Update all locales with the latest Transifex translations

Bumps [ffaker](https://github.com/ffaker/ffaker) from 1.32.1 to 2.11.0.
- [Release notes](https://github.com/ffaker/ffaker/releases)
- [Changelog](https://github.com/ffaker/ffaker/blob/master/Changelog.md)
- [Commits](https://github.com/ffaker/ffaker/commits)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

.github/workflows/brakeman-analysis.yml

@@ -0,0 +1,44 @@
+# This workflow integrates Brakeman with GitHub's Code Scanning feature
+# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications
+
+name: Brakeman Scan
+
+# This section configures the trigger for the workflow. Feel free to customize depending on your convention
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+jobs:
+  brakeman-scan:
+    name: Brakeman Scan
+    runs-on: ubuntu-latest
+    steps:
+    # Checkout the repository to the GitHub Actions runner
+    - name: Checkout
+      uses: actions/checkout@v2
+
+    # Customize the ruby version depending on your needs
+    - name: Setup Ruby
+      uses: actions/setup-ruby@v1
+      with:
+        ruby-version: '2.7'
+
+    - name: Setup Brakeman
+      env:
+        BRAKEMAN_VERSION: '4.10' # SARIF support is provided in Brakeman version 4.10+
+      run: |
+        gem install brakeman --version $BRAKEMAN_VERSION
+
+    # Execute Brakeman CLI and generate a SARIF output with the security issues identified during the analysis
+    - name: Scan
+      continue-on-error: true
+      run: |
+        brakeman -f sarif -o output.sarif.json .
+
+    # Upload the SARIF file generated in the previous step
+    - name: Upload SARIF
+      uses: github/codeql-action/upload-sarif@v1
+      with:
+        sarif_file: output.sarif.json

.hound.yml

@@ -0,0 +1,4 @@
+rubocop:
+  config_file: .rubocop_styleguide.yml
+scss:
+  config_file: .scss-lint.yml

.rubocop_manual_todo.yml

@@ -42,7 +42,6 @@ Layout/LineLength:
   - app/helpers/angular_form_helper.rb
   - app/helpers/checkout_helper.rb
   - app/helpers/enterprises_helper.rb
-  - app/helpers/injection_helper.rb
   - app/helpers/markdown_helper.rb
   - app/helpers/order_cycles_helper.rb
   - app/helpers/spree/orders_helper.rb
@@ -62,11 +61,10 @@ Layout/LineLength:
   - app/models/product_import/unit_converter.rb
   - app/models/proxy_order.rb
   - app/models/schedule.rb
-  - app/models/spree/app_configuration_decorator.rb
+  - app/models/spree/app_configuration.rb
   - app/models/spree/gateway/stripe_connect.rb
   - app/models/spree/image.rb
-  - app/models/spree/line_item_decorator.rb
-  - app/models/spree/order_decorator.rb
+  - app/models/spree/order.rb
   - app/models/spree/payment_method.rb
   - app/models/spree/product_decorator.rb
   - app/models/spree/user.rb
@@ -75,6 +73,7 @@ Layout/LineLength:
   - app/models/variant_override_set.rb
   - app/serializers/api/admin/subscription_line_item_serializer.rb
   - app/services/cart_service.rb
+  - app/services/checkout/post_checkout_actions.rb
   - app/services/default_stock_location.rb
   - app/services/embedded_page_service.rb
   - app/services/order_cycle_form.rb
@@ -88,6 +87,7 @@ Layout/LineLength:
   - Gemfile
   - lib/discourse/single_sign_on.rb
   - lib/open_food_network/available_payment_method_filter.rb
+  - lib/open_food_network/bulk_coop_report.rb
   - lib/open_food_network/customers_report.rb
   - lib/open_food_network/enterprise_fee_applicator.rb
   - lib/open_food_network/enterprise_fee_calculator.rb
@@ -101,7 +101,6 @@ Layout/LineLength:
   - lib/open_food_network/scope_variants_for_search.rb
   - lib/open_food_network/xero_invoices_report.rb
   - lib/spree/localized_number.rb
-  - lib/spree/product_filters.rb
   - lib/tasks/data.rake
   - lib/tasks/enterprises.rake
   - spec/controllers/admin/bulk_line_items_controller_spec.rb
@@ -263,12 +262,17 @@ Layout/LineLength:
   - spec/models/spree/adjustment_spec.rb
   - spec/models/spree/classification_spec.rb
   - spec/models/spree/gateway/stripe_connect_spec.rb
+  - spec/models/spree/inventory_unit_spec.rb
   - spec/models/spree/line_item_spec.rb
+  - spec/models/spree/order/checkout_spec.rb
+  - spec/models/spree/order_inventory_spec.rb
   - spec/models/spree/order_spec.rb
+  - spec/models/spree/order/state_machine_spec.rb
   - spec/models/spree/payment_method_spec.rb
   - spec/models/spree/payment_spec.rb
   - spec/models/spree/product_set_spec.rb
   - spec/models/spree/product_spec.rb
+  - spec/models/spree/return_authorization_spec.rb
   - spec/models/spree/shipping_method_spec.rb
   - spec/models/spree/stock_item_spec.rb
   - spec/models/spree/taxon_spec.rb
@@ -298,6 +302,7 @@ Layout/LineLength:
   - spec/serializers/api/order_serializer_spec.rb
   - spec/services/cart_service_spec.rb
   - spec/services/checkout/form_data_adapter_spec.rb
+  - spec/services/checkout/post_checkout_actions_spec.rb
   - spec/services/embedded_page_service_spec.rb
   - spec/services/exchange_products_renderer_spec.rb
   - spec/services/order_cycle_distributed_products_spec.rb
@@ -384,17 +389,22 @@ Metrics/AbcSize:
   - app/models/proxy_order.rb
   - app/models/spree/ability.rb
   - app/models/spree/address.rb
-  - app/models/spree/line_item_decorator.rb
+  - app/models/spree/line_item.rb
   - app/models/spree/order/checkout.rb
-  - app/models/spree/order_decorator.rb
+  - app/models/spree/order_contents.rb
+  - app/models/spree/order_inventory.rb
+  - app/models/spree/order.rb
   - app/models/spree/payment/processing.rb
   - app/models/spree/payment.rb
+  - app/models/spree/preference.rb
+  - app/models/spree/preferences/preferable_class_methods.rb
+  - app/models/spree/preferences/preferable.rb
   - app/models/spree/product_decorator.rb
+  - app/models/spree/return_authorization.rb
   - app/models/spree/shipment.rb
   - app/models/spree/taxon.rb
   - app/models/spree/tax_rate.rb
   - app/models/spree/zone.rb
-  - app/serializers/api/admin/enterprise_serializer.rb
   - app/serializers/api/product_serializer.rb
   - app/serializers/api/variant_serializer.rb
   - app/services/cart_service.rb
@@ -452,6 +462,7 @@ Metrics/AbcSize:
   - spec/services/order_checkout_restart_spec.rb
   - spec/support/i18n_translations_checker.rb
   - spec/support/performance_helper.rb
+  - spec/support/request/web_helper.rb
 
 Metrics/BlockLength:
   Max: 25
@@ -516,7 +527,11 @@ Metrics/CyclomaticComplexity:
   - app/models/spree/order/checkout.rb
   - app/models/spree/payment_method.rb
   - app/models/spree/payment.rb
+  - app/models/spree/preference.rb
+  - app/models/spree/preferences/preferable.rb
+  - app/models/spree/preferences/preferable_class_methods.rb
   - app/models/spree/product_decorator.rb
+  - app/models/spree/return_authorization.rb
   - app/models/spree/zone.rb
   - app/models/variant_override_set.rb
   - app/services/cart_service.rb
@@ -550,7 +565,10 @@ Metrics/PerceivedComplexity:
   - app/models/spree/order/checkout.rb
   - app/models/spree/payment_method.rb
   - app/models/spree/payment.rb
+  - app/models/spree/preferences/preferable.rb
+  - app/models/spree/preferences/preferable_class_methods.rb
   - app/models/spree/product_decorator.rb
+  - app/models/spree/return_authorization.rb
   - app/models/spree/zone.rb
   - app/models/variant_override_set.rb
   - app/services/cart_service.rb
@@ -576,7 +594,7 @@ Metrics/PerceivedComplexity:
   - app/models/spree/ability.rb
   - app/models/spree/address.rb
   - app/models/spree/order/checkout.rb
-  - app/models/spree/order_decorator.rb
+  - app/models/spree/order.rb
   - app/models/spree/product_decorator.rb
   - app/models/spree/zone.rb
   - engines/order_management/app/services/order_management/reports/bulk_coop/bulk_coop_report.rb
@@ -594,61 +612,6 @@ Metrics/PerceivedComplexity:
 Metrics/MethodLength:
   Max: 10
   Exclude:
-  - app/controllers/admin/enterprise_fees_controller.rb
-  - app/controllers/admin/enterprises_controller.rb
-  - app/controllers/spree/admin/taxons_controller.rb
-  - app/controllers/spree/orders_controller.rb
-  - app/helpers/checkout_helper.rb
-  - app/helpers/order_cycles_helper.rb
-  - app/helpers/spree/admin/base_helper.rb
-  - app/helpers/spree/admin/navigation_helper.rb
-  - app/models/enterprise.rb
-  - app/models/enterprise_relationship.rb
-  - app/models/spree/ability.rb
-  - app/models/spree/address.rb
-  - app/models/spree/order/checkout.rb
-  - app/models/spree/payment_method.rb
-  - app/models/spree/payment.rb
-  - app/models/spree/product_decorator.rb
-  - app/models/spree/zone.rb
-  - app/models/variant_override_set.rb
-  - app/services/cart_service.rb
-  - engines/order_management/app/services/order_management/reports/bulk_coop/bulk_coop_report.rb
-  - engines/order_management/app/services/order_management/stock/estimator.rb
-  - lib/active_merchant/billing/gateways/stripe_payment_intents.rb
-  - lib/discourse/single_sign_on.rb
-  - lib/open_food_network/enterprise_issue_validator.rb
-  - lib/spree/core/calculated_adjustments.rb
-  - lib/spree/core/controller_helpers/order.rb
-  - lib/spree/core/controller_helpers/respond_with.rb
-  - lib/spree/core/controller_helpers/ssl.rb
-  - lib/spree/localized_number.rb
-  - spec/models/product_importer_spec.rb
-  - app/controllers/admin/enterprises_controller.rb
-  - app/controllers/api/variants_controller.rb
-  - app/controllers/spree/admin/taxons_controller.rb
-  - app/controllers/spree/orders_controller.rb
-  - app/helpers/checkout_helper.rb
-  - app/helpers/order_cycles_helper.rb
-  - app/helpers/spree/admin/navigation_helper.rb
-  - app/models/enterprise_relationship.rb
-  - app/models/spree/ability.rb
-  - app/models/spree/address.rb
-  - app/models/spree/order/checkout.rb
-  - app/models/spree/order_decorator.rb
-  - app/models/spree/product_decorator.rb
-  - app/models/spree/zone.rb
-  - engines/order_management/app/services/order_management/reports/bulk_coop/bulk_coop_report.rb
-  - engines/order_management/app/services/order_management/stock/estimator.rb
-  - lib/active_merchant/billing/gateways/stripe_payment_intents.rb
-  - lib/discourse/single_sign_on.rb
-  - lib/open_food_network/enterprise_issue_validator.rb
-  - lib/spree/core/calculated_adjustments.rb
-  - lib/spree/core/controller_helpers/order.rb
-  - lib/spree/core/controller_helpers/respond_with.rb
-  - lib/spree/core/controller_helpers/ssl.rb
-  - lib/spree/localized_number.rb
-  - spec/models/product_importer_spec.rb
   - app/controllers/admin/contents_controller.rb
   - app/controllers/admin/customers_controller.rb
   - app/controllers/admin/enterprise_fees_controller.rb
@@ -698,10 +661,17 @@ Metrics/MethodLength:
   - app/models/spree/address.rb
   - app/models/spree/credit_card.rb
   - app/models/spree/order/checkout.rb
-  - app/models/spree/order_decorator.rb
+  - app/models/spree/order_contents.rb
+  - app/models/spree/order_inventory.rb
+  - app/models/spree/order.rb
   - app/models/spree/payment_method.rb
   - app/models/spree/payment/processing.rb
+  - app/models/spree/preference.rb
+  - app/models/spree/preferences/preferable_class_methods.rb
+  - app/models/spree/preferences/preferable.rb
+  - app/models/spree/preferences/store.rb
   - app/models/spree/product_decorator.rb
+  - app/models/spree/return_authorization.rb
   - app/models/spree/shipment.rb
   - app/models/spree/taxon.rb
   - app/models/spree/tax_rate.rb
@@ -782,6 +752,8 @@ Metrics/ClassLength:
   - app/models/spree/ability.rb
   - app/models/spree/address.rb
   - app/models/spree/credit_card.rb
+  - app/models/spree/line_item.rb
+  - app/models/spree/order.rb
   - app/models/spree/payment.rb
   - app/models/spree/shipment.rb
   - app/models/spree/user.rb
@@ -811,40 +783,18 @@ Metrics/ModuleLength:
   - app/helpers/spree/admin/navigation_helper.rb
   - app/models/spree/order/checkout.rb
   - app/models/spree/payment/processing.rb
-  - engines/order_management/spec/services/order_management/order/updater_spec.rb
-  - engines/order_management/spec/services/order_management/stock/package_spec.rb
-  - engines/order_management/spec/services/order_management/subscriptions/estimator_spec.rb
-  - engines/order_management/spec/services/order_management/subscriptions/form_spec.rb
   - engines/order_management/spec/services/order_management/subscriptions/proxy_order_syncer_spec.rb
-  - engines/order_management/spec/services/order_management/subscriptions/summarizer_spec.rb
   - engines/order_management/spec/services/order_management/subscriptions/validator_spec.rb
-  - engines/order_management/spec/services/order_management/subscriptions/variants_list_spec.rb
   - lib/open_food_network/column_preference_defaults.rb
   - spec/controllers/admin/order_cycles_controller_spec.rb
-  - spec/controllers/api/order_cycles_controller_spec.rb
   - spec/controllers/api/orders_controller_spec.rb
-  - spec/controllers/spree/admin/payment_methods_controller_spec.rb
-  - spec/lib/open_food_network/address_finder_spec.rb
-  - spec/lib/open_food_network/customers_report_spec.rb
-  - spec/lib/open_food_network/enterprise_fee_calculator_spec.rb
   - spec/lib/open_food_network/order_cycle_form_applicator_spec.rb
   - spec/lib/open_food_network/order_cycle_permissions_spec.rb
-  - spec/lib/open_food_network/order_grouper_spec.rb
-  - spec/lib/open_food_network/packing_report_spec.rb
-  - spec/lib/open_food_network/permissions_spec.rb
-  - spec/lib/open_food_network/products_and_inventory_report_spec.rb
-  - spec/lib/open_food_network/scope_variant_to_hub_spec.rb
-  - spec/lib/open_food_network/tag_rule_applicator_spec.rb
-  - spec/lib/open_food_network/user_balance_calculator_spec.rb
-  - spec/lib/open_food_network/users_and_enterprises_report_spec.rb
   - spec/models/spree/adjustment_spec.rb
   - spec/models/spree/credit_card_spec.rb
   - spec/models/spree/line_item_spec.rb
   - spec/models/spree/product_spec.rb
-  - spec/models/spree/shipping_method_spec.rb
   - spec/models/spree/variant_spec.rb
-  - spec/services/permissions/order_spec.rb
-  - spec/services/variant_units/option_value_namer_spec.rb
 
 Metrics/ParameterLists:
   Max: 5
@@ -853,3 +803,9 @@ Metrics/ParameterLists:
   - app/models/product_import/entry_processor.rb
   - lib/open_food_network/xero_invoices_report.rb
   - spec/features/admin/reports_spec.rb
+
+Lint/UselessAssignment:
+  Exclude:
+  - 'spec/**/*'
+  - 'app/models/spree/taxon.rb'
+  - 'lib/spree/core/controller_helpers/common.rb'

.rubocop_specs.yml

@@ -0,0 +1,7 @@
+inherit_from:
+  - .rubocop.yml
+
+# This rubocop config file is only used for specs
+# Here we allow specs to be 300 lines long
+Metrics/ModuleLength:
+  Max: 300

.rubocop_todo.yml

@@ -1,144 +1,11 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config --exclude-limit 1400`
-# on 2020-10-14 09:49:36 +0100 using RuboCop version 0.81.0.
+# on 2020-10-30 17:18:53 +0000 using RuboCop version 0.81.0.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
 
-# Offense count: 3
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, IndentationWidth.
-# SupportedStyles: with_first_argument, with_fixed_indentation
-Layout/ArgumentAlignment:
-  Exclude:
-    - 'spec/models/spree/address_spec.rb'
-    - 'spec/models/spree/order/checkout_spec.rb'
-
-# Offense count: 1
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyleAlignWith.
-# SupportedStylesAlignWith: either, start_of_block, start_of_line
-Layout/BlockAlignment:
-  Exclude:
-    - 'spec/models/spree/order/checkout_spec.rb'
-
-# Offense count: 3
-# Cop supports --auto-correct.
-Layout/EmptyLines:
-  Exclude:
-    - 'spec/features/admin/variants_spec.rb'
-    - 'spec/models/spree/payment_spec.rb'
-
-# Offense count: 4
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: empty_lines, no_empty_lines
-Layout/EmptyLinesAroundBlockBody:
-  Exclude:
-    - 'spec/models/spree/payment_spec.rb'
-    - 'spec/models/spree/zone_spec.rb'
-
-# Offense count: 3
-# Cop supports --auto-correct.
-# Configuration parameters: AllowForAlignment, AllowBeforeTrailingComments, ForceEqualSignAlignment.
-Layout/ExtraSpacing:
-  Exclude:
-    - 'spec/models/spree/payment_spec.rb'
-    - 'spec/requests/api/orders_spec.rb'
-
-# Offense count: 2
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, IndentationWidth.
-# SupportedStyles: special_inside_parentheses, consistent, align_brackets
-Layout/FirstArrayElementIndentation:
-  Exclude:
-    - 'spec/views/spree/admin/payment_methods/index.html.haml_spec.rb'
-
-# Offense count: 3
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, IndentationWidth.
-# SupportedStyles: special_inside_parentheses, consistent, align_braces
-Layout/FirstHashElementIndentation:
-  Exclude:
-    - 'spec/models/spree/payment_spec.rb'
-    - 'spec/swagger_helper.rb'
-
-# Offense count: 8
-# Cop supports --auto-correct.
-# Configuration parameters: AllowMultipleStyles, EnforcedHashRocketStyle, EnforcedColonStyle, EnforcedLastArgumentHashStyle.
-# SupportedHashRocketStyles: key, separator, table
-# SupportedColonStyles: key, separator, table
-# SupportedLastArgumentHashStyles: always_inspect, always_ignore, ignore_implicit, ignore_explicit
-Layout/HashAlignment:
-  Exclude:
-    - 'spec/lib/open_food_network/packing_report_spec.rb'
-    - 'spec/models/spree/payment_spec.rb'
-
-# Offense count: 1
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: normal, indented_internal_methods
-Layout/IndentationConsistency:
-  Exclude:
-    - 'spec/models/spree/order/checkout_spec.rb'
-
-# Offense count: 1
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: symmetrical, new_line, same_line
-Layout/MultilineHashBraceLayout:
-  Exclude:
-    - 'spec/models/spree/payment_spec.rb'
-
-# Offense count: 1
-# Cop supports --auto-correct.
-# Configuration parameters: AllowForAlignment, EnforcedStyleForExponentOperator.
-# SupportedStylesForExponentOperator: space, no_space
-Layout/SpaceAroundOperators:
-  Exclude:
-    - 'spec/models/spree/payment_spec.rb'
-
-# Offense count: 1
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, EnforcedStyleForEmptyBraces, SpaceBeforeBlockParameters.
-# SupportedStyles: space, no_space
-# SupportedStylesForEmptyBraces: space, no_space
-Layout/SpaceInsideBlockBraces:
-  Exclude:
-    - 'spec/models/spree/payment_spec.rb'
-
-# Offense count: 11
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, EnforcedStyleForEmptyBraces.
-# SupportedStyles: space, no_space, compact
-# SupportedStylesForEmptyBraces: space, no_space
-Layout/SpaceInsideHashLiteralBraces:
-  Exclude:
-    - 'spec/models/spree/payment_spec.rb'
-    - 'spec/requests/api/orders_spec.rb'
-    - 'spec/services/checkout/form_data_adapter_spec.rb'
-    - 'spec/services/user_locale_setter_spec.rb'
-
-# Offense count: 3
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: final_newline, final_blank_line
-Layout/TrailingEmptyLines:
-  Exclude:
-    - 'spec/factories.rb'
-    - 'spec/factories/address_factory.rb'
-    - 'spec/support/request/stripe_helper.rb'
-
-# Offense count: 6
-# Cop supports --auto-correct.
-# Configuration parameters: AllowInHeredoc.
-Layout/TrailingWhitespace:
-  Exclude:
-    - 'spec/features/consumer/shopping/shopping_spec.rb'
-    - 'spec/lib/open_food_network/orders_and_fulfillments_report/customer_totals_report_spec.rb'
-    - 'spec/requests/api/orders_spec.rb'
-
 # Offense count: 2
 Lint/DuplicateMethods:
   Exclude:
@@ -152,20 +19,6 @@ Lint/IneffectiveAccessModifier:
     - 'app/services/mail_configuration.rb'
     - 'lib/open_food_network/feature_toggle.rb'
 
-# Offense count: 1
-# Cop supports --auto-correct.
-# Configuration parameters: IgnoreEmptyBlocks, AllowUnusedKeywordArguments.
-Lint/UnusedBlockArgument:
-  Exclude:
-    - 'spec/factories/stock_location_factory.rb'
-
-# Offense count: 4
-# Cop supports --auto-correct.
-# Configuration parameters: AllowUnusedKeywordArguments, IgnoreEmptyMethods, IgnoreNotImplementedMethods.
-Lint/UnusedMethodArgument:
-  Exclude:
-    - 'spec/views/spree/admin/payment_methods/index.html.haml_spec.rb'
-
 # Offense count: 3
 # Configuration parameters: ContextCreatingMethods, MethodCreatingMethods.
 Lint/UselessAccessModifier:
@@ -174,19 +27,20 @@ Lint/UselessAccessModifier:
     - 'app/services/mail_configuration.rb'
     - 'lib/open_food_network/feature_toggle.rb'
 
-# Offense count: 1
+# Offense count: 2
 Lint/UselessAssignment:
   Exclude:
     - 'spec/**/*'
-    - 'lib/spree/core/controller_helpers/common.rb'
     - 'app/models/spree/taxon.rb'
+    - 'lib/spree/core/controller_helpers/common.rb'
 
-# Offense count: 9
+# Offense count: 10
 Naming/AccessorMethodName:
   Exclude:
     - 'app/controllers/spree/admin/taxonomies_controller.rb'
     - 'app/models/spree/adjustment.rb'
-    - 'app/models/spree/order_decorator.rb'
+    - 'app/models/spree/order.rb'
+    - 'app/services/checkout/post_checkout_actions.rb'
     - 'lib/spree/core/controller_helpers/common.rb'
     - 'spec/support/request/shop_workflow.rb'
     - 'spec/support/request/web_helper.rb'
@@ -206,7 +60,7 @@ Naming/MemoizedInstanceVariableName:
     - 'app/mailers/producer_mailer.rb'
     - 'lib/open_food_network/address_finder.rb'
 
-# Offense count: 20
+# Offense count: 24
 # Configuration parameters: NamePrefix, ForbiddenPrefixes, AllowedMethods, MethodDefinitionMacros.
 # NamePrefix: is_, has_, have_
 # ForbiddenPrefixes: is_, has_, have_
@@ -220,10 +74,11 @@ Naming/PredicateName:
     - 'app/models/order_cycle.rb'
     - 'app/models/spree/adjustment.rb'
     - 'app/models/spree/credit_card.rb'
-    - 'app/models/spree/line_item_decorator.rb'
-    - 'app/models/spree/order_decorator.rb'
+    - 'app/models/spree/line_item.rb'
+    - 'app/models/spree/order.rb'
     - 'app/models/spree/payment_method.rb'
     - 'app/models/spree/preferences/file_configuration.rb'
+    - 'app/models/spree/preferences/preferable.rb'
     - 'app/models/spree/shipping_method.rb'
     - 'app/models/spree/user.rb'
     - 'lib/open_food_network/customers_report.rb'
@@ -262,21 +117,14 @@ Rails/Date:
     - 'app/models/order_cycle.rb'
     - 'app/models/spree/credit_card.rb'
 
-# Offense count: 1
+# Offense count: 2
 # Cop supports --auto-correct.
 # Configuration parameters: EnforceForPrefixed.
 Rails/Delegate:
   Exclude:
+    - 'app/models/spree/line_item.rb'
     - 'engines/order_management/app/services/order_management/reports/bulk_coop/renderers/html_renderer.rb'
 
-# Offense count: 1
-# Cop supports --auto-correct.
-# Configuration parameters: Whitelist.
-# Whitelist: find_by_sql
-Rails/DynamicFindBy:
-  Exclude:
-    - 'spec/factories/state_factory.rb'
-
 # Offense count: 16
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: slashes, arguments
@@ -307,13 +155,12 @@ Rails/FindBy:
     - 'app/models/product_import/spreadsheet_data.rb'
     - 'app/models/spree/user.rb'
 
-# Offense count: 2
+# Offense count: 1
 # Cop supports --auto-correct.
 # Configuration parameters: Include.
 # Include: app/models/**/*.rb
 Rails/FindEach:
   Exclude:
-    - 'app/models/spree/order_decorator.rb'
     - 'app/models/spree/shipment.rb'
 
 # Offense count: 9
@@ -324,13 +171,13 @@ Rails/HasAndBelongsToMany:
     - 'app/models/concerns/payment_method_distributors.rb'
     - 'app/models/enterprise.rb'
     - 'app/models/enterprise_group.rb'
-    - 'app/models/spree/line_item_decorator.rb'
+    - 'app/models/spree/line_item.rb'
     - 'app/models/spree/role.rb'
     - 'app/models/spree/shipping_method.rb'
     - 'app/models/spree/user.rb'
     - 'app/models/spree/zone.rb'
 
-# Offense count: 35
+# Offense count: 38
 # Configuration parameters: Include.
 # Include: app/models/**/*.rb
 Rails/HasManyOrHasOneDependent:
@@ -341,9 +188,10 @@ Rails/HasManyOrHasOneDependent:
     - 'app/models/spree/address.rb'
     - 'app/models/spree/adjustment.rb'
     - 'app/models/spree/credit_card.rb'
-    - 'app/models/spree/order_decorator.rb'
+    - 'app/models/spree/order.rb'
     - 'app/models/spree/payment_method.rb'
     - 'app/models/spree/property.rb'
+    - 'app/models/spree/return_authorization.rb'
     - 'app/models/spree/shipment.rb'
     - 'app/models/spree/shipping_category.rb'
     - 'app/models/spree/shipping_method.rb'
@@ -392,7 +240,7 @@ Rails/LexicallyScopedActionFilter:
     - 'app/controllers/spree/users_controller.rb'
     - 'app/controllers/user_passwords_controller.rb'
 
-# Offense count: 13
+# Offense count: 14
 Rails/OutputSafety:
   Exclude:
     - 'app/controllers/spree/admin/reports_controller.rb'
@@ -415,15 +263,16 @@ Rails/RakeEnvironment:
     - 'lib/capistrano/tasks/**/*.rake'
     - 'lib/tasks/specs.rake'
 
-# Offense count: 9
+# Offense count: 11
 Rails/ReflectionClassName:
   Exclude:
     - 'app/models/customer.rb'
     - 'app/models/distributor_shipping_method.rb'
     - 'app/models/enterprise_role.rb'
+    - 'app/models/spree/order.rb'
     - 'app/models/subscription.rb'
 
-# Offense count: 243
+# Offense count: 247
 # Configuration parameters: Blacklist, Whitelist.
 # Blacklist: decrement!, decrement_counter, increment!, increment_counter, toggle!, touch, update_all, update_attribute, update_column, update_columns, update_counters
 Rails/SkipsModelValidations:
@@ -442,7 +291,8 @@ Rails/SkipsModelValidations:
     - 'app/models/spree/address.rb'
     - 'app/models/spree/adjustment.rb'
     - 'app/models/spree/credit_card.rb'
-    - 'app/models/spree/order_decorator.rb'
+    - 'app/models/spree/inventory_unit.rb'
+    - 'app/models/spree/order.rb'
     - 'app/models/spree/payment.rb'
     - 'app/models/spree/shipment.rb'
     - 'app/models/spree/shipping_method.rb'
@@ -480,7 +330,6 @@ Rails/SkipsModelValidations:
     - 'spec/features/admin/order_cycles/complex_editing_spec.rb'
     - 'spec/features/admin/order_cycles/simple_spec.rb'
     - 'spec/features/admin/order_spec.rb'
-    - 'spec/features/admin/payments_spec.rb'
     - 'spec/features/admin/reports_spec.rb'
     - 'spec/features/consumer/caching/shops_caching_spec.rb'
     - 'spec/features/consumer/shopping/checkout_spec.rb'
@@ -501,6 +350,7 @@ Rails/SkipsModelValidations:
     - 'spec/models/spree/adjustment_spec.rb'
     - 'spec/models/spree/asset_spec.rb'
     - 'spec/models/spree/line_item_spec.rb'
+    - 'spec/models/spree/order_inventory_spec.rb'
     - 'spec/models/spree/order_spec.rb'
     - 'spec/models/spree/tax_category_spec.rb'
     - 'spec/models/spree/variant_spec.rb'
@@ -533,7 +383,7 @@ Rails/UniqueValidationWithoutIndex:
 # Environments: development, test, production
 Rails/UnknownEnv:
   Exclude:
-    - 'app/models/spree/app_configuration_decorator.rb'
+    - 'app/models/spree/app_configuration.rb'
     - 'lib/spree/core/controller_helpers/ssl.rb'
 
 # Offense count: 2
@@ -542,7 +392,7 @@ Style/CaseEquality:
     - 'app/helpers/angular_form_helper.rb'
     - 'spec/models/spree/payment_spec.rb'
 
-# Offense count: 64
+# Offense count: 29
 # Cop supports --auto-correct.
 # Configuration parameters: AutoCorrect, EnforcedStyle.
 # SupportedStyles: nested, compact
@@ -557,40 +407,6 @@ Style/ClassAndModuleChildren:
     - 'app/models/tag_rule/filter_payment_methods.rb'
     - 'app/models/tag_rule/filter_shipping_methods.rb'
     - 'app/serializers/api/address_serializer.rb'
-    - 'app/serializers/api/admin/basic_enterprise_fee_serializer.rb'
-    - 'app/serializers/api/admin/basic_enterprise_serializer.rb'
-    - 'app/serializers/api/admin/basic_order_cycle_serializer.rb'
-    - 'app/serializers/api/admin/calculator/flat_percent_item_total_serializer.rb'
-    - 'app/serializers/api/admin/calculator_serializer.rb'
-    - 'app/serializers/api/admin/column_preference_serializer.rb'
-    - 'app/serializers/api/admin/customer_serializer.rb'
-    - 'app/serializers/api/admin/enterprise_fee_serializer.rb'
-    - 'app/serializers/api/admin/enterprise_relationship_permission_serializer.rb'
-    - 'app/serializers/api/admin/enterprise_relationship_serializer.rb'
-    - 'app/serializers/api/admin/enterprise_role_serializer.rb'
-    - 'app/serializers/api/admin/enterprise_serializer.rb'
-    - 'app/serializers/api/admin/exchange_serializer.rb'
-    - 'app/serializers/api/admin/for_order_cycle/enterprise_serializer.rb'
-    - 'app/serializers/api/admin/for_order_cycle/supplied_product_serializer.rb'
-    - 'app/serializers/api/admin/id_name_serializer.rb'
-    - 'app/serializers/api/admin/id_serializer.rb'
-    - 'app/serializers/api/admin/index_enterprise_serializer.rb'
-    - 'app/serializers/api/admin/inventory_item_serializer.rb'
-    - 'app/serializers/api/admin/line_item_serializer.rb'
-    - 'app/serializers/api/admin/order_cycle_serializer.rb'
-    - 'app/serializers/api/admin/order_serializer.rb'
-    - 'app/serializers/api/admin/payment_method/base_serializer.rb'
-    - 'app/serializers/api/admin/payment_method/stripe_serializer.rb'
-    - 'app/serializers/api/admin/product_serializer.rb'
-    - 'app/serializers/api/admin/shipping_method_serializer.rb'
-    - 'app/serializers/api/admin/tag_rule_serializer.rb'
-    - 'app/serializers/api/admin/tax_category_serializer.rb'
-    - 'app/serializers/api/admin/taxon_serializer.rb'
-    - 'app/serializers/api/admin/units_product_serializer.rb'
-    - 'app/serializers/api/admin/units_variant_serializer.rb'
-    - 'app/serializers/api/admin/user_serializer.rb'
-    - 'app/serializers/api/admin/variant_override_serializer.rb'
-    - 'app/serializers/api/admin/variant_serializer.rb'
     - 'app/serializers/api/country_serializer.rb'
     - 'app/serializers/api/currency_config_serializer.rb'
     - 'app/serializers/api/current_order_serializer.rb'
@@ -624,7 +440,7 @@ Style/FormatStringToken:
     - 'lib/open_food_network/sales_tax_report.rb'
     - 'spec/features/admin/bulk_order_management_spec.rb'
 
-# Offense count: 818
+# Offense count: 765
 # Cop supports --auto-correct.
 # Configuration parameters: EnforcedStyle.
 # SupportedStyles: always, always_true, never
@@ -816,13 +632,10 @@ Style/FrozenStringLiteralComment:
     - 'app/models/product_import/unit_converter.rb'
     - 'app/models/proxy_order.rb'
     - 'app/models/schedule.rb'
-    - 'app/models/spree/app_configuration_decorator.rb'
     - 'app/models/spree/gateway/migs.rb'
     - 'app/models/spree/gateway/pin.rb'
     - 'app/models/spree/gateway/stripe_connect.rb'
-    - 'app/models/spree/line_item_decorator.rb'
     - 'app/models/spree/option_type_decorator.rb'
-    - 'app/models/spree/order_decorator.rb'
     - 'app/models/spree/preferences/file_configuration.rb'
     - 'app/models/spree/price_decorator.rb'
     - 'app/models/spree/product_decorator.rb'
@@ -845,48 +658,6 @@ Style/FrozenStringLiteralComment:
     - 'app/models/variant_override_set.rb'
     - 'app/serializers/api/address_serializer.rb'
     - 'app/serializers/api/adjustment_serializer.rb'
-    - 'app/serializers/api/admin/basic_enterprise_fee_serializer.rb'
-    - 'app/serializers/api/admin/basic_enterprise_serializer.rb'
-    - 'app/serializers/api/admin/basic_order_cycle_serializer.rb'
-    - 'app/serializers/api/admin/calculator/flat_percent_item_total_serializer.rb'
-    - 'app/serializers/api/admin/calculator_serializer.rb'
-    - 'app/serializers/api/admin/column_preference_serializer.rb'
-    - 'app/serializers/api/admin/customer_serializer.rb'
-    - 'app/serializers/api/admin/enterprise_fee_serializer.rb'
-    - 'app/serializers/api/admin/enterprise_relationship_permission_serializer.rb'
-    - 'app/serializers/api/admin/enterprise_relationship_serializer.rb'
-    - 'app/serializers/api/admin/enterprise_role_serializer.rb'
-    - 'app/serializers/api/admin/enterprise_serializer.rb'
-    - 'app/serializers/api/admin/exchange_serializer.rb'
-    - 'app/serializers/api/admin/for_order_cycle/enterprise_serializer.rb'
-    - 'app/serializers/api/admin/for_order_cycle/supplied_product_serializer.rb'
-    - 'app/serializers/api/admin/id_email_serializer.rb'
-    - 'app/serializers/api/admin/id_name_serializer.rb'
-    - 'app/serializers/api/admin/id_serializer.rb'
-    - 'app/serializers/api/admin/index_enterprise_serializer.rb'
-    - 'app/serializers/api/admin/index_order_cycle_serializer.rb'
-    - 'app/serializers/api/admin/inventory_item_serializer.rb'
-    - 'app/serializers/api/admin/line_item_serializer.rb'
-    - 'app/serializers/api/admin/order_cycle_serializer.rb'
-    - 'app/serializers/api/admin/order_serializer.rb'
-    - 'app/serializers/api/admin/payment_method/base_serializer.rb'
-    - 'app/serializers/api/admin/payment_method/stripe_serializer.rb'
-    - 'app/serializers/api/admin/payment_method_serializer.rb'
-    - 'app/serializers/api/admin/product_serializer.rb'
-    - 'app/serializers/api/admin/proxy_order_serializer.rb'
-    - 'app/serializers/api/admin/schedule_serializer.rb'
-    - 'app/serializers/api/admin/shipping_method_serializer.rb'
-    - 'app/serializers/api/admin/subscription_customer_serializer.rb'
-    - 'app/serializers/api/admin/subscription_line_item_serializer.rb'
-    - 'app/serializers/api/admin/subscription_serializer.rb'
-    - 'app/serializers/api/admin/tag_rule_serializer.rb'
-    - 'app/serializers/api/admin/tax_category_serializer.rb'
-    - 'app/serializers/api/admin/taxon_serializer.rb'
-    - 'app/serializers/api/admin/units_product_serializer.rb'
-    - 'app/serializers/api/admin/units_variant_serializer.rb'
-    - 'app/serializers/api/admin/user_serializer.rb'
-    - 'app/serializers/api/admin/variant_override_serializer.rb'
-    - 'app/serializers/api/admin/variant_serializer.rb'
     - 'app/serializers/api/cached_enterprise_serializer.rb'
     - 'app/serializers/api/country_serializer.rb'
     - 'app/serializers/api/credit_card_serializer.rb'
@@ -1053,7 +824,6 @@ Style/FrozenStringLiteralComment:
     - 'lib/spree/authentication_helpers.rb'
     - 'lib/spree/localized_number.rb'
     - 'lib/spree/money_decorator.rb'
-    - 'lib/spree/product_filters.rb'
     - 'lib/stripe/account_connector.rb'
     - 'lib/stripe/profile_storer.rb'
     - 'lib/stripe/webhook_handler.rb'
@@ -1121,6 +891,7 @@ Style/FrozenStringLiteralComment:
     - 'spec/controllers/shops_controller_spec.rb'
     - 'spec/controllers/spree/admin/adjustments_controller_spec.rb'
     - 'spec/controllers/spree/admin/base_controller_spec.rb'
+    - 'spec/controllers/spree/admin/general_settings_controller_spec.rb'
     - 'spec/controllers/spree/admin/invoices_controller_spec.rb'
     - 'spec/controllers/spree/admin/mail_methods_controller_spec.rb'
     - 'spec/controllers/spree/admin/orders/customer_details_controller_spec.rb'
@@ -1274,7 +1045,6 @@ Style/FrozenStringLiteralComment:
     - 'spec/lib/open_food_network/users_and_enterprises_report_spec.rb'
     - 'spec/lib/open_food_network/xero_invoices_report_spec.rb'
     - 'spec/lib/spree/localized_number_spec.rb'
-    - 'spec/lib/spree/product_filters_spec.rb'
     - 'spec/lib/stripe/account_connector_spec.rb'
     - 'spec/lib/stripe/webhook_handler_spec.rb'
     - 'spec/lib/tasks/enterprises_rake_spec.rb'
@@ -1318,7 +1088,6 @@ Style/FrozenStringLiteralComment:
     - 'spec/models/spree/classification_spec.rb'
     - 'spec/models/spree/credit_card_spec.rb'
     - 'spec/models/spree/gateway/stripe_connect_spec.rb'
-    - 'spec/models/spree/image_spec.rb'
     - 'spec/models/spree/line_item_spec.rb'
     - 'spec/models/spree/order/checkout_spec.rb'
     - 'spec/models/spree/order_spec.rb'
@@ -1425,7 +1194,6 @@ Style/FrozenStringLiteralComment:
     - 'spec/support/products_helper.rb'
     - 'spec/support/request/admin_helper.rb'
     - 'spec/support/request/authentication_helper.rb'
-    - 'spec/support/request/checkout_helper.rb'
     - 'spec/support/request/cookie_helper.rb'
     - 'spec/support/request/distribution_helper.rb'
     - 'spec/support/request/menu_helper.rb'
@@ -1444,7 +1212,7 @@ Style/FrozenStringLiteralComment:
     - 'spec/views/spree/admin/payment_methods/index.html.haml_spec.rb'
     - 'spec/views/spree/admin/shared/_order_links.html.haml_spec.rb'
 
-# Offense count: 48
+# Offense count: 44
 # Configuration parameters: MinBodyLength.
 Style/GuardClause:
   Exclude:
@@ -1460,7 +1228,7 @@ Style/GuardClause:
     - 'app/models/enterprise.rb'
     - 'app/models/enterprise_group.rb'
     - 'app/models/producer_property.rb'
-    - 'app/models/spree/order_decorator.rb'
+    - 'app/models/spree/preferences/preferable_class_methods.rb'
     - 'app/models/spree/price_decorator.rb'
     - 'app/models/spree/product_decorator.rb'
     - 'app/services/order_syncer.rb'
@@ -1469,25 +1237,15 @@ Style/GuardClause:
     - 'lib/open_food_network/order_cycle_form_applicator.rb'
     - 'lib/open_food_network/rack_request_blocker.rb'
     - 'spec/support/delayed_job_helper.rb'
-    - 'spec/support/request/checkout_helper.rb'
     - 'spec/support/request/distribution_helper.rb'
     - 'spec/support/request/shop_workflow.rb'
 
-# Offense count: 66
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, UseHashRocketsWithSymbolValues, PreferHashRocketsForNonAlnumEndingSymbols.
-# SupportedStyles: ruby19, hash_rockets, no_mixed_keys, ruby19_no_mixed_keys
-Style/HashSyntax:
-  Exclude:
-    - 'spec/factories/stock_location_factory.rb'
-    - 'spec/models/spree/credit_card_spec.rb'
-    - 'spec/models/spree/payment_spec.rb'
-
-# Offense count: 2
+# Offense count: 3
 Style/MissingRespondToMissing:
   Exclude:
     - 'app/helpers/application_helper.rb'
     - 'app/models/spree/gateway.rb'
+    - 'app/models/spree/preferences/configuration.rb'
 
 # Offense count: 2
 Style/MixinUsage:
@@ -1495,7 +1253,7 @@ Style/MixinUsage:
     - 'lib/open_food_network/orders_and_fulfillments_report.rb'
     - 'spec/lib/open_food_network/packing_report_spec.rb'
 
-# Offense count: 36
+# Offense count: 43
 # Cop supports --auto-correct.
 # Configuration parameters: AutoCorrect, EnforcedStyle, IgnoredMethods.
 # SupportedStyles: predicate, comparison
@@ -1509,8 +1267,11 @@ Style/NumericPredicate:
     - 'app/models/product_import/product_importer.rb'
     - 'app/models/product_import/spreadsheet_entry.rb'
     - 'app/models/spree/gateway/stripe_connect.rb'
-    - 'app/models/spree/line_item_decorator.rb'
-    - 'app/models/spree/order_decorator.rb'
+    - 'app/models/spree/line_item.rb'
+    - 'app/models/spree/order.rb'
+    - 'app/models/spree/order_contents.rb'
+    - 'app/models/spree/order_inventory.rb'
+    - 'app/models/spree/preferences/preferable.rb'
     - 'app/models/spree/user.rb'
     - 'app/models/variant_override.rb'
     - 'app/services/cart_service.rb'
@@ -1523,37 +1284,7 @@ Style/NumericPredicate:
     - 'lib/spree/money_decorator.rb'
     - 'lib/tasks/sample_data.rake'
 
-# Offense count: 1
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: compact, exploded
-Style/RaiseArgs:
-  Exclude:
-    - 'spec/controllers/checkout_controller_spec.rb'
-
-# Offense count: 1
-# Cop supports --auto-correct.
-Style/RandomWithOffset:
-  Exclude:
-    - 'spec/factories.rb'
-
-# Offense count: 1
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, AllowInnerSlashes.
-# SupportedStyles: slashes, percent_r, mixed
-Style/RegexpLiteral:
-  Exclude:
-    - 'lib/spree/core/controller_helpers/auth.rb'
-
-# Offense count: 1
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: implicit, explicit
-Style/RescueStandardError:
-  Exclude:
-    - 'lib/spree/core/delegate_belongs_to.rb'
-
-# Offense count: 231
+# Offense count: 241
 Style/Send:
   Exclude:
     - 'spec/controllers/admin/subscriptions_controller_spec.rb'
@@ -1578,8 +1309,10 @@ Style/Send:
     - 'spec/models/enterprise_spec.rb'
     - 'spec/models/exchange_spec.rb'
     - 'spec/models/spree/gateway/stripe_connect_spec.rb'
+    - 'spec/models/spree/order_inventory_spec.rb'
     - 'spec/models/spree/order_spec.rb'
     - 'spec/models/spree/payment_spec.rb'
+    - 'spec/models/spree/return_authorization_spec.rb'
     - 'spec/models/spree/tax_rate_spec.rb'
     - 'spec/models/tag_rule/discount_order_spec.rb'
     - 'spec/models/tag_rule/filter_order_cycles_spec.rb'
@@ -1597,3 +1330,11 @@ Style/Send:
 Style/StructInheritance:
   Exclude:
     - 'lib/open_food_network/enterprise_fee_applicator.rb'
+
+# Offense count: 2
+# Cop supports --auto-correct.
+# Configuration parameters: IgnoredMethods.
+# IgnoredMethods: respond_to, define_method
+Style/SymbolProc:
+  Exclude:
+    - 'app/models/spree/preferences/preferable.rb'

.scss-lint.yml

@@ -1,3 +1,19 @@
 scss_files: 'app/assets/stylesheets/**/*.css.scss'
 
 exclude: 'app/assets/stylesheets/shared/**'
+
+linters:
+  ImportantRule:
+    enabled: false
+    VendorPrefix:
+      enabled: false
+    LeadingZero:
+      enabled: false
+    PropertySortOrder:
+      enabled: false
+    StringQuotes:
+      enabled: false
+    DeclarationOrder:
+      enabled: false
+    NestingDepth:
+      enabled: false

Dockerfile

@@ -1,4 +1,10 @@
-FROM ubuntu:18.04
+FROM ubuntu:20.04
+
+ENV TZ Europe/London
+
+RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
+
+RUN echo "deb http://security.ubuntu.com/ubuntu bionic-security main" >> /etc/apt/sources.list
 
 # Install all the requirements
 RUN apt-get update && apt-get install -y curl git build-essential software-properties-common wget zlib1g-dev libssl1.0-dev libreadline-dev libyaml-dev libffi-dev libxml2-dev libxslt1-dev wait-for-it imagemagick unzip

Gemfile

@@ -2,13 +2,14 @@ source 'https://rubygems.org'
 ruby "2.3.7"
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}.git" }
 
-gem 'i18n', '~> 0.6.11'
+gem 'i18n'
 gem 'i18n-js', '~> 3.8.0'
-gem 'rails', '~> 4.0.13'
-gem 'rails-i18n', '~> 4.0'
+gem 'rails', '~> 4.2'
+gem 'rails-i18n'
 gem 'rails_safe_tasks', '~> 1.0'
 
 gem "activerecord-import"
+gem 'responders', '~> 2.0'
 
 gem "catalog", path: "./engines/catalog"
 gem 'dfc_provider', path: './engines/dfc_provider'
@@ -18,26 +19,19 @@ gem 'web', path: './engines/web'
 gem 'activerecord-postgresql-adapter'
 gem 'pg', '~> 0.21.0'
 
-# OFN-maintained and patched version of Spree v2.0.4. See
-# https://github.com/openfoodfoundation/openfoodnetwork/wiki/Tech-Doc:-OFN's-Spree-fork%F0%9F%8D%B4
-# for details.
-gem 'spree_core', github: 'openfoodfoundation/spree', branch: '2-1-0-stable'
-
-### Dependencies brought from spree core
-gem 'acts_as_list', '= 0.2.0'
-gem 'awesome_nested_set', '~> 3.0.0.rc.1'
+gem 'acts_as_list', '= 0.3.0'
+gem 'awesome_nested_set', '~> 3.2.1'
 gem 'cancan', '~> 1.6.10'
-gem 'ffaker', '~> 1.16'
-gem 'highline', '= 1.6.18' # Necessary for the install generator
-gem 'httparty', '~> 0.18' # Used to check alerts in spree_core, this is not used in OFN.
-gem 'json', '>= 1.7.7'
-gem 'money', '5.1.1'
+gem 'ffaker'
+gem 'highline', '2.0.3' # Necessary for the install generator
+gem 'json'
+gem 'money', '< 6.1.0'
 gem 'paranoia', '~> 2.0'
 gem 'ransack', '~> 1.8.10'
-gem 'state_machine', '1.2.0'
-gem 'stringex', '~> 1.5.1'
+gem 'state_machines-activerecord'
+gem 'stringex', '~> 2.8.5'
 
-gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
+gem 'spree_i18n', github: 'openfoodfoundation/spree_i18n', branch: '1-3-stable'
 
 # Our branch contains the following changes:
 # - Pass customer email and phone number to PayPal (merged to upstream master)
@@ -61,20 +55,17 @@ gem 'daemons'
 gem 'delayed_job_active_record'
 gem 'delayed_job_web'
 
-# Spree's default pagination gem (locked to the current version used by Spree)
-# We use it's methods in OFN code as well, so this is a direct dependency
-gem 'kaminari', '~> 0.14.1'
+gem 'kaminari', '~> 0.17.0'
 
 gem 'andand'
 gem 'angularjs-rails', '1.5.5'
-gem 'aws-sdk', '1.11.1' # temporarily locked down due to https://github.com/aws/aws-sdk-ruby/issues/273
+gem 'aws-sdk', '1.67.0'
 gem 'bugsnag'
 gem 'db2fog'
 gem 'haml'
 gem 'redcarpet'
 gem 'sass'
 gem 'sass-rails'
-gem 'truncate_html', '0.9.2'
 gem 'unicorn'
 
 gem 'actionpack-action_caching'
@@ -100,7 +91,6 @@ gem 'combine_pdf'
 gem 'wicked_pdf'
 gem 'wkhtmltopdf-binary'
 
-gem 'foreigner'
 gem 'immigrant'
 gem 'roo', '~> 2.8.3'
 

Gemfile.lock

@@ -6,12 +6,11 @@ GIT
 
 GIT
   remote: https://github.com/openfoodfoundation/better_spree_paypal_express.git
-  revision: 1736e3268239a841576d2719a1f276cf9b74c5c5
+  revision: 1a477e9f7763297944cc99b6f4dd3d962aa963e9
   branch: 2-1-0-stable
   specs:
     spree_paypal_express (2.0.3)
       paypal-sdk-merchant (= 1.106.1)
-      spree_core (~> 2.1.0)
 
 GIT
   remote: https://github.com/openfoodfoundation/ofn-qz.git
@@ -21,39 +20,13 @@ GIT
     ofn-qz (0.1.0)
 
 GIT
-  remote: https://github.com/openfoodfoundation/spree.git
-  revision: cbb24a6ed701166ffaf2ab60a402154100d74766
-  branch: 2-1-0-stable
-  specs:
-    spree_core (2.1.0)
-      activemerchant (= 1.78.0)
-      acts_as_list (= 0.2.0)
-      awesome_nested_set (~> 3.0.0.rc.1)
-      aws-sdk (= 1.11.1)
-      cancan (~> 1.6.10)
-      ffaker (~> 1.16)
-      highline (= 1.6.18)
-      httparty (~> 0.11)
-      json (>= 1.7.7)
-      kaminari (~> 0.14.1)
-      money (= 5.1.1)
-      paperclip (~> 3.4.1)
-      paranoia (~> 2.0)
-      rails (~> 4.0)
-      ransack (~> 1.0)
-      state_machine (= 1.2.0)
-      stringex (~> 1.5.1)
-      truncate_html (= 0.9.2)
-
-GIT
-  remote: https://github.com/spree/spree_i18n.git
-  revision: 752eb67204e9c5a4e22b62591a8fd55fe2285e43
+  remote: https://github.com/openfoodfoundation/spree_i18n.git
+  revision: 12f18312232f0ce70270d47859d2951d12f7791c
   branch: 1-3-stable
   specs:
     spree_i18n (1.0.0)
       i18n (~> 0.5)
       rails-i18n
-      spree_core (>= 1.1)
 
 PATH
   remote: engines/catalog
@@ -82,33 +55,44 @@ GEM
   remote: https://rubygems.org/
   specs:
     CFPropertyList (2.3.6)
-    actionmailer (4.0.13)
-      actionpack (= 4.0.13)
+    actionmailer (4.2.11.3)
+      actionpack (= 4.2.11.3)
+      actionview (= 4.2.11.3)
+      activejob (= 4.2.11.3)
       mail (~> 2.5, >= 2.5.4)
-    actionpack (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-      erubis (~> 2.7.0)
-      rack (~> 1.5.2)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+    actionpack (4.2.11.3)
+      actionview (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
+      rack (~> 1.6)
       rack-test (~> 0.6.2)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
     actionpack-action_caching (1.2.1)
       actionpack (>= 4.0.0)
+    actionview (4.2.11.3)
+      activesupport (= 4.2.11.3)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.3)
     active_model_serializers (0.8.4)
       activemodel (>= 3.0)
+    activejob (4.2.11.3)
+      activesupport (= 4.2.11.3)
+      globalid (>= 0.3.0)
     activemerchant (1.78.0)
       activesupport (>= 3.2.14, < 6.x)
       builder (>= 2.1.2, < 4.0.0)
       i18n (>= 0.6.9)
       nokogiri (~> 1.4)
-    activemodel (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-    activerecord (4.0.13)
-      activemodel (= 4.0.13)
-      activerecord-deprecated_finders (~> 1.0.2)
-      activesupport (= 4.0.13)
-      arel (~> 4.0.0)
-    activerecord-deprecated_finders (1.0.4)
+    activemodel (4.2.11.3)
+      activesupport (= 4.2.11.3)
+      builder (~> 3.1)
+    activerecord (4.2.11.3)
+      activemodel (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
+      arel (~> 6.0)
     activerecord-import (1.0.7)
       activerecord (>= 3.2)
     activerecord-postgresql-adapter (0.0.1)
@@ -119,18 +103,20 @@ GEM
       multi_json (~> 1.11, >= 1.11.2)
       rack (>= 1.5.2, < 3)
       railties (>= 4.0)
-    activesupport (4.0.13)
-      i18n (~> 0.6, >= 0.6.9)
-      minitest (~> 4.2)
-      multi_json (~> 1.3)
-      thread_safe (~> 0.1)
-      tzinfo (~> 0.3.37)
+    activesupport (4.2.11.3)
+      i18n (~> 0.7)
+      minitest (~> 5.1)
+      thread_safe (~> 0.3, >= 0.3.4)
+      tzinfo (~> 1.1)
     acts-as-taggable-on (4.0.0)
       activerecord (>= 4.0)
-    acts_as_list (0.2.0)
+    acts_as_list (0.3.0)
       activerecord (>= 3.0)
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
+    aliyun-sdk (0.8.0)
+      nokogiri (~> 1.6)
+      rest-client (~> 2.0)
     andand (1.3.3)
     angular-rails-templates (0.3.0)
       railties (>= 3.1)
@@ -138,20 +124,21 @@ GEM
       tilt
     angularjs-file-upload-rails (2.4.1)
     angularjs-rails (1.5.5)
-    arel (4.0.2)
+    arel (6.0.4)
     ast (2.4.0)
     atomic (1.1.101)
-    awesome_nested_set (3.0.3)
-      activerecord (>= 4.0.0, < 5)
+    awesome_nested_set (3.2.1)
+      activerecord (>= 4.0.0, < 7.0)
     awesome_print (1.8.0)
-    aws-sdk (1.11.1)
+    aws-sdk (1.67.0)
+      aws-sdk-v1 (= 1.67.0)
+    aws-sdk-v1 (1.67.0)
       json (~> 1.4)
-      nokogiri (>= 1.4.4)
-      uuidtools (~> 2.1)
-    bcrypt (3.1.13)
-    bugsnag (6.17.0)
+      nokogiri (~> 1)
+    bcrypt (3.1.16)
+    bugsnag (6.18.0)
       concurrent-ruby (~> 1.0)
-    builder (3.1.4)
+    builder (3.2.4)
     byebug (11.0.1)
     cancan (1.6.10)
     capybara (2.18.0)
@@ -163,7 +150,7 @@ GEM
       xpath (>= 2.0, < 4.0)
     childprocess (3.0.0)
     chronic (0.10.2)
-    chunky_png (1.3.11)
+    chunky_png (1.3.14)
     climate_control (0.2.0)
     cocaine (0.5.8)
       climate_control (>= 0.0.3, < 1.0)
@@ -195,6 +182,7 @@ GEM
       sprockets (< 4.0)
     concurrent-ruby (1.1.7)
     crack (0.4.4)
+    crass (1.0.6)
     css_parser (1.7.1)
       addressable
     daemons (1.3.1)
@@ -228,24 +216,26 @@ GEM
       devise (>= 2.1.0)
     devise-token_authenticatable (0.4.10)
       devise (>= 3.5.2, < 4.0.0)
-    diff-lcs (1.3)
+    diff-lcs (1.4.4)
     docile (1.3.2)
+    domain_name (0.5.20190701)
+      unf (>= 0.0.5, < 1.0.0)
     dry-inflector (0.1.2)
     erubis (2.7.0)
     eventmachine (1.2.7)
-    excon (0.71.1)
+    excon (0.78.0)
     execjs (2.7.0)
     factory_bot (4.10.0)
       activesupport (>= 3.0.0)
     factory_bot_rails (4.10.0)
       factory_bot (~> 4.10.0)
       railties (>= 3.0.0)
-    faraday (1.0.0)
+    faraday (1.0.1)
       multipart-post (>= 1.2, < 3)
-    ffaker (1.32.1)
-    ffi (1.12.2)
-    figaro (1.1.1)
-      thor (~> 0.14)
+    ffaker (2.11.0)
+    ffi (1.13.1)
+    figaro (1.2.0)
+      thor (>= 0.14.0, < 2)
     fission (0.5.0)
       CFPropertyList (~> 2.2)
     fog (1.41.0)
@@ -282,7 +272,8 @@ GEM
       fog-xml (~> 0.1.1)
       ipaddress (~> 0.5)
       json (>= 1.8, < 2.0)
-    fog-aliyun (0.3.5)
+    fog-aliyun (0.3.19)
+      aliyun-sdk (~> 0.8.0)
       fog-core
       fog-json
       ipaddress (~> 0.8)
@@ -328,7 +319,7 @@ GEM
       fog-core
       fog-json
       fog-xml
-    fog-internet-archive (0.0.1)
+    fog-internet-archive (0.0.2)
       fog-core
       fog-json
       fog-xml
@@ -385,7 +376,7 @@ GEM
     fog-voxel (0.1.0)
       fog-core
       fog-xml
-    fog-vsphere (3.2.1)
+    fog-vsphere (3.4.0)
       fog-core
       rbvmomi (>= 1.9, < 3)
     fog-xenserver (1.0.0)
@@ -395,8 +386,6 @@ GEM
     fog-xml (0.1.3)
       fog-core
       nokogiri (>= 1.5.11, < 2.0.0)
-    foreigner (1.7.4)
-      activerecord (>= 3.0.0)
     formatador (0.2.5)
     foundation-icons-sass-rails (3.0.0)
       railties (>= 3.1.1)
@@ -408,19 +397,22 @@ GEM
       rspec-core (~> 3.0)
       ruby-progressbar (~> 1.4)
     geocoder (1.6.4)
-    get_process_mem (0.2.5)
+    get_process_mem (0.2.7)
       ffi (~> 1.0)
+    globalid (0.4.2)
+      activesupport (>= 4.2.0)
     gmaps4rails (2.1.2)
     haml (5.2.0)
       temple (>= 0.8.0)
       tilt
     hashdiff (1.0.1)
-    highline (1.6.18)
+    highline (2.0.3)
     hike (1.2.3)
-    httparty (0.18.1)
-      mime-types (~> 3.0)
-      multi_xml (>= 0.5.2)
-    i18n (0.6.11)
+    http-accept (1.7.0)
+    http-cookie (1.0.3)
+      domain_name (~> 0.5)
+    i18n (0.9.5)
+      concurrent-ruby (~> 1.0)
     i18n-js (3.8.0)
       i18n (>= 0.6.6)
     immigrant (0.3.6)
@@ -440,7 +432,7 @@ GEM
       multi_json (~> 1.0)
       rspec (>= 2.0, < 4.0)
     jwt (2.2.2)
-    kaminari (0.14.1)
+    kaminari (0.17.0)
       actionpack (>= 3.0.0)
       activesupport (>= 3.0.0)
     kgio (2.11.3)
@@ -451,6 +443,9 @@ GEM
     letter_opener (1.7.0)
       launchy (~> 2.2)
     libv8 (7.3.492.27.1)
+    loofah (2.7.0)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.5.9)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
     method_source (0.9.2)
@@ -461,15 +456,17 @@ GEM
     mini_portile2 (2.4.0)
     mini_racer (0.2.15)
       libv8 (> 7.3)
-    minitest (4.7.5)
-    money (5.1.1)
-      i18n (~> 0.6.0)
+    minitest (5.14.2)
+    money (5.0.0)
+      i18n (~> 0.4)
+      json
     msgpack (1.3.3)
     multi_json (1.15.0)
     multi_xml (0.6.0)
     multipart-post (2.1.1)
+    netrc (0.11.0)
     newrelic_rpm (3.18.1.330)
-    nokogiri (1.10.9)
+    nokogiri (1.10.10)
       mini_portile2 (~> 2.4.0)
     oauth2 (1.4.4)
       faraday (>= 0.8, < 2.0)
@@ -478,7 +475,7 @@ GEM
       multi_xml (~> 0.5)
       rack (>= 1.2, < 3)
     oj (3.10.8)
-    optimist (3.0.0)
+    optimist (3.0.1)
     orm_adapter (0.5.0)
     paper_trail (7.1.3)
       activerecord (>= 4.0, < 5.2)
@@ -508,7 +505,7 @@ GEM
       byebug (~> 11.0)
       pry (~> 0.10)
     public_suffix (4.0.6)
-    rack (1.5.5)
+    rack (1.6.13)
     rack-mini-profiler (2.0.2)
       rack (>= 1.2.0)
     rack-protection (1.5.5)
@@ -518,21 +515,32 @@ GEM
       rack
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.0.13)
-      actionmailer (= 4.0.13)
-      actionpack (= 4.0.13)
-      activerecord (= 4.0.13)
-      activesupport (= 4.0.13)
+    rails (4.2.11.3)
+      actionmailer (= 4.2.11.3)
+      actionpack (= 4.2.11.3)
+      actionview (= 4.2.11.3)
+      activejob (= 4.2.11.3)
+      activemodel (= 4.2.11.3)
+      activerecord (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.0.13)
-      sprockets-rails (~> 2.0)
-    rails-i18n (4.0.5)
-      i18n (~> 0.6)
+      railties (= 4.2.11.3)
+      sprockets-rails
+    rails-deprecated_sanitizer (1.0.3)
+      activesupport (>= 4.2.0.alpha)
+    rails-dom-testing (1.0.9)
+      activesupport (>= 4.2.0, < 5.0)
+      nokogiri (~> 1.6)
+      rails-deprecated_sanitizer (>= 1.0.1)
+    rails-html-sanitizer (1.3.0)
+      loofah (~> 2.3)
+    rails-i18n (4.0.9)
+      i18n (~> 0.7)
       railties (~> 4.0)
     rails_safe_tasks (1.0.0)
-    railties (4.0.13)
-      actionpack (= 4.0.13)
-      activesupport (= 4.0.13)
+    railties (4.2.11.3)
+      actionpack (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
     rainbow (3.0.0)
@@ -543,10 +551,10 @@ GEM
       activerecord (>= 3.0, < 5.2)
       activesupport (>= 3.0, < 5.2)
       i18n
-    rb-fsevent (0.10.3)
+    rb-fsevent (0.10.4)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rbvmomi (2.2.0)
+    rbvmomi (2.4.1)
       builder (~> 3.0)
       json (>= 1.8)
       nokogiri (~> 1.5)
@@ -554,41 +562,47 @@ GEM
     redcarpet (3.5.0)
     request_store (1.5.0)
       rack (>= 1.4)
-    responders (1.1.2)
-      railties (>= 3.2, < 4.2)
+    responders (2.4.1)
+      actionpack (>= 4.2.0, < 6.0)
+      railties (>= 4.2.0, < 6.0)
+    rest-client (2.1.0)
+      http-accept (>= 1.7.0, < 2.0)
+      http-cookie (>= 1.0.2, < 2.0)
+      mime-types (>= 1.16, < 4.0)
+      netrc (~> 0.8)
     rexml (3.2.4)
-    roadie (3.4.0)
+    roadie (3.5.1)
       css_parser (~> 1.4)
-      nokogiri (~> 1.5)
+      nokogiri (~> 1.8)
     roadie-rails (1.3.0)
       railties (>= 3.0, < 5.3)
       roadie (~> 3.1)
     roo (2.8.3)
       nokogiri (~> 1)
       rubyzip (>= 1.3.0, < 3.0.0)
-    rspec (3.9.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-    rspec-core (3.9.1)
-      rspec-support (~> 3.9.1)
-    rspec-expectations (3.9.0)
+    rspec (3.10.0)
+      rspec-core (~> 3.10.0)
+      rspec-expectations (~> 3.10.0)
+      rspec-mocks (~> 3.10.0)
+    rspec-core (3.10.0)
+      rspec-support (~> 3.10.0)
+    rspec-expectations (3.10.0)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-mocks (3.9.1)
+      rspec-support (~> 3.10.0)
+    rspec-mocks (3.10.0)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-rails (3.9.1)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      railties (>= 3.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-      rspec-support (~> 3.9.0)
+      rspec-support (~> 3.10.0)
+    rspec-rails (4.0.1)
+      actionpack (>= 4.2)
+      activesupport (>= 4.2)
+      railties (>= 4.2)
+      rspec-core (~> 3.9)
+      rspec-expectations (~> 3.9)
+      rspec-mocks (~> 3.9)
+      rspec-support (~> 3.9)
     rspec-retry (0.6.2)
       rspec-core (> 3.3)
-    rspec-support (3.9.2)
+    rspec-support (3.10.0)
     rswag (2.3.1)
       rswag-api (= 2.3.1)
       rswag-specs (= 2.3.1)
@@ -630,8 +644,8 @@ GEM
     selenium-webdriver (3.142.7)
       childprocess (>= 0.5, < 4.0)
       rubyzip (>= 1.2.2)
-    shoulda-matchers (3.1.3)
-      activesupport (>= 4.0.0)
+    shoulda-matchers (4.0.1)
+      activesupport (>= 4.2.0)
     simplecov (0.17.1)
       docile (~> 1.1)
       json (>= 1.8, < 3)
@@ -653,21 +667,30 @@ GEM
       actionpack (>= 3.0)
       activesupport (>= 3.0)
       sprockets (>= 2.8, < 4.0)
-    state_machine (1.2.0)
-    stringex (1.5.1)
-    stripe (5.25.0)
+    state_machines (0.5.0)
+    state_machines-activemodel (0.7.1)
+      activemodel (>= 4.1)
+      state_machines (>= 0.5.0)
+    state_machines-activerecord (0.6.0)
+      activerecord (>= 4.1)
+      state_machines-activemodel (>= 0.5.0)
+    stringex (2.8.5)
+    stripe (5.28.0)
     temple (0.8.2)
     test-prof (0.7.5)
-    test-unit (3.3.6)
+    test-unit (3.3.7)
       power_assert
     thor (0.20.3)
     thread_safe (0.3.6)
     tilt (1.4.1)
     timecop (0.9.2)
-    truncate_html (0.9.2)
-    tzinfo (0.3.57)
+    tzinfo (1.2.8)
+      thread_safe (~> 0.1)
     uglifier (4.2.0)
       execjs (>= 0.3.0, < 3)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.7.7)
     unicode-display_width (1.7.0)
     unicorn (5.7.0)
       kgio (~> 2.6)
@@ -678,14 +701,13 @@ GEM
     unicorn-worker-killer (0.4.4)
       get_process_mem (~> 0)
       unicorn (>= 4, < 6)
-    uuidtools (2.1.5)
     warden (1.2.7)
       rack (>= 1.0)
     webdrivers (4.2.0)
       nokogiri (~> 1.6)
       rubyzip (>= 1.3.0)
       selenium-webdriver (>= 3.0, < 4.0)
-    webmock (3.9.3)
+    webmock (3.10.0)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
@@ -696,8 +718,8 @@ GEM
     wkhtmltopdf-binary (0.12.5)
     xml-simple (1.1.5)
     xmlrpc (0.3.0)
-    xpath (2.1.0)
-      nokogiri (~> 1.3)
+    xpath (3.2.0)
+      nokogiri (~> 1.8)
 
 PLATFORMS
   ruby
@@ -710,15 +732,15 @@ DEPENDENCIES
   activerecord-postgresql-adapter
   activerecord-session_store
   acts-as-taggable-on (~> 4.0)
-  acts_as_list (= 0.2.0)
+  acts_as_list (= 0.3.0)
   andand
   angular-rails-templates (~> 0.3.0)
   angularjs-file-upload-rails (~> 2.4.1)
   angularjs-rails (= 1.5.5)
   atomic
-  awesome_nested_set (~> 3.0.0.rc.1)
+  awesome_nested_set (~> 3.2.1)
   awesome_print
-  aws-sdk (= 1.11.1)
+  aws-sdk (= 1.67.0)
   bugsnag
   byebug (~> 11.0.0)
   cancan (~> 1.6.10)
@@ -742,31 +764,29 @@ DEPENDENCIES
   dfc_provider!
   eventmachine (>= 1.2.3)
   factory_bot_rails (= 4.10.0)
-  ffaker (~> 1.16)
+  ffaker
   figaro
-  foreigner
   foundation-icons-sass-rails
   foundation-rails (= 5.5.2.1)
   fuubar (~> 2.5.0)
   geocoder
   gmaps4rails
   haml
-  highline (= 1.6.18)
-  httparty (~> 0.18)
-  i18n (~> 0.6.11)
+  highline (= 2.0.3)
+  i18n
   i18n-js (~> 3.8.0)
   immigrant
   jquery-migrate-rails
   jquery-rails (= 3.1.5)
   jquery-ui-rails (~> 4.2)
-  json (>= 1.7.7)
+  json
   json_spec (~> 1.1.4)
   jwt (~> 2.2)
-  kaminari (~> 0.14.1)
+  kaminari (~> 0.17.0)
   knapsack
   letter_opener (>= 1.4.1)
   mini_racer (= 0.2.15)
-  money (= 5.1.1)
+  money (< 6.1.0)
   newrelic_rpm (~> 3.0)
   oauth2 (~> 1.4.4)
   ofn-qz!
@@ -781,11 +801,12 @@ DEPENDENCIES
   rack-mini-profiler (< 3.0.0)
   rack-rewrite
   rack-ssl
-  rails (~> 4.0.13)
-  rails-i18n (~> 4.0)
+  rails (~> 4.2)
+  rails-i18n
   rails_safe_tasks (~> 1.0)
   ransack (~> 1.8.10)
   redcarpet
+  responders (~> 2.0)
   roadie-rails (~> 1.3.0)
   roo (~> 2.8.3)
   rspec-rails (>= 3.5.2)
@@ -799,18 +820,16 @@ DEPENDENCIES
   selenium-webdriver
   shoulda-matchers
   simplecov
-  spree_core!
   spree_i18n!
   spree_paypal_express!
   spring
   spring-commands-rspec
-  state_machine (= 1.2.0)
-  stringex (~> 1.5.1)
+  state_machines-activerecord
+  stringex (~> 2.8.5)
   stripe
   test-prof
   test-unit (~> 3.3)
   timecop
-  truncate_html (= 0.9.2)
   uglifier (>= 1.0.3)
   unicorn
   unicorn-rails

README.md

@@ -16,7 +16,7 @@ We're part of global movement - get involved!
 
 ## Contributing
 
-If you are interested in contributing to the OFN in any capacity, please introduce yourself [on Slack][slack-invite], and have a look through our [Contributor Guide][contributor-guide].
+If you are interested in contributing to the OFN in any capacity, please introduce yourself [on Slack][slack-invite], and have a look through the [OFN Handbook][ofn-handbook].
 
 Our [GETTING_STARTED](GETTING_STARTED.md) and [CONTRIBUTING](CONTRIBUTING.md) guides are the best place to start for developers looking to set up a development environment and make contributions to the codebase.
 
@@ -33,7 +33,9 @@ We also have a [Super Admin Guide][super-admin-guide] to help with configuration
 
 ## Testing
 
-We use [BrowserStack](https://www.browserstack.com/) as a manual testing tool. BrowserStack provides open source projects with unlimited and free of charge accounts. A big thanks to them!
+If you'd like to help out with testing, please introduce yourself on the #testing channel on [Slack][slack-invite] and download the [ZenHub browser extension][zenhub] to view the development pipeline.
+
+We use [BrowserStack](https://www.browserstack.com/) as a manual testing tool. BrowserStack provides open source projects with unlimited and free of charge accounts. A big thanks to them! 
 
 ## Licence
 
@@ -41,7 +43,8 @@ Copyright (c) 2012 - 2020 Open Food Foundation, released under the AGPL licence.
 
 [survey]: https://docs.google.com/a/eaterprises.com.au/forms/d/1zxR5vSiU9CigJ9cEaC8-eJLgYid8CR8er7PPH9Mc-30/edit#
 [slack-invite]: https://join.slack.com/t/openfoodnetwork/shared_invite/zt-9sjkjdlu-r02kUMP1zbrTgUhZhYPF~A
-[contributor-guide]: https://ofn-user-guide.gitbook.io/ofn-contributor-guide/who-are-we
+[ofn-handbook]: https://ofn-user-guide.gitbook.io/ofn-handbook/
 [ofn-install]: https://github.com/openfoodfoundation/ofn-install
 [super-admin-guide]: https://ofn-user-guide.gitbook.io/ofn-super-admin-guide
 [welcome-dev]: https://github.com/openfoodfoundation/openfoodnetwork/projects/27
+[zenhub]: https://www.zenhub.com/extension

app/assets/javascripts/admin/all.js

@@ -34,7 +34,7 @@
 //= require css_browser_selector_dev
 //= require responsive-tables
 //= require admin/spree_paypal_express
-//= require handlebars
+//= require admin/spree/handlebar_extensions
 
 // OFN specific
 //= require_tree ../templates/admin

app/assets/javascripts/admin/bulk_product_update.js.coffee

@@ -104,7 +104,7 @@ angular.module("ofn.admin").controller "AdminProductEditCtrl", ($scope, $timeout
   $scope.$watch 'sortOptions', (sort) ->
     return unless sort && sort.predicate != ""
 
-    $scope.sorting = sort.getSortingExpr()
+    $scope.q.sorting = sort.getSortingExpr()
     $scope.fetchProducts()
   , true
 

app/assets/javascripts/admin/customers/controllers/customers_controller.js.coffee

@@ -47,3 +47,8 @@ angular.module("admin.customers").controller "customersCtrl", ($scope, $q, $filt
         tag.text.toLowerCase().indexOf(query.toLowerCase()) != -1
       defer.resolve filtered
     defer.promise
+
+  $scope.displayBalanceStatus = (customer) ->
+    return unless customer.balance_status
+
+    t('admin.customers.index.' + customer.balance_status)

app/assets/javascripts/admin/enterprises/directives/terms_and_conditions_warning.js.coffee

@@ -0,0 +1,30 @@
+angular.module("admin.enterprises").directive 'termsAndConditionsWarning', ($compile, $templateCache, DialogDefaults, $timeout) ->
+  restrict: 'A'
+  scope: true
+
+  link: (scope, element, attr) ->
+    # This file input click handler will hold the browser file input dialog and show a warning modal
+    scope.hold_file_input_and_show_warning_modal = (event) ->
+      event.preventDefault()
+      scope.template = $compile($templateCache.get('admin/modals/terms_and_conditions_warning.html'))(scope)
+      if scope.template.dialog
+        scope.template.dialog(DialogDefaults)
+        scope.template.dialog('open')
+      scope.$apply()
+
+    element.bind 'click', scope.hold_file_input_and_show_warning_modal
+
+    # When the user presses continue in the warning modal, we open the browser file input dialog
+    scope.continue = ->
+      scope.template.dialog('close')
+
+      # unbind warning modal handler and click file input again to open the browser file input dialog
+      element.unbind('click').trigger('click')
+      # afterwards, bind warning modal handler again so that the warning is shown the next time
+      $timeout ->
+        element.bind 'click', scope.hold_file_input_and_show_warning_modal
+      return
+
+    scope.close = ->
+      scope.template.dialog('close')
+      return

app/assets/javascripts/admin/products/services/variant_unit_manager.js.coffee

@@ -1,4 +1,4 @@
-angular.module("admin.products").factory "VariantUnitManager", ->
+angular.module("admin.products").factory "VariantUnitManager", (availableUnits) ->
   class VariantUnitManager
     @units:
       'weight':
@@ -29,12 +29,13 @@ angular.module("admin.products").factory "VariantUnitManager", ->
           system: 'metric'
 
     @variantUnitOptions: ->
+      available = availableUnits.split(",")
       options = for unit_type, _ of @units
-        for scale in @unitScales(unit_type)
+        for scale in @unitScales(unit_type, available)
           name = @getUnitName(scale, unit_type)
           ["#{I18n.t(unit_type)} (#{name})", "#{unit_type}_#{scale}"]
       options.push [[I18n.t('items'), 'items']]
-      [].concat options...
+      options = [].concat options...
 
     @getScale: (value, unitType) ->
       scaledValue = null
@@ -53,8 +54,13 @@ angular.module("admin.products").factory "VariantUnitManager", ->
       else
         ''
 
-    @unitScales: (unitType) ->
-      (parseFloat(scale) for scale in Object.keys(@units[unitType])).sort (a, b) ->
+    @unitScales: (unitType, availableUnits = null) ->
+      scales = Object.keys(@units[unitType])
+      if availableUnits
+        scales = scales.filter (scale) ->
+          availableUnits.includes(VariantUnitManager.getUnitName(scale, unitType))
+
+      (parseFloat(scale) for scale in scales).sort (a, b) ->
          a - b
 
     @compatibleUnitScales: (scale, unitType) ->

app/assets/javascripts/admin/spree/base.js.erb

@@ -1,5 +1,4 @@
 //= require_self
-//= require admin/handlebar_extensions
 //= require admin/spree/orders/variant_autocomplete
 
 /**

app/assets/javascripts/admin/spree/handlebar_extensions.js

@@ -0,0 +1,9 @@
+//= require handlebars
+
+Handlebars.registerHelper("t", function(key) {
+  if (Spree.translations[key]) {
+    return Spree.translations[key]
+  } else {
+    console.error("No translation found for " + key + ". Does it exist within spree/admin/shared/_translations.html.erb?")
+  }
+});

app/assets/javascripts/darkswarm/filters/localize_currency.js.coffee

@@ -6,7 +6,7 @@ Darkswarm.filter "localizeCurrency", (currencyConfig)->
     # Set decimal points, 2 or 0 if hide_cents.
     decimals = if currencyConfig.hide_cents == "true" then 0 else 2
     # Set format if the currency symbol should come after the number, otherwise (default) use the locale setting.
-    format = if currencyConfig.symbol_position == "after" then "%n %u" else undefined
+    format = if currencyConfig.symbol_position == "after" then "%n%u" else undefined
     # We need to use parseFloat as the amount should come in as a string.
     amount = parseFloat(amount)
 

app/assets/javascripts/darkswarm/services/checkout.js.coffee

@@ -95,6 +95,10 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeE
               last_name: @order.bill_address.lastname
               save_requested_by_customer: @secrets.save_requested_by_customer
           }
+
+      if @terms_and_conditions_accepted()
+        munged_order["terms_and_conditions_accepted"] = true
+
       munged_order
 
     shippingMethod: ->
@@ -114,3 +118,7 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeE
 
     cartTotal: ->
       @order.display_total + @shippingPrice() + @paymentPrice()
+
+    terms_and_conditions_accepted: ->
+      terms_and_conditions_checkbox = angular.element("#accept_terms")[0]
+      terms_and_conditions_checkbox? && terms_and_conditions_checkbox.checked

app/assets/javascripts/templates/admin/modals/terms_and_conditions_info.html.haml

@@ -0,0 +1,13 @@
+%div
+  .margin-bottom-30.text-center
+    .text-big
+      {{ 'js.admin.modals.terms_and_conditions_info.title' | t }}
+  .margin-bottom-30
+    %p
+      {{ 'js.admin.modals.terms_and_conditions_info.message_1' | t }}
+  .margin-bottom-30
+    %p
+      {{ 'js.admin.modals.terms_and_conditions_info.message_2' | t }}
+
+  .text-center
+    %input.button.red.icon-plus{ type: 'button', value: t('js.admin.modals.got_it'), ng: { click: 'close()' } }

app/assets/javascripts/templates/admin/modals/terms_and_conditions_warning.html.haml

@@ -0,0 +1,14 @@
+%div
+  .margin-bottom-30.text-center
+    .text-big
+      {{ 'js.admin.modals.terms_and_conditions_warning.title' | t }}
+  .margin-bottom-30
+    %p
+      {{ 'js.admin.modals.terms_and_conditions_warning.message_1' | t }}
+  .margin-bottom-30
+    %p
+      {{ 'js.admin.modals.terms_and_conditions_warning.message_2' | t }}
+
+  .text-center
+    %input.button.red{ type: 'button', value: t('js.admin.modals.close'), ng: { click: 'close()' } }
+    %input.button.red{ type: 'button', value: t('js.admin.modals.continue'), ng: { click: 'continue()' } }

app/assets/javascripts/templates/partials/hub_details.html.haml

@@ -14,8 +14,9 @@
             {{'hubs_delivery' | t}}
     .row
       .columns.small-12
-        %a.cta-hub{"ng-href" => "{{::enterprise.path}}", "ng-attr-target" => "{{ embedded_layout ? '_blank' : undefined}}",
+        %a.cta-hub{"ng-href" => "{{::enterprise.path}}#/shop", "ng-attr-target" => "{{ embedded_layout ? '_blank' : undefined}}",
         "ng-class" => "{primary: enterprise.active, secondary: !enterprise.active}",
+        "ng-click" => "$close()",
         "ofn-change-hub" => "enterprise"}
           .hub-name{"ng-bind" => "::enterprise.name"}
           %span{"ng-if" => "::enterprise.active"} ({{'maps_open' | t}})

app/assets/javascripts/templates/partials/producer_details.html.haml

@@ -12,8 +12,9 @@
     .row
       .columns.small-12
         %a.cta-hub{"ng-repeat" => "hub in enterprise.hubs | filter:{id: '!'+enterprise.id} | orderBy:'-active'",
-        "ng-href" => "{{::hub.path}}", "ofn-empties-cart" => "hub",
-        "ng-class" => "::{primary: hub.active, secondary: !hub.active}"}
+        "ng-href" => "{{::hub.path}}#/shop", "ofn-empties-cart" => "hub",
+        "ng-class" => "::{primary: hub.active, secondary: !hub.active}",
+        "ng-click" => "$close()"}
           .hub-name{"ng-bind" => "::hub.name"}
           %span{"ng-if" => "::hub.active"} ({{'maps_open' | t}})
           %span{"ng-if" => "::!hub.active"} ({{'maps_closed' | t}})

app/assets/stylesheets/admin/products.scss

@@ -121,3 +121,10 @@ form#image_upload {
   }
 }
 
+form.edit_image {
+  .field {
+    img {
+      max-width: 150px;
+    }
+  }
+}

app/assets/stylesheets/admin/shared/typography.scss

@@ -154,3 +154,7 @@ input.text-big {
 .pad-top {
   padding-top: 1em;
 }
+
+.white-space-nowrap {
+  white-space: nowrap;
+}

app/assets/stylesheets/darkswarm/_shop-product-rows.scss

@@ -59,6 +59,7 @@
 
         // Variant price
         .variant-price {
+          white-space: nowrap;
           @include breakpoint(phablet) {
             padding-left: 1rem;
           }

app/assets/stylesheets/darkswarm/embedded_shopfront.scss

@@ -5,7 +5,7 @@ $large-menu-height: 4.6875rem;
 $medium-menu-height: 3rem;
 $gutter-width: 0.9375rem;
 
-nav.top-bar ul.left li.powered-by {
+.top-bar .powered-by {
   display: none;
 }
 

app/assets/stylesheets/darkswarm/menu.scss

@@ -44,6 +44,13 @@ nav.top-bar {
 
 .top-bar-section {
   border-bottom: 1px solid $light-grey-transparency;
+  display: flex;
+  justify-content: space-between;
+
+  .nav-main-menu,
+  .nav-icons-menu {
+    flex-shrink: 0;
+  }
 
   a.icon {
     &:hover {
@@ -99,21 +106,14 @@ nav.top-bar {
     }
   }
 
-  ul.center {
-    display: inline-block;
-
-    // By default, we center between the left and right uls, but we want to be centered
-    // relative to the whole page. The difference in width between the other uls is 74px,
-    // so we offset by that amount here.
-    margin-left: -74px;
-  }
-
   ul.dropdown {
     border: 1px solid $smoke;
     border-top: none;
+    left: auto;
+    right: 0;
   }
 
-  ul.right {
+  .nav-icons-menu {
     > li {
       border-left: 1px solid #ddd;
       padding: 0 14px;
@@ -244,9 +244,7 @@ nav.top-bar {
 
 .top-bar .ofn-logo img {
   height: auto;
-  width: auto;
   max-height: 44px;
-  max-width: 250px;
 }
 
 .left-off-canvas-menu {
@@ -289,10 +287,6 @@ nav.top-bar {
     .has-dropdown > a {
       padding: 0 ($topbar-height / 8) !important;
     }
-
-    ul.center {
-      margin-left: -24px;
-    }
   }
 }
 

app/controllers/admin/enterprise_fees_controller.rb

@@ -27,7 +27,7 @@ module Admin
     end
 
     def bulk_update
-      @enterprise_fee_set = EnterpriseFeeSet.new(params[:enterprise_fee_set])
+      @enterprise_fee_set = EnterpriseFeeSet.new(enterprise_fee_bulk_params)
 
       if @enterprise_fee_set.save
         redirect_to redirect_path, notice: I18n.t(:enterprise_fees_update_notice)
@@ -78,5 +78,15 @@ module Admin
 
       main_app.admin_enterprise_fees_path
     end
+
+    def enterprise_fee_bulk_params
+      params.require(:enterprise_fee_set).permit(
+        collection_attributes: [
+          :id, :enterprise_id, :fee_type, :name, :tax_category_id,
+          :inherits_tax_category, :calculator_type,
+          { calculator_attributes: PermittedAttributes::Calculator.attributes }
+        ]
+      )
+    end
   end
 end

app/controllers/admin/enterprises_controller.rb

@@ -81,14 +81,14 @@ module Admin
     end
 
     def bulk_update
-      @enterprise_set = EnterpriseSet.new(collection, params[:enterprise_set])
+      @enterprise_set = EnterpriseSet.new(collection, bulk_params)
       if @enterprise_set.save
         flash[:success] = I18n.t(:enterprise_bulk_update_success_notice)
 
         redirect_to main_app.admin_enterprises_path
       else
         touched_enterprises = @enterprise_set.collection.select(&:changed?)
-        @enterprise_set.collection.select! { |e| touched_enterprises.include? e }
+        @enterprise_set.collection.to_a.select! { |e| touched_enterprises.include? e }
         flash[:error] = I18n.t(:enterprise_bulk_update_error)
         render :index
       end
@@ -181,10 +181,10 @@ module Admin
       enterprise_payment_methods = @enterprise.payment_methods.to_a
       enterprise_shipping_methods = @enterprise.shipping_methods.to_a
       # rubocop:disable Style/TernaryParentheses
-      @payment_methods = Spree::PaymentMethod.managed_by(spree_current_user).sort_by! do |pm|
+      @payment_methods = Spree::PaymentMethod.managed_by(spree_current_user).to_a.sort_by! do |pm|
         [(enterprise_payment_methods.include? pm) ? 0 : 1, pm.name]
       end
-      @shipping_methods = Spree::ShippingMethod.managed_by(spree_current_user).sort_by! do |sm|
+      @shipping_methods = Spree::ShippingMethod.managed_by(spree_current_user).to_a.sort_by! do |sm|
         [(enterprise_shipping_methods.include? sm) ? 0 : 1, sm.name]
       end
       # rubocop:enable Style/TernaryParentheses
@@ -214,7 +214,8 @@ module Admin
           rule = @object.tag_rules.find_by(id: attrs.delete(:id)) ||
                  attrs[:type].constantize.new(enterprise: @object)
           create_calculator_for(rule, attrs) if rule.type == "TagRule::DiscountOrder" && rule.calculator.nil?
-          rule.update(attrs)
+
+          rule.update(attrs.permit(PermittedAttributes::TagRules.attributes))
         end
       end
     end
@@ -319,6 +320,12 @@ module Admin
       PermittedAttributes::Enterprise.new(params).call
     end
 
+    def bulk_params
+      params.require(:enterprise_set).permit(
+        collection_attributes: PermittedAttributes::Enterprise.attributes
+      )
+    end
+
     # Used in ResourceController#create
     def permitted_resource_params
       enterprise_params

app/controllers/admin/order_cycles_controller.rb

@@ -91,7 +91,7 @@ module Admin
 
     # Send notifications to all producers who are part of the order cycle
     def notify_producers
-      Delayed::Job.enqueue OrderCycleNotificationJob.new(params[:id].to_i)
+      OrderCycleNotificationJob.perform_later params[:id].to_i
 
       redirect_to main_app.admin_order_cycles_path,
                   notice: I18n.t(:order_cycles_email_to_producers_notice)
@@ -223,7 +223,7 @@ module Admin
     end
 
     def order_cycle_set
-      @order_cycle_set ||= OrderCycleSet.new(@order_cycles, params[:order_cycle_set])
+      @order_cycle_set ||= OrderCycleSet.new(@order_cycles, order_cycle_bulk_params)
     end
 
     def require_order_cycle_set_params
@@ -240,5 +240,11 @@ module Admin
     def order_cycle_params
       PermittedAttributes::OrderCycle.new(params).call
     end
+
+    def order_cycle_bulk_params
+      params.require(:order_cycle_set).permit(
+        collection_attributes: [:id] + PermittedAttributes::OrderCycle.basic_attributes
+      )
+    end
   end
 end

app/controllers/api/base_controller.rb

@@ -4,11 +4,12 @@ require "spree/core/controller_helpers/ssl"
 
 module Api
   class BaseController < ActionController::Metal
+    include ActionController::StrongParameters
+    include ActionController::RespondWith
     include Spree::Api::ControllerSetup
     include Spree::Core::ControllerHelpers::SSL
     include ::ActionController::Head
-
-    respond_to :json
+    include ::ActionController::ConditionalGet
 
     attr_accessor :current_api_user
 
@@ -72,7 +73,7 @@ module Api
     end
 
     def error_during_processing(exception)
-      render(text: { exception: exception.message }.to_json,
+      render(json: { exception: exception.message },
              status: :unprocessable_entity) && return
     end
 

app/controllers/api/customers_controller.rb

@@ -11,11 +11,15 @@ module Api
       @customer = Customer.find(params[:id])
       authorize! :update, @customer
 
-      if @customer.update(params[:customer])
+      if @customer.update(customer_params)
         render json: @customer, serializer: CustomerSerializer, status: :ok
       else
         invalid_resource!(@customer)
       end
     end
+
+    def customer_params
+      params.require(:customer).permit(:code, :email, :enterprise_id, :allow_charges)
+    end
   end
 end

app/controllers/api/enterprises_controller.rb

@@ -12,10 +12,10 @@ module Api
       # params[:user_ids] breaks the enterprise creation
       # We remove them from params and save them after creating the enterprise
       user_ids = params[:enterprise].delete(:user_ids)
-      @enterprise = Enterprise.new(params[:enterprise])
+      @enterprise = Enterprise.new(enterprise_params)
       if @enterprise.save
         @enterprise.user_ids = user_ids
-        render text: @enterprise.id, status: :created
+        render json: @enterprise.id, status: :created
       else
         invalid_resource!(@enterprise)
       end
@@ -25,8 +25,8 @@ module Api
       @enterprise = Enterprise.find_by(permalink: params[:id]) || Enterprise.find(params[:id])
       authorize! :update, @enterprise
 
-      if @enterprise.update(params[:enterprise])
-        render text: @enterprise.id, status: :ok
+      if @enterprise.update(enterprise_params)
+        render json: @enterprise.id, status: :ok
       else
         invalid_resource!(@enterprise)
       end
@@ -69,5 +69,9 @@ module Api
     def override_visible
       params[:enterprise][:visible] = false
     end
+
+    def enterprise_params
+      PermittedAttributes::Enterprise.new(params).call
+    end
   end
 end

app/controllers/api/order_cycles_controller.rb

@@ -20,7 +20,7 @@ module Api
         search_params
       ).products_json
 
-      render json: products
+      render plain: products, content_type: "application/json"
     rescue ProductsRenderer::NoProducts
       render_no_products
     end
@@ -31,13 +31,15 @@ module Api
         where(spree_products: { id: distributed_products }).
         select('DISTINCT spree_taxons.*')
 
-      render json: ActiveModel::ArraySerializer.new(taxons, each_serializer: Api::TaxonSerializer)
+      render plain: ActiveModel::ArraySerializer.new(
+        taxons, each_serializer: Api::TaxonSerializer
+      ).to_json, content_type: "application/json"
     end
 
     def properties
-      render json: ActiveModel::ArraySerializer.new(
+      render plain: ActiveModel::ArraySerializer.new(
         product_properties | producer_properties, each_serializer: Api::PropertySerializer
-      )
+      ).to_json, content_type: "application/json"
     end
 
     private

app/controllers/api/products_controller.rb

@@ -1,4 +1,5 @@
 require 'open_food_network/permissions'
+require 'spree/core/product_duplicator'
 
 module Api
   class ProductsController < Api::BaseController
@@ -16,7 +17,7 @@ module Api
     def create
       authorize! :create, Spree::Product
       params[:product][:available_on] ||= Time.zone.now
-      @product = Spree::Product.new(params[:product])
+      @product = Spree::Product.new(product_params)
       begin
         if @product.save
           render json: @product, serializer: Api::Admin::ProductSerializer, status: :created
@@ -32,7 +33,7 @@ module Api
     def update
       authorize! :update, Spree::Product
       @product = find_product(params[:id])
-      if @product.update(params[:product])
+      if @product.update(product_params)
         render json: @product, serializer: Api::Admin::ProductSerializer, status: :ok
       else
         invalid_resource!(@product)
@@ -144,7 +145,7 @@ module Api
     end
 
     def query_params_with_defaults
-      params[:q].to_h.reverse_merge(s: 'created_at desc')
+      (params[:q] || {}).reverse_merge(s: 'created_at desc')
     end
 
     def pagination_data(results)
@@ -155,5 +156,9 @@ module Api
         per_page: (params[:per_page] || DEFAULT_PER_PAGE).to_i
       }
     end
+
+    def product_params
+      params.require(:product).permit PermittedAttributes::Product.attributes
+    end
   end
 end

app/controllers/api/shipments_controller.rb

@@ -30,7 +30,7 @@ module Api
         @shipment.adjustment.open
       end
 
-      @shipment.update(params[:shipment])
+      @shipment.update(shipment_params[:shipment])
 
       if unlock == 'yes'
         @shipment.adjustment.close
@@ -88,7 +88,7 @@ module Api
 
     def find_and_update_shipment
       @shipment = @order.shipments.find_by!(number: params[:id])
-      @shipment.update(params[:shipment])
+      @shipment.update(shipment_params[:shipment]) if shipment_params[:shipment].present?
       @shipment.reload
     end
 
@@ -101,5 +101,12 @@ module Api
     def get_or_create_shipment(stock_location_id)
       @order.shipment || @order.shipments.create(stock_location_id: stock_location_id)
     end
+
+    def shipment_params
+      params.permit(
+        [:id, :order_id, :variant_id, :quantity,
+         { shipment: [:tracking, :selected_shipping_rate_id] }]
+      )
+    end
   end
 end

app/controllers/api/taxons_controller.rb

@@ -22,7 +22,7 @@ module Api
 
     def create
       authorize! :create, Spree::Taxon
-      @taxon = Spree::Taxon.new(params[:taxon])
+      @taxon = Spree::Taxon.new(taxon_params)
       @taxon.taxonomy_id = params[:taxonomy_id]
       taxonomy = Spree::Taxonomy.find_by(id: params[:taxonomy_id])
 
@@ -42,7 +42,7 @@ module Api
 
     def update
       authorize! :update, Spree::Taxon
-      if taxon.update(params[:taxon])
+      if taxon.update(taxon_params)
         render json: taxon, serializer: Api::TaxonSerializer, status: :ok
       else
         invalid_resource!(taxon)
@@ -66,5 +66,11 @@ module Api
     def taxon
       @taxon ||= taxonomy.taxons.find(params[:id])
     end
+
+    def taxon_params
+      return if params[:taxon].blank?
+
+      params.require(:taxon).permit([:name, :parent_id])
+    end
   end
 end

app/controllers/api/variants_controller.rb

@@ -17,7 +17,7 @@ module Api
 
     def create
       authorize! :create, Spree::Variant
-      @variant = scope.new(params[:variant])
+      @variant = scope.new(variant_params)
       if @variant.save
         render json: @variant, serializer: Api::VariantSerializer, status: :created
       else
@@ -28,7 +28,7 @@ module Api
     def update
       authorize! :update, Spree::Variant
       @variant = scope.find(params[:id])
-      if @variant.update(params[:variant])
+      if @variant.update(variant_params)
         render json: @variant, serializer: Api::VariantSerializer, status: :ok
       else
         invalid_resource!(@product)
@@ -69,5 +69,9 @@ module Api
       end
       variants
     end
+
+    def variant_params
+      params.require(:variant).permit(PermittedAttributes::Variant.attributes)
+    end
   end
 end

app/controllers/application_controller.rb

@@ -1,7 +1,13 @@
+# frozen_string_literal: true
+
+require "application_responder"
 require 'open_food_network/referer_parser'
 require_dependency 'spree/authentication_helpers'
 
 class ApplicationController < ActionController::Base
+  self.responder = ApplicationResponder
+  respond_to :html
+
   protect_from_forgery
 
   prepend_before_action :restrict_iframes
@@ -10,6 +16,12 @@ class ApplicationController < ActionController::Base
   include EnterprisesHelper
   include Spree::AuthenticationHelpers
 
+  # Helper for debugging strong_parameters
+  rescue_from ActiveModel::ForbiddenAttributesError, with: :print_params
+  def print_params
+    raise ActiveModel::ForbiddenAttributesError, params.to_s
+  end
+
   def redirect_to(options = {}, response_status = {})
     ::Rails.logger.error("Redirected by #{begin
                                             caller(1).first

app/controllers/cart_controller.rb

@@ -1,5 +1,3 @@
-require 'spree/core/controller_helpers/order'
-
 class CartController < BaseController
   before_action :check_authorization
 

app/controllers/checkout_controller.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
 require 'open_food_network/address_finder'
-require 'spree/core/gateway_error'
 
 class CheckoutController < Spree::StoreController
   layout 'darkswarm'
 
+  include OrderStockCheck
   include CheckoutHelper
   include OrderCyclesHelper
   include EnterprisesHelper
@@ -25,7 +25,7 @@ class CheckoutController < Spree::StoreController
 
   before_action :ensure_order_not_completed
   before_action :ensure_checkout_allowed
-  before_action :ensure_sufficient_stock_lines
+  before_action :handle_insufficient_stock
 
   before_action :associate_user
   before_action :check_authorization
@@ -78,13 +78,6 @@ class CheckoutController < Spree::StoreController
     redirect_to main_app.cart_path if @order.completed?
   end
 
-  def ensure_sufficient_stock_lines
-    if @order.insufficient_stock_lines.present?
-      flash[:error] = Spree.t(:inventory_error_flash_for_insufficient_quantity)
-      redirect_to main_app.cart_path
-    end
-  end
-
   def load_order
     @order = current_order
 

app/controllers/concerns/order_stock_check.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module OrderStockCheck
+  extend ActiveSupport::Concern
+
+  def handle_insufficient_stock
+    return if sufficient_stock?
+
+    flash[:error] = Spree.t(:inventory_error_flash_for_insufficient_quantity)
+    redirect_to main_app.cart_path
+  end
+
+  private
+
+  def sufficient_stock?
+    @sufficient_stock ||= @order.insufficient_stock_lines.blank?
+  end
+end

app/controllers/enterprises_controller.rb

@@ -6,6 +6,8 @@ class EnterprisesController < BaseController
   include OrderCyclesHelper
   include SerializerHelper
 
+  protect_from_forgery except: :check_permalink
+
   # These prepended filters are in the reverse order of execution
   prepend_before_action :set_order_cycles, :require_distributor_chosen, :reset_order, only: :shop
 

app/controllers/spree/admin/general_settings_controller.rb

@@ -10,6 +10,7 @@ module Spree
       end
 
       def update
+        merge_available_units_params unless params[:available_units].nil?
         params.each do |name, value|
           next unless Spree::Config.has_preference? name
 
@@ -19,6 +20,13 @@ module Spree
 
         redirect_to spree.edit_admin_general_settings_path
       end
+
+      private
+
+      def merge_available_units_params
+        params[:available_units] =
+          params[:available_units].select { |_unit, checked| checked == "1" }.keys.join(",")
+      end
     end
   end
 end

app/controllers/spree/admin/images_controller.rb

@@ -25,7 +25,7 @@ module Spree
         @object.attributes = permitted_resource_params
         if @object.save
           flash[:success] = flash_message_for(@object, :successfully_created)
-          redirect_to admin_product_images_url(params[:product_id], @url_filters)
+          redirect_to spree.admin_product_images_url(params[:product_id], @url_filters)
         else
           respond_with(@object)
         end
@@ -41,7 +41,7 @@ module Spree
 
         if @object.update(permitted_resource_params)
           flash[:success] = flash_message_for(@object, :successfully_updated)
-          redirect_to admin_product_images_url(params[:product_id], @url_filters)
+          redirect_to spree.admin_product_images_url(params[:product_id], @url_filters)
         else
           respond_with(@object)
         end
@@ -55,7 +55,7 @@ module Spree
           flash[:success] = flash_message_for(@object, :successfully_removed)
         end
 
-        redirect_to admin_product_images_url(params[:product_id], @url_filters)
+        redirect_to spree.admin_product_images_url(params[:product_id], @url_filters)
       end
 
       private

app/controllers/spree/admin/orders_controller.rb

@@ -3,7 +3,6 @@ require 'open_food_network/spree_api_key_loader'
 module Spree
   module Admin
     class OrdersController < Spree::Admin::BaseController
-      require 'spree/core/gateway_error'
       include OpenFoodNetwork::SpreeApiKeyLoader
       helper CheckoutHelper
 
@@ -44,7 +43,7 @@ module Spree
       end
 
       def update
-        unless @order.update(order_params) && @order.line_items.present?
+        unless order_params.present? && @order.update(order_params) && @order.line_items.present?
           if @order.line_items.empty?
             @order.errors.add(:line_items, Spree.t('errors.messages.blank'))
           end

app/controllers/spree/admin/payment_methods_controller.rb

@@ -15,7 +15,7 @@ module Spree
         @payment_method = params[:payment_method].
           delete(:type).
           constantize.
-          new(payment_method_params)
+          new(PermittedAttributes::PaymentMethod.new(params[:payment_method]).call)
         @object = @payment_method
 
         invoke_callbacks(:create, :before)
@@ -92,17 +92,6 @@ module Spree
 
       private
 
-      def payment_method_params
-        params.require(:payment_method).permit(
-          :name, :description, :type, :active,
-          :environment, :display_on, :tag_list,
-          :preferred_enterprise_id, :preferred_server, :preferred_login, :preferred_password,
-          :calculator_type, :preferred_api_key,
-          :preferred_signature, :preferred_solution, :preferred_landing_page, :preferred_logourl,
-          :preferred_test_mode, distributor_ids: []
-        )
-      end
-
       def force_environment
         params[:payment_method][:environment] = Rails.env unless spree_current_user.admin?
       end
@@ -127,7 +116,7 @@ module Spree
 
       def load_hubs
         # rubocop:disable Style/TernaryParentheses
-        @hubs = Enterprise.managed_by(spree_current_user).is_distributor.sort_by! do |d|
+        @hubs = Enterprise.managed_by(spree_current_user).is_distributor.to_a.sort_by! do |d|
           [(@payment_method.has_distributor? d) ? 0 : 1, d.name]
         end
         # rubocop:enable Style/TernaryParentheses
@@ -164,7 +153,7 @@ module Spree
       # Also, remove password if present and blank
       def params_for_update
         gateway_params = params[ActiveModel::Naming.param_key(@payment_method)] || {}
-        params_for_update = payment_method_params.merge(gateway_params)
+        params_for_update = params[:payment_method].merge(gateway_params)
 
         params_for_update.each do |key, _value|
           if key.include?("password") && params_for_update[key].blank?
@@ -172,7 +161,7 @@ module Spree
           end
         end
 
-        params_for_update
+        PermittedAttributes::PaymentMethod.new(params_for_update).call
       end
     end
   end

app/controllers/spree/admin/product_properties_controller.rb

@@ -16,7 +16,7 @@ module Spree
           flash[:success] = flash_message_for(@object, :successfully_removed)
         end
         # if destroy fails it won't show any errors to the user
-        redirect_to admin_product_product_properties_url(params[:product_id], @url_filters)
+        redirect_to spree.admin_product_product_properties_url(params[:product_id], @url_filters)
       end
 
       private

app/controllers/spree/admin/products_controller.rb

@@ -179,7 +179,7 @@ module Spree
       end
 
       def bulk_index_query(params)
-        params[:filters].to_h.merge(page: params[:page], per_page: params[:per_page])
+        (params[:filters] || {}).merge(page: params[:page], per_page: params[:per_page])
       end
 
       def load_form_data

app/controllers/spree/admin/reports_controller.rb

@@ -294,7 +294,7 @@ module Spree
         if report_in_order_management_engine?(report)
           main_app.public_send("new_order_management_reports_#{report}_url".to_sym)
         else
-          public_send("#{report}_admin_reports_url".to_sym)
+          spree.public_send("#{report}_admin_reports_url".to_sym)
         end
       rescue NoMethodError
         url_for([:new, :admin, :reports, report.to_s.singularize])

app/controllers/spree/admin/shipping_methods_controller.rb

@@ -50,7 +50,7 @@ module Spree
 
       def load_hubs
         # rubocop:disable Style/TernaryParentheses
-        @hubs = Enterprise.managed_by(spree_current_user).is_distributor.sort_by! do |d|
+        @hubs = Enterprise.managed_by(spree_current_user).is_distributor.to_a.sort_by! do |d|
           [(@shipping_method.has_distributor? d) ? 0 : 1, d.name]
         end
         # rubocop:enable Style/TernaryParentheses
@@ -86,12 +86,7 @@ module Spree
         params.require(:shipping_method).permit(
           :name, :description, :display_on, :require_ship_address, :tag_list, :calculator_type,
           distributor_ids: [],
-          calculator_attributes: [
-            :id, :preferred_currency, :preferred_amount, :preferred_unit_from_list,
-            :preferred_per_unit, :preferred_flat_percent, :preferred_first_item,
-            :preferred_additional_item, :preferred_max_items, :preferred_minimal_amount,
-            :preferred_normal_amount, :preferred_discount_amount
-          ]
+          calculator_attributes: PermittedAttributes::Calculator.attributes
         )
       end
     end

app/controllers/spree/admin/variants_controller.rb

@@ -21,9 +21,9 @@ module Spree
 
         if @object.update(permitted_resource_params)
           flash[:success] = flash_message_for(@object, :successfully_updated)
-          redirect_to admin_product_variants_url(params[:product_id], @url_filters)
+          redirect_to spree.admin_product_variants_url(params[:product_id], @url_filters)
         else
-          redirect_to edit_admin_product_variant_url(params[:product_id], @object, @url_filters)
+          redirect_to spree.edit_admin_product_variant_url(params[:product_id], @object, @url_filters)
         end
       end
 
@@ -40,9 +40,9 @@ module Spree
         @object.attributes = permitted_resource_params
         if @object.save
           flash[:success] = flash_message_for(@object, :successfully_created)
-          redirect_to admin_product_variants_url(params[:product_id], @url_filters)
+          redirect_to spree.admin_product_variants_url(params[:product_id], @url_filters)
         else
-          redirect_to new_admin_product_variant_url(params[:product_id], @url_filters)
+          redirect_to spree.new_admin_product_variant_url(params[:product_id], @url_filters)
         end
 
         return unless @object.present? && @object.valid?

app/controllers/spree/orders_controller.rb

@@ -1,6 +1,3 @@
-require 'spree/core/controller_helpers/order'
-require 'spree/core/controller_helpers/auth'
-
 module Spree
   class OrdersController < Spree::StoreController
     include OrderCyclesHelper

app/controllers/spree/paypal_controller_decorator.rb

@@ -1,11 +1,87 @@
 # frozen_string_literal: true
 
 Spree::PaypalController.class_eval do
+  include OrderStockCheck
+
   before_action :enable_embedded_shopfront
   before_action :destroy_orphaned_paypal_payments, only: :confirm
   after_action :reset_order_when_complete, only: :confirm
   before_action :permit_parameters!
 
+  def express
+    order = current_order || raise(ActiveRecord::RecordNotFound)
+    items = order.line_items.map(&method(:line_item))
+
+    tax_adjustments = order.adjustments.tax
+    # TODO: Remove in Spree 2.2
+    tax_adjustments = tax_adjustments.additional if tax_adjustments.respond_to?(:additional)
+    shipping_adjustments = order.adjustments.shipping
+
+    order.adjustments.eligible.each do |adjustment|
+      next if (tax_adjustments + shipping_adjustments).include?(adjustment)
+
+      items << {
+        Name: adjustment.label,
+        Quantity: 1,
+        Amount: {
+          currencyID: order.currency,
+          value: adjustment.amount
+        }
+      }
+    end
+
+    # Because PayPal doesn't accept $0 items at all.
+    # See #10
+    # https://cms.paypal.com/uk/cgi-bin/?cmd=_render-content&content_ID=developer/e_howto_api_ECCustomizing
+    # "It can be a positive or negative value but not zero."
+    items.reject! do |item|
+      item[:Amount][:value].zero?
+    end
+    pp_request = provider.build_set_express_checkout(express_checkout_request_details(order, items))
+
+    begin
+      pp_response = provider.set_express_checkout(pp_request)
+      if pp_response.success?
+        # At this point Paypal has *provisionally* accepted that the payment can now be placed,
+        # and the user will be redirected to a Paypal payment page. On completion, the user is
+        # sent back and the response is handled in the #confirm action in this controller.
+        redirect_to provider.express_checkout_url(pp_response, useraction: 'commit')
+      else
+        flash[:error] = Spree.t('flash.generic_error', scope: 'paypal', reasons: pp_response.errors.map(&:long_message).join(" "))
+        redirect_to spree.checkout_state_path(:payment)
+      end
+    rescue SocketError
+      flash[:error] = Spree.t('flash.connection_failed', scope: 'paypal')
+      redirect_to spree.checkout_state_path(:payment)
+    end
+  end
+
+  def confirm
+    @order = current_order || raise(ActiveRecord::RecordNotFound)
+
+    # At this point the user has come back from the Paypal form, and we get one
+    # last chance to interact with the payment process before the money moves...
+    return reset_to_cart unless sufficient_stock?
+
+    @order.payments.create!({
+      source: Spree::PaypalExpressCheckout.create({
+        token: params[:token],
+        payer_id: params[:PayerID]
+      }),
+      amount: @order.total,
+      payment_method: payment_method
+    })
+    @order.next
+    if @order.complete?
+      flash.notice = Spree.t(:order_processed_successfully)
+      flash[:commerce_tracking] = "nothing special"
+      session[:order_id] = nil
+      redirect_to completion_route(@order)
+    else
+      redirect_to checkout_state_path(@order.state)
+    end
+  end
+
   def cancel
     flash[:notice] = Spree.t('flash.cancel', scope: 'paypal')
     redirect_to main_app.checkout_path
@@ -21,6 +97,10 @@ Spree::PaypalController.class_eval do
 
   private
 
+  def payment_method
+    @payment_method ||= Spree::PaymentMethod.find(params[:payment_method_id])
+  end
+
   def permit_parameters!
     params.permit(:token, :payment_method_id, :PayerID)
   end
@@ -34,6 +114,11 @@ Spree::PaypalController.class_eval do
     end
   end
 
+  def reset_to_cart
+    OrderCheckoutRestart.new(@order).call
+    handle_insufficient_stock
+  end
+
   # See #1074 and #1837 for more detail on why we need this
   # An 'orphaned' Spree::Payment is created for every call to CheckoutController#update
   # for orders that are processed using a Spree::Gateway::PayPalExpress payment method
@@ -49,4 +134,24 @@ Spree::PaypalController.class_eval do
     orphaned_payments = current_order.payments.where(payment_method_id: payment_method.id, source_id: nil)
     orphaned_payments.each(&:destroy)
   end
+
+  def completion_route(order)
+    spree.order_path(order, token: order.token)
+  end
+
+  def express_checkout_request_details(order, items)
+    {
+      SetExpressCheckoutRequestDetails: {
+        InvoiceID: order.number,
+        BuyerEmail: order.email,
+        ReturnURL: spree.confirm_paypal_url(payment_method_id: params[:payment_method_id], utm_nooverride: 1),
+        CancelURL: spree.cancel_paypal_url,
+        SolutionType: payment_method.preferred_solution.presence || "Mark",
+        LandingPage: payment_method.preferred_landing_page.presence || "Billing",
+        cppheaderimage: payment_method.preferred_logourl.presence || "",
+        NoShipping: 1,
+        PaymentDetails: [payment_details(items)]
+      }
+    }
+  end
 end

app/helpers/admin/injection_helper.rb

@@ -184,6 +184,12 @@ module Admin
                        json: "'#{@spree_api_key}'" }
     end
 
+    def admin_inject_available_units
+      admin_inject_json "admin.products",
+                        "availableUnits",
+                        Spree::Config.available_units
+    end
+
     def admin_inject_json(ng_module, name, data)
       json = data.to_json
       render partial: "admin/json/injection_ams",

app/helpers/checkout_helper.rb

@@ -7,6 +7,8 @@ module CheckoutHelper
     adjustments = order.adjustments.eligible
     exclude = opts[:exclude] || {}
 
+    adjustments = adjustments.to_a
+
     # Remove empty tax adjustments and (optionally) shipping fees
     adjustments.reject! { |a| a.originator_type == 'Spree::TaxRate' && a.amount == 0 }
     adjustments.reject! { |a| a.originator_type == 'Spree::ShippingMethod' } if exclude.include? :shipping
@@ -16,7 +18,9 @@ module CheckoutHelper
     enterprise_fee_adjustments = adjustments.select { |a| a.originator_type == 'EnterpriseFee' && a.source_type != 'Spree::LineItem' }
     adjustments.reject! { |a| a.originator_type == 'EnterpriseFee' && a.source_type != 'Spree::LineItem' }
     unless exclude.include? :admin_and_handling
-      adjustments << Spree::Adjustment.new(label: I18n.t(:orders_form_admin), amount: enterprise_fee_adjustments.sum(&:amount))
+      adjustments << Spree::Adjustment.new(
+        label: I18n.t(:orders_form_admin), amount: enterprise_fee_adjustments.map(&:amount).sum
+      )
     end
 
     adjustments
@@ -24,7 +28,7 @@ module CheckoutHelper
 
   def display_checkout_admin_and_handling_adjustments_total_for(order)
     adjustments = order.adjustments.eligible.where('originator_type = ? AND source_type != ? ', 'EnterpriseFee', 'Spree::LineItem')
-    Spree::Money.new adjustments.sum(&:amount), currency: order.currency
+    Spree::Money.new adjustments.map(&:amount).sum, currency: order.currency
   end
 
   def checkout_line_item_adjustments(order)
@@ -32,7 +36,7 @@ module CheckoutHelper
   end
 
   def checkout_subtotal(order)
-    order.item_total + checkout_line_item_adjustments(order).sum(&:amount)
+    order.item_total + checkout_line_item_adjustments(order).map(&:amount).sum
   end
 
   def display_checkout_subtotal(order)

app/helpers/html_helper.rb

@@ -1,21 +0,0 @@
-module HtmlHelper
-  def strip_html(html)
-    strip_surrounding_whitespace substitute_entities strip_tags add_linebreaks html
-  end
-
-  def substitute_entities(html)
-    html.andand.gsub(/ /i, ' ').andand.gsub(/&/i, '&')
-  end
-
-  def add_linebreaks(html)
-    # I know Cthulu is coming for me. Forgive me.
-    # http://stackoverflow.com/a/1732454/2720566
-    html.
-      andand.gsub(%r{</h[^>]>|</p>|</div>}, "\\1\n\n").
-      andand.gsub(/<br[^>]*>/, "\\1\n")
-  end
-
-  def strip_surrounding_whitespace(html)
-    html.andand.strip
-  end
-end

app/helpers/injection_helper.rb

@@ -4,7 +4,7 @@ module InjectionHelper
   include SerializerHelper
 
   def inject_enterprises(enterprises = nil)
-    inject_json_ams(
+    inject_json_array(
       "enterprises",
       enterprises || default_enterprise_query,
       Api::EnterpriseSerializer,
@@ -15,7 +15,7 @@ module InjectionHelper
   def inject_groups
     select_only = required_attributes EnterpriseGroup, Api::GroupListSerializer
 
-    inject_json_ams(
+    inject_json_array(
       "groups",
       EnterpriseGroup.on_front_page.by_position.select(select_only).
         includes(enterprises: [:shipping_methods, { address: [:state, :country] }],
@@ -26,7 +26,7 @@ module InjectionHelper
   end
 
   def inject_enterprise_shopfront(enterprise)
-    inject_json_ams(
+    inject_json(
       "shopfront",
       enterprise,
       Api::EnterpriseShopfrontSerializer
@@ -36,7 +36,7 @@ module InjectionHelper
   def inject_enterprise_shopfront_list
     select_only = required_attributes Enterprise, Api::EnterpriseShopfrontListSerializer
 
-    inject_json_ams(
+    inject_json_array(
       "enterprises",
       Enterprise.activated.visible.select(select_only).includes(address: [:state, :country]).all,
       Api::EnterpriseShopfrontListSerializer
@@ -50,13 +50,13 @@ module InjectionHelper
       includes(:properties, address: [:state, :country], supplied_products: :properties).
       all
 
-    inject_json_ams "enterprises",
-                    enterprises_and_relatives,
-                    Api::EnterpriseSerializer, enterprise_injection_data
+    inject_json_array "enterprises",
+                      enterprises_and_relatives,
+                      Api::EnterpriseSerializer, enterprise_injection_data
   end
 
   def inject_group_enterprises
-    inject_json_ams(
+    inject_json_array(
       "enterprises",
       @group.enterprises.activated.all,
       Api::EnterpriseSerializer,
@@ -65,11 +65,18 @@ module InjectionHelper
   end
 
   def inject_current_hub
-    inject_json_ams "currentHub", current_distributor, Api::EnterpriseSerializer, enterprise_injection_data
+    inject_json "currentHub",
+                current_distributor,
+                Api::EnterpriseSerializer,
+                enterprise_injection_data
   end
 
   def inject_current_order
-    inject_json_ams "currentOrder", current_order, Api::CurrentOrderSerializer, current_distributor: current_distributor, current_order_cycle: current_order_cycle
+    inject_json "currentOrder",
+                current_order,
+                Api::CurrentOrderSerializer,
+                current_distributor: current_distributor,
+                current_order_cycle: current_order_cycle
   end
 
   def inject_current_order_cycle
@@ -79,73 +86,78 @@ module InjectionHelper
   end
 
   def inject_available_shipping_methods
-    inject_json_ams "shippingMethods", available_shipping_methods,
-                    Api::ShippingMethodSerializer, current_order: current_order
+    inject_json_array "shippingMethods", available_shipping_methods,
+                      Api::ShippingMethodSerializer, current_order: current_order
   end
 
   def inject_available_payment_methods
-    inject_json_ams "paymentMethods", available_payment_methods,
-                    Api::PaymentMethodSerializer, current_order: current_order
+    inject_json_array "paymentMethods", available_payment_methods,
+                      Api::PaymentMethodSerializer, current_order: current_order
   end
 
   def inject_taxons
-    inject_json_ams "taxons", Spree::Taxon.all.to_a, Api::TaxonSerializer
+    inject_json_array "taxons", Spree::Taxon.all.to_a, Api::TaxonSerializer
   end
 
   def inject_properties
-    inject_json_ams "properties", Spree::Property.all.to_a, Api::PropertySerializer
+    inject_json_array "properties", Spree::Property.all.to_a, Api::PropertySerializer
   end
 
   def inject_currency_config
-    inject_json_ams "currencyConfig", {}, Api::CurrencyConfigSerializer
+    inject_json "currencyConfig", {}, Api::CurrencyConfigSerializer
   end
 
   def inject_open_street_map_config
-    inject_json_ams "openStreetMapConfig", {}, Api::OpenStreetMapConfigSerializer
+    inject_json "openStreetMapConfig", {}, Api::OpenStreetMapConfigSerializer
   end
 
   def inject_spree_api_key
-    render partial: "json/injection_ams", locals: { name: 'spreeApiKey', json: "'#{@spree_api_key}'" }
+    render partial: "json/injection_ams",
+           locals: { name: 'spreeApiKey', json: "'#{@spree_api_key}'" }
   end
 
   def inject_available_countries
-    inject_json_ams "availableCountries", available_countries, Api::CountrySerializer
+    inject_json_array "availableCountries", available_countries, Api::CountrySerializer
   end
 
   def inject_enterprise_attributes
-    render partial: "json/injection_ams", locals: { name: 'enterpriseAttributes', json: @enterprise_attributes.to_json.to_s }
+    render partial: "json/injection_ams",
+           locals: { name: 'enterpriseAttributes', json: @enterprise_attributes.to_json.to_s }
   end
 
   def inject_orders
-    inject_json_ams "orders", @orders.all, Api::OrderSerializer
+    inject_json_array "orders", @orders.all, Api::OrderSerializer
   end
 
   def inject_shops
     customers = spree_current_user.customers
-    shops = Enterprise.where(id: @orders.pluck(:distributor_id).uniq | customers.pluck(:enterprise_id))
-    inject_json_ams "shops", shops.all, Api::ShopForOrdersSerializer
+    shops = Enterprise.where(id: @orders.pluck(:distributor_id).uniq |
+                                 customers.pluck(:enterprise_id))
+    inject_json_array "shops", shops.all, Api::ShopForOrdersSerializer
   end
 
   def inject_saved_credit_cards
     data = spree_current_user ? spree_current_user.credit_cards.with_payment_profile.all : []
 
-    inject_json_ams "savedCreditCards", data, Api::CreditCardSerializer
+    inject_json_array "savedCreditCards", data, Api::CreditCardSerializer
   end
 
   def inject_current_user
-    inject_json_ams "user", spree_current_user, Api::UserSerializer
+    inject_json "user", spree_current_user, Api::UserSerializer
   end
 
   def inject_rails_flash
-    inject_json_ams "railsFlash", OpenStruct.new(flash.to_hash), Api::RailsFlashSerializer
+    inject_json "railsFlash", OpenStruct.new(flash.to_hash), Api::RailsFlashSerializer
   end
 
-  def inject_json_ams(name, data, serializer, opts = {})
-    if data.is_a?(Array)
-      opts = { each_serializer: serializer }.merge(opts)
-      serializer = ActiveModel::ArraySerializer
-    end
+  def inject_json_array(name, data, serializer, opts = {})
+    opts = { each_serializer: serializer }.merge(opts)
+    serializer = ActiveModel::ArraySerializer
 
+    inject_json(name, data, serializer, opts)
+  end
+
+  def inject_json(name, data, serializer, opts = {})
     serializer_instance = serializer.new(data, opts)
     json = serializer_instance.to_json
     render partial: "json/injection_ams", locals: { name: name, json: json }

app/helpers/spree/admin/general_settings_helper.rb

@@ -8,6 +8,10 @@ module Spree
         end
         options_from_collection_for_select(currencies, :first, :last, Spree::Config[:currency])
       end
+
+      def all_units
+        ["g", "oz", "lb", "kg", "T", "mL", "L", "kL"]
+      end
     end
   end
 end

app/helpers/spree/admin/navigation_helper.rb

@@ -86,9 +86,9 @@ module Spree
 
       def link_to_delete(resource, options = {})
         url = options[:url] || object_url(resource)
-        name = options[:name] || Spree.t(:delete)
+        name = options[:name] || I18n.t(:delete)
         options[:class] = "delete-resource"
-        options[:data] = { confirm: Spree.t(:are_you_sure), action: 'remove' }
+        options[:data] = { confirm: I18n.t(:are_you_sure), action: 'remove' }
         link_to_with_icon 'icon-trash', name, url, options
       end
 

app/helpers/spree/admin/orders_helper.rb

@@ -113,11 +113,12 @@ module Spree
       end
 
       def event_link(event)
-        button_link_to(Spree.t(event),
+        event_label = I18n.t(event, scope: "actions")
+        confirm_message = I18n.t("admin.orders.edit.order_sure_want_to", event: event_label)
+        button_link_to(event_label,
                        fire_admin_order_url(@order, e: event),
-                       method: :put,
-                       icon: "icon-#{event}",
-                       data: { confirm: Spree.t(:order_sure_want_to, event: Spree.t(event)) })
+                       method: :put, icon: "icon-#{event}",
+                       data: { confirm: confirm_message })
       end
     end
   end

app/helpers/terms_and_conditions_helper.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module TermsAndConditionsHelper
+  def terms_and_conditions_activated?
+    current_order.distributor.terms_and_conditions.file?
+  end
+
+  def terms_and_conditions_already_accepted?
+    customer_terms_and_conditions_accepted_at = spree_current_user&.
+      customer_of(current_order.distributor)&.terms_and_conditions_accepted_at
+
+    customer_terms_and_conditions_accepted_at.present? &&
+      (customer_terms_and_conditions_accepted_at >
+        current_order.distributor.terms_and_conditions_updated_at)
+  end
+end

app/jobs/bulk_invoice_job.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class BulkInvoiceJob < ActiveJob::Base
+  def perform(order_ids, filepath)
+    pdf = CombinePDF.new
+
+    orders_from(order_ids).each do |order|
+      invoice = renderer.render_to_string(order)
+
+      pdf << CombinePDF.parse(invoice)
+    end
+
+    pdf.save filepath
+  end
+
+  private
+
+  def orders_from(order_ids)
+    Spree::Order.where(id: order_ids).order("completed_at DESC")
+  end
+
+  def renderer
+    @renderer ||= InvoiceRenderer.new
+  end
+end

app/jobs/confirm_order_job.rb

@@ -1,5 +1,7 @@
-ConfirmOrderJob = Struct.new(:order_id) do
-  def perform
+# frozen_string_literal: true
+
+class ConfirmOrderJob < ActiveJob::Base
+  def perform(order_id)
     Spree::OrderMailer.confirm_email_for_customer(order_id).deliver
     Spree::OrderMailer.confirm_email_for_shop(order_id).deliver
   end

app/jobs/confirm_signup_job.rb

@@ -1,5 +1,7 @@
-ConfirmSignupJob = Struct.new(:user_id) do
-  def perform
+# frozen_string_literal: true
+
+class ConfirmSignupJob < ActiveJob::Base
+  def perform(user_id)
     user = Spree::User.find user_id
     Spree::UserMailer.signup_confirmation(user).deliver
   end

app/jobs/order_cycle_notification_job.rb

@@ -1,6 +1,8 @@
+# frozen_string_literal: true
+
 # Delivers an email with a report of the order cycle to each of its suppliers
-OrderCycleNotificationJob = Struct.new(:order_cycle_id) do
-  def perform
+class OrderCycleNotificationJob < ActiveJob::Base
+  def perform(order_cycle_id)
     order_cycle = OrderCycle.find(order_cycle_id)
     order_cycle.suppliers.each do |supplier|
       ProducerMailer.order_cycle_report(supplier, order_cycle).deliver

app/jobs/welcome_enterprise_job.rb

@@ -1,5 +1,7 @@
-WelcomeEnterpriseJob = Struct.new(:enterprise_id) do
-  def perform
+# frozen_string_literal: true
+
+class WelcomeEnterpriseJob < ActiveJob::Base
+  def perform(enterprise_id)
     enterprise = Enterprise.find enterprise_id
     EnterpriseMailer.welcome(enterprise).deliver
   end

app/mailers/producer_mailer.rb

@@ -60,11 +60,11 @@ class ProducerMailer < Spree::BaseMailer
   end
 
   def total_from_line_items(line_items)
-    Spree::Money.new line_items.sum(&:total)
+    Spree::Money.new line_items.to_a.sum(&:total)
   end
 
   def tax_total_from_line_items(line_items)
-    Spree::Money.new line_items.sum(&:included_tax)
+    Spree::Money.new line_items.to_a.sum(&:included_tax)
   end
 
   # This hack makes ActiveRecord skip the default_scope (deleted_at IS NULL)

app/mailers/spree/order_mailer.rb

@@ -2,7 +2,6 @@
 
 module Spree
   class OrderMailer < BaseMailer
-    helper HtmlHelper
     helper ::CheckoutHelper
     helper SpreeCurrencyHelper
     helper Spree::Admin::PaymentsHelper

app/mailers/spree/user_mailer.rb

@@ -8,10 +8,12 @@ module Spree
     def reset_password_instructions(user, token, _opts = {})
       @edit_password_reset_url = spree.
         edit_spree_user_password_url(reset_password_token: token)
+      subject = "#{Spree::Config[:site_name]} " \
+        "#{I18n.t('spree.user_mailer.reset_password_instructions.subject')}"
 
-      mail(to: user.email, from: from_address,
-           subject: Spree::Config[:site_name] + ' ' +
-             I18n.t(:subject, scope: [:devise, :mailer, :reset_password_instructions]))
+      I18n.with_locale valid_locale(user) do
+        mail(to: user.email, from: from_address, subject: subject)
+      end
     end
 
     # This is a OFN specific email, not from Devise::Mailer

app/models/calculator/default_tax.rb

@@ -49,7 +49,7 @@ module Calculator
     # Finds relevant fees for each line_item,
     #   calculates the tax on them, and returns the total tax
     def per_item_fees_total(order, calculator)
-      order.line_items.sum do |line_item|
+      order.line_items.to_a.sum do |line_item|
         calculator.per_item_enterprise_fee_applicators_for(line_item.variant)
           .select { |applicator| applicable_rate?(applicator, line_item) }
           .sum { |applicator| applicator.enterprise_fee.compute_amount(line_item) }

app/models/calculator/flat_percent_per_item.rb

@@ -18,7 +18,7 @@ class Calculator::FlatPercentPerItem < Spree::Calculator
   end
 
   def compute(object)
-    line_items_for(object).sum do |li|
+    line_items_for(object).to_a.sum do |li|
       unless li.price.present? && li.quantity.present?
         raise ArgumentError, "object must respond to #price and #quantity"
       end

app/models/calculator/weight.rb

@@ -32,7 +32,7 @@ module Calculator
     private
 
     def total_weight(line_items)
-      line_items.sum do |line_item|
+      line_items.to_a.sum do |line_item|
         line_item_weight(line_item)
       end
     end

app/models/concerns/api_action_caching.rb

@@ -9,7 +9,7 @@ module ApiActionCaching
   included do
     include ActionController::Caching
     include ActionController::Caching::Actions
-    include AbstractController::Layouts
+    include ActionView::Layouts
 
     # These configs are not assigned to the controller automatically with ActionController::Metal
     self.cache_store = Rails.configuration.cache_store

app/models/concerns/product_stock.rb

@@ -4,7 +4,7 @@ module ProductStock
   extend ActiveSupport::Concern
 
   def on_demand
-    if has_variants?
+    if variants?
       raise 'Cannot determine product on_demand value of product with multiple variants' if variants.size > 1
 
       variants.first.on_demand
@@ -14,7 +14,7 @@ module ProductStock
   end
 
   def on_hand
-    if has_variants?
+    if variants?
       variants.map(&:on_hand).reduce(:+)
     else
       master.on_hand

app/models/enterprise.rb

@@ -132,7 +132,7 @@ class Enterprise < ActiveRecord::Base
       where(nil)
     end
   }
-  scope :is_primary_producer, -> { where(is_primary_producer: true) }
+  scope :is_primary_producer, -> { where("enterprises.is_primary_producer IS TRUE") }
   scope :is_distributor, -> { where('sells != ?', 'none') }
   scope :is_hub, -> { where(sells: 'any') }
   scope :supplying_variant_in, lambda { |variants|
@@ -400,7 +400,7 @@ class Enterprise < ActiveRecord::Base
   end
 
   def send_welcome_email
-    Delayed::Job.enqueue WelcomeEnterpriseJob.new(id)
+    WelcomeEnterpriseJob.perform_later(id)
   end
 
   def strip_url(url)
@@ -470,6 +470,8 @@ class Enterprise < ActiveRecord::Base
   end
 
   def initialize_permalink
+    return unless name
+
     self.permalink = Enterprise.find_available_permalink(name)
   end
 

app/models/model_set.rb

@@ -50,6 +50,7 @@ class ModelSet
     # Remove all elements to be deleted from collection and return them
     # Allows us to render @model_set.collection without deleted elements
     deleted = []
+    @collection = collection.to_a
     collection.delete_if { |e| deleted << e if @delete_if.andand.call(e.attributes) }
     deleted
   end

app/models/product_import/inventory_reset_strategy.rb

@@ -8,7 +8,7 @@ module ProductImport
       @enterprise_ids = enterprise_ids
 
       if enterprise_ids.present?
-        relation.update_all(count_on_hand: 0)
+        relation.update_all(count_on_hand: 0, on_demand: false)
       else
         0
       end

app/models/spree/ability.rb

@@ -47,7 +47,7 @@ module Spree
       end
 
       add_shopping_abilities user
-      add_base_abilities user if new_user? user
+      add_base_abilities user if is_new_user? user
       add_enterprise_management_abilities user if can_manage_enterprises? user
       add_group_management_abilities user if can_manage_groups? user
       add_product_management_abilities user if can_manage_products? user
@@ -57,7 +57,7 @@ module Spree
     end
 
     # New users have no enterprises.
-    def new_user?(user)
+    def is_new_user?(user)
       user.enterprises.blank?
     end
 

app/models/spree/app_configuration.rb

@@ -21,6 +21,8 @@
 # a.get :color
 # a.preferred_color
 #
+require 'spree/core/mail_settings'
+
 module Spree
   class AppConfiguration < Preferences::Configuration
     # Should state/state_name be required
@@ -144,5 +146,8 @@ module Spree
     # Enable cache
     preference :enable_products_cache?, :boolean,
                default: (Rails.env.production? || Rails.env.staging?)
+
+    # Available units
+    preference :available_units, :string, default: "g,kg,T,mL,L,kL"
   end
 end

app/models/spree/image.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'spree/core/s3_support'
+
 module Spree
   class Image < Asset
     validates_attachment_presence :attachment
@@ -48,26 +50,36 @@ module Spree
       false
     end
 
-    def self.set_attachment_attributes(attribute_name, attribute_value)
+    def self.set_attachment_attribute(attribute_name, attribute_value)
       attachment_definitions[:attachment][attribute_name] = attribute_value
     end
 
-    def self.set_s3_attachment_definitions
+    def self.set_storage_attachment_attributes
       if Spree::Config[:use_s3]
-        set_attachment_attributes(:storage, :s3)
-        set_attachment_attributes(:s3_credentials, s3_credentials)
-        set_attachment_attributes(:s3_headers,
-                                  ActiveSupport::JSON.decode(Spree::Config[:s3_headers]))
-        set_attachment_attributes(:bucket, Spree::Config[:s3_bucket])
+        set_s3_attachment_attributes
       else
-        attachment_definitions[:attachment].delete :storage
+        attachment_definitions[:attachment].delete(:storage)
       end
     end
 
+    def self.set_s3_attachment_attributes
+      set_attachment_attribute(:storage, :s3)
+      set_attachment_attribute(:s3_credentials, s3_credentials)
+      set_attachment_attribute(:s3_headers,
+                               ActiveSupport::JSON.decode(Spree::Config[:s3_headers]))
+      set_attachment_attribute(:bucket, Spree::Config[:s3_bucket])
+
+      # We use :s3_alias_url (virtual host url style) and set the URL on property s3_host_alias
+      set_attachment_attribute(:s3_host_alias, attachment_definitions[:attachment][:url])
+      set_attachment_attribute(:url, ":s3_alias_url")
+    end
+    private_class_method :set_s3_attachment_attributes
+
     def self.s3_credentials
       { access_key_id: Spree::Config[:s3_access_key],
         secret_access_key: Spree::Config[:s3_secret],
         bucket: Spree::Config[:s3_bucket] }
     end
+    private_class_method :s3_credentials
   end
 end

app/models/spree/line_item.rb

@@ -178,7 +178,7 @@ module Spree
     end
 
     def included_tax
-      adjustments.included_tax.sum(&:included_tax)
+      adjustments.included_tax.sum(:included_tax)
     end
 
     def tax_rates
@@ -192,7 +192,7 @@ module Spree
 
       line_item_adjustments = OrderAdjustmentsFetcher.new(order).line_item_adjustments(self)
 
-      (price + line_item_adjustments.sum(&:amount) / quantity).round(2)
+      (price + line_item_adjustments.to_a.sum(&:amount) / quantity).round(2)
     end
 
     def single_display_amount_with_adjustments

app/models/spree/option_type.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Spree
+  class OptionType < ActiveRecord::Base
+    has_many :products, through: :product_option_types
+    has_many :option_values, -> { order(:position) }, dependent: :destroy
+    has_many :product_option_types, dependent: :destroy
+
+    validates :name, :presentation, presence: true
+    default_scope -> { order("#{table_name}.position") }
+
+    accepts_nested_attributes_for :option_values,
+                                  reject_if: lambda { |ov|
+                                    ov[:name].blank? || ov[:presentation].blank?
+                                  },
+                                  allow_destroy: true
+  end
+end

app/models/spree/option_type_decorator.rb

@@ -1,5 +0,0 @@
-module Spree
-  OptionType.class_eval do
-    has_many :products, through: :product_option_types
-  end
-end

app/models/spree/option_value.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Spree
+  class OptionValue < ActiveRecord::Base
+    belongs_to :option_type
+    acts_as_list scope: :option_type
+    has_and_belongs_to_many :variants, join_table: 'spree_option_values_variants',
+                                       class_name: "Spree::Variant"
+
+    validates :name, :presentation, presence: true
+  end
+end

app/models/spree/order.rb

@@ -466,7 +466,7 @@ module Spree
     def deliver_order_confirmation_email
       return if subscription.present?
 
-      Delayed::Job.enqueue ConfirmOrderJob.new(id)
+      ConfirmOrderJob.perform_later(id)
     end
 
     # Helper methods for checkout steps
@@ -729,15 +729,15 @@ module Spree
     end
 
     def shipping_tax
-      adjustments(:reload).shipping.sum(&:included_tax)
+      adjustments(:reload).shipping.sum(:included_tax)
     end
 
     def enterprise_fee_tax
-      adjustments(:reload).enterprise_fee.sum(&:included_tax)
+      adjustments(:reload).enterprise_fee.sum(:included_tax)
     end
 
     def total_tax
-      (adjustments + price_adjustments).sum(&:included_tax)
+      (adjustments.to_a + price_adjustments.to_a).sum(&:included_tax)
     end
 
     def price_adjustments

app/models/spree/order/checkout.rb

@@ -34,7 +34,7 @@ module Spree
             klass = self
 
             # To avoid a ton of warnings when the state machine is re-defined
-            StateMachine::Machine.ignore_method_conflicts = true
+            StateMachines::Machine.ignore_method_conflicts = true
             # To avoid multiple occurrences of the same transition being defined
             # On first definition, state_machines will not be defined
             state_machines.clear if respond_to?(:state_machines)

app/models/spree/payment_method.rb

@@ -98,7 +98,7 @@ module Spree
     end
 
     def init
-      unless reflections.key?(:calculator)
+      unless _reflections.key?(:calculator)
         self.class.include Spree::Core::CalculatedAdjustments
       end
 

app/models/spree/preferences/preferable.rb

@@ -10,6 +10,9 @@
 # inherited hook will assign a new hash for the subclass definitions
 # and copy all the definitions allowing the subclass to add
 # additional defintions without affecting the base
+
+require 'spree/preferences/store'
+
 module Spree
   module Preferences
     module Preferable

app/models/spree/preferences/store.rb

@@ -61,6 +61,8 @@ module Spree
       end
 
       def delete(key)
+        return if key.nil?
+
         @cache.delete(key)
         destroy(key)
       end

app/models/spree/price.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Spree
+  class Price < ActiveRecord::Base
+    acts_as_paranoid without_default_scope: true
+
+    belongs_to :variant, class_name: 'Spree::Variant'
+
+    validate :check_price
+    validates :amount, numericality: { greater_than_or_equal_to: 0 }, allow_nil: true
+
+    def display_amount
+      money
+    end
+    alias :display_price :display_amount
+
+    def money
+      Spree::Money.new(amount || 0, currency: currency)
+    end
+
+    def price
+      amount
+    end
+
+    def price=(price)
+      self[:amount] = parse_price(price)
+    end
+
+    # Allow prices to access associated soft-deleted variants.
+    def variant
+      Spree::Variant.unscoped { super }
+    end
+
+    private
+
+    def check_price
+      return unless currency.nil?
+
+      self.currency = Spree::Config[:currency]
+    end
+
+    # strips all non-price-like characters from the price, taking into account locale settings
+    def parse_price(price)
+      return price unless price.is_a?(String)
+
+      separator, _delimiter = I18n.t([:'number.currency.format.separator',
+                                      :'number.currency.format.delimiter'])
+      non_price_characters = /[^0-9\-#{separator}]/
+      # Strip everything else first
+      price.gsub!(non_price_characters, '')
+      # Then replace the locale-specific decimal separator with the standard separator if necessary
+      price.gsub!(separator, '.') unless separator == '.'
+
+      price.to_d
+    end
+  end
+end

app/models/spree/price_decorator.rb

@@ -1,18 +0,0 @@
-module Spree
-  Price.class_eval do
-    acts_as_paranoid without_default_scope: true
-
-    # Allow prices to access associated soft-deleted variants.
-    def variant
-      Spree::Variant.unscoped { super }
-    end
-
-    private
-
-    def check_price
-      if currency.nil?
-        self.currency = Spree::Config[:currency]
-      end
-    end
-  end
-end

app/models/spree/product.rb

@@ -0,0 +1,486 @@
+# frozen_string_literal: true
+
+require 'open_food_network/permalink_generator'
+require 'open_food_network/property_merge'
+require 'concerns/product_stock'
+
+# PRODUCTS
+# Products represent an entity for sale in a store.
+# Products can have variations, called variants
+# Products properties include description, permalink, availability,
+#   shipping category, etc. that do not change by variant.
+#
+# MASTER VARIANT
+# Every product has one master variant, which stores master price and sku, size and weight, etc.
+# The master variant does not have option values associated with it.
+# Price, SKU, size, weight, etc. are all delegated to the master variant.
+# Contains on_hand inventory levels only when there are no variants for the product.
+#
+# VARIANTS
+# All variants can access the product properties directly (via reverse delegation).
+# Inventory units are tied to Variant.
+# The master variant can have inventory units, but not option values.
+# All other variants have option values and may have inventory units.
+# Sum of on_hand each variant's inventory level determine "on_hand" level for the product.
+#
+module Spree
+  class Product < ActiveRecord::Base
+    include PermalinkGenerator
+    include ProductStock
+
+    acts_as_paranoid
+
+    has_many :product_option_types, dependent: :destroy
+    # We have an after_destroy callback on Spree::ProductOptionType. However, if we
+    # don't specify dependent => destroy on this association, it is not called. See:
+    # https://github.com/rails/rails/issues/7618
+    has_many :option_types, through: :product_option_types, dependent: :destroy
+    has_many :product_properties, dependent: :destroy
+    has_many :properties, through: :product_properties
+
+    has_many :classifications, dependent: :delete_all
+    has_many :taxons, through: :classifications
+
+    belongs_to :tax_category, class_name: 'Spree::TaxCategory'
+    belongs_to :shipping_category, class_name: 'Spree::ShippingCategory'
+    belongs_to :supplier, class_name: 'Enterprise', touch: true
+    belongs_to :primary_taxon, class_name: 'Spree::Taxon', touch: true
+
+    has_one :master,
+            -> { where is_master: true },
+            class_name: 'Spree::Variant',
+            dependent: :destroy
+
+    has_many :variants, -> {
+      where(is_master: false).order("#{::Spree::Variant.quoted_table_name}.position ASC")
+    }, class_name: 'Spree::Variant'
+
+    has_many :variants_including_master,
+             -> { order("#{::Spree::Variant.quoted_table_name}.position ASC") },
+             class_name: 'Spree::Variant',
+             dependent: :destroy
+
+    has_many :prices, -> {
+      order('spree_variants.position, spree_variants.id, currency')
+    }, through: :variants
+
+    has_many :stock_items, through: :variants
+
+    delegate_belongs_to :master, :sku, :price, :currency, :display_amount, :display_price, :weight,
+                        :height, :width, :depth, :is_master, :default_price?, :cost_currency,
+                        :price_in, :amount_in, :unit_value, :unit_description
+    delegate_belongs_to :master, :cost_price if Variant.table_exists? &&
+                                                Variant.column_names.include?('cost_price')
+    delegate :images_attributes=, :display_as=, to: :master
+
+    after_create :set_master_variant_defaults
+    after_create :build_variants_from_option_values_hash, if: :option_values_hash
+    after_save :save_master
+
+    delegate :images, to: :master, prefix: true
+    alias_method :images, :master_images
+
+    has_many :variant_images, -> { order(:position) }, source: :images,
+                                                       through: :variants_including_master
+
+    accepts_nested_attributes_for :variants, allow_destroy: true
+
+    validates :name, presence: true
+    validates :permalink, presence: true
+    validates :price, presence: true, if: proc { Spree::Config[:require_master_price] }
+    validates :shipping_category_id, presence: true
+
+    validates :supplier, presence: true
+    validates :primary_taxon, presence: true
+    validates :tax_category_id, presence: true, if: "Spree::Config.products_require_tax_category"
+
+    validates :variant_unit, presence: true
+    validates :unit_value, presence: { if: ->(p) { %w(weight volume).include? p.variant_unit } }
+    validates :variant_unit_scale,
+              presence: { if: ->(p) { %w(weight volume).include? p.variant_unit } }
+    validates :variant_unit_name,
+              presence: { if: ->(p) { p.variant_unit == 'items' } }
+
+    attr_accessor :option_values_hash
+
+    accepts_nested_attributes_for :product_properties,
+                                  allow_destroy: true,
+                                  reject_if: lambda { |pp| pp[:property_name].blank? }
+
+    make_permalink order: :name
+
+    alias :options :product_option_types
+
+    after_initialize :ensure_master
+    after_initialize :set_available_on_to_now, if: :new_record?
+
+    before_validation :sanitize_permalink
+    before_save :add_primary_taxon_to_taxons
+    after_save :remove_previous_primary_taxon_from_taxons
+    after_save :ensure_standard_variant
+    after_save :update_units
+
+    before_destroy :punch_permalink
+
+    # -- Joins
+    scope :with_order_cycles_outer, -> {
+      joins("
+        LEFT OUTER JOIN spree_variants AS o_spree_variants
+          ON (o_spree_variants.product_id = spree_products.id)").
+        joins("
+          LEFT OUTER JOIN exchange_variants AS o_exchange_variants
+            ON (o_exchange_variants.variant_id = o_spree_variants.id)").
+        joins("
+          LEFT OUTER JOIN exchanges AS o_exchanges
+            ON (o_exchanges.id = o_exchange_variants.exchange_id)").
+        joins("
+          LEFT OUTER JOIN order_cycles AS o_order_cycles
+            ON (o_order_cycles.id = o_exchanges.order_cycle_id)")
+    }
+
+    scope :imported_on, lambda { |import_date|
+      import_date = Time.zone.parse import_date if import_date.is_a? String
+      import_date = import_date.to_date
+      joins(:variants).merge(Spree::Variant.
+        where(import_date: import_date.beginning_of_day..import_date.end_of_day))
+    }
+
+    scope :with_order_cycles_inner, -> {
+      joins(variants_including_master: { exchanges: :order_cycle })
+    }
+
+    scope :visible_for, lambda { |enterprise|
+      joins('
+        LEFT OUTER JOIN spree_variants AS o_spree_variants
+          ON (o_spree_variants.product_id = spree_products.id)').
+        joins('
+          LEFT OUTER JOIN inventory_items AS o_inventory_items
+            ON (o_spree_variants.id = o_inventory_items.variant_id)').
+        where('o_inventory_items.enterprise_id = (?) AND visible = (?)', enterprise, true)
+    }
+
+    # -- Scopes
+    scope :in_supplier, lambda { |supplier| where(supplier_id: supplier) }
+
+    # Products distributed via the given distributor through an OC
+    scope :in_distributor, lambda { |distributor|
+      distributor = distributor.respond_to?(:id) ? distributor.id : distributor.to_i
+
+      with_order_cycles_outer.
+        where('(o_exchanges.incoming = ? AND o_exchanges.receiver_id = ?)', false, distributor).
+        select('distinct spree_products.*')
+    }
+
+    scope :in_distributors, lambda { |distributors|
+      with_order_cycles_outer.
+        where('(o_exchanges.incoming = ? AND o_exchanges.receiver_id IN (?))', false, distributors).
+        uniq
+    }
+
+    # Products supplied by a given enterprise or distributed via that enterprise through an OC
+    scope :in_supplier_or_distributor, lambda { |enterprise|
+      enterprise = enterprise.respond_to?(:id) ? enterprise.id : enterprise.to_i
+
+      with_order_cycles_outer.
+        where("
+          spree_products.supplier_id = ?
+          OR (o_exchanges.incoming = ? AND o_exchanges.receiver_id = ?)
+        ", enterprise, false, enterprise).
+        select('distinct spree_products.*')
+    }
+
+    # Products distributed by the given order cycle
+    scope :in_order_cycle, lambda { |order_cycle|
+      with_order_cycles_inner.
+        merge(Exchange.outgoing).
+        where('order_cycles.id = ?', order_cycle)
+    }
+
+    scope :in_an_active_order_cycle, lambda {
+      with_order_cycles_inner.
+        merge(OrderCycle.active).
+        merge(Exchange.outgoing).
+        where('order_cycles.id IS NOT NULL')
+    }
+
+    scope :by_producer, -> { joins(:supplier).order('enterprises.name') }
+    scope :by_name, -> { order('name') }
+
+    scope :managed_by, lambda { |user|
+      if user.has_spree_role?('admin')
+        where(nil)
+      else
+        where('supplier_id IN (?)', user.enterprises.select("enterprises.id"))
+      end
+    }
+
+    scope :stockable_by, lambda { |enterprise|
+      return where('1=0') if enterprise.blank?
+
+      permitted_producer_ids = EnterpriseRelationship.joins(:parent).permitting(enterprise.id)
+        .with_permission(:add_to_order_cycle)
+        .where(enterprises: { is_primary_producer: true })
+        .pluck(:parent_id)
+      return where('spree_products.supplier_id IN (?)', [enterprise.id] | permitted_producer_ids)
+    }
+
+    scope :active, lambda {
+      where("spree_products.deleted_at IS NULL AND spree_products.available_on <= ?", Time.zone.now)
+    }
+
+    def self.group_by_products_id
+      group(column_names.map { |col_name| "#{table_name}.#{col_name}" })
+    end
+
+    def to_param
+      permalink.present? ? permalink : (permalink_was || name.to_s.to_url)
+    end
+
+    # the master variant is not a member of the variants array
+    def variants?
+      variants.any?
+    end
+
+    def tax_category
+      if self[:tax_category_id].nil?
+        TaxCategory.find_by(is_default: true)
+      else
+        TaxCategory.find(self[:tax_category_id])
+      end
+    end
+
+    # Ensures option_types and product_option_types exist for keys in option_values_hash
+    def ensure_option_types_exist_for_values_hash
+      return if option_values_hash.nil?
+
+      option_values_hash.keys.map(&:to_i).each do |id|
+        option_type_ids << id unless option_type_ids.include?(id)
+        unless product_option_types.pluck(:option_type_id).include?(id)
+          product_option_types.create(option_type_id: id)
+        end
+      end
+    end
+
+    # for adding products which are closely related to existing ones
+    def duplicate
+      duplicator = Spree::Core::ProductDuplicator.new(self)
+      duplicator.duplicate
+    end
+
+    # use deleted? rather than checking the attribute directly. this
+    # allows extensions to override deleted? if they want to provide
+    # their own definition.
+    def deleted?
+      !!deleted_at
+    end
+
+    def available?
+      !(available_on.nil? || available_on.future?)
+    end
+
+    # split variants list into hash which shows mapping of opt value onto matching variants
+    # eg categorise_variants_from_option(color) => {"red" -> [...], "blue" -> [...]}
+    def categorise_variants_from_option(opt_type)
+      return {} unless option_types.include?(opt_type)
+
+      variants.active.group_by { |v| v.option_values.detect { |o| o.option_type == opt_type } }
+    end
+
+    def self.like_any(fields, values)
+      where fields.map { |field|
+        values.map { |value|
+          arel_table[field].matches("%#{value}%")
+        }.inject(:or)
+      }.inject(:or)
+    end
+
+    def empty_option_values?
+      options.empty? || options.any? do |opt|
+        opt.option_type.option_values.empty?
+      end
+    end
+
+    def property(property_name)
+      return nil unless prop = properties.find_by(name: property_name)
+
+      product_properties.find_by(property: prop).try(:value)
+    end
+
+    def set_property(property_name, property_value)
+      ActiveRecord::Base.transaction do
+        property = Property.where(name: property_name).first_or_create!(presentation: property_name)
+        product_property = ProductProperty.where(product: self,
+                                                 property: property).first_or_initialize
+        product_property.value = property_value
+        product_property.save!
+      end
+    end
+
+    def total_on_hand
+      stock_items.sum(&:count_on_hand)
+    end
+
+    # Master variant may be deleted (i.e. when the product is deleted)
+    # which would make AR's default finder return nil.
+    # This is a stopgap for that little problem.
+    def master
+      super || variants_including_master.with_deleted.find_by(is_master: true)
+    end
+
+    def properties_including_inherited
+      # Product properties override producer properties
+      ps = product_properties.all
+
+      if inherits_properties
+        ps = OpenFoodNetwork::PropertyMerge.merge(ps, supplier.producer_properties)
+      end
+
+      ps.
+        sort_by(&:position).
+        map { |pp| { id: pp.property.id, name: pp.property.presentation, value: pp.value } }
+    end
+
+    def in_distributor?(distributor)
+      self.class.in_distributor(distributor).include? self
+    end
+
+    def in_order_cycle?(order_cycle)
+      self.class.in_order_cycle(order_cycle).include? self
+    end
+
+    def variants_distributed_by(order_cycle, distributor)
+      order_cycle.variants_distributed_by(distributor).where(product_id: self)
+    end
+
+    # Get the most recent import_date of a product's variants
+    def import_date
+      variants.map(&:import_date).compact.max
+    end
+
+    def variant_unit_option_type
+      return if variant_unit.blank?
+
+      option_type_name = "unit_#{variant_unit}"
+      option_type_presentation = variant_unit.capitalize
+
+      Spree::OptionType.find_by(name: option_type_name) ||
+        Spree::OptionType.create!(name: option_type_name,
+                                  presentation: option_type_presentation)
+    end
+
+    def self.all_variant_unit_option_types
+      Spree::OptionType.where('name LIKE ?', 'unit_%%')
+    end
+
+    def destroy_with_delete_from_order_cycles
+      transaction do
+        touch_distributors
+
+        ExchangeVariant.
+          where('exchange_variants.variant_id IN (?)', variants_including_master.with_deleted.
+          select(:id)).destroy_all
+
+        destroy_without_delete_from_order_cycles
+      end
+    end
+    alias_method_chain :destroy, :delete_from_order_cycles
+
+    private
+
+    # Builds variants from a hash of option types & values
+    def build_variants_from_option_values_hash
+      ensure_option_types_exist_for_values_hash
+      values = option_values_hash.values
+      values = values.inject(values.shift) { |memo, value| memo.product(value).map(&:flatten) }
+
+      values.each do |ids|
+        variants.create(
+          option_value_ids: ids,
+          price: master.price
+        )
+      end
+      save
+    end
+
+    # ensures the master variant is flagged as such
+    def set_master_variant_defaults
+      master.is_master = true
+    end
+
+    # Here we rescue errors when saving master variants (without the need for a
+    #   validates_associated on master) and we get more specific data about the errors
+    def save_master
+      if master && (
+          master.changed? || master.new_record? || (
+            master.default_price && (
+              master.default_price.changed? || master.default_price.new_record?
+            )
+          )
+        )
+        master.save!
+      end
+
+      # If the master cannot be saved, the Product object will get its errors
+      # and will be destroyed
+    rescue ActiveRecord::RecordInvalid
+      master.errors.each do |att, error|
+        errors.add(att, error)
+      end
+      raise
+    end
+
+    def ensure_master
+      return unless new_record?
+
+      self.master ||= Variant.new
+    end
+
+    def punch_permalink
+      # Punch permalink with date prefix
+      update_attribute :permalink, "#{Time.now.to_i}_#{permalink}"
+    end
+
+    def set_available_on_to_now
+      self.available_on ||= Time.zone.now
+    end
+
+    def update_units
+      return unless variant_unit_changed?
+
+      option_types.delete self.class.all_variant_unit_option_types
+      option_types << variant_unit_option_type if variant_unit.present?
+      variants_including_master.each(&:update_units)
+    end
+
+    def touch_distributors
+      Enterprise.distributing_products(id).each(&:touch)
+    end
+
+    def add_primary_taxon_to_taxons
+      taxons << primary_taxon unless taxons.include? primary_taxon
+    end
+
+    def remove_previous_primary_taxon_from_taxons
+      return unless primary_taxon_id_changed? && primary_taxon_id_was
+
+      taxons.destroy(primary_taxon_id_was)
+    end
+
+    def ensure_standard_variant
+      return unless master.valid? && variants.empty?
+
+      variant = master.dup
+      variant.product = self
+      variant.is_master = false
+      variants << variant
+    end
+
+    # Spree creates a permalink already but our implementation fixes an edge case.
+    def sanitize_permalink
+      return unless permalink.blank? || permalink_changed?
+
+      requested = permalink.presence || permalink_was.presence || name.presence || 'product'
+      self.permalink = create_unique_permalink(requested.parameterize)
+    end
+  end
+end

app/models/spree/product_decorator.rb

@@ -1,265 +0,0 @@
-require 'open_food_network/permalink_generator'
-require 'open_food_network/property_merge'
-require 'concerns/product_stock'
-
-Spree::Product.class_eval do
-  include PermalinkGenerator
-  include ProductStock
-
-  # We have an after_destroy callback on Spree::ProductOptionType. However, if we
-  # don't specify dependent => destroy on this association, it is not called. See:
-  # https://github.com/rails/rails/issues/7618
-  has_many :option_types, through: :product_option_types, dependent: :destroy
-
-  belongs_to :supplier, class_name: 'Enterprise', touch: true
-  belongs_to :primary_taxon, class_name: 'Spree::Taxon', touch: true
-
-  delegate_belongs_to :master, :unit_value, :unit_description
-  delegate :images_attributes=, :display_as=, to: :master
-
-  validates :supplier, presence: true
-  validates :primary_taxon, presence: true
-  validates :tax_category_id, presence: true, if: "Spree::Config.products_require_tax_category"
-
-  validates :variant_unit, presence: true
-  validates :variant_unit_scale,
-            presence: { if: ->(p) { %w(weight volume).include? p.variant_unit } }
-  validates :variant_unit_name,
-            presence: { if: ->(p) { p.variant_unit == 'items' } }
-
-  after_initialize :set_available_on_to_now, if: :new_record?
-  before_validation :sanitize_permalink
-  before_save :add_primary_taxon_to_taxons
-  after_save :remove_previous_primary_taxon_from_taxons
-  after_save :ensure_standard_variant
-  after_save :update_units
-
-  # -- Joins
-  scope :with_order_cycles_outer, -> {
-    joins("
-      LEFT OUTER JOIN spree_variants AS o_spree_variants
-        ON (o_spree_variants.product_id = spree_products.id)").
-      joins("
-        LEFT OUTER JOIN exchange_variants AS o_exchange_variants
-          ON (o_exchange_variants.variant_id = o_spree_variants.id)").
-      joins("
-        LEFT OUTER JOIN exchanges AS o_exchanges
-          ON (o_exchanges.id = o_exchange_variants.exchange_id)").
-      joins("
-        LEFT OUTER JOIN order_cycles AS o_order_cycles
-          ON (o_order_cycles.id = o_exchanges.order_cycle_id)")
-  }
-
-  scope :imported_on, lambda { |import_date|
-    import_date = Time.zone.parse import_date if import_date.is_a? String
-    import_date = import_date.to_date
-    joins(:variants).merge(Spree::Variant.where(import_date: import_date.beginning_of_day..import_date.end_of_day))
-  }
-
-  scope :with_order_cycles_inner, -> {
-    joins(variants_including_master: { exchanges: :order_cycle })
-  }
-
-  scope :visible_for, lambda { |enterprise|
-    joins('LEFT OUTER JOIN spree_variants AS o_spree_variants ON (o_spree_variants.product_id = spree_products.id)').
-      joins('LEFT OUTER JOIN inventory_items AS o_inventory_items ON (o_spree_variants.id = o_inventory_items.variant_id)').
-      where('o_inventory_items.enterprise_id = (?) AND visible = (?)', enterprise, true)
-  }
-
-  # -- Scopes
-  scope :in_supplier, lambda { |supplier| where(supplier_id: supplier) }
-
-  # Products distributed via the given distributor through an OC
-  scope :in_distributor, lambda { |distributor|
-    distributor = distributor.respond_to?(:id) ? distributor.id : distributor.to_i
-
-    with_order_cycles_outer.
-      where('(o_exchanges.incoming = ? AND o_exchanges.receiver_id = ?)', false, distributor).
-      select('distinct spree_products.*')
-  }
-
-  scope :in_distributors, lambda { |distributors|
-    with_order_cycles_outer.
-      where('(o_exchanges.incoming = ? AND o_exchanges.receiver_id IN (?))', false, distributors).
-      uniq
-  }
-
-  # Products supplied by a given enterprise or distributed via that enterprise through an OC
-  scope :in_supplier_or_distributor, lambda { |enterprise|
-    enterprise = enterprise.respond_to?(:id) ? enterprise.id : enterprise.to_i
-
-    with_order_cycles_outer.
-      where("
-        spree_products.supplier_id = ?
-        OR (o_exchanges.incoming = ? AND o_exchanges.receiver_id = ?)
-      ", enterprise, false, enterprise).
-      select('distinct spree_products.*')
-  }
-
-  # Products distributed by the given order cycle
-  scope :in_order_cycle, lambda { |order_cycle|
-    with_order_cycles_inner.
-      merge(Exchange.outgoing).
-      where('order_cycles.id = ?', order_cycle)
-  }
-
-  scope :in_an_active_order_cycle, lambda {
-    with_order_cycles_inner.
-      merge(OrderCycle.active).
-      merge(Exchange.outgoing).
-      where('order_cycles.id IS NOT NULL')
-  }
-
-  scope :by_producer, -> { joins(:supplier).order('enterprises.name') }
-  scope :by_name, -> { order('name') }
-
-  scope :managed_by, lambda { |user|
-    if user.has_spree_role?('admin')
-      where(nil)
-    else
-      where('supplier_id IN (?)', user.enterprises.select("enterprises.id"))
-    end
-  }
-
-  scope :stockable_by, lambda { |enterprise|
-    return where('1=0') if enterprise.blank?
-
-    permitted_producer_ids = EnterpriseRelationship.joins(:parent).permitting(enterprise.id)
-      .with_permission(:add_to_order_cycle).where(enterprises: { is_primary_producer: true }).pluck(:parent_id)
-    return where('spree_products.supplier_id IN (?)', [enterprise.id] | permitted_producer_ids)
-  }
-
-  # -- Methods
-
-  # Called by Spree::Product::duplicate before saving.
-  def duplicate_extra(_parent)
-    # Spree sets the SKU to "COPY OF #{parent sku}".
-    master.sku = ''
-  end
-
-  def properties_including_inherited
-    # Product properties override producer properties
-    ps = product_properties.all
-
-    if inherits_properties
-      ps = OpenFoodNetwork::PropertyMerge.merge(ps, supplier.producer_properties)
-    end
-
-    ps.
-      sort_by(&:position).
-      map { |pp| { id: pp.property.id, name: pp.property.presentation, value: pp.value } }
-  end
-
-  def in_distributor?(distributor)
-    self.class.in_distributor(distributor).include? self
-  end
-
-  def in_order_cycle?(order_cycle)
-    self.class.in_order_cycle(order_cycle).include? self
-  end
-
-  def variants_distributed_by(order_cycle, distributor)
-    order_cycle.variants_distributed_by(distributor).where(product_id: self)
-  end
-
-  # Get the most recent import_date of a product's variants
-  def import_date
-    variants.map(&:import_date).compact.max
-  end
-
-  def variant_unit_option_type
-    if variant_unit.present?
-      option_type_name = "unit_#{variant_unit}"
-      option_type_presentation = variant_unit.capitalize
-
-      Spree::OptionType.find_by(name: option_type_name) ||
-        Spree::OptionType.create!(name: option_type_name,
-                                  presentation: option_type_presentation)
-    end
-  end
-
-  def destroy_with_delete_from_order_cycles
-    transaction do
-      touch_distributors
-
-      ExchangeVariant.
-        where('exchange_variants.variant_id IN (?)', variants_including_master.with_deleted.
-        select(:id)).destroy_all
-
-      destroy_without_delete_from_order_cycles
-    end
-  end
-  alias_method_chain :destroy, :delete_from_order_cycles
-
-  private
-
-  def set_available_on_to_now
-    self.available_on ||= Time.zone.now
-  end
-
-  def update_units
-    if variant_unit_changed?
-      option_types.delete self.class.all_variant_unit_option_types
-      option_types << variant_unit_option_type if variant_unit.present?
-      variants_including_master.each(&:update_units)
-    end
-  end
-
-  def touch_distributors
-    Enterprise.distributing_products(id).each(&:touch)
-  end
-
-  def add_primary_taxon_to_taxons
-    taxons << primary_taxon unless taxons.include? primary_taxon
-  end
-
-  def remove_previous_primary_taxon_from_taxons
-    return unless primary_taxon_id_changed? && primary_taxon_id_was
-
-    taxons.destroy(primary_taxon_id_was)
-  end
-
-  def self.all_variant_unit_option_types
-    Spree::OptionType.where('name LIKE ?', 'unit_%%')
-  end
-
-  def ensure_standard_variant
-    if master.valid? && variants.empty?
-      variant = master.dup
-      variant.product = self
-      variant.is_master = false
-      variants << variant
-    end
-  end
-
-  # Override Spree's old save_master method and replace it with the most recent method from spree repository
-  # This fixes any problems arising from failing master saves, without the need for a validates_associated on
-  # master, while giving us more specific errors as to why saving failed
-  def save_master
-    if master && (
-        master.changed? || master.new_record? || (
-          master.default_price && (
-            master.default_price.changed? || master.default_price.new_record?
-          )
-        )
-      )
-      master.save!
-    end
-
-    # If the master cannot be saved, the Product object will get its errors
-    # and will be destroyed
-  rescue ActiveRecord::RecordInvalid
-    master.errors.each do |att, error|
-      errors.add(att, error)
-    end
-    raise
-  end
-
-  # Spree creates a permalink already but our implementation fixes an edge case.
-  def sanitize_permalink
-    if permalink.blank? || permalink_changed?
-      requested = permalink.presence || permalink_was.presence || name.presence || 'product'
-      self.permalink = create_unique_permalink(requested.parameterize)
-    end
-  end
-end

app/models/spree/product_option_type.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Spree
+  class ProductOptionType < ActiveRecord::Base
+    after_destroy :remove_option_values
+
+    belongs_to :product, class_name: 'Spree::Product'
+    belongs_to :option_type, class_name: 'Spree::OptionType'
+    acts_as_list scope: :product
+
+    def remove_option_values
+      product.variants_including_master.each do |variant|
+        option_values = variant.option_values.where(option_type_id: option_type)
+        variant.option_values.destroy(*option_values)
+      end
+    end
+  end
+end

app/models/spree/product_option_type_decorator.rb

@@ -1,10 +0,0 @@
-Spree::ProductOptionType.class_eval do
-  after_destroy :remove_option_values
-
-  def remove_option_values
-    product.variants_including_master.each do |variant|
-      option_values = variant.option_values.where(option_type_id: option_type)
-      variant.option_values.destroy(*option_values)
-    end
-  end
-end

app/models/spree/product_property.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Spree
+  class ProductProperty < ActiveRecord::Base
+    belongs_to :product, class_name: "Spree::Product", touch: true
+    belongs_to :property, class_name: 'Spree::Property'
+
+    validates :property, presence: true
+    validates :value, length: { maximum: 255 }
+
+    default_scope -> { order("#{table_name}.position") }
+
+    # virtual attributes for use with AJAX completion stuff
+    def property_name
+      property&.name
+    end
+
+    def property_name=(name)
+      return if name.blank?
+
+      unless property = Property.find_by(name: name)
+        property = Property.create(name: name, presentation: name)
+      end
+      self.property = property
+    end
+  end
+end

app/models/spree/product_property_decorator.rb

@@ -1,5 +0,0 @@
-module Spree
-  ProductProperty.class_eval do
-    belongs_to :product, class_name: "Spree::Product", touch: true
-  end
-end