Merge pull request #4714 from luisramos0/fix_permissions_load_problem

Add require to fix loading issue. Some other Permissions module was being loaded

.github/ISSUE_TEMPLATE.md

@@ -1,66 +0,0 @@
-<!-- Provide a general summary of the issue in the Title above.
-
-If your issue is not a bug, please use the Feature template instead:
-https://github.com/openfoodfoundation/openfoodnetwork/wiki/Feature-template
-
--->
-## Description
-<!-- Provide a more detailed introduction to the issue itself, and why you consider it to be a bug -->
-
-
-
-## Expected Behavior
-<!-- Tell us what should happen -->
-
-
-
-## Actual Behavior
-<!-- Tell us what happens instead -->
-
-
-
-## Steps to Reproduce
-<!-- Provide an unambiguous set of steps to reproduce this bug -->
-<!-- Include code to reproduce if relevant -->
-
-1.
-2.
-3.
-4.
-
-## Animated Gif/Screenshot
-<!-- Provide a screenshot or brief animated gif reproducing the bug. Linux users can use
-[Peek](https://github.com/phw/peek#ubuntu) while Mac users can use [Recordit](http://recordit.co/) -->
-
-
-
-## Context
-<!-- How has this bug affected you? What were you trying to accomplish? -->
-
-
-
-## Severity
-<!-- Assign a label and explain the impact.
-
-bug-s1: a critical feature is broken: checkout, payments, signup, login
-bug-s2: a non-critical feature is broken, no workaround
-bug-s3: a feature is broken but there is a workaround
-bug-s4: it's annoying, but you can use it
-bug-s5: we can live with it, only a few users impacted
-
-https://github.com/openfoodfoundation/openfoodnetwork/wiki/Bug-severity
--->
-
-
-
-## Your Environment
-<!-- Include relevant details about the environment you experienced the bug in -->
-
-* Version used:
-* Browser name and version:
-* Operating System and version (desktop or mobile):
-
-## Possible Fix
-<!-- Not obligatory, but suggest a fix or reason for the bug -->
-
-

.github/ISSUE_TEMPLATE/bug_report.md

@@ -9,6 +9,7 @@ assignees: ''
 
 ## Description
 <!-- Provide a more detailed introduction to the issue itself, and why you consider it to be a bug -->
+<!-- How has this bug affected you? What were you trying to accomplish? -->
 
 
 ## Expected Behavior
@@ -22,6 +23,8 @@ assignees: ''
 ## Steps to Reproduce
 <!-- Provide an unambiguous set of steps to reproduce this bug -->
 <!-- Include code to reproduce if relevant -->
+<!-- Include links -->
+<!-- Include user ID -->
 
 1.
 2.
@@ -29,13 +32,11 @@ assignees: ''
 4.
 
 ## Animated Gif/Screenshot
-<!-- Provide a screenshot or brief animated gif reproducing the bug. Linux users can use
-[Peek](https://github.com/phw/peek#ubuntu) while Mac users can use [Recordit](http://recordit.co/) -->
-
-
-## Context
-<!-- How has this bug affected you? What were you trying to accomplish? -->
+<!-- Provide a screenshot or brief video reproducing the bug.  -->
+<!-- Please try to have the dev tools opened on the network tab (press F12 to open the devtools of your browser -->
 
+## Workaround
+<!-- Include a workaround for this bug (if relevant) -->
 
 ## Severity
 <!-- Assign a label and explain the impact.
@@ -55,7 +56,6 @@ https://github.com/openfoodfoundation/openfoodnetwork/wiki/Bug-severity
 * Version used:
 * Browser name and version:
 * Operating System and version (desktop or mobile):
-* OFN Platform instance where you discovered the bug, and which version of the software they are using. 
 
 ## Possible Fix
 <!-- Not obligatory, but suggest a fix or reason for the bug -->

.github/ISSUE_TEMPLATE/release.md

@@ -0,0 +1,19 @@
+---
+name: Release task
+about: Track the process of a new release
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+Steps: 
+
+- [ ] Include translations
+- [ ] Draft: https://github.com/openfoodfoundation/openfoodnetwork/releases/new <!-- replace the URL -->
+- [ ] Test: https://semaphoreci.com/openfoodfoundation/openfoodnetwork-2/branches/master <!-- replace the URL -->
+- [ ] Publish and notify #global-community
+- [ ] Deploy and notify #instance-managers
+- [ ] Nudge next release manager
+
+The full process is described at https://github.com/openfoodfoundation/openfoodnetwork/wiki/Releasing.

.github/ISSUE_TEMPLATE/story-template.md

@@ -14,5 +14,12 @@ assignees: ''
 **- I want to be able to do:** (specify the desired behavior)
 (Link to others issues or resources to provide context > only if really necessary). -->
 
-## Acceptance Criteria
-<!-- Document the outcomes that need to be achieved before this component can be considered complete. -->
+## Acceptance Criteria & Tests
+<!-- Document the outcomes that need to be achieved before this component can be considered complete.
+ -->
+<!-- Provide an unambiguous set of steps a tester should do to validate the PR that will solve this issue -->
+
+1.
+2. 
+3. 
+4.

.rubocop.yml

@@ -4,6 +4,7 @@
 #
 # The configuration is split into three files. Look into those files for more details.
 #
+require: rubocop-rails
 inherit_from:
 
   # The automatically generated todo list to ignore all current violations.

.rubocop_manual_todo.yml

@@ -14,53 +14,43 @@
 #     rubocop > rubo.log
 #     # inspect log file to see which cops are failing
 #     # copy cop configurations and add Exclude parameter
-#     grep ExampleCop rubo.log | cut -d ":" -f 1 | sort -u >> .rubocop.yml
-#     # use vim to add `- ` before each line
+#     grep ExampleCop rubo.log | cut -d ":" -f 1 | sort -u | while read f; do echo "  - $f"; done >> .rubocop.yml
 #
 # This process probably doesn't need repeating. Otherwise there is plenty
 # of room for improvements and automation.
-Metrics/LineLength:
+Layout/LineLength:
   Max: 100
   Exclude:
   - Gemfile
   - app/controllers/admin/bulk_line_items_controller.rb
   - app/controllers/admin/contents_controller.rb
   - app/controllers/admin/customers_controller.rb
-  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/enterprise_fees_controller.rb
   - app/controllers/admin/enterprise_groups_controller.rb
   - app/controllers/admin/enterprise_relationships_controller.rb
   - app/controllers/admin/enterprise_roles_controller.rb
+  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/inventory_items_controller.rb
   - app/controllers/admin/manager_invitations_controller.rb
-  - app/controllers/admin/order_cycles_controller.rb
   - app/controllers/admin/product_import_controller.rb
   - app/controllers/admin/proxy_orders_controller.rb
   - app/controllers/admin/schedules_controller.rb
   - app/controllers/admin/subscriptions_controller.rb
   - app/controllers/admin/variant_overrides_controller.rb
   - app/controllers/api/enterprise_attachment_controller.rb
-  - app/controllers/api/order_cycles_controller.rb
   - app/controllers/api/product_images_controller.rb
   - app/controllers/application_controller.rb
   - app/controllers/checkout_controller.rb
   - app/controllers/spree/admin/adjustments_controller_decorator.rb
-  - app/controllers/spree/admin/base_controller_decorator.rb
   - app/controllers/spree/admin/orders_controller_decorator.rb
   - app/controllers/spree/admin/payments_controller_decorator.rb
-  - app/controllers/spree/admin/payment_methods_controller_decorator.rb
-  - app/controllers/spree/admin/reports_controller_decorator.rb
-  - app/controllers/spree/api/products_controller_decorator.rb
   - app/controllers/spree/credit_cards_controller.rb
-  - app/controllers/spree/orders_controller_decorator.rb
   - app/controllers/spree/paypal_controller_decorator.rb
   - app/controllers/stripe/callbacks_controller.rb
-  - app/helpers/admin/injection_helper.rb
   - app/helpers/angular_form_builder.rb
   - app/helpers/angular_form_helper.rb
   - app/helpers/checkout_helper.rb
   - app/helpers/enterprises_helper.rb
-  - app/helpers/footer_links_helper.rb
   - app/helpers/injection_helper.rb
   - app/helpers/markdown_helper.rb
   - app/helpers/order_cycles_helper.rb
@@ -89,7 +79,6 @@ Metrics/LineLength:
   - app/models/proxy_order.rb
   - app/models/schedule.rb
   - app/models/spree/ability_decorator.rb
-  - app/models/spree/adjustment_decorator.rb
   - app/models/spree/app_configuration_decorator.rb
   - app/models/spree/calculator/default_tax_decorator.rb
   - app/models/spree/classification_decorator.rb
@@ -100,28 +89,14 @@ Metrics/LineLength:
   - app/models/spree/payment_decorator.rb
   - app/models/spree/payment_method_decorator.rb
   - app/models/spree/product_decorator.rb
-  - app/models/spree/shipment_decorator.rb
   - app/models/spree/shipping_method_decorator.rb
   - app/models/spree/tax_rate_decorator.rb
   - app/models/spree/taxon_decorator.rb
-  - app/models/spree/user_decorator.rb
+  - app/models/spree/user.rb
   - app/models/spree/variant_decorator.rb
   - app/models/subscription.rb
   - app/models/variant_override.rb
   - app/models/variant_override_set.rb
-  - app/overrides/add_enterprise_fees_to_admin_configurations_menu.rb
-  - app/serializers/api/admin/basic_enterprise_serializer.rb
-  - app/serializers/api/admin/enterprise_fee_serializer.rb
-  - app/serializers/api/admin/enterprise_serializer.rb
-  - app/serializers/api/admin/exchange_serializer.rb
-  - app/serializers/api/admin/for_order_cycle/enterprise_serializer.rb
-  - app/serializers/api/admin/index_enterprise_serializer.rb
-  - app/serializers/api/admin/index_order_cycle_serializer.rb
-  - app/serializers/api/admin/line_item_serializer.rb
-  - app/serializers/api/admin/order_cycle_serializer.rb
-  - app/serializers/api/admin/subscription_serializer.rb
-  - app/serializers/api/admin/tag_rule_serializer.rb
-  - app/serializers/api/admin/variant_override_serializer.rb
   - app/services/cart_service.rb
   - app/services/default_stock_location.rb
   - app/services/embedded_page_service.rb
@@ -129,11 +104,6 @@ Metrics/LineLength:
   - app/services/order_factory.rb
   - app/services/subscriptions_count.rb
   - app/services/variants_stock_levels.rb
-  - app/views/json/_groups.rabl
-  - app/views/json/_producer.rabl
-  - app/views/json/partials/_enterprise.rabl
-  - app/views/spree/api/products/bulk_show.v1.rabl
-  - app/views/spree/api/variants/bulk_show.v1.rabl
   - engines/web/app/helpers/web/cookies_policy_helper.rb
   - lib/discourse/single_sign_on.rb
   - lib/open_food_network/available_payment_method_filter.rb
@@ -144,26 +114,17 @@ Metrics/LineLength:
   - lib/open_food_network/enterprise_issue_validator.rb
   - lib/open_food_network/group_buy_report.rb
   - lib/open_food_network/lettuce_share_report.rb
-  - lib/open_food_network/order_and_distributor_report.rb
   - lib/open_food_network/order_cycle_form_applicator.rb
   - lib/open_food_network/order_cycle_management_report.rb
-  - lib/open_food_network/order_grouper.rb
-  - lib/open_food_network/orders_and_fulfillments_report.rb
   - lib/open_food_network/payments_report.rb
-  - lib/open_food_network/permalink_generator.rb
-  - lib/open_food_network/products_cache.rb
-  - lib/open_food_network/products_renderer.rb
   - lib/open_food_network/reports/bulk_coop_allocation_report.rb
-  - lib/open_food_network/reports/line_items.rb
   - lib/open_food_network/sales_tax_report.rb
-  - lib/open_food_network/users_and_enterprises_report.rb
   - lib/open_food_network/variant_and_line_item_naming.rb
   - lib/open_food_network/xero_invoices_report.rb
   - lib/spree/core/controller_helpers/respond_with_decorator.rb
   - lib/spree/localized_number.rb
   - lib/spree/product_filters.rb
   - lib/stripe/profile_storer.rb
-  - lib/tasks/cache.rake
   - lib/tasks/data.rake
   - lib/tasks/enterprises.rake
   - spec/controllers/admin/bulk_line_items_controller_spec.rb
@@ -180,11 +141,16 @@ Metrics/LineLength:
   - spec/controllers/admin/subscription_line_items_controller_spec.rb
   - spec/controllers/admin/subscriptions_controller_spec.rb
   - spec/controllers/admin/variant_overrides_controller_spec.rb
+  - spec/controllers/api/base_controller_spec.rb
+  - spec/controllers/api/exchange_products_controller_spec.rb
   - spec/controllers/api/logos_controller_spec.rb
   - spec/controllers/api/order_cycles_controller_spec.rb
   - spec/controllers/api/orders_controller_spec.rb
   - spec/controllers/api/product_images_controller_spec.rb
+  - spec/controllers/api/products_controller_spec.rb
   - spec/controllers/api/promo_images_controller_spec.rb
+  - spec/controllers/api/shipments_controller_spec.rb
+  - spec/controllers/api/variants_controller_spec.rb
   - spec/controllers/cart_controller_spec.rb
   - spec/controllers/checkout_controller_spec.rb
   - spec/controllers/enterprises_controller_spec.rb
@@ -197,12 +163,9 @@ Metrics/LineLength:
   - spec/controllers/spree/admin/orders_controller_spec.rb
   - spec/controllers/spree/admin/payment_methods_controller_spec.rb
   - spec/controllers/spree/admin/payments_controller_spec.rb
+  - spec/controllers/spree/admin/products_controller_spec.rb
   - spec/controllers/spree/admin/reports_controller_spec.rb
   - spec/controllers/spree/admin/variants_controller_spec.rb
-  - spec/controllers/spree/api/line_items_controller_spec.rb
-  - spec/controllers/spree/api/products_controller_spec.rb
-  - spec/controllers/spree/api/shipments_controller_spec.rb
-  - spec/controllers/spree/api/variants_controller_spec.rb
   - spec/controllers/spree/credit_cards_controller_spec.rb
   - spec/controllers/spree/orders_controller_spec.rb
   - spec/controllers/spree/user_sessions_controller_spec.rb
@@ -210,7 +173,6 @@ Metrics/LineLength:
   - spec/controllers/stripe/callbacks_controller_spec.rb
   - spec/controllers/stripe/webhooks_controller_spec.rb
   - spec/controllers/user_confirmations_controller_spec.rb
-  - spec/controllers/user_registrations_controller_spec.rb
   - spec/features/admin/adjustments_spec.rb
   - spec/features/admin/bulk_order_management_spec.rb
   - spec/features/admin/bulk_product_update_spec.rb
@@ -235,6 +197,7 @@ Metrics/LineLength:
   - spec/features/admin/shipping_methods_spec.rb
   - spec/features/admin/subscriptions_spec.rb
   - spec/features/admin/tag_rules_spec.rb
+  - spec/features/admin/users_spec.rb
   - spec/features/admin/variant_overrides_spec.rb
   - spec/features/consumer/account/cards_spec.rb
   - spec/features/consumer/account/settings_spec.rb
@@ -262,17 +225,13 @@ Metrics/LineLength:
   - spec/helpers/order_cycles_helper_spec.rb
   - spec/helpers/spree/admin/base_helper_spec.rb
   - spec/jobs/confirm_order_job_spec.rb
-  - spec/jobs/products_cache_integrity_checker_job_spec.rb
-  - spec/jobs/refresh_products_cache_job_spec.rb
   - spec/jobs/subscription_confirm_job_spec.rb
   - spec/jobs/subscription_placement_job_spec.rb
   - spec/lib/open_food_network/address_finder_spec.rb
   - spec/lib/open_food_network/bulk_coop_report_spec.rb
-  - spec/lib/open_food_network/cached_products_renderer_spec.rb
   - spec/lib/open_food_network/customers_report_spec.rb
   - spec/lib/open_food_network/enterprise_fee_applicator_spec.rb
   - spec/lib/open_food_network/enterprise_fee_calculator_spec.rb
-  - spec/lib/open_food_network/enterprise_injection_data_spec.rb
   - spec/lib/open_food_network/group_buy_report_spec.rb
   - spec/lib/open_food_network/lettuce_share_report_spec.rb
   - spec/lib/open_food_network/option_value_namer_spec.rb
@@ -284,8 +243,6 @@ Metrics/LineLength:
   - spec/lib/open_food_network/packing_report_spec.rb
   - spec/lib/open_food_network/permissions_spec.rb
   - spec/lib/open_food_network/products_and_inventory_report_spec.rb
-  - spec/lib/open_food_network/products_cache_spec.rb
-  - spec/lib/open_food_network/products_renderer_spec.rb
   - spec/lib/open_food_network/proxy_order_syncer_spec.rb
   - spec/lib/open_food_network/scope_variant_to_hub_spec.rb
   - spec/lib/open_food_network/subscription_payment_updater_spec.rb
@@ -298,6 +255,7 @@ Metrics/LineLength:
   - spec/mailers/order_mailer_spec.rb
   - spec/mailers/producer_mailer_spec.rb
   - spec/mailers/subscription_mailer_spec.rb
+  - spec/models/calculator/weight_spec.rb
   - spec/models/column_preference_spec.rb
   - spec/models/concerns/order_shipment_spec.rb
   - spec/models/concerns/product_stock_spec.rb
@@ -319,11 +277,11 @@ Metrics/LineLength:
   - spec/models/spree/calculator/price_sack_spec.rb
   - spec/models/spree/classification_spec.rb
   - spec/models/spree/gateway/stripe_connect_spec.rb
-  - spec/models/spree/image_spec.rb
   - spec/models/spree/line_item_spec.rb
   - spec/models/spree/order_spec.rb
   - spec/models/spree/payment_method_spec.rb
   - spec/models/spree/payment_spec.rb
+  - spec/models/spree/product_set_spec.rb
   - spec/models/spree/product_spec.rb
   - spec/models/spree/property_spec.rb
   - spec/models/spree/shipping_method_spec.rb
@@ -341,24 +299,28 @@ Metrics/LineLength:
   - spec/performance/orders_controller_spec.rb
   - spec/performance/shop_controller_spec.rb
   - spec/requests/checkout/failed_checkout_spec.rb
-  - spec/requests/checkout/stripe_connect_spec.rb
   - spec/requests/embedded_shopfronts_headers_spec.rb
-  - spec/requests/shop_spec.rb
-  - spec/serializers/admin/customer_serializer_spec.rb
-  - spec/serializers/admin/exchange_serializer_spec.rb
-  - spec/serializers/admin/for_order_cycle/enterprise_serializer_spec.rb
-  - spec/serializers/admin/for_order_cycle/supplied_product_serializer_spec.rb
-  - spec/serializers/admin/subscription_customer_serializer_spec.rb
-  - spec/serializers/admin/variant_override_serializer_spec.rb
+  - spec/serializers/api/admin/customer_serializer_spec.rb
+  - spec/serializers/api/admin/exchange_serializer_spec.rb
+  - spec/serializers/api/admin/for_order_cycle/enterprise_serializer_spec.rb
+  - spec/serializers/api/admin/for_order_cycle/supplied_product_serializer_spec.rb
+  - spec/serializers/api/admin/order_cycle_serializer_spec.rb
+  - spec/serializers/api/admin/subscription_customer_serializer_spec.rb
+  - spec/serializers/api/admin/variant_override_serializer_spec.rb
+  - spec/serializers/api/current_order_serializer_spec.rb
   - spec/serializers/api/enterprise_shopfront_serializer_spec.rb
-  - spec/serializers/current_order_serializer_spec.rb
-  - spec/serializers/order_serializer_spec.rb
+  - spec/serializers/api/order_serializer_spec.rb
   - spec/services/cart_service_spec.rb
   - spec/services/embedded_page_service_spec.rb
+  - spec/services/exchange_products_renderer_spec.rb
+  - spec/services/order_cycle_distributed_products_spec.rb
   - spec/services/order_cycle_distributed_variants_spec.rb
   - spec/services/order_cycle_form_spec.rb
   - spec/services/order_factory_spec.rb
   - spec/services/order_syncer_spec.rb
+  - spec/services/permissions/order_spec.rb
+  - spec/services/product_tag_rules_filterer_spec.rb
+  - spec/services/products_renderer_spec.rb
   - spec/services/subscription_estimator_spec.rb
   - spec/services/subscription_form_spec.rb
   - spec/services/subscription_validator_spec.rb
@@ -379,8 +341,8 @@ Metrics/AbcSize:
   Exclude:
   - app/controllers/admin/bulk_line_items_controller.rb
   - app/controllers/admin/customers_controller.rb
-  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/enterprise_fees_controller.rb
+  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/order_cycles_controller.rb
   - app/controllers/admin/product_import_controller.rb
   - app/controllers/admin/schedules_controller.rb
@@ -388,28 +350,37 @@ Metrics/AbcSize:
   - app/controllers/admin/subscription_line_items_controller.rb
   - app/controllers/admin/subscriptions_controller.rb
   - app/controllers/api/enterprises_controller.rb
-  - app/controllers/api/order_cycles_controller.rb
   - app/controllers/api/product_images_controller.rb
+  - app/controllers/api/products_controller.rb
+  - app/controllers/api/shipments_controller.rb
+  - app/controllers/api/taxons_controller.rb
+  - app/controllers/api/variants_controller.rb
   - app/controllers/base_controller.rb
   - app/controllers/cart_controller.rb
   - app/controllers/checkout_controller.rb
   - app/controllers/discourse_sso_controller.rb
   - app/controllers/enterprises_controller.rb
   - app/controllers/spree/admin/adjustments_controller_decorator.rb
+  - app/controllers/spree/admin/image_settings_controller.rb
   - app/controllers/spree/admin/orders/customer_details_controller_decorator.rb
   - app/controllers/spree/admin/orders_controller_decorator.rb
-  - app/controllers/spree/admin/overview_controller_decorator.rb
+  - app/controllers/spree/admin/overview_controller.rb
+  - app/controllers/spree/admin/payment_methods_controller.rb
   - app/controllers/spree/admin/payments_controller_decorator.rb
-  - app/controllers/spree/admin/payment_methods_controller_decorator.rb
-  - app/controllers/spree/admin/products_controller_decorator.rb
-  - app/controllers/spree/admin/reports_controller_decorator.rb
+  - app/controllers/spree/admin/reports_controller.rb
+  - app/controllers/spree/admin/resource_controller.rb
+  - app/controllers/spree/admin/products_controller.rb
   - app/controllers/spree/admin/search_controller_decorator.rb
-  - app/controllers/spree/admin/variants_controller_decorator.rb
-  - app/controllers/spree/api/products_controller_decorator.rb
-  - app/controllers/spree/api/shipments_controller_decorator.rb
+  - app/controllers/spree/admin/taxons_controller.rb
+  - app/controllers/spree/admin/users_controller.rb
+  - app/controllers/spree/admin/variants_controller.rb
+  - app/controllers/spree/checkout_controller.rb
   - app/controllers/spree/credit_cards_controller.rb
-  - app/controllers/spree/orders_controller_decorator.rb
-  - app/controllers/spree/user_sessions_controller_decorator.rb
+  - app/controllers/spree/orders_controller.rb
+  - app/controllers/spree/user_passwords_controller.rb
+  - app/controllers/spree/user_registrations_controller.rb
+  - app/controllers/spree/user_sessions_controller.rb
+  - app/controllers/spree/users_controller.rb
   - app/controllers/stripe/callbacks_controller.rb
   - app/controllers/user_confirmations_controller.rb
   - app/controllers/user_passwords_controller.rb
@@ -417,6 +388,7 @@ Metrics/AbcSize:
   - app/helpers/checkout_helper.rb
   - app/helpers/i18n_helper.rb
   - app/helpers/order_cycles_helper.rb
+  - app/helpers/spree/admin/navigation_helper_decorator.rb
   - app/helpers/spree/orders_helper.rb
   - app/jobs/subscription_placement_job.rb
   - app/mailers/producer_mailer.rb
@@ -438,6 +410,7 @@ Metrics/AbcSize:
   - app/models/spree/product_decorator.rb
   - app/models/spree/taxon_decorator.rb
   - app/serializers/api/admin/enterprise_serializer.rb
+  - app/serializers/api/admin/order_cycle_serializer.rb
   - app/serializers/api/product_serializer.rb
   - app/serializers/api/variant_serializer.rb
   - app/services/cart_service.rb
@@ -455,90 +428,60 @@ Metrics/AbcSize:
   - lib/open_food_network/order_cycle_form_applicator.rb
   - lib/open_food_network/order_cycle_management_report.rb
   - lib/open_food_network/order_cycle_permissions.rb
-  - lib/open_food_network/orders_and_fulfillments_report.rb
   - lib/open_food_network/packing_report.rb
   - lib/open_food_network/payments_report.rb
   - lib/open_food_network/permissions.rb
   - lib/open_food_network/products_and_inventory_report.rb
+  - lib/open_food_network/rack_request_blocker.rb
   - lib/open_food_network/reports/line_items.rb
   - lib/open_food_network/sales_tax_report.rb
   - lib/open_food_network/users_and_enterprises_report.rb
   - lib/open_food_network/variant_and_line_item_naming.rb
   - lib/open_food_network/xero_invoices_report.rb
+  - lib/spree/api/controller_setup.rb
   - lib/spree/core/controller_helpers/respond_with_decorator.rb
   - lib/spree/localized_number.rb
   - lib/stripe/account_connector.rb
   - lib/tasks/enterprises.rake
   - lib/tasks/sample_data/product_factory.rb
-  - spec/controllers/spree/api/shipments_controller_spec.rb
   - spec/features/admin/product_import_spec.rb
   - spec/features/admin/reports_spec.rb
   - spec/features/admin/subscriptions_spec.rb
-  - spec/features/consumer/shopping/checkout_spec.rb
+  - spec/features/consumer/shopping/checkout_paypal_spec.rb
   - spec/features/consumer/shopping/variant_overrides_spec.rb
   - spec/models/enterprise_spec.rb
   - spec/models/product_importer_spec.rb
+  - spec/services/restart_checkout_spec.rb
   - spec/support/performance_helper.rb
 
 Metrics/BlockLength:
   Max: 25
-  ExcludedMethods: ["class_eval", "collection", "context", "describe", "it", "member", "namespace", "resource", "resources"]
+  ExcludedMethods: [
+    "class_eval",
+    "collection",
+    "context",
+    "describe",
+    "feature",
+    "it",
+    "member",
+    "namespace",
+    "resource",
+    "resources",
+    "scenario"
+  ]
   Exclude:
   - lib/tasks/data.rake
-  - lib/tasks/dev.rake
   - spec/controllers/spree/admin/invoices_controller_spec.rb
+  - spec/factories.rb
+  - spec/factories/enterprise_factory.rb
+  - spec/factories/order_cycle_factory.rb
+  - spec/factories/order_factory.rb
+  - spec/factories/product_factory.rb
+  - spec/factories/shipping_method_factory.rb
+  - spec/factories/subscription_factory.rb
   - spec/factories/variant_factory.rb
-  - spec/features/admin/adjustments_spec.rb
-  - spec/features/admin/bulk_order_management_spec.rb
-  - spec/features/admin/bulk_product_update_spec.rb
-  - spec/features/admin/caching_spec.rb
-  - spec/features/admin/content_spec.rb
-  - spec/features/admin/customers_spec.rb
-  - spec/features/admin/enterprise_fees_spec.rb
-  - spec/features/admin/enterprise_groups_spec.rb
-  - spec/features/admin/enterprise_relationships_spec.rb
-  - spec/features/admin/enterprise_roles_spec.rb
-  - spec/features/admin/enterprises/images_spec.rb
-  - spec/features/admin/enterprises/index_spec.rb
-  - spec/features/admin/enterprises_spec.rb
-  - spec/features/admin/enterprise_user_spec.rb
-  - spec/features/admin/multilingual_spec.rb
-  - spec/features/admin/order_cycles_spec.rb
   - spec/features/admin/orders_spec.rb
-  - spec/features/admin/overview_spec.rb
-  - spec/features/admin/payment_method_spec.rb
-  - spec/features/admin/product_import_spec.rb
-  - spec/features/admin/products_spec.rb
-  - spec/features/admin/reports/enterprise_fee_summaries_spec.rb
-  - spec/features/admin/reports_spec.rb
-  - spec/features/admin/schedules_spec.rb
-  - spec/features/admin/shipping_methods_spec.rb
-  - spec/features/admin/subscriptions_spec.rb
-  - spec/features/admin/tag_rules_spec.rb
-  - spec/features/admin/tax_settings_spec.rb
-  - spec/features/admin/users_spec.rb
-  - spec/features/admin/variant_overrides_spec.rb
-  - spec/features/admin/variants_spec.rb
-  - spec/features/consumer/account/cards_spec.rb
-  - spec/features/consumer/account/settings_spec.rb
-  - spec/features/consumer/account_spec.rb
-  - spec/features/consumer/authentication_spec.rb
-  - spec/features/consumer/cookies_spec.rb
-  - spec/features/consumer/external_services_spec.rb
-  - spec/features/consumer/groups_spec.rb
-  - spec/features/consumer/multilingual_spec.rb
-  - spec/features/consumer/producers_spec.rb
-  - spec/features/consumer/registration_spec.rb
-  - spec/features/consumer/shopping/cart_spec.rb
-  - spec/features/consumer/shopping/checkout_auth_spec.rb
-  - spec/features/consumer/shopping/checkout_spec.rb
-  - spec/features/consumer/shopping/embedded_groups_spec.rb
   - spec/features/consumer/shopping/embedded_shopfronts_spec.rb
-  - spec/features/consumer/shopping/orders_spec.rb
-  - spec/features/consumer/shopping/products_spec.rb
-  - spec/features/consumer/shopping/shopping_spec.rb
-  - spec/features/consumer/shopping/variant_overrides_spec.rb
-  - spec/features/consumer/shops_spec.rb
   - spec/lib/open_food_network/group_buy_report_spec.rb
   - spec/models/tag_rule/discount_order_spec.rb
   - spec/spec_helper.rb
@@ -549,11 +492,12 @@ Metrics/BlockLength:
 Metrics/CyclomaticComplexity:
   Max: 6
   Exclude:
-  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/enterprise_fees_controller.rb
+  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/checkout_controller.rb
   - app/controllers/spree/admin/payments_controller_decorator.rb
-  - app/controllers/spree/orders_controller_decorator.rb
+  - app/controllers/spree/admin/taxons_controller.rb
+  - app/controllers/spree/orders_controller.rb
   - app/helpers/checkout_helper.rb
   - app/helpers/i18n_helper.rb
   - app/helpers/order_cycles_helper.rb
@@ -570,7 +514,6 @@ Metrics/CyclomaticComplexity:
   - lib/discourse/single_sign_on.rb
   - lib/open_food_network/bulk_coop_report.rb
   - lib/open_food_network/enterprise_issue_validator.rb
-  - lib/open_food_network/orders_and_fulfillments_report.rb
   - lib/spree/core/controller_helpers/order_decorator.rb
   - lib/spree/core/controller_helpers/respond_with_decorator.rb
   - lib/spree/localized_number.rb
@@ -580,9 +523,11 @@ Metrics/PerceivedComplexity:
   Max: 7
   Exclude:
   - app/controllers/admin/enterprises_controller.rb
+  - app/controllers/api/variants_controller.rb
   - app/controllers/checkout_controller.rb
   - app/controllers/spree/admin/payments_controller_decorator.rb
-  - app/controllers/spree/orders_controller_decorator.rb
+  - app/controllers/spree/admin/taxons_controller.rb
+  - app/controllers/spree/orders_controller.rb
   - app/helpers/checkout_helper.rb
   - app/helpers/i18n_helper.rb
   - app/helpers/order_cycles_helper.rb
@@ -595,7 +540,6 @@ Metrics/PerceivedComplexity:
   - lib/discourse/single_sign_on.rb
   - lib/open_food_network/bulk_coop_report.rb
   - lib/open_food_network/enterprise_issue_validator.rb
-  - lib/open_food_network/orders_and_fulfillments_report.rb
   - lib/spree/core/controller_helpers/order_decorator.rb
   - lib/spree/core/controller_helpers/respond_with_decorator.rb
   - lib/spree/localized_number.rb
@@ -605,25 +549,35 @@ Metrics/MethodLength:
   Max: 10
   Exclude:
   - app/controllers/admin/customers_controller.rb
-  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/enterprise_fees_controller.rb
+  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/manager_invitations_controller.rb
   - app/controllers/admin/order_cycles_controller.rb
   - app/controllers/admin/stripe_accounts_controller.rb
   - app/controllers/admin/subscriptions_controller.rb
+  - app/controllers/api/products_controller.rb
+  - app/controllers/api/shipments_controller.rb
+  - app/controllers/api/taxons_controller.rb
+  - app/controllers/api/variants_controller.rb
   - app/controllers/base_controller.rb
   - app/controllers/cart_controller.rb
   - app/controllers/checkout_controller.rb
   - app/controllers/shop_controller.rb
+  - app/controllers/spree/admin/image_settings_controller.rb
   - app/controllers/spree/admin/orders/customer_details_controller_decorator.rb
+  - app/controllers/spree/admin/payment_methods_controller.rb
   - app/controllers/spree/admin/payments_controller_decorator.rb
-  - app/controllers/spree/admin/payment_methods_controller_decorator.rb
-  - app/controllers/spree/admin/products_controller_decorator.rb
-  - app/controllers/spree/admin/reports_controller_decorator.rb
+  - app/controllers/spree/admin/reports_controller.rb
+  - app/controllers/spree/admin/resource_controller.rb
+  - app/controllers/spree/admin/products_controller.rb
   - app/controllers/spree/admin/search_controller_decorator.rb
+  - app/controllers/spree/admin/tax_categories_controller.rb
+  - app/controllers/spree/admin/taxons_controller.rb
+  - app/controllers/spree/admin/users_controller.rb
   - app/controllers/spree/credit_cards_controller.rb
-  - app/controllers/spree/orders_controller_decorator.rb
-  - app/controllers/spree/user_sessions_controller_decorator.rb
+  - app/controllers/spree/orders_controller.rb
+  - app/controllers/spree/user_registrations_controller.rb
+  - app/controllers/spree/user_sessions_controller.rb
   - app/controllers/stripe/callbacks_controller.rb
   - app/controllers/user_confirmations_controller.rb
   - app/controllers/user_passwords_controller.rb
@@ -665,12 +619,10 @@ Metrics/MethodLength:
   - lib/open_food_network/order_cycle_management_report.rb
   - lib/open_food_network/order_cycle_permissions.rb
   - lib/open_food_network/order_grouper.rb
-  - lib/open_food_network/orders_and_fulfillments_report.rb
   - lib/open_food_network/packing_report.rb
   - lib/open_food_network/payments_report.rb
   - lib/open_food_network/permissions.rb
   - lib/open_food_network/products_and_inventory_report.rb
-  - lib/open_food_network/products_renderer.rb
   - lib/open_food_network/rack_request_blocker.rb
   - lib/open_food_network/reports/bulk_coop_allocation_report.rb
   - lib/open_food_network/reports/bulk_coop_supplier_report.rb
@@ -678,11 +630,12 @@ Metrics/MethodLength:
   - lib/open_food_network/sales_tax_report.rb
   - lib/open_food_network/users_and_enterprises_report.rb
   - lib/open_food_network/xero_invoices_report.rb
+  - lib/spree/api/controller_setup.rb
   - lib/spree/core/controller_helpers/respond_with_decorator.rb
   - lib/spree/localized_number.rb
   - lib/stripe/profile_storer.rb
   - lib/tasks/sample_data/product_factory.rb
-  - spec/features/consumer/shopping/checkout_spec.rb
+  - spec/features/consumer/shopping/checkout_paypal_spec.rb
   - spec/features/consumer/shopping/variant_overrides_spec.rb
   - spec/models/product_importer_spec.rb
   - spec/support/request/authentication_workflow.rb
@@ -693,13 +646,22 @@ Metrics/ClassLength:
   - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/order_cycles_controller.rb
   - app/controllers/admin/subscriptions_controller.rb
+  - app/controllers/api/products_controller.rb
   - app/controllers/checkout_controller.rb
+  - app/controllers/spree/admin/base_controller.rb
+  - app/controllers/spree/admin/payment_methods_controller.rb
+  - app/controllers/spree/admin/reports_controller.rb
+  - app/controllers/spree/admin/resource_controller.rb
+  - app/controllers/spree/admin/products_controller.rb
+  - app/controllers/spree/admin/users_controller.rb
+  - app/controllers/spree/orders_controller.rb
   - app/models/enterprise.rb
   - app/models/order_cycle.rb
   - app/models/product_import/entry_processor.rb
   - app/models/product_import/entry_validator.rb
   - app/models/product_import/product_importer.rb
   - app/models/spree/ability_decorator.rb
+  - app/models/spree/user.rb
   - app/serializers/api/cached_enterprise_serializer.rb
   - app/serializers/api/enterprise_shopfront_serializer.rb
   - app/services/cart_service.rb
@@ -709,24 +671,24 @@ Metrics/ClassLength:
   - lib/open_food_network/order_cycle_form_applicator.rb
   - lib/open_food_network/order_cycle_management_report.rb
   - lib/open_food_network/order_cycle_permissions.rb
-  - lib/open_food_network/orders_and_fulfillments_report.rb
   - lib/open_food_network/packing_report.rb
   - lib/open_food_network/payments_report.rb
   - lib/open_food_network/permissions.rb
-  - lib/open_food_network/products_cache.rb
+  - lib/open_food_network/users_and_enterprises_report.rb
   - lib/open_food_network/xero_invoices_report.rb
 
 Metrics/ModuleLength:
   Max: 100
   Exclude:
+  - app/helpers/admin/injection_helper.rb
+  - app/helpers/injection_helper.rb
   - lib/open_food_network/column_preference_defaults.rb
   - spec/controllers/admin/enterprises_controller_spec.rb
   - spec/controllers/admin/order_cycles_controller_spec.rb
   - spec/controllers/api/order_cycles_controller_spec.rb
   - spec/controllers/api/orders_controller_spec.rb
-  - spec/controllers/spree/api/products_controller_spec.rb
+  - spec/controllers/spree/admin/payment_methods_controller_spec.rb
   - spec/lib/open_food_network/address_finder_spec.rb
-  - spec/lib/open_food_network/cached_products_renderer_spec.rb
   - spec/lib/open_food_network/customers_report_spec.rb
   - spec/lib/open_food_network/enterprise_fee_calculator_spec.rb
   - spec/lib/open_food_network/option_value_namer_spec.rb
@@ -735,7 +697,6 @@ Metrics/ModuleLength:
   - spec/lib/open_food_network/order_grouper_spec.rb
   - spec/lib/open_food_network/permissions_spec.rb
   - spec/lib/open_food_network/products_and_inventory_report_spec.rb
-  - spec/lib/open_food_network/products_cache_spec.rb
   - spec/lib/open_food_network/proxy_order_syncer_spec.rb
   - spec/lib/open_food_network/scope_variant_to_hub_spec.rb
   - spec/lib/open_food_network/subscription_payment_updater_spec.rb
@@ -747,6 +708,7 @@ Metrics/ModuleLength:
   - spec/models/spree/payment_spec.rb
   - spec/models/spree/product_spec.rb
   - spec/models/spree/variant_spec.rb
+  - spec/services/permissions/order_spec.rb
   - spec/support/request/web_helper.rb
 
 Metrics/ParameterLists:
@@ -754,6 +716,5 @@ Metrics/ParameterLists:
   Exclude:
   - app/helpers/angular_form_builder.rb
   - app/models/product_import/entry_processor.rb
-  - app/models/product_import/entry_validator.rb
   - lib/open_food_network/xero_invoices_report.rb
   - spec/features/admin/reports_spec.rb

.rubocop_styleguide.yml

@@ -5,9 +5,9 @@
 # rubocop locally, the default configuration file `.rubocop.yml` loads
 # our "todo lists" to ignore all current violations.
 AllCops:
-  TargetRubyVersion: 2.1
   TargetRailsVersion: 3.2
   Exclude:
+    - 'bin/**/*'
     - 'db/**/*'
     - 'config/**/*'
     - 'script/**/*'
@@ -40,7 +40,7 @@ Layout/MultilineMethodCallIndentation:
   Enabled: true
   EnforcedStyle: indented
 
-Metrics/LineLength:
+Layout/LineLength:
   Max: 100
 
 ## TEMPORARY/CONTESTED SETTINGS
@@ -186,7 +186,19 @@ Metrics/AbcSize:
 
 Metrics/BlockLength:
   Max: 25
-  ExcludedMethods: ["class_eval", "collection", "context", "describe", "it", "member", "namespace", "resource", "resources"]
+  ExcludedMethods: [
+    "class_eval",
+    "collection",
+    "context",
+    "describe",
+    "feature",
+    "it",
+    "member",
+    "namespace",
+    "resource",
+    "resources",
+    "scenario"
+  ]
 
 Metrics/BlockNesting:
   Max: 3

.ruby-version

@@ -1 +1 @@
-2.1.5
+2.3.7

CONTRIBUTING.md

@@ -19,6 +19,10 @@ If you want to run the whole test suite, we recommend using a free CI service to
 
     bundle exec rspec spec
 
+## Which issue to pick first?
+
+We have curated all issues interesting for new members of the community within the [Welcome New Developers project board][welcome-dev]. Have a look and pick the one you would prefer working on!
+
 ## Internationalisation (i18n)
 
 The locale `en` is maintained in the source code, but other locales are managed at [Transifex][ofn-transifex]. Read more about [internationalisation][i18n] in the developer wiki.
@@ -62,3 +66,4 @@ From here, your pull request will progress through the [Review, Test, Merge & De
 [slack-dev]: https://openfoodnetwork.slack.com/messages/C2GQ45KNU
 [ofn-transifex]: https://www.transifex.com/open-food-foundation/open-food-network/
 [i18n]: https://github.com/openfoodfoundation/openfoodnetwork/wiki/i18n
+[welcome-dev]: https://github.com/openfoodfoundation/openfoodnetwork/projects/27

Dockerfile

@@ -6,16 +6,19 @@ RUN apt-get update && apt-get install -y curl git build-essential software-prope
 # Setup ENV variables
 ENV PATH /usr/local/src/rbenv/shims:/usr/local/src/rbenv/bin:$PATH
 ENV RBENV_ROOT /usr/local/src/rbenv
-ENV RUBY_VERSION 2.1.5
 ENV CONFIGURE_OPTS --disable-install-doc
+ENV BUNDLE_PATH /bundles
+
+WORKDIR /usr/src/app
+COPY .ruby-version .
 
 # Rbenv & Ruby part
 RUN git clone https://github.com/rbenv/rbenv.git ${RBENV_ROOT} && \
     git clone https://github.com/rbenv/ruby-build.git ${RBENV_ROOT}/plugins/ruby-build && \
     ${RBENV_ROOT}/plugins/ruby-build/install.sh && \
     echo 'eval "$(rbenv init -)"' >> /etc/profile.d/rbenv.sh && \
-    rbenv install $RUBY_VERSION && \
-    rbenv global $RUBY_VERSION && \
+    rbenv install $(cat .ruby-version) && \
+    rbenv global $(cat .ruby-version) && \
     gem install bundler --version=1.17.2
 
 # Postgres
@@ -24,8 +27,4 @@ RUN sh -c "echo 'deb https://apt.postgresql.org/pub/repos/apt/ bionic-pgdg main'
     apt-get update && \
     apt-get install -yqq --no-install-recommends postgresql-client-9.5 libpq-dev
 
-ENV BUNDLE_PATH /bundles
-
 COPY . /usr/src/app/
-
-WORKDIR /usr/src/app

GETTING_STARTED.md

@@ -11,7 +11,7 @@ The following guides are located in the wiki and provide more OS-specific step-b
 ### Dependencies
 
 * Rails 3.2.x
-* Ruby 2.1.5
+* Ruby 2.1.9
 * PostgreSQL database
 * PhantomJS (for testing)
 * See Gemfile for a list of gems required

Gemfile

@@ -1,9 +1,9 @@
 source 'https://rubygems.org'
-ruby "2.1.5"
+ruby "2.3.7"
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}.git" }
 
 gem 'i18n', '~> 0.6.11'
-gem 'i18n-js', '~> 3.3.0'
+gem 'i18n-js', '~> 3.5.1'
 gem 'rails', '~> 3.2.22'
 gem 'rails-i18n', '~> 3.0.0'
 gem 'rails_safe_tasks', '~> 1.0'
@@ -15,12 +15,12 @@ gem 'nokogiri', '>= 1.6.7.1'
 gem "order_management", path: "./engines/order_management"
 gem 'web', path: './engines/web'
 
-gem 'pg'
+gem 'activerecord-postgresql-adapter'
+gem 'pg', '~> 0.21.0'
 
 # OFN-maintained and patched version of Spree v2.0.4. See
 # https://github.com/openfoodfoundation/openfoodnetwork/wiki/Spree-2.0-upgrade
 # for details.
-gem 'spree_api', github: 'openfoodfoundation/spree', branch: '2-0-4-stable'
 gem 'spree_backend', github: 'openfoodfoundation/spree', branch: '2-0-4-stable'
 gem 'spree_core', github: 'openfoodfoundation/spree', branch: '2-0-4-stable'
 
@@ -39,7 +39,7 @@ gem 'activemerchant', '~> 1.78'
 gem 'devise', '~> 2.2.5'
 gem 'devise-encryptable', '0.2.0'
 gem 'jwt', '~> 2.2'
-gem 'oauth2', '~> 1.4.1' # Used for Stripe Connect
+gem 'oauth2', '~> 1.4.2' # Used for Stripe Connect
 
 gem 'daemons'
 gem 'delayed_job_active_record'
@@ -49,6 +49,10 @@ gem 'delayed_job_web'
 # When merged, revert to upstream gem
 gem 'simple_form', github: 'RohanM/simple_form'
 
+# Spree's default pagination gem (locked to the current version used by Spree)
+# We use it's methods in OFN code as well, so this is a direct dependency
+gem 'kaminari', '~> 0.14.1'
+
 gem 'andand'
 gem 'angularjs-rails', '1.5.5'
 gem 'aws-sdk'
@@ -80,8 +84,7 @@ gem 'paper_trail', '~> 5.2.3'
 gem 'paperclip', '~> 3.4.1'
 gem 'rack-rewrite'
 gem 'rack-ssl', require: 'rack/ssl'
-gem 'roadie-rails', '~> 1.1.1'
-gem 'skylight', '< 2.0'
+gem 'roadie-rails', '~> 1.3.0'
 gem 'spinjs-rails'
 
 gem 'combine_pdf'
@@ -90,18 +93,20 @@ gem 'wkhtmltopdf-binary'
 
 gem 'foreigner'
 gem 'immigrant'
-gem 'roo', '~> 2.7.0'
+gem 'roo', '~> 2.8.2'
 gem 'roo-xls', '~> 1.1.0'
 
 gem 'whenever', require: false
 
+gem 'test-unit', '~> 3.3'
+
 # Gems used only for assets and not required
 # in production environments by default.
 group :assets do
   gem 'coffee-rails', '~> 3.2.1'
   gem 'compass-rails'
 
-  gem 'therubyracer', '=0.12.0'
+  gem 'mini_racer', '0.2.9'
 
   gem 'uglifier', '>= 1.0.3'
 
@@ -127,10 +132,10 @@ group :test, :development do
   # Pretty printed test output
   gem 'atomic'
   gem 'awesome_print'
-  gem 'capybara', '>= 2.15.4'
+  gem 'capybara', '>= 2.18.0' # 3.0 requires nokogiri 1.8
   gem 'database_cleaner', '0.7.1', require: false
   gem "factory_bot_rails", require: false
-  gem 'fuubar', '~> 2.4.1'
+  gem 'fuubar', '~> 2.5.0'
   gem 'json_spec', '~> 1.1.4'
   gem 'knapsack'
   gem 'letter_opener', '>= 1.4.1'
@@ -140,7 +145,7 @@ group :test, :development do
   gem 'shoulda-matchers'
   gem 'timecop'
   gem 'unicorn-rails'
-  gem 'webdrivers', '3.8.1'
+  gem 'webdrivers'
 end
 
 group :test do
@@ -153,14 +158,10 @@ end
 group :development do
   gem 'byebug', '~> 9.0.0' # 9.1 requires ruby 2.2
   gem 'debugger-linecache'
-  gem 'guard'
-  gem 'guard-livereload'
-  gem 'guard-rails'
-  gem 'guard-rspec', '~> 4.7.3'
-  gem 'listen', '3.0.8' # 3.1.0 requires ruby 2.2
   gem "newrelic_rpm", "~> 3.0"
   gem 'pry-byebug', '>= 3.4.3'
-  gem 'rubocop', '>= 0.49.1'
+  gem 'rubocop'
+  gem 'rubocop-rails'
   gem 'spring', '1.7.2'
   gem 'spring-commands-rspec'
 
@@ -169,5 +170,5 @@ group :development do
   # greater than 1.0.9, so we just required the latest available version here.
   gem 'eventmachine', '>= 1.2.3'
 
-  gem 'rack-mini-profiler', '< 1.0.0'
+  gem 'rack-mini-profiler', '< 2.0.0'
 end

Gemfile.lock

@@ -129,8 +129,10 @@ GEM
       activesupport (= 3.2.22.5)
       arel (~> 3.0.2)
       tzinfo (~> 0.3.29)
-    activerecord-import (1.0.2)
+    activerecord-import (1.0.4)
       activerecord (>= 3.2)
+    activerecord-postgresql-adapter (0.0.1)
+      pg
     activeresource (3.2.22.5)
       activemodel (= 3.2.22.5)
       activesupport (= 3.2.22.5)
@@ -141,8 +143,8 @@ GEM
       activerecord (>= 3.2, < 5)
     acts_as_list (0.2.0)
       activerecord (>= 3.0)
-    addressable (2.6.0)
-      public_suffix (>= 2.0.2, < 4.0)
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
     andand (1.3.3)
     angular-rails-templates (0.3.0)
       railties (>= 3.1)
@@ -164,7 +166,7 @@ GEM
     bcrypt-ruby (3.1.5)
       bcrypt (>= 3.1.3)
     blockenspiel (0.5.0)
-    bugsnag (6.11.1)
+    bugsnag (6.12.2)
       concurrent-ruby (~> 1.0)
     builder (3.0.4)
     byebug (9.0.6)
@@ -176,8 +178,7 @@ GEM
       rack (>= 1.0.0)
       rack-test (>= 0.5.4)
       xpath (>= 2.0, < 4.0)
-    childprocess (0.9.0)
-      ffi (~> 1.0, >= 1.0.11)
+    childprocess (3.0.0)
     chronic (0.10.2)
     chunky_png (1.3.10)
     climate_control (0.2.0)
@@ -210,11 +211,10 @@ GEM
       compass (~> 1.0.0)
       sass-rails (< 5.1)
       sprockets (< 4.0)
-    concurrent-ruby (1.1.4)
-    connection_pool (2.2.2)
+    concurrent-ruby (1.1.5)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
-    css_parser (1.6.0)
+    css_parser (1.7.0)
       addressable
     daemons (1.3.1)
     dalli (2.7.10)
@@ -223,7 +223,7 @@ GEM
       activerecord (>= 3.2.0, < 5.0)
       fog (~> 1.0)
       rails (>= 3.2.0, < 5.0)
-    ddtrace (0.26.0)
+    ddtrace (0.31.1)
       msgpack
     debugger-linecache (1.2.0)
     deface (1.0.2)
@@ -231,10 +231,10 @@ GEM
       nokogiri (~> 1.6.0)
       polyglot
       rails (>= 3.1)
-    delayed_job (4.1.5)
-      activesupport (>= 3.0, < 5.3)
-    delayed_job_active_record (4.1.3)
-      activerecord (>= 3.0, < 5.3)
+    delayed_job (4.1.8)
+      activesupport (>= 3.0, < 6.1)
+    delayed_job_active_record (4.1.4)
+      activerecord (>= 3.0, < 6.1)
       delayed_job (>= 3.0, < 5)
     delayed_job_web (1.4.3)
       activerecord (> 3.0.0)
@@ -252,22 +252,19 @@ GEM
     diffy (3.3.0)
     docile (1.3.2)
     dry-inflector (0.1.2)
-    em-websocket (0.5.1)
-      eventmachine (>= 0.12.9)
-      http_parser.rb (~> 0.6.0)
     erubis (2.7.0)
     eventmachine (1.2.7)
-    excon (0.62.0)
+    excon (0.71.1)
     execjs (2.7.0)
     factory_bot (4.10.0)
       activesupport (>= 3.0.0)
     factory_bot_rails (4.10.0)
       factory_bot (~> 4.10.0)
       railties (>= 3.0.0)
-    faraday (0.15.4)
+    faraday (0.17.1)
       multipart-post (>= 1.2, < 3)
     ffaker (1.22.1)
-    ffi (1.10.0)
+    ffi (1.11.3)
     figaro (1.1.1)
       thor (~> 0.14)
     fission (0.5.0)
@@ -427,48 +424,25 @@ GEM
     foundation-rails (5.5.2.1)
       railties (>= 3.1.0)
       sass (>= 3.3.0, < 3.5)
-    fuubar (2.4.1)
+    fuubar (2.5.0)
       rspec-core (~> 3.0)
       ruby-progressbar (~> 1.4)
     geocoder (1.1.8)
     gmaps4rails (1.5.6)
-    guard (2.15.0)
-      formatador (>= 0.2.4)
-      listen (>= 2.7, < 4.0)
-      lumberjack (>= 1.0.12, < 2.0)
-      nenv (~> 0.1)
-      notiffany (~> 0.0)
-      pry (>= 0.9.12)
-      shellany (~> 0.0)
-      thor (>= 0.18.1)
-    guard-compat (1.2.1)
-    guard-livereload (2.5.2)
-      em-websocket (~> 0.5)
-      guard (~> 2.8)
-      guard-compat (~> 1.0)
-      multi_json (~> 1.8)
-    guard-rails (0.7.2)
-      guard (~> 2.11)
-      guard-compat (~> 1.0)
-    guard-rspec (4.7.3)
-      guard (~> 2.1)
-      guard-compat (~> 1.1)
-      rspec (>= 2.99.0, < 4.0)
     haml (4.0.7)
       tilt
     hashdiff (1.0.0)
     highline (1.6.18)
     hike (1.2.3)
-    http_parser.rb (0.6.0)
     httparty (0.16.2)
       multi_xml (>= 0.5.2)
     i18n (0.6.11)
-    i18n-js (3.3.0)
+    i18n-js (3.5.1)
       i18n (>= 0.6.6)
     immigrant (0.3.6)
       activerecord (>= 3.0)
     ipaddress (0.8.3)
-    jaro_winkler (1.5.1)
+    jaro_winkler (1.5.4)
     journey (1.0.4)
     jquery-migrate-rails (1.2.1)
     jquery-rails (3.0.4)
@@ -485,17 +459,13 @@ GEM
       actionpack (>= 3.0.0)
       activesupport (>= 3.0.0)
     kgio (2.11.2)
-    knapsack (1.17.2)
+    knapsack (1.18.0)
       rake
     launchy (2.4.3)
       addressable (~> 2.3)
     letter_opener (1.7.0)
       launchy (~> 2.2)
-    libv8 (3.16.14.19)
-    listen (3.0.8)
-      rb-fsevent (~> 0.9, >= 0.9.4)
-      rb-inotify (~> 0.9, >= 0.9.7)
-    lumberjack (1.0.13)
+    libv8 (7.3.492.27.1)
     mail (2.5.5)
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
@@ -503,30 +473,26 @@ GEM
     mime-types (1.25.1)
     mini_mime (1.0.1)
     mini_portile2 (2.1.0)
+    mini_racer (0.2.9)
+      libv8 (>= 6.9.411)
     momentjs-rails (2.20.1)
       railties (>= 3.1)
     money (5.1.1)
       i18n (~> 0.6.0)
     msgpack (1.3.1)
-    multi_json (1.13.1)
+    multi_json (1.14.1)
     multi_xml (0.6.0)
     multipart-post (2.1.1)
-    nenv (0.3.0)
-    net-http-persistent (3.1.0)
-      connection_pool (~> 2.2)
     newrelic_rpm (3.18.1.330)
     nokogiri (1.6.8.1)
       mini_portile2 (~> 2.1.0)
-    notiffany (0.1.1)
-      nenv (~> 0.1)
-      shellany (~> 0.0)
-    oauth2 (1.4.1)
-      faraday (>= 0.8, < 0.16.0)
+    oauth2 (1.4.2)
+      faraday (>= 0.8, < 2.0)
       jwt (>= 1.0, < 3.0)
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 3)
-    oj (3.7.12)
+    oj (3.10.1)
     orm_adapter (0.5.0)
     paper_trail (5.2.3)
       activerecord (>= 3.0, < 6.0)
@@ -537,10 +503,10 @@ GEM
       activesupport (>= 3.0.0)
       cocaine (~> 0.5.0)
       mime-types
-    parallel (1.11.2)
+    parallel (1.19.1)
     paranoia (1.3.4)
       activerecord (~> 3.1)
-    parser (2.5.1.0)
+    parser (2.7.0.2)
       ast (~> 2.4.0)
     paypal-sdk-core (0.2.10)
       multi_json (~> 1.0)
@@ -551,20 +517,20 @@ GEM
     polyamorous (0.5.0)
       activerecord (~> 3.0)
     polyglot (0.3.5)
-    powerpack (0.1.1)
+    power_assert (1.1.5)
     pry (0.12.2)
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
     pry-byebug (3.4.3)
       byebug (>= 9.0, < 9.1)
       pry (~> 0.10)
-    public_suffix (3.1.1)
+    public_suffix (4.0.3)
     rabl (0.8.4)
       activesupport (>= 2.3.14)
     rack (1.4.7)
     rack-cache (1.9.0)
       rack (>= 0.4)
-    rack-mini-profiler (0.10.7)
+    rack-mini-profiler (1.1.4)
       rack (>= 1.2.0)
     rack-protection (1.5.5)
       rack
@@ -594,7 +560,7 @@ GEM
       thor (>= 0.14.6, < 2.0)
     rainbow (3.0.0)
     raindrops (0.19.0)
-    rake (12.3.3)
+    rake (13.0.0)
     ransack (0.7.2)
       actionpack (~> 3.0)
       activerecord (~> 3.0)
@@ -610,57 +576,58 @@ GEM
     rdoc (3.12.2)
       json (~> 1.4)
     redcarpet (3.5.0)
-    ref (2.0.0)
     request_store (1.4.1)
       rack (>= 1.4)
     roadie (3.4.0)
       css_parser (~> 1.4)
       nokogiri (~> 1.5)
-    roadie-rails (1.1.1)
-      railties (>= 3.0, < 5.1)
+    roadie-rails (1.3.0)
+      railties (>= 3.0, < 5.3)
       roadie (~> 3.1)
-    roo (2.7.1)
+    roo (2.8.2)
       nokogiri (~> 1)
-      rubyzip (~> 1.1, < 2.0.0)
+      rubyzip (>= 1.2.1, < 2.0.0)
     roo-xls (1.1.0)
       nokogiri
       roo (>= 2.0.0beta1, < 3)
       spreadsheet (> 0.9.0)
-    rspec (3.8.0)
-      rspec-core (~> 3.8.0)
-      rspec-expectations (~> 3.8.0)
-      rspec-mocks (~> 3.8.0)
-    rspec-core (3.8.0)
-      rspec-support (~> 3.8.0)
-    rspec-expectations (3.8.2)
+    rspec (3.9.0)
+      rspec-core (~> 3.9.0)
+      rspec-expectations (~> 3.9.0)
+      rspec-mocks (~> 3.9.0)
+    rspec-core (3.9.0)
+      rspec-support (~> 3.9.0)
+    rspec-expectations (3.9.0)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-mocks (3.8.0)
+      rspec-support (~> 3.9.0)
+    rspec-mocks (3.9.0)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.8.0)
-    rspec-rails (3.8.2)
+      rspec-support (~> 3.9.0)
+    rspec-rails (3.9.0)
       actionpack (>= 3.0)
       activesupport (>= 3.0)
       railties (>= 3.0)
-      rspec-core (~> 3.8.0)
-      rspec-expectations (~> 3.8.0)
-      rspec-mocks (~> 3.8.0)
-      rspec-support (~> 3.8.0)
-    rspec-retry (0.6.1)
+      rspec-core (~> 3.9.0)
+      rspec-expectations (~> 3.9.0)
+      rspec-mocks (~> 3.9.0)
+      rspec-support (~> 3.9.0)
+    rspec-retry (0.6.2)
       rspec-core (> 3.3)
-    rspec-support (3.8.0)
-    rubocop (0.57.2)
+    rspec-support (3.9.0)
+    rubocop (0.79.0)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
-      parser (>= 2.5)
-      powerpack (~> 0.1)
+      parser (>= 2.7.0.1)
       rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (~> 1.0, >= 1.0.1)
+      unicode-display_width (>= 1.4.0, < 1.7)
+    rubocop-rails (2.4.1)
+      rack (>= 1.1)
+      rubocop (>= 0.72.0)
     ruby-ole (1.2.12.1)
     ruby-progressbar (1.10.1)
     ruby-rc4 (0.1.5)
-    rubyzip (1.2.2)
+    rubyzip (1.3.0)
     safe_yaml (1.0.5)
     sass (3.3.14)
     sass-rails (3.2.6)
@@ -670,13 +637,12 @@ GEM
     select2-rails (3.4.9)
       sass-rails
       thor (~> 0.14)
-    selenium-webdriver (3.141.0)
-      childprocess (~> 0.5)
-      rubyzip (~> 1.2, >= 1.2.2)
-    shellany (0.0.1)
+    selenium-webdriver (3.142.7)
+      childprocess (>= 0.5, < 4.0)
+      rubyzip (>= 1.2.2)
     shoulda-matchers (2.8.0)
       activesupport (>= 3.0.0)
-    simplecov (0.17.0)
+    simplecov (0.17.1)
       docile (~> 1.1)
       json (>= 1.8, < 3)
       simplecov-html (~> 0.10.0)
@@ -685,8 +651,6 @@ GEM
       rack (~> 1.4)
       rack-protection (~> 1.4)
       tilt (>= 1.3, < 3)
-    skylight (1.7.2)
-      activesupport (>= 3.0.0)
     spinjs-rails (1.4)
       rails (>= 3.1)
     spreadsheet (1.1.7)
@@ -701,12 +665,9 @@ GEM
       tilt (~> 1.1, != 1.3.0)
     state_machine (1.2.0)
     stringex (1.5.1)
-    stripe (4.24.0)
-      faraday (~> 0.13)
-      net-http-persistent (~> 3.0)
-    therubyracer (0.12.0)
-      libv8 (~> 3.16.14.0)
-      ref
+    stripe (5.11.0)
+    test-unit (3.3.5)
+      power_assert
     thor (0.20.3)
     tilt (1.4.1)
     timecop (0.9.1)
@@ -718,11 +679,11 @@ GEM
     turbo-sprockets-rails3 (0.3.14)
       railties (> 3.2.8, < 4.0.0)
       sprockets (>= 2.2.0)
-    tzinfo (0.3.55)
-    uglifier (4.1.20)
+    tzinfo (0.3.56)
+    uglifier (4.2.0)
       execjs (>= 0.3.0, < 3)
-    unicode-display_width (1.3.2)
-    unicorn (5.5.1)
+    unicode-display_width (1.6.0)
+    unicorn (5.5.2)
       kgio (~> 2.6)
       raindrops (~> 0.7)
     unicorn-rails (2.2.1)
@@ -735,18 +696,18 @@ GEM
       railties (>= 3.0)
     warden (1.2.7)
       rack (>= 1.0)
-    webdrivers (3.8.1)
+    webdrivers (4.2.0)
       nokogiri (~> 1.6)
-      rubyzip (~> 1.0)
-      selenium-webdriver (~> 3.0)
-    webmock (3.6.2)
+      rubyzip (>= 1.3.0)
+      selenium-webdriver (>= 3.0, < 4.0)
+    webmock (3.8.0)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     whenever (0.11.0)
       chronic (>= 0.6.3)
     wicked_pdf (1.1.0)
-    wkhtmltopdf-binary (0.12.4)
+    wkhtmltopdf-binary (0.12.5)
     xml-simple (1.1.5)
     xpath (2.1.0)
       nokogiri (~> 1.3)
@@ -758,6 +719,7 @@ DEPENDENCIES
   active_model_serializers (= 0.8.4)
   activemerchant (~> 1.78)
   activerecord-import
+  activerecord-postgresql-adapter
   acts-as-taggable-on (~> 3.4)
   andand
   angular-rails-templates (~> 0.3.0)
@@ -769,7 +731,7 @@ DEPENDENCIES
   blockenspiel
   bugsnag
   byebug (~> 9.0.0)
-  capybara (>= 2.15.4)
+  capybara (>= 2.18.0)
   coffee-rails (~> 3.2.1)
   combine_pdf
   compass-rails
@@ -793,58 +755,54 @@ DEPENDENCIES
   foundation-icons-sass-rails
   foundation-rails
   foundation_rails_helper!
-  fuubar (~> 2.4.1)
+  fuubar (~> 2.5.0)
   geocoder
   gmaps4rails
-  guard
-  guard-livereload
-  guard-rails
-  guard-rspec (~> 4.7.3)
   haml
   i18n (~> 0.6.11)
-  i18n-js (~> 3.3.0)
+  i18n-js (~> 3.5.1)
   immigrant
   jquery-migrate-rails
   jquery-rails (= 3.0.4)
   json_spec (~> 1.1.4)
   jwt (~> 2.2)
+  kaminari (~> 0.14.1)
   knapsack
   letter_opener (>= 1.4.1)
-  listen (= 3.0.8)
+  mini_racer (= 0.2.9)
   momentjs-rails
   newrelic_rpm (~> 3.0)
   nokogiri (>= 1.6.7.1)
-  oauth2 (~> 1.4.1)
+  oauth2 (~> 1.4.2)
   ofn-qz!
   oj
   order_management!
   paper_trail (~> 5.2.3)
   paperclip (~> 3.4.1)
-  pg
+  pg (~> 0.21.0)
   pry-byebug (>= 3.4.3)
   rabl
-  rack-mini-profiler (< 1.0.0)
+  rack-mini-profiler (< 2.0.0)
   rack-rewrite
   rack-ssl
   rails (~> 3.2.22)
   rails-i18n (~> 3.0.0)
   rails_safe_tasks (~> 1.0)
   redcarpet
-  roadie-rails (~> 1.1.1)
-  roo (~> 2.7.0)
+  roadie-rails (~> 1.3.0)
+  roo (~> 2.8.2)
   roo-xls (~> 1.1.0)
   rspec-rails (>= 3.5.2)
   rspec-retry
-  rubocop (>= 0.49.1)
+  rubocop
+  rubocop-rails
   sass (~> 3.3)
   sass-rails (~> 3.2.3)
   selenium-webdriver
   shoulda-matchers
   simple_form!
   simplecov
-  skylight (< 2.0)
   spinjs-rails
-  spree_api!
   spree_backend!
   spree_core!
   spree_i18n!
@@ -852,7 +810,7 @@ DEPENDENCIES
   spring (= 1.7.2)
   spring-commands-rspec
   stripe
-  therubyracer (= 0.12.0)
+  test-unit (~> 3.3)
   timecop
   truncate_html
   turbo-sprockets-rails3
@@ -860,14 +818,14 @@ DEPENDENCIES
   unicorn
   unicorn-rails
   web!
-  webdrivers (= 3.8.1)
+  webdrivers
   webmock
   whenever
   wicked_pdf
   wkhtmltopdf-binary
 
 RUBY VERSION
-   ruby 2.1.5p273
+   ruby 2.3.7p456
 
 BUNDLED WITH
    1.17.2

Guardfile

@@ -1,11 +0,0 @@
-# A sample Guardfile
-# More info at https://github.com/guard/guard#readme
-
-guard 'livereload' do
-  watch(%r{app/views/.+\.(erb|haml|slim)$})
-  watch(%r{app/helpers/.+\.rb})
-  watch(%r{public/.+\.(css|js|html)})
-
-  # Rails Assets Pipeline
-  watch(%r{(app|vendor)(/assets/\w+/(.+\.(css|js|html|png|jpg))).*}) { |m| "/assets/#{m[3]}" }
-end

README.md

@@ -1,23 +1,22 @@
 [![Build Status](https://semaphoreci.com/api/v1/openfoodfoundation/openfoodnetwork-2/branches/master/badge.svg)](https://semaphoreci.com/openfoodfoundation/openfoodnetwork-2)
 [![Code Climate](https://codeclimate.com/github/openfoodfoundation/openfoodnetwork.png)](https://codeclimate.com/github/openfoodfoundation/openfoodnetwork)
-[![View performance data on Skylight](https://badges.skylight.io/status/EiXQ6sSKij8y.svg)](https://oss.skylight.io/app/applications/EiXQ6sSKij8y)
 
 # Open Food Network
 
-The Open Food Network is an online marketplace for local food. It enables a network of independent online food stores that connect farmers and food hubs (including coops, online farmers' markets, independent food businesses etc);  with individuals and local businesses. It gives farmers and food hubs an easier and fairer way to distribute their food.
+The Open Food Network is an online marketplace for local food. It enables a network of independent online food stores that connects farmers and food hubs (including co-ops, online farmers markets, independent food businesses, etc) with individuals and local businesses. It gives farmers and food hubs an easier and fairer way to distribute their food.
 
 Supported by the Open Food Foundation and a network of global affiliates, we are proudly open source and not-for-profit - we're trying to seriously disrupt the concentration of power in global agri-food systems, and we need as many smart people working together on this as possible.
 
 We're part of global movement - get involved!
 
-* Join the conversation [on Slack][slack-invite]. Make sure you introduce yourself in the #general channel
+* Join the conversation [on Slack][slack-invite]. Make sure you introduce yourself in the #general channel.
 * Head to [https://openfoodnetwork.org](https://openfoodnetwork.org) for more information about the global OFN project.
 * Check out the [User Guide](https://guide.openfoodnetwork.org/) for a list of features and tutorials.
 * Join our [discussion forum](https://community.openfoodnetwork.org).
 
 ## Contributing
 
-If you are interested in contributing to the OFN in any capacity, please introducing yourself [on Slack][slack-invite], and have a look through our [Contributor Guide][contributor-guide]
+If you are interested in contributing to the OFN in any capacity, please introduce yourself [on Slack][slack-invite], and have a look through our [Contributor Guide][contributor-guide].
 
 Our [GETTING_STARTED](GETTING_STARTED.md) and [CONTRIBUTING](CONTRIBUTING.md) guides are the best place to start for developers looking to set up a development environment and make contributions to the codebase.
 
@@ -36,7 +35,7 @@ We use [BrowserStack](https://www.browserstack.com/) as a manual testing tool. B
 Copyright (c) 2012 - 2019 Open Food Foundation, released under the AGPL licence.
 
 [survey]: https://docs.google.com/a/eaterprises.com.au/forms/d/1zxR5vSiU9CigJ9cEaC8-eJLgYid8CR8er7PPH9Mc-30/edit#
-[slack-invite]: https://openfoodnetwork.org/slack-invite
+[slack-invite]: https://join.slack.com/t/openfoodnetwork/shared_invite/enQtNzY3NDEwNzM2MDM0LWFmNGRhNDUwYzNmNWNkYmFkMzgxNDg1OTg1ODNjNWY4Y2FhNDIwNmE4ZWI0OThiMGNmZjFkODczNGZiYTJmNWI
 [contributor-guide]: https://ofn-user-guide.gitbook.io/ofn-contributor-guide/who-are-we
 [ofn-install]: https://github.com/openfoodfoundation/ofn-install
 [super-admin-guide]: https://ofn-user-guide.gitbook.io/ofn-super-admin-guide

app/assets/javascripts/admin/bulk_product_update.js.coffee

@@ -1,267 +1,288 @@
-angular.module("ofn.admin").controller "AdminProductEditCtrl", ($scope, $timeout, $http, $window, BulkProducts, DisplayProperties, dataFetcher, DirtyProducts, VariantUnitManager, StatusMessage, producers, Taxons, SpreeApiAuth, Columns, tax_categories) ->
-    $scope.loading = true
-    $scope.loadingAllPages = true
+angular.module("ofn.admin").controller "AdminProductEditCtrl", ($scope, $timeout, $filter, $http, $window, BulkProducts, DisplayProperties, DirtyProducts, VariantUnitManager, StatusMessage, producers, Taxons, Columns, tax_categories, RequestMonitor) ->
+  $scope.StatusMessage = StatusMessage
 
-    $scope.StatusMessage = StatusMessage
+  $scope.columns = Columns.columns
 
-    $scope.columns = Columns.columns
+  $scope.variant_unit_options = VariantUnitManager.variantUnitOptions()
 
-    $scope.variant_unit_options = VariantUnitManager.variantUnitOptions()
+  $scope.RequestMonitor = RequestMonitor
+  $scope.pagination = BulkProducts.pagination
+  $scope.per_page_options = [
+    {id: 15, name: t('js.admin.orders.index.per_page', results: 15)},
+    {id: 50, name: t('js.admin.orders.index.per_page', results: 50)},
+    {id: 100, name: t('js.admin.orders.index.per_page', results: 100)}
+  ]
 
-    $scope.filterableColumns = [
-      { name: t("label_producers"),       db_column: "producer_name" },
-      { name: t("name"),           db_column: "name" }
-    ]
+  $scope.filterableColumns = [
+    { name: t("label_producers"),       db_column: "producer_name" },
+    { name: t("name"),           db_column: "name" }
+  ]
 
-    $scope.filterTypes = [
-      { name: t("equals"),         predicate: "eq" },
-      { name: t("contains"),       predicate: "cont" }
-    ]
+  $scope.filterTypes = [
+    { name: t("equals"),         predicate: "eq" },
+    { name: t("contains"),       predicate: "cont" }
+  ]
 
-    $scope.optionTabs =
-      filters:        { title: t("filter_products"),   visible: false }
+  $scope.optionTabs =
+    filters:        { title: t("filter_products"),   visible: false }
+
+  $scope.producers = producers
+  $scope.taxons = Taxons.all
+  $scope.tax_categories = tax_categories
+  $scope.producerFilter = ""
+  $scope.categoryFilter = ""
+  $scope.importDateFilter = ""
+  $scope.page = 1
+  $scope.per_page = 15
+  $scope.products = BulkProducts.products
+  $scope.query = ""
+  $scope.DisplayProperties = DisplayProperties
+
+  $scope.initialise = ->
+    $scope.fetchProducts()
+
+  $scope.$watchCollection '[query, producerFilter, categoryFilter, importDateFilter, per_page]', ->
+    $scope.page = 1 # Reset page when changing filters for new search
+
+  $scope.changePage = (newPage) ->
+    $scope.page = newPage
+    $scope.fetchProducts()
+
+  $scope.fetchProducts = ->
+    removeClearedValues()
+    params = {
+      'q[name_cont]': $scope.query,
+      'q[supplier_id_eq]': $scope.producerFilter,
+      'q[primary_taxon_id_eq]': $scope.categoryFilter,
+      import_date: $scope.importDateFilter,
+      page: $scope.page,
+      per_page: $scope.per_page
+    }
+    RequestMonitor.load(BulkProducts.fetch(params).$promise).then ->
+      $scope.resetProducts()
+
+  removeClearedValues = ->
+    delete $scope.producerFilter if $scope.producerFilter == "0"
+    delete $scope.categoryFilter if $scope.categoryFilter == "0"
+    delete $scope.importDateFilter if $scope.importDateFilter == "0"
+
+  $timeout ->
+    if $scope.showLatestImport
+      $scope.importDateFilter = $scope.importDates[1].id
+
+  $scope.resetProducts = ->
+    DirtyProducts.clear()
+    StatusMessage.clear()
+
+  $scope.updateOnHand = (product) ->
+    on_demand_variants = []
+    if product.variants
+      on_demand_variants = (variant for id, variant of product.variants when variant.on_demand)
+
+    unless product.on_demand || on_demand_variants.length > 0
+      product.on_hand = $scope.onHand(product)
 
 
-    $scope.producers = producers
-    $scope.taxons = Taxons.all
-    $scope.tax_categories = tax_categories
-    $scope.filterProducers = [{id: "0", name: ""}].concat $scope.producers
-    $scope.filterTaxons = [{id: "0", name: ""}].concat $scope.taxons
+  $scope.onHand = (product) ->
+    onHand = 0
+    if product.hasOwnProperty("variants") and product.variants instanceof Object
+      for id, variant of product.variants
+        onHand = onHand + parseInt(if variant.on_hand > 0 then variant.on_hand else 0)
+    else
+      onHand = "error"
+    onHand
+
+  $scope.shiftTab = (tab) ->
+    $scope.visibleTab.visible = false unless $scope.visibleTab == tab || $scope.visibleTab == undefined
+    tab.visible = !tab.visible
+    $scope.visibleTab = tab
+
+  $scope.resetSelectFilters = ->
+    $scope.query = ""
     $scope.producerFilter = "0"
     $scope.categoryFilter = "0"
     $scope.importDateFilter = "0"
-    $scope.products = BulkProducts.products
-    $scope.filteredProducts = []
-    $scope.currentFilters = []
-    $scope.limit = 15
-    $scope.query = ""
-    $scope.DisplayProperties = DisplayProperties
 
-    $scope.initialise = ->
-      SpreeApiAuth.authorise()
-      .then ->
-        $scope.spree_api_key_ok = true
-        $scope.fetchProducts()
-      .catch (message) ->
-        $scope.api_error_msg = message
+  confirm_unsaved_changes = () ->
+    (DirtyProducts.count() > 0 and confirm(t("unsaved_changes_confirmation"))) or (DirtyProducts.count() == 0)
+  
+  editProductUrl = (product, variant) ->
+    "/admin/products/" + product.permalink_live + ((if variant then "/variants/" + variant.id else "")) + "/edit"
 
-    $scope.$watchCollection '[query, producerFilter, categoryFilter, importDateFilter]', ->
-      $scope.limit = 15 # Reset limit whenever searching
-
-    $scope.fetchProducts = ->
-      $scope.loading = true
-      $scope.loadingAllPages = true
-      BulkProducts.fetch($scope.currentFilters, ->
-        $scope.loadingAllPages = false
-      ).then ->
-        $scope.resetProducts()
-        $scope.loading = false
-
-    $timeout ->
-      if $scope.showLatestImport
-        $scope.importDateFilter = $scope.importDates[1].id
-
-    $scope.resetProducts = ->
-      DirtyProducts.clear()
-      StatusMessage.clear()
-
-    $scope.updateOnHand = (product) ->
-      on_demand_variants = []
-      if product.variants
-        on_demand_variants = (variant for id, variant of product.variants when variant.on_demand)
-
-      unless product.on_demand || on_demand_variants.length > 0
-        product.on_hand = $scope.onHand(product)
+  $scope.editWarn = (product, variant) ->
+    if confirm_unsaved_changes()
+      window.open(editProductUrl(product, variant), "_blank")
 
 
-    $scope.onHand = (product) ->
-      onHand = 0
-      if product.hasOwnProperty("variants") and product.variants instanceof Object
-        for id, variant of product.variants
-          onHand = onHand + parseInt(if variant.on_hand > 0 then variant.on_hand else 0)
-      else
-        onHand = "error"
-      onHand
+  $scope.toggleShowAllVariants = ->
+    showVariants = !DisplayProperties.showVariants 0
+    $scope.products.forEach (product) ->
+      DisplayProperties.setShowVariants product.id, showVariants
+    DisplayProperties.setShowVariants 0, showVariants
 
-    $scope.shiftTab = (tab) ->
-      $scope.visibleTab.visible = false unless $scope.visibleTab == tab || $scope.visibleTab == undefined
-      tab.visible = !tab.visible
-      $scope.visibleTab = tab
-
-    $scope.resetSelectFilters = ->
-      $scope.query = ""
-      $scope.producerFilter = "0"
-      $scope.categoryFilter = "0"
-      $scope.importDateFilter = "0"
-
-    $scope.editWarn = (product, variant) ->
-      if (DirtyProducts.count() > 0 and confirm(t("unsaved_changes_confirmation"))) or (DirtyProducts.count() == 0)
-        window.location = "/admin/products/" + product.permalink_live + ((if variant then "/variants/" + variant.id else "")) + "/edit"
+  $scope.addVariant = (product) ->
+    product.variants.push
+      id: $scope.nextVariantId()
+      unit_value: null
+      unit_description: null
+      on_demand: false
+      display_as: null
+      display_name: null
+      on_hand: null
+      price: null
+    DisplayProperties.setShowVariants product.id, true
 
 
-    $scope.toggleShowAllVariants = ->
-      showVariants = !DisplayProperties.showVariants 0
-      $scope.filteredProducts.forEach (product) ->
-        DisplayProperties.setShowVariants product.id, showVariants
-      DisplayProperties.setShowVariants 0, showVariants
+  $scope.nextVariantId = ->
+    $scope.variantIdCounter = 0 unless $scope.variantIdCounter?
+    $scope.variantIdCounter -= 1
+    $scope.variantIdCounter
 
-    $scope.addVariant = (product) ->
-      product.variants.push
-        id: $scope.nextVariantId()
-        unit_value: null
-        unit_description: null
-        on_demand: false
-        display_as: null
-        display_name: null
-        on_hand: null
-        price: null
-      DisplayProperties.setShowVariants product.id, true
-
-
-    $scope.nextVariantId = ->
-      $scope.variantIdCounter = 0 unless $scope.variantIdCounter?
-      $scope.variantIdCounter -= 1
-      $scope.variantIdCounter
-
-    $scope.deleteProduct = (product) ->
-      if confirm("Are you sure?")
-        $http(
-          method: "DELETE"
-          url: "/api/products/" + product.id + "/soft_delete"
-        ).success (data) ->
-          $scope.products.splice $scope.products.indexOf(product), 1
-          DirtyProducts.deleteProduct product.id
-          $scope.displayDirtyProducts()
-
-
-    $scope.deleteVariant = (product, variant) ->
-      if product.variants.length > 1
-        if !$scope.variantSaved(variant)
-          $scope.removeVariant(product, variant)
-        else
-          if confirm(t("are_you_sure"))
-            $http(
-              method: "DELETE"
-              url: "/api/products/" + product.permalink_live + "/variants/" + variant.id + "/soft_delete"
-            ).success (data) ->
-              $scope.removeVariant(product, variant)
-      else
-        alert(t("delete_product_variant"))
-
-    $scope.removeVariant = (product, variant) ->
-      product.variants.splice product.variants.indexOf(variant), 1
-      DirtyProducts.deleteVariant product.id, variant.id
-      $scope.displayDirtyProducts()
-
-
-    $scope.cloneProduct = (product) ->
-      BulkProducts.cloneProduct product
-
-    $scope.hasVariants = (product) ->
-      product.variants.length > 0
-
-
-    $scope.hasUnit = (product) ->
-      product.variant_unit_with_scale?
-
-
-    $scope.variantSaved = (variant) ->
-      variant.hasOwnProperty('id') && variant.id > 0
-
-
-    $scope.hasOnDemandVariants = (product) ->
-      (variant for id, variant of product.variants when variant.on_demand).length > 0
-
-
-    $scope.submitProducts = ->
-      # Pack pack $scope.products, so they will match the list returned from the server,
-      # then pack $scope.dirtyProducts, ensuring that the correct product info is sent to the server.
-      $scope.packProduct product for id, product of $scope.products
-      $scope.packProduct product for id, product of DirtyProducts.all()
-
-      productsToSubmit = filterSubmitProducts(DirtyProducts.all())
-      if productsToSubmit.length > 0
-        $scope.updateProducts productsToSubmit # Don't submit an empty list
-      else
-        StatusMessage.display 'alert', t("products_change")
-
-
-    $scope.updateProducts = (productsToSubmit) ->
-      $scope.displayUpdating()
+  $scope.deleteProduct = (product) ->
+    if confirm("Are you sure?")
       $http(
-        method: "POST"
-        url: "/admin/products/bulk_update"
-        data:
-          products: productsToSubmit
-          filters: $scope.currentFilters
-      ).success((data) ->
-        DirtyProducts.clear()
-        BulkProducts.updateVariantLists(data.products || [])
-        $timeout -> $scope.displaySuccess()
-      ).error (data, status) ->
-        if status == 400 && data.errors? && data.errors.length > 0
-          errors = error + "\n" for error in data.errors
-          alert t("products_update_error") + "\n" + errors
-          $scope.displayFailure t("products_update_error")
-        else
-          $scope.displayFailure t("products_update_error_data") + status
+        method: "DELETE"
+        url: "/api/products/" + product.id
+      ).success (data) ->
+        $scope.products.splice $scope.products.indexOf(product), 1
+        DirtyProducts.deleteProduct product.id
+        $scope.displayDirtyProducts()
 
-    $scope.cancel = (destination) ->
-      $window.location = destination
 
-    $scope.packProduct = (product) ->
-      if product.variant_unit_with_scale
-        match = product.variant_unit_with_scale.match(/^([^_]+)_([\d\.]+)$/)
-        if match
-          product.variant_unit = match[1]
-          product.variant_unit_scale = parseFloat(match[2])
-        else
-          product.variant_unit = product.variant_unit_with_scale
-          product.variant_unit_scale = null
+  $scope.deleteVariant = (product, variant) ->
+    if product.variants.length > 1
+      if !$scope.variantSaved(variant)
+        $scope.removeVariant(product, variant)
       else
-        product.variant_unit = product.variant_unit_scale = null
+        if confirm(t("are_you_sure"))
+          $http(
+            method: "DELETE"
+            url: "/api/products/" + product.permalink_live + "/variants/" + variant.id
+          ).success (data) ->
+            $scope.removeVariant(product, variant)
+    else
+      alert(t("delete_product_variant"))
 
-      $scope.packVariant product, product.master if product.master
-
-      if product.variants
-        for id, variant of product.variants
-          $scope.packVariant product, variant
+  $scope.removeVariant = (product, variant) ->
+    product.variants.splice product.variants.indexOf(variant), 1
+    DirtyProducts.deleteVariant product.id, variant.id
+    $scope.displayDirtyProducts()
 
 
-    $scope.packVariant = (product, variant) ->
-      if variant.hasOwnProperty("unit_value_with_description")
-        match = variant.unit_value_with_description.match(/^([\d\.]+(?= |$)|)( |)(.*)$/)
-        if match
-          product = BulkProducts.find product.id
-          variant.unit_value  = parseFloat(match[1])
-          variant.unit_value  = null if isNaN(variant.unit_value)
-          variant.unit_value *= product.variant_unit_scale if variant.unit_value && product.variant_unit_scale
-          variant.unit_description = match[3]
+  $scope.cloneProduct = (product) ->
+    BulkProducts.cloneProduct product
 
-    $scope.incrementLimit = ->
-      if $scope.limit < $scope.products.length
-        $scope.limit = $scope.limit + 5
+  $scope.hasVariants = (product) ->
+    product.variants.length > 0
 
 
-    $scope.displayUpdating = ->
-      StatusMessage.display 'progress', t("saving")
+  $scope.hasUnit = (product) ->
+    product.variant_unit_with_scale?
 
 
-    $scope.displaySuccess = ->
-      StatusMessage.display 'success',t("products_changes_saved")
-      $scope.bulk_product_form.$setPristine()
+  $scope.variantSaved = (variant) ->
+    variant.hasOwnProperty('id') && variant.id > 0
 
 
-    $scope.displayFailure = (failMessage) ->
-      StatusMessage.display  'failure', t("products_update_error_msg") + "#{failMessage}"
+  $scope.hasOnDemandVariants = (product) ->
+    (variant for id, variant of product.variants when variant.on_demand).length > 0
 
 
-    $scope.displayDirtyProducts = ->
-      count = DirtyProducts.count()
-      switch count
-        when 0 then StatusMessage.clear()
-        when 1 then StatusMessage.display 'notice', t("one_product_unsaved")
-        else StatusMessage.display 'notice', t("products_unsaved", n: count)
+  $scope.submitProducts = ->
+    # Pack pack $scope.products, so they will match the list returned from the server,
+    # then pack $scope.dirtyProducts, ensuring that the correct product info is sent to the server.
+    $scope.packProduct product for id, product of $scope.products
+    $scope.packProduct product for id, product of DirtyProducts.all()
+
+    productsToSubmit = filterSubmitProducts(DirtyProducts.all())
+    if productsToSubmit.length > 0
+      $scope.updateProducts productsToSubmit # Don't submit an empty list
+    else
+      StatusMessage.display 'alert', t("products_change")
+
+
+  $scope.updateProducts = (productsToSubmit) ->
+    $scope.displayUpdating()
+    $http(
+      method: "POST"
+      url: "/admin/products/bulk_update"
+      data:
+        products: productsToSubmit
+        filters:
+          'q[name_cont]': $scope.query
+          'q[supplier_id_eq]': $scope.producerFilter
+          'q[primary_taxon_id_eq]': $scope.categoryFilter
+          import_date: $scope.importDateFilter
+        page: $scope.page
+        per_page: $scope.per_page
+    ).success((data) ->
+      DirtyProducts.clear()
+      BulkProducts.updateVariantLists(data.products || [])
+      $timeout -> $scope.displaySuccess()
+    ).error (data, status) ->
+      if status == 400 && data.errors? && data.errors.length > 0
+        errors = error + "\n" for error in data.errors
+        alert t("products_update_error") + "\n" + errors
+        $scope.displayFailure t("products_update_error")
+      else
+        $scope.displayFailure t("products_update_error_data") + status
+
+  $scope.cancel = (destination) ->
+    $window.location = destination
+
+  $scope.packProduct = (product) ->
+    if product.variant_unit_with_scale
+      match = product.variant_unit_with_scale.match(/^([^_]+)_([\d\.]+)$/)
+      if match
+        product.variant_unit = match[1]
+        product.variant_unit_scale = parseFloat(match[2])
+      else
+        product.variant_unit = product.variant_unit_with_scale
+        product.variant_unit_scale = null
+    else
+      product.variant_unit = product.variant_unit_scale = null
+
+    $scope.packVariant product, product.master if product.master
+
+    if product.variants
+      for id, variant of product.variants
+        $scope.packVariant product, variant
+
+
+  $scope.packVariant = (product, variant) ->
+    if variant.hasOwnProperty("unit_value_with_description")
+      match = variant.unit_value_with_description.match(/^([\d\.]+(?= |$)|)( |)(.*)$/)
+      if match
+        product = BulkProducts.find product.id
+        variant.unit_value  = parseFloat(match[1])
+        variant.unit_value  = null if isNaN(variant.unit_value)
+        variant.unit_value *= product.variant_unit_scale if variant.unit_value && product.variant_unit_scale
+        variant.unit_description = match[3]
+
+  $scope.incrementLimit = ->
+    if $scope.limit < $scope.products.length
+      $scope.limit = $scope.limit + 5
+
+
+  $scope.displayUpdating = ->
+    StatusMessage.display 'progress', t("saving")
+
+
+  $scope.displaySuccess = ->
+    StatusMessage.display 'success',t("products_changes_saved")
+    $scope.bulk_product_form.$setPristine()
+
+
+  $scope.displayFailure = (failMessage) ->
+    StatusMessage.display  'failure', t("products_update_error_msg") + "#{failMessage}"
+
+
+  $scope.displayDirtyProducts = ->
+    count = DirtyProducts.count()
+    switch count
+      when 0 then StatusMessage.clear()
+      when 1 then StatusMessage.display 'notice', t("one_product_unsaved")
+      else StatusMessage.display 'notice', t("products_unsaved", n: count)
 
 
 filterSubmitProducts = (productsToFilter) ->

app/assets/javascripts/admin/index_utils/services/spree_api_auth.js.coffee

@@ -1,16 +0,0 @@
-angular.module("admin.indexUtils").factory "SpreeApiAuth", ($q, $http, SpreeApiKey) ->
-  new class SpreeApiAuth
-    authorise: ->
-      deferred = $q.defer()
-
-      $http.get("/api/users/authorise_api?token=" + SpreeApiKey)
-      .success (response) ->
-        if response?.success == "Use of API Authorised"
-          $http.defaults.headers.common["X-Spree-Token"] = SpreeApiKey
-          deferred.resolve()
-
-      .error (response) ->
-        error = response?.error || t('js.unauthorized')
-        deferred.reject(error)
-
-      deferred.promise

app/assets/javascripts/admin/order_cycles/controllers/create.js.coffee

@@ -1,92 +1,12 @@
 angular.module('admin.orderCycles')
-  .controller 'AdminCreateOrderCycleCtrl', ($scope, $filter, $window, OrderCycle, Enterprise, EnterpriseFee, Schedules, RequestMonitor, ocInstance, StatusMessage) ->
-    $scope.enterprises = Enterprise.index(coordinator_id: ocInstance.coordinator_id)
-    $scope.supplier_enterprises = Enterprise.producer_enterprises
-    $scope.distributor_enterprises = Enterprise.hub_enterprises
-    $scope.supplied_products = Enterprise.supplied_products
-    $scope.enterprise_fees = EnterpriseFee.index(coordinator_id: ocInstance.coordinator_id)
-    $scope.schedules = Schedules.index({enterprise_id: ocInstance.coordinator_id})
+  .controller 'AdminCreateOrderCycleCtrl', ($scope, $controller, $filter, $window, OrderCycle, Enterprise, EnterpriseFee, Schedules, RequestMonitor, ocInstance, StatusMessage) ->
+    $controller('AdminOrderCycleBasicCtrl', {$scope: $scope, ocInstance: ocInstance})
 
-    $scope.OrderCycle = OrderCycle
     $scope.order_cycle = OrderCycle.new({ coordinator_id: ocInstance.coordinator_id})
-
-    $scope.StatusMessage = StatusMessage
-
-    $scope.$watch 'order_cycle_form.$dirty', (newValue) ->
-      StatusMessage.display 'notice', t("admin.unsaved_changes") if newValue
-
-    $scope.$watch 'order_cycle_form.$valid', (isValid) ->
-      StatusMessage.setValidation(isValid)
-
-    $scope.loaded = ->
-      Enterprise.loaded && EnterpriseFee.loaded && OrderCycle.loaded && !RequestMonitor.loading
-
-    $scope.suppliedVariants = (enterprise_id) ->
-      Enterprise.suppliedVariants(enterprise_id)
-
-    $scope.exchangeSelectedVariants = (exchange) ->
-      OrderCycle.exchangeSelectedVariants(exchange)
-
-    $scope.setExchangeVariants = (exchange, variants, selected) ->
-      OrderCycle.setExchangeVariants(exchange, variants, selected)
-
-    $scope.enterpriseTotalVariants = (enterprise) ->
-      Enterprise.totalVariants(enterprise)
-
-    $scope.productSuppliedToOrderCycle = (product) ->
-      OrderCycle.productSuppliedToOrderCycle(product)
-
-    $scope.variantSuppliedToOrderCycle = (variant) ->
-      OrderCycle.variantSuppliedToOrderCycle(variant)
-
-    $scope.incomingExchangeVariantsFor = (enterprise_id) ->
-      $filter('filterExchangeVariants')(OrderCycle.incomingExchangesVariants(), $scope.order_cycle.visible_variants_for_outgoing_exchanges[enterprise_id])
-
-    $scope.exchangeDirection = (exchange) ->
-      OrderCycle.exchangeDirection(exchange)
-
-    $scope.enterprisesWithFees = ->
-      $scope.enterprises[id] for id in OrderCycle.participatingEnterpriseIds() when $scope.enterpriseFeesForEnterprise(id).length > 0
-
-    $scope.enterpriseFeesForEnterprise = (enterprise_id) ->
-      EnterpriseFee.forEnterprise(parseInt(enterprise_id))
-
-    $scope.addSupplier = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addSupplier($scope.new_supplier_id)
-
-    $scope.addDistributor = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addDistributor($scope.new_distributor_id)
-
-    $scope.removeExchange = ($event, exchange) ->
-      $event.preventDefault()
-      OrderCycle.removeExchange(exchange)
-      $scope.order_cycle_form.$dirty = true
-
-    $scope.addCoordinatorFee = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addCoordinatorFee()
-
-    $scope.removeCoordinatorFee = ($event, index) ->
-      $event.preventDefault()
-      OrderCycle.removeCoordinatorFee(index)
-
-    $scope.addExchangeFee = ($event, exchange) ->
-      $event.preventDefault()
-      OrderCycle.addExchangeFee(exchange)
-
-    $scope.removeExchangeFee = ($event, exchange, index) ->
-      $event.preventDefault()
-      OrderCycle.removeExchangeFee(exchange, index)
-
-    $scope.removeDistributionOfVariant = (variant_id) ->
-      OrderCycle.removeDistributionOfVariant(variant_id)
+    $scope.enterprises = Enterprise.index(coordinator_id: ocInstance.coordinator_id)
+    $scope.enterprise_fees = EnterpriseFee.index(coordinator_id: ocInstance.coordinator_id)
 
     $scope.submit = ($event, destination) ->
       $event.preventDefault()
       StatusMessage.display 'progress', t('js.saving')
       OrderCycle.create(destination)
-
-    $scope.cancel = (destination) ->
-      $window.location = destination

app/assets/javascripts/admin/order_cycles/controllers/edit.js.coffee

@@ -1,91 +1,17 @@
 angular.module('admin.orderCycles')
-  .controller 'AdminEditOrderCycleCtrl', ($scope, $filter, $location, $window, OrderCycle, Enterprise, EnterpriseFee, StatusMessage, Schedules, RequestMonitor, ocInstance) ->
+  .controller 'AdminEditOrderCycleCtrl', ($scope, $controller, $filter, $location, $window, OrderCycle, Enterprise, EnterpriseFee, StatusMessage, Schedules, RequestMonitor, ocInstance) ->
+    $controller('AdminOrderCycleBasicCtrl', {$scope: $scope, ocInstance: ocInstance})
+
     order_cycle_id = $location.absUrl().match(/\/admin\/order_cycles\/(\d+)/)[1]
-    $scope.enterprises = Enterprise.index(order_cycle_id: order_cycle_id)
-    $scope.supplier_enterprises = Enterprise.producer_enterprises
-    $scope.distributor_enterprises = Enterprise.hub_enterprises
-    $scope.supplied_products = Enterprise.supplied_products
-    $scope.enterprise_fees = EnterpriseFee.index(order_cycle_id: order_cycle_id)
-    $scope.schedules = Schedules.index({enterprise_id: ocInstance.coordinator_id})
-
-    $scope.OrderCycle = OrderCycle
     $scope.order_cycle = OrderCycle.load(order_cycle_id)
-
-    $scope.StatusMessage = StatusMessage
-
-    $scope.$watch 'order_cycle_form.$dirty', (newValue) ->
-      StatusMessage.display 'notice', t("admin.unsaved_changes") if newValue
-
-    $scope.$watch 'order_cycle_form.$valid', (isValid) ->
-      StatusMessage.setValidation(isValid)
-
-    $scope.loaded = ->
-      Enterprise.loaded && EnterpriseFee.loaded && OrderCycle.loaded && !RequestMonitor.loading
-
-    $scope.suppliedVariants = (enterprise_id) ->
-      Enterprise.suppliedVariants(enterprise_id)
-
-    $scope.exchangeSelectedVariants = (exchange) ->
-      OrderCycle.exchangeSelectedVariants(exchange)
-
-    $scope.setExchangeVariants = (exchange, variants, selected) ->
-      OrderCycle.setExchangeVariants(exchange, variants, selected)
-
-    $scope.enterpriseTotalVariants = (enterprise) ->
-      Enterprise.totalVariants(enterprise)
-
-    $scope.productSuppliedToOrderCycle = (product) ->
-      OrderCycle.productSuppliedToOrderCycle(product)
-
-    $scope.variantSuppliedToOrderCycle = (variant) ->
-      OrderCycle.variantSuppliedToOrderCycle(variant)
-
-    $scope.incomingExchangeVariantsFor = (enterprise_id) ->
-      $filter('filterExchangeVariants')(OrderCycle.incomingExchangesVariants(), $scope.order_cycle.visible_variants_for_outgoing_exchanges[enterprise_id])
-
-    $scope.exchangeDirection = (exchange) ->
-      OrderCycle.exchangeDirection(exchange)
-
-    $scope.enterprisesWithFees = ->
-      $scope.enterprises[id] for id in OrderCycle.participatingEnterpriseIds() when $scope.enterpriseFeesForEnterprise(id).length > 0
-
-    $scope.enterpriseFeesForEnterprise = (enterprise_id) ->
-      EnterpriseFee.forEnterprise(parseInt(enterprise_id))
-
-    $scope.addSupplier = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addSupplier($scope.new_supplier_id)
-
-    $scope.addDistributor = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addDistributor($scope.new_distributor_id)
-
-    $scope.removeExchange = ($event, exchange) ->
-      $event.preventDefault()
-      OrderCycle.removeExchange(exchange)
-      $scope.order_cycle_form.$dirty = true
-
-    $scope.addCoordinatorFee = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addCoordinatorFee()
+    $scope.enterprises = Enterprise.index(order_cycle_id: order_cycle_id)
+    $scope.enterprise_fees = EnterpriseFee.index(order_cycle_id: order_cycle_id)
 
     $scope.removeCoordinatorFee = ($event, index) ->
       $event.preventDefault()
       OrderCycle.removeCoordinatorFee(index)
       $scope.order_cycle_form.$dirty = true
 
-    $scope.addExchangeFee = ($event, exchange) ->
-      $event.preventDefault()
-      OrderCycle.addExchangeFee(exchange)
-
-    $scope.removeExchangeFee = ($event, exchange, index) ->
-      $event.preventDefault()
-      OrderCycle.removeExchangeFee(exchange, index)
-      $scope.order_cycle_form.$dirty = true
-
-    $scope.removeDistributionOfVariant = (variant_id) ->
-      OrderCycle.removeDistributionOfVariant(variant_id)
-
     $scope.submit = (destination) ->
       $event.preventDefault()
       StatusMessage.display 'progress', t('js.saving')
@@ -94,6 +20,3 @@ angular.module('admin.orderCycles')
       $event.preventDefault()
       StatusMessage.display 'progress', t('js.saving')
       OrderCycle.update(destination, $scope.order_cycle_form)
-
-    $scope.cancel = (destination) ->
-      $window.location = destination

app/assets/javascripts/admin/order_cycles/controllers/incoming_controller.js.coffee

@@ -0,0 +1,31 @@
+angular.module('admin.orderCycles').controller 'AdminOrderCycleIncomingCtrl', ($scope, $controller, $location, Enterprise, OrderCycle, ExchangeProduct, ocInstance) ->
+  $controller('AdminOrderCycleExchangesCtrl', {$scope: $scope, ocInstance: ocInstance, $location: $location})
+
+  $scope.view = 'incoming'
+
+  $scope.exchangeTotalVariants = (exchange) ->
+    return unless $scope.enterprises? && $scope.enterprises[exchange.enterprise_id]?
+
+    enterprise = $scope.enterprises[exchange.enterprise_id]
+    return enterprise.numVariants if enterprise.numVariants?
+
+    enterprise.numVariants = 0
+    params = { exchange_id: exchange.id, enterprise_id: exchange.enterprise_id, order_cycle_id: $scope.order_cycle.id, incoming: true}
+    ExchangeProduct.countVariants params, (variants_count) ->
+      enterprise.numVariants = variants_count
+      $scope.setSelectAllVariantsCheckboxValue(exchange, enterprise.numVariants)
+
+    return enterprise.numVariants
+
+  $scope.addSupplier = ($event) ->
+    $event.preventDefault()
+    OrderCycle.addSupplier $scope.new_supplier_id
+
+  # To select all variants we first need to load them all from the server
+  #
+  # This is only needed in Incoming exchanges as here we use supplied_products,
+  #   in Outgoing Exchanges the variants are loaded as part of the Exchange payload
+  $scope.selectAllVariants = (exchange, selected) ->
+    $scope.loadAllExchangeProducts(exchange).then ->
+      $scope.setExchangeVariants(exchange, $scope.suppliedVariants(exchange.enterprise_id), selected)
+      $scope.$apply()

app/assets/javascripts/admin/order_cycles/controllers/order_cycle_basic_controller.js.coffee

@@ -0,0 +1,40 @@
+angular.module('admin.orderCycles')
+  .controller 'AdminOrderCycleBasicCtrl', ($scope, $filter, $window, OrderCycle, Enterprise, EnterpriseFee, Schedules, RequestMonitor, ocInstance, StatusMessage) ->
+    $scope.StatusMessage = StatusMessage
+    $scope.OrderCycle = OrderCycle
+
+    $scope.$watch 'order_cycle_form.$dirty', (newValue) ->
+      StatusMessage.display 'notice', t("admin.unsaved_changes") if newValue
+
+    $scope.$watch 'order_cycle_form.$valid', (isValid) ->
+      StatusMessage.setValidation(isValid)
+
+    $scope.loaded = ->
+      Enterprise.loaded && EnterpriseFee.loaded && OrderCycle.loaded && !RequestMonitor.loading
+
+    $scope.enterpriseFeesForEnterprise = (enterprise_id) ->
+      EnterpriseFee.forEnterprise(parseInt(enterprise_id))
+
+    $scope.cancel = (destination) ->
+      $window.location = destination
+
+    # Used in panels/exchange_products_supplied.html
+    $scope.suppliedVariants = (enterprise_id) ->
+      Enterprise.suppliedVariants(enterprise_id)
+
+    # Used in panels/exchange_products_supplied.html and panels/exchange_products_distributed.html
+    $scope.setExchangeVariants = (exchange, variants, selected) ->
+      OrderCycle.setExchangeVariants(exchange, variants, selected)
+
+    # The following methods are specific to the general settings pages:
+    #   - simple create, simple edit and general settings pages
+
+    $scope.schedules = Schedules.index({enterprise_id: ocInstance.coordinator_id})
+
+    $scope.addCoordinatorFee = ($event) ->
+      $event.preventDefault()
+      OrderCycle.addCoordinatorFee()
+
+    $scope.removeCoordinatorFee = ($event, index) ->
+      $event.preventDefault()
+      OrderCycle.removeCoordinatorFee(index)

app/assets/javascripts/admin/order_cycles/controllers/order_cycle_exchanges_controller.js.coffee

@@ -0,0 +1,76 @@
+angular.module('admin.orderCycles')
+  .controller 'AdminOrderCycleExchangesCtrl', ($scope, $controller, $filter, $window, $location, $timeout, OrderCycle, ExchangeProduct, Enterprise, EnterpriseFee, Schedules, RequestMonitor, ocInstance, StatusMessage) ->
+    $controller('AdminEditOrderCycleCtrl', {$scope: $scope, ocInstance: ocInstance, $location: $location})
+
+    $scope.supplier_enterprises = Enterprise.producer_enterprises
+    $scope.distributor_enterprises = Enterprise.hub_enterprises
+
+    $scope.productsLoading = ->
+      RequestMonitor.loading
+
+    $scope.setSelectAllVariantsCheckboxValue = (exchange, totalNumberOfVariants) ->
+      exchange.select_all_variants = $scope.exchangeSelectedVariants(exchange) >= totalNumberOfVariants
+
+    $scope.exchangeSelectedVariants = (exchange) ->
+      OrderCycle.exchangeSelectedVariants(exchange)
+
+    $scope.exchangeDirection = (exchange) ->
+      OrderCycle.exchangeDirection(exchange)
+
+    $scope.enterprisesWithFees = ->
+      $scope.enterprises[id] for id in OrderCycle.participatingEnterpriseIds() when $scope.enterpriseFeesForEnterprise(id).length > 0
+
+    $scope.removeExchange = ($event, exchange) ->
+      $event.preventDefault()
+      OrderCycle.removeExchange(exchange)
+      $scope.order_cycle_form.$dirty = true
+
+    $scope.addExchangeFee = ($event, exchange) ->
+      $event.preventDefault()
+      OrderCycle.addExchangeFee(exchange)
+
+    $scope.removeExchangeFee = ($event, exchange, index) ->
+      $event.preventDefault()
+      OrderCycle.removeExchangeFee(exchange, index)
+      $scope.order_cycle_form.$dirty = true
+
+    $scope.setPickupTimeFieldDirty = (index) ->
+      $timeout ->
+        pickup_time_field_name = "order_cycle_outgoing_exchange_" + index + "_pickup_time"
+        $scope.order_cycle_form[pickup_time_field_name].$setDirty()
+
+    $scope.removeDistributionOfVariant = (variant_id) ->
+      OrderCycle.removeDistributionOfVariant(variant_id)
+
+    $scope.loadExchangeProducts = (exchange, page = 1) ->
+      enterprise = $scope.enterprises[exchange.enterprise_id]
+      enterprise.supplied_products ?= []
+
+      return if enterprise.last_page_loaded? && enterprise.last_page_loaded >= page
+      enterprise.last_page_loaded = page
+
+      incoming = true if $scope.view == 'incoming'
+      params = { exchange_id: exchange.id, enterprise_id: exchange.enterprise_id, order_cycle_id: $scope.order_cycle.id, incoming: incoming, page: page}
+      ExchangeProduct.index params, (products, num_of_pages, num_of_products) ->
+        enterprise.num_of_pages = num_of_pages
+        enterprise.num_of_products = num_of_products
+        enterprise.supplied_products.push products...
+
+    $scope.loadMoreExchangeProducts = (exchange) ->
+      $scope.loadExchangeProducts(exchange, $scope.enterprises[exchange.enterprise_id].last_page_loaded + 1)
+
+    $scope.loadAllExchangeProducts = (exchange) ->
+      enterprise = $scope.enterprises[exchange.enterprise_id]
+
+      if enterprise.last_page_loaded < enterprise.num_of_pages
+        for page_to_load in [(enterprise.last_page_loaded + 1)..enterprise.num_of_pages]
+          RequestMonitor.load $scope.loadExchangeProducts(exchange, page_to_load).$promise
+
+      RequestMonitor.loadQueue
+
+    # initialize exchange products panel if not yet done
+    $scope.exchangeProdutsPanelInitialized = []
+    $scope.initializeExchangeProductsPanel = (exchange) ->
+      return if $scope.exchangeProdutsPanelInitialized[exchange.enterprise_id]
+      RequestMonitor.load $scope.loadExchangeProducts(exchange).$promise
+      $scope.exchangeProdutsPanelInitialized[exchange.enterprise_id] = true

app/assets/javascripts/admin/order_cycles/controllers/outgoing_controller.js.coffee

@@ -0,0 +1,24 @@
+angular.module('admin.orderCycles').controller 'AdminOrderCycleOutgoingCtrl', ($scope, $controller, $filter, $location, OrderCycle, ocInstance, StatusMessage) ->
+  $controller('AdminOrderCycleExchangesCtrl', {$scope: $scope, ocInstance: ocInstance, $location: $location})
+
+  $scope.view = 'outgoing'
+
+  $scope.variantSuppliedToOrderCycle = (variant) ->
+    OrderCycle.variantSuppliedToOrderCycle(variant)
+
+  $scope.incomingExchangeVariantsFor = (enterprise_id) ->
+    $filter('filterExchangeVariants')(OrderCycle.incomingExchangesVariants(), $scope.order_cycle.visible_variants_for_outgoing_exchanges[enterprise_id])
+
+  $scope.exchangeTotalVariants = (exchange) ->
+    totalNumberOfVariants = $scope.incomingExchangeVariantsFor(exchange.enterprise_id).length
+    $scope.setSelectAllVariantsCheckboxValue(exchange, totalNumberOfVariants)
+    totalNumberOfVariants
+
+  $scope.addDistributor = ($event) ->
+    $event.preventDefault()
+    OrderCycle.addDistributor $scope.new_distributor_id
+
+  $scope.submit = ($event, destination) ->
+    $event.preventDefault()
+    StatusMessage.display 'progress', t('js.saving')
+    OrderCycle.update(destination, $scope.order_cycle_form) if OrderCycle.confirmNoDistributors()

app/assets/javascripts/admin/order_cycles/controllers/simple_create.js.coffee

@@ -1,58 +1,38 @@
-angular.module('admin.orderCycles').controller "AdminSimpleCreateOrderCycleCtrl", ($scope, $window, OrderCycle, Enterprise, EnterpriseFee, StatusMessage, Schedules, RequestMonitor, ocInstance) ->
-  $scope.StatusMessage = StatusMessage
-  $scope.OrderCycle = OrderCycle
-  $scope.schedules = Schedules.index({enterprise_id: ocInstance.coordinator_id})
+angular.module('admin.orderCycles').controller "AdminSimpleCreateOrderCycleCtrl", ($scope, $controller, $window, OrderCycle, Enterprise, EnterpriseFee, ExchangeProduct, StatusMessage, Schedules, RequestMonitor, ocInstance) ->
+  $controller('AdminOrderCycleBasicCtrl', {$scope: $scope, ocInstance: ocInstance})
+
   $scope.order_cycle = OrderCycle.new {coordinator_id: ocInstance.coordinator_id}, =>
-    # TODO: make this a get method, which only fetches one enterprise
     $scope.enterprises = Enterprise.index {coordinator_id: ocInstance.coordinator_id}, (enterprises) =>
       $scope.init(enterprises)
     $scope.enterprise_fees = EnterpriseFee.index(coordinator_id: ocInstance.coordinator_id)
 
-  $scope.$watch 'order_cycle_form.$dirty', (newValue) ->
-      StatusMessage.display 'notice', t("admin.unsaved_changes") if newValue
-
-  $scope.$watch 'order_cycle_form.$valid', (isValid) ->
-    StatusMessage.setValidation(isValid)
-
   $scope.init = (enterprises) ->
     enterprise = enterprises[Object.keys(enterprises)[0]]
-    OrderCycle.addSupplier enterprise.id
-    OrderCycle.addDistributor enterprise.id
-    $scope.outgoing_exchange = OrderCycle.order_cycle.outgoing_exchanges[0]
-
-    # All variants start as checked
-    OrderCycle.setExchangeVariants(OrderCycle.order_cycle.incoming_exchanges[0],
-      Enterprise.suppliedVariants(enterprise.id), true)
-
     OrderCycle.order_cycle.coordinator_id = enterprise.id
 
-  $scope.loaded = ->
-    Enterprise.loaded && EnterpriseFee.loaded && OrderCycle.loaded && !RequestMonitor.loading
+    OrderCycle.addDistributor enterprise.id, $scope.setOutgoingExchange
+    OrderCycle.addSupplier enterprise.id, $scope.loadExchangeProducts
+
+  $scope.setOutgoingExchange = ->
+    $scope.outgoing_exchange = OrderCycle.order_cycle.outgoing_exchanges[0]
+
+  $scope.loadExchangeProducts = ->
+    $scope.incoming_exchange = OrderCycle.order_cycle.incoming_exchanges[0]
+
+    params = { enterprise_id: $scope.incoming_exchange.enterprise_id, incoming: true }
+    ExchangeProduct.index params, $scope.storeProductsAndSelectAllVariants
+
+  $scope.storeProductsAndSelectAllVariants = (products) ->
+    $scope.enterprises[$scope.incoming_exchange.enterprise_id].supplied_products = products
+
+    # All variants start as checked
+    OrderCycle.setExchangeVariants($scope.incoming_exchange,
+      Enterprise.suppliedVariants($scope.incoming_exchange.enterprise_id), true)
 
   $scope.removeDistributionOfVariant = angular.noop
 
-  $scope.setExchangeVariants = (exchange, variants, selected) ->
-    OrderCycle.setExchangeVariants(exchange, variants, selected)
-
-  $scope.suppliedVariants = (enterprise_id) ->
-    Enterprise.suppliedVariants(enterprise_id)
-
-  $scope.addCoordinatorFee = ($event) ->
-    $event.preventDefault()
-    OrderCycle.addCoordinatorFee()
-
-  $scope.removeCoordinatorFee = ($event, index) ->
-    $event.preventDefault()
-    OrderCycle.removeCoordinatorFee(index)
-
-  $scope.enterpriseFeesForEnterprise = (enterprise_id) ->
-    EnterpriseFee.forEnterprise(parseInt(enterprise_id))
-
   $scope.submit = ($event, destination) ->
     $event.preventDefault()
     StatusMessage.display 'progress', t('js.saving')
     OrderCycle.mirrorIncomingToOutgoingProducts()
-    OrderCycle.create(destination)
-
-  $scope.cancel = (destination) ->
-      $window.location = destination
+    OrderCycle.create(destination) if OrderCycle.confirmNoDistributors()

app/assets/javascripts/admin/order_cycles/controllers/simple_edit.js.coffee

@@ -1,51 +1,27 @@
-angular.module('admin.orderCycles').controller "AdminSimpleEditOrderCycleCtrl", ($scope, $location, $window, OrderCycle, Enterprise, EnterpriseFee, Schedules, RequestMonitor, StatusMessage, ocInstance) ->
+angular.module('admin.orderCycles').controller "AdminSimpleEditOrderCycleCtrl", ($scope, $controller, $location, $window, OrderCycle, Enterprise, EnterpriseFee, ExchangeProduct, Schedules, RequestMonitor, StatusMessage, ocInstance) ->
+  $controller('AdminOrderCycleBasicCtrl', {$scope: $scope, ocInstance: ocInstance})
+
   $scope.orderCycleId = ->
     $location.absUrl().match(/\/admin\/order_cycles\/(\d+)/)[1]
 
-  $scope.StatusMessage = StatusMessage
   $scope.enterprises = Enterprise.index(order_cycle_id: $scope.orderCycleId())
   $scope.enterprise_fees = EnterpriseFee.index(order_cycle_id: $scope.orderCycleId())
-  $scope.schedules = Schedules.index({enterprise_id: ocInstance.coordinator_id})
-  $scope.OrderCycle = OrderCycle
   $scope.order_cycle = OrderCycle.load $scope.orderCycleId(), (order_cycle) =>
     $scope.init()
 
-  $scope.$watch 'order_cycle_form.$dirty', (newValue) ->
-      StatusMessage.display 'notice', t("admin.unsaved_changes") if newValue
-
-  $scope.$watch 'order_cycle_form.$valid', (isValid) ->
-    StatusMessage.setValidation(isValid)
-
-  $scope.loaded = ->
-    Enterprise.loaded && EnterpriseFee.loaded && OrderCycle.loaded && !RequestMonitor.loading
-
   $scope.init = ->
     $scope.outgoing_exchange = OrderCycle.order_cycle.outgoing_exchanges[0]
+    $scope.loadExchangeProducts()
 
-  $scope.enterpriseFeesForEnterprise = (enterprise_id) ->
-    EnterpriseFee.forEnterprise(parseInt(enterprise_id))
+  $scope.loadExchangeProducts = ->
+    exchange = OrderCycle.order_cycle.incoming_exchanges[0]
+    ExchangeProduct.index { exchange_id: exchange.id }, (products) ->
+      $scope.enterprises[exchange.enterprise_id].supplied_products = products
 
   $scope.removeDistributionOfVariant = angular.noop
 
-  $scope.setExchangeVariants = (exchange, variants, selected) ->
-    OrderCycle.setExchangeVariants(exchange, variants, selected)
-
-  $scope.suppliedVariants = (enterprise_id) ->
-    Enterprise.suppliedVariants(enterprise_id)
-
-  $scope.addCoordinatorFee = ($event) ->
-    $event.preventDefault()
-    OrderCycle.addCoordinatorFee()
-
-  $scope.removeCoordinatorFee = ($event, index) ->
-    $event.preventDefault()
-    OrderCycle.removeCoordinatorFee(index)
-
   $scope.submit = ($event, destination) ->
     $event.preventDefault()
     StatusMessage.display 'progress', t('js.saving')
     OrderCycle.mirrorIncomingToOutgoingProducts()
-    OrderCycle.update(destination, $scope.order_cycle_form)
-
-  $scope.cancel = (destination) ->
-    $window.location = destination
+    OrderCycle.update(destination, $scope.order_cycle_form) if OrderCycle.confirmNoDistributors()

app/assets/javascripts/admin/order_cycles/services/enterprise.js.coffee

@@ -12,7 +12,6 @@ angular.module('admin.orderCycles').factory('Enterprise', ($resource) ->
     enterprises: {}
     producer_enterprises: []
     hub_enterprises: []
-    supplied_products: []
     loaded: false
 
     index: (params={}, callback=null) ->
@@ -22,9 +21,6 @@ angular.module('admin.orderCycles').factory('Enterprise', ($resource) ->
           @producer_enterprises.push(enterprise) if enterprise.is_primary_producer
           @hub_enterprises.push(enterprise) if enterprise.sells == 'any'
 
-          for product in enterprise.supplied_products
-            @supplied_products.push(product)
-
         @loaded = true
         (callback || angular.noop)(@enterprises)
 
@@ -39,13 +35,4 @@ angular.module('admin.orderCycles').factory('Enterprise', ($resource) ->
         variant.id for variant in product.variants
       else
         [product.master_id]
-
-    totalVariants: (enterprise) ->
-      numVariants = 0
-
-      if enterprise
-        counts = for product in enterprise.supplied_products
-          numVariants += if product.variants.length == 0 then 1 else product.variants.length
-
-      numVariants
   })

app/assets/javascripts/admin/order_cycles/services/exchange_product.js.coffee

@@ -0,0 +1,16 @@
+angular.module('admin.orderCycles').factory('ExchangeProduct', ($resource) ->
+  ExchangeProductResource = $resource('/api/exchanges/:exchange_id/products.json', {}, {
+    'index': { method: 'GET' }
+    'variant_count': { method: 'GET', params: { action_name: "variant_count" }}
+  })
+  {
+    ExchangeProductResource: ExchangeProductResource
+
+    index: (params={}, callback=null) ->
+      ExchangeProductResource.index params, (data) =>
+        (callback || angular.noop)(data.products, data.pagination.pages, data.pagination.results)
+
+    countVariants: (params={}, callback=null) ->
+      ExchangeProductResource.variant_count params, (data) =>
+        (callback || angular.noop)(data.count)
+  })

app/assets/javascripts/admin/order_cycles/services/order_cycle.js.coffee

@@ -1,4 +1,4 @@
-angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, StatusMessage, Panels) ->
+angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, $timeout, StatusMessage, Panels) ->
   OrderCycleResource = $resource '/admin/order_cycles/:action_name/:order_cycle_id.json', {}, {
     'index':  { method: 'GET', isArray: true}
     'new'   : { method: 'GET', params: { action_name: "new" } }
@@ -44,11 +44,15 @@ angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, S
         @removeDistributionOfVariant(variant.id) if exchange.incoming
 
 
-    addSupplier: (new_supplier_id) ->
-    	this.order_cycle.incoming_exchanges.push({enterprise_id: new_supplier_id, incoming: true, active: true, variants: {}, enterprise_fees: []})
+    addSupplier: (new_supplier_id, callback) ->
+      this.order_cycle.incoming_exchanges.push({enterprise_id: new_supplier_id, incoming: true, active: true, variants: {}, enterprise_fees: []})
+      $timeout ->
+        (callback || angular.noop)()
 
-    addDistributor: (new_distributor_id) ->
-    	this.order_cycle.outgoing_exchanges.push({enterprise_id: new_distributor_id, incoming: false, active: true, variants: {}, enterprise_fees: []})
+    addDistributor: (new_distributor_id, callback) ->
+      this.order_cycle.outgoing_exchanges.push({ enterprise_id: new_distributor_id, incoming: false, active: true, variants: {}, enterprise_fees: [] })
+      $timeout ->
+        (callback || angular.noop)()
 
     removeExchange: (exchange) ->
       if exchange.incoming
@@ -71,18 +75,6 @@ angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, S
     removeExchangeFee: (exchange, index) ->
       exchange.enterprise_fees.splice(index, 1)
 
-    productSuppliedToOrderCycle: (product) ->
-      product_variant_ids = (variant.id for variant in product.variants)
-      variant_ids = [product.master_id].concat(product_variant_ids)
-      incomingExchangesVariants = this.incomingExchangesVariants()
-
-      # TODO: This is an O(n^2) implementation of set intersection and thus is slooow.
-      # Use a better algorithm if needed.
-      # Also, incomingExchangesVariants is called every time, when it only needs to be
-      # called once per change to incoming variants. Some sort of caching?
-      ids = (variant_id for variant_id in variant_ids when incomingExchangesVariants.indexOf(variant_id) != -1)
-      ids.length > 0
-
     variantSuppliedToOrderCycle: (variant) ->
       this.incomingExchangesVariants().indexOf(variant.id) != -1
 
@@ -143,15 +135,18 @@ angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, S
         delete(service.order_cycle.exchanges)
         service.loaded = true
 
-        (callback || angular.noop)(service.order_cycle)
+        $timeout ->
+          (callback || angular.noop)(service.order_cycle)
 
       this.order_cycle
 
     create: (destination) ->
-      return unless @confirmNoDistributors()
       oc = new OrderCycleResource({order_cycle: this.dataForSubmit()})
       oc.$create (data) ->
-        $window.location = destination
+        if destination? && destination.length != 0
+          $window.location = destination
+        else if data.edit_path?
+          $window.location = data.edit_path
       , (response) ->
         if response.data.errors?
           StatusMessage.display('failure', response.data.errors[0])
@@ -159,7 +154,6 @@ angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, S
           StatusMessage.display('failure', t('js.order_cycles.create_failure'))
 
     update: (destination, form) ->
-      return unless @confirmNoDistributors()
       oc = new OrderCycleResource({order_cycle: this.dataForSubmit()})
       oc.$update {order_cycle_id: this.order_cycle.id, reloading: (if destination? then 1 else 0)}, (data) =>
         form.$setPristine() if form
@@ -173,7 +167,6 @@ angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, S
         else
           StatusMessage.display('failure', t('js.order_cycles.update_failure'))
 
-
     confirmNoDistributors: ->
       if @order_cycle.outgoing_exchanges.length == 0
         confirm t('js.order_cycles.no_distributors')

app/assets/javascripts/admin/orders/controllers/orders_controller.js.coffee

@@ -1,4 +1,4 @@
-angular.module("admin.orders").controller "ordersCtrl", ($scope, RequestMonitor, Orders, SortOptions, $window, $filter) ->
+angular.module("admin.orders").controller "ordersCtrl", ($scope, $timeout, RequestMonitor, Orders, SortOptions, $window, $filter) ->
   $scope.RequestMonitor = RequestMonitor
   $scope.pagination = Orders.pagination
   $scope.orders = Orders.all
@@ -13,6 +13,7 @@ angular.module("admin.orders").controller "ordersCtrl", ($scope, RequestMonitor,
   $scope.selected = false
   $scope.select_all = false
   $scope.poll = 0
+  $scope.rowStatus = {}
 
   $scope.initialise = ->
     $scope.per_page = 15
@@ -23,7 +24,7 @@ angular.module("admin.orders").controller "ordersCtrl", ($scope, RequestMonitor,
 
   $scope.fetchResults = (page=1) ->
     $scope.resetSelected()
-    Orders.index({
+    params = {
       'q[completed_at_lt]': $scope['q']['completed_at_lt'],
       'q[completed_at_gt]': $scope['q']['completed_at_gt'],
       'q[state_eq]': $scope['q']['state_eq'],
@@ -39,7 +40,8 @@ angular.module("admin.orders").controller "ordersCtrl", ($scope, RequestMonitor,
       'q[s]': $scope.sorting || 'completed_at desc',
       per_page: $scope.per_page,
       page: page
-    })
+    }
+    RequestMonitor.load(Orders.index(params).$promise)
 
   $scope.resetSelected = ->
     $scope.selected_orders.length = 0
@@ -68,6 +70,23 @@ angular.module("admin.orders").controller "ordersCtrl", ($scope, RequestMonitor,
       $scope.fetchResults()
   , true
 
+  $scope.capturePayment = (order) ->
+    $scope.rowAction('capture', order)
+
+  $scope.shipOrder = (order) ->
+    $scope.rowAction('ship', order)
+
+  $scope.rowAction = (action, order) ->
+    $scope.rowStatus[order.id] = "loading"
+
+    Orders[action](order).$promise.then (data) ->
+      $scope.rowStatus[order.id] = "success"
+      $timeout(->
+        $scope.rowStatus[order.id] = null
+      , 1500)
+    , (error) ->
+      $scope.rowStatus[order.id] = "error"
+
   $scope.changePage = (newPage) ->
     $scope.page = newPage
     $scope.fetchResults(newPage)

app/assets/javascripts/admin/resources/resources/order_resource.js.coffee

@@ -5,4 +5,14 @@ angular.module("admin.resources").factory 'OrderResource', ($resource) ->
       method: 'GET'
     'update':
       method: 'PUT'
+    'capture':
+      url: '/api/orders/:id/capture.json'
+      method: 'PUT'
+      params:
+        id: '@id'
+    'ship':
+      url: '/api/orders/:id/ship.json'
+      method: 'PUT'
+      params:
+        id: '@id'
   })

app/assets/javascripts/admin/resources/resources/product_resource.js.coffee

@@ -0,0 +1,6 @@
+angular.module("admin.resources").factory 'ProductResource', ($resource) ->
+  $resource('/admin/product/:id/:action.json', {}, {
+    'index':
+      url: '/api/products/bulk_products.json'
+      method: 'GET'
+  })

app/assets/javascripts/admin/resources/services/orders.js.coffee

@@ -44,5 +44,19 @@ angular.module("admin.resources").factory 'Orders', ($q, OrderResource, RequestM
         changed.push attr unless attr is "$$hashKey"
       changed
 
+    capture: (order) ->
+      @processAction('capture', order)
+
+    ship: (order) ->
+      @processAction('ship', order)
+
+    processAction: (action, order) ->
+      OrderResource[action] {id: order.number}, (data) =>
+        if data.id
+          angular.merge(order, data)
+          data
+      , (response) =>
+        response.data
+
     resetAttribute: (order, attribute) ->
       order[attribute] = @pristineByID[order.id][attribute]

app/assets/javascripts/admin/services/bulk_products.js.coffee

@@ -1,15 +1,13 @@
-angular.module("ofn.admin").factory "BulkProducts", (PagedFetcher, dataFetcher, $http) ->
+angular.module("ofn.admin").factory "BulkProducts", (ProductResource, dataFetcher, $http) ->
   new class BulkProducts
     products: []
+    pagination: {}
 
-    fetch: (filters, onComplete) ->
-      queryString = filters.reduce (qs,f) ->
-        return qs + "q[#{f.property.db_column}_#{f.predicate.predicate}]=#{f.value};"
-      , ""
-
-      url = "/api/products/bulk_products?page=::page::;per_page=20;#{queryString}"
-      processData = (data) => @addProducts data.products
-      PagedFetcher.fetch url, processData, onComplete
+    fetch: (params) ->
+      ProductResource.index params, (data) =>
+        @products.length = 0
+        @addProducts data.products
+        angular.extend(@pagination, data.pagination)
 
     cloneProduct: (product) ->
       $http.post("/api/products/" + product.id + "/clone").success (data) =>

app/assets/javascripts/admin/subscriptions/controllers/products_panel_controller.js.coffee

@@ -20,4 +20,4 @@ angular.module("admin.subscriptions").controller "ProductsPanelController", ($sc
         keys = Object.keys(response.data.errors)
         StatusMessage.display 'failure', response.data.errors[keys[0]][0]
       else
-        StatusMessage.display 'success', t('js.changes_saved')
+        StatusMessage.display 'failure', t('js.admin.subscriptions.error_saving')

app/assets/javascripts/admin/variant_overrides/controllers/variant_overrides_controller.js.coffee

@@ -1,4 +1,4 @@
-angular.module("admin.variantOverrides").controller "AdminVariantOverridesCtrl", ($scope, $http, $timeout, Indexer, Columns, Views, SpreeApiAuth, PagedFetcher, StatusMessage, RequestMonitor, hubs, producers, hubPermissions, InventoryItems, VariantOverrides, DirtyVariantOverrides) ->
+angular.module("admin.variantOverrides").controller "AdminVariantOverridesCtrl", ($scope, $http, $timeout, Indexer, Columns, Views, PagedFetcher, StatusMessage, RequestMonitor, hubs, producers, hubPermissions, InventoryItems, VariantOverrides, DirtyVariantOverrides) ->
   $scope.hubs = Indexer.index hubs
   $scope.hub_id = if hubs.length == 1 then hubs[0].id else null
   $scope.products = []
@@ -39,13 +39,7 @@ angular.module("admin.variantOverrides").controller "AdminVariantOverridesCtrl",
     $scope.producerFilter != 0 || $scope.query != ''
 
   $scope.initialise = ->
-    SpreeApiAuth.authorise()
-    .then ->
-      $scope.spree_api_key_ok = true
-      $scope.fetchProducts()
-    .catch (message) ->
-      $scope.api_error_msg = message
-
+    $scope.fetchProducts()
 
   $scope.fetchProducts = ->
     url = "/api/products/overridable?page=::page::;per_page=100"

app/assets/javascripts/darkswarm/controllers/order_cycle_controller.js.coffee

@@ -1,4 +1,4 @@
-Darkswarm.controller "OrderCycleCtrl", ($scope, $timeout, OrderCycle) ->
+Darkswarm.controller "OrderCycleCtrl", ($scope, $rootScope, $timeout, OrderCycle) ->
   $scope.order_cycle = OrderCycle.order_cycle
   $scope.OrderCycle = OrderCycle
 
@@ -6,11 +6,12 @@ Darkswarm.controller "OrderCycleCtrl", ($scope, $timeout, OrderCycle) ->
   # This is a hack. We should probably write our own "popover" directive
   # That takes an expression instead of a trigger, and binds to that
   $timeout =>
+    $rootScope.$broadcast 'orderCycleSelected'
     if !$scope.OrderCycle.selected()
       $("#order_cycle_id").trigger("openTrigger")
 
 
-Darkswarm.controller "OrderCycleChangeCtrl", ($scope, $timeout, OrderCycle, Products, Variants, Cart, ChangeableOrdersAlert) ->
+Darkswarm.controller "OrderCycleChangeCtrl", ($scope, $rootScope, $timeout, OrderCycle, Products, Variants, Cart, ChangeableOrdersAlert) ->
   # Track previous order cycle id for use with revertOrderCycle()
   $scope.previous_order_cycle_id = OrderCycle.order_cycle.order_cycle_id
   $scope.$watch 'order_cycle.order_cycle_id', (newValue, oldValue)->
@@ -32,3 +33,4 @@ Darkswarm.controller "OrderCycleChangeCtrl", ($scope, $timeout, OrderCycle, Prod
     Products.update()
     Cart.reloadFinalisedLineItems()
     ChangeableOrdersAlert.reload()
+    $rootScope.$broadcast 'orderCycleSelected'

app/assets/javascripts/darkswarm/controllers/products_controller.js.coffee

@@ -1,41 +1,65 @@
-Darkswarm.controller "ProductsCtrl", ($scope, $filter, $rootScope, Products, OrderCycle, FilterSelectorsService, Cart, Taxons, Properties) ->
+Darkswarm.controller "ProductsCtrl", ($scope, $filter, $rootScope, Products, OrderCycle, OrderCycleResource, FilterSelectorsService, Cart, Dereferencer, Taxons, Properties, currentHub, $timeout) ->
   $scope.Products = Products
   $scope.Cart = Cart
   $scope.query = ""
   $scope.taxonSelectors = FilterSelectorsService.createSelectors()
   $scope.propertySelectors = FilterSelectorsService.createSelectors()
   $scope.filtersActive = true
-  $scope.limit = 10
+  $scope.page = 1
+  $scope.per_page = 10
   $scope.order_cycle = OrderCycle.order_cycle
-  # $scope.infiniteDisabled = true
+  $scope.supplied_taxons = null
+  $scope.supplied_properties = null
 
-  # All of this logic basically just replicates the functionality filtering an ng-repeat
-  # except that it allows us to filter a separate list before rendering, meaning that
-  # we can get much better performance when applying filters by resetting the limit on the
-  # number of products being rendered each time a filter is changed.
+  $rootScope.$on "orderCycleSelected", ->
+    $scope.update_filters()
+    $scope.clearAll()
 
-  $scope.$watch "Products.loading", (newValue, oldValue) ->
-    $scope.updateFilteredProducts()
-    $scope.$broadcast("loadFilterSelectors") if !newValue
+  $scope.update_filters = ->
+    order_cycle_id = OrderCycle.order_cycle.order_cycle_id
 
-  $scope.incrementLimit = ->
-    if $scope.limit < Products.products.length
-      $scope.limit += 10
-      $scope.updateVisibleProducts()
+    return unless order_cycle_id
 
-  $scope.$watch 'query', -> $scope.updateFilteredProducts()
-  $scope.$watchCollection 'activeTaxons', -> $scope.updateFilteredProducts()
-  $scope.$watchCollection 'activeProperties', -> $scope.updateFilteredProducts()
+    params = {
+      id: order_cycle_id,
+      distributor: currentHub.id
+    }
+    OrderCycleResource.taxons params, (data)=>
+      $scope.supplied_taxons = {}
+      data.map( (taxon) ->
+        $scope.supplied_taxons[taxon.id] = Taxons.taxons_by_id[taxon.id]
+      )
+    OrderCycleResource.properties params, (data)=>
+      $scope.supplied_properties = {}
+      data.map( (property) ->
+        $scope.supplied_properties[property.id] = Properties.properties_by_id[property.id]
+      )
 
-  $scope.updateFilteredProducts = ->
-    $scope.limit = 10
-    f1 = $filter('products')(Products.products, $scope.query)
-    f2 = $filter('taxons')(f1, $scope.activeTaxons)
-    $scope.filteredProducts = $filter('properties')(f2, $scope.activeProperties)
-    $scope.updateVisibleProducts()
+  $scope.loadMore = ->
+    if ($scope.page * $scope.per_page) <= Products.products.length
+      $scope.loadMoreProducts()
 
-  $scope.updateVisibleProducts = ->
-    $scope.visibleProducts = $filter('limitTo')($scope.filteredProducts, $scope.limit)
+  $scope.$watch 'query', (newValue, oldValue) -> $scope.loadProducts() if newValue != oldValue
+  $scope.$watchCollection 'activeTaxons', (newValue, oldValue) -> $scope.loadProducts() if newValue != oldValue
+  $scope.$watchCollection 'activeProperties', (newValue, oldValue) -> $scope.loadProducts() if newValue != oldValue
+
+  $scope.loadProducts = ->
+    $scope.page = 1
+    Products.update($scope.queryParams())
+
+  $scope.loadMoreProducts = ->
+    Products.update($scope.queryParams($scope.page + 1), true)
+    $scope.page += 1
+
+  $scope.queryParams = (page = null) ->
+    {
+      id: $scope.order_cycle.order_cycle_id,
+      page: page || $scope.page,
+      per_page: $scope.per_page,
+      'q[name_or_meta_keywords_or_supplier_name_cont]': $scope.query,
+      'q[properties_id_or_supplier_properties_id_in_any][]': $scope.activeProperties,
+      'q[primary_taxon_id_in_any][]': $scope.activeTaxons
+    }
 
   $scope.searchKeypress = (e)->
     code = e.keyCode || e.which
@@ -56,3 +80,11 @@ Darkswarm.controller "ProductsCtrl", ($scope, $filter, $rootScope, Products, Ord
     $scope.query = ""
     $scope.taxonSelectors.clearAll()
     $scope.propertySelectors.clearAll()
+
+  $scope.refreshStaleData = ->
+    # If the products template has already been loaded but the controller is being initialized
+    # again after the template has switched, refresh loaded data to avoid conflicts
+    if $scope.Products.products.length > 0
+      $scope.Products.products = []
+      $scope.update_filters()
+      $scope.loadProducts()

app/assets/javascripts/darkswarm/directives/tabset_ctrl.js.coffee

@@ -5,13 +5,15 @@ Darkswarm.directive "tabsetCtrl", (Tabsets, $location) ->
     selected: "@"
     navigate: "="
     prefix: "@?"
+    alwaysopen: "="
   controller: ($scope, $element) ->
     if $scope.navigate
       path = $location.path()?.match(/^\/\w+$/)?[0]
       $scope.selected = path[1..] if path
 
     this.toggle = (name) ->
-      Tabsets.toggle($scope.id, name)
+      state = if $scope.alwaysopen then 'open' else null
+      Tabsets.toggle($scope.id, name, state)
 
     this.select = (selection) ->
       $scope.$broadcast("selection:changed", selection)

app/assets/javascripts/darkswarm/filters/dates.js.coffee

@@ -1,10 +1,15 @@
+@API_DATETIME_FORMAT = "YYYY-MM-DD HH:mm:SS Z"
+
 Darkswarm.filter "date_in_words", ->
-  (date) ->
-    moment(date).fromNow()
+  (date, dateFormat) ->
+    dateFormat ?= @API_DATETIME_FORMAT
+    moment(date, dateFormat).fromNow()
 
 Darkswarm.filter "sensible_timeframe", (date_in_wordsFilter)->
-  (date) ->
-    if moment().add(2, 'days') < moment(date)
+  (date, dateFormat) ->
+    dateFormat ?= @API_DATETIME_FORMAT
+
+    if moment().add(2, 'days') < moment(date, dateFormat)
       t 'orders_open'
     else
       t('closing') + date_in_wordsFilter(date)

app/assets/javascripts/darkswarm/services/order_cycle_resource.js.coffee

@@ -0,0 +1,21 @@
+Darkswarm.factory 'OrderCycleResource', ($resource) ->
+  $resource('/api/order_cycles/:id', {}, {
+    'products':
+      method: 'GET'
+      isArray: true
+      url: '/api/order_cycles/:id/products'
+      params:
+        id: '@id'
+    'taxons':
+      method: 'GET'
+      isArray: true
+      url: '/api/order_cycles/:id/taxons'
+      params:
+        id: '@id'
+    'properties':
+      method: 'GET'
+      isArray: true
+      url: '/api/order_cycles/:id/properties'
+      params:
+        id: '@id'
+  })

app/assets/javascripts/darkswarm/services/products.js.coffee

@@ -1,26 +1,34 @@
-Darkswarm.factory 'Products', ($resource, Shopfront, Dereferencer, Taxons, Properties, Cart, Variants) ->
+Darkswarm.factory 'Products', (OrderCycleResource, OrderCycle, Shopfront, currentHub, Dereferencer, Taxons, Properties, Cart, Variants) ->
   new class Products
     constructor: ->
       @update()
 
-    # TODO: don't need to scope this into object
-    # Already on object as far as controller scope is concerned
-    products: null
+    products: []
+    fetched_products: []
     loading: true
 
-    update: =>
+    update: (params = {}, load_more = false) =>
       @loading = true
-      @products = []
-      $resource("/shop/products").query (products)=>
-        @products = products
+      order_cycle_id = OrderCycle.order_cycle.order_cycle_id
 
+      if order_cycle_id == undefined
+        @loading = false
+        return
+
+      params['id'] = order_cycle_id
+      params['distributor'] = currentHub.id
+
+      OrderCycleResource.products params, (data)=>
+        @products = [] unless load_more
+        @fetched_products = data
         @extend()
         @dereference()
         @registerVariants()
+        @products = @products.concat(@fetched_products)
         @loading = false
 
     extend: ->
-      for product in @products
+      for product in @fetched_products
         if product.variants?.length > 0
           prices = (v.price for v in product.variants)
           product.price = Math.min.apply(null, prices)
@@ -30,7 +38,7 @@ Darkswarm.factory 'Products', ($resource, Shopfront, Dereferencer, Taxons, Prope
         product.largeImage = product.images[0]?.large_url if product.images
 
     dereference: ->
-      for product in @products
+      for product in @fetched_products
         product.supplier = Shopfront.producers_by_id[product.supplier.id]
         Dereferencer.dereference product.taxons, Taxons.taxons_by_id
 
@@ -40,7 +48,7 @@ Darkswarm.factory 'Products', ($resource, Shopfront, Dereferencer, Taxons, Prope
     # May return different objects! If the variant has already been registered
     # by another service, we fetch those
     registerVariants: ->
-      for product in @products
+      for product in @fetched_products
         if product.variants
           product.variant_names = ""
           product.variants = for variant in product.variants

app/assets/javascripts/templates/admin/panels/exchange_products_distributed.html.haml

@@ -1,5 +1,7 @@
-.row.exchange-distributed-products
-  .sixteen.columns.alpha.omega
+.row.exchange-distributed-products{'ng-init' => 'initializeExchangeProductsPanel(exchange)'}
+  .sixteen.columns.alpha.omega{ 'ng-show' => 'enterprises[exchange.enterprise_id].supplied_products.length != 0' }
+    %div{ 'ng-include' => "'admin/panels/exchange_products_panel_header.html'" }
+
     .exchange-select-all-variants
       %label
         %input{ type: 'checkbox', name: 'order_cycle_outgoing_exchange_{{ $parent.$index }}_select_all_variants',
@@ -7,11 +9,10 @@
           'ng-model' => 'exchange.select_all_variants',
           'ng-change' => 'setExchangeVariants(exchange, incomingExchangeVariantsFor(exchange.enterprise_id), exchange.select_all_variants)',
           'id' => 'order_cycle_outgoing_exchange_{{ $parent.$index }}_select_all_variants' }
-        {{ 'admin.select_all' | t }}
+        {{ 'js.admin.panels.exchange_products.select_all_products' | t:{ total_number_of_products: enterprises[exchange.enterprise_id].num_of_products } }}
 
-    .exchange-products
-      -# Scope product list based on permissions the current user has to view variants in this exchange
-      .exchange-product{'ng-repeat' => 'product in supplied_products | filter:productSuppliedToOrderCycle | visibleProducts:exchange:order_cycle.visible_variants_for_outgoing_exchanges | orderBy:"name"' }
+    .exchange-products{ 'ng-hide' => 'productsLoading()' }
+      .exchange-product{'ng-repeat' => 'product in enterprises[exchange.enterprise_id].supplied_products | filter:visibleProducts:exchange:order_cycle.visible_variants_for_outgoing_exchanges' }
         .exchange-product-details
           %label
             %img{'ng-src' => '{{ product.image_url }}'}
@@ -26,3 +27,5 @@
               'id' => 'order_cycle_outgoing_exchange_{{ $parent.$parent.$index }}_variants_{{ variant.id }}',
               'ng-disabled' => '!order_cycle.editable_variants_for_outgoing_exchanges.hasOwnProperty(exchange.enterprise_id) || order_cycle.editable_variants_for_outgoing_exchanges[exchange.enterprise_id].indexOf(variant.id) < 0' }
             {{ variant.label }}
+
+    %div{ 'ng-include' => "'admin/panels/exchange_products_panel_footer.html'" }

app/assets/javascripts/templates/admin/panels/exchange_products_panel_footer.html.haml

@@ -0,0 +1,11 @@
+.pagination{ 'ng-show' => 'enterprises[exchange.enterprise_id].last_page_loaded < enterprises[exchange.enterprise_id].num_of_pages && !productsLoading()'}
+  .button{ 'ng-click' => 'loadMoreExchangeProducts(exchange)' }
+    {{ 'js.admin.panels.exchange_products.load_more_products' | t }}
+  .button{ 'ng-click' => 'loadAllExchangeProducts(exchange)' }
+    {{ 'js.admin.panels.exchange_products.load_all_products' | t }}
+
+.sixteen.columns.alpha#loading{ 'ng-show' => 'productsLoading()' }
+  %br
+  %img.spinner{ src: "/assets/spinning-circles.svg" }
+  %h1
+    {{ 'js.admin.panels.exchange_products.loading_products' | t }}

app/assets/javascripts/templates/admin/panels/exchange_products_panel_header.html.haml

@@ -0,0 +1,5 @@
+.exchange-load-all-variants
+  %div
+    {{ 'js.admin.panels.exchange_products.products_loaded' | t:{ num_of_products_loaded: enterprises[exchange.enterprise_id].supplied_products.length, total_number_of_products: enterprises[exchange.enterprise_id].num_of_products } }}
+    %a{ 'ng-click' => 'loadAllExchangeProducts(exchange)', 'ng-show' => 'enterprises[exchange.enterprise_id].last_page_loaded < enterprises[exchange.enterprise_id].num_of_pages' }
+      {{ 'js.admin.panels.exchange_products.load_all_products' | t }}

app/assets/javascripts/templates/admin/panels/exchange_products_simple.html.haml

@@ -0,0 +1,12 @@
+.row.exchange-supplied-products
+  .sixteen.columns.alpha.omega
+    .exchange-select-all-variants
+      %label
+        %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants',
+          value: 1,
+          'ng-model' => 'exchange.select_all_variants',
+          'ng-change' => 'setExchangeVariants(exchange, suppliedVariants(exchange.enterprise_id), exchange.select_all_variants)',
+          'id' => 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants' }
+        {{ 'admin.select_all' | t }}
+
+    %div{ 'ng-include' => "'admin/panels/exchange_products_supplied_list.html'" }

app/assets/javascripts/templates/admin/panels/exchange_products_supplied.html.haml

@@ -0,0 +1,16 @@
+.row.exchange-supplied-products{'ng-init' => 'initializeExchangeProductsPanel(exchange)'}
+  .sixteen.columns.alpha.omega{ 'ng-show' => 'enterprises[exchange.enterprise_id].supplied_products.length != 0' }
+    %div{ 'ng-include' => "'admin/panels/exchange_products_panel_header.html'" }
+
+    .exchange-select-all-variants
+      %label
+        %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants',
+          value: 1,
+          'ng-model' => 'exchange.select_all_variants',
+          'ng-change' => 'selectAllVariants(exchange, exchange.select_all_variants)',
+          'id' => 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants' }
+        {{ 'js.admin.panels.exchange_products.select_all_products' | t:{ total_number_of_products: enterprises[exchange.enterprise_id].num_of_products } }}
+
+    %div{ 'ng-include' => "'admin/panels/exchange_products_supplied_list.html'" }
+
+    %div{ 'ng-include' => "'admin/panels/exchange_products_panel_footer.html'" }

app/assets/javascripts/templates/admin/panels/exchange_products_supplied_list.html.haml

@@ -0,0 +1,16 @@
+.exchange-products{ 'ng-hide' => 'productsLoading()' }
+  .exchange-product{'ng-repeat' => 'product in enterprises[exchange.enterprise_id].supplied_products'}
+    .exchange-product-details
+      %label
+        %img{'ng-src' => '{{ product.image_url }}'}
+        {{ product.name }}
+
+    .exchange-product-variant{'ng-repeat' => 'variant in product.variants'}
+      %label
+        %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $parent.$parent.$index }}_variants_{{ variant.id }}',
+          value: 1,
+          'ng-model' => 'exchange.variants[variant.id]',
+          'ofn-sync-distributions' => '{{ variant.id }}',
+          'id' => 'order_cycle_incoming_exchange_{{ $parent.$parent.$index }}_variants_{{ variant.id }}',
+          'ng-disabled' => '!order_cycle.editable_variants_for_incoming_exchanges.hasOwnProperty(exchange.enterprise_id) || order_cycle.editable_variants_for_incoming_exchanges[exchange.enterprise_id].indexOf(variant.id) < 0' }
+        {{ variant.label }}

app/assets/javascripts/templates/admin/panels/exchange_supplied_products.html.haml

@@ -1,49 +0,0 @@
-.row.exchange-supplied-products
-  .sixteen.columns.alpha.omega
-    .exchange-select-all-variants
-      %label
-        %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants',
-          value: 1,
-          'ng-model' => 'exchange.select_all_variants',
-          'ng-change' => 'setExchangeVariants(exchange, suppliedVariants(exchange.enterprise_id), exchange.select_all_variants)',
-          'id' => 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants' }
-        {{ 'admin.select_all' | t }}
-
-    .exchange-products
-      -# No need to scope product list based on permissions, because if an incoming exchange is visible,
-      -# then all of the variants within it should be visible. May change in the future?
-      .exchange-product{'ng-repeat' => 'product in enterprises[exchange.enterprise_id].supplied_products'}
-
-        .exchange-product-details
-          %label
-            %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $parent.$index }}_variants_{{ product.master_id }}',
-              value: 1,
-              'ng-hide' => 'product.variants.length > 0',
-              'ng-model' => 'exchange.variants[product.master_id]',
-              'ofn-sync-distributions' => '{{ product.master_id }}',
-              'id' => 'order_cycle_incoming_exchange_{{ $parent.$index }}_variants_{{ product.master_id }}',
-              'ng-disabled' => 'product.variants.length > 0 || !order_cycle.editable_variants_for_incoming_exchanges.hasOwnProperty(exchange.enterprise_id) || order_cycle.editable_variants_for_incoming_exchanges[exchange.enterprise_id].indexOf(product.master_id) < 0' }
-            %img{'ng-src' => '{{ product.image_url }}'}
-            {{ product.name }}
-
-        -# When the master variant is in the order cycle but the product has variants, we want to
-        -# be able to remove the master variant, since it serves no purpose. Display a checkbox to do so.
-        .exchange-product-variant{'ng-show' => 'exchange.variants[product.master_id] && product.variants.length > 0'}
-          %label
-            %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $parent.$index }}_variants_{{ product.master_id }}',
-              value: 1,
-              'ng-model' => 'exchange.variants[product.master_id]',
-              'ofn-sync-distributions' => '{{ product.master_id }}',
-              'id' => 'order_cycle_incoming_exchange_{{ $parent.$index }}_variants_{{ product.master_id }}',
-              'ng-disabled' => '!order_cycle.editable_variants_for_incoming_exchanges.hasOwnProperty(exchange.enterprise_id) || order_cycle.editable_variants_for_incoming_exchanges[exchange.enterprise_id].indexOf(product.master_id) < 0' }
-            {{ 'admin.obsolete_master' | t }}
-
-        .exchange-product-variant{'ng-repeat' => 'variant in product.variants'}
-          %label
-            %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $parent.$parent.$index }}_variants_{{ variant.id }}',
-              value: 1,
-              'ng-model' => 'exchange.variants[variant.id]',
-              'ofn-sync-distributions' => '{{ variant.id }}',
-              'id' => 'order_cycle_incoming_exchange_{{ $parent.$parent.$index }}_variants_{{ variant.id }}',
-              'ng-disabled' => '!order_cycle.editable_variants_for_incoming_exchanges.hasOwnProperty(exchange.enterprise_id) || order_cycle.editable_variants_for_incoming_exchanges[exchange.enterprise_id].indexOf(variant.id) < 0' }
-            {{ variant.label }}

app/assets/javascripts/templates/admin/save_bar.html.haml

@@ -1,9 +1,9 @@
 #save-bar.animate-show{ ng: { show: 'dirty || persist || StatusMessage.active()' } }
   .container
-    .eight.columns.alpha
+    .seven.columns.alpha
       %h5#status-message{ ng: { show: "StatusMessage.invalidMessage == ''", style: 'StatusMessage.statusMessage.style' } }
         {{ StatusMessage.statusMessage.text || " " }}
       %h5#status-message{ ng: { show: "StatusMessage.invalidMessage !== ''" }, style: 'color: #da5354' }
         {{ StatusMessage.invalidMessage || " " }}
-    .eight.columns.omega.text-right{ ng: { transclude: true } }
+    .nine.columns.omega.text-right{ ng: { transclude: true } }
 

app/assets/javascripts/templates/shop_variant.html.haml

@@ -17,7 +17,7 @@
   .small-4.medium-2.large-2.columns.variant-price
     .table-cell.price
       %i.ofn-i_009-close
-      {{  ::variant.price_with_fees | localizeCurrency }}
+      {{ variant.price_with_fees | localizeCurrency }}
 
       -# Now in a template in app/assets/javascripts/templates !
       %price-breakdown{"price-breakdown" => "_", variant: "variant",

app/assets/stylesheets/admin/components/table_loading.css.scss

@@ -0,0 +1,32 @@
+@import '../variables';
+
+.row-loading {
+  opacity: .5;
+}
+
+.row-loading-icons {
+  margin-left: 3em;
+  position: absolute;
+
+  .spinner {
+    border: 0;
+    width: 2.3em;
+  }
+
+  i {
+    font-size: 2.3em;
+    opacity: .75;
+
+    &::before {
+      vertical-align: top;
+    }
+
+    &.success {
+      color: $spree-green;
+    }
+
+    &.error {
+      color: $warning-red;
+    }
+  }
+}

app/assets/stylesheets/admin/components/tooltip.css.scss

@@ -0,0 +1,4 @@
+#powerTip {
+  max-width: 240px;
+  white-space: normal;
+}

app/assets/stylesheets/admin/components/wizard_progress.css.scss

@@ -19,6 +19,9 @@ ul.wizard-progress {
 		line-height: 30px;
 		padding: 0 25px 0 40px;
 		position: relative;
+		a {
+		  color: #494949;
+		}
 		&:first-child {
 			padding-left: 25px;
 			border-top-left-radius: 3px;
@@ -62,6 +65,9 @@ ul.wizard-progress {
 		&.current {
 			background-color: $color_selected;
 			color: #fff;
+			a {
+			  color: #fff;
+			}
 			&:after {
 				background-color: $color_selected;
 			}

app/assets/stylesheets/admin/openfoodnetwork.css.scss

@@ -104,9 +104,13 @@ form.order_cycle {
       width: 20px;
     }
 
+    .exchange-load-all-variants {
+      margin: 0px 5px 20px 5px;
+    }
+
     .exchange-select-all-variants {
       clear: both;
-      margin: 5px;
+      margin: 15px 5px 25px 5px;
     }
 
     .exchange-products {
@@ -209,6 +213,7 @@ table#listing_enterprise_groups {
 #loading {
   text-align: center;
   img.spinner {
+    border: 0px;
     width: 100px;
     height: 100px;
   }
@@ -255,6 +260,9 @@ text-angular {
       background-color: #4583bf;
     }
   }
+  a {
+    color: $spree-green
+  }
 }
 
 span.required {

app/assets/stylesheets/admin/select2.css.scss

@@ -3,7 +3,7 @@
 .select2-container {
   .select2-choice {
     .select2-search-choice-close {
-      display: none;
+      display: none !important;
     }
     .select2-arrow {
       width: 22px;

app/assets/stylesheets/darkswarm/_shop-popovers.css.scss

@@ -19,6 +19,10 @@ ordercycle {
       margin: 0;
       font-weight: 700;
     }
+
+    @media all and (max-width: 768px) {
+      z-index: 10;
+    }
   }
 }
 

app/assets/stylesheets/darkswarm/shop.css.scss

@@ -114,12 +114,7 @@
     margin-bottom: 0px;
   }
 
-  .alert-box.shopfront-message {
-    border: 2px solid $clr-turquoise;
-    border-radius: 5px;
-    background-color: $clr-turquoise-light;
-    color: $clr-turquoise;
-
+  .shopfront-message {
     a {
       color: #0096ad;
 

app/assets/stylesheets/darkswarm/shop_tabs.css.scss

@@ -4,20 +4,25 @@
 
 // Tabs styling
 .tabset-ctrl#shop-tabs {
-  background: url("/assets/gray_jean.png") top left repeat;
 
-  @include box-shadow(inset 0 2px 3px 0 rgba(0, 0, 0, 0.15));
+  .tab-buttons {
+    background: url("/assets/gray_jean.png") top left repeat;
 
-  display: block;
-  color: $dark-grey;
+    @include box-shadow(inset 0 2px 3px 0 rgba(0, 0, 0, 0.15));
+
+    color: $dark-grey;
+
+    .row:first-child {
+      display: flex;
+      justify-content: space-between;
+    }
+  }
 
   .tab {
     text-align: center;
     border-top: 4px solid transparent;
-
-    @media all and (max-width: 640px) {
-      text-align: left;
-    }
+    display: inline-block;
+    width: 100%;
 
     >a {
       outline: none;
@@ -35,7 +40,7 @@
       line-height: 1;
       font-size: 0.875em;
       text-shadow: 0 -1px 1px #ffffff;
-      padding: 1em;
+      padding: 1em 2em;
       border: none;
 
       &:hover, &:focus, &:active {
@@ -50,51 +55,13 @@
         padding: 0.35em 0 0.65em 0;
         text-shadow: none;
       }
-
-      &:after {
-        padding-left: 8px;
-        content: "";
-        visibility: hidden;
-
-        @include icon-font;
-
-        @media all and (max-width: 640px) {
-          content: "";
-        }
-      }
-    }
-
-    &:hover {
-      a:after {
-        visibility: visible;
-      }
     }
 
     &.selected {
-      border-top: 4px solid $clr-brick;
-
-      @media all and (max-width: 640px) {
-        border-top: 4px solid transparent;
-        background-color: $clr-brick;
-      }
+      border-bottom: 4px solid $clr-brick;
 
       a {
         color: $clr-brick;
-
-        @media all and (max-width: 640px) {
-          color: white;
-        }
-      }
-
-      a:after {
-        content: "";
-        visibility: visible;
-
-        @include icon-font;
-
-        @media all and (max-width: 640px) {
-          content: "";
-        }
       }
     }
   }
@@ -102,43 +69,45 @@
   // content revealed in accordion
 
   .tab-view {
-    margin-bottom: 0;
-    padding: 0;
+    margin-bottom: 5em;
     background: none;
     border: none;
 
-    img {
-      margin: 0px 0px 0px 40px;
-    }
+    .content {
+      padding: 1.25em 0;
+      background-color: $white;
 
-    p {
-      max-width: 100%;
-
-      @media all and (max-width: 768px) {
-        height: auto !important;
+      img {
+        margin: 0px 0px 0px 40px;
       }
-    }
 
-    ul {
-      list-style-type: none;
-      padding-left: none;
-    }
+      h5 {
+        margin-bottom: 1em;
+      }
 
-    .header {
-      text-align: center;
-      text-transform: uppercase;
-      color: $dark-grey;
-      border-bottom: 1px solid $disabled-dark;
-      margin-top: 0.75rem;
-      margin-bottom: 0.75rem;
-      padding-bottom: 0.25rem;
-      font-size: 0.875rem;
-    }
+      p {
+        max-width: 100%;
 
-    .panel {
-      padding-bottom: 1.25em;
-      border-color: $clr-brick-bright;
-      background-color: rgba(255, 255, 255, 0);
+        @media all and (max-width: 768px) {
+          height: auto !important;
+        }
+      }
+
+      ul {
+        list-style-type: none;
+        padding-left: none;
+      }
+
+      .header {
+        text-align: center;
+        text-transform: uppercase;
+        color: $dark-grey;
+        border-bottom: 1px solid $disabled-dark;
+        margin-top: 0.75rem;
+        margin-bottom: 0.75rem;
+        padding-bottom: 0.25rem;
+        font-size: 0.875rem;
+      }
     }
   }
 }

app/controllers/admin/bulk_line_items_controller.rb

@@ -4,9 +4,18 @@ module Admin
     #
     def index
       order_params = params[:q].andand.delete :order
-      orders = OpenFoodNetwork::Permissions.new(spree_current_user).editable_orders.ransack(order_params).result
-      line_items = OpenFoodNetwork::Permissions.new(spree_current_user).editable_line_items.where(order_id: orders).ransack(params[:q])
-      render_as_json line_items.result.reorder('order_id ASC, id ASC')
+
+      order_permissions = ::Permissions::Order.new(spree_current_user)
+      orders = order_permissions.
+        editable_orders.ransack(order_params).result
+
+      line_items = order_permissions.
+        editable_line_items.where(order_id: orders).
+        includes(variant: { option_values: :option_type }).
+        ransack(params[:q]).result.
+        reorder('spree_line_items.order_id ASC, spree_line_items.id ASC')
+
+      render_as_json line_items
     end
 
     # PUT /admin/bulk_line_items/:id.json

app/controllers/admin/cache_settings_controller.rb

@@ -1,27 +0,0 @@
-require 'open_food_network/products_cache_integrity_checker'
-
-module Admin
-  class CacheSettingsController < Spree::Admin::BaseController
-    def edit
-      @results = Exchange.cachable.map do |exchange|
-        checker = OpenFoodNetwork::ProductsCacheIntegrityChecker
-          .new(exchange.receiver, exchange.order_cycle)
-
-        {
-          distributor: exchange.receiver,
-          order_cycle: exchange.order_cycle,
-          status: checker.ok?,
-          diff: checker.diff
-        }
-      end
-    end
-
-    def update
-      Spree::Config.set(params[:preferences])
-
-      respond_to do |format|
-        format.html { redirect_to main_app.edit_admin_cache_settings_path }
-      end
-    end
-  end
-end

app/controllers/admin/customers_controller.rb

@@ -63,6 +63,7 @@ module Admin
 
     def collection
       return Customer.where("1=0") unless json_request? && params[:enterprise_id].present?
+
       enterprise = Enterprise.managed_by(spree_current_user).find_by_id(params[:enterprise_id])
       Customer.of(enterprise)
     end

app/controllers/admin/enterprise_fees_controller.rb

@@ -28,15 +28,12 @@ module Admin
 
     def bulk_update
       @enterprise_fee_set = EnterpriseFeeSet.new(params[:enterprise_fee_set])
-      if @enterprise_fee_set.save
-        redirect_path = main_app.admin_enterprise_fees_path
-        if params.key? :enterprise_id
-          redirect_path = main_app.admin_enterprise_fees_path(enterprise_id: params[:enterprise_id])
-        end
-        redirect_to redirect_path, notice: I18n.t(:enterprise_fees_update_notice)
 
+      if @enterprise_fee_set.save
+        redirect_to redirect_path, notice: I18n.t(:enterprise_fees_update_notice)
       else
-        render :index
+        redirect_to redirect_path,
+                    flash: { error: @enterprise_fee_set.errors.full_messages.to_sentence }
       end
     end
 
@@ -73,5 +70,13 @@ module Admin
     def current_enterprise
       Enterprise.find params[:enterprise_id] if params.key? :enterprise_id
     end
+
+    def redirect_path
+      if params.key? :enterprise_id
+        return main_app.admin_enterprise_fees_path(enterprise_id: params[:enterprise_id])
+      end
+
+      main_app.admin_enterprise_fees_path
+    end
   end
 end

app/controllers/admin/enterprises_controller.rb

@@ -66,7 +66,7 @@ module Admin
 
       if @enterprise.update_attributes(attributes)
         flash[:success] = I18n.t(:enterprise_register_success_notice, enterprise: @enterprise.name)
-        redirect_to admin_path
+        redirect_to admin_dashboard_path
       else
         flash[:error] = I18n.t(:enterprise_register_error, enterprise: @enterprise.name)
         render :welcome, layout: "spree/layouts/bare_admin"
@@ -148,7 +148,8 @@ module Admin
 
         unless enterprises.empty?
           enterprises.includes(
-            supplied_products: [:supplier, :variants, master: [:images]]
+            supplied_products:
+              [:supplier, master: [:images], variants: { option_values: :option_type }]
           )
         end
       when :index

app/controllers/admin/order_cycles_controller.rb

@@ -2,6 +2,7 @@ module Admin
   class OrderCyclesController < ResourceController
     include OrderCyclesHelper
 
+    prepend_before_filter :set_order_cycle_id, only: [:incoming, :outgoing]
     before_filter :load_data_for_index, only: :index
     before_filter :require_coordinator, only: :new
     before_filter :remove_protected_attrs, only: [:update]
@@ -12,7 +13,10 @@ module Admin
       respond_to do |format|
         format.html
         format.json do
-          render_as_json @collection, ams_prefix: params[:ams_prefix], current_user: spree_current_user, subscriptions_count: SubscriptionsCount.new(@collection)
+          render_as_json @collection,
+                         ams_prefix: params[:ams_prefix],
+                         current_user: spree_current_user,
+                         subscriptions_count: SubscriptionsCount.new(@collection)
         end
       end
     end
@@ -40,12 +44,17 @@ module Admin
 
       if @order_cycle_form.save
         flash[:notice] = I18n.t(:order_cycles_create_notice)
-        render json: { success: true }
+        render json: { success: true,
+                       edit_path: main_app.admin_order_cycle_incoming_path(@order_cycle) }
       else
         render json: { errors: @order_cycle.errors.full_messages }, status: :unprocessable_entity
       end
     end
 
+    def set_order_cycle_id
+      params[:id] = params[:order_cycle_id]
+    end
+
     def update
       @order_cycle_form = OrderCycleForm.new(@order_cycle, params, spree_current_user)
 
@@ -62,7 +71,10 @@ module Admin
 
     def bulk_update
       if order_cycle_set.andand.save
-        render_as_json @order_cycles, ams_prefix: 'index', current_user: spree_current_user, subscriptions_count: SubscriptionsCount.new(@collection)
+        render_as_json @order_cycles,
+                       ams_prefix: 'index',
+                       current_user: spree_current_user,
+                       subscriptions_count: SubscriptionsCount.new(@collection)
       else
         order_cycle = order_cycle_set.collection.find{ |oc| oc.errors.present? }
         render json: { errors: order_cycle.errors.full_messages }, status: :unprocessable_entity
@@ -72,14 +84,16 @@ module Admin
     def clone
       @order_cycle = OrderCycle.find params[:id]
       @order_cycle.clone!
-      redirect_to main_app.admin_order_cycles_path, notice: I18n.t(:order_cycles_clone_notice, name: @order_cycle.name)
+      redirect_to main_app.admin_order_cycles_path,
+                  notice: I18n.t(:order_cycles_clone_notice, name: @order_cycle.name)
     end
 
     # Send notifications to all producers who are part of the order cycle
     def notify_producers
       Delayed::Job.enqueue OrderCycleNotificationJob.new(params[:id].to_i)
 
-      redirect_to main_app.admin_order_cycles_path, notice: I18n.t(:order_cycles_email_to_producers_notice)
+      redirect_to main_app.admin_order_cycles_path,
+                  notice: I18n.t(:order_cycles_email_to_producers_notice)
     end
 
     protected
@@ -87,20 +101,9 @@ module Admin
     def collection
       return Enterprise.where("1=0") unless json_request?
       return order_cycles_from_set if params[:order_cycle_set]
-      ocs = if params[:as] == "distributor"
-              OrderCycle.preload(:schedules).ransack(params[:q]).result.
-                involving_managed_distributors_of(spree_current_user).order('updated_at DESC')
-            elsif params[:as] == "producer"
-              OrderCycle.preload(:schedules).ransack(params[:q]).result.
-                involving_managed_producers_of(spree_current_user).order('updated_at DESC')
-            else
-              OrderCycle.preload(:schedules).ransack(params[:q]).result.accessible_by(spree_current_user)
-      end
 
-      ocs.undated |
-        ocs.soonest_closing |
-        ocs.soonest_opening |
-        ocs.closed
+      ocs = order_cycles
+      ocs.undated | ocs.soonest_closing | ocs.soonest_opening | ocs.closed
     end
 
     def collection_actions
@@ -109,21 +112,60 @@ module Admin
 
     private
 
+    def order_cycles
+      if params[:as] == "distributor"
+        order_cycles_as_distributor
+      elsif params[:as] == "producer"
+        order_cycles_as_producer
+      else
+        order_cycles_as_both
+      end
+    end
+
+    def order_cycles_as_distributor
+      OrderCycle.
+        preload(:schedules).
+        ransack(params[:q]).
+        result.
+        involving_managed_distributors_of(spree_current_user).
+        order('updated_at DESC')
+    end
+
+    def order_cycles_as_producer
+      OrderCycle.
+        preload(:schedules).
+        ransack(params[:q]).
+        result.
+        involving_managed_producers_of(spree_current_user).
+        order('updated_at DESC')
+    end
+
+    def order_cycles_as_both
+      OrderCycle.
+        preload(:schedules).
+        ransack(params[:q]).
+        result.
+        accessible_by(spree_current_user)
+    end
+
     def load_data_for_index
       if json_request?
-        # Split ransack params into all those that currently exist and new ones to limit returned ocs to recent or undated
+        # Split ransack params into all those that currently exist and new ones
+        #   to limit returned ocs to recent or undated
         orders_close_at_gt = params[:q].andand.delete(:orders_close_at_gt) || 31.days.ago
         params[:q] = {
-          g: [params.delete(:q) || {}, { m: 'or', orders_close_at_gt: orders_close_at_gt, orders_close_at_null: true }]
+          g: [params.delete(:q) || {}, { m: 'or',
+                                         orders_close_at_gt: orders_close_at_gt,
+                                         orders_close_at_null: true }]
         }
         @collection = collection
       end
     end
 
     def require_coordinator
-      if params[:coordinator_id] && @order_cycle.coordinator = permitted_coordinating_enterprises_for(@order_cycle).find_by_id(params[:coordinator_id])
-        return
-      end
+      @order_cycle.coordinator =
+        permitted_coordinating_enterprises_for(@order_cycle).find_by_id(params[:coordinator_id])
+      return if params[:coordinator_id] && @order_cycle.coordinator
 
       available_coordinators = permitted_coordinating_enterprises_for(@order_cycle)
       case available_coordinators.count
@@ -133,7 +175,9 @@ module Admin
       when 1
         @order_cycle.coordinator = available_coordinators.first
       else
-        flash[:error] = I18n.t(:order_cycles_no_permission_to_create_error) if params[:coordinator_id]
+        if params[:coordinator_id]
+          flash[:error] = I18n.t(:order_cycles_no_permission_to_create_error)
+        end
         render :set_coordinator
       end
     end
@@ -157,7 +201,9 @@ module Admin
       params[:order_cycle].delete :coordinator_id
 
       unless Enterprise.managed_by(spree_current_user).include?(@order_cycle.coordinator)
-        params[:order_cycle].delete_if{ |k, _v| [:name, :orders_open_at, :orders_close_at].include? k.to_sym }
+        params[:order_cycle].delete_if do |k, _v|
+          [:name, :orders_open_at, :orders_close_at].include? k.to_sym
+        end
       end
     end
 
@@ -181,7 +227,9 @@ module Admin
 
     def require_order_cycle_set_params
       return if params[:order_cycle_set]
-      render json: { errors: t('admin.order_cycles.bulk_update.no_data') }, status: :unprocessable_entity
+
+      render json: { errors: t('admin.order_cycles.bulk_update.no_data') },
+             status: :unprocessable_entity
     end
 
     def ams_prefix_whitelist

app/controllers/admin/product_import_controller.rb

@@ -23,11 +23,13 @@ module Admin
 
     def validate_data
       return unless process_data('validate')
+
       render json: @importer.import_results, response: 200
     end
 
     def save_data
       return unless process_data('save')
+
       render json: @importer.save_results, response: 200
     end
 

app/controllers/admin/schedules_controller.rb

@@ -31,6 +31,7 @@ module Admin
 
     def collection
       return Schedule.where("1=0") unless json_request?
+
       if params[:enterprise_id]
         filter_schedules_by_enterprise_id(permissions.visible_schedules, params[:enterprise_id])
       else
@@ -49,6 +50,7 @@ module Admin
 
     def check_editable_order_cycle_ids
       return unless params[:schedule][:order_cycle_ids]
+
       requested = params[:schedule][:order_cycle_ids]
       @existing_order_cycle_ids = @schedule.persisted? ? @schedule.order_cycle_ids : []
       permitted = OrderCycle.where(id: params[:schedule][:order_cycle_ids] | @existing_order_cycle_ids).merge(OrderCycle.managed_by(spree_current_user)).pluck(:id)
@@ -61,19 +63,23 @@ module Admin
 
     def check_dependent_subscriptions
       return if Subscription.where(schedule_id: @schedule).empty?
+
       render json: { errors: [t('admin.schedules.destroy.associated_subscriptions_error')] }, status: :conflict
     end
 
     def permissions
       return @permissions unless @permission.nil?
+
       @permissions = OpenFoodNetwork::Permissions.new(spree_current_user)
     end
 
     def sync_subscriptions
       return unless params[:schedule][:order_cycle_ids]
+
       removed_ids = @existing_order_cycle_ids - @schedule.order_cycle_ids
       new_ids = @schedule.order_cycle_ids - @existing_order_cycle_ids
       return unless removed_ids.any? || new_ids.any?
+
       subscriptions = Subscription.where(schedule_id: @schedule)
       syncer = OpenFoodNetwork::ProxyOrderSyncer.new(subscriptions)
       syncer.sync!

app/controllers/admin/stripe_accounts_controller.rb

@@ -22,13 +22,15 @@ module Admin
       redirect_to main_app.edit_admin_enterprise_path(stripe_account.enterprise)
     rescue ActiveRecord::RecordNotFound
       flash[:error] = "Failed to disconnect Stripe."
-      redirect_to spree.admin_path
+      redirect_to spree.admin_dashboard_path
     end
 
     def status
       return render json: { status: :stripe_disabled } unless Spree::Config.stripe_connect_enabled
+
       stripe_account = StripeAccount.find_by_enterprise_id(params[:enterprise_id])
       return render json: { status: :account_missing } unless stripe_account
+
       authorize! :status, stripe_account
 
       begin

app/controllers/admin/stripe_connect_settings_controller.rb

@@ -8,6 +8,7 @@ module Admin
 
     def edit
       return @stripe_account = { status: :empty_api_key_error_html } if Stripe.api_key.blank?
+
       attrs = %i[id business_name charges_enabled]
       @obfuscated_secret_key = obfuscated_secret_key
       @stripe_account = Stripe::Account.retrieve.to_hash.slice(*attrs).merge(status: :ok)

app/controllers/admin/subscription_line_items_controller.rb

@@ -36,17 +36,20 @@ module Admin
 
     def ensure_shop
       return if @shop
+
       render json: { errors: ['Unauthorised'] }, status: :unauthorized
     end
 
     def ensure_variant
       return if @variant
+
       error = "#{@shop.name} is not permitted to sell the selected product"
       render json: { errors: [error] }, status: :unprocessable_entity
     end
 
     def price_estimate
       return unless @order_cycle
+
       fee_calculator = OpenFoodNetwork::EnterpriseFeeCalculator.new(@shop, @order_cycle)
       OpenFoodNetwork::ScopeVariantToHub.new(@shop).scope(@variant)
       @variant.price + fee_calculator.indexed_fees_for(@variant)

app/controllers/admin/subscriptions_controller.rb

@@ -80,6 +80,7 @@ module Admin
 
     def permissions
       return @permissions unless @permissions.nil?
+
       @permissions = OpenFoodNetwork::Permissions.new(spree_current_user)
     end
 
@@ -126,14 +127,17 @@ module Admin
 
     def check_for_open_orders
       return if params[:open_orders] == 'cancel'
+
       @open_orders_to_keep = @subscription.proxy_orders.placed_and_open.pluck(:id)
       return if @open_orders_to_keep.empty? || params[:open_orders] == 'keep'
+
       render json: { errors: { open_orders: t('admin.subscriptions.confirm_cancel_open_orders_msg') } }, status: :conflict
     end
 
     def check_for_canceled_orders
       return if params[:canceled_orders] == 'notified'
       return if @subscription.proxy_orders.active.canceled.empty?
+
       render json: { errors: { canceled_orders: t('admin.subscriptions.resume_canceled_orders_msg') } }, status: :conflict
     end
 

app/controllers/api/base_controller.rb

@@ -1,16 +1,44 @@
 # Base controller for OFN's API
-# Includes the minimum machinery required by ActiveModelSerializers
+require_dependency 'spree/api/controller_setup'
+
 module Api
-  class BaseController < Spree::Api::BaseController
-    # Need to include these because Spree::Api::BaseContoller inherits
-    # from ActionController::Metal rather than ActionController::Base
-    # and they are required by ActiveModelSerializers
+  class BaseController < ActionController::Metal
+    include Spree::Api::ControllerSetup
+    include Spree::Core::ControllerHelpers::SSL
+    include ::ActionController::Head
+
+    respond_to :json
+
+    attr_accessor :current_api_user
+
+    before_filter :set_content_type
+    before_filter :authenticate_user
+    after_filter  :set_jsonp_format
+
+    rescue_from Exception, with: :error_during_processing
+    rescue_from CanCan::AccessDenied, with: :unauthorized
+    rescue_from ActiveRecord::RecordNotFound, with: :not_found
+
+    helper Spree::Api::ApiHelpers
+
+    ssl_allowed
+
+    # Include these because we inherit from ActionController::Metal
+    #   rather than ActionController::Base and these are required for AMS
     include ActionController::Serialization
     include ActionController::UrlFor
     include Rails.application.routes.url_helpers
+
     use_renderers :json
     check_authorization
 
+    def set_jsonp_format
+      return unless params[:callback] && request.get?
+
+      self.response_body = "#{params[:callback]}(#{response_body})"
+      headers["Content-Type"] = 'application/javascript'
+    end
+
     def respond_with_conflict(json_hash)
       render json: json_hash, status: :conflict
     end
@@ -19,16 +47,63 @@ module Api
 
     # Use logged in user (spree_current_user) for API authentication (current_api_user)
     def authenticate_user
-      @current_api_user = try_spree_current_user
-      super
+      return if @current_api_user = try_spree_current_user
+
+      if api_key.blank?
+        # An anonymous user
+        @current_api_user = Spree.user_class.new
+        return
+      end
+
+      return if @current_api_user = Spree.user_class.find_by_spree_api_key(api_key.to_s)
+
+      invalid_api_key
     end
 
-    # Allows API access without authentication, but only for OFN controllers which inherit
-    # from Api::BaseController. @current_api_user will now initialize an empty Spree::User
-    # unless one is present. We now also apply devise's `check_authorization`. See here for
-    # details: https://github.com/CanCanCommunity/cancancan/wiki/Ensure-Authorization
-    def requires_authentication?
-      false
+    def set_content_type
+      content_type = case params[:format]
+                     when "json"
+                       "application/json"
+                     when "xml"
+                       "text/xml"
+                     end
+      headers["Content-Type"] = content_type
+    end
+
+    def error_during_processing(exception)
+      render(text: { exception: exception.message }.to_json,
+             status: :unprocessable_entity) && return
+    end
+
+    def current_ability
+      Spree::Ability.new(current_api_user)
+    end
+
+    def api_key
+      request.headers["X-Spree-Token"] || params[:token]
+    end
+    helper_method :api_key
+
+    def invalid_resource!(resource)
+      @resource = resource
+      render(json: { error: I18n.t(:invalid_resource, scope: "spree.api"),
+                     errors: @resource.errors },
+             status: :unprocessable_entity)
+    end
+
+    def invalid_api_key
+      render(json: { error: I18n.t(:invalid_api_key, key: api_key, scope: "spree.api") },
+             status: :unauthorized) && return
+    end
+
+    def unauthorized
+      render(json: { error: I18n.t(:unauthorized, scope: "spree.api") },
+             status: :unauthorized) && return
+    end
+
+    def not_found
+      render(json: { error: I18n.t(:resource_not_found, scope: "spree.api") },
+             status: :not_found) && return
     end
   end
 end

app/controllers/api/enterprise_attachment_controller.rb

@@ -27,6 +27,7 @@ module Api
     def load_enterprise
       @enterprise = Enterprise.find_by_permalink(params[:enterprise_id].to_s)
       raise UnknownEnterpriseAuthorizationActionError if enterprise_authorize_action.blank?
+
       authorize!(enterprise_authorize_action, @enterprise)
     end
 

app/controllers/api/exchange_products_controller.rb

@@ -0,0 +1,92 @@
+# This controller lists products that can be added to an exchange
+module Api
+  class ExchangeProductsController < Api::BaseController
+    DEFAULT_PAGE = 1
+    DEFAULT_PER_PAGE = 100
+
+    skip_authorization_check only: [:index]
+
+    # If exchange_id is present in the URL:
+    #   Lists Products that can be added to that Exchange
+    #
+    # If exchange_id is not present in the URL:
+    #   Lists Products of the Enterprise given that can be added to the given Order Cycle
+    #   In this case parameters are: enterprise_id, order_cycle_id and incoming
+    #     (order_cycle_id is not necessary for incoming exchanges)
+    def index
+      if params[:exchange_id].present?
+        load_data_from_exchange
+      else
+        load_data_from_other_params
+      end
+
+      render_variant_count && return if params[:action_name] == "variant_count"
+
+      render_paginated_products paginated_products
+    end
+
+    private
+
+    def render_variant_count
+      render text: {
+        count: Spree::Variant.
+          not_master.
+          where(product_id: products).
+          count
+      }.to_json
+    end
+
+    def products
+      ExchangeProductsRenderer.
+        new(@order_cycle, spree_current_user).
+        exchange_products(@incoming, @enterprise)
+    end
+
+    def paginated_products
+      products.
+        page(params[:page] || DEFAULT_PAGE).
+        per(params[:per_page] || DEFAULT_PER_PAGE)
+    end
+
+    def load_data_from_exchange
+      exchange = Exchange.find_by_id(params[:exchange_id])
+
+      @order_cycle = exchange.order_cycle
+      @incoming = exchange.incoming
+      @enterprise = exchange.sender
+    end
+
+    def load_data_from_other_params
+      @enterprise = Enterprise.find_by_id(params[:enterprise_id])
+
+      if params[:order_cycle_id]
+        @order_cycle = OrderCycle.find_by_id(params[:order_cycle_id])
+      elsif !params[:incoming]
+        raise "order_cycle_id is required to list products for new outgoing exchange"
+      end
+      @incoming = params[:incoming]
+    end
+
+    def render_paginated_products(paginated_products)
+      serializer = ActiveModel::ArraySerializer.new(
+        paginated_products,
+        each_serializer: Api::Admin::ForOrderCycle::SuppliedProductSerializer,
+        order_cycle: @order_cycle
+      )
+
+      render text: {
+        products: serializer,
+        pagination: pagination_data(paginated_products)
+      }.to_json
+    end
+
+    def pagination_data(paginated_products)
+      {
+        results: paginated_products.total_count,
+        pages: paginated_products.num_pages,
+        page: (params[:page] || DEFAULT_PAGE).to_i,
+        per_page: (params[:per_page] || DEFAULT_PER_PAGE).to_i
+      }
+    end
+  end
+end

app/controllers/api/order_cycles_controller.rb

@@ -0,0 +1,88 @@
+module Api
+  class OrderCyclesController < BaseController
+    include EnterprisesHelper
+    respond_to :json
+
+    skip_authorization_check
+
+    def products
+      products = ProductsRenderer.new(
+        distributor,
+        order_cycle,
+        customer,
+        search_params
+      ).products_json
+
+      render json: products
+    rescue ProductsRenderer::NoProducts
+      render status: :not_found, json: ''
+    end
+
+    def taxons
+      taxons = Spree::Taxon.
+        joins(:products).
+        where(spree_products: { id: distributed_products }).
+        select('DISTINCT spree_taxons.*')
+
+      render json: ActiveModel::ArraySerializer.new(taxons, each_serializer: Api::TaxonSerializer)
+    end
+
+    def properties
+      render json: ActiveModel::ArraySerializer.new(
+        product_properties | producer_properties, each_serializer: Api::PropertySerializer
+      )
+    end
+
+    private
+
+    def product_properties
+      Spree::Property.
+        joins(:products).
+        where(spree_products: { id: distributed_products }).
+        select('DISTINCT spree_properties.*')
+    end
+
+    def producer_properties
+      producers = Enterprise.
+        joins(:supplied_products).
+        where(spree_products: { id: distributed_products })
+
+      Spree::Property.
+        joins(:producer_properties).
+        where(producer_properties: { producer_id: producers }).
+        select('DISTINCT spree_properties.*')
+    end
+
+    def search_params
+      permitted_search_params = params.slice :q, :page, :per_page
+
+      if permitted_search_params.key? :q
+        permitted_search_params[:q].slice!(*permitted_ransack_params)
+      end
+
+      permitted_search_params
+    end
+
+    def permitted_ransack_params
+      [:name_or_meta_keywords_or_supplier_name_cont,
+       :properties_id_or_supplier_properties_id_in_any,
+       :primary_taxon_id_in_any]
+    end
+
+    def distributor
+      Enterprise.find_by_id(params[:distributor])
+    end
+
+    def order_cycle
+      OrderCycle.find_by_id(params[:id])
+    end
+
+    def customer
+      @current_api_user.andand.customer_of(distributor) || nil
+    end
+
+    def distributed_products
+      OrderCycleDistributedProducts.new(distributor, order_cycle, customer).products_relation
+    end
+  end
+end

app/controllers/api/orders_controller.rb

@@ -1,5 +1,10 @@
 module Api
   class OrdersController < BaseController
+    def show
+      authorize! :read, order
+      render json: order, serializer: Api::OrderDetailedSerializer, current_order: order
+    end
+
     def index
       authorize! :admin, Spree::Order
 
@@ -11,13 +16,50 @@ module Api
       }
     end
 
+    def ship
+      authorize! :admin, order
+
+      if order.ship
+        render json: order.reload, serializer: Api::Admin::OrderSerializer, status: :ok
+      else
+        render json: { error: I18n.t('api.orders.failed_to_update') }, status: :unprocessable_entity
+      end
+    end
+
+    def capture
+      authorize! :admin, order
+
+      pending_payment = order.pending_payments.first
+
+      return payment_capture_failed unless order.payment_required? && pending_payment
+
+      if pending_payment.capture!
+        render json: order.reload, serializer: Api::Admin::OrderSerializer, status: :ok
+      else
+        payment_capture_failed
+      end
+    rescue Spree::Core::GatewayError => e
+      error_during_processing(e)
+    end
+
     private
 
+    def payment_capture_failed
+      render json: { error: t(:payment_processing_failed) }, status: :unprocessable_entity
+    end
+
     def serialized_orders(orders)
       ActiveModel::ArraySerializer.new(
         orders,
         each_serializer: Api::Admin::OrderSerializer
       )
     end
+
+    def order
+      @order ||= Spree::Order.
+        where(number: params[:id]).
+        includes(line_items: { variant: [:product, :stock_items, :default_price] }).
+        first!
+    end
   end
 end

app/controllers/api/products_controller.rb

@@ -0,0 +1,148 @@
+require 'open_food_network/permissions'
+
+module Api
+  class ProductsController < Api::BaseController
+    respond_to :json
+    DEFAULT_PAGE = 1
+    DEFAULT_PER_PAGE = 15
+
+    skip_authorization_check only: [:show, :bulk_products, :overridable]
+
+    def show
+      @product = find_product(params[:id])
+      render json: @product, serializer: Api::Admin::ProductSerializer
+    end
+
+    def create
+      authorize! :create, Spree::Product
+      params[:product][:available_on] ||= Time.zone.now
+      @product = Spree::Product.new(params[:product])
+      begin
+        if @product.save
+          render json: @product, serializer: Api::Admin::ProductSerializer, status: :created
+        else
+          invalid_resource!(@product)
+        end
+      rescue ActiveRecord::RecordNotUnique
+        @product.permalink = nil
+        retry
+      end
+    end
+
+    def update
+      authorize! :update, Spree::Product
+      @product = find_product(params[:id])
+      if @product.update_attributes(params[:product])
+        render json: @product, serializer: Api::Admin::ProductSerializer, status: :ok
+      else
+        invalid_resource!(@product)
+      end
+    end
+
+    def destroy
+      authorize! :delete, Spree::Product
+      @product = find_product(params[:id])
+      authorize! :delete, @product
+      @product.destroy
+      render json: @product, serializer: Api::Admin::ProductSerializer, status: :no_content
+    end
+
+    def bulk_products
+      product_query = OpenFoodNetwork::Permissions.new(current_api_user).
+        editable_products.merge(product_scope)
+
+      if params[:import_date].present?
+        product_query = product_query.imported_on(params[:import_date]).group_by_products_id
+      end
+
+      @products = product_query.order('created_at DESC').
+        ransack(params[:q]).result.
+        page(params[:page] || DEFAULT_PAGE).per(params[:per_page] || DEFAULT_PER_PAGE)
+
+      render_paged_products @products
+    end
+
+    def overridable
+      producers = OpenFoodNetwork::Permissions.new(current_api_user).
+        variant_override_producers.by_name
+
+      @products = paged_products_for_producers producers
+
+      render_paged_products @products
+    end
+
+    # POST /api/products/:product_id/clone
+    #
+    def clone
+      authorize! :create, Spree::Product
+      original_product = find_product(params[:product_id])
+      authorize! :update, original_product
+
+      @product = original_product.duplicate
+
+      render json: @product, serializer: Api::Admin::ProductSerializer, status: :created
+    end
+
+    private
+
+    def find_product(id)
+      product_scope.find_by_permalink!(id.to_s)
+    rescue ActiveRecord::RecordNotFound
+      product_scope.find(id)
+    end
+
+    def product_scope
+      if current_api_user.has_spree_role?("admin") || current_api_user.enterprises.present?
+        scope = Spree::Product
+        if params[:show_deleted]
+          scope = scope.with_deleted
+        end
+      else
+        scope = Spree::Product.active
+      end
+
+      scope.includes(product_query_includes)
+    end
+
+    def product_query_includes
+      [
+        master: [:images],
+        variants: [:default_price, :stock_locations, :stock_items, :variant_overrides,
+                   { option_values: :option_type }]
+      ]
+    end
+
+    def paged_products_for_producers(producers)
+      Spree::Product.scoped.
+        merge(product_scope).
+        where(supplier_id: producers).
+        by_producer.by_name.
+        ransack(params[:q]).result.
+        page(params[:page]).per(params[:per_page])
+    end
+
+    def render_paged_products(products)
+      serializer = ActiveModel::ArraySerializer.new(
+        products,
+        each_serializer: ::Api::Admin::ProductSerializer
+      )
+
+      render text: {
+        products: serializer,
+        # This line is used by the PagedFetcher JS service (inventory).
+        pages: products.num_pages,
+        # This hash is used by the BulkProducts JS service.
+        pagination: pagination_data(products)
+      }.to_json
+    end
+
+    def pagination_data(results)
+      {
+        results: results.total_count,
+        pages: results.num_pages,
+        page: (params[:page] || DEFAULT_PAGE).to_i,
+        per_page: (params[:per_page] || DEFAULT_PER_PAGE).to_i
+      }
+    end
+  end
+end

app/controllers/api/shipments_controller.rb

@@ -0,0 +1,105 @@
+require 'open_food_network/scope_variant_to_hub'
+
+module Api
+  class ShipmentsController < Api::BaseController
+    respond_to :json
+
+    before_filter :find_order
+    before_filter :find_and_update_shipment, only: [:ship, :ready, :add, :remove]
+
+    def create
+      variant = scoped_variant(params[:variant_id])
+      quantity = params[:quantity].to_i
+      @shipment = get_or_create_shipment(params[:stock_location_id])
+
+      @order.contents.add(variant, quantity, nil, @shipment)
+
+      @shipment.refresh_rates
+      @shipment.save!
+
+      render json: @shipment.reload, serializer: Api::ShipmentSerializer, status: :ok
+    end
+
+    def update
+      authorize! :read, Spree::Shipment
+      @shipment = @order.shipments.find_by_number!(params[:id])
+      params[:shipment] ||= []
+      unlock = params[:shipment].delete(:unlock)
+
+      if unlock == 'yes'
+        @shipment.adjustment.open
+      end
+
+      @shipment.update_attributes(params[:shipment])
+
+      if unlock == 'yes'
+        @shipment.adjustment.close
+      end
+
+      render json: @shipment.reload, serializer: Api::ShipmentSerializer, status: :ok
+    end
+
+    def ready
+      authorize! :read, Spree::Shipment
+      unless @shipment.ready?
+        if @shipment.can_ready?
+          @shipment.ready!
+        else
+          render(json: { error: I18n.t(:cannot_ready, scope: "spree.api.shipment") },
+                 status: :unprocessable_entity) && return
+        end
+      end
+      render json: @shipment, serializer: Api::ShipmentSerializer, status: :ok
+    end
+
+    def ship
+      authorize! :read, Spree::Shipment
+      unless @shipment.shipped?
+        @shipment.ship!
+      end
+      render json: @shipment, serializer: Api::ShipmentSerializer, status: :ok
+    end
+
+    def add
+      variant = scoped_variant(params[:variant_id])
+      quantity = params[:quantity].to_i
+
+      @order.contents.add(variant, quantity, nil, @shipment)
+
+      render json: @shipment, serializer: Api::ShipmentSerializer, status: :ok
+    end
+
+    def remove
+      variant = scoped_variant(params[:variant_id])
+      quantity = params[:quantity].to_i
+
+      @order.contents.remove(variant, quantity, @shipment)
+      @shipment.reload if @shipment.persisted?
+
+      render json: @shipment, serializer: Api::ShipmentSerializer, status: :ok
+    end
+
+    private
+
+    def find_order
+      @order = Spree::Order.find_by_number!(params[:order_id])
+      authorize! :read, @order
+    end
+
+    def find_and_update_shipment
+      @shipment = @order.shipments.find_by_number!(params[:id])
+      @shipment.update_attributes(params[:shipment])
+      @shipment.reload
+    end
+
+    def scoped_variant(variant_id)
+      variant = Spree::Variant.find(variant_id)
+      OpenFoodNetwork::ScopeVariantToHub.new(@order.distributor).scope(variant)
+      variant
+    end
+
+    def get_or_create_shipment(stock_location_id)
+      @order.shipment || @order.shipments.create(stock_location_id: stock_location_id)
+    end
+  end
+end

app/controllers/api/statuses_controller.rb

@@ -10,7 +10,7 @@ module Api
 
     def job_queue_alive?
       Spree::Config.last_job_queue_heartbeat_at.present? &&
-        Time.parse(Spree::Config.last_job_queue_heartbeat_at) > 6.minutes.ago
+        Time.parse(Spree::Config.last_job_queue_heartbeat_at).in_time_zone > 6.minutes.ago
     end
   end
 end

app/controllers/api/taxonomies_controller.rb

@@ -0,0 +1,12 @@
+module Api
+  class TaxonomiesController < Api::BaseController
+    respond_to :json
+
+    skip_authorization_check only: :jstree
+
+    def jstree
+      @taxonomy = Spree::Taxonomy.find(params[:id])
+      render json: @taxonomy.root, serializer: Api::TaxonJstreeSerializer
+    end
+  end
+end

app/controllers/api/taxons_controller.rb

@@ -0,0 +1,72 @@
+module Api
+  class TaxonsController < Api::BaseController
+    respond_to :json
+
+    skip_authorization_check only: [:index, :show, :jstree]
+
+    def index
+      if taxonomy
+        @taxons = taxonomy.root.children
+      else
+        if params[:ids]
+          @taxons = Spree::Taxon.where(id: params[:ids].split(","))
+        else
+          @taxons = Spree::Taxon.ransack(params[:q]).result
+        end
+      end
+      render json: @taxons, each_serializer: Api::TaxonSerializer
+    end
+
+    def jstree
+      @taxon = taxon
+      render json: @taxon.children, each_serializer: Api::TaxonJstreeSerializer
+    end
+
+    def create
+      authorize! :create, Spree::Taxon
+      @taxon = Spree::Taxon.new(params[:taxon])
+      @taxon.taxonomy_id = params[:taxonomy_id]
+      taxonomy = Spree::Taxonomy.find_by_id(params[:taxonomy_id])
+
+      if taxonomy.nil?
+        @taxon.errors[:taxonomy_id] = I18n.t(:invalid_taxonomy_id, scope: 'spree.api')
+        invalid_resource!(@taxon) && return
+      end
+
+      @taxon.parent_id = taxonomy.root.id unless params[:taxon][:parent_id]
+
+      if @taxon.save
+        render json: @taxon, serializer: Api::TaxonSerializer, status: :created
+      else
+        invalid_resource!(@taxon)
+      end
+    end
+
+    def update
+      authorize! :update, Spree::Taxon
+      if taxon.update_attributes(params[:taxon])
+        render json: taxon, serializer: Api::TaxonSerializer, status: :ok
+      else
+        invalid_resource!(taxon)
+      end
+    end
+
+    def destroy
+      authorize! :delete, Spree::Taxon
+      taxon.destroy
+      render json: taxon, serializer: Api::TaxonSerializer, status: :no_content
+    end
+
+    private
+
+    def taxonomy
+      return if params[:taxonomy_id].blank?
+
+      @taxonomy ||= Spree::Taxonomy.find(params[:taxonomy_id])
+    end
+
+    def taxon
+      @taxon ||= taxonomy.taxons.find(params[:id])
+    end
+  end
+end

app/controllers/api/variants_controller.rb

@@ -0,0 +1,73 @@
+module Api
+  class VariantsController < Api::BaseController
+    respond_to :json
+
+    skip_authorization_check only: [:index, :show]
+    before_filter :product
+
+    def index
+      @variants = scope.includes(option_values: :option_type).ransack(params[:q]).result
+      render json: @variants, each_serializer: Api::VariantSerializer
+    end
+
+    def show
+      @variant = scope.includes(option_values: :option_type).find(params[:id])
+      render json: @variant, serializer: Api::VariantSerializer
+    end
+
+    def create
+      authorize! :create, Spree::Variant
+      @variant = scope.new(params[:variant])
+      if @variant.save
+        render json: @variant, serializer: Api::VariantSerializer, status: :created
+      else
+        invalid_resource!(@variant)
+      end
+    end
+
+    def update
+      authorize! :update, Spree::Variant
+      @variant = scope.find(params[:id])
+      if @variant.update_attributes(params[:variant])
+        render json: @variant, serializer: Api::VariantSerializer, status: :ok
+      else
+        invalid_resource!(@product)
+      end
+    end
+
+    def destroy
+      authorize! :delete, Spree::Variant
+      @variant = scope.find(params[:id])
+      authorize! :delete, @variant
+
+      VariantDeleter.new.delete(@variant)
+      render json: @variant, serializer: Api::VariantSerializer, status: :no_content
+    end
+
+    private
+
+    def product
+      @product ||= Spree::Product.find_by_permalink(params[:product_id]) if params[:product_id]
+    end
+
+    def scope
+      if @product
+        variants = if current_api_user.has_spree_role?("admin") || params[:show_deleted]
+                     @product.variants_including_master.with_deleted
+                   else
+                     @product.variants_including_master
+                   end
+      else
+        variants = Spree::Variant.scoped
+        if current_api_user.has_spree_role?("admin")
+          unless params[:show_deleted]
+            variants = Spree::Variant.active
+          end
+        else
+          variants = variants.active
+        end
+      end
+      variants
+    end
+  end
+end

app/controllers/application_controller.rb

@@ -47,6 +47,7 @@ class ApplicationController < ActionController::Base
 
   def after_sign_in_path_for(resource_or_scope)
     return session[:shopfront_redirect] if session[:shopfront_redirect]
+
     stored_location_for(resource_or_scope) || signed_in_root_path(resource_or_scope)
   end
 

app/controllers/checkout_controller.rb

@@ -3,6 +3,10 @@ require 'open_food_network/address_finder'
 class CheckoutController < Spree::CheckoutController
   layout 'darkswarm'
 
+  # We need pessimistic locking to avoid race conditions.
+  # Otherwise we fail on duplicate indexes or end up with negative stock.
+  prepend_around_filter CurrentOrderLocker, only: :update
+
   prepend_before_filter :check_hub_ready_for_checkout
   prepend_before_filter :check_order_cycle_expiry
   prepend_before_filter :require_order_cycle
@@ -152,7 +156,7 @@ class CheckoutController < Spree::CheckoutController
   end
 
   def update_failed
-    clear_ship_address
+    current_order.updater.shipping_address_from_distributor
     RestartCheckout.new(@order).call
 
     respond_to do |format|
@@ -165,15 +169,6 @@ class CheckoutController < Spree::CheckoutController
     end
   end
 
-  # When we have a pickup Shipping Method,
-  #   we clone the distributor address into ship_address before_save
-  # We don't want this data in the form, so we clear it out
-  def clear_ship_address
-    unless current_order.shipping_method.andand.require_ship_address
-      current_order.ship_address = Spree::Address.default
-    end
-  end
-
   def load_order
     @order = current_order
     redirect_to(main_app.shop_path) && return unless @order && @order.checkout_allowed?

app/controllers/enterprises_controller.rb

@@ -16,6 +16,7 @@ class EnterprisesController < BaseController
 
   def shop
     return redirect_to main_app.cart_path unless enough_stock?
+
     set_noindex_meta_tag
 
     @enterprise = current_distributor

app/controllers/line_items_controller.rb

@@ -23,6 +23,7 @@ class LineItemsController < BaseController
   # List all items the user already ordered in the current order cycle
   def bought_items
     return [] unless current_order_cycle && spree_current_user && current_distributor
+
     current_order_cycle.items_bought_by_user(spree_current_user, current_distributor)
   end
 

app/controllers/shop_controller.rb

@@ -1,5 +1,3 @@
-require 'open_food_network/cached_products_renderer'
-
 class ShopController < BaseController
   layout "darkswarm"
   before_filter :require_distributor_chosen, :set_order_cycles, except: :changeable_orders_alert
@@ -9,19 +7,6 @@ class ShopController < BaseController
     redirect_to main_app.enterprise_shop_path(current_distributor)
   end
 
-  def products
-    renderer = OpenFoodNetwork::CachedProductsRenderer.new(current_distributor,
-                                                           current_order_cycle)
-
-    # If we add any more filtering logic, we should probably
-    # move it all to a lib class like 'CachedProductsFilterer'
-    products_json = filter(renderer.products_json)
-
-    render json: products_json
-  rescue OpenFoodNetwork::CachedProductsRenderer::NoProducts
-    render status: :not_found, json: ''
-  end
-
   def order_cycle
     if request.post?
       if oc = OrderCycle.with_distributor(@distributor).active.find_by_id(params[:order_cycle_id])
@@ -39,27 +24,4 @@ class ShopController < BaseController
   def changeable_orders_alert
     render layout: false
   end
-
-  private
-
-  def filtered_json(products_json)
-    if applicator.rules.any?
-      filter(products_json)
-    else
-      products_json
-    end
-  end
-
-  def filter(products_json)
-    products_hash = JSON.parse(products_json)
-    applicator.filter!(products_hash)
-    JSON.unparse(products_hash)
-  end
-
-  def applicator
-    return @applicator unless @applicator.nil?
-    @applicator = OpenFoodNetwork::TagRuleApplicator.new(current_distributor,
-                                                         "FilterProducts",
-                                                         current_customer.andand.tag_list)
-  end
 end

app/controllers/spree/admin/adjustments_controller.rb

@@ -1,12 +1,23 @@
 module Spree
   module Admin
-    AdjustmentsController.class_eval do
+    class AdjustmentsController < ResourceController
+      belongs_to 'spree/order', find_by: :number
+      destroy.after :reload_order
+
       prepend_before_filter :set_included_tax, only: [:create, :update]
       before_filter :set_default_tax_rate, only: :edit
       before_filter :enable_updates, only: :update
 
       private
 
+      def reload_order
+        @order.reload
+      end
+
+      def collection
+        parent.adjustments.eligible
+      end
+
       # Choose a default tax rate to show on the edit form. The adjustment stores its included
       # tax in dollars, but doesn't store the source of the tax (ie. TaxRate that generated it).
       # We guess which tax rate here, choosing:
@@ -15,28 +26,34 @@ module Spree
       # When we have to go with 2, we show an error message to ask the admin to check that the
       # correct tax is being applied.
       def set_default_tax_rate
-        if @adjustment.included_tax > 0
-          trs = TaxRate.match(@order)
-          tr_yielding_matching_tax = trs.select { |tr| tr.compute_tax(@adjustment.amount) == @adjustment.included_tax }.first.andand.id
-          tr_valid_for_order = TaxRate.match(@order).first.andand.id
+        return if @adjustment.included_tax <= 0
 
-          @tax_rate_id = tr_yielding_matching_tax || tr_valid_for_order
+        tax_rates = TaxRate.match(@order)
+        tax_rate_with_matching_tax = find_tax_rate_with_matching_tax(tax_rates)
+        tax_rate_valid_for_order = tax_rates.first.andand.id
 
-          if tr_yielding_matching_tax.nil?
-            @adjustment.errors.add :tax_rate_id, I18n.t(:adjustments_tax_rate_error)
-          end
+        @tax_rate_id = tax_rate_with_matching_tax || tax_rate_valid_for_order
+
+        return unless tax_rate_with_matching_tax.nil?
+
+        @adjustment.errors.add :tax_rate_id, I18n.t(:adjustments_tax_rate_error)
+      end
+
+      def find_tax_rate_with_matching_tax(tax_rates)
+        tax_rates_yielding_matching_tax = tax_rates.select do |tr|
+          tr.compute_tax(@adjustment.amount) == @adjustment.included_tax
         end
+        tax_rates_yielding_matching_tax.first.andand.id
       end
 
       def set_included_tax
+        included_tax = 0
         if params[:tax_rate_id].present?
           tax_rate = TaxRate.find params[:tax_rate_id]
           amount = params[:adjustment][:amount].to_f
-          params[:adjustment][:included_tax] = tax_rate.compute_tax amount
-
-        else
-          params[:adjustment][:included_tax] = 0
+          included_tax = tax_rate.compute_tax amount
         end
+        params[:adjustment][:included_tax] = included_tax
       end
 
       # Spree 2.0 keeps shipping fee adjustments open unless they are manually

app/controllers/spree/admin/base_controller.rb

@@ -0,0 +1,142 @@
+module Spree
+  module Admin
+    class BaseController < Spree::BaseController
+      ssl_required
+
+      helper 'spree/admin/navigation'
+      layout '/spree/layouts/admin'
+
+      include I18nHelper
+
+      before_filter :authorize_admin
+      before_filter :set_locale
+      before_filter :warn_invalid_order_cycles, if: :html_request?
+
+      # Warn the user when they have an active order cycle with hubs that are not ready
+      # for checkout (ie. does not have valid shipping and payment methods).
+      def warn_invalid_order_cycles
+        distributors = active_distributors_not_ready_for_checkout
+
+        return if distributors.empty? || flash[:notice].present?
+
+        flash[:notice] = active_distributors_not_ready_for_checkout_message(distributors)
+      end
+
+      # This is in Spree::Core::ControllerHelpers::Auth
+      # But you can't easily reopen modules in Ruby
+      def unauthorized
+        if try_spree_current_user
+          flash[:error] = t(:authorization_failure)
+          redirect_to '/unauthorized'
+        else
+          store_location
+          redirect_to root_path(anchor: "login?after_login=#{request.env['PATH_INFO']}")
+        end
+      end
+
+      protected
+
+      def model_class
+        const_name = controller_name.classify
+        return "Spree::#{const_name}".constantize if Spree.const_defined?(const_name)
+
+        nil
+      end
+
+      def action
+        params[:action].to_sym
+      end
+
+      def authorize_admin
+        if respond_to?(:model_class, true) && model_class
+          record = model_class
+        else
+          # This allows specificity for each non-resource controller
+          #   (to be consistent with "authorize_resource :class => false", see https://github.com/ryanb/cancan/blob/60cf6a67ef59c0c9b63bc27ea0101125c4193ea6/lib/cancan/controller_resource.rb#L146)
+          record = self.class.to_s.
+            sub("Controller", "").
+            underscore.split('/').last.singularize.to_sym
+        end
+        authorize! :admin, record
+        authorize! resource_authorize_action, record
+      end
+
+      def resource_authorize_action
+        action
+      end
+
+      def flash_message_for(object, event_sym)
+        resource_desc  = object.class.model_name.human
+        resource_desc += " \"#{object.name}\"" if object.respond_to?(:name) && object.name.present?
+        Spree.t(event_sym, resource: resource_desc)
+      end
+
+      def render_js_for_destroy
+        render partial: '/spree/admin/shared/destroy'
+      end
+
+      # Index request for JSON needs to pass a CSRF token in order to prevent JSON Hijacking
+      def check_json_authenticity
+        return unless request.format.js? || request.format.json?
+
+        return unless protect_against_forgery?
+
+        auth_token = params[request_forgery_protection_token]
+        return if auth_token && form_authenticity_token == CGI.unescape(auth_token)
+
+        raise(ActionController::InvalidAuthenticityToken)
+      end
+
+      def config_locale
+        Spree::Backend::Config[:locale]
+      end
+
+      private
+
+      def active_distributors_not_ready_for_checkout
+        ocs = OrderCycle.managed_by(spree_current_user).active
+        distributors = ocs.includes(:distributors).map(&:distributors).flatten.uniq
+        Enterprise.where('enterprises.id IN (?)', distributors).not_ready_for_checkout
+      end
+
+      def active_distributors_not_ready_for_checkout_message(distributors)
+        distributor_names = distributors.map(&:name).join ', '
+
+        if distributors.count > 1
+          I18n.t(:active_distributors_not_ready_for_checkout_message_plural,
+                 distributor_names: distributor_names)
+        else
+          I18n.t(:active_distributors_not_ready_for_checkout_message_singular,
+                 distributor_names: distributor_names)
+        end
+      end
+
+      def html_request?
+        request.format.html?
+      end
+
+      def json_request?
+        request.format.json?
+      end
+
+      def render_as_json(data, options = {})
+        ams_prefix = options.delete :ams_prefix
+        if [Array, ActiveRecord::Relation].include? data.class
+          render options.merge(json: data, each_serializer: serializer(ams_prefix))
+        else
+          render options.merge(json: data, serializer: serializer(ams_prefix))
+        end
+      end
+
+      def serializer(ams_prefix)
+        unless ams_prefix.nil? || ams_prefix_whitelist.include?(ams_prefix.to_sym)
+          raise "Suffix '#{ams_prefix}' not found in ams_prefix_whitelist for #{self.class.name}."
+        end
+
+        prefix = ams_prefix.andand.classify || ""
+        name = controller_name.classify
+        "::Api::Admin::#{prefix}#{name}Serializer".constantize
+      end
+    end
+  end
+end

app/controllers/spree/admin/base_controller_decorator.rb

@@ -1,104 +0,0 @@
-require 'spree/core/controller_helpers/respond_with_decorator'
-
-Spree::Admin::BaseController.class_eval do
-  include I18nHelper
-
-  layout 'spree/layouts/admin'
-
-  before_filter :set_locale
-  before_filter :warn_invalid_order_cycles, if: :html_request?
-
-  # Warn the user when they have an active order cycle with hubs that are not ready
-  # for checkout (ie. does not have valid shipping and payment methods).
-  def warn_invalid_order_cycles
-    distributors = active_distributors_not_ready_for_checkout
-
-    if distributors.any? && flash[:notice].nil?
-      flash[:notice] = active_distributors_not_ready_for_checkout_message(distributors)
-    end
-  end
-
-  # Override Spree method
-  # It's a shame Spree doesn't just let CanCan handle this in it's own way
-  def authorize_admin
-    if respond_to?(:model_class, true) && model_class
-      record = model_class
-    else
-      # this line changed to allow specificity for each non-resource controller (to be consistent with "authorize_resource :class => false", see https://github.com/ryanb/cancan/blob/60cf6a67ef59c0c9b63bc27ea0101125c4193ea6/lib/cancan/controller_resource.rb#L146)
-      record = self.class.to_s.sub("Controller", "").underscore.split('/').last.singularize.to_sym
-    end
-    authorize! :admin, record
-    authorize! resource_authorize_action, record
-  end
-
-  def resource_authorize_action
-    action
-  end
-
-  # This is in Spree::Core::ControllerHelpers::Auth
-  # But you can't easily reopen modules in Ruby
-  def unauthorized
-    if try_spree_current_user
-      flash[:error] = t(:authorization_failure)
-      redirect_to '/unauthorized'
-    else
-      store_location
-      redirect_to root_path(anchor: "login?after_login=#{request.env['PATH_INFO']}")
-    end
-  end
-
-  protected
-
-  def model_class
-    const_name = controller_name.classify
-    if Spree.const_defined?(const_name)
-      return "Spree::#{const_name}".constantize
-    end
-    nil
-  end
-
-  private
-
-  def active_distributors_not_ready_for_checkout
-    ocs = OrderCycle.managed_by(spree_current_user).active
-    distributors = ocs.includes(:distributors).map(&:distributors).flatten.uniq
-    Enterprise.where('enterprises.id IN (?)', distributors).not_ready_for_checkout
-  end
-
-  def active_distributors_not_ready_for_checkout_message(distributors)
-    distributor_names = distributors.map(&:name).join ', '
-
-    if distributors.count > 1
-      I18n.t(:active_distributors_not_ready_for_checkout_message_plural, distributor_names: distributor_names)
-    else
-      I18n.t(:active_distributors_not_ready_for_checkout_message_singular, distributor_names: distributor_names)
-    end
-  end
-
-  def html_request?
-    request.format.html?
-  end
-
-  def json_request?
-    request.format.json?
-  end
-
-  def render_as_json(data, options = {})
-    ams_prefix = options.delete :ams_prefix
-    if [Array, ActiveRecord::Relation].include? data.class
-      render options.merge(json: data, each_serializer: serializer(ams_prefix))
-    else
-      render options.merge(json: data, serializer: serializer(ams_prefix))
-    end
-  end
-
-  def serializer(ams_prefix)
-    if ams_prefix.nil? || ams_prefix_whitelist.include?(ams_prefix.to_sym)
-      prefix = ams_prefix.andand.classify || ""
-      name = controller_name.classify
-      "Api::Admin::#{prefix}#{name}Serializer".constantize
-    else
-      raise "Suffix '#{ams_prefix}' not found in ams_prefix_whitelist for #{self.class.name}."
-    end
-  end
-end

app/controllers/spree/admin/countries_controller.rb

@@ -0,0 +1,9 @@
+module Spree
+  module Admin
+    class CountriesController < ResourceController
+      def collection
+        super.order(:name)
+      end
+    end
+  end
+end

app/controllers/spree/admin/general_settings_controller.rb

@@ -0,0 +1,24 @@
+module Spree
+  module Admin
+    class GeneralSettingsController < Spree::Admin::BaseController
+      def edit
+        @preferences_general = [:site_name, :default_seo_title, :default_meta_keywords,
+                                :default_meta_description, :site_url, :bugherd_api_key]
+        @preferences_security = [:allow_ssl_in_production,
+                                 :allow_ssl_in_staging, :allow_ssl_in_development_and_test]
+        @preferences_currency = [:display_currency, :hide_cents]
+      end
+
+      def update
+        params.each do |name, value|
+          next unless Spree::Config.has_preference? name
+
+          Spree::Config[name] = value
+        end
+        flash[:success] = Spree.t(:successfully_updated, resource: Spree.t(:general_settings))
+
+        redirect_to edit_admin_general_settings_path
+      end
+    end
+  end
+end

app/controllers/spree/admin/general_settings_controller_decorator.rb

@@ -1,14 +0,0 @@
-module Spree
-  module Admin
-    GeneralSettingsController.class_eval do
-    end
-
-    module GeneralSettingsEditPreferences
-      def edit
-        super
-        @preferences_general << :bugherd_api_key
-      end
-    end
-    GeneralSettingsController.prepend(GeneralSettingsEditPreferences)
-  end
-end

app/controllers/spree/admin/image_settings_controller.rb

@@ -0,0 +1,79 @@
+module Spree
+  module Admin
+    class ImageSettingsController < Spree::Admin::BaseController
+      def edit
+        @styles = ActiveSupport::JSON.decode(Spree::Config[:attachment_styles])
+        @headers = ActiveSupport::JSON.decode(Spree::Config[:s3_headers])
+      end
+
+      def update
+        update_styles(params)
+        update_headers(params) if Spree::Config[:use_s3]
+
+        Spree::Config.set(params[:preferences])
+        update_paperclip_settings
+
+        respond_to do |format|
+          format.html {
+            flash[:success] = Spree.t(:image_settings_updated)
+            redirect_to spree.edit_admin_image_settings_path
+          }
+        end
+      end
+
+      private
+
+      def update_styles(params)
+        if params[:new_attachment_styles].present?
+          params[:new_attachment_styles].each do |_index, style|
+            params[:attachment_styles][style[:name]] = style[:value] unless style[:value].empty?
+          end
+        end
+
+        styles = params[:attachment_styles]
+
+        Spree::Config[:attachment_styles] = ActiveSupport::JSON.encode(styles) unless styles.nil?
+      end
+
+      def update_headers(params)
+        if params[:new_s3_headers].present?
+          params[:new_s3_headers].each do |_index, header|
+            params[:s3_headers][header[:name]] = header[:value] unless header[:value].empty?
+          end
+        end
+
+        headers = params[:s3_headers]
+
+        Spree::Config[:s3_headers] = ActiveSupport::JSON.encode(headers) unless headers.nil?
+      end
+
+      def update_paperclip_settings
+        if Spree::Config[:use_s3]
+          s3_creds = { access_key_id: Spree::Config[:s3_access_key],
+                       secret_access_key: Spree::Config[:s3_secret],
+                       bucket: Spree::Config[:s3_bucket] }
+          Spree::Image.attachment_definitions[:attachment][:storage] = :s3
+          Spree::Image.attachment_definitions[:attachment][:s3_credentials] = s3_creds
+          Spree::Image.attachment_definitions[:attachment][:s3_headers] =
+            ActiveSupport::JSON.decode(Spree::Config[:s3_headers])
+          Spree::Image.attachment_definitions[:attachment][:bucket] = Spree::Config[:s3_bucket]
+        else
+          Spree::Image.attachment_definitions[:attachment].delete :storage
+        end
+
+        Spree::Image.attachment_definitions[:attachment][:styles] =
+          ActiveSupport::JSON.decode(Spree::Config[:attachment_styles]).symbolize_keys!
+        Spree::Image.attachment_definitions[:attachment][:path] = Spree::Config[:attachment_path]
+        Spree::Image.attachment_definitions[:attachment][:default_url] =
+          Spree::Config[:attachment_default_url]
+        Spree::Image.attachment_definitions[:attachment][:default_style] =
+          Spree::Config[:attachment_default_style]
+
+        # Spree stores attachent definitions in JSON. This converts the style name and format to
+        # strings. However, when paperclip encounters these, it doesn't recognise the format.
+        # Here we solve that problem by converting format and style name to symbols.
+        Spree::Image.reformat_styles
+      end
+    end
+  end
+end

app/controllers/spree/admin/image_settings_controller_decorator.rb

@@ -1,11 +0,0 @@
-Spree::Admin::ImageSettingsController.class_eval do
-  # Spree stores attachent definitions in JSON. This converts the style name and format to
-  # strings. However, when paperclip encounters these, it doesn't recognise the format.
-  # Here we solve that problem by converting format and style name to symbols.
-  def update_paperclip_settings_with_format_styles
-    update_paperclip_settings_without_format_styles
-    Spree::Image.reformat_styles
-  end
-
-  alias_method_chain :update_paperclip_settings, :format_styles
-end

app/controllers/spree/admin/images_controller.rb

@@ -0,0 +1,39 @@
+module Spree
+  module Admin
+    class ImagesController < ResourceController
+      # This will make resource controller redirect correctly after deleting product images.
+      # This can be removed after upgrading to Spree 2.1.
+      # See here https://github.com/spree/spree/commit/334a011d2b8e16355e4ae77ae07cd93f7cbc8fd1
+      belongs_to 'spree/product', find_by: :permalink
+
+      before_filter :load_data
+
+      create.before :set_viewable
+      update.before :set_viewable
+      destroy.before :destroy_before
+
+      private
+
+      def location_after_save
+        admin_product_images_url(@product)
+      end
+
+      def load_data
+        @product = Product.find_by_permalink(params[:product_id])
+        @variants = @product.variants.collect do |variant|
+          [variant.options_text, variant.id]
+        end
+        @variants.insert(0, [Spree.t(:all), @product.master.id])
+      end
+
+      def set_viewable
+        @image.viewable_type = 'Spree::Variant'
+        @image.viewable_id = params[:image][:viewable_id]
+      end
+
+      def destroy_before
+        @viewable = @image.viewable
+      end
+    end
+  end
+end

app/controllers/spree/admin/images_controller_decorator.rb

@@ -1,6 +0,0 @@
-Spree::Admin::ImagesController.class_eval do
-  # This will make resource controller redirect correctly after deleting product images.
-  # This can be removed after upgrading to Spree 2.1.
-  # See here https://github.com/spree/spree/commit/334a011d2b8e16355e4ae77ae07cd93f7cbc8fd1
-  belongs_to 'spree/product', find_by: :permalink
-end

app/controllers/spree/admin/mail_methods_controller.rb

@@ -0,0 +1,40 @@
+module Spree
+  module Admin
+    class MailMethodsController < Spree::Admin::BaseController
+      after_filter :initialize_mail_settings
+
+      def update
+        if params[:smtp_password].blank?
+          params.delete(:smtp_password)
+        end
+
+        params.each do |name, value|
+          next unless Spree::Config.has_preference? name
+
+          Spree::Config[name] = value
+        end
+
+        flash[:success] = Spree.t(:successfully_updated, resource: Spree.t(:mail_methods))
+        render :edit
+      end
+
+      def testmail
+        if TestMailer.test_email(try_spree_current_user).deliver
+          flash[:success] = Spree.t('admin.mail_methods.testmail.delivery_success')
+        else
+          flash[:error] = Spree.t('admin.mail_methods.testmail.delivery_error')
+        end
+      rescue StandardError => e
+        flash[:error] = Spree.t('admin.mail_methods.testmail.error') % { e: e }
+      ensure
+        redirect_to edit_admin_mail_method_url
+      end
+
+      private
+
+      def initialize_mail_settings
+        Spree::Core::MailSettings.init
+      end
+    end
+  end
+end

app/controllers/spree/admin/orders/customer_details_controller_decorator.rb

@@ -43,6 +43,7 @@ Spree::Admin::Orders::CustomerDetailsController.class_eval do
     params[:order][:guest_checkout] = registered_user.nil?
 
     return unless registered_user
+
     @order.user_id = registered_user.id
   end
 end

app/controllers/spree/admin/orders_controller_decorator.rb

@@ -3,7 +3,6 @@ require 'open_food_network/spree_api_key_loader'
 Spree::Admin::OrdersController.class_eval do
   include OpenFoodNetwork::SpreeApiKeyLoader
   helper CheckoutHelper
-  before_filter :load_spree_api_key, only: :bulk_management
   before_filter :load_order, only: %i[show edit update fire resend invoice print print_ticket]
 
   before_filter :load_distribution_choices, only: [:new, :edit, :update]
@@ -27,6 +26,10 @@ Spree::Admin::OrdersController.class_eval do
     # within the page then fetches the data it needs from Api::OrdersController
   end
 
+  def bulk_management
+    load_spree_api_key
+  end
+
   def edit
     @order.shipments.map &:refresh_rates