openfoodnetwork/app/controllers/admin/schedules_controller.rb

require 'open_food_network/permissions'

module Admin
  class SchedulesController < ResourceController
    before_filter :check_editable_order_cycle_ids, only: [:create, :update]

    respond_to :json

    respond_override create: { json: {
      success: lambda { render_as_json @schedule, editable_schedule_ids: permissions.editable_schedules.pluck(:id) },
      failure: lambda { render json: { errors: @schedule.errors.full_messages }, status: :unprocessable_entity }
    } }
    respond_override update: { json: {
      success: lambda { render_as_json @schedule, editable_schedule_ids: permissions.editable_schedules.pluck(:id) },
      failure: lambda { render json: { errors: @schedule.errors.full_messages }, status: :unprocessable_entity }
    } }


    def index
      respond_to do |format|
        format.json do
          render_as_json @collection, ams_prefix: params[:ams_prefix], editable_schedule_ids: permissions.editable_schedules.pluck(:id)
        end
      end
    end

    private
    def collection
      return Schedule.where("1=0") unless json_request?
      permissions.visible_schedules
    end

    def collection_actions
      [:index]
    end

    def check_editable_order_cycle_ids
      return unless params[:schedule][:order_cycle_ids]
      requested = params[:schedule][:order_cycle_ids]
      existing = @schedule.persisted? ? @schedule.order_cycle_ids : []
      permitted = OrderCycle.where(id: params[:schedule][:order_cycle_ids] | existing).merge(OrderCycle.managed_by(spree_current_user)).pluck(:id)
      result = existing
      result |= (requested & permitted) # add any requested & permitted ids
      result -= ((result & permitted) - requested) # remove any existing and permitted ids that were not specifically requested
      params[:schedule][:order_cycle_ids] = result
      @object.order_cycle_ids = result
    end

    def permissions
      return @permissions unless @permission.nil?
      @permissions = OpenFoodNetwork::Permissions.new(spree_current_user)
    end
  end
end