Merge branch 'active-storage' into HEAD

Creating a seperate release off the master branch.

.env

@@ -53,18 +53,11 @@ SMTP_PASSWORD="f00d"
 # see="https://developers.google.com/maps/documentation/javascript/get-api-key
 # GOOGLE_MAPS_API_KEY="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
 
-# Stripe Connect details for instance account
-# Find these under 'API keys' and 'Connect' in your Stripe account dashboard -> Account Settings
+# Stripe details for instance account
+# Find these under 'Developers' -> 'API keys' in your Stripe account dashboard.
 # Under 'Connect', the Redirect URI should be set to https://YOUR_SERVER_URL/stripe/callbacks (e.g. https://openfoodnetwork.org.uk/stripe/callbacks)
 # Under 'Webhooks', you should set up a Connect endpoint pointing to https://YOUR_SERVER_URL/stripe/webhooks e.g. (https://openfoodnetwork.org.uk/stripe/webhooks)
 # STRIPE_INSTANCE_SECRET_KEY="sk_test_xxxxxx" # This can be a test key or a live key
 # STRIPE_INSTANCE_PUBLISHABLE_KEY="pk_test_xxxx" # This can be a test key or a live key
 # STRIPE_CLIENT_ID="ca_xxxx" # This can be a development ID or a production ID
 # STRIPE_ENDPOINT_SECRET="whsec_xxxx"
-
-# Feature toggles
-#
-# Adding user emails separated by commas will enable them the use of certain features. See
-# config/initializers/feature_toggles.rb for details.
-#
-# BETA_TESTERS="ofn@example.com,superadmin@example.com"

.github/ISSUE_TEMPLATE/release.md

@@ -28,7 +28,7 @@ assignees: ''
   <pre>
   git checkout master # same version as the release draft
   git fetch upstream
-  git diff upstream master -- config/locales/en.yml
+  git diff upstream/master -- config/locales/en.yml
   tx pull --force # if no changes or only additions in the locale
   git checkout --detach # if we need to commit new translations
   git commit -a -m "Update translations"
@@ -43,7 +43,6 @@ assignees: ''
   <pre>
   cd ofn-install
   git pull
-  (cd ../ofn-secrets && git pull)
   ansible-playbook --limit all-prod --extra-vars "git_version=vx.y.z" playbooks/deploy.yml
   </pre>
   </details>

.github/workflows/linters.yml

@@ -11,6 +11,8 @@ jobs:
       - name: rubocop
         uses: reviewdog/action-rubocop@v2
         with:
+          rubocop_version: gemfile
+          rubocop_extensions: rubocop-rails:gemfile
           reporter: github-pr-check
           level: error
           fail_on_error: true

.github/workflows/mapi.yml

@@ -0,0 +1,46 @@
+name: 'Mayhem for API'
+on: [push]
+jobs:
+  test:
+    if: ${{ github.repository_owner == 'openfoodfoundation' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+    steps:
+    - uses: actions/checkout@v2
+    - run: docker/build
+    - run: docker-compose up --detach
+    - run: until curl -f -s http://localhost:3000; do echo "waiting for api server"; sleep 1; done
+    - run: docker-compose exec -T db psql postgresql://ofn:f00d@localhost:5432/open_food_network_dev --command="update spree_users set spree_api_key='testing' where login='ofn@example.com'"
+    # equivalent to Flipper.enable(:api_v1)
+    - run: docker-compose exec -T db psql postgresql://ofn:f00d@localhost:5432/open_food_network_dev --command="insert into flipper_features (key, created_at, updated_at) values ('api_v1', localtimestamp, localtimestamp)"
+    - run: docker-compose exec -T db psql postgresql://ofn:f00d@localhost:5432/open_food_network_dev --command="insert into flipper_gates (feature_key, key, value, created_at, updated_at) values ('api_v1', 'boolean', 'true', localtimestamp, localtimestamp)"
+
+    # Run Mayhem for API
+    - name: Run Mayhem for API
+      uses: ForAllSecure/mapi-action@v1
+      continue-on-error: true
+      with:
+        mapi-token: ${{ secrets.MAPI_TOKEN }}
+        api-url: http://localhost:3000
+        api-spec: swagger/v1/swagger.yaml
+        target: openfoodfoundation/openfoodnetwork
+        duration: 1min
+        sarif-report: mapi.sarif
+        html-report: mapi.html
+        run-args: |
+          --header-auth
+          X-Api-Token: testing
+
+    # Archive HTML report
+    - name: Archive Mayhem for API report
+      uses: actions/upload-artifact@v2
+      with:
+        name: mapi-report
+        path: mapi.html
+
+    # Upload SARIF file (only available on public repos or github enterprise)
+    - name: Upload SARIF file
+      uses: github/codeql-action/upload-sarif@v1
+      with:
+        sarif_file: mapi.sarif

.gitignore

@@ -15,6 +15,7 @@ db/*.csv
 log/*.log
 log/*.log.lck
 log/*.log.*
+/storage
 tmp/
 .idea/*
 \#*

.rubocop.yml

@@ -10,6 +10,9 @@ inherit_from:
   # The automatically generated todo list to ignore all current violations.
   - .rubocop_todo.yml
 
+  # The relaxed style rules as a common starting point which we can refine.
+  - .rubocop_relaxed_styleguide.yml
+
   # Our Open Food Network style guide. If you want to see all violations,
   # then use only that configuration:
   #

.rubocop_relaxed_styleguide.yml

@@ -0,0 +1,153 @@
+# Relaxed.Ruby.Style
+## Version 2.5
+
+Style/Alias:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylealias
+
+Style/AsciiComments:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleasciicomments
+
+Style/BeginBlock:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylebeginblock
+
+Style/BlockDelimiters:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleblockdelimiters
+
+Style/CommentAnnotation:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylecommentannotation
+
+Style/Documentation:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styledocumentation
+
+Layout/DotPosition:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#layoutdotposition
+
+Style/DoubleNegation:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styledoublenegation
+
+Style/EndBlock:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleendblock
+
+Style/FormatString:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleformatstring
+
+Style/IfUnlessModifier:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleifunlessmodifier
+
+Style/Lambda:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylelambda
+
+Style/ModuleFunction:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylemodulefunction
+
+Style/MultilineBlockChain:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylemultilineblockchain
+
+Style/NegatedIf:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylenegatedif
+
+Style/NegatedWhile:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylenegatedwhile
+
+Style/NumericPredicate:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylenumericpredicate
+
+Style/ParallelAssignment:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleparallelassignment
+
+Style/PercentLiteralDelimiters:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylepercentliteraldelimiters
+
+Style/PerlBackrefs:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleperlbackrefs
+
+Style/Semicolon:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylesemicolon
+
+Style/SignalException:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylesignalexception
+
+Style/SingleLineBlockParams:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylesinglelineblockparams
+
+Style/SingleLineMethods:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylesinglelinemethods
+
+Layout/SpaceBeforeBlockBraces:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#layoutspacebeforeblockbraces
+
+Layout/SpaceInsideParens:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#layoutspaceinsideparens
+
+Style/SpecialGlobalVars:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylespecialglobalvars
+
+Style/StringLiterals:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylestringliterals
+
+Style/TrailingCommaInArguments:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styletrailingcommainarguments
+
+Style/TrailingCommaInArrayLiteral:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styletrailingcommainarrayliteral
+
+Style/TrailingCommaInHashLiteral:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styletrailingcommainhashliteral
+
+Style/SymbolArray:
+  Enabled: false
+  StyleGuide: http://relaxed.ruby.style/#stylesymbolarray
+
+Style/WhileUntilModifier:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylewhileuntilmodifier
+
+Style/WordArray:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylewordarray
+
+Lint/AmbiguousRegexpLiteral:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#lintambiguousregexpliteral
+
+Lint/AssignmentInCondition:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#lintassignmentincondition
+
+Layout/LineLength:
+  Enabled: false
+
+Metrics:
+  Enabled: false
+

.rubocop_specs.yml

@@ -1,7 +0,0 @@
-inherit_from:
-  - .rubocop.yml
-
-# This rubocop config file is only used for specs
-# Here we allow specs to be 300 lines long
-Metrics/ModuleLength:
-  Max: 300

.rubocop_styleguide.yml

@@ -19,6 +19,30 @@ AllCops:
 #
 # Cop settings that have been agreed upon by the OFN community
 
+Metrics:
+  Enabled: true
+
+Metrics/BlockLength:
+  IgnoredMethods: [
+    "class_eval",
+    "collection",
+    "context",
+    "delete",
+    "describe",
+    "feature",
+    "get",
+    "it",
+    "member",
+    "namespace",
+    "path",
+    "post",
+    "put",
+    "resource",
+    "resources",
+    "scenario",
+    "shared_examples",
+  ]
+
 Rails/SkipsModelValidations:
   AllowedMethods:
     - "touch"
@@ -46,6 +70,7 @@ Layout/MultilineMethodCallIndentation:
   EnforcedStyle: indented
 
 Layout/LineLength:
+  Enabled: true
   Max: 100
 
 Lint/RaiseException:
@@ -54,6 +79,11 @@ Lint/RaiseException:
 Lint/StructNewOverride:
   Enabled: true
 
+Naming/VariableNumber:
+  AllowedIdentifiers:
+    - street_address_1
+    - street_address_2
+
 Bundler/DuplicatedGem:
   Enabled: false
 
@@ -75,156 +105,20 @@ Lint/UselessAssignment:
   Exclude:
   - spec/**/*
 
-## Relaxed.Ruby.Style SETTINGS
-#
-# These styles are a starting point for the conversation around conventions
-# They should be removed or tweaked and moved above as decisions are made
-# NOTE: Cops which did not fail at the time of writing were removed
-
-Layout/DotPosition:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#styledotposition
-
-Layout/SpaceBeforeBlockBraces:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylespacebeforeblockbraces
-
-Layout/SpaceInsideParens:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylespaceinsideparens
-
-Style/Alias:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylealias
-
-Style/BlockDelimiters:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#styleblockdelimiters
-
-Style/CommentAnnotation:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylecommentannotation
-
-Style/DoubleNegation:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#styledoublenegation
-
-Style/FormatString:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#styleformatstring
-
-Style/HashEachMethods:
-  Enabled: false
-
-Style/HashTransformKeys:
-  Enabled: false
-
-Style/HashTransformValues:
-  Enabled: false
-
-Style/IfUnlessModifier:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#styleifunlessmodifier
-
-Style/Lambda:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylelambda
-
-Style/MultilineBlockChain:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylemultilineblockchain
-
-Style/NegatedIf:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylenegatedif
-
-Style/NegatedWhile:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylenegatedwhile
-
-Style/ParallelAssignment:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#styleparallelassignment
-
-Style/PercentLiteralDelimiters:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylepercentliteraldelimiters
-
-Style/Semicolon:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylesemicolon
-
-Style/SingleLineMethods:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylesinglelinemethods
-
-Style/TrailingCommaInArguments:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#styletrailingcommainarguments
-
-Style/TrailingCommaInArrayLiteral:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#styletrailingcommainliteral
-
-Style/TrailingCommaInHashLiteral:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#styletrailingcommainliteral
-
-Style/WordArray:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#stylewordarray
-
-Style/SymbolArray:
-  Enabled: false
-  StyleGuide: https://rubocop.readthedocs.io/en/latest/cops_style/#stylesymbolarray
-
-Lint/AmbiguousRegexpLiteral:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#lintambiguousregexpliteral
-
-Lint/AssignmentInCondition:
-  Enabled: false
-  StyleGuide: http://relaxed.ruby.style/#lintassignmentincondition
+Lint/MissingSuper:
+  Exclude:
+    - 'app/components/**/*'
 
 Metrics/AbcSize:
-  Max: 15
-
-Metrics/BlockLength:
-  Max: 25
-  IgnoredMethods: [
-    "class_eval",
-    "collection",
-    "context",
-    "describe",
-    "feature",
-    "it",
-    "member",
-    "namespace",
-    "resource",
-    "resources",
-    "scenario"
-  ]
-
-Metrics/BlockNesting:
-  Max: 3
-
-Metrics/ClassLength:
-  Max: 100
-
-Metrics/ModuleLength:
-  Max: 100
-
-Metrics/CyclomaticComplexity:
-  Max: 6
+  Max: 30 # default 17
 
 Metrics/MethodLength:
-  Max: 10
-
-Metrics/ParameterLists:
-  Max: 5
+  Enabled: true
+  Max: 25 # default 10
 
 Metrics/PerceivedComplexity:
-  Max: 7
+  Enabled: true
+  Max: 14 # default 8
 
 Naming/PredicateName:
   Enabled: false

.ruby-version

@@ -1 +1 @@
-2.7.3
+3.0.3

Dockerfile

@@ -23,7 +23,9 @@ RUN apt-get update && apt-get install -y \
   imagemagick \
   unzip \
   libjemalloc-dev \
-  libssl-dev
+  libssl-dev \
+  ca-certificates \
+  gnupg
 
 # Setup ENV variables
 ENV PATH /usr/local/src/rbenv/shims:/usr/local/src/rbenv/bin:$PATH
@@ -40,20 +42,18 @@ RUN git clone --depth 1 https://github.com/rbenv/rbenv.git ${RBENV_ROOT} && \
     git clone --depth 1 https://github.com/rbenv/ruby-build.git ${RBENV_ROOT}/plugins/ruby-build && \
     echo 'eval "$(rbenv init -)"' >> /etc/profile.d/rbenv.sh && \
     RUBY_CONFIGURE_OPTS=--with-jemalloc rbenv install $(cat .ruby-version) && \
-    rbenv global $(cat .ruby-version) && \
-    gem install bundler --version=1.17.3
+    rbenv global $(cat .ruby-version)
 
 # Install Postgres
-RUN sh -c "echo 'deb https://apt.postgresql.org/pub/repos/apt/ bionic-pgdg main' > /etc/apt/sources.list.d/pgdg.list" && \
-    wget --quiet -O - https://apt.postgresql.org/pub/repos/apt/ACCC4CF8.asc | apt-key add - && \
+RUN sh -c "echo 'deb http://apt.postgresql.org/pub/repos/apt/ `lsb_release -cs`-pgdg main' >> /etc/apt/sources.list.d/pgdg.list" && \
+    curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/apt.postgresql.org.gpg >/dev/null && \
     apt-get update && \
-    apt-get install -yqq --no-install-recommends postgresql-client-9.5 libpq-dev
+    apt-get install -yqq --no-install-recommends postgresql-client-10 libpq-dev
 
-# Install node & yarn
-RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add - && \
-    echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list && \
-    apt-get update && \
-    apt-get install -y nodejs yarn
+# Install NodeJs and yarn
+RUN curl -sL https://deb.nodesource.com/setup_14.x | bash - \
+    && apt-get install --no-install-recommends -y nodejs \
+    && npm install -g yarn
 
 # Install Chrome
 RUN wget --quiet -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - && \
@@ -69,6 +69,9 @@ RUN wget https://chromedriver.storage.googleapis.com/2.41/chromedriver_linux64.z
 # Copy code and install app dependencies
 COPY . /usr/src/app/
 
+# Install Bundler
+RUN ./script/install-bundler
+
 # Install front-end dependencies
 RUN yarn install
 

GETTING_STARTED.md

@@ -60,7 +60,7 @@ If the script succeeds you're ready to start developing. If not, take a look at
 
 Now, your dreams of spinning up a development server can be realised:
 
-    bundle exec rails server
+    foreman start
 
 Go to [http://localhost:3000](http://localhost:3000) to play around!
 

Gemfile

@@ -1,14 +1,20 @@
 # frozen_string_literal: true
 
 source 'https://rubygems.org'
-ruby "2.7.3"
+ruby "3.0.3"
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}.git" }
 
 gem 'dotenv-rails', require: 'dotenv/rails-now' # Load ENV vars before other gems
 
 gem 'rails', '>= 6.1.4'
 
+# Active Storage
+gem "active_storage_validations"
+gem "aws-sdk-s3", require: false
+gem "image_processing"
+
 gem 'activemerchant', '>= 1.78.0'
+gem 'rexml'
 gem 'angular-rails-templates', '>= 0.3.0'
 gem 'awesome_nested_set'
 gem 'ransack', '2.4.2'
@@ -37,13 +43,14 @@ gem "pg", "~> 1.2.3"
 
 gem 'acts_as_list', '1.0.4'
 gem 'cancancan', '~> 1.15.0'
+gem 'digest'
 gem 'ffaker'
 gem 'highline', '2.0.3' # Necessary for the install generator
 gem 'json'
 gem 'monetize', '~> 1.11'
 gem 'paranoia', '~> 2.4'
 gem 'state_machines-activerecord'
-gem 'stringex', '~> 2.8.5'
+gem 'stringex', '~> 2.8.5', require: false
 
 gem 'paypal-sdk-merchant', '1.117.2'
 gem 'stripe'
@@ -55,8 +62,12 @@ gem 'devise-token_authenticatable'
 gem 'jwt', '~> 2.3'
 gem 'oauth2', '~> 1.4.7' # Used for Stripe Connect
 
+gem 'jsonapi-serializer'
 gem 'pagy', '~> 5.1'
 
+gem 'rswag-api'
+gem 'rswag-ui'
+
 gem 'angularjs-rails', '1.8.0'
 gem 'aws-sdk', '1.67.0'
 gem 'bugsnag'
@@ -75,7 +86,6 @@ gem 'bootsnap', require: false
 gem 'geocoder'
 gem 'gmaps4rails'
 gem 'mimemagic', '> 0.3.5'
-gem 'paperclip', '~> 3.4.1'
 gem 'paper_trail', '~> 12.1.0'
 gem 'rack-rewrite'
 gem 'rack-ssl', require: 'rack/ssl'
@@ -87,14 +97,14 @@ gem 'redis', '>= 4.0', require: ['redis', 'redis/connection/hiredis']
 gem 'sidekiq'
 gem 'sidekiq-scheduler'
 
-gem "cable_ready", "5.0.0.pre2"
+gem "cable_ready", "5.0.0.pre3"
 
 gem 'combine_pdf'
 gem 'wicked_pdf'
 gem 'wkhtmltopdf-binary'
 
 gem 'immigrant'
-gem 'roo', '~> 2.8.3'
+gem 'roo', github: "roo-rb/roo" # master is currently needed for Ruby 3.x (awaiting new release)
 gem 'spreadsheet_architect'
 
 gem 'whenever', require: false
@@ -143,7 +153,7 @@ group :test, :development do
   gem 'letter_opener', '>= 1.4.1'
   gem 'rspec-rails', ">= 3.5.2"
   gem 'rspec-retry'
-  gem 'rswag'
+  gem 'rswag-specs'
   gem 'selenium-webdriver'
   gem 'shoulda-matchers'
   gem 'timecop'

Gemfile.lock

@@ -24,6 +24,14 @@ GIT
       sass-rails
       thor (>= 0.14)
 
+GIT
+  remote: https://github.com/roo-rb/roo.git
+  revision: 709464c77623be2bc09b2103405d90ded7604a75
+  specs:
+    roo (2.8.3)
+      nokogiri (~> 1)
+      rubyzip (>= 1.3.0, < 3.0.0)
+
 PATH
   remote: engines/catalog
   specs:
@@ -93,6 +101,11 @@ GEM
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
     active_model_serializers (0.8.4)
       activemodel (>= 3.0)
+    active_storage_validations (0.9.7)
+      activejob (>= 5.2.0)
+      activemodel (>= 5.2.0)
+      activestorage (>= 5.2.0)
+      activesupport (>= 5.2.0)
     activejob (6.1.4.4)
       activesupport (= 6.1.4.4)
       globalid (>= 0.3.6)
@@ -150,19 +163,35 @@ GEM
     awesome_nested_set (3.4.0)
       activerecord (>= 4.0.0, < 7.0)
     awesome_print (1.9.2)
+    aws-eventstream (1.2.0)
+    aws-partitions (1.570.0)
     aws-sdk (1.67.0)
       aws-sdk-v1 (= 1.67.0)
+    aws-sdk-core (3.130.0)
+      aws-eventstream (~> 1, >= 1.0.2)
+      aws-partitions (~> 1, >= 1.525.0)
+      aws-sigv4 (~> 1.1)
+      jmespath (~> 1.0)
+    aws-sdk-kms (1.55.0)
+      aws-sdk-core (~> 3, >= 3.127.0)
+      aws-sigv4 (~> 1.1)
+    aws-sdk-s3 (1.113.0)
+      aws-sdk-core (~> 3, >= 3.127.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.4)
     aws-sdk-v1 (1.67.0)
       json (~> 1.4)
       nokogiri (~> 1)
+    aws-sigv4 (1.4.0)
+      aws-eventstream (~> 1, >= 1.0.2)
     axlsx_styler (1.1.0)
       activesupport (>= 3.1)
       caxlsx (>= 2.0.2)
     bcrypt (3.1.16)
     bigdecimal (3.0.2)
     bindex (0.8.1)
-    bootsnap (1.9.1)
-      msgpack (~> 1.0)
+    bootsnap (1.10.1)
+      msgpack (~> 1.2)
     bugsnag (6.24.1)
       concurrent-ruby (~> 1.0)
     builder (3.2.4)
@@ -170,7 +199,7 @@ GEM
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
     byebug (11.1.3)
-    cable_ready (5.0.0.pre2)
+    cable_ready (5.0.0.pre3)
       rails (>= 5.2)
       thread-local (>= 1.1.0)
     cancancan (1.15.0)
@@ -190,10 +219,7 @@ GEM
       rubyzip (>= 1.3.0, < 3)
     childprocess (4.1.0)
     chronic (0.10.2)
-    climate_control (0.2.0)
     cliver (0.3.2)
-    cocaine (0.5.8)
-      climate_control (>= 0.0.3, < 1.0)
     coderay (1.1.3)
     coffee-rails (5.0.0)
       coffee-script (>= 2.2.0)
@@ -238,6 +264,7 @@ GEM
     devise-token_authenticatable (1.1.0)
       devise (>= 4.0.0, < 5.0.0)
     diff-lcs (1.4.4)
+    digest (3.1.0)
     docile (1.4.0)
     dotenv (2.7.6)
     dotenv-rails (2.7.6)
@@ -322,9 +349,13 @@ GEM
       concurrent-ruby (~> 1.0)
     i18n-js (3.9.0)
       i18n (>= 0.6.6)
+    image_processing (1.12.2)
+      mini_magick (>= 4.9.5, < 5)
+      ruby-vips (>= 2.0.17, < 3)
     immigrant (0.3.6)
       activerecord (>= 3.0)
     ipaddress (0.8.3)
+    jmespath (1.6.1)
     jquery-rails (4.4.0)
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
@@ -337,6 +368,8 @@ GEM
     json_spec (1.1.5)
       multi_json (~> 1.0)
       rspec (>= 2.0, < 4.0)
+    jsonapi-serializer (2.2.0)
+      activesupport (>= 4.2)
     jwt (2.3.0)
     knapsack (4.0.0)
       rake
@@ -356,28 +389,26 @@ GEM
     marcel (1.0.2)
     matrix (0.4.2)
     method_source (1.0.0)
-    mime-types (3.3.1)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2021.0225)
     mimemagic (0.4.3)
       nokogiri (~> 1)
       rake
+    mini_magick (4.11.0)
     mini_mime (1.1.2)
-    mini_portile2 (2.7.1)
+    mini_portile2 (2.8.0)
     mini_racer (0.4.0)
       libv8-node (~> 15.14.0.0)
     minitest (5.15.0)
-    monetize (1.11.0)
+    monetize (1.12.0)
       money (~> 6.12)
-    money (6.14.1)
+    money (6.16.0)
       i18n (>= 0.6.4, <= 2)
     msgpack (1.4.2)
     multi_json (1.15.0)
     multi_xml (0.6.0)
     multipart-post (2.1.1)
     nio4r (2.5.8)
-    nokogiri (1.13.1)
-      mini_portile2 (~> 2.7.0)
+    nokogiri (1.13.3)
+      mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     oauth2 (1.4.7)
       faraday (>= 0.8, < 2.0)
@@ -390,12 +421,6 @@ GEM
     paper_trail (12.1.0)
       activerecord (>= 5.2)
       request_store (~> 1.1)
-    paperclip (3.4.2)
-      activemodel (>= 3.0.0)
-      activerecord (>= 3.0.0)
-      activesupport (>= 3.0.0)
-      cocaine (~> 0.5.0)
-      mime-types
     parallel (1.21.0)
     paranoia (2.4.3)
       activerecord (>= 4.0, < 6.2)
@@ -421,7 +446,7 @@ GEM
       byebug (~> 11.0)
       pry (~> 0.13.0)
     public_suffix (4.0.6)
-    puma (5.5.2)
+    puma (5.6.2)
       nio4r (~> 2.0)
     raabro (1.4.0)
     racc (1.6.0)
@@ -500,9 +525,6 @@ GEM
       builder (>= 3.0)
       dry-inflector (~> 0.1)
       rubyzip (>= 1.0)
-    roo (2.8.3)
-      nokogiri (~> 1)
-      rubyzip (>= 1.3.0, < 3.0.0)
     rspec (3.10.0)
       rspec-core (~> 3.10.0)
       rspec-expectations (~> 3.10.0)
@@ -526,10 +548,6 @@ GEM
     rspec-retry (0.6.2)
       rspec-core (> 3.3)
     rspec-support (3.10.2)
-    rswag (2.4.0)
-      rswag-api (= 2.4.0)
-      rswag-specs (= 2.4.0)
-      rswag-ui (= 2.4.0)
     rswag-api (2.4.0)
       railties (>= 3.1, < 7.0)
     rswag-specs (2.4.0)
@@ -556,6 +574,8 @@ GEM
       rubocop (>= 1.7.0, < 2.0)
     ruby-progressbar (1.11.0)
     ruby-rc4 (0.1.5)
+    ruby-vips (2.1.4)
+      ffi (~> 1.12)
     ruby2_keywords (0.0.4)
     rubyzip (2.3.2)
     rufus-scheduler (3.7.0)
@@ -679,6 +699,7 @@ PLATFORMS
 DEPENDENCIES
   actionpack-action_caching
   active_model_serializers (= 0.8.4)
+  active_storage_validations
   activemerchant (>= 1.78.0)
   activerecord-import
   activerecord-postgresql-adapter
@@ -693,12 +714,13 @@ DEPENDENCIES
   awesome_nested_set
   awesome_print
   aws-sdk (= 1.67.0)
+  aws-sdk-s3
   bigdecimal (= 3.0.2)
   bootsnap
   bugsnag
   bullet
   byebug
-  cable_ready (= 5.0.0.pre2)
+  cable_ready (= 5.0.0.pre3)
   cancancan (~> 1.15.0)
   capybara
   catalog!
@@ -714,6 +736,7 @@ DEPENDENCIES
   devise-i18n
   devise-token_authenticatable
   dfc_provider!
+  digest
   dotenv-rails
   factory_bot_rails (= 6.2.0)
   ffaker
@@ -731,11 +754,13 @@ DEPENDENCIES
   hiredis
   i18n
   i18n-js (~> 3.9.0)
+  image_processing
   immigrant
   jquery-rails (= 4.4.0)
   jquery-ui-rails (~> 4.2)
   json
   json_spec (~> 1.1.4)
+  jsonapi-serializer
   jwt (~> 2.3)
   knapsack
   letter_opener (>= 1.4.1)
@@ -748,7 +773,6 @@ DEPENDENCIES
   order_management!
   pagy (~> 5.1)
   paper_trail (~> 12.1.0)
-  paperclip (~> 3.4.1)
   paranoia (~> 2.4)
   paypal-sdk-merchant (= 1.117.2)
   pdf-reader
@@ -768,11 +792,14 @@ DEPENDENCIES
   redcarpet
   redis (>= 4.0)
   responders
+  rexml
   roadie-rails
-  roo (~> 2.8.3)
+  roo!
   rspec-rails (>= 3.5.2)
   rspec-retry
-  rswag
+  rswag-api
+  rswag-specs
+  rswag-ui
   rubocop
   rubocop-rails
   sd_notify
@@ -805,7 +832,7 @@ DEPENDENCIES
   wkhtmltopdf-binary
 
 RUBY VERSION
-   ruby 2.7.3p183
+   ruby 3.0.3p157
 
 BUNDLED WITH
    2.1.4

app/assets/javascripts/admin/directives/select2_no_search.js.coffee

@@ -1,6 +0,0 @@
-angular.module("ofn.admin").directive "select2NoSearch", ($timeout) ->
-  restrict: 'CA'
-  link: (scope, element, attrs) ->
-    $timeout ->
-      element.select2
-        minimumResultsForSearch: Infinity

app/assets/javascripts/admin/enterprise_fees/directives/ensure_calculator_preferences_match_type.js.coffee

@@ -9,9 +9,9 @@ angular.module("admin.enterpriseFees").directive 'spreeEnsureCalculatorPreferenc
       settings = element.parent().parent().find('div.calculator-settings')
       if value == orig_calculator_type
         settings.show()
-        settings.find('input').prop 'disabled', false
+        settings.find('input, select').prop 'disabled', false
       else
         settings.hide()
-        settings.find('input').prop 'disabled', true
+        settings.find('input, select').prop 'disabled', true
       return
     return

app/assets/javascripts/admin/enterprises/controllers/side_menu_controller.js.coffee

@@ -16,6 +16,7 @@ angular.module("admin.enterprises")
       { name: 'shipping_methods', label: t('shipping_methods'), icon_class: "icon-truck", show: "showShippingMethods()" }
       { name: 'payment_methods', label: t('payment_methods'), icon_class: "icon-money", show: "showPaymentMethods()" }
       { name: 'enterprise_fees', label: t('enterprise_fees'), icon_class: "icon-tasks", show: "showEnterpriseFees()" }
+      { name: 'enterprise_permissions', label: t('enterprise_permissions'), icon_class: "icon-plug" }
       { name: 'inventory_settings', label: t('inventory_settings'), icon_class: "icon-list-ol", show: "enterpriseIsShop()" }
       { name: 'tag_rules', label: t('tag_rules'), icon_class: "icon-random", show: "enterpriseIsShop()" }
       { name: 'shop_preferences', label: t('shop_preferences'), icon_class: "icon-shopping-cart", show: "enterpriseIsShop()" }
@@ -44,3 +45,5 @@ angular.module("admin.enterprises")
 
     $scope.enterpriseIsShop = ->
       $scope.Enterprise.sells != "none"
+
+    $scope.menu.redirect_function('enterprise_permissions', '/admin/enterprise_relationships')

app/assets/javascripts/admin/line_items/controllers/line_items_controller.js.coffee

@@ -104,15 +104,45 @@ angular.module("admin.lineItems").controller 'LineItemsCtrl', ($scope, $timeout,
     else
       StatusMessage.display 'failure', t "unsaved_changes_error"
 
+  $scope.cancelOrder = (order, sendEmailCancellation) ->
+    return $http(
+      method: 'GET'
+      url: "/admin/orders/#{order.number}/fire?e=cancel&send_cancellation_email=#{sendEmailCancellation}")
+  
   $scope.deleteLineItem = (lineItem) ->
-    if ($scope.confirmDelete && confirm(t "are_you_sure")) || !$scope.confirmDelete
-      LineItems.delete lineItem
+    if lineItem.order.item_count == 1
+      ofnCancelOrderAlert((confirm, sendEmailCancellation) ->
+        if confirm
+          $scope.cancelOrder(lineItem.order, sendEmailCancellation).then(->
+            $scope.refreshData()
+          )
+        else
+          $scope.refreshData()
+      , "js.admin.deleting_item_will_cancel_order")
+    else if ($scope.confirmDelete && confirm(t "are_you_sure")) || !$scope.confirmDelete
+      LineItems.delete(lineItem, () -> $scope.refreshData())
 
-  $scope.deleteLineItems = (lineItemsToDelete) ->
-    existingState = $scope.confirmDelete
-    $scope.confirmDelete = false
-    $scope.deleteLineItem lineItem for lineItem in lineItemsToDelete when lineItem.checked
-    $scope.confirmDelete = existingState
+  $scope.deleteLineItems = (lineItems) ->
+    lineItemsToDelete = lineItems.filter (item) -> item.checked
+    willCancelOrders = false
+    itemsPerOrder = new Map()
+    for item in lineItemsToDelete
+      { order } = item
+      if itemsPerOrder.has(order)
+        itemsPerOrder.get(order).push(item)
+      else
+        itemsPerOrder.set(order, [item])
+      willCancelOrders = true if (order.item_count == itemsPerOrder.get(order).length)
+
+    if willCancelOrders
+      ofnCancelOrderAlert((confirm, sendEmailCancellation) ->
+        if confirm
+          itemsPerOrder.forEach (items, order) =>
+            if order.item_count == items.length
+              $scope.cancelOrder(order, sendEmailCancellation).then(-> $scope.refreshData())
+            else
+              Promise.all(LineItems.delete(item) for item in items).then(-> $scope.refreshData())
+      , "js.admin.deleting_item_will_cancel_order")   
 
   $scope.allBoxesChecked = ->
     checkedCount = $scope.filteredLineItems.reduce (count,lineItem) ->
@@ -128,29 +158,53 @@ angular.module("admin.lineItems").controller 'LineItemsCtrl', ($scope, $timeout,
     $scope.selectedUnitsProduct = unitsProduct
     $scope.selectedUnitsVariant = unitsVariant
 
+  $scope.getLineItemScale = (lineItem) ->
+    if lineItem.units_product && lineItem.units_variant && (lineItem.units_product.variant_unit == "weight" || lineItem.units_product.variant_unit == "volume") 
+      lineItem.units_product.variant_unit_scale
+    else
+      1
+
   $scope.sumUnitValues = ->
-    sum = $scope.filteredLineItems?.reduce (sum,lineItem) ->
-      sum + lineItem.final_weight_volume
+    sum = $scope.filteredLineItems?.reduce (sum, lineItem) ->
+      sum + $scope.roundToThreeDecimals(lineItem.final_weight_volume / $scope.getLineItemScale(lineItem))
     , 0
 
   $scope.sumMaxUnitValues = ->
     sum = $scope.filteredLineItems?.reduce (sum,lineItem) ->
-        sum + lineItem.max_quantity * lineItem.units_variant.unit_value
+      sum + lineItem.max_quantity * $scope.roundToThreeDecimals(lineItem.units_variant.unit_value / $scope.getLineItemScale(lineItem))
     , 0
 
+  $scope.roundToThreeDecimals = (value) ->
+    Math.round(value * 1000) / 1000
+
   $scope.allFinalWeightVolumesPresent = ->
     for i,lineItem of $scope.filteredLineItems
       return false if !lineItem.hasOwnProperty('final_weight_volume') || !(lineItem.final_weight_volume > 0)
     true
 
-  # How is this different to OptionValueNamer#name?
-  # Should it be extracted to that class or VariantUnitManager?
-  $scope.formattedValueWithUnitName = (value, unitsProduct, unitsVariant) ->
-    # A Units Variant is an API object which holds unit properies of a variant
-    if unitsProduct.hasOwnProperty("variant_unit") && (unitsProduct.variant_unit == "weight" || unitsProduct.variant_unit == "volume") && value > 0
-      scale = VariantUnitManager.getScale(value, unitsProduct.variant_unit)
-      Math.round(value/scale * 1000)/1000 + " " + VariantUnitManager.getUnitName(scale, unitsProduct.variant_unit)
+  $scope.getScale = (unitsProduct, unitsVariant) ->
+    if unitsProduct.hasOwnProperty("variant_unit") && (unitsProduct.variant_unit == "weight" || unitsProduct.variant_unit == "volume")
+      unitsProduct.variant_unit_scale
     else
+      null
+
+  $scope.getFormattedValueWithUnitName = (value, unitsProduct, unitsVariant, scale) ->
+    unit_name = VariantUnitManager.getUnitName(scale, unitsProduct.variant_unit)
+    $scope.roundToThreeDecimals(value) + " " + unit_name
+
+  $scope.getGroupBySizeFormattedValueWithUnitName = (value, unitsProduct, unitsVariant) ->
+    scale = $scope.getScale(unitsProduct, unitsVariant)
+    if scale
+      value = value / scale if scale != 28.35 && scale != 1 && scale != 453.6 # divide by scale if not smallest unit
+      $scope.getFormattedValueWithUnitName(value, unitsProduct, unitsVariant, scale)
+    else
+      ''
+
+  $scope.formattedValueWithUnitName = (value, unitsProduct, unitsVariant) ->
+    scale = $scope.getScale(unitsProduct, unitsVariant)
+    if scale
+      $scope.getFormattedValueWithUnitName(value, unitsProduct, unitsVariant, scale)
+    else 
       ''
 
   $scope.fulfilled = (sumOfUnitValues) ->
@@ -158,7 +212,9 @@ angular.module("admin.lineItems").controller 'LineItemsCtrl', ($scope, $timeout,
     if $scope.selectedUnitsProduct.hasOwnProperty("group_buy_unit_size") && $scope.selectedUnitsProduct.group_buy_unit_size > 0 &&
       $scope.selectedUnitsProduct.hasOwnProperty("variant_unit") &&
       ( $scope.selectedUnitsProduct.variant_unit == "weight" || $scope.selectedUnitsProduct.variant_unit == "volume" )
-        Math.round( sumOfUnitValues / $scope.selectedUnitsProduct.group_buy_unit_size * 1000)/1000
+        scale = $scope.selectedUnitsProduct.variant_unit_scale
+        sumOfUnitValues = sumOfUnitValues * scale unless scale == 28.35 || scale == 453.6
+        $scope.roundToThreeDecimals(sumOfUnitValues / $scope.selectedUnitsProduct.group_buy_unit_size)
     else
       ''
 

app/assets/javascripts/admin/order_cycles/services/order_cycle.js.coffee

@@ -1,4 +1,4 @@
-angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, $timeout, StatusMessage, Panels) ->
+angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, $timeout, StatusMessage, Panels, Enterprise) ->
   OrderCycleResource = $resource '/admin/order_cycles/:action_name/:order_cycle_id.json', {}, {
     'index':  { method: 'GET', isArray: true}
     'new'   : { method: 'GET', params: { action_name: "new" } }
@@ -50,7 +50,14 @@ angular.module('admin.orderCycles').factory 'OrderCycle', ($resource, $window, $
         (callback || angular.noop)()
 
     addDistributor: (new_distributor_id, callback) ->
-      this.order_cycle.outgoing_exchanges.push({ enterprise_id: new_distributor_id, incoming: false, active: true, variants: {}, enterprise_fees: [] })
+      exchange = { enterprise_id: new_distributor_id, incoming: false, active: true, variants: {}, enterprise_fees: [] }
+      if (Enterprise.hub_enterprises.length == 1)
+        editable = this.order_cycle["editable_variants_for_outgoing_exchanges"][new_distributor_id] || []
+        variants = this.incomingExchangesVariants()
+        for variant in variants when variant in editable
+          exchange.variants[variant] = true
+
+      this.order_cycle.outgoing_exchanges.push(exchange)
       $timeout ->
         (callback || angular.noop)()
 

app/assets/javascripts/admin/products/services/variant_unit_manager.js.coffee

@@ -37,17 +37,6 @@ angular.module("admin.products").factory "VariantUnitManager", (availableUnits)
       options.push [[I18n.t('items'), 'items']]
       options = [].concat options...
 
-    @getScale: (value, unitType) ->
-      scaledValue = null
-      validScales = []
-      unitScales = VariantUnitManager.unitScales(unitType)
-
-      validScales.unshift scale for scale in unitScales when value/scale >= 1
-      if validScales.length > 0
-        validScales[0]
-      else
-        unitScales[0]
-
     @getUnitName: (scale, unitType) ->
       if @units[unitType][scale]
         @units[unitType][scale]['name']

app/assets/javascripts/admin/resources/services/order_cycles.js.coffee

@@ -43,7 +43,7 @@ angular.module("admin.resources").factory 'OrderCycles', ($q, $injector, OrderCy
             angular.extend(@byID[orderCycle.id], orderCycle)
             angular.extend(@pristineByID[orderCycle.id], orderCycle)
           form.$setPristine() if form?
-          StatusMessage.display('success', "Order cycles have been updated.")
+          StatusMessage.display('success', t('order_cycles_bulk_update_notice'))
         , (response) =>
           if response.data.errors?
             StatusMessage.display('failure', response.data.errors[0])

app/assets/javascripts/admin/side_menu/services/side_menu.js.coffee

@@ -30,3 +30,14 @@ angular.module("admin.side_menu")
         for item in @items when item.name is name
           return item
         null
+
+      redirect_function: (elementID , href) =>
+        window.addEventListener 'load', ->
+          element = document.getElementById(elementID)
+          if !element
+            return
+          element.addEventListener 'click', ->
+            window.location.replace(href)
+            return
+          return
+

app/assets/javascripts/admin/spree/calculator.js

@@ -7,11 +7,11 @@ $(function() {
     if (calculator_select.val() === original_calc_type) {
       $('div.calculator-settings').show();
       $('.calculator-settings-warning').hide();
-      $('.calculator-settings').find('input,textarea').prop("disabled", false);
+      $('.calculator-settings').find('input,textarea,select').prop("disabled", false);
     } else {
       $('div.calculator-settings').hide();
       $('.calculator-settings-warning').show();
-      $('.calculator-settings').find('input,textarea').prop("disabled", true);
+      $('.calculator-settings').find('input,textarea,select').prop("disabled", true);
     }
   });
 })

app/assets/javascripts/admin/spree/orders/address_states.js

@@ -1,17 +0,0 @@
-var update_state = function(region) {
-  var country        = $('span#' + region + 'country .select2').select2('val');
-  var state_select   = $('span#' + region + 'state select.select2');
-
-  $.get(Spree.routes.states_search + "?country_id=" + country, function(states) {
-    state_select.html('');
-    var states_with_blank = [{name: '', id: ''}].concat(states);
-    $.each(states_with_blank, function(pos,state) {
-      var opt = $(document.createElement('option'))
-                .attr('value', state.id)
-                .html(state.name);
-      state_select.append(opt);
-    });
-    state_select.prop("disabled", false).show();
-    state_select.select2();
-  })
-};

app/assets/javascripts/admin/spree/orders/variant_autocomplete.js.erb

@@ -4,6 +4,7 @@ $(document).ready(function() {
 
   initAlert()
   initConfirm()
+  initCancelOrder()
 
   if ($('#variant_autocomplete_template').length > 0) {
     window.variantTemplate = Handlebars.compile($('#variant_autocomplete_template').text());
@@ -52,12 +53,12 @@ $(document).ready(function() {
       }
       toggleItemEdit();
 
-      adjustItems(shipment_number, variant_id, quantity);
+      adjustItems(shipment_number, variant_id, quantity, true);
       return false;
     }
     $('a.save-item').click(handle_save_click);
 
-    handle_delete_click = function(elementSelector){
+    handle_delete_click = function(elementSelector, restock_item){
       var del = $(elementSelector);
       del.hide()
       var shipment_number = del.data('shipment-number');
@@ -65,38 +66,65 @@ $(document).ready(function() {
 
       toggleItemEdit();
 
-      adjustItems(shipment_number, variant_id, 0);
+      adjustItems(shipment_number, variant_id, 0, restock_item);
     }
 
     $('a.delete-item').click((event) => {
-      ofnConfirm(() => {
-        handle_delete_click('#custom-confirm');
-      });
+     try {
+         var del = $('a.delete-item');
+         var shipment_number = del.data('shipment-number');
+         var variant_id = del.data('variant-id');
+         var shipment = _.findWhere(shipments, {number: shipment_number + ''});
+         var inventory_units = _.where(shipment.inventory_units, {variant_id: variant_id});
+         if (inventory_units.length !== shipment.inventory_units.length) {
+             ofnConfirm((reStockItem) => {
+                 handle_delete_click('#custom-confirm', reStockItem);
+             });
+         } else {
+             adjustItems(shipment_number, variant_id, 0);
+         }
+     } catch (e) {
+     }
     });
-
   }
 });
 
-adjustItems = function(shipment_number, variant_id, quantity){
+adjustItems = function(shipment_number, variant_id, quantity, restock_item){
   var shipment = _.findWhere(shipments, {number: shipment_number + ''});
   var inventory_units = _.where(shipment.inventory_units, {variant_id: variant_id});
 
-  if (quantity == 0 && inventory_units.length == shipment.inventory_units.length) {
-    ofnAlert(t("js.admin.orders.cannot_remove_last_item"));
+  if (quantity === 0 && inventory_units.length === shipment.inventory_units.length) {
+    ofnCancelOrderAlert((confirm, sendEmailCancellation, restock_item) => {
+      if (confirm) {
+        doAdjustItems(shipment_number, variant_id, quantity, inventory_units, restock_item, () => {
+          var redirectTo = new URL(Spree.routes.cancel_order.toString());
+          redirectTo.searchParams.append("send_cancellation_email", sendEmailCancellation);
+          window.location.href = redirectTo.toString();
+        });
+      }
+    });
     return;
   }
+  doAdjustItems(shipment_number, variant_id, quantity, inventory_units, restock_item, () => {
+    window.location.reload();
+  });
+}
 
+doAdjustItems = function(shipment_number, variant_id, quantity, inventory_units, restock_item, callback) {
   var url = Spree.routes.orders_api + "/" + order_number + "/shipments/" + shipment_number;
 
   var new_quantity = 0;
+  var data = { variant_id: variant_id };
   if (inventory_units.length < quantity) {
     url += "/add";
     new_quantity = (quantity - inventory_units.length);
   } else if (inventory_units.length > quantity) {
     url += "/remove"
     new_quantity = (inventory_units.length - quantity);
+    data.restock_item = restock_item;
   }
   url += '.json';
+  data.quantity = new_quantity;
 
   if (new_quantity == 0) {
     ofnAlert(t("js.admin.orders.quantity_unchanged"));
@@ -104,9 +132,9 @@ adjustItems = function(shipment_number, variant_id, quantity){
     $.ajax({
       type: "PUT",
       url: Spree.url(url),
-      data: { variant_id: variant_id, quantity: new_quantity }
+      data: data
     }).done(function( msg ) {
-      window.location.reload();
+      callback();
     });
   }
 }
@@ -158,7 +186,7 @@ addVariantFromStockLocation = function() {
     });
   }else{
     //add to existing shipment
-    adjustItems(shipment.number, variant_id, quantity);
+    adjustItems(shipment.number, variant_id, quantity, true);
   }
   return 1
 }
@@ -181,8 +209,54 @@ ofnAlert = function(message) {
   $('#custom-alert').show();
 }
 
-ofnConfirm = function(callback) {
-  $('#custom-confirm').data($(event.target).data());
-  $('#custom-confirm button.confirm').click(callback);
+ofnCancelOrderAlert = function(callback, i18nKey) {
+  if (i18nKey == undefined) {
+    i18nKey = "js.admin.orders.cancel_the_order_html";
+  }
+  $('#custom-confirm .message').html(
+    ` ${t(i18nKey)}
+      <div class="form">
+        <input type="checkbox" name="send_cancellation_email" value="1" id="send_cancellation_email" checked="true" />
+        <label for="send_cancellation_email">${t("js.admin.orders.cancel_the_order_send_cancelation_email")}</label><br />
+        <input type="checkbox" name="restock_items"  id="restock_items" checked="checked"/>
+        <label for="restock_items">${t("js.admin.orders.restock_items")}</label>
+      </div>`);
+  $('#custom-confirm button.confirm').unbind( "click" ).click(() => {
+    $('#custom-confirm').hide();
+    callback(true, $('#send_cancellation_email').is(':checked'), $('#restock_items').is(':checked'));
+  });
+  $('#custom-confirm button.cancel').click(() => {
+    $('#custom-confirm').hide();
+    callback(false)
+  });
   $('#custom-confirm').show();
 }
+
+ofnConfirm = function(callback) {
+  $('#custom-confirm .message').html(
+      ` ${t("are_you_sure")}
+    <div class="form">
+      <input type="checkbox" name="restock_items"  id="restock_items" checked="checked"/>
+      <label for="restock_items">${t("js.admin.orders.restock_item")}</label>
+    </div>`);
+  $('#custom-confirm').data($(event.target).data());
+  $('#custom-confirm button.confirm').click(() => {
+      callback($('#restock_items').is(':checked'));
+  });
+  $('#custom-confirm').show();
+}
+
+initCancelOrder = function() {
+    $('#cancel_order_form').submit(function(e){
+        ofnCancelOrderAlert((confirm, sendEmailCancellation, restock_items) => {
+            if (confirm) {
+                var redirectTo = new URL(Spree.routes.cancel_order.toString());
+                redirectTo.searchParams.append("send_cancellation_email", sendEmailCancellation);
+                redirectTo.searchParams.append("restock_items", restock_items);
+                window.location.href = redirectTo.toString();
+            }
+        });
+        e.preventDefault();
+        return false;
+    });
+}

app/assets/javascripts/admin/spree/progress.coffee

@@ -1,7 +1,11 @@
 $(document).ready ->
+  progressTimer = null
   $(document).ajaxStart ->
-    $("#progress").fadeIn()
+    progressTimer = setTimeout ->
+      $("#progress").fadeIn()
+    , 500
 
   $(document).ajaxStop ->
-    $("#progress").fadeOut()
+    clearTimeout(progressTimer) if progressTimer?
+    $("#progress").stop().hide()
 

app/assets/javascripts/admin/spree/spree.js.coffee

@@ -1,13 +1,10 @@
-#= require jsuri
-
 class window.Spree
   # Helper function to take a URL and add query parameters to it
-  @url: (uri, query) ->
-    if uri.path == undefined
-      uri = new Uri(uri)
-    if query
-      $.each query, (key, value) ->
-        uri.addQueryParam(key, value)
+  @url: (uri) ->
+    if uri.pathname == undefined
+      uri = new URL(uri.toString())
     if Spree.api_key
-      uri.addQueryParam('token', Spree.api_key)
+      params = new URLSearchParams(uri.search)
+      params.append('token', Spree.api_key)
+
     return uri

app/assets/javascripts/admin/spree/taxons/taxon_tree_menu.js.coffee

@@ -2,10 +2,9 @@ root = exports ? this
 
 root.taxon_tree_menu = (obj, context) ->
 
-  base_url = Spree.url(Spree.routes.taxonomy_taxons_path)
-  admin_base_url = Spree.url(Spree.routes.admin_taxonomy_taxons_path)
-  edit_url = admin_base_url.clone()
-  edit_url.setPath(edit_url.path() + '/' + obj.attr("id") + "/edit");
+  base_url = Spree.url(Spree.routes.taxonomy_taxons)
+  admin_base_url = Spree.url(Spree.routes.admin_taxonomy_taxons)
+  edit_url = Spree.url(Spree.routes.admin_taxonomy_taxons + '/' + obj.attr("id") + "/edit");
 
   create:
     label: "<i class='icon-plus'></i> " + Spree.translations.add,

app/assets/javascripts/admin/spree/taxons/taxonomy.js.coffee

@@ -9,7 +9,7 @@ handle_move = (e, data) ->
   new_parent = data.rslt.np
 
   url = Spree.url(base_url).clone()
-  url.setPath url.path() + '/' + node.attr("id")
+  url.pathname = url.pathname + '/' + node.attr("id")
   $.ajax
     type: "POST",
     dataType: "json",
@@ -41,7 +41,7 @@ handle_rename = (e, data) ->
   name = data.rslt.new_name
 
   url = Spree.url(base_url).clone()
-  url.setPath(url.path() + '/' + node.attr("id"))
+  url.pathname = url.pathname + '/' + node.attr("id")
 
   $.ajax
     type: "POST",
@@ -70,10 +70,10 @@ root = exports ? this
 root.setup_taxonomy_tree = (taxonomy_id) ->
   if taxonomy_id != undefined
     # this is defined within admin/taxonomies/edit
-    root.base_url = Spree.url(Spree.routes.taxonomy_taxons_path)
+    root.base_url = Spree.url(Spree.routes.taxonomy_taxons)
 
     $.ajax
-      url: base_url.path().replace("/taxons", "/jstree"),
+      url: base_url.pathname.replace("/taxons", "/jstree"),
       success: (taxonomy) ->
         last_rollback = null
 
@@ -82,7 +82,7 @@ root.setup_taxonomy_tree = (taxonomy_id) ->
             data: taxonomy,
             ajax:
               url: (e) ->
-                base_url.path() + '/' + e.attr('id') + '/jstree'
+                base_url.pathname + '/' + e.attr('id') + '/jstree'
           themes:
             theme: "apple",
             url: "/assets/jquery.jstree/themes/apple/style.css"

app/assets/javascripts/admin/subscriptions/controllers/details_controller.js.coffee

@@ -16,7 +16,7 @@ angular.module("admin.subscriptions").controller "DetailsController", ($scope, $
     return if !newValue?
     paymentMethod = ($scope.paymentMethods.filter (pm) -> pm.id == newValue)[0]
     return unless paymentMethod?
-    $scope.cardRequired = (paymentMethod.type == "Spree::Gateway::StripeConnect" || paymentMethod.type == "Spree::Gateway::StripeSCA")
+    $scope.cardRequired = paymentMethod.type == "Spree::Gateway::StripeSCA"
     $scope.loadCustomer() if $scope.cardRequired && !$scope.customer
 
   $scope.loadCustomer = ->

app/assets/javascripts/admin/utils/directives/help-modal.js.coffee

@@ -1,20 +0,0 @@
-angular.module("admin.utils").directive 'helpModal', ($rootScope, $compile, $templateCache, $window, DialogDefaults) ->
-  restrict: 'C'
-  scope:
-    template: '@'
-  link: (scope, element, attr) ->
-    # Compile modal template
-    template = $compile($templateCache.get(scope.template))(scope)
-
-    # Load Dialog Options
-    template.dialog(DialogDefaults)
-
-    # Link opening of dialog to click event on element
-    element.bind 'click', (e) ->
-      template.dialog('open')
-      $rootScope.$evalAsync()
-
-    scope.close = ->
-      template.dialog('close')
-      $rootScope.$evalAsync()
-      return

app/assets/javascripts/darkswarm/all.js.coffee

@@ -56,7 +56,8 @@
 #= require_tree .
 
 document.addEventListener "turbo:load", ->
-  window.injector = angular.bootstrap document.body, ["Darkswarm"]
+  try
+    window.injector = angular.bootstrap document.body, ["Darkswarm"]
   true
 
 document.addEventListener "turbo:before-render", ->

app/assets/javascripts/darkswarm/controllers/authentication/forgot_controller.js.coffee

@@ -1,19 +0,0 @@
-angular.module('Darkswarm').controller "ForgotCtrl", ($scope, $http, $location, AuthenticationService) ->
-  $scope.path = "/forgot"
-  $scope.sent = false
-
-  $scope.submit = ->
-    if $scope.spree_user.email != null
-      $http.post("/user/spree_user/password", {spree_user: $scope.spree_user}).then (response)->
-        $scope.sent = true
-      .catch (response) ->
-        $scope.errors = response.data.error
-        $scope.user_unconfirmed = (response.status == 401)
-    else
-      $scope.errors = t 'email_required'
-
-  $scope.resend_confirmation = ->
-    $http.post("/user/spree_user/confirmation", {spree_user: $scope.spree_user, return_url: $location.absUrl()}).then (response)->
-      $scope.messages = t('devise.confirmations.send_instructions')
-    .catch (response) ->
-      $scope.errors = t('devise.confirmations.failed_to_send')

app/assets/javascripts/darkswarm/controllers/authentication/login_controller.js.coffee

@@ -1,36 +0,0 @@
-angular.module('Darkswarm').controller "LoginCtrl", ($scope, $timeout, $location, $http, $window, AuthenticationService, Redirections, Loading) ->
-  $scope.path = "/login"
-
-  $scope.modalMessage = null
-
-  $scope.$watch (->
-    AuthenticationService.modalMessage
-  ), (newValue) ->
-    $scope.errors = newValue
-
-  $scope.submit = ->
-    Loading.message = t 'logging_in'
-    $http.post("/user/spree_user/sign_in", {spree_user: $scope.spree_user}).then (response)->
-      if window._paq
-        window._paq.push(['trackEvent', 'Signin/Signup', 'Login Submit Success', $location.absUrl()]);
-      if Redirections.after_login
-        $window.location.href = $window.location.origin + Redirections.after_login
-      else
-        $window.location.href = $window.location.origin + $window.location.pathname  # Strips out hash fragments
-    .catch (response) ->
-      Loading.clear()
-      $scope.errors = response.data.message || response.data.error
-      $scope.user_unconfirmed = (response.data.error == t('devise.failure.unconfirmed'))
-
-  $scope.resend_confirmation = ->
-    $http.post("/user/spree_user/confirmation", {spree_user: $scope.spree_user, return_url: $location.absUrl()}).then (response)->
-      $scope.messages = t('devise.confirmations.send_instructions')
-    .catch (response) ->
-      $scope.errors = t('devise.confirmations.failed_to_send')
-
-  $timeout ->
-    if angular.isDefined($location.search()['validation'])
-      if $location.search()['validation'] == 'confirmed'
-        $scope.messages = t('devise.confirmations.confirmed')
-      if $location.search()['validation'] == 'not_confirmed'
-        $scope.errors = t('devise.confirmations.not_confirmed')

app/assets/javascripts/darkswarm/controllers/authentication/signup_controller.js.coffee

@@ -1,17 +0,0 @@
-angular.module('Darkswarm').controller "SignupCtrl", ($scope, $http, $window, $location, Redirections, AuthenticationService) ->
-  $scope.path = "/signup"
-
-  $scope.spree_user.password_confirmation = ''
-
-  $scope.errors =
-    email: null
-    password: null
-
-  $scope.submit = ->
-    $http.post("/user/spree_user", {spree_user: $scope.spree_user, return_url: $location.absUrl()}).then (response)->
-      $scope.errors = {email: null, password: null}
-      $scope.messages = t('devise.user_registrations.spree_user.signed_up_but_unconfirmed')
-      if window._paq
-        window._paq.push(['trackEvent', 'Signin/Signup', 'Signup Submit Success', $location.absUrl()]);
-    .catch (response) ->
-      $scope.errors = response.data

app/assets/javascripts/darkswarm/controllers/authentication_controller.js.coffee

@@ -1,12 +0,0 @@
-angular.module('Darkswarm').controller "AuthenticationCtrl", ($scope, AuthenticationService, SpreeUser)->
-  $scope.open = AuthenticationService.open
-  $scope.toggle = AuthenticationService.toggle
-
-  $scope.spree_user = SpreeUser.spree_user
-  $scope.isActive = AuthenticationService.isActive
-  $scope.select = AuthenticationService.select
-
-  $scope.tabs =
-    login: { active: $scope.isActive('/login') }
-    signup: { active: $scope.isActive('/signup') }
-    forgot: { active: $scope.isActive('/forgot') }

app/assets/javascripts/darkswarm/controllers/checkout/checkout_controller.js.coffee

@@ -1,4 +1,4 @@
-angular.module('Darkswarm').controller "CheckoutCtrl", ($scope, localStorageService, Checkout, CurrentUser, CurrentHub, AuthenticationService, SpreeUser, $http) ->
+angular.module('Darkswarm').controller "CheckoutCtrl", ($scope, localStorageService, Checkout, CurrentUser, CurrentHub, $http) ->
   $scope.Checkout = Checkout
   $scope.submitted = false
 
@@ -35,14 +35,9 @@ angular.module('Darkswarm').controller "CheckoutCtrl", ($scope, localStorageServ
       $scope.$broadcast 'purchaseFormInvalid', $scope.formdata
 
   $scope.ensureUserIsGuest = (callback = null) ->
-    $http.post("/user/registered_email", {email: $scope.order.email}).then (response)->
-      if response.data.registered == true
-        $scope.promptLogin()
-      else
+    $http.post("/user/registered_email", {email: $scope.order.email})
+      .then (response)->
+        window.CableReady.perform(response.data)
+      .catch ->
         $scope.validateForm() if $scope.submitted
         callback() if callback
-
-  $scope.promptLogin = ->
-    SpreeUser.spree_user.email = $scope.order.email
-    AuthenticationService.pushMessage t('devise.failure.already_registered')
-    AuthenticationService.open '/login'

app/assets/javascripts/darkswarm/controllers/checkout/details_controller.js.coffee

@@ -1,4 +1,4 @@
-angular.module('Darkswarm').controller "DetailsCtrl", ($scope, $timeout, $http, CurrentUser, AuthenticationService, SpreeUser, $controller) ->
+angular.module('Darkswarm').controller "DetailsCtrl", ($scope, $timeout, $http, CurrentUser, SpreeUser, $controller) ->
   angular.extend this, $controller('FieldsetMixin', {$scope: $scope})
 
   $scope.name = "details"

app/assets/javascripts/darkswarm/controllers/products_controller.js.coffee

@@ -67,7 +67,7 @@ angular.module('Darkswarm').controller "ProductsCtrl", ($scope, $sce, $filter, $
       page: page || $scope.page,
       per_page: $scope.per_page,
       'q[name_or_meta_keywords_or_variants_display_as_or_variants_display_name_or_supplier_name_cont]': $scope.query,
-      'q[properties_id_or_supplier_properties_id_in_any][]': $scope.activeProperties,
+      'q[with_properties][]': $scope.activeProperties,
       'q[primary_taxon_id_in_any][]': $scope.activeTaxons
     }
 

app/assets/javascripts/darkswarm/controllers/shop_variant_controller.js.coffee

@@ -1,4 +1,4 @@
-angular.module('Darkswarm').controller "ShopVariantCtrl", ($scope, $modal, Cart) ->
+angular.module('Darkswarm').controller "ShopVariantCtrl", ($scope, $modal, Cart, Shopfront) ->
   $scope.updateCart = (line_item) ->
     Cart.adjust($scope.variant.line_item)
 
@@ -69,3 +69,6 @@ angular.module('Darkswarm').controller "ShopVariantCtrl", ($scope, $modal, Cart)
   $scope.addBulk = (quantity) ->
     $scope.add(quantity)
     $modal.open(templateUrl: "bulk_buy_modal.html", scope: $scope, windowClass: "product-bulk-modal")
+
+  $scope.displayRemainingInStock = ->
+    Shopfront.shopfront.preferred_product_low_stock_display && $scope.available() <= 3 && !$scope.variant.line_item.quantity

app/assets/javascripts/darkswarm/directives/auth.js.coffee

@@ -1,11 +0,0 @@
-angular.module('Darkswarm').directive 'auth', (AuthenticationService) ->
-  restrict: 'A'
-  link: (scope, elem, attrs) ->
-    elem.bind "click", ->
-      AuthenticationService.open '/' + attrs.auth
-
-    window.addEventListener "login:modal:open", ->
-      AuthenticationService.open '/login'
-
-    scope.$on "$destroy", ->
-      window.removeEventListener "login:modal:open"

app/assets/javascripts/darkswarm/directives/help_modal.js.coffee

@@ -1,13 +0,0 @@
-angular.module('Darkswarm').directive "helpModal", ($modal, $compile, $templateCache)->
-  restrict: 'A'
-  scope:
-    helpText: "@helpModal"
-
-  link: (scope, elem, attrs, ctrl)->
-    compiled = $compile($templateCache.get('help-modal.html'))(scope)
-
-    elem.on "click", =>
-      $modal.open(controller: ctrl, template: compiled, scope: scope, windowClass: 'help-modal small')
-
-    scope.$on "$destroy", ->
-      elem.off("click")

app/assets/javascripts/darkswarm/directives/map_search.js.coffee

@@ -3,7 +3,7 @@ angular.module('Darkswarm').directive 'mapSearch', ($timeout, Search) ->
   restrict: 'E'
   require: ['^uiGmapGoogleMap', 'ngModel']
   replace: true
-  template: '<input id="pac-input" ng-model="query" placeholder="' + t('location_placeholder') + '"></input>'
+  template: '<input id="pac-input" ng-model="query" placeholder="' + t('location_placeholder') + '" onfocus="this.select()"></input>'
   scope: {}
 
   controller: ($scope) ->

app/assets/javascripts/darkswarm/directives/shipping_type_selector.js.coffee

@@ -1,8 +1,6 @@
 angular.module('Darkswarm').directive "shippingTypeSelector", ->
   # Builds selector for shipping types
-  restrict: 'E'
-  replace: true
-  templateUrl: 'shipping_type_selector.html'
+  restrict: 'C'
   link: (scope, elem, attr)->
     scope.shippingTypes =
       pickup: false

app/assets/javascripts/darkswarm/directives/shop_variant.js.coffee

@@ -1,7 +0,0 @@
-angular.module('Darkswarm').directive "shopVariant", ->
-  restrict: 'E'
-  replace: true
-  templateUrl: 'shop_variant.html'
-  scope:
-    variant: '='
-  controller: 'ShopVariantCtrl'

app/assets/javascripts/darkswarm/directives/stripe_elements.js.coffee

@@ -9,7 +9,7 @@ angular.module('Darkswarm').directive "stripeElements", ($injector, StripeElemen
     if $injector.has('stripeObject')
       stripe = $injector.get('stripeObject')
 
-      card = stripe.elements().create 'card',
+      card = stripe.elements({ locale: I18n.base_locale }).create 'card',
         hidePostalCode: true
         style:
           base:

app/assets/javascripts/darkswarm/services/authentication_service.js.coffee

@@ -1,54 +0,0 @@
-# This class deals with displaying things in the login modal. It chooses
-# the modal tab templates and deals with switching tabs and passing data
-# between the tabs. It has direct access to the instance of the login modal,
-# and provides that access to other controllers as a service.
-
-angular.module('Darkswarm').factory "AuthenticationService", (Navigation, $modal, $location, Redirections, Loading)->
-
-  new class AuthenticationService
-    selectedPath: "/login"
-    modalMessage: null
-
-    constructor: ->
-      if $location.path() in ["/login", "/signup", "/forgot"] || location.pathname is '/register/auth'
-        @open @initialTab(), @initialTemplate()
-
-    open: (path = false, template = 'authentication.html') =>
-      @modalInstance = $modal.open
-        templateUrl: template
-        windowClass: "login-modal medium"
-      @modalInstance.result.then @close, @close
-      @selectedPath = path || @selectedPath
-      Navigation.navigate @selectedPath
-
-    # Opens the /login tab if returning from email confirmation,
-    # the /signup tab if opened from the enterprise registration page,
-    # otherwise opens whichever tab is selected in the URL params ('/login', '/signup', or '/forgot')
-    initialTab: ->
-      if angular.isDefined($location.search()['validation'])
-        '/login'
-      else if location.pathname is '/register/auth'
-        '/signup'
-      else
-        $location.path()
-
-    # Loads the registration page modal when needed, otherwise the default modal
-    initialTemplate: ->
-      if location.pathname is '/register/auth'
-        'registration_authentication.html'
-      else
-        'authentication.html'
-    pushMessage: (message) ->
-      @modalMessage = String(message)
-
-    select: (path)=>
-      @selectedPath = path
-      Navigation.navigate @selectedPath
-
-    isActive: Navigation.isActive
-
-    close: ->
-      if location.pathname in ["/register", "/register/auth"]
-        Loading.message = t 'going_back_to_home_page'
-        location.hash = ""
-        location.pathname = "/"

app/assets/javascripts/darkswarm/services/redirections.js.coffee

@@ -1,3 +0,0 @@
-angular.module('Darkswarm').factory "Redirections", ($location)->
-  new class Redirections
-    after_login: $location.search().after_login

app/assets/javascripts/templates/admin/modals/business_address_info.html.haml

@@ -1,7 +0,0 @@
-%div
-  .margin-bottom-30
-    %p
-      {{ 'js.admin.modals.business_address_info.message' | t }}
-
-  .text-center
-    %input.button.red.icon-plus{ type: 'button', value: '{{ "js.admin.modals.got_it" | t }}', ng: { click: 'close()' } }

app/assets/javascripts/templates/admin/modals/invite_manager.html.haml

@@ -1,19 +0,0 @@
-#invite-manager-modal{ng: {app: 'admin.enterprises', controller: 'enterpriseCtrl'}}
-
-  .margin-bottom-30.text-center
-    .text-big
-      = t('js.admin.modals.invite_title')
-
-  %p.alert-box.ok{ng: {show: 'invite_success'}}
-    {{invite_success}}
-
-  %p.alert-box.error{ng: {show: 'invite_errors'}}
-    {{invite_errors}}
-
-  %input#invite_email.fullwidth.margin-bottom-20{ng: {model: 'newUser'}}
-
-  .margin-bottom-20.text-center
-    %button.text-center.margin-top-10{ng: {show: '!invite_success', click: 'inviteManager()'}}
-      = t('js.admin.modals.invite')
-    %button.text-center.margin-top-10{ng: {show: 'invite_success', click: 'resetModal(); close()'}}
-      = t('js.admin.modals.close')

app/assets/javascripts/templates/admin/modals/tag_rule_help.html.haml

@@ -1,25 +0,0 @@
-#tag-rule-help
-  .margin-bottom-30.text-center
-    .text-big
-      {{ 'js.admin.modals.tag_rule_help.title' | t }}
-
-  .margin-bottom-30
-    .text-normal
-      {{ 'js.admin.modals.tag_rule_help.overview' | t }}
-    %p
-      {{ 'js.admin.modals.tag_rule_help.overview_text' | t }}
-
-  .margin-bottom-30
-    .text-normal
-      {{ 'js.admin.modals.tag_rule_help.by_default_rules' | t }}
-    %p
-      {{ 'js.admin.modals.tag_rule_help.by_default_rules_text' | t }}
-
-  .margin-bottom-30
-    .text-normal
-      {{ 'js.admin.modals.tag_rule_help.customer_tagged_rules' | t }}
-    %p
-      {{ 'js.admin.modals.tag_rule_help.customer_tagged_rules_text' | t }}
-
-  .text-center
-    %input.button.red.icon-plus{ type: 'button', value: t('js.admin.modals.got_it'), ng: { click: 'close()' } }

app/assets/javascripts/templates/admin/modals/terms_and_conditions_info.html.haml

@@ -1,13 +0,0 @@
-%div
-  .margin-bottom-30.text-center
-    .text-big
-      {{ 'js.admin.modals.terms_and_conditions_info.title' | t }}
-  .margin-bottom-30
-    %p
-      {{ 'js.admin.modals.terms_and_conditions_info.message_1' | t }}
-  .margin-bottom-30
-    %p
-      {{ 'js.admin.modals.terms_and_conditions_info.message_2' | t }}
-
-  .text-center
-    %input.button.red.icon-plus{ type: 'button', value: t('js.admin.modals.got_it'), ng: { click: 'close()' } }

app/assets/javascripts/templates/admin/panels/exchange_products_panel_footer.html.haml

@@ -6,6 +6,6 @@
 
 .sixteen.columns.alpha#loading{ 'ng-show' => 'productsLoading()' }
   %br
-  %img.spinner{ src: image_path("/spinning-circles.svg")}
+  %i.spinner.fa.fa-spin.fa-circle-o-notch
   %h1
     {{ 'js.admin.panels.exchange_products.loading_variants' | t }}

app/assets/javascripts/templates/admin/schedule_dialog.html.haml

@@ -21,5 +21,4 @@
       %input.button{ type: 'submit', value: "{{ 'js.admin.order_cycles.schedules.update_schedule' | t }}", ng: { show: 'schedule.id' } }
       %span{ ng: { show: 'schedule.id' } } or
       %input.button.red{ type: 'button', value: "{{ 'js.admin.order_cycles.schedules.delete_schedule' | t }}", ng: { show: 'schedule.id', click: 'delete()'} }
-      or
       %input.button{ type: 'button', value: "{{ 'actions.cancel' | t }}", ng: { click: 'close()' } }

app/assets/javascripts/templates/admin/show_more.html.haml

@@ -1,4 +1,3 @@
 %div{ ng: { show: "data.length > limit" } }
   %input{ type: 'button', value: t(:show_more), ng: { click: 'limit = limit + increment' } }
-  or
   %input{ type: 'button', value: t(:show_all_with_more, num: '{{ data.length - limit }}'), ng: { click: 'limit = data.length' } }

app/assets/javascripts/templates/authentication.html.haml

@@ -1,7 +0,0 @@
-%div{"ng-controller" => "AuthenticationCtrl"}
-  %tabset
-    %ng-include{src: "'login.html'"}
-    %ng-include{src: "'signup.html'"}
-    %ng-include{src: "'forgot.html'"}
-%a.close-reveal-modal{"ng-click" => "$close()"}  
-  %i.ofn-i_009-close

app/assets/javascripts/templates/forgot.html.haml

@@ -1,31 +0,0 @@
-%tab#forgot{ heading: "{{'forgot_password' | t}}", active: "tabs.forgot.active", select: "select(path)"}
-  %form{ ng: { controller: "ForgotCtrl", submit: "submit()" } }
-    .row
-      .large-12.columns
-        .alert-box.success{"ng-show" => "sent"}
-          {{ 'password_reset_sent' | t }}
-
-        .alert-box.success{"ng-show" => "messages != null"}
-          {{ messages }}
-
-        .alert-box.alert{"ng-show" => "errors != null"}
-          {{ errors }}
-          %a{ng: {show: 'user_unconfirmed', click: 'resend_confirmation()'}}
-            = t('devise.confirmations.resend_confirmation_email')
-
-    .row
-      .large-12.columns
-        %label{for: "email"} {{'signup_email' | t}}
-        %input.title.input-text{name: "email",
-          type: "email",
-          id: "email",
-          tabindex: 1,
-          inputmode: "email",
-          "ng-model" => "spree_user.email"}
-    .row
-      .large-12.columns
-        %input.button.primary{name: "commit",
-          tabindex: "3",
-          type: "submit",
-          value: "{{'reset_password' | t}}"}
-

app/assets/javascripts/templates/login.html.haml

@@ -1,48 +0,0 @@
-%tab#login-content{ heading: "{{'label_login' | t}}", active: "tabs.login.active", select: "select(path)"}
-  %form{ ng: { controller: "LoginCtrl", submit: "submit()" } }
-    .row
-      .large-12.columns
-        .alert-box.alert{"ng-show" => "errors != null"}
-          {{ errors }}
-          %a{ng: {show: 'user_unconfirmed', click: 'resend_confirmation()'}}
-            = t('devise.confirmations.resend_confirmation_email')
-        .alert-box.success{ng: {show: 'messages != null'}}
-          {{ messages }}
-    .row
-      .large-12.columns
-        %label{for: "email"} {{'email' | t}}
-        %input.title.input-text{name: "email",
-          type: "email",
-          id: "email",
-          tabindex: "1",
-          inputmode: "email",
-          "ng-model" => "spree_user.email"}
-    .row
-      .large-12.columns
-        %label{for: "password"} {{'password' | t}}
-        %input.title.input-text{name: "password",
-          type: "password",
-          id: "password",
-          autocomplete: "off",
-          tabindex: "2",
-          inputmode: "password",
-          "ng-model" => "spree_user.password"}
-    .row
-      .large-12.columns
-        %input{name: "remember_me",
-        type: "checkbox",
-        id: "remember_me",
-        value: "1",
-        tabindex: "3",
-        "ng-model" => "spree_user.remember_me"}
-        %label{for: "remember_me"} {{'remember_me' | t}}
-    .row
-      .large-12.columns
-        %input.button.primary{name: "commit",
-          tabindex: "4",
-          type: "submit",
-          value: "{{'label_login' | t}}"}
-:javascript
-  if (window._paq) {
-    window._paq.push(['trackEvent', 'Signin/Signup', 'Login Modal View', window.location.href]);
-  }

app/assets/javascripts/templates/registration_authentication.html.haml

@@ -1,17 +0,0 @@
-.container
-  .row.modal-centered
-    %h2 {{'js.registration.welcome_to_ofn' | t}}
-    %h5 {{'js.registration.signup_or_login' | t}}:
-  %div{"ng-controller" => "AuthenticationCtrl"}
-    %tabset
-      %ng-include{src: "'signup.html'"}
-      %ng-include{src: "'login.html'"}
-      %ng-include{src: "'forgot.html'"}
-    %div{ ng: { show: "active('/signup')"} }
-      %hr
-      {{'js.registration.have_an_account' | t}}
-      %a{ href: "", ng: { click: "select('/login')"}}
-        {{'js.registration.action_login' | t}}
-
-%a.close-reveal-modal{"ng-click" => "$close()"}
-  %i.ofn-i_009-close

app/assets/javascripts/templates/shipping_type_selector.html.haml

@@ -1,4 +0,0 @@
-%ul.small-block-grid-2.medium-block-grid-4.large-block-grid-2
-  %active-selector{"ng-repeat" => "(name, selector) in selectors"}
-    %i{"ng-class" => "selector.icon"}
-    {{ selector.translation_key | t | capitalize }}

app/assets/javascripts/templates/shop_variant.html.haml

@@ -1,23 +0,0 @@
-.variants.row
-  .small-4.medium-4.large-5.columns.variant-name
-    .inline{"ng-if" => "::variant.display_name"} {{ ::variant.display_name }}
-    .variant-unit {{ ::variant.unit_to_display }}
-  .small-3.medium-3.large-2.columns.variant-price
-    %price-breakdown{"price-breakdown" => "_", variant: "variant",
-      "price-breakdown-append-to-body" => "true",
-      "price-breakdown-placement" => "bottom",
-      "price-breakdown-animation" => true}
-    {{ variant.price_with_fees | localizeCurrency }}
-    .unit-price.variant-unit-price
-      %question-mark-with-tooltip{"question-mark-with-tooltip" => "_",
-      "question-mark-with-tooltip-append-to-body" => "true",
-      "question-mark-with-tooltip-placement" => "top",
-      "question-mark-with-tooltip-animation" => true,
-      key: "'js.shopfront.unit_price_tooltip'"}
-      {{ variant.unit_price_price | localizeCurrency }} / {{ variant.unit_price_unit }}
-        
-  .medium-2.large-2.columns.total-price
-    %span{"ng-class" => "{filled: variant.line_item.total_price}"}
-      {{ variant.line_item.total_price | localizeCurrency }}
-  %ng-include{src: "'partials/shop_variant_no_group_buy.html'"}
-  %ng-include{src: "'partials/shop_variant_with_group_buy.html'"}

app/assets/javascripts/templates/signup.html.haml

@@ -1,51 +0,0 @@
-%tab#sign-up-content{ heading: "{{'label_signup' | t}}", active: 'tabs.signup.active', select: "select(path)"}
-  %form{ ng: { controller: "SignupCtrl", submit: "submit()" } }
-    .row
-      .large-12.columns
-        .alert-box.success{ng: {show: 'messages != null'}}
-          {{ messages }}
-      .large-12.columns
-        .alert-box.alert{ng: {show: 'errors.message != null'}}
-          {{ errors.message }}
-    .row
-      .large-12.columns
-        %label{for: "email"} {{'signup_email' | t}}
-        %input.title.input-text{name: "email",
-          type: "email",
-          id: "email",
-          tabindex: 1,
-          inputmode: "email",
-          "ng-model" => "spree_user.email"}
-        %span.error{"ng-show" => "errors.email != null"}
-          {{ errors.email.join(' ') }}
-    .row
-      .large-12.columns
-        %label{for: "password"} {{'choose_password' | t}}
-        %input.title.input-text{name: "password",
-          type: "password",
-          id: "password",
-          autocomplete: "off",
-          tabindex: 2,
-          inputmode: "password",
-          "ng-model" => "spree_user.password"}
-        %span.error{"ng-show" => "errors.password != null"}
-          {{ errors.password.join(' ') }}
-    .row
-      .large-12.columns
-        %label{for: "password_confirmation"} {{'confirm_password' | t}}
-        %input.title.input-text{name: "password_confirmation",
-          type: "password",
-          id: "password_confirmation",
-          autocomplete: "off",
-          tabindex: 2,
-          inputmode: "password",
-          "ng-model" => "spree_user.password_confirmation"}
-        %span.error{"ng-show" => "errors.password_confirmation != null"}
-          {{ errors.password_confirmation.join(' ') }}
-    .row
-      .large-12.columns
-        %input.button.primary{name: "commit",
-          tabindex: "3",
-          type: "submit",
-          value: "{{'action_signup' | t}}"}
-

app/components/help_modal_component.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class HelpModalComponent < ViewComponent::Base
+  def initialize(id:, close_button: true)
+    @id = id
+    @close_button = close_button
+  end
+
+  private
+
+  def close_button_class
+    if namespace == "admin"
+      "red"
+    else
+      "primary"
+    end
+  end
+
+  def close_button?
+    !!@close_button
+  end
+
+  def namespace
+    helpers.controller_path.split("/").first
+  end
+end

app/components/help_modal_component/help_modal_component.html.haml

@@ -0,0 +1,8 @@
+%div{ id: @id, "data-controller": "help-modal", "data-action": "keyup@document->help-modal#closeIfEscapeKey" }
+  .reveal-modal-bg.fade{ "data-help-modal-target": "background", "data-action": "click->help-modal#close" }
+  .reveal-modal.fade.small.help-modal{ "data-help-modal-target": "modal" }
+    = content
+
+    - if close_button?
+      .text-center
+        %input{ class: "button icon-plus #{close_button_class}", type: 'button', value: t('js.admin.modals.got_it'), "data-action": "click->help-modal#close" }

app/components/help_modal_component/help_modal_component.scss

@@ -0,0 +1,10 @@
+.help-modal {
+  visibility: visible;
+  position: fixed;
+  top: 3em;
+}
+
+/* prevent arrow on selected admin menu item appearing above modal */
+body.modal-open #admin-menu li.selected a::after {
+  z-index: 0;
+}

app/constraints/split_checkout_constraint.rb

@@ -2,10 +2,10 @@
 
 class SplitCheckoutConstraint
   def matches?(request)
-    Flipper.enabled? :split_checkout, current_user(request)
+    OpenFoodNetwork::FeatureToggle.enabled? :split_checkout, current_user(request)
   end
 
   def current_user(request)
-    @spree_current_user ||= request.env['warden'].user
+    request.env['warden'].user
   end
 end

app/controllers/admin/contents_controller.rb

@@ -10,14 +10,14 @@ module Admin
 
     def update
       params.each do |name, value|
-        if ContentConfig.has_preference?(name) || ContentConfig.has_attachment?(name)
-          ContentConfig.public_send("#{name}=", value)
+        if value.is_a?(ActionDispatch::Http::UploadedFile)
+          blob = store_file(value)
+          update_preference("#{name}_blob_id", blob.id)
+        else
+          update_preference(name, value)
         end
       end
 
-      # Save any uploaded images
-      ContentConfig.save
-
       flash[:success] =
         t(:successfully_updated, resource: I18n.t('admin.contents.edit.your_content'))
 
@@ -26,6 +26,22 @@ module Admin
 
     private
 
+    def store_file(attachable)
+      ActiveStorage::Blob.create_and_upload!(
+        io: attachable.open,
+        filename: attachable.original_filename,
+        content_type: attachable.content_type,
+        service_name: :local,
+        identify: false,
+      )
+    end
+
+    def update_preference(name, value)
+      return unless ContentConfig.has_preference?(name)
+
+      ContentConfig.public_send("#{name}=", value)
+    end
+
     def preference_sections
       [
         PreferenceSections::HeaderSection.new,

app/controllers/admin/customers_controller.rb

@@ -99,7 +99,7 @@ module Admin
 
     def customer_params
       params.require(:customer).permit(
-        :enterprise_id, :name, :email, :code, :tag_list,
+        :enterprise_id, :first_name, :last_name, :email, :code, :tag_list,
         ship_address_attributes: PermittedAttributes::Address.attributes,
         bill_address_attributes: PermittedAttributes::Address.attributes,
       )

app/controllers/admin/enterprises_controller.rb

@@ -234,8 +234,10 @@ module Admin
     end
 
     def update_enterprise_notifications
-      if params.key? :receives_notifications
-        @enterprise.update_contact params[:receives_notifications]
+      user_id = params[:receives_notifications].to_i
+
+      if user_id.positive? && @enterprise.user_ids.include?(user_id)
+        @enterprise.update_contact(user_id)
       end
     end
 

app/controllers/admin/order_cycles_controller.rb

@@ -64,6 +64,7 @@ module Admin
       @order_cycle_form = OrderCycleForm.new(@order_cycle, order_cycle_params, spree_current_user)
 
       if @order_cycle_form.save
+        update_nil_subscription_line_items_price_estimate(@order_cycle)
         respond_to do |format|
           flash[:notice] = I18n.t(:order_cycles_update_notice) if params[:reloading] == '1'
           format.html { redirect_back(fallback_location: root_path) }
@@ -76,6 +77,7 @@ module Admin
 
     def bulk_update
       if order_cycle_set&.save
+        bulk_update_nil_subscription_line_items_price_estimate
         render_as_json @order_cycles,
                        ams_prefix: 'index',
                        current_user: spree_current_user,
@@ -86,6 +88,27 @@ module Admin
       end
     end
 
+    def bulk_update_nil_subscription_line_items_price_estimate
+      @collection.upcoming.each do |order_cycle|
+        update_nil_subscription_line_items_price_estimate(order_cycle)
+      end
+    end
+
+    def update_nil_subscription_line_items_price_estimate(order_cycle)
+      order_cycle.schedules.each do |schedule|
+        Subscription.where(schedule_id: schedule.id).each do |subscription|
+          shop = Enterprise.managed_by(spree_current_user).find_by(id: subscription.shop_id)
+          subscription.subscription_line_items.nil_price_estimate.each do |line_item|
+            variant = OrderManagement::Subscriptions::
+                VariantsList.eligible_variants(shop).find_by(id: line_item.variant_id)
+            fee_calculator = OpenFoodNetwork::EnterpriseFeeCalculator.new(shop, order_cycle)
+            price = variant.price + fee_calculator.indexed_fees_for(variant)
+            line_item.update_column(:price_estimate, price)
+          end
+        end
+      end
+    end
+
     def clone
       @order_cycle = OrderCycle.find params[:id]
       @order_cycle.clone!

app/controllers/admin/reports_controller.rb

@@ -5,14 +5,23 @@ module Admin
     include ReportsActions
     helper ReportsHelper
 
-    before_action :authorize_report
+    before_action :authorize_report, only: [:show]
+
+    # Define model class for Can? permissions
+    def model_class
+      Admin::ReportsController
+    end
+
+    def index
+      @reports = reports.select do |report_type, _description|
+        can? report_type, :report
+      end
+    end
 
     def show
-      render_report && return if ransack_params.blank?
+      @report = report_class.new(spree_current_user, params, request)
 
-      @report = report_class.new(spree_current_user, ransack_params, report_options)
-
-      if export_spreadsheet?
+      if report_format.present?
         export_report
       else
         render_report
@@ -22,33 +31,23 @@ module Admin
     private
 
     def export_report
-      render report_format.to_sym => @report.public_send("to_#{report_format}"),
-             :filename => report_filename
+      send_data @report.render_as(report_format, controller: self), filename: report_filename
     end
 
     def render_report
       assign_view_data
-      load_form_options
-
-      render report_type
+      render "show"
     end
 
     def assign_view_data
       @report_type = report_type
-      @report_subtype = report_subtype || report_loader.default_report_subtype
-      @report_subtypes = report_class.report_subtypes.map do |subtype|
-        [t("packing.#{subtype}_report", scope: i18n_scope), subtype]
-      end
-    end
+      @report_subtypes = report_subtypes
+      @report_subtype = report_subtype
 
-    def load_form_options
-      return unless form_options_required?
+      # Initialize data
+      params[:display_summary_row] = true if request.get?
 
-      form_options = Reporting::FrontendData.new(spree_current_user)
-
-      @distributors = form_options.distributors.to_a
-      @suppliers = form_options.suppliers.to_a
-      @order_cycles = form_options.order_cycles.to_a
+      @data = Reporting::FrontendData.new(spree_current_user)
     end
   end
 end

app/controllers/admin/subscriptions_controller.rb

@@ -16,15 +16,16 @@ module Admin
       respond_to do |format|
         format.html do
           if view_context.subscriptions_setup_complete?(@shops)
-            @order_cycles = OrderCycle.joins(:schedules).managed_by(spree_current_user)
-            @payment_methods = Spree::PaymentMethod.managed_by(spree_current_user)
+            @order_cycles = OrderCycle.joins(:schedules).managed_by(spree_current_user).includes([:distributors, :cached_incoming_exchanges])
+            @payment_methods = Spree::PaymentMethod.managed_by(spree_current_user).includes(:taggings)
+            @payment_method_tags = payment_method_tags_by_id
             @shipping_methods = Spree::ShippingMethod.managed_by(spree_current_user)
           else
             @shop = @shops.first
             render :setup_explanation
           end
         end
-        format.json { render_as_json @collection, ams_prefix: params[:ams_prefix] }
+        format.json { render_as_json @collection, ams_prefix: params[:ams_prefix], payment_method_tags: payment_method_tags_by_id }
       end
     end
 
@@ -165,5 +166,21 @@ module Admin
       @subscription_params ||= PermittedAttributes::Subscription.new(params).call.
         to_h.with_indifferent_access
     end
+
+    def payment_method_tags_by_id
+      payment_method_tags = ::ActsAsTaggableOn::Tag.
+        joins(:taggings).
+        includes(:taggings).
+        where(taggings: { taggable_type: "Spree::PaymentMethod",
+                          taggable_id: Spree::PaymentMethod.from(Enterprise.managed_by(spree_current_user).
+                          select('enterprises.id').find_by(id: params[:enterprise_id])),
+                          context: 'tags' })
+
+      payment_method_tags.each_with_object({}) do |tag, hash|
+        payment_method_id = tag.taggings.first.taggable_id
+        hash[payment_method_id] ||= []
+        hash[payment_method_id] << tag.name
+      end
+    end
   end
 end

app/controllers/api/v0/enterprise_attachment_controller.rb

@@ -14,7 +14,7 @@ module Api
       respond_to :json
 
       def destroy
-        unless @enterprise.public_send("#{attachment_name}?")
+        unless @enterprise.public_send(attachment_name).attached?
           return respond_with_conflict(error: destroy_attachment_does_not_exist_error_message)
         end
 

app/controllers/api/v0/enterprises_controller.rb

@@ -44,9 +44,9 @@ module Api
         authorize! :update, @enterprise
 
         if params[:logo] && @enterprise.update( logo: params[:logo] )
-          render html: @enterprise.logo.url(:medium), status: :ok
-        elsif params[:promo] && @enterprise.update( promo_image: params[:promo] )
-          render html: @enterprise.promo_image.url(:medium), status: :ok
+          render(html: @enterprise.logo_url(:medium), status: :ok)
+        elsif params[:promo] && @enterprise.update!( promo_image: params[:promo] )
+          render(html: @enterprise.promo_image_url(:medium), status: :ok)
         else
           invalid_resource!(@enterprise)
         end

app/controllers/api/v0/order_cycles_controller.rb

@@ -81,8 +81,7 @@ module Api
 
       def permitted_ransack_params
         [:name_or_meta_keywords_or_variants_display_as_or_variants_display_name_or_supplier_name_cont,
-         :properties_id_or_supplier_properties_id_in_any,
-         :primary_taxon_id_in_any]
+         :with_properties, :primary_taxon_id_in_any]
       end
 
       def distributor

app/controllers/api/v0/reports_controller.rb

@@ -10,7 +10,8 @@ module Api
       before_action :validate_report, :authorize_report, :validate_query
 
       def show
-        @report = report_class.new(current_api_user, ransack_params, report_options)
+        params[:report_format] = 'json'
+        @report = report_class.new(current_api_user, params)
 
         render_report
       end

app/controllers/api/v0/shipments_controller.rb

@@ -79,8 +79,9 @@ module Api
       def remove
         variant = scoped_variant(params[:variant_id])
         quantity = params[:quantity].to_i
+        restock_item = params.fetch(:restock_item, "true") == "true"
 
-        @order.contents.remove(variant, quantity, @shipment)
+        @order.contents.remove(variant, quantity, @shipment, restock_item)
         @shipment.reload if @shipment.persisted?
 
         render json: @shipment, serializer: Api::ShipmentSerializer, status: :ok

app/controllers/api/v1/base_controller.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+module Api
+  module V1
+    class BaseController < ActionController::API
+      include CanCan::ControllerAdditions
+      include RequestTimeouts
+      include Pagy::Backend
+      include JsonApiPagination
+      include RaisingParameters
+
+      check_authorization
+
+      attr_accessor :current_api_user
+
+      before_action :authenticate_user
+      before_action :restrict_feature
+
+      rescue_from StandardError, with: :error_during_processing
+      rescue_from CanCan::AccessDenied, with: :unauthorized
+      rescue_from ActiveRecord::RecordNotFound, with: :not_found
+      rescue_from Pagy::VariableError, with: :invalid_pagination
+      rescue_from ActionController::ParameterMissing, with: :missing_parameter
+      rescue_from ActionController::UnpermittedParameters, with: :unpermitted_parameters
+
+      private
+
+      def authenticate_user
+        return if (@current_api_user = request.env['warden'].user)
+
+        if api_key.blank?
+          # An anonymous user
+          @current_api_user = Spree::User.new
+          return
+        end
+
+        return if (@current_api_user = Spree::User.find_by(spree_api_key: api_key.to_s))
+
+        invalid_api_key
+      end
+
+      def restrict_feature
+        not_found unless Flipper.enabled?(:api_v1, @current_api_user)
+      end
+
+      def current_ability
+        Spree::Ability.new(current_api_user)
+      end
+
+      def api_key
+        request.headers["X-Api-Token"] || params[:token]
+      end
+
+      def error_during_processing(exception)
+        Bugsnag.notify(exception)
+
+        if Rails.env.development? || Rails.env.test?
+          render status: :unprocessable_entity,
+                 json: json_api_error(exception.message, meta: exception.backtrace)
+        else
+          render status: :unprocessable_entity,
+                 json: json_api_error(I18n.t(:unknown_error, scope: "api"))
+        end
+      end
+
+      def invalid_pagination(exception)
+        render status: :unprocessable_entity,
+               json: json_api_error(exception.message)
+      end
+
+      def missing_parameter(error)
+        message = I18n.t(:missing_parameter, param: error.param, scope: :api)
+
+        render status: :unprocessable_entity,
+               json: json_api_error(message)
+      end
+
+      def unpermitted_parameters(error)
+        message = I18n.t(:unpermitted_parameters, params: error.params.join(", "), scope: :api)
+
+        render status: :unprocessable_entity,
+               json: json_api_error(message)
+      end
+
+      def invalid_resource!(resource = nil)
+        render status: :unprocessable_entity,
+               json: json_api_invalid(
+                 I18n.t(:invalid_resource, scope: "api"),
+                 resource&.errors
+               )
+      end
+
+      def invalid_api_key
+        render status: :unauthorized,
+               json: json_api_error(I18n.t(:invalid_api_key, key: api_key, scope: "api"))
+      end
+
+      def unauthorized
+        render status: :unauthorized,
+               json: json_api_error(I18n.t(:unauthorized, scope: "api"))
+      end
+
+      def not_found
+        render status: :not_found,
+               json: json_api_error(I18n.t(:resource_not_found, scope: "api"))
+      end
+
+      def json_api_error(message, **options)
+        { errors: [{ detail: message }] }.merge(options)
+      end
+
+      def json_api_invalid(message, errors)
+        error_response = { errors: [{ detail: message }] }
+        error_response.merge!(meta: { validation_errors: errors.to_a }) if errors.any?
+        error_response
+      end
+    end
+  end
+end

app/controllers/api/v1/customers_controller.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require 'open_food_network/permissions'
+
+module Api
+  module V1
+    class CustomersController < Api::V1::BaseController
+      skip_authorization_check only: :index
+
+      before_action :set_customer, only: [:show, :update, :destroy]
+      before_action :authorize_action, only: [:show, :update, :destroy]
+
+      def index
+        @pagy, customers = pagy(search_customers, pagy_options)
+
+        render json: Api::V1::CustomerSerializer.new(customers, pagination_options)
+      end
+
+      def show
+        render json: Api::V1::CustomerSerializer.new(@customer, include_options)
+      end
+
+      def create
+        authorize! :update, Enterprise.find(customer_params[:enterprise_id])
+        @customer = Customer.new(customer_params)
+
+        if @customer.save
+          render json: Api::V1::CustomerSerializer.new(@customer), status: :created
+        else
+          invalid_resource! @customer
+        end
+      end
+
+      def update
+        if @customer.update(customer_params)
+          render json: Api::V1::CustomerSerializer.new(@customer)
+        else
+          invalid_resource! @customer
+        end
+      end
+
+      def destroy
+        if @customer.destroy
+          render json: Api::V1::CustomerSerializer.new(@customer)
+        else
+          invalid_resource! @customer
+        end
+      end
+
+      private
+
+      def set_customer
+        @customer = Customer.find(params[:id])
+      end
+
+      def authorize_action
+        authorize! action_name.to_sym, @customer
+      end
+
+      def search_customers
+        customers = visible_customers.includes(:bill_address, :ship_address)
+        customers = customers.where(enterprise_id: params[:enterprise_id]) if params[:enterprise_id]
+        customers.ransack(params[:q]).result
+      end
+
+      def visible_customers
+        current_api_user.customers.or(
+          Customer.where(enterprise_id: editable_enterprises)
+        )
+      end
+
+      def customer_params
+        attributes = params.require(:customer).permit(
+          :email, :enterprise_id,
+          :code, :first_name, :last_name,
+          :billing_address, shipping_address: [
+            :phone, :latitude, :longitude,
+            :first_name, :last_name,
+            :street_address_1, :street_address_2,
+            :postal_code, :locality, :region, :country,
+          ]
+        ).to_h
+
+        attributes.merge!(tag_list: params[:tags]) if params.key?(:tags)
+
+        transform_address!(attributes, :billing_address, :bill_address)
+        transform_address!(attributes, :shipping_address, :ship_address)
+
+        attributes
+      end
+
+      def transform_address!(attributes, from, to)
+        return unless attributes.key?(from)
+
+        address = attributes.delete(from)
+
+        if address.nil?
+          attributes[to] = nil
+          return
+        end
+
+        address.transform_keys! do |key|
+          {
+            phone: :phone, latitude: :latitude, longitude: :longitude,
+            first_name: :firstname, last_name: :lastname,
+            street_address_1: :address1, street_address_2: :address2,
+            postal_code: :zipcode,
+            locality: :city,
+            region: :state_name,
+            country: :country,
+          }.with_indifferent_access[key]
+        end
+
+        if address[:state_name].present?
+          address[:state] = Spree::State.find_by(name: address[:state_name])
+        end
+
+        if address[:country].present?
+          address[:country] = Spree::Country.find_by(name: address[:country])
+        end
+
+        attributes["#{to}_attributes"] = address
+      end
+
+      def editable_enterprises
+        OpenFoodNetwork::Permissions.new(current_api_user).editable_enterprises.select(:id)
+      end
+
+      def include_options
+        fields = [params.fetch(:include, [])].flatten
+
+        { include: fields.map(&:to_s) }
+      end
+    end
+  end
+end

app/controllers/application_controller.rb

@@ -29,6 +29,7 @@ class ApplicationController < ActionController::Base
   helper 'footer_links'
   helper 'discourse'
   helper 'checkout'
+  helper 'link'
   helper 'terms_and_conditions'
 
   protect_from_forgery
@@ -37,8 +38,8 @@ class ApplicationController < ActionController::Base
   include Spree::Core::ControllerHelpers::RespondWith
   include Spree::Core::ControllerHelpers::Common
 
-  prepend_before_action :restrict_iframes
   before_action :set_cache_headers # prevent cart emptying via cache when using back button #1213
+  before_action :set_after_login_url
 
   include RawParams
   include EnterprisesHelper
@@ -62,15 +63,11 @@ class ApplicationController < ActionController::Base
   end
 
   def set_checkout_redirect
-    referer_path = OpenFoodNetwork::RefererParser.path(request.referer)
-    if referer_path
-      is_checkout_path_the_referer = [main_app.checkout_path].include?(referer_path)
-      session["spree_user_return_to"] = if is_checkout_path_the_referer
-                                          referer_path
-                                        else
-                                          main_app.root_path
-                                        end
-    end
+    referer_path = URI(request.referer.to_s).path
+    return unless referer_path == main_app.checkout_path ||
+                  referer_path == main_app.checkout_step_path(:details)
+
+    session["spree_user_return_to"] = main_app.checkout_path
   end
 
   def shopfront_session
@@ -103,27 +100,20 @@ class ApplicationController < ActionController::Base
 
   private
 
+  def set_after_login_url
+    store_location_for(:spree_user, params[:after_login]) if params[:after_login]
+  end
+
   def shopfront_redirect
     session[:shopfront_redirect]
   end
 
-  def restrict_iframes
-    response.headers['X-Frame-Options'] = 'DENY'
-    response.headers['Content-Security-Policy'] = "frame-ancestors 'none'"
-  end
-
-  def enable_embedded_shopfront
-    embed_service = EmbeddedPageService.new(params, session, request, response)
-    embed_service.embed!
-    @shopfront_layout = 'embedded' if embed_service.use_embedded_layout?
-  end
-
   def action
     params[:action].to_sym
   end
 
   def require_distributor_chosen
-    unless @distributor = current_distributor
+    unless (@distributor = current_distributor)
       redirect_to main_app.root_path
       false
     end
@@ -151,17 +141,6 @@ class ApplicationController < ActionController::Base
       !current_distributor.ready_for_checkout?
   end
 
-  def check_order_cycle_expiry
-    if current_order_cycle&.closed?
-      Bugsnag.notify("Notice: order cycle closed during checkout completion", order: current_order)
-      current_order.empty!
-      current_order.set_order_cycle! nil
-      flash[:info] = I18n.t('order_cycle_closed')
-
-      redirect_to main_app.shop_path
-    end
-  end
-
   # All render calls within the block will be performed with the specified format
   # Useful for rendering html within a JSON response, particularly if the specified
   # template or partial then goes on to render further partials without specifying

app/controllers/base_controller.rb

@@ -12,7 +12,6 @@ class BaseController < ApplicationController
   include OrderCyclesHelper
 
   before_action :set_locale
-  before_action :check_order_cycle_expiry
 
   private
 

app/controllers/checkout_controller.rb

@@ -3,11 +3,11 @@
 require 'open_food_network/address_finder'
 
 class CheckoutController < ::BaseController
-  layout 'darkswarm'
-
   include OrderStockCheck
   include OrderCompletion
 
+  layout 'darkswarm'
+
   helper 'terms_and_conditions'
   helper 'checkout'
 
@@ -26,7 +26,6 @@ class CheckoutController < ::BaseController
 
   before_action :associate_user
   before_action :check_authorization
-  before_action :enable_embedded_shopfront
 
   helper 'spree/orders'
 
@@ -97,6 +96,7 @@ class CheckoutController < ::BaseController
   def checkout_workflow(shipping_method_id)
     while @order.state != "complete"
       if @order.state == "payment"
+        update_payment_total
         return if redirect_to_payment_gateway
 
         return action_failed if @order.errors.any?
@@ -111,6 +111,11 @@ class CheckoutController < ::BaseController
     update_response
   end
 
+  def update_payment_total
+    @order.updater.update_totals
+    @order.updater.update_pending_payment
+  end
+
   def redirect_to_payment_gateway
     return unless selected_payment_method.external_gateway?
     return unless (redirect_url = selected_payment_method.external_payment_url(order: @order))

app/controllers/concerns/checkout_callbacks.rb

@@ -2,6 +2,7 @@
 
 module CheckoutCallbacks
   extend ActiveSupport::Concern
+  include EnterprisesHelper
 
   included do
     # We need pessimistic locking to avoid race conditions.
@@ -14,13 +15,12 @@ module CheckoutCallbacks
     prepend_before_action :require_distributor_chosen
 
     before_action :load_order, :associate_user, :load_saved_addresses, :load_saved_credit_cards
-    before_action :load_shipping_methods, :load_countries, if: -> { params[:step] == "details" }
+    before_action :load_shipping_methods, if: -> { params[:step] == "details" }
 
     before_action :ensure_order_not_completed
     before_action :ensure_checkout_allowed
     before_action :handle_insufficient_stock
     before_action :check_authorization
-    before_action :enable_embedded_shopfront
   end
 
   private
@@ -47,16 +47,7 @@ module CheckoutCallbacks
   end
 
   def load_shipping_methods
-    @shipping_methods = Spree::ShippingMethod.for_distributor(@order.distributor).order(:name)
-  end
-
-  def load_countries
-    @countries = available_countries.map { |c| [c.name, c.id] }
-    @countries_with_states = available_countries.map { |c|
-      [c.id, c.states.map { |s|
-               [s.name, s.id]
-             }]
-    }
+    @shipping_methods = available_shipping_methods.sort { |a, b| a.name.casecmp(b.name) }
   end
 
   def redirect_to_shop?

app/controllers/concerns/embedded_pages.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module EmbeddedPages
+  extend ActiveSupport::Concern
+
+  included do
+    content_security_policy do |policy|
+      policy.frame_ancestors :self, -> { embed_service.embedding_domain }
+    end
+
+    before_action :enable_embedded_pages
+  end
+
+  private
+
+  def enable_embedded_pages
+    return unless embed_service.use_embedded_layout
+
+    @shopfront_layout = 'embedded'
+  end
+
+  def embed_service
+    @embed_service ||= EmbeddedPageService.
+      new(params, session, request, response).
+      tap(&:embed!)
+  end
+end

app/controllers/concerns/json_api_pagination.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module JsonApiPagination
+  extend ActiveSupport::Concern
+
+  DEFAULT_PER_PAGE = 50
+  MAX_PER_PAGE = 200
+
+  def pagination_options
+    {
+      is_collection: true,
+      meta: meta_options,
+      links: links_options,
+    }
+  end
+
+  def pagy_options
+    { items: final_per_page_value }
+  end
+
+  private
+
+  def meta_options
+    {
+      pagination: {
+        results: @pagy.count,
+        pages: total_pages,
+        page: current_page,
+        per_page: final_per_page_value
+      }
+    }
+  end
+
+  def links_options
+    {
+      self: pagination_url(current_page),
+      first: pagination_url(1),
+      prev: pagination_url(previous_page),
+      next: pagination_url(next_page),
+      last: pagination_url(total_pages)
+    }
+  end
+
+  def pagination_url(page_number)
+    return if page_number.nil?
+
+    url_for(only_path: false, params: request.query_parameters.merge(page: page_number))
+  end
+
+  # User-specified value, or DEFAULT_PER_PAGE, capped at MAX_PER_PAGE
+  def final_per_page_value
+    (params[:per_page] || DEFAULT_PER_PAGE).to_i.clamp(1, MAX_PER_PAGE)
+  end
+
+  def current_page
+    (params[:page] || 1).to_i
+  end
+
+  def total_pages
+    @pagy.pages
+  end
+
+  def previous_page
+    return nil if current_page < 2
+
+    current_page - 1
+  end
+
+  def next_page
+    return nil if current_page >= total_pages
+
+    current_page + 1
+  end
+end

app/controllers/concerns/order_stock_check.rb

@@ -18,6 +18,17 @@ module OrderStockCheck
     redirect_to main_app.cart_path
   end
 
+  def check_order_cycle_expiry
+    return unless current_order_cycle&.closed?
+
+    Bugsnag.notify("Notice: order cycle closed during checkout completion", order: current_order)
+    current_order.empty!
+    current_order.set_order_cycle! nil
+
+    flash[:info] = I18n.t('order_cycle_closed')
+    redirect_to main_app.shop_path
+  end
+
   private
 
   def sufficient_stock?
@@ -25,7 +36,7 @@ module OrderStockCheck
   end
 
   def reset_order_to_cart
-    return if Flipper.enabled? :split_checkout
+    return if Flipper.enabled? :split_checkout, spree_current_user
 
     OrderCheckoutRestart.new(@order).call
   end

app/controllers/concerns/raising_parameters.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+# The API uses strict parameter checking.
+#
+# We want to raise errors when unused or unpermitted parameters are given
+# to the API. You then know straight away when a parameter isn't used.
+module RaisingParameters
+  extend ActiveSupport::Concern
+
+  # ActionController manages this config on a per-class basis. The subclass
+  # enables us to raise errors only here and not in the rest of the app.
+  class Parameters < ActionController::Parameters
+    def self.action_on_unpermitted_parameters
+      :raise
+    end
+  end
+
+  # We override the params method so that we always use the strict parameters.
+  # We could rename this method if we need access to the orginal as well.
+  def params
+    Parameters.new(super.to_unsafe_hash)
+  end
+end

app/controllers/concerns/reports_actions.rb

@@ -3,10 +3,14 @@
 module ReportsActions
   extend ActiveSupport::Concern
 
+  def reports
+    Reporting::Reports::List.all
+  end
+
   private
 
   def authorize_report
-    authorize! report_type&.to_sym, :report
+    authorize! report_type.to_sym, :report
   end
 
   def report_class
@@ -23,31 +27,26 @@ module ReportsActions
     params[:report_type]
   end
 
+  def report_subtypes
+    reports[report_type.to_sym] || []
+  end
+
+  def report_subtypes_codes
+    report_subtypes.map(&:second).map(&:to_s)
+  end
+
   def report_subtype
-    params[:report_subtype]
+    params[:report_subtype] || report_subtypes_codes.first
   end
 
   def ransack_params
     raw_params[:q]
   end
 
-  def report_options
-    raw_params[:options]
-  end
-
   def report_format
     params[:report_format]
   end
 
-  def export_spreadsheet?
-    ['xlsx', 'ods', 'csv'].include?(report_format)
-  end
-
-  def form_options_required?
-    [:packing, :customers, :products_and_inventory, :order_cycle_management].
-      include? report_type.to_sym
-  end
-
   def report_filename
     "#{report_type || action_name}_#{file_timestamp}.#{report_format}"
   end

app/controllers/enterprises_controller.rb

@@ -14,7 +14,6 @@ class EnterprisesController < BaseController
   prepend_before_action :set_order_cycles, :require_distributor_chosen, :reset_order, only: :shop
 
   before_action :clean_permalink, only: :check_permalink
-  before_action :enable_embedded_shopfront
 
   respond_to :js, only: :permalink_checker
 

app/controllers/groups_controller.rb

@@ -1,10 +1,11 @@
 # frozen_string_literal: true
 
 class GroupsController < BaseController
+  include EmbeddedPages
+
   layout 'darkswarm'
 
   def show
-    enable_embedded_shopfront
     @hide_menu = true if @shopfront_layout == 'embedded'
     @group = EnterpriseGroup.find_by(permalink: params[:id]) || EnterpriseGroup.find(params[:id])
   end

app/controllers/home_controller.rb

@@ -3,8 +3,6 @@
 class HomeController < BaseController
   layout 'darkswarm'
 
-  before_action :enable_embedded_shopfront
-
   def index
     if ContentConfig.home_show_stats
       @num_distributors = cached_count('distributors', Enterprise.is_distributor.activated.visible)

app/controllers/payment_gateways/paypal_controller.rb

@@ -5,10 +5,10 @@ module PaymentGateways
     include OrderStockCheck
     include OrderCompletion
 
-    before_action :enable_embedded_shopfront
     before_action :destroy_orphaned_paypal_payments, only: :confirm
     before_action :load_checkout_order, only: [:express, :confirm]
     before_action :handle_insufficient_stock, only: [:express, :confirm]
+    before_action :check_order_cycle_expiry, only: [:express, :confirm]
     before_action :permit_parameters!
 
     after_action :reset_order_when_complete, only: :confirm

app/controllers/payment_gateways/stripe_controller.rb

@@ -7,6 +7,7 @@ module PaymentGateways
 
     before_action :load_checkout_order, only: :confirm
     before_action :validate_payment_intent, only: :confirm
+    before_action :check_order_cycle_expiry, only: :confirm
     before_action :validate_stock, only: :confirm
 
     def confirm
@@ -46,7 +47,7 @@ module PaymentGateways
       return if session[:access_token] || params[:order_token] || spree_current_user
 
       flash[:error] = I18n.t("spree.orders.edit.login_to_view_order")
-      redirect_to root_path(anchor: "login?after_login=#{request.env['PATH_INFO']}")
+      redirect_to root_path(anchor: "login", after_login: request.original_fullpath)
     end
 
     def validate_stock
@@ -67,12 +68,16 @@ module PaymentGateways
       @valid_payment_intent ||= begin
         return false unless params["payment_intent"]&.starts_with?("pi_")
 
-        @order.state == "payment" &&
-          last_payment&.state == "requires_authorization" &&
-          last_payment&.response_code == params["payment_intent"]
+        order_and_payment_valid?
       end
     end
 
+    def order_and_payment_valid?
+      @order.state.in?(["payment", "confirmation"]) &&
+        last_payment&.state == "requires_authorization" &&
+        last_payment&.response_code == params["payment_intent"]
+    end
+
     def last_payment
       @last_payment ||= OrderPaymentFinder.new(@order).last_payment
     end

app/controllers/payments_controller.rb

@@ -9,7 +9,7 @@ class PaymentsController < BaseController
     @payment = Spree::Payment.find(params[:id])
     authorize! :show, @payment.order
 
-    if url = @payment.cvv_response_message
+    if (url = @payment.cvv_response_message)
       redirect_to url
     else
       redirect_to order_url(@payment.order)
@@ -21,7 +21,9 @@ class PaymentsController < BaseController
   def require_logged_in
     return if session[:access_token] || spree_current_user
 
+    store_location_for :spree_user, request.original_fullpath
+
     flash[:error] = I18n.t("spree.orders.edit.login_to_view_order")
-    redirect_to main_app.root_path(anchor: "login?after_login=#{request.env['PATH_INFO']}")
+    redirect_to main_app.root_path(anchor: "/login", after_login: request.original_fullpath)
   end
 end

app/controllers/producers_controller.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
 class ProducersController < BaseController
-  layout 'darkswarm'
+  include EmbeddedPages
 
-  before_action :enable_embedded_shopfront
+  layout 'darkswarm'
 
   def index
     @enterprises = Enterprise

app/controllers/registration_controller.rb

@@ -19,7 +19,7 @@ class RegistrationController < BaseController
 
   def check_user
     if spree_current_user.nil?
-      redirect_to registration_auth_path(anchor: "signup?after_login=#{request.env['PATH_INFO']}")
+      redirect_to registration_auth_path(anchor: "/signup", after_login: request.original_fullpath)
     elsif !spree_current_user.can_own_more_enterprises?
       render :limit_reached
     end

app/controllers/shop_controller.rb

@@ -3,7 +3,6 @@
 class ShopController < BaseController
   layout "darkswarm"
   before_action :require_distributor_chosen, :set_order_cycles, except: :changeable_orders_alert
-  before_action :enable_embedded_shopfront
 
   def show
     redirect_to main_app.enterprise_shop_path(current_distributor)

app/controllers/shops_controller.rb

@@ -3,8 +3,6 @@
 class ShopsController < BaseController
   layout 'darkswarm'
 
-  before_action :enable_embedded_shopfront
-
   def index
     @enterprises = ShopsListService.new.open_shops
   end

app/controllers/split_checkout_controller.rb

@@ -8,29 +8,39 @@ class SplitCheckoutController < ::BaseController
   include OrderStockCheck
   include Spree::BaseHelper
   include CheckoutCallbacks
+  include OrderCompletion
   include CablecarResponses
 
   helper 'terms_and_conditions'
   helper 'checkout'
   helper 'spree/orders'
+  helper EnterprisesHelper
   helper OrderHelper
 
+  before_action :set_checkout_redirect
+
   def edit
-    redirect_to_step unless params[:step]
+    redirect_to_step_based_on_order unless params[:step]
   end
 
   def update
     if confirm_order || update_order
+      return if performed?
+
       clear_invalid_payments
       advance_order_state
       redirect_to_step
     else
-      flash.now[:error] = I18n.t('split_checkout.errors.global')
+      flash.now[:error] ||= I18n.t('split_checkout.errors.global')
 
       render status: :unprocessable_entity, operations: cable_car.
         replace("#checkout", partial("split_checkout/checkout")).
         replace("#flashes", partial("shared/flashes", locals: { flashes: flash }))
     end
+  rescue Spree::Core::GatewayError => e
+    flash[:error] = I18n.t(:spree_gateway_error_flash_for_checkout, error: e.message)
+    @order.update_column(:state, "payment")
+    render operations: cable_car.redirect_to(url: checkout_step_path(:payment))
   end
 
   private
@@ -44,14 +54,31 @@ class SplitCheckoutController < ::BaseController
     return unless validate_summary! && @order.errors.empty?
 
     @order.customer.touch :terms_and_conditions_accepted_at
+
+    return true if redirect_to_payment_gateway
+
     @order.confirm!
+    order_completion_reset @order
+  end
+
+  def redirect_to_payment_gateway
+    return unless selected_payment_method&.external_gateway?
+    return unless (redirect_url = selected_payment_method.external_payment_url(order: @order))
+
+    render operations: cable_car.redirect_to(url: redirect_url)
+    true
+  end
+
+  def selected_payment_method
+    @selected_payment_method ||= Checkout::PaymentMethodFetcher.new(@order).call
   end
 
   def update_order
-    return if @order.errors.any?
+    return if params[:confirm_order] || @order.errors.any?
 
     @order.select_shipping_method(params[:shipping_method_id])
     @order.update(order_params)
+    @order.updater.update_totals_and_states
 
     validate_current_step!
 
@@ -93,10 +120,10 @@ class SplitCheckoutController < ::BaseController
   end
 
   def order_params
-    @order_params ||= Checkout::Params.new(@order, params).call
+    @order_params ||= Checkout::Params.new(@order, params, spree_current_user).call
   end
 
-  def redirect_to_step
+  def redirect_to_step_based_on_order
     case @order.state
     when "cart", "address", "delivery"
       redirect_to checkout_step_path(:details)
@@ -105,7 +132,17 @@ class SplitCheckoutController < ::BaseController
     when "confirmation"
       redirect_to checkout_step_path(:summary)
     else
-      redirect_to order_path(@order)
+      redirect_to order_path(@order, order_token: @order.token)
     end
   end
+
+  def redirect_to_step
+    case params[:step]
+    when "details"
+      return redirect_to checkout_step_path(:payment)
+    when "payment"
+      return redirect_to checkout_step_path(:summary)
+    end
+    redirect_to_step_based_on_order
+  end
 end