Contents

module Spree::Auth::Admin::OrdersControllerDecorator

  def self.prepended(base)
    base.before_action :check_authorization
  end

  private

  def load_order_action
    [:edit, :update, :cancel, :resume, :approve, :resend, :open_adjustments, :close_adjustments, :cart]
  end

  def check_authorization
    action = params[:action].to_sym
    if load_order_action.include?(action)
      load_order
      session[:access_token] ||= params[:token]
      resource = @order || Spree::Order.new
      authorize! action, resource, session[:access_token]
    else
      authorize! :index, Spree::Order
    end
  end
end
Spree::Admin::OrdersController.prepend(Spree::Auth::Admin::OrdersControllerDecorator)

Version data entries

5 entries across 5 versions & 1 rubygems

Version	Path
spree_auth_devise-4.6.3	lib/controllers/backend/spree/auth/admin/orders_controller_decorator.rb
spree_auth_devise-4.6.2	lib/controllers/backend/spree/auth/admin/orders_controller_decorator.rb
spree_auth_devise-4.6.1	lib/controllers/backend/spree/auth/admin/orders_controller_decorator.rb
spree_auth_devise-4.6.0	lib/controllers/backend/spree/auth/admin/orders_controller_decorator.rb
spree_auth_devise-4.5.0	lib/controllers/backend/spree/auth/admin/orders_controller_decorator.rb