('.title')
+
+%fieldset.no-border-bottom
+  %legend
+    = t('.settings')
+  = form_for @settings, as: :settings, url: main_app.admin_stripe_connect_settings_path, :method => :put do |f|
+    .row
+      .twelve.columns.alpha.omega
+        .field
+          - disabled = !@settings.stripe_connect_enabled && @stripe_account[:status] != :ok
+          = f.label :stripe_connect_enabled, t('.stripe_connect_enabled')
+          = f.check_box :stripe_connect_enabled, disabled: disabled
+    .row
+      .twelve.columns.alpha.omega.form-buttons{"data-hook" => "buttons"}
+        = button t(:update), 'icon-refresh', value: "update"
+
+%fieldset.no-border-bottom
+  %legend= t('.status')
+  - if @stripe_account[:status] == :ok
+    .alert-box.ok
+      .status
+        %strong= t(".status") + ":"
+        = t(".ok")
+        %i.icon-ok
+      .business_name
+        %strong= t(".business_name") + ":"
+        = @stripe_account[:business_name]
+      .charges_enabled
+        %strong
+        - enabled_text = t(@stripe_account[:charges_enabled] ? :say_yes : :say_no)
+        = t(".charges_enabled") + ":"
+        = enabled_text
+      .account_id
+        %strong= t(".account_id") + ":"
+        = @stripe_account[:id]
+      .secret_key
+        %strong= t('.instance_secret_key') + ":"
+        = @obfuscated_secret_key
+      .publishable_key
+        %strong= t('.instance_publishable_key') + ":"
+        = ENV["STRIPE_INSTANCE_PUBLISHABLE_KEY"]
+    - if !@stripe_account[:charges_enabled]
+      .alert-box.warning
+        = t(".charges_enabled_warning")
+  - else
+    .alert-box.error
+      = t(".#{@stripe_account[:status]}_error")
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 66be05de9f..a92f6fc59b 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -665,6 +665,7 @@ en:
     shared:
       user_guide_link:
         user_guide: User Guide
+
     invoice_settings:
       edit:
         title: Invoice Settings
@@ -735,6 +736,28 @@ en:
         description: Invoices for import into Xero
       packing:
         name: Packing Reports
+
+    stripe_connect_settings:
+      edit:
+        title: "Stripe Connect"
+        settings: "Settings"
+        stripe_connect_enabled: Enable shops to accept payments using Stripe Connect?
+        no_api_key_msg: No Stripe account exists for this enterprise.
+        status: Status
+        ok: Ok
+        instance_secret_key: Instance Secret Key
+        account_id: Account ID
+        business_name: Business Name
+        charges_enabled: Charges Enabled
+        charges_enabled_warning: "Warning: Charges are not enabled for your account"
+        auth_fail_error: The API key you provided is invalid
+        empty_api_key_error: No Stripe API key has been provided. To set your API key, please follow the instructions at
+
+    # Admin controllers
+    controllers:
+      stripe_connect_settings:
+        resource: Stripe Connect configuration
+
 # Frontend views
 #
 # These keys are referenced relatively like `t('.message')` in
@@ -2120,6 +2143,9 @@ Please follow the instructions there to make your enterprise visible on the Open
           bulk_coop_allocation: 'Bulk Co-op - Allocation'
           bulk_coop_packing_sheets: 'Bulk Co-op - Packing Sheets'
           bulk_coop_customer_payments: 'Bulk Co-op - Customer Payments'
+      shared:
+        configuration_menu:
+          stripe_connect: Stripe Connect
       variants:
         autocomplete:
           producer_name: Producer
diff --git a/config/routes.rb b/config/routes.rb
index cf6f6bda4f..bb1422063c 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -171,6 +171,8 @@ Openfoodnetwork::Application.routes.draw do
     end
 
     resource :invoice_settings, only: [:edit, :update]
+
+    resource :stripe_connect_settings, only: [:edit, :update]
   end
 
   namespace :api do
diff --git a/spec/controllers/admin/stripe_connect_settings_controller_spec.rb b/spec/controllers/admin/stripe_connect_settings_controller_spec.rb
new file mode 100644
index 0000000000..6a029d2bf7
--- /dev/null
+++ b/spec/controllers/admin/stripe_connect_settings_controller_spec.rb
@@ -0,0 +1,89 @@
+require 'spec_helper'
+
+describe Admin::StripeConnectSettingsController, type: :controller do
+  let(:user) { create(:user) }
+  let(:admin) { create(:admin_user) }
+
+  before do
+    Spree::Config.set(stripe_connect_enabled: true)
+  end
+
+  describe "edit" do
+    context "as an enterprise user" do
+      before { allow(controller).to receive(:spree_current_user) { user } }
+
+      it "does not allow access" do
+        spree_get :edit
+        expect(response).to redirect_to spree.unauthorized_path
+      end
+    end
+
+    context "as super admin" do
+      before { allow(controller).to receive(:spree_current_user) { admin } }
+
+      context "when a Stripe API key is not set" do
+        before { Stripe.api_key = nil }
+
+        it "sets the account status to :empty_api_key" do
+          spree_get :edit
+          expect(assigns(:stripe_account)[:status]).to eq :empty_api_key
+          expect(assigns(:settings).stripe_connect_enabled).to be true
+        end
+      end
+
+      context "when a Stripe API key is set" do
+        before { Stripe.api_key = "sk_test_xxxx" }
+
+        context "and the request to retrieve Stripe account info fails" do
+          before do
+            stub_request(:get, "https://api.stripe.com/v1/account").
+            to_return(:status => 401, :body => "{\"error\": {\"message\": \"Invalid API Key provided: sk_test_****xxxx\"}}")
+          end
+
+          it "sets the account status to :auth_fail" do
+            spree_get :edit
+            expect(assigns(:stripe_account)[:status]).to eq :auth_fail
+            expect(assigns(:settings).stripe_connect_enabled).to be true
+          end
+        end
+
+        context "and the request to retrieve Stripe account info succeeds" do
+          before do
+            stub_request(:get, "https://api.stripe.com/v1/account").
+            to_return(:status => 200, :body => "{ \"id\": \"acct_1234\", \"business_name\": \"OFN\" }")
+          end
+
+          it "sets the account status to :ok, loads settings into Struct" do
+            spree_get :edit
+            expect(assigns(:stripe_account)[:status]).to eq :ok
+            expect(assigns(:obfuscated_secret_key)).to eq "sk_test_****xxxx"
+            expect(assigns(:settings).stripe_connect_enabled).to be true
+          end
+        end
+      end
+    end
+  end
+
+  describe "update" do
+    let(:params) { { settings: { stripe_connect_enabled: false } } }
+
+    context "as an enterprise user" do
+      before { allow(controller).to receive(:spree_current_user) { user } }
+
+      it "does not allow access" do
+        spree_get :update, params
+        expect(response).to redirect_to spree.unauthorized_path
+      end
+    end
+
+    context "as super admin" do
+      before {allow(controller).to receive(:spree_current_user) { admin } }
+
+      it "sets global config to the specified values" do
+        expect(Spree::Config.stripe_connect_enabled).to be true
+        spree_get :update, params
+        expect(Spree::Config.stripe_connect_enabled).to be false
+      end
+    end
+  end
+end

From f8909274238d6528eecba2f868113bedb76ea1e4 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 22 Jun 2017 09:38:48 +1000
Subject: [PATCH 215/353] Implementing the Stripe Connect feature toggle

---
 .../admin/stripe_accounts_controller.rb       |  1 +
 .../payment_methods_controller_decorator.rb   |  7 ++
 app/helpers/enterprises_helper.rb             |  1 +
 .../form/_payment_methods.html.haml           |  3 +-
 .../payment_methods/_stripe_connect.html.haml |  3 +
 app/views/spree/users/show.html.haml          |  5 +-
 config/locales/en.yml                         |  1 +
 .../admin/stripe_account_controller_spec.rb   | 71 +++++++++++--------
 spec/features/admin/payment_method_spec.rb    |  1 +
 spec/features/consumer/account/cards_spec.rb  |  2 +
 .../consumer/shopping/checkout_spec.rb        | 11 ++-
 spec/helpers/enterprises_helper_spec.rb       | 21 ++++++
 12 files changed, 89 insertions(+), 38 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index 93afa8a92d..c63ba934c8 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -30,6 +30,7 @@ module Admin
 
     def status
       authorize! :stripe_account, Enterprise.find_by_id(params[:enterprise_id])
+      return render json: { status: :stripe_disabled } unless Spree::Config.stripe_connect_enabled
       stripe_account = StripeAccount.find_by_enterprise_id(params[:enterprise_id])
       return render json: { status: :account_missing } unless stripe_account
 
diff --git a/app/controllers/spree/admin/payment_methods_controller_decorator.rb b/app/controllers/spree/admin/payment_methods_controller_decorator.rb
index fc15324d0b..2456f7c5aa 100644
--- a/app/controllers/spree/admin/payment_methods_controller_decorator.rb
+++ b/app/controllers/spree/admin/payment_methods_controller_decorator.rb
@@ -57,12 +57,19 @@ module Spree
         else
           @providers = Gateway.providers.reject{ |p| p.name.include? "Bogus" }.sort{|p1, p2| p1.name <=> p2.name }
         end
+        @providers.reject!{ |p| p.name.ends_with? "StripeConnect" } unless show_stripe?
         @calculators = PaymentMethod.calculators.sort_by(&:name)
       end
 
       def load_hubs
         @hubs = Enterprise.managed_by(spree_current_user).is_distributor.sort_by!{ |d| [(@payment_method.has_distributor? d) ? 0 : 1, d.name] }
       end
+
+      # Show Stripe as an option if enabled, or if the
+      # current payment_method is already a Stripe method
+      def show_stripe?
+        Spree::Config.stripe_connect_enabled || @payment_method.try(:type) == "Spree::Gateway::StripeConnect"
+      end
     end
   end
 end
diff --git a/app/helpers/enterprises_helper.rb b/app/helpers/enterprises_helper.rb
index 6b42d3bca5..1b5f54a84c 100644
--- a/app/helpers/enterprises_helper.rb
+++ b/app/helpers/enterprises_helper.rb
@@ -21,6 +21,7 @@ module EnterprisesHelper
   def available_payment_methods
     return [] unless current_distributor.present?
     payment_methods = current_distributor.payment_methods.available(:front_end).all
+    payment_methods.reject!{ |p| p.type.ends_with? "StripeConnect" } unless Spree::Config.stripe_connect_enabled
 
     applicator = OpenFoodNetwork::TagRuleApplicator.new(current_distributor, "FilterPaymentMethods", current_customer.andand.tag_list)
     applicator.filter!(payment_methods)
diff --git a/app/views/admin/enterprises/form/_payment_methods.html.haml b/app/views/admin/enterprises/form/_payment_methods.html.haml
index 261fa33bcc..30a5852816 100644
--- a/app/views/admin/enterprises/form/_payment_methods.html.haml
+++ b/app/views/admin/enterprises/form/_payment_methods.html.haml
@@ -1,4 +1,5 @@
-= render 'admin/enterprises/form/stripe_connect'
+- if Spree::Config.stripe_connect_enabled || @enterprise.stripe_account
+  = render 'admin/enterprises/form/stripe_connect'
 
 - if @payment_methods.count > 0
   %table
diff --git a/app/views/spree/admin/payment_methods/_stripe_connect.html.haml b/app/views/spree/admin/payment_methods/_stripe_connect.html.haml
index 6eb55b50d8..9ccc733720 100644
--- a/app/views/spree/admin/payment_methods/_stripe_connect.html.haml
+++ b/app/views/spree/admin/payment_methods/_stripe_connect.html.haml
@@ -14,6 +14,9 @@
       .alert-box.warning{ ng: { hide: "stripe_account.status" } }
         = t(".loading_account_information_msg")
 
+      .alert-box.error{ ng: { show: "stripe_account.status == 'stripe_disabled'" } }
+        = t(".stripe_disabled_msg")
+
       .alert-box.error{ ng: { show: "stripe_account.status == 'request_failed'" } }
         = t(".request_failed_msg")
 
diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index 43a7e04f64..23c9e3b52d 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -21,8 +21,9 @@
   .row.tabset-ctrl#account-tabs{ style: 'margin-bottom: 100px', navigate: 'true', selected: 'orders', prefix: 'account' }
     .small.12.medium-3.columns.tab{ name: "orders" }
       %a{ href: 'javascript:void(0)' }=t('.tabs.orders')
-    .small.12.medium-3.columns.tab{ name: "cards" }
-      %a{ href: 'javascript:void(0)' }=t('.tabs.cards')
+    - if Spree::Config.stripe_connect_enabled
+      .small.12.medium-3.columns.tab{ name: "cards" }
+        %a{ href: 'javascript:void(0)' }=t('.tabs.cards')
     .small.12.medium-3.columns.tab{ name: "transactions" }
       %a{ href: 'javascript:void(0)' }=t('.tabs.transactions')
     .small.12.medium-3.columns.tab{ name: "settings" }
diff --git a/config/locales/en.yml b/config/locales/en.yml
index a92f6fc59b..bb1d1bbd80 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2109,6 +2109,7 @@ Please follow the instructions there to make your enterprise visible on the Open
         stripe_connect:
           enterprise_select_placeholder: Choose...
           loading_account_information_msg: Loading account information from stripe, please wait...
+          stripe_disabled_msg: Stripe payments have been disabled by the system administrator.
           request_failed_msg: Sorry. Something went wrong when trying to verify account details with Stripe...
           account_missing_msg: No Stripe account exists for this enterprise.
           connect_one: Connect One
diff --git a/spec/controllers/admin/stripe_account_controller_spec.rb b/spec/controllers/admin/stripe_account_controller_spec.rb
index 44e41eb6e6..415baac673 100644
--- a/spec/controllers/admin/stripe_account_controller_spec.rb
+++ b/spec/controllers/admin/stripe_account_controller_spec.rb
@@ -46,6 +46,7 @@ describe Admin::StripeAccountsController, type: :controller do
 
     before do
       Stripe.api_key = "sk_test_12345"
+      Spree::Config.set({stripe_connect_enabled: false})
     end
 
     context "where I don't manage the specified enterprise" do
@@ -69,49 +70,61 @@ describe Admin::StripeAccountsController, type: :controller do
         allow(controller).to receive(:spree_current_user) { enterprise.owner }
       end
 
-      context "but it has no associated stripe account" do
-        it "returns with a status of 'account_missing'" do
+      context "but Stripe is not enabled" do
+        it "returns with a status of 'stripe_disabled'" do
           spree_get :status, params
           json_response = JSON.parse(response.body)
-          expect(json_response["status"]).to eq "account_missing"
+          expect(json_response["status"]).to eq "stripe_disabled"
         end
       end
 
-      context "and it has an associated stripe account" do
-        let!(:account) { create(:stripe_account, stripe_user_id: "acc_123", enterprise: enterprise) }
+      context "and Stripe is enabled" do
+        before { Spree::Config.set({stripe_connect_enabled: true}) }
 
-        context "which has been revoked or does not exist" do
-          before do
-            stub_request(:get, "https://api.stripe.com/v1/accounts/acc_123").to_return(status: 404)
-          end
-
-          it "returns with a status of 'access_revoked'" do
+        context "but it has no associated stripe account" do
+          it "returns with a status of 'account_missing'" do
             spree_get :status, params
             json_response = JSON.parse(response.body)
-            expect(json_response["status"]).to eq "access_revoked"
+            expect(json_response["status"]).to eq "account_missing"
           end
         end
 
-        context "which is connected" do
-          let(:stripe_account_mock) { {
-            id: "acc_123",
-            business_name: "My Org",
-            charges_enabled: true,
-            some_other_attr: "something"
-          } }
+        context "and it has an associated stripe account" do
+          let!(:account) { create(:stripe_account, stripe_user_id: "acc_123", enterprise: enterprise) }
 
-          before do
-            stub_request(:get, "https://api.stripe.com/v1/accounts/acc_123").to_return(body: JSON.generate(stripe_account_mock))
+          context "which has been revoked or does not exist" do
+            before do
+              stub_request(:get, "https://api.stripe.com/v1/accounts/acc_123").to_return(status: 404)
+            end
+
+            it "returns with a status of 'access_revoked'" do
+              spree_get :status, params
+              json_response = JSON.parse(response.body)
+              expect(json_response["status"]).to eq "access_revoked"
+            end
           end
 
-          it "returns with a status of 'connected'" do
-            spree_get :status, params
-            json_response = JSON.parse(response.body)
-            expect(json_response["status"]).to eq "connected"
-            # serializes required attrs
-            expect(json_response["business_name"]).to eq "My Org"
-            # ignores other attrs
-            expect(json_response["some_other_attr"]).to be nil
+          context "which is connected" do
+            let(:stripe_account_mock) { {
+              id: "acc_123",
+              business_name: "My Org",
+              charges_enabled: true,
+              some_other_attr: "something"
+            } }
+
+            before do
+              stub_request(:get, "https://api.stripe.com/v1/accounts/acc_123").to_return(body: JSON.generate(stripe_account_mock))
+            end
+
+            it "returns with a status of 'connected'" do
+              spree_get :status, params
+              json_response = JSON.parse(response.body)
+              expect(json_response["status"]).to eq "connected"
+              # serializes required attrs
+              expect(json_response["business_name"]).to eq "My Org"
+              # ignores other attrs
+              expect(json_response["some_other_attr"]).to be nil
+            end
           end
         end
       end
diff --git a/spec/features/admin/payment_method_spec.rb b/spec/features/admin/payment_method_spec.rb
index 68f1d0035c..6a82e7951b 100644
--- a/spec/features/admin/payment_method_spec.rb
+++ b/spec/features/admin/payment_method_spec.rb
@@ -40,6 +40,7 @@ feature %q{
       let!(:stripe_account_mock) { { id: "acc_connected123", business_name: "My Org", charges_enabled: true } }
 
       before do
+        Spree::Config.set({stripe_connect_enabled: true})
         Stripe.api_key = "sk_test_12345"
         stub_request(:get, "https://api.stripe.com/v1/accounts/acc_connected123").to_return(body: JSON.generate(stripe_account_mock))
         stub_request(:get, "https://api.stripe.com/v1/accounts/acc_revoked123").to_return(status: 404)
diff --git a/spec/features/consumer/account/cards_spec.rb b/spec/features/consumer/account/cards_spec.rb
index 56d760c1f3..ce0b846d00 100644
--- a/spec/features/consumer/account/cards_spec.rb
+++ b/spec/features/consumer/account/cards_spec.rb
@@ -9,6 +9,8 @@ feature "Credit Cards", js: true do
     before do
       quick_login_as user
 
+      Spree::Config.set({stripe_connect_enabled: true})
+
       stub_request(:get, "https://api.stripe.com/v1/customers/cus_AZNMJ").
       to_return(:status => 200, :body => JSON.generate({id: "cus_AZNMJ"}))
 
diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index ae2d0e0f38..6dbe5dc445 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -157,6 +157,7 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
 
         before do
           Stripe.api_key = "sk_test_123456"
+          Spree::Config.set({stripe_connect_enabled: true})
           stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
             .to_return(body: JSON.generate(response_mock))
 
@@ -166,17 +167,15 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
           choose stripe_pm.name
         end
 
-        it "shows the saved credit card dropdown" do
+        it "allows use of a saved card" do
+          # shows the saved credit card dropdown
           page.should have_content "Previously Used Credit Cards"
-        end
 
-        it "disables the input fields when a saved card is selected" do
+          # disables the input fields when a saved card is selected" do
           select "Visa x-1111 Exp:01/2025", from: "selected_card"
           page.should have_css "#secrets\\.card_number[disabled]"
-        end
 
-        it "allows use of a saved card" do
-          select "Visa x-1111 Exp:01/2025", from: "selected_card"
+          # allows checkout
           place_order
           page.should have_content "Your order has been processed successfully"
         end
diff --git a/spec/helpers/enterprises_helper_spec.rb b/spec/helpers/enterprises_helper_spec.rb
index 8e8fa3ed5e..ebfaa8d890 100644
--- a/spec/helpers/enterprises_helper_spec.rb
+++ b/spec/helpers/enterprises_helper_spec.rb
@@ -219,5 +219,26 @@ describe EnterprisesHelper do
         end
       end
     end
+
+    context "when StripeConnect payment methods are present" do
+      let!(:pm3) { create(:payment_method, type: "Spree::Gateway::StripeConnect", distributors: [distributor])}
+      before { allow(helper).to receive(:current_distributor) { distributor } }
+
+      context "and Stripe Connect is disabled" do
+        before { Spree::Config.set({stripe_connect_enabled: false}) }
+
+        it "ignores the Stripe payment method" do
+          expect(helper.available_payment_methods.map(&:id)).to_not include pm3.id
+        end
+      end
+
+      context "and Stripe Connect is enabled" do
+        before { Spree::Config.set({stripe_connect_enabled: true}) }
+
+        it "includes the Stripe payment method" do
+          expect(helper.available_payment_methods.map(&:id)).to include pm3.id
+        end
+      end
+    end
   end
 end

From e8636c0cbf5ad4b1e71116278e34cdbc41164f55 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 22 Jun 2017 13:36:07 +1000
Subject: [PATCH 216/353] Set dummy Stripe API key for front-end credits cards
 feature spec

---
 spec/features/consumer/account/cards_spec.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/spec/features/consumer/account/cards_spec.rb b/spec/features/consumer/account/cards_spec.rb
index ce0b846d00..ed12543099 100644
--- a/spec/features/consumer/account/cards_spec.rb
+++ b/spec/features/consumer/account/cards_spec.rb
@@ -9,6 +9,7 @@ feature "Credit Cards", js: true do
     before do
       quick_login_as user
 
+      Stripe.api_key = "sk_test_xxxx"
       Spree::Config.set({stripe_connect_enabled: true})
 
       stub_request(:get, "https://api.stripe.com/v1/customers/cus_AZNMJ").

From 5d77ef52c5381f4672819cdbf9beadb48ba7a35d Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 30 Jun 2017 13:26:01 +1000
Subject: [PATCH 217/353] Replace text strings with variables in stripe request
 spec

---
 spec/requests/stripe_connect_checkout_spec.rb | 55 +++++++++++--------
 1 file changed, 32 insertions(+), 23 deletions(-)

diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index 61eed6c319..9a58395f24 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -6,7 +6,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
   let!(:order_cycle) { create(:simple_order_cycle) }
   let!(:enterprise) { create(:distributor_enterprise) }
-  let!(:exchange) { create(:exchange, order_cycle: order_cycle, sender: order_cycle.coordinator, receiver: enterprise, incoming: false, pickup_time: "Monday")}
+  let!(:exchange) { create(:exchange, order_cycle: order_cycle, sender: order_cycle.coordinator, receiver: enterprise, incoming: false, pickup_time: "Monday") }
   let!(:shipping_method) { create(:shipping_method, calculator: Spree::Calculator::FlatRate.new(preferred_amount: 0), distributors: [enterprise]) }
   let!(:payment_method) { create(:payment_method, type: "Spree::Gateway::StripeConnect", distributors: [enterprise]) }
   let!(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
@@ -14,12 +14,17 @@ describe "Submitting Stripe Connect charge requests", type: :request do
   let!(:order) { line_item.order }
   let(:address) { create(:address) }
   let(:token) { "token123" }
-  let(:params) { { format: :json, order: {
+  let(:new_token) { "newtoken123" }
+  let(:card_id) { "card_XyZ456" }
+  let(:customer_id) { "cus_A123" }
+  let(:params) do
+    { format: :json, order: {
       shipping_method_id: shipping_method.id,
       payments_attributes: [{payment_method_id: payment_method.id, source_attributes: { gateway_payment_profile_id: token, cc_type: "visa", last_digits: "4242", month: 10, year: 2025 }}],
       bill_address_attributes: address.attributes.slice("firstname","lastname","address1","address2","phone","city","zipcode","state_id","country_id"),
       ship_address_attributes: address.attributes.slice("firstname","lastname","address1","address2","phone","city","zipcode","state_id","country_id")
-  } } }
+    } }
+  end
 
   before do
     Stripe.api_key = "sk_test_123456"
@@ -37,17 +42,17 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
       # Requests a token from the newly saved card
       stub_request(:post, "https://api.stripe.com/v1/tokens")
-        .with(:body => { card: "card_XyZ456", customer: "cus_A123"})
-        .to_return(status: 200, body: JSON.generate({id: "newtoken_123"}))
+        .with(:body => { card: card_id, customer: customer_id})
+        .to_return(status: 200, body: JSON.generate(id: new_token))
 
       # Charges the card
       stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
-        .with(:body => {"amount"=>"1234", "card"=>"newtoken_123", "currency"=>"aud", "description"=>"Spree Order ID: #{order.number}", "payment_user_agent"=>"Stripe/v1 ActiveMerchantBindings/1.63.0"})
-        .to_return(body: JSON.generate(charge_response_mock))
+        .with(:body => {"amount" => "1234", "card" => new_token, "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
+        .to_return(status: 200, body: JSON.generate(charge_response_mock))
     end
 
-    context "and the store and charge requests are accepted" do
-      let(:store_response_mock) { { id: "cus_A123", default_card: "card_XyZ456", sources: { data: [{id: "1"}] } } }
+    context "and the store, token and charge requests are successful" do
+      let(:store_response_mock) { { id: customer_id, default_card: card_id, sources: { data: [{id: "1"}] } } }
       let(:charge_response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
 
       it "should process the payment, and stores the card/customer details" do
@@ -56,8 +61,8 @@ describe "Submitting Stripe Connect charge requests", type: :request do
         expect(json_response["path"]).to eq spree.order_path(order)
         expect(order.payments.completed.count).to be 1
         card = order.payments.completed.first.source
-        expect(card.gateway_customer_profile_id).to eq "cus_A123"
-        expect(card.gateway_payment_profile_id).to eq "card_XyZ456"
+        expect(card.gateway_customer_profile_id).to eq customer_id
+        expect(card.gateway_payment_profile_id).to eq card_id
       end
     end
 
@@ -75,7 +80,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     end
 
     context "when the charge request returns an error message" do
-      let(:store_response_mock) { { id: "cus_A123", default_card: "card_XyZ456", sources: { data: [{id: "1"}] } } }
+      let(:store_response_mock) { { id: customer_id, default_card: card_id, sources: { data: [{id: "1"}] } } }
       let(:charge_response_mock) { { error: { message: "Bup-bow..."} } }
 
       it "should not process the payment" do
@@ -89,12 +94,16 @@ describe "Submitting Stripe Connect charge requests", type: :request do
   end
 
   context "when an existing card is submitted" do
-    let(:credit_card) { create(:credit_card,
-      payment_method_id: payment_method.id,
-      user_id: order.user_id,
-      gateway_payment_profile_id: "card_AbC123",
-      gateway_customer_profile_id: "cus_Z456",
-      month: 11, year: 2026) }
+    let(:credit_card) do
+      create(
+        :credit_card,
+        payment_method_id: payment_method.id,
+        user_id: order.user_id,
+        gateway_payment_profile_id: card_id,
+        gateway_customer_profile_id: customer_id,
+        month: 11, year: 2026
+      )
+    end
 
     before do
       params[:order][:existing_card] = credit_card.id
@@ -102,12 +111,12 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
       # Requests a token
       stub_request(:post, "https://api.stripe.com/v1/tokens")
-        .with(:body => {"card"=>"card_AbC123", "customer"=>"cus_Z456"})
-        .to_return(status: 200, body: JSON.generate({id: "newtoken_123"}), headers: {})
+        .with(:body => {"card" => card_id, "customer" => customer_id})
+        .to_return(status: 200, body: JSON.generate(id: new_token), headers: {})
 
       # Charges the card
       stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
-        .with(:body => {"amount"=>"1234", "card"=>"newtoken_123", "currency"=>"aud", "description"=>"Spree Order ID: #{order.number}", "payment_user_agent"=>"Stripe/v1 ActiveMerchantBindings/1.63.0"})
+        .with(:body => {"amount"=>"1234", "card"=> new_token, "currency"=>"aud", "description"=>"Spree Order ID: #{order.number}", "payment_user_agent"=>"Stripe/v1 ActiveMerchantBindings/1.63.0"})
         .to_return(body: JSON.generate(charge_response_mock))
     end
 
@@ -120,8 +129,8 @@ describe "Submitting Stripe Connect charge requests", type: :request do
         expect(json_response["path"]).to eq spree.order_path(order)
         expect(order.payments.completed.count).to be 1
         card = order.payments.completed.first.source
-        expect(card.gateway_customer_profile_id).to eq "cus_Z456"
-        expect(card.gateway_payment_profile_id).to eq "card_AbC123"
+        expect(card.gateway_customer_profile_id).to eq customer_id
+        expect(card.gateway_payment_profile_id).to eq card_id
       end
     end
 

From 01ce092ebc50d914828684e47dd142417737e1cf Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 30 Jun 2017 13:56:25 +1000
Subject: [PATCH 218/353] Handle Stripe token creation request failure

---
 app/models/spree/gateway/stripe_connect.rb    | 11 ++-
 spec/requests/stripe_connect_checkout_spec.rb | 74 ++++++++++++++-----
 2 files changed, 62 insertions(+), 23 deletions(-)

diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index ca62c4a8fe..89318142f7 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -136,12 +136,11 @@ module Spree
     end
 
     def tokenize_instance_customer_card(customer, card)
-      begin
-        token = Stripe::Token.create({card: card, customer: customer}, { stripe_account: stripe_account_id})
-        token.id
-      rescue Stripe::InvalidRequestError
-        # Not really sure what to do here....
-      end
+      token = Stripe::Token.create({card: card, customer: customer}, {stripe_account: stripe_account_id})
+      token.id
+    rescue Stripe::StripeError => e
+      Rails.logger.error("Stripe Error: #{e}")
+      nil
     end
   end
 end
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index 9a58395f24..7cd63fb0b5 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -34,27 +34,28 @@ describe "Submitting Stripe Connect charge requests", type: :request do
   end
 
   context "when a new card is submitted" do
+    let(:store_response_mock) { { status: 200, body: JSON.generate(id: customer_id, default_card: card_id, sources: { data: [{id: "1"}] }) } }
+    let(:charge_response_mock) { { status: 200, body: JSON.generate(id: "ch_1234", object: "charge", amount: 2000) } }
+    let(:token_response_mock) { { status: 200, body: JSON.generate(id: new_token) } }
+
     before do
       # Saves the card against the user
       stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/customers")
         .with(:body => { card: token, email: order.email})
-        .to_return(status: 200, body: JSON.generate(store_response_mock))
+        .to_return(store_response_mock)
 
       # Requests a token from the newly saved card
       stub_request(:post, "https://api.stripe.com/v1/tokens")
         .with(:body => { card: card_id, customer: customer_id})
-        .to_return(status: 200, body: JSON.generate(id: new_token))
+        .to_return(token_response_mock)
 
       # Charges the card
       stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
         .with(:body => {"amount" => "1234", "card" => new_token, "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
-        .to_return(status: 200, body: JSON.generate(charge_response_mock))
+        .to_return(charge_response_mock)
     end
 
     context "and the store, token and charge requests are successful" do
-      let(:store_response_mock) { { id: customer_id, default_card: card_id, sources: { data: [{id: "1"}] } } }
-      let(:charge_response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
-
       it "should process the payment, and stores the card/customer details" do
         put update_checkout_path, params
         json_response = JSON.parse(response.body)
@@ -67,8 +68,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     end
 
     context "when the store request returns an error message" do
-      let(:store_response_mock) { { error: { message: "Bup-bow..."} } }
-      let(:charge_response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
+      let(:store_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
 
       it "should not process the payment" do
         put update_checkout_path, params
@@ -80,8 +80,27 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     end
 
     context "when the charge request returns an error message" do
-      let(:store_response_mock) { { id: customer_id, default_card: card_id, sources: { data: [{id: "1"}] } } }
-      let(:charge_response_mock) { { error: { message: "Bup-bow..."} } }
+      let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+
+      it "should not process the payment" do
+        put update_checkout_path, params
+        expect(response.status).to be 400
+        json_response = JSON.parse(response.body)
+        expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
+        expect(order.payments.completed.count).to be 0
+      end
+    end
+
+    context "when the token request returns an error message" do
+      let(:token_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+      let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+
+      before do
+        # Attempts to charge the card without a token, which will return an error
+        stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+          .with(:body => {"amount" => "1234", "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
+          .to_return(charge_response_mock)
+      end
 
       it "should not process the payment" do
         put update_checkout_path, params
@@ -105,6 +124,9 @@ describe "Submitting Stripe Connect charge requests", type: :request do
       )
     end
 
+    let(:charge_response_mock) { { status: 200, body: JSON.generate(id: "ch_1234", object: "charge", amount: 2000) } }
+    let(:token_response_mock) { { status: 200, body: JSON.generate(id: new_token) } }
+
     before do
       params[:order][:existing_card] = credit_card.id
       quick_login_as(order.user)
@@ -112,17 +134,15 @@ describe "Submitting Stripe Connect charge requests", type: :request do
       # Requests a token
       stub_request(:post, "https://api.stripe.com/v1/tokens")
         .with(:body => {"card" => card_id, "customer" => customer_id})
-        .to_return(status: 200, body: JSON.generate(id: new_token), headers: {})
+        .to_return(token_response_mock)
 
       # Charges the card
       stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
-        .with(:body => {"amount"=>"1234", "card"=> new_token, "currency"=>"aud", "description"=>"Spree Order ID: #{order.number}", "payment_user_agent"=>"Stripe/v1 ActiveMerchantBindings/1.63.0"})
-        .to_return(body: JSON.generate(charge_response_mock))
+        .with(:body => {"amount" => "1234", "card" => new_token, "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"} )
+        .to_return(charge_response_mock)
     end
 
-    context "and the charge request is accepted" do
-      let(:charge_response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
-
+    context "and the charge and token requests are accepted" do
       it "should process the payment, and keep the profile ids" do
         put update_checkout_path, params
         json_response = JSON.parse(response.body)
@@ -135,7 +155,27 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     end
 
     context "when the charge request returns an error message" do
-      let(:charge_response_mock) { { error: { message: "Bup-bow..."} } }
+      let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+
+      it "should not process the payment" do
+        put update_checkout_path, params
+        expect(response.status).to be 400
+        json_response = JSON.parse(response.body)
+        expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
+        expect(order.payments.completed.count).to be 0
+      end
+    end
+
+    context "when the token request returns an error message" do
+      let(:token_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+      let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+
+      before do
+        # Attempts to charge the card without a token, which will return an error
+        stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+          .with(:body => {"amount" => "1234", "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
+          .to_return(charge_response_mock)
+      end
 
       it "should not process the payment" do
         put update_checkout_path, params

From e6eb45b453d89f3dd5518ffb13117f94cec79996 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 6 Jul 2017 20:45:01 +1000
Subject: [PATCH 219/353] Name StripeAccountController spec file correctly

---
 ...ount_controller_spec.rb => stripe_accounts_controller_spec.rb} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename spec/controllers/admin/{stripe_account_controller_spec.rb => stripe_accounts_controller_spec.rb} (100%)

diff --git a/spec/controllers/admin/stripe_account_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
similarity index 100%
rename from spec/controllers/admin/stripe_account_controller_spec.rb
rename to spec/controllers/admin/stripe_accounts_controller_spec.rb

From ae2d3d3fd92e29b0f663f7a5332a5bd4a4338e03 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 7 Jul 2017 11:48:57 +1000
Subject: [PATCH 220/353] Refactoring StripeHelper into service objects

---
 .../admin/enterprises_controller.rb           |  48 ++-----
 .../admin/stripe_accounts_controller.rb       |  33 +++--
 app/controllers/checkout_controller.rb        |  22 +--
 app/helpers/admin/stripe_helper.rb            |  75 ----------
 app/models/spree/ability_decorator.rb         |   4 +
 app/models/spree/gateway/stripe_connect.rb    |  19 +--
 app/models/stripe_account.rb                  |  11 ++
 lib/stripe/account_connector.rb               |  43 ++++++
 lib/stripe/oauth.rb                           |  51 +++++++
 .../admin/enterprises_controller_spec.rb      | 114 ++++++++--------
 .../admin/stripe_accounts_controller_spec.rb  | 129 +++++++++++++-----
 spec/helpers/admin/stripe_helper_spec.rb      |  52 -------
 spec/lib/stripe/account_connector_spec.rb     |  77 +++++++++++
 spec/lib/stripe/oauth_spec.rb                 |  25 ++++
 .../spree/gateway/stripe_connect_spec.rb      |   1 +
 spec/models/stripe_account_spec.rb            |  47 +++++++
 16 files changed, 463 insertions(+), 288 deletions(-)
 delete mode 100644 app/helpers/admin/stripe_helper.rb
 create mode 100644 lib/stripe/account_connector.rb
 create mode 100644 lib/stripe/oauth.rb
 delete mode 100644 spec/helpers/admin/stripe_helper_spec.rb
 create mode 100644 spec/lib/stripe/account_connector_spec.rb
 create mode 100644 spec/lib/stripe/oauth_spec.rb
 create mode 100644 spec/models/stripe_account_spec.rb

diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index 672e1ce178..6d548cc602 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -1,4 +1,6 @@
 require 'open_food_network/referer_parser'
+require 'stripe/account_connector'
+require 'stripe/oauth'
 
 module Admin
   class EnterprisesController < ResourceController
@@ -23,7 +25,6 @@ module Admin
     helper 'spree/products'
     include ActionView::Helpers::TextHelper
     include OrderCyclesHelper
-    include Admin::StripeHelper
 
     def index
       respond_to do |format|
@@ -115,48 +116,19 @@ module Admin
     end
 
     def stripe_connect
-      redirect_to authorize_stripe(params[:enterprise_id])
+      redirect_to Stripe::OAuth.authorize_url(params[:enterprise_id])
     end
 
     def stripe_connect_callback
-      if params["code"]
-        state = jwt_decode(params["state"])
-        unless state.keys.include? "enterprise_id"
-          redirect_to '/unauthorized' and return
-        end
-
-        # Get the Enterprise
-        @enterprise = Enterprise.find_by_permalink(state["enterprise_id"])
-        # Get the deets from Stripe
-        response_params = get_stripe_token(params["code"]).params
-
-        # In case of a problem, need to also issue a request to disconnect the account from Stripe
-        if !(spree_current_user.enterprises.include? @enterprise) && !(spree_current_user.admin?)
-          deauthorize_request_for_stripe_id(response_params["stripe_user_id"])
-          redirect_to '/unauthorized' and return
-        end
-
-        stripe_account = StripeAccount.new(stripe_user_id: response_params["stripe_user_id"], stripe_publishable_key: response_params["stripe_publishable_key"], enterprise: @enterprise)
-        if stripe_account.save
-          respond_to do |format|
-            format.html { redirect_to main_app.edit_admin_enterprise_path(@enterprise), notice: "Stripe account connected successfully."}
-            format.json { render json: stripe_account }
-          end
-        else
-          render text: "Failed to save Stripe token", status: 500
-        end
+      connector = Stripe::AccountConnector.new(spree_current_user, params)
+      if connector.create_account
+        flash[:success] = t('admin.controllers.enterprises.stripe_connect_success')
+        redirect_to main_app.edit_admin_enterprise_path(@enterprise)
       else
-        render text: params["error_description"], status: 500
-      end
-    end
-
-    def stripe_disconnect
-      if deauthorize_stripe(params[:account_id])
-        respond_to do |format|
-          format.html { redirect_to main_app.edit_admin_enterprise_path(@enterprise), notice: "Stripe account disconnected."}
-          format.json { render json: "Disconnected" }
-        end
+        render text: t('admin.controllers.enterprises.stripe_connect_fail'), status: 500
       end
+    rescue Stripe::StripeError => e
+      render text: e.message, status: 500
     end
 
     protected
diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index c63ba934c8..e5325e917a 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -1,30 +1,33 @@
 module Admin
   class StripeAccountsController < BaseController
-    include Admin::StripeHelper
     protect_from_forgery except: :destroy_from_webhook
 
     def destroy
-      if deauthorize_stripe(params[:id])
-        respond_to do |format|
-          format.html { redirect_to main_app.edit_admin_enterprise_path(params[:enterprise_id]), notice: "Stripe account disconnected."}
-          format.json { render json: stripe_account }
-        end
+      stripe_account = StripeAccount.find(params[:id])
+      authorize! :destroy, stripe_account
+
+      if stripe_account.deauthorize_and_destroy
+        flash[:success] = "Stripe account disconnected."
       else
-        respond_to do |format|
-          format.html { redirect_to main_app.edit_admin_enterprise_path(params[:enterprise_id]), notice: "Failed to disconnect Stripe."}
-          format.json { render json: stripe_account }
-        end
+        flash[:error] = "Failed to disconnect Stripe."
       end
+
+      redirect_to main_app.edit_admin_enterprise_path(stripe_account.enterprise)
+    rescue ActiveRecord::RecordNotFound
+      flash[:error] = "Failed to disconnect Stripe."
+      redirect_to spree.admin_path
     end
 
     def destroy_from_webhook
-      # Fetch the event again direct from stripe for extra security
-      event = fetch_event_from_stripe(request)
-      if event.type == "account.application.deauthorized"
-        StripeAccount.where(stripe_user_id: event.user_id).map{ |account| account.destroy }
+      # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
+      event = Stripe::Event.construct_from(params)
+      return render nothing: true, status: 400 unless event.type == "account.application.deauthorized"
+
+      destroyed = StripeAccount.where(stripe_user_id: event.user_id).destroy_all
+      if destroyed.any?
         render text: "Account #{event.user_id} deauthorized", status: 200
       else
-        render json: nil, status: 501
+        render nothing: true, status: 400
       end
     end
 
diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 0233e2c383..2f2d5a64ee 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -208,19 +208,19 @@ class CheckoutController < Spree::CheckoutController
 
   def construct_saved_card_attributes
     existing_card_id = params[:order].delete(:existing_card)
-    if existing_card_id.present?
-      credit_card = Spree::CreditCard.find(existing_card_id)
-      if credit_card.try(:user_id).blank? || credit_card.user_id != spree_current_user.try(:id)
-        raise Spree::Core::GatewayError.new I18n.t(:invalid_credit_card)
-      end
+    return if existing_card_id.blank?
 
-      # Not currently supported but maybe we should add it...?
-      credit_card.verification_value = params[:cvc_confirm] if params[:cvc_confirm].present?
-
-      params[:order][:payments_attributes].first[:source] = credit_card
-      params[:order][:payments_attributes].first[:payment_method_id] = credit_card.payment_method_id
-      params[:order][:payments_attributes].first.delete :source_attributes
+    credit_card = Spree::CreditCard.find(existing_card_id)
+    if credit_card.try(:user_id).blank? || credit_card.user_id != spree_current_user.try(:id)
+      raise Spree::Core::GatewayError, I18n.t(:invalid_credit_card)
     end
+
+    # Not currently supported but maybe we should add it...?
+    credit_card.verification_value = params[:cvc_confirm] if params[:cvc_confirm].present?
+
+    params[:order][:payments_attributes].first[:source] = credit_card
+    params[:order][:payments_attributes].first[:payment_method_id] = credit_card.payment_method_id
+    params[:order][:payments_attributes].first.delete :source_attributes
   end
 
   def rescue_from_spree_gateway_error(error)
diff --git a/app/helpers/admin/stripe_helper.rb b/app/helpers/admin/stripe_helper.rb
deleted file mode 100644
index 4fdc16355c..0000000000
--- a/app/helpers/admin/stripe_helper.rb
+++ /dev/null
@@ -1,75 +0,0 @@
-# require File.join(Rails.root, '/lib/oauth2/strategy/deauthorize')
-# require File.join(Rails.root, '/lib/oauth2/client')
-# require 'oauth2'
-module Admin
-  module StripeHelper
-
-    class << self
-      attr_accessor :client, :options
-    end
-
-    @options = {
-      :site => 'https://connect.stripe.com',
-      :authorize_url => '/oauth/authorize',
-      :deauthorize_url => '/oauth/deauthorize',
-      :token_url => '/oauth/token'
-    }
-
-    @client = OAuth2::Client.new(
-      ENV['STRIPE_CLIENT_ID'],
-      ENV['STRIPE_INSTANCE_SECRET_KEY'],
-      options
-    )
-
-    def get_stripe_token(code, options={})
-      StripeHelper.client.auth_code.get_token(code, options)
-    end
-
-    def authorize_stripe(enterprise_id, options={})
-      options = options.merge({enterprise_id: enterprise_id})
-      jwt = jwt_encode options
-      # State param will be passed back after auth
-      StripeHelper.client.auth_code.authorize_url(state: jwt, scope: 'read_write')
-    end
-
-    def deauthorize_stripe(account_id)
-      stripe_account = StripeAccount.find(account_id)
-      if stripe_account
-        # If the account is only connected to one Enterprise, make a request to remove it on the Stripe side
-        if StripeAccount.where(stripe_user_id: stripe_account.stripe_user_id).size == 1
-          response = deauthorize_request_for_stripe_id(stripe_account.stripe_user_id)
-          if response # Response from OAuth2 only returned if successful
-            stripe_account.destroy
-          end
-        else
-          stripe_account.destroy
-        end
-      end
-    end
-
-    def fetch_event_from_stripe(request)
-      event_json = JSON.parse(request.body.read)
-      # If the application has been deauthorised, we are no longer authorised to retrieve events for that account
-      # Left here in case it's useful for other webhooks
-      unless event_json["type"] == "account.application.deauthorized"
-        acct_param = event_json["user_id"] ? {"Stripe-Account" => event_json["user_id"]} : nil
-        Stripe::Event.retrieve(event_json["id"],acct_param)
-      else
-        Stripe::Event.construct_from(event_json)
-      end
-    end
-
-    def deauthorize_request_for_stripe_id(id)
-      StripeHelper.client.deauthorize(id).deauthorize_request
-    end
-
-    private
-    def jwt_encode payload
-      JWT.encode(payload, Openfoodnetwork::Application.config.secret_token, 'HS256')
-    end
-
-    def jwt_decode token
-      JWT.decode(token, Openfoodnetwork::Application.config.secret_token, true, algorithm: 'HS256')[0] # only returns the original payload
-    end
-  end
-end
diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb
index a56f233434..78c994f8a7 100644
--- a/app/models/spree/ability_decorator.rb
+++ b/app/models/spree/ability_decorator.rb
@@ -121,6 +121,10 @@ class AbilityDecorator
 
     # Not sure how to restrict these methods to a non-resource Controller
     can [:stripe_connect, :stripe_connect_callback, :stripe_disconnect], :all
+
+    can [:destroy], StripeAccount do |stripe_account|
+      user.enterprises.include? stripe_account.enterprise
+    end
   end
 
   def add_product_management_abilities(user)
diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index 89318142f7..66e0e88cf5 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -123,16 +123,17 @@ module Spree
     end
 
     def token_from_card_profile_ids(creditcard)
-      if token_or_card_id = creditcard.gateway_payment_profile_id
-        if customer = creditcard.gateway_customer_profile_id
-          # Assume the gateway_payment_profile_id is a Stripe card_id
-          # So generate a new token, using the customer_id and card_id
-          return tokenize_instance_customer_card(customer, token_or_card_id)
-        end
+      token_or_card_id = creditcard.gateway_payment_profile_id
+      customer = creditcard.gateway_customer_profile_id
 
-        # Assume the gateway_payment_profile_id is a token generated by StripeJS
-        return token_or_card_id
-      end
+      return nil if token_or_card_id.blank?
+
+      # Assume the gateway_payment_profile_id is a token generated by StripeJS
+      return token_or_card_id if customer.blank?
+
+      # Assume the gateway_payment_profile_id is a Stripe card_id
+      # So generate a new token, using the customer_id and card_id
+      tokenize_instance_customer_card(customer, token_or_card_id)
     end
 
     def tokenize_instance_customer_card(customer, card)
diff --git a/app/models/stripe_account.rb b/app/models/stripe_account.rb
index dd263a6b37..8c727533f0 100644
--- a/app/models/stripe_account.rb
+++ b/app/models/stripe_account.rb
@@ -2,4 +2,15 @@ class StripeAccount < ActiveRecord::Base
   belongs_to :enterprise
   validates_presence_of :stripe_user_id, :stripe_publishable_key
   validates_uniqueness_of :enterprise_id
+
+  def deauthorize_and_destroy
+    accounts = StripeAccount.where(stripe_user_id: stripe_user_id)
+
+    # Only deauthorize the user if it is not linked to multiple accounts
+    if accounts.count > 1 || Stripe::OAuth.deauthorize(stripe_user_id)
+      destroy
+    else
+      false
+    end
+  end
 end
diff --git a/lib/stripe/account_connector.rb b/lib/stripe/account_connector.rb
new file mode 100644
index 0000000000..c48f38d117
--- /dev/null
+++ b/lib/stripe/account_connector.rb
@@ -0,0 +1,43 @@
+# Encapsulation of logic used to handle the response from Stripe following an
+# attempt to connect an account to the instance using the OAuth Connection Flow
+# https://stripe.com/docs/connect/standard-accounts#oauth-flow
+
+module Stripe
+  class AccountConnector
+    attr_reader :oauth_response, :enterprise, :user, :params
+
+    def initialize(user, params)
+      @user = user
+      @params = params
+
+      raise StripeError, params["error_description"] unless params["code"]
+      raise CanCan::AccessDenied unless state.keys.include? "enterprise_id"
+
+      # Request an access token based on the code provided
+      @oauth_response = OAuth.request_access_token(params["code"])
+
+      # Find the Enterprise
+      @enterprise = Enterprise.find_by_permalink(state["enterprise_id"])
+
+      return if user.enterprises.include?(enterprise) || user.admin?
+
+      # Local authorisation issue, so request disconnection from Stripe
+      OAuth.deauthorize(oauth_response["stripe_user_id"])
+      raise CanCan::AccessDenied
+    end
+
+    def create_account
+      StripeAccount.create(
+        stripe_user_id: oauth_response["stripe_user_id"],
+        stripe_publishable_key: oauth_response["stripe_publishable_key"],
+        enterprise: enterprise
+      )
+    end
+
+    private
+
+    def state
+      OAuth.send(:jwt_decode, params["state"])
+    end
+  end
+end
diff --git a/lib/stripe/oauth.rb b/lib/stripe/oauth.rb
new file mode 100644
index 0000000000..105e8cdd3d
--- /dev/null
+++ b/lib/stripe/oauth.rb
@@ -0,0 +1,51 @@
+module Stripe
+  class OAuth
+    class << self
+      attr_accessor :client, :options
+    end
+
+    @options = {
+      :site => 'https://connect.stripe.com',
+      :authorize_url => '/oauth/authorize',
+      :deauthorize_url => '/oauth/deauthorize',
+      :token_url => '/oauth/token'
+    }
+
+    @client = OAuth2::Client.new(
+      ENV['STRIPE_CLIENT_ID'],
+      ENV['STRIPE_INSTANCE_SECRET_KEY'],
+      options
+    )
+
+    def self.authorize_url(enterprise_id, options = {})
+      options[:enterprise_id] = enterprise_id
+      jwt = jwt_encode(options)
+      # State param will be passed back after auth
+      client.auth_code.authorize_url(state: jwt, scope: 'read_write')
+    end
+
+    def self.request_access_token(auth_code)
+      # Fetch and return the account details from Stripe
+      client.auth_code.get_token(auth_code).params
+    end
+
+    def self.deauthorize(stripe_user_id)
+      client.deauthorize(stripe_user_id).deauthorize_request
+    end
+
+    private
+
+    def self.secret_token
+      Openfoodnetwork::Application.config.secret_token
+    end
+
+    def self.jwt_encode(payload)
+      JWT.encode(payload, secret_token, 'HS256')
+    end
+
+    def self.jwt_decode(token)
+      # Returns the original payload
+      JWT.decode(token, secret_token, true, algorithm: 'HS256')[0]
+    end
+  end
+end
diff --git a/spec/controllers/admin/enterprises_controller_spec.rb b/spec/controllers/admin/enterprises_controller_spec.rb
index 836f3e0de0..c51fbddd4f 100644
--- a/spec/controllers/admin/enterprises_controller_spec.rb
+++ b/spec/controllers/admin/enterprises_controller_spec.rb
@@ -144,67 +144,71 @@ module Admin
           expect(distributor.users).to_not include user
         end
 
-        describe "stripe connect" do
-          it "redirects to Stripe" do
-            controller.stub spree_current_user: distributor_manager
-            Admin::StripeHelper.client.stub id: "abc"
+        describe "#stripe_connect" do
+          before do
+            allow(controller).to receive(:spree_current_user) { distributor_manager }
+            allow(::Stripe::OAuth).to receive(:authorize_url) { "some_url" }
+          end
+
+          it "redirects to Stripe Authorization url constructed OAuth" do
             spree_get :stripe_connect
-            ['https://connect.stripe.com/oauth/authorize',
-              'response_type=code',
-              'state=',
-              'client_id=abc'].each{|element| response.location.should match element}
+            expect(response).to redirect_to "some_url"
+          end
+        end
+
+        context "#stripe_connect_callback" do
+          let(:params) { { id: distributor.permalink } }
+          before { allow(controller).to receive(:spree_current_user) { distributor_manager } }
+
+          context "when the connector raises a StripeError" do
+            before do
+              allow(Stripe::AccountConnector).to receive(:new).and_raise Stripe::StripeError, "some error"
+            end
+
+            it "returns a 500 error" do
+              spree_get :stripe_connect_callback, params
+              response.status.should be 500
+            end
           end
 
-          it "returns 500 on callback if the response code is not provided" do
-            controller.stub spree_current_user: distributor_manager
-            spree_get :stripe_connect_callback
-            response.status.should be 500
+          context "when the connector raises an AccessDenied error" do
+            before do
+              allow(Stripe::AccountConnector).to receive(:new).and_raise CanCan::AccessDenied, "some error"
+            end
+
+            it "redirects to unauthorized" do
+              spree_get :stripe_connect_callback, params
+              expect(response).to redirect_to spree.unauthorized_path
+            end
           end
 
-          it "redirects to login with the query params in case of session problems" do
-            pending("Difficult to reproduce: sometimes get logged out of OFN during Stripe connect
-            redirect/callback process. After logging in again, it doesn't redirect to the callback URL.")
-            controller.stub spree_current_user: nil
-            params = {this: "that"}
-            spree_get :stripe_connect_callback, params
-            # This is the idea - but even if generated correctly not sure it actually works since the redirect
-            # is ultimately handled in Angular, which presumably doesn't know which controller to
-            # use for the action?
-            response.should redirect_to root_path(anchor: "login?after_login=/?action=stripe_connect&this=that")
+          context "when initializing the connector does not raise an error" do
+            let(:connector) { double(:connector) }
+
+            before do
+              allow(Stripe::AccountConnector).to receive(:new) { connector }
+            end
+
+            context "when the connector succeeds in creating a new stripe account record" do
+              before { allow(connector).to receive(:create_account) { true } }
+
+              it "redirects to the enterprise edit path" do
+                spree_get :stripe_connect_callback, params
+                expect(flash[:success]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_success')
+                expect(response).to redirect_to edit_admin_enterprise_path(distributor)
+              end
+            end
+
+            context "when the connector succeeds in creating a new stripe account record" do
+              before { allow(connector).to receive(:create_account) { false } }
+
+              it "renders a failure message" do
+                spree_get :stripe_connect_callback, params
+                expect(response.body).to eq I18n.t('admin.controllers.enterprises.stripe_connect_fail')
+                expect(response.status).to be 500
+              end
+            end
           end
-
-          it "redirects to unauthorized if the callback state param is invalid" do
-             controller.stub spree_current_user: distributor_manager
-             payload = {junk: "Ssfs"}
-             params = {state: JWT.encode(payload, Openfoodnetwork::Application.config.secret_token),
-                        code: "code"}
-             spree_get :stripe_connect_callback, params
-             response.should redirect_to '/unauthorized'
-          end
-
-          # TODO: This should probably also include managers/coordinators as well as owners?
-          it "makes a request to cancel the Stripe connection if the user does not own the enterprise" do
-            controller.stub spree_current_user: distributor_manager
-            controller.stub(:deauthorize_request_for_stripe_id)
-            controller.stub_chain(:get_stripe_token, :params).and_return({stripe_user_id: "xyz123", stripe_publishable_key: "abc456"}.to_json)
-            payload = {enterprise_id: supplier.permalink} # Request is not for the current user's Enterprise
-            params = {state: JWT.encode(payload, Openfoodnetwork::Application.config.secret_token),
-                        code: "code"}
-            spree_get :stripe_connect_callback, params
-
-            controller.should have_received(:deauthorize_request_for_stripe_id)
-          end
-
-          it "makes a new Stripe Account from the callback params" do
-            controller.stub spree_current_user: distributor_manager
-            controller.stub_chain(:get_stripe_token, :params).and_return({stripe_user_id: "xyz123", stripe_publishable_key: "abc456"}.to_json)
-            payload = {enterprise_id: distributor.permalink}
-            params = {state: JWT.encode(payload, Openfoodnetwork::Application.config.secret_token),
-                        code: "code"}
-            expect{spree_get :stripe_connect_callback, params}.to change{StripeAccount.all.length}.by 1
-            StripeAccount.last.enterprise_id.should eq distributor.id
-          end
-
         end
 
 
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 415baac673..047885041f 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -3,40 +3,103 @@ require 'spec_helper'
 describe Admin::StripeAccountsController, type: :controller do
 
   describe "destroy_from_webhook" do
+    let!(:stripe_account) { create(:stripe_account, stripe_user_id: "webhook_id") }
+    let(:params) do
+      {
+        "format"=> "json",
+        "id" => "evt_123",
+        "object" => "event",
+        "data" => { "object" => { "id" => "ca_9B" } },
+        "type" => "account.application.deauthorized",
+        "user_id" => "webhook_id"
+      }
+    end
+
     it "deletes Stripe accounts in response to a webhook" do
-      # https://stripe.com/docs/api#retrieve_event
-      allow(controller).to receive(:fetch_event_from_stripe)
-        .and_return(Stripe::Event.construct_from({"id"=>"evt_wrfwg4323fw",
-                     "object"=>"event",
-                     "api_version"=>nil,
-                     "created"=>1484870684,
-                     "data"=>
-                      {"object"=>
-                        {"id"=>"application_id",
-                         "object"=>"application",
-                         "name"=>"Open Food Network UK"}},
-                     "livemode"=>false,
-                     "pending_webhooks"=>1,
-                     "request"=>nil,
-                     "type"=>"account.application.deauthorized",
-                     "user_id"=>"webhook_id"}))
-      account = create(:stripe_account, stripe_user_id: "webhook_id")
-      expect(Stripe::Event).not_to receive(:retrieve) # should not retrieve direct for a deauth event
-      post 'destroy_from_webhook', {"id"=>"evt_wrfwg4323fw",
-                                     "object"=>"event",
-                                     "api_version"=>nil,
-                                     "created"=>1484870684,
-                                     "data"=>
-                                      {"object"=>
-                                        {"id"=>"ca_9ByaSyyyXj5O73DWisU0KLluf0870Vro",
-                                         "object"=>"application",
-                                         "name"=>"Open Food Network UK"}},
-                                     "livemode"=>false,
-                                     "pending_webhooks"=>1,
-                                     "request"=>nil,
-                                     "type"=>"account.application.deauthorized",
-                                     "user_id"=>"webhook_id"}
-      expect(StripeAccount.all).not_to include account
+      post 'destroy_from_webhook', params
+      expect(response.status).to eq 200
+      expect(response.body).to eq "Account webhook_id deauthorized"
+      expect(StripeAccount.all).not_to include stripe_account
+    end
+
+    context "when the user_id on the event does not match any known accounts" do
+      before do
+        params["user_id"] = "webhook_id1"
+      end
+
+      it "does nothing" do
+        post 'destroy_from_webhook', params
+        expect(response.status).to eq 400
+        expect(StripeAccount.all).to include stripe_account
+      end
+    end
+
+    context "when the event is not a deauthorize event" do
+      before do
+        params["type"] = "account.application.authorized"
+      end
+
+      it "does nothing" do
+        post 'destroy_from_webhook', params
+        expect(response.status).to eq 400
+        expect(StripeAccount.all).to include stripe_account
+      end
+    end
+  end
+
+  describe "destroy" do
+    let(:enterprise) { create(:distributor_enterprise) }
+    let(:params) { { format: :json, id: "some_id"  } }
+
+    context "when the specified stripe account doesn't exist" do
+      it "raises an error?" do
+        spree_delete :destroy, params
+      end
+    end
+
+    context "when the specified stripe account exists" do
+      let(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
+
+      before do
+        # So that we can stub #deauthorize_and_destroy
+        allow(StripeAccount).to receive(:find) { stripe_account }
+        params[:id] = stripe_account.id
+      end
+
+      context "when I don't manage the enterprise linked to the stripe account" do
+        let(:some_user) { create(:user) }
+
+        before { allow(controller).to receive(:spree_current_user) { some_user } }
+
+        it "redirects to unauthorized" do
+          spree_delete :destroy, params
+          expect(response).to redirect_to spree.unauthorized_path
+        end
+      end
+
+      context "when I manage the enterprise linked to the stripe account" do
+        before { allow(controller).to receive(:spree_current_user) { enterprise.owner } }
+
+        context "and the attempt to deauthorize_and_destroy succeeds" do
+          before { allow(stripe_account).to receive(:deauthorize_and_destroy) { stripe_account } }
+
+          it "redirects to unauthorized" do
+            spree_delete :destroy, params
+            expect(response).to redirect_to edit_admin_enterprise_path(enterprise)
+            expect(flash[:success]).to eq "Stripe account disconnected."
+          end
+        end
+
+        context "and the attempt to deauthorize_and_destroy fails" do
+          before { allow(stripe_account).to receive(:deauthorize_and_destroy) { false } }
+
+          it "redirects to unauthorized" do
+            spree_delete :destroy, params
+            expect(response).to redirect_to edit_admin_enterprise_path(enterprise)
+            expect(flash[:error]).to eq "Failed to disconnect Stripe."
+          end
+        end
+      end
     end
   end
 
diff --git a/spec/helpers/admin/stripe_helper_spec.rb b/spec/helpers/admin/stripe_helper_spec.rb
deleted file mode 100644
index c15ca4a59f..0000000000
--- a/spec/helpers/admin/stripe_helper_spec.rb
+++ /dev/null
@@ -1,52 +0,0 @@
-require 'spec_helper'
-
-describe Admin::StripeHelper do
-  let!(:enterprise) { create(:enterprise) }
-  let!(:enterprise2) { create(:enterprise) }
-  let!(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
-
-  it "calls the Stripe API to get a token" do
-    expect(Admin::StripeHelper.client.auth_code).to receive(:get_token).with("abc", {})
-    helper.get_stripe_token("abc")
-  end
-
-  it "calls the Stripe API for authorization with read_write permission, passing appropriate JWT in the state param" do
-    expect(Admin::StripeHelper.client.auth_code).to receive(:authorize_url).with({
-      state: JWT.encode({enterprise_id: "enterprise-permalink"}, Openfoodnetwork::Application.config.secret_token, 'HS256'),
-      scope: "read_write"
-    })
-    helper.authorize_stripe("enterprise-permalink")
-  end
-
-  context "Disconnecting an account" do
-    it "doesn't destroy the database record if the Stripe API disconnect failed" do
-      Admin::StripeHelper.client
-        .deauthorize(stripe_account.stripe_user_id)
-        .stub(:deauthorize_request)
-        .and_return(nil)
-
-      deauthorize_stripe(stripe_account.id)
-      expect(StripeAccount.all).to include(stripe_account)
-    end
-
-    it "destroys the record if the Stripe API disconnect succeeds" do
-      Admin::StripeHelper.client
-        .deauthorize(stripe_account.stripe_user_id)
-        .stub(:deauthorize_request)
-        .and_return("something truthy")
-
-      deauthorize_stripe(stripe_account.id)
-      expect(StripeAccount.all).not_to include(stripe_account)
-    end
-
-    it "Doesn't make a Stripe API disconnection request if the account is also associated with another Enterprise" do
-      another_stripe_account = create(:stripe_account, enterprise: enterprise2, stripe_user_id: stripe_account.stripe_user_id)
-      expect(Admin::StripeHelper.client.deauthorize(stripe_account.stripe_user_id)).not_to receive(:deauthorize_request)
-      deauthorize_stripe(stripe_account.id)
-    end
-
-    it "encodes and decodes JWT" do
-      jwt_decode(jwt_encode({test: "string"})).should eq({"test" => "string"})
-    end
-  end
-end
diff --git a/spec/lib/stripe/account_connector_spec.rb b/spec/lib/stripe/account_connector_spec.rb
new file mode 100644
index 0000000000..51893bf806
--- /dev/null
+++ b/spec/lib/stripe/account_connector_spec.rb
@@ -0,0 +1,77 @@
+require 'spec_helper'
+require 'stripe/account_connector'
+require 'stripe/oauth'
+
+module Stripe
+  describe AccountConnector do
+    describe "initialization" do
+      let(:user) { create(:user) }
+      let(:enterprise) { create(:enterprise) }
+      let(:payload) { { "junk" => "Ssfs" } }
+      let(:state) { JWT.encode(payload, Openfoodnetwork::Application.config.secret_token) }
+      let(:params) { { "state" => state } }
+
+      context "when params have no 'code' key" do
+        it "raises a StripeError" do
+           expect{ AccountConnector.new(user, params) }.to raise_error StripeError
+        end
+      end
+
+      context "when params have a 'code' key" do
+        before { params["code"] = 'code' }
+
+        context "and the decoded state param doesn't contain an 'enterprise_id' key" do
+          it "raises an AccessDenied error" do
+            expect{ AccountConnector.new(user, params) }.to raise_error CanCan::AccessDenied
+          end
+        end
+
+        context "and the decoded state param contains an 'enterprise_id' key" do
+          let(:payload) { { enterprise_id: enterprise.permalink } }
+          let(:access_token) { { "stripe_user_id" => "some_user_id", "stripe_publishable_key" => "some_key" } }
+
+          before do
+            expect(OAuth).to receive(:request_access_token) { access_token }
+          end
+
+          context "but the user doesn't manage own or manage the corresponding enterprise" do
+            it "makes a request to cancel the Stripe connection and raises an error" do
+              expect(OAuth).to receive(:deauthorize).with("some_user_id")
+              expect{ AccountConnector.new(user, params) }.to raise_error CanCan::AccessDenied
+            end
+          end
+
+          context "and the user manages the corresponding enterprise" do
+            before do
+              user.enterprise_roles.create(enterprise: enterprise)
+            end
+
+            it "raises no errors" do
+              expect(OAuth).to_not receive(:deauthorize)
+              AccountConnector.new(user, params)
+            end
+
+            it "allows creations of a new Stripe Account from the callback params" do
+              connector = AccountConnector.new(user, params)
+              expect{connector.create_account}.to change(StripeAccount, :count).by(1)
+            end
+          end
+
+          context "and the user owns the corresponding enterprise" do
+            let(:user) { enterprise.owner }
+
+            it "raises no errors" do
+              expect(OAuth).to_not receive(:deauthorize)
+              AccountConnector.new(user, params)
+            end
+
+            it "allows creations of a new Stripe Account from the callback params" do
+              connector = AccountConnector.new(user, params)
+              expect{connector.create_account}.to change(StripeAccount, :count).by(1)
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/spec/lib/stripe/oauth_spec.rb b/spec/lib/stripe/oauth_spec.rb
new file mode 100644
index 0000000000..6f46f138cb
--- /dev/null
+++ b/spec/lib/stripe/oauth_spec.rb
@@ -0,0 +1,25 @@
+require 'spec_helper'
+require 'stripe/oauth'
+
+module Stripe
+  describe OAuth do
+    describe "contructing an authorization url" do
+      let(:enterprise_id) { "ent_id" }
+
+      before do
+        allow(OAuth.client).to receive(:id) { 'abc' }
+      end
+
+      it "builds a url with all of the necessary params" do
+        url = OAuth.authorize_url(enterprise_id)
+        uri = URI.parse(url)
+        params = CGI::parse(uri.query)
+        expect(params.keys).to include 'client_id', 'response_type', 'state', 'scope'
+        expect(params["state"]).to eq [OAuth.jwt_encode(enterprise_id: enterprise_id)]
+        expect(uri.scheme).to eq 'https'
+        expect(uri.host).to eq 'connect.stripe.com'
+        expect(uri.path).to eq '/oauth/authorize'
+      end
+    end
+  end
+end
diff --git a/spec/models/spree/gateway/stripe_connect_spec.rb b/spec/models/spree/gateway/stripe_connect_spec.rb
index 56cd7e6e41..d2cc2310ea 100644
--- a/spec/models/spree/gateway/stripe_connect_spec.rb
+++ b/spec/models/spree/gateway/stripe_connect_spec.rb
@@ -43,6 +43,7 @@ describe Spree::Gateway::StripeConnect, type: :model do
 
     context "when the credit card provided does not have a gateway_payment_profile_id" do
       before { allow(creditcard).to receive(:gateway_payment_profile_id) { nil } }
+      before { allow(creditcard).to receive(:gateway_customer_profile_id) { "customer_id123" } }
 
       it "returns nil....?" do
         result = subject.send(:token_from_card_profile_ids, creditcard)
diff --git a/spec/models/stripe_account_spec.rb b/spec/models/stripe_account_spec.rb
new file mode 100644
index 0000000000..dd81c202b1
--- /dev/null
+++ b/spec/models/stripe_account_spec.rb
@@ -0,0 +1,47 @@
+require 'spec_helper'
+require 'stripe/oauth'
+
+describe StripeAccount do
+  describe "deauthorize_and_destroy" do
+    let!(:enterprise) { create(:enterprise) }
+    let!(:enterprise2) { create(:enterprise) }
+    let!(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
+
+    context "when the Stripe API disconnect fails" do
+      before do
+        Stripe::OAuth.client
+          .deauthorize(stripe_account.stripe_user_id)
+          .stub(:deauthorize_request)
+          .and_return(nil)
+      end
+
+      it "doesn't destroy the record" do
+        stripe_account.deauthorize_and_destroy
+        expect(StripeAccount.all).to include(stripe_account)
+      end
+    end
+
+    context "when the Stripe API disconnect succeeds" do
+      before do
+        Stripe::OAuth.client
+          .deauthorize(stripe_account.stripe_user_id)
+          .stub(:deauthorize_request)
+          .and_return("something truthy")
+      end
+
+      it "destroys the record" do
+        stripe_account.deauthorize_and_destroy
+        expect(StripeAccount.all).not_to include(stripe_account)
+      end
+    end
+
+    context "if the account is also associated with another Enterprise" do
+      let!(:another_stripe_account) { create(:stripe_account, enterprise: enterprise2, stripe_user_id: stripe_account.stripe_user_id) }
+
+      it "Doesn't make a Stripe API disconnection request " do
+        expect(Stripe::OAuth.client.deauthorize(stripe_account.stripe_user_id)).not_to receive(:deauthorize_request)
+        stripe_account.deauthorize_and_destroy
+      end
+    end
+  end
+end

From c83755f901c8023e03df2a545f12f4f47b5872c7 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 7 Jul 2017 14:58:18 +1000
Subject: [PATCH 221/353] Clean up StripeConnect gateway

---
 app/models/spree/gateway/stripe_connect.rb | 49 ++++++++++++----------
 1 file changed, 27 insertions(+), 22 deletions(-)

diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index 66e0e88cf5..eec28fddd8 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -30,25 +30,25 @@ module Spree
       provider.purchase(*options_for_purchase_or_auth(money, creditcard, gateway_options))
     end
 
-    def authorize(money, creditcard, gateway_options)
-      provider.authorize(*options_for_purchase_or_auth(money, creditcard, gateway_options))
-    end
+    # def authorize(money, creditcard, gateway_options)
+    #   provider.authorize(*options_for_purchase_or_auth(money, creditcard, gateway_options))
+    # end
 
-    def capture(money, response_code, gateway_options)
-      provider.capture(money, response_code, gateway_options)
-    end
+    # def capture(money, response_code, gateway_options)
+    #   provider.capture(money, response_code, gateway_options)
+    # end
 
-    def credit(money, creditcard, response_code, gateway_options)
-      provider.refund(money, response_code, {})
-    end
+    # def credit(money, creditcard, response_code, gateway_options)
+    #   provider.refund(money, response_code, {})
+    # end
 
-    def void(response_code, creditcard, gateway_options)
-      provider.void(response_code, {})
-    end
+    # def void(response_code, creditcard, gateway_options)
+    #   provider.void(response_code, {})
+    # end
 
-    def cancel(response_code)
-      provider.void(response_code, {})
-    end
+    # def cancel(response_code)
+    #   provider.void(response_code, {})
+    # end
 
     def create_profile(payment)
       return unless payment.source.gateway_customer_profile_id.nil?
@@ -57,12 +57,7 @@ module Spree
         login: Stripe.api_key,
       }.merge! address_for(payment)
 
-      source = update_source!(payment.source)
-      if source.number.blank? && source.gateway_payment_profile_id.present?
-        creditcard = source.gateway_payment_profile_id
-      else
-        creditcard = source
-      end
+      creditcard = card_to_store(payment.source)
 
       response = provider.store(creditcard, options)
       if response.success?
@@ -71,7 +66,6 @@ module Spree
           gateway_customer_profile_id: response.params['id'],
           gateway_payment_profile_id: response.params['default_source'] || response.params['default_card']
         })
-
       else
         payment.send(:gateway_error, response.message)
       end
@@ -122,6 +116,17 @@ module Spree
       source
     end
 
+    def card_to_store(source)
+      source = update_source!(source)
+      if source.number.blank? && source.gateway_payment_profile_id.present?
+        # StripeJS Token
+        source.gateway_payment_profile_id
+      else
+        # Spree::CreditCard object
+        source
+      end
+    end
+
     def token_from_card_profile_ids(creditcard)
       token_or_card_id = creditcard.gateway_payment_profile_id
       customer = creditcard.gateway_customer_profile_id

From 42dd58426e0421d6817be2fe3364911df5fc2c42 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 7 Jul 2017 15:03:22 +1000
Subject: [PATCH 222/353] Auto-correct rubocop offences for stripe-connect

---
 .../admin/stripe_accounts_controller.rb       |  2 +-
 .../stripe_connect_settings_controller.rb     | 14 +++++-----
 .../spree/admin/base_controller_decorator.rb  |  2 +-
 .../spree/credit_cards_controller.rb          | 25 +++++++++--------
 app/models/spree/gateway/stripe_connect.rb    | 20 +++++++-------
 app/models/spree/payment_decorator.rb         |  6 ++---
 app/models/stripe_account.rb                  |  4 +--
 .../api/admin/payment_method_serializer.rb    |  4 +--
 .../admin/stripe_accounts_controller_spec.rb  | 27 ++++++++++---------
 ...stripe_connect_settings_controller_spec.rb |  6 ++---
 .../spree/credit_cards_controller_spec.rb     |  4 +--
 .../spree/users_controller_spec.rb            |  4 +--
 spec/factories.rb                             |  1 -
 spec/features/admin/payment_method_spec.rb    |  2 +-
 spec/features/admin/stripe_connect_spec.rb    |  1 -
 spec/features/consumer/account/cards_spec.rb  |  6 ++---
 .../consumer/shopping/checkout_spec.rb        |  2 +-
 spec/helpers/enterprises_helper_spec.rb       |  4 +--
 spec/lib/stripe/account_connector_spec.rb     |  6 ++---
 spec/lib/stripe/oauth_spec.rb                 |  2 +-
 .../spree/gateway/stripe_connect_spec.rb      |  6 ++---
 spec/models/stripe_account_spec.rb            | 12 ++++-----
 spec/requests/stripe_connect_checkout_spec.rb |  4 +--
 .../credit_card_serializer_spec.rb            |  1 -
 24 files changed, 78 insertions(+), 87 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index e5325e917a..004ad7e664 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -39,7 +39,7 @@ module Admin
 
       begin
         status = Stripe::Account.retrieve(stripe_account.stripe_user_id)
-        attrs = [:id, :business_name, :charges_enabled]
+        attrs = %i[id business_name charges_enabled]
         render json: status.to_hash.slice(*attrs).merge( status: :connected)
       rescue Stripe::APIError => e
         render json: { status: :access_revoked }
diff --git a/app/controllers/admin/stripe_connect_settings_controller.rb b/app/controllers/admin/stripe_connect_settings_controller.rb
index 4e81f89e3c..a121609a1f 100644
--- a/app/controllers/admin/stripe_connect_settings_controller.rb
+++ b/app/controllers/admin/stripe_connect_settings_controller.rb
@@ -3,14 +3,12 @@ module Admin
     before_filter :load_settings, only: [:edit]
 
     def edit
-      begin
-        return @stripe_account = { status: :empty_api_key } if Stripe.api_key.blank?
-        attrs = [:id, :business_name, :charges_enabled]
-        @obfuscated_secret_key = obfuscated_secret_key
-        @stripe_account = Stripe::Account.retrieve.to_hash.slice(*attrs).merge(status: :ok)
-      rescue Stripe::AuthenticationError => e
-        @stripe_account = { status: :auth_fail }
-      end
+      return @stripe_account = { status: :empty_api_key } if Stripe.api_key.blank?
+      attrs = %i[id business_name charges_enabled]
+      @obfuscated_secret_key = obfuscated_secret_key
+      @stripe_account = Stripe::Account.retrieve.to_hash.slice(*attrs).merge(status: :ok)
+    rescue Stripe::AuthenticationError => e
+      @stripe_account = { status: :auth_fail }
     end
 
     def update
diff --git a/app/controllers/spree/admin/base_controller_decorator.rb b/app/controllers/spree/admin/base_controller_decorator.rb
index 58102e20eb..716f4ef50f 100644
--- a/app/controllers/spree/admin/base_controller_decorator.rb
+++ b/app/controllers/spree/admin/base_controller_decorator.rb
@@ -37,7 +37,7 @@ Spree::Admin::BaseController.class_eval do
       redirect_to '/unauthorized'
     else
       store_location
-      redirect_to root_path(anchor: "login?after_login=#{ request.env['PATH_INFO'] }")
+      redirect_to root_path(anchor: "login?after_login=#{request.env['PATH_INFO']}")
     end
   end
 
diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
index 53fb641f5c..90f754a3fe 100644
--- a/app/controllers/spree/credit_cards_controller.rb
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -1,24 +1,22 @@
 module Spree
   class CreditCardsController < BaseController
-
     before_filter :set_credit_card, only: [:destroy]
     before_filter :destroy_at_stripe, only: [:destroy]
 
     def new_from_token
       # A new Customer is created for every credit card (same as via ActiveMerchant)
       # Note that default_source is the card represented by the token
-      begin
-        @customer = create_customer(params[:token])
-        @credit_card = build_card_from(stored_card_attributes)
-        if @credit_card.save
-          render json: @credit_card, serializer: ::Api::CreditCardSerializer, status: :ok
-        else
-          message = t(:card_could_not_be_saved)
-          render json: { flash: { error: I18n.t(:spree_gateway_error_flash_for_checkout, error: message) } }, status: 400
-        end
-      rescue Stripe::CardError => e
-        return render json: { flash: { error: I18n.t(:spree_gateway_error_flash_for_checkout, error: e.message) } }, status: 400
+
+      @customer = create_customer(params[:token])
+      @credit_card = build_card_from(stored_card_attributes)
+      if @credit_card.save
+        render json: @credit_card, serializer: ::Api::CreditCardSerializer, status: :ok
+      else
+        message = t(:card_could_not_be_saved)
+        render json: { flash: { error: I18n.t(:spree_gateway_error_flash_for_checkout, error: message) } }, status: 400
       end
+    rescue Stripe::CardError => e
+      return render json: { flash: { error: I18n.t(:spree_gateway_error_flash_for_checkout, error: e.message) } }, status: 400
     end
 
     def destroy
@@ -35,7 +33,8 @@ module Spree
       end
     end
 
-  private
+    private
+
     def create_customer(token)
       Stripe::Customer.create(email: spree_current_user.email, source: token)
     end
diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index eec28fddd8..0927730e26 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -8,7 +8,7 @@ module Spree
       'American Express' => 'american_express',
       'Diners Club' => 'diners_club',
       'Visa' => 'visa'
-    }
+    }.freeze
 
     def method_type
       'stripe'
@@ -61,11 +61,9 @@ module Spree
 
       response = provider.store(creditcard, options)
       if response.success?
-        payment.source.update_attributes!({
-          cc_type: payment.source.cc_type, # side-effect of update_source!
-          gateway_customer_profile_id: response.params['id'],
-          gateway_payment_profile_id: response.params['default_source'] || response.params['default_card']
-        })
+        payment.source.update_attributes!( cc_type: payment.source.cc_type, # side-effect of update_source!
+                                           gateway_customer_profile_id: response.params['id'],
+                                           gateway_payment_profile_id: response.params['default_source'] || response.params['default_card'])
       else
         payment.send(:gateway_error, response.message)
       end
@@ -87,21 +85,21 @@ module Spree
 
       creditcard = token_from_card_profile_ids(creditcard)
 
-      return money, creditcard, options
+      [money, creditcard, options]
     end
 
     def address_for(payment)
       {}.tap do |options|
         if address = payment.order.bill_address
-          options.merge!(address: {
+          options[:address] = {
             address1: address.address1,
             address2: address.address2,
             city: address.city,
             zip: address.zipcode
-          })
+          }
 
           if country = address.country
-            options[:address].merge!(country: country.name)
+            options[:address][:country] = country.name
           end
 
           if state = address.state
@@ -142,7 +140,7 @@ module Spree
     end
 
     def tokenize_instance_customer_card(customer, card)
-      token = Stripe::Token.create({card: card, customer: customer}, {stripe_account: stripe_account_id})
+      token = Stripe::Token.create({card: card, customer: customer}, stripe_account: stripe_account_id)
       token.id
     rescue Stripe::StripeError => e
       Rails.logger.error("Stripe Error: #{e}")
diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index bede38dbe7..a13f71e041 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -78,10 +78,10 @@ module Spree
     # Import from future Spree
     def build_source
       return if source_attributes.nil?
-      if payment_method and payment_method.payment_source_class
+      if payment_method && payment_method.payment_source_class
         self.source = payment_method.payment_source_class.new(source_attributes)
-        self.source.payment_method_id = payment_method.id
-        self.source.user_id = self.order.user_id if self.order
+        source.payment_method_id = payment_method.id
+        source.user_id = order.user_id if order
       end
     end
 
diff --git a/app/models/stripe_account.rb b/app/models/stripe_account.rb
index 8c727533f0..6aac4b4dfd 100644
--- a/app/models/stripe_account.rb
+++ b/app/models/stripe_account.rb
@@ -1,7 +1,7 @@
 class StripeAccount < ActiveRecord::Base
   belongs_to :enterprise
-  validates_presence_of :stripe_user_id, :stripe_publishable_key
-  validates_uniqueness_of :enterprise_id
+  validates :stripe_user_id, :stripe_publishable_key, presence: true
+  validates :enterprise_id, uniqueness: true
 
   def deauthorize_and_destroy
     accounts = StripeAccount.where(stripe_user_id: stripe_user_id)
diff --git a/app/serializers/api/admin/payment_method_serializer.rb b/app/serializers/api/admin/payment_method_serializer.rb
index edcf482915..8b2c4e1cf0 100644
--- a/app/serializers/api/admin/payment_method_serializer.rb
+++ b/app/serializers/api/admin/payment_method_serializer.rb
@@ -1,7 +1,5 @@
 class Api::Admin::PaymentMethodSerializer < ActiveModel::Serializer
-  def serializable_hash
-    method_serializer.serializable_hash
-  end
+  delegate :serializable_hash, to: :method_serializer
 
   def method_serializer
     if object.type == 'Spree::Gateway::StripeConnect'
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 047885041f..01dff11d31 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -1,12 +1,11 @@
 require 'spec_helper'
 
 describe Admin::StripeAccountsController, type: :controller do
-
   describe "destroy_from_webhook" do
     let!(:stripe_account) { create(:stripe_account, stripe_user_id: "webhook_id") }
     let(:params) do
       {
-        "format"=> "json",
+        "format" => "json",
         "id" => "evt_123",
         "object" => "event",
         "data" => { "object" => { "id" => "ca_9B" } },
@@ -49,7 +48,7 @@ describe Admin::StripeAccountsController, type: :controller do
 
   describe "destroy" do
     let(:enterprise) { create(:distributor_enterprise) }
-    let(:params) { { format: :json, id: "some_id"  } }
+    let(:params) { { format: :json, id: "some_id" } }
 
     context "when the specified stripe account doesn't exist" do
       it "raises an error?" do
@@ -109,7 +108,7 @@ describe Admin::StripeAccountsController, type: :controller do
 
     before do
       Stripe.api_key = "sk_test_12345"
-      Spree::Config.set({stripe_connect_enabled: false})
+      Spree::Config.set(stripe_connect_enabled: false)
     end
 
     context "where I don't manage the specified enterprise" do
@@ -117,7 +116,7 @@ describe Admin::StripeAccountsController, type: :controller do
       let(:enterprise2) { create(:enterprise) }
       before do
         user.owned_enterprises << enterprise2
-        params.merge!({enterprise_id: enterprise.id})
+        params[:enterprise_id] = enterprise.id
         allow(controller).to receive(:spree_current_user) { user }
       end
 
@@ -129,7 +128,7 @@ describe Admin::StripeAccountsController, type: :controller do
 
     context "where I manage the specified enterprise" do
       before do
-        params.merge!({enterprise_id: enterprise.id})
+        params[:enterprise_id] = enterprise.id
         allow(controller).to receive(:spree_current_user) { enterprise.owner }
       end
 
@@ -142,7 +141,7 @@ describe Admin::StripeAccountsController, type: :controller do
       end
 
       context "and Stripe is enabled" do
-        before { Spree::Config.set({stripe_connect_enabled: true}) }
+        before { Spree::Config.set(stripe_connect_enabled: true) }
 
         context "but it has no associated stripe account" do
           it "returns with a status of 'account_missing'" do
@@ -168,12 +167,14 @@ describe Admin::StripeAccountsController, type: :controller do
           end
 
           context "which is connected" do
-            let(:stripe_account_mock) { {
-              id: "acc_123",
-              business_name: "My Org",
-              charges_enabled: true,
-              some_other_attr: "something"
-            } }
+            let(:stripe_account_mock) do
+              {
+                id: "acc_123",
+                business_name: "My Org",
+                charges_enabled: true,
+                some_other_attr: "something"
+              }
+            end
 
             before do
               stub_request(:get, "https://api.stripe.com/v1/accounts/acc_123").to_return(body: JSON.generate(stripe_account_mock))
diff --git a/spec/controllers/admin/stripe_connect_settings_controller_spec.rb b/spec/controllers/admin/stripe_connect_settings_controller_spec.rb
index 6a029d2bf7..2614f2065f 100644
--- a/spec/controllers/admin/stripe_connect_settings_controller_spec.rb
+++ b/spec/controllers/admin/stripe_connect_settings_controller_spec.rb
@@ -37,7 +37,7 @@ describe Admin::StripeConnectSettingsController, type: :controller do
         context "and the request to retrieve Stripe account info fails" do
           before do
             stub_request(:get, "https://api.stripe.com/v1/account").
-            to_return(:status => 401, :body => "{\"error\": {\"message\": \"Invalid API Key provided: sk_test_****xxxx\"}}")
+              to_return(:status => 401, :body => "{\"error\": {\"message\": \"Invalid API Key provided: sk_test_****xxxx\"}}")
           end
 
           it "sets the account status to :auth_fail" do
@@ -50,7 +50,7 @@ describe Admin::StripeConnectSettingsController, type: :controller do
         context "and the request to retrieve Stripe account info succeeds" do
           before do
             stub_request(:get, "https://api.stripe.com/v1/account").
-            to_return(:status => 200, :body => "{ \"id\": \"acct_1234\", \"business_name\": \"OFN\" }")
+              to_return(:status => 200, :body => "{ \"id\": \"acct_1234\", \"business_name\": \"OFN\" }")
           end
 
           it "sets the account status to :ok, loads settings into Struct" do
@@ -77,7 +77,7 @@ describe Admin::StripeConnectSettingsController, type: :controller do
     end
 
     context "as super admin" do
-      before {allow(controller).to receive(:spree_current_user) { admin } }
+      before { allow(controller).to receive(:spree_current_user) { admin } }
 
       it "sets global config to the specified values" do
         expect(Spree::Config.stripe_connect_enabled).to be true
diff --git a/spec/controllers/spree/credit_cards_controller_spec.rb b/spec/controllers/spree/credit_cards_controller_spec.rb
index 4c183cb9d1..e1e5b5fec7 100644
--- a/spec/controllers/spree/credit_cards_controller_spec.rb
+++ b/spec/controllers/spree/credit_cards_controller_spec.rb
@@ -26,7 +26,7 @@ describe Spree::CreditCardsController do
 
   describe "#new_from_token" do
     context "when the request to store the customer/card with Stripe is successful" do
-      let(:response_mock) { { status: 200, body: JSON.generate({ id: "cus_AZNMJ", default_source: "card_1AEEb" }) } }
+      let(:response_mock) { { status: 200, body: JSON.generate(id: "cus_AZNMJ", default_source: "card_1AEEb") } }
 
       it "saves the card locally" do
         expect{ post :new_from_token, params }.to change(Spree::CreditCard, :count).by(1)
@@ -54,7 +54,7 @@ describe Spree::CreditCardsController do
     end
 
     context "when the request to store the customer/card with Stripe fails" do
-      let(:response_mock) { { status: 402, body: JSON.generate({ error: { message: "Bup-bow..." }}) } }
+      let(:response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..." }) } }
       it "doesn't save the card locally, and renders a flash error" do
         expect{ post :new_from_token, params }.to_not change(Spree::CreditCard, :count)
 
diff --git a/spec/controllers/spree/users_controller_spec.rb b/spec/controllers/spree/users_controller_spec.rb
index cbb08ece20..f980e21498 100644
--- a/spec/controllers/spree/users_controller_spec.rb
+++ b/spec/controllers/spree/users_controller_spec.rb
@@ -13,14 +13,14 @@ describe Spree::UsersController do
     let!(:d1_order_for_u2) { create(:completed_order_with_totals, distributor: distributor1, user_id: u2.id) }
     let!(:d1o3) { create(:order, state: 'cart', distributor: distributor1, user_id: u1.id) }
     let!(:d2o1) { create(:completed_order_with_totals, distributor: distributor2, user_id: u2.id) }
-    let!(:accounts_distributor) {create :distributor_enterprise}
+    let!(:accounts_distributor) { create :distributor_enterprise }
     let!(:order_account_invoice) { create(:order, distributor: accounts_distributor, state: 'complete', user: u1) }
 
     let(:orders) { assigns(:orders) }
     let(:shops) { Enterprise.where(id: orders.pluck(:distributor_id)) }
 
     before do
-      Spree::Config.set({ accounts_distributor_id: accounts_distributor.id })
+      Spree::Config.set(accounts_distributor_id: accounts_distributor.id)
       allow(controller).to receive(:spree_current_user) { u1 }
     end
 
diff --git a/spec/factories.rb b/spec/factories.rb
index a574d88edf..6592dc2940 100644
--- a/spec/factories.rb
+++ b/spec/factories.rb
@@ -368,7 +368,6 @@ FactoryGirl.define do
     stripe_user_id "abc123"
     stripe_publishable_key "xyz456"
   end
-
 end
 
 
diff --git a/spec/features/admin/payment_method_spec.rb b/spec/features/admin/payment_method_spec.rb
index 6a82e7951b..ac3b9df118 100644
--- a/spec/features/admin/payment_method_spec.rb
+++ b/spec/features/admin/payment_method_spec.rb
@@ -40,7 +40,7 @@ feature %q{
       let!(:stripe_account_mock) { { id: "acc_connected123", business_name: "My Org", charges_enabled: true } }
 
       before do
-        Spree::Config.set({stripe_connect_enabled: true})
+        Spree::Config.set(stripe_connect_enabled: true)
         Stripe.api_key = "sk_test_12345"
         stub_request(:get, "https://api.stripe.com/v1/accounts/acc_connected123").to_return(body: JSON.generate(stripe_account_mock))
         stub_request(:get, "https://api.stripe.com/v1/accounts/acc_revoked123").to_return(status: 404)
diff --git a/spec/features/admin/stripe_connect_spec.rb b/spec/features/admin/stripe_connect_spec.rb
index f68280c710..1c56f703e9 100644
--- a/spec/features/admin/stripe_connect_spec.rb
+++ b/spec/features/admin/stripe_connect_spec.rb
@@ -8,5 +8,4 @@ feature "Connecting a Stripe Account" do
   before(:each) do
     login_to_admin_as enterprise_user
   end
-
 end
diff --git a/spec/features/consumer/account/cards_spec.rb b/spec/features/consumer/account/cards_spec.rb
index ed12543099..86b1092ccc 100644
--- a/spec/features/consumer/account/cards_spec.rb
+++ b/spec/features/consumer/account/cards_spec.rb
@@ -10,13 +10,13 @@ feature "Credit Cards", js: true do
       quick_login_as user
 
       Stripe.api_key = "sk_test_xxxx"
-      Spree::Config.set({stripe_connect_enabled: true})
+      Spree::Config.set(stripe_connect_enabled: true)
 
       stub_request(:get, "https://api.stripe.com/v1/customers/cus_AZNMJ").
-      to_return(:status => 200, :body => JSON.generate({id: "cus_AZNMJ"}))
+        to_return(:status => 200, :body => JSON.generate(id: "cus_AZNMJ"))
 
       stub_request(:delete, "https://api.stripe.com/v1/customers/cus_AZNMJ").
-      to_return(:status => 200, :body => JSON.generate({deleted: true, id: "cus_AZNMJ"}))
+        to_return(:status => 200, :body => JSON.generate(deleted: true, id: "cus_AZNMJ"))
     end
 
     it "lists saved cards, shows interface for adding new cards" do
diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index 6dbe5dc445..508a9ba9d7 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -157,7 +157,7 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
 
         before do
           Stripe.api_key = "sk_test_123456"
-          Spree::Config.set({stripe_connect_enabled: true})
+          Spree::Config.set(stripe_connect_enabled: true)
           stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
             .to_return(body: JSON.generate(response_mock))
 
diff --git a/spec/helpers/enterprises_helper_spec.rb b/spec/helpers/enterprises_helper_spec.rb
index ebfaa8d890..2aa9131942 100644
--- a/spec/helpers/enterprises_helper_spec.rb
+++ b/spec/helpers/enterprises_helper_spec.rb
@@ -225,7 +225,7 @@ describe EnterprisesHelper do
       before { allow(helper).to receive(:current_distributor) { distributor } }
 
       context "and Stripe Connect is disabled" do
-        before { Spree::Config.set({stripe_connect_enabled: false}) }
+        before { Spree::Config.set(stripe_connect_enabled: false) }
 
         it "ignores the Stripe payment method" do
           expect(helper.available_payment_methods.map(&:id)).to_not include pm3.id
@@ -233,7 +233,7 @@ describe EnterprisesHelper do
       end
 
       context "and Stripe Connect is enabled" do
-        before { Spree::Config.set({stripe_connect_enabled: true}) }
+        before { Spree::Config.set(stripe_connect_enabled: true) }
 
         it "includes the Stripe payment method" do
           expect(helper.available_payment_methods.map(&:id)).to include pm3.id
diff --git a/spec/lib/stripe/account_connector_spec.rb b/spec/lib/stripe/account_connector_spec.rb
index 51893bf806..119d6c7e38 100644
--- a/spec/lib/stripe/account_connector_spec.rb
+++ b/spec/lib/stripe/account_connector_spec.rb
@@ -13,7 +13,7 @@ module Stripe
 
       context "when params have no 'code' key" do
         it "raises a StripeError" do
-           expect{ AccountConnector.new(user, params) }.to raise_error StripeError
+          expect{ AccountConnector.new(user, params) }.to raise_error StripeError
         end
       end
 
@@ -53,7 +53,7 @@ module Stripe
 
             it "allows creations of a new Stripe Account from the callback params" do
               connector = AccountConnector.new(user, params)
-              expect{connector.create_account}.to change(StripeAccount, :count).by(1)
+              expect{ connector.create_account }.to change(StripeAccount, :count).by(1)
             end
           end
 
@@ -67,7 +67,7 @@ module Stripe
 
             it "allows creations of a new Stripe Account from the callback params" do
               connector = AccountConnector.new(user, params)
-              expect{connector.create_account}.to change(StripeAccount, :count).by(1)
+              expect{ connector.create_account }.to change(StripeAccount, :count).by(1)
             end
           end
         end
diff --git a/spec/lib/stripe/oauth_spec.rb b/spec/lib/stripe/oauth_spec.rb
index 6f46f138cb..c7b16ca257 100644
--- a/spec/lib/stripe/oauth_spec.rb
+++ b/spec/lib/stripe/oauth_spec.rb
@@ -13,7 +13,7 @@ module Stripe
       it "builds a url with all of the necessary params" do
         url = OAuth.authorize_url(enterprise_id)
         uri = URI.parse(url)
-        params = CGI::parse(uri.query)
+        params = CGI.parse(uri.query)
         expect(params.keys).to include 'client_id', 'response_type', 'state', 'scope'
         expect(params["state"]).to eq [OAuth.jwt_encode(enterprise_id: enterprise_id)]
         expect(uri.scheme).to eq 'https'
diff --git a/spec/models/spree/gateway/stripe_connect_spec.rb b/spec/models/spree/gateway/stripe_connect_spec.rb
index d2cc2310ea..377cb0c968 100644
--- a/spec/models/spree/gateway/stripe_connect_spec.rb
+++ b/spec/models/spree/gateway/stripe_connect_spec.rb
@@ -11,7 +11,7 @@ describe Spree::Gateway::StripeConnect, type: :model do
 
   before do
     Stripe.api_key = "sk_test_123456"
-    subject.stub(:options_for_purchase_or_auth).and_return(['money','cc','opts'])
+    subject.stub(:options_for_purchase_or_auth).and_return(['money', 'cc', 'opts'])
     subject.stub(:provider).and_return provider
   end
 
@@ -59,8 +59,8 @@ describe Spree::Gateway::StripeConnect, type: :model do
 
     before do
       stub_request(:post, "https://api.stripe.com/v1/tokens")
-      .with(body: { "card"=>"card123", "customer"=>"customer123"})
-      .to_return(body: JSON.generate(token_mock))
+        .with(body: { "card" => "card123", "customer" => "customer123"})
+        .to_return(body: JSON.generate(token_mock))
     end
 
     it "requests a new token for the customer and card from Stripe, and returns the id of the response" do
diff --git a/spec/models/stripe_account_spec.rb b/spec/models/stripe_account_spec.rb
index dd81c202b1..7244e44979 100644
--- a/spec/models/stripe_account_spec.rb
+++ b/spec/models/stripe_account_spec.rb
@@ -10,9 +10,9 @@ describe StripeAccount do
     context "when the Stripe API disconnect fails" do
       before do
         Stripe::OAuth.client
-          .deauthorize(stripe_account.stripe_user_id)
-          .stub(:deauthorize_request)
-          .and_return(nil)
+                     .deauthorize(stripe_account.stripe_user_id)
+                     .stub(:deauthorize_request)
+                     .and_return(nil)
       end
 
       it "doesn't destroy the record" do
@@ -24,9 +24,9 @@ describe StripeAccount do
     context "when the Stripe API disconnect succeeds" do
       before do
         Stripe::OAuth.client
-          .deauthorize(stripe_account.stripe_user_id)
-          .stub(:deauthorize_request)
-          .and_return("something truthy")
+                     .deauthorize(stripe_account.stripe_user_id)
+                     .stub(:deauthorize_request)
+                     .and_return("something truthy")
       end
 
       it "destroys the record" do
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index 7cd63fb0b5..6e5d10517f 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -21,8 +21,8 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     { format: :json, order: {
       shipping_method_id: shipping_method.id,
       payments_attributes: [{payment_method_id: payment_method.id, source_attributes: { gateway_payment_profile_id: token, cc_type: "visa", last_digits: "4242", month: 10, year: 2025 }}],
-      bill_address_attributes: address.attributes.slice("firstname","lastname","address1","address2","phone","city","zipcode","state_id","country_id"),
-      ship_address_attributes: address.attributes.slice("firstname","lastname","address1","address2","phone","city","zipcode","state_id","country_id")
+      bill_address_attributes: address.attributes.slice("firstname", "lastname", "address1", "address2", "phone", "city", "zipcode", "state_id", "country_id"),
+      ship_address_attributes: address.attributes.slice("firstname", "lastname", "address1", "address2", "phone", "city", "zipcode", "state_id", "country_id")
     } }
   end
 
diff --git a/spec/serializers/credit_card_serializer_spec.rb b/spec/serializers/credit_card_serializer_spec.rb
index 100067b2e5..baa9c2a3e9 100644
--- a/spec/serializers/credit_card_serializer_spec.rb
+++ b/spec/serializers/credit_card_serializer_spec.rb
@@ -12,5 +12,4 @@ describe Api::CreditCardSerializer do
   it "formats an identifying string with the card number masked" do
     expect(serializer.formatted).to eq "Visa x-1111 Exp:12/2013"
   end
-
 end

From 5b675cbaba4e06d156199aaf581674a828a563dd Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 7 Jul 2017 15:21:30 +1000
Subject: [PATCH 223/353] Make OAuth private methods actually private

---
 lib/stripe/oauth.rb           | 56 +++++++++++++++++------------------
 spec/lib/stripe/oauth_spec.rb |  2 +-
 2 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/lib/stripe/oauth.rb b/lib/stripe/oauth.rb
index 105e8cdd3d..37ca203cdc 100644
--- a/lib/stripe/oauth.rb
+++ b/lib/stripe/oauth.rb
@@ -1,9 +1,5 @@
 module Stripe
   class OAuth
-    class << self
-      attr_accessor :client, :options
-    end
-
     @options = {
       :site => 'https://connect.stripe.com',
       :authorize_url => '/oauth/authorize',
@@ -14,38 +10,42 @@ module Stripe
     @client = OAuth2::Client.new(
       ENV['STRIPE_CLIENT_ID'],
       ENV['STRIPE_INSTANCE_SECRET_KEY'],
-      options
+      @options
     )
 
-    def self.authorize_url(enterprise_id, options = {})
-      options[:enterprise_id] = enterprise_id
-      jwt = jwt_encode(options)
-      # State param will be passed back after auth
-      client.auth_code.authorize_url(state: jwt, scope: 'read_write')
-    end
+    class << self
+      attr_accessor :client
 
-    def self.request_access_token(auth_code)
-      # Fetch and return the account details from Stripe
-      client.auth_code.get_token(auth_code).params
-    end
+      def authorize_url(enterprise_id, options = {})
+        options[:enterprise_id] = enterprise_id
+        jwt = jwt_encode(options)
+        # State param will be passed back after auth
+        client.auth_code.authorize_url(state: jwt, scope: 'read_write')
+      end
 
-    def self.deauthorize(stripe_user_id)
-      client.deauthorize(stripe_user_id).deauthorize_request
-    end
+      def request_access_token(auth_code)
+        # Fetch and return the account details from Stripe
+        client.auth_code.get_token(auth_code).params
+      end
 
-    private
+      def deauthorize(stripe_user_id)
+        client.deauthorize(stripe_user_id).deauthorize_request
+      end
 
-    def self.secret_token
-      Openfoodnetwork::Application.config.secret_token
-    end
+      private
 
-    def self.jwt_encode(payload)
-      JWT.encode(payload, secret_token, 'HS256')
-    end
+      def secret_token
+        Openfoodnetwork::Application.config.secret_token
+      end
 
-    def self.jwt_decode(token)
-      # Returns the original payload
-      JWT.decode(token, secret_token, true, algorithm: 'HS256')[0]
+      def jwt_encode(payload)
+        JWT.encode(payload, secret_token, 'HS256')
+      end
+
+      def jwt_decode(token)
+        # Returns the original payload
+        JWT.decode(token, secret_token, true, algorithm: 'HS256')[0]
+      end
     end
   end
 end
diff --git a/spec/lib/stripe/oauth_spec.rb b/spec/lib/stripe/oauth_spec.rb
index c7b16ca257..526c1d1167 100644
--- a/spec/lib/stripe/oauth_spec.rb
+++ b/spec/lib/stripe/oauth_spec.rb
@@ -15,7 +15,7 @@ module Stripe
         uri = URI.parse(url)
         params = CGI.parse(uri.query)
         expect(params.keys).to include 'client_id', 'response_type', 'state', 'scope'
-        expect(params["state"]).to eq [OAuth.jwt_encode(enterprise_id: enterprise_id)]
+        expect(params["state"]).to eq [OAuth.send(:jwt_encode, enterprise_id: enterprise_id)]
         expect(uri.scheme).to eq 'https'
         expect(uri.host).to eq 'connect.stripe.com'
         expect(uri.path).to eq '/oauth/authorize'

From 28ba05ec6b62c956db725ee7908162238852ab07 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 7 Jul 2017 15:23:31 +1000
Subject: [PATCH 224/353] Fix Lint/UselessAssignment offences for
 stripe-connect

---
 app/controllers/admin/stripe_accounts_controller.rb         | 2 +-
 app/controllers/admin/stripe_connect_settings_controller.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index 004ad7e664..695f415eb9 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -41,7 +41,7 @@ module Admin
         status = Stripe::Account.retrieve(stripe_account.stripe_user_id)
         attrs = %i[id business_name charges_enabled]
         render json: status.to_hash.slice(*attrs).merge( status: :connected)
-      rescue Stripe::APIError => e
+      rescue Stripe::APIError
         render json: { status: :access_revoked }
       end
     end
diff --git a/app/controllers/admin/stripe_connect_settings_controller.rb b/app/controllers/admin/stripe_connect_settings_controller.rb
index a121609a1f..cadcdbaf4a 100644
--- a/app/controllers/admin/stripe_connect_settings_controller.rb
+++ b/app/controllers/admin/stripe_connect_settings_controller.rb
@@ -7,7 +7,7 @@ module Admin
       attrs = %i[id business_name charges_enabled]
       @obfuscated_secret_key = obfuscated_secret_key
       @stripe_account = Stripe::Account.retrieve.to_hash.slice(*attrs).merge(status: :ok)
-    rescue Stripe::AuthenticationError => e
+    rescue Stripe::AuthenticationError
       @stripe_account = { status: :auth_fail }
     end
 

From a68ae1fe2dd1769c7830357c8a696a523ddafd7a Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 7 Jul 2017 15:27:01 +1000
Subject: [PATCH 225/353] Provide a sensible flash message when
 CreditCard#destroy action fails

---
 app/controllers/spree/credit_cards_controller.rb | 4 +++-
 config/locales/en.yml                            | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
index 90f754a3fe..2fb4d51a05 100644
--- a/app/controllers/spree/credit_cards_controller.rb
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -22,8 +22,10 @@ module Spree
     def destroy
       if @credit_card.destroy
         flash[:success] = I18n.t(:card_has_been_removed, number: "x-#{@credit_card.last_digits}")
-        redirect_to "/account#/cards"
+      else
+        flash[:error] = I18n.t(:card_could_not_be_removed)
       end
+      redirect_to "/account#/cards"
     end
 
     # Currently can only destroy the whole customer object
diff --git a/config/locales/en.yml b/config/locales/en.yml
index bb1d1bbd80..31b75dac6b 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -903,6 +903,7 @@ en:
   you_have_no_saved_cards: You haven't saved any cards yet
   saving_credit_card: Saving credit card...
   card_has_been_removed: "Your card has been removed (number: %{number})"
+  card_could_not_be_removed: Sorry, the card could not be removed
 
   ie_warning_headline: "Your browser is out of date :-("
   ie_warning_text: "For the best Open Food Network experience, we strongly recommend upgrading your browser:"

From ecb78233d933de5ede3d124382debd85b9908dca Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 7 Jul 2017 15:31:18 +1000
Subject: [PATCH 226/353] Use guard clauses where possible

---
 app/controllers/spree/credit_cards_controller.rb    |  5 ++---
 app/controllers/spree/users_controller_decorator.rb |  6 +++---
 app/models/spree/payment_decorator.rb               | 10 +++++-----
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
index 2fb4d51a05..ee9373e1ce 100644
--- a/app/controllers/spree/credit_cards_controller.rb
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -30,9 +30,8 @@ module Spree
 
     # Currently can only destroy the whole customer object
     def destroy_at_stripe
-      if stripe_customer = Stripe::Customer.retrieve( @credit_card.gateway_customer_profile_id )
-        stripe_customer.delete
-      end
+      stripe_customer = Stripe::Customer.retrieve(@credit_card.gateway_customer_profile_id)
+      stripe_customer.delete if stripe_customer
     end
 
     private
diff --git a/app/controllers/spree/users_controller_decorator.rb b/app/controllers/spree/users_controller_decorator.rb
index 1657f17727..bfdd83f839 100644
--- a/app/controllers/spree/users_controller_decorator.rb
+++ b/app/controllers/spree/users_controller_decorator.rb
@@ -9,9 +9,9 @@ Spree::UsersController.class_eval do
   def show
     @orders = @user.orders.where(state: 'complete').order('completed_at desc')
 
-    if Spree::Config.accounts_distributor_id
-      @orders = @orders.where('distributor_id != ?', Spree::Config.accounts_distributor_id)
-    end
+    return unless Spree::Config.accounts_distributor_id
+
+    @orders = @orders.where('distributor_id != ?', Spree::Config.accounts_distributor_id)
   end
 
   private
diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index a13f71e041..568d82371a 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -78,11 +78,11 @@ module Spree
     # Import from future Spree
     def build_source
       return if source_attributes.nil?
-      if payment_method && payment_method.payment_source_class
-        self.source = payment_method.payment_source_class.new(source_attributes)
-        source.payment_method_id = payment_method.id
-        source.user_id = order.user_id if order
-      end
+      return unless payment_method.andand.payment_source_class
+
+      self.source = payment_method.payment_source_class.new(source_attributes)
+      source.payment_method_id = payment_method.id
+      source.user_id = order.user_id if order
     end
 
     private

From f3af36deca56703e48cc9fa178c5c21adcddf58e Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 7 Jul 2017 15:33:40 +1000
Subject: [PATCH 227/353] Disable rubocop Style/PredicateName check against
 override of Spree method

---
 app/models/spree/credit_card_decorator.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/models/spree/credit_card_decorator.rb b/app/models/spree/credit_card_decorator.rb
index 0744bf5da5..8bcc43ff78 100644
--- a/app/models/spree/credit_card_decorator.rb
+++ b/app/models/spree/credit_card_decorator.rb
@@ -7,7 +7,7 @@ Spree::CreditCard.class_eval do
   # Should be able to remove once we reach Spree v2.2.0
   # Commit: https://github.com/spree/spree/commit/5a4d690ebc64b264bf12904a70187e7a8735ef3f
   # See also: https://github.com/spree/spree_gateway/issues/111
-  def has_payment_profile?
+  def has_payment_profile? # rubocop:disable Style/PredicateName
     gateway_customer_profile_id.present? || gateway_payment_profile_id.present?
   end
 end

From e9d062a8c2393eec6888a549f9882f30fada5bac Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 7 Jul 2017 15:38:40 +1000
Subject: [PATCH 228/353] Use nested module/class definitions instead of
 compact style

---
 app/models/spree/gateway/stripe_connect.rb    | 248 +++++++++---------
 app/serializers/api/credit_card_serializer.rb |  38 +--
 2 files changed, 145 insertions(+), 141 deletions(-)

diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index 0927730e26..2cc7a139d7 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -1,150 +1,152 @@
 module Spree
-  class Gateway::StripeConnect < Gateway
-    preference :enterprise_id, :integer
+  class Gateway
+    class StripeConnect < Gateway
+      preference :enterprise_id, :integer
 
-    attr_accessible :preferred_enterprise_id
+      attr_accessible :preferred_enterprise_id
 
-    CARD_TYPE_MAPPING = {
-      'American Express' => 'american_express',
-      'Diners Club' => 'diners_club',
-      'Visa' => 'visa'
-    }.freeze
+      CARD_TYPE_MAPPING = {
+        'American Express' => 'american_express',
+        'Diners Club' => 'diners_club',
+        'Visa' => 'visa'
+      }.freeze
 
-    def method_type
-      'stripe'
-    end
-
-    def provider_class
-      ActiveMerchant::Billing::StripeGateway
-    end
-
-    def payment_profiles_supported?
-      true
-    end
-
-    def stripe_account_id
-      StripeAccount.find_by_enterprise_id(preferred_enterprise_id).andand.stripe_user_id
-    end
-
-    def purchase(money, creditcard, gateway_options)
-      provider.purchase(*options_for_purchase_or_auth(money, creditcard, gateway_options))
-    end
-
-    # def authorize(money, creditcard, gateway_options)
-    #   provider.authorize(*options_for_purchase_or_auth(money, creditcard, gateway_options))
-    # end
-
-    # def capture(money, response_code, gateway_options)
-    #   provider.capture(money, response_code, gateway_options)
-    # end
-
-    # def credit(money, creditcard, response_code, gateway_options)
-    #   provider.refund(money, response_code, {})
-    # end
-
-    # def void(response_code, creditcard, gateway_options)
-    #   provider.void(response_code, {})
-    # end
-
-    # def cancel(response_code)
-    #   provider.void(response_code, {})
-    # end
-
-    def create_profile(payment)
-      return unless payment.source.gateway_customer_profile_id.nil?
-      options = {
-        email: payment.order.email,
-        login: Stripe.api_key,
-      }.merge! address_for(payment)
-
-      creditcard = card_to_store(payment.source)
-
-      response = provider.store(creditcard, options)
-      if response.success?
-        payment.source.update_attributes!( cc_type: payment.source.cc_type, # side-effect of update_source!
-                                           gateway_customer_profile_id: response.params['id'],
-                                           gateway_payment_profile_id: response.params['default_source'] || response.params['default_card'])
-      else
-        payment.send(:gateway_error, response.message)
+      def method_type
+        'stripe'
       end
-    end
 
-    private
+      def provider_class
+        ActiveMerchant::Billing::StripeGateway
+      end
 
-    # In this gateway, what we call 'secret_key' is the 'login'
-    def options
-      options = super
-      options.merge(:login => Stripe.api_key)
-    end
+      def payment_profiles_supported?
+        true
+      end
 
-    def options_for_purchase_or_auth(money, creditcard, gateway_options)
-      options = {}
-      options[:description] = "Spree Order ID: #{gateway_options[:order_id]}"
-      options[:currency] = gateway_options[:currency]
-      options[:stripe_account] = stripe_account_id
+      def stripe_account_id
+        StripeAccount.find_by_enterprise_id(preferred_enterprise_id).andand.stripe_user_id
+      end
 
-      creditcard = token_from_card_profile_ids(creditcard)
+      def purchase(money, creditcard, gateway_options)
+        provider.purchase(*options_for_purchase_or_auth(money, creditcard, gateway_options))
+      end
 
-      [money, creditcard, options]
-    end
+      # def authorize(money, creditcard, gateway_options)
+      #   provider.authorize(*options_for_purchase_or_auth(money, creditcard, gateway_options))
+      # end
 
-    def address_for(payment)
-      {}.tap do |options|
-        if address = payment.order.bill_address
-          options[:address] = {
-            address1: address.address1,
-            address2: address.address2,
-            city: address.city,
-            zip: address.zipcode
-          }
+      # def capture(money, response_code, gateway_options)
+      #   provider.capture(money, response_code, gateway_options)
+      # end
 
-          if country = address.country
-            options[:address][:country] = country.name
-          end
+      # def credit(money, creditcard, response_code, gateway_options)
+      #   provider.refund(money, response_code, {})
+      # end
 
-          if state = address.state
-            options[:address].merge!(state: state.name)
+      # def void(response_code, creditcard, gateway_options)
+      #   provider.void(response_code, {})
+      # end
+
+      # def cancel(response_code)
+      #   provider.void(response_code, {})
+      # end
+
+      def create_profile(payment)
+        return unless payment.source.gateway_customer_profile_id.nil?
+        options = {
+          email: payment.order.email,
+          login: Stripe.api_key,
+        }.merge! address_for(payment)
+
+        creditcard = card_to_store(payment.source)
+
+        response = provider.store(creditcard, options)
+        if response.success?
+          payment.source.update_attributes!( cc_type: payment.source.cc_type, # side-effect of update_source!
+                                             gateway_customer_profile_id: response.params['id'],
+                                             gateway_payment_profile_id: response.params['default_source'] || response.params['default_card'])
+        else
+          payment.send(:gateway_error, response.message)
+        end
+      end
+
+      private
+
+      # In this gateway, what we call 'secret_key' is the 'login'
+      def options
+        options = super
+        options.merge(:login => Stripe.api_key)
+      end
+
+      def options_for_purchase_or_auth(money, creditcard, gateway_options)
+        options = {}
+        options[:description] = "Spree Order ID: #{gateway_options[:order_id]}"
+        options[:currency] = gateway_options[:currency]
+        options[:stripe_account] = stripe_account_id
+
+        creditcard = token_from_card_profile_ids(creditcard)
+
+        [money, creditcard, options]
+      end
+
+      def address_for(payment)
+        {}.tap do |options|
+          if address = payment.order.bill_address
+            options[:address] = {
+              address1: address.address1,
+              address2: address.address2,
+              city: address.city,
+              zip: address.zipcode
+            }
+
+            if country = address.country
+              options[:address][:country] = country.name
+            end
+
+            if state = address.state
+              options[:address].merge!(state: state.name)
+            end
           end
         end
       end
-    end
 
-    def update_source!(source)
-      source.cc_type = CARD_TYPE_MAPPING[source.cc_type] if CARD_TYPE_MAPPING.include?(source.cc_type)
-      source
-    end
-
-    def card_to_store(source)
-      source = update_source!(source)
-      if source.number.blank? && source.gateway_payment_profile_id.present?
-        # StripeJS Token
-        source.gateway_payment_profile_id
-      else
-        # Spree::CreditCard object
+      def update_source!(source)
+        source.cc_type = CARD_TYPE_MAPPING[source.cc_type] if CARD_TYPE_MAPPING.include?(source.cc_type)
         source
       end
-    end
 
-    def token_from_card_profile_ids(creditcard)
-      token_or_card_id = creditcard.gateway_payment_profile_id
-      customer = creditcard.gateway_customer_profile_id
+      def card_to_store(source)
+        source = update_source!(source)
+        if source.number.blank? && source.gateway_payment_profile_id.present?
+          # StripeJS Token
+          source.gateway_payment_profile_id
+        else
+          # Spree::CreditCard object
+          source
+        end
+      end
 
-      return nil if token_or_card_id.blank?
+      def token_from_card_profile_ids(creditcard)
+        token_or_card_id = creditcard.gateway_payment_profile_id
+        customer = creditcard.gateway_customer_profile_id
 
-      # Assume the gateway_payment_profile_id is a token generated by StripeJS
-      return token_or_card_id if customer.blank?
+        return nil if token_or_card_id.blank?
 
-      # Assume the gateway_payment_profile_id is a Stripe card_id
-      # So generate a new token, using the customer_id and card_id
-      tokenize_instance_customer_card(customer, token_or_card_id)
-    end
+        # Assume the gateway_payment_profile_id is a token generated by StripeJS
+        return token_or_card_id if customer.blank?
 
-    def tokenize_instance_customer_card(customer, card)
-      token = Stripe::Token.create({card: card, customer: customer}, stripe_account: stripe_account_id)
-      token.id
-    rescue Stripe::StripeError => e
-      Rails.logger.error("Stripe Error: #{e}")
-      nil
+        # Assume the gateway_payment_profile_id is a Stripe card_id
+        # So generate a new token, using the customer_id and card_id
+        tokenize_instance_customer_card(customer, token_or_card_id)
+      end
+
+      def tokenize_instance_customer_card(customer, card)
+        token = Stripe::Token.create({card: card, customer: customer}, stripe_account: stripe_account_id)
+        token.id
+      rescue Stripe::StripeError => e
+        Rails.logger.error("Stripe Error: #{e}")
+        nil
+      end
     end
   end
 end
diff --git a/app/serializers/api/credit_card_serializer.rb b/app/serializers/api/credit_card_serializer.rb
index f53e9f4e23..1ea2da07d5 100644
--- a/app/serializers/api/credit_card_serializer.rb
+++ b/app/serializers/api/credit_card_serializer.rb
@@ -1,25 +1,27 @@
-class Api::CreditCardSerializer < ActiveModel::Serializer
-  attributes :id, :brand, :number, :expiry, :formatted, :delete_link
+module Api
+  class CreditCardSerializer < ActiveModel::Serializer
+    attributes :id, :brand, :number, :expiry, :formatted, :delete_link
 
-  def brand
-    object.cc_type.capitalize
-  end
+    def brand
+      object.cc_type.capitalize
+    end
 
-  def number
-    "x-#{object.last_digits}"
-  end
+    def number
+      "x-#{object.last_digits}"
+    end
 
-  def expiry
-    m = object.month.to_i
-    m = m < 10 ? "0#{m}" : m.to_s
-    "#{m}/#{object.year}"
-  end
+    def expiry
+      m = object.month.to_i
+      m = m < 10 ? "0#{m}" : m.to_s
+      "#{m}/#{object.year}"
+    end
 
-  def formatted
-    "#{brand} #{number} #{I18n.t(:card_expiry_abbreviation)}:#{expiry}"
-  end
+    def formatted
+      "#{brand} #{number} #{I18n.t(:card_expiry_abbreviation)}:#{expiry}"
+    end
 
-  def delete_link
-    Spree::Core::Engine.routes.url_helpers.credit_card_path(object.id)
+    def delete_link
+      Spree::Core::Engine.routes.url_helpers.credit_card_path(object.id)
+    end
   end
 end

From 0e14704572b8bde1a9b91cf7739e98affc0b21cd Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 7 Jul 2017 16:54:01 +1000
Subject: [PATCH 229/353] Kill empty space

---
 app/controllers/enterprises_controller.rb | 2 --
 app/models/enterprise.rb                  | 4 ----
 2 files changed, 6 deletions(-)

diff --git a/app/controllers/enterprises_controller.rb b/app/controllers/enterprises_controller.rb
index 53e52415e5..8f38f4e095 100644
--- a/app/controllers/enterprises_controller.rb
+++ b/app/controllers/enterprises_controller.rb
@@ -38,8 +38,6 @@ class EnterprisesController < BaseController
     end
   end
 
-
-
   private
 
   def set_enterprise
diff --git a/app/models/enterprise.rb b/app/models/enterprise.rb
index edf1fe9a7d..95fb6461cc 100644
--- a/app/models/enterprise.rb
+++ b/app/models/enterprise.rb
@@ -67,7 +67,6 @@ class Enterprise < ActiveRecord::Base
   supports_s3 :logo
   supports_s3 :promo_image
 
-
   validates :name, presence: true
   validate :name_is_unique
   validates :sells, presence: true, inclusion: {in: SELLS}
@@ -79,7 +78,6 @@ class Enterprise < ActiveRecord::Base
   validate :enforce_ownership_limit, if: lambda { owner_id_changed? && !owner_id.nil? }
   validates_length_of :description, :maximum => 255
 
-
   before_save :confirmation_check, if: lambda { email_changed? }
 
   before_validation :initialize_permalink, if: lambda { permalink.nil? }
@@ -96,7 +94,6 @@ class Enterprise < ActiveRecord::Base
 
   after_rollback :restore_permalink
 
-
   scope :by_name, order('name')
   scope :visible, where(visible: true)
   scope :confirmed, where('confirmed_at IS NOT NULL')
@@ -366,7 +363,6 @@ class Enterprise < ActiveRecord::Base
     abn.present?
   end
 
-
   protected
 
   def devise_mailer

From 919e39f95075ed2cf8f9967fee6121c9bcd1e912 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 13 Jul 2017 14:12:06 +1000
Subject: [PATCH 230/353] Provide a valid enterprise for building redirect path
 for Stripe Connect callback

---
 app/controllers/admin/enterprises_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index 6d548cc602..0ccb65095b 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -123,7 +123,7 @@ module Admin
       connector = Stripe::AccountConnector.new(spree_current_user, params)
       if connector.create_account
         flash[:success] = t('admin.controllers.enterprises.stripe_connect_success')
-        redirect_to main_app.edit_admin_enterprise_path(@enterprise)
+        redirect_to main_app.edit_admin_enterprise_path(connector.enterprise)
       else
         render text: t('admin.controllers.enterprises.stripe_connect_fail'), status: 500
       end

From 3efabf5c501c0c95ef05123d89c1494bf76b5c2b Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 13 Jul 2017 14:15:10 +1000
Subject: [PATCH 231/353] Add translations for Stripe connection flashes

---
 config/locales/en.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/config/locales/en.yml b/config/locales/en.yml
index 31b75dac6b..0043447e90 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -755,6 +755,9 @@ en:
 
     # Admin controllers
     controllers:
+      enterprises:
+        stripe_connect_success: "Stripe account connected successfully"
+        stripe_connect_fail: Sorry, the connection of your Stripe account failed
       stripe_connect_settings:
         resource: Stripe Connect configuration
 

From 5c58d30ca7c2e24cb9aad733e61aa51270c5805e Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 14 Jul 2017 10:48:27 +1000
Subject: [PATCH 232/353] Create payment from user-specified payment method
 when using existing card

---
 app/controllers/checkout_controller.rb        | 1 -
 spec/requests/stripe_connect_checkout_spec.rb | 1 -
 2 files changed, 2 deletions(-)

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 2f2d5a64ee..5d3c884400 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -219,7 +219,6 @@ class CheckoutController < Spree::CheckoutController
     credit_card.verification_value = params[:cvc_confirm] if params[:cvc_confirm].present?
 
     params[:order][:payments_attributes].first[:source] = credit_card
-    params[:order][:payments_attributes].first[:payment_method_id] = credit_card.payment_method_id
     params[:order][:payments_attributes].first.delete :source_attributes
   end
 
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index 6e5d10517f..fcc3d6f26d 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -116,7 +116,6 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     let(:credit_card) do
       create(
         :credit_card,
-        payment_method_id: payment_method.id,
         user_id: order.user_id,
         gateway_payment_profile_id: card_id,
         gateway_customer_profile_id: customer_id,

From ffc99df3731e823ee9166f2f279c41a00f603228 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 14 Jul 2017 11:40:08 +1000
Subject: [PATCH 233/353] Consolidate Stripe routes/actions into
 StripeAccountsController

---
 .../controllers/stripe_controller.js.coffee   |  2 +-
 .../admin/enterprises_controller.rb           | 18 ----
 .../admin/stripe_accounts_controller.rb       | 21 ++++-
 .../form/_stripe_connect.html.haml            |  4 +-
 config/routes.rb                              | 14 +--
 .../admin/enterprises_controller_spec.rb      | 68 ---------------
 .../admin/stripe_accounts_controller_spec.rb  | 85 +++++++++++++++++--
 7 files changed, 107 insertions(+), 105 deletions(-)

diff --git a/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee b/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
index c8a1b6a019..575a7995a9 100644
--- a/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
+++ b/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
@@ -5,7 +5,7 @@ angular.module("admin.paymentMethods").controller "StripeController", ($scope, $
   $scope.$watch "paymentMethod.preferred_enterprise_id", (newID, oldID) ->
     return unless newID?
     $scope.stripe_account = {}
-    $http.get("/admin/enterprises/#{newID}/stripe_account.json").success (data) ->
+    $http.get("/admin/stripe_accounts/status.json?enterprise_id=#{newID}").success (data) ->
       angular.extend($scope.stripe_account, data)
     .error (response) ->
       $scope.stripe_account.status = "request_failed"
diff --git a/app/controllers/admin/enterprises_controller.rb b/app/controllers/admin/enterprises_controller.rb
index 0ccb65095b..1e8a4f0968 100644
--- a/app/controllers/admin/enterprises_controller.rb
+++ b/app/controllers/admin/enterprises_controller.rb
@@ -1,6 +1,4 @@
 require 'open_food_network/referer_parser'
-require 'stripe/account_connector'
-require 'stripe/oauth'
 
 module Admin
   class EnterprisesController < ResourceController
@@ -115,22 +113,6 @@ module Admin
       end
     end
 
-    def stripe_connect
-      redirect_to Stripe::OAuth.authorize_url(params[:enterprise_id])
-    end
-
-    def stripe_connect_callback
-      connector = Stripe::AccountConnector.new(spree_current_user, params)
-      if connector.create_account
-        flash[:success] = t('admin.controllers.enterprises.stripe_connect_success')
-        redirect_to main_app.edit_admin_enterprise_path(connector.enterprise)
-      else
-        render text: t('admin.controllers.enterprises.stripe_connect_fail'), status: 500
-      end
-    rescue Stripe::StripeError => e
-      render text: e.message, status: 500
-    end
-
     protected
 
     def build_resource_with_address
diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index 695f415eb9..8bdbeee504 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -1,7 +1,26 @@
+require 'stripe/account_connector'
+require 'stripe/oauth'
+
 module Admin
   class StripeAccountsController < BaseController
     protect_from_forgery except: :destroy_from_webhook
 
+    def connect
+      redirect_to Stripe::OAuth.authorize_url(params[:enterprise_id])
+    end
+
+    def connect_callback
+      connector = Stripe::AccountConnector.new(spree_current_user, params)
+      if connector.create_account
+        flash[:success] = t('admin.controllers.enterprises.stripe_connect_success')
+        redirect_to main_app.edit_admin_enterprise_path(connector.enterprise)
+      else
+        render text: t('admin.controllers.enterprises.stripe_connect_fail'), status: 500
+      end
+    rescue Stripe::StripeError => e
+      render text: e.message, status: 500
+    end
+
     def destroy
       stripe_account = StripeAccount.find(params[:id])
       authorize! :destroy, stripe_account
@@ -18,7 +37,7 @@ module Admin
       redirect_to spree.admin_path
     end
 
-    def destroy_from_webhook
+    def deauthorize
       # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
       event = Stripe::Event.construct_from(params)
       return render nothing: true, status: 400 unless event.type == "account.application.deauthorized"
diff --git a/app/views/admin/enterprises/form/_stripe_connect.html.haml b/app/views/admin/enterprises/form/_stripe_connect.html.haml
index 4b13fca017..b1ed3802e6 100644
--- a/app/views/admin/enterprises/form/_stripe_connect.html.haml
+++ b/app/views/admin/enterprises/form/_stripe_connect.html.haml
@@ -3,7 +3,7 @@
     .row
       = t('.stripe_account_connected')
     .row
-      =link_to t('.disconnect'), main_app.admin_enterprise_stripe_account_path(@enterprise,@stripe_account), method: :delete, class: 'button'
+      =link_to t('.disconnect'), main_app.admin_stripe_account_path(@stripe_account), method: :delete, class: 'button'
 - else
   .row.stripe-info
     .six.columns.alpha
@@ -15,5 +15,5 @@
       -# What, if any, fees the platform charges.
       =t('.stripe_connect_info')
     .five.columns.omega.text-right
-      %a.stripe-connect{href: 'stripe_connect'}
+      %a.stripe-connect{ href: main_app.connect_admin_stripe_accounts_path(enterprise_id: @enterprise) }
         %span= t('.connect_with_stripe')
diff --git a/config/routes.rb b/config/routes.rb
index bb1422063c..9ed42772e5 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -65,9 +65,6 @@ Openfoodnetwork::Application.routes.draw do
   post 'embedded_shopfront/enable', to: 'application#enable_embedded_styles'
   post 'embedded_shopfront/disable', to: 'application#disable_embedded_styles'
 
-  get '/stripe/callback', :to => 'admin/enterprises#stripe_connect_callback'
-  post '/stripe/webhook', :to => 'admin/stripe_accounts#destroy_from_webhook'
-
   resources :enterprises do
     collection do
       post :search
@@ -101,10 +98,6 @@ Openfoodnetwork::Application.routes.draw do
         post :bulk_update, as: :bulk_update
       end
 
-      get "/stripe_connect", to: "enterprises#stripe_connect"
-      get "/stripe_account", to: "stripe_accounts#status"
-      resources :stripe_accounts, only: [:destroy]
-
       member do
         get :welcome
         put :register
@@ -173,6 +166,13 @@ Openfoodnetwork::Application.routes.draw do
     resource :invoice_settings, only: [:edit, :update]
 
     resource :stripe_connect_settings, only: [:edit, :update]
+
+    resources :stripe_accounts, only: [:destroy] do
+      get :connect, on: :collection
+      get :connect_callback, on: :collection
+      get :status, on: :collection
+      post :deauthorize, on: :collection
+    end
   end
 
   namespace :api do
diff --git a/spec/controllers/admin/enterprises_controller_spec.rb b/spec/controllers/admin/enterprises_controller_spec.rb
index c51fbddd4f..5e2300d122 100644
--- a/spec/controllers/admin/enterprises_controller_spec.rb
+++ b/spec/controllers/admin/enterprises_controller_spec.rb
@@ -144,74 +144,6 @@ module Admin
           expect(distributor.users).to_not include user
         end
 
-        describe "#stripe_connect" do
-          before do
-            allow(controller).to receive(:spree_current_user) { distributor_manager }
-            allow(::Stripe::OAuth).to receive(:authorize_url) { "some_url" }
-          end
-
-          it "redirects to Stripe Authorization url constructed OAuth" do
-            spree_get :stripe_connect
-            expect(response).to redirect_to "some_url"
-          end
-        end
-
-        context "#stripe_connect_callback" do
-          let(:params) { { id: distributor.permalink } }
-          before { allow(controller).to receive(:spree_current_user) { distributor_manager } }
-
-          context "when the connector raises a StripeError" do
-            before do
-              allow(Stripe::AccountConnector).to receive(:new).and_raise Stripe::StripeError, "some error"
-            end
-
-            it "returns a 500 error" do
-              spree_get :stripe_connect_callback, params
-              response.status.should be 500
-            end
-          end
-
-          context "when the connector raises an AccessDenied error" do
-            before do
-              allow(Stripe::AccountConnector).to receive(:new).and_raise CanCan::AccessDenied, "some error"
-            end
-
-            it "redirects to unauthorized" do
-              spree_get :stripe_connect_callback, params
-              expect(response).to redirect_to spree.unauthorized_path
-            end
-          end
-
-          context "when initializing the connector does not raise an error" do
-            let(:connector) { double(:connector) }
-
-            before do
-              allow(Stripe::AccountConnector).to receive(:new) { connector }
-            end
-
-            context "when the connector succeeds in creating a new stripe account record" do
-              before { allow(connector).to receive(:create_account) { true } }
-
-              it "redirects to the enterprise edit path" do
-                spree_get :stripe_connect_callback, params
-                expect(flash[:success]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_success')
-                expect(response).to redirect_to edit_admin_enterprise_path(distributor)
-              end
-            end
-
-            context "when the connector succeeds in creating a new stripe account record" do
-              before { allow(connector).to receive(:create_account) { false } }
-
-              it "renders a failure message" do
-                spree_get :stripe_connect_callback, params
-                expect(response.body).to eq I18n.t('admin.controllers.enterprises.stripe_connect_fail')
-                expect(response.status).to be 500
-              end
-            end
-          end
-        end
-
-
         describe "enterprise properties" do
           let(:producer) { create(:enterprise) }
           let!(:property) { create(:property, name: "A nice name") }
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 01dff11d31..5ee046debf 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -1,7 +1,78 @@
 require 'spec_helper'
 
 describe Admin::StripeAccountsController, type: :controller do
-  describe "destroy_from_webhook" do
+  let(:enterprise) { create(:distributor_enterprise) }
+
+  describe "#connect" do
+    before do
+      allow(controller).to receive(:spree_current_user) { enterprise.owner }
+      allow(Stripe::OAuth).to receive(:authorize_url) { "some_url" }
+    end
+
+    it "redirects to Stripe Authorization url constructed OAuth" do
+      spree_get :connect
+      expect(response).to redirect_to "some_url"
+    end
+  end
+
+  context "#connect_callback" do
+    let(:params) { { id: enterprise.permalink } }
+    before { allow(controller).to receive(:spree_current_user) { enterprise.owner } }
+
+    context "when the connector raises a StripeError" do
+      before do
+        allow(Stripe::AccountConnector).to receive(:new).and_raise Stripe::StripeError, "some error"
+      end
+
+      it "returns a 500 error" do
+        spree_get :connect_callback, params
+        response.status.should be 500
+      end
+    end
+
+    context "when the connector raises an AccessDenied error" do
+      before do
+        allow(Stripe::AccountConnector).to receive(:new).and_raise CanCan::AccessDenied, "some error"
+      end
+
+      it "redirects to unauthorized" do
+        spree_get :connect_callback, params
+        expect(response).to redirect_to spree.unauthorized_path
+      end
+    end
+
+    context "when initializing the connector does not raise an error" do
+      let(:connector) { double(:connector) }
+
+      before do
+        allow(Stripe::AccountConnector).to receive(:new) { connector }
+      end
+
+      context "when the connector succeeds in creating a new stripe account record" do
+        before { allow(connector).to receive(:create_account) { true } }
+
+        it "redirects to the enterprise edit path" do
+          expect(connector).to receive(:enterprise) { enterprise }
+          spree_get :connect_callback, params
+          expect(flash[:success]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_success')
+          expect(response).to redirect_to edit_admin_enterprise_path(enterprise)
+        end
+      end
+
+      context "when the connector succeeds in creating a new stripe account record" do
+        before { allow(connector).to receive(:create_account) { false } }
+
+        it "renders a failure message" do
+          expect(connector).to_not receive(:enterprise)
+          spree_get :connect_callback, params
+          expect(response.body).to eq I18n.t('admin.controllers.enterprises.stripe_connect_fail')
+          expect(response.status).to be 500
+        end
+      end
+    end
+  end
+
+  describe "#deauthorize" do
     let!(:stripe_account) { create(:stripe_account, stripe_user_id: "webhook_id") }
     let(:params) do
       {
@@ -15,7 +86,7 @@ describe Admin::StripeAccountsController, type: :controller do
     end
 
     it "deletes Stripe accounts in response to a webhook" do
-      post 'destroy_from_webhook', params
+      post 'deauthorize', params
       expect(response.status).to eq 200
       expect(response.body).to eq "Account webhook_id deauthorized"
       expect(StripeAccount.all).not_to include stripe_account
@@ -27,7 +98,7 @@ describe Admin::StripeAccountsController, type: :controller do
       end
 
       it "does nothing" do
-        post 'destroy_from_webhook', params
+        post 'deauthorize', params
         expect(response.status).to eq 400
         expect(StripeAccount.all).to include stripe_account
       end
@@ -39,15 +110,14 @@ describe Admin::StripeAccountsController, type: :controller do
       end
 
       it "does nothing" do
-        post 'destroy_from_webhook', params
+        post 'deauthorize', params
         expect(response.status).to eq 400
         expect(StripeAccount.all).to include stripe_account
       end
     end
   end
 
-  describe "destroy" do
-    let(:enterprise) { create(:distributor_enterprise) }
+  describe "#destroy" do
     let(:params) { { format: :json, id: "some_id" } }
 
     context "when the specified stripe account doesn't exist" do
@@ -102,8 +172,7 @@ describe Admin::StripeAccountsController, type: :controller do
     end
   end
 
-  describe "verifying stripe account status with Stripe" do
-    let(:enterprise) { create(:distributor_enterprise) }
+  describe "#status" do
     let(:params) { { format: :json } }
 
     before do

From ce65a9d06300cd38fe46e07084553f118ab1e3d4 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 14 Jul 2017 14:39:20 +1000
Subject: [PATCH 234/353] Bump stripe gem version to 3.0.1

Allows us to use the stripe gem's built-in OAuth wrappers, rather than our own
---
 Gemfile                                       |  2 +-
 Gemfile.lock                                  | 18 ++-----
 .../admin/stripe_accounts_controller.rb       |  6 ++-
 app/models/stripe_account.rb                  |  4 +-
 config/initializers/stripe.rb                 |  1 +
 lib/stripe/account_connector.rb               | 14 ++---
 lib/stripe/oauth.rb                           | 51 -------------------
 .../admin/stripe_accounts_controller_spec.rb  |  6 ++-
 spec/lib/stripe/account_connector_spec.rb     | 14 +++--
 spec/lib/stripe/oauth_spec.rb                 | 25 ---------
 spec/models/stripe_account_spec.rb            | 24 +++++----
 11 files changed, 49 insertions(+), 116 deletions(-)
 delete mode 100644 lib/stripe/oauth.rb
 delete mode 100644 spec/lib/stripe/oauth_spec.rb

diff --git a/Gemfile b/Gemfile
index 45763bebcf..1984e82211 100644
--- a/Gemfile
+++ b/Gemfile
@@ -19,7 +19,7 @@ gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch:
 # - Change type of password from string to password to hide it in the form
 gem 'spree_paypal_express', :github => "openfoodfoundation/better_spree_paypal_express", :branch => "spree-upgrade-intermediate"
 #gem 'spree_paypal_express', :github => "spree-contrib/better_spree_paypal_express", :branch => "1-3-stable"
-gem 'stripe', '~>1.51.0'
+gem 'stripe', '~> 3.0.1'
 gem 'activemerchant', '~> 1.71.0'
 
 gem 'oauth2', '~> 1.2.0' # Used for Stripe Connect
diff --git a/Gemfile.lock b/Gemfile.lock
index 50ba18ebb6..1afefa3d73 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -271,8 +271,6 @@ GEM
       devise (>= 2.1.0)
     diff-lcs (1.2.4)
     diffy (3.1.0)
-    domain_name (0.5.20160615)
-      unf (>= 0.0.5, < 1.0.0)
     em-websocket (0.5.0)
       eventmachine (>= 0.12.9)
       http_parser.rb (~> 0.5.3)
@@ -433,8 +431,6 @@ GEM
       tilt
     highline (1.6.15)
     hike (1.2.3)
-    http-cookie (1.0.2)
-      domain_name (~> 0.5)
     http_parser.rb (0.5.3)
     httparty (0.9.0)
       multi_json (~> 1.0)
@@ -488,7 +484,6 @@ GEM
     multi_json (1.12.1)
     multi_xml (0.6.0)
     multipart-post (2.0.0)
-    netrc (0.11.0)
     newrelic_rpm (3.12.0.288)
     nokogiri (1.6.8.1)
       mini_portile2 (~> 2.1.0)
@@ -588,10 +583,6 @@ GEM
     representative_view (1.2.2)
       actionpack (> 2.3.0, < 4.0.0)
       representative (~> 1.0.2)
-    rest-client (2.0.0)
-      http-cookie (>= 1.0.2, < 2.0)
-      mime-types (>= 1.16, < 4.0)
-      netrc (~> 0.8)
     roadie (3.0.1)
       css_parser (~> 1.3.4)
       nokogiri (~> 1.6.0)
@@ -648,8 +639,8 @@ GEM
       tilt (~> 1.1, != 1.3.0)
     state_machine (1.2.0)
     stringex (1.3.3)
-    stripe (1.51.0)
-      rest-client (>= 1.4, < 3.0)
+    stripe (3.0.1)
+      faraday (~> 0.9)
     therubyracer (0.12.0)
       libv8 (~> 3.16.14.0)
       ref
@@ -670,9 +661,6 @@ GEM
     uglifier (2.7.1)
       execjs (>= 0.3.0)
       json (>= 1.8.0)
-    unf (0.1.4)
-      unf_ext
-    unf_ext (0.0.7.2)
     unicode-display_width (1.3.0)
     unicorn (4.9.0)
       kgio (~> 2.6)
@@ -789,7 +777,7 @@ DEPENDENCIES
   spree_auth_devise!
   spree_i18n!
   spree_paypal_express!
-  stripe (~> 1.51.0)
+  stripe (~> 3.0.1)
   therubyracer
   timecop
   truncate_html
diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index 8bdbeee504..383857c2db 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -1,12 +1,14 @@
 require 'stripe/account_connector'
-require 'stripe/oauth'
 
 module Admin
   class StripeAccountsController < BaseController
     protect_from_forgery except: :destroy_from_webhook
 
     def connect
-      redirect_to Stripe::OAuth.authorize_url(params[:enterprise_id])
+      payload = params.slice(:enterprise_id)
+      key = Openfoodnetwork::Application.config.secret_token
+      url_params = { state: JWT.encode(payload, key, 'HS256'), scope: "read_write" }
+      redirect_to Stripe::OAuth.authorize_url(url_params)
     end
 
     def connect_callback
diff --git a/app/models/stripe_account.rb b/app/models/stripe_account.rb
index 6aac4b4dfd..dfbcc560ea 100644
--- a/app/models/stripe_account.rb
+++ b/app/models/stripe_account.rb
@@ -7,10 +7,12 @@ class StripeAccount < ActiveRecord::Base
     accounts = StripeAccount.where(stripe_user_id: stripe_user_id)
 
     # Only deauthorize the user if it is not linked to multiple accounts
-    if accounts.count > 1 || Stripe::OAuth.deauthorize(stripe_user_id)
+    if accounts.count > 1 || Stripe::OAuth.deauthorize(stripe_user_id: stripe_user_id)
       destroy
     else
       false
     end
+  rescue Stripe::OAuth::OAuthError
+    false
   end
 end
diff --git a/config/initializers/stripe.rb b/config/initializers/stripe.rb
index 2dc4035a49..64bda99d91 100644
--- a/config/initializers/stripe.rb
+++ b/config/initializers/stripe.rb
@@ -1 +1,2 @@
 Stripe.api_key = ENV['STRIPE_INSTANCE_SECRET_KEY']
+Stripe.client_id = ENV['STRIPE_CLIENT_ID']
diff --git a/lib/stripe/account_connector.rb b/lib/stripe/account_connector.rb
index c48f38d117..99efbe1aa8 100644
--- a/lib/stripe/account_connector.rb
+++ b/lib/stripe/account_connector.rb
@@ -4,7 +4,7 @@
 
 module Stripe
   class AccountConnector
-    attr_reader :oauth_response, :enterprise, :user, :params
+    attr_reader :token, :enterprise, :user, :params
 
     def initialize(user, params)
       @user = user
@@ -14,7 +14,7 @@ module Stripe
       raise CanCan::AccessDenied unless state.keys.include? "enterprise_id"
 
       # Request an access token based on the code provided
-      @oauth_response = OAuth.request_access_token(params["code"])
+      @token = OAuth.token(grant_type: 'authorization_code', code: params["code"])
 
       # Find the Enterprise
       @enterprise = Enterprise.find_by_permalink(state["enterprise_id"])
@@ -22,14 +22,14 @@ module Stripe
       return if user.enterprises.include?(enterprise) || user.admin?
 
       # Local authorisation issue, so request disconnection from Stripe
-      OAuth.deauthorize(oauth_response["stripe_user_id"])
+      OAuth.deauthorize(stripe_user_id: token.stripe_user_id)
       raise CanCan::AccessDenied
     end
 
     def create_account
       StripeAccount.create(
-        stripe_user_id: oauth_response["stripe_user_id"],
-        stripe_publishable_key: oauth_response["stripe_publishable_key"],
+        stripe_user_id: token.stripe_user_id,
+        stripe_publishable_key: token.stripe_publishable_key,
         enterprise: enterprise
       )
     end
@@ -37,7 +37,9 @@ module Stripe
     private
 
     def state
-      OAuth.send(:jwt_decode, params["state"])
+      # Returns the original payload
+      key = Openfoodnetwork::Application.config.secret_token
+      JWT.decode(params["state"], key, true, algorithm: 'HS256')[0]
     end
   end
 end
diff --git a/lib/stripe/oauth.rb b/lib/stripe/oauth.rb
deleted file mode 100644
index 37ca203cdc..0000000000
--- a/lib/stripe/oauth.rb
+++ /dev/null
@@ -1,51 +0,0 @@
-module Stripe
-  class OAuth
-    @options = {
-      :site => 'https://connect.stripe.com',
-      :authorize_url => '/oauth/authorize',
-      :deauthorize_url => '/oauth/deauthorize',
-      :token_url => '/oauth/token'
-    }
-
-    @client = OAuth2::Client.new(
-      ENV['STRIPE_CLIENT_ID'],
-      ENV['STRIPE_INSTANCE_SECRET_KEY'],
-      @options
-    )
-
-    class << self
-      attr_accessor :client
-
-      def authorize_url(enterprise_id, options = {})
-        options[:enterprise_id] = enterprise_id
-        jwt = jwt_encode(options)
-        # State param will be passed back after auth
-        client.auth_code.authorize_url(state: jwt, scope: 'read_write')
-      end
-
-      def request_access_token(auth_code)
-        # Fetch and return the account details from Stripe
-        client.auth_code.get_token(auth_code).params
-      end
-
-      def deauthorize(stripe_user_id)
-        client.deauthorize(stripe_user_id).deauthorize_request
-      end
-
-      private
-
-      def secret_token
-        Openfoodnetwork::Application.config.secret_token
-      end
-
-      def jwt_encode(payload)
-        JWT.encode(payload, secret_token, 'HS256')
-      end
-
-      def jwt_decode(token)
-        # Returns the original payload
-        JWT.decode(token, secret_token, true, algorithm: 'HS256')[0]
-      end
-    end
-  end
-end
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 5ee046debf..2702d58084 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -6,12 +6,14 @@ describe Admin::StripeAccountsController, type: :controller do
   describe "#connect" do
     before do
       allow(controller).to receive(:spree_current_user) { enterprise.owner }
-      allow(Stripe::OAuth).to receive(:authorize_url) { "some_url" }
     end
 
     it "redirects to Stripe Authorization url constructed OAuth" do
       spree_get :connect
-      expect(response).to redirect_to "some_url"
+      expect(response.location).to match %r(\Ahttps://connect.stripe.com)
+      uri = URI.parse(response.location)
+      params = CGI.parse(uri.query)
+      expect(params.keys).to include 'client_id', 'response_type', 'state', 'scope'
     end
   end
 
diff --git a/spec/lib/stripe/account_connector_spec.rb b/spec/lib/stripe/account_connector_spec.rb
index 119d6c7e38..ebe75f2b04 100644
--- a/spec/lib/stripe/account_connector_spec.rb
+++ b/spec/lib/stripe/account_connector_spec.rb
@@ -28,15 +28,17 @@ module Stripe
 
         context "and the decoded state param contains an 'enterprise_id' key" do
           let(:payload) { { enterprise_id: enterprise.permalink } }
-          let(:access_token) { { "stripe_user_id" => "some_user_id", "stripe_publishable_key" => "some_key" } }
+          let(:token_response) { { "stripe_user_id" => "some_user_id", "stripe_publishable_key" => "some_key" } }
 
           before do
-            expect(OAuth).to receive(:request_access_token) { access_token }
+            stub_request(:post, "https://connect.stripe.com/oauth/token").
+              with(body: {"code"=>"code", "grant_type"=>"authorization_code"}).
+              to_return(status: 200, body: JSON.generate(token_response) )
           end
 
           context "but the user doesn't manage own or manage the corresponding enterprise" do
             it "makes a request to cancel the Stripe connection and raises an error" do
-              expect(OAuth).to receive(:deauthorize).with("some_user_id")
+              expect(OAuth).to receive(:deauthorize).with(stripe_user_id: "some_user_id")
               expect{ AccountConnector.new(user, params) }.to raise_error CanCan::AccessDenied
             end
           end
@@ -54,6 +56,9 @@ module Stripe
             it "allows creations of a new Stripe Account from the callback params" do
               connector = AccountConnector.new(user, params)
               expect{ connector.create_account }.to change(StripeAccount, :count).by(1)
+              account = StripeAccount.last
+              expect(account.stripe_user_id).to eq "some_user_id"
+              expect(account.stripe_publishable_key).to eq "some_key"
             end
           end
 
@@ -68,6 +73,9 @@ module Stripe
             it "allows creations of a new Stripe Account from the callback params" do
               connector = AccountConnector.new(user, params)
               expect{ connector.create_account }.to change(StripeAccount, :count).by(1)
+              account = StripeAccount.last
+              expect(account.stripe_user_id).to eq "some_user_id"
+              expect(account.stripe_publishable_key).to eq "some_key"
             end
           end
         end
diff --git a/spec/lib/stripe/oauth_spec.rb b/spec/lib/stripe/oauth_spec.rb
deleted file mode 100644
index 526c1d1167..0000000000
--- a/spec/lib/stripe/oauth_spec.rb
+++ /dev/null
@@ -1,25 +0,0 @@
-require 'spec_helper'
-require 'stripe/oauth'
-
-module Stripe
-  describe OAuth do
-    describe "contructing an authorization url" do
-      let(:enterprise_id) { "ent_id" }
-
-      before do
-        allow(OAuth.client).to receive(:id) { 'abc' }
-      end
-
-      it "builds a url with all of the necessary params" do
-        url = OAuth.authorize_url(enterprise_id)
-        uri = URI.parse(url)
-        params = CGI.parse(uri.query)
-        expect(params.keys).to include 'client_id', 'response_type', 'state', 'scope'
-        expect(params["state"]).to eq [OAuth.send(:jwt_encode, enterprise_id: enterprise_id)]
-        expect(uri.scheme).to eq 'https'
-        expect(uri.host).to eq 'connect.stripe.com'
-        expect(uri.path).to eq '/oauth/authorize'
-      end
-    end
-  end
-end
diff --git a/spec/models/stripe_account_spec.rb b/spec/models/stripe_account_spec.rb
index 7244e44979..5aaf0f56ee 100644
--- a/spec/models/stripe_account_spec.rb
+++ b/spec/models/stripe_account_spec.rb
@@ -5,14 +5,19 @@ describe StripeAccount do
   describe "deauthorize_and_destroy" do
     let!(:enterprise) { create(:enterprise) }
     let!(:enterprise2) { create(:enterprise) }
-    let!(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
+    let(:client_id) { 'ca_abc123' }
+    let(:stripe_user_id) { 'acct_abc123' }
+    let!(:stripe_account) { create(:stripe_account, enterprise: enterprise, stripe_user_id: stripe_user_id) }
+
+    before do
+      allow(Stripe).to receive(:client_id) { client_id }
+    end
 
     context "when the Stripe API disconnect fails" do
       before do
-        Stripe::OAuth.client
-                     .deauthorize(stripe_account.stripe_user_id)
-                     .stub(:deauthorize_request)
-                     .and_return(nil)
+        stub_request(:post, "https://connect.stripe.com/oauth/deauthorize").
+          with(body: { "client_id" => client_id, "stripe_user_id" => stripe_user_id }).
+          to_return(status: 400, body: JSON.generate(error: 'invalid_grant', error_description: "Some Message"))
       end
 
       it "doesn't destroy the record" do
@@ -23,10 +28,9 @@ describe StripeAccount do
 
     context "when the Stripe API disconnect succeeds" do
       before do
-        Stripe::OAuth.client
-                     .deauthorize(stripe_account.stripe_user_id)
-                     .stub(:deauthorize_request)
-                     .and_return("something truthy")
+        stub_request(:post, "https://connect.stripe.com/oauth/deauthorize").
+          with(body: { "client_id" => client_id, "stripe_user_id" => stripe_user_id }).
+          to_return(status: 200, body: JSON.generate(stripe_user_id: stripe_user_id))
       end
 
       it "destroys the record" do
@@ -39,7 +43,7 @@ describe StripeAccount do
       let!(:another_stripe_account) { create(:stripe_account, enterprise: enterprise2, stripe_user_id: stripe_account.stripe_user_id) }
 
       it "Doesn't make a Stripe API disconnection request " do
-        expect(Stripe::OAuth.client.deauthorize(stripe_account.stripe_user_id)).not_to receive(:deauthorize_request)
+        expect(Stripe::OAuth).to_not receive(:deauthorize)
         stripe_account.deauthorize_and_destroy
       end
     end

From 692ccf0598015b4913fe475f71708f5ba7303c8e Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 14 Jul 2017 14:42:09 +1000
Subject: [PATCH 235/353] Cleaning up oauth2 extension that is no longer
 required

(We're using Stripes built-in OAuth Libraries instead)
---
 config/initializers/oauth2.rb | 47 -----------------------------------
 1 file changed, 47 deletions(-)
 delete mode 100644 config/initializers/oauth2.rb

diff --git a/config/initializers/oauth2.rb b/config/initializers/oauth2.rb
deleted file mode 100644
index 2b46cb0e1e..0000000000
--- a/config/initializers/oauth2.rb
+++ /dev/null
@@ -1,47 +0,0 @@
-Rails.application.config.to_prepare do
-  OAuth2::Client.class_eval do
-    def deauthorize_url(params = nil)
-     connection.build_url(options[:deauthorize_url]).to_s
-    end
-
-    def deauthorize(account)
-      client_object = self.dup
-      client_object.options[:stripe_user_id] = account
-      @deauthorize ||= OAuth2::Strategy::Deauthorize.new(client_object)
-    end
-
-    def deauthorize_request(params)
-      headers = params.delete(:headers)
-      opts = {}
-      opts[:body] = params
-      opts[:headers] = {'Content-Type' => 'application/x-www-form-urlencoded'}
-      opts[:headers].merge!(headers) if headers
-      request(:post, deauthorize_url, opts)
-    end
-  end
-
-  module OAuth2
-    module Strategy
-      # Deauthorization Strategy -- for Stripe
-      class Deauthorize < Base
-        # The required query parameters for the authorize URL
-        #
-        def deauthorize_params(params = {})
-          params.merge({  'client_id' => @client.id,
-                          'stripe_user_id' => @client.options[:stripe_user_id]
-                      })
-        end
-
-        def deauthorize_url(params = {})
-         @client.deauthorize_url(deauthorize_params.merge(params))
-        end
-
-        def deauthorize_request(params = {})
-          params = params.merge(deauthorize_params).merge(client_params)
-          @client.deauthorize_request(params)
-        end
-
-      end
-    end
-  end
-end

From 576e4db9bee89b1bef7272b1fb2d5bdf865a7ed8 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 14 Jul 2017 15:32:06 +1000
Subject: [PATCH 236/353] Authorize StripeAccount#status using the account
 object

Rather than the enterprise
---
 .../admin/stripe_accounts_controller.rb       |  2 +-
 app/models/spree/ability_decorator.rb         |  4 +-
 .../admin/stripe_accounts_controller_spec.rb  | 56 +++++++++----------
 3 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index 383857c2db..937c4f7e8e 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -53,10 +53,10 @@ module Admin
     end
 
     def status
-      authorize! :stripe_account, Enterprise.find_by_id(params[:enterprise_id])
       return render json: { status: :stripe_disabled } unless Spree::Config.stripe_connect_enabled
       stripe_account = StripeAccount.find_by_enterprise_id(params[:enterprise_id])
       return render json: { status: :account_missing } unless stripe_account
+      authorize! :status, stripe_account
 
       begin
         status = Stripe::Account.retrieve(stripe_account.stripe_user_id)
diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb
index 78c994f8a7..ab370f68c2 100644
--- a/app/models/spree/ability_decorator.rb
+++ b/app/models/spree/ability_decorator.rb
@@ -96,7 +96,7 @@ class AbilityDecorator
     can [:welcome, :register], Enterprise do |enterprise|
       enterprise.owner == user
     end
-    can [:manage_payment_methods, :manage_shipping_methods, :manage_enterprise_fees, :stripe_account], Enterprise do |enterprise|
+    can [:manage_payment_methods, :manage_shipping_methods, :manage_enterprise_fees], Enterprise do |enterprise|
       user.enterprises.include? enterprise
     end
 
@@ -122,7 +122,7 @@ class AbilityDecorator
     # Not sure how to restrict these methods to a non-resource Controller
     can [:stripe_connect, :stripe_connect_callback, :stripe_disconnect], :all
 
-    can [:destroy], StripeAccount do |stripe_account|
+    can [:status, :destroy], StripeAccount do |stripe_account|
       user.enterprises.include? stripe_account.enterprise
     end
   end
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 2702d58084..dbe215c6fe 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -182,50 +182,50 @@ describe Admin::StripeAccountsController, type: :controller do
       Spree::Config.set(stripe_connect_enabled: false)
     end
 
-    context "where I don't manage the specified enterprise" do
-      let(:user) { create(:user) }
-      let(:enterprise2) { create(:enterprise) }
-      before do
-        user.owned_enterprises << enterprise2
-        params[:enterprise_id] = enterprise.id
-        allow(controller).to receive(:spree_current_user) { user }
-      end
-
-      it "redirects to unauthorized" do
+    context "when Stripe is not enabled" do
+      it "returns with a status of 'stripe_disabled'" do
         spree_get :status, params
-        expect(response).to redirect_to spree.unauthorized_path
+        json_response = JSON.parse(response.body)
+        expect(json_response["status"]).to eq "stripe_disabled"
       end
     end
 
-    context "where I manage the specified enterprise" do
-      before do
-        params[:enterprise_id] = enterprise.id
-        allow(controller).to receive(:spree_current_user) { enterprise.owner }
-      end
+    context "when Stripe is enabled" do
+      before { Spree::Config.set(stripe_connect_enabled: true) }
 
-      context "but Stripe is not enabled" do
-        it "returns with a status of 'stripe_disabled'" do
+      context "but no stripe account is associated with the specified enterprise" do
+        it "returns with a status of 'account_missing'" do
           spree_get :status, params
           json_response = JSON.parse(response.body)
-          expect(json_response["status"]).to eq "stripe_disabled"
+          expect(json_response["status"]).to eq "account_missing"
         end
       end
 
-      context "and Stripe is enabled" do
-        before { Spree::Config.set(stripe_connect_enabled: true) }
+      context "and a stripe account is associated with the specified enterprise" do
+        let!(:account) { create(:stripe_account, stripe_user_id: "acc_123", enterprise: enterprise) }
 
-        context "but it has no associated stripe account" do
-          it "returns with a status of 'account_missing'" do
+        context "but I don't manage the enterprise" do
+          let(:user) { create(:user) }
+          let(:enterprise2) { create(:enterprise) }
+          before do
+            user.owned_enterprises << enterprise2
+            params[:enterprise_id] = enterprise.id
+            allow(controller).to receive(:spree_current_user) { user }
+          end
+
+          it "redirects to unauthorized" do
             spree_get :status, params
-            json_response = JSON.parse(response.body)
-            expect(json_response["status"]).to eq "account_missing"
+            expect(response).to redirect_to spree.unauthorized_path
           end
         end
 
-        context "and it has an associated stripe account" do
-          let!(:account) { create(:stripe_account, stripe_user_id: "acc_123", enterprise: enterprise) }
+        context "and I manage the enterprise" do
+          before do
+            params[:enterprise_id] = enterprise.id
+            allow(controller).to receive(:spree_current_user) { enterprise.owner }
+          end
 
-          context "which has been revoked or does not exist" do
+          context "but access has been revoked or does not exist on stripe's servers" do
             before do
               stub_request(:get, "https://api.stripe.com/v1/accounts/acc_123").to_return(status: 404)
             end

From d2b6ba43303e4cfa3ab367e2a3ef8cbfb7624b61 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 14 Jul 2017 17:33:54 +1000
Subject: [PATCH 237/353] Provide a Stripe client_id for
 StripeAccountsController spec

---
 spec/controllers/admin/stripe_accounts_controller_spec.rb | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index dbe215c6fe..af9dbb1a94 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -3,6 +3,10 @@ require 'spec_helper'
 describe Admin::StripeAccountsController, type: :controller do
   let(:enterprise) { create(:distributor_enterprise) }
 
+  before do
+    allow(Stripe).to receive(:client_id) { "some_id" }
+  end
+
   describe "#connect" do
     before do
       allow(controller).to receive(:spree_current_user) { enterprise.owner }
@@ -178,7 +182,7 @@ describe Admin::StripeAccountsController, type: :controller do
     let(:params) { { format: :json } }
 
     before do
-      Stripe.api_key = "sk_test_12345"
+      allow(Stripe).to receive(:api_key) { "sk_test_12345" }
       Spree::Config.set(stripe_connect_enabled: false)
     end
 

From 44d172f3b4309a9d8501812dfbff878109ec8d73 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 14 Jul 2017 17:36:31 +1000
Subject: [PATCH 238/353] Mock stripe_account_id for StripeAccount gateway
 specs

---
 spec/models/spree/gateway/stripe_connect_spec.rb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/spec/models/spree/gateway/stripe_connect_spec.rb b/spec/models/spree/gateway/stripe_connect_spec.rb
index 377cb0c968..9e4d1600f7 100644
--- a/spec/models/spree/gateway/stripe_connect_spec.rb
+++ b/spec/models/spree/gateway/stripe_connect_spec.rb
@@ -9,8 +9,11 @@ describe Spree::Gateway::StripeConnect, type: :model do
     end
   end
 
+  let(:stripe_account_id) { "acct_123"  }
+
   before do
     Stripe.api_key = "sk_test_123456"
+    allow(subject).to receive(:stripe_account_id) { stripe_account_id }
     subject.stub(:options_for_purchase_or_auth).and_return(['money', 'cc', 'opts'])
     subject.stub(:provider).and_return provider
   end

From 44ba499ad9c1233c05291e1d5c05453cb9a465f6 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 14 Jul 2017 17:37:20 +1000
Subject: [PATCH 239/353] Stub rather than set Stripe api_key in specs

---
 .../admin/stripe_connect_settings_controller_spec.rb |  8 ++++++--
 .../spree/credit_cards_controller_spec.rb            |  4 ++--
 spec/features/admin/payment_method_spec.rb           |  2 +-
 spec/features/consumer/account/cards_spec.rb         |  2 +-
 spec/features/consumer/shopping/checkout_spec.rb     |  4 ++--
 spec/lib/stripe/account_connector_spec.rb            |  4 ++++
 spec/models/spree/gateway/stripe_connect_spec.rb     |  2 +-
 spec/models/stripe_account_spec.rb                   |  1 +
 spec/requests/stripe_connect_checkout_spec.rb        | 12 ++++++------
 9 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/spec/controllers/admin/stripe_connect_settings_controller_spec.rb b/spec/controllers/admin/stripe_connect_settings_controller_spec.rb
index 2614f2065f..7d0b47974e 100644
--- a/spec/controllers/admin/stripe_connect_settings_controller_spec.rb
+++ b/spec/controllers/admin/stripe_connect_settings_controller_spec.rb
@@ -22,7 +22,9 @@ describe Admin::StripeConnectSettingsController, type: :controller do
       before { allow(controller).to receive(:spree_current_user) { admin } }
 
       context "when a Stripe API key is not set" do
-        before { Stripe.api_key = nil }
+        before do
+          allow(Stripe).to receive(:api_key) { nil }
+        end
 
         it "sets the account status to :empty_api_key" do
           spree_get :edit
@@ -32,7 +34,9 @@ describe Admin::StripeConnectSettingsController, type: :controller do
       end
 
       context "when a Stripe API key is set" do
-        before { Stripe.api_key = "sk_test_xxxx" }
+        before do
+          allow(Stripe).to receive(:api_key) { "sk_test_xxxx" }
+        end
 
         context "and the request to retrieve Stripe account info fails" do
           before do
diff --git a/spec/controllers/spree/credit_cards_controller_spec.rb b/spec/controllers/spree/credit_cards_controller_spec.rb
index e1e5b5fec7..fcff7c7254 100644
--- a/spec/controllers/spree/credit_cards_controller_spec.rb
+++ b/spec/controllers/spree/credit_cards_controller_spec.rb
@@ -17,8 +17,8 @@ describe Spree::CreditCardsController do
   end
 
   before do
-    Stripe.api_key = "sk_test_12345"
-    controller.stub(:spree_current_user) { user }
+    allow(Stripe).to receive(:api_key) { "sk_test_12345" }
+    allow(controller).to receive(:spree_current_user) { user }
     stub_request(:post, "https://api.stripe.com/v1/customers")
       .with(:body => { email: user.email, source: token })
       .to_return(response_mock)
diff --git a/spec/features/admin/payment_method_spec.rb b/spec/features/admin/payment_method_spec.rb
index ac3b9df118..b856cd5807 100644
--- a/spec/features/admin/payment_method_spec.rb
+++ b/spec/features/admin/payment_method_spec.rb
@@ -41,7 +41,7 @@ feature %q{
 
       before do
         Spree::Config.set(stripe_connect_enabled: true)
-        Stripe.api_key = "sk_test_12345"
+        allow(Stripe).to receive(:api_key) { "sk_test_12345" }
         stub_request(:get, "https://api.stripe.com/v1/accounts/acc_connected123").to_return(body: JSON.generate(stripe_account_mock))
         stub_request(:get, "https://api.stripe.com/v1/accounts/acc_revoked123").to_return(status: 404)
       end
diff --git a/spec/features/consumer/account/cards_spec.rb b/spec/features/consumer/account/cards_spec.rb
index 86b1092ccc..590c67d42b 100644
--- a/spec/features/consumer/account/cards_spec.rb
+++ b/spec/features/consumer/account/cards_spec.rb
@@ -9,7 +9,7 @@ feature "Credit Cards", js: true do
     before do
       quick_login_as user
 
-      Stripe.api_key = "sk_test_xxxx"
+      allow(Stripe).to receive(:api_key) { "sk_test_xxxx" }
       Spree::Config.set(stripe_connect_enabled: true)
 
       stub_request(:get, "https://api.stripe.com/v1/customers/cus_AZNMJ").
diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index 508a9ba9d7..68a2f97585 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -156,9 +156,9 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
         let(:response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
 
         before do
-          Stripe.api_key = "sk_test_123456"
+          allow(Stripe).to receive(:api_key) { "sk_test_12345" }
           Spree::Config.set(stripe_connect_enabled: true)
-          stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+          stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
             .to_return(body: JSON.generate(response_mock))
 
           visit checkout_path
diff --git a/spec/lib/stripe/account_connector_spec.rb b/spec/lib/stripe/account_connector_spec.rb
index ebe75f2b04..cfa942852b 100644
--- a/spec/lib/stripe/account_connector_spec.rb
+++ b/spec/lib/stripe/account_connector_spec.rb
@@ -11,6 +11,10 @@ module Stripe
       let(:state) { JWT.encode(payload, Openfoodnetwork::Application.config.secret_token) }
       let(:params) { { "state" => state } }
 
+      before do
+        allow(Stripe).to receive(:api_key) { "sk_test_12345" }
+      end
+
       context "when params have no 'code' key" do
         it "raises a StripeError" do
           expect{ AccountConnector.new(user, params) }.to raise_error StripeError
diff --git a/spec/models/spree/gateway/stripe_connect_spec.rb b/spec/models/spree/gateway/stripe_connect_spec.rb
index 9e4d1600f7..4e39a7812e 100644
--- a/spec/models/spree/gateway/stripe_connect_spec.rb
+++ b/spec/models/spree/gateway/stripe_connect_spec.rb
@@ -12,7 +12,7 @@ describe Spree::Gateway::StripeConnect, type: :model do
   let(:stripe_account_id) { "acct_123"  }
 
   before do
-    Stripe.api_key = "sk_test_123456"
+    allow(Stripe).to receive(:api_key) { "sk_test_123456" }
     allow(subject).to receive(:stripe_account_id) { stripe_account_id }
     subject.stub(:options_for_purchase_or_auth).and_return(['money', 'cc', 'opts'])
     subject.stub(:provider).and_return provider
diff --git a/spec/models/stripe_account_spec.rb b/spec/models/stripe_account_spec.rb
index 5aaf0f56ee..a3afa1685a 100644
--- a/spec/models/stripe_account_spec.rb
+++ b/spec/models/stripe_account_spec.rb
@@ -10,6 +10,7 @@ describe StripeAccount do
     let!(:stripe_account) { create(:stripe_account, enterprise: enterprise, stripe_user_id: stripe_user_id) }
 
     before do
+      allow(Stripe).to receive(:api_key) { "sk_test_12345" }
       allow(Stripe).to receive(:client_id) { client_id }
     end
 
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index fcc3d6f26d..247f8fb81e 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -27,7 +27,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
   end
 
   before do
-    Stripe.api_key = "sk_test_123456"
+    allow(Stripe).to receive(:api_key) { "sk_test_12345" }
     order.update_attributes(distributor_id: enterprise.id, order_cycle_id: order_cycle.id)
     order.reload.update_totals
     set_order order
@@ -40,7 +40,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
     before do
       # Saves the card against the user
-      stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/customers")
+      stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/customers")
         .with(:body => { card: token, email: order.email})
         .to_return(store_response_mock)
 
@@ -50,7 +50,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
         .to_return(token_response_mock)
 
       # Charges the card
-      stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+      stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
         .with(:body => {"amount" => "1234", "card" => new_token, "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
         .to_return(charge_response_mock)
     end
@@ -97,7 +97,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
       before do
         # Attempts to charge the card without a token, which will return an error
-        stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+        stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
           .with(:body => {"amount" => "1234", "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
           .to_return(charge_response_mock)
       end
@@ -136,7 +136,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
         .to_return(token_response_mock)
 
       # Charges the card
-      stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+      stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
         .with(:body => {"amount" => "1234", "card" => new_token, "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"} )
         .to_return(charge_response_mock)
     end
@@ -171,7 +171,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
       before do
         # Attempts to charge the card without a token, which will return an error
-        stub_request(:post, "https://sk_test_123456:@api.stripe.com/v1/charges")
+        stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
           .with(:body => {"amount" => "1234", "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
           .to_return(charge_response_mock)
       end

From ee92f46bd5fc8eba8370988284d3150ab5bd238b Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 14 Jul 2017 18:21:32 +1000
Subject: [PATCH 240/353] Fix stripe request spec by providing en enterprise_id

The enterprise_id is used to lookup a StripeAccount which is provided to the Spree::Token#create call in the StripeConnect gateway
---
 spec/factories.rb                             | 5 +++++
 spec/requests/stripe_connect_checkout_spec.rb | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/spec/factories.rb b/spec/factories.rb
index 6592dc2940..14c97d0f55 100644
--- a/spec/factories.rb
+++ b/spec/factories.rb
@@ -363,6 +363,11 @@ FactoryGirl.define do
     end
   end
 
+  factory :stripe_payment_method, :class => Spree::Gateway::StripeConnect do
+    name 'Stripe'
+    environment 'test'
+  end
+
   factory :stripe_account do
     enterprise { FactoryGirl.create :distributor_enterprise }
     stripe_user_id "abc123"
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index 247f8fb81e..776426911e 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -8,7 +8,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
   let!(:enterprise) { create(:distributor_enterprise) }
   let!(:exchange) { create(:exchange, order_cycle: order_cycle, sender: order_cycle.coordinator, receiver: enterprise, incoming: false, pickup_time: "Monday") }
   let!(:shipping_method) { create(:shipping_method, calculator: Spree::Calculator::FlatRate.new(preferred_amount: 0), distributors: [enterprise]) }
-  let!(:payment_method) { create(:payment_method, type: "Spree::Gateway::StripeConnect", distributors: [enterprise]) }
+  let!(:payment_method) { create(:stripe_payment_method, distributors: [enterprise], preferred_enterprise_id: enterprise.id) }
   let!(:stripe_account) { create(:stripe_account, enterprise: enterprise) }
   let!(:line_item) { create(:line_item, price: 12.34) }
   let!(:order) { line_item.order }

From 8901af897a40c9b1d0f95fd3e4f73748da80b835 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 19 Jul 2017 14:58:42 +1000
Subject: [PATCH 241/353] Store card details submitted via checkout

---
 app/controllers/spree/credit_cards_controller.rb |  4 +---
 app/models/spree/credit_card_decorator.rb        |  5 +++++
 spec/requests/stripe_connect_checkout_spec.rb    | 16 ++++++++++++++--
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
index ee9373e1ce..a39db0d929 100644
--- a/app/controllers/spree/credit_cards_controller.rb
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -54,9 +54,7 @@ module Spree
 
     def build_card_from(attrs)
       card = Spree::CreditCard.new(attrs)
-      # Can't mass assign these:
-      card.cc_type = attrs[:cc_type]
-      card.last_digits = attrs[:last_digits]
+      # Can't mass assign user:
       card.user_id = spree_current_user.id
       card
     end
diff --git a/app/models/spree/credit_card_decorator.rb b/app/models/spree/credit_card_decorator.rb
index 8bcc43ff78..01b8bc0eba 100644
--- a/app/models/spree/credit_card_decorator.rb
+++ b/app/models/spree/credit_card_decorator.rb
@@ -1,4 +1,9 @@
 Spree::CreditCard.class_eval do
+  # Allows user to submit these attributes with checkout request
+  # Required to be able to correctly store details for token-based charges
+  # Obviously can be removed once we are using strong params
+  attr_accessible :cc_type, :last_digits
+
   # Should be able to remove once we reach Spree v2.2.0
   # https://github.com/spree/spree/commit/411010f3975c919ab298cb63962ee492455b415c
   belongs_to :payment_method
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index 776426911e..f89b681e89 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -20,7 +20,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
   let(:params) do
     { format: :json, order: {
       shipping_method_id: shipping_method.id,
-      payments_attributes: [{payment_method_id: payment_method.id, source_attributes: { gateway_payment_profile_id: token, cc_type: "visa", last_digits: "4242", month: 10, year: 2025 }}],
+      payments_attributes: [{payment_method_id: payment_method.id, source_attributes: { gateway_payment_profile_id: token, cc_type: "visa", last_digits: "4242", month: 10, year: 2025, first_name: 'Jill', last_name: 'Jeffreys' }}],
       bill_address_attributes: address.attributes.slice("firstname", "lastname", "address1", "address2", "phone", "city", "zipcode", "state_id", "country_id"),
       ship_address_attributes: address.attributes.slice("firstname", "lastname", "address1", "address2", "phone", "city", "zipcode", "state_id", "country_id")
     } }
@@ -64,6 +64,10 @@ describe "Submitting Stripe Connect charge requests", type: :request do
         card = order.payments.completed.first.source
         expect(card.gateway_customer_profile_id).to eq customer_id
         expect(card.gateway_payment_profile_id).to eq card_id
+        expect(card.cc_type).to eq "visa"
+        expect(card.last_digits).to eq "4242"
+        expect(card.first_name).to eq "Jill"
+        expect(card.last_name).to eq "Jeffreys"
       end
     end
 
@@ -119,6 +123,10 @@ describe "Submitting Stripe Connect charge requests", type: :request do
         user_id: order.user_id,
         gateway_payment_profile_id: card_id,
         gateway_customer_profile_id: customer_id,
+        last_digits: "4321",
+        cc_type: "master",
+        first_name: "Sammy",
+        last_name: "Signpost",
         month: 11, year: 2026
       )
     end
@@ -142,7 +150,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     end
 
     context "and the charge and token requests are accepted" do
-      it "should process the payment, and keep the profile ids" do
+      it "should process the payment, and keep the profile ids and other card details" do
         put update_checkout_path, params
         json_response = JSON.parse(response.body)
         expect(json_response["path"]).to eq spree.order_path(order)
@@ -150,6 +158,10 @@ describe "Submitting Stripe Connect charge requests", type: :request do
         card = order.payments.completed.first.source
         expect(card.gateway_customer_profile_id).to eq customer_id
         expect(card.gateway_payment_profile_id).to eq card_id
+        expect(card.cc_type).to eq "master"
+        expect(card.last_digits).to eq "4321"
+        expect(card.first_name).to eq "Sammy"
+        expect(card.last_name).to eq "Signpost"
       end
     end
 

From 35912605c3dea5c2de8f55497c7048ad90728c9d Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 19 Jul 2017 16:01:58 +1000
Subject: [PATCH 242/353] Include customer name in source attrs for Stripe
 checkout requests

---
 app/assets/javascripts/darkswarm/services/checkout.js.coffee    | 2 ++
 .../javascripts/unit/darkswarm/services/checkout_spec.js.coffee | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/app/assets/javascripts/darkswarm/services/checkout.js.coffee b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
index d8d193b310..7d19c71799 100644
--- a/app/assets/javascripts/darkswarm/services/checkout.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
@@ -72,6 +72,8 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeJ
               last_digits: @secrets.card.last4
               month: @secrets.card.exp_month
               year: @secrets.card.exp_year
+              first_name: @order.bill_address.firstname
+              last_name: @order.bill_address.lastname
           }
       munged_order
 
diff --git a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
index a137b2f4ac..1a107776f0 100644
--- a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
@@ -197,6 +197,8 @@ describe 'Checkout service', ->
         expect(source_attributes.last_digits).toBe "1234"
         expect(source_attributes.year).toBe "2099"
         expect(source_attributes.month).toBe "10"
+        expect(source_attributes.first_name).toBe orderData.bill_address.firstname
+        expect(source_attributes.last_name).toBe orderData.bill_address.lastname
 
     describe "when a saved card from Stripe is used", ->
       beforeEach ->

From f317cee9e9aa7f99bc9cf54672e20e76e4354690 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 31 Jul 2017 11:47:32 +1000
Subject: [PATCH 243/353] Tweak UI for selecting an existing card at Checkout

---
 .../checkout/payment_controller.js.coffee          |  8 ++------
 .../spree/checkout/payment/_gateway.html.haml      | 10 +++++-----
 app/views/spree/checkout/payment/_stripe.html.haml | 14 +++++++++-----
 app/views/spree/users/_new_card_form.html.haml     |  8 ++++----
 config/locales/en.yml                              |  7 +++++++
 spec/features/consumer/shopping/checkout_spec.rb   |  9 +++++----
 6 files changed, 32 insertions(+), 24 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
index 236bf5fb14..04ff6ab45e 100644
--- a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
@@ -1,15 +1,11 @@
 Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards, Dates) ->
   angular.extend(this, new FieldsetMixin($scope))
-  defaultCard = [ {id: null, formatted: t("new_credit_card")} ]
-  $scope.savedCreditCards = defaultCard.concat savedCreditCards if savedCreditCards
-  $scope.selected_card = null
-
 
+  $scope.savedCreditCards = savedCreditCards
   $scope.name = "payment"
-
   $scope.months = Dates.months
-
   $scope.years = Dates.years
+
   $scope.secrets.card_month = "1"
   $scope.secrets.card_year = moment().year()
 
diff --git a/app/views/spree/checkout/payment/_gateway.html.haml b/app/views/spree/checkout/payment/_gateway.html.haml
index b78733ee01..0bcf038cb9 100644
--- a/app/views/spree/checkout/payment/_gateway.html.haml
+++ b/app/views/spree/checkout/payment/_gateway.html.haml
@@ -11,17 +11,17 @@
     %input{type: :text, "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.lastname"}
 
   .small-6.columns
-    = validated_input t(:card_number), "secrets.card_number", "ng-required" => "!secrets.selected_card", maxlength: 19, autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"
+    = validated_input t(:card_number), "secrets.card_number", maxlength: 19, autocomplete: "off"
   .small-6.columns
-    = validated_input t(:card_securitycode), "secrets.card_verification_value", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"
+    = validated_input t(:card_securitycode), "secrets.card_verification_value"
 
 .row
   .small-12.columns
     %label{for: "secrets.card_month"}
-      = t :card_expiry_date, "ng-disabled" => "!!secrets.selected_card"
+      = t :card_expiry_date
 
 .row
   .small-6.columns
-    %select{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
+    %select{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month"}
   .small-6.columns
-    %select{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
+    %select{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year"}
diff --git a/app/views/spree/checkout/payment/_stripe.html.haml b/app/views/spree/checkout/payment/_stripe.html.haml
index ad94b03e1b..885156dd5c 100644
--- a/app/views/spree/checkout/payment/_stripe.html.haml
+++ b/app/views/spree/checkout/payment/_stripe.html.haml
@@ -1,10 +1,14 @@
-.row{ "ng-show" => "savedCreditCards != null && savedCreditCards.length > 1" }
+.row{ "ng-show" => "savedCreditCards != null && savedCreditCards.length > 0" }
   .small-12.columns
-    %label
-      = t :previously_used_credit_cards
-    %select{"ng-model" => "secrets.selected_card", "ng-options" => "card.id as card.formatted for card in savedCreditCards", name: "selected_card", required: false}
+    %h6= t('.used_saved_card')
+    %select{ name: "selected_card", required: false, ng: { model: "secrets.selected_card", options: "card.id as card.formatted for card in savedCreditCards" } }
+      %option{ value: "" }= "{{ secrets.selected_card ? '#{t('.enter_new_card')}' : '#{t('.choose_one')}' }}"
 
-= render "spree/checkout/payment/gateway", payment_method: payment_method
+    %h6{ ng: { if: '!secrets.selected_card' } }
+      = t('.or_enter_new_card')
+
+%div{ ng: { if: '!secrets.selected_card' } }
+  = render "spree/checkout/payment/gateway", payment_method: payment_method
 
 :javascript
   Stripe.setPublishableKey("#{ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']}")
diff --git a/app/views/spree/users/_new_card_form.html.haml b/app/views/spree/users/_new_card_form.html.haml
index 03dc9ff1c5..ce1f14f1f1 100644
--- a/app/views/spree/users/_new_card_form.html.haml
+++ b/app/views/spree/users/_new_card_form.html.haml
@@ -14,11 +14,11 @@
     .small-6.columns
       %label
         = t(:card_number)
-      %input#card_number{type: :text, "ng-model" => "secrets.card_number", "ng-required" => "!secrets.selected_card", maxlength: 19, autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
+      %input#card_number{type: :text, "ng-model" => "secrets.card_number", maxlength: 19, autocomplete: "off"}
     .small-6.columns
       %label
         = t(:card_securitycode)
-      %input#security_code{type: :text, "ng-model" => "secrets.card_verification_value", "ng-required" => "!secrets.selected_card", autocomplete: "off", "ng-disabled" => "!!secrets.selected_card"}
+      %input#security_code{type: :text, "ng-model" => "secrets.card_verification_value", autocomplete: "off"}
 
   .row
     .small-12.columns
@@ -26,9 +26,9 @@
         = t(:card_expiry_date)
   .row
     .small-6.columns
-      %select#card_month{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
+      %select#card_month{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month"}
     .small-6.columns
-      %select#card_year{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year", "ng-required" => "!secrets.selected_card", "ng-disabled" => "!!secrets.selected_card"}
+      %select#card_year{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year"}
 
   %p
     %button.button.primary{type: :submit}
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 0043447e90..56b7163f4b 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2154,6 +2154,13 @@ Please follow the instructions there to make your enterprise visible on the Open
       variants:
         autocomplete:
           producer_name: Producer
+    checkout:
+      payment:
+        stripe:
+          choose_one: Choose one
+          enter_new_card: Enter details for a new card
+          used_saved_card: "Use a saved card:"
+          or_enter_new_card: "Or, enter details for a new card:"
     date_picker:
       format: ! '%Y-%m-%d'
       js_format: 'yy-mm-dd'
diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index 68a2f97585..1c4ea9bb65 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -169,15 +169,16 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
 
         it "allows use of a saved card" do
           # shows the saved credit card dropdown
-          page.should have_content "Previously Used Credit Cards"
+          expect(page).to have_content I18n.t("spree.checkout.payment.stripe.used_saved_card")
 
-          # disables the input fields when a saved card is selected" do
+          # removes the input fields when a saved card is selected"
+          expect(page).to have_input "secrets.card_number"
           select "Visa x-1111 Exp:01/2025", from: "selected_card"
-          page.should have_css "#secrets\\.card_number[disabled]"
+          expect(page).to_not have_input "secrets.card_number"
 
           # allows checkout
           place_order
-          page.should have_content "Your order has been processed successfully"
+          expect(page).to have_content "Your order has been processed successfully"
         end
       end
     end

From 3b78179deabb9192a02cf2e9f8811a92055ebecf Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 31 Jul 2017 12:46:41 +1000
Subject: [PATCH 244/353] Ask customer about saving card details used in
 checkout

---
 .../darkswarm/services/checkout.js.coffee     |   1 +
 app/models/spree/credit_card_decorator.rb     |   8 +
 app/models/spree/payment_decorator.rb         |   1 +
 .../spree/checkout/payment/_stripe.html.haml  |   5 +
 config/locales/en.yml                         |   1 +
 spec/requests/stripe_connect_checkout_spec.rb | 183 +++++++++++-------
 6 files changed, 128 insertions(+), 71 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/services/checkout.js.coffee b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
index 7d19c71799..cc17e4e032 100644
--- a/app/assets/javascripts/darkswarm/services/checkout.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
@@ -74,6 +74,7 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeJ
               year: @secrets.card.exp_year
               first_name: @order.bill_address.firstname
               last_name: @order.bill_address.lastname
+              save_requested_by_customer: @secrets.save_requested_by_customer
           }
       munged_order
 
diff --git a/app/models/spree/credit_card_decorator.rb b/app/models/spree/credit_card_decorator.rb
index 01b8bc0eba..69dadd6707 100644
--- a/app/models/spree/credit_card_decorator.rb
+++ b/app/models/spree/credit_card_decorator.rb
@@ -4,6 +4,10 @@ Spree::CreditCard.class_eval do
   # Obviously can be removed once we are using strong params
   attr_accessible :cc_type, :last_digits
 
+  # For holding customer preference in memory
+  attr_accessible :save_requested_by_customer
+  attr_writer :save_requested_by_customer
+
   # Should be able to remove once we reach Spree v2.2.0
   # https://github.com/spree/spree/commit/411010f3975c919ab298cb63962ee492455b415c
   belongs_to :payment_method
@@ -15,4 +19,8 @@ Spree::CreditCard.class_eval do
   def has_payment_profile? # rubocop:disable Style/PredicateName
     gateway_customer_profile_id.present? || gateway_payment_profile_id.present?
   end
+
+  def save_requested_by_customer?
+    !!@save_requested_by_customer
+  end
 end
diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index 568d82371a..84e3aa6d51 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -94,6 +94,7 @@ module Spree
 
     def create_payment_profile
       return unless source.is_a?(CreditCard)
+      return unless source.try(:save_requested_by_customer?)
       return unless source.number || source.gateway_payment_profile_id
       return unless source.gateway_customer_profile_id.nil?
       payment_method.create_profile(self)
diff --git a/app/views/spree/checkout/payment/_stripe.html.haml b/app/views/spree/checkout/payment/_stripe.html.haml
index 885156dd5c..398636cdd3 100644
--- a/app/views/spree/checkout/payment/_stripe.html.haml
+++ b/app/views/spree/checkout/payment/_stripe.html.haml
@@ -10,5 +10,10 @@
 %div{ ng: { if: '!secrets.selected_card' } }
   = render "spree/checkout/payment/gateway", payment_method: payment_method
 
+.row
+  .small-12.columns.text-right
+    = check_box_tag 'secrets.save_requested_by_customer'
+    = label_tag 'secrets.save_requested_by_customer', t('.remember_this_card')
+
 :javascript
   Stripe.setPublishableKey("#{ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']}")
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 56b7163f4b..e5d630e4cb 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2161,6 +2161,7 @@ Please follow the instructions there to make your enterprise visible on the Open
           enter_new_card: Enter details for a new card
           used_saved_card: "Use a saved card:"
           or_enter_new_card: "Or, enter details for a new card:"
+          remember_this_card: Remember this card?
     date_picker:
       format: ! '%Y-%m-%d'
       js_format: 'yy-mm-dd'
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index f89b681e89..d5cc332126 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -35,83 +35,124 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
   context "when a new card is submitted" do
     let(:store_response_mock) { { status: 200, body: JSON.generate(id: customer_id, default_card: card_id, sources: { data: [{id: "1"}] }) } }
-    let(:charge_response_mock) { { status: 200, body: JSON.generate(id: "ch_1234", object: "charge", amount: 2000) } }
     let(:token_response_mock) { { status: 200, body: JSON.generate(id: new_token) } }
+    let(:charge_response_mock) { { status: 200, body: JSON.generate(id: "ch_1234", object: "charge", amount: 2000) } }
 
-    before do
-      # Saves the card against the user
-      stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/customers")
-        .with(:body => { card: token, email: order.email})
-        .to_return(store_response_mock)
-
-      # Requests a token from the newly saved card
-      stub_request(:post, "https://api.stripe.com/v1/tokens")
-        .with(:body => { card: card_id, customer: customer_id})
-        .to_return(token_response_mock)
-
-      # Charges the card
-      stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
-        .with(:body => {"amount" => "1234", "card" => new_token, "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
-        .to_return(charge_response_mock)
-    end
-
-    context "and the store, token and charge requests are successful" do
-      it "should process the payment, and stores the card/customer details" do
-        put update_checkout_path, params
-        json_response = JSON.parse(response.body)
-        expect(json_response["path"]).to eq spree.order_path(order)
-        expect(order.payments.completed.count).to be 1
-        card = order.payments.completed.first.source
-        expect(card.gateway_customer_profile_id).to eq customer_id
-        expect(card.gateway_payment_profile_id).to eq card_id
-        expect(card.cc_type).to eq "visa"
-        expect(card.last_digits).to eq "4242"
-        expect(card.first_name).to eq "Jill"
-        expect(card.last_name).to eq "Jeffreys"
-      end
-    end
-
-    context "when the store request returns an error message" do
-      let(:store_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
-
-      it "should not process the payment" do
-        put update_checkout_path, params
-        expect(response.status).to be 400
-        json_response = JSON.parse(response.body)
-        expect(json_response["flash"]["error"]).to eq I18n.t(:spree_gateway_error_flash_for_checkout, error: 'Bup-bow...')
-        expect(order.payments.completed.count).to be 0
-      end
-    end
-
-    context "when the charge request returns an error message" do
-      let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
-
-      it "should not process the payment" do
-        put update_checkout_path, params
-        expect(response.status).to be 400
-        json_response = JSON.parse(response.body)
-        expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
-        expect(order.payments.completed.count).to be 0
-      end
-    end
-
-    context "when the token request returns an error message" do
-      let(:token_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
-      let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
-
+    context "and the user doesn't request that the card is saved for later" do
       before do
-        # Attempts to charge the card without a token, which will return an error
+        # Charges the card
         stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
-          .with(:body => {"amount" => "1234", "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
+          .with(:body => {"amount" => "1234", "card" => token, "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
           .to_return(charge_response_mock)
       end
 
-      it "should not process the payment" do
-        put update_checkout_path, params
-        expect(response.status).to be 400
-        json_response = JSON.parse(response.body)
-        expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
-        expect(order.payments.completed.count).to be 0
+      context "and the charge request is successful" do
+        it "should process the payment without storing card details" do
+          put update_checkout_path, params
+          json_response = JSON.parse(response.body)
+          expect(json_response["path"]).to eq spree.order_path(order)
+          expect(order.payments.completed.count).to be 1
+          card = order.payments.completed.first.source
+          expect(card.gateway_customer_profile_id).to eq nil
+          expect(card.gateway_payment_profile_id).to eq token
+          expect(card.cc_type).to eq "visa"
+          expect(card.last_digits).to eq "4242"
+          expect(card.first_name).to eq "Jill"
+          expect(card.last_name).to eq "Jeffreys"
+        end
+      end
+
+      context "when the charge request returns an error message" do
+        let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+
+        it "should not process the payment" do
+          put update_checkout_path, params
+          expect(response.status).to be 400
+          json_response = JSON.parse(response.body)
+          expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
+          expect(order.payments.completed.count).to be 0
+        end
+      end
+    end
+
+    context "and the customer requests that the card is saved for later" do
+      before do
+        params[:order][:payments_attributes][0][:source_attributes][:save_requested_by_customer] = '1'
+
+        # Saves the card against the user
+        stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/customers")
+          .with(:body => { card: token, email: order.email})
+          .to_return(store_response_mock)
+
+        # Requests a token from the newly saved card
+        stub_request(:post, "https://api.stripe.com/v1/tokens")
+          .with(:body => { card: card_id, customer: customer_id})
+          .to_return(token_response_mock)
+
+        # Charges the card
+        stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
+          .with(:body => {"amount" => "1234", "card" => new_token, "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
+          .to_return(charge_response_mock)
+      end
+
+      context "and the store, token and charge requests are successful" do
+        it "should process the payment, and stores the card/customer details" do
+          put update_checkout_path, params
+          json_response = JSON.parse(response.body)
+          expect(json_response["path"]).to eq spree.order_path(order)
+          expect(order.payments.completed.count).to be 1
+          card = order.payments.completed.first.source
+          expect(card.gateway_customer_profile_id).to eq customer_id
+          expect(card.gateway_payment_profile_id).to eq card_id
+          expect(card.cc_type).to eq "visa"
+          expect(card.last_digits).to eq "4242"
+          expect(card.first_name).to eq "Jill"
+          expect(card.last_name).to eq "Jeffreys"
+        end
+      end
+
+      context "when the store request returns an error message" do
+        let(:store_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+
+        it "should not process the payment" do
+          put update_checkout_path, params
+          expect(response.status).to be 400
+          json_response = JSON.parse(response.body)
+          expect(json_response["flash"]["error"]).to eq I18n.t(:spree_gateway_error_flash_for_checkout, error: 'Bup-bow...')
+          expect(order.payments.completed.count).to be 0
+        end
+      end
+
+      context "when the charge request returns an error message" do
+        let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+
+        it "should not process the payment" do
+          put update_checkout_path, params
+          expect(response.status).to be 400
+          json_response = JSON.parse(response.body)
+          expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
+          expect(order.payments.completed.count).to be 0
+        end
+      end
+
+      context "when the token request returns an error message" do
+        let(:token_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+        let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+
+        before do
+          # Attempts to charge the card without a token, which will return an error
+          stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
+            .with(:body => {"amount" => "1234", "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
+            .to_return(charge_response_mock)
+        end
+
+        it "should not process the payment" do
+          put update_checkout_path, params
+          expect(response.status).to be 400
+          json_response = JSON.parse(response.body)
+          expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
+          expect(order.payments.completed.count).to be 0
+        end
       end
     end
   end
@@ -131,8 +172,8 @@ describe "Submitting Stripe Connect charge requests", type: :request do
       )
     end
 
-    let(:charge_response_mock) { { status: 200, body: JSON.generate(id: "ch_1234", object: "charge", amount: 2000) } }
     let(:token_response_mock) { { status: 200, body: JSON.generate(id: new_token) } }
+    let(:charge_response_mock) { { status: 200, body: JSON.generate(id: "ch_1234", object: "charge", amount: 2000) } }
 
     before do
       params[:order][:existing_card] = credit_card.id

From 862443ed6d16cb6d9fc6eee6783e80d11cfdf9f2 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 31 Jul 2017 13:24:56 +1000
Subject: [PATCH 245/353] Add hash navigation to admin Enterprise edit view

---
 .../controllers/side_menu_controller.js.coffee    |  2 +-
 .../admin/side_menu/services/side_menu.js.coffee  | 15 ++++++++++++++-
 .../side_menu_controller_spec.js.coffee           |  3 ++-
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/app/assets/javascripts/admin/enterprises/controllers/side_menu_controller.js.coffee b/app/assets/javascripts/admin/enterprises/controllers/side_menu_controller.js.coffee
index fa346e100f..c69e109236 100644
--- a/app/assets/javascripts/admin/enterprises/controllers/side_menu_controller.js.coffee
+++ b/app/assets/javascripts/admin/enterprises/controllers/side_menu_controller.js.coffee
@@ -22,7 +22,7 @@ angular.module("admin.enterprises")
       { name: 'users', label: t('users'), icon_class: "icon-user" }
     ]
 
-    $scope.select(0)
+    SideMenu.init()
 
     $scope.showItem = (item) ->
       if item.show?
diff --git a/app/assets/javascripts/admin/side_menu/services/side_menu.js.coffee b/app/assets/javascripts/admin/side_menu/services/side_menu.js.coffee
index 020f0981d8..4f6fe5ab59 100644
--- a/app/assets/javascripts/admin/side_menu/services/side_menu.js.coffee
+++ b/app/assets/javascripts/admin/side_menu/services/side_menu.js.coffee
@@ -1,9 +1,21 @@
 angular.module("admin.side_menu")
-  .factory "SideMenu", ->
+  .factory "SideMenu", ($location) ->
     new class SideMenu
       items: []
       selected: null
 
+
+      # Checks for path and uses it to set the view
+      # If no path, loads first view
+      init: =>
+        path = $location.path()?.match(/^\/\w+$/)?[0]
+        index = if path
+          name = path[1..]
+          @items.indexOf(@find_by_name(name))
+        else
+          0
+        @select(index)
+
       setItems: (items) =>
         @items = items
         item.visible = true for item in @items
@@ -13,6 +25,7 @@ angular.module("admin.side_menu")
           @selected.selected = false if @selected
           @selected = @items[index]
           @selected.selected = true
+          $location.path(@selected.name)
 
       find_by_name: (name) =>
         for item in @items when item.name is name
diff --git a/spec/javascripts/unit/admin/enterprises/controllers/side_menu_controller_spec.js.coffee b/spec/javascripts/unit/admin/enterprises/controllers/side_menu_controller_spec.js.coffee
index c4a724a137..c168047ccf 100644
--- a/spec/javascripts/unit/admin/enterprises/controllers/side_menu_controller_spec.js.coffee
+++ b/spec/javascripts/unit/admin/enterprises/controllers/side_menu_controller_spec.js.coffee
@@ -17,6 +17,7 @@ describe "menuCtrl", ->
     inject ($rootScope, $controller, _SideMenu_) ->
       scope = $rootScope
       SideMenu = _SideMenu_
+      spyOn(SideMenu, "init").and.callThrough()
       spyOn(SideMenu, "select").and.callThrough()
       spyOn(SideMenu, "setItems").and.callThrough()
       ctrl = $controller 'sideMenuCtrl', {$scope: scope, enterprise: enterprise, SideMenu: SideMenu, enterprisePermissions: {}}
@@ -30,7 +31,7 @@ describe "menuCtrl", ->
       expect(scope.menu.items).toBe SideMenu.items
 
     it "sets the initally selected value", ->
-      expect(SideMenu.select).toHaveBeenCalledWith 0
+      expect(SideMenu.init).toHaveBeenCalled()
 
 
   describe "selecting an item", ->

From 7c406f7c3a2e09278a7af5850ce381651c135450 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 31 Jul 2017 13:38:55 +1000
Subject: [PATCH 246/353] Use hash navigation to direct users to
 #/payment_methods from Stripe PM

---
 .../payment_methods/controllers/stripe_controller.js.coffee     | 2 +-
 spec/features/admin/payment_method_spec.rb                      | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee b/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
index 575a7995a9..2e55dae3a0 100644
--- a/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
+++ b/app/assets/javascripts/admin/payment_methods/controllers/stripe_controller.js.coffee
@@ -15,4 +15,4 @@ angular.module("admin.paymentMethods").controller "StripeController", ($scope, $
     permalink = shops.filter((shop) ->
       shop.id == $scope.paymentMethod.preferred_enterprise_id
     )[0].permalink
-    "/admin/enterprises/#{permalink}/edit#stripe"
+    "/admin/enterprises/#{permalink}/edit#/payment_methods"
diff --git a/spec/features/admin/payment_method_spec.rb b/spec/features/admin/payment_method_spec.rb
index b856cd5807..9df6ef0114 100644
--- a/spec/features/admin/payment_method_spec.rb
+++ b/spec/features/admin/payment_method_spec.rb
@@ -54,6 +54,8 @@ feature %q{
 
         select2_select "Missing", from: "payment_method_preferred_enterprise_id"
         expect(page).to have_selector "#stripe-account-status .alert-box.error", text: I18n.t("spree.admin.payment_methods.stripe_connect.account_missing_msg")
+        connect_one = I18n.t("spree.admin.payment_methods.stripe_connect.connect_one")
+        expect(page).to have_link connect_one, href: edit_admin_enterprise_path(missing_account_enterprise, anchor: "/payment_methods")
 
         select2_select "Revoked", from: "payment_method_preferred_enterprise_id"
         expect(page).to have_selector "#stripe-account-status .alert-box.error", text: I18n.t("spree.admin.payment_methods.stripe_connect.access_revoked_msg")

From 8cae874109f0c3f3534372879f509a5292f88de2 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 31 Jul 2017 13:56:42 +1000
Subject: [PATCH 247/353] Fix styling on jquery dialogs

---
 .../admin/components/jquery_dialog.scss       | 29 ++++++++++++++-----
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/app/assets/stylesheets/admin/components/jquery_dialog.scss b/app/assets/stylesheets/admin/components/jquery_dialog.scss
index f3fe08da60..35f410dbb6 100644
--- a/app/assets/stylesheets/admin/components/jquery_dialog.scss
+++ b/app/assets/stylesheets/admin/components/jquery_dialog.scss
@@ -42,21 +42,25 @@ light: #ccc
 .ui-dialog .ui-corner-all{
   border-radius: 8px;
 }
-.ui-dialog  {
-  .ui-state-hover, .ui-state-focus{
-    border: none;
-    background: none;
-    color: #545454;
-  }
-}
+// .ui-dialog  {
+//   .ui-state-hover, .ui-state-focus{
+//     border: none;
+//     background: none;
+//     color: #545454;
+//   }
+// }
 
 .ui-state-hover, .ui-widget-header .ui-state-hover, .ui-widget-content .ui-state-hover {
   background-color: #ffffff;
   background: none;
 }
 
-.ui-dialog-titlebar-close {
+.ui-dialog .ui-dialog-titlebar .ui-dialog-titlebar-close {
   float: right;
+
+  border: none;
+  background: none;
+
   &:before {
     color: #000000;
     font-size: 2em;
@@ -76,9 +80,18 @@ light: #ccc
       display: none;
     }
   }
+
+  .ui-button-text {
+    display: none;
+  }
 }
 
 .ui-widget-overlay {
   background: #000000;
   opacity: 0.5;
+  position: fixed;
+  height: 100vh;
+  width: 100vw;
+  left: 0px;
+  top: 0px;
 }

From 589c2a150065a04c6f306e2dd617cc8ec01b0ef3 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 31 Jul 2017 17:26:56 +1000
Subject: [PATCH 248/353] Add a modal to handle explanation of user's
 responsibilities before redirecting to Stripe

---
 .../admin/openfoodnetwork.css.scss            |  7 +++++
 .../form/_stripe_connect.html.haml            | 12 +++------
 .../stripe_connect/_confirm_modal.html.haml   | 27 +++++++++++++++++++
 config/locales/en.yml                         |  9 ++++++-
 4 files changed, 46 insertions(+), 9 deletions(-)
 create mode 100644 app/views/admin/enterprises/form/stripe_connect/_confirm_modal.html.haml

diff --git a/app/assets/stylesheets/admin/openfoodnetwork.css.scss b/app/assets/stylesheets/admin/openfoodnetwork.css.scss
index df55d3065b..4c520108a9 100644
--- a/app/assets/stylesheets/admin/openfoodnetwork.css.scss
+++ b/app/assets/stylesheets/admin/openfoodnetwork.css.scss
@@ -43,6 +43,13 @@ input.red {
   margin-right: 5px;
 }
 
+a.button.red {
+  &:not(:hover) {
+    color: #fff;
+    background-color: #DA5354;
+  }
+}
+
 input.orange {
 	background-color: #FF9848;
   margin-right: 5px;
diff --git a/app/views/admin/enterprises/form/_stripe_connect.html.haml b/app/views/admin/enterprises/form/_stripe_connect.html.haml
index b1ed3802e6..be0f4dd157 100644
--- a/app/views/admin/enterprises/form/_stripe_connect.html.haml
+++ b/app/views/admin/enterprises/form/_stripe_connect.html.haml
@@ -1,3 +1,5 @@
+= render 'admin/enterprises/form/stripe_connect/confirm_modal'
+
 - if @stripe_account = @enterprise.stripe_account
   .stripe-info
     .row
@@ -7,13 +9,7 @@
 - else
   .row.stripe-info
     .six.columns.alpha
-      -# Recommended info to impart (from Stripe Connect docs):
-      -# indicate to the user what you’re responsible for and what they’ll be expected to do. It’s particularly important to communicate:
-      -# That they’ll need to create and maintain their Stripe account.
-      -# That they’ll need to handle chargebacks and all customer service issues.
-      -# Who is responsible for paying the Stripe fees.
-      -# What, if any, fees the platform charges.
-      =t('.stripe_connect_info')
+      =t('.stripe_connect_intro')
     .five.columns.omega.text-right
-      %a.stripe-connect{ href: main_app.connect_admin_stripe_accounts_path(enterprise_id: @enterprise) }
+      %a.stripe-connect.help-modal{ template: 'admin/modals/stripe_connect_confirm.html' }
         %span= t('.connect_with_stripe')
diff --git a/app/views/admin/enterprises/form/stripe_connect/_confirm_modal.html.haml b/app/views/admin/enterprises/form/stripe_connect/_confirm_modal.html.haml
new file mode 100644
index 0000000000..ac16e619a5
--- /dev/null
+++ b/app/views/admin/enterprises/form/stripe_connect/_confirm_modal.html.haml
@@ -0,0 +1,27 @@
+%script{ type: "text/ng-template", id: "admin/modals/stripe_connect_confirm.html" }
+  -# Recommended info to impart (from Stripe Connect docs):
+  -# indicate to the user what you’re responsible for and what they’ll be expected to do. It’s particularly important to communicate:
+  -# That they’ll need to create and maintain their Stripe account.
+  -# That they’ll need to handle chargebacks and all customer service issues.
+  -# Who is responsible for paying the Stripe fees.
+  -# What, if any, fees the platform charges.
+
+  #stripe-connect-confirm
+    .margin-bottom-30.text-center
+      .text-big
+        = t('.title')
+
+    .margin-bottom-30
+      %p= t('.part1')
+
+    .margin-bottom-30
+      %p= t('.part2')
+
+    .margin-bottom-30
+      %p= t('.part3')
+
+    .text-center
+      %a.button.icon-ok{ href: main_app.connect_admin_stripe_accounts_path(enterprise_id: @enterprise) }
+        = t('.i_agree')
+      %a.button.red.icon-remove{ href: 'javascript:void(0)', ng: { click: 'close()' } }
+        = t('.cancel')
diff --git a/config/locales/en.yml b/config/locales/en.yml
index e5d630e4cb..79b375c34e 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -525,9 +525,16 @@ en:
           twitter_placeholder: eg. @the_prof
         stripe_connect:
           connect_with_stripe: "Connect with Stripe"
-          stripe_connect_info: "Connect your Stripe account by clicking the button below. This will allow Open Food Network to charge your customers on your behalf. You will need to maintain your Stripe account, pay Stripe fees and handle any chargebacks and customer service."
+          stripe_connect_intro: "To accept payments using credit card, you will need to connect your stripe account to the Open Food Network. Use the button to the right to get started."
           stripe_account_connected: "Stripe account connected."
           disconnect: "Disconnect account"
+          confirm_modal:
+            title: Connect with Stripe
+            part1: Stripe is a payment processing service that allows shops on the OFN to accept credit card payments from customers.
+            part2: To use this feature, you must connect your Stripe account the OFN. Clicking 'I Agree' below will redirect to you the Stripe website where you can connect an existing Stripe account to your OFN, or create a new one if you don't already have one.
+            part3: This will allow the Open Food Network to accept credit card payments from customers on your behalf. Please note that you will need to maintain your own Stripe account, pay the fees Stripe charges and handle any chargebacks and customer service yourself.
+            i_agree: I Agree
+            cancel: Cancel
         tag_rules:
           default_rules:
             by_default: By Default

From 2f6493bb8642f67b82a00f4b5947f71fed42a5bc Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 31 Jul 2017 17:29:02 +1000
Subject: [PATCH 249/353] Use ng-cloak for admin/enterprises/edit form

---
 app/views/admin/enterprises/_ng_form.html.haml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/admin/enterprises/_ng_form.html.haml b/app/views/admin/enterprises/_ng_form.html.haml
index 7d645b9860..f635ad95c4 100644
--- a/app/views/admin/enterprises/_ng_form.html.haml
+++ b/app/views/admin/enterprises/_ng_form.html.haml
@@ -4,7 +4,7 @@
 = form_for [main_app, :admin, @enterprise], html: { name: "enterprise_form",
   "ng-controller" => 'enterpriseCtrl',
   'onchange' => 'angular.element(enterprise_form).scope().setFormDirty()',
-  } do |f|
+  "ng-cloak" => true } do |f|
 
   %save-bar{ dirty: "enterprise_form.$dirty", persist: "true" }
     %input.red{ type: "button", value: t(:update), ng: { click: "submit()", disabled: "!enterprise_form.$dirty" } }

From a04116466edfef396d5eafff48af97c72ff428b9 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 2 Aug 2017 15:36:33 +1000
Subject: [PATCH 250/353] Fix js for switching form partial for new admin
 payments

All of the functional changes made in this commit came from a future version of Spree:
https://github.com/spree/spree/commit/8a3a80b08abf80fbed2fcee4b429ba1caf68baf1
---
 app/assets/javascripts/admin/payments/new.js  | 33 +++++++++++
 app/views/spree/admin/payments/_form.html.erb | 34 +++++++++++
 .../payments/source_forms/_gateway.html.erb   | 58 +++++++++++++++++++
 3 files changed, 125 insertions(+)
 create mode 100644 app/assets/javascripts/admin/payments/new.js
 create mode 100644 app/views/spree/admin/payments/_form.html.erb
 create mode 100644 app/views/spree/admin/payments/source_forms/_gateway.html.erb

diff --git a/app/assets/javascripts/admin/payments/new.js b/app/assets/javascripts/admin/payments/new.js
new file mode 100644
index 0000000000..e50c348daa
--- /dev/null
+++ b/app/assets/javascripts/admin/payments/new.js
@@ -0,0 +1,33 @@
+// Override of Spree's logic in the file of the same name
+// Changes made as per https://github.com/spree/spree/commit/8a3a80b08abf80fbed2fcee4b429ba1caf68baf1
+// which allows the form partial in admin/payments/new to be switched using radio buttons
+// We can remove this file when we reach 2.3.0
+
+$(document).ready(function() {
+  if ($("#new_payment").is("*")) {
+    $('.payment_methods_radios').click(
+      function() {
+        $('.payment-methods').hide();
+        if (this.checked) {
+          $('#payment_method_' + this.value).show();
+        }
+      }
+    );
+
+    $('.payment_methods_radios').each(
+      function() {
+        if (this.checked) {
+          $('#payment_method_' + this.value).show();
+        } else {
+          $('#payment_method_' + this.value).hide();
+        }
+      }
+    );
+
+    $(".card_new").radioControlsVisibilityOfElement('.card_form');
+
+    $('select.jump_menu').change(function(){
+      window.location = this.options[this.selectedIndex].value;
+    });
+  }
+});
diff --git a/app/views/spree/admin/payments/_form.html.erb b/app/views/spree/admin/payments/_form.html.erb
new file mode 100644
index 0000000000..fe019007b1
--- /dev/null
+++ b/app/views/spree/admin/payments/_form.html.erb
@@ -0,0 +1,34 @@
+<div data-hook="admin_payment_form_fields" class="row">
+  <div class="alpha three columns">
+    <div class="field">
+      <%= f.label :amount, t(:amount) %>
+      <%= f.text_field :amount, :value => @order.outstanding_balance, :class => 'fullwidth' %>
+    </div>
+  </div>
+  <div class="omega nine columns">
+    <div class="field">
+      <label><%= t(:payment_method) %></label>
+      <ul>
+        <% @payment_methods.each do |method| %>
+          <li>
+            <label data-hook="payment_method_field">
+              <%= radio_button_tag 'payment[payment_method_id]', method.id, method == @payment_method, { class: "payment_methods_radios" } %>
+              <%= t(method.name, :scope => :payment_methods, :default => method.name) %>
+            </label>
+          </li>
+        <% end %>
+      </ul>
+
+      <div class="payment-method-settings">
+        <% @payment_methods.each do |method| %>
+          <div class="payment-methods" id="payment_method_<%= method.id %>">
+            <% if method.source_required? %>
+              <br />
+              <%= render :partial => "spree/admin/payments/source_forms/#{method.method_type}", :locals => { :payment_method => method } %>
+            <% end %>
+          </div>
+        <% end %>
+      </div>
+    </div>
+  </div>
+</div>
diff --git a/app/views/spree/admin/payments/source_forms/_gateway.html.erb b/app/views/spree/admin/payments/source_forms/_gateway.html.erb
new file mode 100644
index 0000000000..8cf4b914cc
--- /dev/null
+++ b/app/views/spree/admin/payments/source_forms/_gateway.html.erb
@@ -0,0 +1,58 @@
+<fieldset class="no-border-bottom">
+  <div class="field" data-hook="previous_cards">
+    <% @previous_cards.each do |card| %>
+      <label><%= radio_button_tag :card, card.id, card == @previous_cards.first %> <%= card.display_number %><br /></label>
+    <% end %>
+    <label><%= radio_button_tag :card, 'new', @previous_cards.none?, { class: "card_new" } %> <%= t(:use_new_cc) %></label>
+  </div>
+
+  <div class="card_form" data-hook>
+    <% param_prefix = "payment_source[#{payment_method.id}]" %>
+
+    <div class="clear"></div>
+
+    <div class="alpha four columns">
+      <div data-hook="card_number">
+        <div class="field">
+          <%= hidden_field_tag "#{param_prefix}[cc_type]", '', {class: 'ccType'} %>
+          <%= label_tag "card_number#{payment_method.id}", raw(t(:card_number) + content_tag(:span, ' *', :class => 'required')) %>
+          <%= text_field_tag "#{param_prefix}[number]", '', :class => 'required fullwidth cardNumber', :id => "card_number#{payment_method.id}", :maxlength => 19 %>
+          <span id="card_type" style="display:none;">
+            ( <span id="looks_like" ><%= t(:card_type_is) %> <span id="type"></span></span>
+              <span id="unrecognized"><%= t(:unrecognized_card_type) %></span>
+            )
+          </span>
+        </div>
+      </div>
+    </div>
+    <div class="alpha four columns">
+      <div data-hook="card_name">
+        <div class="field">
+          <%= label_tag "card_name#{payment_method.id}", raw(t(:name) + content_tag(:span, ' *', :class => 'required')) %>
+          <%= text_field_tag "#{param_prefix}[name]", '', id: "card_name#{payment_method.id}", class: 'required fullwidth', maxlength: 19 %>
+        </div>
+      </div>
+    </div>
+    <div class="three columns">
+      <div data-hook="card_expiration" class="field">
+        <%= label_tag "card_expiry#{payment_method.id}", raw(t(:expiration) + content_tag(:span, ' *', :class => 'required')) %><br>
+        <%= text_field_tag "#{param_prefix}[expiry]", '', id: "card_expiry#{payment_method.id}", class: "required cardExpiry", placeholder: "MM / YY" %>
+      </div>
+    </div>
+    <div class="omega two columns">
+      <div data-hook="card_code" class="field">
+        <%= label_tag "card_code#{payment_method.id}", raw(t(:card_code) + content_tag(:span, ' *', :class => "required")) %>
+        <%= text_field_tag "#{param_prefix}[verification_value]", '', id: "card_code#{payment_method.id}", class: 'required fullwidth cardCode', size: 5 %>
+        <a href="/content/cvv" class="info cvvLink" target="_blank">
+          (<%= t(:what_is_this) %>)
+        </a>
+      </div>
+    </div>
+
+    <div class="nine columns">
+      <%= image_tag 'credit_cards/credit_card.gif', :class => 'credit-card-image' %>
+    </div>
+
+    <div class="clear"></div>
+  </div>
+</fieldset>

From fab893e60b1edbb2d667c7545c8d7975a8a3e55b Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 2 Aug 2017 16:40:09 +1000
Subject: [PATCH 251/353] Fix paypal source_form view

The previous commit broke the selectors used by app/assets/javascripts/spree/backend/paypal_express.js
in the better_spree_paypal_express gem.

We can remove this override of the paypal source_form view when we update better_spree_paypal_express
to a version that includes the following commit:
https://github.com/spree-contrib/better_spree_paypal_express/commit/4360a1fb82d30d7601bc6a98e7b74819f0b377f0
---
 .../spree/admin/payments/source_forms/_paypal.html.haml   | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 app/views/spree/admin/payments/source_forms/_paypal.html.haml

diff --git a/app/views/spree/admin/payments/source_forms/_paypal.html.haml b/app/views/spree/admin/payments/source_forms/_paypal.html.haml
new file mode 100644
index 0000000000..e26db66846
--- /dev/null
+++ b/app/views/spree/admin/payments/source_forms/_paypal.html.haml
@@ -0,0 +1,8 @@
+-# We can remove this file as soon as we have a version of better_spree_paypal_express that includes:
+-# https://github.com/spree-contrib/better_spree_paypal_express/commit/4360a1fb82d30d7601bc6a98e7b74819f0b377f0
+
+-# The selectors in app/assets/javascripts/spree/backend/paypal_express.js don't work with the version
+-# of the views we are using, so the warning below wasn't displaying without this override.
+
+#paypal-warning
+  %strong= t('no_payment_via_admin_backend', :scope => 'paypal')

From 11daf89005593bc6ac5226dbabcc4429f9fd9c66 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 2 Aug 2017 16:56:01 +1000
Subject: [PATCH 252/353] Add admin views for Stripe payment methods

These views were pretty much just copied from https://github.com/spree/spree_gateway
---
 app/views/spree/admin/payments/source_forms/_stripe.html.haml | 4 ++++
 app/views/spree/admin/payments/source_views/_stripe.html.haml | 1 +
 config/locales/en.yml                                         | 4 ++++
 3 files changed, 9 insertions(+)
 create mode 100644 app/views/spree/admin/payments/source_forms/_stripe.html.haml
 create mode 100644 app/views/spree/admin/payments/source_views/_stripe.html.haml

diff --git a/app/views/spree/admin/payments/source_forms/_stripe.html.haml b/app/views/spree/admin/payments/source_forms/_stripe.html.haml
new file mode 100644
index 0000000000..24bde74a31
--- /dev/null
+++ b/app/views/spree/admin/payments/source_forms/_stripe.html.haml
@@ -0,0 +1,4 @@
+-# = render "spree/admin/payments/source_forms/gateway", payment_method: payment_method
+
+%strong
+  = t('.no_payment_via_admin_backend')
diff --git a/app/views/spree/admin/payments/source_views/_stripe.html.haml b/app/views/spree/admin/payments/source_views/_stripe.html.haml
new file mode 100644
index 0000000000..64af07bd3b
--- /dev/null
+++ b/app/views/spree/admin/payments/source_views/_stripe.html.haml
@@ -0,0 +1 @@
+= render "spree/admin/payments/source_views/gateway", payment: payment
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 79b375c34e..799e9c402b 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2130,6 +2130,10 @@ Please follow the instructions there to make your enterprise visible on the Open
           account_id: Account ID
           business_name: Business Name
           charges_enabled: Charges Enabled
+      payments:
+        source_forms:
+          stripe:
+            no_payment_via_admin_backend: Creating Stripe-based payments from the admin backend is not possible at this time
       products:
         new:
           title: 'New Product'

From 1f8890b430122e9e8052a17a5f7fdf48c2f42a55 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 3 Aug 2017 11:01:04 +1000
Subject: [PATCH 253/353] Use an explicit date format for
 PaymentsSerializer#updated_at

---
 app/serializers/api/payment_serializer.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/serializers/api/payment_serializer.rb b/app/serializers/api/payment_serializer.rb
index f610fcdb58..f0d91cce72 100644
--- a/app/serializers/api/payment_serializer.rb
+++ b/app/serializers/api/payment_serializer.rb
@@ -10,7 +10,7 @@ module Api
     end
 
     def updated_at
-      I18n.l(object.updated_at, format: :long)
+      I18n.l(object.updated_at, format: "%b %d, %Y %H:%M")
     end
   end
 end

From 4865533f2673a42c27c513ca632877277fb36ad1 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 3 Aug 2017 16:29:30 +1000
Subject: [PATCH 254/353] Restrict edit permissions on Stripe payment methods

---
 .../payment_methods_controller_decorator.rb   | 11 +++++++
 .../payment_methods/_stripe_connect.html.haml | 11 ++++---
 .../admin/payment_methods_controller_spec.rb  | 31 +++++++++++++++++++
 3 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/app/controllers/spree/admin/payment_methods_controller_decorator.rb b/app/controllers/spree/admin/payment_methods_controller_decorator.rb
index 2456f7c5aa..8c96ccd943 100644
--- a/app/controllers/spree/admin/payment_methods_controller_decorator.rb
+++ b/app/controllers/spree/admin/payment_methods_controller_decorator.rb
@@ -1,6 +1,7 @@
 module Spree
   module Admin
     PaymentMethodsController.class_eval do
+      before_filter :restrict_stripe_account_change, only: [:update]
       before_filter :force_environment, only: [:create, :update]
       skip_before_filter :load_resource, only: [:show_provider_preferences]
       before_filter :load_hubs, only: [:new, :edit, :update]
@@ -70,6 +71,16 @@ module Spree
       def show_stripe?
         Spree::Config.stripe_connect_enabled || @payment_method.try(:type) == "Spree::Gateway::StripeConnect"
       end
+
+      def restrict_stripe_account_change
+        return unless @payment_method.try(:type) == "Spree::Gateway::StripeConnect"
+        return unless @payment_method.preferred_enterprise_id
+
+        @stripe_account_holder = Enterprise.find(@payment_method.preferred_enterprise_id)
+        unless spree_current_user.enterprises.include? @stripe_account_holder
+          params[:payment_method][:preferred_enterprise_id] = @stripe_account_holder.id
+        end
+      end
     end
   end
 end
diff --git a/app/views/spree/admin/payment_methods/_stripe_connect.html.haml b/app/views/spree/admin/payment_methods/_stripe_connect.html.haml
index 9ccc733720..0e9ff2f614 100644
--- a/app/views/spree/admin/payment_methods/_stripe_connect.html.haml
+++ b/app/views/spree/admin/payment_methods/_stripe_connect.html.haml
@@ -5,10 +5,13 @@
     = fields_for :payment_method, @payment_method do |payment_method_form|
       = payment_method_form.label :stripe_account_owner
       %br
-      %input.ofn-select2.fullwidth#payment_method_preferred_enterprise_id{ type: 'number',
-        name: 'payment_method[preferred_enterprise_id]',
-        placeholder: t(".enterprise_select_placeholder"),
-        data: 'shops', ng: { model: 'paymentMethod.preferred_enterprise_id' } }
+      - if @stripe_account_holder.nil? || spree_current_user.enterprises.include?(@stripe_account_holder)
+        %input.ofn-select2.fullwidth#payment_method_preferred_enterprise_id{ type: 'number',
+          name: 'payment_method[preferred_enterprise_id]',
+          placeholder: t(".enterprise_select_placeholder"),
+          data: 'shops', ng: { model: 'paymentMethod.preferred_enterprise_id' } }
+      - else
+        %strong= Enterprise.find_by_id(@payment_method).andand.name
 
     #stripe-account-status{ ng: { show: "paymentMethod.preferred_enterprise_id" } }
       .alert-box.warning{ ng: { hide: "stripe_account.status" } }
diff --git a/spec/controllers/spree/admin/payment_methods_controller_spec.rb b/spec/controllers/spree/admin/payment_methods_controller_spec.rb
index c27fe16f19..b3942bfa92 100644
--- a/spec/controllers/spree/admin/payment_methods_controller_spec.rb
+++ b/spec/controllers/spree/admin/payment_methods_controller_spec.rb
@@ -1,6 +1,37 @@
 require 'spec_helper'
 
 describe Spree::Admin::PaymentMethodsController do
+  describe "#update" do
+    context "on a StripeConnect payment method" do
+      let!(:user) { create(:user, enterprise_limit: 2) }
+      let!(:enterprise1) { create(:distributor_enterprise, owner: user) }
+      let!(:enterprise2) { create(:distributor_enterprise, owner: create(:user)) }
+      let!(:payment_method) { create(:stripe_payment_method, distributor_ids: [enterprise1.id, enterprise2.id], preferred_enterprise_id: enterprise2.id) }
+
+      before { allow(controller).to receive(:spree_current_user) { user } }
+
+      context "when an attempt is made to change the stripe account holder (preferred_enterprise_id)" do
+        let(:params) { { id: payment_method.id, payment_method: { type: "Spree::Gateway::StripeConnect", preferred_enterprise_id: enterprise1.id } } }
+
+        context "as a user that does not manage the existing stripe account holder" do
+          it "prevents the stripe account holder from being updated" do
+            spree_put :update, params
+            expect(payment_method.reload.preferred_enterprise_id).to eq enterprise2.id
+          end
+        end
+
+        context "as a user that does not manage the existing stripe account holder" do
+          before { enterprise2.update_attributes!(owner_id: user.id) }
+
+          it "allows the stripe account holder to be updated" do
+            spree_put :update, params
+            expect(payment_method.reload.preferred_enterprise_id).to eq enterprise1.id
+          end
+        end
+      end
+    end
+  end
+
   context "Requesting provider preference fields" do
     let(:enterprise) { create(:distributor_enterprise) }
     let(:user) do

From 98317e96d0e21cfee14fed23186752597849104a Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 3 Aug 2017 16:35:09 +1000
Subject: [PATCH 255/353] Remove unused stripe action abilities

---
 app/models/spree/ability_decorator.rb | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb
index ab370f68c2..9e36f7e5c6 100644
--- a/app/models/spree/ability_decorator.rb
+++ b/app/models/spree/ability_decorator.rb
@@ -119,9 +119,6 @@ class AbilityDecorator
       column_preference.user == user
     end
 
-    # Not sure how to restrict these methods to a non-resource Controller
-    can [:stripe_connect, :stripe_connect_callback, :stripe_disconnect], :all
-
     can [:status, :destroy], StripeAccount do |stripe_account|
       user.enterprises.include? stripe_account.enterprise
     end

From 4e96487da99e7f83142d9d1fcf9759356a3fc9a2 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 4 Aug 2017 11:19:59 +1000
Subject: [PATCH 256/353] Redirect to #/payment methods from stripe connect
 callback

---
 app/controllers/admin/stripe_accounts_controller.rb       | 2 +-
 spec/controllers/admin/stripe_accounts_controller_spec.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index 937c4f7e8e..75fd9ec110 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -15,7 +15,7 @@ module Admin
       connector = Stripe::AccountConnector.new(spree_current_user, params)
       if connector.create_account
         flash[:success] = t('admin.controllers.enterprises.stripe_connect_success')
-        redirect_to main_app.edit_admin_enterprise_path(connector.enterprise)
+        redirect_to main_app.edit_admin_enterprise_path(connector.enterprise, anchor: 'payment_methods')
       else
         render text: t('admin.controllers.enterprises.stripe_connect_fail'), status: 500
       end
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index af9dbb1a94..940fe41761 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -61,7 +61,7 @@ describe Admin::StripeAccountsController, type: :controller do
           expect(connector).to receive(:enterprise) { enterprise }
           spree_get :connect_callback, params
           expect(flash[:success]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_success')
-          expect(response).to redirect_to edit_admin_enterprise_path(enterprise)
+          expect(response).to redirect_to edit_admin_enterprise_path(enterprise, anchor: 'payment_methods')
         end
       end
 

From b31881baa5aeef06623e943bc7c06264fa652dd4 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 4 Aug 2017 11:49:48 +1000
Subject: [PATCH 257/353] Add explanation about configuring Stripe API keys

---
 app/views/admin/stripe_connect_settings/edit.html.haml | 1 +
 config/locales/en.yml                                  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/app/views/admin/stripe_connect_settings/edit.html.haml b/app/views/admin/stripe_connect_settings/edit.html.haml
index bd5d32cf6c..f3867af97a 100644
--- a/app/views/admin/stripe_connect_settings/edit.html.haml
+++ b/app/views/admin/stripe_connect_settings/edit.html.haml
@@ -19,6 +19,7 @@
 
 %fieldset.no-border-bottom
   %legend= t('.status')
+  %strong= t('.configuration_explanation_html')
   - if @stripe_account[:status] == :ok
     .alert-box.ok
       .status
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 799e9c402b..9e6f976aa8 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -750,6 +750,7 @@ en:
         settings: "Settings"
         stripe_connect_enabled: Enable shops to accept payments using Stripe Connect?
         no_api_key_msg: No Stripe account exists for this enterprise.
+        configuration_explanation_html: For detailed instructions on configuring the Stripe Connect integration, please <a href='https://github.com/openfoodfoundation/openfoodnetwork/wiki/Setting-up-Stripe-on-an-OFN-instance' target='_blank'>consult this guide</a>.
         status: Status
         ok: Ok
         instance_secret_key: Instance Secret Key

From 4fb1c7fd92bb216bcefb35671bd26b1f248d67ea Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 4 Aug 2017 12:41:19 +1000
Subject: [PATCH 258/353] Add 'Stripe is in Beta' warning

---
 app/views/admin/stripe_connect_settings/edit.html.haml | 2 ++
 config/locales/en.yml                                  | 1 +
 2 files changed, 3 insertions(+)

diff --git a/app/views/admin/stripe_connect_settings/edit.html.haml b/app/views/admin/stripe_connect_settings/edit.html.haml
index f3867af97a..d004d65f0e 100644
--- a/app/views/admin/stripe_connect_settings/edit.html.haml
+++ b/app/views/admin/stripe_connect_settings/edit.html.haml
@@ -6,6 +6,8 @@
 %fieldset.no-border-bottom
   %legend
     = t('.settings')
+  .alert-box.warning
+    = t(".stripe_beta_warning")
   = form_for @settings, as: :settings, url: main_app.admin_stripe_connect_settings_path, :method => :put do |f|
     .row
       .twelve.columns.alpha.omega
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 9e6f976aa8..ebd1c89952 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -748,6 +748,7 @@ en:
       edit:
         title: "Stripe Connect"
         settings: "Settings"
+        stripe_beta_warning: "Warning: The Stripe Connect integration is currently in beta and should not be enabled in production yet"
         stripe_connect_enabled: Enable shops to accept payments using Stripe Connect?
         no_api_key_msg: No Stripe account exists for this enterprise.
         configuration_explanation_html: For detailed instructions on configuring the Stripe Connect integration, please <a href='https://github.com/openfoodfoundation/openfoodnetwork/wiki/Setting-up-Stripe-on-an-OFN-instance' target='_blank'>consult this guide</a>.

From 6133b302afd103b9572f81359aba5c2f9453e9e9 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 4 Aug 2017 14:04:50 +1000
Subject: [PATCH 259/353] Use guard clause in
 PaymentMethodsController#restrict_stripe_account_change

---
 .../spree/admin/payment_methods_controller_decorator.rb     | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/controllers/spree/admin/payment_methods_controller_decorator.rb b/app/controllers/spree/admin/payment_methods_controller_decorator.rb
index 8c96ccd943..b13bcd2f17 100644
--- a/app/controllers/spree/admin/payment_methods_controller_decorator.rb
+++ b/app/controllers/spree/admin/payment_methods_controller_decorator.rb
@@ -77,9 +77,9 @@ module Spree
         return unless @payment_method.preferred_enterprise_id
 
         @stripe_account_holder = Enterprise.find(@payment_method.preferred_enterprise_id)
-        unless spree_current_user.enterprises.include? @stripe_account_holder
-          params[:payment_method][:preferred_enterprise_id] = @stripe_account_holder.id
-        end
+        return if spree_current_user.enterprises.include? @stripe_account_holder
+
+        params[:payment_method][:preferred_enterprise_id] = @stripe_account_holder.id
       end
     end
   end

From 41b7be900c7c4b035ada1c3e03865adb36fb5869 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 4 Aug 2017 16:49:56 +1000
Subject: [PATCH 260/353] Restrict the meaning of 'Saved Cards' to mean those
 with a payment profile

---
 app/helpers/injection_helper.rb       | 3 +--
 spec/helpers/injection_helper_spec.rb | 8 ++++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/app/helpers/injection_helper.rb b/app/helpers/injection_helper.rb
index 88309c09d2..c0e83b5b90 100644
--- a/app/helpers/injection_helper.rb
+++ b/app/helpers/injection_helper.rb
@@ -74,7 +74,7 @@ module InjectionHelper
   end
 
   def inject_saved_credit_cards
-    data = spree_current_user.try(:credit_cards)
+    data = spree_current_user.credit_cards.with_payment_profile.all
     inject_json_ams "savedCreditCards", data, Api::CreditCardSerializer
   end
 
@@ -98,5 +98,4 @@ module InjectionHelper
     @enterprise_injection_data ||= OpenFoodNetwork::EnterpriseInjectionData.new
     {data: @enterprise_injection_data}
   end
-
 end
diff --git a/spec/helpers/injection_helper_spec.rb b/spec/helpers/injection_helper_spec.rb
index acec197b20..1cdeca6a3a 100644
--- a/spec/helpers/injection_helper_spec.rb
+++ b/spec/helpers/injection_helper_spec.rb
@@ -54,4 +54,12 @@ describe InjectionHelper do
     helper.inject_taxons.should match taxon.name
   end
 
+  it "only injects credit cards with a payment profile" do
+    allow(helper).to receive(:spree_current_user) { user }
+    card1 = create(:credit_card, last_digits: "1234", user_id: user.id, gateway_customer_profile_id: 'cust_123')
+    card2 = create(:credit_card, last_digits: "4321", user_id: user.id, gateway_customer_profile_id: nil)
+    injected_cards = helper.inject_saved_credit_cards
+    expect(injected_cards).to match "1234"
+    expect(injected_cards).to_not match "4321"
+  end
 end

From cb08011450817e1c390f76c0c285c78a43db1e40 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 4 Aug 2017 16:52:10 +1000
Subject: [PATCH 261/353] Fix typo in Stripe confirm modal

---
 config/locales/en.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/locales/en.yml b/config/locales/en.yml
index ebd1c89952..ccd3b9bbb2 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -531,7 +531,7 @@ en:
           confirm_modal:
             title: Connect with Stripe
             part1: Stripe is a payment processing service that allows shops on the OFN to accept credit card payments from customers.
-            part2: To use this feature, you must connect your Stripe account the OFN. Clicking 'I Agree' below will redirect to you the Stripe website where you can connect an existing Stripe account to your OFN, or create a new one if you don't already have one.
+            part2: To use this feature, you must connect your Stripe account to the OFN. Clicking 'I Agree' below will redirect to you the Stripe website where you can connect an existing Stripe account, or create a new one if you don't already have one.
             part3: This will allow the Open Food Network to accept credit card payments from customers on your behalf. Please note that you will need to maintain your own Stripe account, pay the fees Stripe charges and handle any chargebacks and customer service yourself.
             i_agree: I Agree
             cancel: Cancel

From d5ab9eb67517ddb2e9f19c2795b61d5d4bac480d Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 4 Aug 2017 17:09:00 +1000
Subject: [PATCH 262/353] Hide option to 'Remember this card' when an existing
 card is selected

---
 app/views/spree/checkout/payment/_stripe.html.haml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/views/spree/checkout/payment/_stripe.html.haml b/app/views/spree/checkout/payment/_stripe.html.haml
index 398636cdd3..b8050b91ca 100644
--- a/app/views/spree/checkout/payment/_stripe.html.haml
+++ b/app/views/spree/checkout/payment/_stripe.html.haml
@@ -10,10 +10,10 @@
 %div{ ng: { if: '!secrets.selected_card' } }
   = render "spree/checkout/payment/gateway", payment_method: payment_method
 
-.row
-  .small-12.columns.text-right
-    = check_box_tag 'secrets.save_requested_by_customer'
-    = label_tag 'secrets.save_requested_by_customer', t('.remember_this_card')
+  .row
+    .small-12.columns.text-right
+      = check_box_tag 'secrets.save_requested_by_customer'
+      = label_tag 'secrets.save_requested_by_customer', t('.remember_this_card')
 
 :javascript
   Stripe.setPublishableKey("#{ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']}")

From 511afa0ddcce9b4f32f9515f44f752904bb7cbed Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 20 Aug 2017 19:36:05 +0100
Subject: [PATCH 263/353] Bump Stripe gem version

---
 Gemfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile b/Gemfile
index 1984e82211..36ca2fc59a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -19,7 +19,7 @@ gem 'spree_auth_devise', github: 'openfoodfoundation/spree_auth_devise', branch:
 # - Change type of password from string to password to hide it in the form
 gem 'spree_paypal_express', :github => "openfoodfoundation/better_spree_paypal_express", :branch => "spree-upgrade-intermediate"
 #gem 'spree_paypal_express', :github => "spree-contrib/better_spree_paypal_express", :branch => "1-3-stable"
-gem 'stripe', '~> 3.0.1'
+gem 'stripe', '~> 3.3.1'
 gem 'activemerchant', '~> 1.71.0'
 
 gem 'oauth2', '~> 1.2.0' # Used for Stripe Connect

From f065cbe2512cded05122f2739d3437bc49c6eee8 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Wed, 23 Aug 2017 09:22:04 +0100
Subject: [PATCH 264/353] Fix specs for saved credit cards: Add payment profile
 ID to fixture (now denotes that a card has been saved), check for current
 user to avoid error attempting to inject saved cards as a guest

---
 Gemfile.lock                                     | 4 ++--
 app/helpers/injection_helper.rb                  | 5 ++++-
 spec/features/consumer/shopping/checkout_spec.rb | 3 ++-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 1afefa3d73..d41516fe5e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -639,7 +639,7 @@ GEM
       tilt (~> 1.1, != 1.3.0)
     state_machine (1.2.0)
     stringex (1.3.3)
-    stripe (3.0.1)
+    stripe (3.3.1)
       faraday (~> 0.9)
     therubyracer (0.12.0)
       libv8 (~> 3.16.14.0)
@@ -777,7 +777,7 @@ DEPENDENCIES
   spree_auth_devise!
   spree_i18n!
   spree_paypal_express!
-  stripe (~> 3.0.1)
+  stripe (~> 3.3.1)
   therubyracer
   timecop
   truncate_html
diff --git a/app/helpers/injection_helper.rb b/app/helpers/injection_helper.rb
index c0e83b5b90..b750d3f46b 100644
--- a/app/helpers/injection_helper.rb
+++ b/app/helpers/injection_helper.rb
@@ -74,7 +74,10 @@ module InjectionHelper
   end
 
   def inject_saved_credit_cards
-    data = spree_current_user.credit_cards.with_payment_profile.all
+    if spree_current_user
+      data = spree_current_user.credit_cards.with_payment_profile.all
+    end
+
     inject_json_ams "savedCreditCards", data, Api::CreditCardSerializer
   end
 
diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index 1c4ea9bb65..a5da47e8ef 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -150,7 +150,8 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
           year: "2025",
           cc_type: "Visa",
           number: "1111111111111111",
-          payment_method_id: stripe_pm.id)
+          payment_method_id: stripe_pm.id,
+          gateway_customer_profile_id: "i_am_saved")
         }
 
         let(:response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }

From da5c907e0f411d3c44e5966e2134def8dd6b9115 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Wed, 23 Aug 2017 21:42:33 +0100
Subject: [PATCH 265/353] Add/remove comments from PR feedback

---
 app/models/spree/gateway/stripe_connect.rb   | 19 -------------------
 app/models/spree/payment_decorator.rb        |  2 +-
 app/models/spree/payment_method_decorator.rb |  2 +-
 3 files changed, 2 insertions(+), 21 deletions(-)

diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index 2cc7a139d7..2ce9065419 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -31,25 +31,6 @@ module Spree
         provider.purchase(*options_for_purchase_or_auth(money, creditcard, gateway_options))
       end
 
-      # def authorize(money, creditcard, gateway_options)
-      #   provider.authorize(*options_for_purchase_or_auth(money, creditcard, gateway_options))
-      # end
-
-      # def capture(money, response_code, gateway_options)
-      #   provider.capture(money, response_code, gateway_options)
-      # end
-
-      # def credit(money, creditcard, response_code, gateway_options)
-      #   provider.refund(money, response_code, {})
-      # end
-
-      # def void(response_code, creditcard, gateway_options)
-      #   provider.void(response_code, {})
-      # end
-
-      # def cancel(response_code)
-      #   provider.void(response_code, {})
-      # end
 
       def create_profile(payment)
         return unless payment.source.gateway_customer_profile_id.nil?
diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index 84e3aa6d51..9097fb1b91 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -75,7 +75,7 @@ module Spree
       end
     end
 
-    # Import from future Spree
+    # Import from future Spree v.2.3.0 d470b31798f37
     def build_source
       return if source_attributes.nil?
       return unless payment_method.andand.payment_source_class
diff --git a/app/models/spree/payment_method_decorator.rb b/app/models/spree/payment_method_decorator.rb
index 2d65797d29..86538af117 100644
--- a/app/models/spree/payment_method_decorator.rb
+++ b/app/models/spree/payment_method_decorator.rb
@@ -6,7 +6,7 @@ Spree::PaymentMethod.class_eval do
   acts_as_taggable
 
   has_and_belongs_to_many :distributors, join_table: 'distributors_payment_methods', :class_name => 'Enterprise', association_foreign_key: 'distributor_id'
-  has_many :credit_cards, class_name: "Spree::CreditCard" # from future Spree version
+  has_many :credit_cards, class_name: "Spree::CreditCard" # from Spree v.2.3.0 d470b31798f37
 
   attr_accessible :distributor_ids, :tag_list
 

From 0a12f78444d8ce8e1304439c3e20a0543d4ebfe0 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Wed, 23 Aug 2017 21:44:22 +0100
Subject: [PATCH 266/353] Separate files for Payment Method serializers

---
 .../admin/payment_method/base_serializer.rb   | 13 +++++++++
 .../payment_method_serializer.rb              | 11 +++++++
 .../admin/payment_method/stripe_serializer.rb |  5 ++++
 .../api/admin/payment_method_serializer.rb    | 29 -------------------
 4 files changed, 29 insertions(+), 29 deletions(-)
 create mode 100644 app/serializers/api/admin/payment_method/base_serializer.rb
 create mode 100644 app/serializers/api/admin/payment_method/payment_method_serializer.rb
 create mode 100644 app/serializers/api/admin/payment_method/stripe_serializer.rb
 delete mode 100644 app/serializers/api/admin/payment_method_serializer.rb

diff --git a/app/serializers/api/admin/payment_method/base_serializer.rb b/app/serializers/api/admin/payment_method/base_serializer.rb
new file mode 100644
index 0000000000..cc915ace40
--- /dev/null
+++ b/app/serializers/api/admin/payment_method/base_serializer.rb
@@ -0,0 +1,13 @@
+module Api::Admin::PaymentMethod
+  class BaseSerializer < ActiveModel::Serializer
+    attributes :id, :name, :type, :tag_list, :tags
+
+    def tag_list
+      object.tag_list.join(",")
+    end
+
+    def tags
+      object.tag_list.map{ |t| { text: t } }
+    end
+  end
+end
diff --git a/app/serializers/api/admin/payment_method/payment_method_serializer.rb b/app/serializers/api/admin/payment_method/payment_method_serializer.rb
new file mode 100644
index 0000000000..342bc254fd
--- /dev/null
+++ b/app/serializers/api/admin/payment_method/payment_method_serializer.rb
@@ -0,0 +1,11 @@
+class Api::Admin::PaymentMethodSerializer < ActiveModel::Serializer
+  delegate :serializable_hash, to: :method_serializer
+
+  def method_serializer
+    if object.type == 'Spree::Gateway::StripeConnect'
+      Api::Admin::PaymentMethod::StripeSerializer.new(object)
+    else
+      Api::Admin::PaymentMethod::BaseSerializer.new(object)
+    end
+  end
+end
diff --git a/app/serializers/api/admin/payment_method/stripe_serializer.rb b/app/serializers/api/admin/payment_method/stripe_serializer.rb
new file mode 100644
index 0000000000..e679547e16
--- /dev/null
+++ b/app/serializers/api/admin/payment_method/stripe_serializer.rb
@@ -0,0 +1,5 @@
+module Api::Admin::PaymentMethod
+  class StripeSerializer < BaseSerializer
+    attributes :preferred_enterprise_id
+  end
+end
diff --git a/app/serializers/api/admin/payment_method_serializer.rb b/app/serializers/api/admin/payment_method_serializer.rb
deleted file mode 100644
index 8b2c4e1cf0..0000000000
--- a/app/serializers/api/admin/payment_method_serializer.rb
+++ /dev/null
@@ -1,29 +0,0 @@
-class Api::Admin::PaymentMethodSerializer < ActiveModel::Serializer
-  delegate :serializable_hash, to: :method_serializer
-
-  def method_serializer
-    if object.type == 'Spree::Gateway::StripeConnect'
-      Api::Admin::PaymentMethod::StripeSerializer.new(object)
-    else
-      Api::Admin::PaymentMethod::BaseSerializer.new(object)
-    end
-  end
-end
-
-module Api::Admin::PaymentMethod
-  class BaseSerializer < ActiveModel::Serializer
-    attributes :id, :name, :type, :tag_list, :tags
-
-    def tag_list
-      object.tag_list.join(",")
-    end
-
-    def tags
-      object.tag_list.map{ |t| { text: t } }
-    end
-  end
-
-  class StripeSerializer < BaseSerializer
-    attributes :preferred_enterprise_id
-  end
-end

From 5b7e2f7ca801360942527ae04ac8a1a281cd6816 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Fri, 25 Aug 2017 14:24:05 +1000
Subject: [PATCH 267/353] Apply style guide

---
 app/models/spree/gateway/stripe_connect.rb            | 1 -
 lib/open_food_network/users_and_enterprises_report.rb | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index 2ce9065419..06a632c04a 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -31,7 +31,6 @@ module Spree
         provider.purchase(*options_for_purchase_or_auth(money, creditcard, gateway_options))
       end
 
-
       def create_profile(payment)
         return unless payment.source.gateway_customer_profile_id.nil?
         options = {
diff --git a/lib/open_food_network/users_and_enterprises_report.rb b/lib/open_food_network/users_and_enterprises_report.rb
index fd580393be..58cb9688c8 100644
--- a/lib/open_food_network/users_and_enterprises_report.rb
+++ b/lib/open_food_network/users_and_enterprises_report.rb
@@ -30,7 +30,7 @@ module OpenFoodNetwork
         uae["sells"],
         uae["visible"],
         to_local_datetime(uae["confirmed_at"])
-        ]
+      ]
       end
     end
 

From 926f196b96c2b010d0bfd5f550f5769795e448f9 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Fri, 25 Aug 2017 14:33:21 +1000
Subject: [PATCH 268/353] Re-generate rubocop_todo

---
 .rubocop_todo.yml | 115 ++++++++++++++++++++++------------------------
 1 file changed, 54 insertions(+), 61 deletions(-)

diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
index dd05d120e6..136580b472 100644
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@@ -1,6 +1,6 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config --exclude-limit 100`
-# on 2017-07-12 10:36:44 +0200 using RuboCop version 0.49.1.
+# on 2017-08-25 14:27:48 +1000 using RuboCop version 0.49.1.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
@@ -14,7 +14,7 @@ Bundler/OrderedGems:
   Exclude:
     - 'Gemfile'
 
-# Offense count: 77
+# Offense count: 128
 # Cop supports --auto-correct.
 Layout/AlignArray:
   Exclude:
@@ -59,7 +59,7 @@ Layout/AlignHash:
     - 'spec/models/spree/shipping_method_spec.rb'
     - 'spec/models/spree/variant_spec.rb'
 
-# Offense count: 42
+# Offense count: 43
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles, IndentationWidth.
 # SupportedStyles: with_first_parameter, with_fixed_indentation
@@ -113,11 +113,12 @@ Layout/CaseIndentation:
     - 'app/models/enterprise.rb'
     - 'app/models/product_importer.rb'
 
-# Offense count: 2
+# Offense count: 3
 # Cop supports --auto-correct.
 Layout/ClosingParenthesisIndentation:
   Exclude:
     - 'app/overrides/add_capture_order_shortcut.rb'
+    - 'spec/serializers/variant_serializer_spec.rb'
 
 # Offense count: 8
 # Cop supports --auto-correct.
@@ -137,7 +138,7 @@ Layout/ElseAlignment:
     - 'app/serializers/api/admin/order_cycle_serializer.rb'
     - 'lib/open_food_network/sales_tax_report.rb'
 
-# Offense count: 223
+# Offense count: 215
 # Cop supports --auto-correct.
 Layout/EmptyLines:
   Enabled: false
@@ -152,7 +153,7 @@ Layout/EmptyLinesAroundAccessModifier:
     - 'spec/helpers/products_helper_spec.rb'
     - 'spec/support/request/web_helper.rb'
 
-# Offense count: 73
+# Offense count: 70
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: empty_lines, no_empty_lines
@@ -170,7 +171,6 @@ Layout/EmptyLinesAroundBlockBody:
     - 'app/models/spree/calculator_decorator.rb'
     - 'app/models/spree/money_decorator.rb'
     - 'app/models/spree/option_value_decorator.rb'
-    - 'app/models/spree/payment_decorator.rb'
     - 'lib/open_food_network/group_buy_report.rb'
     - 'lib/spree/money_decorator.rb'
     - 'lib/tasks/dev.rake'
@@ -188,10 +188,10 @@ Layout/EmptyLinesAroundBlockBody:
     - 'spec/features/admin/orders_spec.rb'
     - 'spec/features/admin/reports_spec.rb'
     - 'spec/features/admin/variant_overrides_spec.rb'
+    - 'spec/features/consumer/shopping/embedded_shopfronts_spec.rb'
     - 'spec/features/consumer/shopping/shopping_spec.rb'
     - 'spec/features/consumer/shopping/variant_overrides_spec.rb'
     - 'spec/helpers/admin/business_model_configuration_helper_spec.rb'
-    - 'spec/helpers/injection_helper_spec.rb'
     - 'spec/helpers/shared_helper_spec.rb'
     - 'spec/helpers/shop_helper_spec.rb'
     - 'spec/helpers/spree/orders_helper_spec.rb'
@@ -212,8 +212,7 @@ Layout/EmptyLinesAroundBlockBody:
     - 'spec/models/tag_rule/filter_shipping_methods_spec.rb'
     - 'spec/serializers/admin/for_order_cycle/enterprise_serializer_spec.rb'
     - 'spec/serializers/admin/for_order_cycle/supplied_product_serializer_spec.rb'
-    - 'spec/serializers/order_serializer_spec.rb'
-    - 'spec/serializers/orders_by_distributor_serializer_spec.rb'
+    - 'spec/serializers/variant_serializer_spec.rb'
     - 'spec/support/matchers/delegate_matchers.rb'
     - 'spec/support/matchers/select2_matchers.rb'
     - 'spec/support/matchers/table_matchers.rb'
@@ -270,7 +269,7 @@ Layout/EmptyLinesAroundMethodBody:
     - 'app/serializers/api/product_serializer.rb'
     - 'lib/open_food_network/orders_and_fulfillments_report.rb'
 
-# Offense count: 13
+# Offense count: 12
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: empty_lines, empty_lines_except_namespace, empty_lines_special, no_empty_lines
@@ -278,7 +277,6 @@ Layout/EmptyLinesAroundModuleBody:
   Exclude:
     - 'app/helpers/add_to_cart_helper.rb'
     - 'app/helpers/groups_helper.rb'
-    - 'app/helpers/injection_helper.rb'
     - 'app/helpers/spree/admin/base_helper_decorator.rb'
     - 'lib/open_food_network/column_preference_defaults.rb'
     - 'lib/open_food_network/group_buy_report.rb'
@@ -289,7 +287,7 @@ Layout/EmptyLinesAroundModuleBody:
     - 'spec/support/request/distribution_helper.rb'
     - 'spec/support/request/ui_component_helper.rb'
 
-# Offense count: 54
+# Offense count: 55
 # Cop supports --auto-correct.
 # Configuration parameters: AllowForAlignment, ForceEqualSignAlignment.
 Layout/ExtraSpacing:
@@ -326,29 +324,28 @@ Layout/ExtraSpacing:
     - 'spec/models/enterprise_spec.rb'
     - 'spec/models/order_cycle_spec.rb'
     - 'spec/models/spree/adjustment_spec.rb'
+    - 'spec/models/spree/gateway/stripe_connect_spec.rb'
     - 'spec/models/spree/order_spec.rb'
     - 'spec/models/variant_override_spec.rb'
     - 'spec/serializers/admin/for_order_cycle/enterprise_serializer_spec.rb'
     - 'spec/serializers/admin/for_order_cycle/supplied_product_serializer_spec.rb'
     - 'spec/support/request/web_helper.rb'
 
-# Offense count: 1
+# Offense count: 2
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles, IndentationWidth.
 # SupportedStyles: consistent, special_for_inner_method_call, special_for_inner_method_call_in_parentheses
 Layout/FirstParameterIndentation:
   Exclude:
     - 'lib/open_food_network/permissions.rb'
+    - 'spec/serializers/variant_serializer_spec.rb'
 
-# Offense count: 6
+# Offense count: 4
 # Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, SupportedStyles, IndentationWidth.
+# Configuration parameters: SupportedStyles, IndentationWidth.
 # SupportedStyles: special_inside_parentheses, consistent, align_brackets
 Layout/IndentArray:
-  Exclude:
-    - 'lib/open_food_network/users_and_enterprises_report.rb'
-    - 'spec/features/admin/reports_spec.rb'
-    - 'spec/lib/open_food_network/products_and_inventory_report_spec.rb'
+  EnforcedStyle: consistent
 
 # Offense count: 2
 # Cop supports --auto-correct.
@@ -403,7 +400,7 @@ Layout/IndentationConsistency:
     - 'spec/models/spree/line_item_spec.rb'
     - 'spec/models/spree/product_spec.rb'
 
-# Offense count: 20
+# Offense count: 18
 # Cop supports --auto-correct.
 # Configuration parameters: Width, IgnoredPatterns.
 Layout/IndentationWidth:
@@ -411,13 +408,11 @@ Layout/IndentationWidth:
     - 'app/controllers/admin/invoice_settings_controller.rb'
     - 'app/controllers/admin/order_cycles_controller.rb'
     - 'app/controllers/api/order_cycles_controller.rb'
-    - 'app/controllers/spree/admin/reports_controller_decorator.rb'
     - 'app/models/spree/line_item_decorator.rb'
     - 'app/serializers/api/admin/for_order_cycle/enterprise_serializer.rb'
     - 'app/serializers/api/admin/for_order_cycle/supplied_product_serializer.rb'
     - 'app/serializers/api/admin/order_cycle_serializer.rb'
     - 'lib/discourse/single_sign_on.rb'
-    - 'lib/open_food_network/last_used_address.rb'
     - 'spec/features/consumer/shopping/variant_overrides_spec.rb'
     - 'spec/helpers/admin/business_model_configuration_helper_spec.rb'
     - 'spec/helpers/groups_helper_spec.rb'
@@ -525,7 +520,15 @@ Layout/MultilineMethodCallBraceLayout:
     - 'lib/open_food_network/products_renderer.rb'
     - 'spec/lib/open_food_network/products_and_inventory_report_spec.rb'
 
-# Offense count: 34
+# Offense count: 1
+# Cop supports --auto-correct.
+# Configuration parameters: EnforcedStyle, SupportedStyles, IndentationWidth.
+# SupportedStyles: aligned, indented, indented_relative_to_receiver
+Layout/MultilineMethodCallIndentation:
+  Exclude:
+    - 'spec/serializers/variant_serializer_spec.rb'
+
+# Offense count: 33
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles, IndentationWidth.
 # SupportedStyles: aligned, indented
@@ -538,7 +541,6 @@ Layout/MultilineOperationIndentation:
     - 'app/models/producer_property.rb'
     - 'app/models/product_importer.rb'
     - 'app/models/spree/ability_decorator.rb'
-    - 'app/models/spree/order_decorator.rb'
     - 'app/models/spree/product_set.rb'
     - 'app/models/variant_override_set.rb'
     - 'lib/open_food_network/accounts_and_billing_settings_validator.rb'
@@ -558,20 +560,18 @@ Layout/SpaceAfterColon:
     - 'spec/models/variant_override_spec.rb'
     - 'spec/spec_helper.rb'
 
-# Offense count: 58
+# Offense count: 53
 # Cop supports --auto-correct.
 Layout/SpaceAfterComma:
   Exclude:
     - 'app/controllers/admin/order_cycles_controller.rb'
     - 'app/controllers/spree/admin/products_controller_decorator.rb'
-    - 'app/controllers/spree/admin/reports_controller_decorator.rb'
     - 'app/controllers/spree/orders_controller_decorator.rb'
     - 'app/models/column_preference.rb'
     - 'app/models/product_importer.rb'
     - 'lib/discourse/single_sign_on.rb'
     - 'lib/open_food_network/accounts_and_billing_settings_validator.rb'
     - 'lib/open_food_network/business_model_configuration_validator.rb'
-    - 'lib/open_food_network/order_and_distributor_report.rb'
     - 'lib/open_food_network/order_cycle_form_applicator.rb'
     - 'lib/open_food_network/users_and_enterprises_report.rb'
     - 'spec/controllers/admin/enterprises_controller_spec.rb'
@@ -648,7 +648,7 @@ Layout/SpaceAroundEqualsInParameterDefault:
     - 'spec/support/request/distribution_helper.rb'
     - 'spec/support/request/web_helper.rb'
 
-# Offense count: 58
+# Offense count: 60
 # Cop supports --auto-correct.
 # Configuration parameters: AllowForAlignment.
 Layout/SpaceAroundOperators:
@@ -677,6 +677,7 @@ Layout/SpaceAroundOperators:
     - 'spec/helpers/order_cycles_helper_spec.rb'
     - 'spec/jobs/update_billable_periods_spec.rb'
     - 'spec/lib/open_food_network/order_grouper_spec.rb'
+    - 'spec/lib/stripe/account_connector_spec.rb'
     - 'spec/models/calculator/weight_spec.rb'
     - 'spec/support/cancan_helper.rb'
     - 'spec/support/seeds.rb'
@@ -715,7 +716,7 @@ Layout/SpaceInLambdaLiteral:
     - 'app/models/spree/product_decorator.rb'
     - 'app/models/spree/variant_decorator.rb'
 
-# Offense count: 194
+# Offense count: 187
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles, EnforcedStyleForEmptyBraces, SupportedStylesForEmptyBraces, SpaceBeforeBlockParameters.
 # SupportedStyles: space, no_space
@@ -765,11 +766,9 @@ Layout/SpaceInsideBlockBraces:
     - 'spec/models/spree/order_spec.rb'
     - 'spec/models/spree/payment_spec.rb'
     - 'spec/models/spree/product_spec.rb'
-    - 'spec/models/spree/user_spec.rb'
     - 'spec/models/tag_rule/discount_order_spec.rb'
     - 'spec/serializers/admin/for_order_cycle/enterprise_serializer_spec.rb'
     - 'spec/serializers/admin/for_order_cycle/supplied_product_serializer_spec.rb'
-    - 'spec/serializers/orders_by_distributor_serializer_spec.rb'
     - 'spec/spec_helper.rb'
     - 'spec/support/cancan_helper.rb'
 
@@ -796,7 +795,7 @@ Layout/SpaceInsideBrackets:
     - 'spec/lib/open_food_network/users_and_enterprises_report_spec.rb'
     - 'spec/performance/orders_controller_spec.rb'
 
-# Offense count: 729
+# Offense count: 766
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles, EnforcedStyleForEmptyBraces, SupportedStylesForEmptyBraces.
 # SupportedStyles: space, no_space, compact
@@ -823,12 +822,11 @@ Layout/Tab:
     - 'spec/lib/spree/product_filters_spec.rb'
     - 'spec/models/spree/line_item_spec.rb'
 
-# Offense count: 32
+# Offense count: 42
 # Cop supports --auto-correct.
 Layout/TrailingWhitespace:
   Exclude:
     - 'app/models/distributor_shipping_method.rb'
-    - 'app/models/product_importer.rb'
     - 'app/models/spree/money_decorator.rb'
     - 'app/serializers/api/image_serializer.rb'
     - 'app/serializers/api/shipping_method_serializer.rb'
@@ -836,7 +834,6 @@ Layout/TrailingWhitespace:
     - 'app/views/json/_enterprises.rabl'
     - 'app/views/json/_producer.rabl'
     - 'app/views/json/partials/_producer.rabl'
-    - 'lib/open_food_network/group_buy_report.rb'
     - 'lib/tasks/dev.rake'
     - 'spec/controllers/spree/store_controller_spec.rb'
     - 'spec/features/admin/enterprise_user_spec.rb'
@@ -844,17 +841,16 @@ Layout/TrailingWhitespace:
     - 'spec/lib/open_food_network/option_value_namer_spec.rb'
     - 'spec/lib/open_food_network/order_grouper_spec.rb'
     - 'spec/serializers/admin/enterprise_serializer_spec.rb'
+    - 'spec/serializers/variant_serializer_spec.rb'
     - 'spec/support/request/menu_helper.rb'
     - 'spec/views/json/producers.json.rabl_spec.rb'
 
-# Offense count: 8
+# Offense count: 6
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyleAlignWith, SupportedStylesAlignWith.
 # SupportedStylesAlignWith: either, start_of_block, start_of_line
 Lint/BlockAlignment:
   Exclude:
-    - 'app/controllers/spree/admin/reports_controller_decorator.rb'
-    - 'lib/open_food_network/last_used_address.rb'
     - 'spec/lib/open_food_network/enterprise_fee_calculator_spec.rb'
     - 'spec/models/enterprise_spec.rb'
     - 'spec/models/spree/calculator/flat_percent_item_total_spec.rb'
@@ -1011,7 +1007,7 @@ Lint/UselessAccessModifier:
     - 'lib/open_food_network/reports/bulk_coop_report.rb'
     - 'spec/lib/open_food_network/reports/report_spec.rb'
 
-# Offense count: 340
+# Offense count: 341
 Lint/Void:
   Exclude:
     - 'app/serializers/api/enterprise_serializer.rb'
@@ -1080,7 +1076,7 @@ Lint/Void:
     - 'spec/serializers/enterprise_serializer_spec.rb'
     - 'spec/support/request/web_helper.rb'
 
-# Offense count: 706
+# Offense count: 747
 # Configuration parameters: CountComments, ExcludedMethods.
 Metrics/BlockLength:
   Max: 711
@@ -1165,7 +1161,7 @@ Rails/Delegate:
     - 'app/serializers/api/admin/tag_rule_serializer.rb'
     - 'app/serializers/api/variant_serializer.rb'
 
-# Offense count: 6
+# Offense count: 7
 Rails/FilePath:
   Exclude:
     - 'lib/tasks/karma.rake'
@@ -1203,7 +1199,7 @@ Rails/HasAndBelongsToMany:
     - 'app/models/spree/line_item_decorator.rb'
     - 'app/models/spree/payment_method_decorator.rb'
 
-# Offense count: 11
+# Offense count: 10
 Rails/OutputSafety:
   Exclude:
     - 'app/controllers/spree/admin/reports_controller_decorator.rb'
@@ -1211,7 +1207,6 @@ Rails/OutputSafety:
     - 'app/helpers/spree/reports_helper.rb'
     - 'app/serializers/api/product_serializer.rb'
     - 'lib/spree/money_decorator.rb'
-    - 'lib/tasks/karma.rake'
 
 # Offense count: 6
 # Cop supports --auto-correct.
@@ -1302,15 +1297,16 @@ Rails/Validation:
     - 'app/models/spree/variant_decorator.rb'
     - 'app/models/variant_override.rb'
 
-# Offense count: 6
+# Offense count: 7
 Style/AccessorMethodName:
   Exclude:
     - 'app/models/product_importer.rb'
     - 'app/models/spree/adjustment_decorator.rb'
     - 'app/models/spree/order_decorator.rb'
     - 'spec/support/request/shop_workflow.rb'
+    - 'spec/support/request/web_helper.rb'
 
-# Offense count: 35
+# Offense count: 34
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: always, conditionals
@@ -1326,7 +1322,6 @@ Style/AndOr:
     - 'app/models/product_importer.rb'
     - 'app/models/spreadsheet_entry.rb'
     - 'app/models/spree/adjustment_decorator.rb'
-    - 'app/models/spree/order_decorator.rb'
     - 'app/models/spree/product_set.rb'
     - 'app/views/json/partials/_enterprise.rabl'
     - 'lib/spree/core/controller_helpers/respond_with_decorator.rb'
@@ -1340,7 +1335,7 @@ Style/BarePercentLiterals:
     - 'spec/features/admin/variants_spec.rb'
     - 'spec/support/request/web_helper.rb'
 
-# Offense count: 209
+# Offense count: 208
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: braces, no_braces, context_dependent
@@ -1410,7 +1405,6 @@ Style/BracesAroundHashParameters:
     - 'spec/models/spree/product_spec.rb'
     - 'spec/models/spree/taxon_spec.rb'
     - 'spec/serializers/admin/customer_serializer_spec.rb'
-    - 'spec/serializers/orders_by_distributor_serializer_spec.rb'
     - 'spec/spec_helper.rb'
     - 'spec/support/cancan_helper.rb'
     - 'spec/support/request/authentication_workflow.rb'
@@ -1422,7 +1416,7 @@ Style/CaseEquality:
     - 'app/helpers/angular_form_helper.rb'
     - 'spec/models/spree/payment_spec.rb'
 
-# Offense count: 86
+# Offense count: 88
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: nested, compact
 Style/ClassAndModuleChildren:
@@ -1468,7 +1462,9 @@ Style/ClassAndModuleChildren:
     - 'app/serializers/api/admin/line_item_serializer.rb'
     - 'app/serializers/api/admin/order_cycle_serializer.rb'
     - 'app/serializers/api/admin/order_serializer.rb'
-    - 'app/serializers/api/admin/payment_method_serializer.rb'
+    - 'app/serializers/api/admin/payment_method/base_serializer.rb'
+    - 'app/serializers/api/admin/payment_method/payment_method_serializer.rb'
+    - 'app/serializers/api/admin/payment_method/stripe_serializer.rb'
     - 'app/serializers/api/admin/product_serializer.rb'
     - 'app/serializers/api/admin/shipping_method_serializer.rb'
     - 'app/serializers/api/admin/tag_rule_serializer.rb'
@@ -1601,7 +1597,7 @@ Style/FileName:
 Style/FormatStringToken:
   EnforcedStyle: template
 
-# Offense count: 88
+# Offense count: 89
 # Configuration parameters: MinBodyLength.
 Style/GuardClause:
   Exclude:
@@ -1655,7 +1651,7 @@ Style/GuardClause:
     - 'spec/support/request/distribution_helper.rb'
     - 'spec/support/request/shop_workflow.rb'
 
-# Offense count: 1241
+# Offense count: 1255
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, SupportedStyles, UseHashRocketsWithSymbolValues, PreferHashRocketsForNonAlnumEndingSymbols.
 # SupportedStyles: ruby19, hash_rockets, no_mixed_keys, ruby19_no_mixed_keys
@@ -1685,11 +1681,10 @@ Style/InverseMethods:
     - 'app/controllers/admin/column_preferences_controller.rb'
     - 'spec/support/cancan_helper.rb'
 
-# Offense count: 9
+# Offense count: 5
 # Cop supports --auto-correct.
 Style/LineEndConcatenation:
   Exclude:
-    - 'app/controllers/spree/admin/base_controller_decorator.rb'
     - 'lib/spree/core/controller_helpers/respond_with_decorator.rb'
     - 'spec/controllers/spree/admin/base_controller_spec.rb'
 
@@ -1736,11 +1731,10 @@ Style/MultilineIfModifier:
     - 'lib/open_food_network/enterprise_issue_validator.rb'
     - 'lib/spree/core/controller_helpers/respond_with_decorator.rb'
 
-# Offense count: 8
+# Offense count: 7
 # Cop supports --auto-correct.
 Style/MutableConstant:
   Exclude:
-    - 'app/controllers/spree/admin/reports_controller_decorator.rb'
     - 'app/models/enterprise.rb'
     - 'app/models/enterprise_fee.rb'
     - 'app/models/spree/payment_method_decorator.rb'
@@ -1798,7 +1792,7 @@ Style/NumericLiteralPrefix:
   Exclude:
     - 'spec/features/admin/order_cycles_spec.rb'
 
-# Offense count: 16
+# Offense count: 15
 # Cop supports --auto-correct.
 # Configuration parameters: Strict.
 Style/NumericLiterals:
@@ -2025,7 +2019,7 @@ Style/StructInheritance:
   Exclude:
     - 'lib/open_food_network/enterprise_fee_applicator.rb'
 
-# Offense count: 182
+# Offense count: 183
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle, MinSize, SupportedStyles.
 # SupportedStyles: percent, brackets
@@ -2069,7 +2063,7 @@ Style/SymbolArray:
     - 'spec/models/exchange_spec.rb'
     - 'spec/models/spree/ability_spec.rb'
 
-# Offense count: 97
+# Offense count: 96
 # Cop supports --auto-correct.
 # Configuration parameters: IgnoredMethods.
 # IgnoredMethods: respond_to, define_method
@@ -2101,7 +2095,6 @@ Style/SymbolProc:
     - 'spec/features/admin/order_cycles_spec.rb'
     - 'spec/lib/open_food_network/group_buy_report_spec.rb'
     - 'spec/lib/open_food_network/order_grouper_spec.rb'
-    - 'spec/models/spree/user_spec.rb'
 
 # Offense count: 6
 # Cop supports --auto-correct.

From 56ff877b25b5dff60b699e19464956a5e4b468a5 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sat, 5 Aug 2017 12:59:19 +0100
Subject: [PATCH 269/353] Use Stripe Elements instead of StripeJS:
 https://stripe.com/docs/elements

---
 app/views/layouts/darkswarm.html.haml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/layouts/darkswarm.html.haml b/app/views/layouts/darkswarm.html.haml
index 29019fb848..5bd57ea8e6 100644
--- a/app/views/layouts/darkswarm.html.haml
+++ b/app/views/layouts/darkswarm.html.haml
@@ -13,7 +13,7 @@
     %link{href: "https://fonts.googleapis.com/css?family=Roboto:400,300italic,400italic,300,700,700italic|Oswald:300,400,700", rel: "stylesheet", type: "text/css"}
 
     = yield :scripts
-    %script{:src => "https://js.stripe.com/v2/", :type => "text/javascript"}
+    %script{:src => "https://js.stripe.com/v3/", :type => "text/javascript"}
     %script{src: "//maps.googleapis.com/maps/api/js?libraries=places,geometry#{ ENV['GOOGLE_MAPS_API_KEY'] ? '&key=' + ENV['GOOGLE_MAPS_API_KEY'] : ''} "}
     = split_stylesheet_link_tag "darkswarm/all"
     = javascript_include_tag "darkswarm/all"

From 15ed4c32d994215e5f33f76a9f5d65d12e1cbf95 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 6 Aug 2017 14:25:36 +0100
Subject: [PATCH 270/353] Checkout switched to Stripe Elements from StripeJS

---
 .../checkout/payment_controller.js.coffee     |  5 +-
 .../darkswarm/services/checkout.js.coffee     |  4 +-
 .../services/stripe_elements.js.coffee        | 50 +++++++++++++++++++
 .../stylesheets/darkswarm/checkout.css.sass   |  3 ++
 app/views/checkout/_payment.html.haml         |  2 +
 app/views/checkout/payment/_stripe.html.haml  |  6 +++
 .../spree/checkout/payment/_stripe.html.haml  |  5 +-
 7 files changed, 68 insertions(+), 7 deletions(-)
 create mode 100644 app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
 create mode 100644 app/views/checkout/payment/_stripe.html.haml

diff --git a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
index 04ff6ab45e..756bfb753f 100644
--- a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
@@ -1,4 +1,4 @@
-Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards, Dates) ->
+Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards, StripeElements, Dates) ->
   angular.extend(this, new FieldsetMixin($scope))
 
   $scope.savedCreditCards = savedCreditCards
@@ -12,4 +12,7 @@ Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards, Dates)
   $scope.summary = ->
     [$scope.Checkout.paymentMethod()?.name]
 
+  $scope.mountElements = ->
+    StripeElements.mountElements()
+
   $timeout $scope.onTimeout
diff --git a/app/assets/javascripts/darkswarm/services/checkout.js.coffee b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
index cc17e4e032..fd07e71e86 100644
--- a/app/assets/javascripts/darkswarm/services/checkout.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
@@ -1,4 +1,4 @@
-Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeJS, PaymentMethods, $http, Navigation, CurrentHub, RailsFlashLoader, Loading)->
+Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeElements, PaymentMethods, $http, Navigation, CurrentHub, RailsFlashLoader, Loading)->
   new class Checkout
     errors: {}
     secrets: {}
@@ -6,7 +6,7 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeJ
 
     purchase: ->
       if @paymentMethod()?.method_type == 'stripe' && !@secrets.selected_card
-        StripeJS.requestToken(@secrets, @submit)
+        StripeElements.requestToken(@secrets, @submit)
       else
         @submit()
 
diff --git a/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee b/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
new file mode 100644
index 0000000000..881cfa63d0
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
@@ -0,0 +1,50 @@
+Darkswarm.factory 'StripeElements', ($rootScope, Loading, RailsFlashLoader, stripeObject) ->
+  new class StripeElements
+    # This is the global Stripe object created by Stripe.js [v3+], included in the _stripe partial
+    stripe = stripeObject
+    elements = stripe.elements()
+    card = elements.create('card', hidePostalCode = false)
+
+    mountElements: ->
+      card.mount('#card-element')
+      # Elements validates user input as it is typed. To help your customers
+      # catch mistakes, you should listen to change events on the card Element
+      # and display any errors:
+      card.addEventListener 'change', (event) ->
+        displayError = document.getElementById('card-errors')
+        if event.error
+          displayError.textContent = event.error.message
+        else
+          displayError.textContent = ''
+        return
+
+    # New Stripe Elements method
+    requestToken: (secrets, submit, loading_message = t("processing_payment")) ->
+      Loading.message = loading_message
+
+      stripe.createToken(card).then (response) =>
+        if(response.error)
+          $rootScope.$apply ->
+            Loading.clear()
+            RailsFlashLoader.loadFlash({error: t("error") + ": #{response.error.message}"})
+        else
+          console.log(response)
+          secrets.token = response.token.id
+          secrets.cc_type = @mapCC(response.token.card.brand)
+          secrets.card = response.token.card
+          submit()
+
+    mapCC: (ccType) ->
+      if ccType == 'MasterCard'
+        return 'mastercard'
+      else if ccType == 'Visa'
+        return 'visa'
+      else if ccType == 'American Express'
+        return 'amex'
+      else if ccType == 'Discover'
+        return 'discover'
+      else if ccType == 'Diners Club'
+        return 'dinersclub'
+      else if ccType == 'JCB'
+        return 'jcb'
+      return
diff --git a/app/assets/stylesheets/darkswarm/checkout.css.sass b/app/assets/stylesheets/darkswarm/checkout.css.sass
index f13d2d1bc6..ff18863259 100644
--- a/app/assets/stylesheets/darkswarm/checkout.css.sass
+++ b/app/assets/stylesheets/darkswarm/checkout.css.sass
@@ -81,3 +81,6 @@ checkout
         display: inline
       span.accordion-down
         display: none
+
+  .error
+    color: #c82020
diff --git a/app/views/checkout/_payment.html.haml b/app/views/checkout/_payment.html.haml
index 928578158f..e7b29c7635 100644
--- a/app/views/checkout/_payment.html.haml
+++ b/app/views/checkout/_payment.html.haml
@@ -1,4 +1,6 @@
 %fieldset#payment
+  :javascript
+    angular.module('Darkswarm').value("stripeObject", Stripe("#{ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']}"))
   %ng-form{"ng-controller" => "PaymentCtrl", name: "payment"}
 
     %h5{"ng-class" => "{valid: payment.$valid, dirty: payment.$dirty || submitted}"}
diff --git a/app/views/checkout/payment/_stripe.html.haml b/app/views/checkout/payment/_stripe.html.haml
new file mode 100644
index 0000000000..5574e3d9dd
--- /dev/null
+++ b/app/views/checkout/payment/_stripe.html.haml
@@ -0,0 +1,6 @@
+%label{:for => "card-element"}
+    Credit or debit card
+    / a Stripe Element will be inserted here.
+    #card-element{"ng-init" => " mountElements() "}
+    / Used to display Element errors
+    #card-errors.error
diff --git a/app/views/spree/checkout/payment/_stripe.html.haml b/app/views/spree/checkout/payment/_stripe.html.haml
index b8050b91ca..86db4e49a3 100644
--- a/app/views/spree/checkout/payment/_stripe.html.haml
+++ b/app/views/spree/checkout/payment/_stripe.html.haml
@@ -8,12 +8,9 @@
       = t('.or_enter_new_card')
 
 %div{ ng: { if: '!secrets.selected_card' } }
-  = render "spree/checkout/payment/gateway", payment_method: payment_method
+  = render "/checkout/payment/stripe"
 
   .row
     .small-12.columns.text-right
       = check_box_tag 'secrets.save_requested_by_customer'
       = label_tag 'secrets.save_requested_by_customer', t('.remember_this_card')
-
-:javascript
-  Stripe.setPublishableKey("#{ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']}")

From 74a7cb82bc1c34891fdb36595891644ad125579a Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 6 Aug 2017 18:53:06 +0100
Subject: [PATCH 271/353] Modify to use Stripe Elements to manually add cards
 in Account page. Remove StripeJS service

---
 .../credit_cards_controller.js.coffee         |  7 ++--
 .../darkswarm/services/credit_card.js.coffee  |  4 +--
 .../darkswarm/services/stripe.js.coffee       | 36 -------------------
 .../services/stripe_elements.js.coffee        | 14 ++++++--
 app/views/checkout/payment/_stripe.html.haml  |  1 -
 .../spree/users/_new_card_form.html.haml      | 19 +---------
 app/views/spree/users/show.html.haml          |  2 +-
 7 files changed, 19 insertions(+), 64 deletions(-)
 delete mode 100644 app/assets/javascripts/darkswarm/services/stripe.js.coffee

diff --git a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
index 1ddfc45d16..90225692e6 100644
--- a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
@@ -1,4 +1,4 @@
-Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, CreditCards, StripeJS, Dates) ->
+Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, CreditCards, StripeElements, Dates) ->
   angular.extend(this, new FieldsetMixin($scope))
   $scope.savedCreditCards = CreditCards.saved
   $scope.CreditCard = CreditCard
@@ -8,5 +8,6 @@ Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, CreditCar
 
   $scope.allow_name_change = true
   $scope.disable_fields = false
-  $scope.months = Dates.months
-  $scope.years = Dates.years
+  
+  $scope.mountElements = ->
+    StripeElements.mountElements()
diff --git a/app/assets/javascripts/darkswarm/services/credit_card.js.coffee b/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
index 4f0488ad17..5f7fa5c0ce 100644
--- a/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
@@ -1,4 +1,4 @@
-Darkswarm.factory 'CreditCard', ($injector, $rootScope, CreditCards, StripeJS, Navigation, $http, RailsFlashLoader, Loading)->
+Darkswarm.factory 'CreditCard', ($injector, $rootScope, CreditCards, StripeElements, Navigation, $http, RailsFlashLoader, Loading)->
   new class CreditCard
     visible: false
     errors: {}
@@ -6,7 +6,7 @@ Darkswarm.factory 'CreditCard', ($injector, $rootScope, CreditCards, StripeJS, N
 
     requestToken: =>
       @setFullName()
-      StripeJS.requestToken(@secrets, @submit, t("saving_credit_card"))
+      StripeElements.requestToken(@secrets, @submit, t("saving_credit_card"))
 
     submit: =>
       params = @process_params()
diff --git a/app/assets/javascripts/darkswarm/services/stripe.js.coffee b/app/assets/javascripts/darkswarm/services/stripe.js.coffee
deleted file mode 100644
index 01fc54a30f..0000000000
--- a/app/assets/javascripts/darkswarm/services/stripe.js.coffee
+++ /dev/null
@@ -1,36 +0,0 @@
-Darkswarm.factory 'StripeJS', ($rootScope, Loading, RailsFlashLoader) ->
-  new class StripeJS
-    requestToken: (secrets, submit, loading_message = t("processing_payment")) ->
-      Loading.message = loading_message
-      params =
-        number: secrets.card_number
-        cvc: secrets.card_verification_value
-        exp_month: secrets.card_month or 0
-        exp_year: secrets.card_year or 0
-
-      # This is the global Stripe object created by Stripe.js, included in the _stripe partial
-      Stripe.card.createToken params, (status, response) =>
-        if response.error
-          $rootScope.$apply ->
-            Loading.clear()
-            RailsFlashLoader.loadFlash({error: t("error") + ": #{response.error.message}"})
-        else
-          secrets.token = response['id']
-          secrets.cc_type = @mapCC(response.card.brand)
-          secrets.card = response.card
-          submit()
-
-    mapCC: (ccType) ->
-      if ccType == 'MasterCard'
-        return 'mastercard'
-      else if ccType == 'Visa'
-        return 'visa'
-      else if ccType == 'American Express'
-        return 'amex'
-      else if ccType == 'Discover'
-        return 'discover'
-      else if ccType == 'Diners Club'
-        return 'dinersclub'
-      else if ccType == 'JCB'
-        return 'jcb'
-      return
diff --git a/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee b/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
index 881cfa63d0..b5fcb95209 100644
--- a/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
@@ -2,8 +2,9 @@ Darkswarm.factory 'StripeElements', ($rootScope, Loading, RailsFlashLoader, stri
   new class StripeElements
     # This is the global Stripe object created by Stripe.js [v3+], included in the _stripe partial
     stripe = stripeObject
+    # TODO: add locale here for translations of error messages etc. from Stripe
     elements = stripe.elements()
-    card = elements.create('card', hidePostalCode = false)
+    card = elements.create('card', {hidePostalCode: false})
 
     mountElements: ->
       card.mount('#card-element')
@@ -21,14 +22,14 @@ Darkswarm.factory 'StripeElements', ($rootScope, Loading, RailsFlashLoader, stri
     # New Stripe Elements method
     requestToken: (secrets, submit, loading_message = t("processing_payment")) ->
       Loading.message = loading_message
+      cardData = @makeCardData(secrets)
 
-      stripe.createToken(card).then (response) =>
+      stripe.createToken(card, cardData).then (response) =>
         if(response.error)
           $rootScope.$apply ->
             Loading.clear()
             RailsFlashLoader.loadFlash({error: t("error") + ": #{response.error.message}"})
         else
-          console.log(response)
           secrets.token = response.token.id
           secrets.cc_type = @mapCC(response.token.card.brand)
           secrets.card = response.token.card
@@ -48,3 +49,10 @@ Darkswarm.factory 'StripeElements', ($rootScope, Loading, RailsFlashLoader, stri
       else if ccType == 'JCB'
         return 'jcb'
       return
+
+    # It doesn't matter if any of these are nil, all are optional.
+    makeCardData: (secrets) ->
+      {'name': secrets.name,
+      'address1': secrets.address1,
+      'city': secrets.city,
+      'zipcode': secrets.zipcode}
diff --git a/app/views/checkout/payment/_stripe.html.haml b/app/views/checkout/payment/_stripe.html.haml
index 5574e3d9dd..70fa231522 100644
--- a/app/views/checkout/payment/_stripe.html.haml
+++ b/app/views/checkout/payment/_stripe.html.haml
@@ -1,5 +1,4 @@
 %label{:for => "card-element"}
-    Credit or debit card
     / a Stripe Element will be inserted here.
     #card-element{"ng-init" => " mountElements() "}
     / Used to display Element errors
diff --git a/app/views/spree/users/_new_card_form.html.haml b/app/views/spree/users/_new_card_form.html.haml
index ce1f14f1f1..53c14e2a91 100644
--- a/app/views/spree/users/_new_card_form.html.haml
+++ b/app/views/spree/users/_new_card_form.html.haml
@@ -10,26 +10,9 @@
       %label
         = t(:last_name)
       %input#last_name{type: :text, "ng-model" => "secrets.last_name", "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.lastname"}
-  .row
-    .small-6.columns
-      %label
-        = t(:card_number)
-      %input#card_number{type: :text, "ng-model" => "secrets.card_number", maxlength: 19, autocomplete: "off"}
-    .small-6.columns
-      %label
-        = t(:card_securitycode)
-      %input#security_code{type: :text, "ng-model" => "secrets.card_verification_value", autocomplete: "off"}
-
   .row
     .small-12.columns
-      %label{for: "secrets.card_month"}
-        = t(:card_expiry_date)
-  .row
-    .small-6.columns
-      %select#card_month{"ng-model" => "secrets.card_month", "ng-options" => "currMonth.value as currMonth.key for currMonth in months", name: "secrets.card_month"}
-    .small-6.columns
-      %select#card_year{"ng-model" => "secrets.card_year", "ng-options" => "year for year in years", name: "secrets.card_year"}
-
+      = render '/checkout/payment/stripe'
   %p
     %button.button.primary{type: :submit}
       = t(:add_card)
diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index 23c9e3b52d..29c213145d 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -4,7 +4,7 @@
   = inject_saved_credit_cards
 
   :javascript
-    Stripe.setPublishableKey("#{ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']}")
+    angular.module('Darkswarm').value("stripeObject", Stripe("#{ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']}"))
 
   .row.pad-top
     .small-12.columns.pad-top

From 6690f2e9e7d6f248ecbb42a24ed079adee6a8bc4 Mon Sep 17 00:00:00 2001
From: stveep <spettitt@gmail.com>
Date: Sun, 6 Aug 2017 19:06:56 +0100
Subject: [PATCH 272/353] Restyle add card form

---
 app/views/spree/users/_new_card_form.html.haml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/app/views/spree/users/_new_card_form.html.haml b/app/views/spree/users/_new_card_form.html.haml
index 53c14e2a91..368e19bc50 100644
--- a/app/views/spree/users/_new_card_form.html.haml
+++ b/app/views/spree/users/_new_card_form.html.haml
@@ -1,4 +1,9 @@
 %form{ novalidate: true, "ng-submit" => "storeCard()" }
+  .row
+    .small-12.columns
+      %label
+        = t(:card_details)
+      = render '/checkout/payment/stripe'
   .row
     .small-6.columns
       %label
@@ -11,8 +16,7 @@
         = t(:last_name)
       %input#last_name{type: :text, "ng-model" => "secrets.last_name", "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.lastname"}
   .row
-    .small-12.columns
-      = render '/checkout/payment/stripe'
-  %p
-    %button.button.primary{type: :submit}
-      = t(:add_card)
+    .small-4.columns
+      %p
+        %button.button.primary{type: :submit}
+          = t(:add_card)

From 746c2ffef98a67581ad09d776b1ca9429b50c9c1 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 30 Aug 2017 11:49:16 +1000
Subject: [PATCH 273/353] Add 'publishable_key' property to Stripe module
 (enables stubbing)

---
 .../admin/stripe_connect_settings/edit.html.haml      |  2 +-
 app/views/checkout/_payment.html.haml                 |  2 +-
 app/views/spree/users/show.html.haml                  |  2 +-
 config/initializers/stripe.rb                         | 11 +++++++++++
 4 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/app/views/admin/stripe_connect_settings/edit.html.haml b/app/views/admin/stripe_connect_settings/edit.html.haml
index d004d65f0e..43d90b4574 100644
--- a/app/views/admin/stripe_connect_settings/edit.html.haml
+++ b/app/views/admin/stripe_connect_settings/edit.html.haml
@@ -44,7 +44,7 @@
         = @obfuscated_secret_key
       .publishable_key
         %strong= t('.instance_publishable_key') + ":"
-        = ENV["STRIPE_INSTANCE_PUBLISHABLE_KEY"]
+        = Stripe.publishable_key
     - if !@stripe_account[:charges_enabled]
       .alert-box.warning
         = t(".charges_enabled_warning")
diff --git a/app/views/checkout/_payment.html.haml b/app/views/checkout/_payment.html.haml
index e7b29c7635..3ac4b8cdf9 100644
--- a/app/views/checkout/_payment.html.haml
+++ b/app/views/checkout/_payment.html.haml
@@ -1,6 +1,6 @@
 %fieldset#payment
   :javascript
-    angular.module('Darkswarm').value("stripeObject", Stripe("#{ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']}"))
+    angular.module('Darkswarm').value("stripeObject", Stripe("#{Stripe.publishable_key}"))
   %ng-form{"ng-controller" => "PaymentCtrl", name: "payment"}
 
     %h5{"ng-class" => "{valid: payment.$valid, dirty: payment.$dirty || submitted}"}
diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index 29c213145d..aae16de24f 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -4,7 +4,7 @@
   = inject_saved_credit_cards
 
   :javascript
-    angular.module('Darkswarm').value("stripeObject", Stripe("#{ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']}"))
+    angular.module('Darkswarm').value("stripeObject", Stripe("#{Stripe.publishable_key}"))
 
   .row.pad-top
     .small-12.columns.pad-top
diff --git a/config/initializers/stripe.rb b/config/initializers/stripe.rb
index 64bda99d91..c7ec6599d8 100644
--- a/config/initializers/stripe.rb
+++ b/config/initializers/stripe.rb
@@ -1,2 +1,13 @@
+# Add the :publishable_key property, to allow us to access this
+# property from the object, rather than calling from ENV directly.
+# This is mostly useful for stubbing when testing, but also feels
+# a bit cleaner than accessing keys in different ways.
+module Stripe
+  class << self
+    attr_accessor :publishable_key
+  end
+end
+
 Stripe.api_key = ENV['STRIPE_INSTANCE_SECRET_KEY']
+Stripe.publishable_key = ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']
 Stripe.client_id = ENV['STRIPE_CLIENT_ID']

From 65ab83a9a5bb2e01796be5cc66b2f957fd6faf54 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 30 Aug 2017 15:56:54 +1000
Subject: [PATCH 274/353] Move StripeElements element to an AngularJS
 directive, mount from there

---
 .../checkout/payment_controller.js.coffee     |  5 +---
 .../credit_cards_controller.js.coffee         |  5 +---
 .../directives/stripe_elements.js.coffee      | 27 +++++++++++++++++++
 .../services/stripe_elements.js.coffee        | 25 +++++------------
 app/views/checkout/payment/_stripe.html.haml  |  5 ----
 .../spree/checkout/payment/_stripe.html.haml  |  2 +-
 .../spree/users/_new_card_form.html.haml      |  2 +-
 7 files changed, 38 insertions(+), 33 deletions(-)
 create mode 100644 app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee
 delete mode 100644 app/views/checkout/payment/_stripe.html.haml

diff --git a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
index 756bfb753f..04ff6ab45e 100644
--- a/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/checkout/payment_controller.js.coffee
@@ -1,4 +1,4 @@
-Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards, StripeElements, Dates) ->
+Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards, Dates) ->
   angular.extend(this, new FieldsetMixin($scope))
 
   $scope.savedCreditCards = savedCreditCards
@@ -12,7 +12,4 @@ Darkswarm.controller "PaymentCtrl", ($scope, $timeout, savedCreditCards, StripeE
   $scope.summary = ->
     [$scope.Checkout.paymentMethod()?.name]
 
-  $scope.mountElements = ->
-    StripeElements.mountElements()
-
   $timeout $scope.onTimeout
diff --git a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
index 90225692e6..0875175c32 100644
--- a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
@@ -1,4 +1,4 @@
-Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, CreditCards, StripeElements, Dates) ->
+Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, CreditCards, Dates) ->
   angular.extend(this, new FieldsetMixin($scope))
   $scope.savedCreditCards = CreditCards.saved
   $scope.CreditCard = CreditCard
@@ -8,6 +8,3 @@ Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, CreditCar
 
   $scope.allow_name_change = true
   $scope.disable_fields = false
-  
-  $scope.mountElements = ->
-    StripeElements.mountElements()
diff --git a/app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee b/app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee
new file mode 100644
index 0000000000..c613fb3061
--- /dev/null
+++ b/app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee
@@ -0,0 +1,27 @@
+Darkswarm.directive "stripeElements", ($injector, StripeElements) ->
+  restrict: 'E'
+  template: "<label for='card-element'>\
+             <div id='card-element'></div>\
+             <div id='card-errors' class='error'></div>\
+             </label>"
+
+  link: (scope, elem, attr)->
+    if $injector.has('stripeObject')
+      stripe = $injector.get('stripeObject')
+
+      card = stripe.elements().create('card', {hidePostalCode: false})
+      card.mount('#card-element')
+
+      # Elements validates user input as it is typed. To help your customers
+      # catch mistakes, you should listen to change events on the card Element
+      # and display any errors:
+      card.addEventListener 'change', (event) ->
+        displayError = document.getElementById('card-errors')
+        if event.error
+          displayError.textContent = event.error.message
+        else
+          displayError.textContent = ''
+        return
+
+      StripeElements.stripe = stripe
+      StripeElements.card = card
diff --git a/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee b/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
index b5fcb95209..8c3837845f 100644
--- a/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
@@ -1,30 +1,19 @@
-Darkswarm.factory 'StripeElements', ($rootScope, Loading, RailsFlashLoader, stripeObject) ->
+Darkswarm.factory 'StripeElements', ($rootScope, Loading, RailsFlashLoader) ->
   new class StripeElements
-    # This is the global Stripe object created by Stripe.js [v3+], included in the _stripe partial
-    stripe = stripeObject
     # TODO: add locale here for translations of error messages etc. from Stripe
-    elements = stripe.elements()
-    card = elements.create('card', {hidePostalCode: false})
 
-    mountElements: ->
-      card.mount('#card-element')
-      # Elements validates user input as it is typed. To help your customers
-      # catch mistakes, you should listen to change events on the card Element
-      # and display any errors:
-      card.addEventListener 'change', (event) ->
-        displayError = document.getElementById('card-errors')
-        if event.error
-          displayError.textContent = event.error.message
-        else
-          displayError.textContent = ''
-        return
+    # These are both set from the StripeElements directive
+    stripe: null
+    card: null
 
     # New Stripe Elements method
     requestToken: (secrets, submit, loading_message = t("processing_payment")) ->
+      return unless @stripe? && @card?
+
       Loading.message = loading_message
       cardData = @makeCardData(secrets)
 
-      stripe.createToken(card, cardData).then (response) =>
+      @stripe.createToken(@card, cardData).then (response) =>
         if(response.error)
           $rootScope.$apply ->
             Loading.clear()
diff --git a/app/views/checkout/payment/_stripe.html.haml b/app/views/checkout/payment/_stripe.html.haml
deleted file mode 100644
index 70fa231522..0000000000
--- a/app/views/checkout/payment/_stripe.html.haml
+++ /dev/null
@@ -1,5 +0,0 @@
-%label{:for => "card-element"}
-    / a Stripe Element will be inserted here.
-    #card-element{"ng-init" => " mountElements() "}
-    / Used to display Element errors
-    #card-errors.error
diff --git a/app/views/spree/checkout/payment/_stripe.html.haml b/app/views/spree/checkout/payment/_stripe.html.haml
index 86db4e49a3..738bed97b0 100644
--- a/app/views/spree/checkout/payment/_stripe.html.haml
+++ b/app/views/spree/checkout/payment/_stripe.html.haml
@@ -8,7 +8,7 @@
       = t('.or_enter_new_card')
 
 %div{ ng: { if: '!secrets.selected_card' } }
-  = render "/checkout/payment/stripe"
+  %stripe-elements
 
   .row
     .small-12.columns.text-right
diff --git a/app/views/spree/users/_new_card_form.html.haml b/app/views/spree/users/_new_card_form.html.haml
index 368e19bc50..e410d9cc98 100644
--- a/app/views/spree/users/_new_card_form.html.haml
+++ b/app/views/spree/users/_new_card_form.html.haml
@@ -3,7 +3,7 @@
     .small-12.columns
       %label
         = t(:card_details)
-      = render '/checkout/payment/stripe'
+      %stripe-elements
   .row
     .small-6.columns
       %label

From 69385370ee346443872ae1320efd687bcae92a59 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 30 Aug 2017 16:06:50 +1000
Subject: [PATCH 275/353] Initialize Stripe object only if a publishable_key
 has been defined

---
 app/helpers/enterprises_helper.rb                | 4 +++-
 app/views/checkout/_payment.html.haml            | 6 ++++--
 app/views/spree/users/show.html.haml             | 7 ++++---
 spec/features/consumer/account/cards_spec.rb     | 1 +
 spec/features/consumer/shopping/checkout_spec.rb | 1 +
 spec/helpers/enterprises_helper_spec.rb          | 5 ++++-
 6 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/app/helpers/enterprises_helper.rb b/app/helpers/enterprises_helper.rb
index 1b5f54a84c..37df04b685 100644
--- a/app/helpers/enterprises_helper.rb
+++ b/app/helpers/enterprises_helper.rb
@@ -21,7 +21,9 @@ module EnterprisesHelper
   def available_payment_methods
     return [] unless current_distributor.present?
     payment_methods = current_distributor.payment_methods.available(:front_end).all
-    payment_methods.reject!{ |p| p.type.ends_with? "StripeConnect" } unless Spree::Config.stripe_connect_enabled
+
+    stripe_enabled = Spree::Config.stripe_connect_enabled && Stripe.publishable_key
+    payment_methods.reject!{ |p| p.type.ends_with? "StripeConnect" } unless stripe_enabled
 
     applicator = OpenFoodNetwork::TagRuleApplicator.new(current_distributor, "FilterPaymentMethods", current_customer.andand.tag_list)
     applicator.filter!(payment_methods)
diff --git a/app/views/checkout/_payment.html.haml b/app/views/checkout/_payment.html.haml
index 3ac4b8cdf9..ab3ad309be 100644
--- a/app/views/checkout/_payment.html.haml
+++ b/app/views/checkout/_payment.html.haml
@@ -1,6 +1,8 @@
 %fieldset#payment
-  :javascript
-    angular.module('Darkswarm').value("stripeObject", Stripe("#{Stripe.publishable_key}"))
+  - if Stripe.publishable_key
+    :javascript
+      angular.module('Darkswarm').value("stripeObject", Stripe("#{Stripe.publishable_key}"))
+
   %ng-form{"ng-controller" => "PaymentCtrl", name: "payment"}
 
     %h5{"ng-class" => "{valid: payment.$valid, dirty: payment.$dirty || submitted}"}
diff --git a/app/views/spree/users/show.html.haml b/app/views/spree/users/show.html.haml
index aae16de24f..23de4fd744 100644
--- a/app/views/spree/users/show.html.haml
+++ b/app/views/spree/users/show.html.haml
@@ -3,8 +3,9 @@
   = inject_shops
   = inject_saved_credit_cards
 
-  :javascript
-    angular.module('Darkswarm').value("stripeObject", Stripe("#{Stripe.publishable_key}"))
+  - if Stripe.publishable_key
+    :javascript
+      angular.module('Darkswarm').value("stripeObject", Stripe("#{Stripe.publishable_key}"))
 
   .row.pad-top
     .small-12.columns.pad-top
@@ -21,7 +22,7 @@
   .row.tabset-ctrl#account-tabs{ style: 'margin-bottom: 100px', navigate: 'true', selected: 'orders', prefix: 'account' }
     .small.12.medium-3.columns.tab{ name: "orders" }
       %a{ href: 'javascript:void(0)' }=t('.tabs.orders')
-    - if Spree::Config.stripe_connect_enabled
+    - if Spree::Config.stripe_connect_enabled && Stripe.publishable_key
       .small.12.medium-3.columns.tab{ name: "cards" }
         %a{ href: 'javascript:void(0)' }=t('.tabs.cards')
     .small.12.medium-3.columns.tab{ name: "transactions" }
diff --git a/spec/features/consumer/account/cards_spec.rb b/spec/features/consumer/account/cards_spec.rb
index 590c67d42b..2482d2b956 100644
--- a/spec/features/consumer/account/cards_spec.rb
+++ b/spec/features/consumer/account/cards_spec.rb
@@ -10,6 +10,7 @@ feature "Credit Cards", js: true do
       quick_login_as user
 
       allow(Stripe).to receive(:api_key) { "sk_test_xxxx" }
+      allow(Stripe).to receive(:publishable_key) { "some_token" }
       Spree::Config.set(stripe_connect_enabled: true)
 
       stub_request(:get, "https://api.stripe.com/v1/customers/cus_AZNMJ").
diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index a5da47e8ef..debcfabf15 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -158,6 +158,7 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
 
         before do
           allow(Stripe).to receive(:api_key) { "sk_test_12345" }
+          allow(Stripe).to receive(:publishable_key) { "some_key" }
           Spree::Config.set(stripe_connect_enabled: true)
           stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
             .to_return(body: JSON.generate(response_mock))
diff --git a/spec/helpers/enterprises_helper_spec.rb b/spec/helpers/enterprises_helper_spec.rb
index 2aa9131942..ac2307f94f 100644
--- a/spec/helpers/enterprises_helper_spec.rb
+++ b/spec/helpers/enterprises_helper_spec.rb
@@ -233,7 +233,10 @@ describe EnterprisesHelper do
       end
 
       context "and Stripe Connect is enabled" do
-        before { Spree::Config.set(stripe_connect_enabled: true) }
+        before do
+          Spree::Config.set(stripe_connect_enabled: true)
+          allow(Stripe).to receive(:publishable_key) { "some_key" }
+        end
 
         it "includes the Stripe payment method" do
           expect(helper.available_payment_methods.map(&:id)).to include pm3.id

From 1aa477c57c293e82751e11552450bc8ba2260f20 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 30 Aug 2017 16:37:16 +1000
Subject: [PATCH 276/353] Update feature specs to look for Stripe Elements
 element

---
 spec/features/consumer/account/cards_spec.rb     | 3 +--
 spec/features/consumer/shopping/checkout_spec.rb | 4 ++--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/spec/features/consumer/account/cards_spec.rb b/spec/features/consumer/account/cards_spec.rb
index 2482d2b956..3a9e32ddd6 100644
--- a/spec/features/consumer/account/cards_spec.rb
+++ b/spec/features/consumer/account/cards_spec.rb
@@ -35,8 +35,7 @@ feature "Credit Cards", js: true do
       # Shows the interface for adding a card
       click_button I18n.t(:add_a_card)
       expect(page).to have_field 'first_name'
-      expect(page).to have_field 'card_number'
-      expect(page).to have_field 'card_month'
+      expect(page).to have_selector '#card-element.StripeElement'
 
       # Allows deletion of cards
       click_link I18n.t(:delete)
diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index debcfabf15..0e95197011 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -174,9 +174,9 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
           expect(page).to have_content I18n.t("spree.checkout.payment.stripe.used_saved_card")
 
           # removes the input fields when a saved card is selected"
-          expect(page).to have_input "secrets.card_number"
+          expect(page).to have_selector "#card-element.StripeElement"
           select "Visa x-1111 Exp:01/2025", from: "selected_card"
-          expect(page).to_not have_input "secrets.card_number"
+          expect(page).to_not have_selector "#card-element.StripeElement"
 
           # allows checkout
           place_order

From f9df4d4c9330b591744ede6bf64ac67c4d9d9790 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 31 Aug 2017 16:10:53 +1000
Subject: [PATCH 277/353] Rewrite js unit specs for Stripe Elements service

---
 .../services/stripe_elements.js.coffee        |  5 ++--
 .../services/checkout_spec.js.coffee          | 14 ++++-----
 ....coffee => stripe_elements_spec.js.coffee} | 30 +++++++++++--------
 3 files changed, 27 insertions(+), 22 deletions(-)
 rename spec/javascripts/unit/darkswarm/services/{stripe_spec.js.coffee => stripe_elements_spec.js.coffee} (53%)

diff --git a/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee b/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
index 8c3837845f..256f6b1681 100644
--- a/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
@@ -15,9 +15,8 @@ Darkswarm.factory 'StripeElements', ($rootScope, Loading, RailsFlashLoader) ->
 
       @stripe.createToken(@card, cardData).then (response) =>
         if(response.error)
-          $rootScope.$apply ->
-            Loading.clear()
-            RailsFlashLoader.loadFlash({error: t("error") + ": #{response.error.message}"})
+          Loading.clear()
+          RailsFlashLoader.loadFlash({error: t("error") + ": #{response.error.message}"})
         else
           secrets.token = response.token.id
           secrets.cc_type = @mapCC(response.token.card.brand)
diff --git a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
index 1a107776f0..9120ad31b6 100644
--- a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
@@ -117,19 +117,19 @@ describe 'Checkout service', ->
         expect(Checkout.errors).toEqual {error: "frogs"}
 
     describe "when using the Stripe Connect gateway", ->
-      beforeEach inject ($injector, StripeJS) ->
+      beforeEach inject ($injector, StripeElements) ->
         Checkout.order.payment_method_id = 666
 
-      it "requests a Stripe token before submitting", inject (StripeJS) ->
-        spyOn(StripeJS, "requestToken")
+      it "requests a Stripe token before submitting", inject (StripeElements) ->
+        spyOn(StripeElements, "requestToken")
         Checkout.purchase()
-        expect(StripeJS.requestToken).toHaveBeenCalled()
+        expect(StripeElements.requestToken).toHaveBeenCalled()
 
-      it "doesn't hit Stripe when reusing a credit card", inject (StripeJS) ->
-        spyOn(StripeJS, "requestToken")
+      it "doesn't hit Stripe when reusing a credit card", inject (StripeElements) ->
+        spyOn(StripeElements, "requestToken")
         Checkout.secrets.selected_card = 1
         Checkout.purchase()
-        expect(StripeJS.requestToken).not.toHaveBeenCalled()
+        expect(StripeElements.requestToken).not.toHaveBeenCalled()
 
   describe "data preprocessing", ->
     beforeEach ->
diff --git a/spec/javascripts/unit/darkswarm/services/stripe_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/stripe_elements_spec.js.coffee
similarity index 53%
rename from spec/javascripts/unit/darkswarm/services/stripe_spec.js.coffee
rename to spec/javascripts/unit/darkswarm/services/stripe_elements_spec.js.coffee
index 1cf883b316..1cf860ed3c 100644
--- a/spec/javascripts/unit/darkswarm/services/stripe_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/services/stripe_elements_spec.js.coffee
@@ -1,6 +1,7 @@
-describe 'StripeJS Service', ->
-  $httpBackend = StripeJS = null
-  StripeMock = { card: {} }
+describe 'StripeElements Service', ->
+  $httpBackend = $q = $rootScope = StripeElements = null
+  StripeMock = { createToken: null }
+  CardMock = { some: "card" }
 
   beforeEach ->
     module 'Darkswarm'
@@ -8,9 +9,11 @@ describe 'StripeJS Service', ->
       $provide.value "railsFlash", null
       null
 
-    inject (_StripeJS_, _$httpBackend_) ->
+    inject (_StripeElements_, _$httpBackend_, _$q_, _$rootScope_) ->
       $httpBackend = _$httpBackend_
-      StripeJS = _StripeJS_
+      StripeElements = _StripeElements_
+      $q = _$q_
+      $rootScope = _$rootScope_
 
   describe "requestToken", ->
     secrets = {}
@@ -18,16 +21,18 @@ describe 'StripeJS Service', ->
     response = null
 
     beforeEach inject ($window) ->
-      $window.Stripe = StripeMock
+      StripeElements.stripe = StripeMock
+      StripeElements.card = CardMock
 
     describe "with satifactory data", ->
       beforeEach ->
         submit = jasmine.createSpy()
-        response = { id: "token", card: { brand: 'MasterCard', last4: "5678", exp_month: 10, exp_year: 2099 } }
-        StripeMock.card.createToken = (params, callback) => callback(200, response)
+        response = { token: { id: "token", card: { brand: 'MasterCard', last4: "5678", exp_month: 10, exp_year: 2099 } } }
+        StripeMock.createToken = => $q.when(response)
 
       it "saves the response data to secrets, and submits the form", ->
-        StripeJS.requestToken(secrets, submit)
+        StripeElements.requestToken(secrets, submit)
+        $rootScope.$digest() # required for #then to by called
         expect(secrets.token).toEqual "token"
         expect(secrets.cc_type).toEqual "mastercard"
         expect(submit).toHaveBeenCalled()
@@ -35,13 +40,14 @@ describe 'StripeJS Service', ->
     describe "with unsatifactory data", ->
       beforeEach ->
         submit = jasmine.createSpy()
-        response = { id: "token", error: { message: 'There was a problem' } }
-        StripeMock.card.createToken = (params, callback) => callback(400, response)
+        response = { token: {id: "token" }, error: { message: 'There was a problem' } }
+        StripeMock.createToken = => $q.when(response)
 
       it "doesn't submit the form, shows an error message instead", inject (Loading, RailsFlashLoader) ->
         spyOn(Loading, "clear")
         spyOn(RailsFlashLoader, "loadFlash")
-        StripeJS.requestToken(secrets, submit)
+        StripeElements.requestToken(secrets, submit)
+        $rootScope.$digest() # required for #then to by called
         expect(submit).not.toHaveBeenCalled()
         expect(Loading.clear).toHaveBeenCalled()
         expect(RailsFlashLoader.loadFlash).toHaveBeenCalledWith({error: "Error: There was a problem"})

From 2ed5e144ca5ebdb84077d3dc555d30735e45e59c Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sat, 2 Sep 2017 09:58:56 +1000
Subject: [PATCH 278/353] Convert problematic embedded shopfronts feature spec
 into request spec

---
 .../shopping/embedded_shopfronts_spec.rb      | 31 ----------
 .../embedded_shopfronts_headers_spec.rb       | 62 +++++++++++++++++++
 2 files changed, 62 insertions(+), 31 deletions(-)
 create mode 100644 spec/requests/embedded_shopfronts_headers_spec.rb

diff --git a/spec/features/consumer/shopping/embedded_shopfronts_spec.rb b/spec/features/consumer/shopping/embedded_shopfronts_spec.rb
index 4c88cd492d..4a4900e8c3 100644
--- a/spec/features/consumer/shopping/embedded_shopfronts_spec.rb
+++ b/spec/features/consumer/shopping/embedded_shopfronts_spec.rb
@@ -9,37 +9,6 @@ feature "Using embedded shopfront functionality", js: true do
 
   Capybara.server_port = 9999
 
-  describe "enabling embedded shopfronts" do
-    before do
-      Spree::Config[:enable_embedded_shopfronts] = false
-    end
-
-    it "disables iframes by default" do
-      visit shops_path
-      expect(page.response_headers['X-Frame-Options']).to eq 'DENY'
-      expect(page.response_headers['Content-Security-Policy']).to eq "frame-ancestors 'none'"
-    end
-
-    it "allows iframes on certain pages when enabled in configuration" do
-      quick_login_as_admin
-
-      visit spree.edit_admin_general_settings_path
-
-      check 'enable_embedded_shopfronts'
-      fill_in 'embedded_shopfronts_whitelist', with: "test.com"
-
-      click_button 'Update'
-
-      visit shops_path
-      expect(page.response_headers['X-Frame-Options']).to be_nil
-      expect(page.response_headers['Content-Security-Policy']).to eq "frame-ancestors test.com"
-
-      visit spree.admin_path
-      expect(page.response_headers['X-Frame-Options']).to eq 'DENY'
-      expect(page.response_headers['Content-Security-Policy']).to eq "frame-ancestors 'none'"
-    end
-  end
-
   describe "using iframes" do
     let(:distributor) { create(:distributor_enterprise, name: 'My Embedded Hub', permalink: 'test_enterprise', with_payment_and_shipping: true) }
     let(:supplier) { create(:supplier_enterprise) }
diff --git a/spec/requests/embedded_shopfronts_headers_spec.rb b/spec/requests/embedded_shopfronts_headers_spec.rb
new file mode 100644
index 0000000000..a991d7362c
--- /dev/null
+++ b/spec/requests/embedded_shopfronts_headers_spec.rb
@@ -0,0 +1,62 @@
+require 'spec_helper'
+
+describe "setting response headers for embedded shopfronts", type: :request do
+  include AuthenticationWorkflow
+
+  let(:enterprise) { create(:distributor_enterprise) }
+  let(:user) { enterprise.owner }
+
+  before do
+    quick_login_as(user)
+  end
+
+  context "with embedded shopfront disabled" do
+    before do
+      Spree::Config[:enable_embedded_shopfronts] = false
+    end
+
+    it "disables iframes by default" do
+      get shops_path
+      expect(response.status).to be 200
+      expect(response.headers['X-Frame-Options']).to eq 'DENY'
+      expect(response.headers['Content-Security-Policy']).to eq "frame-ancestors 'none'"
+    end
+  end
+
+  context "with embedded shopfronts enabled" do
+    before do
+      Spree::Config[:enable_embedded_shopfronts] = true
+    end
+
+    context "but no whitelist" do
+      before do
+        Spree::Config[:embedded_shopfronts_whitelist] = ""
+      end
+
+      it "disables iframes" do
+        get shops_path
+        expect(response.status).to be 200
+        expect(response.headers['X-Frame-Options']).to eq 'DENY'
+        expect(response.headers['Content-Security-Policy']).to eq "frame-ancestors 'none'"
+      end
+    end
+
+    context "with a valid whitelist" do
+      before do
+        Spree::Config[:embedded_shopfronts_whitelist] = "test.com"
+      end
+
+      it "allows iframes on certain pages when enabled in configuration" do
+        get shops_path
+        expect(response.status).to be 200
+        expect(response.headers['X-Frame-Options']).to be_nil
+        expect(response.headers['Content-Security-Policy']).to eq "frame-ancestors test.com"
+
+        get spree.admin_path
+        expect(response.status).to be 200
+        expect(response.headers['X-Frame-Options']).to eq 'DENY'
+        expect(response.headers['Content-Security-Policy']).to eq "frame-ancestors 'none'"
+      end
+    end
+  end
+end

From e4872172c876c732397722b3d9ad293fd170a8eb Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 7 Sep 2017 12:39:31 +1000
Subject: [PATCH 279/353] Move PaymentMethodSerializer to correct path

---
 .../api/admin/{payment_method => }/payment_method_serializer.rb   | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename app/serializers/api/admin/{payment_method => }/payment_method_serializer.rb (100%)

diff --git a/app/serializers/api/admin/payment_method/payment_method_serializer.rb b/app/serializers/api/admin/payment_method_serializer.rb
similarity index 100%
rename from app/serializers/api/admin/payment_method/payment_method_serializer.rb
rename to app/serializers/api/admin/payment_method_serializer.rb

From 7b456461f3dbd7f02179468dfb90aa1e70385431 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 7 Sep 2017 12:41:32 +1000
Subject: [PATCH 280/353] Add ng-model directive to save credit card checkbox

I have no idea how this was working before\?!\?!\?!
---
 app/views/spree/checkout/payment/_stripe.html.haml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/spree/checkout/payment/_stripe.html.haml b/app/views/spree/checkout/payment/_stripe.html.haml
index 738bed97b0..9ab8d4818e 100644
--- a/app/views/spree/checkout/payment/_stripe.html.haml
+++ b/app/views/spree/checkout/payment/_stripe.html.haml
@@ -12,5 +12,5 @@
 
   .row
     .small-12.columns.text-right
-      = check_box_tag 'secrets.save_requested_by_customer'
+      = check_box_tag 'secrets.save_requested_by_customer', '1', false, 'ng-model' => 'secrets.save_requested_by_customer'
       = label_tag 'secrets.save_requested_by_customer', t('.remember_this_card')

From dd56e03be13d0c01253b85aa0f64893a9c7a7dfd Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 6 Jul 2017 12:43:38 +1000
Subject: [PATCH 281/353] Stop setting host for url helpers in specs

---
 config/environments/test.rb                              | 2 +-
 spec/controllers/spree/admin/products_controller_spec.rb | 2 +-
 spec/controllers/user_passwords_controller_spec.rb       | 1 -
 spec/features/admin/orders_spec.rb                       | 1 -
 spec/spec_helper.rb                                      | 3 +++
 5 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/config/environments/test.rb b/config/environments/test.rb
index f0ef05acaa..3a33fd53d7 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -45,7 +45,6 @@ Openfoodnetwork::Application.configure do
 
   # Print deprecation notices to the stderr
   config.active_support.deprecation = :stderr
-  config.action_mailer.default_url_options = { :host => "test.host" }
 
   # To block requests before running the database cleaner
   require 'open_food_network/rack_request_blocker'
@@ -55,3 +54,4 @@ end
 
 # Allows us to use _url helpers in Rspec
 Rails.application.routes.default_url_options[:host] = 'test.host'
+Spree::Core::Engine.routes.default_url_options[:host] = 'test.host'
diff --git a/spec/controllers/spree/admin/products_controller_spec.rb b/spec/controllers/spree/admin/products_controller_spec.rb
index b8d76abd9c..02a5d6bced 100644
--- a/spec/controllers/spree/admin/products_controller_spec.rb
+++ b/spec/controllers/spree/admin/products_controller_spec.rb
@@ -12,7 +12,7 @@ describe Spree::Admin::ProductsController do
     end
 
     it "denies access" do
-      response.should redirect_to "http://test.host/unauthorized"
+      response.should redirect_to spree.unauthorized_url
     end
 
     it "does not update any product" do
diff --git a/spec/controllers/user_passwords_controller_spec.rb b/spec/controllers/user_passwords_controller_spec.rb
index 59fadf8e99..26584a8619 100644
--- a/spec/controllers/user_passwords_controller_spec.rb
+++ b/spec/controllers/user_passwords_controller_spec.rb
@@ -6,7 +6,6 @@ describe UserPasswordsController do
 
   before do
     @request.env["devise.mapping"] = Devise.mappings[:spree_user]
-    ActionMailer::Base.default_url_options[:host] = "test.host"
   end
 
   describe "create" do
diff --git a/spec/features/admin/orders_spec.rb b/spec/features/admin/orders_spec.rb
index 5b0a215dd8..4b5df630f1 100644
--- a/spec/features/admin/orders_spec.rb
+++ b/spec/features/admin/orders_spec.rb
@@ -204,7 +204,6 @@ feature %q{
     end
 
     context "viewing the edit page" do
-      before { Rails.application.routes.default_url_options[:host] = "test.host" }
       it "shows the dropdown menu" do
         distributor1.update_attribute(:abn, '12345678')
         order = create(:completed_order_with_totals, distributor: distributor1)
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index e24d2a7cf7..4ef7c63b40 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -47,6 +47,9 @@ Capybara.default_max_wait_time = 30
 
 require "paperclip/matchers"
 
+# Override setting in Spree engine: Spree::Core::MailSettings
+ActionMailer::Base.default_url_options[:host] = 'test.host'
+
 RSpec.configure do |config|
   # ## Mock Framework
   #

From ecef90544429a989c341adbda912e5149b65083f Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 7 Sep 2017 18:05:23 +1000
Subject: [PATCH 282/353] Allow Stripe-based payments to be voided (refunded)

---
 app/models/spree/gateway/stripe_connect.rb    |  5 ++
 .../spree/admin/payments_controller_spec.rb   | 72 +++++++++++++++++++
 2 files changed, 77 insertions(+)
 create mode 100644 spec/controllers/spree/admin/payments_controller_spec.rb

diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index 06a632c04a..7745ca708e 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -31,6 +31,11 @@ module Spree
         provider.purchase(*options_for_purchase_or_auth(money, creditcard, gateway_options))
       end
 
+      def void(response_code, creditcard, gateway_options)
+        gateway_options[:stripe_account] = stripe_account_id
+        provider.void(response_code, gateway_options)
+      end
+
       def create_profile(payment)
         return unless payment.source.gateway_customer_profile_id.nil?
         options = {
diff --git a/spec/controllers/spree/admin/payments_controller_spec.rb b/spec/controllers/spree/admin/payments_controller_spec.rb
new file mode 100644
index 0000000000..79a6e0ed65
--- /dev/null
+++ b/spec/controllers/spree/admin/payments_controller_spec.rb
@@ -0,0 +1,72 @@
+module Spree
+  module Admin
+    describe PaymentsController do
+      let!(:shop) { create(:enterprise) }
+      let!(:user) { shop.owner }
+      let!(:order) { create(:order, distributor: shop) }
+      let!(:line_item) { create(:line_item, order: order, price: 5.0) }
+
+      context "as an enterprise user" do
+        before do
+          allow(controller).to receive(:spree_current_user) { user }
+          order.reload.update_totals
+        end
+
+        context "requesting a refund on a payment" do
+          let(:params) { { id: payment.id, order_id: order.number, e: :void } }
+
+          # Required for the respond override in the controller decorator to work
+          before { @request.env['HTTP_REFERER'] = spree.admin_order_payments_url(payment) }
+
+          context "that was processed by stripe" do
+            let!(:payment_method) { create(:stripe_payment_method, distributors: [shop]) }
+            # let!(:credit_card) { create(:credit_card, gateway_customer_profile_id: "cus_1", gateway_payment_profile_id: 'card_2') }
+            let!(:payment) { create(:payment, order: order, state: 'completed', payment_method: payment_method, response_code: 'ch_1a2b3c', amount: order.total) }
+
+
+            before do
+              allow(Stripe).to receive(:api_key) { "sk_test_12345" }
+            end
+
+            context "where the request succeeds" do
+              before do
+                stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges/ch_1a2b3c/refunds").
+                to_return(:status => 200, :body => JSON.generate(id: 're_123', object: 'refund', status: 'succeeded') )
+              end
+
+              it "voids the payment" do
+                order.reload
+                expect(order.payment_total).to_not eq 0
+                expect(order.outstanding_balance).to eq 0
+                spree_put :fire, params
+                expect(payment.reload.state).to eq 'void'
+                order.reload
+                expect(order.payment_total).to eq 0
+                expect(order.outstanding_balance).to_not eq 0
+              end
+            end
+
+            context "where the request fails" do
+              before do
+                stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges/ch_1a2b3c/refunds").
+                to_return(:status => 200, :body => JSON.generate(error: { message: "Bup-bow!"}) )
+              end
+
+              it "does not void the payment" do
+                order.reload
+                expect(order.payment_total).to_not eq 0
+                expect(order.outstanding_balance).to eq 0
+                spree_put :fire, params
+                expect(payment.reload.state).to eq 'completed'
+                order.reload
+                expect(order.payment_total).to_not eq 0
+                expect(order.outstanding_balance).to eq 0
+                expect(flash[:error]).to eq "Bup-bow!"
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

From 742dd0b5dd8f28c519af65a96a6218810fc338fb Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 7 Sep 2017 18:51:07 +1000
Subject: [PATCH 283/353] Clean up jquery dialog styling

---
 .../stylesheets/admin/components/jquery_dialog.scss      | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/app/assets/stylesheets/admin/components/jquery_dialog.scss b/app/assets/stylesheets/admin/components/jquery_dialog.scss
index 35f410dbb6..13e2f87bda 100644
--- a/app/assets/stylesheets/admin/components/jquery_dialog.scss
+++ b/app/assets/stylesheets/admin/components/jquery_dialog.scss
@@ -24,8 +24,6 @@ light: #ccc
   }
 }
 
-/*.ui-dialog .ui-icon-closethick{background:url(/static/assets/dialogCloseButton.png);}*/
-
 .ui-dialog .ui-widget-header{
   background-image: none;
   background-color: #ffffff;
@@ -42,13 +40,6 @@ light: #ccc
 .ui-dialog .ui-corner-all{
   border-radius: 8px;
 }
-// .ui-dialog  {
-//   .ui-state-hover, .ui-state-focus{
-//     border: none;
-//     background: none;
-//     color: #545454;
-//   }
-// }
 
 .ui-state-hover, .ui-widget-header .ui-state-hover, .ui-widget-content .ui-state-hover {
   background-color: #ffffff;

From 2f153d799b0bbed4435b61a7850538b605f368ad Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 7 Sep 2017 18:56:17 +1000
Subject: [PATCH 284/353] Hide 'save credit card' checkbox for guests

---
 app/views/spree/checkout/payment/_stripe.html.haml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/app/views/spree/checkout/payment/_stripe.html.haml b/app/views/spree/checkout/payment/_stripe.html.haml
index 9ab8d4818e..3c1bc0c35e 100644
--- a/app/views/spree/checkout/payment/_stripe.html.haml
+++ b/app/views/spree/checkout/payment/_stripe.html.haml
@@ -10,7 +10,8 @@
 %div{ ng: { if: '!secrets.selected_card' } }
   %stripe-elements
 
-  .row
-    .small-12.columns.text-right
-      = check_box_tag 'secrets.save_requested_by_customer', '1', false, 'ng-model' => 'secrets.save_requested_by_customer'
-      = label_tag 'secrets.save_requested_by_customer', t('.remember_this_card')
+  - if spree_current_user
+    .row
+      .small-12.columns.text-right
+        = check_box_tag 'secrets.save_requested_by_customer', '1', false, 'ng-model' => 'secrets.save_requested_by_customer'
+        = label_tag 'secrets.save_requested_by_customer', t('.remember_this_card')

From ca1987fc87b1dcee284abb66907b5aa00c0b4897 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 8 Sep 2017 10:17:47 +1000
Subject: [PATCH 285/353] Prevent Stripe payment methods without account owners
 from being saved

---
 .../payment_methods_controller_decorator.rb   |  2 +-
 app/models/spree/gateway/stripe_connect.rb    |  7 +++++
 .../admin/payment_methods_controller_spec.rb  | 26 ++++++++++++++++++-
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/app/controllers/spree/admin/payment_methods_controller_decorator.rb b/app/controllers/spree/admin/payment_methods_controller_decorator.rb
index b13bcd2f17..aea47a05f3 100644
--- a/app/controllers/spree/admin/payment_methods_controller_decorator.rb
+++ b/app/controllers/spree/admin/payment_methods_controller_decorator.rb
@@ -74,7 +74,7 @@ module Spree
 
       def restrict_stripe_account_change
         return unless @payment_method.try(:type) == "Spree::Gateway::StripeConnect"
-        return unless @payment_method.preferred_enterprise_id
+        return unless @payment_method.preferred_enterprise_id.andand > 0
 
         @stripe_account_holder = Enterprise.find(@payment_method.preferred_enterprise_id)
         return if spree_current_user.enterprises.include? @stripe_account_holder
diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index 7745ca708e..d3ac5fd49d 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -3,6 +3,8 @@ module Spree
     class StripeConnect < Gateway
       preference :enterprise_id, :integer
 
+      validate :ensure_enterprise_selected
+
       attr_accessible :preferred_enterprise_id
 
       CARD_TYPE_MAPPING = {
@@ -132,6 +134,11 @@ module Spree
         Rails.logger.error("Stripe Error: #{e}")
         nil
       end
+
+      def ensure_enterprise_selected
+        return if preferred_enterprise_id.andand > 0
+        errors.add(:stripe_account_owner, I18n.t(:error_required))
+      end
     end
   end
 end
diff --git a/spec/controllers/spree/admin/payment_methods_controller_spec.rb b/spec/controllers/spree/admin/payment_methods_controller_spec.rb
index b3942bfa92..681d7c5309 100644
--- a/spec/controllers/spree/admin/payment_methods_controller_spec.rb
+++ b/spec/controllers/spree/admin/payment_methods_controller_spec.rb
@@ -20,13 +20,37 @@ describe Spree::Admin::PaymentMethodsController do
           end
         end
 
-        context "as a user that does not manage the existing stripe account holder" do
+        context "as a user that manages the existing stripe account holder" do
           before { enterprise2.update_attributes!(owner_id: user.id) }
 
           it "allows the stripe account holder to be updated" do
             spree_put :update, params
             expect(payment_method.reload.preferred_enterprise_id).to eq enterprise1.id
           end
+
+          context "when no enterprise is selected as the account holder" do
+            before { payment_method.update_attribute(:preferred_enterprise_id, nil) }
+
+            context "id not provided at all" do
+              before { params[:payment_method].delete(:preferred_enterprise_id) }
+
+              it "does not save the payment method" do
+                spree_put :update, params
+                expect(response).to render_template :edit
+                expect(assigns(:payment_method).errors.messages[:stripe_account_owner]).to include I18n.t(:error_required)
+              end
+            end
+
+            context "enterprise_id of 0" do
+              before { params[:payment_method][:preferred_enterprise_id] = 0 }
+
+              it "does not save the payment method" do
+                spree_put :update, params
+                expect(response).to render_template :edit
+                expect(assigns(:payment_method).errors.messages[:stripe_account_owner]).to include I18n.t(:error_required)
+              end
+            end
+          end
         end
       end
     end

From 0cd43987de7f53222f7e22c676088f1f7a6aef75 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 8 Sep 2017 10:45:30 +1000
Subject: [PATCH 286/353] Hide Stripe payment methods without a
 preferred_enterprise_id from the front-end

---
 app/helpers/enterprises_helper.rb       | 12 ++++++++++--
 spec/helpers/enterprises_helper_spec.rb | 16 +++++++++++-----
 2 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/app/helpers/enterprises_helper.rb b/app/helpers/enterprises_helper.rb
index 37df04b685..94c3901f8a 100644
--- a/app/helpers/enterprises_helper.rb
+++ b/app/helpers/enterprises_helper.rb
@@ -22,8 +22,7 @@ module EnterprisesHelper
     return [] unless current_distributor.present?
     payment_methods = current_distributor.payment_methods.available(:front_end).all
 
-    stripe_enabled = Spree::Config.stripe_connect_enabled && Stripe.publishable_key
-    payment_methods.reject!{ |p| p.type.ends_with? "StripeConnect" } unless stripe_enabled
+    apply_stripe_filters_to(payment_methods)
 
     applicator = OpenFoodNetwork::TagRuleApplicator.new(current_distributor, "FilterPaymentMethods", current_customer.andand.tag_list)
     applicator.filter!(payment_methods)
@@ -99,4 +98,13 @@ module EnterprisesHelper
   def show_bought_items?
     order_changes_allowed? && current_order.finalised_line_items.present?
   end
+
+  def apply_stripe_filters_to(payment_methods)
+    stripe_enabled = Spree::Config.stripe_connect_enabled && Stripe.publishable_key
+    if stripe_enabled
+      payment_methods.reject!{ |p| p.type.ends_with?("StripeConnect") && p.preferred_enterprise_id == 0 }
+    else
+      payment_methods.reject!{ |p| p.type.ends_with?("StripeConnect") }
+    end
+  end
 end
diff --git a/spec/helpers/enterprises_helper_spec.rb b/spec/helpers/enterprises_helper_spec.rb
index ac2307f94f..9ab6d1d17d 100644
--- a/spec/helpers/enterprises_helper_spec.rb
+++ b/spec/helpers/enterprises_helper_spec.rb
@@ -221,14 +221,19 @@ describe EnterprisesHelper do
     end
 
     context "when StripeConnect payment methods are present" do
-      let!(:pm3) { create(:payment_method, type: "Spree::Gateway::StripeConnect", distributors: [distributor])}
-      before { allow(helper).to receive(:current_distributor) { distributor } }
+      let!(:pm3) { create(:stripe_payment_method, distributors: [distributor], preferred_enterprise_id: distributor.id) }
+      let!(:pm4) { create(:stripe_payment_method, distributors: [distributor], preferred_enterprise_id: distributor.id) }
+
+      before do
+        allow(helper).to receive(:current_distributor) { distributor }
+        pm4.update_attribute(:preferred_enterprise_id, nil)
+      end
 
       context "and Stripe Connect is disabled" do
         before { Spree::Config.set(stripe_connect_enabled: false) }
 
-        it "ignores the Stripe payment method" do
-          expect(helper.available_payment_methods.map(&:id)).to_not include pm3.id
+        it "ignores Stripe payment methods" do
+          expect(helper.available_payment_methods.map(&:id)).to_not include pm3.id, pm4.id
         end
       end
 
@@ -238,8 +243,9 @@ describe EnterprisesHelper do
           allow(Stripe).to receive(:publishable_key) { "some_key" }
         end
 
-        it "includes the Stripe payment method" do
+        it "includes Stripe payment methods with a preferred_enterprise_id" do
           expect(helper.available_payment_methods.map(&:id)).to include pm3.id
+          expect(helper.available_payment_methods.map(&:id)).to_not include pm4.id
         end
       end
     end

From 3a0b47c451dc7c50b90ac7c9b0889994fdb5c00f Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 8 Sep 2017 11:32:11 +1000
Subject: [PATCH 287/353] Add border to Stripe Elements input, make text larger

---
 .../directives/stripe_elements.js.coffee         | 10 +++++++++-
 .../darkswarm/stripe-elements.css.scss           | 16 ++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 app/assets/stylesheets/darkswarm/stripe-elements.css.scss

diff --git a/app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee b/app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee
index c613fb3061..0465a87e79 100644
--- a/app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee
+++ b/app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee
@@ -9,7 +9,15 @@ Darkswarm.directive "stripeElements", ($injector, StripeElements) ->
     if $injector.has('stripeObject')
       stripe = $injector.get('stripeObject')
 
-      card = stripe.elements().create('card', {hidePostalCode: false})
+      card = stripe.elements().create 'card',
+        hidePostalCode: false
+        style:
+          base:
+            fontFamily: "Roboto, Arial, sans-serif"
+            fontSize: '16px'
+            color: '#4c4c4c'
+            '::placeholder':
+              color: '#6c6c6c'
       card.mount('#card-element')
 
       # Elements validates user input as it is typed. To help your customers
diff --git a/app/assets/stylesheets/darkswarm/stripe-elements.css.scss b/app/assets/stylesheets/darkswarm/stripe-elements.css.scss
new file mode 100644
index 0000000000..1318aa9b81
--- /dev/null
+++ b/app/assets/stylesheets/darkswarm/stripe-elements.css.scss
@@ -0,0 +1,16 @@
+stripe-elements #card-element {
+  background: white;
+  box-sizing: border-box;
+  font-weight: 400;
+  padding: 0.8rem 0.5rem;
+  border: 1px solid #cccccc;
+  box-shadow: inset 0 1px 2px rgba(0, 0, 0, 0.1);
+  border-radius: 0px;
+  color: #32315E;
+  outline: none;
+  height: 48px;
+  line-height: 48px;
+  cursor: text;
+  width: 100%;
+  float: right;
+}

From 19213a5ca8884fbefec2a84cae57d28270d7fab9 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 8 Sep 2017 12:20:58 +1000
Subject: [PATCH 288/353] Rearrange new card inputs on account page

---
 .../directives/stripe_elements.js.coffee      |  2 +-
 .../darkswarm/stripe-elements.css.scss        | 30 +++++++++----------
 .../spree/users/_new_card_form.html.haml      | 10 +++----
 3 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee b/app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee
index 0465a87e79..d325b6f962 100644
--- a/app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee
+++ b/app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee
@@ -15,7 +15,7 @@ Darkswarm.directive "stripeElements", ($injector, StripeElements) ->
           base:
             fontFamily: "Roboto, Arial, sans-serif"
             fontSize: '16px'
-            color: '#4c4c4c'
+            color: '#5c5c5c'
             '::placeholder':
               color: '#6c6c6c'
       card.mount('#card-element')
diff --git a/app/assets/stylesheets/darkswarm/stripe-elements.css.scss b/app/assets/stylesheets/darkswarm/stripe-elements.css.scss
index 1318aa9b81..5ef854746a 100644
--- a/app/assets/stylesheets/darkswarm/stripe-elements.css.scss
+++ b/app/assets/stylesheets/darkswarm/stripe-elements.css.scss
@@ -1,16 +1,16 @@
-stripe-elements #card-element {
-  background: white;
-  box-sizing: border-box;
-  font-weight: 400;
-  padding: 0.8rem 0.5rem;
-  border: 1px solid #cccccc;
-  box-shadow: inset 0 1px 2px rgba(0, 0, 0, 0.1);
-  border-radius: 0px;
-  color: #32315E;
-  outline: none;
-  height: 48px;
-  line-height: 48px;
-  cursor: text;
-  width: 100%;
-  float: right;
+stripe-elements {
+  margin-bottom: 15px;
+  display: block;
+
+  #card-element {
+    background: white;
+    box-sizing: border-box;
+    font-weight: 400;
+    padding: 0.6rem 0.5rem;
+    border: 1px solid #cccccc;
+    box-shadow: inset 0 1px 2px rgba(0, 0, 0, 0.1);
+    border-radius: 0px;
+    height: 42px;
+    width: 100%;
+  }
 }
diff --git a/app/views/spree/users/_new_card_form.html.haml b/app/views/spree/users/_new_card_form.html.haml
index e410d9cc98..af780ace8f 100644
--- a/app/views/spree/users/_new_card_form.html.haml
+++ b/app/views/spree/users/_new_card_form.html.haml
@@ -1,9 +1,4 @@
 %form{ novalidate: true, "ng-submit" => "storeCard()" }
-  .row
-    .small-12.columns
-      %label
-        = t(:card_details)
-      %stripe-elements
   .row
     .small-6.columns
       %label
@@ -15,6 +10,11 @@
       %label
         = t(:last_name)
       %input#last_name{type: :text, "ng-model" => "secrets.last_name", "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.lastname"}
+  .row
+    .small-12.columns
+      %label
+        = t(:card_details)
+      %stripe-elements
   .row
     .small-4.columns
       %p

From 9832966b7785caedbeadc16ccfcd9b29531a5b6c Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 8 Sep 2017 23:54:10 +1000
Subject: [PATCH 289/353] Fix Admin::PaymentsController spec

---
 .../spree/admin/payments_controller_spec.rb   | 116 +++++++++---------
 1 file changed, 57 insertions(+), 59 deletions(-)

diff --git a/spec/controllers/spree/admin/payments_controller_spec.rb b/spec/controllers/spree/admin/payments_controller_spec.rb
index 79a6e0ed65..cfc1b3336c 100644
--- a/spec/controllers/spree/admin/payments_controller_spec.rb
+++ b/spec/controllers/spree/admin/payments_controller_spec.rb
@@ -1,69 +1,67 @@
-module Spree
-  module Admin
-    describe PaymentsController do
-      let!(:shop) { create(:enterprise) }
-      let!(:user) { shop.owner }
-      let!(:order) { create(:order, distributor: shop) }
-      let!(:line_item) { create(:line_item, order: order, price: 5.0) }
+require 'spec_helper'
+
+describe Spree::Admin::PaymentsController do
+  let!(:shop) { create(:enterprise) }
+  let!(:user) { shop.owner }
+  let!(:order) { create(:order, distributor: shop) }
+  let!(:line_item) { create(:line_item, order: order, price: 5.0) }
+
+  context "as an enterprise user" do
+    before do
+      allow(controller).to receive(:spree_current_user) { user }
+      order.reload.update_totals
+    end
+
+    context "requesting a refund on a payment" do
+      let(:params) { { id: payment.id, order_id: order.number, e: :void } }
+
+      # Required for the respond override in the controller decorator to work
+      before { @request.env['HTTP_REFERER'] = spree.admin_order_payments_url(payment) }
+
+      context "that was processed by stripe" do
+        let!(:payment_method) { create(:stripe_payment_method, distributors: [shop], preferred_enterprise_id: shop.id) }
+        # let!(:credit_card) { create(:credit_card, gateway_customer_profile_id: "cus_1", gateway_payment_profile_id: 'card_2') }
+        let!(:payment) { create(:payment, order: order, state: 'completed', payment_method: payment_method, response_code: 'ch_1a2b3c', amount: order.total) }
+
 
-      context "as an enterprise user" do
         before do
-          allow(controller).to receive(:spree_current_user) { user }
-          order.reload.update_totals
+          allow(Stripe).to receive(:api_key) { "sk_test_12345" }
         end
 
-        context "requesting a refund on a payment" do
-          let(:params) { { id: payment.id, order_id: order.number, e: :void } }
+        context "where the request succeeds" do
+          before do
+            stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges/ch_1a2b3c/refunds").
+            to_return(:status => 200, :body => JSON.generate(id: 're_123', object: 'refund', status: 'succeeded') )
+          end
 
-          # Required for the respond override in the controller decorator to work
-          before { @request.env['HTTP_REFERER'] = spree.admin_order_payments_url(payment) }
+          it "voids the payment" do
+            order.reload
+            expect(order.payment_total).to_not eq 0
+            expect(order.outstanding_balance).to eq 0
+            spree_put :fire, params
+            expect(payment.reload.state).to eq 'void'
+            order.reload
+            expect(order.payment_total).to eq 0
+            expect(order.outstanding_balance).to_not eq 0
+          end
+        end
 
-          context "that was processed by stripe" do
-            let!(:payment_method) { create(:stripe_payment_method, distributors: [shop]) }
-            # let!(:credit_card) { create(:credit_card, gateway_customer_profile_id: "cus_1", gateway_payment_profile_id: 'card_2') }
-            let!(:payment) { create(:payment, order: order, state: 'completed', payment_method: payment_method, response_code: 'ch_1a2b3c', amount: order.total) }
+        context "where the request fails" do
+          before do
+            stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges/ch_1a2b3c/refunds").
+            to_return(:status => 200, :body => JSON.generate(error: { message: "Bup-bow!"}) )
+          end
 
-
-            before do
-              allow(Stripe).to receive(:api_key) { "sk_test_12345" }
-            end
-
-            context "where the request succeeds" do
-              before do
-                stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges/ch_1a2b3c/refunds").
-                to_return(:status => 200, :body => JSON.generate(id: 're_123', object: 'refund', status: 'succeeded') )
-              end
-
-              it "voids the payment" do
-                order.reload
-                expect(order.payment_total).to_not eq 0
-                expect(order.outstanding_balance).to eq 0
-                spree_put :fire, params
-                expect(payment.reload.state).to eq 'void'
-                order.reload
-                expect(order.payment_total).to eq 0
-                expect(order.outstanding_balance).to_not eq 0
-              end
-            end
-
-            context "where the request fails" do
-              before do
-                stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges/ch_1a2b3c/refunds").
-                to_return(:status => 200, :body => JSON.generate(error: { message: "Bup-bow!"}) )
-              end
-
-              it "does not void the payment" do
-                order.reload
-                expect(order.payment_total).to_not eq 0
-                expect(order.outstanding_balance).to eq 0
-                spree_put :fire, params
-                expect(payment.reload.state).to eq 'completed'
-                order.reload
-                expect(order.payment_total).to_not eq 0
-                expect(order.outstanding_balance).to eq 0
-                expect(flash[:error]).to eq "Bup-bow!"
-              end
-            end
+          it "does not void the payment" do
+            order.reload
+            expect(order.payment_total).to_not eq 0
+            expect(order.outstanding_balance).to eq 0
+            spree_put :fire, params
+            expect(payment.reload.state).to eq 'completed'
+            order.reload
+            expect(order.payment_total).to_not eq 0
+            expect(order.outstanding_balance).to eq 0
+            expect(flash[:error]).to eq "Bup-bow!"
           end
         end
       end

From 22bbe29f3d0431246a4065213de4896b7e5c4ca7 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 12:03:53 +1000
Subject: [PATCH 290/353] Call single-use before_filters from actions instead

---
 app/controllers/enterprises_controller.rb        |  3 ++-
 app/controllers/spree/credit_cards_controller.rb | 10 +++-------
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/app/controllers/enterprises_controller.rb b/app/controllers/enterprises_controller.rb
index 8f38f4e095..06926a746c 100644
--- a/app/controllers/enterprises_controller.rb
+++ b/app/controllers/enterprises_controller.rb
@@ -11,11 +11,12 @@ class EnterprisesController < BaseController
 
   before_filter :clean_permalink, only: :check_permalink
   before_filter :enable_embedded_shopfront
-  before_filter :set_enterprise, only: :relatives
 
   respond_to :js, only: :permalink_checker
 
   def relatives
+    set_enterprise
+
     respond_to do |format|
       format.json do
         enterprises = @enterprise.andand.relatives.andand.activated
diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
index a39db0d929..aa67514f47 100644
--- a/app/controllers/spree/credit_cards_controller.rb
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -1,8 +1,5 @@
 module Spree
   class CreditCardsController < BaseController
-    before_filter :set_credit_card, only: [:destroy]
-    before_filter :destroy_at_stripe, only: [:destroy]
-
     def new_from_token
       # A new Customer is created for every credit card (same as via ActiveMerchant)
       # Note that default_source is the card represented by the token
@@ -20,6 +17,9 @@ module Spree
     end
 
     def destroy
+      @credit_card = Spree::CreditCard.find(params[:id])
+      destroy_at_stripe
+
       if @credit_card.destroy
         flash[:success] = I18n.t(:card_has_been_removed, number: "x-#{@credit_card.last_digits}")
       else
@@ -58,9 +58,5 @@ module Spree
       card.user_id = spree_current_user.id
       card
     end
-
-    def set_credit_card
-      @credit_card = Spree::CreditCard.find(params[:id])
-    end
   end
 end

From 4464a85a74a864baa85213b60e9301c8e3fd8ede Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 15:02:19 +1000
Subject: [PATCH 291/353] Add missing controller specs for CreditCardController
 #destroy

---
 .../spree/credit_cards_controller.rb          | 19 ++--
 app/models/spree/ability_decorator.rb         |  5 ++
 app/models/spree/credit_card_decorator.rb     |  2 +
 .../spree/credit_cards_controller_spec.rb     | 90 ++++++++++++++++---
 4 files changed, 97 insertions(+), 19 deletions(-)

diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
index aa67514f47..a4b8ce9479 100644
--- a/app/controllers/spree/credit_cards_controller.rb
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -17,25 +17,32 @@ module Spree
     end
 
     def destroy
-      @credit_card = Spree::CreditCard.find(params[:id])
-      destroy_at_stripe
+      @credit_card = Spree::CreditCard.find_by_id(params[:id])
+      if @credit_card
+        authorize! :destroy, @credit_card
+        destroy_at_stripe
+      end
 
-      if @credit_card.destroy
+      # Using try because we may not have a card here
+      if @credit_card.try(:destroy)
         flash[:success] = I18n.t(:card_has_been_removed, number: "x-#{@credit_card.last_digits}")
       else
         flash[:error] = I18n.t(:card_could_not_be_removed)
       end
-      redirect_to "/account#/cards"
+      redirect_to account_path(anchor: 'cards')
+    rescue Stripe::CardError => e
+      flash[:error] = I18n.t(:card_could_not_be_removed)
+      redirect_to account_path(anchor: 'cards')
     end
 
+    private
+
     # Currently can only destroy the whole customer object
     def destroy_at_stripe
       stripe_customer = Stripe::Customer.retrieve(@credit_card.gateway_customer_profile_id)
       stripe_customer.delete if stripe_customer
     end
 
-    private
-
     def create_customer(token)
       Stripe::Customer.create(email: spree_current_user.email, source: token)
     end
diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb
index 9e36f7e5c6..164e27d81a 100644
--- a/app/models/spree/ability_decorator.rb
+++ b/app/models/spree/ability_decorator.rb
@@ -56,9 +56,14 @@ class AbilityDecorator
       user == item.order.user &&
       item.order.changes_allowed?
     end
+
     can [:cancel], Spree::Order do |order|
       order.user == user
     end
+
+    can [:destroy], Spree::CreditCard do |credit_card|
+      credit_card.user == user
+    end
   end
 
   # New users can create an enterprise, and gain other permissions from doing this.
diff --git a/app/models/spree/credit_card_decorator.rb b/app/models/spree/credit_card_decorator.rb
index 69dadd6707..b9c0fca337 100644
--- a/app/models/spree/credit_card_decorator.rb
+++ b/app/models/spree/credit_card_decorator.rb
@@ -12,6 +12,8 @@ Spree::CreditCard.class_eval do
   # https://github.com/spree/spree/commit/411010f3975c919ab298cb63962ee492455b415c
   belongs_to :payment_method
 
+  belongs_to :user
+
   # Allows us to use a gateway_payment_profile_id to store Stripe Tokens
   # Should be able to remove once we reach Spree v2.2.0
   # Commit: https://github.com/spree/spree/commit/5a4d690ebc64b264bf12904a70187e7a8735ef3f
diff --git a/spec/controllers/spree/credit_cards_controller_spec.rb b/spec/controllers/spree/credit_cards_controller_spec.rb
index fcff7c7254..0fc910f2d2 100644
--- a/spec/controllers/spree/credit_cards_controller_spec.rb
+++ b/spec/controllers/spree/credit_cards_controller_spec.rb
@@ -5,26 +5,30 @@ describe Spree::CreditCardsController do
   include AuthenticationWorkflow
   let(:user) { create_enterprise_user }
   let(:token) { "tok_234bd2c22" }
-  let(:params) do
-    {
-      format: :json,
-      "exp_month" => 12,
-      "exp_year" => 2020,
-      "last4" => 4242,
-      "token" => token,
-      "cc_type" => "visa"
-    }
-  end
 
   before do
     allow(Stripe).to receive(:api_key) { "sk_test_12345" }
     allow(controller).to receive(:spree_current_user) { user }
-    stub_request(:post, "https://api.stripe.com/v1/customers")
-      .with(:body => { email: user.email, source: token })
-      .to_return(response_mock)
   end
 
   describe "#new_from_token" do
+    let(:params) do
+      {
+        format: :json,
+        "exp_month" => 12,
+        "exp_year" => 2020,
+        "last4" => 4242,
+        "token" => token,
+        "cc_type" => "visa"
+      }
+    end
+
+    before do
+      stub_request(:post, "https://api.stripe.com/v1/customers")
+        .with(:body => { email: user.email, source: token })
+        .to_return(response_mock)
+    end
+
     context "when the request to store the customer/card with Stripe is successful" do
       let(:response_mock) { { status: 200, body: JSON.generate(id: "cus_AZNMJ", default_source: "card_1AEEb") } }
 
@@ -64,4 +68,64 @@ describe Spree::CreditCardsController do
       end
     end
   end
+
+  describe "#destroy" do
+    context "when the specified credit card is not found" do
+      let(:params) { { id: 123 } }
+
+      it "redirects to /account with a flash error, does not request deletion with Stripe" do
+        expect(controller).to_not receive(:destroy_at_stripe)
+        delete :destroy, params
+        expect(flash[:error]).to eq I18n.t(:card_could_not_be_removed)
+        expect(response).to redirect_to spree.account_path(anchor: 'cards')
+      end
+    end
+
+    context "when the specified credit card is found" do
+      let!(:card) { create(:credit_card, gateway_customer_profile_id: 'cus_AZNMJ') }
+      let(:params) { { id: card.id } }
+
+      context "but the card is not owned by the user" do
+        it "redirects to unauthorized" do
+          delete :destroy, params
+          expect(response).to redirect_to spree.unauthorized_path
+        end
+      end
+
+      context "and the card is owned by the user" do
+        before do
+          card.update_attribute(:user_id, user.id)
+
+          stub_request(:get, "https://api.stripe.com/v1/customers/cus_AZNMJ").
+            to_return(:status => 200, :body => JSON.generate(id: "cus_AZNMJ"))
+        end
+
+        context "where the request to destroy the Stripe customer fails" do
+          before do
+            stub_request(:delete, "https://api.stripe.com/v1/customers/cus_AZNMJ").
+              to_return(:status => 402, :body => JSON.generate(error: { message: 'Bup-bow!' }))
+          end
+
+          it "doesn't delete the card" do
+            expect{ delete :destroy, params }.to_not change(Spree::CreditCard, :count)
+            expect(flash[:error]).to eq I18n.t(:card_could_not_be_removed)
+            expect(response).to redirect_to spree.account_path(anchor: 'cards')
+          end
+        end
+
+        context "where the request to destroy the Stripe customer succeeds" do
+          before do
+            stub_request(:delete, "https://api.stripe.com/v1/customers/cus_AZNMJ").
+              to_return(:status => 200, :body => JSON.generate(deleted: true, id: "cus_AZNMJ"))
+          end
+
+          it "deletes the card and redirects to account_path" do
+            expect{ delete :destroy, params }.to change(Spree::CreditCard, :count).by(-1)
+            expect(flash[:success]).to eq I18n.t(:card_has_been_removed, number: "x-#{card.last_digits}")
+            expect(response).to redirect_to spree.account_path(anchor: 'cards')
+          end
+        end
+      end
+    end
+  end
 end

From f6c3a2a46e9f5b390f5d82eda21b850e1aaa9d92 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 15:10:50 +1000
Subject: [PATCH 292/353] Remove new credit card initialisation logic from
 Spree::UsersController#show

---
 app/controllers/spree/users_controller_decorator.rb | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/app/controllers/spree/users_controller_decorator.rb b/app/controllers/spree/users_controller_decorator.rb
index bfdd83f839..417086ca51 100644
--- a/app/controllers/spree/users_controller_decorator.rb
+++ b/app/controllers/spree/users_controller_decorator.rb
@@ -2,7 +2,6 @@ Spree::UsersController.class_eval do
   layout 'darkswarm'
 
   before_filter :enable_embedded_shopfront
-  before_filter :set_credit_card, only: :show
 
   # Override of spree_auth_devise default
   # Ignores invoice orders, only order where state: 'complete'
@@ -13,10 +12,4 @@ Spree::UsersController.class_eval do
 
     @orders = @orders.where('distributor_id != ?', Spree::Config.accounts_distributor_id)
   end
-
-  private
-
-  def set_credit_card
-    @credit_card = Spree::CreditCard.new(user: @user)
-  end
 end

From a74c502fd9b1c34b3f76d15601e06d532c2dbfc8 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 16:39:52 +1000
Subject: [PATCH 293/353] Refactor logic for creating a payment profile from a
 Stripe token into a service object

---
 app/models/spree/gateway/stripe_connect.rb | 50 ++----------------
 lib/stripe/profile_storer.rb               | 60 ++++++++++++++++++++++
 2 files changed, 64 insertions(+), 46 deletions(-)
 create mode 100644 lib/stripe/profile_storer.rb

diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index d3ac5fd49d..ba235d213d 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -1,3 +1,5 @@
+require 'stripe/profile_storer'
+
 module Spree
   class Gateway
     class StripeConnect < Gateway
@@ -40,21 +42,9 @@ module Spree
 
       def create_profile(payment)
         return unless payment.source.gateway_customer_profile_id.nil?
-        options = {
-          email: payment.order.email,
-          login: Stripe.api_key,
-        }.merge! address_for(payment)
 
-        creditcard = card_to_store(payment.source)
-
-        response = provider.store(creditcard, options)
-        if response.success?
-          payment.source.update_attributes!( cc_type: payment.source.cc_type, # side-effect of update_source!
-                                             gateway_customer_profile_id: response.params['id'],
-                                             gateway_payment_profile_id: response.params['default_source'] || response.params['default_card'])
-        else
-          payment.send(:gateway_error, response.message)
-        end
+        profile_storer = Stripe::ProfileStorer.new(payment, provider)
+        profile_storer.create_customer_from_token
       end
 
       private
@@ -76,43 +66,11 @@ module Spree
         [money, creditcard, options]
       end
 
-      def address_for(payment)
-        {}.tap do |options|
-          if address = payment.order.bill_address
-            options[:address] = {
-              address1: address.address1,
-              address2: address.address2,
-              city: address.city,
-              zip: address.zipcode
-            }
-
-            if country = address.country
-              options[:address][:country] = country.name
-            end
-
-            if state = address.state
-              options[:address].merge!(state: state.name)
-            end
-          end
-        end
-      end
-
       def update_source!(source)
         source.cc_type = CARD_TYPE_MAPPING[source.cc_type] if CARD_TYPE_MAPPING.include?(source.cc_type)
         source
       end
 
-      def card_to_store(source)
-        source = update_source!(source)
-        if source.number.blank? && source.gateway_payment_profile_id.present?
-          # StripeJS Token
-          source.gateway_payment_profile_id
-        else
-          # Spree::CreditCard object
-          source
-        end
-      end
-
       def token_from_card_profile_ids(creditcard)
         token_or_card_id = creditcard.gateway_payment_profile_id
         customer = creditcard.gateway_customer_profile_id
diff --git a/lib/stripe/profile_storer.rb b/lib/stripe/profile_storer.rb
new file mode 100644
index 0000000000..497df8c8c5
--- /dev/null
+++ b/lib/stripe/profile_storer.rb
@@ -0,0 +1,60 @@
+# Encapsulation of logic used to convert a token generated by Stripe Elements
+# into a Stripe Customer + Card which can then be charged at a later point in time
+# Stores the generated customer & card ids against the local instance of Spree::CreditCard
+
+module Stripe
+  class ProfileStorer
+    def initialize(payment, provider)
+      @payment = payment
+      @provider = provider
+
+      @options = {
+        email: @payment.order.email,
+        login: Stripe.api_key,
+      }.merge! address_for(@payment)
+    end
+
+    def create_customer_from_token
+      token = @payment.source.gateway_payment_profile_id
+      response = @provider.store(token, @options)
+
+      if response.success?
+        attrs = source_attrs_from(response)
+        @payment.source.update_attributes!(attrs)
+      else
+        @payment.send(:gateway_error, response.message)
+      end
+    end
+
+    private
+
+    def address_for(payment)
+      {}.tap do |options|
+        if address = payment.order.bill_address
+          options[:address] = {
+            address1: address.address1,
+            address2: address.address2,
+            city: address.city,
+            zip: address.zipcode
+          }
+
+          if country = address.country
+            options[:address][:country] = country.name
+          end
+
+          if state = address.state
+            options[:address].merge!(state: state.name)
+          end
+        end
+      end
+    end
+
+    def source_attrs_from(response)
+      {
+        cc_type: @payment.source.cc_type, # side-effect of update_source!
+        gateway_customer_profile_id: response.params['id'],
+        gateway_payment_profile_id: response.params['default_source'] || response.params['default_card']
+      }
+    end
+  end
+end

From a2dee8d3d84ad9894a5936987107e1fe7c5ccf12 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 16:50:00 +1000
Subject: [PATCH 294/353] Create a Struct for Stripe Connect settings once
 rather than on each request

---
 app/controllers/admin/stripe_connect_settings_controller.rb | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/controllers/admin/stripe_connect_settings_controller.rb b/app/controllers/admin/stripe_connect_settings_controller.rb
index cadcdbaf4a..dc962ad707 100644
--- a/app/controllers/admin/stripe_connect_settings_controller.rb
+++ b/app/controllers/admin/stripe_connect_settings_controller.rb
@@ -1,5 +1,7 @@
 module Admin
   class StripeConnectSettingsController < Spree::Admin::BaseController
+    StripeConnectSettings = Struct.new(:stripe_connect_enabled)
+
     before_filter :load_settings, only: [:edit]
 
     def edit
@@ -21,8 +23,7 @@ module Admin
     private
 
     def load_settings
-      klass = Struct.new(:stripe_connect_enabled)
-      @settings = klass.new(Spree::Config[:stripe_connect_enabled])
+      @settings = StripeConnectSettings.new(Spree::Config[:stripe_connect_enabled])
     end
 
     def redirect_to_edit

From 61feb2b27d82088aa8c8ddf0e8189e7ea95aa47c Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 17:22:11 +1000
Subject: [PATCH 295/353] Rename Stripe existing_card param key to
 existing_card_id

---
 app/assets/javascripts/darkswarm/services/checkout.js.coffee  | 2 +-
 app/controllers/checkout_controller.rb                        | 4 ++--
 .../unit/darkswarm/services/checkout_spec.js.coffee           | 2 +-
 spec/requests/stripe_connect_checkout_spec.rb                 | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/services/checkout.js.coffee b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
index fd07e71e86..204c35ac66 100644
--- a/app/assets/javascripts/darkswarm/services/checkout.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/checkout.js.coffee
@@ -62,7 +62,7 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeE
       if @paymentMethod()?.method_type == 'stripe'
         if @secrets.selected_card
           angular.extend munged_order, {
-            existing_card: @secrets.selected_card
+            existing_card_id: @secrets.selected_card
           }
         else
           angular.extend munged_order.payments_attributes[0], {
diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 5d3c884400..62c91df4f4 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -119,7 +119,7 @@ class CheckoutController < Spree::CheckoutController
     if (params[:order][:payments_attributes])
       params[:order][:payments_attributes].first[:amount] = @order.total
     end
-    if params[:order][:existing_card]
+    if params[:order][:existing_card_id]
       construct_saved_card_attributes
     end
     params[:order]
@@ -207,7 +207,7 @@ class CheckoutController < Spree::CheckoutController
   end
 
   def construct_saved_card_attributes
-    existing_card_id = params[:order].delete(:existing_card)
+    existing_card_id = params[:order].delete(:existing_card_id)
     return if existing_card_id.blank?
 
     credit_card = Spree::CreditCard.find(existing_card_id)
diff --git a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
index 9120ad31b6..5ca05a344f 100644
--- a/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/services/checkout_spec.js.coffee
@@ -208,4 +208,4 @@ describe 'Checkout service', ->
         Checkout.secrets.selected_card = 1
         source_attributes = Checkout.preprocess()
         expect(source_attributes).toBeDefined()
-        expect(source_attributes.existing_card).toBe 1
+        expect(source_attributes.existing_card_id).toBe 1
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index d5cc332126..511f380f24 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -176,7 +176,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     let(:charge_response_mock) { { status: 200, body: JSON.generate(id: "ch_1234", object: "charge", amount: 2000) } }
 
     before do
-      params[:order][:existing_card] = credit_card.id
+      params[:order][:existing_card_id] = credit_card.id
       quick_login_as(order.user)
 
       # Requests a token

From 08c723b10ff213f1089b581f677c34ffd8e8f147 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 17:37:36 +1000
Subject: [PATCH 296/353] Use expect syntax instead of should

---
 spec/controllers/admin/stripe_accounts_controller_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 940fe41761..8b867fdde4 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -32,7 +32,7 @@ describe Admin::StripeAccountsController, type: :controller do
 
       it "returns a 500 error" do
         spree_get :connect_callback, params
-        response.status.should be 500
+        expect(response.status).to be 500
       end
     end
 

From 5cba63578340e609306c90c4d9d6d1f4bc152df7 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 17:39:26 +1000
Subject: [PATCH 297/353] Add documentation to StripeConnectSettings controller

---
 app/controllers/admin/stripe_connect_settings_controller.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/app/controllers/admin/stripe_connect_settings_controller.rb b/app/controllers/admin/stripe_connect_settings_controller.rb
index dc962ad707..b4ab06d3b3 100644
--- a/app/controllers/admin/stripe_connect_settings_controller.rb
+++ b/app/controllers/admin/stripe_connect_settings_controller.rb
@@ -1,3 +1,5 @@
+# This controller is used by super admin users to update the settings the app is using
+
 module Admin
   class StripeConnectSettingsController < Spree::Admin::BaseController
     StripeConnectSettings = Struct.new(:stripe_connect_enabled)

From 620721c8cb58b130b10be16044ba1eaf71eee4cc Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 17:50:38 +1000
Subject: [PATCH 298/353] Use find_by_id instead of find in
 EnterpriseController

---
 app/controllers/enterprises_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/enterprises_controller.rb b/app/controllers/enterprises_controller.rb
index 06926a746c..83c6f6e6c0 100644
--- a/app/controllers/enterprises_controller.rb
+++ b/app/controllers/enterprises_controller.rb
@@ -42,7 +42,7 @@ class EnterprisesController < BaseController
   private
 
   def set_enterprise
-    @enterprise = Enterprise.find(params[:id])
+    @enterprise = Enterprise.find_by_id(params[:id])
   end
 
   def clean_permalink

From 0e42c1cf305c50c1e92f15ba259a3b0b39e5b61a Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 20:11:09 +1000
Subject: [PATCH 299/353] Refactor ProfileStorer, call options as a separate
 method

---
 lib/stripe/profile_storer.rb | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/lib/stripe/profile_storer.rb b/lib/stripe/profile_storer.rb
index 497df8c8c5..9b1579228d 100644
--- a/lib/stripe/profile_storer.rb
+++ b/lib/stripe/profile_storer.rb
@@ -7,16 +7,11 @@ module Stripe
     def initialize(payment, provider)
       @payment = payment
       @provider = provider
-
-      @options = {
-        email: @payment.order.email,
-        login: Stripe.api_key,
-      }.merge! address_for(@payment)
     end
 
     def create_customer_from_token
       token = @payment.source.gateway_payment_profile_id
-      response = @provider.store(token, @options)
+      response = @provider.store(token, options)
 
       if response.success?
         attrs = source_attrs_from(response)
@@ -28,22 +23,30 @@ module Stripe
 
     private
 
+    def options
+      {
+        email: @payment.order.email,
+        login: Stripe.api_key,
+        address: address_for(@payment)
+      }
+    end
+
     def address_for(payment)
-      {}.tap do |options|
+      {}.tap do |hash|
         if address = payment.order.bill_address
-          options[:address] = {
+          hash = {
             address1: address.address1,
             address2: address.address2,
             city: address.city,
             zip: address.zipcode
           }
 
-          if country = address.country
-            options[:address][:country] = country.name
+          if address.country
+            hash[:country] = address.country.name
           end
 
-          if state = address.state
-            options[:address].merge!(state: state.name)
+          if address.state
+            hash[:state] = address.state.name
           end
         end
       end

From 0bbaafbd4152ffe9cf86bb0af280547d2ae77d38 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Mon, 11 Sep 2017 20:36:52 +1000
Subject: [PATCH 300/353] Use guard clause

---
 .../spree/admin/payment_methods_controller_decorator.rb        | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/controllers/spree/admin/payment_methods_controller_decorator.rb b/app/controllers/spree/admin/payment_methods_controller_decorator.rb
index aea47a05f3..bded58fe19 100644
--- a/app/controllers/spree/admin/payment_methods_controller_decorator.rb
+++ b/app/controllers/spree/admin/payment_methods_controller_decorator.rb
@@ -73,7 +73,8 @@ module Spree
       end
 
       def restrict_stripe_account_change
-        return unless @payment_method.try(:type) == "Spree::Gateway::StripeConnect"
+        return unless @payment_method
+        return unless @payment_method.type == "Spree::Gateway::StripeConnect"
         return unless @payment_method.preferred_enterprise_id.andand > 0
 
         @stripe_account_holder = Enterprise.find(@payment_method.preferred_enterprise_id)

From 1cd1e9dc3707d82ea8bfca5eb898a66ff5ef648f Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 13 Sep 2017 09:01:33 +1000
Subject: [PATCH 301/353] Extract filters for available PMs into service object

---
 app/helpers/enterprises_helper.rb               | 14 ++++----------
 .../available_payment_method_filter.rb          | 17 +++++++++++++++++
 2 files changed, 21 insertions(+), 10 deletions(-)
 create mode 100644 lib/open_food_network/available_payment_method_filter.rb

diff --git a/app/helpers/enterprises_helper.rb b/app/helpers/enterprises_helper.rb
index 94c3901f8a..7d4591da90 100644
--- a/app/helpers/enterprises_helper.rb
+++ b/app/helpers/enterprises_helper.rb
@@ -1,3 +1,5 @@
+require 'open_food_network/available_payment_method_filter'
+
 module EnterprisesHelper
   def current_distributor
     @current_distributor ||= current_order(false).andand.distributor
@@ -22,7 +24,8 @@ module EnterprisesHelper
     return [] unless current_distributor.present?
     payment_methods = current_distributor.payment_methods.available(:front_end).all
 
-    apply_stripe_filters_to(payment_methods)
+    filter = OpenFoodNetwork::AvailablePaymentMethodFilter.new
+    filter.filter!(payment_methods)
 
     applicator = OpenFoodNetwork::TagRuleApplicator.new(current_distributor, "FilterPaymentMethods", current_customer.andand.tag_list)
     applicator.filter!(payment_methods)
@@ -98,13 +101,4 @@ module EnterprisesHelper
   def show_bought_items?
     order_changes_allowed? && current_order.finalised_line_items.present?
   end
-
-  def apply_stripe_filters_to(payment_methods)
-    stripe_enabled = Spree::Config.stripe_connect_enabled && Stripe.publishable_key
-    if stripe_enabled
-      payment_methods.reject!{ |p| p.type.ends_with?("StripeConnect") && p.preferred_enterprise_id == 0 }
-    else
-      payment_methods.reject!{ |p| p.type.ends_with?("StripeConnect") }
-    end
-  end
 end
diff --git a/lib/open_food_network/available_payment_method_filter.rb b/lib/open_food_network/available_payment_method_filter.rb
new file mode 100644
index 0000000000..bb33fcd4bc
--- /dev/null
+++ b/lib/open_food_network/available_payment_method_filter.rb
@@ -0,0 +1,17 @@
+module OpenFoodNetwork
+  class AvailablePaymentMethodFilter
+    def filter!(payment_methods)
+      if stripe_enabled?
+        payment_methods.reject!{ |p| p.type.ends_with?("StripeConnect") && p.preferred_enterprise_id.zero? }
+      else
+        payment_methods.reject!{ |p| p.type.ends_with?("StripeConnect") }
+      end
+    end
+
+    private
+
+    def stripe_enabled?
+      Spree::Config.stripe_connect_enabled && Stripe.publishable_key
+    end
+  end
+end

From 098afc62c1ce0359025dcde5f0fa44aa18ff68c1 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 13 Sep 2017 17:27:02 +1000
Subject: [PATCH 302/353] Fix rubocop issues

---
 .../spree/credit_cards_controller.rb           |  2 +-
 app/models/spree/gateway/stripe_connect.rb     |  2 +-
 .../api/admin/payment_method_serializer.rb     | 18 +++++++++++-------
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/app/controllers/spree/credit_cards_controller.rb b/app/controllers/spree/credit_cards_controller.rb
index a4b8ce9479..4582931dd0 100644
--- a/app/controllers/spree/credit_cards_controller.rb
+++ b/app/controllers/spree/credit_cards_controller.rb
@@ -30,7 +30,7 @@ module Spree
         flash[:error] = I18n.t(:card_could_not_be_removed)
       end
       redirect_to account_path(anchor: 'cards')
-    rescue Stripe::CardError => e
+    rescue Stripe::CardError
       flash[:error] = I18n.t(:card_could_not_be_removed)
       redirect_to account_path(anchor: 'cards')
     end
diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index ba235d213d..f4a0435ace 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -35,7 +35,7 @@ module Spree
         provider.purchase(*options_for_purchase_or_auth(money, creditcard, gateway_options))
       end
 
-      def void(response_code, creditcard, gateway_options)
+      def void(response_code, _creditcard, gateway_options)
         gateway_options[:stripe_account] = stripe_account_id
         provider.void(response_code, gateway_options)
       end
diff --git a/app/serializers/api/admin/payment_method_serializer.rb b/app/serializers/api/admin/payment_method_serializer.rb
index 342bc254fd..3d66ddbc03 100644
--- a/app/serializers/api/admin/payment_method_serializer.rb
+++ b/app/serializers/api/admin/payment_method_serializer.rb
@@ -1,11 +1,15 @@
-class Api::Admin::PaymentMethodSerializer < ActiveModel::Serializer
-  delegate :serializable_hash, to: :method_serializer
+module Api
+  module Admin
+    class PaymentMethodSerializer < ActiveModel::Serializer
+      delegate :serializable_hash, to: :method_serializer
 
-  def method_serializer
-    if object.type == 'Spree::Gateway::StripeConnect'
-      Api::Admin::PaymentMethod::StripeSerializer.new(object)
-    else
-      Api::Admin::PaymentMethod::BaseSerializer.new(object)
+      def method_serializer
+        if object.type == 'Spree::Gateway::StripeConnect'
+          Api::Admin::PaymentMethod::StripeSerializer.new(object)
+        else
+          Api::Admin::PaymentMethod::BaseSerializer.new(object)
+        end
+      end
     end
   end
 end

From fbda1a27ad23f2b19911527c1a2e935c17d4bf95 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 13 Sep 2017 23:51:42 +1000
Subject: [PATCH 303/353] Add missing translation referenced from
 spree_auth_devise

---
 config/locales/en.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/config/locales/en.yml b/config/locales/en.yml
index ccd3b9bbb2..d7725ec20c 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2096,6 +2096,8 @@ Please follow the instructions there to make your enterprise visible on the Open
   spree:
     # TODO: remove `email` key once we get to Spree 2.0
     email: Email
+    # TODO: remove 'account_updated' key once we get to Spree 2.0
+    account_updated: "Account updated!"
     admin:
       orders:
         invoice:

From d2096cf6d165312184a62f9b0665b94b45c8e01a Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 13 Sep 2017 23:52:42 +1000
Subject: [PATCH 304/353] Make request stubs less brittle by using regex

---
 spec/requests/stripe_connect_checkout_spec.rb | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index 511f380f24..ce787802f0 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -42,8 +42,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
       before do
         # Charges the card
         stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
-          .with(:body => {"amount" => "1234", "card" => token, "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
-          .to_return(charge_response_mock)
+          .with(body: /#{token}.*#{order.number}/).to_return(charge_response_mock)
       end
 
       context "and the charge request is successful" do
@@ -91,8 +90,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
         # Charges the card
         stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
-          .with(:body => {"amount" => "1234", "card" => new_token, "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
-          .to_return(charge_response_mock)
+          .with(body: /#{token}.*#{order.number}/).to_return(charge_response_mock)
       end
 
       context "and the store, token and charge requests are successful" do
@@ -142,8 +140,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
         before do
           # Attempts to charge the card without a token, which will return an error
           stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
-            .with(:body => {"amount" => "1234", "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
-            .to_return(charge_response_mock)
+            .with(body: /#{order.number}/).to_return(charge_response_mock)
         end
 
         it "should not process the payment" do
@@ -186,8 +183,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
 
       # Charges the card
       stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
-        .with(:body => {"amount" => "1234", "card" => new_token, "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"} )
-        .to_return(charge_response_mock)
+        .with(body: /#{token}.*#{order.number}/).to_return(charge_response_mock)
     end
 
     context "and the charge and token requests are accepted" do
@@ -225,8 +221,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
       before do
         # Attempts to charge the card without a token, which will return an error
         stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
-          .with(:body => {"amount" => "1234", "currency" => "aud", "description" => "Spree Order ID: #{order.number}", "payment_user_agent" => "Stripe/v1 ActiveMerchantBindings/1.63.0"})
-          .to_return(charge_response_mock)
+          .with(body: /#{order.number}/).to_return(charge_response_mock)
       end
 
       it "should not process the payment" do

From e14b017f1fa8b9df754559c7e8e863136be85d74 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 13 Sep 2017 23:53:38 +1000
Subject: [PATCH 305/353] Fix broken Stripe checkout spec

---
 spec/features/consumer/shopping/checkout_spec.rb | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index 0e95197011..f453d61dee 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -141,18 +141,23 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
       end
 
       context "with Stripe" do
-        let!(:stripe_pm) { create(:payment_method, distributors: [distributor], name: "Stripe", type: "Spree::Gateway::StripeConnect") }
+        let!(:stripe_pm) do
+          create(:stripe_payment_method,
+            distributors: [distributor],
+            name: "Stripe",
+            preferred_enterprise_id: distributor.id)
+        end
 
-        let!(:saved_card) {
+        let!(:saved_card) do
           create(:credit_card,
           user_id: user.id,
           month: "01",
           year: "2025",
-          cc_type: "Visa",
+          cc_type: "visa",
           number: "1111111111111111",
           payment_method_id: stripe_pm.id,
           gateway_customer_profile_id: "i_am_saved")
-        }
+        end
 
         let(:response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
 
@@ -161,7 +166,7 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
           allow(Stripe).to receive(:publishable_key) { "some_key" }
           Spree::Config.set(stripe_connect_enabled: true)
           stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
-            .to_return(body: JSON.generate(response_mock))
+            .to_return(status: 200, body: JSON.generate(response_mock))
 
           visit checkout_path
           fill_out_form

From 4785f3eacc69a6c6158d13dde395c011ad77dae2 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 14 Sep 2017 10:22:24 +1000
Subject: [PATCH 306/353] Use lowercased cc_type in CreditCard service

---
 .../darkswarm/services/credit_card.js.coffee  |  2 +-
 .../services/credit_card_spec.js.coffee       | 31 +++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 spec/javascripts/unit/darkswarm/services/credit_card_spec.js.coffee

diff --git a/app/assets/javascripts/darkswarm/services/credit_card.js.coffee b/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
index 5f7fa5c0ce..28c2cde5f3 100644
--- a/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/credit_card.js.coffee
@@ -31,7 +31,7 @@ Darkswarm.factory 'CreditCard', ($injector, $rootScope, CreditCards, StripeEleme
       "exp_year": @secrets.card.exp_year,
       "last4": @secrets.card.last4,
       "token": @secrets.token,
-      "cc_type": @secrets.card.brand}
+      "cc_type": @secrets.cc_type}
 
     show: => @visible = true
 
diff --git a/spec/javascripts/unit/darkswarm/services/credit_card_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/credit_card_spec.js.coffee
new file mode 100644
index 0000000000..f6b6993859
--- /dev/null
+++ b/spec/javascripts/unit/darkswarm/services/credit_card_spec.js.coffee
@@ -0,0 +1,31 @@
+describe 'CreditCard service', ->
+  CreditCard = null
+
+  beforeEach ->
+    module 'Darkswarm'
+    module ($provide)->
+      $provide.value "savedCreditCards", []
+      $provide.value "railsFlash", null
+      null
+
+    inject (_CreditCard_)->
+      CreditCard = _CreditCard_
+
+  describe "process_params", ->
+    beforeEach ->
+      CreditCard.secrets =
+        card:
+          exp_month: "12"
+          exp_year: "2030"
+          last4: "1234"
+        cc_type: 'mastercard'
+        token: "token123"
+
+    it "uses cc_type, rather than fetching the brand from the card", ->
+      # This is important for processing the card with activemerchant
+      process_params = CreditCard.process_params()
+      expect(process_params['exp_month']).toEqual "12"
+      expect(process_params['exp_year']).toEqual "2030"
+      expect(process_params['last4']).toEqual "1234"
+      expect(process_params['token']).toEqual "token123"
+      expect(process_params['cc_type']).toEqual "mastercard"

From 34b109cbb740649638124197e7c97a33506525e6 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 14 Sep 2017 11:00:40 +1000
Subject: [PATCH 307/353] Add basic validation to credit card form on account
 page

---
 .../credit_cards_controller.js.coffee         |  4 +++-
 .../stylesheets/darkswarm/account.css.scss    |  4 ++++
 .../spree/users/_new_card_form.html.haml      | 19 ++++++++++++++++---
 3 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
index 0875175c32..7fa3e4f8c4 100644
--- a/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
+++ b/app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee
@@ -4,7 +4,9 @@ Darkswarm.controller "CreditCardsCtrl", ($scope, $timeout, CreditCard, CreditCar
   $scope.CreditCard = CreditCard
   $scope.secrets = CreditCard.secrets
   $scope.showForm = CreditCard.show
-  $scope.storeCard = CreditCard.requestToken
+  $scope.storeCard = ->
+    if $scope.new_card_form.$valid
+      CreditCard.requestToken()
 
   $scope.allow_name_change = true
   $scope.disable_fields = false
diff --git a/app/assets/stylesheets/darkswarm/account.css.scss b/app/assets/stylesheets/darkswarm/account.css.scss
index 91cd042d28..c41cd2ef98 100644
--- a/app/assets/stylesheets/darkswarm/account.css.scss
+++ b/app/assets/stylesheets/darkswarm/account.css.scss
@@ -23,6 +23,10 @@
     &.visible {
       opacity: 1;
     }
+
+    input.ng-invalid {
+      margin-bottom: 0px;
+    }
   }
 }
 
diff --git a/app/views/spree/users/_new_card_form.html.haml b/app/views/spree/users/_new_card_form.html.haml
index af780ace8f..3d17afbf6a 100644
--- a/app/views/spree/users/_new_card_form.html.haml
+++ b/app/views/spree/users/_new_card_form.html.haml
@@ -1,15 +1,28 @@
-%form{ novalidate: true, "ng-submit" => "storeCard()" }
+%form{ novalidate: true, name: 'new_card_form', "ng-submit" => "storeCard()" }
   .row
     .small-6.columns
       %label
         = t(:first_name)
         -# Changing name not permitted by default (in checkout) - can be enabled by setting an allow_name_change variable in $scope
-      %input#first_name{type: :text,  "ng-model" => "secrets.first_name","ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.firstname"}
+      %input#first_name{ type: :text,
+        name: 'first_name',
+        required: true,
+        ng: { model: "secrets.first_name",
+          disabled: "!allow_name_change",
+          value: "order.bill_address.firstname"} }
+      %small.error{ ng: { show: 'new_card_form.$submitted && new_card_form.first_name.$error.required' } }= t(:error_required)
 
     .small-6.columns
       %label
         = t(:last_name)
-      %input#last_name{type: :text, "ng-model" => "secrets.last_name", "ng-disabled" => "!allow_name_change", "ng-value" => "order.bill_address.lastname"}
+      %input#last_name{type: :text,
+      name: "last_name",
+      required: true,
+      ng: { model: "secrets.last_name",
+        disabled: "!allow_name_change",
+        value: "order.bill_address.lastname" } }
+      %small.error{ ng: { show: 'new_card_form.$submitted && new_card_form.last_name.$error.required' } }= t(:error_required)
+
   .row
     .small-12.columns
       %label

From 393a4efbf64089781b8e4a212b117f5b4136bd05 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 14 Sep 2017 11:18:20 +1000
Subject: [PATCH 308/353] Fix flaky OrderSerializer spec

Make sure that completed payment is for an amount less that the order total
---
 spec/serializers/order_serializer_spec.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/spec/serializers/order_serializer_spec.rb b/spec/serializers/order_serializer_spec.rb
index ed3fbd994d..cbbe13eb69 100644
--- a/spec/serializers/order_serializer_spec.rb
+++ b/spec/serializers/order_serializer_spec.rb
@@ -4,7 +4,7 @@ describe Api::OrderSerializer do
   let(:serializer) { Api::OrderSerializer.new order }
   let(:order) { create(:completed_order_with_totals) }
 
-  let!(:completed_payment) { create(:payment, order: order, state: 'completed', amount: 43.21) }
+  let!(:completed_payment) { create(:payment, order: order, state: 'completed', amount: order.total - 1) }
   let!(:payment) { create(:payment, order: order, state: 'checkout', amount: 123.45) }
 
   it "serializes an order" do
@@ -12,6 +12,7 @@ describe Api::OrderSerializer do
   end
 
   it "convert the state attributes to translatable keys" do
+    # byebug if serializer.to_json =~ /balance_due/
     expect(serializer.to_json).to match "complete"
     expect(serializer.to_json).to match "balance_due"
   end

From 0f19be4db491d3dcc8a7d21738ebe0f6e793901d Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 14 Sep 2017 16:44:12 +1000
Subject: [PATCH 309/353] Configure StripeElements service to map cc_type to
 that used by activemerchant

---
 .../darkswarm/services/stripe_elements.js.coffee      |  9 +++++----
 .../darkswarm/services/stripe_elements_spec.js.coffee | 11 ++++++++++-
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee b/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
index 256f6b1681..1b0db2dcc9 100644
--- a/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/stripe_elements.js.coffee
@@ -23,19 +23,20 @@ Darkswarm.factory 'StripeElements', ($rootScope, Loading, RailsFlashLoader) ->
           secrets.card = response.token.card
           submit()
 
+    # Maps the brand returned by Stripe to that required by activemerchant
     mapCC: (ccType) ->
       if ccType == 'MasterCard'
-        return 'mastercard'
+        return 'master'
       else if ccType == 'Visa'
         return 'visa'
       else if ccType == 'American Express'
-        return 'amex'
+        return 'american_express'
       else if ccType == 'Discover'
         return 'discover'
-      else if ccType == 'Diners Club'
-        return 'dinersclub'
       else if ccType == 'JCB'
         return 'jcb'
+      else if ccType == 'Diners Club'
+        return 'diners_club'
       return
 
     # It doesn't matter if any of these are nil, all are optional.
diff --git a/spec/javascripts/unit/darkswarm/services/stripe_elements_spec.js.coffee b/spec/javascripts/unit/darkswarm/services/stripe_elements_spec.js.coffee
index 1cf860ed3c..0252298f82 100644
--- a/spec/javascripts/unit/darkswarm/services/stripe_elements_spec.js.coffee
+++ b/spec/javascripts/unit/darkswarm/services/stripe_elements_spec.js.coffee
@@ -34,7 +34,7 @@ describe 'StripeElements Service', ->
         StripeElements.requestToken(secrets, submit)
         $rootScope.$digest() # required for #then to by called
         expect(secrets.token).toEqual "token"
-        expect(secrets.cc_type).toEqual "mastercard"
+        expect(secrets.cc_type).toEqual "master"
         expect(submit).toHaveBeenCalled()
 
     describe "with unsatifactory data", ->
@@ -51,3 +51,12 @@ describe 'StripeElements Service', ->
         expect(submit).not.toHaveBeenCalled()
         expect(Loading.clear).toHaveBeenCalled()
         expect(RailsFlashLoader.loadFlash).toHaveBeenCalledWith({error: "Error: There was a problem"})
+
+  describe 'mapCC', ->
+    it "maps the brand returned by Stripe to that required by activemerchant", ->
+      expect(StripeElements.mapCC('MasterCard')).toEqual "master"
+      expect(StripeElements.mapCC('Visa')).toEqual "visa"
+      expect(StripeElements.mapCC('American Express')).toEqual "american_express"
+      expect(StripeElements.mapCC('Discover')).toEqual "discover"
+      expect(StripeElements.mapCC('JCB')).toEqual "jcb"
+      expect(StripeElements.mapCC('Diners Club')).toEqual "diners_club"

From 7d2deca969115e97de797d66f67525a7731f5307 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 15 Sep 2017 10:31:41 +1000
Subject: [PATCH 310/353] Ensure cart_spec runs in context where backorders are
 disabled

---
 spec/features/consumer/shopping/cart_spec.rb | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/spec/features/consumer/shopping/cart_spec.rb b/spec/features/consumer/shopping/cart_spec.rb
index 99c0f75450..2b824ef8d7 100644
--- a/spec/features/consumer/shopping/cart_spec.rb
+++ b/spec/features/consumer/shopping/cart_spec.rb
@@ -20,6 +20,13 @@ feature "full-page cart", js: true do
       set_order order
     end
 
+    around do |example|
+      allow_backorders = Spree::Config.allow_backorders
+      Spree::Config.allow_backorders = false
+      example.run
+      Spree::Config.allow_backorders = allow_backorders
+    end
+
     describe "fees" do
       let(:percentage_fee) { create(:enterprise_fee, calculator: Calculator::FlatPercentPerItem.new(preferred_flat_percent: 20)) }
 

From d3566f9303c9445dc9a3b19f0b686159077d0ee9 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 15 Sep 2017 15:26:12 +1000
Subject: [PATCH 311/353] Update deauthorize webhook to latest version of API

---
 app/controllers/admin/stripe_accounts_controller.rb       | 4 ++--
 spec/controllers/admin/stripe_accounts_controller_spec.rb | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index 75fd9ec110..46b560bfda 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -44,9 +44,9 @@ module Admin
       event = Stripe::Event.construct_from(params)
       return render nothing: true, status: 400 unless event.type == "account.application.deauthorized"
 
-      destroyed = StripeAccount.where(stripe_user_id: event.user_id).destroy_all
+      destroyed = StripeAccount.where(stripe_user_id: event.stripe_account.id).destroy_all
       if destroyed.any?
-        render text: "Account #{event.user_id} deauthorized", status: 200
+        render text: "Account #{event.stripe_account.id} deauthorized", status: 200
       else
         render nothing: true, status: 400
       end
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 8b867fdde4..97cb46f7ee 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -87,7 +87,7 @@ describe Admin::StripeAccountsController, type: :controller do
         "object" => "event",
         "data" => { "object" => { "id" => "ca_9B" } },
         "type" => "account.application.deauthorized",
-        "user_id" => "webhook_id"
+        "stripe_account" => { "id" => "webhook_id" }
       }
     end
 
@@ -98,9 +98,9 @@ describe Admin::StripeAccountsController, type: :controller do
       expect(StripeAccount.all).not_to include stripe_account
     end
 
-    context "when the user_id on the event does not match any known accounts" do
+    context "when the stripe_account id on the event does not match any known accounts" do
       before do
-        params["user_id"] = "webhook_id1"
+        params["stripe_account"]["id"] = "webhook_id1"
       end
 
       it "does nothing" do

From 665749d0c585adc247b2e26f93bff21e0b91d449 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sun, 17 Sep 2017 09:48:56 +1000
Subject: [PATCH 312/353] Refactor Stripe::AccountConnector

Connector now handles cancellation of the connection wizard by the user more elegantly
---
 .../admin/stripe_accounts_controller.rb       |   7 +-
 config/locales/en.yml                         |   1 +
 lib/stripe/account_connector.rb               |  41 +++++--
 .../admin/stripe_accounts_controller_spec.rb  |  54 +++++----
 spec/lib/stripe/account_connector_spec.rb     | 114 ++++++++++--------
 5 files changed, 134 insertions(+), 83 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index 46b560bfda..3f837e5931 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -13,12 +13,15 @@ module Admin
 
     def connect_callback
       connector = Stripe::AccountConnector.new(spree_current_user, params)
+
       if connector.create_account
         flash[:success] = t('admin.controllers.enterprises.stripe_connect_success')
-        redirect_to main_app.edit_admin_enterprise_path(connector.enterprise, anchor: 'payment_methods')
+      elsif connector.connection_cancelled_by_user?
+        flash[:notice] = t('admin.controllers.enterprises.stripe_connect_cancelled')
       else
-        render text: t('admin.controllers.enterprises.stripe_connect_fail'), status: 500
+        flash[:error] = t('admin.controllers.enterprises.stripe_connect_fail')
       end
+      redirect_to main_app.edit_admin_enterprise_path(connector.enterprise, anchor: 'payment_methods')
     rescue Stripe::StripeError => e
       render text: e.message, status: 500
     end
diff --git a/config/locales/en.yml b/config/locales/en.yml
index d7725ec20c..9623c1f8fd 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -765,6 +765,7 @@ en:
     # Admin controllers
     controllers:
       enterprises:
+        stripe_connect_cancelled: "Connection to Stripe has been cancelled"
         stripe_connect_success: "Stripe account connected successfully"
         stripe_connect_fail: Sorry, the connection of your Stripe account failed
       stripe_connect_settings:
diff --git a/lib/stripe/account_connector.rb b/lib/stripe/account_connector.rb
index 99efbe1aa8..9d0c8d3ddb 100644
--- a/lib/stripe/account_connector.rb
+++ b/lib/stripe/account_connector.rb
@@ -4,29 +4,22 @@
 
 module Stripe
   class AccountConnector
-    attr_reader :token, :enterprise, :user, :params
+    attr_reader :user, :params
 
     def initialize(user, params)
       @user = user
       @params = params
+    end
+
+    def create_account
+      return false if connection_cancelled_by_user?
 
       raise StripeError, params["error_description"] unless params["code"]
       raise CanCan::AccessDenied unless state.keys.include? "enterprise_id"
 
-      # Request an access token based on the code provided
-      @token = OAuth.token(grant_type: 'authorization_code', code: params["code"])
-
-      # Find the Enterprise
-      @enterprise = Enterprise.find_by_permalink(state["enterprise_id"])
-
-      return if user.enterprises.include?(enterprise) || user.admin?
-
       # Local authorisation issue, so request disconnection from Stripe
-      OAuth.deauthorize(stripe_user_id: token.stripe_user_id)
-      raise CanCan::AccessDenied
-    end
+      deauthorize unless user_has_permission_to_connect?
 
-    def create_account
       StripeAccount.create(
         stripe_user_id: token.stripe_user_id,
         stripe_publishable_key: token.stripe_publishable_key,
@@ -34,6 +27,14 @@ module Stripe
       )
     end
 
+    def connection_cancelled_by_user?
+      params[:action] == "connect_callback" && params[:error] == "access_denied"
+    end
+
+    def enterprise
+      @enterprise ||= Enterprise.find_by_permalink(state["enterprise_id"])
+    end
+
     private
 
     def state
@@ -41,5 +42,19 @@ module Stripe
       key = Openfoodnetwork::Application.config.secret_token
       JWT.decode(params["state"], key, true, algorithm: 'HS256')[0]
     end
+
+    def token
+      # Request an access token based on the code provided
+      @token ||= OAuth.token(grant_type: 'authorization_code', code: params["code"])
+    end
+
+    def deauthorize
+      OAuth.deauthorize(stripe_user_id: token.stripe_user_id)
+      raise CanCan::AccessDenied
+    end
+
+    def user_has_permission_to_connect?
+      user.enterprises.include?(enterprise) || user.admin?
+    end
   end
 end
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 97cb46f7ee..d81ad363ff 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -23,11 +23,16 @@ describe Admin::StripeAccountsController, type: :controller do
 
   context "#connect_callback" do
     let(:params) { { id: enterprise.permalink } }
-    before { allow(controller).to receive(:spree_current_user) { enterprise.owner } }
+    let(:connector) { double(:connector) }
 
-    context "when the connector raises a StripeError" do
+    before do
+      allow(controller).to receive(:spree_current_user) { enterprise.owner }
+      allow(Stripe::AccountConnector).to receive(:new) { connector }
+    end
+
+    context "when the connector.create_account raises a StripeError" do
       before do
-        allow(Stripe::AccountConnector).to receive(:new).and_raise Stripe::StripeError, "some error"
+        allow(connector).to receive(:create_account).and_raise Stripe::StripeError, "some error"
       end
 
       it "returns a 500 error" do
@@ -36,9 +41,9 @@ describe Admin::StripeAccountsController, type: :controller do
       end
     end
 
-    context "when the connector raises an AccessDenied error" do
+    context "when the connector.create_account raises an AccessDenied error" do
       before do
-        allow(Stripe::AccountConnector).to receive(:new).and_raise CanCan::AccessDenied, "some error"
+        allow(connector).to receive(:create_account).and_raise CanCan::AccessDenied, "some error"
       end
 
       it "redirects to unauthorized" do
@@ -47,35 +52,42 @@ describe Admin::StripeAccountsController, type: :controller do
       end
     end
 
-    context "when initializing the connector does not raise an error" do
-      let(:connector) { double(:connector) }
+    context "when the connector fails in creating a new stripe account record" do
+      before { allow(connector).to receive(:create_account) { false } }
 
-      before do
-        allow(Stripe::AccountConnector).to receive(:new) { connector }
-      end
+      context "when the user cancelled the connection" do
+        before { allow(connector).to receive(:connection_cancelled_by_user?) { true } }
 
-      context "when the connector succeeds in creating a new stripe account record" do
-        before { allow(connector).to receive(:create_account) { true } }
-
-        it "redirects to the enterprise edit path" do
-          expect(connector).to receive(:enterprise) { enterprise }
+        it "renders a failure message" do
+          allow(connector).to receive(:enterprise) { enterprise }
           spree_get :connect_callback, params
-          expect(flash[:success]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_success')
+          expect(flash[:notice]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_cancelled')
           expect(response).to redirect_to edit_admin_enterprise_path(enterprise, anchor: 'payment_methods')
         end
       end
 
-      context "when the connector succeeds in creating a new stripe account record" do
-        before { allow(connector).to receive(:create_account) { false } }
+      context "when some other error caused the failure" do
+        before { allow(connector).to receive(:connection_cancelled_by_user?) { false } }
 
         it "renders a failure message" do
-          expect(connector).to_not receive(:enterprise)
+          allow(connector).to receive(:enterprise) { enterprise }
           spree_get :connect_callback, params
-          expect(response.body).to eq I18n.t('admin.controllers.enterprises.stripe_connect_fail')
-          expect(response.status).to be 500
+          expect(flash[:error]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_fail')
+          expect(response).to redirect_to edit_admin_enterprise_path(enterprise, anchor: 'payment_methods')
         end
       end
     end
+
+    context "when the connector succeeds in creating a new stripe account record" do
+      before { allow(connector).to receive(:create_account) { true } }
+
+      it "redirects to the enterprise edit path" do
+        allow(connector).to receive(:enterprise) { enterprise }
+        spree_get :connect_callback, params
+        expect(flash[:success]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_success')
+        expect(response).to redirect_to edit_admin_enterprise_path(enterprise, anchor: 'payment_methods')
+      end
+    end
   end
 
   describe "#deauthorize" do
diff --git a/spec/lib/stripe/account_connector_spec.rb b/spec/lib/stripe/account_connector_spec.rb
index cfa942852b..1b5721ba33 100644
--- a/spec/lib/stripe/account_connector_spec.rb
+++ b/spec/lib/stripe/account_connector_spec.rb
@@ -4,82 +4,102 @@ require 'stripe/oauth'
 
 module Stripe
   describe AccountConnector do
-    describe "initialization" do
+    describe "create_account" do
       let(:user) { create(:user) }
       let(:enterprise) { create(:enterprise) }
       let(:payload) { { "junk" => "Ssfs" } }
       let(:state) { JWT.encode(payload, Openfoodnetwork::Application.config.secret_token) }
       let(:params) { { "state" => state } }
+      let(:connector) { AccountConnector.new(user, params) }
 
       before do
         allow(Stripe).to receive(:api_key) { "sk_test_12345" }
       end
 
-      context "when params have no 'code' key" do
-        it "raises a StripeError" do
-          expect{ AccountConnector.new(user, params) }.to raise_error StripeError
+      context "when the connection was cancelled by the user" do
+        before do
+          params[:action] = "connect_callback"
+          params[:error] = "access_denied"
+        end
+
+        it "returns false and does not create a new StripeAccount" do
+          expect do
+            expect(connector.create_account).to be false
+          end.to_not change(StripeAccount, :count)
         end
       end
 
-      context "when params have a 'code' key" do
-        before { params["code"] = 'code' }
-
-        context "and the decoded state param doesn't contain an 'enterprise_id' key" do
-          it "raises an AccessDenied error" do
-            expect{ AccountConnector.new(user, params) }.to raise_error CanCan::AccessDenied
+      context "when the connection was not cancelled by the user" do
+        context "when params have no 'code' key" do
+          it "raises a StripeError" do
+            expect do
+              expect{ connector.create_account }.to raise_error StripeError
+            end.to_not change(StripeAccount, :count)
           end
         end
 
-        context "and the decoded state param contains an 'enterprise_id' key" do
-          let(:payload) { { enterprise_id: enterprise.permalink } }
-          let(:token_response) { { "stripe_user_id" => "some_user_id", "stripe_publishable_key" => "some_key" } }
+        context "when params have a 'code' key" do
+          before { params["code"] = 'code' }
 
-          before do
-            stub_request(:post, "https://connect.stripe.com/oauth/token").
-              with(body: {"code"=>"code", "grant_type"=>"authorization_code"}).
-              to_return(status: 200, body: JSON.generate(token_response) )
-          end
-
-          context "but the user doesn't manage own or manage the corresponding enterprise" do
-            it "makes a request to cancel the Stripe connection and raises an error" do
-              expect(OAuth).to receive(:deauthorize).with(stripe_user_id: "some_user_id")
-              expect{ AccountConnector.new(user, params) }.to raise_error CanCan::AccessDenied
+          context "and the decoded state param doesn't contain an 'enterprise_id' key" do
+            it "raises an AccessDenied error" do
+              expect do
+                expect{ connector.create_account }.to raise_error CanCan::AccessDenied
+              end.to_not change(StripeAccount, :count)
             end
           end
 
-          context "and the user manages the corresponding enterprise" do
+          context "and the decoded state param contains an 'enterprise_id' key" do
+            let(:payload) { { enterprise_id: enterprise.permalink } }
+            let(:token_response) { { "stripe_user_id" => "some_user_id", "stripe_publishable_key" => "some_key" } }
+
             before do
-              user.enterprise_roles.create(enterprise: enterprise)
+              stub_request(:post, "https://connect.stripe.com/oauth/token").
+                with(body: {"code"=>"code", "grant_type"=>"authorization_code"}).
+                to_return(status: 200, body: JSON.generate(token_response) )
             end
 
-            it "raises no errors" do
-              expect(OAuth).to_not receive(:deauthorize)
-              AccountConnector.new(user, params)
+            context "but the user doesn't manage own or manage the corresponding enterprise" do
+              it "makes a request to cancel the Stripe connection and raises an error" do
+                expect(OAuth).to receive(:deauthorize).with(stripe_user_id: "some_user_id")
+                expect do
+                  expect{ connector.create_account }.to raise_error CanCan::AccessDenied
+                end.to_not change(StripeAccount, :count)
+              end
             end
 
-            it "allows creations of a new Stripe Account from the callback params" do
-              connector = AccountConnector.new(user, params)
-              expect{ connector.create_account }.to change(StripeAccount, :count).by(1)
-              account = StripeAccount.last
-              expect(account.stripe_user_id).to eq "some_user_id"
-              expect(account.stripe_publishable_key).to eq "some_key"
-            end
-          end
+            context "and the user manages the corresponding enterprise" do
+              before do
+                user.enterprise_roles.create(enterprise: enterprise)
+              end
 
-          context "and the user owns the corresponding enterprise" do
-            let(:user) { enterprise.owner }
+              it "raises no errors" do
+                expect(OAuth).to_not receive(:deauthorize)
+                connector.create_account
+              end
 
-            it "raises no errors" do
-              expect(OAuth).to_not receive(:deauthorize)
-              AccountConnector.new(user, params)
+              it "allows creations of a new Stripe Account from the callback params" do
+                expect{ connector.create_account }.to change(StripeAccount, :count).by(1)
+                account = StripeAccount.last
+                expect(account.stripe_user_id).to eq "some_user_id"
+                expect(account.stripe_publishable_key).to eq "some_key"
+              end
             end
 
-            it "allows creations of a new Stripe Account from the callback params" do
-              connector = AccountConnector.new(user, params)
-              expect{ connector.create_account }.to change(StripeAccount, :count).by(1)
-              account = StripeAccount.last
-              expect(account.stripe_user_id).to eq "some_user_id"
-              expect(account.stripe_publishable_key).to eq "some_key"
+            context "and the user owns the corresponding enterprise" do
+              let(:user) { enterprise.owner }
+
+              it "raises no errors" do
+                expect(OAuth).to_not receive(:deauthorize)
+                connector.create_account
+              end
+
+              it "allows creations of a new Stripe Account from the callback params" do
+                expect{ connector.create_account }.to change(StripeAccount, :count).by(1)
+                account = StripeAccount.last
+                expect(account.stripe_user_id).to eq "some_user_id"
+                expect(account.stripe_publishable_key).to eq "some_key"
+              end
             end
           end
         end

From 7c82fa3d44713a6e4ae036497729ff94e2eb0d55 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sun, 17 Sep 2017 11:47:46 +1000
Subject: [PATCH 313/353] Show more helpful payment processing error in
 checkout

---
 app/models/spree/order_decorator.rb           | 18 ++++++++++++++++++
 spec/requests/stripe_connect_checkout_spec.rb | 10 +++++-----
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/app/models/spree/order_decorator.rb b/app/models/spree/order_decorator.rb
index 8c0eddfea0..9892293114 100644
--- a/app/models/spree/order_decorator.rb
+++ b/app/models/spree/order_decorator.rb
@@ -293,6 +293,24 @@ Spree::Order.class_eval do
     complete? && distributor.andand.allow_order_changes? && order_cycle.andand.open?
   end
 
+  # Override of existing Spree method. Can remove when we reach 2-0-stable
+  # See commit: https://github.com/spree/spree/commit/5fca58f658273451193d5711081d018c317814ed
+  # Allows GatewayError to show useful error messages in checkout
+  def process_payments!
+    pending_payments.each do |payment|
+      break if payment_total >= total
+
+      payment.process!
+
+      if payment.completed?
+        self.payment_total += payment.amount
+      end
+    end
+  rescue Spree::Core::GatewayError => e # This section changed
+    result = !!Spree::Config[:allow_checkout_on_gateway_error]
+    errors.add(:base, e.message) and return result
+  end
+
   private
 
   def shipping_address_from_distributor
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index ce787802f0..2bd2909cf0 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -68,7 +68,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
           put update_checkout_path, params
           expect(response.status).to be 400
           json_response = JSON.parse(response.body)
-          expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
+          expect(json_response["flash"]["error"]).to eq "Bup-bow..."
           expect(order.payments.completed.count).to be 0
         end
       end
@@ -128,7 +128,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
           put update_checkout_path, params
           expect(response.status).to be 400
           json_response = JSON.parse(response.body)
-          expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
+          expect(json_response["flash"]["error"]).to eq "Bup-bow..."
           expect(order.payments.completed.count).to be 0
         end
       end
@@ -147,7 +147,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
           put update_checkout_path, params
           expect(response.status).to be 400
           json_response = JSON.parse(response.body)
-          expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
+          expect(json_response["flash"]["error"]).to eq "Bup-bow..."
           expect(order.payments.completed.count).to be 0
         end
       end
@@ -209,7 +209,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
         put update_checkout_path, params
         expect(response.status).to be 400
         json_response = JSON.parse(response.body)
-        expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
+        expect(json_response["flash"]["error"]).to eq "Bup-bow..."
         expect(order.payments.completed.count).to be 0
       end
     end
@@ -228,7 +228,7 @@ describe "Submitting Stripe Connect charge requests", type: :request do
         put update_checkout_path, params
         expect(response.status).to be 400
         json_response = JSON.parse(response.body)
-        expect(json_response["flash"]["error"]).to eq I18n.t(:payment_processing_failed)
+        expect(json_response["flash"]["error"]).to eq "Bup-bow..."
         expect(order.payments.completed.count).to be 0
       end
     end

From ba61f94906c5b4f65bfbb9c3f11eda8a5b88a067 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sun, 17 Sep 2017 12:10:16 +1000
Subject: [PATCH 314/353] Expose Stripe token creation error messages in
 Checkout

---
 app/models/spree/gateway/stripe_connect.rb    | 10 +++--
 spec/requests/stripe_connect_checkout_spec.rb | 39 +++++++------------
 2 files changed, 20 insertions(+), 29 deletions(-)

diff --git a/app/models/spree/gateway/stripe_connect.rb b/app/models/spree/gateway/stripe_connect.rb
index f4a0435ace..6efd2f79ef 100644
--- a/app/models/spree/gateway/stripe_connect.rb
+++ b/app/models/spree/gateway/stripe_connect.rb
@@ -33,6 +33,9 @@ module Spree
 
       def purchase(money, creditcard, gateway_options)
         provider.purchase(*options_for_purchase_or_auth(money, creditcard, gateway_options))
+      rescue Stripe::StripeError => e
+        # This will be an error caused by generating a stripe token
+        failed_activemerchant_billing_response(e.message)
       end
 
       def void(response_code, _creditcard, gateway_options)
@@ -88,9 +91,10 @@ module Spree
       def tokenize_instance_customer_card(customer, card)
         token = Stripe::Token.create({card: card, customer: customer}, stripe_account: stripe_account_id)
         token.id
-      rescue Stripe::StripeError => e
-        Rails.logger.error("Stripe Error: #{e}")
-        nil
+      end
+
+      def failed_activemerchant_billing_response(error_message)
+        ActiveMerchant::Billing::Response.new(false, error_message)
       end
 
       def ensure_enterprise_selected
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/stripe_connect_checkout_spec.rb
index 2bd2909cf0..b3d21afdd5 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/stripe_connect_checkout_spec.rb
@@ -62,13 +62,13 @@ describe "Submitting Stripe Connect charge requests", type: :request do
       end
 
       context "when the charge request returns an error message" do
-        let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+        let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "charge-failure"}) } }
 
         it "should not process the payment" do
           put update_checkout_path, params
           expect(response.status).to be 400
           json_response = JSON.parse(response.body)
-          expect(json_response["flash"]["error"]).to eq "Bup-bow..."
+          expect(json_response["flash"]["error"]).to eq "charge-failure"
           expect(order.payments.completed.count).to be 0
         end
       end
@@ -110,44 +110,38 @@ describe "Submitting Stripe Connect charge requests", type: :request do
       end
 
       context "when the store request returns an error message" do
-        let(:store_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+        let(:store_response_mock) { { status: 402, body: JSON.generate(error: { message: "store-failure"}) } }
 
         it "should not process the payment" do
           put update_checkout_path, params
           expect(response.status).to be 400
           json_response = JSON.parse(response.body)
-          expect(json_response["flash"]["error"]).to eq I18n.t(:spree_gateway_error_flash_for_checkout, error: 'Bup-bow...')
+          expect(json_response["flash"]["error"]).to eq I18n.t(:spree_gateway_error_flash_for_checkout, error: 'store-failure')
           expect(order.payments.completed.count).to be 0
         end
       end
 
       context "when the charge request returns an error message" do
-        let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+        let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "charge-failure"}) } }
 
         it "should not process the payment" do
           put update_checkout_path, params
           expect(response.status).to be 400
           json_response = JSON.parse(response.body)
-          expect(json_response["flash"]["error"]).to eq "Bup-bow..."
+          expect(json_response["flash"]["error"]).to eq "charge-failure"
           expect(order.payments.completed.count).to be 0
         end
       end
 
       context "when the token request returns an error message" do
-        let(:token_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
-        let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
-
-        before do
-          # Attempts to charge the card without a token, which will return an error
-          stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
-            .with(body: /#{order.number}/).to_return(charge_response_mock)
-        end
+        let(:token_response_mock) { { status: 402, body: JSON.generate(error: { message: "token-failure"}) } }
 
+        # Note, no requests have been stubbed
         it "should not process the payment" do
           put update_checkout_path, params
           expect(response.status).to be 400
           json_response = JSON.parse(response.body)
-          expect(json_response["flash"]["error"]).to eq "Bup-bow..."
+          expect(json_response["flash"]["error"]).to eq "token-failure"
           expect(order.payments.completed.count).to be 0
         end
       end
@@ -203,32 +197,25 @@ describe "Submitting Stripe Connect charge requests", type: :request do
     end
 
     context "when the charge request returns an error message" do
-      let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
+      let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "charge-failure"}) } }
 
       it "should not process the payment" do
         put update_checkout_path, params
         expect(response.status).to be 400
         json_response = JSON.parse(response.body)
-        expect(json_response["flash"]["error"]).to eq "Bup-bow..."
+        expect(json_response["flash"]["error"]).to eq "charge-failure"
         expect(order.payments.completed.count).to be 0
       end
     end
 
     context "when the token request returns an error message" do
-      let(:token_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
-      let(:charge_response_mock) { { status: 402, body: JSON.generate(error: { message: "Bup-bow..."}) } }
-
-      before do
-        # Attempts to charge the card without a token, which will return an error
-        stub_request(:post, "https://sk_test_12345:@api.stripe.com/v1/charges")
-          .with(body: /#{order.number}/).to_return(charge_response_mock)
-      end
+      let(:token_response_mock) { { status: 402, body: JSON.generate(error: { message: "token-error"}) } }
 
       it "should not process the payment" do
         put update_checkout_path, params
         expect(response.status).to be 400
         json_response = JSON.parse(response.body)
-        expect(json_response["flash"]["error"]).to eq "Bup-bow..."
+        expect(json_response["flash"]["error"]).to eq "token-error"
         expect(order.payments.completed.count).to be 0
       end
     end

From 7ba99c0fe082f5f197adaf5b446d0103c5a09432 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sun, 17 Sep 2017 13:42:02 +1000
Subject: [PATCH 315/353] Update Bogus Gateway error message in checkout spec

---
 spec/features/consumer/shopping/checkout_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index f453d61dee..5774b29d53 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -461,7 +461,7 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
                   fill_in 'Security Code', with: '123'
 
                   place_order
-                  page.should have_content "Payment could not be processed, please check the details you entered"
+                  page.should have_content 'Bogus Gateway: Forced failure'
 
                   # Does not show duplicate shipping fee
                   visit checkout_path

From 90007d7114da2ac1ba2e8a05fa47a76b4e372e7b Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 22 Sep 2017 16:24:15 +1000
Subject: [PATCH 316/353] Prevent Stripe-based payment methods that are not
 linked to a StripeAccount from displaying in the checkout

---
 .../available_payment_method_filter.rb             |  8 +++++++-
 spec/features/consumer/shopping/checkout_spec.rb   |  2 ++
 spec/helpers/enterprises_helper_spec.rb            | 14 ++++++++------
 3 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/lib/open_food_network/available_payment_method_filter.rb b/lib/open_food_network/available_payment_method_filter.rb
index bb33fcd4bc..379beb22b5 100644
--- a/lib/open_food_network/available_payment_method_filter.rb
+++ b/lib/open_food_network/available_payment_method_filter.rb
@@ -2,7 +2,7 @@ module OpenFoodNetwork
   class AvailablePaymentMethodFilter
     def filter!(payment_methods)
       if stripe_enabled?
-        payment_methods.reject!{ |p| p.type.ends_with?("StripeConnect") && p.preferred_enterprise_id.zero? }
+        payment_methods.reject!{ |p| p.type.ends_with?("StripeConnect") && stripe_configuration_incomplete?(p) }
       else
         payment_methods.reject!{ |p| p.type.ends_with?("StripeConnect") }
       end
@@ -13,5 +13,11 @@ module OpenFoodNetwork
     def stripe_enabled?
       Spree::Config.stripe_connect_enabled && Stripe.publishable_key
     end
+
+    def stripe_configuration_incomplete?(payment_method)
+      return true if payment_method.preferred_enterprise_id.zero?
+
+      payment_method.stripe_account_id.blank?
+    end
   end
 end
diff --git a/spec/features/consumer/shopping/checkout_spec.rb b/spec/features/consumer/shopping/checkout_spec.rb
index 5774b29d53..0a55324b37 100644
--- a/spec/features/consumer/shopping/checkout_spec.rb
+++ b/spec/features/consumer/shopping/checkout_spec.rb
@@ -159,6 +159,8 @@ feature "As a consumer I want to check out my cart", js: true, retry: 3 do
           gateway_customer_profile_id: "i_am_saved")
         end
 
+        let!(:stripe_account) { create(:stripe_account, enterprise_id: distributor.id, stripe_user_id: 'some_id') }
+
         let(:response_mock) { { id: "ch_1234", object: "charge", amount: 2000} }
 
         before do
diff --git a/spec/helpers/enterprises_helper_spec.rb b/spec/helpers/enterprises_helper_spec.rb
index 9ab6d1d17d..f63cb49c0e 100644
--- a/spec/helpers/enterprises_helper_spec.rb
+++ b/spec/helpers/enterprises_helper_spec.rb
@@ -222,30 +222,32 @@ describe EnterprisesHelper do
 
     context "when StripeConnect payment methods are present" do
       let!(:pm3) { create(:stripe_payment_method, distributors: [distributor], preferred_enterprise_id: distributor.id) }
-      let!(:pm4) { create(:stripe_payment_method, distributors: [distributor], preferred_enterprise_id: distributor.id) }
+      let!(:pm4) { create(:stripe_payment_method, distributors: [distributor], preferred_enterprise_id: some_other_distributor.id) }
+      let(:available_payment_methods) { helper.available_payment_methods }
 
       before do
         allow(helper).to receive(:current_distributor) { distributor }
-        pm4.update_attribute(:preferred_enterprise_id, nil)
       end
 
       context "and Stripe Connect is disabled" do
         before { Spree::Config.set(stripe_connect_enabled: false) }
 
         it "ignores Stripe payment methods" do
-          expect(helper.available_payment_methods.map(&:id)).to_not include pm3.id, pm4.id
+          expect(available_payment_methods).to_not include pm3, pm4
         end
       end
 
       context "and Stripe Connect is enabled" do
+        let!(:stripe_account) { create(:stripe_account, enterprise_id: distributor.id) }
+
         before do
           Spree::Config.set(stripe_connect_enabled: true)
           allow(Stripe).to receive(:publishable_key) { "some_key" }
         end
 
-        it "includes Stripe payment methods with a preferred_enterprise_id" do
-          expect(helper.available_payment_methods.map(&:id)).to include pm3.id
-          expect(helper.available_payment_methods.map(&:id)).to_not include pm4.id
+        it "includes Stripe payment methods with a valid stripe accounts" do
+          expect(available_payment_methods).to include pm3
+          expect(available_payment_methods).to_not include pm4
         end
       end
     end

From dd3d2055365cfc11f2b396722cb905968ef41e2a Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 22 Sep 2017 16:30:49 +1000
Subject: [PATCH 317/353] Update deauthorize webhook to latest version of API
 (again)

---
 app/controllers/admin/stripe_accounts_controller.rb       | 4 ++--
 spec/controllers/admin/stripe_accounts_controller_spec.rb | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index 3f837e5931..98f3386472 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -47,9 +47,9 @@ module Admin
       event = Stripe::Event.construct_from(params)
       return render nothing: true, status: 400 unless event.type == "account.application.deauthorized"
 
-      destroyed = StripeAccount.where(stripe_user_id: event.stripe_account.id).destroy_all
+      destroyed = StripeAccount.where(stripe_user_id: event.account).destroy_all
       if destroyed.any?
-        render text: "Account #{event.stripe_account.id} deauthorized", status: 200
+        render text: "Account #{event.account} deauthorized", status: 200
       else
         render nothing: true, status: 400
       end
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index d81ad363ff..87b33605fc 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -99,7 +99,7 @@ describe Admin::StripeAccountsController, type: :controller do
         "object" => "event",
         "data" => { "object" => { "id" => "ca_9B" } },
         "type" => "account.application.deauthorized",
-        "stripe_account" => { "id" => "webhook_id" }
+        "account" => "webhook_id"
       }
     end
 
@@ -112,7 +112,7 @@ describe Admin::StripeAccountsController, type: :controller do
 
     context "when the stripe_account id on the event does not match any known accounts" do
       before do
-        params["stripe_account"]["id"] = "webhook_id1"
+        params["account"] = "webhook_id1"
       end
 
       it "does nothing" do

From db5503dd807937a4696a6cd27350dca3c2bd313c Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 22 Sep 2017 16:47:22 +1000
Subject: [PATCH 318/353] Allow destruction of StripeAccounts even if
 deauthorise request fails

Log deauthorise failures to Bugsnag
---
 app/models/stripe_account.rb       | 15 +++++++++------
 spec/models/stripe_account_spec.rb |  8 +++++---
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/app/models/stripe_account.rb b/app/models/stripe_account.rb
index dfbcc560ea..1b2840ffe6 100644
--- a/app/models/stripe_account.rb
+++ b/app/models/stripe_account.rb
@@ -7,12 +7,15 @@ class StripeAccount < ActiveRecord::Base
     accounts = StripeAccount.where(stripe_user_id: stripe_user_id)
 
     # Only deauthorize the user if it is not linked to multiple accounts
-    if accounts.count > 1 || Stripe::OAuth.deauthorize(stripe_user_id: stripe_user_id)
-      destroy
-    else
-      false
-    end
+    return destroy if accounts.count > 1
+
+    destroy && Stripe::OAuth.deauthorize(stripe_user_id: stripe_user_id)
   rescue Stripe::OAuth::OAuthError
-    false
+    Bugsnag.notify(
+      RuntimeError.new("StripeDeauthorizeFailure"),
+      stripe_account: stripe_user_id,
+      enterprise_id: enterprise_id
+    )
+    true
   end
 end
diff --git a/spec/models/stripe_account_spec.rb b/spec/models/stripe_account_spec.rb
index a3afa1685a..b4a1cbfb00 100644
--- a/spec/models/stripe_account_spec.rb
+++ b/spec/models/stripe_account_spec.rb
@@ -21,9 +21,10 @@ describe StripeAccount do
           to_return(status: 400, body: JSON.generate(error: 'invalid_grant', error_description: "Some Message"))
       end
 
-      it "doesn't destroy the record" do
+      it "destroys the record and notifies Bugsnag" do
+        expect(Bugsnag).to receive(:notify)
         stripe_account.deauthorize_and_destroy
-        expect(StripeAccount.all).to include(stripe_account)
+        expect(StripeAccount.all).to_not include(stripe_account)
       end
     end
 
@@ -41,11 +42,12 @@ describe StripeAccount do
     end
 
     context "if the account is also associated with another Enterprise" do
-      let!(:another_stripe_account) { create(:stripe_account, enterprise: enterprise2, stripe_user_id: stripe_account.stripe_user_id) }
+      let!(:another_stripe_account) { create(:stripe_account, enterprise: enterprise2, stripe_user_id: stripe_user_id) }
 
       it "Doesn't make a Stripe API disconnection request " do
         expect(Stripe::OAuth).to_not receive(:deauthorize)
         stripe_account.deauthorize_and_destroy
+        expect(StripeAccount.all).not_to include(stripe_account)
       end
     end
   end

From e486dbd4f888982ddd67e45745f902aff738efe5 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 22 Sep 2017 17:32:31 +1000
Subject: [PATCH 319/353] Respond to Stripe webhook with status of 204 if
 specified account is not found

---
 app/controllers/admin/stripe_accounts_controller.rb       | 4 ++--
 spec/controllers/admin/stripe_accounts_controller_spec.rb | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index 98f3386472..d862664b02 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -45,13 +45,13 @@ module Admin
     def deauthorize
       # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
       event = Stripe::Event.construct_from(params)
-      return render nothing: true, status: 400 unless event.type == "account.application.deauthorized"
+      return render nothing: true, status: 204 unless event.type == "account.application.deauthorized"
 
       destroyed = StripeAccount.where(stripe_user_id: event.account).destroy_all
       if destroyed.any?
         render text: "Account #{event.account} deauthorized", status: 200
       else
-        render nothing: true, status: 400
+        render nothing: true, status: 204
       end
     end
 
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 87b33605fc..13ea627499 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -117,7 +117,7 @@ describe Admin::StripeAccountsController, type: :controller do
 
       it "does nothing" do
         post 'deauthorize', params
-        expect(response.status).to eq 400
+        expect(response.status).to eq 204
         expect(StripeAccount.all).to include stripe_account
       end
     end
@@ -129,7 +129,7 @@ describe Admin::StripeAccountsController, type: :controller do
 
       it "does nothing" do
         post 'deauthorize', params
-        expect(response.status).to eq 400
+        expect(response.status).to eq 204
         expect(StripeAccount.all).to include stripe_account
       end
     end

From a09a54e4cb0fe9d0d01e6cfd8edfbe8c082c61b9 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sat, 23 Sep 2017 10:33:58 +1000
Subject: [PATCH 320/353] Set transaction fee adjustments to ineligible if
 payment is invalid or failed

---
 app/models/spree/payment_decorator.rb | 21 +++++--
 spec/models/spree/payment_spec.rb     | 84 +++++++++++++++++++++++++++
 2 files changed, 99 insertions(+), 6 deletions(-)

diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index 9097fb1b91..a09e65c2fd 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -7,12 +7,10 @@ module Spree
     attr_accessible :source
 
     def ensure_correct_adjustment
-      # Don't charge for invalid payments.
-      # PayPalExpress always creates a payment that is invalidated later.
-      # Unknown: What about failed payments?
-      if state == "invalid"
-        adjustment.andand.destroy
-      elsif adjustment
+      revoke_adjustment_eligibility if ['failed', 'invalid'].include?(state)
+      return if adjustment.try(:finalized?)
+
+      if adjustment
         adjustment.originator = payment_method
         adjustment.label = adjustment_label
         adjustment.save
@@ -101,5 +99,16 @@ module Spree
     rescue ActiveMerchant::ConnectionError => e
       gateway_error e
     end
+
+    # Don't charge fees for invalid or failed payments.
+    # This is called twice for failed payments, because the persistence of the 'failed'
+    # state is acheived through some trickery using an after_rollback callback on the
+    # payment model. See Spree::Payment#persist_invalid
+    def revoke_adjustment_eligibility
+      return unless adjustment.reload
+      return if adjustment.finalized?
+      adjustment.update_attribute(:eligible, false)
+      adjustment.finalize!
+    end
   end
 end
diff --git a/spec/models/spree/payment_spec.rb b/spec/models/spree/payment_spec.rb
index 0877959cbb..36fb1ceaea 100644
--- a/spec/models/spree/payment_spec.rb
+++ b/spec/models/spree/payment_spec.rb
@@ -124,5 +124,89 @@ module Spree
         payment.refund!
       end
     end
+
+    describe "applying transaction fees" do
+      let!(:order) { create(:order) }
+      let!(:line_item) { create(:line_item, order: order, quantity: 3, price: 5.00) }
+
+      before do
+        order.reload.update!
+      end
+
+      context "to Stripe payments" do
+        let(:shop) { create(:enterprise) }
+        let(:payment_method) { create(:stripe_payment_method, distributor_ids: [create(:distributor_enterprise).id], preferred_enterprise_id: shop.id) }
+        let(:payment) { create(:payment, order: order, payment_method: payment_method, amount: order.total) }
+        let(:calculator) { Spree::Calculator::FlatPercentItemTotal.new(preferred_flat_percent: 10) }
+
+        before do
+          payment_method.calculator = calculator
+          payment_method.save!
+
+          allow(order).to receive(:pending_payments) { [payment] }
+        end
+
+        context "when the payment fails" do
+          let(:failed_response) { ActiveMerchant::Billing::Response.new(false, "This is an error message") }
+
+          before do
+            allow(payment_method).to receive(:purchase) { failed_response }
+          end
+
+          it "makes the transaction fee ineligible and finalizes it" do
+            # Decided to wrap the save process in order.process_payments!
+            # since that is the context it is usually performed in
+            order.process_payments!
+            expect(order.payments.count).to eq 1
+            expect(order.payments).to include payment
+            expect(payment.state).to eq "failed"
+            expect(payment.adjustment.eligible?).to be false
+            expect(payment.adjustment.finalized?).to be true
+            expect(order.adjustments.payment_fee.count).to eq 1
+            expect(order.adjustments.payment_fee.eligible).to_not include payment.adjustment
+          end
+        end
+
+        context "when the payment information is invalid" do
+          before do
+            allow(payment_method).to receive(:supports?) { false }
+          end
+
+          it "makes the transaction fee ineligible and finalizes it" do
+            # Decided to wrap the save process in order.process_payments!
+            # since that is the context it is usually performed in
+            order.process_payments!
+            expect(order.payments.count).to eq 1
+            expect(order.payments).to include payment
+            expect(payment.state).to eq "invalid"
+            expect(payment.adjustment.eligible?).to be false
+            expect(payment.adjustment.finalized?).to be true
+            expect(order.adjustments.payment_fee.count).to eq 1
+            expect(order.adjustments.payment_fee.eligible).to_not include payment.adjustment
+          end
+        end
+
+        context "when the payment is processed successfully" do
+          let(:successful_response) { ActiveMerchant::Billing::Response.new(true, "Yay!") }
+
+          before do
+            allow(payment_method).to receive(:purchase) { successful_response }
+          end
+
+          it "creates an appropriate adjustment" do
+            # Decided to wrap the save process in order.process_payments!
+            # since that is the context it is usually performed in
+            order.process_payments!
+            expect(order.payments.count).to eq 1
+            expect(order.payments).to include payment
+            expect(payment.state).to eq "completed"
+            expect(payment.adjustment.eligible?).to be true
+            expect(order.adjustments.payment_fee.count).to eq 1
+            expect(order.adjustments.payment_fee.eligible).to include payment.adjustment
+            expect(payment.adjustment.amount).to eq 1.5
+          end
+        end
+      end
+    end
   end
 end

From 75ec77dc31de2c57514948211755a05356eab938 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Sat, 23 Sep 2017 12:33:45 +1000
Subject: [PATCH 321/353] Remove the 'confirm' step from the order checkout
 flow

This step is not being responded to anyway, since we are not rending a page for each checkout step

It was causing an issue whereby an order in the 'confirm' state was not able to progress through the
checkout controller because it was expecting to only redirect to paypal from the 'payment' state.
figured it was easiest to just remove the step, seeing as it wasn't being used in any meaningful way.
It should be fine to bring the 'confirm' step back in the future if we need it, we will just have to
make sure paypal the paypal issue is resolved.
---
 app/models/spree/order_decorator.rb |  3 ++-
 spec/models/spree/order_spec.rb     | 11 +++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/app/models/spree/order_decorator.rb b/app/models/spree/order_decorator.rb
index 9892293114..0166fc10c1 100644
--- a/app/models/spree/order_decorator.rb
+++ b/app/models/spree/order_decorator.rb
@@ -37,7 +37,8 @@ Spree::Order.class_eval do
       end
       order.payment_required?
     }
-    go_to_state :confirm, :if => lambda { |order| order.confirmation_required? }
+    # NOTE: :confirm step was removed because we were not actually using it
+    # go_to_state :confirm, :if => lambda { |order| order.confirmation_required? }
     go_to_state :complete
     remove_transition :from => :delivery, :to => :confirm
   end
diff --git a/spec/models/spree/order_spec.rb b/spec/models/spree/order_spec.rb
index 8ed03ff0f7..d722e234d2 100644
--- a/spec/models/spree/order_spec.rb
+++ b/spec/models/spree/order_spec.rb
@@ -750,4 +750,15 @@ describe Spree::Order do
       end
     end
   end
+
+  describe "determining checkout steps for an order" do
+    let!(:enterprise) { create(:enterprise) }
+    let!(:order) { create(:order, distributor: enterprise) }
+    let!(:payment_method) { create(:stripe_payment_method, distributor_ids: [enterprise.id], preferred_enterprise_id: enterprise.id) }
+    let!(:payment) { create(:payment, order: order, payment_method: payment_method) }
+
+    it "does not include the :confirm step" do
+      expect(order.checkout_steps).to_not include "confirm"
+    end
+  end
 end

From d8e305257559b2129d0dbeddd01d1ed8398074ac Mon Sep 17 00:00:00 2001
From: Pau Perez <saulopefa@gmail.com>
Date: Fri, 29 Sep 2017 16:10:11 +0200
Subject: [PATCH 322/353] Ensure a callback function is provided

---
 .../services/enterprise_registration_service.js.coffee        | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee b/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee
index 7e81d53d70..25ec644a66 100644
--- a/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee
+++ b/app/assets/javascripts/darkswarm/services/enterprise_registration_service.js.coffee
@@ -29,7 +29,6 @@ Darkswarm.factory "EnterpriseRegistrationService", ($http, RegistrationService,
         @enterprise.id = data
         EnterpriseImageService.configure(@enterprise)
         RegistrationService.select('about')
-        callback.call()
       ).error((data) =>
         Loading.clear()
         if data?.errors?
@@ -37,9 +36,8 @@ Darkswarm.factory "EnterpriseRegistrationService", ($http, RegistrationService,
           alert t('failed_to_create_enterprise') + "\n" + errors.join('\n')
         else
           alert(t('failed_to_create_enterprise_unknown'))
-
-        callback.call()
       )
+      callback.call() if callback?
 
     update: (step) =>
       Loading.message = t('updating') + " " + @enterprise.name

From 2b989f49eaaa1674f8a47f9fb6dc2ddeabc85a25 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Wed, 20 Sep 2017 15:20:42 +1000
Subject: [PATCH 323/353] Enable iframes in development environment

---
 app/controllers/application_controller.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 001805928f..b241dede09 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -57,7 +57,7 @@ class ApplicationController < ActionController::Base
   def enable_embedded_shopfront
     whitelist = Spree::Config[:embedded_shopfronts_whitelist]
     return unless Spree::Config[:enable_embedded_shopfronts] && whitelist.present?
-    return if request.referer && URI(request.referer).scheme != 'https' && !Rails.env.test?
+    return if request.referer && URI(request.referer).scheme != 'https' && !Rails.env.test? && !Rails.env.development?
 
     response.headers.delete 'X-Frame-Options'
     response.headers['Content-Security-Policy'] = "frame-ancestors #{whitelist}"

From 28b1ea2d9ff7be5c5b9a607795119dbe7a9a8af4 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Wed, 20 Sep 2017 15:41:48 +1000
Subject: [PATCH 324/353] Allow group pages to be in iframes

---
 app/controllers/groups_controller.rb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index 43a3f49abe..0a3b46b342 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -6,6 +6,7 @@ class GroupsController < BaseController
   end
 
   def show
+    enable_embedded_shopfront
     @group = EnterpriseGroup.find_by_permalink(params[:id]) || EnterpriseGroup.find(params[:id])
   end
 end

From b8a124b99e7d3d53ff935eb33e10909a8d1c9015 Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Wed, 20 Sep 2017 15:51:09 +1000
Subject: [PATCH 325/353] Add preview page for embedded groups

---
 public/embedded-group-preview.html | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 public/embedded-group-preview.html

diff --git a/public/embedded-group-preview.html b/public/embedded-group-preview.html
new file mode 100644
index 0000000000..70b28777e1
--- /dev/null
+++ b/public/embedded-group-preview.html
@@ -0,0 +1,20 @@
+<html>
+  <head><title>Embedded Group</title></head>
+<body>
+
+  <p>
+  This is a preview page for embedded groups.
+  Choose a group to display by copying its permalink id into the URL after the question mark.
+  Example: <code>embedded-group-preview.html?flavour-crusader</code>
+  </p>
+
+  <iframe style="width:100%;min-height:35em"></iframe>
+  <script>
+    var unsafeGroupName = window.location.search.substr(1);
+    var group = unsafeGroupName.replace(/[^a-z0-9-]/g, '');
+    var iframe = document.querySelector("iframe");
+    iframe.src = "/groups/" + group + "?embedded_shopfront=true";
+  </script>
+
+</body>
+</html>

From 10bbc5f9efd849f66273f941f808995ab64003db Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Wed, 20 Sep 2017 16:16:44 +1000
Subject: [PATCH 326/353] Hide the menu on embedded group pages

---
 app/controllers/groups_controller.rb  | 1 +
 app/helpers/application_helper.rb     | 6 ++++++
 app/views/layouts/darkswarm.html.haml | 4 ++--
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index 0a3b46b342..ce72038e70 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -7,6 +7,7 @@ class GroupsController < BaseController
 
   def show
     enable_embedded_shopfront
+    @hide_menu = true if @shopfront_layout == 'embedded'
     @group = EnterpriseGroup.find_by_permalink(params[:id]) || EnterpriseGroup.find(params[:id])
   end
 end
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index a9abf266dc..bec9d181c9 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -20,4 +20,10 @@ module ApplicationHelper
       super
     end
   end
+
+  def body_classes
+    classes = []
+    classes << "off-canvas" unless @hide_menu
+    classes << @shopfront_layout
+  end
 end
diff --git a/app/views/layouts/darkswarm.html.haml b/app/views/layouts/darkswarm.html.haml
index 5bd57ea8e6..c702848e89 100644
--- a/app/views/layouts/darkswarm.html.haml
+++ b/app/views/layouts/darkswarm.html.haml
@@ -22,7 +22,7 @@
     = render "layouts/bugherd_script"
     = csrf_meta_tags
 
-  %body.off-canvas{class: @shopfront_layout, ng: {app: "Darkswarm"}}
+  %body{class: body_classes, ng: {app: "Darkswarm"}}
     / [if lte IE 8]
       = render partial: "shared/ie_warning"
       = javascript_include_tag "iehack"
@@ -39,7 +39,7 @@
 
     .off-canvas-wrap{offcanvas: true}
       .inner-wrap
-        = render "shared/menu/menu"
+        = render "shared/menu/menu" unless @hide_menu
 
         %section{ role: "main" }
           = yield

From 6ad7c7b835856d4e4fa6d3a22a105037b3d5a90b Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Fri, 22 Sep 2017 15:47:28 +1000
Subject: [PATCH 327/353] Tidy up HTML indent

---
 public/embedded-group-preview.html | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/public/embedded-group-preview.html b/public/embedded-group-preview.html
index 70b28777e1..a15a5c6a17 100644
--- a/public/embedded-group-preview.html
+++ b/public/embedded-group-preview.html
@@ -1,20 +1,20 @@
 <html>
   <head><title>Embedded Group</title></head>
-<body>
+  <body>
 
-  <p>
-  This is a preview page for embedded groups.
-  Choose a group to display by copying its permalink id into the URL after the question mark.
-  Example: <code>embedded-group-preview.html?flavour-crusader</code>
-  </p>
+    <p>
+    This is a preview page for embedded groups.
+    Choose a group to display by copying its permalink id into the URL after the question mark.
+    Example: <code>embedded-group-preview.html?flavour-crusader</code>
+    </p>
 
-  <iframe style="width:100%;min-height:35em"></iframe>
-  <script>
-    var unsafeGroupName = window.location.search.substr(1);
-    var group = unsafeGroupName.replace(/[^a-z0-9-]/g, '');
-    var iframe = document.querySelector("iframe");
-    iframe.src = "/groups/" + group + "?embedded_shopfront=true";
-  </script>
+    <iframe style="width:100%;min-height:35em"></iframe>
+    <script>
+      var unsafeGroupName = window.location.search.substr(1);
+      var group = unsafeGroupName.replace(/[^a-z0-9-]/g, '');
+      var iframe = document.querySelector("iframe");
+      iframe.src = "/groups/" + group + "?embedded_shopfront=true";
+    </script>
 
-</body>
+  </body>
 </html>

From 4dd71c12404554053da2d78b3a3a7e0cba6335fe Mon Sep 17 00:00:00 2001
From: Maikel Linke <mkllnk@web.de>
Date: Fri, 6 Oct 2017 15:48:44 +1100
Subject: [PATCH 328/353] Add CSS workaround to display repeated table head

Fixes https://github.com/openfoodfoundation/openfoodnetwork/issues/1738
---
 app/assets/stylesheets/mail/email.css.scss | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/app/assets/stylesheets/mail/email.css.scss b/app/assets/stylesheets/mail/email.css.scss
index 0b2f641b4f..10a16941dd 100644
--- a/app/assets/stylesheets/mail/email.css.scss
+++ b/app/assets/stylesheets/mail/email.css.scss
@@ -408,3 +408,12 @@ ul {
   display: inline-block;
   margin: 0px;
 }
+
+/*
+ * Fix overlapping table header on second page of long invoices.
+ * Problem description: https://github.com/openfoodfoundation/openfoodnetwork/issues/1738
+ * Solution: https://github.com/wkhtmltopdf/wkhtmltopdf/issues/1770#issuecomment-73530576
+ */
+thead { display: table-header-group }
+tfoot { display: table-row-group }
+tr { page-break-inside: avoid }

From d147d2035d2d4688a6b6965f2273255b600178d1 Mon Sep 17 00:00:00 2001
From: Matt-Yorkley <visible_souls@hotmail.com>
Date: Sat, 7 Oct 2017 11:50:59 +0100
Subject: [PATCH 329/353] Disable symbol array cop

---
 .rubocop.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.rubocop.yml b/.rubocop.yml
index 04839c512d..2e664e7c2b 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -143,6 +143,10 @@ Style/WordArray:
   Enabled: false
   StyleGuide: http://relaxed.ruby.style/#stylewordarray
 
+Style/SymbolArray:
+  Enabled: false
+  StyleGuide: https://rubocop.readthedocs.io/en/latest/cops_style/#stylesymbolarray
+
 Lint/AmbiguousRegexpLiteral:
   Enabled: false
   StyleGuide: http://relaxed.ruby.style/#lintambiguousregexpliteral

From c747bb5305bd64adf95388cb4f4dec4616ed7123 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 11 Oct 2017 15:51:16 +1100
Subject: [PATCH 330/353] Remove improper use of quick_login_as_admin from unit
 spec

---
 spec/models/spree/user_spec.rb | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/spec/models/spree/user_spec.rb b/spec/models/spree/user_spec.rb
index fb75264550..ea22d42ec0 100644
--- a/spec/models/spree/user_spec.rb
+++ b/spec/models/spree/user_spec.rb
@@ -1,6 +1,4 @@
 describe Spree.user_class do
-  include AuthenticationWorkflow
-
   describe "associations" do
     it { should have_many(:owned_enterprises) }
 
@@ -95,7 +93,7 @@ describe Spree.user_class do
     end
 
     describe "as admin" do
-      let(:admin) { quick_login_as_admin }
+      let(:admin) { create(:admin_user) }
 
       it "returns all users" do
         expect(admin.known_users).to include u1, u2, u3

From 23d2b3a664423e3e6d45acf47f20a26023b72b61 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 11 Oct 2017 16:38:19 +1100
Subject: [PATCH 331/353] Move Stripe webhook logic into dedicated frontend
 controller

---
 .../admin/stripe_accounts_controller.rb       | 13 -----
 app/controllers/stripe_controller.rb          | 14 ++++++
 config/routes.rb                              |  5 +-
 .../admin/stripe_accounts_controller_spec.rb  | 45 -----------------
 spec/controllers/stripe_controller_spec.rb    | 48 +++++++++++++++++++
 5 files changed, 66 insertions(+), 59 deletions(-)
 create mode 100644 app/controllers/stripe_controller.rb
 create mode 100644 spec/controllers/stripe_controller_spec.rb

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index d862664b02..e23ab7ffb4 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -42,19 +42,6 @@ module Admin
       redirect_to spree.admin_path
     end
 
-    def deauthorize
-      # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
-      event = Stripe::Event.construct_from(params)
-      return render nothing: true, status: 204 unless event.type == "account.application.deauthorized"
-
-      destroyed = StripeAccount.where(stripe_user_id: event.account).destroy_all
-      if destroyed.any?
-        render text: "Account #{event.account} deauthorized", status: 200
-      else
-        render nothing: true, status: 204
-      end
-    end
-
     def status
       return render json: { status: :stripe_disabled } unless Spree::Config.stripe_connect_enabled
       stripe_account = StripeAccount.find_by_enterprise_id(params[:enterprise_id])
diff --git a/app/controllers/stripe_controller.rb b/app/controllers/stripe_controller.rb
new file mode 100644
index 0000000000..dd5b8e5639
--- /dev/null
+++ b/app/controllers/stripe_controller.rb
@@ -0,0 +1,14 @@
+class StripeController < BaseController
+  def deauthorize
+    # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
+    event = Stripe::Event.construct_from(params)
+    return render nothing: true, status: 204 unless event.type == "account.application.deauthorized"
+
+    destroyed = StripeAccount.where(stripe_user_id: event.account).destroy_all
+    if destroyed.any?
+      render text: "Account #{event.account} deauthorized", status: 200
+    else
+      render nothing: true, status: 204
+    end
+  end
+end
diff --git a/config/routes.rb b/config/routes.rb
index 9ed42772e5..64243e39a3 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -53,6 +53,10 @@ Openfoodnetwork::Application.routes.draw do
     end
   end
 
+  resource :stripe, only: [] do
+    post :deauthorize
+  end
+
   namespace :admin do
     resources :bulk_line_items
   end
@@ -171,7 +175,6 @@ Openfoodnetwork::Application.routes.draw do
       get :connect, on: :collection
       get :connect_callback, on: :collection
       get :status, on: :collection
-      post :deauthorize, on: :collection
     end
   end
 
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 13ea627499..96a17e02d8 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -90,51 +90,6 @@ describe Admin::StripeAccountsController, type: :controller do
     end
   end
 
-  describe "#deauthorize" do
-    let!(:stripe_account) { create(:stripe_account, stripe_user_id: "webhook_id") }
-    let(:params) do
-      {
-        "format" => "json",
-        "id" => "evt_123",
-        "object" => "event",
-        "data" => { "object" => { "id" => "ca_9B" } },
-        "type" => "account.application.deauthorized",
-        "account" => "webhook_id"
-      }
-    end
-
-    it "deletes Stripe accounts in response to a webhook" do
-      post 'deauthorize', params
-      expect(response.status).to eq 200
-      expect(response.body).to eq "Account webhook_id deauthorized"
-      expect(StripeAccount.all).not_to include stripe_account
-    end
-
-    context "when the stripe_account id on the event does not match any known accounts" do
-      before do
-        params["account"] = "webhook_id1"
-      end
-
-      it "does nothing" do
-        post 'deauthorize', params
-        expect(response.status).to eq 204
-        expect(StripeAccount.all).to include stripe_account
-      end
-    end
-
-    context "when the event is not a deauthorize event" do
-      before do
-        params["type"] = "account.application.authorized"
-      end
-
-      it "does nothing" do
-        post 'deauthorize', params
-        expect(response.status).to eq 204
-        expect(StripeAccount.all).to include stripe_account
-      end
-    end
-  end
-
   describe "#destroy" do
     let(:params) { { format: :json, id: "some_id" } }
 
diff --git a/spec/controllers/stripe_controller_spec.rb b/spec/controllers/stripe_controller_spec.rb
new file mode 100644
index 0000000000..dc9f32f5c7
--- /dev/null
+++ b/spec/controllers/stripe_controller_spec.rb
@@ -0,0 +1,48 @@
+require 'spec_helper'
+
+describe StripeController do
+  describe "#deauthorize" do
+    let!(:stripe_account) { create(:stripe_account, stripe_user_id: "webhook_id") }
+    let(:params) do
+      {
+        "format" => "json",
+        "id" => "evt_123",
+        "object" => "event",
+        "data" => { "object" => { "id" => "ca_9B" } },
+        "type" => "account.application.deauthorized",
+        "account" => "webhook_id"
+      }
+    end
+
+    it "deletes Stripe accounts in response to a webhook" do
+      post 'deauthorize', params
+      expect(response.status).to eq 200
+      expect(response.body).to eq "Account webhook_id deauthorized"
+      expect(StripeAccount.all).not_to include stripe_account
+    end
+
+    context "when the stripe_account id on the event does not match any known accounts" do
+      before do
+        params["account"] = "webhook_id1"
+      end
+
+      it "does nothing" do
+        post 'deauthorize', params
+        expect(response.status).to eq 204
+        expect(StripeAccount.all).to include stripe_account
+      end
+    end
+
+    context "when the event is not a deauthorize event" do
+      before do
+        params["type"] = "account.application.authorized"
+      end
+
+      it "does nothing" do
+        post 'deauthorize', params
+        expect(response.status).to eq 204
+        expect(StripeAccount.all).to include stripe_account
+      end
+    end
+  end
+end

From c54119f4824495c3d886902707ef593e8d1d4f6b Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 11 Oct 2017 17:11:02 +1100
Subject: [PATCH 332/353] Rename stripe controller action from 'deauthorize' to
 'webhook'

---
 app/controllers/stripe_controller.rb       | 2 +-
 config/routes.rb                           | 2 +-
 spec/controllers/stripe_controller_spec.rb | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/app/controllers/stripe_controller.rb b/app/controllers/stripe_controller.rb
index dd5b8e5639..e81e951fb9 100644
--- a/app/controllers/stripe_controller.rb
+++ b/app/controllers/stripe_controller.rb
@@ -1,5 +1,5 @@
 class StripeController < BaseController
-  def deauthorize
+  def webhook
     # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
     event = Stripe::Event.construct_from(params)
     return render nothing: true, status: 204 unless event.type == "account.application.deauthorized"
diff --git a/config/routes.rb b/config/routes.rb
index 64243e39a3..1fcb2b6f7a 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -54,7 +54,7 @@ Openfoodnetwork::Application.routes.draw do
   end
 
   resource :stripe, only: [] do
-    post :deauthorize
+    post :webhook
   end
 
   namespace :admin do
diff --git a/spec/controllers/stripe_controller_spec.rb b/spec/controllers/stripe_controller_spec.rb
index dc9f32f5c7..ac10d08432 100644
--- a/spec/controllers/stripe_controller_spec.rb
+++ b/spec/controllers/stripe_controller_spec.rb
@@ -1,7 +1,7 @@
 require 'spec_helper'
 
 describe StripeController do
-  describe "#deauthorize" do
+  describe "#webhook" do
     let!(:stripe_account) { create(:stripe_account, stripe_user_id: "webhook_id") }
     let(:params) do
       {
@@ -15,7 +15,7 @@ describe StripeController do
     end
 
     it "deletes Stripe accounts in response to a webhook" do
-      post 'deauthorize', params
+      post 'webhook', params
       expect(response.status).to eq 200
       expect(response.body).to eq "Account webhook_id deauthorized"
       expect(StripeAccount.all).not_to include stripe_account
@@ -27,7 +27,7 @@ describe StripeController do
       end
 
       it "does nothing" do
-        post 'deauthorize', params
+        post 'webhook', params
         expect(response.status).to eq 204
         expect(StripeAccount.all).to include stripe_account
       end
@@ -39,7 +39,7 @@ describe StripeController do
       end
 
       it "does nothing" do
-        post 'deauthorize', params
+        post 'webhook', params
         expect(response.status).to eq 204
         expect(StripeAccount.all).to include stripe_account
       end

From f22dd7513d6e2d62b9a30c093ba29abbf1329943 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 11 Oct 2017 17:50:46 +1100
Subject: [PATCH 333/353] Add a service object for handling Stripe webhooks

---
 app/controllers/stripe_controller.rb       | 13 ++--
 lib/stripe/webhook_handler.rb              | 34 +++++++++
 spec/controllers/stripe_controller_spec.rb |  1 -
 spec/lib/stripe/webhook_handler_spec.rb    | 86 ++++++++++++++++++++++
 4 files changed, 125 insertions(+), 9 deletions(-)
 create mode 100644 lib/stripe/webhook_handler.rb
 create mode 100644 spec/lib/stripe/webhook_handler_spec.rb

diff --git a/app/controllers/stripe_controller.rb b/app/controllers/stripe_controller.rb
index e81e951fb9..374f116cef 100644
--- a/app/controllers/stripe_controller.rb
+++ b/app/controllers/stripe_controller.rb
@@ -1,14 +1,11 @@
+require 'stripe/webhook_handler'
+
 class StripeController < BaseController
   def webhook
     # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
-    event = Stripe::Event.construct_from(params)
-    return render nothing: true, status: 204 unless event.type == "account.application.deauthorized"
+    handler = Stripe::WebhookHandler.new(params)
+    status = handler.handle ? 200 : 204
 
-    destroyed = StripeAccount.where(stripe_user_id: event.account).destroy_all
-    if destroyed.any?
-      render text: "Account #{event.account} deauthorized", status: 200
-    else
-      render nothing: true, status: 204
-    end
+    render nothing: true, status: status
   end
 end
diff --git a/lib/stripe/webhook_handler.rb b/lib/stripe/webhook_handler.rb
new file mode 100644
index 0000000000..b40fa7a0a3
--- /dev/null
+++ b/lib/stripe/webhook_handler.rb
@@ -0,0 +1,34 @@
+module Stripe
+  class WebhookHandler
+    def initialize(params)
+      @event = Event.construct_from(params)
+    end
+
+    def handle
+      return false unless known_event?
+      send(event_mappings[@event.type])
+    end
+
+    private
+
+    def event_mappings
+      {
+        "account.application.deauthorized" => :deauthorize
+      }
+    end
+
+    def known_event?
+      event_mappings.keys.include? @event.type
+    end
+
+    def deauthorize
+      return false unless @event.respond_to?(:account)
+      destroyed = destroy_stripe_accounts_linked_to(@event.account)
+      destroyed.any?
+    end
+
+    def destroy_stripe_accounts_linked_to(account)
+      StripeAccount.where(stripe_user_id: account).destroy_all
+    end
+  end
+end
diff --git a/spec/controllers/stripe_controller_spec.rb b/spec/controllers/stripe_controller_spec.rb
index ac10d08432..7896cf1230 100644
--- a/spec/controllers/stripe_controller_spec.rb
+++ b/spec/controllers/stripe_controller_spec.rb
@@ -17,7 +17,6 @@ describe StripeController do
     it "deletes Stripe accounts in response to a webhook" do
       post 'webhook', params
       expect(response.status).to eq 200
-      expect(response.body).to eq "Account webhook_id deauthorized"
       expect(StripeAccount.all).not_to include stripe_account
     end
 
diff --git a/spec/lib/stripe/webhook_handler_spec.rb b/spec/lib/stripe/webhook_handler_spec.rb
new file mode 100644
index 0000000000..2847efdab9
--- /dev/null
+++ b/spec/lib/stripe/webhook_handler_spec.rb
@@ -0,0 +1,86 @@
+require 'spec_helper'
+require 'stripe/webhook_handler'
+
+module Stripe
+  describe WebhookHandler do
+    let(:params) { { type: 'some.event' } }
+    let(:handler) { WebhookHandler.new(params) }
+
+    describe "event_mappings" do
+      it { expect(handler.send(:event_mappings)).to be_a Hash }
+    end
+
+    describe "known_event?" do
+      context "when event mappings know about the event type" do
+        before do
+          allow(handler).to receive(:event_mappings) { { 'some.event' => :something } }
+        end
+
+        it { expect(handler.send(:known_event?)).to be true }
+      end
+
+      context "when event mappings do not know about the event type" do
+        before do
+          allow(handler).to receive(:event_mappings) { { 'some.other.event' => :something } }
+        end
+
+        it { expect(handler.send(:known_event?)).to be false }
+      end
+    end
+
+    describe "handle" do
+      context "when the event is known" do
+        before do
+          allow(handler).to receive(:event_mappings) { { 'some.event' => :some_method } }
+        end
+
+        it "calls the handler method, and returns the result" do
+          expect(handler).to receive(:some_method) { 'result' }
+          expect(handler.handle).to eq 'result'
+        end
+      end
+
+      context "when the event is unknown" do
+        before do
+          allow(handler).to receive(:event_mappings) { { 'some.other.event' => :some_method } }
+        end
+
+        it "does not call the handler method, and returns false" do
+          expect(handler).to_not receive(:some_method)
+          expect(handler.handle).to be false
+        end
+      end
+    end
+
+    describe "deauthorize" do
+      context "when the event has no 'account' attribute" do
+        it "does destroy stripe accounts, returns false" do
+          expect(handler).to_not receive(:destroy_stripe_accounts_linked_to)
+          expect(handler.send(:deauthorize)).to be false
+        end
+      end
+
+      context "when the event has an 'account' attribute" do
+        before do
+          params[:account] = 'some.account'
+        end
+
+        context "when some stripe accounts are destroyed" do
+          before do
+            allow(handler).to receive(:destroy_stripe_accounts_linked_to).with('some.account') { [double(:destroyed_stripe_account)] }
+          end
+
+          it { expect(handler.send(:deauthorize)).to be true }
+        end
+
+        context "when no stripe accounts are destroyed" do
+          before do
+            allow(handler).to receive(:destroy_stripe_accounts_linked_to).with('some.account') { [] }
+          end
+
+          it { expect(handler.send(:deauthorize)).to be false }
+        end
+      end
+    end
+  end
+end

From eb7cb02f33a7d66cf06aed891e06c00b0f7f6acd Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 12 Oct 2017 13:58:53 +1100
Subject: [PATCH 334/353] Namespace stripe webhook controller in Stripe module

---
 app/controllers/stripe/webhooks_controller.rb    | 16 ++++++++++++++++
 app/controllers/stripe_controller.rb             | 11 -----------
 config/application.yml.example                   |  2 +-
 config/routes.rb                                 |  4 ++--
 .../webhooks_controller_spec.rb}                 | 10 +++++-----
 5 files changed, 24 insertions(+), 19 deletions(-)
 create mode 100644 app/controllers/stripe/webhooks_controller.rb
 delete mode 100644 app/controllers/stripe_controller.rb
 rename spec/controllers/{stripe_controller_spec.rb => stripe/webhooks_controller_spec.rb} (88%)

diff --git a/app/controllers/stripe/webhooks_controller.rb b/app/controllers/stripe/webhooks_controller.rb
new file mode 100644
index 0000000000..8f778eee43
--- /dev/null
+++ b/app/controllers/stripe/webhooks_controller.rb
@@ -0,0 +1,16 @@
+require 'stripe/webhook_handler'
+
+module Stripe
+  class WebhooksController < BaseController
+    protect_from_forgery except: :create
+
+    # POST /stripe/webhook
+    def create
+      # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
+      handler = WebhookHandler.new(params)
+      status = handler.handle ? 200 : 204
+
+      render nothing: true, status: status
+    end
+  end
+end
diff --git a/app/controllers/stripe_controller.rb b/app/controllers/stripe_controller.rb
deleted file mode 100644
index 374f116cef..0000000000
--- a/app/controllers/stripe_controller.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-require 'stripe/webhook_handler'
-
-class StripeController < BaseController
-  def webhook
-    # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
-    handler = Stripe::WebhookHandler.new(params)
-    status = handler.handle ? 200 : 204
-
-    render nothing: true, status: status
-  end
-end
diff --git a/config/application.yml.example b/config/application.yml.example
index c3882edf4a..e10402fd79 100644
--- a/config/application.yml.example
+++ b/config/application.yml.example
@@ -30,7 +30,7 @@ CURRENCY: AUD
 # Stripe Connect details for instance account
 # Find these under 'API keys' and 'Connect' in your Stripe account dashboard -> Account Settings
 # Under 'Connect', the Redirect URI should be set to https://YOUR_SERVER_URL/stripe/callback (e.g. https://openfoodnetwork.org.uk/stripe/connect)
-# Under 'Webhooks', you should set up a Connect endpoint pointing to https://YOUR_SERVER_URL/stripe/webhook e.g. (https://openfoodnetwork.org.uk/stripe/webhook)
+# Under 'Webhooks', you should set up a Connect endpoint pointing to https://YOUR_SERVER_URL/stripe/webhooks e.g. (https://openfoodnetwork.org.uk/stripe/webhooks)
 # STRIPE_INSTANCE_SECRET_KEY: "sk_test_xxxxxx" # This can be a test key or a live key
 # STRIPE_INSTANCE_PUBLISHABLE_KEY: "pk_test_xxxx" # This can be a test key or a live key
 # STRIPE_CLIENT_ID: "ca_xxxx" # This can be a development ID or a production ID
diff --git a/config/routes.rb b/config/routes.rb
index 1fcb2b6f7a..1f0a611fb9 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -53,8 +53,8 @@ Openfoodnetwork::Application.routes.draw do
     end
   end
 
-  resource :stripe, only: [] do
-    post :webhook
+  namespace :stripe do
+    resources :webhooks, only: [:create]
   end
 
   namespace :admin do
diff --git a/spec/controllers/stripe_controller_spec.rb b/spec/controllers/stripe/webhooks_controller_spec.rb
similarity index 88%
rename from spec/controllers/stripe_controller_spec.rb
rename to spec/controllers/stripe/webhooks_controller_spec.rb
index 7896cf1230..3d62585372 100644
--- a/spec/controllers/stripe_controller_spec.rb
+++ b/spec/controllers/stripe/webhooks_controller_spec.rb
@@ -1,7 +1,7 @@
 require 'spec_helper'
 
-describe StripeController do
-  describe "#webhook" do
+describe Stripe::WebhooksController do
+  describe "#create" do
     let!(:stripe_account) { create(:stripe_account, stripe_user_id: "webhook_id") }
     let(:params) do
       {
@@ -15,7 +15,7 @@ describe StripeController do
     end
 
     it "deletes Stripe accounts in response to a webhook" do
-      post 'webhook', params
+      post 'create', params
       expect(response.status).to eq 200
       expect(StripeAccount.all).not_to include stripe_account
     end
@@ -26,7 +26,7 @@ describe StripeController do
       end
 
       it "does nothing" do
-        post 'webhook', params
+        post 'create', params
         expect(response.status).to eq 204
         expect(StripeAccount.all).to include stripe_account
       end
@@ -38,7 +38,7 @@ describe StripeController do
       end
 
       it "does nothing" do
-        post 'webhook', params
+        post 'create', params
         expect(response.status).to eq 204
         expect(StripeAccount.all).to include stripe_account
       end

From 434528516427a1a144f8e819f189d690ecec0050 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 12 Oct 2017 14:48:19 +1100
Subject: [PATCH 335/353] Allow more granularity in Stripe WebhookHandler
 responses

---
 app/controllers/stripe/webhooks_controller.rb | 16 ++++++-
 lib/stripe/webhook_handler.rb                 |  6 +--
 .../stripe/webhooks_controller_spec.rb        | 47 ++++++++++---------
 spec/lib/stripe/webhook_handler_spec.rb       | 16 +++----
 4 files changed, 49 insertions(+), 36 deletions(-)

diff --git a/app/controllers/stripe/webhooks_controller.rb b/app/controllers/stripe/webhooks_controller.rb
index 8f778eee43..7ad7c1e507 100644
--- a/app/controllers/stripe/webhooks_controller.rb
+++ b/app/controllers/stripe/webhooks_controller.rb
@@ -8,9 +8,21 @@ module Stripe
     def create
       # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
       handler = WebhookHandler.new(params)
-      status = handler.handle ? 200 : 204
+      result = handler.handle
 
-      render nothing: true, status: status
+      render nothing: true, status: status_mappings[result]
+    end
+
+    private
+
+    # Stripe interprets a 4xx or 3xx response as a failure to receive the webhook,
+    # and will stop sending events if too many of these are returned.
+    def status_mappings
+      {
+        success: 200,
+        failure: 202,
+        silent_fail: 204
+      }
     end
   end
 end
diff --git a/lib/stripe/webhook_handler.rb b/lib/stripe/webhook_handler.rb
index b40fa7a0a3..7a5332bacd 100644
--- a/lib/stripe/webhook_handler.rb
+++ b/lib/stripe/webhook_handler.rb
@@ -5,7 +5,7 @@ module Stripe
     end
 
     def handle
-      return false unless known_event?
+      return :failure unless known_event?
       send(event_mappings[@event.type])
     end
 
@@ -22,9 +22,9 @@ module Stripe
     end
 
     def deauthorize
-      return false unless @event.respond_to?(:account)
+      return :silent_fail unless @event.respond_to?(:account)
       destroyed = destroy_stripe_accounts_linked_to(@event.account)
-      destroyed.any?
+      destroyed.any? ? :success : :silent_fail
     end
 
     def destroy_stripe_accounts_linked_to(account)
diff --git a/spec/controllers/stripe/webhooks_controller_spec.rb b/spec/controllers/stripe/webhooks_controller_spec.rb
index 3d62585372..b415b6b865 100644
--- a/spec/controllers/stripe/webhooks_controller_spec.rb
+++ b/spec/controllers/stripe/webhooks_controller_spec.rb
@@ -2,45 +2,46 @@ require 'spec_helper'
 
 describe Stripe::WebhooksController do
   describe "#create" do
-    let!(:stripe_account) { create(:stripe_account, stripe_user_id: "webhook_id") }
     let(:params) do
       {
         "format" => "json",
         "id" => "evt_123",
         "object" => "event",
         "data" => { "object" => { "id" => "ca_9B" } },
-        "type" => "account.application.deauthorized",
-        "account" => "webhook_id"
+        "type" => "account.application.authorized",
+        "account" => "webhook_id1"
       }
     end
 
-    it "deletes Stripe accounts in response to a webhook" do
-      post 'create', params
-      expect(response.status).to eq 200
-      expect(StripeAccount.all).not_to include stripe_account
-    end
-
-    context "when the stripe_account id on the event does not match any known accounts" do
-      before do
-        params["account"] = "webhook_id1"
-      end
-
-      it "does nothing" do
+    context "when an event with an unknown type is received" do
+      it "responds with a 202" do
         post 'create', params
-        expect(response.status).to eq 204
-        expect(StripeAccount.all).to include stripe_account
+        expect(response.status).to eq 202
       end
     end
 
-    context "when the event is not a deauthorize event" do
+    describe "when an account.application.deauthorized event is received" do
+      let!(:stripe_account) { create(:stripe_account, stripe_user_id: "webhook_id") }
       before do
-        params["type"] = "account.application.authorized"
+        params["type"] = "account.application.deauthorized"
       end
 
-      it "does nothing" do
-        post 'create', params
-        expect(response.status).to eq 204
-        expect(StripeAccount.all).to include stripe_account
+      context "when the stripe_account id on the event does not match any known accounts" do
+        it "doesn't delete any Stripe accounts, responds with 204" do
+          post 'create', params
+          expect(response.status).to eq 204
+          expect(StripeAccount.all).to include stripe_account
+        end
+      end
+
+      context "when the stripe_account id on the event matches a known account" do
+        before { params["account"] = "webhook_id" }
+
+        it "deletes Stripe accounts in response to a webhook" do
+          post 'create', params
+          expect(response.status).to eq 200
+          expect(StripeAccount.all).not_to include stripe_account
+        end
       end
     end
   end
diff --git a/spec/lib/stripe/webhook_handler_spec.rb b/spec/lib/stripe/webhook_handler_spec.rb
index 2847efdab9..fea36f21da 100644
--- a/spec/lib/stripe/webhook_handler_spec.rb
+++ b/spec/lib/stripe/webhook_handler_spec.rb
@@ -35,8 +35,8 @@ module Stripe
         end
 
         it "calls the handler method, and returns the result" do
-          expect(handler).to receive(:some_method) { 'result' }
-          expect(handler.handle).to eq 'result'
+          expect(handler).to receive(:some_method) { :result }
+          expect(handler.handle).to eq :result
         end
       end
 
@@ -45,18 +45,18 @@ module Stripe
           allow(handler).to receive(:event_mappings) { { 'some.other.event' => :some_method } }
         end
 
-        it "does not call the handler method, and returns false" do
+        it "does not call the handler method, and returns :failure" do
           expect(handler).to_not receive(:some_method)
-          expect(handler.handle).to be false
+          expect(handler.handle).to be :failure
         end
       end
     end
 
     describe "deauthorize" do
       context "when the event has no 'account' attribute" do
-        it "does destroy stripe accounts, returns false" do
+        it "does destroy stripe accounts, returns :silent_fail" do
           expect(handler).to_not receive(:destroy_stripe_accounts_linked_to)
-          expect(handler.send(:deauthorize)).to be false
+          expect(handler.send(:deauthorize)).to be :silent_fail
         end
       end
 
@@ -70,7 +70,7 @@ module Stripe
             allow(handler).to receive(:destroy_stripe_accounts_linked_to).with('some.account') { [double(:destroyed_stripe_account)] }
           end
 
-          it { expect(handler.send(:deauthorize)).to be true }
+          it { expect(handler.send(:deauthorize)).to be :success }
         end
 
         context "when no stripe accounts are destroyed" do
@@ -78,7 +78,7 @@ module Stripe
             allow(handler).to receive(:destroy_stripe_accounts_linked_to).with('some.account') { [] }
           end
 
-          it { expect(handler.send(:deauthorize)).to be false }
+          it { expect(handler.send(:deauthorize)).to be :silent_fail }
         end
       end
     end

From ed375a1e2c880c9673a278de6ee1e5c0e71b6d7e Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 12 Oct 2017 16:31:17 +1100
Subject: [PATCH 336/353] Build Event object in controller instead of service
 object

---
 app/controllers/stripe/webhooks_controller.rb | 3 ++-
 lib/stripe/webhook_handler.rb                 | 4 ++--
 spec/lib/stripe/webhook_handler_spec.rb       | 6 +++---
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/app/controllers/stripe/webhooks_controller.rb b/app/controllers/stripe/webhooks_controller.rb
index 7ad7c1e507..c80dc500ae 100644
--- a/app/controllers/stripe/webhooks_controller.rb
+++ b/app/controllers/stripe/webhooks_controller.rb
@@ -7,7 +7,8 @@ module Stripe
     # POST /stripe/webhook
     def create
       # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
-      handler = WebhookHandler.new(params)
+      event = Event.construct_from(params)
+      handler = WebhookHandler.new(event)
       result = handler.handle
 
       render nothing: true, status: status_mappings[result]
diff --git a/lib/stripe/webhook_handler.rb b/lib/stripe/webhook_handler.rb
index 7a5332bacd..da5482d723 100644
--- a/lib/stripe/webhook_handler.rb
+++ b/lib/stripe/webhook_handler.rb
@@ -1,7 +1,7 @@
 module Stripe
   class WebhookHandler
-    def initialize(params)
-      @event = Event.construct_from(params)
+    def initialize(event)
+      @event = event
     end
 
     def handle
diff --git a/spec/lib/stripe/webhook_handler_spec.rb b/spec/lib/stripe/webhook_handler_spec.rb
index fea36f21da..1795430b9f 100644
--- a/spec/lib/stripe/webhook_handler_spec.rb
+++ b/spec/lib/stripe/webhook_handler_spec.rb
@@ -3,8 +3,8 @@ require 'stripe/webhook_handler'
 
 module Stripe
   describe WebhookHandler do
-    let(:params) { { type: 'some.event' } }
-    let(:handler) { WebhookHandler.new(params) }
+    let(:event) { double(:event, type: 'some.event') }
+    let(:handler) { WebhookHandler.new(event) }
 
     describe "event_mappings" do
       it { expect(handler.send(:event_mappings)).to be_a Hash }
@@ -62,7 +62,7 @@ module Stripe
 
       context "when the event has an 'account' attribute" do
         before do
-          params[:account] = 'some.account'
+          allow(event).to receive(:account) { 'some.account' }
         end
 
         context "when some stripe accounts are destroyed" do

From 068dbe5013913f0cb7ac661f29ed84445c794e12 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 12 Oct 2017 17:14:09 +1100
Subject: [PATCH 337/353] Add verification to Stripe webhook endpoint

---
 app/controllers/stripe/webhooks_controller.rb | 25 +++++---
 config/application.yml.example                |  3 +-
 config/initializers/stripe.rb                 |  7 ++-
 .../stripe/webhooks_controller_spec.rb        | 60 ++++++++++++++-----
 4 files changed, 67 insertions(+), 28 deletions(-)

diff --git a/app/controllers/stripe/webhooks_controller.rb b/app/controllers/stripe/webhooks_controller.rb
index c80dc500ae..8ada0361b6 100644
--- a/app/controllers/stripe/webhooks_controller.rb
+++ b/app/controllers/stripe/webhooks_controller.rb
@@ -3,26 +3,35 @@ require 'stripe/webhook_handler'
 module Stripe
   class WebhooksController < BaseController
     protect_from_forgery except: :create
+    before_filter :verify_webhook
 
     # POST /stripe/webhook
     def create
-      # TODO is there a sensible way to confirm this webhook call is actually from Stripe?
-      event = Event.construct_from(params)
-      handler = WebhookHandler.new(event)
+      handler = WebhookHandler.new(@event)
       result = handler.handle
 
-      render nothing: true, status: status_mappings[result]
+      render nothing: true, status: status_mappings[result] || 200
     end
 
     private
 
+    def verify_webhook
+      payload = request.raw_post
+      signature = request.headers["HTTP_STRIPE_SIGNATURE"]
+      @event = Webhook.construct_event(payload, signature, Stripe.endpoint_secret)
+    rescue JSON::ParserError
+      render nothing: true, status: 400
+    rescue Stripe::SignatureVerificationError
+      render nothing: true, status: 401
+    end
+
     # Stripe interprets a 4xx or 3xx response as a failure to receive the webhook,
-    # and will stop sending events if too many of these are returned.
+    # and will stop sending events if too many of either of these are returned.
     def status_mappings
       {
-        success: 200,
-        failure: 202,
-        silent_fail: 204
+        success: 200, # The event was handled successfully
+        unknown: 202, # The event was of an unknown type
+        ignored: 204  # No action was taken in response to the event
       }
     end
   end
diff --git a/config/application.yml.example b/config/application.yml.example
index e10402fd79..1d8bf45f2d 100644
--- a/config/application.yml.example
+++ b/config/application.yml.example
@@ -29,8 +29,9 @@ CURRENCY: AUD
 
 # Stripe Connect details for instance account
 # Find these under 'API keys' and 'Connect' in your Stripe account dashboard -> Account Settings
-# Under 'Connect', the Redirect URI should be set to https://YOUR_SERVER_URL/stripe/callback (e.g. https://openfoodnetwork.org.uk/stripe/connect)
+# Under 'Connect', the Redirect URI should be set to https://YOUR_SERVER_URL/admin/stripe_accounts/connect_callback (e.g. https://openfoodnetwork.org.uk/admin/stripe_accounts/connect_callback)
 # Under 'Webhooks', you should set up a Connect endpoint pointing to https://YOUR_SERVER_URL/stripe/webhooks e.g. (https://openfoodnetwork.org.uk/stripe/webhooks)
 # STRIPE_INSTANCE_SECRET_KEY: "sk_test_xxxxxx" # This can be a test key or a live key
 # STRIPE_INSTANCE_PUBLISHABLE_KEY: "pk_test_xxxx" # This can be a test key or a live key
 # STRIPE_CLIENT_ID: "ca_xxxx" # This can be a development ID or a production ID
+# STRIPE_ENDPOINT_SECRET: "whsec_xxxx"
diff --git a/config/initializers/stripe.rb b/config/initializers/stripe.rb
index c7ec6599d8..8237b0dcab 100644
--- a/config/initializers/stripe.rb
+++ b/config/initializers/stripe.rb
@@ -1,13 +1,14 @@
-# Add the :publishable_key property, to allow us to access this
-# property from the object, rather than calling from ENV directly.
+# Add some additional properties, to allow us to access these
+# properties from the object, rather than calling from ENV directly.
 # This is mostly useful for stubbing when testing, but also feels
 # a bit cleaner than accessing keys in different ways.
 module Stripe
   class << self
-    attr_accessor :publishable_key
+    attr_accessor :publishable_key, :endpoint_secret
   end
 end
 
 Stripe.api_key = ENV['STRIPE_INSTANCE_SECRET_KEY']
 Stripe.publishable_key = ENV['STRIPE_INSTANCE_PUBLISHABLE_KEY']
 Stripe.client_id = ENV['STRIPE_CLIENT_ID']
+Stripe.endpoint_secret = ENV['STRIPE_ENDPOINT_SECRET']
diff --git a/spec/controllers/stripe/webhooks_controller_spec.rb b/spec/controllers/stripe/webhooks_controller_spec.rb
index b415b6b865..40ec3c625b 100644
--- a/spec/controllers/stripe/webhooks_controller_spec.rb
+++ b/spec/controllers/stripe/webhooks_controller_spec.rb
@@ -13,34 +13,62 @@ describe Stripe::WebhooksController do
       }
     end
 
-    context "when an event with an unknown type is received" do
-      it "responds with a 202" do
+    context "when invalid json is provided" do
+      before do
+        allow(Stripe::Webhook).to receive(:construct_event).and_raise JSON::ParserError, "parsing failed"
+      end
+
+      it "responds with a 400" do
         post 'create', params
-        expect(response.status).to eq 202
+        expect(response.status).to eq 400
       end
     end
 
-    describe "when an account.application.deauthorized event is received" do
-      let!(:stripe_account) { create(:stripe_account, stripe_user_id: "webhook_id") }
+    context "when event signature verification fails" do
       before do
-        params["type"] = "account.application.deauthorized"
+        allow(Stripe::Webhook).to receive(:construct_event).and_raise Stripe::SignatureVerificationError.new("verfication failed", "header")
       end
 
-      context "when the stripe_account id on the event does not match any known accounts" do
-        it "doesn't delete any Stripe accounts, responds with 204" do
+      it "responds with a 401" do
+        post 'create', params
+        expect(response.status).to eq 401
+      end
+    end
+
+    context "when event signature verification succeeds" do
+      before do
+        allow(Stripe::Webhook).to receive(:construct_event) { Stripe::Event.construct_from(params) }
+      end
+
+      context "when an event with an unknown type is received" do
+        it "responds with a 202" do
           post 'create', params
-          expect(response.status).to eq 204
-          expect(StripeAccount.all).to include stripe_account
+          expect(response.status).to eq 202
         end
       end
 
-      context "when the stripe_account id on the event matches a known account" do
-        before { params["account"] = "webhook_id" }
+      describe "when an account.application.deauthorized event is received" do
+        let!(:stripe_account) { create(:stripe_account, stripe_user_id: "webhook_id") }
+        before do
+          params["type"] = "account.application.deauthorized"
+        end
 
-        it "deletes Stripe accounts in response to a webhook" do
-          post 'create', params
-          expect(response.status).to eq 200
-          expect(StripeAccount.all).not_to include stripe_account
+        context "when the stripe_account id on the event does not match any known accounts" do
+          it "doesn't delete any Stripe accounts, responds with 204" do
+            post 'create', params
+            expect(response.status).to eq 204
+            expect(StripeAccount.all).to include stripe_account
+          end
+        end
+
+        context "when the stripe_account id on the event matches a known account" do
+          before { params["account"] = "webhook_id" }
+
+          it "deletes Stripe accounts in response to a webhook" do
+            post 'create', params
+            expect(response.status).to eq 200
+            expect(StripeAccount.all).not_to include stripe_account
+          end
         end
       end
     end

From 99cac20725e09287be050dd668a7943c53109cd9 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 12 Oct 2017 17:27:24 +1100
Subject: [PATCH 338/353] Fall back to 200 when handler returns an unknown
 result

---
 .../stripe/webhooks_controller_spec.rb        | 24 +++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/spec/controllers/stripe/webhooks_controller_spec.rb b/spec/controllers/stripe/webhooks_controller_spec.rb
index 40ec3c625b..d413bbb08b 100644
--- a/spec/controllers/stripe/webhooks_controller_spec.rb
+++ b/spec/controllers/stripe/webhooks_controller_spec.rb
@@ -40,10 +40,26 @@ describe Stripe::WebhooksController do
         allow(Stripe::Webhook).to receive(:construct_event) { Stripe::Event.construct_from(params) }
       end
 
-      context "when an event with an unknown type is received" do
-        it "responds with a 202" do
-          post 'create', params
-          expect(response.status).to eq 202
+      describe "setting the response status" do
+        let(:handler) { double(:handler) }
+        before { allow(Stripe::WebhookHandler).to receive(:new) { handler } }
+
+        context "when an unknown result is returned by the handler" do
+          before { allow(handler).to receive(:handle) { :garbage } }
+
+          it "falls back to 200" do
+            post 'create', params
+            expect(response.status).to eq 200
+          end
+        end
+
+        context "when the result returned by the handler is :failure" do
+          before { allow(handler).to receive(:handle) { :failure } }
+
+          it "responds with 202" do
+            post 'create', params
+            expect(response.status).to eq 202
+          end
         end
       end
 

From 01f9fd323222b7b4f2e2925ecbd304491f9e81a9 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 12 Oct 2017 17:38:20 +1100
Subject: [PATCH 339/353] Rename webhook handler status mappings

---
 lib/stripe/webhook_handler.rb                       |  6 +++---
 spec/controllers/stripe/webhooks_controller_spec.rb |  4 ++--
 spec/lib/stripe/webhook_handler_spec.rb             | 10 +++++-----
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/stripe/webhook_handler.rb b/lib/stripe/webhook_handler.rb
index da5482d723..875dd9e52b 100644
--- a/lib/stripe/webhook_handler.rb
+++ b/lib/stripe/webhook_handler.rb
@@ -5,7 +5,7 @@ module Stripe
     end
 
     def handle
-      return :failure unless known_event?
+      return :unknown unless known_event?
       send(event_mappings[@event.type])
     end
 
@@ -22,9 +22,9 @@ module Stripe
     end
 
     def deauthorize
-      return :silent_fail unless @event.respond_to?(:account)
+      return :ignored unless @event.respond_to?(:account)
       destroyed = destroy_stripe_accounts_linked_to(@event.account)
-      destroyed.any? ? :success : :silent_fail
+      destroyed.any? ? :success : :ignored
     end
 
     def destroy_stripe_accounts_linked_to(account)
diff --git a/spec/controllers/stripe/webhooks_controller_spec.rb b/spec/controllers/stripe/webhooks_controller_spec.rb
index d413bbb08b..8c0bda6c87 100644
--- a/spec/controllers/stripe/webhooks_controller_spec.rb
+++ b/spec/controllers/stripe/webhooks_controller_spec.rb
@@ -53,8 +53,8 @@ describe Stripe::WebhooksController do
           end
         end
 
-        context "when the result returned by the handler is :failure" do
-          before { allow(handler).to receive(:handle) { :failure } }
+        context "when the result returned by the handler is :unknown" do
+          before { allow(handler).to receive(:handle) { :unknown } }
 
           it "responds with 202" do
             post 'create', params
diff --git a/spec/lib/stripe/webhook_handler_spec.rb b/spec/lib/stripe/webhook_handler_spec.rb
index 1795430b9f..e83cf01805 100644
--- a/spec/lib/stripe/webhook_handler_spec.rb
+++ b/spec/lib/stripe/webhook_handler_spec.rb
@@ -45,18 +45,18 @@ module Stripe
           allow(handler).to receive(:event_mappings) { { 'some.other.event' => :some_method } }
         end
 
-        it "does not call the handler method, and returns :failure" do
+        it "does not call the handler method, and returns :unknown" do
           expect(handler).to_not receive(:some_method)
-          expect(handler.handle).to be :failure
+          expect(handler.handle).to be :unknown
         end
       end
     end
 
     describe "deauthorize" do
       context "when the event has no 'account' attribute" do
-        it "does destroy stripe accounts, returns :silent_fail" do
+        it "does destroy stripe accounts, returns :ignored" do
           expect(handler).to_not receive(:destroy_stripe_accounts_linked_to)
-          expect(handler.send(:deauthorize)).to be :silent_fail
+          expect(handler.send(:deauthorize)).to be :ignored
         end
       end
 
@@ -78,7 +78,7 @@ module Stripe
             allow(handler).to receive(:destroy_stripe_accounts_linked_to).with('some.account') { [] }
           end
 
-          it { expect(handler.send(:deauthorize)).to be :silent_fail }
+          it { expect(handler.send(:deauthorize)).to be :ignored }
         end
       end
     end

From 0b8b5e694e7669dc86cd06df1a77789e86462317 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 12 Oct 2017 20:49:28 +1100
Subject: [PATCH 340/353] Move Stripe Connect callback action to dedicated
 controller

---
 .../admin/stripe_accounts_controller.rb       | 15 ----
 .../stripe/callbacks_controller.rb            | 20 +++++
 config/application.yml.example                |  2 +-
 config/routes.rb                              |  2 +-
 .../admin/stripe_accounts_controller_spec.rb  | 69 -----------------
 .../stripe/callbacks_controller_spec.rb       | 74 +++++++++++++++++++
 6 files changed, 96 insertions(+), 86 deletions(-)
 create mode 100644 app/controllers/stripe/callbacks_controller.rb
 create mode 100644 spec/controllers/stripe/callbacks_controller_spec.rb

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index e23ab7ffb4..026db1840e 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -11,21 +11,6 @@ module Admin
       redirect_to Stripe::OAuth.authorize_url(url_params)
     end
 
-    def connect_callback
-      connector = Stripe::AccountConnector.new(spree_current_user, params)
-
-      if connector.create_account
-        flash[:success] = t('admin.controllers.enterprises.stripe_connect_success')
-      elsif connector.connection_cancelled_by_user?
-        flash[:notice] = t('admin.controllers.enterprises.stripe_connect_cancelled')
-      else
-        flash[:error] = t('admin.controllers.enterprises.stripe_connect_fail')
-      end
-      redirect_to main_app.edit_admin_enterprise_path(connector.enterprise, anchor: 'payment_methods')
-    rescue Stripe::StripeError => e
-      render text: e.message, status: 500
-    end
-
     def destroy
       stripe_account = StripeAccount.find(params[:id])
       authorize! :destroy, stripe_account
diff --git a/app/controllers/stripe/callbacks_controller.rb b/app/controllers/stripe/callbacks_controller.rb
new file mode 100644
index 0000000000..4db446144f
--- /dev/null
+++ b/app/controllers/stripe/callbacks_controller.rb
@@ -0,0 +1,20 @@
+require 'stripe/account_connector'
+
+module Stripe
+  class CallbacksController < BaseController
+    def index
+      connector = Stripe::AccountConnector.new(spree_current_user, params)
+
+      if connector.create_account
+        flash[:success] = t('admin.controllers.enterprises.stripe_connect_success')
+      elsif connector.connection_cancelled_by_user?
+        flash[:notice] = t('admin.controllers.enterprises.stripe_connect_cancelled')
+      else
+        flash[:error] = t('admin.controllers.enterprises.stripe_connect_fail')
+      end
+      redirect_to main_app.edit_admin_enterprise_path(connector.enterprise, anchor: 'payment_methods')
+    rescue Stripe::StripeError => e
+      render text: e.message, status: 500
+    end
+  end
+end
diff --git a/config/application.yml.example b/config/application.yml.example
index 1d8bf45f2d..310e248726 100644
--- a/config/application.yml.example
+++ b/config/application.yml.example
@@ -29,7 +29,7 @@ CURRENCY: AUD
 
 # Stripe Connect details for instance account
 # Find these under 'API keys' and 'Connect' in your Stripe account dashboard -> Account Settings
-# Under 'Connect', the Redirect URI should be set to https://YOUR_SERVER_URL/admin/stripe_accounts/connect_callback (e.g. https://openfoodnetwork.org.uk/admin/stripe_accounts/connect_callback)
+# Under 'Connect', the Redirect URI should be set to https://YOUR_SERVER_URL/stripe/callbacks (e.g. https://openfoodnetwork.org.uk/stripe/callbacks)
 # Under 'Webhooks', you should set up a Connect endpoint pointing to https://YOUR_SERVER_URL/stripe/webhooks e.g. (https://openfoodnetwork.org.uk/stripe/webhooks)
 # STRIPE_INSTANCE_SECRET_KEY: "sk_test_xxxxxx" # This can be a test key or a live key
 # STRIPE_INSTANCE_PUBLISHABLE_KEY: "pk_test_xxxx" # This can be a test key or a live key
diff --git a/config/routes.rb b/config/routes.rb
index 1f0a611fb9..0484754d39 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -54,6 +54,7 @@ Openfoodnetwork::Application.routes.draw do
   end
 
   namespace :stripe do
+    resources :callbacks, only: [:index]
     resources :webhooks, only: [:create]
   end
 
@@ -173,7 +174,6 @@ Openfoodnetwork::Application.routes.draw do
 
     resources :stripe_accounts, only: [:destroy] do
       get :connect, on: :collection
-      get :connect_callback, on: :collection
       get :status, on: :collection
     end
   end
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 96a17e02d8..4db449d2df 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -21,75 +21,6 @@ describe Admin::StripeAccountsController, type: :controller do
     end
   end
 
-  context "#connect_callback" do
-    let(:params) { { id: enterprise.permalink } }
-    let(:connector) { double(:connector) }
-
-    before do
-      allow(controller).to receive(:spree_current_user) { enterprise.owner }
-      allow(Stripe::AccountConnector).to receive(:new) { connector }
-    end
-
-    context "when the connector.create_account raises a StripeError" do
-      before do
-        allow(connector).to receive(:create_account).and_raise Stripe::StripeError, "some error"
-      end
-
-      it "returns a 500 error" do
-        spree_get :connect_callback, params
-        expect(response.status).to be 500
-      end
-    end
-
-    context "when the connector.create_account raises an AccessDenied error" do
-      before do
-        allow(connector).to receive(:create_account).and_raise CanCan::AccessDenied, "some error"
-      end
-
-      it "redirects to unauthorized" do
-        spree_get :connect_callback, params
-        expect(response).to redirect_to spree.unauthorized_path
-      end
-    end
-
-    context "when the connector fails in creating a new stripe account record" do
-      before { allow(connector).to receive(:create_account) { false } }
-
-      context "when the user cancelled the connection" do
-        before { allow(connector).to receive(:connection_cancelled_by_user?) { true } }
-
-        it "renders a failure message" do
-          allow(connector).to receive(:enterprise) { enterprise }
-          spree_get :connect_callback, params
-          expect(flash[:notice]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_cancelled')
-          expect(response).to redirect_to edit_admin_enterprise_path(enterprise, anchor: 'payment_methods')
-        end
-      end
-
-      context "when some other error caused the failure" do
-        before { allow(connector).to receive(:connection_cancelled_by_user?) { false } }
-
-        it "renders a failure message" do
-          allow(connector).to receive(:enterprise) { enterprise }
-          spree_get :connect_callback, params
-          expect(flash[:error]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_fail')
-          expect(response).to redirect_to edit_admin_enterprise_path(enterprise, anchor: 'payment_methods')
-        end
-      end
-    end
-
-    context "when the connector succeeds in creating a new stripe account record" do
-      before { allow(connector).to receive(:create_account) { true } }
-
-      it "redirects to the enterprise edit path" do
-        allow(connector).to receive(:enterprise) { enterprise }
-        spree_get :connect_callback, params
-        expect(flash[:success]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_success')
-        expect(response).to redirect_to edit_admin_enterprise_path(enterprise, anchor: 'payment_methods')
-      end
-    end
-  end
-
   describe "#destroy" do
     let(:params) { { format: :json, id: "some_id" } }
 
diff --git a/spec/controllers/stripe/callbacks_controller_spec.rb b/spec/controllers/stripe/callbacks_controller_spec.rb
new file mode 100644
index 0000000000..831dc5e348
--- /dev/null
+++ b/spec/controllers/stripe/callbacks_controller_spec.rb
@@ -0,0 +1,74 @@
+require 'spec_helper'
+
+describe Stripe::CallbacksController do
+  let(:enterprise) { create(:distributor_enterprise) }
+
+  context "#index" do
+    let(:params) { { id: enterprise.permalink } }
+    let(:connector) { double(:connector) }
+
+    before do
+      allow(controller).to receive(:spree_current_user) { enterprise.owner }
+      allow(Stripe::AccountConnector).to receive(:new) { connector }
+    end
+
+    context "when the connector.create_account raises a StripeError" do
+      before do
+        allow(connector).to receive(:create_account).and_raise Stripe::StripeError, "some error"
+      end
+
+      it "returns a 500 error" do
+        spree_get :index, params
+        expect(response.status).to be 500
+      end
+    end
+
+    context "when the connector.create_account raises an AccessDenied error" do
+      before do
+        allow(connector).to receive(:create_account).and_raise CanCan::AccessDenied, "some error"
+      end
+
+      it "redirects to unauthorized" do
+        spree_get :index, params
+        expect(response).to redirect_to spree.unauthorized_path
+      end
+    end
+
+    context "when the connector fails in creating a new stripe account record" do
+      before { allow(connector).to receive(:create_account) { false } }
+
+      context "when the user cancelled the connection" do
+        before { allow(connector).to receive(:connection_cancelled_by_user?) { true } }
+
+        it "renders a failure message" do
+          allow(connector).to receive(:enterprise) { enterprise }
+          spree_get :index, params
+          expect(flash[:notice]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_cancelled')
+          expect(response).to redirect_to edit_admin_enterprise_path(enterprise, anchor: 'payment_methods')
+        end
+      end
+
+      context "when some other error caused the failure" do
+        before { allow(connector).to receive(:connection_cancelled_by_user?) { false } }
+
+        it "renders a failure message" do
+          allow(connector).to receive(:enterprise) { enterprise }
+          spree_get :index, params
+          expect(flash[:error]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_fail')
+          expect(response).to redirect_to edit_admin_enterprise_path(enterprise, anchor: 'payment_methods')
+        end
+      end
+    end
+
+    context "when the connector succeeds in creating a new stripe account record" do
+      before { allow(connector).to receive(:create_account) { true } }
+
+      it "redirects to the enterprise edit path" do
+        allow(connector).to receive(:enterprise) { enterprise }
+        spree_get :index, params
+        expect(flash[:success]).to eq I18n.t('admin.controllers.enterprises.stripe_connect_success')
+        expect(response).to redirect_to edit_admin_enterprise_path(enterprise, anchor: 'payment_methods')
+      end
+    end
+  end
+end

From f2ad087be5374f1192243c87e8b45d833ac211cd Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Thu, 12 Oct 2017 21:35:31 +1100
Subject: [PATCH 341/353] Change inheritance of StripeAccountsController

---
 .../admin/stripe_accounts_controller.rb       | 10 ++--
 app/models/spree/ability_decorator.rb         |  2 +-
 .../admin/stripe_accounts_controller_spec.rb  | 53 +++++++++----------
 3 files changed, 33 insertions(+), 32 deletions(-)

diff --git a/app/controllers/admin/stripe_accounts_controller.rb b/app/controllers/admin/stripe_accounts_controller.rb
index 026db1840e..e0a72c093c 100644
--- a/app/controllers/admin/stripe_accounts_controller.rb
+++ b/app/controllers/admin/stripe_accounts_controller.rb
@@ -1,9 +1,7 @@
 require 'stripe/account_connector'
 
 module Admin
-  class StripeAccountsController < BaseController
-    protect_from_forgery except: :destroy_from_webhook
-
+  class StripeAccountsController < Spree::Admin::BaseController
     def connect
       payload = params.slice(:enterprise_id)
       key = Openfoodnetwork::Application.config.secret_token
@@ -41,5 +39,11 @@ module Admin
         render json: { status: :access_revoked }
       end
     end
+
+    private
+
+    def model_class
+      StripeAccount
+    end
   end
 end
diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb
index 164e27d81a..662cc5d1d6 100644
--- a/app/models/spree/ability_decorator.rb
+++ b/app/models/spree/ability_decorator.rb
@@ -124,7 +124,7 @@ class AbilityDecorator
       column_preference.user == user
     end
 
-    can [:status, :destroy], StripeAccount do |stripe_account|
+    can [:admin, :connect, :status, :destroy], StripeAccount do |stripe_account|
       user.enterprises.include? stripe_account.enterprise
     end
   end
diff --git a/spec/controllers/admin/stripe_accounts_controller_spec.rb b/spec/controllers/admin/stripe_accounts_controller_spec.rb
index 4db449d2df..9a6854ae85 100644
--- a/spec/controllers/admin/stripe_accounts_controller_spec.rb
+++ b/spec/controllers/admin/stripe_accounts_controller_spec.rb
@@ -77,55 +77,52 @@ describe Admin::StripeAccountsController, type: :controller do
   end
 
   describe "#status" do
-    let(:params) { { format: :json } }
+    let(:params) { { format: :json, enterprise_id: enterprise.id } }
 
     before do
       allow(Stripe).to receive(:api_key) { "sk_test_12345" }
       Spree::Config.set(stripe_connect_enabled: false)
     end
 
-    context "when Stripe is not enabled" do
-      it "returns with a status of 'stripe_disabled'" do
+    context "when I don't manage the specified enterprise" do
+      let(:user) { create(:user) }
+
+      before do
+        allow(controller).to receive(:spree_current_user) { user }
+      end
+
+      it "redirects to unauthorized" do
         spree_get :status, params
-        json_response = JSON.parse(response.body)
-        expect(json_response["status"]).to eq "stripe_disabled"
+        expect(response).to redirect_to spree.unauthorized_path
       end
     end
 
-    context "when Stripe is enabled" do
-      before { Spree::Config.set(stripe_connect_enabled: true) }
+    context "when I manage the specified enterprise" do
+      before do
+        allow(controller).to receive(:spree_current_user) { enterprise.owner }
+      end
 
-      context "but no stripe account is associated with the specified enterprise" do
-        it "returns with a status of 'account_missing'" do
+      context "when Stripe is not enabled" do
+        it "returns with a status of 'stripe_disabled'" do
           spree_get :status, params
           json_response = JSON.parse(response.body)
-          expect(json_response["status"]).to eq "account_missing"
+          expect(json_response["status"]).to eq "stripe_disabled"
         end
       end
 
-      context "and a stripe account is associated with the specified enterprise" do
-        let!(:account) { create(:stripe_account, stripe_user_id: "acc_123", enterprise: enterprise) }
+      context "when Stripe is enabled" do
+        before { Spree::Config.set(stripe_connect_enabled: true) }
 
-        context "but I don't manage the enterprise" do
-          let(:user) { create(:user) }
-          let(:enterprise2) { create(:enterprise) }
-          before do
-            user.owned_enterprises << enterprise2
-            params[:enterprise_id] = enterprise.id
-            allow(controller).to receive(:spree_current_user) { user }
-          end
-
-          it "redirects to unauthorized" do
+        context "when no stripe account is associated with the specified enterprise" do
+          it "returns with a status of 'account_missing'" do
             spree_get :status, params
-            expect(response).to redirect_to spree.unauthorized_path
+            json_response = JSON.parse(response.body)
+            expect(json_response["status"]).to eq "account_missing"
           end
         end
 
-        context "and I manage the enterprise" do
-          before do
-            params[:enterprise_id] = enterprise.id
-            allow(controller).to receive(:spree_current_user) { enterprise.owner }
-          end
+        context "when a stripe account is associated with the specified enterprise" do
+          let!(:account) { create(:stripe_account, stripe_user_id: "acc_123", enterprise: enterprise) }
 
           context "but access has been revoked or does not exist on stripe's servers" do
             before do

From aae8f1cbc485ae748fad4c2fc57c3c694a8749e8 Mon Sep 17 00:00:00 2001
From: Pierre de Lacroix <pierre@pdelacroix.com>
Date: Tue, 26 Sep 2017 10:45:29 +0200
Subject: [PATCH 342/353] Change localizeCurrency filter to use I18n.toCurrency

---
 .../darkswarm/filters/localize_currency.js.coffee   | 13 ++++++-------
 .../api/orders_by_distributor_serializer.rb         |  2 +-
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/filters/localize_currency.js.coffee b/app/assets/javascripts/darkswarm/filters/localize_currency.js.coffee
index 7087e09fc3..a194e78e7b 100644
--- a/app/assets/javascripts/darkswarm/filters/localize_currency.js.coffee
+++ b/app/assets/javascripts/darkswarm/filters/localize_currency.js.coffee
@@ -5,11 +5,10 @@ Darkswarm.filter "localizeCurrency", (currencyConfig)->
     currency_code = if currencyConfig.display_currency then " " + currencyConfig.currency else ""
     # Set decimal points,  2 or 0 if hide_cents.
     decimals = if currencyConfig.hide_cents == "true" then 0 else 2
-    # We need to use parseFloat before toFixed as the amount should come in as a string.
-    amount_fixed = parseFloat(amount).toFixed(decimals)
+    # Set wether the currency symbol appears first
+    sign_first =  currencyConfig.symbol_position == 'before'
+    # We need to use parseFloat as the amount should come in as a string.
+    amount = parseFloat(amount)
 
-    # Build the final price string. TODO use spree decimal point and spacer character settings.
-    if currencyConfig.symbol_position == 'before'
-      currencyConfig.symbol + amount_fixed + currency_code
-    else
-      amount_fixed + " " + currencyConfig.symbol + currency_code
+    # Build the final price string.
+    I18n.toCurrency(amount, {precision: decimals, unit: currencyConfig.symbol, sign_first: sign_first}) + currency_code
diff --git a/app/serializers/api/orders_by_distributor_serializer.rb b/app/serializers/api/orders_by_distributor_serializer.rb
index b920272df2..df1cefffc5 100644
--- a/app/serializers/api/orders_by_distributor_serializer.rb
+++ b/app/serializers/api/orders_by_distributor_serializer.rb
@@ -4,7 +4,7 @@ module Api
     has_many :distributed_orders, serializer: Api::OrderSerializer
 
     def balance
-      object.distributed_orders.map(&:outstanding_balance).reduce(:+).to_money.to_s
+      object.distributed_orders.map(&:outstanding_balance).reduce(:+)
     end
 
     def hash

From 089c754f62f8ec8c1e28f94adc2a3c9b090b3ad4 Mon Sep 17 00:00:00 2001
From: Pierre de Lacroix <pierre@pdelacroix.com>
Date: Tue, 26 Sep 2017 19:48:54 +0200
Subject: [PATCH 343/353] Remove conversion of amounts to currency strings via
 Money in serializers as it's better done in JS

---
 app/serializers/api/order_serializer.rb   | 4 ----
 app/serializers/api/payment_serializer.rb | 4 ----
 2 files changed, 8 deletions(-)

diff --git a/app/serializers/api/order_serializer.rb b/app/serializers/api/order_serializer.rb
index 328c1dc11a..481d8ec213 100644
--- a/app/serializers/api/order_serializer.rb
+++ b/app/serializers/api/order_serializer.rb
@@ -28,10 +28,6 @@ module Api
       I18n.l(object.order_cycle.andand.orders_close_at, format: "%b %d, %Y %H:%M")
     end
 
-    def total
-      object.total.to_money.to_s
-    end
-
     def shipment_state
       object.shipment_state ? object.shipment_state : nil
     end
diff --git a/app/serializers/api/payment_serializer.rb b/app/serializers/api/payment_serializer.rb
index f0d91cce72..8b956ecb1f 100644
--- a/app/serializers/api/payment_serializer.rb
+++ b/app/serializers/api/payment_serializer.rb
@@ -5,10 +5,6 @@ module Api
       object.payment_method.try(:name)
     end
 
-    def amount
-      object.amount.to_money.to_s
-    end
-
     def updated_at
       I18n.l(object.updated_at, format: "%b %d, %Y %H:%M")
     end

From 65d176f533746d463d125573e66d170f78516111 Mon Sep 17 00:00:00 2001
From: Pierre de Lacroix <pierre@pdelacroix.com>
Date: Wed, 4 Oct 2017 00:33:42 +0200
Subject: [PATCH 344/353] Fix wrong way to force currency symbol after the
 amount

---
 .../darkswarm/filters/localize_currency.js.coffee         | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/assets/javascripts/darkswarm/filters/localize_currency.js.coffee b/app/assets/javascripts/darkswarm/filters/localize_currency.js.coffee
index a194e78e7b..37de2759cc 100644
--- a/app/assets/javascripts/darkswarm/filters/localize_currency.js.coffee
+++ b/app/assets/javascripts/darkswarm/filters/localize_currency.js.coffee
@@ -3,12 +3,12 @@ Darkswarm.filter "localizeCurrency", (currencyConfig)->
   (amount) ->
     # Set country code (eg. "US").
     currency_code = if currencyConfig.display_currency then " " + currencyConfig.currency else ""
-    # Set decimal points,  2 or 0 if hide_cents.
+    # Set decimal points, 2 or 0 if hide_cents.
     decimals = if currencyConfig.hide_cents == "true" then 0 else 2
-    # Set wether the currency symbol appears first
-    sign_first =  currencyConfig.symbol_position == 'before'
+    # Set format if the currency symbol should come after the number, otherwise (default) use the locale setting.
+    format = if currencyConfig.symbol_position == "after" then "%n %u" else undefined
     # We need to use parseFloat as the amount should come in as a string.
     amount = parseFloat(amount)
 
     # Build the final price string.
-    I18n.toCurrency(amount, {precision: decimals, unit: currencyConfig.symbol, sign_first: sign_first}) + currency_code
+    I18n.toCurrency(amount, {precision: decimals, unit: currencyConfig.symbol, format: format}) + currency_code

From 508dfa4f23f3647ddb675a8abdb5fd965d85229c Mon Sep 17 00:00:00 2001
From: Pierre de Lacroix <pierre@pdelacroix.com>
Date: Wed, 4 Oct 2017 14:54:53 +0200
Subject: [PATCH 345/353] Fix failing tests assuming localizeCurrency has no
 "delimiter"

---
 spec/support/spree/money_helper.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/support/spree/money_helper.rb b/spec/support/spree/money_helper.rb
index f0ca8f73d9..dc5a374c39 100644
--- a/spec/support/spree/money_helper.rb
+++ b/spec/support/spree/money_helper.rb
@@ -1,7 +1,7 @@
 module Spree
   module MoneyHelper
     def with_currency(amount, options = {})
-      Spree::Money.new(amount, {delimiter: ''}.merge(options)).to_s # Delimiter is to match js localizeCurrency
+      Spree::Money.new(amount, options).to_s
     end
   end
 end

From e5fb8712d77d3a6e5de3dce483339c0774370aab Mon Sep 17 00:00:00 2001
From: Duende13 <susana.r.cunado@gmail.com>
Date: Tue, 12 Sep 2017 07:09:39 +0100
Subject: [PATCH 346/353] Simplify Product Edit Screen removing fields and
 adding 2 new menu options for seo and group buy (#1741)

---
 app/models/spree/ability_decorator.rb         |  2 +-
 .../add_group_buy_to_admin_product_edit.rb    |  5 --
 .../_form/add_notes_field.html.haml.deface    |  6 --
 .../add_primary_taxon_field.html.haml.deface  |  2 +-
 .../_form/add_supplier.html.haml.deface       |  5 +-
 .../products/_form/remove_available_on.deface |  2 +
 .../_form/remove_cost_currency.deface         |  2 +
 .../products/_form/remove_cost_price.deface   |  2 +
 .../_form/remove_meta_description.deface      |  1 +
 .../remove_option_types_and_taxons.deface     |  1 +
 ...eplace_master_price_label.html.haml.deface |  2 +
 .../_form/replace_taxons_div.html.haml.deface |  5 ++
 .../add_group_buy.html.haml.deface            |  5 ++
 .../_product_tabs/add_seo.html.haml.deface    |  5 ++
 .../admin/products/_group_buy_form.html.haml  | 14 ++---
 .../spree/admin/products/_seo_form.html.haml  | 15 +++++
 .../products/group_buy_options.html.haml      |  8 +++
 app/views/spree/admin/products/seo.html.haml  |  8 +++
 config/routes.rb                              |  2 +
 spec/features/admin/products_spec.rb          | 57 ++++++++++---------
 20 files changed, 99 insertions(+), 50 deletions(-)
 delete mode 100644 app/overrides/add_group_buy_to_admin_product_edit.rb
 delete mode 100644 app/overrides/spree/admin/products/_form/add_notes_field.html.haml.deface
 create mode 100644 app/overrides/spree/admin/products/_form/remove_available_on.deface
 create mode 100644 app/overrides/spree/admin/products/_form/remove_cost_currency.deface
 create mode 100644 app/overrides/spree/admin/products/_form/remove_cost_price.deface
 create mode 100644 app/overrides/spree/admin/products/_form/remove_meta_description.deface
 create mode 100644 app/overrides/spree/admin/products/_form/remove_option_types_and_taxons.deface
 create mode 100644 app/overrides/spree/admin/products/_form/replace_master_price_label.html.haml.deface
 create mode 100644 app/overrides/spree/admin/products/_form/replace_taxons_div.html.haml.deface
 create mode 100644 app/overrides/spree/admin/shared/_product_tabs/add_group_buy.html.haml.deface
 create mode 100644 app/overrides/spree/admin/shared/_product_tabs/add_seo.html.haml.deface
 create mode 100644 app/views/spree/admin/products/_seo_form.html.haml
 create mode 100644 app/views/spree/admin/products/group_buy_options.html.haml
 create mode 100644 app/views/spree/admin/products/seo.html.haml

diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb
index 662cc5d1d6..c08bd1f654 100644
--- a/app/models/spree/ability_decorator.rb
+++ b/app/models/spree/ability_decorator.rb
@@ -132,7 +132,7 @@ class AbilityDecorator
   def add_product_management_abilities(user)
     # Enterprise User can only access products that they are a supplier for
     can [:create], Spree::Product
-    can [:admin, :read, :update, :product_distributions, :bulk_edit, :bulk_update, :clone, :delete, :destroy], Spree::Product do |product|
+    can [:admin, :read, :update, :product_distributions, :seo, :group_buy_options, :bulk_edit, :bulk_update, :clone, :delete, :destroy], Spree::Product do |product|
       OpenFoodNetwork::Permissions.new(user).managed_product_enterprises.include? product.supplier
     end
 
diff --git a/app/overrides/add_group_buy_to_admin_product_edit.rb b/app/overrides/add_group_buy_to_admin_product_edit.rb
deleted file mode 100644
index eb44ca5c6c..0000000000
--- a/app/overrides/add_group_buy_to_admin_product_edit.rb
+++ /dev/null
@@ -1,5 +0,0 @@
-Deface::Override.new(:virtual_path => "spree/admin/products/_form",
-                     :insert_top   => "[data-hook='admin_product_form_right']",
-                     :partial      => "spree/admin/products/group_buy_form",
-                     :name         => "add_group_buy_to_admin_product_edit",
-                     :original     => '0c0e8d714989e48ee246a8253fb2b362f108621a')
diff --git a/app/overrides/spree/admin/products/_form/add_notes_field.html.haml.deface b/app/overrides/spree/admin/products/_form/add_notes_field.html.haml.deface
deleted file mode 100644
index dcc7937d6b..0000000000
--- a/app/overrides/spree/admin/products/_form/add_notes_field.html.haml.deface
+++ /dev/null
@@ -1,6 +0,0 @@
-/ insert_bottom "[data-hook='admin_product_form_additional_fields']"
-
-= f.field_container :notes do
-  = f.label :notes, t(:notes)
-  = f.text_area :notes, { :class => 'fullwidth', rows: 5 }
-  = f.error_message_on :notes
diff --git a/app/overrides/spree/admin/products/_form/add_primary_taxon_field.html.haml.deface b/app/overrides/spree/admin/products/_form/add_primary_taxon_field.html.haml.deface
index efd7ccbfaf..46afe1f94d 100644
--- a/app/overrides/spree/admin/products/_form/add_primary_taxon_field.html.haml.deface
+++ b/app/overrides/spree/admin/products/_form/add_primary_taxon_field.html.haml.deface
@@ -1,3 +1,3 @@
-/ insert_top "[data-hook='admin_product_form_right']"
+/ insert_after "div[class='variant_units_form']"
 
 = render 'spree/admin/products/primary_taxon_form', f: f
\ No newline at end of file
diff --git a/app/overrides/spree/admin/products/_form/add_supplier.html.haml.deface b/app/overrides/spree/admin/products/_form/add_supplier.html.haml.deface
index deba9ff633..a814c10b80 100644
--- a/app/overrides/spree/admin/products/_form/add_supplier.html.haml.deface
+++ b/app/overrides/spree/admin/products/_form/add_supplier.html.haml.deface
@@ -1,7 +1,6 @@
-/ insert_top "[data-hook='admin_product_form_right']"
-
+/ insert_before "code[erb-loud]:contains('f.field_container :price')"
 = f.field_container :supplier do
   = f.label :supplier, t(:spree_admin_supplier)
   %br
   = f.collection_select(:supplier_id, @producers, :id, :name, {:include_blank => true}, {:class => "select2"})
-  = f.error_message_on :supplier
+  = f.error_message_on :supplier
\ No newline at end of file
diff --git a/app/overrides/spree/admin/products/_form/remove_available_on.deface b/app/overrides/spree/admin/products/_form/remove_available_on.deface
new file mode 100644
index 0000000000..645fb76bde
--- /dev/null
+++ b/app/overrides/spree/admin/products/_form/remove_available_on.deface
@@ -0,0 +1,2 @@
+remove "code[erb-loud]:contains('f.label :available_on')"
+closing_selector("code[erb-loud]:contains('f.text_field :available_on')")
\ No newline at end of file
diff --git a/app/overrides/spree/admin/products/_form/remove_cost_currency.deface b/app/overrides/spree/admin/products/_form/remove_cost_currency.deface
new file mode 100644
index 0000000000..a194a5e03a
--- /dev/null
+++ b/app/overrides/spree/admin/products/_form/remove_cost_currency.deface
@@ -0,0 +1,2 @@
+remove "code[erb-loud]:contains('f.field_container :cost_currency')"
+closing_selector("code[erb-silent]:contains('end')")
\ No newline at end of file
diff --git a/app/overrides/spree/admin/products/_form/remove_cost_price.deface b/app/overrides/spree/admin/products/_form/remove_cost_price.deface
new file mode 100644
index 0000000000..9f9cd8ec3f
--- /dev/null
+++ b/app/overrides/spree/admin/products/_form/remove_cost_price.deface
@@ -0,0 +1,2 @@
+remove "code[erb-loud]:contains('f.field_container :cost_price')"
+closing_selector("code[erb-silent]:contains('end')")
\ No newline at end of file
diff --git a/app/overrides/spree/admin/products/_form/remove_meta_description.deface b/app/overrides/spree/admin/products/_form/remove_meta_description.deface
new file mode 100644
index 0000000000..15a00a5df0
--- /dev/null
+++ b/app/overrides/spree/admin/products/_form/remove_meta_description.deface
@@ -0,0 +1 @@
+remove "div[data-hook='admin_product_form_meta']"
\ No newline at end of file
diff --git a/app/overrides/spree/admin/products/_form/remove_option_types_and_taxons.deface b/app/overrides/spree/admin/products/_form/remove_option_types_and_taxons.deface
new file mode 100644
index 0000000000..eeccddc25c
--- /dev/null
+++ b/app/overrides/spree/admin/products/_form/remove_option_types_and_taxons.deface
@@ -0,0 +1 @@
+remove "div[class='twelve columns alpha omega']"
\ No newline at end of file
diff --git a/app/overrides/spree/admin/products/_form/replace_master_price_label.html.haml.deface b/app/overrides/spree/admin/products/_form/replace_master_price_label.html.haml.deface
new file mode 100644
index 0000000000..02152cb521
--- /dev/null
+++ b/app/overrides/spree/admin/products/_form/replace_master_price_label.html.haml.deface
@@ -0,0 +1,2 @@
+/ replace "[data-hook=admin_product_form_right] code[erb-loud]:contains('f.label :price')"
+= f.label :price, raw(t(:price) + content_tag(:span, ' *', :class => 'required'))
\ No newline at end of file
diff --git a/app/overrides/spree/admin/products/_form/replace_taxons_div.html.haml.deface b/app/overrides/spree/admin/products/_form/replace_taxons_div.html.haml.deface
new file mode 100644
index 0000000000..697255ab70
--- /dev/null
+++ b/app/overrides/spree/admin/products/_form/replace_taxons_div.html.haml.deface
@@ -0,0 +1,5 @@
+/ insert_bottom "[data-hook=admin_product_form_left]"
+= f.field_container :taxons do 
+  = f.label :taxon_ids, t(:taxons) 
+  %br
+  = f.hidden_field :taxon_ids, :value => @product.taxon_ids.join(',')
\ No newline at end of file
diff --git a/app/overrides/spree/admin/shared/_product_tabs/add_group_buy.html.haml.deface b/app/overrides/spree/admin/shared/_product_tabs/add_group_buy.html.haml.deface
new file mode 100644
index 0000000000..ab62e4725a
--- /dev/null
+++ b/app/overrides/spree/admin/shared/_product_tabs/add_group_buy.html.haml.deface
@@ -0,0 +1,5 @@
+/ insert_bottom "[data-hook='admin_product_tabs']"
+
+- klass = current == 'Group Buy Options' ? 'active' : ''
+%li{:class => klass}
+  = link_to_with_icon 'icon-tasks', 'Group Buy Options', group_buy_options_admin_product_url(@product)
diff --git a/app/overrides/spree/admin/shared/_product_tabs/add_seo.html.haml.deface b/app/overrides/spree/admin/shared/_product_tabs/add_seo.html.haml.deface
new file mode 100644
index 0000000000..98023bf7a1
--- /dev/null
+++ b/app/overrides/spree/admin/shared/_product_tabs/add_seo.html.haml.deface
@@ -0,0 +1,5 @@
+/ insert_bottom "[data-hook='admin_product_tabs']"
+
+- klass = current == 'SEO' ? 'active' : ''
+%li{:class => klass}
+  = link_to_with_icon 'icon-tasks', 'SEO', seo_admin_product_url(@product)
diff --git a/app/views/spree/admin/products/_group_buy_form.html.haml b/app/views/spree/admin/products/_group_buy_form.html.haml
index f61fc7b38d..6ccf23a024 100644
--- a/app/views/spree/admin/products/_group_buy_form.html.haml
+++ b/app/views/spree/admin/products/_group_buy_form.html.haml
@@ -2,13 +2,13 @@
   = f.label :group_buy, t('.group_buy')
   %br
   .alpha.two.columns
-    = f.radio_button :group_buy, '1', checked: f.object.group_buy
     = f.label :group_buy_1, t(:yes)
+    = f.radio_button :group_buy, '1', checked: f.object.group_buy
   .alpha.two.columns
-    = f.radio_button :group_buy, '0', checked: !f.object.group_buy
     = f.label :group_buy_0, t(:no)
-%br.clear
-= f.field_container :group_buy_unit_size do
-  = f.label :group_buy_unit_size, t('.bulk_unit_size')
-  %br
-  = f.text_field :group_buy_unit_size
+    = f.radio_button :group_buy, '0', checked: !f.object.group_buy
+  %br.clear
+  = f.field_container :group_buy_unit_size do
+    = f.label :group_buy_unit_size, t('.bulk_unit_size')
+    %br
+    = f.text_field :group_buy_unit_size
diff --git a/app/views/spree/admin/products/_seo_form.html.haml b/app/views/spree/admin/products/_seo_form.html.haml
new file mode 100644
index 0000000000..bbc5bdb4f0
--- /dev/null
+++ b/app/views/spree/admin/products/_seo_form.html.haml
@@ -0,0 +1,15 @@
+.row{"data-hook" => "admin_product_meta_form"}
+  .alpha.eleven.columns
+    = f.field_container :meta_description do
+      = f.label :meta_keywords, t(:meta_keywords)
+      %br/
+      = f.text_field :meta_keywords, :class => 'fullwidth', :rows => 6
+    = f.field_container :meta_description do
+      = f.label :meta_description, t(:meta_description)
+      %br/
+      = f.text_field :meta_description, :class => 'fullwidth', :rows => 6
+  .alpha.eleven.columns
+    = f.field_container :notes do
+      = f.label :notes, t(:notes)
+      = f.text_area :notes, { :class => 'fullwidth', rows: 5 }
+      = f.error_message_on :notes
\ No newline at end of file
diff --git a/app/views/spree/admin/products/group_buy_options.html.haml b/app/views/spree/admin/products/group_buy_options.html.haml
new file mode 100644
index 0000000000..9261ddbfc6
--- /dev/null
+++ b/app/views/spree/admin/products/group_buy_options.html.haml
@@ -0,0 +1,8 @@
+= render :partial => 'spree/admin/shared/product_sub_menu'
+= render :partial => 'spree/admin/shared/product_tabs', :locals => { :current => 'Group Buy Options' }
+= render :partial => 'spree/shared/error_messages', :locals => { :target => @product }
+
+= form_for [:admin, @product], :method => :put, :html => { :multipart => true } do |f|
+  %fieldset.no-border-top
+    = render :partial => 'group_buy_form', :locals => { :f => f }
+    = render :partial => 'spree/admin/shared/edit_resource_links'
diff --git a/app/views/spree/admin/products/seo.html.haml b/app/views/spree/admin/products/seo.html.haml
new file mode 100644
index 0000000000..ddcd00402f
--- /dev/null
+++ b/app/views/spree/admin/products/seo.html.haml
@@ -0,0 +1,8 @@
+= render :partial => 'spree/admin/shared/product_sub_menu'
+= render :partial => 'spree/admin/shared/product_tabs', :locals => { :current => 'SEO' }
+= render :partial => 'spree/shared/error_messages', :locals => { :target => @product }
+
+= form_for [:admin, @product], :method => :put, :html => { :multipart => true } do |f|
+  %fieldset.no-border-top
+    = render :partial => 'seo_form', :locals => { :f => f }
+    = render :partial => 'spree/admin/shared/edit_resource_links'
diff --git a/config/routes.rb b/config/routes.rb
index 0484754d39..ca8114ddb8 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -275,6 +275,8 @@ Spree::Core::Engine.routes.prepend do
 
     resources :products do
       get :product_distributions, on: :member
+      get :group_buy_options, on: :member
+      get :seo, on: :member
 
       post :bulk_update, :on => :collection, :as => :bulk_update
     end
diff --git a/spec/features/admin/products_spec.rb b/spec/features/admin/products_spec.rb
index cc11e5853d..eb6e765b00 100644
--- a/spec/features/admin/products_spec.rb
+++ b/spec/features/admin/products_spec.rb
@@ -86,24 +86,6 @@ feature %q{
       variant = product.variants.first
       variant.on_demand.should be_true
     end
-
-    scenario "making a product into a group buy product" do
-      product = create(:simple_product, name: 'group buy product')
-
-      login_to_admin_section
-
-      visit spree.edit_admin_product_path(product)
-
-      choose 'product_group_buy_1'
-      fill_in 'product_group_buy_unit_size', with: '10'
-
-      click_button 'Update'
-
-      flash_message.should == 'Product "group buy product" has been successfully updated!'
-      product.reload
-      product.group_buy.should be_true
-      product.group_buy_unit_size.should == 10.0
-    end
   end
 
   context "as an enterprise user" do
@@ -121,15 +103,6 @@ feature %q{
       login_to_admin_as @new_user
     end
 
-
-    context "additional fields" do
-      it "should have a notes field" do
-        product = create(:simple_product, supplier: @supplier2)
-        visit spree.edit_admin_product_path product
-        page.should have_content "Notes"
-      end
-    end
-
     context "products do not require a tax category" do
       scenario "creating a new product", js: true do
         with_products_require_tax_category(false) do
@@ -174,6 +147,22 @@ feature %q{
       product.tax_category.should == tax_category
     end
 
+    scenario "editing product group buy options" do
+      product = product = create(:simple_product, supplier: @supplier2)
+
+      visit spree.edit_admin_product_path product
+      within('#sidebar') { click_link 'Group Buy Options' }
+      choose('product_group_buy_1')
+      fill_in 'Bulk unit size', :with => '10'
+
+      click_button 'Update'
+
+      flash_message.should == "Product \"#{product.name}\" has been successfully updated!"
+      product.reload
+      product.group_buy.should be_true
+      product.group_buy_unit_size.should == 10.0
+    end
+
     scenario "editing product distributions" do
       product = create(:simple_product, supplier: @supplier2)
 
@@ -195,6 +184,20 @@ feature %q{
       product.distributors.should == [@distributors[0]]
     end
 
+    scenario "editing product SEO" do
+      product = product = create(:simple_product, supplier: @supplier2)
+      visit spree.edit_admin_product_path product
+      within('#sidebar') { click_link 'SEO' }
+      fill_in "product_meta_keywords", :with => 'Meta Keywords'
+      fill_in 'Meta Description', :with => 'Meta Description'
+      fill_in 'Notes', :with => 'Just testing Notes'
+      click_button 'Update'
+      flash_message.should == "Product \"#{product.name}\" has been successfully updated!"
+      product.reload
+      product.notes.should == 'Just testing Notes'
+      product.meta_keywords.should == 'Meta Keywords'
+      product.meta_description.should == 'Meta Description'
+    end
 
     scenario "deleting product properties", js: true do
       # Given a product with a property

From 6006952603060714c838179ae98276867a706143 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 6 Oct 2017 08:45:33 +1100
Subject: [PATCH 347/353] Moving checkout request specs into their own folder

---
 .../{paypal_confirm_spec.rb => checkout/paypal_spec.rb}         | 2 +-
 .../stripe_connect_spec.rb}                                     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename spec/requests/{paypal_confirm_spec.rb => checkout/paypal_spec.rb} (96%)
 rename spec/requests/{stripe_connect_checkout_spec.rb => checkout/stripe_connect_spec.rb} (99%)

diff --git a/spec/requests/paypal_confirm_spec.rb b/spec/requests/checkout/paypal_spec.rb
similarity index 96%
rename from spec/requests/paypal_confirm_spec.rb
rename to spec/requests/checkout/paypal_spec.rb
index 2f36d3a612..0537770474 100644
--- a/spec/requests/paypal_confirm_spec.rb
+++ b/spec/requests/checkout/paypal_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe "confirming an order with paypal express payment method", type: :request do
+describe "checking out an order with a paypal express payment method", type: :request do
   include ShopWorkflow
 
   let!(:address) { create(:address) }
diff --git a/spec/requests/stripe_connect_checkout_spec.rb b/spec/requests/checkout/stripe_connect_spec.rb
similarity index 99%
rename from spec/requests/stripe_connect_checkout_spec.rb
rename to spec/requests/checkout/stripe_connect_spec.rb
index b3d21afdd5..d78b315e34 100644
--- a/spec/requests/stripe_connect_checkout_spec.rb
+++ b/spec/requests/checkout/stripe_connect_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe "Submitting Stripe Connect charge requests", type: :request do
+describe "checking out an order with a Stripe Connect payment method", type: :request do
   include ShopWorkflow
   include AuthenticationWorkflow
 

From c031b0e52b6d6133c120cee5793f342a544fd0ee Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 6 Oct 2017 12:16:13 +1100
Subject: [PATCH 348/353] Clear shipments and payments after failed payment at
 checkout

---
 app/controllers/checkout_controller.rb        | 13 ++++
 app/models/spree/order_decorator.rb           |  7 +-
 .../requests/checkout/failed_checkout_spec.rb | 70 +++++++++++++++++++
 3 files changed, 88 insertions(+), 2 deletions(-)
 create mode 100644 spec/requests/checkout/failed_checkout_spec.rb

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 62c91df4f4..817be578b0 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -15,6 +15,10 @@ class CheckoutController < Spree::CheckoutController
   include EnterprisesHelper
 
   def edit
+    # This is only required because of spree_paypal_express. If we implement
+    # a version of paypal that uses this controller, and more specifically
+    # the #update_failed method, then we can remove this call
+    restart_checkout
   end
 
   def update
@@ -137,6 +141,7 @@ class CheckoutController < Spree::CheckoutController
 
   def update_failed
     clear_ship_address
+    restart_checkout
     respond_to do |format|
       format.html do
         render :edit
@@ -155,6 +160,14 @@ class CheckoutController < Spree::CheckoutController
     end
   end
 
+  def restart_checkout
+    return if @order.state == 'cart'
+    @order.restart_checkout! # resets state to 'cart'
+    @order.shipments.with_state(:pending).destroy_all
+    @order.payments.with_state(:checkout).destroy_all
+    @order.reload
+  end
+
   def skip_state_validation?
     true
   end
diff --git a/app/models/spree/order_decorator.rb b/app/models/spree/order_decorator.rb
index 0166fc10c1..31c14c0225 100644
--- a/app/models/spree/order_decorator.rb
+++ b/app/models/spree/order_decorator.rb
@@ -376,11 +376,14 @@ Spree::Order.class_eval do
   # object_params sets the payment amount to the order total, but it does this before
   # the shipping method is set. This results in the customer not being charged for their
   # order's shipping. To fix this, we refresh the payment amount here.
-  def charge_shipping!
+  def charge_shipping_and_payment_fees!
     update_totals
     return unless payments.any?
     payments.first.update_attribute :amount, total
   end
 end
 
-Spree::Order.state_machine.after_transition to: :payment, do: :charge_shipping!
+Spree::Order.state_machine.after_transition to: :payment, do: :charge_shipping_and_payment_fees!
+Spree::Order.state_machine.event :restart_checkout do
+  transition :to => :cart, unless: :completed?
+end
diff --git a/spec/requests/checkout/failed_checkout_spec.rb b/spec/requests/checkout/failed_checkout_spec.rb
new file mode 100644
index 0000000000..6246beadf0
--- /dev/null
+++ b/spec/requests/checkout/failed_checkout_spec.rb
@@ -0,0 +1,70 @@
+require 'spec_helper'
+
+describe "checking out an order that initially fails", type: :request do
+  include ShopWorkflow
+
+  let!(:shop) { create(:enterprise) }
+  let!(:order_cycle) { create(:simple_order_cycle) }
+  let!(:exchange) { create(:exchange, order_cycle: order_cycle, sender: order_cycle.coordinator, receiver: shop, incoming: false, pickup_time: "Monday") }
+  let!(:address) { create(:address) }
+  let!(:order) { create(:order, distributor: shop, order_cycle: order_cycle) }
+  let!(:line_item) { create(:line_item, order: order, quantity: 3, price: 5.00) }
+  let!(:payment_method) { create(:bogus_payment_method, distributor_ids: [shop.id], environment: Rails.env) }
+  let!(:check_payment_method) { create(:payment_method, distributor_ids: [shop.id], environment: Rails.env) }
+  let!(:shipping_method) { create(:shipping_method, distributor_ids: [shop.id]) }
+  let!(:shipment) { create(:shipment, order: order, shipping_method: shipping_method) }
+  let(:params) do
+    { format: :json, order: {
+      shipping_method_id: shipping_method.id,
+      payments_attributes: [{payment_method_id: payment_method.id}],
+      bill_address_attributes: address.attributes.slice("firstname", "lastname", "address1", "address2", "phone", "city", "zipcode", "state_id", "country_id"),
+      ship_address_attributes: address.attributes.slice("firstname", "lastname", "address1", "address2", "phone", "city", "zipcode", "state_id", "country_id")
+    } }
+  end
+
+  before do
+    order.reload.update_totals
+    set_order order
+  end
+
+  context "when shipping and payment fees apply" do
+    let(:calculator) { Spree::Calculator::FlatPercentItemTotal.new(preferred_flat_percent: 10) }
+
+    before do
+      payment_method.calculator = calculator.dup
+      payment_method.save!
+      check_payment_method.calculator = calculator.dup
+      check_payment_method.save!
+      shipping_method.calculator = calculator.dup
+      shipping_method.save!
+    end
+
+    it "clears shipments and payments before rendering the checkout" do
+      put update_checkout_path, params
+
+      # Checking out a BogusGateway without a source fails at :payment
+      # Shipments and payments should then be cleared before rendering checkout
+      expect(response.status).to be 400
+      expect(flash[:error]).to eq I18n.t(:payment_processing_failed)
+      order.reload
+      expect(order.shipments.count).to be 0
+      expect(order.payments.count).to be 0
+      expect(order.adjustment_total).to eq 0
+
+      # Add another line item to change the fee totals
+      create(:line_item, order: order, quantity: 3, price: 5.00)
+
+      # Use a check payment method, which should work
+      params[:order][:payments_attributes][0][:payment_method_id] = check_payment_method.id
+      put update_checkout_path, params
+
+      expect(response.status).to be 200
+      order.reload
+      expect(order.total).to eq 36
+      expect(order.adjustment_total).to eq 6
+      expect(order.item_total).to eq 30
+      expect(order.shipments.count).to eq 1
+      expect(order.payments.count).to eq 1
+    end
+  end
+end

From f96502c369554e9a81d23b39724cc80f660c1727 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Wed, 11 Oct 2017 11:51:58 +1100
Subject: [PATCH 349/353] Add unit specs for
 CheckoutController#restart_checkout

---
 app/models/spree/payment_decorator.rb        |  2 +-
 spec/controllers/checkout_controller_spec.rb | 65 ++++++++++++++++++--
 2 files changed, 60 insertions(+), 7 deletions(-)

diff --git a/app/models/spree/payment_decorator.rb b/app/models/spree/payment_decorator.rb
index a09e65c2fd..c9ae401541 100644
--- a/app/models/spree/payment_decorator.rb
+++ b/app/models/spree/payment_decorator.rb
@@ -105,7 +105,7 @@ module Spree
     # state is acheived through some trickery using an after_rollback callback on the
     # payment model. See Spree::Payment#persist_invalid
     def revoke_adjustment_eligibility
-      return unless adjustment.reload
+      return unless adjustment.try(:reload)
       return if adjustment.finalized?
       adjustment.update_attribute(:eligible, false)
       adjustment.finalize!
diff --git a/spec/controllers/checkout_controller_spec.rb b/spec/controllers/checkout_controller_spec.rb
index 38d72d6442..51351797b1 100644
--- a/spec/controllers/checkout_controller_spec.rb
+++ b/spec/controllers/checkout_controller_spec.rb
@@ -190,16 +190,69 @@ describe CheckoutController do
   describe "Paypal routing" do
     let(:payment_method) { create(:payment_method, type: "Spree::Gateway::PayPalExpress") }
     before do
-      controller.stub(:current_distributor).and_return(distributor)
-      controller.stub(:current_order_cycle).and_return(order_cycle)
-      controller.stub(:current_order).and_return(order)
+      allow(controller).to receive(:current_distributor) { distributor }
+      allow(controller).to receive(:current_order_cycle) { order_cycle }
+      allow(controller).to receive(:current_order) { order }
+      allow(controller).to receive(:restart_checkout)
     end
 
     it "should check the payment method for Paypalness if we've selected one" do
-      Spree::PaymentMethod.should_receive(:find).with(payment_method.id.to_s).and_return payment_method
-      order.stub(:update_attributes).and_return true
-      order.stub(:state).and_return "payment"
+      expect(Spree::PaymentMethod).to receive(:find).with(payment_method.id.to_s) { payment_method }
+      allow(order).to receive(:update_attributes) { true }
+      allow(order).to receive(:state) { "payment" }
       spree_post :update, order: {payments_attributes: [{payment_method_id: payment_method.id}]}
     end
   end
+
+  describe "#update_failed" do
+    before do
+      controller.instance_variable_set(:@order, order)
+    end
+
+    it "clears the shipping address and restarts the checkout" do
+      expect(controller).to receive(:clear_ship_address)
+      expect(controller).to receive(:restart_checkout)
+      expect(controller).to receive(:respond_to)
+      controller.send(:update_failed)
+    end
+  end
+
+  describe "#restart_checkout" do
+    let!(:shipment_pending) { create(:shipment, order: order, state: 'pending') }
+    let!(:payment_checkout) { create(:payment, order: order, state: 'checkout') }
+    let!(:payment_failed) { create(:payment, order: order, state: 'failed') }
+
+    before do
+      controller.instance_variable_set(:@order, order.reload)
+    end
+
+    context "when the order is already in the 'cart' state" do
+      it "does nothing" do
+        expect(order).to_not receive(:restart_checkout!)
+        controller.send(:restart_checkout)
+      end
+    end
+
+    context "when the order is in a subsequent state" do
+      before do
+        order.update_attribute(:state, "payment")
+      end
+
+      # NOTE: at the time of writing, it was not possible to create a shipment with a state other than
+      # 'pending' when the order has not been completed, so this is not a case that requires testing.
+      it "resets the order state, and clears incomplete shipments and payments" do
+        expect(order).to receive(:restart_checkout!).and_call_original
+        expect(order.shipments.count).to be 1
+        expect(order.adjustments.shipping.count).to be 1
+        expect(order.payments.count).to be 2
+        expect(order.adjustments.payment_fee.count).to be 2
+        controller.send(:restart_checkout)
+        expect(order.reload.state).to eq 'cart'
+        expect(order.shipments.count).to be 0
+        expect(order.adjustments.shipping.count).to be 0
+        expect(order.payments.count).to be 1
+        expect(order.adjustments.payment_fee.count).to be 1
+      end
+    end
+  end
 end

From 1fcbf6b44dcc0981d287ffc412c968f1eed4f8d3 Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 13 Oct 2017 12:45:02 +1100
Subject: [PATCH 350/353] Clear shipping_method_id from order when restarting
 checkout

If the order is allowed to retain a shipping_method_id, then subsequent
saves of the order will cause a new shipment to be initialised. Seems to
only happen for delivery shipping methods. This is undesirable because
fees for the new shipment will appear in the checkout summary, which is
not smart enough to recognise existing shipment fees and adjust the order
total accordingly.
---
 app/controllers/checkout_controller.rb       | 1 +
 spec/controllers/checkout_controller_spec.rb | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/app/controllers/checkout_controller.rb b/app/controllers/checkout_controller.rb
index 817be578b0..ee0bb1f77d 100644
--- a/app/controllers/checkout_controller.rb
+++ b/app/controllers/checkout_controller.rb
@@ -163,6 +163,7 @@ class CheckoutController < Spree::CheckoutController
   def restart_checkout
     return if @order.state == 'cart'
     @order.restart_checkout! # resets state to 'cart'
+    @order.update_attributes!(shipping_method_id: nil)
     @order.shipments.with_state(:pending).destroy_all
     @order.payments.with_state(:checkout).destroy_all
     @order.reload
diff --git a/spec/controllers/checkout_controller_spec.rb b/spec/controllers/checkout_controller_spec.rb
index 51351797b1..70332b5ea5 100644
--- a/spec/controllers/checkout_controller_spec.rb
+++ b/spec/controllers/checkout_controller_spec.rb
@@ -223,6 +223,7 @@ describe CheckoutController do
     let!(:payment_failed) { create(:payment, order: order, state: 'failed') }
 
     before do
+      order.update_attribute(:shipping_method_id, shipment_pending.shipping_method_id)
       controller.instance_variable_set(:@order, order.reload)
     end
 
@@ -242,12 +243,14 @@ describe CheckoutController do
       # 'pending' when the order has not been completed, so this is not a case that requires testing.
       it "resets the order state, and clears incomplete shipments and payments" do
         expect(order).to receive(:restart_checkout!).and_call_original
+        expect(order.shipping_method_id).to_not be nil
         expect(order.shipments.count).to be 1
         expect(order.adjustments.shipping.count).to be 1
         expect(order.payments.count).to be 2
         expect(order.adjustments.payment_fee.count).to be 2
         controller.send(:restart_checkout)
         expect(order.reload.state).to eq 'cart'
+        expect(order.shipping_method_id).to be nil
         expect(order.shipments.count).to be 0
         expect(order.adjustments.shipping.count).to be 0
         expect(order.payments.count).to be 1

From 768378b1472b32ada4ec5b7e937ac3c1f37371b8 Mon Sep 17 00:00:00 2001
From: Pierre de Lacroix <pierre@pdelacroix.com>
Date: Mon, 25 Sep 2017 14:04:54 +0200
Subject: [PATCH 351/353] Add pointer cursor to EXPAND ALL link in products
 bulk edit

---
 .../spree/admin/products/bulk_edit/_products_head.html.haml     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/spree/admin/products/bulk_edit/_products_head.html.haml b/app/views/spree/admin/products/bulk_edit/_products_head.html.haml
index 9a8f7ad86a..5bd4418ac2 100644
--- a/app/views/spree/admin/products/bulk_edit/_products_head.html.haml
+++ b/app/views/spree/admin/products/bulk_edit/_products_head.html.haml
@@ -19,7 +19,7 @@
 %thead
   %tr{ ng: { controller: "ColumnsCtrl" } }
     %th.left-actions
-      %a{ 'ng-click' => 'toggleShowAllVariants()', :style => 'color: red' }
+      %a{ 'ng-click' => 'toggleShowAllVariants()', :style => 'color: red; cursor: pointer' }
         = t(:expand_all)
     %th.producer{ 'ng-show' => 'columns.producer.visible' }=t('admin.producer')
     %th.sku{ 'ng-show' => 'columns.sku.visible' }=t('admin.sku')

From 1fe10b4b25da9f2551cbe6bf0a9dd5f38657c187 Mon Sep 17 00:00:00 2001
From: Pierre de Lacroix <pierre@pdelacroix.com>
Date: Mon, 25 Sep 2017 16:17:35 +0200
Subject: [PATCH 352/353] Add pointer cursor to other links in products bulk
 edit

---
 app/assets/stylesheets/admin/products.css.scss | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/app/assets/stylesheets/admin/products.css.scss b/app/assets/stylesheets/admin/products.css.scss
index b14dadd866..79854e4c33 100644
--- a/app/assets/stylesheets/admin/products.css.scss
+++ b/app/assets/stylesheets/admin/products.css.scss
@@ -69,4 +69,10 @@ table#listing_products.bulk {
       margin-bottom: 0.5em;
     }
   }
+
+  td.left-actions {
+    a.view-variants, a.add-variant {
+      cursor: pointer;
+    }
+  }
 }

From bca409bfe43aeefdfd2a9bad8890d158efcc7dbe Mon Sep 17 00:00:00 2001
From: Rob Harrington <oeoeaio@gmail.com>
Date: Fri, 6 Oct 2017 08:23:08 +1100
Subject: [PATCH 353/353] Bumping very outdated versions of pry and byebug

---
 Gemfile      |  3 ++-
 Gemfile.lock | 26 +++++++++++---------------
 2 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/Gemfile b/Gemfile
index 36ca2fc59a..72c12fa7c5 100644
--- a/Gemfile
+++ b/Gemfile
@@ -126,7 +126,8 @@ group :test do
 end
 
 group :development do
-  gem 'pry-byebug'
+  gem 'byebug', '~> 9.0.0' # 9.1 requires ruby 2.2
+  gem 'pry-byebug', '>= 3.4.3'
   gem 'debugger-linecache'
   gem 'guard'
   gem 'guard-livereload'
diff --git a/Gemfile.lock b/Gemfile.lock
index d41516fe5e..241c6298bb 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -198,9 +198,7 @@ GEM
     blockenspiel (0.4.5)
     bugsnag (4.1.0)
     builder (3.0.4)
-    byebug (2.7.0)
-      columnize (~> 0.3)
-      debugger-linecache (~> 1.2)
+    byebug (9.0.6)
     cancan (1.6.8)
     capybara (2.7.1)
       addressable
@@ -217,7 +215,7 @@ GEM
     cliver (0.3.2)
     cocaine (0.5.8)
       climate_control (>= 0.0.3, < 1.0)
-    coderay (1.0.9)
+    coderay (1.1.2)
     coffee-rails (3.2.2)
       coffee-script (>= 2.2.0)
       railties (~> 3.2.0)
@@ -226,7 +224,6 @@ GEM
       execjs
     coffee-script-source (1.10.0)
     colorize (0.8.1)
-    columnize (0.9.0)
     compass (1.0.3)
       chunky_png (~> 1.2)
       compass-core (~> 1.0.2)
@@ -474,7 +471,7 @@ GEM
     mail (2.5.4)
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
-    method_source (0.8.2)
+    method_source (0.9.0)
     mime-types (1.25.1)
     mini_portile2 (2.1.0)
     momentjs-rails (2.5.1)
@@ -523,13 +520,12 @@ GEM
       activerecord (~> 3.0)
     polyglot (0.3.5)
     powerpack (0.1.1)
-    pry (0.9.12.2)
-      coderay (~> 1.0.5)
-      method_source (~> 0.8)
-      slop (~> 3.4)
-    pry-byebug (1.3.2)
-      byebug (~> 2.7)
-      pry (~> 0.9.12)
+    pry (0.11.1)
+      coderay (~> 1.1.0)
+      method_source (~> 0.9.0)
+    pry-byebug (3.4.3)
+      byebug (>= 9.0, < 9.1)
+      pry (~> 0.10)
     rabl (0.7.2)
       activesupport (>= 2.3.14)
       multi_json (~> 1.0)
@@ -629,7 +625,6 @@ GEM
       thor (~> 0.14)
     shoulda-matchers (1.1.0)
       activesupport (>= 3.0.0)
-    slop (3.4.5)
     spinjs-rails (1.3)
       rails (>= 3.1)
     sprockets (2.2.3)
@@ -707,6 +702,7 @@ DEPENDENCIES
   aws-sdk
   blockenspiel
   bugsnag
+  byebug (~> 9.0.0)
   capybara
   coffee-rails (~> 3.2.1)
   compass-rails
@@ -755,7 +751,7 @@ DEPENDENCIES
   parallel_tests
   pg
   poltergeist
-  pry-byebug
+  pry-byebug (>= 3.4.3)
   rabl
   rack-livereload
   rack-ssl