Show bought items only if changes are allowed

An enterprise can decide to allow changes to orders in open order
cycles. The items of these orders are then displayed in the shopping
cart and can be removed on the cart edit page.

app/helpers/enterprises_helper.rb

@@ -88,4 +88,8 @@ module EnterprisesHelper
   def remaining_trial_days(enterprise)
     distance_of_time_in_words(Time.zone.now, enterprise.shop_trial_start_date + Spree::Config[:shop_trial_length_days].days)
   end
+
+  def show_bought_items?
+    current_order.andand.distributor.andand.allow_order_changes? && current_order.finalised_line_items.present?
+  end
 end

app/models/spree/ability_decorator.rb

@@ -53,7 +53,7 @@ class AbilityDecorator
 
   def add_shopping_abilities(user)
     can [:destroy], Spree::LineItem do |item|
-      item.andand.order.andand.order_cycle.andand.open? && item.order.user_id == user.id
+      item.andand.order.andand.can_remove_items? user
     end
   end
 

app/models/spree/order_decorator.rb

@@ -270,6 +270,10 @@ Spree::Order.class_eval do
     Delayed::Job.enqueue ConfirmOrderJob.new(id) unless account_invoice?
   end
 
+  def can_remove_items?(user)
+    user_id == user.id && distributor.andand.allow_order_changes? && order_cycle.andand.open?
+  end
+
   private
 
   def shipping_address_from_distributor

app/views/shared/menu/_cart.html.haml

@@ -48,23 +48,24 @@
           = "{{ Cart.dirty ? '#{t(:cart_updating)}' : (Cart.empty() ? '#{t(:cart_empty)}' : '#{t(:cart_edit)}' ) }}"
         %a.button.primary.tiny{href: checkout_path, "ng-disabled" => "Cart.dirty || Cart.empty()"}
           = t 'checkout'
-      %h5{"ng-if" => "Cart.line_items_finalised().length", style: 'margin-top: 1em'}
-        = t '.already_ordered_products'
-      %table
-        %tr.product-cart{"ng-repeat" => "line_item in Cart.line_items_finalised()",
-        "id" => "cart-variant-{{ line_item.variant.id }}"}
-          %td
-            %small
-              %strong
-                {{ line_item.variant.extended_name }}
-          %td.text-right
-            %small
-              %span.quantity {{ line_item.quantity }}
-              %i.ofn-i_009-close
-              %span.price {{ line_item.variant.price_with_fees | localizeCurrency }}
+      - if show_bought_items?
+        %h5{"ng-if" => "Cart.line_items_finalised().length", style: 'margin-top: 1em'}
+          = t '.already_ordered_products'
+        %table
+          %tr.product-cart{"ng-repeat" => "line_item in Cart.line_items_finalised()",
+          "id" => "cart-variant-{{ line_item.variant.id }}"}
+            %td
+              %small
+                %strong
+                  {{ line_item.variant.extended_name }}
+            %td.text-right
+              %small
+                %span.quantity {{ line_item.quantity }}
+                %i.ofn-i_009-close
+                %span.price {{ line_item.variant.price_with_fees | localizeCurrency }}
 
-          %td
-            %small
-              \=
-              %strong
-                .total-price.right {{ line_item.total_price | localizeCurrency }}
+            %td
+              %small
+                \=
+                %strong
+                  .total-price.right {{ line_item.total_price | localizeCurrency }}

app/views/spree/orders/edit.html.haml

@@ -44,6 +44,6 @@
                 = t :orders_edit_checkout
                 %i.ofn-i_007-caret-right
 
-    = render 'bought' if @order.finalised_line_items.present?
+    = render 'bought' if show_bought_items?
 
 = render partial: "shared/footer"

spec/controllers/line_items_controller_spec.rb

@@ -4,10 +4,18 @@ describe LineItemsController do
   let(:item) { create(:line_item) }
   let(:item_with_oc) do
     order_cycle = create(:simple_order_cycle)
+    distributor = create(:distributor_enterprise)
     item.order.order_cycle = order_cycle
+    item.order.distributor = distributor
     item.order.save
     item
   end
+  let(:distributor) do
+    distributor = create(:distributor_enterprise)
+    item.order.distributor = distributor
+    item.order.save
+    distributor
+  end
 
   it "fails without line item id" do
     expect { delete :destroy }.to raise_error
@@ -16,22 +24,33 @@ describe LineItemsController do
   it "denies deletion without order cycle" do
     request = { format: :json, id: item }
     delete :destroy, request
-    expect(response.status).to be 403
+    expect(response.status).to eq 403
     expect { item.reload }.to_not raise_error
   end
 
   it "denies deletion without user" do
     request = { format: :json, id: item_with_oc }
     delete :destroy, request
-    expect(response.status).to be 403
+    expect(response.status).to eq 403
     expect { item.reload }.to_not raise_error
   end
 
-  it "deletes the line item" do
+  it "denies deletion if editing is not allowed" do
     controller.stub spree_current_user: item.order.user
     request = { format: :json, id: item_with_oc }
     delete :destroy, request
-    expect(response.status).to be 204
+    expect(response.status).to eq 403
+    expect { item.reload }.to_not raise_error
+  end
+
+  it "deletes the line item if allowed" do
+    controller.stub spree_current_user: item.order.user
+    distributor = item_with_oc.order.distributor
+    distributor.allow_order_changes = true
+    distributor.save
+    request = { format: :json, id: item_with_oc }
+    delete :destroy, request
+    expect(response.status).to eq 204
     expect { item.reload }.to raise_error
   end
 end

spec/features/consumer/shopping/cart_spec.rb

@@ -94,6 +94,8 @@ feature "full-page cart", js: true do
       before do
         order.user = user
         order.save
+        order.distributor.allow_order_changes = true
+        order.distributor.save
         add_product_to_cart order, product_tax
         quick_login_as user
         visit spree.cart_path