diff --git a/app/controllers/spree/orders_controller_decorator.rb b/app/controllers/spree/orders_controller_decorator.rb index a354852391..72b5cf3c14 100644 --- a/app/controllers/spree/orders_controller_decorator.rb +++ b/app/controllers/spree/orders_controller_decorator.rb @@ -5,6 +5,7 @@ Spree::OrdersController.class_eval do before_filter :filter_order_params, only: :update before_filter :enable_embedded_shopfront + prepend_before_filter :require_order_authentication, only: :show prepend_before_filter :require_order_cycle, only: :edit prepend_before_filter :require_distributor_chosen, only: :edit before_filter :check_hub_ready_for_checkout, only: :edit @@ -128,6 +129,13 @@ Spree::OrdersController.class_eval do private + def require_order_authentication + return if session[:access_token] || params[:token] || spree_current_user + + flash[:error] = I18n.t("spree.orders.edit.login_to_view_order") + redirect_to root_path(anchor: "login?after_login=#{request.env['PATH_INFO']}") + end + def order_to_update return @order_to_update if defined? @order_to_update return @order_to_update = current_order unless params[:id] diff --git a/config/locales/en.yml b/config/locales/en.yml index f34706ca29..7d3ce3b831 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -2699,6 +2699,8 @@ See the %{link} to find out more about %{sitename}'s features and to start using inventory: Inventory zipcode: Postcode orders: + edit: + login_to_view_order: "Please log in to view your order." bought: item: "Already ordered in this order cycle" shipment_states: diff --git a/spec/controllers/spree/orders_controller_spec.rb b/spec/controllers/spree/orders_controller_spec.rb index 43b26a17b7..d2f2cbf8da 100644 --- a/spec/controllers/spree/orders_controller_spec.rb +++ b/spec/controllers/spree/orders_controller_spec.rb @@ -63,9 +63,14 @@ describe Spree::OrdersController, type: :controller do context "when neither checked out as an anonymous guest nor logged in" do let(:current_user) { nil } + before do + request.env["PATH_INFO"] = spree.order_path(order) + end + it "redirects to unauthorized" do spree_get :show, id: order.number - expect(response.status).to eq(401) + expect(response).to redirect_to(root_path(anchor: "login?after_login=#{spree.order_path(order)}")) + expect(flash[:error]).to eq("Please log in to view your order.") end end end diff --git a/spec/features/consumer/shopping/orders_spec.rb b/spec/features/consumer/shopping/orders_spec.rb index f4b78ff752..4f0adfe772 100644 --- a/spec/features/consumer/shopping/orders_spec.rb +++ b/spec/features/consumer/shopping/orders_spec.rb @@ -69,9 +69,14 @@ feature "Order Management", js: true do context "when not logged in" do let(:user) { create(:user) } - it "does not allow the user to see order details" do + it "allows the user to see order details after login" do + # Cannot load the page without signing in visit spree.order_path(order) expect(page).to_not be_confirmed_order_page + + # Can load the page after signing in + fill_in_and_submit_login_form user + expect(page).to be_confirmed_order_page end end end diff --git a/spec/support/request/authentication_workflow.rb b/spec/support/request/authentication_workflow.rb index 5d3181ea4f..7645db0012 100644 --- a/spec/support/request/authentication_workflow.rb +++ b/spec/support/request/authentication_workflow.rb @@ -54,9 +54,13 @@ module AuthenticationWorkflow user.spree_roles << user_role visit spree.login_path - fill_in 'email', :with => 'someone@ofn.org' - fill_in 'password', :with => 'passw0rd' - click_button 'Login' + fill_in_and_submit_login_form user + end + + def fill_in_and_submit_login_form(user) + fill_in "email", with: user.email + fill_in "password", with: user.password + click_button "Login" end end