Update all locales with the latest Transifex translations

Rails 4 prep continued

.github/ISSUE_TEMPLATE/release.md

@@ -0,0 +1,19 @@
+---
+name: Release task
+about: Track the process of a new release
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+Steps: 
+
+- [ ] Include translations
+- [ ] Draft: https://github.com/openfoodfoundation/openfoodnetwork/releases/new <!-- replace the URL -->
+- [ ] Test: https://semaphoreci.com/openfoodfoundation/openfoodnetwork-2/branches/master <!-- replace the URL -->
+- [ ] Publish and notify #global-community
+- [ ] Deploy and notify #instance-managers
+- [ ] Nudge next release manager
+
+The full process is described at https://github.com/openfoodfoundation/openfoodnetwork/wiki/Releasing.

.rubocop.yml

@@ -4,6 +4,7 @@
 #
 # The configuration is split into three files. Look into those files for more details.
 #
+require: rubocop-rails
 inherit_from:
 
   # The automatically generated todo list to ignore all current violations.

.rubocop_manual_todo.yml

@@ -14,53 +14,43 @@
 #     rubocop > rubo.log
 #     # inspect log file to see which cops are failing
 #     # copy cop configurations and add Exclude parameter
-#     grep ExampleCop rubo.log | cut -d ":" -f 1 | sort -u >> .rubocop.yml
-#     # use vim to add `- ` before each line
+#     grep ExampleCop rubo.log | cut -d ":" -f 1 | sort -u | while read f; do echo "  - $f"; done >> .rubocop.yml
 #
 # This process probably doesn't need repeating. Otherwise there is plenty
 # of room for improvements and automation.
-Metrics/LineLength:
+Layout/LineLength:
   Max: 100
   Exclude:
   - Gemfile
   - app/controllers/admin/bulk_line_items_controller.rb
   - app/controllers/admin/contents_controller.rb
   - app/controllers/admin/customers_controller.rb
-  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/enterprise_fees_controller.rb
   - app/controllers/admin/enterprise_groups_controller.rb
   - app/controllers/admin/enterprise_relationships_controller.rb
   - app/controllers/admin/enterprise_roles_controller.rb
+  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/inventory_items_controller.rb
   - app/controllers/admin/manager_invitations_controller.rb
-  - app/controllers/admin/order_cycles_controller.rb
   - app/controllers/admin/product_import_controller.rb
   - app/controllers/admin/proxy_orders_controller.rb
   - app/controllers/admin/schedules_controller.rb
   - app/controllers/admin/subscriptions_controller.rb
   - app/controllers/admin/variant_overrides_controller.rb
   - app/controllers/api/enterprise_attachment_controller.rb
-  - app/controllers/api/order_cycles_controller.rb
   - app/controllers/api/product_images_controller.rb
   - app/controllers/application_controller.rb
   - app/controllers/checkout_controller.rb
   - app/controllers/spree/admin/adjustments_controller_decorator.rb
-  - app/controllers/spree/admin/base_controller_decorator.rb
   - app/controllers/spree/admin/orders_controller_decorator.rb
   - app/controllers/spree/admin/payments_controller_decorator.rb
-  - app/controllers/spree/admin/payment_methods_controller_decorator.rb
-  - app/controllers/spree/admin/reports_controller_decorator.rb
-  - app/controllers/spree/api/products_controller_decorator.rb
   - app/controllers/spree/credit_cards_controller.rb
-  - app/controllers/spree/orders_controller_decorator.rb
   - app/controllers/spree/paypal_controller_decorator.rb
   - app/controllers/stripe/callbacks_controller.rb
-  - app/helpers/admin/injection_helper.rb
   - app/helpers/angular_form_builder.rb
   - app/helpers/angular_form_helper.rb
   - app/helpers/checkout_helper.rb
   - app/helpers/enterprises_helper.rb
-  - app/helpers/footer_links_helper.rb
   - app/helpers/injection_helper.rb
   - app/helpers/markdown_helper.rb
   - app/helpers/order_cycles_helper.rb
@@ -89,7 +79,6 @@ Metrics/LineLength:
   - app/models/proxy_order.rb
   - app/models/schedule.rb
   - app/models/spree/ability_decorator.rb
-  - app/models/spree/adjustment_decorator.rb
   - app/models/spree/app_configuration_decorator.rb
   - app/models/spree/calculator/default_tax_decorator.rb
   - app/models/spree/classification_decorator.rb
@@ -100,16 +89,14 @@ Metrics/LineLength:
   - app/models/spree/payment_decorator.rb
   - app/models/spree/payment_method_decorator.rb
   - app/models/spree/product_decorator.rb
-  - app/models/spree/shipment_decorator.rb
   - app/models/spree/shipping_method_decorator.rb
   - app/models/spree/tax_rate_decorator.rb
   - app/models/spree/taxon_decorator.rb
-  - app/models/spree/user_decorator.rb
+  - app/models/spree/user.rb
   - app/models/spree/variant_decorator.rb
   - app/models/subscription.rb
   - app/models/variant_override.rb
   - app/models/variant_override_set.rb
-  - app/overrides/add_enterprise_fees_to_admin_configurations_menu.rb
   - app/services/cart_service.rb
   - app/services/default_stock_location.rb
   - app/services/embedded_page_service.rb
@@ -117,11 +104,6 @@ Metrics/LineLength:
   - app/services/order_factory.rb
   - app/services/subscriptions_count.rb
   - app/services/variants_stock_levels.rb
-  - app/views/json/_groups.rabl
-  - app/views/json/_producer.rabl
-  - app/views/json/partials/_enterprise.rabl
-  - app/views/spree/api/products/bulk_show.v1.rabl
-  - app/views/spree/api/variants/bulk_show.v1.rabl
   - engines/web/app/helpers/web/cookies_policy_helper.rb
   - lib/discourse/single_sign_on.rb
   - lib/open_food_network/available_payment_method_filter.rb
@@ -132,24 +114,17 @@ Metrics/LineLength:
   - lib/open_food_network/enterprise_issue_validator.rb
   - lib/open_food_network/group_buy_report.rb
   - lib/open_food_network/lettuce_share_report.rb
-  - lib/open_food_network/order_and_distributor_report.rb
   - lib/open_food_network/order_cycle_form_applicator.rb
   - lib/open_food_network/order_cycle_management_report.rb
-  - lib/open_food_network/order_grouper.rb
   - lib/open_food_network/payments_report.rb
-  - lib/open_food_network/permalink_generator.rb
-  - lib/open_food_network/products_cache.rb
   - lib/open_food_network/reports/bulk_coop_allocation_report.rb
-  - lib/open_food_network/reports/line_items.rb
   - lib/open_food_network/sales_tax_report.rb
-  - lib/open_food_network/users_and_enterprises_report.rb
   - lib/open_food_network/variant_and_line_item_naming.rb
   - lib/open_food_network/xero_invoices_report.rb
   - lib/spree/core/controller_helpers/respond_with_decorator.rb
   - lib/spree/localized_number.rb
   - lib/spree/product_filters.rb
   - lib/stripe/profile_storer.rb
-  - lib/tasks/cache.rake
   - lib/tasks/data.rake
   - lib/tasks/enterprises.rake
   - spec/controllers/admin/bulk_line_items_controller_spec.rb
@@ -166,11 +141,16 @@ Metrics/LineLength:
   - spec/controllers/admin/subscription_line_items_controller_spec.rb
   - spec/controllers/admin/subscriptions_controller_spec.rb
   - spec/controllers/admin/variant_overrides_controller_spec.rb
+  - spec/controllers/api/base_controller_spec.rb
+  - spec/controllers/api/exchange_products_controller_spec.rb
   - spec/controllers/api/logos_controller_spec.rb
   - spec/controllers/api/order_cycles_controller_spec.rb
   - spec/controllers/api/orders_controller_spec.rb
   - spec/controllers/api/product_images_controller_spec.rb
+  - spec/controllers/api/products_controller_spec.rb
   - spec/controllers/api/promo_images_controller_spec.rb
+  - spec/controllers/api/shipments_controller_spec.rb
+  - spec/controllers/api/variants_controller_spec.rb
   - spec/controllers/cart_controller_spec.rb
   - spec/controllers/checkout_controller_spec.rb
   - spec/controllers/enterprises_controller_spec.rb
@@ -183,12 +163,9 @@ Metrics/LineLength:
   - spec/controllers/spree/admin/orders_controller_spec.rb
   - spec/controllers/spree/admin/payment_methods_controller_spec.rb
   - spec/controllers/spree/admin/payments_controller_spec.rb
+  - spec/controllers/spree/admin/products_controller_spec.rb
   - spec/controllers/spree/admin/reports_controller_spec.rb
   - spec/controllers/spree/admin/variants_controller_spec.rb
-  - spec/controllers/spree/api/line_items_controller_spec.rb
-  - spec/controllers/spree/api/products_controller_spec.rb
-  - spec/controllers/spree/api/shipments_controller_spec.rb
-  - spec/controllers/spree/api/variants_controller_spec.rb
   - spec/controllers/spree/credit_cards_controller_spec.rb
   - spec/controllers/spree/orders_controller_spec.rb
   - spec/controllers/spree/user_sessions_controller_spec.rb
@@ -196,7 +173,6 @@ Metrics/LineLength:
   - spec/controllers/stripe/callbacks_controller_spec.rb
   - spec/controllers/stripe/webhooks_controller_spec.rb
   - spec/controllers/user_confirmations_controller_spec.rb
-  - spec/controllers/user_registrations_controller_spec.rb
   - spec/features/admin/adjustments_spec.rb
   - spec/features/admin/bulk_order_management_spec.rb
   - spec/features/admin/bulk_product_update_spec.rb
@@ -221,6 +197,7 @@ Metrics/LineLength:
   - spec/features/admin/shipping_methods_spec.rb
   - spec/features/admin/subscriptions_spec.rb
   - spec/features/admin/tag_rules_spec.rb
+  - spec/features/admin/users_spec.rb
   - spec/features/admin/variant_overrides_spec.rb
   - spec/features/consumer/account/cards_spec.rb
   - spec/features/consumer/account/settings_spec.rb
@@ -255,7 +232,6 @@ Metrics/LineLength:
   - spec/lib/open_food_network/customers_report_spec.rb
   - spec/lib/open_food_network/enterprise_fee_applicator_spec.rb
   - spec/lib/open_food_network/enterprise_fee_calculator_spec.rb
-  - spec/lib/open_food_network/enterprise_injection_data_spec.rb
   - spec/lib/open_food_network/group_buy_report_spec.rb
   - spec/lib/open_food_network/lettuce_share_report_spec.rb
   - spec/lib/open_food_network/option_value_namer_spec.rb
@@ -267,7 +243,6 @@ Metrics/LineLength:
   - spec/lib/open_food_network/packing_report_spec.rb
   - spec/lib/open_food_network/permissions_spec.rb
   - spec/lib/open_food_network/products_and_inventory_report_spec.rb
-  - spec/lib/open_food_network/products_cache_spec.rb
   - spec/lib/open_food_network/proxy_order_syncer_spec.rb
   - spec/lib/open_food_network/scope_variant_to_hub_spec.rb
   - spec/lib/open_food_network/subscription_payment_updater_spec.rb
@@ -280,6 +255,7 @@ Metrics/LineLength:
   - spec/mailers/order_mailer_spec.rb
   - spec/mailers/producer_mailer_spec.rb
   - spec/mailers/subscription_mailer_spec.rb
+  - spec/models/calculator/weight_spec.rb
   - spec/models/column_preference_spec.rb
   - spec/models/concerns/order_shipment_spec.rb
   - spec/models/concerns/product_stock_spec.rb
@@ -301,11 +277,11 @@ Metrics/LineLength:
   - spec/models/spree/calculator/price_sack_spec.rb
   - spec/models/spree/classification_spec.rb
   - spec/models/spree/gateway/stripe_connect_spec.rb
-  - spec/models/spree/image_spec.rb
   - spec/models/spree/line_item_spec.rb
   - spec/models/spree/order_spec.rb
   - spec/models/spree/payment_method_spec.rb
   - spec/models/spree/payment_spec.rb
+  - spec/models/spree/product_set_spec.rb
   - spec/models/spree/product_spec.rb
   - spec/models/spree/property_spec.rb
   - spec/models/spree/shipping_method_spec.rb
@@ -324,22 +300,27 @@ Metrics/LineLength:
   - spec/performance/shop_controller_spec.rb
   - spec/requests/checkout/failed_checkout_spec.rb
   - spec/requests/embedded_shopfronts_headers_spec.rb
-  - spec/requests/shop_spec.rb
-  - spec/serializers/admin/customer_serializer_spec.rb
-  - spec/serializers/admin/exchange_serializer_spec.rb
-  - spec/serializers/admin/for_order_cycle/enterprise_serializer_spec.rb
-  - spec/serializers/admin/for_order_cycle/supplied_product_serializer_spec.rb
-  - spec/serializers/admin/subscription_customer_serializer_spec.rb
-  - spec/serializers/admin/variant_override_serializer_spec.rb
+  - spec/serializers/api/admin/customer_serializer_spec.rb
+  - spec/serializers/api/admin/exchange_serializer_spec.rb
+  - spec/serializers/api/admin/for_order_cycle/enterprise_serializer_spec.rb
+  - spec/serializers/api/admin/for_order_cycle/supplied_product_serializer_spec.rb
+  - spec/serializers/api/admin/order_cycle_serializer_spec.rb
+  - spec/serializers/api/admin/subscription_customer_serializer_spec.rb
+  - spec/serializers/api/admin/variant_override_serializer_spec.rb
+  - spec/serializers/api/current_order_serializer_spec.rb
   - spec/serializers/api/enterprise_shopfront_serializer_spec.rb
-  - spec/serializers/current_order_serializer_spec.rb
-  - spec/serializers/order_serializer_spec.rb
+  - spec/serializers/api/order_serializer_spec.rb
   - spec/services/cart_service_spec.rb
   - spec/services/embedded_page_service_spec.rb
+  - spec/services/exchange_products_renderer_spec.rb
+  - spec/services/order_cycle_distributed_products_spec.rb
   - spec/services/order_cycle_distributed_variants_spec.rb
   - spec/services/order_cycle_form_spec.rb
   - spec/services/order_factory_spec.rb
   - spec/services/order_syncer_spec.rb
+  - spec/services/permissions/order_spec.rb
+  - spec/services/product_tag_rules_filterer_spec.rb
+  - spec/services/products_renderer_spec.rb
   - spec/services/subscription_estimator_spec.rb
   - spec/services/subscription_form_spec.rb
   - spec/services/subscription_validator_spec.rb
@@ -360,8 +341,8 @@ Metrics/AbcSize:
   Exclude:
   - app/controllers/admin/bulk_line_items_controller.rb
   - app/controllers/admin/customers_controller.rb
-  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/enterprise_fees_controller.rb
+  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/order_cycles_controller.rb
   - app/controllers/admin/product_import_controller.rb
   - app/controllers/admin/schedules_controller.rb
@@ -369,28 +350,37 @@ Metrics/AbcSize:
   - app/controllers/admin/subscription_line_items_controller.rb
   - app/controllers/admin/subscriptions_controller.rb
   - app/controllers/api/enterprises_controller.rb
-  - app/controllers/api/order_cycles_controller.rb
   - app/controllers/api/product_images_controller.rb
+  - app/controllers/api/products_controller.rb
+  - app/controllers/api/shipments_controller.rb
+  - app/controllers/api/taxons_controller.rb
+  - app/controllers/api/variants_controller.rb
   - app/controllers/base_controller.rb
   - app/controllers/cart_controller.rb
   - app/controllers/checkout_controller.rb
   - app/controllers/discourse_sso_controller.rb
   - app/controllers/enterprises_controller.rb
   - app/controllers/spree/admin/adjustments_controller_decorator.rb
+  - app/controllers/spree/admin/image_settings_controller.rb
   - app/controllers/spree/admin/orders/customer_details_controller_decorator.rb
   - app/controllers/spree/admin/orders_controller_decorator.rb
-  - app/controllers/spree/admin/overview_controller_decorator.rb
+  - app/controllers/spree/admin/overview_controller.rb
+  - app/controllers/spree/admin/payment_methods_controller.rb
   - app/controllers/spree/admin/payments_controller_decorator.rb
-  - app/controllers/spree/admin/payment_methods_controller_decorator.rb
   - app/controllers/spree/admin/products_controller_decorator.rb
-  - app/controllers/spree/admin/reports_controller_decorator.rb
+  - app/controllers/spree/admin/reports_controller.rb
+  - app/controllers/spree/admin/resource_controller.rb
   - app/controllers/spree/admin/search_controller_decorator.rb
+  - app/controllers/spree/admin/taxons_controller.rb
+  - app/controllers/spree/admin/users_controller.rb
   - app/controllers/spree/admin/variants_controller_decorator.rb
-  - app/controllers/spree/api/products_controller_decorator.rb
-  - app/controllers/spree/api/shipments_controller_decorator.rb
+  - app/controllers/spree/checkout_controller.rb
   - app/controllers/spree/credit_cards_controller.rb
-  - app/controllers/spree/orders_controller_decorator.rb
-  - app/controllers/spree/user_sessions_controller_decorator.rb
+  - app/controllers/spree/orders_controller.rb
+  - app/controllers/spree/user_passwords_controller.rb
+  - app/controllers/spree/user_registrations_controller.rb
+  - app/controllers/spree/user_sessions_controller.rb
+  - app/controllers/spree/users_controller.rb
   - app/controllers/stripe/callbacks_controller.rb
   - app/controllers/user_confirmations_controller.rb
   - app/controllers/user_passwords_controller.rb
@@ -398,6 +388,7 @@ Metrics/AbcSize:
   - app/helpers/checkout_helper.rb
   - app/helpers/i18n_helper.rb
   - app/helpers/order_cycles_helper.rb
+  - app/helpers/spree/admin/navigation_helper_decorator.rb
   - app/helpers/spree/orders_helper.rb
   - app/jobs/subscription_placement_job.rb
   - app/mailers/producer_mailer.rb
@@ -419,6 +410,7 @@ Metrics/AbcSize:
   - app/models/spree/product_decorator.rb
   - app/models/spree/taxon_decorator.rb
   - app/serializers/api/admin/enterprise_serializer.rb
+  - app/serializers/api/admin/order_cycle_serializer.rb
   - app/serializers/api/product_serializer.rb
   - app/serializers/api/variant_serializer.rb
   - app/services/cart_service.rb
@@ -440,24 +432,26 @@ Metrics/AbcSize:
   - lib/open_food_network/payments_report.rb
   - lib/open_food_network/permissions.rb
   - lib/open_food_network/products_and_inventory_report.rb
+  - lib/open_food_network/rack_request_blocker.rb
   - lib/open_food_network/reports/line_items.rb
   - lib/open_food_network/sales_tax_report.rb
   - lib/open_food_network/users_and_enterprises_report.rb
   - lib/open_food_network/variant_and_line_item_naming.rb
   - lib/open_food_network/xero_invoices_report.rb
+  - lib/spree/api/controller_setup.rb
   - lib/spree/core/controller_helpers/respond_with_decorator.rb
   - lib/spree/localized_number.rb
   - lib/stripe/account_connector.rb
   - lib/tasks/enterprises.rake
   - lib/tasks/sample_data/product_factory.rb
-  - spec/controllers/spree/api/shipments_controller_spec.rb
   - spec/features/admin/product_import_spec.rb
   - spec/features/admin/reports_spec.rb
   - spec/features/admin/subscriptions_spec.rb
-  - spec/features/consumer/shopping/checkout_spec.rb
+  - spec/features/consumer/shopping/checkout_paypal_spec.rb
   - spec/features/consumer/shopping/variant_overrides_spec.rb
   - spec/models/enterprise_spec.rb
   - spec/models/product_importer_spec.rb
+  - spec/services/restart_checkout_spec.rb
   - spec/support/performance_helper.rb
 
 Metrics/BlockLength:
@@ -477,8 +471,14 @@ Metrics/BlockLength:
   ]
   Exclude:
   - lib/tasks/data.rake
-  - lib/tasks/dev.rake
   - spec/controllers/spree/admin/invoices_controller_spec.rb
+  - spec/factories.rb
+  - spec/factories/enterprise_factory.rb
+  - spec/factories/order_cycle_factory.rb
+  - spec/factories/order_factory.rb
+  - spec/factories/product_factory.rb
+  - spec/factories/shipping_method_factory.rb
+  - spec/factories/subscription_factory.rb
   - spec/factories/variant_factory.rb
   - spec/features/admin/orders_spec.rb
   - spec/features/consumer/shopping/embedded_shopfronts_spec.rb
@@ -492,11 +492,12 @@ Metrics/BlockLength:
 Metrics/CyclomaticComplexity:
   Max: 6
   Exclude:
-  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/enterprise_fees_controller.rb
+  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/checkout_controller.rb
   - app/controllers/spree/admin/payments_controller_decorator.rb
-  - app/controllers/spree/orders_controller_decorator.rb
+  - app/controllers/spree/admin/taxons_controller.rb
+  - app/controllers/spree/orders_controller.rb
   - app/helpers/checkout_helper.rb
   - app/helpers/i18n_helper.rb
   - app/helpers/order_cycles_helper.rb
@@ -522,9 +523,11 @@ Metrics/PerceivedComplexity:
   Max: 7
   Exclude:
   - app/controllers/admin/enterprises_controller.rb
+  - app/controllers/api/variants_controller.rb
   - app/controllers/checkout_controller.rb
   - app/controllers/spree/admin/payments_controller_decorator.rb
-  - app/controllers/spree/orders_controller_decorator.rb
+  - app/controllers/spree/admin/taxons_controller.rb
+  - app/controllers/spree/orders_controller.rb
   - app/helpers/checkout_helper.rb
   - app/helpers/i18n_helper.rb
   - app/helpers/order_cycles_helper.rb
@@ -546,25 +549,35 @@ Metrics/MethodLength:
   Max: 10
   Exclude:
   - app/controllers/admin/customers_controller.rb
-  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/enterprise_fees_controller.rb
+  - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/manager_invitations_controller.rb
   - app/controllers/admin/order_cycles_controller.rb
   - app/controllers/admin/stripe_accounts_controller.rb
   - app/controllers/admin/subscriptions_controller.rb
+  - app/controllers/api/products_controller.rb
+  - app/controllers/api/shipments_controller.rb
+  - app/controllers/api/taxons_controller.rb
+  - app/controllers/api/variants_controller.rb
   - app/controllers/base_controller.rb
   - app/controllers/cart_controller.rb
   - app/controllers/checkout_controller.rb
   - app/controllers/shop_controller.rb
+  - app/controllers/spree/admin/image_settings_controller.rb
   - app/controllers/spree/admin/orders/customer_details_controller_decorator.rb
+  - app/controllers/spree/admin/payment_methods_controller.rb
   - app/controllers/spree/admin/payments_controller_decorator.rb
-  - app/controllers/spree/admin/payment_methods_controller_decorator.rb
   - app/controllers/spree/admin/products_controller_decorator.rb
-  - app/controllers/spree/admin/reports_controller_decorator.rb
+  - app/controllers/spree/admin/reports_controller.rb
+  - app/controllers/spree/admin/resource_controller.rb
   - app/controllers/spree/admin/search_controller_decorator.rb
+  - app/controllers/spree/admin/tax_categories_controller.rb
+  - app/controllers/spree/admin/taxons_controller.rb
+  - app/controllers/spree/admin/users_controller.rb
   - app/controllers/spree/credit_cards_controller.rb
-  - app/controllers/spree/orders_controller_decorator.rb
-  - app/controllers/spree/user_sessions_controller_decorator.rb
+  - app/controllers/spree/orders_controller.rb
+  - app/controllers/spree/user_registrations_controller.rb
+  - app/controllers/spree/user_sessions_controller.rb
   - app/controllers/stripe/callbacks_controller.rb
   - app/controllers/user_confirmations_controller.rb
   - app/controllers/user_passwords_controller.rb
@@ -617,11 +630,12 @@ Metrics/MethodLength:
   - lib/open_food_network/sales_tax_report.rb
   - lib/open_food_network/users_and_enterprises_report.rb
   - lib/open_food_network/xero_invoices_report.rb
+  - lib/spree/api/controller_setup.rb
   - lib/spree/core/controller_helpers/respond_with_decorator.rb
   - lib/spree/localized_number.rb
   - lib/stripe/profile_storer.rb
   - lib/tasks/sample_data/product_factory.rb
-  - spec/features/consumer/shopping/checkout_spec.rb
+  - spec/features/consumer/shopping/checkout_paypal_spec.rb
   - spec/features/consumer/shopping/variant_overrides_spec.rb
   - spec/models/product_importer_spec.rb
   - spec/support/request/authentication_workflow.rb
@@ -632,13 +646,21 @@ Metrics/ClassLength:
   - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/order_cycles_controller.rb
   - app/controllers/admin/subscriptions_controller.rb
+  - app/controllers/api/products_controller.rb
   - app/controllers/checkout_controller.rb
+  - app/controllers/spree/admin/base_controller.rb
+  - app/controllers/spree/admin/payment_methods_controller.rb
+  - app/controllers/spree/admin/reports_controller.rb
+  - app/controllers/spree/admin/resource_controller.rb
+  - app/controllers/spree/admin/users_controller.rb
+  - app/controllers/spree/orders_controller.rb
   - app/models/enterprise.rb
   - app/models/order_cycle.rb
   - app/models/product_import/entry_processor.rb
   - app/models/product_import/entry_validator.rb
   - app/models/product_import/product_importer.rb
   - app/models/spree/ability_decorator.rb
+  - app/models/spree/user.rb
   - app/serializers/api/cached_enterprise_serializer.rb
   - app/serializers/api/enterprise_shopfront_serializer.rb
   - app/services/cart_service.rb
@@ -651,18 +673,20 @@ Metrics/ClassLength:
   - lib/open_food_network/packing_report.rb
   - lib/open_food_network/payments_report.rb
   - lib/open_food_network/permissions.rb
-  - lib/open_food_network/products_cache.rb
+  - lib/open_food_network/users_and_enterprises_report.rb
   - lib/open_food_network/xero_invoices_report.rb
 
 Metrics/ModuleLength:
   Max: 100
   Exclude:
+  - app/helpers/admin/injection_helper.rb
+  - app/helpers/injection_helper.rb
   - lib/open_food_network/column_preference_defaults.rb
   - spec/controllers/admin/enterprises_controller_spec.rb
   - spec/controllers/admin/order_cycles_controller_spec.rb
   - spec/controllers/api/order_cycles_controller_spec.rb
   - spec/controllers/api/orders_controller_spec.rb
-  - spec/controllers/spree/api/products_controller_spec.rb
+  - spec/controllers/spree/admin/payment_methods_controller_spec.rb
   - spec/lib/open_food_network/address_finder_spec.rb
   - spec/lib/open_food_network/customers_report_spec.rb
   - spec/lib/open_food_network/enterprise_fee_calculator_spec.rb
@@ -672,7 +696,6 @@ Metrics/ModuleLength:
   - spec/lib/open_food_network/order_grouper_spec.rb
   - spec/lib/open_food_network/permissions_spec.rb
   - spec/lib/open_food_network/products_and_inventory_report_spec.rb
-  - spec/lib/open_food_network/products_cache_spec.rb
   - spec/lib/open_food_network/proxy_order_syncer_spec.rb
   - spec/lib/open_food_network/scope_variant_to_hub_spec.rb
   - spec/lib/open_food_network/subscription_payment_updater_spec.rb
@@ -684,6 +707,7 @@ Metrics/ModuleLength:
   - spec/models/spree/payment_spec.rb
   - spec/models/spree/product_spec.rb
   - spec/models/spree/variant_spec.rb
+  - spec/services/permissions/order_spec.rb
   - spec/support/request/web_helper.rb
 
 Metrics/ParameterLists:
@@ -691,6 +715,5 @@ Metrics/ParameterLists:
   Exclude:
   - app/helpers/angular_form_builder.rb
   - app/models/product_import/entry_processor.rb
-  - app/models/product_import/entry_validator.rb
   - lib/open_food_network/xero_invoices_report.rb
   - spec/features/admin/reports_spec.rb

.rubocop_styleguide.yml

@@ -5,9 +5,9 @@
 # rubocop locally, the default configuration file `.rubocop.yml` loads
 # our "todo lists" to ignore all current violations.
 AllCops:
-  TargetRubyVersion: 2.1
   TargetRailsVersion: 3.2
   Exclude:
+    - 'bin/**/*'
     - 'db/**/*'
     - 'config/**/*'
     - 'script/**/*'
@@ -40,7 +40,7 @@ Layout/MultilineMethodCallIndentation:
   Enabled: true
   EnforcedStyle: indented
 
-Metrics/LineLength:
+Layout/LineLength:
   Max: 100
 
 ## TEMPORARY/CONTESTED SETTINGS

.ruby-version

@@ -1 +1 @@
-2.2.10
+2.3.7

Dockerfile

@@ -6,16 +6,19 @@ RUN apt-get update && apt-get install -y curl git build-essential software-prope
 # Setup ENV variables
 ENV PATH /usr/local/src/rbenv/shims:/usr/local/src/rbenv/bin:$PATH
 ENV RBENV_ROOT /usr/local/src/rbenv
-ENV RUBY_VERSION 2.1.9
 ENV CONFIGURE_OPTS --disable-install-doc
+ENV BUNDLE_PATH /bundles
+
+WORKDIR /usr/src/app
+COPY .ruby-version .
 
 # Rbenv & Ruby part
 RUN git clone https://github.com/rbenv/rbenv.git ${RBENV_ROOT} && \
     git clone https://github.com/rbenv/ruby-build.git ${RBENV_ROOT}/plugins/ruby-build && \
     ${RBENV_ROOT}/plugins/ruby-build/install.sh && \
     echo 'eval "$(rbenv init -)"' >> /etc/profile.d/rbenv.sh && \
-    rbenv install $RUBY_VERSION && \
-    rbenv global $RUBY_VERSION && \
+    rbenv install $(cat .ruby-version) && \
+    rbenv global $(cat .ruby-version) && \
     gem install bundler --version=1.17.2
 
 # Postgres
@@ -24,8 +27,4 @@ RUN sh -c "echo 'deb https://apt.postgresql.org/pub/repos/apt/ bionic-pgdg main'
     apt-get update && \
     apt-get install -yqq --no-install-recommends postgresql-client-9.5 libpq-dev
 
-ENV BUNDLE_PATH /bundles
-
 COPY . /usr/src/app/
-
-WORKDIR /usr/src/app

Gemfile

@@ -1,9 +1,9 @@
 source 'https://rubygems.org'
-ruby "2.2.10"
+ruby "2.3.7"
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}.git" }
 
 gem 'i18n', '~> 0.6.11'
-gem 'i18n-js', '~> 3.4.1'
+gem 'i18n-js', '~> 3.5.1'
 gem 'rails', '~> 3.2.22'
 gem 'rails-i18n', '~> 3.0.0'
 gem 'rails_safe_tasks', '~> 1.0'
@@ -84,7 +84,7 @@ gem 'paper_trail', '~> 5.2.3'
 gem 'paperclip', '~> 3.4.1'
 gem 'rack-rewrite'
 gem 'rack-ssl', require: 'rack/ssl'
-gem 'roadie-rails', '~> 1.1.1'
+gem 'roadie-rails', '~> 1.3.0'
 gem 'spinjs-rails'
 
 gem 'combine_pdf'
@@ -93,12 +93,12 @@ gem 'wkhtmltopdf-binary'
 
 gem 'foreigner'
 gem 'immigrant'
-gem 'roo', '~> 2.7.0'
+gem 'roo', '~> 2.8.2'
 gem 'roo-xls', '~> 1.1.0'
 
 gem 'whenever', require: false
 
-gem 'test-unit', '~> 3.0'
+gem 'test-unit', '~> 3.3'
 
 # Gems used only for assets and not required
 # in production environments by default.
@@ -106,10 +106,7 @@ group :assets do
   gem 'coffee-rails', '~> 3.2.1'
   gem 'compass-rails'
 
-  gem 'mini_racer', '0.1.15'
-  # Previously we found that libv8 6.7.288.46.1 breakis the compilation of mini_racer.
-  # Now we see that we need to set the version explicitly. Nothing else depends on libv8.
-  gem 'libv8', '6.3.292.48.1'
+  gem 'mini_racer', '0.2.4'
 
   gem 'uglifier', '>= 1.0.3'
 
@@ -135,7 +132,7 @@ group :test, :development do
   # Pretty printed test output
   gem 'atomic'
   gem 'awesome_print'
-  gem 'capybara', '>= 2.15.4'
+  gem 'capybara', '>= 2.18.0' # 3.0 requires nokogiri 1.8
   gem 'database_cleaner', '0.7.1', require: false
   gem "factory_bot_rails", require: false
   gem 'fuubar', '~> 2.5.0'
@@ -148,7 +145,7 @@ group :test, :development do
   gem 'shoulda-matchers'
   gem 'timecop'
   gem 'unicorn-rails'
-  gem 'webdrivers', '3.8.1'
+  gem 'webdrivers'
 end
 
 group :test do
@@ -161,10 +158,10 @@ end
 group :development do
   gem 'byebug', '~> 9.0.0' # 9.1 requires ruby 2.2
   gem 'debugger-linecache'
-  gem 'listen', '3.0.8' # 3.1.0 requires ruby 2.2
   gem "newrelic_rpm", "~> 3.0"
   gem 'pry-byebug', '>= 3.4.3'
-  gem 'rubocop', '>= 0.49.1'
+  gem 'rubocop'
+  gem 'rubocop-rails'
   gem 'spring', '1.7.2'
   gem 'spring-commands-rspec'
 
@@ -173,5 +170,5 @@ group :development do
   # greater than 1.0.9, so we just required the latest available version here.
   gem 'eventmachine', '>= 1.2.3'
 
-  gem 'rack-mini-profiler', '< 1.0.0'
+  gem 'rack-mini-profiler', '< 2.0.0'
 end

Gemfile.lock

@@ -129,7 +129,7 @@ GEM
       activesupport (= 3.2.22.5)
       arel (~> 3.0.2)
       tzinfo (~> 0.3.29)
-    activerecord-import (1.0.3)
+    activerecord-import (1.0.4)
       activerecord (>= 3.2)
     activerecord-postgresql-adapter (0.0.1)
       pg
@@ -178,8 +178,7 @@ GEM
       rack (>= 1.0.0)
       rack-test (>= 0.5.4)
       xpath (>= 2.0, < 4.0)
-    childprocess (0.9.0)
-      ffi (~> 1.0, >= 1.0.11)
+    childprocess (3.0.0)
     chronic (0.10.2)
     chunky_png (1.3.10)
     climate_control (0.2.0)
@@ -213,10 +212,9 @@ GEM
       sass-rails (< 5.1)
       sprockets (< 4.0)
     concurrent-ruby (1.1.5)
-    connection_pool (2.2.2)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
-    css_parser (1.6.0)
+    css_parser (1.7.0)
       addressable
     daemons (1.3.1)
     dalli (2.7.10)
@@ -225,7 +223,7 @@ GEM
       activerecord (>= 3.2.0, < 5.0)
       fog (~> 1.0)
       rails (>= 3.2.0, < 5.0)
-    ddtrace (0.28.0)
+    ddtrace (0.31.0)
       msgpack
     debugger-linecache (1.2.0)
     deface (1.0.2)
@@ -256,17 +254,17 @@ GEM
     dry-inflector (0.1.2)
     erubis (2.7.0)
     eventmachine (1.2.7)
-    excon (0.62.0)
+    excon (0.71.1)
     execjs (2.7.0)
     factory_bot (4.10.0)
       activesupport (>= 3.0.0)
     factory_bot_rails (4.10.0)
       factory_bot (~> 4.10.0)
       railties (>= 3.0.0)
-    faraday (0.15.4)
+    faraday (0.17.1)
       multipart-post (>= 1.2, < 3)
     ffaker (1.22.1)
-    ffi (1.10.0)
+    ffi (1.11.3)
     figaro (1.1.1)
       thor (~> 0.14)
     fission (0.5.0)
@@ -439,12 +437,12 @@ GEM
     httparty (0.16.2)
       multi_xml (>= 0.5.2)
     i18n (0.6.11)
-    i18n-js (3.4.1)
+    i18n-js (3.5.1)
       i18n (>= 0.6.6)
     immigrant (0.3.6)
       activerecord (>= 3.0)
     ipaddress (0.8.3)
-    jaro_winkler (1.5.1)
+    jaro_winkler (1.5.4)
     journey (1.0.4)
     jquery-migrate-rails (1.2.1)
     jquery-rails (3.0.4)
@@ -467,10 +465,7 @@ GEM
       addressable (~> 2.3)
     letter_opener (1.7.0)
       launchy (~> 2.2)
-    libv8 (6.3.292.48.1)
-    listen (3.0.8)
-      rb-fsevent (~> 0.9, >= 0.9.4)
-      rb-inotify (~> 0.9, >= 0.9.7)
+    libv8 (7.3.492.27.1)
     mail (2.5.5)
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
@@ -478,18 +473,16 @@ GEM
     mime-types (1.25.1)
     mini_mime (1.0.1)
     mini_portile2 (2.1.0)
-    mini_racer (0.1.15)
-      libv8 (~> 6.3)
+    mini_racer (0.2.4)
+      libv8 (>= 6.3)
     momentjs-rails (2.20.1)
       railties (>= 3.1)
     money (5.1.1)
       i18n (~> 0.6.0)
     msgpack (1.3.1)
-    multi_json (1.13.1)
+    multi_json (1.14.1)
     multi_xml (0.6.0)
     multipart-post (2.1.1)
-    net-http-persistent (3.1.0)
-      connection_pool (~> 2.2)
     newrelic_rpm (3.18.1.330)
     nokogiri (1.6.8.1)
       mini_portile2 (~> 2.1.0)
@@ -499,7 +492,7 @@ GEM
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 3)
-    oj (3.7.12)
+    oj (3.10.0)
     orm_adapter (0.5.0)
     paper_trail (5.2.3)
       activerecord (>= 3.0, < 6.0)
@@ -510,10 +503,10 @@ GEM
       activesupport (>= 3.0.0)
       cocaine (~> 0.5.0)
       mime-types
-    parallel (1.11.2)
+    parallel (1.19.1)
     paranoia (1.3.4)
       activerecord (~> 3.1)
-    parser (2.5.1.0)
+    parser (2.7.0.2)
       ast (~> 2.4.0)
     paypal-sdk-core (0.2.10)
       multi_json (~> 1.0)
@@ -525,7 +518,6 @@ GEM
       activerecord (~> 3.0)
     polyglot (0.3.5)
     power_assert (1.1.5)
-    powerpack (0.1.1)
     pry (0.12.2)
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
@@ -538,7 +530,7 @@ GEM
     rack (1.4.7)
     rack-cache (1.9.0)
       rack (>= 0.4)
-    rack-mini-profiler (0.10.7)
+    rack-mini-profiler (1.1.4)
       rack (>= 1.2.0)
     rack-protection (1.5.5)
       rack
@@ -568,7 +560,7 @@ GEM
       thor (>= 0.14.6, < 2.0)
     rainbow (3.0.0)
     raindrops (0.19.0)
-    rake (12.3.3)
+    rake (13.0.0)
     ransack (0.7.2)
       actionpack (~> 3.0)
       activerecord (~> 3.0)
@@ -589,12 +581,12 @@ GEM
     roadie (3.4.0)
       css_parser (~> 1.4)
       nokogiri (~> 1.5)
-    roadie-rails (1.1.1)
-      railties (>= 3.0, < 5.1)
+    roadie-rails (1.3.0)
+      railties (>= 3.0, < 5.3)
       roadie (~> 3.1)
-    roo (2.7.1)
+    roo (2.8.2)
       nokogiri (~> 1)
-      rubyzip (~> 1.1, < 2.0.0)
+      rubyzip (>= 1.2.1, < 2.0.0)
     roo-xls (1.1.0)
       nokogiri
       roo (>= 2.0.0beta1, < 3)
@@ -619,17 +611,19 @@ GEM
       rspec-expectations (~> 3.9.0)
       rspec-mocks (~> 3.9.0)
       rspec-support (~> 3.9.0)
-    rspec-retry (0.6.1)
+    rspec-retry (0.6.2)
       rspec-core (> 3.3)
     rspec-support (3.9.0)
-    rubocop (0.57.2)
+    rubocop (0.79.0)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
-      parser (>= 2.5)
-      powerpack (~> 0.1)
+      parser (>= 2.7.0.1)
       rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (~> 1.0, >= 1.0.1)
+      unicode-display_width (>= 1.4.0, < 1.7)
+    rubocop-rails (2.4.1)
+      rack (>= 1.1)
+      rubocop (>= 0.72.0)
     ruby-ole (1.2.12.1)
     ruby-progressbar (1.10.1)
     ruby-rc4 (0.1.5)
@@ -643,9 +637,9 @@ GEM
     select2-rails (3.4.9)
       sass-rails
       thor (~> 0.14)
-    selenium-webdriver (3.141.0)
-      childprocess (~> 0.5)
-      rubyzip (~> 1.2, >= 1.2.2)
+    selenium-webdriver (3.142.7)
+      childprocess (>= 0.5, < 4.0)
+      rubyzip (>= 1.2.2)
     shoulda-matchers (2.8.0)
       activesupport (>= 3.0.0)
     simplecov (0.17.1)
@@ -671,10 +665,8 @@ GEM
       tilt (~> 1.1, != 1.3.0)
     state_machine (1.2.0)
     stringex (1.5.1)
-    stripe (4.24.0)
-      faraday (~> 0.13)
-      net-http-persistent (~> 3.0)
-    test-unit (3.3.3)
+    stripe (5.11.0)
+    test-unit (3.3.5)
       power_assert
     thor (0.20.3)
     tilt (1.4.1)
@@ -687,11 +679,11 @@ GEM
     turbo-sprockets-rails3 (0.3.14)
       railties (> 3.2.8, < 4.0.0)
       sprockets (>= 2.2.0)
-    tzinfo (0.3.55)
+    tzinfo (0.3.56)
     uglifier (4.2.0)
       execjs (>= 0.3.0, < 3)
-    unicode-display_width (1.3.2)
-    unicorn (5.5.1)
+    unicode-display_width (1.6.0)
+    unicorn (5.5.2)
       kgio (~> 2.6)
       raindrops (~> 0.7)
     unicorn-rails (2.2.1)
@@ -704,10 +696,10 @@ GEM
       railties (>= 3.0)
     warden (1.2.7)
       rack (>= 1.0)
-    webdrivers (3.8.1)
+    webdrivers (4.2.0)
       nokogiri (~> 1.6)
-      rubyzip (~> 1.0)
-      selenium-webdriver (~> 3.0)
+      rubyzip (>= 1.3.0)
+      selenium-webdriver (>= 3.0, < 4.0)
     webmock (3.7.6)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
@@ -715,7 +707,7 @@ GEM
     whenever (0.11.0)
       chronic (>= 0.6.3)
     wicked_pdf (1.1.0)
-    wkhtmltopdf-binary (0.12.4)
+    wkhtmltopdf-binary (0.12.5)
     xml-simple (1.1.5)
     xpath (2.1.0)
       nokogiri (~> 1.3)
@@ -739,7 +731,7 @@ DEPENDENCIES
   blockenspiel
   bugsnag
   byebug (~> 9.0.0)
-  capybara (>= 2.15.4)
+  capybara (>= 2.18.0)
   coffee-rails (~> 3.2.1)
   combine_pdf
   compass-rails
@@ -768,7 +760,7 @@ DEPENDENCIES
   gmaps4rails
   haml
   i18n (~> 0.6.11)
-  i18n-js (~> 3.4.1)
+  i18n-js (~> 3.5.1)
   immigrant
   jquery-migrate-rails
   jquery-rails (= 3.0.4)
@@ -777,9 +769,7 @@ DEPENDENCIES
   kaminari (~> 0.14.1)
   knapsack
   letter_opener (>= 1.4.1)
-  libv8 (= 6.3.292.48.1)
-  listen (= 3.0.8)
-  mini_racer (= 0.1.15)
+  mini_racer (= 0.2.4)
   momentjs-rails
   newrelic_rpm (~> 3.0)
   nokogiri (>= 1.6.7.1)
@@ -792,19 +782,20 @@ DEPENDENCIES
   pg (~> 0.21.0)
   pry-byebug (>= 3.4.3)
   rabl
-  rack-mini-profiler (< 1.0.0)
+  rack-mini-profiler (< 2.0.0)
   rack-rewrite
   rack-ssl
   rails (~> 3.2.22)
   rails-i18n (~> 3.0.0)
   rails_safe_tasks (~> 1.0)
   redcarpet
-  roadie-rails (~> 1.1.1)
-  roo (~> 2.7.0)
+  roadie-rails (~> 1.3.0)
+  roo (~> 2.8.2)
   roo-xls (~> 1.1.0)
   rspec-rails (>= 3.5.2)
   rspec-retry
-  rubocop (>= 0.49.1)
+  rubocop
+  rubocop-rails
   sass (~> 3.3)
   sass-rails (~> 3.2.3)
   selenium-webdriver
@@ -819,7 +810,7 @@ DEPENDENCIES
   spring (= 1.7.2)
   spring-commands-rspec
   stripe
-  test-unit (~> 3.0)
+  test-unit (~> 3.3)
   timecop
   truncate_html
   turbo-sprockets-rails3
@@ -827,14 +818,14 @@ DEPENDENCIES
   unicorn
   unicorn-rails
   web!
-  webdrivers (= 3.8.1)
+  webdrivers
   webmock
   whenever
   wicked_pdf
   wkhtmltopdf-binary
 
 RUBY VERSION
-   ruby 2.2.10p489
+   ruby 2.3.7p456
 
 BUNDLED WITH
    1.17.2

app/assets/javascripts/admin/bulk_product_update.js.coffee

@@ -142,7 +142,7 @@ angular.module("ofn.admin").controller "AdminProductEditCtrl", ($scope, $timeout
     if confirm("Are you sure?")
       $http(
         method: "DELETE"
-        url: "/api/products/" + product.id + "/soft_delete"
+        url: "/api/products/" + product.id
       ).success (data) ->
         $scope.products.splice $scope.products.indexOf(product), 1
         DirtyProducts.deleteProduct product.id
@@ -157,7 +157,7 @@ angular.module("ofn.admin").controller "AdminProductEditCtrl", ($scope, $timeout
         if confirm(t("are_you_sure"))
           $http(
             method: "DELETE"
-            url: "/api/products/" + product.permalink_live + "/variants/" + variant.id + "/soft_delete"
+            url: "/api/products/" + product.permalink_live + "/variants/" + variant.id
           ).success (data) ->
             $scope.removeVariant(product, variant)
     else

app/assets/javascripts/admin/order_cycles/controllers/create.js.coffee

@@ -1,92 +1,12 @@
 angular.module('admin.orderCycles')
-  .controller 'AdminCreateOrderCycleCtrl', ($scope, $filter, $window, OrderCycle, Enterprise, EnterpriseFee, Schedules, RequestMonitor, ocInstance, StatusMessage) ->
-    $scope.enterprises = Enterprise.index(coordinator_id: ocInstance.coordinator_id)
-    $scope.supplier_enterprises = Enterprise.producer_enterprises
-    $scope.distributor_enterprises = Enterprise.hub_enterprises
-    $scope.supplied_products = Enterprise.supplied_products
-    $scope.enterprise_fees = EnterpriseFee.index(coordinator_id: ocInstance.coordinator_id)
-    $scope.schedules = Schedules.index({enterprise_id: ocInstance.coordinator_id})
+  .controller 'AdminCreateOrderCycleCtrl', ($scope, $controller, $filter, $window, OrderCycle, Enterprise, EnterpriseFee, Schedules, RequestMonitor, ocInstance, StatusMessage) ->
+    $controller('AdminOrderCycleBasicCtrl', {$scope: $scope, ocInstance: ocInstance})
 
-    $scope.OrderCycle = OrderCycle
     $scope.order_cycle = OrderCycle.new({ coordinator_id: ocInstance.coordinator_id})
-
-    $scope.StatusMessage = StatusMessage
-
-    $scope.$watch 'order_cycle_form.$dirty', (newValue) ->
-      StatusMessage.display 'notice', t("admin.unsaved_changes") if newValue
-
-    $scope.$watch 'order_cycle_form.$valid', (isValid) ->
-      StatusMessage.setValidation(isValid)
-
-    $scope.loaded = ->
-      Enterprise.loaded && EnterpriseFee.loaded && OrderCycle.loaded && !RequestMonitor.loading
-
-    $scope.suppliedVariants = (enterprise_id) ->
-      Enterprise.suppliedVariants(enterprise_id)
-
-    $scope.exchangeSelectedVariants = (exchange) ->
-      OrderCycle.exchangeSelectedVariants(exchange)
-
-    $scope.setExchangeVariants = (exchange, variants, selected) ->
-      OrderCycle.setExchangeVariants(exchange, variants, selected)
-
-    $scope.enterpriseTotalVariants = (enterprise) ->
-      Enterprise.totalVariants(enterprise)
-
-    $scope.productSuppliedToOrderCycle = (product) ->
-      OrderCycle.productSuppliedToOrderCycle(product)
-
-    $scope.variantSuppliedToOrderCycle = (variant) ->
-      OrderCycle.variantSuppliedToOrderCycle(variant)
-
-    $scope.incomingExchangeVariantsFor = (enterprise_id) ->
-      $filter('filterExchangeVariants')(OrderCycle.incomingExchangesVariants(), $scope.order_cycle.visible_variants_for_outgoing_exchanges[enterprise_id])
-
-    $scope.exchangeDirection = (exchange) ->
-      OrderCycle.exchangeDirection(exchange)
-
-    $scope.enterprisesWithFees = ->
-      $scope.enterprises[id] for id in OrderCycle.participatingEnterpriseIds() when $scope.enterpriseFeesForEnterprise(id).length > 0
-
-    $scope.enterpriseFeesForEnterprise = (enterprise_id) ->
-      EnterpriseFee.forEnterprise(parseInt(enterprise_id))
-
-    $scope.addSupplier = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addSupplier($scope.new_supplier_id)
-
-    $scope.addDistributor = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addDistributor($scope.new_distributor_id)
-
-    $scope.removeExchange = ($event, exchange) ->
-      $event.preventDefault()
-      OrderCycle.removeExchange(exchange)
-      $scope.order_cycle_form.$dirty = true
-
-    $scope.addCoordinatorFee = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addCoordinatorFee()
-
-    $scope.removeCoordinatorFee = ($event, index) ->
-      $event.preventDefault()
-      OrderCycle.removeCoordinatorFee(index)
-
-    $scope.addExchangeFee = ($event, exchange) ->
-      $event.preventDefault()
-      OrderCycle.addExchangeFee(exchange)
-
-    $scope.removeExchangeFee = ($event, exchange, index) ->
-      $event.preventDefault()
-      OrderCycle.removeExchangeFee(exchange, index)
-
-    $scope.removeDistributionOfVariant = (variant_id) ->
-      OrderCycle.removeDistributionOfVariant(variant_id)
+    $scope.enterprises = Enterprise.index(coordinator_id: ocInstance.coordinator_id)
+    $scope.enterprise_fees = EnterpriseFee.index(coordinator_id: ocInstance.coordinator_id)
 
     $scope.submit = ($event, destination) ->
       $event.preventDefault()
       StatusMessage.display 'progress', t('js.saving')
       OrderCycle.create(destination)
-
-    $scope.cancel = (destination) ->
-      $window.location = destination

app/assets/javascripts/admin/order_cycles/controllers/edit.js.coffee

@@ -1,91 +1,17 @@
 angular.module('admin.orderCycles')
-  .controller 'AdminEditOrderCycleCtrl', ($scope, $filter, $location, $window, OrderCycle, Enterprise, EnterpriseFee, StatusMessage, Schedules, RequestMonitor, ocInstance) ->
+  .controller 'AdminEditOrderCycleCtrl', ($scope, $controller, $filter, $location, $window, OrderCycle, Enterprise, EnterpriseFee, StatusMessage, Schedules, RequestMonitor, ocInstance) ->
+    $controller('AdminOrderCycleBasicCtrl', {$scope: $scope, ocInstance: ocInstance})
+
     order_cycle_id = $location.absUrl().match(/\/admin\/order_cycles\/(\d+)/)[1]
-    $scope.enterprises = Enterprise.index(order_cycle_id: order_cycle_id)
-    $scope.supplier_enterprises = Enterprise.producer_enterprises
-    $scope.distributor_enterprises = Enterprise.hub_enterprises
-    $scope.supplied_products = Enterprise.supplied_products
-    $scope.enterprise_fees = EnterpriseFee.index(order_cycle_id: order_cycle_id)
-    $scope.schedules = Schedules.index({enterprise_id: ocInstance.coordinator_id})
-
-    $scope.OrderCycle = OrderCycle
     $scope.order_cycle = OrderCycle.load(order_cycle_id)
-
-    $scope.StatusMessage = StatusMessage
-
-    $scope.$watch 'order_cycle_form.$dirty', (newValue) ->
-      StatusMessage.display 'notice', t("admin.unsaved_changes") if newValue
-
-    $scope.$watch 'order_cycle_form.$valid', (isValid) ->
-      StatusMessage.setValidation(isValid)
-
-    $scope.loaded = ->
-      Enterprise.loaded && EnterpriseFee.loaded && OrderCycle.loaded && !RequestMonitor.loading
-
-    $scope.suppliedVariants = (enterprise_id) ->
-      Enterprise.suppliedVariants(enterprise_id)
-
-    $scope.exchangeSelectedVariants = (exchange) ->
-      OrderCycle.exchangeSelectedVariants(exchange)
-
-    $scope.setExchangeVariants = (exchange, variants, selected) ->
-      OrderCycle.setExchangeVariants(exchange, variants, selected)
-
-    $scope.enterpriseTotalVariants = (enterprise) ->
-      Enterprise.totalVariants(enterprise)
-
-    $scope.productSuppliedToOrderCycle = (product) ->
-      OrderCycle.productSuppliedToOrderCycle(product)
-
-    $scope.variantSuppliedToOrderCycle = (variant) ->
-      OrderCycle.variantSuppliedToOrderCycle(variant)
-
-    $scope.incomingExchangeVariantsFor = (enterprise_id) ->
-      $filter('filterExchangeVariants')(OrderCycle.incomingExchangesVariants(), $scope.order_cycle.visible_variants_for_outgoing_exchanges[enterprise_id])
-
-    $scope.exchangeDirection = (exchange) ->
-      OrderCycle.exchangeDirection(exchange)
-
-    $scope.enterprisesWithFees = ->
-      $scope.enterprises[id] for id in OrderCycle.participatingEnterpriseIds() when $scope.enterpriseFeesForEnterprise(id).length > 0
-
-    $scope.enterpriseFeesForEnterprise = (enterprise_id) ->
-      EnterpriseFee.forEnterprise(parseInt(enterprise_id))
-
-    $scope.addSupplier = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addSupplier($scope.new_supplier_id)
-
-    $scope.addDistributor = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addDistributor($scope.new_distributor_id)
-
-    $scope.removeExchange = ($event, exchange) ->
-      $event.preventDefault()
-      OrderCycle.removeExchange(exchange)
-      $scope.order_cycle_form.$dirty = true
-
-    $scope.addCoordinatorFee = ($event) ->
-      $event.preventDefault()
-      OrderCycle.addCoordinatorFee()
+    $scope.enterprises = Enterprise.index(order_cycle_id: order_cycle_id)
+    $scope.enterprise_fees = EnterpriseFee.index(order_cycle_id: order_cycle_id)
 
     $scope.removeCoordinatorFee = ($event, index) ->
       $event.preventDefault()
       OrderCycle.removeCoordinatorFee(index)
       $scope.order_cycle_form.$dirty = true
 
-    $scope.addExchangeFee = ($event, exchange) ->
-      $event.preventDefault()
-      OrderCycle.addExchangeFee(exchange)
-
-    $scope.removeExchangeFee = ($event, exchange, index) ->
-      $event.preventDefault()
-      OrderCycle.removeExchangeFee(exchange, index)
-      $scope.order_cycle_form.$dirty = true
-
-    $scope.removeDistributionOfVariant = (variant_id) ->
-      OrderCycle.removeDistributionOfVariant(variant_id)
-
     $scope.submit = (destination) ->
       $event.preventDefault()
       StatusMessage.display 'progress', t('js.saving')
@@ -94,6 +20,3 @@ angular.module('admin.orderCycles')
       $event.preventDefault()
       StatusMessage.display 'progress', t('js.saving')
       OrderCycle.update(destination, $scope.order_cycle_form)
-
-    $scope.cancel = (destination) ->
-      $window.location = destination

app/assets/javascripts/admin/order_cycles/controllers/incoming_controller.js.coffee

@@ -0,0 +1,31 @@
+angular.module('admin.orderCycles').controller 'AdminOrderCycleIncomingCtrl', ($scope, $controller, $location, Enterprise, OrderCycle, ExchangeProduct, ocInstance) ->
+  $controller('AdminOrderCycleExchangesCtrl', {$scope: $scope, ocInstance: ocInstance, $location: $location})
+
+  $scope.view = 'incoming'
+
+  $scope.exchangeTotalVariants = (exchange) ->
+    return unless $scope.enterprises? && $scope.enterprises[exchange.enterprise_id]?
+
+    enterprise = $scope.enterprises[exchange.enterprise_id]
+    return enterprise.numVariants if enterprise.numVariants?
+
+    enterprise.numVariants = 0
+    params = { exchange_id: exchange.id, enterprise_id: exchange.enterprise_id, order_cycle_id: $scope.order_cycle.id, incoming: true}
+    ExchangeProduct.countVariants params, (variants_count) ->
+      enterprise.numVariants = variants_count
+      $scope.setSelectAllVariantsCheckboxValue(exchange, enterprise.numVariants)
+
+    return enterprise.numVariants
+
+  $scope.addSupplier = ($event) ->
+    $event.preventDefault()
+    OrderCycle.addSupplier $scope.new_supplier_id
+
+  # To select all variants we first need to load them all from the server
+  #
+  # This is only needed in Incoming exchanges as here we use supplied_products,
+  #   in Outgoing Exchanges the variants are loaded as part of the Exchange payload
+  $scope.selectAllVariants = (exchange, selected) ->
+    $scope.loadAllExchangeProducts(exchange).then ->
+      $scope.setExchangeVariants(exchange, $scope.suppliedVariants(exchange.enterprise_id), selected)
+      $scope.$apply()

app/assets/javascripts/admin/order_cycles/controllers/order_cycle_basic_controller.js.coffee

@@ -0,0 +1,40 @@
+angular.module('admin.orderCycles')
+  .controller 'AdminOrderCycleBasicCtrl', ($scope, $filter, $window, OrderCycle, Enterprise, EnterpriseFee, Schedules, RequestMonitor, ocInstance, StatusMessage) ->
+    $scope.StatusMessage = StatusMessage
+    $scope.OrderCycle = OrderCycle
+
+    $scope.$watch 'order_cycle_form.$dirty', (newValue) ->
+      StatusMessage.display 'notice', t("admin.unsaved_changes") if newValue
+
+    $scope.$watch 'order_cycle_form.$valid', (isValid) ->
+      StatusMessage.setValidation(isValid)
+
+    $scope.loaded = ->
+      Enterprise.loaded && EnterpriseFee.loaded && OrderCycle.loaded && !RequestMonitor.loading
+
+    $scope.enterpriseFeesForEnterprise = (enterprise_id) ->
+      EnterpriseFee.forEnterprise(parseInt(enterprise_id))
+
+    $scope.cancel = (destination) ->
+      $window.location = destination
+
+    # Used in panels/exchange_products_supplied.html
+    $scope.suppliedVariants = (enterprise_id) ->
+      Enterprise.suppliedVariants(enterprise_id)
+
+    # Used in panels/exchange_products_supplied.html and panels/exchange_products_distributed.html
+    $scope.setExchangeVariants = (exchange, variants, selected) ->
+      OrderCycle.setExchangeVariants(exchange, variants, selected)
+
+    # The following methods are specific to the general settings pages:
+    #   - simple create, simple edit and general settings pages
+
+    $scope.schedules = Schedules.index({enterprise_id: ocInstance.coordinator_id})
+
+    $scope.addCoordinatorFee = ($event) ->
+      $event.preventDefault()
+      OrderCycle.addCoordinatorFee()
+
+    $scope.removeCoordinatorFee = ($event, index) ->
+      $event.preventDefault()
+      OrderCycle.removeCoordinatorFee(index)

app/assets/javascripts/admin/order_cycles/controllers/order_cycle_exchanges_controller.js.coffee

@@ -0,0 +1,76 @@
+angular.module('admin.orderCycles')
+  .controller 'AdminOrderCycleExchangesCtrl', ($scope, $controller, $filter, $window, $location, $timeout, OrderCycle, ExchangeProduct, Enterprise, EnterpriseFee, Schedules, RequestMonitor, ocInstance, StatusMessage) ->
+    $controller('AdminEditOrderCycleCtrl', {$scope: $scope, ocInstance: ocInstance, $location: $location})
+
+    $scope.supplier_enterprises = Enterprise.producer_enterprises
+    $scope.distributor_enterprises = Enterprise.hub_enterprises
+
+    $scope.productsLoading = ->
+      RequestMonitor.loading
+
+    $scope.setSelectAllVariantsCheckboxValue = (exchange, totalNumberOfVariants) ->
+      exchange.select_all_variants = $scope.exchangeSelectedVariants(exchange) >= totalNumberOfVariants
+
+    $scope.exchangeSelectedVariants = (exchange) ->
+      OrderCycle.exchangeSelectedVariants(exchange)
+
+    $scope.exchangeDirection = (exchange) ->
+      OrderCycle.exchangeDirection(exchange)
+
+    $scope.enterprisesWithFees = ->
+      $scope.enterprises[id] for id in OrderCycle.participatingEnterpriseIds() when $scope.enterpriseFeesForEnterprise(id).length > 0
+
+    $scope.removeExchange = ($event, exchange) ->
+      $event.preventDefault()
+      OrderCycle.removeExchange(exchange)
+      $scope.order_cycle_form.$dirty = true
+
+    $scope.addExchangeFee = ($event, exchange) ->
+      $event.preventDefault()
+      OrderCycle.addExchangeFee(exchange)
+
+    $scope.removeExchangeFee = ($event, exchange, index) ->
+      $event.preventDefault()
+      OrderCycle.removeExchangeFee(exchange, index)
+      $scope.order_cycle_form.$dirty = true
+
+    $scope.setPickupTimeFieldDirty = (index) ->
+      $timeout ->
+        pickup_time_field_name = "order_cycle_outgoing_exchange_" + index + "_pickup_time"
+        $scope.order_cycle_form[pickup_time_field_name].$setDirty()
+
+    $scope.removeDistributionOfVariant = (variant_id) ->
+      OrderCycle.removeDistributionOfVariant(variant_id)
+
+    $scope.loadExchangeProducts = (exchange, page = 1) ->
+      enterprise = $scope.enterprises[exchange.enterprise_id]
+      enterprise.supplied_products ?= []
+
+      return if enterprise.last_page_loaded? && enterprise.last_page_loaded >= page
+      enterprise.last_page_loaded = page
+
+      incoming = true if $scope.view == 'incoming'
+      params = { exchange_id: exchange.id, enterprise_id: exchange.enterprise_id, order_cycle_id: $scope.order_cycle.id, incoming: incoming, page: page}
+      ExchangeProduct.index params, (products, num_of_pages, num_of_products) ->
+        enterprise.num_of_pages = num_of_pages
+        enterprise.num_of_products = num_of_products
+        enterprise.supplied_products.push products...
+
+    $scope.loadMoreExchangeProducts = (exchange) ->
+      $scope.loadExchangeProducts(exchange, $scope.enterprises[exchange.enterprise_id].last_page_loaded + 1)
+
+    $scope.loadAllExchangeProducts = (exchange) ->
+      enterprise = $scope.enterprises[exchange.enterprise_id]
+
+      if enterprise.last_page_loaded < enterprise.num_of_pages
+        for page_to_load in [(enterprise.last_page_loaded + 1)..enterprise.num_of_pages]
+          RequestMonitor.load $scope.loadExchangeProducts(exchange, page_to_load).$promise
+
+      RequestMonitor.loadQueue
+
+    # initialize exchange products panel if not yet done
+    $scope.exchangeProdutsPanelInitialized = []
+    $scope.initializeExchangeProductsPanel = (exchange) ->
+      return if $scope.exchangeProdutsPanelInitialized[exchange.enterprise_id]
+      RequestMonitor.load $scope.loadExchangeProducts(exchange).$promise
+      $scope.exchangeProdutsPanelInitialized[exchange.enterprise_id] = true

app/assets/javascripts/admin/order_cycles/controllers/outgoing_controller.js.coffee

@@ -0,0 +1,24 @@
+angular.module('admin.orderCycles').controller 'AdminOrderCycleOutgoingCtrl', ($scope, $controller, $filter, $location, OrderCycle, ocInstance, StatusMessage) ->
+  $controller('AdminOrderCycleExchangesCtrl', {$scope: $scope, ocInstance: ocInstance, $location: $location})
+
+  $scope.view = 'outgoing'
+
+  $scope.variantSuppliedToOrderCycle = (variant) ->
+    OrderCycle.variantSuppliedToOrderCycle(variant)
+
+  $scope.incomingExchangeVariantsFor = (enterprise_id) ->
+    $filter('filterExchangeVariants')(OrderCycle.incomingExchangesVariants(), $scope.order_cycle.visible_variants_for_outgoing_exchanges[enterprise_id])
+
+  $scope.exchangeTotalVariants = (exchange) ->
+    totalNumberOfVariants = $scope.incomingExchangeVariantsFor(exchange.enterprise_id).length
+    $scope.setSelectAllVariantsCheckboxValue(exchange, totalNumberOfVariants)
+    totalNumberOfVariants
+
+  $scope.addDistributor = ($event) ->
+    $event.preventDefault()
+    OrderCycle.addDistributor $scope.new_distributor_id
+
+  $scope.submit = ($event, destination) ->
+    $event.preventDefault()
+    StatusMessage.display 'progress', t('js.saving')
+    OrderCycle.update(destination, $scope.order_cycle_form) if OrderCycle.confirmNoDistributors()

app/assets/javascripts/admin/order_cycles/controllers/simple_create.js.coffee

@@ -1,58 +1,38 @@
-angular.module('admin.orderCycles').controller "AdminSimpleCreateOrderCycleCtrl", ($scope, $window, OrderCycle, Enterprise, EnterpriseFee, StatusMessage, Schedules, RequestMonitor, ocInstance) ->
-  $scope.StatusMessage = StatusMessage
-  $scope.OrderCycle = OrderCycle
-  $scope.schedules = Schedules.index({enterprise_id: ocInstance.coordinator_id})
+angular.module('admin.orderCycles').controller "AdminSimpleCreateOrderCycleCtrl", ($scope, $controller, $window, OrderCycle, Enterprise, EnterpriseFee, ExchangeProduct, StatusMessage, Schedules, RequestMonitor, ocInstance) ->
+  $controller('AdminOrderCycleBasicCtrl', {$scope: $scope, ocInstance: ocInstance})
+
   $scope.order_cycle = OrderCycle.new {coordinator_id: ocInstance.coordinator_id}, =>
-    # TODO: make this a get method, which only fetches one enterprise
     $scope.enterprises = Enterprise.index {coordinator_id: ocInstance.coordinator_id}, (enterprises) =>
       $scope.init(enterprises)
     $scope.enterprise_fees = EnterpriseFee.index(coordinator_id: ocInstance.coordinator_id)
 
-  $scope.$watch 'order_cycle_form.$dirty', (newValue) ->
-      StatusMessage.display 'notice', t("admin.unsaved_changes") if newValue
-
-  $scope.$watch 'order_cycle_form.$valid', (isValid) ->
-    StatusMessage.setValidation(isValid)
-
   $scope.init = (enterprises) ->
     enterprise = enterprises[Object.keys(enterprises)[0]]
-    OrderCycle.addSupplier enterprise.id
-    OrderCycle.addDistributor enterprise.id
-    $scope.outgoing_exchange = OrderCycle.order_cycle.outgoing_exchanges[0]
-
-    # All variants start as checked
-    OrderCycle.setExchangeVariants(OrderCycle.order_cycle.incoming_exchanges[0],
-      Enterprise.suppliedVariants(enterprise.id), true)
-
     OrderCycle.order_cycle.coordinator_id = enterprise.id
 
-  $scope.loaded = ->
-    Enterprise.loaded && EnterpriseFee.loaded && OrderCycle.loaded && !RequestMonitor.loading
+    OrderCycle.addDistributor enterprise.id, $scope.setOutgoingExchange
+    OrderCycle.addSupplier enterprise.id, $scope.loadExchangeProducts
+
+  $scope.setOutgoingExchange = ->
+    $scope.outgoing_exchange = OrderCycle.order_cycle.outgoing_exchanges[0]
+
+  $scope.loadExchangeProducts = ->
+    $scope.incoming_exchange = OrderCycle.order_cycle.incoming_exchanges[0]
+
+    params = { enterprise_id: $scope.incoming_exchange.enterprise_id, incoming: true }
+    ExchangeProduct.index params, $scope.storeProductsAndSelectAllVariants
+
+  $scope.storeProductsAndSelectAllVariants = (products) ->
+    $scope.enterprises[$scope.incoming_exchange.enterprise_id].supplied_products = products
+
+    # All variants start as checked
+    OrderCycle.setExchangeVariants($scope.incoming_exchange,
+      Enterprise.suppliedVariants($scope.incoming_exchange.enterprise_id), true)
 
   $scope.removeDistributionOfVariant = angular.noop
 
-  $scope.setExchangeVariants = (exchange, variants, selected) ->
-    OrderCycle.setExchangeVariants(exchange, variants, selected)
-
-  $scope.suppliedVariants = (enterprise_id) ->
-    Enterprise.suppliedVariants(enterprise_id)
-
-  $scope.addCoordinatorFee = ($event) ->
-    $event.preventDefault()
-    OrderCycle.addCoordinatorFee()
-
-  $scope.removeCoordinatorFee = ($event, index) ->
-    $event.preventDefault()
-    OrderCycle.removeCoordinatorFee(index)
-
-  $scope.enterpriseFeesForEnterprise = (enterprise_id) ->
-    EnterpriseFee.forEnterprise(parseInt(enterprise_id))
-
   $scope.submit = ($event, destination) ->
     $event.preventDefault()
     StatusMessage.display 'progress', t('js.saving')
     OrderCycle.mirrorIncomingToOutgoingProducts()
-    OrderCycle.create(destination)
-
-  $scope.cancel = (destination) ->
-      $window.location = destination
+    OrderCycle.create(destination) if OrderCycle.confirmNoDistributors()

app/assets/javascripts/admin/order_cycles/controllers/simple_edit.js.coffee

@@ -1,51 +1,27 @@
-angular.module('admin.orderCycles').controller "AdminSimpleEditOrderCycleCtrl", ($scope, $location, $window, OrderCycle, Enterprise, EnterpriseFee, Schedules, RequestMonitor, StatusMessage, ocInstance) ->
+angular.module('admin.orderCycles').controller "AdminSimpleEditOrderCycleCtrl", ($scope, $controller, $location, $window, OrderCycle, Enterprise, EnterpriseFee, ExchangeProduct, Schedules, RequestMonitor, StatusMessage, ocInstance) ->
+  $controller('AdminOrderCycleBasicCtrl', {$scope: $scope, ocInstance: ocInstance})
+
   $scope.orderCycleId = ->
     $location.absUrl().match(/\/admin\/order_cycles\/(\d+)/)[1]
 
-  $scope.StatusMessage = StatusMessage
   $scope.enterprises = Enterprise.index(order_cycle_id: $scope.orderCycleId())
   $scope.enterprise_fees = EnterpriseFee.index(order_cycle_id: $scope.orderCycleId())
-  $scope.schedules = Schedules.index({enterprise_id: ocInstance.coordinator_id})
-  $scope.OrderCycle = OrderCycle
   $scope.order_cycle = OrderCycle.load $scope.orderCycleId(), (order_cycle) =>
     $scope.init()
 
-  $scope.$watch 'order_cycle_form.$dirty', (newValue) ->
-      StatusMessage.display 'notice', t("admin.unsaved_changes") if newValue
-
-  $scope.$watch 'order_cycle_form.$valid', (isValid) ->
-    StatusMessage.setValidation(isValid)
-
-  $scope.loaded = ->
-    Enterprise.loaded && EnterpriseFee.loaded && OrderCycle.loaded && !RequestMonitor.loading
-
   $scope.init = ->
     $scope.outgoing_exchange = OrderCycle.order_cycle.outgoing_exchanges[0]
+    $scope.loadExchangeProducts()
 
-  $scope.enterpriseFeesForEnterprise = (enterprise_id) ->
-    EnterpriseFee.forEnterprise(parseInt(enterprise_id))
+  $scope.loadExchangeProducts = ->
+    exchange = OrderCycle.order_cycle.incoming_exchanges[0]
+    ExchangeProduct.index { exchange_id: exchange.id }, (products) ->
+      $scope.enterprises[exchange.enterprise_id].supplied_products = products
 
   $scope.removeDistributionOfVariant = angular.noop
 
-  $scope.setExchangeVariants = (exchange, variants, selected) ->
-    OrderCycle.setExchangeVariants(exchange, variants, selected)
-
-  $scope.suppliedVariants = (enterprise_id) ->
-    Enterprise.suppliedVariants(enterprise_id)
-
-  $scope.addCoordinatorFee = ($event) ->
-    $event.preventDefault()
-    OrderCycle.addCoordinatorFee()
-
-  $scope.removeCoordinatorFee = ($event, index) ->
-    $event.preventDefault()
-    OrderCycle.removeCoordinatorFee(index)
-
   $scope.submit = ($event, destination) ->
     $event.preventDefault()
     StatusMessage.display 'progress', t('js.saving')
     OrderCycle.mirrorIncomingToOutgoingProducts()
-    OrderCycle.update(destination, $scope.order_cycle_form)
-
-  $scope.cancel = (destination) ->
-    $window.location = destination
+    OrderCycle.update(destination, $scope.order_cycle_form) if OrderCycle.confirmNoDistributors()

app/assets/javascripts/admin/order_cycles/services/enterprise.js.coffee

@@ -12,7 +12,6 @@ angular.module('admin.orderCycles').factory('Enterprise', ($resource) ->
     enterprises: {}
     producer_enterprises: []
     hub_enterprises: []
-    supplied_products: []
     loaded: false
 
     index: (params={}, callback=null) ->
@@ -22,9 +21,6 @@ angular.module('admin.orderCycles').factory('Enterprise', ($resource) ->
           @producer_enterprises.push(enterprise) if enterprise.is_primary_producer
           @hub_enterprises.push(enterprise) if enterprise.sells == 'any'
 
-          for product in enterprise.supplied_products
-            @supplied_products.push(product)
-
         @loaded = true
         (callback || angular.noop)(@enterprises)
 
@@ -39,13 +35,4 @@ angular.module('admin.orderCycles').factory('Enterprise', ($resource) ->
         variant.id for variant in product.variants
       else
         [product.master_id]
-
-    totalVariants: (enterprise) ->
-      numVariants = 0
-
-      if enterprise
-        counts = for product in enterprise.supplied_products
-          numVariants += if product.variants.length == 0 then 1 else product.variants.length
-
-      numVariants
   })

app/assets/javascripts/admin/order_cycles/services/exchange_product.js.coffee

@@ -0,0 +1,16 @@
+angular.module('admin.orderCycles').factory('ExchangeProduct', ($resource) ->
+  ExchangeProductResource = $resource('/api/exchanges/:exchange_id/products.json', {}, {
+    'index': { method: 'GET' }
+    'variant_count': { method: 'GET', params: { action_name: "variant_count" }}
+  })
+  {
+    ExchangeProductResource: ExchangeProductResource
+
+    index: (params={}, callback=null) ->
+      ExchangeProductResource.index params, (data) =>
+        (callback || angular.noop)(data.products, data.pagination.pages, data.pagination.results)
+
+    countVariants: (params={}, callback=null) ->
+      ExchangeProductResource.variant_count params, (data) =>
+        (callback || angular.noop)(data.count)
+  })

app/assets/javascripts/admin/order_cycles/services/order_cycle.js.coffee

@@ -1,4 +1,4 @@
-angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, StatusMessage, Panels) ->
+angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, $timeout, StatusMessage, Panels) ->
   OrderCycleResource = $resource '/admin/order_cycles/:action_name/:order_cycle_id.json', {}, {
     'index':  { method: 'GET', isArray: true}
     'new'   : { method: 'GET', params: { action_name: "new" } }
@@ -44,11 +44,15 @@ angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, S
         @removeDistributionOfVariant(variant.id) if exchange.incoming
 
 
-    addSupplier: (new_supplier_id) ->
-    	this.order_cycle.incoming_exchanges.push({enterprise_id: new_supplier_id, incoming: true, active: true, variants: {}, enterprise_fees: []})
+    addSupplier: (new_supplier_id, callback) ->
+      this.order_cycle.incoming_exchanges.push({enterprise_id: new_supplier_id, incoming: true, active: true, variants: {}, enterprise_fees: []})
+      $timeout ->
+        (callback || angular.noop)()
 
-    addDistributor: (new_distributor_id) ->
-    	this.order_cycle.outgoing_exchanges.push({enterprise_id: new_distributor_id, incoming: false, active: true, variants: {}, enterprise_fees: []})
+    addDistributor: (new_distributor_id, callback) ->
+      this.order_cycle.outgoing_exchanges.push({ enterprise_id: new_distributor_id, incoming: false, active: true, variants: {}, enterprise_fees: [] })
+      $timeout ->
+        (callback || angular.noop)()
 
     removeExchange: (exchange) ->
       if exchange.incoming
@@ -71,18 +75,6 @@ angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, S
     removeExchangeFee: (exchange, index) ->
       exchange.enterprise_fees.splice(index, 1)
 
-    productSuppliedToOrderCycle: (product) ->
-      product_variant_ids = (variant.id for variant in product.variants)
-      variant_ids = [product.master_id].concat(product_variant_ids)
-      incomingExchangesVariants = this.incomingExchangesVariants()
-
-      # TODO: This is an O(n^2) implementation of set intersection and thus is slooow.
-      # Use a better algorithm if needed.
-      # Also, incomingExchangesVariants is called every time, when it only needs to be
-      # called once per change to incoming variants. Some sort of caching?
-      ids = (variant_id for variant_id in variant_ids when incomingExchangesVariants.indexOf(variant_id) != -1)
-      ids.length > 0
-
     variantSuppliedToOrderCycle: (variant) ->
       this.incomingExchangesVariants().indexOf(variant.id) != -1
 
@@ -143,15 +135,18 @@ angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, S
         delete(service.order_cycle.exchanges)
         service.loaded = true
 
-        (callback || angular.noop)(service.order_cycle)
+        $timeout ->
+          (callback || angular.noop)(service.order_cycle)
 
       this.order_cycle
 
     create: (destination) ->
-      return unless @confirmNoDistributors()
       oc = new OrderCycleResource({order_cycle: this.dataForSubmit()})
       oc.$create (data) ->
-        $window.location = destination
+        if destination? && destination.length != 0
+          $window.location = destination
+        else if data.edit_path?
+          $window.location = data.edit_path
       , (response) ->
         if response.data.errors?
           StatusMessage.display('failure', response.data.errors[0])
@@ -159,7 +154,6 @@ angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, S
           StatusMessage.display('failure', t('js.order_cycles.create_failure'))
 
     update: (destination, form) ->
-      return unless @confirmNoDistributors()
       oc = new OrderCycleResource({order_cycle: this.dataForSubmit()})
       oc.$update {order_cycle_id: this.order_cycle.id, reloading: (if destination? then 1 else 0)}, (data) =>
         form.$setPristine() if form
@@ -173,7 +167,6 @@ angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, S
         else
           StatusMessage.display('failure', t('js.order_cycles.update_failure'))
 
-
     confirmNoDistributors: ->
       if @order_cycle.outgoing_exchanges.length == 0
         confirm t('js.order_cycles.no_distributors')

app/assets/javascripts/admin/orders/controllers/orders_controller.js.coffee

@@ -1,4 +1,4 @@
-angular.module("admin.orders").controller "ordersCtrl", ($scope, RequestMonitor, Orders, SortOptions, $window, $filter) ->
+angular.module("admin.orders").controller "ordersCtrl", ($scope, $timeout, RequestMonitor, Orders, SortOptions, $window, $filter) ->
   $scope.RequestMonitor = RequestMonitor
   $scope.pagination = Orders.pagination
   $scope.orders = Orders.all
@@ -13,6 +13,7 @@ angular.module("admin.orders").controller "ordersCtrl", ($scope, RequestMonitor,
   $scope.selected = false
   $scope.select_all = false
   $scope.poll = 0
+  $scope.rowStatus = {}
 
   $scope.initialise = ->
     $scope.per_page = 15
@@ -69,6 +70,23 @@ angular.module("admin.orders").controller "ordersCtrl", ($scope, RequestMonitor,
       $scope.fetchResults()
   , true
 
+  $scope.capturePayment = (order) ->
+    $scope.rowAction('capture', order)
+
+  $scope.shipOrder = (order) ->
+    $scope.rowAction('ship', order)
+
+  $scope.rowAction = (action, order) ->
+    $scope.rowStatus[order.id] = "loading"
+
+    Orders[action](order).$promise.then (data) ->
+      $scope.rowStatus[order.id] = "success"
+      $timeout(->
+        $scope.rowStatus[order.id] = null
+      , 1500)
+    , (error) ->
+      $scope.rowStatus[order.id] = "error"
+
   $scope.changePage = (newPage) ->
     $scope.page = newPage
     $scope.fetchResults(newPage)

app/assets/javascripts/admin/resources/resources/order_resource.js.coffee

@@ -5,4 +5,14 @@ angular.module("admin.resources").factory 'OrderResource', ($resource) ->
       method: 'GET'
     'update':
       method: 'PUT'
+    'capture':
+      url: '/api/orders/:id/capture.json'
+      method: 'PUT'
+      params:
+        id: '@id'
+    'ship':
+      url: '/api/orders/:id/ship.json'
+      method: 'PUT'
+      params:
+        id: '@id'
   })

app/assets/javascripts/admin/resources/services/orders.js.coffee

@@ -44,5 +44,19 @@ angular.module("admin.resources").factory 'Orders', ($q, OrderResource, RequestM
         changed.push attr unless attr is "$$hashKey"
       changed
 
+    capture: (order) ->
+      @processAction('capture', order)
+
+    ship: (order) ->
+      @processAction('ship', order)
+
+    processAction: (action, order) ->
+      OrderResource[action] {id: order.number}, (data) =>
+        if data.id
+          angular.merge(order, data)
+          data
+      , (response) =>
+        response.data
+
     resetAttribute: (order, attribute) ->
       order[attribute] = @pristineByID[order.id][attribute]

app/assets/javascripts/admin/subscriptions/controllers/products_panel_controller.js.coffee

@@ -20,4 +20,4 @@ angular.module("admin.subscriptions").controller "ProductsPanelController", ($sc
         keys = Object.keys(response.data.errors)
         StatusMessage.display 'failure', response.data.errors[keys[0]][0]
       else
-        StatusMessage.display 'success', t('js.changes_saved')
+        StatusMessage.display 'failure', t('js.admin.subscriptions.error_saving')

app/assets/javascripts/templates/admin/panels/exchange_products_distributed.html.haml

@@ -1,5 +1,7 @@
-.row.exchange-distributed-products
-  .sixteen.columns.alpha.omega
+.row.exchange-distributed-products{'ng-init' => 'initializeExchangeProductsPanel(exchange)'}
+  .sixteen.columns.alpha.omega{ 'ng-show' => 'enterprises[exchange.enterprise_id].supplied_products.length != 0' }
+    %div{ 'ng-include' => "'admin/panels/exchange_products_panel_header.html'" }
+
     .exchange-select-all-variants
       %label
         %input{ type: 'checkbox', name: 'order_cycle_outgoing_exchange_{{ $parent.$index }}_select_all_variants',
@@ -7,11 +9,10 @@
           'ng-model' => 'exchange.select_all_variants',
           'ng-change' => 'setExchangeVariants(exchange, incomingExchangeVariantsFor(exchange.enterprise_id), exchange.select_all_variants)',
           'id' => 'order_cycle_outgoing_exchange_{{ $parent.$index }}_select_all_variants' }
-        {{ 'admin.select_all' | t }}
+        {{ 'js.admin.panels.exchange_products.select_all_products' | t:{ total_number_of_products: enterprises[exchange.enterprise_id].num_of_products } }}
 
-    .exchange-products
-      -# Scope product list based on permissions the current user has to view variants in this exchange
-      .exchange-product{'ng-repeat' => 'product in supplied_products | filter:productSuppliedToOrderCycle | visibleProducts:exchange:order_cycle.visible_variants_for_outgoing_exchanges | orderBy:"name"' }
+    .exchange-products{ 'ng-hide' => 'productsLoading()' }
+      .exchange-product{'ng-repeat' => 'product in enterprises[exchange.enterprise_id].supplied_products | filter:visibleProducts:exchange:order_cycle.visible_variants_for_outgoing_exchanges' }
         .exchange-product-details
           %label
             %img{'ng-src' => '{{ product.image_url }}'}
@@ -26,3 +27,5 @@
               'id' => 'order_cycle_outgoing_exchange_{{ $parent.$parent.$index }}_variants_{{ variant.id }}',
               'ng-disabled' => '!order_cycle.editable_variants_for_outgoing_exchanges.hasOwnProperty(exchange.enterprise_id) || order_cycle.editable_variants_for_outgoing_exchanges[exchange.enterprise_id].indexOf(variant.id) < 0' }
             {{ variant.label }}
+
+    %div{ 'ng-include' => "'admin/panels/exchange_products_panel_footer.html'" }

app/assets/javascripts/templates/admin/panels/exchange_products_panel_footer.html.haml

@@ -0,0 +1,11 @@
+.pagination{ 'ng-show' => 'enterprises[exchange.enterprise_id].last_page_loaded < enterprises[exchange.enterprise_id].num_of_pages && !productsLoading()'}
+  .button{ 'ng-click' => 'loadMoreExchangeProducts(exchange)' }
+    {{ 'js.admin.panels.exchange_products.load_more_products' | t }}
+  .button{ 'ng-click' => 'loadAllExchangeProducts(exchange)' }
+    {{ 'js.admin.panels.exchange_products.load_all_products' | t }}
+
+.sixteen.columns.alpha#loading{ 'ng-show' => 'productsLoading()' }
+  %br
+  %img.spinner{ src: "/assets/spinning-circles.svg" }
+  %h1
+    {{ 'js.admin.panels.exchange_products.loading_products' | t }}

app/assets/javascripts/templates/admin/panels/exchange_products_panel_header.html.haml

@@ -0,0 +1,5 @@
+.exchange-load-all-variants
+  %div
+    {{ 'js.admin.panels.exchange_products.products_loaded' | t:{ num_of_products_loaded: enterprises[exchange.enterprise_id].supplied_products.length, total_number_of_products: enterprises[exchange.enterprise_id].num_of_products } }}
+    %a{ 'ng-click' => 'loadAllExchangeProducts(exchange)', 'ng-show' => 'enterprises[exchange.enterprise_id].last_page_loaded < enterprises[exchange.enterprise_id].num_of_pages' }
+      {{ 'js.admin.panels.exchange_products.load_all_products' | t }}

app/assets/javascripts/templates/admin/panels/exchange_products_simple.html.haml

@@ -0,0 +1,12 @@
+.row.exchange-supplied-products
+  .sixteen.columns.alpha.omega
+    .exchange-select-all-variants
+      %label
+        %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants',
+          value: 1,
+          'ng-model' => 'exchange.select_all_variants',
+          'ng-change' => 'setExchangeVariants(exchange, suppliedVariants(exchange.enterprise_id), exchange.select_all_variants)',
+          'id' => 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants' }
+        {{ 'admin.select_all' | t }}
+
+    %div{ 'ng-include' => "'admin/panels/exchange_products_supplied_list.html'" }

app/assets/javascripts/templates/admin/panels/exchange_products_supplied.html.haml

@@ -0,0 +1,16 @@
+.row.exchange-supplied-products{'ng-init' => 'initializeExchangeProductsPanel(exchange)'}
+  .sixteen.columns.alpha.omega{ 'ng-show' => 'enterprises[exchange.enterprise_id].supplied_products.length != 0' }
+    %div{ 'ng-include' => "'admin/panels/exchange_products_panel_header.html'" }
+
+    .exchange-select-all-variants
+      %label
+        %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants',
+          value: 1,
+          'ng-model' => 'exchange.select_all_variants',
+          'ng-change' => 'selectAllVariants(exchange, exchange.select_all_variants)',
+          'id' => 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants' }
+        {{ 'js.admin.panels.exchange_products.select_all_products' | t:{ total_number_of_products: enterprises[exchange.enterprise_id].num_of_products } }}
+
+    %div{ 'ng-include' => "'admin/panels/exchange_products_supplied_list.html'" }
+
+    %div{ 'ng-include' => "'admin/panels/exchange_products_panel_footer.html'" }

app/assets/javascripts/templates/admin/panels/exchange_products_supplied_list.html.haml

@@ -0,0 +1,16 @@
+.exchange-products{ 'ng-hide' => 'productsLoading()' }
+  .exchange-product{'ng-repeat' => 'product in enterprises[exchange.enterprise_id].supplied_products'}
+    .exchange-product-details
+      %label
+        %img{'ng-src' => '{{ product.image_url }}'}
+        {{ product.name }}
+
+    .exchange-product-variant{'ng-repeat' => 'variant in product.variants'}
+      %label
+        %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $parent.$parent.$index }}_variants_{{ variant.id }}',
+          value: 1,
+          'ng-model' => 'exchange.variants[variant.id]',
+          'ofn-sync-distributions' => '{{ variant.id }}',
+          'id' => 'order_cycle_incoming_exchange_{{ $parent.$parent.$index }}_variants_{{ variant.id }}',
+          'ng-disabled' => '!order_cycle.editable_variants_for_incoming_exchanges.hasOwnProperty(exchange.enterprise_id) || order_cycle.editable_variants_for_incoming_exchanges[exchange.enterprise_id].indexOf(variant.id) < 0' }
+        {{ variant.label }}

app/assets/javascripts/templates/admin/panels/exchange_supplied_products.html.haml

@@ -1,49 +0,0 @@
-.row.exchange-supplied-products
-  .sixteen.columns.alpha.omega
-    .exchange-select-all-variants
-      %label
-        %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants',
-          value: 1,
-          'ng-model' => 'exchange.select_all_variants',
-          'ng-change' => 'setExchangeVariants(exchange, suppliedVariants(exchange.enterprise_id), exchange.select_all_variants)',
-          'id' => 'order_cycle_incoming_exchange_{{ $index }}_select_all_variants' }
-        {{ 'admin.select_all' | t }}
-
-    .exchange-products
-      -# No need to scope product list based on permissions, because if an incoming exchange is visible,
-      -# then all of the variants within it should be visible. May change in the future?
-      .exchange-product{'ng-repeat' => 'product in enterprises[exchange.enterprise_id].supplied_products'}
-
-        .exchange-product-details
-          %label
-            %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $parent.$index }}_variants_{{ product.master_id }}',
-              value: 1,
-              'ng-hide' => 'product.variants.length > 0',
-              'ng-model' => 'exchange.variants[product.master_id]',
-              'ofn-sync-distributions' => '{{ product.master_id }}',
-              'id' => 'order_cycle_incoming_exchange_{{ $parent.$index }}_variants_{{ product.master_id }}',
-              'ng-disabled' => 'product.variants.length > 0 || !order_cycle.editable_variants_for_incoming_exchanges.hasOwnProperty(exchange.enterprise_id) || order_cycle.editable_variants_for_incoming_exchanges[exchange.enterprise_id].indexOf(product.master_id) < 0' }
-            %img{'ng-src' => '{{ product.image_url }}'}
-            {{ product.name }}
-
-        -# When the master variant is in the order cycle but the product has variants, we want to
-        -# be able to remove the master variant, since it serves no purpose. Display a checkbox to do so.
-        .exchange-product-variant{'ng-show' => 'exchange.variants[product.master_id] && product.variants.length > 0'}
-          %label
-            %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $parent.$index }}_variants_{{ product.master_id }}',
-              value: 1,
-              'ng-model' => 'exchange.variants[product.master_id]',
-              'ofn-sync-distributions' => '{{ product.master_id }}',
-              'id' => 'order_cycle_incoming_exchange_{{ $parent.$index }}_variants_{{ product.master_id }}',
-              'ng-disabled' => '!order_cycle.editable_variants_for_incoming_exchanges.hasOwnProperty(exchange.enterprise_id) || order_cycle.editable_variants_for_incoming_exchanges[exchange.enterprise_id].indexOf(product.master_id) < 0' }
-            {{ 'admin.obsolete_master' | t }}
-
-        .exchange-product-variant{'ng-repeat' => 'variant in product.variants'}
-          %label
-            %input{ type: 'checkbox', name: 'order_cycle_incoming_exchange_{{ $parent.$parent.$index }}_variants_{{ variant.id }}',
-              value: 1,
-              'ng-model' => 'exchange.variants[variant.id]',
-              'ofn-sync-distributions' => '{{ variant.id }}',
-              'id' => 'order_cycle_incoming_exchange_{{ $parent.$parent.$index }}_variants_{{ variant.id }}',
-              'ng-disabled' => '!order_cycle.editable_variants_for_incoming_exchanges.hasOwnProperty(exchange.enterprise_id) || order_cycle.editable_variants_for_incoming_exchanges[exchange.enterprise_id].indexOf(variant.id) < 0' }
-            {{ variant.label }}

app/assets/javascripts/templates/admin/save_bar.html.haml

@@ -1,9 +1,9 @@
 #save-bar.animate-show{ ng: { show: 'dirty || persist || StatusMessage.active()' } }
   .container
-    .eight.columns.alpha
+    .seven.columns.alpha
       %h5#status-message{ ng: { show: "StatusMessage.invalidMessage == ''", style: 'StatusMessage.statusMessage.style' } }
         {{ StatusMessage.statusMessage.text || " " }}
       %h5#status-message{ ng: { show: "StatusMessage.invalidMessage !== ''" }, style: 'color: #da5354' }
         {{ StatusMessage.invalidMessage || " " }}
-    .eight.columns.omega.text-right{ ng: { transclude: true } }
+    .nine.columns.omega.text-right{ ng: { transclude: true } }
 

app/assets/stylesheets/admin/components/table_loading.css.scss

@@ -0,0 +1,32 @@
+@import '../variables';
+
+.row-loading {
+  opacity: .5;
+}
+
+.row-loading-icons {
+  margin-left: 3em;
+  position: absolute;
+
+  .spinner {
+    border: 0;
+    width: 2.3em;
+  }
+
+  i {
+    font-size: 2.3em;
+    opacity: .75;
+
+    &::before {
+      vertical-align: top;
+    }
+
+    &.success {
+      color: $spree-green;
+    }
+
+    &.error {
+      color: $warning-red;
+    }
+  }
+}

app/assets/stylesheets/admin/components/tooltip.css.scss

@@ -0,0 +1,4 @@
+#powerTip {
+  max-width: 240px;
+  white-space: normal;
+}

app/assets/stylesheets/admin/components/wizard_progress.css.scss

@@ -19,6 +19,9 @@ ul.wizard-progress {
 		line-height: 30px;
 		padding: 0 25px 0 40px;
 		position: relative;
+		a {
+		  color: #494949;
+		}
 		&:first-child {
 			padding-left: 25px;
 			border-top-left-radius: 3px;
@@ -62,6 +65,9 @@ ul.wizard-progress {
 		&.current {
 			background-color: $color_selected;
 			color: #fff;
+			a {
+			  color: #fff;
+			}
 			&:after {
 				background-color: $color_selected;
 			}

app/assets/stylesheets/admin/openfoodnetwork.css.scss

@@ -104,9 +104,13 @@ form.order_cycle {
       width: 20px;
     }
 
+    .exchange-load-all-variants {
+      margin: 0px 5px 20px 5px;
+    }
+
     .exchange-select-all-variants {
       clear: both;
-      margin: 5px;
+      margin: 15px 5px 25px 5px;
     }
 
     .exchange-products {
@@ -209,6 +213,7 @@ table#listing_enterprise_groups {
 #loading {
   text-align: center;
   img.spinner {
+    border: 0px;
     width: 100px;
     height: 100px;
   }

app/controllers/admin/bulk_line_items_controller.rb

@@ -4,9 +4,18 @@ module Admin
     #
     def index
       order_params = params[:q].andand.delete :order
-      orders = OpenFoodNetwork::Permissions.new(spree_current_user).editable_orders.ransack(order_params).result
-      line_items = OpenFoodNetwork::Permissions.new(spree_current_user).editable_line_items.where(order_id: orders).ransack(params[:q])
-      render_as_json line_items.result.reorder('order_id ASC, id ASC')
+
+      order_permissions = ::Permissions::Order.new(spree_current_user)
+      orders = order_permissions.
+        editable_orders.ransack(order_params).result
+
+      line_items = order_permissions.
+        editable_line_items.where(order_id: orders).
+        includes(variant: { option_values: :option_type }).
+        ransack(params[:q]).result.
+        reorder('spree_line_items.order_id ASC, spree_line_items.id ASC')
+
+      render_as_json line_items
     end
 
     # PUT /admin/bulk_line_items/:id.json

app/controllers/admin/customers_controller.rb

@@ -63,6 +63,7 @@ module Admin
 
     def collection
       return Customer.where("1=0") unless json_request? && params[:enterprise_id].present?
+
       enterprise = Enterprise.managed_by(spree_current_user).find_by_id(params[:enterprise_id])
       Customer.of(enterprise)
     end

app/controllers/admin/enterprise_fees_controller.rb

@@ -28,15 +28,12 @@ module Admin
 
     def bulk_update
       @enterprise_fee_set = EnterpriseFeeSet.new(params[:enterprise_fee_set])
-      if @enterprise_fee_set.save
-        redirect_path = main_app.admin_enterprise_fees_path
-        if params.key? :enterprise_id
-          redirect_path = main_app.admin_enterprise_fees_path(enterprise_id: params[:enterprise_id])
-        end
-        redirect_to redirect_path, notice: I18n.t(:enterprise_fees_update_notice)
 
+      if @enterprise_fee_set.save
+        redirect_to redirect_path, notice: I18n.t(:enterprise_fees_update_notice)
       else
-        render :index
+        redirect_to redirect_path,
+                    flash: { error: @enterprise_fee_set.errors.full_messages.to_sentence }
       end
     end
 
@@ -73,5 +70,13 @@ module Admin
     def current_enterprise
       Enterprise.find params[:enterprise_id] if params.key? :enterprise_id
     end
+
+    def redirect_path
+      if params.key? :enterprise_id
+        return main_app.admin_enterprise_fees_path(enterprise_id: params[:enterprise_id])
+      end
+
+      main_app.admin_enterprise_fees_path
+    end
   end
 end

app/controllers/admin/enterprises_controller.rb

@@ -66,7 +66,7 @@ module Admin
 
       if @enterprise.update_attributes(attributes)
         flash[:success] = I18n.t(:enterprise_register_success_notice, enterprise: @enterprise.name)
-        redirect_to admin_path
+        redirect_to admin_dashboard_path
       else
         flash[:error] = I18n.t(:enterprise_register_error, enterprise: @enterprise.name)
         render :welcome, layout: "spree/layouts/bare_admin"
@@ -148,7 +148,8 @@ module Admin
 
         unless enterprises.empty?
           enterprises.includes(
-            supplied_products: [:supplier, :variants, master: [:images]]
+            supplied_products:
+              [:supplier, master: [:images], variants: { option_values: :option_type }]
           )
         end
       when :index

app/controllers/admin/order_cycles_controller.rb

@@ -2,6 +2,7 @@ module Admin
   class OrderCyclesController < ResourceController
     include OrderCyclesHelper
 
+    prepend_before_filter :set_order_cycle_id, only: [:incoming, :outgoing]
     before_filter :load_data_for_index, only: :index
     before_filter :require_coordinator, only: :new
     before_filter :remove_protected_attrs, only: [:update]
@@ -12,7 +13,10 @@ module Admin
       respond_to do |format|
         format.html
         format.json do
-          render_as_json @collection, ams_prefix: params[:ams_prefix], current_user: spree_current_user, subscriptions_count: SubscriptionsCount.new(@collection)
+          render_as_json @collection,
+                         ams_prefix: params[:ams_prefix],
+                         current_user: spree_current_user,
+                         subscriptions_count: SubscriptionsCount.new(@collection)
         end
       end
     end
@@ -40,12 +44,17 @@ module Admin
 
       if @order_cycle_form.save
         flash[:notice] = I18n.t(:order_cycles_create_notice)
-        render json: { success: true }
+        render json: { success: true,
+                       edit_path: main_app.admin_order_cycle_incoming_path(@order_cycle) }
       else
         render json: { errors: @order_cycle.errors.full_messages }, status: :unprocessable_entity
       end
     end
 
+    def set_order_cycle_id
+      params[:id] = params[:order_cycle_id]
+    end
+
     def update
       @order_cycle_form = OrderCycleForm.new(@order_cycle, params, spree_current_user)
 
@@ -62,7 +71,10 @@ module Admin
 
     def bulk_update
       if order_cycle_set.andand.save
-        render_as_json @order_cycles, ams_prefix: 'index', current_user: spree_current_user, subscriptions_count: SubscriptionsCount.new(@collection)
+        render_as_json @order_cycles,
+                       ams_prefix: 'index',
+                       current_user: spree_current_user,
+                       subscriptions_count: SubscriptionsCount.new(@collection)
       else
         order_cycle = order_cycle_set.collection.find{ |oc| oc.errors.present? }
         render json: { errors: order_cycle.errors.full_messages }, status: :unprocessable_entity
@@ -72,14 +84,16 @@ module Admin
     def clone
       @order_cycle = OrderCycle.find params[:id]
       @order_cycle.clone!
-      redirect_to main_app.admin_order_cycles_path, notice: I18n.t(:order_cycles_clone_notice, name: @order_cycle.name)
+      redirect_to main_app.admin_order_cycles_path,
+                  notice: I18n.t(:order_cycles_clone_notice, name: @order_cycle.name)
     end
 
     # Send notifications to all producers who are part of the order cycle
     def notify_producers
       Delayed::Job.enqueue OrderCycleNotificationJob.new(params[:id].to_i)
 
-      redirect_to main_app.admin_order_cycles_path, notice: I18n.t(:order_cycles_email_to_producers_notice)
+      redirect_to main_app.admin_order_cycles_path,
+                  notice: I18n.t(:order_cycles_email_to_producers_notice)
     end
 
     protected
@@ -87,20 +101,9 @@ module Admin
     def collection
       return Enterprise.where("1=0") unless json_request?
       return order_cycles_from_set if params[:order_cycle_set]
-      ocs = if params[:as] == "distributor"
-              OrderCycle.preload(:schedules).ransack(params[:q]).result.
-                involving_managed_distributors_of(spree_current_user).order('updated_at DESC')
-            elsif params[:as] == "producer"
-              OrderCycle.preload(:schedules).ransack(params[:q]).result.
-                involving_managed_producers_of(spree_current_user).order('updated_at DESC')
-            else
-              OrderCycle.preload(:schedules).ransack(params[:q]).result.accessible_by(spree_current_user)
-      end
 
-      ocs.undated |
-        ocs.soonest_closing |
-        ocs.soonest_opening |
-        ocs.closed
+      ocs = order_cycles
+      ocs.undated | ocs.soonest_closing | ocs.soonest_opening | ocs.closed
     end
 
     def collection_actions
@@ -109,21 +112,60 @@ module Admin
 
     private
 
+    def order_cycles
+      if params[:as] == "distributor"
+        order_cycles_as_distributor
+      elsif params[:as] == "producer"
+        order_cycles_as_producer
+      else
+        order_cycles_as_both
+      end
+    end
+
+    def order_cycles_as_distributor
+      OrderCycle.
+        preload(:schedules).
+        ransack(params[:q]).
+        result.
+        involving_managed_distributors_of(spree_current_user).
+        order('updated_at DESC')
+    end
+
+    def order_cycles_as_producer
+      OrderCycle.
+        preload(:schedules).
+        ransack(params[:q]).
+        result.
+        involving_managed_producers_of(spree_current_user).
+        order('updated_at DESC')
+    end
+
+    def order_cycles_as_both
+      OrderCycle.
+        preload(:schedules).
+        ransack(params[:q]).
+        result.
+        accessible_by(spree_current_user)
+    end
+
     def load_data_for_index
       if json_request?
-        # Split ransack params into all those that currently exist and new ones to limit returned ocs to recent or undated
+        # Split ransack params into all those that currently exist and new ones
+        #   to limit returned ocs to recent or undated
         orders_close_at_gt = params[:q].andand.delete(:orders_close_at_gt) || 31.days.ago
         params[:q] = {
-          g: [params.delete(:q) || {}, { m: 'or', orders_close_at_gt: orders_close_at_gt, orders_close_at_null: true }]
+          g: [params.delete(:q) || {}, { m: 'or',
+                                         orders_close_at_gt: orders_close_at_gt,
+                                         orders_close_at_null: true }]
         }
         @collection = collection
       end
     end
 
     def require_coordinator
-      if params[:coordinator_id] && @order_cycle.coordinator = permitted_coordinating_enterprises_for(@order_cycle).find_by_id(params[:coordinator_id])
-        return
-      end
+      @order_cycle.coordinator =
+        permitted_coordinating_enterprises_for(@order_cycle).find_by_id(params[:coordinator_id])
+      return if params[:coordinator_id] && @order_cycle.coordinator
 
       available_coordinators = permitted_coordinating_enterprises_for(@order_cycle)
       case available_coordinators.count
@@ -133,7 +175,9 @@ module Admin
       when 1
         @order_cycle.coordinator = available_coordinators.first
       else
-        flash[:error] = I18n.t(:order_cycles_no_permission_to_create_error) if params[:coordinator_id]
+        if params[:coordinator_id]
+          flash[:error] = I18n.t(:order_cycles_no_permission_to_create_error)
+        end
         render :set_coordinator
       end
     end
@@ -157,7 +201,9 @@ module Admin
       params[:order_cycle].delete :coordinator_id
 
       unless Enterprise.managed_by(spree_current_user).include?(@order_cycle.coordinator)
-        params[:order_cycle].delete_if{ |k, _v| [:name, :orders_open_at, :orders_close_at].include? k.to_sym }
+        params[:order_cycle].delete_if do |k, _v|
+          [:name, :orders_open_at, :orders_close_at].include? k.to_sym
+        end
       end
     end
 
@@ -181,7 +227,9 @@ module Admin
 
     def require_order_cycle_set_params
       return if params[:order_cycle_set]
-      render json: { errors: t('admin.order_cycles.bulk_update.no_data') }, status: :unprocessable_entity
+
+      render json: { errors: t('admin.order_cycles.bulk_update.no_data') },
+             status: :unprocessable_entity
     end
 
     def ams_prefix_whitelist

app/controllers/admin/product_import_controller.rb

@@ -23,11 +23,13 @@ module Admin
 
     def validate_data
       return unless process_data('validate')
+
       render json: @importer.import_results, response: 200
     end
 
     def save_data
       return unless process_data('save')
+
       render json: @importer.save_results, response: 200
     end
 

app/controllers/admin/schedules_controller.rb

@@ -31,6 +31,7 @@ module Admin
 
     def collection
       return Schedule.where("1=0") unless json_request?
+
       if params[:enterprise_id]
         filter_schedules_by_enterprise_id(permissions.visible_schedules, params[:enterprise_id])
       else
@@ -49,6 +50,7 @@ module Admin
 
     def check_editable_order_cycle_ids
       return unless params[:schedule][:order_cycle_ids]
+
       requested = params[:schedule][:order_cycle_ids]
       @existing_order_cycle_ids = @schedule.persisted? ? @schedule.order_cycle_ids : []
       permitted = OrderCycle.where(id: params[:schedule][:order_cycle_ids] | @existing_order_cycle_ids).merge(OrderCycle.managed_by(spree_current_user)).pluck(:id)
@@ -61,19 +63,23 @@ module Admin
 
     def check_dependent_subscriptions
       return if Subscription.where(schedule_id: @schedule).empty?
+
       render json: { errors: [t('admin.schedules.destroy.associated_subscriptions_error')] }, status: :conflict
     end
 
     def permissions
       return @permissions unless @permission.nil?
+
       @permissions = OpenFoodNetwork::Permissions.new(spree_current_user)
     end
 
     def sync_subscriptions
       return unless params[:schedule][:order_cycle_ids]
+
       removed_ids = @existing_order_cycle_ids - @schedule.order_cycle_ids
       new_ids = @schedule.order_cycle_ids - @existing_order_cycle_ids
       return unless removed_ids.any? || new_ids.any?
+
       subscriptions = Subscription.where(schedule_id: @schedule)
       syncer = OpenFoodNetwork::ProxyOrderSyncer.new(subscriptions)
       syncer.sync!

app/controllers/admin/stripe_accounts_controller.rb

@@ -22,13 +22,15 @@ module Admin
       redirect_to main_app.edit_admin_enterprise_path(stripe_account.enterprise)
     rescue ActiveRecord::RecordNotFound
       flash[:error] = "Failed to disconnect Stripe."
-      redirect_to spree.admin_path
+      redirect_to spree.admin_dashboard_path
     end
 
     def status
       return render json: { status: :stripe_disabled } unless Spree::Config.stripe_connect_enabled
+
       stripe_account = StripeAccount.find_by_enterprise_id(params[:enterprise_id])
       return render json: { status: :account_missing } unless stripe_account
+
       authorize! :status, stripe_account
 
       begin

app/controllers/admin/stripe_connect_settings_controller.rb

@@ -8,6 +8,7 @@ module Admin
 
     def edit
       return @stripe_account = { status: :empty_api_key_error_html } if Stripe.api_key.blank?
+
       attrs = %i[id business_name charges_enabled]
       @obfuscated_secret_key = obfuscated_secret_key
       @stripe_account = Stripe::Account.retrieve.to_hash.slice(*attrs).merge(status: :ok)

app/controllers/admin/subscription_line_items_controller.rb

@@ -36,17 +36,20 @@ module Admin
 
     def ensure_shop
       return if @shop
+
       render json: { errors: ['Unauthorised'] }, status: :unauthorized
     end
 
     def ensure_variant
       return if @variant
+
       error = "#{@shop.name} is not permitted to sell the selected product"
       render json: { errors: [error] }, status: :unprocessable_entity
     end
 
     def price_estimate
       return unless @order_cycle
+
       fee_calculator = OpenFoodNetwork::EnterpriseFeeCalculator.new(@shop, @order_cycle)
       OpenFoodNetwork::ScopeVariantToHub.new(@shop).scope(@variant)
       @variant.price + fee_calculator.indexed_fees_for(@variant)

app/controllers/admin/subscriptions_controller.rb

@@ -80,6 +80,7 @@ module Admin
 
     def permissions
       return @permissions unless @permissions.nil?
+
       @permissions = OpenFoodNetwork::Permissions.new(spree_current_user)
     end
 
@@ -126,14 +127,17 @@ module Admin
 
     def check_for_open_orders
       return if params[:open_orders] == 'cancel'
+
       @open_orders_to_keep = @subscription.proxy_orders.placed_and_open.pluck(:id)
       return if @open_orders_to_keep.empty? || params[:open_orders] == 'keep'
+
       render json: { errors: { open_orders: t('admin.subscriptions.confirm_cancel_open_orders_msg') } }, status: :conflict
     end
 
     def check_for_canceled_orders
       return if params[:canceled_orders] == 'notified'
       return if @subscription.proxy_orders.active.canceled.empty?
+
       render json: { errors: { canceled_orders: t('admin.subscriptions.resume_canceled_orders_msg') } }, status: :conflict
     end
 

app/controllers/api/base_controller.rb

@@ -48,6 +48,7 @@ module Api
     # Use logged in user (spree_current_user) for API authentication (current_api_user)
     def authenticate_user
       return if @current_api_user = try_spree_current_user
+
       if api_key.blank?
         # An anonymous user
         @current_api_user = Spree.user_class.new

app/controllers/api/enterprise_attachment_controller.rb

@@ -27,6 +27,7 @@ module Api
     def load_enterprise
       @enterprise = Enterprise.find_by_permalink(params[:enterprise_id].to_s)
       raise UnknownEnterpriseAuthorizationActionError if enterprise_authorize_action.blank?
+
       authorize!(enterprise_authorize_action, @enterprise)
     end
 

app/controllers/api/exchange_products_controller.rb

@@ -0,0 +1,92 @@
+# This controller lists products that can be added to an exchange
+module Api
+  class ExchangeProductsController < Api::BaseController
+    DEFAULT_PAGE = 1
+    DEFAULT_PER_PAGE = 100
+
+    skip_authorization_check only: [:index]
+
+    # If exchange_id is present in the URL:
+    #   Lists Products that can be added to that Exchange
+    #
+    # If exchange_id is not present in the URL:
+    #   Lists Products of the Enterprise given that can be added to the given Order Cycle
+    #   In this case parameters are: enterprise_id, order_cycle_id and incoming
+    #     (order_cycle_id is not necessary for incoming exchanges)
+    def index
+      if params[:exchange_id].present?
+        load_data_from_exchange
+      else
+        load_data_from_other_params
+      end
+
+      render_variant_count && return if params[:action_name] == "variant_count"
+
+      render_paginated_products paginated_products
+    end
+
+    private
+
+    def render_variant_count
+      render text: {
+        count: Spree::Variant.
+          not_master.
+          where(product_id: products).
+          count
+      }.to_json
+    end
+
+    def products
+      ExchangeProductsRenderer.
+        new(@order_cycle, spree_current_user).
+        exchange_products(@incoming, @enterprise)
+    end
+
+    def paginated_products
+      products.
+        page(params[:page] || DEFAULT_PAGE).
+        per(params[:per_page] || DEFAULT_PER_PAGE)
+    end
+
+    def load_data_from_exchange
+      exchange = Exchange.find_by_id(params[:exchange_id])
+
+      @order_cycle = exchange.order_cycle
+      @incoming = exchange.incoming
+      @enterprise = exchange.sender
+    end
+
+    def load_data_from_other_params
+      @enterprise = Enterprise.find_by_id(params[:enterprise_id])
+
+      if params[:order_cycle_id]
+        @order_cycle = OrderCycle.find_by_id(params[:order_cycle_id])
+      elsif !params[:incoming]
+        raise "order_cycle_id is required to list products for new outgoing exchange"
+      end
+      @incoming = params[:incoming]
+    end
+
+    def render_paginated_products(paginated_products)
+      serializer = ActiveModel::ArraySerializer.new(
+        paginated_products,
+        each_serializer: Api::Admin::ForOrderCycle::SuppliedProductSerializer,
+        order_cycle: @order_cycle
+      )
+
+      render text: {
+        products: serializer,
+        pagination: pagination_data(paginated_products)
+      }.to_json
+    end
+
+    def pagination_data(paginated_products)
+      {
+        results: paginated_products.total_count,
+        pages: paginated_products.num_pages,
+        page: (params[:page] || DEFAULT_PAGE).to_i,
+        per_page: (params[:per_page] || DEFAULT_PER_PAGE).to_i
+      }
+    end
+  end
+end

app/controllers/api/orders_controller.rb

@@ -16,8 +16,38 @@ module Api
       }
     end
 
+    def ship
+      authorize! :admin, order
+
+      if order.ship
+        render json: order.reload, serializer: Api::Admin::OrderSerializer, status: :ok
+      else
+        render json: { error: I18n.t('api.orders.failed_to_update') }, status: :unprocessable_entity
+      end
+    end
+
+    def capture
+      authorize! :admin, order
+
+      pending_payment = order.pending_payments.first
+
+      return payment_capture_failed unless order.payment_required? && pending_payment
+
+      if pending_payment.capture!
+        render json: order.reload, serializer: Api::Admin::OrderSerializer, status: :ok
+      else
+        payment_capture_failed
+      end
+    rescue Spree::Core::GatewayError => e
+      error_during_processing(e)
+    end
+
     private
 
+    def payment_capture_failed
+      render json: { error: t(:payment_processing_failed) }, status: :unprocessable_entity
+    end
+
     def serialized_orders(orders)
       ActiveModel::ArraySerializer.new(
         orders,

app/controllers/api/products_controller.rb

@@ -19,7 +19,7 @@ module Api
       @product = Spree::Product.new(params[:product])
       begin
         if @product.save
-          render json: @product, serializer: Api::Admin::ProductSerializer, status: 201
+          render json: @product, serializer: Api::Admin::ProductSerializer, status: :created
         else
           invalid_resource!(@product)
         end
@@ -33,7 +33,7 @@ module Api
       authorize! :update, Spree::Product
       @product = find_product(params[:id])
       if @product.update_attributes(params[:product])
-        render json: @product, serializer: Api::Admin::ProductSerializer, status: 200
+        render json: @product, serializer: Api::Admin::ProductSerializer, status: :ok
       else
         invalid_resource!(@product)
       end
@@ -42,9 +42,9 @@ module Api
     def destroy
       authorize! :delete, Spree::Product
       @product = find_product(params[:id])
-      @product.update_attribute(:deleted_at, Time.zone.now)
-      @product.variants_including_master.update_all(deleted_at: Time.zone.now)
-      render json: @product, serializer: Api::Admin::ProductSerializer, status: 204
+      authorize! :delete, @product
+      @product.destroy
+      render json: @product, serializer: Api::Admin::ProductSerializer, status: :no_content
     end
 
     def bulk_products
@@ -71,14 +71,6 @@ module Api
       render_paged_products @products
     end
 
-    def soft_delete
-      authorize! :delete, Spree::Product
-      @product = find_product(params[:product_id])
-      authorize! :delete, @product
-      @product.destroy
-      render json: @product, serializer: Api::Admin::ProductSerializer, status: 204
-    end
-
     # POST /api/products/:product_id/clone
     #
     def clone
@@ -88,7 +80,7 @@ module Api
 
       @product = original_product.duplicate
 
-      render json: @product, serializer: Api::Admin::ProductSerializer, status: 201
+      render json: @product, serializer: Api::Admin::ProductSerializer, status: :created
     end
 
     private
@@ -109,7 +101,15 @@ module Api
         scope = Spree::Product.active
       end
 
-      scope.includes(:master)
+      scope.includes(product_query_includes)
+    end
+
+    def product_query_includes
+      [
+        master: [:images],
+        variants: [:default_price, :stock_locations, :stock_items, :variant_overrides,
+                   { option_values: :option_type }]
+      ]
     end
 
     def paged_products_for_producers(producers)

app/controllers/api/statuses_controller.rb

@@ -10,7 +10,7 @@ module Api
 
     def job_queue_alive?
       Spree::Config.last_job_queue_heartbeat_at.present? &&
-        Time.parse(Spree::Config.last_job_queue_heartbeat_at) > 6.minutes.ago
+        Time.parse(Spree::Config.last_job_queue_heartbeat_at).in_time_zone > 6.minutes.ago
     end
   end
 end

app/controllers/api/taxons_controller.rb

@@ -61,6 +61,7 @@ module Api
 
     def taxonomy
       return if params[:taxonomy_id].blank?
+
       @taxonomy ||= Spree::Taxonomy.find(params[:taxonomy_id])
     end
 

app/controllers/api/variants_controller.rb

@@ -6,12 +6,12 @@ module Api
     before_filter :product
 
     def index
-      @variants = scope.includes(:option_values).ransack(params[:q]).result
+      @variants = scope.includes(option_values: :option_type).ransack(params[:q]).result
       render json: @variants, each_serializer: Api::VariantSerializer
     end
 
     def show
-      @variant = scope.includes(:option_values).find(params[:id])
+      @variant = scope.includes(option_values: :option_type).find(params[:id])
       render json: @variant, serializer: Api::VariantSerializer
     end
 
@@ -19,7 +19,7 @@ module Api
       authorize! :create, Spree::Variant
       @variant = scope.new(params[:variant])
       if @variant.save
-        render json: @variant, serializer: Api::VariantSerializer, status: 201
+        render json: @variant, serializer: Api::VariantSerializer, status: :created
       else
         invalid_resource!(@variant)
       end
@@ -29,25 +29,19 @@ module Api
       authorize! :update, Spree::Variant
       @variant = scope.find(params[:id])
       if @variant.update_attributes(params[:variant])
-        render json: @variant, serializer: Api::VariantSerializer, status: 200
+        render json: @variant, serializer: Api::VariantSerializer, status: :ok
       else
         invalid_resource!(@product)
       end
     end
 
-    def soft_delete
-      @variant = scope.find(params[:variant_id])
-      authorize! :delete, @variant
-
-      VariantDeleter.new.delete(@variant)
-      render json: @variant, serializer: Api::VariantSerializer, status: 204
-    end
-
     def destroy
       authorize! :delete, Spree::Variant
       @variant = scope.find(params[:id])
-      @variant.destroy
-      render json: @variant, serializer: Api::VariantSerializer, status: 204
+      authorize! :delete, @variant
+
+      VariantDeleter.new.delete(@variant)
+      render json: @variant, serializer: Api::VariantSerializer, status: :no_content
     end
 
     private
@@ -58,11 +52,11 @@ module Api
 
     def scope
       if @product
-        unless current_api_user.has_spree_role?("admin") || params[:show_deleted]
-          variants = @product.variants_including_master
-        else
-          variants = @product.variants_including_master.with_deleted
-        end
+        variants = if current_api_user.has_spree_role?("admin") || params[:show_deleted]
+                     @product.variants_including_master.with_deleted
+                   else
+                     @product.variants_including_master
+                   end
       else
         variants = Spree::Variant.scoped
         if current_api_user.has_spree_role?("admin")

app/controllers/application_controller.rb

@@ -47,6 +47,7 @@ class ApplicationController < ActionController::Base
 
   def after_sign_in_path_for(resource_or_scope)
     return session[:shopfront_redirect] if session[:shopfront_redirect]
+
     stored_location_for(resource_or_scope) || signed_in_root_path(resource_or_scope)
   end
 

app/controllers/checkout_controller.rb

@@ -3,6 +3,10 @@ require 'open_food_network/address_finder'
 class CheckoutController < Spree::CheckoutController
   layout 'darkswarm'
 
+  # We need pessimistic locking to avoid race conditions.
+  # Otherwise we fail on duplicate indexes or end up with negative stock.
+  prepend_around_filter CurrentOrderLocker, only: :update
+
   prepend_before_filter :check_hub_ready_for_checkout
   prepend_before_filter :check_order_cycle_expiry
   prepend_before_filter :require_order_cycle

app/controllers/enterprises_controller.rb

@@ -16,6 +16,7 @@ class EnterprisesController < BaseController
 
   def shop
     return redirect_to main_app.cart_path unless enough_stock?
+
     set_noindex_meta_tag
 
     @enterprise = current_distributor

app/controllers/line_items_controller.rb

@@ -23,6 +23,7 @@ class LineItemsController < BaseController
   # List all items the user already ordered in the current order cycle
   def bought_items
     return [] unless current_order_cycle && spree_current_user && current_distributor
+
     current_order_cycle.items_bought_by_user(spree_current_user, current_distributor)
   end
 

app/controllers/spree/admin/adjustments_controller.rb

@@ -1,12 +1,23 @@
 module Spree
   module Admin
-    AdjustmentsController.class_eval do
+    class AdjustmentsController < ResourceController
+      belongs_to 'spree/order', find_by: :number
+      destroy.after :reload_order
+
       prepend_before_filter :set_included_tax, only: [:create, :update]
       before_filter :set_default_tax_rate, only: :edit
       before_filter :enable_updates, only: :update
 
       private
 
+      def reload_order
+        @order.reload
+      end
+
+      def collection
+        parent.adjustments.eligible
+      end
+
       # Choose a default tax rate to show on the edit form. The adjustment stores its included
       # tax in dollars, but doesn't store the source of the tax (ie. TaxRate that generated it).
       # We guess which tax rate here, choosing:
@@ -15,28 +26,34 @@ module Spree
       # When we have to go with 2, we show an error message to ask the admin to check that the
       # correct tax is being applied.
       def set_default_tax_rate
-        if @adjustment.included_tax > 0
-          trs = TaxRate.match(@order)
-          tr_yielding_matching_tax = trs.select { |tr| tr.compute_tax(@adjustment.amount) == @adjustment.included_tax }.first.andand.id
-          tr_valid_for_order = TaxRate.match(@order).first.andand.id
+        return if @adjustment.included_tax <= 0
 
-          @tax_rate_id = tr_yielding_matching_tax || tr_valid_for_order
+        tax_rates = TaxRate.match(@order)
+        tax_rate_with_matching_tax = find_tax_rate_with_matching_tax(tax_rates)
+        tax_rate_valid_for_order = tax_rates.first.andand.id
 
-          if tr_yielding_matching_tax.nil?
-            @adjustment.errors.add :tax_rate_id, I18n.t(:adjustments_tax_rate_error)
-          end
+        @tax_rate_id = tax_rate_with_matching_tax || tax_rate_valid_for_order
+
+        return unless tax_rate_with_matching_tax.nil?
+
+        @adjustment.errors.add :tax_rate_id, I18n.t(:adjustments_tax_rate_error)
+      end
+
+      def find_tax_rate_with_matching_tax(tax_rates)
+        tax_rates_yielding_matching_tax = tax_rates.select do |tr|
+          tr.compute_tax(@adjustment.amount) == @adjustment.included_tax
         end
+        tax_rates_yielding_matching_tax.first.andand.id
       end
 
       def set_included_tax
+        included_tax = 0
         if params[:tax_rate_id].present?
           tax_rate = TaxRate.find params[:tax_rate_id]
           amount = params[:adjustment][:amount].to_f
-          params[:adjustment][:included_tax] = tax_rate.compute_tax amount
-
-        else
-          params[:adjustment][:included_tax] = 0
+          included_tax = tax_rate.compute_tax amount
         end
+        params[:adjustment][:included_tax] = included_tax
       end
 
       # Spree 2.0 keeps shipping fee adjustments open unless they are manually

app/controllers/spree/admin/base_controller.rb

@@ -0,0 +1,142 @@
+module Spree
+  module Admin
+    class BaseController < Spree::BaseController
+      ssl_required
+
+      helper 'spree/admin/navigation'
+      layout '/spree/layouts/admin'
+
+      include I18nHelper
+
+      before_filter :authorize_admin
+      before_filter :set_locale
+      before_filter :warn_invalid_order_cycles, if: :html_request?
+
+      # Warn the user when they have an active order cycle with hubs that are not ready
+      # for checkout (ie. does not have valid shipping and payment methods).
+      def warn_invalid_order_cycles
+        distributors = active_distributors_not_ready_for_checkout
+
+        return if distributors.empty? || flash[:notice].present?
+
+        flash[:notice] = active_distributors_not_ready_for_checkout_message(distributors)
+      end
+
+      # This is in Spree::Core::ControllerHelpers::Auth
+      # But you can't easily reopen modules in Ruby
+      def unauthorized
+        if try_spree_current_user
+          flash[:error] = t(:authorization_failure)
+          redirect_to '/unauthorized'
+        else
+          store_location
+          redirect_to root_path(anchor: "login?after_login=#{request.env['PATH_INFO']}")
+        end
+      end
+
+      protected
+
+      def model_class
+        const_name = controller_name.classify
+        return "Spree::#{const_name}".constantize if Spree.const_defined?(const_name)
+
+        nil
+      end
+
+      def action
+        params[:action].to_sym
+      end
+
+      def authorize_admin
+        if respond_to?(:model_class, true) && model_class
+          record = model_class
+        else
+          # This allows specificity for each non-resource controller
+          #   (to be consistent with "authorize_resource :class => false", see https://github.com/ryanb/cancan/blob/60cf6a67ef59c0c9b63bc27ea0101125c4193ea6/lib/cancan/controller_resource.rb#L146)
+          record = self.class.to_s.
+            sub("Controller", "").
+            underscore.split('/').last.singularize.to_sym
+        end
+        authorize! :admin, record
+        authorize! resource_authorize_action, record
+      end
+
+      def resource_authorize_action
+        action
+      end
+
+      def flash_message_for(object, event_sym)
+        resource_desc  = object.class.model_name.human
+        resource_desc += " \"#{object.name}\"" if object.respond_to?(:name) && object.name.present?
+        Spree.t(event_sym, resource: resource_desc)
+      end
+
+      def render_js_for_destroy
+        render partial: '/spree/admin/shared/destroy'
+      end
+
+      # Index request for JSON needs to pass a CSRF token in order to prevent JSON Hijacking
+      def check_json_authenticity
+        return unless request.format.js? || request.format.json?
+
+        return unless protect_against_forgery?
+
+        auth_token = params[request_forgery_protection_token]
+        return if auth_token && form_authenticity_token == CGI.unescape(auth_token)
+
+        raise(ActionController::InvalidAuthenticityToken)
+      end
+
+      def config_locale
+        Spree::Backend::Config[:locale]
+      end
+
+      private
+
+      def active_distributors_not_ready_for_checkout
+        ocs = OrderCycle.managed_by(spree_current_user).active
+        distributors = ocs.includes(:distributors).map(&:distributors).flatten.uniq
+        Enterprise.where('enterprises.id IN (?)', distributors).not_ready_for_checkout
+      end
+
+      def active_distributors_not_ready_for_checkout_message(distributors)
+        distributor_names = distributors.map(&:name).join ', '
+
+        if distributors.count > 1
+          I18n.t(:active_distributors_not_ready_for_checkout_message_plural,
+                 distributor_names: distributor_names)
+        else
+          I18n.t(:active_distributors_not_ready_for_checkout_message_singular,
+                 distributor_names: distributor_names)
+        end
+      end
+
+      def html_request?
+        request.format.html?
+      end
+
+      def json_request?
+        request.format.json?
+      end
+
+      def render_as_json(data, options = {})
+        ams_prefix = options.delete :ams_prefix
+        if [Array, ActiveRecord::Relation].include? data.class
+          render options.merge(json: data, each_serializer: serializer(ams_prefix))
+        else
+          render options.merge(json: data, serializer: serializer(ams_prefix))
+        end
+      end
+
+      def serializer(ams_prefix)
+        unless ams_prefix.nil? || ams_prefix_whitelist.include?(ams_prefix.to_sym)
+          raise "Suffix '#{ams_prefix}' not found in ams_prefix_whitelist for #{self.class.name}."
+        end
+
+        prefix = ams_prefix.andand.classify || ""
+        name = controller_name.classify
+        "::Api::Admin::#{prefix}#{name}Serializer".constantize
+      end
+    end
+  end
+end

app/controllers/spree/admin/base_controller_decorator.rb

@@ -1,104 +0,0 @@
-require 'spree/core/controller_helpers/respond_with_decorator'
-
-Spree::Admin::BaseController.class_eval do
-  include I18nHelper
-
-  layout 'spree/layouts/admin'
-
-  before_filter :set_locale
-  before_filter :warn_invalid_order_cycles, if: :html_request?
-
-  # Warn the user when they have an active order cycle with hubs that are not ready
-  # for checkout (ie. does not have valid shipping and payment methods).
-  def warn_invalid_order_cycles
-    distributors = active_distributors_not_ready_for_checkout
-
-    if distributors.any? && flash[:notice].nil?
-      flash[:notice] = active_distributors_not_ready_for_checkout_message(distributors)
-    end
-  end
-
-  # Override Spree method
-  # It's a shame Spree doesn't just let CanCan handle this in it's own way
-  def authorize_admin
-    if respond_to?(:model_class, true) && model_class
-      record = model_class
-    else
-      # this line changed to allow specificity for each non-resource controller (to be consistent with "authorize_resource :class => false", see https://github.com/ryanb/cancan/blob/60cf6a67ef59c0c9b63bc27ea0101125c4193ea6/lib/cancan/controller_resource.rb#L146)
-      record = self.class.to_s.sub("Controller", "").underscore.split('/').last.singularize.to_sym
-    end
-    authorize! :admin, record
-    authorize! resource_authorize_action, record
-  end
-
-  def resource_authorize_action
-    action
-  end
-
-  # This is in Spree::Core::ControllerHelpers::Auth
-  # But you can't easily reopen modules in Ruby
-  def unauthorized
-    if try_spree_current_user
-      flash[:error] = t(:authorization_failure)
-      redirect_to '/unauthorized'
-    else
-      store_location
-      redirect_to root_path(anchor: "login?after_login=#{request.env['PATH_INFO']}")
-    end
-  end
-
-  protected
-
-  def model_class
-    const_name = controller_name.classify
-    if Spree.const_defined?(const_name)
-      return "Spree::#{const_name}".constantize
-    end
-    nil
-  end
-
-  private
-
-  def active_distributors_not_ready_for_checkout
-    ocs = OrderCycle.managed_by(spree_current_user).active
-    distributors = ocs.includes(:distributors).map(&:distributors).flatten.uniq
-    Enterprise.where('enterprises.id IN (?)', distributors).not_ready_for_checkout
-  end
-
-  def active_distributors_not_ready_for_checkout_message(distributors)
-    distributor_names = distributors.map(&:name).join ', '
-
-    if distributors.count > 1
-      I18n.t(:active_distributors_not_ready_for_checkout_message_plural, distributor_names: distributor_names)
-    else
-      I18n.t(:active_distributors_not_ready_for_checkout_message_singular, distributor_names: distributor_names)
-    end
-  end
-
-  def html_request?
-    request.format.html?
-  end
-
-  def json_request?
-    request.format.json?
-  end
-
-  def render_as_json(data, options = {})
-    ams_prefix = options.delete :ams_prefix
-    if [Array, ActiveRecord::Relation].include? data.class
-      render options.merge(json: data, each_serializer: serializer(ams_prefix))
-    else
-      render options.merge(json: data, serializer: serializer(ams_prefix))
-    end
-  end
-
-  def serializer(ams_prefix)
-    if ams_prefix.nil? || ams_prefix_whitelist.include?(ams_prefix.to_sym)
-      prefix = ams_prefix.andand.classify || ""
-      name = controller_name.classify
-      "Api::Admin::#{prefix}#{name}Serializer".constantize
-    else
-      raise "Suffix '#{ams_prefix}' not found in ams_prefix_whitelist for #{self.class.name}."
-    end
-  end
-end

app/controllers/spree/admin/general_settings_controller.rb

@@ -5,31 +5,20 @@ module Spree
         @preferences_general = [:site_name, :default_seo_title, :default_meta_keywords,
                                 :default_meta_description, :site_url, :bugherd_api_key]
         @preferences_security = [:allow_ssl_in_production,
-                                 :allow_ssl_in_staging, :allow_ssl_in_development_and_test,
-                                 :check_for_spree_alerts]
+                                 :allow_ssl_in_staging, :allow_ssl_in_development_and_test]
         @preferences_currency = [:display_currency, :hide_cents]
       end
 
       def update
         params.each do |name, value|
           next unless Spree::Config.has_preference? name
+
           Spree::Config[name] = value
         end
         flash[:success] = Spree.t(:successfully_updated, resource: Spree.t(:general_settings))
 
         redirect_to edit_admin_general_settings_path
       end
-
-      def dismiss_alert
-        return unless request.xhr? && params[:alert_id]
-        dismissed = Spree::Config[:dismissed_spree_alerts] || ''
-        Spree::Config.set(dismissed_spree_alerts: dismissed.
-                                                    split(',').
-                                                    push(params[:alert_id]).
-                                                    join(','))
-        filter_dismissed_alerts
-        render nothing: true
-      end
     end
   end
 end

app/controllers/spree/admin/images_controller.rb

@@ -0,0 +1,39 @@
+module Spree
+  module Admin
+    class ImagesController < ResourceController
+      # This will make resource controller redirect correctly after deleting product images.
+      # This can be removed after upgrading to Spree 2.1.
+      # See here https://github.com/spree/spree/commit/334a011d2b8e16355e4ae77ae07cd93f7cbc8fd1
+      belongs_to 'spree/product', find_by: :permalink
+
+      before_filter :load_data
+
+      create.before :set_viewable
+      update.before :set_viewable
+      destroy.before :destroy_before
+
+      private
+
+      def location_after_save
+        admin_product_images_url(@product)
+      end
+
+      def load_data
+        @product = Product.find_by_permalink(params[:product_id])
+        @variants = @product.variants.collect do |variant|
+          [variant.options_text, variant.id]
+        end
+        @variants.insert(0, [Spree.t(:all), @product.master.id])
+      end
+
+      def set_viewable
+        @image.viewable_type = 'Spree::Variant'
+        @image.viewable_id = params[:image][:viewable_id]
+      end
+
+      def destroy_before
+        @viewable = @image.viewable
+      end
+    end
+  end
+end

app/controllers/spree/admin/images_controller_decorator.rb

@@ -1,6 +0,0 @@
-Spree::Admin::ImagesController.class_eval do
-  # This will make resource controller redirect correctly after deleting product images.
-  # This can be removed after upgrading to Spree 2.1.
-  # See here https://github.com/spree/spree/commit/334a011d2b8e16355e4ae77ae07cd93f7cbc8fd1
-  belongs_to 'spree/product', find_by: :permalink
-end

app/controllers/spree/admin/mail_methods_controller.rb

@@ -10,6 +10,7 @@ module Spree
 
         params.each do |name, value|
           next unless Spree::Config.has_preference? name
+
           Spree::Config[name] = value
         end
 

app/controllers/spree/admin/orders/customer_details_controller_decorator.rb

@@ -43,6 +43,7 @@ Spree::Admin::Orders::CustomerDetailsController.class_eval do
     params[:order][:guest_checkout] = registered_user.nil?
 
     return unless registered_user
+
     @order.user_id = registered_user.id
   end
 end

app/controllers/spree/admin/overview_controller.rb

@@ -0,0 +1,79 @@
+# this clas was inspired (heavily) from the mephisto admin architecture
+module Spree
+  module Admin
+    class OverviewController < Spree::Admin::BaseController
+      def index
+        @enterprises = Enterprise
+          .managed_by(spree_current_user)
+          .order('is_primary_producer ASC, name')
+        @product_count = Spree::Product.active.managed_by(spree_current_user).count
+        @order_cycle_count = OrderCycle.active.managed_by(spree_current_user).count
+
+        if first_access
+          redirect_to enterprises_path
+        else
+          render dashboard_view
+        end
+      end
+
+      private
+
+      # Checks whether the user is accessing the admin for the first time
+      #
+      # @return [Boolean]
+      def first_access
+        outside_referral && incomplete_enterprise_registration?
+      end
+
+      # Checks whether the request comes from another admin page or not
+      #
+      # @return [Boolean]
+      def outside_referral
+        !URI(request.referer.to_s).path.match(%r{/admin})
+      end
+
+      # Checks that all of the enterprises owned by the current user have a 'sells'
+      # property specified, which indicates that the registration process has been
+      # completed
+      #
+      # @return [Boolean]
+      def incomplete_enterprise_registration?
+        @incomplete_enterprise_registration ||= spree_current_user
+          .owned_enterprises
+          .where(sells: 'unspecified')
+          .exists?
+      end
+
+      # Returns the appropriate enterprise path for the current user
+      #
+      # @return [String]
+      def enterprises_path
+        if managed_enterprises.size == 1
+          @enterprise = @enterprises.first
+          main_app.welcome_admin_enterprise_path(@enterprise)
+        else
+          main_app.admin_enterprises_path
+        end
+      end
+
+      # Returns the appropriate dashboard view for the current user
+      #
+      # @return [String]
+      def dashboard_view
+        if managed_enterprises.size == 1
+          @enterprise = @enterprises.first
+          :single_enterprise_dashboard
+        else
+          :multi_enterprise_dashboard
+        end
+      end
+
+      # Returns the list of enterprises the current user is manager of
+      #
+      # @return [ActiveRecord::Relation<Enterprise>]
+      def managed_enterprises
+        spree_current_user.enterprises
+      end
+    end
+  end
+end

app/controllers/spree/admin/overview_controller_decorator.rb

@@ -1,74 +0,0 @@
-Spree::Admin::OverviewController.class_eval do
-  def index
-    @enterprises = Enterprise
-      .managed_by(spree_current_user)
-      .order('is_primary_producer ASC, name')
-    @product_count = Spree::Product.active.managed_by(spree_current_user).count
-    @order_cycle_count = OrderCycle.active.managed_by(spree_current_user).count
-
-    if first_access
-      redirect_to enterprises_path
-    else
-      render dashboard_view
-    end
-  end
-
-  private
-
-  # Checks whether the user is accessing the admin for the first time
-  #
-  # @return [Boolean]
-  def first_access
-    outside_referral && incomplete_enterprise_registration?
-  end
-
-  # Checks whether the request comes from another admin page or not
-  #
-  # @return [Boolean]
-  def outside_referral
-    !URI(request.referer.to_s).path.match(%r{/admin})
-  end
-
-  # Checks that all of the enterprises owned by the current user have a 'sells'
-  # property specified, which indicates that the registration process has been
-  # completed
-  #
-  # @return [Boolean]
-  def incomplete_enterprise_registration?
-    @incomplete_enterprise_registration ||= spree_current_user
-      .owned_enterprises
-      .where(sells: 'unspecified')
-      .exists?
-  end
-
-  # Returns the appropriate enterprise path for the current user
-  #
-  # @return [String]
-  def enterprises_path
-    if managed_enterprises.size == 1
-      @enterprise = @enterprises.first
-      main_app.welcome_admin_enterprise_path(@enterprise)
-    else
-      main_app.admin_enterprises_path
-    end
-  end
-
-  # Returns the appropriate dashboard view for the current user
-  #
-  # @return [String]
-  def dashboard_view
-    if managed_enterprises.size == 1
-      @enterprise = @enterprises.first
-      :single_enterprise_dashboard
-    else
-      :multi_enterprise_dashboard
-    end
-  end
-
-  # Returns the list of enterprises the current user is manager of
-  #
-  # @return [ActiveRecord::Relation<Enterprise>]
-  def managed_enterprises
-    spree_current_user.enterprises
-  end
-end

app/controllers/spree/admin/payment_methods_controller.rb

@@ -1,16 +1,68 @@
 module Spree
   module Admin
-    PaymentMethodsController.class_eval do
-      before_filter :restrict_stripe_account_change, only: [:update]
-      before_filter :force_environment, only: [:create, :update]
-      skip_before_filter :load_resource, only: [:show_provider_preferences]
+    class PaymentMethodsController < ResourceController
+      skip_before_filter :load_resource, only: [:create, :show_provider_preferences]
+      before_filter :load_data
+      before_filter :validate_payment_method_provider, only: [:create]
       before_filter :load_hubs, only: [:new, :edit, :update]
       create.before :load_hubs
 
+      respond_to :html
+
+      def create
+        force_environment
+
+        @payment_method = params[:payment_method].
+          delete(:type).
+          constantize.
+          new(params[:payment_method])
+        @object = @payment_method
+
+        invoke_callbacks(:create, :before)
+        if @payment_method.save
+          invoke_callbacks(:create, :after)
+          flash[:success] = Spree.t(:successfully_created, resource: Spree.t(:payment_method))
+          redirect_to edit_admin_payment_method_path(@payment_method)
+        else
+          invoke_callbacks(:create, :fails)
+          respond_with(@payment_method)
+        end
+      end
+
+      def update
+        restrict_stripe_account_change
+        force_environment
+
+        invoke_callbacks(:update, :before)
+        payment_method_type = params[:payment_method].delete(:type)
+        if @payment_method['type'].to_s != payment_method_type
+          @payment_method.update_column(:type, payment_method_type)
+          @payment_method = PaymentMethod.find(params[:id])
+        end
+
+        payment_method_params = params[ActiveModel::Naming.param_key(@payment_method)] || {}
+        attributes = params[:payment_method].merge(payment_method_params)
+        attributes.each do |k, _v|
+          if k.include?("password") && attributes[k].blank?
+            attributes.delete(k)
+          end
+        end
+
+        if @payment_method.update_attributes(attributes)
+          invoke_callbacks(:update, :after)
+          flash[:success] = Spree.t(:successfully_updated, resource: Spree.t(:payment_method))
+          redirect_to edit_admin_payment_method_path(@payment_method)
+        else
+          invoke_callbacks(:update, :fails)
+          respond_with(@payment_method)
+        end
+      end
+
       # Only show payment methods that user has access to and sort by distributor name
       # ! Redundant code copied from Spree::Admin::ResourceController with modifications marked
       def collection
         return parent.public_send(controller_name) if parent_data.present?
+
         collection = if model_class.respond_to?(:accessible_by) &&
                         !current_ability.has_block?(params[:action], model_class)
 
@@ -62,6 +114,14 @@ module Spree
         @calculators = PaymentMethod.calculators.sort_by(&:name)
       end
 
+      def validate_payment_method_provider
+        valid_payment_methods = Rails.application.config.spree.payment_methods.map(&:to_s)
+        return if valid_payment_methods.include?(params[:payment_method][:type])
+
+        flash[:error] = Spree.t(:invalid_payment_provider)
+        redirect_to new_admin_payment_method_path
+      end
+
       def load_hubs
         # rubocop:disable Style/TernaryParentheses
         @hubs = Enterprise.managed_by(spree_current_user).is_distributor.sort_by! do |d|
@@ -73,7 +133,8 @@ module Spree
       # Show Stripe as an option if enabled, or if the
       # current payment_method is already a Stripe method
       def show_stripe?
-        Spree::Config.stripe_connect_enabled || @payment_method.try(:type) == "Spree::Gateway::StripeConnect"
+        Spree::Config.stripe_connect_enabled ||
+          @payment_method.try(:type) == "Spree::Gateway::StripeConnect"
       end
 
       def restrict_stripe_account_change

app/controllers/spree/admin/payments_controller_decorator.rb

@@ -43,8 +43,8 @@ Spree::Admin::PaymentsController.class_eval do
     else
       flash[:error] = t(:cannot_perform_operation)
     end
-  rescue Spree::Core::GatewayError => ge
-    flash[:error] = ge.message
+  rescue Spree::Core::GatewayError => e
+    flash[:error] = e.message
   ensure
     redirect_to request.referer
   end

app/controllers/spree/admin/product_properties_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Admin
+    class ProductPropertiesController < ResourceController
+      belongs_to 'spree/product', find_by: :permalink
+      before_filter :find_properties
+      before_filter :setup_property, only: [:index]
+
+      private
+
+      def find_properties
+        @properties = Spree::Property.pluck(:name)
+      end
+
+      def setup_property
+        @product.product_properties.build
+      end
+    end
+  end
+end

app/controllers/spree/admin/products_controller_decorator.rb

@@ -79,6 +79,7 @@ Spree::Admin::ProductsController.class_eval do
     # enterprise users.
     # TODO: There has to be a better way!!!
     return @collection if @collection.present?
+
     params[:q] ||= {}
     params[:q][:deleted_at_null] ||= "1"
 
@@ -147,6 +148,7 @@ Spree::Admin::ProductsController.class_eval do
 
   def strip_new_properties
     return if spree_current_user.admin? || params[:product][:product_properties_attributes].nil?
+
     names = Spree::Property.pluck(:name)
     params[:product][:product_properties_attributes].each do |key, property|
       unless names.include? property[:property_name]
@@ -170,9 +172,9 @@ Spree::Admin::ProductsController.class_eval do
     begin
       variant.on_demand = on_demand if on_demand.present?
       variant.on_hand = on_hand.to_i if on_hand.present?
-    rescue StandardError => error
-      notify_bugsnag(error, product, variant)
-      raise error
+    rescue StandardError => e
+      notify_bugsnag(e, product, variant)
+      raise e
     end
   end
 

app/controllers/spree/admin/properties_controller.rb

@@ -0,0 +1,6 @@
+module Spree
+  module Admin
+    class PropertiesController < ResourceController
+    end
+  end
+end

app/controllers/spree/admin/reports_controller.rb

@@ -0,0 +1,317 @@
+require 'csv'
+
+require 'open_food_network/reports/list'
+require 'open_food_network/order_and_distributor_report'
+require 'open_food_network/products_and_inventory_report'
+require 'open_food_network/lettuce_share_report'
+require 'open_food_network/group_buy_report'
+require 'open_food_network/order_grouper'
+require 'open_food_network/customers_report'
+require 'open_food_network/users_and_enterprises_report'
+require 'open_food_network/order_cycle_management_report'
+require 'open_food_network/packing_report'
+require 'open_food_network/sales_tax_report'
+require 'open_food_network/xero_invoices_report'
+require 'open_food_network/bulk_coop_report'
+require 'open_food_network/payments_report'
+require 'open_food_network/orders_and_fulfillments_report'
+
+module Spree
+  module Admin
+    class ReportsController < Spree::Admin::BaseController
+      include Spree::ReportsHelper
+
+      helper_method :render_content?
+
+      before_filter :cache_search_state
+      # Fetches user's distributors, suppliers and order_cycles
+      before_filter :load_data,
+                    only: [:customers, :products_and_inventory, :order_cycle_management, :packing]
+
+      respond_to :html
+
+      def report_types
+        OpenFoodNetwork::Reports::List.all
+      end
+
+      def index
+        @reports = authorized_reports
+        respond_with(@reports)
+      end
+
+      def customers
+        @report_types = report_types[:customers]
+        @report_type = params[:report_type]
+        @report = OpenFoodNetwork::CustomersReport.new spree_current_user, params, render_content?
+        render_report(@report.header, @report.table, params[:csv], "customers_#{timestamp}.csv")
+      end
+
+      def order_cycle_management
+        params[:q] ||= {}
+
+        @report_types = report_types[:order_cycle_management]
+        @report_type = params[:report_type]
+
+        # -- Build Report with Order Grouper
+        @report = OpenFoodNetwork::OrderCycleManagementReport.new spree_current_user,
+                                                                  params,
+                                                                  render_content?
+        @table = @report.table_items
+
+        render_report(@report.header, @table, params[:csv],
+                      "order_cycle_management_#{timestamp}.csv")
+      end
+
+      def packing
+        params[:q] ||= {}
+
+        @report_types = report_types[:packing]
+        @report_type = params[:report_type]
+
+        # -- Build Report with Order Grouper
+        @report = OpenFoodNetwork::PackingReport.new spree_current_user, params, render_content?
+        @table = order_grouper_table
+
+        render_report(@report.header, @table, params[:csv], "packing_#{timestamp}.csv")
+      end
+
+      def orders_and_distributors
+        @report = OpenFoodNetwork::OrderAndDistributorReport.new spree_current_user,
+                                                                 params,
+                                                                 render_content?
+        @search = @report.search
+        csv_file_name = "orders_and_distributors_#{timestamp}.csv"
+        render_report(@report.header, @report.table, params[:csv], csv_file_name)
+      end
+
+      def sales_tax
+        @distributors = my_distributors
+        @report_type = params[:report_type]
+        @report = OpenFoodNetwork::SalesTaxReport.new spree_current_user, params, render_content?
+        render_report(@report.header, @report.table, params[:csv], "sales_tax.csv")
+      end
+
+      def bulk_coop
+        # -- Prepare form options
+        @distributors = my_distributors
+        @report_type = params[:report_type]
+
+        # -- Build Report with Order Grouper
+        @report = OpenFoodNetwork::BulkCoopReport.new spree_current_user, params, render_content?
+        @table = order_grouper_table
+        csv_file_name = "bulk_coop_#{params[:report_type]}_#{timestamp}.csv"
+
+        render_report(@report.header, @table, params[:csv], csv_file_name)
+      end
+
+      def payments
+        # -- Prepare Form Options
+        @distributors = my_distributors
+        @report_type = params[:report_type]
+
+        # -- Build Report with Order Grouper
+        @report = OpenFoodNetwork::PaymentsReport.new spree_current_user, params, render_content?
+        @table = order_grouper_table
+        csv_file_name = "payments_#{timestamp}.csv"
+
+        render_report(@report.header, @table, params[:csv], csv_file_name)
+      end
+
+      def orders_and_fulfillment
+        params[:q] ||= orders_and_fulfillment_default_filters
+
+        # -- Prepare Form Options
+        permissions = OpenFoodNetwork::Permissions.new(spree_current_user)
+        # My distributors and any distributors distributing products I supply
+        @distributors = permissions.visible_enterprises_for_order_reports.is_distributor
+        # My suppliers and any suppliers supplying products I distribute
+        @suppliers = permissions.visible_enterprises_for_order_reports.is_primary_producer
+
+        @order_cycles = my_order_cycles
+
+        @report_types = report_types[:orders_and_fulfillment]
+        @report_type = params[:report_type]
+
+        @include_blank = I18n.t(:all)
+
+        # -- Build Report with Order Grouper
+        @report = OpenFoodNetwork::OrdersAndFulfillmentsReport.new spree_current_user,
+                                                                   params,
+                                                                   render_content?
+        @table = order_grouper_table
+        csv_file_name = "#{params[:report_type]}_#{timestamp}.csv"
+
+        render_report(@report.header, @table, params[:csv], csv_file_name)
+      end
+
+      def products_and_inventory
+        @report_types = report_types[:products_and_inventory]
+        @report = if params[:report_type] != 'lettuce_share'
+                    OpenFoodNetwork::ProductsAndInventoryReport.new spree_current_user,
+                                                                    params,
+                                                                    render_content?
+                  else
+                    OpenFoodNetwork::LettuceShareReport.new spree_current_user,
+                                                            params,
+                                                            render_content?
+                  end
+
+        render_report @report.header,
+                      @report.table,
+                      params[:csv],
+                      "products_and_inventory_#{timestamp}.csv"
+      end
+
+      def users_and_enterprises
+        @report = OpenFoodNetwork::UsersAndEnterprisesReport.new params, render_content?
+        render_report(@report.header, @report.table, params[:csv],
+                      "users_and_enterprises_#{timestamp}.csv")
+      end
+
+      def xero_invoices
+        params[:q] ||= {}
+
+        @distributors = my_distributors
+        @order_cycles = my_order_cycles
+
+        @report = OpenFoodNetwork::XeroInvoicesReport.new(spree_current_user,
+                                                          params,
+                                                          render_content?)
+        render_report(@report.header, @report.table, params[:csv], "xero_invoices_#{timestamp}.csv")
+      end
+
+      private
+
+      def model_class
+        Spree::Admin::ReportsController
+      end
+
+      # Some actions are changing the `params` object. That is unfortunate Spree
+      # behavior and we are building on it. So we have to look at `params` early
+      # to check if we are searching or just displaying a report search form.
+      def cache_search_state
+        search_keys = [
+          # search parameter for ransack
+          :q,
+          # common in all reports, only set for CSV rendering
+          :csv,
+          # `button` is included in all forms. It's not important for searching,
+          # but the Users & Enterprises report doesn't have any other parameter
+          # for an empty search. So we use this one to display data.
+          :button,
+          # Some reports use filtering by enterprise or order cycle
+          :distributor_id,
+          :supplier_id,
+          :order_cycle_id,
+          # Xero Invoices can be filtered by date
+          :invoice_date,
+          :due_date
+        ]
+        @searching = search_keys.any? { |key| params.key? key }
+      end
+
+      # We don't want to render data unless search params are supplied.
+      # Compiling data can take a long time.
+      def render_content?
+        @searching
+      end
+
+      def render_report(header, table, create_csv, csv_file_name)
+        send_data csv_report(header, table), filename: csv_file_name if create_csv
+        @header = header
+        @table = table
+        # Rendering HTML is the default.
+      end
+
+      def csv_report(header, table)
+        CSV.generate do |csv|
+          csv << header
+          table.each { |row| csv << row }
+        end
+      end
+
+      def load_data
+        @distributors = my_distributors
+        @suppliers = my_suppliers | suppliers_of_products_distributed_by(@distributors)
+        @order_cycles = my_order_cycles
+      end
+
+      # Load managed distributor enterprises of current user
+      def my_distributors
+        Enterprise.is_distributor.managed_by(spree_current_user)
+      end
+
+      # Load managed producer enterprises of current user
+      def my_suppliers
+        Enterprise.is_primary_producer.managed_by(spree_current_user)
+      end
+
+      def suppliers_of_products_distributed_by(distributors)
+        distributors.map { |d| Spree::Product.in_distributor(d).includes(:supplier).all }.
+          flatten.map(&:supplier).uniq
+      end
+
+      # Load order cycles the current user has access to
+      def my_order_cycles
+        OrderCycle.
+          active_or_complete.
+          accessible_by(spree_current_user).
+          order('orders_close_at DESC')
+      end
+
+      def order_grouper_table
+        order_grouper = OpenFoodNetwork::OrderGrouper.new @report.rules, @report.columns
+        order_grouper.table(@report.table_items)
+      end
+
+      def authorized_reports
+        all_reports = [
+          :orders_and_distributors,
+          :bulk_coop,
+          :payments,
+          :orders_and_fulfillment,
+          :customers,
+          :products_and_inventory,
+          :users_and_enterprises,
+          :enterprise_fee_summary,
+          :order_cycle_management,
+          :sales_tax,
+          :xero_invoices,
+          :packing
+        ]
+        reports = all_reports.select { |action| can? action, Spree::Admin::ReportsController }
+        reports.map { |report| [report, describe_report(report)] }.to_h
+      end
+
+      def describe_report(report)
+        name = I18n.t(:name, scope: [:admin, :reports, report])
+        description = begin
+                        I18n.t!(:description, scope: [:admin, :reports, report])
+                      rescue I18n::MissingTranslationData
+                        render_to_string(
+                          partial: "#{report}_description",
+                          layout: false,
+                          locals: { report_types: report_types[report] }
+                        ).html_safe
+                      end
+        { name: name, url: url_for_report(report), description: description }
+      end
+
+      def url_for_report(report)
+        public_send("#{report}_admin_reports_url".to_sym)
+      rescue NoMethodError
+        url_for([:new, :admin, :reports, report.to_s.singularize])
+      end
+
+      def timestamp
+        Time.zone.now.strftime("%Y%m%d")
+      end
+
+      def orders_and_fulfillment_default_filters
+        now = Time.zone.now
+        { completed_at_gt: (now - 1.month).beginning_of_day,
+          completed_at_lt: (now + 1.day).beginning_of_day }
+      end
+    end
+  end
+end

app/controllers/spree/admin/reports_controller_decorator.rb

@@ -1,287 +0,0 @@
-require 'csv'
-
-require 'open_food_network/reports/list'
-require 'open_food_network/order_and_distributor_report'
-require 'open_food_network/products_and_inventory_report'
-require 'open_food_network/lettuce_share_report'
-require 'open_food_network/group_buy_report'
-require 'open_food_network/order_grouper'
-require 'open_food_network/customers_report'
-require 'open_food_network/users_and_enterprises_report'
-require 'open_food_network/order_cycle_management_report'
-require 'open_food_network/packing_report'
-require 'open_food_network/sales_tax_report'
-require 'open_food_network/xero_invoices_report'
-require 'open_food_network/bulk_coop_report'
-require 'open_food_network/payments_report'
-require 'open_food_network/orders_and_fulfillments_report'
-
-Spree::Admin::ReportsController.class_eval do
-  include Spree::ReportsHelper
-
-  helper_method :render_content?
-
-  before_filter :cache_search_state
-  # Fetches user's distributors, suppliers and order_cycles
-  before_filter :load_data, only: [:customers, :products_and_inventory, :order_cycle_management, :packing]
-
-  def report_types
-    OpenFoodNetwork::Reports::List.all
-  end
-
-  # Override spree reports list.
-  def index
-    @reports = authorized_reports
-    respond_with(@reports)
-  end
-
-  def customers
-    @report_types = report_types[:customers]
-    @report_type = params[:report_type]
-    @report = OpenFoodNetwork::CustomersReport.new spree_current_user, params, render_content?
-    render_report(@report.header, @report.table, params[:csv], "customers_#{timestamp}.csv")
-  end
-
-  def order_cycle_management
-    params[:q] ||= {}
-
-    @report_types = report_types[:order_cycle_management]
-    @report_type = params[:report_type]
-
-    # -- Build Report with Order Grouper
-    @report = OpenFoodNetwork::OrderCycleManagementReport.new spree_current_user, params, render_content?
-    @table = @report.table_items
-
-    render_report(@report.header, @table, params[:csv], "order_cycle_management_#{timestamp}.csv")
-  end
-
-  def packing
-    params[:q] ||= {}
-
-    @report_types = report_types[:packing]
-    @report_type = params[:report_type]
-
-    # -- Build Report with Order Grouper
-    @report = OpenFoodNetwork::PackingReport.new spree_current_user, params, render_content?
-    @table = order_grouper_table
-
-    render_report(@report.header, @table, params[:csv], "packing_#{timestamp}.csv")
-  end
-
-  def orders_and_distributors
-    @report = OpenFoodNetwork::OrderAndDistributorReport.new spree_current_user, params, render_content?
-    @search = @report.search
-    csv_file_name = "orders_and_distributors_#{timestamp}.csv"
-    render_report(@report.header, @report.table, params[:csv], csv_file_name)
-  end
-
-  def sales_tax
-    @distributors = my_distributors
-    @report_type = params[:report_type]
-    @report = OpenFoodNetwork::SalesTaxReport.new spree_current_user, params, render_content?
-    render_report(@report.header, @report.table, params[:csv], "sales_tax.csv")
-  end
-
-  def bulk_coop
-    # -- Prepare form options
-    @distributors = my_distributors
-    @report_type = params[:report_type]
-
-    # -- Build Report with Order Grouper
-    @report = OpenFoodNetwork::BulkCoopReport.new spree_current_user, params, render_content?
-    @table = order_grouper_table
-    csv_file_name = "bulk_coop_#{params[:report_type]}_#{timestamp}.csv"
-
-    render_report(@report.header, @table, params[:csv], csv_file_name)
-  end
-
-  def payments
-    # -- Prepare Form Options
-    @distributors = my_distributors
-    @report_type = params[:report_type]
-
-    # -- Build Report with Order Grouper
-    @report = OpenFoodNetwork::PaymentsReport.new spree_current_user, params, render_content?
-    @table = order_grouper_table
-    csv_file_name = "payments_#{timestamp}.csv"
-
-    render_report(@report.header, @table, params[:csv], csv_file_name)
-  end
-
-  def orders_and_fulfillment
-    params[:q] ||= orders_and_fulfillment_default_filters
-
-    # -- Prepare Form Options
-    permissions = OpenFoodNetwork::Permissions.new(spree_current_user)
-    # My distributors and any distributors distributing products I supply
-    @distributors = permissions.visible_enterprises_for_order_reports.is_distributor
-    # My suppliers and any suppliers supplying products I distribute
-    @suppliers = permissions.visible_enterprises_for_order_reports.is_primary_producer
-
-    @order_cycles = my_order_cycles
-
-    @report_types = report_types[:orders_and_fulfillment]
-    @report_type = params[:report_type]
-
-    @include_blank = I18n.t(:all)
-
-    # -- Build Report with Order Grouper
-    @report = OpenFoodNetwork::OrdersAndFulfillmentsReport.new(permissions,
-                                                               params, render_content?)
-    @table = order_grouper_table
-    csv_file_name = "#{params[:report_type]}_#{timestamp}.csv"
-
-    render_report(@report.header, @table, params[:csv], csv_file_name)
-  end
-
-  def products_and_inventory
-    @report_types = report_types[:products_and_inventory]
-    @report = if params[:report_type] != 'lettuce_share'
-                OpenFoodNetwork::ProductsAndInventoryReport.new spree_current_user, params, render_content?
-              else
-                OpenFoodNetwork::LettuceShareReport.new spree_current_user, params, render_content?
-              end
-    render_report(@report.header, @report.table, params[:csv], "products_and_inventory_#{timestamp}.csv")
-  end
-
-  def users_and_enterprises
-    @report = OpenFoodNetwork::UsersAndEnterprisesReport.new params, render_content?
-    render_report(@report.header, @report.table, params[:csv], "users_and_enterprises_#{timestamp}.csv")
-  end
-
-  def xero_invoices
-    params[:q] ||= {}
-
-    @distributors = my_distributors
-    @order_cycles = my_order_cycles
-
-    @report = OpenFoodNetwork::XeroInvoicesReport.new spree_current_user, params, render_content?
-    render_report(@report.header, @report.table, params[:csv], "xero_invoices_#{timestamp}.csv")
-  end
-
-  private
-
-  # Some actions are changing the `params` object. That is unfortunate Spree
-  # behavior and we are building on it. So we have to look at `params` early
-  # to check if we are searching or just displaying a report search form.
-  def cache_search_state
-    search_keys = [
-      # search parameter for ransack
-      :q,
-      # common in all reports, only set for CSV rendering
-      :csv,
-      # `button` is included in all forms. It's not important for searching,
-      # but the Users & Enterprises report doesn't have any other parameter
-      # for an empty search. So we use this one to display data.
-      :button,
-      # Some reports use filtering by enterprise or order cycle
-      :distributor_id,
-      :supplier_id,
-      :order_cycle_id,
-      # Xero Invoices can be filtered by date
-      :invoice_date,
-      :due_date
-    ]
-    @searching = search_keys.any? { |key| params.key? key }
-  end
-
-  # We don't want to render data unless search params are supplied.
-  # Compiling data can take a long time.
-  def render_content?
-    @searching
-  end
-
-  def render_report(header, table, create_csv, csv_file_name)
-    send_data csv_report(header, table), filename: csv_file_name if create_csv
-    @header = header
-    @table = table
-    # Rendering HTML is the default.
-  end
-
-  def csv_report(header, table)
-    CSV.generate do |csv|
-      csv << header
-      table.each { |row| csv << row }
-    end
-  end
-
-  def load_data
-    @distributors = my_distributors
-    @suppliers = my_suppliers | suppliers_of_products_distributed_by(@distributors)
-    @order_cycles = my_order_cycles
-  end
-
-  # Load managed distributor enterprises of current user
-  def my_distributors
-    Enterprise.is_distributor.managed_by(spree_current_user)
-  end
-
-  # Load managed producer enterprises of current user
-  def my_suppliers
-    Enterprise.is_primary_producer.managed_by(spree_current_user)
-  end
-
-  def suppliers_of_products_distributed_by(distributors)
-    distributors.map { |d| Spree::Product.in_distributor(d) }.flatten.map(&:supplier).uniq
-  end
-
-  # Load order cycles the current user has access to
-  def my_order_cycles
-    OrderCycle.active_or_complete.accessible_by(spree_current_user).order('orders_close_at DESC')
-  end
-
-  def order_grouper_table
-    order_grouper = OpenFoodNetwork::OrderGrouper.new @report.rules, @report.columns
-    order_grouper.table(@report.table_items)
-  end
-
-  def authorized_reports
-    all_reports = [
-      :orders_and_distributors,
-      :bulk_coop,
-      :payments,
-      :orders_and_fulfillment,
-      :customers,
-      :products_and_inventory,
-      :sales_total,
-      :users_and_enterprises,
-      :enterprise_fee_summary,
-      :order_cycle_management,
-      :sales_tax,
-      :xero_invoices,
-      :packing
-    ]
-    reports = all_reports.select { |action| can? action, Spree::Admin::ReportsController }
-    reports.map { |report| [report, describe_report(report)] }.to_h
-  end
-
-  def describe_report(report)
-    name = I18n.t(:name, scope: [:admin, :reports, report])
-    description = begin
-      I18n.t!(:description, scope: [:admin, :reports, report])
-    rescue I18n::MissingTranslationData
-      render_to_string(
-        partial: "#{report}_description",
-        layout: false,
-        locals: { report_types: report_types[report] }
-      ).html_safe
-    end
-    { name: name, url: url_for_report(report), description: description }
-  end
-
-  def url_for_report(report)
-    public_send("#{report}_admin_reports_url".to_sym)
-  rescue NoMethodError
-    url_for([:new, :admin, :reports, report.to_s.singularize])
-  end
-
-  def timestamp
-    Time.zone.now.strftime("%Y%m%d")
-  end
-
-  def orders_and_fulfillment_default_filters
-    now = Time.zone.now
-    { completed_at_gt: (now - 1.month).beginning_of_day,
-      completed_at_lt: (now + 1.day).beginning_of_day }
-  end
-end

app/controllers/spree/admin/resource_controller.rb

@@ -0,0 +1,275 @@
+require 'action_callbacks'
+
+module Spree
+  module Admin
+    class ResourceController < Spree::Admin::BaseController
+      helper_method :new_object_url, :edit_object_url, :object_url, :collection_url
+      before_filter :load_resource, except: [:update_positions]
+      rescue_from ActiveRecord::RecordNotFound, with: :resource_not_found
+      rescue_from CanCan::AccessDenied, with: :unauthorized
+
+      respond_to :html
+      respond_to :js, except: [:show, :index]
+
+      def new
+        invoke_callbacks(:new_action, :before)
+        respond_with(@object) do |format|
+          format.html { render layout: !request.xhr? }
+          format.js   { render layout: false }
+        end
+      end
+
+      def edit
+        respond_with(@object) do |format|
+          format.html { render layout: !request.xhr? }
+          format.js   { render layout: false }
+        end
+      end
+
+      def update
+        invoke_callbacks(:update, :before)
+        if @object.update_attributes(params[object_name])
+          invoke_callbacks(:update, :after)
+          flash[:success] = flash_message_for(@object, :successfully_updated)
+          respond_with(@object) do |format|
+            format.html { redirect_to location_after_save }
+            format.js   { render layout: false }
+          end
+        else
+          invoke_callbacks(:update, :fails)
+          respond_with(@object)
+        end
+      end
+
+      def create
+        invoke_callbacks(:create, :before)
+        @object.attributes = params[object_name]
+        if @object.save
+          invoke_callbacks(:create, :after)
+          flash[:success] = flash_message_for(@object, :successfully_created)
+          respond_with(@object) do |format|
+            format.html { redirect_to location_after_save }
+            format.js   { render layout: false }
+          end
+        else
+          invoke_callbacks(:create, :fails)
+          respond_with(@object)
+        end
+      end
+
+      def update_positions
+        params[:positions].each do |id, index|
+          model_class.where(id: id).update_all(position: index)
+        end
+
+        respond_to do |format|
+          format.js { render text: 'Ok' }
+        end
+      end
+
+      def destroy
+        invoke_callbacks(:destroy, :before)
+        if @object.destroy
+          invoke_callbacks(:destroy, :after)
+          flash[:success] = flash_message_for(@object, :successfully_removed)
+          respond_with(@object) do |format|
+            format.html { redirect_to collection_url }
+            format.js   { render partial: "spree/admin/shared/destroy" }
+          end
+        else
+          invoke_callbacks(:destroy, :fails)
+          respond_with(@object) do |format|
+            format.html { redirect_to collection_url }
+          end
+        end
+      end
+
+      protected
+
+      def resource_not_found
+        flash[:error] = flash_message_for(model_class.new, :not_found)
+        redirect_to collection_url
+      end
+
+      class << self
+        attr_accessor :parent_data
+        attr_accessor :callbacks
+
+        def belongs_to(model_name, options = {})
+          @parent_data ||= {}
+          @parent_data[:model_name] = model_name
+          @parent_data[:model_class] = model_name.to_s.classify.constantize
+          @parent_data[:find_by] = options[:find_by] || :id
+        end
+
+        def new_action
+          @callbacks ||= {}
+          @callbacks[:new_action] ||= ActionCallbacks.new
+        end
+
+        def create
+          @callbacks ||= {}
+          @callbacks[:create] ||= ActionCallbacks.new
+        end
+
+        def update
+          @callbacks ||= {}
+          @callbacks[:update] ||= ActionCallbacks.new
+        end
+
+        def destroy
+          @callbacks ||= {}
+          @callbacks[:destroy] ||= ActionCallbacks.new
+        end
+      end
+
+      def model_class
+        "Spree::#{controller_name.classify}".constantize
+      end
+
+      def model_name
+        parent_data[:model_name].gsub('spree/', '')
+      end
+
+      def object_name
+        controller_name.singularize
+      end
+
+      def load_resource
+        if member_action?
+          @object ||= load_resource_instance
+
+          # call authorize! a third time (called twice already in Admin::BaseController)
+          # this time we pass the actual instance so fine-grained abilities can control
+          # access to individual records, not just entire models.
+          authorize! action, @object
+
+          instance_variable_set("@#{object_name}", @object)
+
+          # If we don't have access, clear the object
+          unless can? action, @object
+            instance_variable_set("@#{object_name}", nil)
+          end
+
+          authorize! action, @object
+        else
+          @collection ||= collection
+
+          # note: we don't call authorize here as the collection method should use
+          # CanCan's accessible_by method to restrict the actual records returned
+
+          instance_variable_set("@#{controller_name}", @collection)
+        end
+      end
+
+      def load_resource_instance
+        if new_actions.include?(action)
+          build_resource
+        elsif params[:id]
+          find_resource
+        end
+      end
+
+      def parent_data
+        self.class.parent_data
+      end
+
+      def parent
+        return nil if parent_data.blank?
+
+        @parent ||= parent_data[:model_class].
+          public_send("find_by_#{parent_data[:find_by]}", params["#{model_name}_id"])
+        instance_variable_set("@#{model_name}", @parent)
+      end
+
+      def find_resource
+        if parent_data.present?
+          parent.public_send(controller_name).find(params[:id])
+        else
+          model_class.find(params[:id])
+        end
+      end
+
+      def build_resource
+        if parent_data.present?
+          parent.public_send(controller_name).build
+        else
+          model_class.new
+        end
+      end
+
+      def collection
+        return parent.public_send(controller_name) if parent_data.present?
+
+        if model_class.respond_to?(:accessible_by) &&
+           !current_ability.has_block?(params[:action], model_class)
+          model_class.accessible_by(current_ability, action)
+        else
+          model_class.scoped
+        end
+      end
+
+      def location_after_save
+        collection_url
+      end
+
+      def invoke_callbacks(action, callback_type)
+        callbacks = self.class.callbacks || {}
+        return if callbacks[action].nil?
+
+        case callback_type.to_sym
+        when :before then callbacks[action].before_methods.each { |method| __send__ method }
+        when :after  then callbacks[action].after_methods.each  { |method| __send__ method }
+        when :fails  then callbacks[action].fails_methods.each  { |method| __send__ method }
+        end
+      end
+
+      # URL helpers
+
+      def new_object_url(options = {})
+        if parent_data.present?
+          spree.new_polymorphic_url([:admin, parent, model_class], options)
+        else
+          spree.new_polymorphic_url([:admin, model_class], options)
+        end
+      end
+
+      def edit_object_url(object, options = {})
+        if parent_data.present?
+          spree.public_send "edit_admin_#{model_name}_#{object_name}_url", parent, object, options
+        else
+          spree.public_send "edit_admin_#{object_name}_url", object, options
+        end
+      end
+
+      def object_url(object = nil, options = {})
+        target = object || @object
+        if parent_data.present?
+          spree.public_send "admin_#{model_name}_#{object_name}_url", parent, target, options
+        else
+          spree.public_send "admin_#{object_name}_url", target, options
+        end
+      end
+
+      def collection_url(options = {})
+        if parent_data.present?
+          spree.polymorphic_url([:admin, parent, model_class], options)
+        else
+          spree.polymorphic_url([:admin, model_class], options)
+        end
+      end
+
+      def collection_actions
+        [:index]
+      end
+
+      def member_action?
+        !collection_actions.include? action
+      end
+
+      def new_actions
+        [:new, :create]
+      end
+    end
+  end
+end

app/controllers/spree/admin/resource_controller_decorator.rb

@@ -1,20 +0,0 @@
-module AuthorizeOnLoadResource
-  def load_resource
-    super
-
-    if member_action?
-      # If we don't have access, clear the object
-      unless can? action, @object
-        instance_variable_set("@#{object_name}", nil)
-      end
-
-      authorize! action, @object
-    end
-  end
-end
-
-Spree::Admin::ResourceController.prepend(AuthorizeOnLoadResource)
-
-Spree::Admin::ResourceController.class_eval do
-  rescue_from CanCan::AccessDenied, :with => :unauthorized
-end

app/controllers/spree/admin/return_authorizations_controller.rb

@@ -0,0 +1,24 @@
+module Spree
+  module Admin
+    class ReturnAuthorizationsController < ResourceController
+      belongs_to 'spree/order', find_by: :number
+
+      update.after :associate_inventory_units
+      create.after :associate_inventory_units
+
+      def fire
+        @return_authorization.public_send("#{params[:e]}!")
+        flash[:success] = Spree.t(:return_authorization_updated)
+        redirect_to :back
+      end
+
+      protected
+
+      def associate_inventory_units
+        (params[:return_quantity] || []).each do |variant_id, qty|
+          @return_authorization.add_variant(variant_id.to_i, qty.to_i)
+        end
+      end
+    end
+  end
+end

app/controllers/spree/admin/shipping_methods_controller.rb

@@ -58,6 +58,7 @@ module Spree
 
       def set_shipping_category
         return true if params["shipping_method"][:shipping_categories] == ""
+
         @shipping_method.shipping_categories =
           Spree::ShippingCategory.where(id: params["shipping_method"][:shipping_categories])
         @shipping_method.save
@@ -66,6 +67,7 @@ module Spree
 
       def set_zones
         return true if params["shipping_method"][:zones] == ""
+
         @shipping_method.zones = Spree::Zone.where(id: params["shipping_method"][:zones])
         @shipping_method.save
         params[:shipping_method].delete(:zones)

app/controllers/spree/admin/taxonomies_controller.rb

@@ -1,7 +1,7 @@
 module Spree
   module Admin
     class TaxonomiesController < ResourceController
-      respond_to :json, :only => [:get_children]
+      respond_to :json, only: [:get_children]
 
       def get_children
         @taxons = Taxon.find(params[:parent_id]).children

app/controllers/spree/admin/taxons_controller.rb

@@ -4,11 +4,11 @@ module Spree
       respond_to :html, :json, :js
 
       def search
-        if params[:ids]
-          @taxons = Spree::Taxon.where(id: params[:ids].split(','))
-        else
-          @taxons = Spree::Taxon.limit(20).search(name_cont: params[:q]).result
-        end
+        @taxons = if params[:ids]
+                    Spree::Taxon.where(id: params[:ids].split(','))
+                  else
+                    Spree::Taxon.limit(20).search(name_cont: params[:q]).result
+                  end
       end
 
       def create

app/controllers/spree/admin/users_controller.rb

@@ -74,6 +74,7 @@ module Spree
 
       def collection
         return @collection if @collection.present?
+
         if request.xhr? && params[:q].present?
           # Disabling proper nested include here due to rails 3.1 bug
           @collection = Spree::User.
@@ -125,6 +126,7 @@ module Spree
 
       def sign_in_if_change_own_password
         return unless spree_current_user == @user && @user.password.present?
+
         sign_in(@user, event: :authentication, bypass: true)
       end
 

app/controllers/spree/checkout_controller.rb

@@ -18,7 +18,7 @@ module Spree
 
     helper 'spree/orders'
 
-    rescue_from Spree::Core::GatewayError, :with => :rescue_from_spree_gateway_error
+    rescue_from Spree::Core::GatewayError, with: :rescue_from_spree_gateway_error
 
     def edit
       flash.keep

app/controllers/spree/credit_cards_controller.rb

@@ -19,6 +19,7 @@ module Spree
     def update
       @credit_card = Spree::CreditCard.find_by_id(params[:id])
       return update_failed unless @credit_card
+
       authorize! :update, @credit_card
 
       if @credit_card.update_attributes(params[:credit_card])
@@ -63,6 +64,7 @@ module Spree
 
     def stored_card_attributes
       return {} unless @customer.try(:default_source)
+
       {
         month: params[:exp_month],
         year: params[:exp_year],

app/controllers/spree/orders_controller.rb

@@ -9,7 +9,7 @@ module Spree
     ssl_required :show
 
     before_filter :check_authorization
-    rescue_from ActiveRecord::RecordNotFound, :with => :render_404
+    rescue_from ActiveRecord::RecordNotFound, with: :render_404
     helper 'spree/products', 'spree/orders'
 
     respond_to :html
@@ -176,7 +176,7 @@ module Spree
       previous_states = @order.adjustments.each_with_object({}) do |adjustment, hash|
         hash[adjustment.id] = adjustment.state
       end
-      @order.adjustments.each(&:open)
+      @order.adjustments.each { |adjustment| adjustment.fire_events(:open) }
 
       yield
 
@@ -200,6 +200,7 @@ module Spree
     def order_to_update
       return @order_to_update if defined? @order_to_update
       return @order_to_update = current_order unless params[:id]
+
       @order_to_update = changeable_order_from_number
     end
 
@@ -208,6 +209,7 @@ module Spree
     def changeable_order_from_number
       order = Spree::Order.complete.find_by_number(params[:id])
       return nil unless order.andand.changes_allowed? && can?(:update, order)
+
       order
     end
 

app/controllers/spree/paypal_controller_decorator.rb

@@ -38,6 +38,7 @@ Spree::PaypalController.class_eval do
   # the payment details have been confirmed, but before any payments have been processed
   def destroy_orphaned_paypal_payments
     return unless payment_method.is_a?(Spree::Gateway::PayPalExpress)
+
     orphaned_payments = current_order.payments.where(payment_method_id: payment_method.id, source_id: nil)
     orphaned_payments.each(&:destroy)
   end

app/controllers/user_registrations_controller.rb

@@ -25,8 +25,8 @@ class UserRegistrationsController < Spree::UserRegistrationsController
         render json: { email: @user.email }
       end
     end
-  rescue StandardError => error
-    OpenFoodNetwork::ErrorLogger.notify(error)
+  rescue StandardError => e
+    OpenFoodNetwork::ErrorLogger.notify(e)
     render_error(message: I18n.t('unknown_error', scope: I18N_SCOPE))
   end
 

app/helpers/admin/enterprises_helper.rb

@@ -0,0 +1,11 @@
+module Admin
+  module EnterprisesHelper
+    def add_check_if_single(count)
+      if count == 1
+        { checked: true }
+      else
+        {}
+      end
+    end
+  end
+end

app/helpers/admin/injection_helper.rb

@@ -1,83 +1,133 @@
 module Admin
   module InjectionHelper
     def admin_inject_enterprise
-      admin_inject_json_ams "admin.enterprises", "enterprise", @enterprise, Api::Admin::EnterpriseSerializer
+      admin_inject_json_ams "admin.enterprises",
+                            "enterprise",
+                            @enterprise,
+                            Api::Admin::EnterpriseSerializer
     end
 
     def admin_inject_enterprises
-      admin_inject_json_ams_array("ofn.admin", "my_enterprises", @my_enterprises, Api::Admin::BasicEnterpriseSerializer) +
-        admin_inject_json_ams_array("ofn.admin", "all_enterprises", @all_enterprises, Api::Admin::BasicEnterpriseSerializer)
+      admin_inject_json_ams_array("ofn.admin",
+                                  "my_enterprises",
+                                  @my_enterprises,
+                                  Api::Admin::BasicEnterpriseSerializer) +
+        admin_inject_json_ams_array("ofn.admin",
+                                    "all_enterprises",
+                                    @all_enterprises,
+                                    Api::Admin::BasicEnterpriseSerializer)
     end
 
     def admin_inject_enterprise_relationships
-      admin_inject_json_ams_array "ofn.admin", "enterprise_relationships", @enterprise_relationships, Api::Admin::EnterpriseRelationshipSerializer
+      admin_inject_json_ams_array "ofn.admin",
+                                  "enterprise_relationships",
+                                  @enterprise_relationships,
+                                  Api::Admin::EnterpriseRelationshipSerializer
     end
 
     def admin_inject_enterprise_roles
-      admin_inject_json_ams_array "ofn.admin", "enterpriseRoles", @enterprise_roles, Api::Admin::EnterpriseRoleSerializer
+      admin_inject_json_ams_array "ofn.admin",
+                                  "enterpriseRoles",
+                                  @enterprise_roles,
+                                  Api::Admin::EnterpriseRoleSerializer
     end
 
     def admin_inject_payment_methods
-      admin_inject_json_ams_array "admin.paymentMethods", "paymentMethods", @payment_methods, Api::Admin::IdNameSerializer
+      admin_inject_json_ams_array "admin.paymentMethods",
+                                  "paymentMethods",
+                                  @payment_methods,
+                                  Api::Admin::IdNameSerializer
     end
 
     def admin_inject_payment_method
-      admin_inject_json_ams "admin.paymentMethods", "paymentMethod", @payment_method, Api::Admin::PaymentMethodSerializer
+      admin_inject_json_ams "admin.paymentMethods",
+                            "paymentMethod",
+                            @payment_method,
+                            Api::Admin::PaymentMethodSerializer
     end
 
     def admin_inject_shipping_methods
-      admin_inject_json_ams_array "admin.shippingMethods", "shippingMethods", @shipping_methods, Api::Admin::IdNameSerializer
+      admin_inject_json_ams_array "admin.shippingMethods",
+                                  "shippingMethods",
+                                  @shipping_methods,
+                                  Api::Admin::IdNameSerializer
     end
 
     def admin_inject_shipping_method
-      admin_inject_json_ams "admin.shippingMethods", "shippingMethod", @shipping_method, Api::Admin::ShippingMethodSerializer
+      admin_inject_json_ams "admin.shippingMethods",
+                            "shippingMethod",
+                            @shipping_method,
+                            Api::Admin::ShippingMethodSerializer
     end
 
     def admin_inject_shops(opts = {})
       opts.reverse_merge!(module: 'admin.customers')
-      admin_inject_json_ams_array opts[:module], "shops", @shops, Api::Admin::IdNameSerializer
+      admin_inject_json_ams_array opts[:module],
+                                  "shops",
+                                  @shops,
+                                  Api::Admin::IdNameSerializer
     end
 
     def admin_inject_available_countries(opts = {})
       opts.reverse_merge!(module: 'admin.customers')
-      admin_inject_json_ams_array opts[:module], 'availableCountries', available_countries, Api::CountrySerializer
+      admin_inject_json_ams_array opts[:module],
+                                  'availableCountries',
+                                  available_countries,
+                                  Api::CountrySerializer
     end
 
     def admin_inject_hubs(opts = {})
       opts.reverse_merge!(module: 'ofn.admin')
-      admin_inject_json_ams_array opts[:module], "hubs", @hubs, Api::Admin::IdNameSerializer
+      admin_inject_json_ams_array opts[:module],
+                                  "hubs",
+                                  @hubs,
+                                  Api::Admin::IdNameSerializer
     end
 
     def admin_inject_producers(opts = {})
       opts.reverse_merge!(module: 'ofn.admin')
-      admin_inject_json_ams_array opts[:module], "producers", @producers, Api::Admin::IdNameSerializer
+      admin_inject_json_ams_array opts[:module],
+                                  "producers",
+                                  @producers,
+                                  Api::Admin::IdNameSerializer
     end
 
     def admin_inject_inventory_items(opts = { module: 'ofn.admin' })
-      admin_inject_json_ams_array opts[:module], "inventoryItems", @inventory_items, Api::Admin::InventoryItemSerializer
+      admin_inject_json_ams_array opts[:module],
+                                  "inventoryItems",
+                                  @inventory_items,
+                                  Api::Admin::InventoryItemSerializer
     end
 
     def admin_inject_column_preferences(opts = {})
       opts.reverse_merge!(module: 'ofn.admin', action: "#{controller_name}_#{action_name}")
       column_preferences = ColumnPreference.for(spree_current_user, opts[:action])
-      admin_inject_json_ams_array opts[:module], "columns", column_preferences, Api::Admin::ColumnPreferenceSerializer
+      admin_inject_json_ams_array opts[:module],
+                                  "columns",
+                                  column_preferences,
+                                  Api::Admin::ColumnPreferenceSerializer
     end
 
     def admin_inject_currency_config
-      admin_inject_json_ams 'admin.utils', "currencyConfig", {}, Api::CurrencyConfigSerializer
+      admin_inject_json_ams 'admin.utils',
+                            "currencyConfig",
+                            {},
+                            Api::CurrencyConfigSerializer
     end
 
     def admin_inject_enterprise_permissions
       permissions =
         { can_manage_shipping_methods: can?(:manage_shipping_methods, @enterprise),
-          can_manage_payment_methods:  can?(:manage_payment_methods, @enterprise),
-          can_manage_enterprise_fees:  can?(:manage_enterprise_fees, @enterprise) }
+          can_manage_payment_methods: can?(:manage_payment_methods, @enterprise),
+          can_manage_enterprise_fees: can?(:manage_enterprise_fees, @enterprise) }
 
       admin_inject_json "admin.enterprises", "enterprisePermissions", permissions
     end
 
     def admin_inject_hub_permissions
-      render partial: "admin/json/injection_ams", locals: { ngModule: "admin.variantOverrides", name: "hubPermissions", json: @hub_permissions.to_json }
+      render partial: "admin/json/injection_ams", locals: { ngModule: "admin.variantOverrides",
+                                                            name: "hubPermissions",
+                                                            json: @hub_permissions.to_json }
     end
 
     def admin_inject_products
@@ -85,46 +135,79 @@ module Admin
     end
 
     def admin_inject_tax_categories(opts = { module: 'ofn.admin' })
-      admin_inject_json_ams_array opts[:module], "tax_categories", @tax_categories, Api::Admin::TaxCategorySerializer
+      admin_inject_json_ams_array opts[:module],
+                                  "tax_categories",
+                                  @tax_categories,
+                                  Api::Admin::TaxCategorySerializer
     end
 
     def admin_inject_taxons
-      admin_inject_json_ams_array "admin.taxons", "taxons", @taxons, Api::Admin::TaxonSerializer
+      admin_inject_json_ams_array "admin.taxons",
+                                  "taxons",
+                                  @taxons,
+                                  Api::Admin::TaxonSerializer
     end
 
     def admin_inject_users
-      admin_inject_json_ams_array "ofn.admin", "users", @users, Api::Admin::UserSerializer
+      admin_inject_json_ams_array "ofn.admin",
+                                  "users",
+                                  @users,
+                                  Api::Admin::UserSerializer
     end
 
     def admin_inject_variant_overrides
-      admin_inject_json_ams_array "admin.variantOverrides", "variantOverrides", @variant_overrides, Api::Admin::VariantOverrideSerializer
+      admin_inject_json_ams_array "admin.variantOverrides",
+                                  "variantOverrides",
+                                  @variant_overrides,
+                                  Api::Admin::VariantOverrideSerializer
     end
 
     def admin_inject_order_cycle_instance
-      render partial: "admin/json/injection_ams", locals: { ngModule: 'admin.orderCycles', name: 'ocInstance', json: "{coordinator_id: '#{@order_cycle.coordinator.id}'}" }
+      render partial: "admin/json/injection_ams",
+             locals: { ngModule: 'admin.orderCycles',
+                       name: 'ocInstance',
+                       json: "{coordinator_id: '#{@order_cycle.coordinator.id}'}" }
     end
 
     def admin_inject_order_cycles
-      admin_inject_json_ams_array "admin.orders", "orderCycles", @order_cycles, Api::Admin::BasicOrderCycleSerializer, current_user: spree_current_user
+      admin_inject_json_ams_array "admin.orders",
+                                  "orderCycles",
+                                  @order_cycles,
+                                  Api::Admin::BasicOrderCycleSerializer,
+                                  current_user: spree_current_user
     end
 
     def admin_inject_spree_api_key
-      render partial: "admin/json/injection_ams", locals: { ngModule: 'admin.indexUtils', name: 'SpreeApiKey', json: "'#{@spree_api_key}'" }
+      render partial: "admin/json/injection_ams",
+             locals: { ngModule: 'admin.indexUtils',
+                       name: 'SpreeApiKey',
+                       json: "'#{@spree_api_key}'" }
     end
 
-    def admin_inject_json(ngModule, name, data)
+    def admin_inject_json(ng_module, name, data)
       json = data.to_json
-      render partial: "admin/json/injection_ams", locals: { ngModule: ngModule, name: name, json: json }
+      render partial: "admin/json/injection_ams",
+             locals: { ngModule: ng_module,
+                       name: name,
+                       json: json }
     end
 
-    def admin_inject_json_ams(ngModule, name, data, serializer, opts = {})
+    def admin_inject_json_ams(ng_module, name, data, serializer, opts = {})
       json = serializer.new(data, { scope: spree_current_user }.merge(opts)).to_json
-      render partial: "admin/json/injection_ams", locals: { ngModule: ngModule, name: name, json: json }
+      render partial: "admin/json/injection_ams",
+             locals: { ngModule: ng_module,
+                       name: name,
+                       json: json }
     end
 
-    def admin_inject_json_ams_array(ngModule, name, data, serializer, opts = {})
-      json = ActiveModel::ArraySerializer.new(data, { each_serializer: serializer, scope: spree_current_user }.merge(opts)).to_json
-      render partial: "admin/json/injection_ams", locals: { ngModule: ngModule, name: name, json: json }
+    def admin_inject_json_ams_array(ng_module, name, data, serializer, opts = {})
+      json = ActiveModel::ArraySerializer.
+        new(data, { each_serializer: serializer, scope: spree_current_user }.merge(opts)).to_json
+
+      render partial: "admin/json/injection_ams",
+             locals: { ngModule: ng_module,
+                       name: name,
+                       json: json }
     end
   end
 end

app/helpers/admin/subscriptions_helper.rb

@@ -2,6 +2,7 @@ module Admin
   module SubscriptionsHelper
     def subscriptions_setup_complete?(shops)
       return false unless shops.any?
+
       shops = shops.select{ |shop| shipping_and_payment_methods_ok?(shop) && customers_ok?(shop) }
       Schedule.joins(:order_cycles).where(order_cycles: { coordinator_id: shops }).any?
     end

app/helpers/angular_form_builder.rb

@@ -1,6 +1,7 @@
 class AngularFormBuilder < ActionView::Helpers::FormBuilder
   def ng_fields_for(record_name, *_args)
     raise "Nested ng_fields_for is not yet supported" if @fields_for_record_name.present?
+
     @fields_for_record_name = record_name
     yield self
     @fields_for_record_name = nil

app/helpers/enterprises_helper.rb

@@ -7,11 +7,13 @@ module EnterprisesHelper
 
   def current_customer
     return nil unless spree_current_user && current_distributor
+
     @current_customer ||= spree_current_user.customer_of(current_distributor)
   end
 
   def available_shipping_methods
     return [] if current_distributor.blank?
+
     shipping_methods = current_distributor.shipping_methods
 
     applicator = OpenFoodNetwork::TagRuleApplicator.new(current_distributor, "FilterShippingMethods", current_customer.andand.tag_list)
@@ -22,6 +24,7 @@ module EnterprisesHelper
 
   def available_payment_methods
     return [] if current_distributor.blank?
+
     payment_methods = current_distributor.payment_methods.available(:front_end).all
 
     filter = OpenFoodNetwork::AvailablePaymentMethodFilter.new

app/helpers/footer_links_helper.rb

@@ -2,10 +2,17 @@ require 'web/cookies_consent'
 
 module FooterLinksHelper
   def cookies_policy_link
-    link_to( t( '.footer_data_cookies_policy' ), '', 'cookies-policy-modal' => true, 'cookies-banner' => !Web::CookiesConsent.new(cookies, request.host).exists? && Spree::Config.cookies_consent_banner_toggle)
+    link_to( t( '.footer_data_cookies_policy' ),
+             '',
+             'cookies-policy-modal' => true,
+             'cookies-banner' => !Web::CookiesConsent.new(cookies, request.host).exists? &&
+                                   Spree::Config.cookies_consent_banner_toggle)
   end
 
   def privacy_policy_link
-    link_to( t( '.footer_data_privacy_policy' ), Spree::Config.privacy_policy_url, target: '_blank' )
+    link_to( t( '.footer_data_privacy_policy' ),
+             Spree::Config.privacy_policy_url,
+             target: '_blank',
+             rel: 'noopener' )
   end
 end

app/helpers/groups_helper.rb

@@ -1,6 +1,7 @@
 module GroupsHelper
   def link_to_service(baseurl, name, html_options = {})
     return if name.blank?
+
     html_options = html_options.merge target: '_blank'
     link_to ext_url(baseurl, name), html_options do
       yield
@@ -8,7 +9,7 @@ module GroupsHelper
   end
 
   def ext_url(prefix, url)
-    if url =~ /^https?:\/\//i
+    if url =~ %r{^https?://}i
       url
     else
       prefix + url
@@ -16,6 +17,6 @@ module GroupsHelper
   end
 
   def strip_url(url)
-    url.andand.sub(/^https?:\/\//i, '')
+    url.andand.sub(%r{^https?://}i, '')
   end
 end

app/helpers/html_helper.rb

@@ -11,7 +11,7 @@ module HtmlHelper
     # I know Cthulu is coming for me. Forgive me.
     # http://stackoverflow.com/a/1732454/2720566
     html.
-      andand.gsub(/<\/h[^>]>|<\/p>|<\/div>/, "\\1\n\n").
+      andand.gsub(%r{</h[^>]>|</p>|</div>}, "\\1\n\n").
       andand.gsub(/<br[^>]*>/, "\\1\n")
   end
 

app/helpers/serializer_helper.rb

@@ -1,6 +1,7 @@
 module SerializerHelper
   def ids_to_objs(ids)
     return [] if ids.blank?
+
     ids.map { |id| { id: id } }
   end
 

app/helpers/shop_helper.rb

@@ -20,12 +20,27 @@ module ShopHelper
     )
   end
 
-  def shop_tabs
+  def base_shop_tabs(column_sizes)
     [
-      { name: 'about', title: t(:shopping_tabs_about, distributor: current_distributor.name), cols: 6 },
-      { name: 'producers', title: t(:label_producers), cols: 2 },
-      { name: 'contact', title: t(:shopping_tabs_contact), cols: 2 },
-      { name: 'groups', title: t(:label_groups), cols: 2 },
+      { name: 'about', cols: column_sizes[0],
+        title: t(:shopping_tabs_about, distributor: current_distributor.name) },
+      { name: 'producers', cols: column_sizes[1],
+        title: t(:label_producers) },
+      { name: 'contact', cols: column_sizes[2],
+        title: t(:shopping_tabs_contact) }
     ]
   end
+
+  def tabs_with_groups
+    tabs = base_shop_tabs([6, 2, 2])
+    tabs << { name: 'groups', title: t(:label_groups), cols: 2 }
+  end
+
+  def tabs_without_groups
+    base_shop_tabs([4, 4, 4])
+  end
+
+  def shop_tabs
+    current_distributor.groups.present? ? tabs_with_groups : tabs_without_groups
+  end
 end

app/helpers/spree/admin/base_helper_decorator.rb

@@ -1,3 +1,5 @@
+require 'spree/admin/base_helper'
+
 module Spree
   module Admin
     module BaseHelper