Merge pull request #6546 from andrewpbrett/sca-backend

Fix #6543

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+
+  - package-ecosystem: "bundler"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"

.github/workflows/brakeman-analysis.yml

@@ -0,0 +1,44 @@
+# This workflow integrates Brakeman with GitHub's Code Scanning feature
+# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications
+
+name: Brakeman Scan
+
+# This section configures the trigger for the workflow. Feel free to customize depending on your convention
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+jobs:
+  brakeman-scan:
+    name: Brakeman Scan
+    runs-on: ubuntu-latest
+    steps:
+    # Checkout the repository to the GitHub Actions runner
+    - name: Checkout
+      uses: actions/checkout@v2
+
+    # Customize the ruby version depending on your needs
+    - name: Setup Ruby
+      uses: actions/setup-ruby@v1
+      with:
+        ruby-version: '2.7'
+
+    - name: Setup Brakeman
+      env:
+        BRAKEMAN_VERSION: '4.10' # SARIF support is provided in Brakeman version 4.10+
+      run: |
+        gem install brakeman --version $BRAKEMAN_VERSION
+
+    # Execute Brakeman CLI and generate a SARIF output with the security issues identified during the analysis
+    - name: Scan
+      continue-on-error: true
+      run: |
+        brakeman -f sarif -o output.sarif.json .
+
+    # Upload the SARIF file generated in the previous step
+    - name: Upload SARIF
+      uses: github/codeql-action/upload-sarif@v1
+      with:
+        sarif_file: output.sarif.json

.hound.yml

@@ -0,0 +1,4 @@
+rubocop:
+  config_file: .rubocop_styleguide.yml
+scss:
+  config_file: .scss-lint.yml

.rubocop_manual_todo.yml

@@ -42,7 +42,6 @@ Layout/LineLength:
   - app/helpers/angular_form_helper.rb
   - app/helpers/checkout_helper.rb
   - app/helpers/enterprises_helper.rb
-  - app/helpers/injection_helper.rb
   - app/helpers/markdown_helper.rb
   - app/helpers/order_cycles_helper.rb
   - app/helpers/spree/orders_helper.rb
@@ -62,19 +61,20 @@ Layout/LineLength:
   - app/models/product_import/unit_converter.rb
   - app/models/proxy_order.rb
   - app/models/schedule.rb
-  - app/models/spree/app_configuration_decorator.rb
+  - app/models/spree/app_configuration.rb
   - app/models/spree/gateway/stripe_connect.rb
   - app/models/spree/image.rb
-  - app/models/spree/line_item_decorator.rb
-  - app/models/spree/order_decorator.rb
+  - app/models/spree/order.rb
   - app/models/spree/payment_method.rb
-  - app/models/spree/product_decorator.rb
+  - app/models/spree/product.rb
   - app/models/spree/user.rb
+  - app/models/spree/variant.rb
   - app/models/subscription.rb
   - app/models/variant_override.rb
   - app/models/variant_override_set.rb
   - app/serializers/api/admin/subscription_line_item_serializer.rb
   - app/services/cart_service.rb
+  - app/services/checkout/post_checkout_actions.rb
   - app/services/default_stock_location.rb
   - app/services/embedded_page_service.rb
   - app/services/order_cycle_form.rb
@@ -88,6 +88,7 @@ Layout/LineLength:
   - Gemfile
   - lib/discourse/single_sign_on.rb
   - lib/open_food_network/available_payment_method_filter.rb
+  - lib/open_food_network/bulk_coop_report.rb
   - lib/open_food_network/customers_report.rb
   - lib/open_food_network/enterprise_fee_applicator.rb
   - lib/open_food_network/enterprise_fee_calculator.rb
@@ -101,7 +102,6 @@ Layout/LineLength:
   - lib/open_food_network/scope_variants_for_search.rb
   - lib/open_food_network/xero_invoices_report.rb
   - lib/spree/localized_number.rb
-  - lib/spree/product_filters.rb
   - lib/tasks/data.rake
   - lib/tasks/enterprises.rake
   - spec/controllers/admin/bulk_line_items_controller_spec.rb
@@ -263,12 +263,17 @@ Layout/LineLength:
   - spec/models/spree/adjustment_spec.rb
   - spec/models/spree/classification_spec.rb
   - spec/models/spree/gateway/stripe_connect_spec.rb
+  - spec/models/spree/inventory_unit_spec.rb
   - spec/models/spree/line_item_spec.rb
+  - spec/models/spree/order/checkout_spec.rb
+  - spec/models/spree/order_inventory_spec.rb
   - spec/models/spree/order_spec.rb
+  - spec/models/spree/order/state_machine_spec.rb
   - spec/models/spree/payment_method_spec.rb
   - spec/models/spree/payment_spec.rb
   - spec/models/spree/product_set_spec.rb
   - spec/models/spree/product_spec.rb
+  - spec/models/spree/return_authorization_spec.rb
   - spec/models/spree/shipping_method_spec.rb
   - spec/models/spree/stock_item_spec.rb
   - spec/models/spree/taxon_spec.rb
@@ -298,6 +303,7 @@ Layout/LineLength:
   - spec/serializers/api/order_serializer_spec.rb
   - spec/services/cart_service_spec.rb
   - spec/services/checkout/form_data_adapter_spec.rb
+  - spec/services/checkout/post_checkout_actions_spec.rb
   - spec/services/embedded_page_service_spec.rb
   - spec/services/exchange_products_renderer_spec.rb
   - spec/services/order_cycle_distributed_products_spec.rb
@@ -331,6 +337,7 @@ Metrics/AbcSize:
   - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/order_cycles_controller.rb
   - app/controllers/admin/product_import_controller.rb
+  - app/controllers/admin/resource_controller.rb
   - app/controllers/admin/stripe_accounts_controller.rb
   - app/controllers/admin/subscription_line_items_controller.rb
   - app/controllers/admin/subscriptions_controller.rb
@@ -351,13 +358,13 @@ Metrics/AbcSize:
   - app/controllers/spree/admin/payments_controller.rb
   - app/controllers/spree/admin/products_controller.rb
   - app/controllers/spree/admin/reports_controller.rb
-  - app/controllers/spree/admin/resource_controller.rb
   - app/controllers/spree/admin/search_controller.rb
   - app/controllers/spree/admin/taxons_controller.rb
   - app/controllers/spree/admin/users_controller.rb
   - app/controllers/spree/admin/variants_controller.rb
   - app/controllers/spree/credit_cards_controller.rb
   - app/controllers/spree/orders_controller.rb
+  - app/controllers/spree/paypal_controller_decorator.rb
   - app/controllers/spree/user_passwords_controller.rb
   - app/controllers/spree/user_registrations_controller.rb
   - app/controllers/spree/users_controller.rb
@@ -384,17 +391,23 @@ Metrics/AbcSize:
   - app/models/proxy_order.rb
   - app/models/spree/ability.rb
   - app/models/spree/address.rb
-  - app/models/spree/line_item_decorator.rb
+  - app/models/spree/line_item.rb
   - app/models/spree/order/checkout.rb
-  - app/models/spree/order_decorator.rb
+  - app/models/spree/order_contents.rb
+  - app/models/spree/order_inventory.rb
+  - app/models/spree/order.rb
   - app/models/spree/payment/processing.rb
   - app/models/spree/payment.rb
-  - app/models/spree/product_decorator.rb
+  - app/models/spree/preference.rb
+  - app/models/spree/preferences/preferable_class_methods.rb
+  - app/models/spree/preferences/preferable.rb
+  - app/models/spree/product.rb
+  - app/models/spree/return_authorization.rb
   - app/models/spree/shipment.rb
   - app/models/spree/taxon.rb
   - app/models/spree/tax_rate.rb
+  - app/models/spree/variant.rb
   - app/models/spree/zone.rb
-  - app/serializers/api/admin/enterprise_serializer.rb
   - app/serializers/api/product_serializer.rb
   - app/serializers/api/variant_serializer.rb
   - app/services/cart_service.rb
@@ -452,6 +465,7 @@ Metrics/AbcSize:
   - spec/services/order_checkout_restart_spec.rb
   - spec/support/i18n_translations_checker.rb
   - spec/support/performance_helper.rb
+  - spec/support/request/web_helper.rb
 
 Metrics/BlockLength:
   Max: 25
@@ -516,7 +530,11 @@ Metrics/CyclomaticComplexity:
   - app/models/spree/order/checkout.rb
   - app/models/spree/payment_method.rb
   - app/models/spree/payment.rb
-  - app/models/spree/product_decorator.rb
+  - app/models/spree/preference.rb
+  - app/models/spree/preferences/preferable.rb
+  - app/models/spree/preferences/preferable_class_methods.rb
+  - app/models/spree/product.rb
+  - app/models/spree/return_authorization.rb
   - app/models/spree/zone.rb
   - app/models/variant_override_set.rb
   - app/services/cart_service.rb
@@ -535,36 +553,6 @@ Metrics/CyclomaticComplexity:
 Metrics/PerceivedComplexity:
   Max: 7
   Exclude:
-  - app/controllers/admin/enterprise_fees_controller.rb
-  - app/controllers/admin/enterprises_controller.rb
-  - app/controllers/spree/admin/taxons_controller.rb
-  - app/controllers/spree/orders_controller.rb
-  - app/helpers/checkout_helper.rb
-  - app/helpers/order_cycles_helper.rb
-  - app/helpers/spree/admin/base_helper.rb
-  - app/helpers/spree/admin/navigation_helper.rb
-  - app/models/enterprise.rb
-  - app/models/enterprise_relationship.rb
-  - app/models/spree/ability.rb
-  - app/models/spree/address.rb
-  - app/models/spree/order/checkout.rb
-  - app/models/spree/payment_method.rb
-  - app/models/spree/payment.rb
-  - app/models/spree/product_decorator.rb
-  - app/models/spree/zone.rb
-  - app/models/variant_override_set.rb
-  - app/services/cart_service.rb
-  - engines/order_management/app/services/order_management/reports/bulk_coop/bulk_coop_report.rb
-  - engines/order_management/app/services/order_management/stock/estimator.rb
-  - lib/active_merchant/billing/gateways/stripe_payment_intents.rb
-  - lib/discourse/single_sign_on.rb
-  - lib/open_food_network/enterprise_issue_validator.rb
-  - lib/spree/core/calculated_adjustments.rb
-  - lib/spree/core/controller_helpers/order.rb
-  - lib/spree/core/controller_helpers/respond_with.rb
-  - lib/spree/core/controller_helpers/ssl.rb
-  - lib/spree/localized_number.rb
-  - spec/models/product_importer_spec.rb
   - app/controllers/admin/enterprises_controller.rb
   - app/controllers/api/variants_controller.rb
   - app/controllers/spree/admin/taxons_controller.rb
@@ -576,8 +564,11 @@ Metrics/PerceivedComplexity:
   - app/models/spree/ability.rb
   - app/models/spree/address.rb
   - app/models/spree/order/checkout.rb
-  - app/models/spree/order_decorator.rb
-  - app/models/spree/product_decorator.rb
+  - app/models/spree/order.rb
+  - app/models/spree/preferences/preferable_class_methods.rb
+  - app/models/spree/preferences/preferable.rb
+  - app/models/spree/product.rb
+  - app/models/spree/return_authorization.rb
   - app/models/spree/zone.rb
   - engines/order_management/app/services/order_management/reports/bulk_coop/bulk_coop_report.rb
   - engines/order_management/app/services/order_management/stock/estimator.rb
@@ -594,67 +585,13 @@ Metrics/PerceivedComplexity:
 Metrics/MethodLength:
   Max: 10
   Exclude:
-  - app/controllers/admin/enterprise_fees_controller.rb
-  - app/controllers/admin/enterprises_controller.rb
-  - app/controllers/spree/admin/taxons_controller.rb
-  - app/controllers/spree/orders_controller.rb
-  - app/helpers/checkout_helper.rb
-  - app/helpers/order_cycles_helper.rb
-  - app/helpers/spree/admin/base_helper.rb
-  - app/helpers/spree/admin/navigation_helper.rb
-  - app/models/enterprise.rb
-  - app/models/enterprise_relationship.rb
-  - app/models/spree/ability.rb
-  - app/models/spree/address.rb
-  - app/models/spree/order/checkout.rb
-  - app/models/spree/payment_method.rb
-  - app/models/spree/payment.rb
-  - app/models/spree/product_decorator.rb
-  - app/models/spree/zone.rb
-  - app/models/variant_override_set.rb
-  - app/services/cart_service.rb
-  - engines/order_management/app/services/order_management/reports/bulk_coop/bulk_coop_report.rb
-  - engines/order_management/app/services/order_management/stock/estimator.rb
-  - lib/active_merchant/billing/gateways/stripe_payment_intents.rb
-  - lib/discourse/single_sign_on.rb
-  - lib/open_food_network/enterprise_issue_validator.rb
-  - lib/spree/core/calculated_adjustments.rb
-  - lib/spree/core/controller_helpers/order.rb
-  - lib/spree/core/controller_helpers/respond_with.rb
-  - lib/spree/core/controller_helpers/ssl.rb
-  - lib/spree/localized_number.rb
-  - spec/models/product_importer_spec.rb
-  - app/controllers/admin/enterprises_controller.rb
-  - app/controllers/api/variants_controller.rb
-  - app/controllers/spree/admin/taxons_controller.rb
-  - app/controllers/spree/orders_controller.rb
-  - app/helpers/checkout_helper.rb
-  - app/helpers/order_cycles_helper.rb
-  - app/helpers/spree/admin/navigation_helper.rb
-  - app/models/enterprise_relationship.rb
-  - app/models/spree/ability.rb
-  - app/models/spree/address.rb
-  - app/models/spree/order/checkout.rb
-  - app/models/spree/order_decorator.rb
-  - app/models/spree/product_decorator.rb
-  - app/models/spree/zone.rb
-  - engines/order_management/app/services/order_management/reports/bulk_coop/bulk_coop_report.rb
-  - engines/order_management/app/services/order_management/stock/estimator.rb
-  - lib/active_merchant/billing/gateways/stripe_payment_intents.rb
-  - lib/discourse/single_sign_on.rb
-  - lib/open_food_network/enterprise_issue_validator.rb
-  - lib/spree/core/calculated_adjustments.rb
-  - lib/spree/core/controller_helpers/order.rb
-  - lib/spree/core/controller_helpers/respond_with.rb
-  - lib/spree/core/controller_helpers/ssl.rb
-  - lib/spree/localized_number.rb
-  - spec/models/product_importer_spec.rb
   - app/controllers/admin/contents_controller.rb
   - app/controllers/admin/customers_controller.rb
   - app/controllers/admin/enterprise_fees_controller.rb
   - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/manager_invitations_controller.rb
   - app/controllers/admin/order_cycles_controller.rb
+  - app/controllers/admin/resource_controller.rb
   - app/controllers/admin/stripe_accounts_controller.rb
   - app/controllers/admin/subscriptions_controller.rb
   - app/controllers/api/products_controller.rb
@@ -669,13 +606,13 @@ Metrics/MethodLength:
   - app/controllers/spree/admin/payments_controller.rb
   - app/controllers/spree/admin/products_controller.rb
   - app/controllers/spree/admin/reports_controller.rb
-  - app/controllers/spree/admin/resource_controller.rb
   - app/controllers/spree/admin/tax_categories_controller.rb
   - app/controllers/spree/admin/taxons_controller.rb
   - app/controllers/spree/admin/users_controller.rb
   - app/controllers/spree/admin/variants_controller.rb
   - app/controllers/spree/credit_cards_controller.rb
   - app/controllers/spree/orders_controller.rb
+  - app/controllers/spree/paypal_controller_decorator.rb
   - app/controllers/spree/user_sessions_controller.rb
   - app/controllers/stripe/callbacks_controller.rb
   - app/controllers/user_confirmations_controller.rb
@@ -698,13 +635,22 @@ Metrics/MethodLength:
   - app/models/spree/address.rb
   - app/models/spree/credit_card.rb
   - app/models/spree/order/checkout.rb
-  - app/models/spree/order_decorator.rb
+  - app/models/spree/order_contents.rb
+  - app/models/spree/order_inventory.rb
+  - app/models/spree/order.rb
   - app/models/spree/payment_method.rb
   - app/models/spree/payment/processing.rb
+  - app/models/spree/preference.rb
+  - app/models/spree/preferences/preferable_class_methods.rb
+  - app/models/spree/preferences/preferable.rb
+  - app/models/spree/preferences/store.rb
+  - app/models/spree/product.rb
   - app/models/spree/product_decorator.rb
+  - app/models/spree/return_authorization.rb
   - app/models/spree/shipment.rb
   - app/models/spree/taxon.rb
   - app/models/spree/tax_rate.rb
+  - app/models/spree/variant.rb
   - app/models/spree/zone.rb
   - app/serializers/api/admin/order_cycle_serializer.rb
   - app/serializers/api/cached_enterprise_serializer.rb
@@ -762,6 +708,7 @@ Metrics/ClassLength:
   Exclude:
   - app/controllers/admin/enterprises_controller.rb
   - app/controllers/admin/order_cycles_controller.rb
+  - app/controllers/admin/resource_controller.rb
   - app/controllers/admin/schedules_controller.rb
   - app/controllers/admin/subscriptions_controller.rb
   - app/controllers/api/products_controller.rb
@@ -771,7 +718,6 @@ Metrics/ClassLength:
   - app/controllers/spree/admin/payment_methods_controller.rb
   - app/controllers/spree/admin/products_controller.rb
   - app/controllers/spree/admin/reports_controller.rb
-  - app/controllers/spree/admin/resource_controller.rb
   - app/controllers/spree/admin/users_controller.rb
   - app/controllers/spree/orders_controller.rb
   - app/models/enterprise.rb
@@ -782,9 +728,13 @@ Metrics/ClassLength:
   - app/models/spree/ability.rb
   - app/models/spree/address.rb
   - app/models/spree/credit_card.rb
+  - app/models/spree/line_item.rb
+  - app/models/spree/order.rb
   - app/models/spree/payment.rb
+  - app/models/spree/product.rb
   - app/models/spree/shipment.rb
   - app/models/spree/user.rb
+  - app/models/spree/variant.rb
   - app/models/spree/zone.rb
   - app/serializers/api/cached_enterprise_serializer.rb
   - app/serializers/api/enterprise_shopfront_serializer.rb
@@ -811,40 +761,18 @@ Metrics/ModuleLength:
   - app/helpers/spree/admin/navigation_helper.rb
   - app/models/spree/order/checkout.rb
   - app/models/spree/payment/processing.rb
-  - engines/order_management/spec/services/order_management/order/updater_spec.rb
-  - engines/order_management/spec/services/order_management/stock/package_spec.rb
-  - engines/order_management/spec/services/order_management/subscriptions/estimator_spec.rb
-  - engines/order_management/spec/services/order_management/subscriptions/form_spec.rb
   - engines/order_management/spec/services/order_management/subscriptions/proxy_order_syncer_spec.rb
-  - engines/order_management/spec/services/order_management/subscriptions/summarizer_spec.rb
   - engines/order_management/spec/services/order_management/subscriptions/validator_spec.rb
-  - engines/order_management/spec/services/order_management/subscriptions/variants_list_spec.rb
   - lib/open_food_network/column_preference_defaults.rb
   - spec/controllers/admin/order_cycles_controller_spec.rb
-  - spec/controllers/api/order_cycles_controller_spec.rb
   - spec/controllers/api/orders_controller_spec.rb
-  - spec/controllers/spree/admin/payment_methods_controller_spec.rb
-  - spec/lib/open_food_network/address_finder_spec.rb
-  - spec/lib/open_food_network/customers_report_spec.rb
-  - spec/lib/open_food_network/enterprise_fee_calculator_spec.rb
   - spec/lib/open_food_network/order_cycle_form_applicator_spec.rb
   - spec/lib/open_food_network/order_cycle_permissions_spec.rb
-  - spec/lib/open_food_network/order_grouper_spec.rb
-  - spec/lib/open_food_network/packing_report_spec.rb
-  - spec/lib/open_food_network/permissions_spec.rb
-  - spec/lib/open_food_network/products_and_inventory_report_spec.rb
-  - spec/lib/open_food_network/scope_variant_to_hub_spec.rb
-  - spec/lib/open_food_network/tag_rule_applicator_spec.rb
-  - spec/lib/open_food_network/user_balance_calculator_spec.rb
-  - spec/lib/open_food_network/users_and_enterprises_report_spec.rb
   - spec/models/spree/adjustment_spec.rb
   - spec/models/spree/credit_card_spec.rb
   - spec/models/spree/line_item_spec.rb
   - spec/models/spree/product_spec.rb
-  - spec/models/spree/shipping_method_spec.rb
   - spec/models/spree/variant_spec.rb
-  - spec/services/permissions/order_spec.rb
-  - spec/services/variant_units/option_value_namer_spec.rb
 
 Metrics/ParameterLists:
   Max: 5
@@ -853,3 +781,9 @@ Metrics/ParameterLists:
   - app/models/product_import/entry_processor.rb
   - lib/open_food_network/xero_invoices_report.rb
   - spec/features/admin/reports_spec.rb
+
+Lint/UselessAssignment:
+  Exclude:
+  - 'spec/**/*'
+  - 'app/models/spree/taxon.rb'
+  - 'lib/spree/core/controller_helpers/common.rb'

.rubocop_specs.yml

@@ -0,0 +1,7 @@
+inherit_from:
+  - .rubocop.yml
+
+# This rubocop config file is only used for specs
+# Here we allow specs to be 300 lines long
+Metrics/ModuleLength:
+  Max: 300

.scss-lint.yml

@@ -1,3 +1,19 @@
 scss_files: 'app/assets/stylesheets/**/*.css.scss'
 
 exclude: 'app/assets/stylesheets/shared/**'
+
+linters:
+  ImportantRule:
+    enabled: false
+    VendorPrefix:
+      enabled: false
+    LeadingZero:
+      enabled: false
+    PropertySortOrder:
+      enabled: false
+    StringQuotes:
+      enabled: false
+    DeclarationOrder:
+      enabled: false
+    NestingDepth:
+      enabled: false

Dockerfile

@@ -1,4 +1,10 @@
-FROM ubuntu:18.04
+FROM ubuntu:20.04
+
+ENV TZ Europe/London
+
+RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
+
+RUN echo "deb http://security.ubuntu.com/ubuntu bionic-security main" >> /etc/apt/sources.list
 
 # Install all the requirements
 RUN apt-get update && apt-get install -y curl git build-essential software-properties-common wget zlib1g-dev libssl1.0-dev libreadline-dev libyaml-dev libffi-dev libxml2-dev libxslt1-dev wait-for-it imagemagick unzip

Gemfile

@@ -1,14 +1,17 @@
+# frozen_string_literal: true
+
 source 'https://rubygems.org'
 ruby "2.3.7"
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}.git" }
 
-gem 'i18n', '~> 0.6.11'
+gem 'i18n'
 gem 'i18n-js', '~> 3.8.0'
-gem 'rails', '~> 4.0.13'
-gem 'rails-i18n', '~> 4.0'
+gem 'rails', '~> 4.2'
+gem 'rails-i18n'
 gem 'rails_safe_tasks', '~> 1.0'
 
 gem "activerecord-import"
+gem 'responders', '~> 2.0'
 
 gem "catalog", path: "./engines/catalog"
 gem 'dfc_provider', path: './engines/dfc_provider'
@@ -18,26 +21,17 @@ gem 'web', path: './engines/web'
 gem 'activerecord-postgresql-adapter'
 gem 'pg', '~> 0.21.0'
 
-# OFN-maintained and patched version of Spree v2.0.4. See
-# https://github.com/openfoodfoundation/openfoodnetwork/wiki/Tech-Doc:-OFN's-Spree-fork%F0%9F%8D%B4
-# for details.
-gem 'spree_core', github: 'openfoodfoundation/spree', branch: '2-1-0-stable'
-
-### Dependencies brought from spree core
-gem 'acts_as_list', '= 0.2.0'
-gem 'awesome_nested_set', '~> 3.0.0.rc.1'
+gem 'acts_as_list', '0.9.19'
+gem 'awesome_nested_set', '~> 3.2.1'
 gem 'cancan', '~> 1.6.10'
-gem 'ffaker', '~> 1.16'
-gem 'highline', '= 1.6.18' # Necessary for the install generator
-gem 'httparty', '~> 0.18' # Used to check alerts in spree_core, this is not used in OFN.
-gem 'json', '>= 1.7.7'
-gem 'money', '5.1.1'
+gem 'ffaker'
+gem 'highline', '2.0.3' # Necessary for the install generator
+gem 'json'
+gem 'money', '< 6.1.0'
 gem 'paranoia', '~> 2.0'
 gem 'ransack', '~> 1.8.10'
-gem 'state_machine', '1.2.0'
-gem 'stringex', '~> 1.5.1'
-
-gem 'spree_i18n', github: 'spree/spree_i18n', branch: '1-3-stable'
+gem 'state_machines-activerecord'
+gem 'stringex', '~> 2.8.5'
 
 # Our branch contains the following changes:
 # - Pass customer email and phone number to PayPal (merged to upstream master)
@@ -51,9 +45,9 @@ gem 'stripe'
 # which is needed for Pin Payments (and possibly others).
 gem 'activemerchant', '~> 1.78.0'
 
-gem 'devise', '~> 3.5.10' # v4.0.0 needs rails 4.1
+gem 'devise'
 gem 'devise-encryptable'
-gem 'devise-token_authenticatable', '~> 0.4.10' # v0.5.0 needs devise v4
+gem 'devise-token_authenticatable'
 gem 'jwt', '~> 2.2'
 gem 'oauth2', '~> 1.4.4' # Used for Stripe Connect
 
@@ -61,20 +55,17 @@ gem 'daemons'
 gem 'delayed_job_active_record'
 gem 'delayed_job_web'
 
-# Spree's default pagination gem (locked to the current version used by Spree)
-# We use it's methods in OFN code as well, so this is a direct dependency
-gem 'kaminari', '~> 0.14.1'
+gem 'kaminari', '~> 0.17.0'
 
 gem 'andand'
 gem 'angularjs-rails', '1.5.5'
-gem 'aws-sdk', '1.11.1' # temporarily locked down due to https://github.com/aws/aws-sdk-ruby/issues/273
+gem 'aws-sdk', '1.67.0'
 gem 'bugsnag'
 gem 'db2fog'
 gem 'haml'
 gem 'redcarpet'
 gem 'sass'
 gem 'sass-rails'
-gem 'truncate_html', '0.9.2'
 gem 'unicorn'
 
 gem 'actionpack-action_caching'
@@ -100,7 +91,6 @@ gem 'combine_pdf'
 gem 'wicked_pdf'
 gem 'wkhtmltopdf-binary'
 
-gem 'foreigner'
 gem 'immigrant'
 gem 'roo', '~> 2.8.3'
 
@@ -121,7 +111,7 @@ gem 'foundation-icons-sass-rails'
 gem 'foundation-rails', '= 5.5.2.1'
 
 gem 'jquery-migrate-rails'
-gem 'jquery-rails', '3.1.5'
+gem 'jquery-rails', '4.4.0'
 gem 'jquery-ui-rails', '~> 4.2'
 gem 'select2-rails', '~> 3.4.7'
 
@@ -136,9 +126,9 @@ group :test, :development do
   # Pretty printed test output
   gem 'atomic'
   gem 'awesome_print'
-  gem 'capybara', '>= 2.18.0' # 3.0 requires rack 1.6 that only works with Rails 4.2
+  gem 'capybara'
   gem 'database_cleaner', require: false
-  gem "factory_bot_rails", '4.10.0', require: false
+  gem "factory_bot_rails", '5.2.0', require: false
   gem 'fuubar', '~> 2.5.0'
   gem 'json_spec', '~> 1.1.4'
   gem 'knapsack'
@@ -156,6 +146,7 @@ end
 group :test do
   gem 'simplecov', require: false
   gem 'test-prof'
+  gem 'test_after_commit' # needed to test Devise callbacks
   gem 'webmock'
   # See spec/spec_helper.rb for instructions
   # gem 'perftools.rb'
@@ -164,7 +155,6 @@ end
 group :development do
   gem 'byebug', '~> 11.0.0' # 11.1 requires ruby 2.4
   gem 'debugger-linecache'
-  gem "newrelic_rpm", "~> 3.0"
   gem "pry", "~> 0.12.0" # pry 0.13 is not compatible with pry-byebug 3.7
   gem 'pry-byebug', '~> 3.7.0' # 3.8 requires ruby 2.4
   gem 'rubocop'

Gemfile.lock

@@ -6,12 +6,11 @@ GIT
 
 GIT
   remote: https://github.com/openfoodfoundation/better_spree_paypal_express.git
-  revision: 1736e3268239a841576d2719a1f276cf9b74c5c5
+  revision: 1a477e9f7763297944cc99b6f4dd3d962aa963e9
   branch: 2-1-0-stable
   specs:
     spree_paypal_express (2.0.3)
       paypal-sdk-merchant (= 1.106.1)
-      spree_core (~> 2.1.0)
 
 GIT
   remote: https://github.com/openfoodfoundation/ofn-qz.git
@@ -20,41 +19,6 @@ GIT
   specs:
     ofn-qz (0.1.0)
 
-GIT
-  remote: https://github.com/openfoodfoundation/spree.git
-  revision: cbb24a6ed701166ffaf2ab60a402154100d74766
-  branch: 2-1-0-stable
-  specs:
-    spree_core (2.1.0)
-      activemerchant (= 1.78.0)
-      acts_as_list (= 0.2.0)
-      awesome_nested_set (~> 3.0.0.rc.1)
-      aws-sdk (= 1.11.1)
-      cancan (~> 1.6.10)
-      ffaker (~> 1.16)
-      highline (= 1.6.18)
-      httparty (~> 0.11)
-      json (>= 1.7.7)
-      kaminari (~> 0.14.1)
-      money (= 5.1.1)
-      paperclip (~> 3.4.1)
-      paranoia (~> 2.0)
-      rails (~> 4.0)
-      ransack (~> 1.0)
-      state_machine (= 1.2.0)
-      stringex (~> 1.5.1)
-      truncate_html (= 0.9.2)
-
-GIT
-  remote: https://github.com/spree/spree_i18n.git
-  revision: 752eb67204e9c5a4e22b62591a8fd55fe2285e43
-  branch: 1-3-stable
-  specs:
-    spree_i18n (1.0.0)
-      i18n (~> 0.5)
-      rails-i18n
-      spree_core (>= 1.1)
-
 PATH
   remote: engines/catalog
   specs:
@@ -82,33 +46,44 @@ GEM
   remote: https://rubygems.org/
   specs:
     CFPropertyList (2.3.6)
-    actionmailer (4.0.13)
-      actionpack (= 4.0.13)
+    actionmailer (4.2.11.3)
+      actionpack (= 4.2.11.3)
+      actionview (= 4.2.11.3)
+      activejob (= 4.2.11.3)
       mail (~> 2.5, >= 2.5.4)
-    actionpack (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-      erubis (~> 2.7.0)
-      rack (~> 1.5.2)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+    actionpack (4.2.11.3)
+      actionview (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
+      rack (~> 1.6)
       rack-test (~> 0.6.2)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
     actionpack-action_caching (1.2.1)
       actionpack (>= 4.0.0)
+    actionview (4.2.11.3)
+      activesupport (= 4.2.11.3)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.3)
     active_model_serializers (0.8.4)
       activemodel (>= 3.0)
+    activejob (4.2.11.3)
+      activesupport (= 4.2.11.3)
+      globalid (>= 0.3.0)
     activemerchant (1.78.0)
       activesupport (>= 3.2.14, < 6.x)
       builder (>= 2.1.2, < 4.0.0)
       i18n (>= 0.6.9)
       nokogiri (~> 1.4)
-    activemodel (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-    activerecord (4.0.13)
-      activemodel (= 4.0.13)
-      activerecord-deprecated_finders (~> 1.0.2)
-      activesupport (= 4.0.13)
-      arel (~> 4.0.0)
-    activerecord-deprecated_finders (1.0.4)
+    activemodel (4.2.11.3)
+      activesupport (= 4.2.11.3)
+      builder (~> 3.1)
+    activerecord (4.2.11.3)
+      activemodel (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
+      arel (~> 6.0)
     activerecord-import (1.0.7)
       activerecord (>= 3.2)
     activerecord-postgresql-adapter (0.0.1)
@@ -119,18 +94,20 @@ GEM
       multi_json (~> 1.11, >= 1.11.2)
       rack (>= 1.5.2, < 3)
       railties (>= 4.0)
-    activesupport (4.0.13)
-      i18n (~> 0.6, >= 0.6.9)
-      minitest (~> 4.2)
-      multi_json (~> 1.3)
-      thread_safe (~> 0.1)
-      tzinfo (~> 0.3.37)
+    activesupport (4.2.11.3)
+      i18n (~> 0.7)
+      minitest (~> 5.1)
+      thread_safe (~> 0.3, >= 0.3.4)
+      tzinfo (~> 1.1)
     acts-as-taggable-on (4.0.0)
       activerecord (>= 4.0)
-    acts_as_list (0.2.0)
+    acts_as_list (0.9.19)
       activerecord (>= 3.0)
     addressable (2.7.0)
       public_suffix (>= 2.0.2, < 5.0)
+    aliyun-sdk (0.8.0)
+      nokogiri (~> 1.6)
+      rest-client (~> 2.0)
     andand (1.3.3)
     angular-rails-templates (0.3.0)
       railties (>= 3.1)
@@ -138,32 +115,34 @@ GEM
       tilt
     angularjs-file-upload-rails (2.4.1)
     angularjs-rails (1.5.5)
-    arel (4.0.2)
+    arel (6.0.4)
     ast (2.4.0)
     atomic (1.1.101)
-    awesome_nested_set (3.0.3)
-      activerecord (>= 4.0.0, < 5)
+    awesome_nested_set (3.2.1)
+      activerecord (>= 4.0.0, < 7.0)
     awesome_print (1.8.0)
-    aws-sdk (1.11.1)
+    aws-sdk (1.67.0)
+      aws-sdk-v1 (= 1.67.0)
+    aws-sdk-v1 (1.67.0)
       json (~> 1.4)
-      nokogiri (>= 1.4.4)
-      uuidtools (~> 2.1)
-    bcrypt (3.1.13)
-    bugsnag (6.17.0)
+      nokogiri (~> 1)
+    bcrypt (3.1.16)
+    bugsnag (6.18.0)
       concurrent-ruby (~> 1.0)
-    builder (3.1.4)
+    builder (3.2.4)
     byebug (11.0.1)
     cancan (1.6.10)
-    capybara (2.18.0)
+    capybara (3.15.1)
       addressable
       mini_mime (>= 0.1.3)
-      nokogiri (>= 1.3.3)
-      rack (>= 1.0.0)
-      rack-test (>= 0.5.4)
-      xpath (>= 2.0, < 4.0)
+      nokogiri (~> 1.8)
+      rack (>= 1.6.0)
+      rack-test (>= 0.6.3)
+      regexp_parser (~> 1.2)
+      xpath (~> 3.2)
     childprocess (3.0.0)
     chronic (0.10.2)
-    chunky_png (1.3.11)
+    chunky_png (1.3.14)
     climate_control (0.2.0)
     cocaine (0.5.8)
       climate_control (>= 0.0.3, < 1.0)
@@ -175,7 +154,7 @@ GEM
       coffee-script-source
       execjs
     coffee-script-source (1.12.2)
-    combine_pdf (1.0.16)
+    combine_pdf (1.0.21)
       ruby-rc4 (>= 0.1.5)
     compass (1.0.3)
       chunky_png (~> 1.2)
@@ -195,6 +174,7 @@ GEM
       sprockets (< 4.0)
     concurrent-ruby (1.1.7)
     crack (0.4.4)
+    crass (1.0.6)
     css_parser (1.7.1)
       addressable
     daemons (1.3.1)
@@ -204,48 +184,49 @@ GEM
       activerecord (>= 3.2.0, < 5.0)
       fog (~> 1.0)
       rails (>= 3.2.0, < 5.0)
-    ddtrace (0.42.0)
+    ddtrace (0.43.0)
       msgpack
     debugger-linecache (1.2.0)
-    delayed_job (4.1.8)
-      activesupport (>= 3.0, < 6.1)
-    delayed_job_active_record (4.1.4)
-      activerecord (>= 3.0, < 6.1)
+    delayed_job (4.1.9)
+      activesupport (>= 3.0, < 6.2)
+    delayed_job_active_record (4.1.5)
+      activerecord (>= 3.0, < 6.2)
       delayed_job (>= 3.0, < 5)
     delayed_job_web (1.4.3)
       activerecord (> 3.0.0)
       delayed_job (> 2.0.3)
       rack-protection (>= 1.5.5)
       sinatra (>= 1.4.4)
-    devise (3.5.10)
+    devise (4.7.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 3.2.6, < 5)
+      railties (>= 4.1.0)
       responders
-      thread_safe (~> 0.1)
       warden (~> 1.2.3)
     devise-encryptable (0.2.0)
       devise (>= 2.1.0)
-    devise-token_authenticatable (0.4.10)
-      devise (>= 3.5.2, < 4.0.0)
-    diff-lcs (1.3)
+    devise-token_authenticatable (1.1.0)
+      devise (>= 4.0.0, < 5.0.0)
+    diff-lcs (1.4.4)
     docile (1.3.2)
+    domain_name (0.5.20190701)
+      unf (>= 0.0.5, < 1.0.0)
     dry-inflector (0.1.2)
     erubis (2.7.0)
     eventmachine (1.2.7)
-    excon (0.71.1)
+    excon (0.78.0)
     execjs (2.7.0)
-    factory_bot (4.10.0)
-      activesupport (>= 3.0.0)
-    factory_bot_rails (4.10.0)
-      factory_bot (~> 4.10.0)
-      railties (>= 3.0.0)
-    faraday (1.0.0)
+    factory_bot (5.2.0)
+      activesupport (>= 4.2.0)
+    factory_bot_rails (5.2.0)
+      factory_bot (~> 5.2.0)
+      railties (>= 4.2.0)
+    faraday (1.0.1)
       multipart-post (>= 1.2, < 3)
-    ffaker (1.32.1)
-    ffi (1.12.2)
-    figaro (1.1.1)
-      thor (~> 0.14)
+    ffaker (2.11.0)
+    ffi (1.13.1)
+    figaro (1.2.0)
+      thor (>= 0.14.0, < 2)
     fission (0.5.0)
       CFPropertyList (~> 2.2)
     fog (1.41.0)
@@ -282,7 +263,8 @@ GEM
       fog-xml (~> 0.1.1)
       ipaddress (~> 0.5)
       json (>= 1.8, < 2.0)
-    fog-aliyun (0.3.5)
+    fog-aliyun (0.3.19)
+      aliyun-sdk (~> 0.8.0)
       fog-core
       fog-json
       ipaddress (~> 0.8)
@@ -328,7 +310,7 @@ GEM
       fog-core
       fog-json
       fog-xml
-    fog-internet-archive (0.0.1)
+    fog-internet-archive (0.0.2)
       fog-core
       fog-json
       fog-xml
@@ -385,7 +367,7 @@ GEM
     fog-voxel (0.1.0)
       fog-core
       fog-xml
-    fog-vsphere (3.2.1)
+    fog-vsphere (3.4.0)
       fog-core
       rbvmomi (>= 1.9, < 3)
     fog-xenserver (1.0.0)
@@ -395,8 +377,6 @@ GEM
     fog-xml (0.1.3)
       fog-core
       nokogiri (>= 1.5.11, < 2.0.0)
-    foreigner (1.7.4)
-      activerecord (>= 3.0.0)
     formatador (0.2.5)
     foundation-icons-sass-rails (3.0.0)
       railties (>= 3.1.1)
@@ -408,19 +388,22 @@ GEM
       rspec-core (~> 3.0)
       ruby-progressbar (~> 1.4)
     geocoder (1.6.4)
-    get_process_mem (0.2.5)
+    get_process_mem (0.2.7)
       ffi (~> 1.0)
+    globalid (0.4.2)
+      activesupport (>= 4.2.0)
     gmaps4rails (2.1.2)
-    haml (5.2.0)
+    haml (5.2.1)
       temple (>= 0.8.0)
       tilt
     hashdiff (1.0.1)
-    highline (1.6.18)
+    highline (2.0.3)
     hike (1.2.3)
-    httparty (0.18.1)
-      mime-types (~> 3.0)
-      multi_xml (>= 0.5.2)
-    i18n (0.6.11)
+    http-accept (1.7.0)
+    http-cookie (1.0.3)
+      domain_name (~> 0.5)
+    i18n (0.9.5)
+      concurrent-ruby (~> 1.0)
     i18n-js (3.8.0)
       i18n (>= 0.6.6)
     immigrant (0.3.6)
@@ -428,8 +411,9 @@ GEM
     ipaddress (0.8.3)
     jaro_winkler (1.5.4)
     jquery-migrate-rails (1.2.1)
-    jquery-rails (3.1.5)
-      railties (>= 3.0, < 5.0)
+    jquery-rails (4.4.0)
+      rails-dom-testing (>= 1, < 3)
+      railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
     jquery-ui-rails (4.2.1)
       railties (>= 3.2.16)
@@ -440,17 +424,20 @@ GEM
       multi_json (~> 1.0)
       rspec (>= 2.0, < 4.0)
     jwt (2.2.2)
-    kaminari (0.14.1)
+    kaminari (0.17.0)
       actionpack (>= 3.0.0)
       activesupport (>= 3.0.0)
     kgio (2.11.3)
-    knapsack (1.19.0)
+    knapsack (1.20.0)
       rake
     launchy (2.4.3)
       addressable (~> 2.3)
     letter_opener (1.7.0)
       launchy (~> 2.2)
     libv8 (7.3.492.27.1)
+    loofah (2.8.0)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.5.9)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
     method_source (0.9.2)
@@ -461,15 +448,16 @@ GEM
     mini_portile2 (2.4.0)
     mini_racer (0.2.15)
       libv8 (> 7.3)
-    minitest (4.7.5)
-    money (5.1.1)
-      i18n (~> 0.6.0)
+    minitest (5.14.2)
+    money (5.0.0)
+      i18n (~> 0.4)
+      json
     msgpack (1.3.3)
     multi_json (1.15.0)
     multi_xml (0.6.0)
     multipart-post (2.1.1)
-    newrelic_rpm (3.18.1.330)
-    nokogiri (1.10.9)
+    netrc (0.11.0)
+    nokogiri (1.10.10)
       mini_portile2 (~> 2.4.0)
     oauth2 (1.4.4)
       faraday (>= 0.8, < 2.0)
@@ -478,7 +466,7 @@ GEM
       multi_xml (~> 0.5)
       rack (>= 1.2, < 3)
     oj (3.10.8)
-    optimist (3.0.0)
+    optimist (3.0.1)
     orm_adapter (0.5.0)
     paper_trail (7.1.3)
       activerecord (>= 4.0, < 5.2)
@@ -508,7 +496,7 @@ GEM
       byebug (~> 11.0)
       pry (~> 0.10)
     public_suffix (4.0.6)
-    rack (1.5.5)
+    rack (1.6.13)
     rack-mini-profiler (2.0.2)
       rack (>= 1.2.0)
     rack-protection (1.5.5)
@@ -518,21 +506,32 @@ GEM
       rack
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.0.13)
-      actionmailer (= 4.0.13)
-      actionpack (= 4.0.13)
-      activerecord (= 4.0.13)
-      activesupport (= 4.0.13)
+    rails (4.2.11.3)
+      actionmailer (= 4.2.11.3)
+      actionpack (= 4.2.11.3)
+      actionview (= 4.2.11.3)
+      activejob (= 4.2.11.3)
+      activemodel (= 4.2.11.3)
+      activerecord (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.0.13)
-      sprockets-rails (~> 2.0)
-    rails-i18n (4.0.5)
-      i18n (~> 0.6)
+      railties (= 4.2.11.3)
+      sprockets-rails
+    rails-deprecated_sanitizer (1.0.3)
+      activesupport (>= 4.2.0.alpha)
+    rails-dom-testing (1.0.9)
+      activesupport (>= 4.2.0, < 5.0)
+      nokogiri (~> 1.6)
+      rails-deprecated_sanitizer (>= 1.0.1)
+    rails-html-sanitizer (1.3.0)
+      loofah (~> 2.3)
+    rails-i18n (4.0.9)
+      i18n (~> 0.7)
       railties (~> 4.0)
     rails_safe_tasks (1.0.0)
-    railties (4.0.13)
-      actionpack (= 4.0.13)
-      activesupport (= 4.0.13)
+    railties (4.2.11.3)
+      actionpack (= 4.2.11.3)
+      activesupport (= 4.2.11.3)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
     rainbow (3.0.0)
@@ -543,52 +542,59 @@ GEM
       activerecord (>= 3.0, < 5.2)
       activesupport (>= 3.0, < 5.2)
       i18n
-    rb-fsevent (0.10.3)
+    rb-fsevent (0.10.4)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rbvmomi (2.2.0)
+    rbvmomi (2.4.1)
       builder (~> 3.0)
       json (>= 1.8)
       nokogiri (~> 1.5)
       optimist (~> 3.0)
     redcarpet (3.5.0)
+    regexp_parser (1.8.2)
     request_store (1.5.0)
       rack (>= 1.4)
-    responders (1.1.2)
-      railties (>= 3.2, < 4.2)
+    responders (2.4.1)
+      actionpack (>= 4.2.0, < 6.0)
+      railties (>= 4.2.0, < 6.0)
+    rest-client (2.1.0)
+      http-accept (>= 1.7.0, < 2.0)
+      http-cookie (>= 1.0.2, < 2.0)
+      mime-types (>= 1.16, < 4.0)
+      netrc (~> 0.8)
     rexml (3.2.4)
-    roadie (3.4.0)
+    roadie (3.5.1)
       css_parser (~> 1.4)
-      nokogiri (~> 1.5)
+      nokogiri (~> 1.8)
     roadie-rails (1.3.0)
       railties (>= 3.0, < 5.3)
       roadie (~> 3.1)
     roo (2.8.3)
       nokogiri (~> 1)
       rubyzip (>= 1.3.0, < 3.0.0)
-    rspec (3.9.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-    rspec-core (3.9.1)
-      rspec-support (~> 3.9.1)
-    rspec-expectations (3.9.0)
+    rspec (3.10.0)
+      rspec-core (~> 3.10.0)
+      rspec-expectations (~> 3.10.0)
+      rspec-mocks (~> 3.10.0)
+    rspec-core (3.10.0)
+      rspec-support (~> 3.10.0)
+    rspec-expectations (3.10.0)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-mocks (3.9.1)
+      rspec-support (~> 3.10.0)
+    rspec-mocks (3.10.0)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-rails (3.9.1)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      railties (>= 3.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-      rspec-support (~> 3.9.0)
+      rspec-support (~> 3.10.0)
+    rspec-rails (4.0.1)
+      actionpack (>= 4.2)
+      activesupport (>= 4.2)
+      railties (>= 4.2)
+      rspec-core (~> 3.9)
+      rspec-expectations (~> 3.9)
+      rspec-mocks (~> 3.9)
+      rspec-support (~> 3.9)
     rspec-retry (0.6.2)
       rspec-core (> 3.3)
-    rspec-support (3.9.2)
+    rspec-support (3.10.0)
     rswag (2.3.1)
       rswag-api (= 2.3.1)
       rswag-specs (= 2.3.1)
@@ -630,8 +636,8 @@ GEM
     selenium-webdriver (3.142.7)
       childprocess (>= 0.5, < 4.0)
       rubyzip (>= 1.2.2)
-    shoulda-matchers (3.1.3)
-      activesupport (>= 4.0.0)
+    shoulda-matchers (4.0.1)
+      activesupport (>= 4.2.0)
     simplecov (0.17.1)
       docile (~> 1.1)
       json (>= 1.8, < 3)
@@ -641,7 +647,8 @@ GEM
       rack (~> 1.5)
       rack-protection (~> 1.4)
       tilt (>= 1.3, < 3)
-    spring (1.7.2)
+    spring (2.0.2)
+      activesupport (>= 4.2)
     spring-commands-rspec (1.0.4)
       spring (>= 0.9.1)
     sprockets (2.12.5)
@@ -653,21 +660,32 @@ GEM
       actionpack (>= 3.0)
       activesupport (>= 3.0)
       sprockets (>= 2.8, < 4.0)
-    state_machine (1.2.0)
-    stringex (1.5.1)
-    stripe (5.25.0)
+    state_machines (0.5.0)
+    state_machines-activemodel (0.7.1)
+      activemodel (>= 4.1)
+      state_machines (>= 0.5.0)
+    state_machines-activerecord (0.6.0)
+      activerecord (>= 4.1)
+      state_machines-activemodel (>= 0.5.0)
+    stringex (2.8.5)
+    stripe (5.28.0)
     temple (0.8.2)
     test-prof (0.7.5)
-    test-unit (3.3.6)
+    test-unit (3.3.7)
       power_assert
+    test_after_commit (1.2.2)
+      activerecord (>= 3.2, < 5.0)
     thor (0.20.3)
     thread_safe (0.3.6)
     tilt (1.4.1)
     timecop (0.9.2)
-    truncate_html (0.9.2)
-    tzinfo (0.3.57)
+    tzinfo (1.2.8)
+      thread_safe (~> 0.1)
     uglifier (4.2.0)
       execjs (>= 0.3.0, < 3)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.7.7)
     unicode-display_width (1.7.0)
     unicorn (5.7.0)
       kgio (~> 2.6)
@@ -678,14 +696,13 @@ GEM
     unicorn-worker-killer (0.4.4)
       get_process_mem (~> 0)
       unicorn (>= 4, < 6)
-    uuidtools (2.1.5)
     warden (1.2.7)
       rack (>= 1.0)
     webdrivers (4.2.0)
       nokogiri (~> 1.6)
       rubyzip (>= 1.3.0)
       selenium-webdriver (>= 3.0, < 4.0)
-    webmock (3.9.3)
+    webmock (3.10.0)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
@@ -696,8 +713,8 @@ GEM
     wkhtmltopdf-binary (0.12.5)
     xml-simple (1.1.5)
     xmlrpc (0.3.0)
-    xpath (2.1.0)
-      nokogiri (~> 1.3)
+    xpath (3.2.0)
+      nokogiri (~> 1.8)
 
 PLATFORMS
   ruby
@@ -710,19 +727,19 @@ DEPENDENCIES
   activerecord-postgresql-adapter
   activerecord-session_store
   acts-as-taggable-on (~> 4.0)
-  acts_as_list (= 0.2.0)
+  acts_as_list (= 0.9.19)
   andand
   angular-rails-templates (~> 0.3.0)
   angularjs-file-upload-rails (~> 2.4.1)
   angularjs-rails (= 1.5.5)
   atomic
-  awesome_nested_set (~> 3.0.0.rc.1)
+  awesome_nested_set (~> 3.2.1)
   awesome_print
-  aws-sdk (= 1.11.1)
+  aws-sdk (= 1.67.0)
   bugsnag
   byebug (~> 11.0.0)
   cancan (~> 1.6.10)
-  capybara (>= 2.18.0)
+  capybara
   catalog!
   coffee-rails (~> 4.2.2)
   combine_pdf
@@ -736,38 +753,35 @@ DEPENDENCIES
   debugger-linecache
   delayed_job_active_record
   delayed_job_web
-  devise (~> 3.5.10)
+  devise
   devise-encryptable
-  devise-token_authenticatable (~> 0.4.10)
+  devise-token_authenticatable
   dfc_provider!
   eventmachine (>= 1.2.3)
-  factory_bot_rails (= 4.10.0)
-  ffaker (~> 1.16)
+  factory_bot_rails (= 5.2.0)
+  ffaker
   figaro
-  foreigner
   foundation-icons-sass-rails
   foundation-rails (= 5.5.2.1)
   fuubar (~> 2.5.0)
   geocoder
   gmaps4rails
   haml
-  highline (= 1.6.18)
-  httparty (~> 0.18)
-  i18n (~> 0.6.11)
+  highline (= 2.0.3)
+  i18n
   i18n-js (~> 3.8.0)
   immigrant
   jquery-migrate-rails
-  jquery-rails (= 3.1.5)
+  jquery-rails (= 4.4.0)
   jquery-ui-rails (~> 4.2)
-  json (>= 1.7.7)
+  json
   json_spec (~> 1.1.4)
   jwt (~> 2.2)
-  kaminari (~> 0.14.1)
+  kaminari (~> 0.17.0)
   knapsack
   letter_opener (>= 1.4.1)
   mini_racer (= 0.2.15)
-  money (= 5.1.1)
-  newrelic_rpm (~> 3.0)
+  money (< 6.1.0)
   oauth2 (~> 1.4.4)
   ofn-qz!
   oj
@@ -781,11 +795,12 @@ DEPENDENCIES
   rack-mini-profiler (< 3.0.0)
   rack-rewrite
   rack-ssl
-  rails (~> 4.0.13)
-  rails-i18n (~> 4.0)
+  rails (~> 4.2)
+  rails-i18n
   rails_safe_tasks (~> 1.0)
   ransack (~> 1.8.10)
   redcarpet
+  responders (~> 2.0)
   roadie-rails (~> 1.3.0)
   roo (~> 2.8.3)
   rspec-rails (>= 3.5.2)
@@ -799,18 +814,16 @@ DEPENDENCIES
   selenium-webdriver
   shoulda-matchers
   simplecov
-  spree_core!
-  spree_i18n!
   spree_paypal_express!
   spring
   spring-commands-rspec
-  state_machine (= 1.2.0)
-  stringex (~> 1.5.1)
+  state_machines-activerecord
+  stringex (~> 2.8.5)
   stripe
   test-prof
   test-unit (~> 3.3)
+  test_after_commit
   timecop
-  truncate_html (= 0.9.2)
   uglifier (>= 1.0.3)
   unicorn
   unicorn-rails

README.md

@@ -16,7 +16,7 @@ We're part of global movement - get involved!
 
 ## Contributing
 
-If you are interested in contributing to the OFN in any capacity, please introduce yourself [on Slack][slack-invite], and have a look through our [Contributor Guide][contributor-guide].
+If you are interested in contributing to the OFN in any capacity, please introduce yourself [on Slack][slack-invite], and have a look through the [OFN Handbook][ofn-handbook].
 
 Our [GETTING_STARTED](GETTING_STARTED.md) and [CONTRIBUTING](CONTRIBUTING.md) guides are the best place to start for developers looking to set up a development environment and make contributions to the codebase.
 
@@ -33,7 +33,9 @@ We also have a [Super Admin Guide][super-admin-guide] to help with configuration
 
 ## Testing
 
-We use [BrowserStack](https://www.browserstack.com/) as a manual testing tool. BrowserStack provides open source projects with unlimited and free of charge accounts. A big thanks to them!
+If you'd like to help out with testing, please introduce yourself on the #testing channel on [Slack][slack-invite] and download the [ZenHub browser extension][zenhub] to view the development pipeline.
+
+We use [BrowserStack](https://www.browserstack.com/) as a manual testing tool. BrowserStack provides open source projects with unlimited and free of charge accounts. A big thanks to them! 
 
 ## Licence
 
@@ -41,7 +43,8 @@ Copyright (c) 2012 - 2020 Open Food Foundation, released under the AGPL licence.
 
 [survey]: https://docs.google.com/a/eaterprises.com.au/forms/d/1zxR5vSiU9CigJ9cEaC8-eJLgYid8CR8er7PPH9Mc-30/edit#
 [slack-invite]: https://join.slack.com/t/openfoodnetwork/shared_invite/zt-9sjkjdlu-r02kUMP1zbrTgUhZhYPF~A
-[contributor-guide]: https://ofn-user-guide.gitbook.io/ofn-contributor-guide/who-are-we
+[ofn-handbook]: https://ofn-user-guide.gitbook.io/ofn-handbook/
 [ofn-install]: https://github.com/openfoodfoundation/ofn-install
 [super-admin-guide]: https://ofn-user-guide.gitbook.io/ofn-super-admin-guide
 [welcome-dev]: https://github.com/openfoodfoundation/openfoodnetwork/projects/27
+[zenhub]: https://www.zenhub.com/extension

Rakefile

@@ -1,4 +1,6 @@
 #!/usr/bin/env rake
+# frozen_string_literal: true
+
 # Add your own tasks in files placed in lib/tasks ending in .rake,
 # for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
 

app/assets/javascripts/admin/all.js

@@ -34,7 +34,7 @@
 //= require css_browser_selector_dev
 //= require responsive-tables
 //= require admin/spree_paypal_express
-//= require handlebars
+//= require admin/spree/handlebar_extensions
 
 // OFN specific
 //= require_tree ../templates/admin

app/assets/javascripts/admin/bulk_product_update.js.coffee

@@ -104,7 +104,7 @@ angular.module("ofn.admin").controller "AdminProductEditCtrl", ($scope, $timeout
   $scope.$watch 'sortOptions', (sort) ->
     return unless sort && sort.predicate != ""
 
-    $scope.sorting = sort.getSortingExpr()
+    $scope.q.sorting = sort.getSortingExpr()
     $scope.fetchProducts()
   , true
 

app/assets/javascripts/admin/customers/controllers/customers_controller.js.coffee

@@ -47,3 +47,8 @@ angular.module("admin.customers").controller "customersCtrl", ($scope, $q, $filt
         tag.text.toLowerCase().indexOf(query.toLowerCase()) != -1
       defer.resolve filtered
     defer.promise
+
+  $scope.displayBalanceStatus = (customer) ->
+    return unless customer.balance_status
+
+    t('admin.customers.index.' + customer.balance_status)

app/assets/javascripts/admin/enterprises/directives/terms_and_conditions_warning.js.coffee

@@ -0,0 +1,30 @@
+angular.module("admin.enterprises").directive 'termsAndConditionsWarning', ($compile, $templateCache, DialogDefaults, $timeout) ->
+  restrict: 'A'
+  scope: true
+
+  link: (scope, element, attr) ->
+    # This file input click handler will hold the browser file input dialog and show a warning modal
+    scope.hold_file_input_and_show_warning_modal = (event) ->
+      event.preventDefault()
+      scope.template = $compile($templateCache.get('admin/modals/terms_and_conditions_warning.html'))(scope)
+      if scope.template.dialog
+        scope.template.dialog(DialogDefaults)
+        scope.template.dialog('open')
+      scope.$apply()
+
+    element.bind 'click', scope.hold_file_input_and_show_warning_modal
+
+    # When the user presses continue in the warning modal, we open the browser file input dialog
+    scope.continue = ->
+      scope.template.dialog('close')
+
+      # unbind warning modal handler and click file input again to open the browser file input dialog
+      element.unbind('click').trigger('click')
+      # afterwards, bind warning modal handler again so that the warning is shown the next time
+      $timeout ->
+        element.bind 'click', scope.hold_file_input_and_show_warning_modal
+      return
+
+    scope.close = ->
+      scope.template.dialog('close')
+      return

app/assets/javascripts/admin/products/services/variant_unit_manager.js.coffee

@@ -1,4 +1,4 @@
-angular.module("admin.products").factory "VariantUnitManager", ->
+angular.module("admin.products").factory "VariantUnitManager", (availableUnits) ->
   class VariantUnitManager
     @units:
       'weight':
@@ -29,12 +29,13 @@ angular.module("admin.products").factory "VariantUnitManager", ->
           system: 'metric'
 
     @variantUnitOptions: ->
+      available = availableUnits.split(",")
       options = for unit_type, _ of @units
-        for scale in @unitScales(unit_type)
+        for scale in @unitScales(unit_type, available)
           name = @getUnitName(scale, unit_type)
           ["#{I18n.t(unit_type)} (#{name})", "#{unit_type}_#{scale}"]
       options.push [[I18n.t('items'), 'items']]
-      [].concat options...
+      options = [].concat options...
 
     @getScale: (value, unitType) ->
       scaledValue = null
@@ -53,8 +54,13 @@ angular.module("admin.products").factory "VariantUnitManager", ->
       else
         ''
 
-    @unitScales: (unitType) ->
-      (parseFloat(scale) for scale in Object.keys(@units[unitType])).sort (a, b) ->
+    @unitScales: (unitType, availableUnits = null) ->
+      scales = Object.keys(@units[unitType])
+      if availableUnits
+        scales = scales.filter (scale) ->
+          availableUnits.includes(VariantUnitManager.getUnitName(scale, unitType))
+
+      (parseFloat(scale) for scale in scales).sort (a, b) ->
          a - b
 
     @compatibleUnitScales: (scale, unitType) ->

app/assets/javascripts/admin/spree/base.js.erb

@@ -1,5 +1,4 @@
 //= require_self
-//= require admin/handlebar_extensions
 //= require admin/spree/orders/variant_autocomplete
 
 /**
@@ -128,7 +127,16 @@ $(document).ready(function() {
         nextText: Spree.translations.next,
         showOn: "focus"
       });
-
+      
+       $.datepicker.regional[I18n.locale] = {
+          prevText: Spree.translations.previous,
+          nextText: Spree.translations.next,
+          monthNames: Spree.translations.month_names,
+          dayNames: Spree.translations.abbr_day_names,
+          dayNamesMin: Spree.translations.abbr_day_names,
+          dateFormat: Spree.translations.date_picker
+      };
+      $.datepicker.setDefaults( $.datepicker.regional[I18n.locale]);
       // Correctly display range dates
       $('.date-range-filter .datepicker-from').datepicker('option', 'onSelect', function(selectedDate) {
         $(".date-range-filter .datepicker-to" ).datepicker( "option", "minDate", selectedDate );

app/assets/javascripts/admin/spree/handlebar_extensions.js

@@ -0,0 +1,9 @@
+//= require handlebars
+
+Handlebars.registerHelper("t", function(key) {
+  if (Spree.translations[key]) {
+    return Spree.translations[key]
+  } else {
+    console.error("No translation found for " + key + ". Does it exist within spree/admin/shared/_translations.html.erb?")
+  }
+});

app/assets/javascripts/darkswarm/controllers/credit_cards_controller.js.coffee

@@ -1,7 +1,7 @@
 Darkswarm.controller "CreditCardsCtrl", ($scope, CreditCard, CreditCards) ->
   angular.extend(this, new FieldsetMixin($scope))
   $scope.savedCreditCards = CreditCards.saved
-  $scope.setDefault = CreditCards.setDefault
+  $scope.confirmSetDefault = CreditCards.confirmSetDefault
   $scope.CreditCard = CreditCard
   $scope.secrets = CreditCard.secrets
   $scope.showForm = CreditCard.show

app/assets/javascripts/darkswarm/controllers/order_cycle_controller.js.coffee

@@ -25,3 +25,6 @@ Darkswarm.controller "OrderCycleChangeCtrl", ($scope, $rootScope, $timeout, Orde
     Cart.reloadFinalisedLineItems()
     ChangeableOrdersAlert.reload()
     $rootScope.$broadcast 'orderCycleSelected'
+
+  $scope.closesInLessThan3Months = () ->
+    moment().diff(moment(OrderCycle.orders_close_at(),  "YYYY-MM-DD HH:mm:SS Z"), 'days') > -75

app/assets/javascripts/darkswarm/directives/tabset_ctrl.js.coffee

@@ -5,15 +5,13 @@ Darkswarm.directive "tabsetCtrl", (Tabsets, $location) ->
     selected: "@"
     navigate: "="
     prefix: "@?"
-    alwaysopen: "="
   controller: ($scope, $element) ->
     if $scope.navigate
       path = $location.path()?.match(/^\/\w+$/)?[0]
       $scope.selected = path[1..] if path
 
     this.toggle = (name) ->
-      state = if $scope.alwaysopen then 'open' else null
-      Tabsets.toggle($scope.id, name, state)
+      Tabsets.toggle($scope.id, name)
 
     this.select = (selection) ->
       $scope.$broadcast("selection:changed", selection)

app/assets/javascripts/darkswarm/filters/localize_currency.js.coffee

@@ -6,7 +6,7 @@ Darkswarm.filter "localizeCurrency", (currencyConfig)->
     # Set decimal points, 2 or 0 if hide_cents.
     decimals = if currencyConfig.hide_cents == "true" then 0 else 2
     # Set format if the currency symbol should come after the number, otherwise (default) use the locale setting.
-    format = if currencyConfig.symbol_position == "after" then "%n %u" else undefined
+    format = if currencyConfig.symbol_position == "after" then "%n%u" else undefined
     # We need to use parseFloat as the amount should come in as a string.
     amount = parseFloat(amount)
 

app/assets/javascripts/darkswarm/services/cart.js.coffee

@@ -50,7 +50,7 @@ Darkswarm.factory 'Cart', (CurrentOrder, Variants, $timeout, $http, $modal, $roo
         @popQueue() if @update_enqueued
 
       .error (response, status)=>
-        Messages.flash({error: t('js.cart.add_to_cart_failed')})
+        Messages.flash({error: response.error})
         @update_running = false
 
     compareAndNotifyStockLevels: (stockLevels) =>

app/assets/javascripts/darkswarm/services/checkout.js.coffee

@@ -95,6 +95,10 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeE
               last_name: @order.bill_address.lastname
               save_requested_by_customer: @secrets.save_requested_by_customer
           }
+
+      if @terms_and_conditions_accepted()
+        munged_order["terms_and_conditions_accepted"] = true
+
       munged_order
 
     shippingMethod: ->
@@ -114,3 +118,7 @@ Darkswarm.factory 'Checkout', ($injector, CurrentOrder, ShippingMethods, StripeE
 
     cartTotal: ->
       @order.display_total + @shippingPrice() + @paymentPrice()
+
+    terms_and_conditions_accepted: ->
+      terms_and_conditions_checkbox = angular.element("#accept_terms")[0]
+      terms_and_conditions_checkbox? && terms_and_conditions_checkbox.checked

app/assets/javascripts/darkswarm/services/credit_cards.js.coffee

@@ -1,4 +1,4 @@
-Darkswarm.factory 'CreditCards', ($http, $filter, savedCreditCards, Messages)->
+Darkswarm.factory 'CreditCards', ($http, $filter, savedCreditCards, Messages, Customers)->
   new class CreditCard
     saved: $filter('orderBy')(savedCreditCards,'-is_default')
 
@@ -11,5 +11,13 @@ Darkswarm.factory 'CreditCards', ($http, $filter, savedCreditCards, Messages)->
         othercard.is_default = false
       $http.put("/credit_cards/#{card.id}", is_default: true).then (data) ->
         Messages.success(t('js.default_card_updated'))
+        Customers.clearAllAllowCharges()
       , (response) ->
         Messages.flash(response.data.flash)
+
+    confirmSetDefault: (card, event) =>
+      if confirm t("js.default_card_voids_auth")
+        @setDefault(card)
+      else
+        event.preventDefault()
+        return false

app/assets/javascripts/darkswarm/services/customer.js.coffee

@@ -1,4 +1,4 @@
-angular.module("Darkswarm").factory 'Customer', ($resource, Messages) ->
+angular.module("Darkswarm").factory 'Customer', ($resource, $injector, Messages) ->
   Customer = $resource('/api/customers/:id/:action.json', {}, {
     'index':
       method: 'GET'
@@ -12,8 +12,21 @@ angular.module("Darkswarm").factory 'Customer', ($resource, Messages) ->
   })
 
   Customer.prototype.update = ->
+    if @allow_charges
+      Messages.loading(t('js.authorising'))
     @$update().then (response) =>
-      Messages.success(t('js.changes_saved'))
+      if response.gateway_recurring_payment_client_secret && $injector.has('stripePublishableKey')
+        Messages.clear()
+        stripe = Stripe($injector.get('stripePublishableKey'), { stripeAccount: response.gateway_shop_id })
+        stripe.confirmCardSetup(response.gateway_recurring_payment_client_secret).then (result) =>
+          if result.error
+            @allow_charges = false
+            @$update(allow_charges: false)
+            Messages.error(result.error.message)
+          else
+            Messages.success(t('js.changes_saved'))
+      else
+        Messages.success(t('js.changes_saved'))
     , (response) =>
       Messages.error(response.data.error)
 

app/assets/javascripts/darkswarm/services/customers.js.coffee

@@ -12,3 +12,7 @@ angular.module("Darkswarm").factory 'Customers', (Customer) ->
       for customer in customers
         @all.push customer
         @byID[customer.id] = customer
+
+    clearAllAllowCharges: () ->
+      for customer in @index()
+        customer.allow_charges = false

app/assets/javascripts/darkswarm/services/tabsets.js.coffee

@@ -7,12 +7,10 @@ Darkswarm.factory 'Tabsets', ->
         @tabsets.push { ctrl: ctrl, id: id, selected: selected }
         ctrl.select(selected) if selected?
 
-    toggle: (id, name, state=null) ->
+    toggle: (id, name) ->
       tabset = @findTabsetByObject(id)
-      if tabset.selected == name
-        @select(tabset, null) unless state == "open"
-      else
-        @select(tabset, name) unless state == "closed"
+      if tabset.selected != name
+        @select(tabset, name)
 
     select: (tabset, name) ->
       tabset.selected = name

app/assets/javascripts/templates/admin/modals/terms_and_conditions_info.html.haml

@@ -0,0 +1,13 @@
+%div
+  .margin-bottom-30.text-center
+    .text-big
+      {{ 'js.admin.modals.terms_and_conditions_info.title' | t }}
+  .margin-bottom-30
+    %p
+      {{ 'js.admin.modals.terms_and_conditions_info.message_1' | t }}
+  .margin-bottom-30
+    %p
+      {{ 'js.admin.modals.terms_and_conditions_info.message_2' | t }}
+
+  .text-center
+    %input.button.red.icon-plus{ type: 'button', value: t('js.admin.modals.got_it'), ng: { click: 'close()' } }

app/assets/javascripts/templates/admin/modals/terms_and_conditions_warning.html.haml

@@ -0,0 +1,14 @@
+%div
+  .margin-bottom-30.text-center
+    .text-big
+      {{ 'js.admin.modals.terms_and_conditions_warning.title' | t }}
+  .margin-bottom-30
+    %p
+      {{ 'js.admin.modals.terms_and_conditions_warning.message_1' | t }}
+  .margin-bottom-30
+    %p
+      {{ 'js.admin.modals.terms_and_conditions_warning.message_2' | t }}
+
+  .text-center
+    %input.button.red{ type: 'button', value: t('js.admin.modals.close'), ng: { click: 'close()' } }
+    %input.button.red{ type: 'button', value: t('js.admin.modals.continue'), ng: { click: 'continue()' } }

app/assets/javascripts/templates/partials/hub_details.html.haml

@@ -14,8 +14,9 @@
             {{'hubs_delivery' | t}}
     .row
       .columns.small-12
-        %a.cta-hub{"ng-href" => "{{::enterprise.path}}", "ng-attr-target" => "{{ embedded_layout ? '_blank' : undefined}}",
+        %a.cta-hub{"ng-href" => "{{::enterprise.path}}#/shop", "ng-attr-target" => "{{ embedded_layout ? '_blank' : undefined}}",
         "ng-class" => "{primary: enterprise.active, secondary: !enterprise.active}",
+        "ng-click" => "$close()",
         "ofn-change-hub" => "enterprise"}
           .hub-name{"ng-bind" => "::enterprise.name"}
           %span{"ng-if" => "::enterprise.active"} ({{'maps_open' | t}})

app/assets/javascripts/templates/partials/producer_details.html.haml

@@ -12,8 +12,9 @@
     .row
       .columns.small-12
         %a.cta-hub{"ng-repeat" => "hub in enterprise.hubs | filter:{id: '!'+enterprise.id} | orderBy:'-active'",
-        "ng-href" => "{{::hub.path}}", "ofn-empties-cart" => "hub",
-        "ng-class" => "::{primary: hub.active, secondary: !hub.active}"}
+        "ng-href" => "{{::hub.path}}#/shop", "ofn-empties-cart" => "hub",
+        "ng-class" => "::{primary: hub.active, secondary: !hub.active}",
+        "ng-click" => "$close()"}
           .hub-name{"ng-bind" => "::hub.name"}
           %span{"ng-if" => "::hub.active"} ({{'maps_open' | t}})
           %span{"ng-if" => "::!hub.active"} ({{'maps_closed' | t}})

app/assets/stylesheets/admin/products.scss

@@ -121,3 +121,10 @@ form#image_upload {
   }
 }
 
+form.edit_image {
+  .field {
+    img {
+      max-width: 150px;
+    }
+  }
+}

app/assets/stylesheets/admin/shared/typography.scss

@@ -154,3 +154,7 @@ input.text-big {
 .pad-top {
   padding-top: 1em;
 }
+
+.white-space-nowrap {
+  white-space: nowrap;
+}

app/assets/stylesheets/darkswarm/_shop-product-rows.scss

@@ -59,6 +59,7 @@
 
         // Variant price
         .variant-price {
+          white-space: nowrap;
           @include breakpoint(phablet) {
             padding-left: 1rem;
           }

app/assets/stylesheets/darkswarm/embedded_shopfront.scss

@@ -5,7 +5,7 @@ $large-menu-height: 4.6875rem;
 $medium-menu-height: 3rem;
 $gutter-width: 0.9375rem;
 
-nav.top-bar ul.left li.powered-by {
+.top-bar .powered-by {
   display: none;
 }
 

app/assets/stylesheets/darkswarm/menu.scss

@@ -44,6 +44,13 @@ nav.top-bar {
 
 .top-bar-section {
   border-bottom: 1px solid $light-grey-transparency;
+  display: flex;
+  justify-content: space-between;
+
+  .nav-main-menu,
+  .nav-icons-menu {
+    flex-shrink: 0;
+  }
 
   a.icon {
     &:hover {
@@ -99,21 +106,14 @@ nav.top-bar {
     }
   }
 
-  ul.center {
-    display: inline-block;
-
-    // By default, we center between the left and right uls, but we want to be centered
-    // relative to the whole page. The difference in width between the other uls is 74px,
-    // so we offset by that amount here.
-    margin-left: -74px;
-  }
-
   ul.dropdown {
     border: 1px solid $smoke;
     border-top: none;
+    left: auto;
+    right: 0;
   }
 
-  ul.right {
+  .nav-icons-menu {
     > li {
       border-left: 1px solid #ddd;
       padding: 0 14px;
@@ -244,9 +244,7 @@ nav.top-bar {
 
 .top-bar .ofn-logo img {
   height: auto;
-  width: auto;
   max-height: 44px;
-  max-width: 250px;
 }
 
 .left-off-canvas-menu {
@@ -289,10 +287,6 @@ nav.top-bar {
     .has-dropdown > a {
       padding: 0 ($topbar-height / 8) !important;
     }
-
-    ul.center {
-      margin-left: -24px;
-    }
   }
 }
 

app/controllers/admin/column_preferences_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  class ColumnPreferencesController < ResourceController
+  class ColumnPreferencesController < Admin::ResourceController
     before_action :load_collection, only: [:bulk_update]
 
     respond_to :json

app/controllers/admin/customers_controller.rb

@@ -1,7 +1,7 @@
 require 'open_food_network/address_finder'
 
 module Admin
-  class CustomersController < ResourceController
+  class CustomersController < Admin::ResourceController
     before_action :load_managed_shops, only: :index, if: :html_request?
     respond_to :json
 
@@ -42,7 +42,7 @@ module Admin
       end
     end
 
-    # copy of Spree::Admin::ResourceController without flash notice
+    # copy of Admin::ResourceController without flash notice
     def destroy
       invoke_callbacks(:destroy, :before)
       if @object.destroy
@@ -95,7 +95,7 @@ module Admin
       )
     end
 
-    # Used in ResourceController#update
+    # Used in Admin::ResourceController#update
     def permitted_resource_params
       customer_params
     end

app/controllers/admin/enterprise_fees_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  class EnterpriseFeesController < ResourceController
+  class EnterpriseFeesController < Admin::ResourceController
     before_action :load_enterprise_fee_set, only: :index
     before_action :load_data
 
@@ -27,7 +27,7 @@ module Admin
     end
 
     def bulk_update
-      @enterprise_fee_set = EnterpriseFeeSet.new(params[:enterprise_fee_set])
+      @enterprise_fee_set = EnterpriseFeeSet.new(enterprise_fee_bulk_params)
 
       if @enterprise_fee_set.save
         redirect_to redirect_path, notice: I18n.t(:enterprise_fees_update_notice)
@@ -78,5 +78,15 @@ module Admin
 
       main_app.admin_enterprise_fees_path
     end
+
+    def enterprise_fee_bulk_params
+      params.require(:enterprise_fee_set).permit(
+        collection_attributes: [
+          :id, :enterprise_id, :fee_type, :name, :tax_category_id,
+          :inherits_tax_category, :calculator_type,
+          { calculator_attributes: PermittedAttributes::Calculator.attributes }
+        ]
+      )
+    end
   end
 end

app/controllers/admin/enterprise_groups_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  class EnterpriseGroupsController < ResourceController
+  class EnterpriseGroupsController < Admin::ResourceController
     before_action :load_data, except: :index
     before_action :load_object_data, only: [:new, :edit, :create, :update]
 

app/controllers/admin/enterprise_relationships_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  class EnterpriseRelationshipsController < ResourceController
+  class EnterpriseRelationshipsController < Admin::ResourceController
     def index
       @my_enterprises = Enterprise.
         includes(:shipping_methods, :payment_methods).

app/controllers/admin/enterprise_roles_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  class EnterpriseRolesController < ResourceController
+  class EnterpriseRolesController < Admin::ResourceController
     def index
       @enterprise_roles = EnterpriseRole.by_user_email
       @users = Spree::User.order('spree_users.email')

app/controllers/admin/enterprises_controller.rb

@@ -3,7 +3,7 @@ require 'open_food_network/permissions'
 require 'open_food_network/order_cycle_permissions'
 
 module Admin
-  class EnterprisesController < ResourceController
+  class EnterprisesController < Admin::ResourceController
     # These need to run before #load_resource so that @object is initialised with sanitised values
     prepend_before_action :override_owner, only: :create
     prepend_before_action :override_sells, only: :create
@@ -81,14 +81,14 @@ module Admin
     end
 
     def bulk_update
-      @enterprise_set = EnterpriseSet.new(collection, params[:enterprise_set])
+      @enterprise_set = EnterpriseSet.new(collection, bulk_params)
       if @enterprise_set.save
         flash[:success] = I18n.t(:enterprise_bulk_update_success_notice)
 
         redirect_to main_app.admin_enterprises_path
       else
         touched_enterprises = @enterprise_set.collection.select(&:changed?)
-        @enterprise_set.collection.select! { |e| touched_enterprises.include? e }
+        @enterprise_set.collection.to_a.select! { |e| touched_enterprises.include? e }
         flash[:error] = I18n.t(:enterprise_bulk_update_error)
         render :index
       end
@@ -181,10 +181,10 @@ module Admin
       enterprise_payment_methods = @enterprise.payment_methods.to_a
       enterprise_shipping_methods = @enterprise.shipping_methods.to_a
       # rubocop:disable Style/TernaryParentheses
-      @payment_methods = Spree::PaymentMethod.managed_by(spree_current_user).sort_by! do |pm|
+      @payment_methods = Spree::PaymentMethod.managed_by(spree_current_user).to_a.sort_by! do |pm|
         [(enterprise_payment_methods.include? pm) ? 0 : 1, pm.name]
       end
-      @shipping_methods = Spree::ShippingMethod.managed_by(spree_current_user).sort_by! do |sm|
+      @shipping_methods = Spree::ShippingMethod.managed_by(spree_current_user).to_a.sort_by! do |sm|
         [(enterprise_shipping_methods.include? sm) ? 0 : 1, sm.name]
       end
       # rubocop:enable Style/TernaryParentheses
@@ -214,7 +214,8 @@ module Admin
           rule = @object.tag_rules.find_by(id: attrs.delete(:id)) ||
                  attrs[:type].constantize.new(enterprise: @object)
           create_calculator_for(rule, attrs) if rule.type == "TagRule::DiscountOrder" && rule.calculator.nil?
-          rule.update(attrs)
+
+          rule.update(attrs.permit(PermittedAttributes::TagRules.attributes))
         end
       end
     end
@@ -319,7 +320,13 @@ module Admin
       PermittedAttributes::Enterprise.new(params).call
     end
 
-    # Used in ResourceController#create
+    def bulk_params
+      params.require(:enterprise_set).permit(
+        collection_attributes: PermittedAttributes::Enterprise.attributes
+      )
+    end
+
+    # Used in Admin::ResourceController#create
     def permitted_resource_params
       enterprise_params
     end

app/controllers/admin/inventory_items_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  class InventoryItemsController < ResourceController
+  class InventoryItemsController < Admin::ResourceController
     respond_to :json
 
     respond_override update: { json: {

app/controllers/admin/order_cycles_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  class OrderCyclesController < ResourceController
+  class OrderCyclesController < Admin::ResourceController
     include OrderCyclesHelper
     include PaperTrailLogging
 
@@ -91,7 +91,7 @@ module Admin
 
     # Send notifications to all producers who are part of the order cycle
     def notify_producers
-      Delayed::Job.enqueue OrderCycleNotificationJob.new(params[:id].to_i)
+      OrderCycleNotificationJob.perform_later params[:id].to_i
 
       redirect_to main_app.admin_order_cycles_path,
                   notice: I18n.t(:order_cycles_email_to_producers_notice)
@@ -223,7 +223,7 @@ module Admin
     end
 
     def order_cycle_set
-      @order_cycle_set ||= OrderCycleSet.new(@order_cycles, params[:order_cycle_set])
+      @order_cycle_set ||= OrderCycleSet.new(@order_cycles, order_cycle_bulk_params)
     end
 
     def require_order_cycle_set_params
@@ -240,5 +240,11 @@ module Admin
     def order_cycle_params
       PermittedAttributes::OrderCycle.new(params).call
     end
+
+    def order_cycle_bulk_params
+      params.require(:order_cycle_set).permit(
+        collection_attributes: [:id] + PermittedAttributes::OrderCycle.basic_attributes
+      )
+    end
   end
 end

app/controllers/admin/producer_properties_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  class ProducerPropertiesController < ResourceController
+  class ProducerPropertiesController < Admin::ResourceController
     before_action :load_enterprise
     before_action :load_properties
     before_action :setup_property, only: [:index]

app/controllers/admin/proxy_orders_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  class ProxyOrdersController < ResourceController
+  class ProxyOrdersController < Admin::ResourceController
     respond_to :json
 
     def edit

app/controllers/admin/resource_controller.rb

@@ -1,41 +1,303 @@
+require 'action_callbacks'
+
 module Admin
-  class ResourceController < Spree::Admin::ResourceController
+  class ResourceController < Spree::Admin::BaseController
+    helper_method :new_object_url, :edit_object_url, :object_url, :collection_url
+    before_action :load_resource, except: [:update_positions]
+    rescue_from ActiveRecord::RecordNotFound, with: :resource_not_found
+    rescue_from CanCan::AccessDenied, with: :unauthorized
+
+    respond_to :html
+    respond_to :js, except: [:show, :index]
+
+    def new
+      invoke_callbacks(:new_action, :before)
+      respond_with(@object) do |format|
+        format.html { render layout: !request.xhr? }
+        format.js   { render layout: false }
+      end
+    end
+
+    def edit
+      respond_with(@object) do |format|
+        format.html { render layout: !request.xhr? }
+        format.js   { render layout: false }
+      end
+    end
+
+    def update
+      invoke_callbacks(:update, :before)
+      if @object.update(permitted_resource_params)
+        invoke_callbacks(:update, :after)
+        flash[:success] = flash_message_for(@object, :successfully_updated)
+        respond_with(@object) do |format|
+          format.html { redirect_to location_after_save }
+          format.js   { render layout: false }
+        end
+      else
+        invoke_callbacks(:update, :fails)
+        respond_with(@object)
+      end
+    end
+
+    def create
+      invoke_callbacks(:create, :before)
+      @object.attributes = permitted_resource_params
+      if @object.save
+        invoke_callbacks(:create, :after)
+        flash[:success] = flash_message_for(@object, :successfully_created)
+        respond_with(@object) do |format|
+          format.html { redirect_to location_after_save }
+          format.js   { render layout: false }
+        end
+      else
+        invoke_callbacks(:create, :fails)
+        respond_with(@object)
+      end
+    end
+
+    def update_positions
+      params[:positions].each do |id, index|
+        model_class.where(id: id).update_all(position: index)
+      end
+
+      respond_to do |format|
+        format.js { render text: 'Ok' }
+      end
+    end
+
+    def destroy
+      invoke_callbacks(:destroy, :before)
+      if @object.destroy
+        invoke_callbacks(:destroy, :after)
+        flash[:success] = flash_message_for(@object, :successfully_removed)
+        respond_with(@object) do |format|
+          format.html { redirect_to collection_url }
+          format.js   { render partial: "spree/admin/shared/destroy" }
+        end
+      else
+        invoke_callbacks(:destroy, :fails)
+        respond_with(@object) do |format|
+          format.html { redirect_to collection_url }
+        end
+      end
+    end
+
+    protected
+
+    def resource_not_found
+      flash[:error] = flash_message_for(model_class.new, :not_found)
+      redirect_to collection_url
+    end
+
+    class << self
+      attr_accessor :parent_data
+      attr_accessor :callbacks
+
+      def belongs_to(model_name, options = {})
+        @parent_data ||= {}
+        @parent_data[:model_name] = model_name
+        @parent_data[:model_class] = model_name.to_s.classify.constantize
+        @parent_data[:find_by] = options[:find_by] || :id
+      end
+
+      def new_action
+        @callbacks ||= {}
+        @callbacks[:new_action] ||= ActionCallbacks.new
+      end
+
+      def create
+        @callbacks ||= {}
+        @callbacks[:create] ||= ActionCallbacks.new
+      end
+
+      def update
+        @callbacks ||= {}
+        @callbacks[:update] ||= ActionCallbacks.new
+      end
+
+      def destroy
+        @callbacks ||= {}
+        @callbacks[:destroy] ||= ActionCallbacks.new
+      end
+    end
+
     def model_class
-      controller_name.classify.to_s.constantize
+      controller_class_name.constantize
+    end
+
+    def model_name
+      parent_data[:model_name].gsub('spree/', '')
+    end
+
+    def object_name
+      controller_name.singularize
+    end
+
+    def load_resource
+      if member_action?
+        @object ||= load_resource_instance
+
+        # call authorize! a third time (called twice already in Admin::BaseController)
+        # this time we pass the actual instance so fine-grained abilities can control
+        # access to individual records, not just entire models.
+        authorize! action, @object
+
+        instance_variable_set("@#{object_name}", @object)
+
+        # If we don't have access, clear the object
+        unless can? action, @object
+          instance_variable_set("@#{object_name}", nil)
+        end
+
+        authorize! action, @object
+      else
+        @collection ||= collection
+
+        # note: we don't call authorize here as the collection method should use
+        # CanCan's accessible_by method to restrict the actual records returned
+
+        instance_variable_set("@#{controller_name}", @collection)
+      end
+    end
+
+    def load_resource_instance
+      if new_actions.include?(action)
+        build_resource
+      elsif params[:id]
+        find_resource
+      end
+    end
+
+    def parent_data
+      self.class.parent_data
+    end
+
+    def parent
+      return nil if parent_data.blank?
+
+      @parent ||= parent_data[:model_class].
+        public_send("find_by", parent_data[:find_by] => params["#{model_name}_id"])
+      instance_variable_set("@#{model_name}", @parent)
+    end
+
+    def find_resource
+      if parent_data.present?
+        parent.public_send(controller_name).find(params[:id])
+      else
+        model_class.find(params[:id])
+      end
+    end
+
+    def build_resource
+      if parent_data.present?
+        parent.public_send(controller_name).build
+      else
+        model_class.new
+      end
+    end
+
+    def collection
+      return parent.public_send(controller_name) if parent_data.present?
+
+      if model_class.respond_to?(:accessible_by) &&
+         !current_ability.has_block?(params[:action], model_class)
+        model_class.accessible_by(current_ability, action)
+      else
+        model_class.scoped
+      end
+    end
+
+    def location_after_save
+      collection_url
+    end
+
+    def invoke_callbacks(action, callback_type)
+      callbacks = self.class.callbacks || {}
+      return if callbacks[action].nil?
+
+      case callback_type.to_sym
+      when :before then callbacks[action].before_methods.each { |method| __send__ method }
+      when :after  then callbacks[action].after_methods.each  { |method| __send__ method }
+      when :fails  then callbacks[action].fails_methods.each  { |method| __send__ method }
+      end
     end
 
     # URL helpers
     def new_object_url(options = {})
       if parent_data.present?
-        main_app.new_polymorphic_url([:admin, parent, model_class], options)
+        url_helper.new_polymorphic_url([:admin, parent, model_class], options)
       else
-        main_app.new_polymorphic_url([:admin, model_class], options)
+        url_helper.new_polymorphic_url([:admin, model_class], options)
       end
     end
 
     def edit_object_url(object, options = {})
       if parent_data.present?
-        main_app.public_send "edit_admin_#{model_name}_#{object_name}_url", parent, object, options
+        url_helper.public_send "edit_admin_#{model_name}_#{object_name}_url",
+                               parent, object, options
       else
-        main_app.public_send "edit_admin_#{object_name}_url", object, options
+        url_helper.public_send "edit_admin_#{object_name}_url",
+                               object, options
       end
     end
 
     def object_url(object = nil, options = {})
       target = object || @object
       if parent_data.present?
-        main_app.public_send "admin_#{model_name}_#{object_name}_url", parent, target, options
+        url_helper.public_send "admin_#{model_name}_#{object_name}_url", parent, target, options
       else
-        main_app.public_send "admin_#{object_name}_url", target, options
+        url_helper.public_send "admin_#{object_name}_url", target, options
       end
     end
 
+    # Permit specific list of params
+    #
+    # Example: params.require(object_name).permit(:name)
+    def permitted_resource_params
+      raise "All extending controllers need to override the method permitted_resource_params"
+    end
+
     def collection_url(options = {})
       if parent_data.present?
-        main_app.polymorphic_url([:admin, parent, model_class], options)
+        url_helper.polymorphic_url([:admin, parent, model_class], options)
       else
-        main_app.polymorphic_url([:admin, model_class], options)
+        url_helper.polymorphic_url([:admin, model_class], options)
       end
     end
+
+    def collection_actions
+      [:index]
+    end
+
+    def member_action?
+      !collection_actions.include? action
+    end
+
+    def new_actions
+      [:new, :create]
+    end
+
+    private
+
+    def controller_class_name
+      if spree_controller?
+        "Spree::#{controller_name.classify}"
+      else
+        controller_name.classify.to_s
+      end
+    end
+
+    def url_helper
+      if spree_controller?
+        spree
+      else
+        main_app
+      end
+    end
+
+    def spree_controller?
+      controller_path.starts_with? "spree"
+    end
   end
 end

app/controllers/admin/schedules_controller.rb

@@ -2,7 +2,7 @@ require 'open_food_network/permissions'
 require 'order_management/subscriptions/proxy_order_syncer'
 
 module Admin
-  class SchedulesController < ResourceController
+  class SchedulesController < Admin::ResourceController
     include PaperTrailLogging
 
     before_action :adapt_params, only: [:update]

app/controllers/admin/subscription_line_items_controller.rb

@@ -3,7 +3,7 @@ require 'open_food_network/order_cycle_permissions'
 require 'open_food_network/scope_variant_to_hub'
 
 module Admin
-  class SubscriptionLineItemsController < ResourceController
+  class SubscriptionLineItemsController < Admin::ResourceController
     before_action :load_build_context, only: [:build]
     before_action :ensure_shop, only: [:build]
     before_action :ensure_variant, only: [:build]

app/controllers/admin/subscriptions_controller.rb

@@ -1,7 +1,7 @@
 require 'open_food_network/permissions'
 
 module Admin
-  class SubscriptionsController < ResourceController
+  class SubscriptionsController < Admin::ResourceController
     before_action :load_shops, only: [:index]
     before_action :load_form_data, only: [:new, :edit]
     before_action :strip_banned_attrs, only: [:update]

app/controllers/admin/tag_rules_controller.rb

@@ -1,5 +1,5 @@
 module Admin
-  class TagRulesController < ResourceController
+  class TagRulesController < Admin::ResourceController
     respond_to :json
 
     respond_override destroy: { json: {

app/controllers/admin/variant_overrides_controller.rb

@@ -1,7 +1,7 @@
 require 'open_food_network/spree_api_key_loader'
 
 module Admin
-  class VariantOverridesController < ResourceController
+  class VariantOverridesController < Admin::ResourceController
     include OpenFoodNetwork::SpreeApiKeyLoader
     include EnterprisesHelper
 

app/controllers/api/base_controller.rb

@@ -4,11 +4,12 @@ require "spree/core/controller_helpers/ssl"
 
 module Api
   class BaseController < ActionController::Metal
+    include ActionController::StrongParameters
+    include ActionController::RespondWith
     include Spree::Api::ControllerSetup
     include Spree::Core::ControllerHelpers::SSL
     include ::ActionController::Head
-
-    respond_to :json
+    include ::ActionController::ConditionalGet
 
     attr_accessor :current_api_user
 
@@ -72,7 +73,7 @@ module Api
     end
 
     def error_during_processing(exception)
-      render(text: { exception: exception.message }.to_json,
+      render(json: { exception: exception.message },
              status: :unprocessable_entity) && return
     end
 

app/controllers/api/customers_controller.rb

@@ -11,11 +11,27 @@ module Api
       @customer = Customer.find(params[:id])
       authorize! :update, @customer
 
-      if @customer.update(params[:customer])
+      client_secret = RecurringPayments.setup_for(@customer) if params[:customer][:allow_charges]
+
+      if @customer.update(customer_params)
+        add_recurring_payment_info(client_secret)
         render json: @customer, serializer: CustomerSerializer, status: :ok
       else
         invalid_resource!(@customer)
       end
     end
+
+    private
+
+    def add_recurring_payment_info(client_secret)
+      return unless client_secret
+
+      @customer.gateway_recurring_payment_client_secret = client_secret
+      @customer.gateway_shop_id = @customer.enterprise.stripe_account&.stripe_user_id
+    end
+
+    def customer_params
+      params.require(:customer).permit(:code, :email, :enterprise_id, :allow_charges)
+    end
   end
 end

app/controllers/api/enterprises_controller.rb

@@ -12,10 +12,10 @@ module Api
       # params[:user_ids] breaks the enterprise creation
       # We remove them from params and save them after creating the enterprise
       user_ids = params[:enterprise].delete(:user_ids)
-      @enterprise = Enterprise.new(params[:enterprise])
+      @enterprise = Enterprise.new(enterprise_params)
       if @enterprise.save
         @enterprise.user_ids = user_ids
-        render text: @enterprise.id, status: :created
+        render json: @enterprise.id, status: :created
       else
         invalid_resource!(@enterprise)
       end
@@ -25,8 +25,8 @@ module Api
       @enterprise = Enterprise.find_by(permalink: params[:id]) || Enterprise.find(params[:id])
       authorize! :update, @enterprise
 
-      if @enterprise.update(params[:enterprise])
-        render text: @enterprise.id, status: :ok
+      if @enterprise.update(enterprise_params)
+        render json: @enterprise.id, status: :ok
       else
         invalid_resource!(@enterprise)
       end
@@ -69,5 +69,9 @@ module Api
     def override_visible
       params[:enterprise][:visible] = false
     end
+
+    def enterprise_params
+      PermittedAttributes::Enterprise.new(params).call
+    end
   end
 end

app/controllers/api/order_cycles_controller.rb

@@ -20,7 +20,7 @@ module Api
         search_params
       ).products_json
 
-      render json: products
+      render plain: products, content_type: "application/json"
     rescue ProductsRenderer::NoProducts
       render_no_products
     end
@@ -31,13 +31,15 @@ module Api
         where(spree_products: { id: distributed_products }).
         select('DISTINCT spree_taxons.*')
 
-      render json: ActiveModel::ArraySerializer.new(taxons, each_serializer: Api::TaxonSerializer)
+      render plain: ActiveModel::ArraySerializer.new(
+        taxons, each_serializer: Api::TaxonSerializer
+      ).to_json, content_type: "application/json"
     end
 
     def properties
-      render json: ActiveModel::ArraySerializer.new(
+      render plain: ActiveModel::ArraySerializer.new(
         product_properties | producer_properties, each_serializer: Api::PropertySerializer
-      )
+      ).to_json, content_type: "application/json"
     end
 
     private

app/controllers/api/products_controller.rb

@@ -1,4 +1,5 @@
 require 'open_food_network/permissions'
+require 'spree/core/product_duplicator'
 
 module Api
   class ProductsController < Api::BaseController
@@ -16,7 +17,7 @@ module Api
     def create
       authorize! :create, Spree::Product
       params[:product][:available_on] ||= Time.zone.now
-      @product = Spree::Product.new(params[:product])
+      @product = Spree::Product.new(product_params)
       begin
         if @product.save
           render json: @product, serializer: Api::Admin::ProductSerializer, status: :created
@@ -32,7 +33,7 @@ module Api
     def update
       authorize! :update, Spree::Product
       @product = find_product(params[:id])
-      if @product.update(params[:product])
+      if @product.update(product_params)
         render json: @product, serializer: Api::Admin::ProductSerializer, status: :ok
       else
         invalid_resource!(@product)
@@ -144,7 +145,7 @@ module Api
     end
 
     def query_params_with_defaults
-      params[:q].to_h.reverse_merge(s: 'created_at desc')
+      (params[:q] || {}).reverse_merge(s: 'created_at desc')
     end
 
     def pagination_data(results)
@@ -155,5 +156,9 @@ module Api
         per_page: (params[:per_page] || DEFAULT_PER_PAGE).to_i
       }
     end
+
+    def product_params
+      params.require(:product).permit PermittedAttributes::Product.attributes
+    end
   end
 end

app/controllers/api/shipments_controller.rb

@@ -30,7 +30,7 @@ module Api
         @shipment.adjustment.open
       end
 
-      @shipment.update(params[:shipment])
+      @shipment.update(shipment_params[:shipment])
 
       if unlock == 'yes'
         @shipment.adjustment.close
@@ -88,7 +88,7 @@ module Api
 
     def find_and_update_shipment
       @shipment = @order.shipments.find_by!(number: params[:id])
-      @shipment.update(params[:shipment])
+      @shipment.update(shipment_params[:shipment]) if shipment_params[:shipment].present?
       @shipment.reload
     end
 
@@ -101,5 +101,12 @@ module Api
     def get_or_create_shipment(stock_location_id)
       @order.shipment || @order.shipments.create(stock_location_id: stock_location_id)
     end
+
+    def shipment_params
+      params.permit(
+        [:id, :order_id, :variant_id, :quantity,
+         { shipment: [:tracking, :selected_shipping_rate_id] }]
+      )
+    end
   end
 end

app/controllers/api/taxons_controller.rb

@@ -22,7 +22,7 @@ module Api
 
     def create
       authorize! :create, Spree::Taxon
-      @taxon = Spree::Taxon.new(params[:taxon])
+      @taxon = Spree::Taxon.new(taxon_params)
       @taxon.taxonomy_id = params[:taxonomy_id]
       taxonomy = Spree::Taxonomy.find_by(id: params[:taxonomy_id])
 
@@ -42,7 +42,7 @@ module Api
 
     def update
       authorize! :update, Spree::Taxon
-      if taxon.update(params[:taxon])
+      if taxon.update(taxon_params)
         render json: taxon, serializer: Api::TaxonSerializer, status: :ok
       else
         invalid_resource!(taxon)
@@ -66,5 +66,11 @@ module Api
     def taxon
       @taxon ||= taxonomy.taxons.find(params[:id])
     end
+
+    def taxon_params
+      return if params[:taxon].blank?
+
+      params.require(:taxon).permit([:name, :parent_id])
+    end
   end
 end

app/controllers/api/variants_controller.rb

@@ -17,7 +17,7 @@ module Api
 
     def create
       authorize! :create, Spree::Variant
-      @variant = scope.new(params[:variant])
+      @variant = scope.new(variant_params)
       if @variant.save
         render json: @variant, serializer: Api::VariantSerializer, status: :created
       else
@@ -28,7 +28,7 @@ module Api
     def update
       authorize! :update, Spree::Variant
       @variant = scope.find(params[:id])
-      if @variant.update(params[:variant])
+      if @variant.update(variant_params)
         render json: @variant, serializer: Api::VariantSerializer, status: :ok
       else
         invalid_resource!(@product)
@@ -69,5 +69,9 @@ module Api
       end
       variants
     end
+
+    def variant_params
+      params.require(:variant).permit(PermittedAttributes::Variant.attributes)
+    end
   end
 end

app/controllers/application_controller.rb

@@ -1,7 +1,13 @@
+# frozen_string_literal: true
+
+require "application_responder"
 require 'open_food_network/referer_parser'
 require_dependency 'spree/authentication_helpers'
 
 class ApplicationController < ActionController::Base
+  self.responder = ApplicationResponder
+  respond_to :html
+
   protect_from_forgery
 
   prepend_before_action :restrict_iframes
@@ -10,6 +16,12 @@ class ApplicationController < ActionController::Base
   include EnterprisesHelper
   include Spree::AuthenticationHelpers
 
+  # Helper for debugging strong_parameters
+  rescue_from ActiveModel::ForbiddenAttributesError, with: :print_params
+  def print_params
+    raise ActiveModel::ForbiddenAttributesError, params.to_s
+  end
+
   def redirect_to(options = {}, response_status = {})
     ::Rails.logger.error("Redirected by #{begin
                                             caller(1).first

app/controllers/cart_controller.rb

@@ -1,5 +1,3 @@
-require 'spree/core/controller_helpers/order'
-
 class CartController < BaseController
   before_action :check_authorization
 
@@ -13,7 +11,8 @@ class CartController < BaseController
     Spree::Adjustment.without_callbacks do
       cart_service = CartService.new(order)
 
-      if cart_service.populate(params.slice(:products, :variants, :quantity), true)
+      cart_service.populate(params.slice(:products, :variants, :quantity), true)
+      if cart_service.valid?
         order.update_distribution_charge!
         order.cap_quantity_at_stock!
         order.update!
@@ -24,7 +23,8 @@ class CartController < BaseController
                        stock_levels: VariantsStockLevels.new.call(order, variant_ids) },
                status: :ok
       else
-        render json: { error: true }, status: :precondition_failed
+        render json: { error: cart_service.errors.full_messages.join(",") },
+               status: :precondition_failed
       end
     end
     populate_variant_attributes

app/controllers/checkout_controller.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
 require 'open_food_network/address_finder'
-require 'spree/core/gateway_error'
 
 class CheckoutController < Spree::StoreController
   layout 'darkswarm'
 
+  include OrderStockCheck
   include CheckoutHelper
   include OrderCyclesHelper
   include EnterprisesHelper
@@ -25,7 +25,7 @@ class CheckoutController < Spree::StoreController
 
   before_action :ensure_order_not_completed
   before_action :ensure_checkout_allowed
-  before_action :ensure_sufficient_stock_lines
+  before_action :handle_insufficient_stock
 
   before_action :associate_user
   before_action :check_authorization
@@ -78,13 +78,6 @@ class CheckoutController < Spree::StoreController
     redirect_to main_app.cart_path if @order.completed?
   end
 
-  def ensure_sufficient_stock_lines
-    if @order.insufficient_stock_lines.present?
-      flash[:error] = Spree.t(:inventory_error_flash_for_insufficient_quantity)
-      redirect_to main_app.cart_path
-    end
-  end
-
   def load_order
     @order = current_order
 

app/controllers/concerns/order_stock_check.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module OrderStockCheck
+  extend ActiveSupport::Concern
+
+  def handle_insufficient_stock
+    return if sufficient_stock?
+
+    flash[:error] = Spree.t(:inventory_error_flash_for_insufficient_quantity)
+    redirect_to main_app.cart_path
+  end
+
+  private
+
+  def sufficient_stock?
+    @sufficient_stock ||= @order.insufficient_stock_lines.blank?
+  end
+end

app/controllers/enterprises_controller.rb

@@ -6,6 +6,8 @@ class EnterprisesController < BaseController
   include OrderCyclesHelper
   include SerializerHelper
 
+  protect_from_forgery except: :check_permalink
+
   # These prepended filters are in the reverse order of execution
   prepend_before_action :set_order_cycles, :require_distributor_chosen, :reset_order, only: :shop
 

app/controllers/spree/admin/adjustments_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class AdjustmentsController < ResourceController
+    class AdjustmentsController < ::Admin::ResourceController
       belongs_to 'spree/order', find_by: :number
       destroy.after :reload_order
 

app/controllers/spree/admin/countries_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class CountriesController < ResourceController
+    class CountriesController < ::Admin::ResourceController
       protected
 
       def permitted_resource_params

app/controllers/spree/admin/general_settings_controller.rb

@@ -10,6 +10,7 @@ module Spree
       end
 
       def update
+        merge_available_units_params unless params[:available_units].nil?
         params.each do |name, value|
           next unless Spree::Config.has_preference? name
 
@@ -19,6 +20,13 @@ module Spree
 
         redirect_to spree.edit_admin_general_settings_path
       end
+
+      private
+
+      def merge_available_units_params
+        params[:available_units] =
+          params[:available_units].select { |_unit, checked| checked == "1" }.keys.join(",")
+      end
     end
   end
 end

app/controllers/spree/admin/images_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class ImagesController < ResourceController
+    class ImagesController < ::Admin::ResourceController
       # This will make resource controller redirect correctly after deleting product images.
       # This can be removed after upgrading to Spree 2.1.
       # See here https://github.com/spree/spree/commit/334a011d2b8e16355e4ae77ae07cd93f7cbc8fd1
@@ -25,7 +25,7 @@ module Spree
         @object.attributes = permitted_resource_params
         if @object.save
           flash[:success] = flash_message_for(@object, :successfully_created)
-          redirect_to admin_product_images_url(params[:product_id], @url_filters)
+          redirect_to spree.admin_product_images_url(params[:product_id], @url_filters)
         else
           respond_with(@object)
         end
@@ -41,7 +41,7 @@ module Spree
 
         if @object.update(permitted_resource_params)
           flash[:success] = flash_message_for(@object, :successfully_updated)
-          redirect_to admin_product_images_url(params[:product_id], @url_filters)
+          redirect_to spree.admin_product_images_url(params[:product_id], @url_filters)
         else
           respond_with(@object)
         end
@@ -55,7 +55,7 @@ module Spree
           flash[:success] = flash_message_for(@object, :successfully_removed)
         end
 
-        redirect_to admin_product_images_url(params[:product_id], @url_filters)
+        redirect_to spree.admin_product_images_url(params[:product_id], @url_filters)
       end
 
       private

app/controllers/spree/admin/orders_controller.rb

@@ -3,7 +3,6 @@ require 'open_food_network/spree_api_key_loader'
 module Spree
   module Admin
     class OrdersController < Spree::Admin::BaseController
-      require 'spree/core/gateway_error'
       include OpenFoodNetwork::SpreeApiKeyLoader
       helper CheckoutHelper
 
@@ -44,7 +43,7 @@ module Spree
       end
 
       def update
-        unless @order.update(order_params) && @order.line_items.present?
+        unless order_params.present? && @order.update(order_params) && @order.line_items.present?
           if @order.line_items.empty?
             @order.errors.add(:line_items, Spree.t('errors.messages.blank'))
           end

app/controllers/spree/admin/payment_methods_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class PaymentMethodsController < ResourceController
+    class PaymentMethodsController < ::Admin::ResourceController
       skip_before_action :load_resource, only: [:create, :show_provider_preferences]
       before_action :load_data
       before_action :validate_payment_method_provider, only: [:create]
@@ -15,7 +15,7 @@ module Spree
         @payment_method = params[:payment_method].
           delete(:type).
           constantize.
-          new(payment_method_params)
+          new(PermittedAttributes::PaymentMethod.new(params[:payment_method]).call)
         @object = @payment_method
 
         invoke_callbacks(:create, :before)
@@ -51,7 +51,7 @@ module Spree
       end
 
       # Only show payment methods that user has access to and sort by distributor name
-      # ! Redundant code copied from Spree::Admin::ResourceController with modifications marked
+      # ! Redundant code copied from Admin::ResourceController with modifications marked
       def collection
         return parent.public_send(controller_name) if parent_data.present?
 
@@ -92,17 +92,6 @@ module Spree
 
       private
 
-      def payment_method_params
-        params.require(:payment_method).permit(
-          :name, :description, :type, :active,
-          :environment, :display_on, :tag_list,
-          :preferred_enterprise_id, :preferred_server, :preferred_login, :preferred_password,
-          :calculator_type, :preferred_api_key,
-          :preferred_signature, :preferred_solution, :preferred_landing_page, :preferred_logourl,
-          :preferred_test_mode, distributor_ids: []
-        )
-      end
-
       def force_environment
         params[:payment_method][:environment] = Rails.env unless spree_current_user.admin?
       end
@@ -127,7 +116,7 @@ module Spree
 
       def load_hubs
         # rubocop:disable Style/TernaryParentheses
-        @hubs = Enterprise.managed_by(spree_current_user).is_distributor.sort_by! do |d|
+        @hubs = Enterprise.managed_by(spree_current_user).is_distributor.to_a.sort_by! do |d|
           [(@payment_method.has_distributor? d) ? 0 : 1, d.name]
         end
         # rubocop:enable Style/TernaryParentheses
@@ -164,7 +153,7 @@ module Spree
       # Also, remove password if present and blank
       def params_for_update
         gateway_params = params[ActiveModel::Naming.param_key(@payment_method)] || {}
-        params_for_update = payment_method_params.merge(gateway_params)
+        params_for_update = params[:payment_method].merge(gateway_params)
 
         params_for_update.each do |key, _value|
           if key.include?("password") && params_for_update[key].blank?
@@ -172,7 +161,7 @@ module Spree
           end
         end
 
-        params_for_update
+        PermittedAttributes::PaymentMethod.new(params_for_update).call
       end
     end
   end

app/controllers/spree/admin/payments_controller.rb

@@ -135,7 +135,9 @@ module Spree
         return unless @payment.payment_method.class == Spree::Gateway::StripeSCA
 
         @payment.authorize!
-        raise Spree::Core::GatewayError, I18n.t('authorization_failure') unless @payment.pending?
+        return if @payment.pending? && @payment.cvv_response_message.nil?
+
+        raise Spree::Core::GatewayError, I18n.t('authorization_failure')
       end
     end
   end

app/controllers/spree/admin/product_properties_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class ProductPropertiesController < ResourceController
+    class ProductPropertiesController < ::Admin::ResourceController
       belongs_to 'spree/product', find_by: :permalink
       before_action :find_properties
       before_action :setup_property, only: [:index]
@@ -16,7 +16,7 @@ module Spree
           flash[:success] = flash_message_for(@object, :successfully_removed)
         end
         # if destroy fails it won't show any errors to the user
-        redirect_to admin_product_product_properties_url(params[:product_id], @url_filters)
+        redirect_to spree.admin_product_product_properties_url(params[:product_id], @url_filters)
       end
 
       private

app/controllers/spree/admin/products_controller.rb

@@ -4,7 +4,7 @@ require 'open_food_network/permissions'
 
 module Spree
   module Admin
-    class ProductsController < ResourceController
+    class ProductsController < ::Admin::ResourceController
       helper 'spree/products'
       include OpenFoodNetwork::SpreeApiKeyLoader
       include OrderCyclesHelper
@@ -179,7 +179,7 @@ module Spree
       end
 
       def bulk_index_query(params)
-        params[:filters].to_h.merge(page: params[:page], per_page: params[:per_page])
+        (params[:filters] || {}).merge(page: params[:page], per_page: params[:per_page])
       end
 
       def load_form_data

app/controllers/spree/admin/properties_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class PropertiesController < ResourceController
+    class PropertiesController < ::Admin::ResourceController
       def permitted_resource_params
         params.require(:property).permit(:name, :presentation)
       end

app/controllers/spree/admin/reports_controller.rb

@@ -294,7 +294,7 @@ module Spree
         if report_in_order_management_engine?(report)
           main_app.public_send("new_order_management_reports_#{report}_url".to_sym)
         else
-          public_send("#{report}_admin_reports_url".to_sym)
+          spree.public_send("#{report}_admin_reports_url".to_sym)
         end
       rescue NoMethodError
         url_for([:new, :admin, :reports, report.to_s.singularize])

app/controllers/spree/admin/resource_controller.rb

@@ -1,282 +0,0 @@
-require 'action_callbacks'
-
-module Spree
-  module Admin
-    class ResourceController < Spree::Admin::BaseController
-      helper_method :new_object_url, :edit_object_url, :object_url, :collection_url
-      before_action :load_resource, except: [:update_positions]
-      rescue_from ActiveRecord::RecordNotFound, with: :resource_not_found
-      rescue_from CanCan::AccessDenied, with: :unauthorized
-
-      respond_to :html
-      respond_to :js, except: [:show, :index]
-
-      def new
-        invoke_callbacks(:new_action, :before)
-        respond_with(@object) do |format|
-          format.html { render layout: !request.xhr? }
-          format.js   { render layout: false }
-        end
-      end
-
-      def edit
-        respond_with(@object) do |format|
-          format.html { render layout: !request.xhr? }
-          format.js   { render layout: false }
-        end
-      end
-
-      def update
-        invoke_callbacks(:update, :before)
-        if @object.update(permitted_resource_params)
-          invoke_callbacks(:update, :after)
-          flash[:success] = flash_message_for(@object, :successfully_updated)
-          respond_with(@object) do |format|
-            format.html { redirect_to location_after_save }
-            format.js   { render layout: false }
-          end
-        else
-          invoke_callbacks(:update, :fails)
-          respond_with(@object)
-        end
-      end
-
-      def create
-        invoke_callbacks(:create, :before)
-        @object.attributes = permitted_resource_params
-        if @object.save
-          invoke_callbacks(:create, :after)
-          flash[:success] = flash_message_for(@object, :successfully_created)
-          respond_with(@object) do |format|
-            format.html { redirect_to location_after_save }
-            format.js   { render layout: false }
-          end
-        else
-          invoke_callbacks(:create, :fails)
-          respond_with(@object)
-        end
-      end
-
-      def update_positions
-        params[:positions].each do |id, index|
-          model_class.where(id: id).update_all(position: index)
-        end
-
-        respond_to do |format|
-          format.js { render text: 'Ok' }
-        end
-      end
-
-      def destroy
-        invoke_callbacks(:destroy, :before)
-        if @object.destroy
-          invoke_callbacks(:destroy, :after)
-          flash[:success] = flash_message_for(@object, :successfully_removed)
-          respond_with(@object) do |format|
-            format.html { redirect_to collection_url }
-            format.js   { render partial: "spree/admin/shared/destroy" }
-          end
-        else
-          invoke_callbacks(:destroy, :fails)
-          respond_with(@object) do |format|
-            format.html { redirect_to collection_url }
-          end
-        end
-      end
-
-      protected
-
-      def resource_not_found
-        flash[:error] = flash_message_for(model_class.new, :not_found)
-        redirect_to collection_url
-      end
-
-      class << self
-        attr_accessor :parent_data
-        attr_accessor :callbacks
-
-        def belongs_to(model_name, options = {})
-          @parent_data ||= {}
-          @parent_data[:model_name] = model_name
-          @parent_data[:model_class] = model_name.to_s.classify.constantize
-          @parent_data[:find_by] = options[:find_by] || :id
-        end
-
-        def new_action
-          @callbacks ||= {}
-          @callbacks[:new_action] ||= ActionCallbacks.new
-        end
-
-        def create
-          @callbacks ||= {}
-          @callbacks[:create] ||= ActionCallbacks.new
-        end
-
-        def update
-          @callbacks ||= {}
-          @callbacks[:update] ||= ActionCallbacks.new
-        end
-
-        def destroy
-          @callbacks ||= {}
-          @callbacks[:destroy] ||= ActionCallbacks.new
-        end
-      end
-
-      def model_class
-        "Spree::#{controller_name.classify}".constantize
-      end
-
-      def model_name
-        parent_data[:model_name].gsub('spree/', '')
-      end
-
-      def object_name
-        controller_name.singularize
-      end
-
-      def load_resource
-        if member_action?
-          @object ||= load_resource_instance
-
-          # call authorize! a third time (called twice already in Admin::BaseController)
-          # this time we pass the actual instance so fine-grained abilities can control
-          # access to individual records, not just entire models.
-          authorize! action, @object
-
-          instance_variable_set("@#{object_name}", @object)
-
-          # If we don't have access, clear the object
-          unless can? action, @object
-            instance_variable_set("@#{object_name}", nil)
-          end
-
-          authorize! action, @object
-        else
-          @collection ||= collection
-
-          # note: we don't call authorize here as the collection method should use
-          # CanCan's accessible_by method to restrict the actual records returned
-
-          instance_variable_set("@#{controller_name}", @collection)
-        end
-      end
-
-      def load_resource_instance
-        if new_actions.include?(action)
-          build_resource
-        elsif params[:id]
-          find_resource
-        end
-      end
-
-      def parent_data
-        self.class.parent_data
-      end
-
-      def parent
-        return nil if parent_data.blank?
-
-        @parent ||= parent_data[:model_class].
-          public_send("find_by", parent_data[:find_by] => params["#{model_name}_id"])
-        instance_variable_set("@#{model_name}", @parent)
-      end
-
-      def find_resource
-        if parent_data.present?
-          parent.public_send(controller_name).find(params[:id])
-        else
-          model_class.find(params[:id])
-        end
-      end
-
-      def build_resource
-        if parent_data.present?
-          parent.public_send(controller_name).build
-        else
-          model_class.new
-        end
-      end
-
-      def collection
-        return parent.public_send(controller_name) if parent_data.present?
-
-        if model_class.respond_to?(:accessible_by) &&
-           !current_ability.has_block?(params[:action], model_class)
-          model_class.accessible_by(current_ability, action)
-        else
-          model_class.scoped
-        end
-      end
-
-      def location_after_save
-        collection_url
-      end
-
-      def invoke_callbacks(action, callback_type)
-        callbacks = self.class.callbacks || {}
-        return if callbacks[action].nil?
-
-        case callback_type.to_sym
-        when :before then callbacks[action].before_methods.each { |method| __send__ method }
-        when :after  then callbacks[action].after_methods.each  { |method| __send__ method }
-        when :fails  then callbacks[action].fails_methods.each  { |method| __send__ method }
-        end
-      end
-
-      # URL helpers
-
-      def new_object_url(options = {})
-        if parent_data.present?
-          spree.new_polymorphic_url([:admin, parent, model_class], options)
-        else
-          spree.new_polymorphic_url([:admin, model_class], options)
-        end
-      end
-
-      def edit_object_url(object, options = {})
-        if parent_data.present?
-          spree.public_send "edit_admin_#{model_name}_#{object_name}_url", parent, object, options
-        else
-          spree.public_send "edit_admin_#{object_name}_url", object, options
-        end
-      end
-
-      def object_url(object = nil, options = {})
-        target = object || @object
-        if parent_data.present?
-          spree.public_send "admin_#{model_name}_#{object_name}_url", parent, target, options
-        else
-          spree.public_send "admin_#{object_name}_url", target, options
-        end
-      end
-
-      # Permit specific list of params
-      #
-      # Example: params.require(object_name).permit(:name)
-      def permitted_resource_params
-        raise "All extending controllers need to override the method permitted_resource_params"
-      end
-
-      def collection_url(options = {})
-        if parent_data.present?
-          spree.polymorphic_url([:admin, parent, model_class], options)
-        else
-          spree.polymorphic_url([:admin, model_class], options)
-        end
-      end
-
-      def collection_actions
-        [:index]
-      end
-
-      def member_action?
-        !collection_actions.include? action
-      end
-
-      def new_actions
-        [:new, :create]
-      end
-    end
-  end
-end

app/controllers/spree/admin/return_authorizations_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class ReturnAuthorizationsController < ResourceController
+    class ReturnAuthorizationsController < ::Admin::ResourceController
       belongs_to 'spree/order', find_by: :number
 
       update.after :associate_inventory_units

app/controllers/spree/admin/shipping_categories_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class ShippingCategoriesController < ResourceController
+    class ShippingCategoriesController < ::Admin::ResourceController
       protected
 
       def permitted_resource_params

app/controllers/spree/admin/shipping_methods_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class ShippingMethodsController < ResourceController
+    class ShippingMethodsController < ::Admin::ResourceController
       before_action :load_data, except: [:index]
       before_action :set_shipping_category, only: [:create, :update]
       before_action :set_zones, only: [:create, :update]
@@ -50,7 +50,7 @@ module Spree
 
       def load_hubs
         # rubocop:disable Style/TernaryParentheses
-        @hubs = Enterprise.managed_by(spree_current_user).is_distributor.sort_by! do |d|
+        @hubs = Enterprise.managed_by(spree_current_user).is_distributor.to_a.sort_by! do |d|
           [(@shipping_method.has_distributor? d) ? 0 : 1, d.name]
         end
         # rubocop:enable Style/TernaryParentheses
@@ -86,12 +86,7 @@ module Spree
         params.require(:shipping_method).permit(
           :name, :description, :display_on, :require_ship_address, :tag_list, :calculator_type,
           distributor_ids: [],
-          calculator_attributes: [
-            :id, :preferred_currency, :preferred_amount, :preferred_unit_from_list,
-            :preferred_per_unit, :preferred_flat_percent, :preferred_first_item,
-            :preferred_additional_item, :preferred_max_items, :preferred_minimal_amount,
-            :preferred_normal_amount, :preferred_discount_amount
-          ]
+          calculator_attributes: PermittedAttributes::Calculator.attributes
         )
       end
     end

app/controllers/spree/admin/states_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class StatesController < ResourceController
+    class StatesController < ::Admin::ResourceController
       belongs_to 'spree/country'
       before_action :load_data
 

app/controllers/spree/admin/tax_categories_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class TaxCategoriesController < ResourceController
+    class TaxCategoriesController < ::Admin::ResourceController
       def destroy
         if @object.destroy
           flash[:success] = flash_message_for(@object, :successfully_removed)

app/controllers/spree/admin/tax_rates_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class TaxRatesController < ResourceController
+    class TaxRatesController < ::Admin::ResourceController
       before_action :load_data
 
       private

app/controllers/spree/admin/taxonomies_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class TaxonomiesController < ResourceController
+    class TaxonomiesController < ::Admin::ResourceController
       respond_to :json, only: [:get_children]
 
       def get_children

app/controllers/spree/admin/users_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class UsersController < ResourceController
+    class UsersController < ::Admin::ResourceController
       rescue_from Spree::User::DestroyWithOrdersError, with: :user_destroy_with_orders_error
 
       after_action :sign_in_if_change_own_password, only: :update
@@ -100,7 +100,7 @@ module Spree
 
       private
 
-      # handling raise from Spree::Admin::ResourceController#destroy
+      # handling raise from Admin::ResourceController#destroy
       def user_destroy_with_orders_error
         invoke_callbacks(:destroy, :fails)
         render status: :forbidden, text: Spree.t(:error_user_destroy_with_orders)

app/controllers/spree/admin/variants_controller.rb

@@ -2,7 +2,7 @@ require 'open_food_network/scope_variants_for_search'
 
 module Spree
   module Admin
-    class VariantsController < ResourceController
+    class VariantsController < ::Admin::ResourceController
       helper 'spree/products'
 
       belongs_to 'spree/product', find_by: :permalink
@@ -21,9 +21,11 @@ module Spree
 
         if @object.update(permitted_resource_params)
           flash[:success] = flash_message_for(@object, :successfully_updated)
-          redirect_to admin_product_variants_url(params[:product_id], @url_filters)
+          redirect_to spree.admin_product_variants_url(params[:product_id], @url_filters)
         else
-          redirect_to edit_admin_product_variant_url(params[:product_id], @object, @url_filters)
+          redirect_to spree.edit_admin_product_variant_url(params[:product_id],
+                                                           @object,
+                                                           @url_filters)
         end
       end
 
@@ -40,9 +42,9 @@ module Spree
         @object.attributes = permitted_resource_params
         if @object.save
           flash[:success] = flash_message_for(@object, :successfully_created)
-          redirect_to admin_product_variants_url(params[:product_id], @url_filters)
+          redirect_to spree.admin_product_variants_url(params[:product_id], @url_filters)
         else
-          redirect_to new_admin_product_variant_url(params[:product_id], @url_filters)
+          redirect_to spree.new_admin_product_variant_url(params[:product_id], @url_filters)
         end
 
         return unless @object.present? && @object.valid?

app/controllers/spree/admin/zones_controller.rb

@@ -1,6 +1,6 @@
 module Spree
   module Admin
-    class ZonesController < ResourceController
+    class ZonesController < ::Admin::ResourceController
       before_action :load_data, except: [:index]
 
       def new

app/controllers/spree/credit_cards_controller.rb

@@ -1,3 +1,5 @@
+require 'stripe/credit_card_clone_destroyer'
+
 module Spree
   class CreditCardsController < BaseController
     def new_from_token
@@ -27,6 +29,7 @@ module Spree
       authorize! :update, @credit_card
 
       if @credit_card.update(credit_card_params)
+        remove_shop_authorizations if credit_card_params["is_default"]
         render json: @credit_card, serializer: ::Api::CreditCardSerializer, status: :ok
       else
         update_failed
@@ -44,6 +47,7 @@ module Spree
 
       # Using try because we may not have a card here
       if @credit_card.try(:destroy)
+        remove_shop_authorizations if @credit_card.is_default
         flash[:success] = I18n.t(:card_has_been_removed, number: "x-#{@credit_card.last_digits}")
       else
         flash[:error] = I18n.t(:card_could_not_be_removed)
@@ -56,18 +60,16 @@ module Spree
 
     private
 
-    # It destroys the whole customer object
-    def destroy_at_stripe
-      stripe_customer = Stripe::Customer.retrieve(@credit_card.gateway_customer_profile_id, {})
-
-      stripe_customer&.delete
+    def remove_shop_authorizations
+      @credit_card.user.customers.update_all(allow_charges: false)
     end
 
-    def stripe_account_id
-      StripeAccount.
-        find_by(enterprise_id: @credit_card.payment_method.preferred_enterprise_id).
-        andand.
-        stripe_user_id
+    # It destroys the whole customer object
+    def destroy_at_stripe
+      Stripe::CreditCardCloneDestroyer.new.destroy_clones(@credit_card)
+
+      stripe_customer = Stripe::Customer.retrieve(@credit_card.gateway_customer_profile_id, {})
+      stripe_customer&.delete unless stripe_customer.deleted?
     end
 
     def create_customer(token)

app/controllers/spree/orders_controller.rb

@@ -1,6 +1,3 @@
-require 'spree/core/controller_helpers/order'
-require 'spree/core/controller_helpers/auth'
-
 module Spree
   class OrdersController < Spree::StoreController
     include OrderCyclesHelper

app/controllers/spree/paypal_controller_decorator.rb

@@ -1,11 +1,87 @@
 # frozen_string_literal: true
 
 Spree::PaypalController.class_eval do
+  include OrderStockCheck
+
   before_action :enable_embedded_shopfront
   before_action :destroy_orphaned_paypal_payments, only: :confirm
   after_action :reset_order_when_complete, only: :confirm
   before_action :permit_parameters!
 
+  def express
+    order = current_order || raise(ActiveRecord::RecordNotFound)
+    items = order.line_items.map(&method(:line_item))
+
+    tax_adjustments = order.adjustments.tax
+    # TODO: Remove in Spree 2.2
+    tax_adjustments = tax_adjustments.additional if tax_adjustments.respond_to?(:additional)
+    shipping_adjustments = order.adjustments.shipping
+
+    order.adjustments.eligible.each do |adjustment|
+      next if (tax_adjustments + shipping_adjustments).include?(adjustment)
+
+      items << {
+        Name: adjustment.label,
+        Quantity: 1,
+        Amount: {
+          currencyID: order.currency,
+          value: adjustment.amount
+        }
+      }
+    end
+
+    # Because PayPal doesn't accept $0 items at all.
+    # See #10
+    # https://cms.paypal.com/uk/cgi-bin/?cmd=_render-content&content_ID=developer/e_howto_api_ECCustomizing
+    # "It can be a positive or negative value but not zero."
+    items.reject! do |item|
+      item[:Amount][:value].zero?
+    end
+    pp_request = provider.build_set_express_checkout(express_checkout_request_details(order, items))
+
+    begin
+      pp_response = provider.set_express_checkout(pp_request)
+      if pp_response.success?
+        # At this point Paypal has *provisionally* accepted that the payment can now be placed,
+        # and the user will be redirected to a Paypal payment page. On completion, the user is
+        # sent back and the response is handled in the #confirm action in this controller.
+        redirect_to provider.express_checkout_url(pp_response, useraction: 'commit')
+      else
+        flash[:error] = Spree.t('flash.generic_error', scope: 'paypal', reasons: pp_response.errors.map(&:long_message).join(" "))
+        redirect_to spree.checkout_state_path(:payment)
+      end
+    rescue SocketError
+      flash[:error] = Spree.t('flash.connection_failed', scope: 'paypal')
+      redirect_to spree.checkout_state_path(:payment)
+    end
+  end
+
+  def confirm
+    @order = current_order || raise(ActiveRecord::RecordNotFound)
+
+    # At this point the user has come back from the Paypal form, and we get one
+    # last chance to interact with the payment process before the money moves...
+    return reset_to_cart unless sufficient_stock?
+
+    @order.payments.create!({
+      source: Spree::PaypalExpressCheckout.create({
+        token: params[:token],
+        payer_id: params[:PayerID]
+      }),
+      amount: @order.total,
+      payment_method: payment_method
+    })
+    @order.next
+    if @order.complete?
+      flash.notice = Spree.t(:order_processed_successfully)
+      flash[:commerce_tracking] = "nothing special"
+      session[:order_id] = nil
+      redirect_to completion_route(@order)
+    else
+      redirect_to checkout_state_path(@order.state)
+    end
+  end
+
   def cancel
     flash[:notice] = Spree.t('flash.cancel', scope: 'paypal')
     redirect_to main_app.checkout_path
@@ -21,6 +97,10 @@ Spree::PaypalController.class_eval do
 
   private
 
+  def payment_method
+    @payment_method ||= Spree::PaymentMethod.find(params[:payment_method_id])
+  end
+
   def permit_parameters!
     params.permit(:token, :payment_method_id, :PayerID)
   end
@@ -34,6 +114,11 @@ Spree::PaypalController.class_eval do
     end
   end
 
+  def reset_to_cart
+    OrderCheckoutRestart.new(@order).call
+    handle_insufficient_stock
+  end
+
   # See #1074 and #1837 for more detail on why we need this
   # An 'orphaned' Spree::Payment is created for every call to CheckoutController#update
   # for orders that are processed using a Spree::Gateway::PayPalExpress payment method
@@ -49,4 +134,24 @@ Spree::PaypalController.class_eval do
     orphaned_payments = current_order.payments.where(payment_method_id: payment_method.id, source_id: nil)
     orphaned_payments.each(&:destroy)
   end
+
+  def completion_route(order)
+    spree.order_path(order, token: order.token)
+  end
+
+  def express_checkout_request_details(order, items)
+    {
+      SetExpressCheckoutRequestDetails: {
+        InvoiceID: order.number,
+        BuyerEmail: order.email,
+        ReturnURL: spree.confirm_paypal_url(payment_method_id: params[:payment_method_id], utm_nooverride: 1),
+        CancelURL: spree.cancel_paypal_url,
+        SolutionType: payment_method.preferred_solution.presence || "Mark",
+        LandingPage: payment_method.preferred_landing_page.presence || "Billing",
+        cppheaderimage: payment_method.preferred_logourl.presence || "",
+        NoShipping: 1,
+        PaymentDetails: [payment_details(items)]
+      }
+    }
+  end
 end

app/controllers/spree/user_registrations_controller.rb

@@ -18,26 +18,6 @@ module Spree
     before_action :check_permissions, only: [:edit, :update]
     skip_before_action :require_no_authentication
 
-    # GET /resource/sign_up
-    def new
-      super
-      @user = resource
-    end
-
-    # POST /resource/sign_up
-    def create
-      @user = build_resource(params[:spree_user])
-      if resource.save
-        set_flash_message(:notice, :signed_up)
-        sign_in(:spree_user, @user)
-        associate_user
-        respond_with resource, location: after_sign_up_path_for(resource)
-      else
-        clean_up_passwords(resource)
-        render :new
-      end
-    end
-
     # GET /resource/edit
     def edit
       super

app/helpers/admin/injection_helper.rb

@@ -184,6 +184,12 @@ module Admin
                        json: "'#{@spree_api_key}'" }
     end
 
+    def admin_inject_available_units
+      admin_inject_json "admin.products",
+                        "availableUnits",
+                        Spree::Config.available_units
+    end
+
     def admin_inject_json(ng_module, name, data)
       json = data.to_json
       render partial: "admin/json/injection_ams",

app/helpers/application_helper.rb

@@ -1,6 +1,6 @@
 module ApplicationHelper
-  def feature?(feature)
-    OpenFoodNetwork::FeatureToggle.enabled? feature
+  def feature?(feature, user = nil)
+    OpenFoodNetwork::FeatureToggle.enabled?(feature, user)
   end
 
   def ng_form_for(name, *args, &block)

app/helpers/checkout_helper.rb

@@ -7,6 +7,8 @@ module CheckoutHelper
     adjustments = order.adjustments.eligible
     exclude = opts[:exclude] || {}
 
+    adjustments = adjustments.to_a
+
     # Remove empty tax adjustments and (optionally) shipping fees
     adjustments.reject! { |a| a.originator_type == 'Spree::TaxRate' && a.amount == 0 }
     adjustments.reject! { |a| a.originator_type == 'Spree::ShippingMethod' } if exclude.include? :shipping
@@ -16,7 +18,9 @@ module CheckoutHelper
     enterprise_fee_adjustments = adjustments.select { |a| a.originator_type == 'EnterpriseFee' && a.source_type != 'Spree::LineItem' }
     adjustments.reject! { |a| a.originator_type == 'EnterpriseFee' && a.source_type != 'Spree::LineItem' }
     unless exclude.include? :admin_and_handling
-      adjustments << Spree::Adjustment.new(label: I18n.t(:orders_form_admin), amount: enterprise_fee_adjustments.sum(&:amount))
+      adjustments << Spree::Adjustment.new(
+        label: I18n.t(:orders_form_admin), amount: enterprise_fee_adjustments.map(&:amount).sum
+      )
     end
 
     adjustments
@@ -24,7 +28,7 @@ module CheckoutHelper
 
   def display_checkout_admin_and_handling_adjustments_total_for(order)
     adjustments = order.adjustments.eligible.where('originator_type = ? AND source_type != ? ', 'EnterpriseFee', 'Spree::LineItem')
-    Spree::Money.new adjustments.sum(&:amount), currency: order.currency
+    Spree::Money.new adjustments.map(&:amount).sum, currency: order.currency
   end
 
   def checkout_line_item_adjustments(order)
@@ -32,7 +36,7 @@ module CheckoutHelper
   end
 
   def checkout_subtotal(order)
-    order.item_total + checkout_line_item_adjustments(order).sum(&:amount)
+    order.item_total + checkout_line_item_adjustments(order).map(&:amount).sum
   end
 
   def display_checkout_subtotal(order)

app/helpers/html_helper.rb

@@ -1,21 +0,0 @@
-module HtmlHelper
-  def strip_html(html)
-    strip_surrounding_whitespace substitute_entities strip_tags add_linebreaks html
-  end
-
-  def substitute_entities(html)
-    html.andand.gsub(/ /i, ' ').andand.gsub(/&/i, '&')
-  end
-
-  def add_linebreaks(html)
-    # I know Cthulu is coming for me. Forgive me.
-    # http://stackoverflow.com/a/1732454/2720566
-    html.
-      andand.gsub(%r{</h[^>]>|</p>|</div>}, "\\1\n\n").
-      andand.gsub(/<br[^>]*>/, "\\1\n")
-  end
-
-  def strip_surrounding_whitespace(html)
-    html.andand.strip
-  end
-end

app/helpers/injection_helper.rb

@@ -4,7 +4,7 @@ module InjectionHelper
   include SerializerHelper
 
   def inject_enterprises(enterprises = nil)
-    inject_json_ams(
+    inject_json_array(
       "enterprises",
       enterprises || default_enterprise_query,
       Api::EnterpriseSerializer,
@@ -15,7 +15,7 @@ module InjectionHelper
   def inject_groups
     select_only = required_attributes EnterpriseGroup, Api::GroupListSerializer
 
-    inject_json_ams(
+    inject_json_array(
       "groups",
       EnterpriseGroup.on_front_page.by_position.select(select_only).
         includes(enterprises: [:shipping_methods, { address: [:state, :country] }],
@@ -26,7 +26,7 @@ module InjectionHelper
   end
 
   def inject_enterprise_shopfront(enterprise)
-    inject_json_ams(
+    inject_json(
       "shopfront",
       enterprise,
       Api::EnterpriseShopfrontSerializer
@@ -36,7 +36,7 @@ module InjectionHelper
   def inject_enterprise_shopfront_list
     select_only = required_attributes Enterprise, Api::EnterpriseShopfrontListSerializer
 
-    inject_json_ams(
+    inject_json_array(
       "enterprises",
       Enterprise.activated.visible.select(select_only).includes(address: [:state, :country]).all,
       Api::EnterpriseShopfrontListSerializer
@@ -50,13 +50,13 @@ module InjectionHelper
       includes(:properties, address: [:state, :country], supplied_products: :properties).
       all
 
-    inject_json_ams "enterprises",
-                    enterprises_and_relatives,
-                    Api::EnterpriseSerializer, enterprise_injection_data
+    inject_json_array "enterprises",
+                      enterprises_and_relatives,
+                      Api::EnterpriseSerializer, enterprise_injection_data
   end
 
   def inject_group_enterprises
-    inject_json_ams(
+    inject_json_array(
       "enterprises",
       @group.enterprises.activated.all,
       Api::EnterpriseSerializer,
@@ -65,11 +65,18 @@ module InjectionHelper
   end
 
   def inject_current_hub
-    inject_json_ams "currentHub", current_distributor, Api::EnterpriseSerializer, enterprise_injection_data
+    inject_json "currentHub",
+                current_distributor,
+                Api::EnterpriseSerializer,
+                enterprise_injection_data
   end
 
   def inject_current_order
-    inject_json_ams "currentOrder", current_order, Api::CurrentOrderSerializer, current_distributor: current_distributor, current_order_cycle: current_order_cycle
+    inject_json "currentOrder",
+                current_order,
+                Api::CurrentOrderSerializer,
+                current_distributor: current_distributor,
+                current_order_cycle: current_order_cycle
   end
 
   def inject_current_order_cycle
@@ -79,73 +86,78 @@ module InjectionHelper
   end
 
   def inject_available_shipping_methods
-    inject_json_ams "shippingMethods", available_shipping_methods,
-                    Api::ShippingMethodSerializer, current_order: current_order
+    inject_json_array "shippingMethods", available_shipping_methods,
+                      Api::ShippingMethodSerializer, current_order: current_order
   end
 
   def inject_available_payment_methods
-    inject_json_ams "paymentMethods", available_payment_methods,
-                    Api::PaymentMethodSerializer, current_order: current_order
+    inject_json_array "paymentMethods", available_payment_methods,
+                      Api::PaymentMethodSerializer, current_order: current_order
   end
 
   def inject_taxons
-    inject_json_ams "taxons", Spree::Taxon.all.to_a, Api::TaxonSerializer
+    inject_json_array "taxons", Spree::Taxon.all.to_a, Api::TaxonSerializer
   end
 
   def inject_properties
-    inject_json_ams "properties", Spree::Property.all.to_a, Api::PropertySerializer
+    inject_json_array "properties", Spree::Property.all.to_a, Api::PropertySerializer
   end
 
   def inject_currency_config
-    inject_json_ams "currencyConfig", {}, Api::CurrencyConfigSerializer
+    inject_json "currencyConfig", {}, Api::CurrencyConfigSerializer
   end
 
   def inject_open_street_map_config
-    inject_json_ams "openStreetMapConfig", {}, Api::OpenStreetMapConfigSerializer
+    inject_json "openStreetMapConfig", {}, Api::OpenStreetMapConfigSerializer
   end
 
   def inject_spree_api_key
-    render partial: "json/injection_ams", locals: { name: 'spreeApiKey', json: "'#{@spree_api_key}'" }
+    render partial: "json/injection_ams",
+           locals: { name: 'spreeApiKey', json: "'#{@spree_api_key}'" }
   end
 
   def inject_available_countries
-    inject_json_ams "availableCountries", available_countries, Api::CountrySerializer
+    inject_json_array "availableCountries", available_countries, Api::CountrySerializer
   end
 
   def inject_enterprise_attributes
-    render partial: "json/injection_ams", locals: { name: 'enterpriseAttributes', json: @enterprise_attributes.to_json.to_s }
+    render partial: "json/injection_ams",
+           locals: { name: 'enterpriseAttributes', json: @enterprise_attributes.to_json.to_s }
   end
 
   def inject_orders
-    inject_json_ams "orders", @orders.all, Api::OrderSerializer
+    inject_json_array "orders", @orders.all, Api::OrderSerializer
   end
 
   def inject_shops
     customers = spree_current_user.customers
-    shops = Enterprise.where(id: @orders.pluck(:distributor_id).uniq | customers.pluck(:enterprise_id))
-    inject_json_ams "shops", shops.all, Api::ShopForOrdersSerializer
+    shops = Enterprise.where(id: @orders.pluck(:distributor_id).uniq |
+                                 customers.pluck(:enterprise_id))
+    inject_json_array "shops", shops.all, Api::ShopForOrdersSerializer
   end
 
   def inject_saved_credit_cards
     data = spree_current_user ? spree_current_user.credit_cards.with_payment_profile.all : []
 
-    inject_json_ams "savedCreditCards", data, Api::CreditCardSerializer
+    inject_json_array "savedCreditCards", data, Api::CreditCardSerializer
   end
 
   def inject_current_user
-    inject_json_ams "user", spree_current_user, Api::UserSerializer
+    inject_json "user", spree_current_user, Api::UserSerializer
   end
 
   def inject_rails_flash
-    inject_json_ams "railsFlash", OpenStruct.new(flash.to_hash), Api::RailsFlashSerializer
+    inject_json "railsFlash", OpenStruct.new(flash.to_hash), Api::RailsFlashSerializer
   end
 
-  def inject_json_ams(name, data, serializer, opts = {})
-    if data.is_a?(Array)
-      opts = { each_serializer: serializer }.merge(opts)
-      serializer = ActiveModel::ArraySerializer
-    end
+  def inject_json_array(name, data, serializer, opts = {})
+    opts = { each_serializer: serializer }.merge(opts)
+    serializer = ActiveModel::ArraySerializer
 
+    inject_json(name, data, serializer, opts)
+  end
+
+  def inject_json(name, data, serializer, opts = {})
     serializer_instance = serializer.new(data, opts)
     json = serializer_instance.to_json
     render partial: "json/injection_ams", locals: { name: name, json: json }