Commit Graph

17478 Commits

Author SHA1 Message Date
David Rodríguez
e32dcd53b5 Pass media attribute explicitly to stylesheet link tags
So that we can enable Rails default behavior for potential future such link
tags without changing current behavior.
2025-11-25 08:08:59 +01:00
Maikel
dc13ef4162 Merge pull request #13743 from deivid-rodriguez/bump-prettier
Bump prettier and let Dependabot handle further updates
2025-11-24 12:06:19 +11:00
Maikel
dcb48272f5 Merge pull request #13746 from rioug/security-255-code-injection
[Security]  Fix potential code injection
2025-11-24 12:01:44 +11:00
Gaetan Craig-Riou
74d2a94181 Add input validation to prevent code injection
Plus spec
2025-11-23 13:46:36 +11:00
David Rodríguez
a509d49ec6 Bump prettier to 3.6.2
And fix new style issues.
2025-11-21 12:49:06 +01:00
Filipe
dddc945c42 Merge pull request #13679 from deivid-rodriguez/customer-edition
Improve `/admin/customers` form handling
2025-11-21 10:51:55 +00:00
Filipe
12c0363b7e Merge pull request #13716 from chahmedejaz/bugfix/13554-sorting-on-demand-products
"On hand" value influences sorting of "on demand" products/variants
2025-11-21 10:05:44 +00:00
Filipe
a1ee1eac4c Merge pull request #13680 from rioug/13674-enable-variant-tag-new-enterprise
[Variant tags] Enable variant tag for enterprise created after 11th of August and super admins
2025-11-17 23:05:11 +00:00
Maikel
e194ebf0f3 Merge pull request #13552 from openfoodfoundation/dependabot/npm_and_yarn/jest-30.2.0
Bump jest from 27.5.1 to 30.2.0
2025-11-17 15:21:57 +11:00
Filipe
d9e3076a3b Merge pull request #13654 from pacodelaluna/check-enterprise-image-logic
Improve enterprise images-related logic
2025-11-14 18:15:50 +00:00
Filipe
271e895486 Merge pull request #13676 from deivid-rodriguez/z-index
Fix tag rule visibility select box options hidden by save bar
2025-11-14 17:41:52 +00:00
Filipe
3e02a03312 Merge pull request #13650 from rioug/13539-update-variant-multi-producer
Fix update multi producer products
2025-11-14 16:56:16 +00:00
Ahmed Ejaz
763655f0e5 Enhance product sorting for On-Demand items and add backorderable name support 2025-11-14 06:04:32 +05:00
David Rodríguez
f6d605a3aa Dismiss success message automatically after 5 seconds
We were already eventually removing the "success" border style on
inputs. I think it makes sense to do the same for the success message
itself. That's how our standard "flash messages" already work.
2025-11-13 08:37:52 +01:00
David Rodríguez
6901323827 Fix success message taking 5 seconds to show up
This is pretty black magic to me, but my understanding is that:

* When submitting customer forms, we use `$q.all()` on the result of
  submitting each form asynchronously in order to decide whether to
  display a success message (no errors) or a failure message.

* The value returned for each particular form submission was the return
  value of either `change.scope.success()` or `change.scope.error()`.
  These use the `switchClass` factory, which changes a particular DOM
  element's class to the proper pending/success/error class, but in the
  success case, it also sets a timeout to remove the class using
  `$timeout()`, which is a promise, and that was its return value.

* Because of the above, `$q.all()` was actually waiting for the
  `$timeout()` promise to be fulfilled before proceeding.

The fix is to not return a `$timeout()` promise from the `switchClass`
factory when a timeout is passed, but instead set a timeout on the
element, but return the element itself regardless.
2025-11-13 08:37:52 +01:00
David Rodríguez
186fe0503f Show orange border when input has changes
Even if it's on focus.
2025-11-13 08:37:52 +01:00
David Rodríguez
e990e5ffd5 Don't show flash messages in customer edition form
They don't actually show up when the customer is saved, but the next
time the page is reloaded. We already have the save bar for the same
purpose so it's not necessary.
2025-11-13 08:37:52 +01:00
David Rodríguez
3d7207d8c5 Properly track changes in code attribute
If the code was initially nil, some value is added, and then removed, we
would not detect that the code has not actually changed.
2025-11-13 08:37:52 +01:00
David Rodríguez
278a8b1ec2 Let save-bar properly track form state
* Keep save bar visible as long as there's a customer form displayed.
* Only display "You have unsaved changes" when there's any difference
  from the original values. If form changes are reverted, hide that
  note.
* Similarly, only let the button be enabled if there are any actual
  changes to be saved.
2025-11-13 08:37:51 +01:00
Gaetan Craig-Riou
4e62e20fa8 Fix test to work with new jsdom restriction
since jsdom 21, it's no longer possible to mock window.location
See : https://github.com/jsdom/jsdom/issues/3492
2025-11-11 14:58:48 +11:00
Gaetan Craig-Riou
460d109bd2 Update product ability
A user has product permission if it is a supplier of at least one of the
product's variants
2025-11-11 11:35:19 +11:00
David Rodríguez
9645660d87 Fix tag rule visibility select box options hidden by save bar 2025-11-10 17:32:11 +01:00
Gaetan Craig-Riou
e8b81c1ff6 Fix variant filtering
We don't want to filter out variant missing producer, so that the user
can address the problem.
2025-11-10 16:29:27 +11:00
Gaetan Craig-Riou
ab443fa50f Refactor the clone template to use local variable
and add define locals on the template
2025-11-10 16:29:27 +11:00
Gaetan Craig-Riou
25d55fec24 Filter out variant the user is not allowed to update
With a product with mutiple variant, we can end in a scenario where a
user sees variant associated to producer it doesn't have permission for.
This prevents the user from updating any variant. This fix filter out
variant a user shoudn't be seeing
2025-11-10 16:29:27 +11:00
Gaetan Craig-Riou
61f8b5c7f4 Add strict locals for some products V3 templates
Rails now allows you to define which local a template is expecting:
https://edgeguides.rubyonrails.org/7_1_release_notes.html#allow-templates-to-set-strict-locals
2025-11-10 16:29:27 +11:00
Maikel
587f76415b Merge pull request #13656 from pacodelaluna/replace-alias-attribute-with-alias-method
Replace alias_attribute with alias_method
2025-11-10 11:50:33 +11:00
Gaetan Craig-Riou
0745028c06 Fix checking if variant tag is enabled
variant_tag feature check should happen per enterprise basis, but we
still want super admin to so see variant tag. To do so we check if the
user is amdin or if any of the current user enterprise has variant tag
enable.
2025-11-10 11:14:56 +11:00
Rachel Arnould
94bda6d0f8 Merge pull request #13592 from rioug/13266-tag-variant-tag-rule
[Variant tags] Add tag rules for variant
2025-11-07 14:14:50 +01:00
Filipe
95ad87d840 Merge pull request #13666 from chahmedejaz/bugfix/13519-order-disappear-from-orders-page
Order lines are deleted when one tries to capture a payment after order cycle is closed
2025-11-06 13:07:36 +00:00
Konrad
7357419f6f Merge pull request #13652 from navaneethkp36/13651-fix-button-size-order-confirmation
Make the width of "Back to Store" and "Back to Website" buttons consistent with other buttons in order confirmation page
2025-11-05 19:29:42 +01:00
David Cook
8e5fac9fb3 Merge pull request #13632 from rioug/security-247-code-injection
[security] Fix potential code injection
2025-11-05 16:34:37 +11:00
Ahmed Ejaz
913dded766 Refactor order cycle handling to simplify closed cycle checks and improve redirection messaging 2025-11-05 02:50:01 +05:00
François Turbelin
b2d7d797d9 Use wrap_parameters to handle address params on Customer v1 API 2025-11-03 11:35:39 +01:00
François Turbelin
e385b9f708 Revert "Use customer-nested params for Customer v1 API writing operations"
This reverts commit cf4cd311b3.
2025-11-03 10:32:26 +01:00
Gaetan Craig-Riou
bd0db57768 Per review, more concise code 2025-11-03 15:58:27 +11:00
Gaetan Craig-Riou
bb8ecccc31 Fix variant tag rules endpoint
It now returns tag rules filtered on the preferred variant tags and not
the prefered customer tags
2025-11-03 15:50:12 +11:00
Gaetan Craig-Riou
1a68236c3c Add variant_tag_rule ability
It's needed to allow enterprise user to get a tag autocomplete. Classic
mistake of not testing with a non superadmin user.
2025-11-03 14:25:48 +11:00
Gaetan Craig-Riou
c057bab493 Use route helpers for autocomplete url
Co-authored-by: Maikel <maikel@email.org.au>
2025-11-03 14:25:48 +11:00
Gaetan Craig-Riou
59340c7cff Per review, remove unnecessary new translation 2025-11-03 14:25:48 +11:00
Gaetan Craig-Riou
ce60335a60 Per review, fix leftover comment 2025-11-03 14:25:48 +11:00
Gaetan Craig-Riou
07a3e83dc6 Fix enterprise specs
Plus small refactor
2025-11-03 14:25:48 +11:00
Gaetan Craig-Riou
38f58b168a Fix tag rules spec
Make sure the autocomplete dropdown list is hidden by default
2025-11-03 14:25:48 +11:00
Gaetan Craig-Riou
ab194a0e80 Add styling for the dropdown
It's mostly the same styling as the AngularJs version but with updated
colors
2025-11-03 14:25:05 +11:00
Gaetan Craig-Riou
749944fc25 Rework TagListInputComponent to integrate autocomplete
The component now will try to load a list of existing tag if you give an
`autocomplete_url`. I tried to keep the tag input and the autocomplete
functionality decoupled but is wasn't really possible. Instead I opted
to sub class the Autocomplete stimulus controller, but it only gets
initialised if we pass an `autocomplete_url`.
2025-11-03 14:25:05 +11:00
Gaetan Craig-Riou
3cffc5538a Add tag filtering for tag autocomplete 2025-11-03 14:25:05 +11:00
Gaetan Craig-Riou
6d7908e1f8 Style formatting 2025-11-03 14:25:05 +11:00
Gaetan Craig-Riou
965b34318f Add new component to provide tag autocomplete for variant tag
It uses composition and inject the TagListInputComponent as a depency,
which should be more flexible that creating a sub class. This new
component could potentially be made more generic if needed
2025-11-03 14:25:05 +11:00
Gaetan Craig-Riou
3bb9eb9765 Add endpoint to provide autocomplete tag for variant
It return a list of available tags and number of related rules, based on
the given enterprise and a partial match on the given tag
2025-11-03 14:25:05 +11:00
Gaetan Craig-Riou
bd39595917 Add ability to pass option to the tag input field
And also render any content given to the component via block
2025-11-03 14:25:05 +11:00