diff --git a/lib/open_food_network/permissions.rb b/lib/open_food_network/permissions.rb index b917d1fc7d..aa47fef16a 100644 --- a/lib/open_food_network/permissions.rb +++ b/lib/open_food_network/permissions.rb @@ -55,8 +55,9 @@ module OpenFoodNetwork # Find the exchanges of an order cycle that an admin can manage def order_cycle_exchanges(order_cycle) - enterprises = managed_and_related_enterprises_with :add_to_order_cycle - order_cycle.exchanges.to_enterprises(enterprises).from_enterprises(enterprises) + ids = order_cycle_exchange_ids_involving_my_enterprises(order_cycle) + + Exchange.where(id: ids, order_cycle_id: order_cycle) end def managed_products @@ -103,5 +104,10 @@ module OpenFoodNetwork def related_enterprise_products Spree::Product.where('supplier_id IN (?)', related_enterprises_with(:manage_products)) end + + def order_cycle_exchange_ids_involving_my_enterprises(order_cycle) + # Any exchanges that my managed enterprises are involved in directly + order_cycle.exchanges.involving(managed_enterprises).pluck :id + end end end diff --git a/spec/lib/open_food_network/permissions_spec.rb b/spec/lib/open_food_network/permissions_spec.rb index f28956d34b..4c2c34a5f1 100644 --- a/spec/lib/open_food_network/permissions_spec.rb +++ b/spec/lib/open_food_network/permissions_spec.rb @@ -122,19 +122,19 @@ module OpenFoodNetwork permissions.order_cycle_exchanges(oc).should == [ex] end - it "returns exchanges involving enterprises with E2E permission" do + it "does not return exchanges involving enterprises with E2E permission" do permissions.stub(:related_enterprises_with) { Enterprise.where(id: [e1, e2]) } + permissions.order_cycle_exchanges(oc).should == [] + end + + it "returns exchanges involving only the sender" do + permissions.stub(:managed_enterprises) { Enterprise.where(id: [e1]) } permissions.order_cycle_exchanges(oc).should == [ex] end - it "does not return exchanges involving only the sender" do - permissions.stub(:managed_enterprises) { Enterprise.where(id: [e1]) } - permissions.order_cycle_exchanges(oc).should == [] - end - - it "does not return exchanges involving only the receiver" do + it "returns exchanges involving only the receiver" do permissions.stub(:managed_enterprises) { Enterprise.where(id: [e2]) } - permissions.order_cycle_exchanges(oc).should == [] + permissions.order_cycle_exchanges(oc).should == [ex] end end