From 8b79d41b81a1706bd4ad2487491d79e6913deeec Mon Sep 17 00:00:00 2001
From: Steve Roberts <steve@commoncode.io>
Date: Wed, 10 Jun 2020 16:29:07 +1000
Subject: [PATCH 1/6] Update orders swagger spec and fix api_key access to
 orders endpoint

---
 app/controllers/api/orders_controller.rb |  2 +-
 swagger.yaml                             | 53 +++++++++++++++++++++++-
 2 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/app/controllers/api/orders_controller.rb b/app/controllers/api/orders_controller.rb
index c011db44ec..7339af3c61 100644
--- a/app/controllers/api/orders_controller.rb
+++ b/app/controllers/api/orders_controller.rb
@@ -8,7 +8,7 @@ module Api
     def index
       authorize! :admin, Spree::Order
 
-      search_results = SearchOrders.new(params, spree_current_user)
+      search_results = SearchOrders.new(params, current_api_user)
 
       render json: {
         orders: serialized_orders(search_results.orders),
diff --git a/swagger.yaml b/swagger.yaml
index 838f09f2d4..0aed7ded9e 100644
--- a/swagger.yaml
+++ b/swagger.yaml
@@ -342,9 +342,60 @@ paths:
 
   /orders:
     get:
-      description: Gets all Orders.
+      description: Gets all Orders. Use combinations of parameters to filter your query. For example /api/orders?q[completed_at_gt]=2020_02_02&q[completed_at_lt]=2020_02_10 returns orders between 2nd and 10th February 2020.
       tags:
         - orders
+      parameters:
+        - in: query
+          name: q[distributor_id_eq]
+          schema:
+            type: string
+          style: deepObject
+          description: Query orders for a specific distributor id. 
+          required: false
+        - in: query
+          name: q[completed_at_gt]
+          schema:
+            type: string
+          style: deepObject
+          description: Query orders completed after a date. 
+          required: false
+        - in: query
+          name: q[completed_at_lt]
+          schema:
+            type: string
+          style: deepObject
+          description: Query orders completed before a date. 
+          required: false
+        - in: query
+          name: q[state_eq]
+          schema:
+            type: string
+          style: deepObject
+          description: Query orders by order state, eg 'cart', 'complete'. 
+          required: false
+        - in: query
+          name: q[payment_state_eq]
+          schema:
+            type: string
+          style: deepObject
+          description: Query orders by order payment_state, eg 'balance_due', 'paid', 'failed'. 
+          required: false
+        - in: query
+          name: q[email_cont]
+          schema:
+            type: string
+          style: deepObject
+          description: Query orders where the order email contains a string. 
+          required: false
+        - in: query
+          name: q[order_cycle_id_eq]
+          schema:
+            type: string
+          style: deepObject
+          description: Query orders for a specific order_cycle id. 
+          required: false
+
       responses:
         '200':
           description: successful operation

From 9e19d79337cb0f2f95fc3f1e7e4475e568f85987 Mon Sep 17 00:00:00 2001
From: Steve Roberts <steve@commoncode.io>
Date: Wed, 10 Jun 2020 17:05:25 +1000
Subject: [PATCH 2/6] Add more detail on the ransack based queries in the
 description

---
 swagger.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/swagger.yaml b/swagger.yaml
index 0aed7ded9e..9f4accc980 100644
--- a/swagger.yaml
+++ b/swagger.yaml
@@ -342,7 +342,10 @@ paths:
 
   /orders:
     get:
-      description: Gets all Orders. Use combinations of parameters to filter your query. For example /api/orders?q[completed_at_gt]=2020_02_02&q[completed_at_lt]=2020_02_10 returns orders between 2nd and 10th February 2020.
+      description: >
+        Gets all Orders. Use combinations of parameters to filter your query. 
+        For example /api/orders?q[completed_at_gt]=2020_02_02&q[completed_at_lt]=2020_02_10 returns orders between 2nd and 10th February 2020. 
+        Query parameters are generated for the '#/components/schemas/Order_Concise' model with [Ransack](https://github.com/activerecord-hackery/ransack#search-matchers) search matchers
       tags:
         - orders
       parameters:

From e619ae621c9b3c08bbaf1fd35095baf52dcb8edd Mon Sep 17 00:00:00 2001
From: Steve Roberts <steve@commoncode.io>
Date: Fri, 5 Jun 2020 10:15:35 +1000
Subject: [PATCH 3/6] Add rswag and coverage for orders endpoint

Add coverage for core orders endpoint queries (WIP)
---
 Gemfile                          |   3 +-
 Gemfile.lock                     |  18 ++++-
 config/initializers/rswag-ui.rb  |  14 ++++
 config/initializers/rswag_api.rb |  14 ++++
 config/routes.rb                 |   4 +
 spec/requests/api/orders_spec.rb | 130 ++++++++++++++++++++++++++++++
 spec/swagger_helper.rb           |  72 +++++++++++++++++
 swagger/v1/swagger.yaml          | 131 +++++++++++++++++++++++++++++++
 8 files changed, 384 insertions(+), 2 deletions(-)
 create mode 100644 config/initializers/rswag-ui.rb
 create mode 100644 config/initializers/rswag_api.rb
 create mode 100644 spec/requests/api/orders_spec.rb
 create mode 100644 spec/swagger_helper.rb
 create mode 100644 swagger/v1/swagger.yaml

diff --git a/Gemfile b/Gemfile
index eb3e367894..2cc566eeaa 100644
--- a/Gemfile
+++ b/Gemfile
@@ -145,6 +145,7 @@ group :test, :development do
   gem 'letter_opener', '>= 1.4.1'
   gem 'rspec-rails', ">= 3.5.2"
   gem 'rspec-retry'
+  gem 'rswag', "2.2.0"
   gem 'selenium-webdriver'
   gem 'shoulda-matchers'
   gem 'timecop'
@@ -165,7 +166,7 @@ group :development do
   gem "newrelic_rpm", "~> 3.0"
   gem "pry", "~> 0.12.0" # pry 0.13 is not compatible with pry-byebug 3.7
   gem 'pry-byebug', '~> 3.7.0' # 3.8 requires ruby 2.4
-  gem 'rubocop'
+  gem 'rubocop', '0.81'
   gem 'rubocop-rails'
   gem 'spring'
   gem 'spring-commands-rspec'
diff --git a/Gemfile.lock b/Gemfile.lock
index 02b4c3433b..77da7e9485 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -434,6 +434,8 @@ GEM
     jquery-ui-rails (4.2.1)
       railties (>= 3.2.16)
     json (1.8.6)
+    json-schema (2.8.1)
+      addressable (>= 2.4)
     json_spec (1.1.5)
       multi_json (~> 1.0)
       rspec (>= 2.0, < 4.0)
@@ -590,6 +592,19 @@ GEM
     rspec-retry (0.6.2)
       rspec-core (> 3.3)
     rspec-support (3.9.2)
+    rswag (2.2.0)
+      rswag-api (= 2.2.0)
+      rswag-specs (= 2.2.0)
+      rswag-ui (= 2.2.0)
+    rswag-api (2.2.0)
+      railties (>= 3.1, < 6.1)
+    rswag-specs (2.2.0)
+      activesupport (>= 3.1, < 6.1)
+      json-schema (~> 2.2)
+      railties (>= 3.1, < 6.1)
+    rswag-ui (2.2.0)
+      actionpack (>= 3.1, < 6.1)
+      railties (>= 3.1, < 6.1)
     rubocop (0.81.0)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
@@ -780,7 +795,8 @@ DEPENDENCIES
   roo (~> 2.8.3)
   rspec-rails (>= 3.5.2)
   rspec-retry
-  rubocop
+  rswag (= 2.2.0)
+  rubocop (= 0.81)
   rubocop-rails
   sass
   sass-rails
diff --git a/config/initializers/rswag-ui.rb b/config/initializers/rswag-ui.rb
new file mode 100644
index 0000000000..0b9a4ab179
--- /dev/null
+++ b/config/initializers/rswag-ui.rb
@@ -0,0 +1,14 @@
+Rswag::Ui.configure do |c|
+
+  # List the Swagger endpoints that you want to be documented through the swagger-ui
+  # The first parameter is the path (absolute or relative to the UI host) to the corresponding
+  # endpoint and the second is a title that will be displayed in the document selector
+  # NOTE: If you're using rspec-api to expose Swagger files (under swagger_root) as JSON or YAML endpoints,
+  # then the list below should correspond to the relative paths for those endpoints
+
+  c.swagger_endpoint '/api-docs/v1/swagger.yaml', 'API V1 Docs'
+
+  # Add Basic Auth in case your API is private
+  # c.basic_auth_enabled = true
+  # c.basic_auth_credentials 'username', 'password'
+end
diff --git a/config/initializers/rswag_api.rb b/config/initializers/rswag_api.rb
new file mode 100644
index 0000000000..5f3ddc40f1
--- /dev/null
+++ b/config/initializers/rswag_api.rb
@@ -0,0 +1,14 @@
+Rswag::Api.configure do |c|
+
+  # Specify a root folder where Swagger JSON files are located
+  # This is used by the Swagger middleware to serve requests for API descriptions
+  # NOTE: If you're using rswag-specs to generate Swagger, you'll need to ensure
+  # that it's configured to generate files in the same folder
+  c.swagger_root = Rails.root.to_s + '/swagger'
+
+  # Inject a lamda function to alter the returned Swagger prior to serialization
+  # The function will have access to the rack env for the current request
+  # For example, you could leverage this to dynamically assign the "host" property
+  #
+  #c.swagger_filter = lambda { |swagger, env| swagger['host'] = env['HTTP_HOST'] }
+end
diff --git a/config/routes.rb b/config/routes.rb
index 877ca407d3..9fcf21bef8 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -1,4 +1,8 @@
 Openfoodnetwork::Application.routes.draw do
+  mount Rswag::Ui::Engine => '/api-docs'
+
+  mount Rswag::Api::Engine => '/api-docs'
+
   root :to => 'home#index'
 
   # Redirects from old URLs avoid server errors and helps search engines
diff --git a/spec/requests/api/orders_spec.rb b/spec/requests/api/orders_spec.rb
new file mode 100644
index 0000000000..fe85260382
--- /dev/null
+++ b/spec/requests/api/orders_spec.rb
@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require 'swagger_helper'
+
+describe 'api/orders', type: :request do
+  path '/api/orders' do
+    get('list orders') do
+      tags 'Orders'
+      # type should be replaced with swagger 3.01 valid schema: {type: string} when rswag #317 is resoved:
+      # https://github.com/rswag/rswag/pull/319
+      parameter name: 'X-Spree-Token', in: :header, type: :string
+      parameter name: 'q[distributor_id_eq]', in: :query, type: :string, required: false, description: "Query orders for a specific distributor id."
+      parameter name: 'q[completed_at_gt]', in: :query, type: :string, required: false, description: "Query orders completed after a date."
+      parameter name: 'q[completed_at_lt]', in: :query, type: :string, required: false, description: "Query orders completed before a date."
+      parameter name: 'q[state_eq]', in: :query, type: :string, required: false, description: "Query orders by order state, eg 'cart', 'complete'."
+      parameter name: 'q[payment_state_eq]', in: :query, type: :string, required: false, description: "Query orders by order payment_state, eg 'balance_due', 'paid', 'failed'."
+      parameter name: 'q[email_cont]', in: :query, type: :string, required: false, description: "Query orders where the order email contains a string."
+      parameter name: 'q[order_cycle_id_eq]', in: :query, type: :string, required: false, description: "Query orders for a specific order_cycle id."
+      
+      response(200, 'get orders') do
+        # Adds model metadata for Swagger UI. Ideally we'd be able to just add:
+        # schema '$ref' => '#/components/schemas/Order_Concise'
+        # Which would also validate the response in the test, this is an open 
+        # issue with rswag: https://github.com/rswag/rswag/issues/268
+        metadata[:response][:content] = { "application/json": {
+            schema: {'$ref' => '#/components/schemas/Order_Concise'}
+          }
+        }
+        context "when there are four orders with different properties set" do
+          let(:order_dist_1) { create(:order_with_distributor, email: "specific_name@example.com") }
+          let(:order_dist_2) { create(:order_with_distributor) }
+          let(:order_dist_1_complete) { create(:order,  distributor: order_dist_1.distributor, state: 'complete', completed_at: Time.zone.today - 7.days) }
+          let(:order_dist_1_credit_owed) { create(:order,  distributor: order_dist_1.distributor, state: 'complete', payment_state: 'credit_owed', completed_at: Time.zone.today) }
+          
+          let(:user) { order_dist_1.distributor.owner }
+          let(:'X-Spree-Token') do
+            user.generate_spree_api_key!
+            user.spree_api_key
+          end
+
+          context "and there are no query parameters" do
+            
+            run_test! do |response|
+              expect(response).to have_http_status(200)
+
+              data = JSON.parse(response.body)
+              orders = data["orders"]
+              expect(orders.size).to eq 4
+            end
+          end
+
+          context "and queried by distributor id" do
+            let(:'q[distributor_id_eq]') { order_dist_2.distributor.id }
+
+            run_test! do |response|
+              expect(response).to have_http_status(200)
+
+              data = JSON.parse(response.body)
+              orders = data["orders"]
+              expect(orders.size).to eq 1
+              expect(orders.first["id"]).to eq order_dist_2.id
+            end
+          end
+
+          context "and queried within a date range" do  
+            let(:'q[completed_at_gt]') { Time.zone.today - 7.days - 1.second }
+            let(:'q[completed_at_lt]') { Time.zone.today - 6.days }
+
+            run_test! do |response|
+              expect(response).to have_http_status(200)
+
+              data = JSON.parse(response.body)
+              orders = data["orders"]
+              expect(orders.size).to eq 1
+              expect(orders.first["id"]).to eq order_dist_1_complete.id
+            end
+          end
+          
+          context "and queried by complete state" do
+            let(:'q[state_eq]') { "complete" }
+            run_test! do |response|
+              expect(response).to have_http_status(200)
+
+              data = JSON.parse(response.body)
+              orders = data["orders"]
+              expect(orders.size).to eq 1
+              expect(orders.first["id"]).to eq order_dist_1_complete.id
+            end
+          end
+
+          context "and queried by credit_owed payment_state" do
+            let(:'q[payment_state_eq]') { "credit_owed" }
+            run_test! do |response|
+              expect(response).to have_http_status(200)
+
+              data = JSON.parse(response.body)
+              orders = data["orders"]
+              expect(orders.size).to eq 1
+              expect(orders.first["id"]).to eq order_dist_1_credit_owed.id
+            end
+          end
+
+          context "and queried by buyer email contains a specific string" do
+            let(:'q[email_cont]') { order_dist_1.email.split("@").first }
+            run_test! do |response|
+              expect(response).to have_http_status(200)
+
+              data = JSON.parse(response.body)
+              orders = data["orders"]
+              expect(orders.size).to eq 1
+              expect(orders.first["id"]).to eq order_dist_1_credit_owed.id
+            end
+          end
+          
+          context "and queried by a specific order_cycle" do
+            let(:'q[order_cycle_id_eq]') { order_dist_2.order_cycle.id }
+            run_test! do |response|
+              expect(response).to have_http_status(200)
+
+              data = JSON.parse(response.body)
+              orders = data["orders"]
+              expect(orders.size).to eq 1
+              expect(orders.first["id"]).to eq order_dist_2.id
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/spec/swagger_helper.rb b/spec/swagger_helper.rb
new file mode 100644
index 0000000000..cca08655f6
--- /dev/null
+++ b/spec/swagger_helper.rb
@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.configure do |config|
+  config.swagger_root = Rails.root.join('swagger').to_s
+  config.swagger_docs = {
+    'v1/swagger.yaml' => {
+      openapi: '3.0.1',
+      info: {
+        title: 'The Open Food Network',
+        description: 'Some endpoints are public and require no authorization; others require authorization. Talk to us to get your credentials set up. Check out our repo! https://github.com/openfoodfoundation/openfoodnetwork',
+        version: '0.1',
+      },
+      components: {
+        securitySchemes: {
+          api_key: {
+              type: :apiKey,
+              name: 'X-Spree-Token',
+              in: :header
+          }
+        },
+        schemas: {
+          Order_Concise: {
+            type: 'object',
+            properties: {
+              id: { type: 'integer' },
+              number: { type: 'string' },
+              full_name: { type: 'string' },
+              email: { type: 'string' },
+              phone: { type: 'string' },
+              completed_at: { type: 'string' },
+              display_total: { type: 'string' },
+              show_path: { type: 'string' },
+              edit_path: { type: 'string' },
+              state: { type: 'string' },
+              payment_state: { type: 'string' },
+              shipment_state: { type: 'string' },
+              payments_path: { type: 'string' },
+              shipments_path: { type: 'string' },
+              ship_path: { type: 'string' },
+              ready_to_ship: { type: 'string' },
+              created_at: { type: 'string' },
+              distributor_name: { type: 'string' },
+              special_instructions: { type: 'string' },
+              payment_capture_path: { type: 'string' },
+              distributor: {
+                type: 'object',
+                properties: {
+                  id: { type: 'integer' }
+                }
+              },
+              order_cycle: {
+                type: 'object',
+                properties: {
+                  id: { type: 'integer' }
+                }
+              }
+            }
+          }
+        }
+      },
+      paths: {},
+      servers: [
+        {
+          url: 'https://staging.katuma.org/api'
+        }
+      ]
+    }
+  }
+  config.swagger_format = :yaml
+end
diff --git a/swagger/v1/swagger.yaml b/swagger/v1/swagger.yaml
new file mode 100644
index 0000000000..739e210e86
--- /dev/null
+++ b/swagger/v1/swagger.yaml
@@ -0,0 +1,131 @@
+---
+openapi: 3.0.1
+info:
+  title: The Open Food Network
+  description: Some endpoints are public and require no authorization; others require
+    authorization. Talk to us to get your credentials set up. Check out our repo!
+    https://github.com/openfoodfoundation/openfoodnetwork
+  version: '0.1'
+components:
+  securitySchemes:
+    api_key:
+      type: apiKey
+      name: X-Spree-Token
+      in: header
+  schemas:
+    Order_Concise:
+      type: object
+      properties:
+        id:
+          type: integer
+        number:
+          type: string
+        full_name:
+          type: string
+        email:
+          type: string
+        phone:
+          type: string
+        completed_at:
+          type: string
+        display_total:
+          type: string
+        show_path:
+          type: string
+        edit_path:
+          type: string
+        state:
+          type: string
+        payment_state:
+          type: string
+        shipment_state:
+          type: string
+        payments_path:
+          type: string
+        shipments_path:
+          type: string
+        ship_path:
+          type: string
+        ready_to_ship:
+          type: string
+        created_at:
+          type: string
+        distributor_name:
+          type: string
+        special_instructions:
+          type: string
+        payment_capture_path:
+          type: string
+        distributor:
+          type: object
+          properties:
+            id:
+              type: integer
+        order_cycle:
+          type: object
+          properties:
+            id:
+              type: integer
+paths:
+  "/api/orders":
+    get:
+      summary: list orders
+      tags:
+      - Orders
+      parameters:
+      - name: X-Spree-Token
+        in: header
+        schema:
+          type: string
+      - name: q[distributor_id_eq]
+        in: query
+        schema:
+          type: string
+        style: deepObject
+        description: Query orders for a specific distributor id.
+      - name: q[completed_at_gt]
+        in: query
+        schema:
+          type: string
+        style: deepObject
+        description: Query orders completed after a date.
+      - name: q[completed_at_lt]
+        in: query
+        schema:
+          type: string
+        style: deepObject
+        description: Query orders completed before a date.
+      - name: q[state_eq]
+        in: query
+        schema:
+          type: string
+        style: deepObject
+        description: Query orders by order state, eg 'cart', 'complete'.
+      - name: q[payment_state_eq]
+        in: query
+        schema:
+          type: string
+        style: deepObject
+        description: Query orders by order payment_state, eg 'balance_due', 'paid',
+          'failed'.
+      - name: q[email_cont]
+        in: query
+        schema:
+          type: string
+        style: deepObject
+        description: Query orders where the order email contains a string.
+      - name: q[order_cycle_id_eq]
+        in: query
+        schema:
+          type: string
+        style: deepObject
+        description: Query orders for a specific order_cycle id.
+      responses:
+        '200':
+          description: get orders
+          content:
+            application/json:
+              schema:
+                "$ref": "#/components/schemas/Order_Concise"
+servers:
+- url: https://staging.katuma.org/api

From b59dbebba6b40a55d479124baacf670a68e1338f Mon Sep 17 00:00:00 2001
From: Steve Roberts <steve@commoncode.io>
Date: Wed, 17 Jun 2020 12:42:39 +1000
Subject: [PATCH 4/6] Revert Gemfile change to specific version of rubocop

Turns out it wasn't necessary. I thought it was needed to install a compatible version of rswag
---
 Gemfile      | 4 ++--
 Gemfile.lock | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Gemfile b/Gemfile
index 2cc566eeaa..cba7513c0a 100644
--- a/Gemfile
+++ b/Gemfile
@@ -145,7 +145,7 @@ group :test, :development do
   gem 'letter_opener', '>= 1.4.1'
   gem 'rspec-rails', ">= 3.5.2"
   gem 'rspec-retry'
-  gem 'rswag', "2.2.0"
+  gem 'rswag'
   gem 'selenium-webdriver'
   gem 'shoulda-matchers'
   gem 'timecop'
@@ -166,7 +166,7 @@ group :development do
   gem "newrelic_rpm", "~> 3.0"
   gem "pry", "~> 0.12.0" # pry 0.13 is not compatible with pry-byebug 3.7
   gem 'pry-byebug', '~> 3.7.0' # 3.8 requires ruby 2.4
-  gem 'rubocop', '0.81'
+  gem 'rubocop'
   gem 'rubocop-rails'
   gem 'spring'
   gem 'spring-commands-rspec'
diff --git a/Gemfile.lock b/Gemfile.lock
index 77da7e9485..d156e3c981 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -795,8 +795,8 @@ DEPENDENCIES
   roo (~> 2.8.3)
   rspec-rails (>= 3.5.2)
   rspec-retry
-  rswag (= 2.2.0)
-  rubocop (= 0.81)
+  rswag
+  rubocop
   rubocop-rails
   sass
   sass-rails

From 9541dbf49524bd5228a5c59c9592c0c140aa6e2b Mon Sep 17 00:00:00 2001
From: Steve Roberts <steve@commoncode.io>
Date: Wed, 24 Jun 2020 15:15:18 +1000
Subject: [PATCH 5/6] Fix order api spec and add incomplete generated
 swagger.yml

---
 spec/requests/api/orders_spec.rb | 33 ++++++++++++++---------
 spec/swagger_helper.rb           |  4 ++-
 swagger/v1/swagger.yaml          | 45 ++++++++++++++------------------
 3 files changed, 42 insertions(+), 40 deletions(-)

diff --git a/spec/requests/api/orders_spec.rb b/spec/requests/api/orders_spec.rb
index fe85260382..b282b4045a 100644
--- a/spec/requests/api/orders_spec.rb
+++ b/spec/requests/api/orders_spec.rb
@@ -6,7 +6,7 @@ describe 'api/orders', type: :request do
   path '/api/orders' do
     get('list orders') do
       tags 'Orders'
-      # type should be replaced with swagger 3.01 valid schema: {type: string} when rswag #317 is resoved:
+      # type should be replaced with swagger 3.01 valid schema: {type: string} when rswag #317 is resolved:
       # https://github.com/rswag/rswag/pull/319
       parameter name: 'X-Spree-Token', in: :header, type: :string
       parameter name: 'q[distributor_id_eq]', in: :query, type: :string, required: false, description: "Query orders for a specific distributor id."
@@ -16,22 +16,23 @@ describe 'api/orders', type: :request do
       parameter name: 'q[payment_state_eq]', in: :query, type: :string, required: false, description: "Query orders by order payment_state, eg 'balance_due', 'paid', 'failed'."
       parameter name: 'q[email_cont]', in: :query, type: :string, required: false, description: "Query orders where the order email contains a string."
       parameter name: 'q[order_cycle_id_eq]', in: :query, type: :string, required: false, description: "Query orders for a specific order_cycle id."
-      
+
       response(200, 'get orders') do
         # Adds model metadata for Swagger UI. Ideally we'd be able to just add:
         # schema '$ref' => '#/components/schemas/Order_Concise'
         # Which would also validate the response in the test, this is an open 
         # issue with rswag: https://github.com/rswag/rswag/issues/268
-        metadata[:response][:content] = { "application/json": {
+        metadata[:response][:content] = { 
+          "application/json": {
             schema: {'$ref' => '#/components/schemas/Order_Concise'}
           }
         }
         context "when there are four orders with different properties set" do
-          let(:order_dist_1) { create(:order_with_distributor, email: "specific_name@example.com") }
-          let(:order_dist_2) { create(:order_with_distributor) }
-          let(:order_dist_1_complete) { create(:order,  distributor: order_dist_1.distributor, state: 'complete', completed_at: Time.zone.today - 7.days) }
-          let(:order_dist_1_credit_owed) { create(:order,  distributor: order_dist_1.distributor, state: 'complete', payment_state: 'credit_owed', completed_at: Time.zone.today) }
-          
+          let!(:order_dist_1) { create(:order_with_distributor, email: "specific_name@example.com") }
+          let!(:order_dist_2) { create(:order_with_totals_and_distribution) }
+          let!(:order_dist_1_complete) { create(:order,  distributor: order_dist_1.distributor, state: 'complete', completed_at: Time.zone.today - 7.days) }
+          let!(:order_dist_1_credit_owed) { create(:order,  distributor: order_dist_1.distributor, payment_state: 'credit_owed', completed_at: Time.zone.today) }
+
           let(:user) { order_dist_1.distributor.owner }
           let(:'X-Spree-Token') do
             user.generate_spree_api_key!
@@ -39,7 +40,6 @@ describe 'api/orders', type: :request do
           end
 
           context "and there are no query parameters" do
-            
             run_test! do |response|
               expect(response).to have_http_status(200)
 
@@ -52,6 +52,8 @@ describe 'api/orders', type: :request do
           context "and queried by distributor id" do
             let(:'q[distributor_id_eq]') { order_dist_2.distributor.id }
 
+            before { order_dist_2.distributor.update_attributes owner: user }
+
             run_test! do |response|
               expect(response).to have_http_status(200)
 
@@ -75,7 +77,7 @@ describe 'api/orders', type: :request do
               expect(orders.first["id"]).to eq order_dist_1_complete.id
             end
           end
-          
+
           context "and queried by complete state" do
             let(:'q[state_eq]') { "complete" }
             run_test! do |response|
@@ -108,12 +110,17 @@ describe 'api/orders', type: :request do
               data = JSON.parse(response.body)
               orders = data["orders"]
               expect(orders.size).to eq 1
-              expect(orders.first["id"]).to eq order_dist_1_credit_owed.id
+              expect(orders.first["id"]).to eq order_dist_1.id
             end
           end
-          
+
           context "and queried by a specific order_cycle" do
-            let(:'q[order_cycle_id_eq]') { order_dist_2.order_cycle.id }
+            let(:'q[order_cycle_id_eq]') {
+              order_dist_2.order_cycle.id 
+            }
+
+            before { order_dist_2.distributor.update_attributes owner: user }
+
             run_test! do |response|
               expect(response).to have_http_status(200)
 
diff --git a/spec/swagger_helper.rb b/spec/swagger_helper.rb
index cca08655f6..0bf64f9ced 100644
--- a/spec/swagger_helper.rb
+++ b/spec/swagger_helper.rb
@@ -9,7 +9,9 @@ RSpec.configure do |config|
       openapi: '3.0.1',
       info: {
         title: 'The Open Food Network',
-        description: 'Some endpoints are public and require no authorization; others require authorization. Talk to us to get your credentials set up. Check out our repo! https://github.com/openfoodfoundation/openfoodnetwork',
+        description: 'This spec is auto generated using the rswag gem. It is incomplete and not yet valid for openapi 3.0.1. Do not publish this. \
+Some endpoints are public and require no authorization; others require authorization. Talk to us to get your credentials set up. \
+Check out our repo! https://github.com/openfoodfoundation/openfoodnetwork',
         version: '0.1',
       },
       components: {
diff --git a/swagger/v1/swagger.yaml b/swagger/v1/swagger.yaml
index 739e210e86..88d54ed960 100644
--- a/swagger/v1/swagger.yaml
+++ b/swagger/v1/swagger.yaml
@@ -2,9 +2,10 @@
 openapi: 3.0.1
 info:
   title: The Open Food Network
-  description: Some endpoints are public and require no authorization; others require
-    authorization. Talk to us to get your credentials set up. Check out our repo!
-    https://github.com/openfoodfoundation/openfoodnetwork
+  description: |-
+    This spec is auto generated using the rswag gem. It is incomplete and not yet valid for openapi 3.0.1. Do not publish this. \
+    Some endpoints are public and require no authorization; others require authorization. Talk to us to get your credentials set up. \
+    Check out our repo! https://github.com/openfoodfoundation/openfoodnetwork
   version: '0.1'
 components:
   securitySchemes:
@@ -75,50 +76,42 @@ paths:
       parameters:
       - name: X-Spree-Token
         in: header
-        schema:
-          type: string
+        type: string
       - name: q[distributor_id_eq]
         in: query
-        schema:
-          type: string
-        style: deepObject
+        type: string
+        required: false
         description: Query orders for a specific distributor id.
       - name: q[completed_at_gt]
         in: query
-        schema:
-          type: string
-        style: deepObject
+        type: string
+        required: false
         description: Query orders completed after a date.
       - name: q[completed_at_lt]
         in: query
-        schema:
-          type: string
-        style: deepObject
+        type: string
+        required: false
         description: Query orders completed before a date.
       - name: q[state_eq]
         in: query
-        schema:
-          type: string
-        style: deepObject
+        type: string
+        required: false
         description: Query orders by order state, eg 'cart', 'complete'.
       - name: q[payment_state_eq]
         in: query
-        schema:
-          type: string
-        style: deepObject
+        type: string
+        required: false
         description: Query orders by order payment_state, eg 'balance_due', 'paid',
           'failed'.
       - name: q[email_cont]
         in: query
-        schema:
-          type: string
-        style: deepObject
+        type: string
+        required: false
         description: Query orders where the order email contains a string.
       - name: q[order_cycle_id_eq]
         in: query
-        schema:
-          type: string
-        style: deepObject
+        type: string
+        required: false
         description: Query orders for a specific order_cycle id.
       responses:
         '200':

From 3d2a0d4d6764765a7258c4dba60c1d91e50a4041 Mon Sep 17 00:00:00 2001
From: Steve Roberts <steve@commoncode.io>
Date: Wed, 24 Jun 2020 15:51:08 +1000
Subject: [PATCH 6/6] Remove UI and API engine as we will not host the swagger
 spec right now

---
 config/initializers/rswag-ui.rb  | 14 --------------
 config/initializers/rswag_api.rb | 14 --------------
 config/routes.rb                 |  3 ---
 3 files changed, 31 deletions(-)
 delete mode 100644 config/initializers/rswag-ui.rb
 delete mode 100644 config/initializers/rswag_api.rb

diff --git a/config/initializers/rswag-ui.rb b/config/initializers/rswag-ui.rb
deleted file mode 100644
index 0b9a4ab179..0000000000
--- a/config/initializers/rswag-ui.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-Rswag::Ui.configure do |c|
-
-  # List the Swagger endpoints that you want to be documented through the swagger-ui
-  # The first parameter is the path (absolute or relative to the UI host) to the corresponding
-  # endpoint and the second is a title that will be displayed in the document selector
-  # NOTE: If you're using rspec-api to expose Swagger files (under swagger_root) as JSON or YAML endpoints,
-  # then the list below should correspond to the relative paths for those endpoints
-
-  c.swagger_endpoint '/api-docs/v1/swagger.yaml', 'API V1 Docs'
-
-  # Add Basic Auth in case your API is private
-  # c.basic_auth_enabled = true
-  # c.basic_auth_credentials 'username', 'password'
-end
diff --git a/config/initializers/rswag_api.rb b/config/initializers/rswag_api.rb
deleted file mode 100644
index 5f3ddc40f1..0000000000
--- a/config/initializers/rswag_api.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-Rswag::Api.configure do |c|
-
-  # Specify a root folder where Swagger JSON files are located
-  # This is used by the Swagger middleware to serve requests for API descriptions
-  # NOTE: If you're using rswag-specs to generate Swagger, you'll need to ensure
-  # that it's configured to generate files in the same folder
-  c.swagger_root = Rails.root.to_s + '/swagger'
-
-  # Inject a lamda function to alter the returned Swagger prior to serialization
-  # The function will have access to the rack env for the current request
-  # For example, you could leverage this to dynamically assign the "host" property
-  #
-  #c.swagger_filter = lambda { |swagger, env| swagger['host'] = env['HTTP_HOST'] }
-end
diff --git a/config/routes.rb b/config/routes.rb
index 9fcf21bef8..ef3380ea79 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -1,7 +1,4 @@
 Openfoodnetwork::Application.routes.draw do
-  mount Rswag::Ui::Engine => '/api-docs'
-
-  mount Rswag::Api::Engine => '/api-docs'
 
   root :to => 'home#index'