replace skeleton files by previous version; apply obvious fixes

app/controllers/application_controller.rb

@@ -1,2 +1,32 @@
+# Filters added to this controller apply to all controllers in the application.
+# Likewise, all the methods added will be available for all controllers.
+
 class ApplicationController < ActionController::Base
+
+  protect_from_forgery
+
+  before_action :login_required!
+
+  helper_method :current_user
+
+  private
+
+  def current_user
+    @current_user ||= User.find(session[:user_id]) if session[:user_id]
+  end
+
+  def login_required!
+    if current_user.nil?
+      flash[:error] = "Login required"
+      redirect_to log_in_url
+    end
+  end
+
+  def authenticate_supplier_admin!
+    @supplier = Supplier.find((params[:supplier_id] || params[:id]))
+    unless current_user.has_access_to?(@supplier)
+      flash[:error] = "Not authorized!"
+      redirect_to root_url
+    end
+  end
 end

app/controllers/articles_controller.rb

@@ -0,0 +1,147 @@
+# encoding: utf-8
+
+class ArticlesController < ApplicationController
+
+  before_action :authenticate_supplier_admin!
+
+  # GET /supplier/:id/articles
+  # GET /supplier/:id/articles.xml
+  def index
+    if params[:filter]
+      @filter = params[:filter]
+      @articles = @supplier.articles
+      @articles = @articles.where('name LIKE ?', "%#{@filter}%") unless @filter.nil?
+      @articles = @articles.page(params[:page])
+    elsif params[:order]
+      case params[:order]
+      when 'updated_on'
+        @articles = @supplier.articles.paginate :all, :order => "updated_on DESC", :page => params[:page]
+        @updated_on = true
+      end
+    else
+      @articles = @supplier.articles.paginate :page => params[:page]
+    end
+
+    respond_to do |format|
+      format.html # index.haml
+      format.xml  { render :xml => @articles.to_xml }
+    end
+  end
+
+  # GET /supplier/1/articles/1
+  # GET /supplier/1/articles/1.xml
+  def show
+    @article = @supplier.articles.find(params[:id])
+
+    respond_to do |format|
+      format.html # show.haml
+      format.xml  { render :xml => @article.to_xml }
+    end
+  end
+
+  # GET /supplier/1/articles/new
+  def new
+    @article = @supplier.articles.build
+  end
+
+  # GET /supplier/1/articles/1/edit
+  def edit
+    @article = @supplier.articles.find(params[:id])
+  end
+
+  # POST /supplier/1/articles
+  # POST /supplier/1/articles.xml
+  def create
+    @article = Article.new(params[:article])
+    respond_to do |format|
+      if @article.save
+        flash[:notice] = 'Article was successfully created.'
+        format.html { redirect_to supplier_article_url(@article.supplier, @article) }
+        format.xml  { head :created, :location => supplier_article_url(@article.supplier, @article) }
+      else
+        format.html { render :action => "new" }
+        format.xml  { render :xml => @article.errors.to_xml }
+      end
+    end
+  end
+
+  # PUT /supplier/1/articles/1
+  # PUT /supplier/1/articles/1.xml
+  def update
+    @article = @supplier.articles.find(params[:id])
+    respond_to do |format|
+      if @article.update_attributes(params[:article])
+        flash[:notice] = 'Article was successfully updated.'
+        format.html { redirect_to supplier_article_url(@article.supplier, @article) }
+        format.xml  { head :ok }
+      else
+        format.html { render :action => "edit" }
+        format.xml  { render :xml => @article.errors.to_xml }
+      end
+    end
+  end
+
+  # DELETE /supplier/1/articles/1
+  # DELETE /supplier/1/articles/1.xml
+  def destroy
+    @article = @supplier.articles.find(params[:id])
+    @article.destroy
+
+    respond_to do |format|
+      format.html { redirect_to supplier_articles_url(@supplier) }
+      format.xml  { head :ok }
+    end
+  end
+
+  # Renders the upload form
+  def upload
+  end
+
+  # parse the file to load articles
+  # checks if the article should be updated, create or destroyed
+  def parse
+    if params[:articles].blank?
+      flash[:error] = "Please select a file to import"
+      redirect_to upload_supplier_articles_url(@supplier)
+      return
+    end
+    if params[:type].blank?
+      flash[:error] = "Please select a file-format"
+      redirect_to upload_supplier_articles_url(@supplier)
+      return
+    end
+
+    file = params[:articles]["file"].tempfile
+    filename = params[:articles]["file"].original_filename
+    type = params[:type].presence
+    encoding = params[:encoding].presence
+
+    begin
+      Article.transaction do
+        Article.delete_all :supplier_id => @supplier.id unless params[:delete_existing].blank?
+
+        @outlisted_counter, @new_counter, @updated_counter, @invalid_articles =
+            @supplier.update_articles_from_file(file, type: type, encoding: encoding, filename: filename)
+
+        if @invalid_articles.empty?
+          flash[:notice] = "Hochladen erfolgreich: #{@new_counter} neue, #{@updated_counter} aktualisiert und #{@outlisted_counter} ausgelistet."
+          redirect_to supplier_articles_url(@supplier)
+        else
+          flash[:error] = "#{@invalid_articles.size} Artikel konnte(n) nicht gespeichert werden"
+          render :template => 'articles/parse_errors'
+        end
+      end
+    rescue => error
+      flash[:error] = "Fehler beim hochladen der Artikel: #{error.message}"
+      redirect_to upload_supplier_articles_url(@supplier)
+    end
+  end
+
+  # deletes all articles of a supplier
+  def destroy_all
+    Article.where(supplier_id: @supplier.id).delete_all
+    flash[:notice] = "Alle Artikel wurden gelöscht"
+    redirect_to supplier_articles_url(@supplier)
+  end
+
+end

app/controllers/sessions_controller.rb

@@ -0,0 +1,24 @@
+class SessionsController < ApplicationController
+
+  skip_before_action :login_required!
+
+  def new
+  end
+
+  def create
+    user = User.authenticate(params[:email], params[:password])
+    if user
+      session[:user_id] = user.id
+      flash[:notice] = "Logged in!"
+      redirect_to root_url
+    else
+      flash.now[:error] = "Invalid email or password"
+      render "new"
+    end
+  end
+
+  def destroy
+    session[:user_id] = nil
+    redirect_to root_url, :notice => "Logged out!"
+  end
+end

app/controllers/suppliers_controller.rb

@@ -0,0 +1,89 @@
+class SuppliersController < ApplicationController
+
+  before_action :authenticate_supplier_admin!, :except => [:index, :new, :create]
+
+  # GET /suppliers
+  # GET /suppliers.xml
+  def index
+    @suppliers = Supplier.all
+
+    respond_to do |format|
+      format.html # index.rhtml
+      format.xml  { render :xml => @suppliers.to_xml }
+    end
+  end
+
+  # GET /suppliers/1
+  # GET /suppliers/1.xml
+  def show
+    @supplier = Supplier.find(params[:id])
+
+    respond_to do |format|
+      format.html # show.rhtml
+      format.xml  { render :xml => @supplier.to_xml }
+    end
+  end
+
+  # GET /suppliers/new
+  def new
+    @supplier = Supplier.new
+  end
+
+  # GET /suppliers/1;edit
+  def edit
+    @supplier = Supplier.find(params[:id])
+  end
+
+  # POST /suppliers
+  # POST /suppliers.xml
+  def create
+    @supplier = Supplier.new(params[:supplier])
+
+    respond_to do |format|
+      if @supplier.save
+        flash[:notice] = 'Supplier was successfully created.'
+        format.html { redirect_to supplier_url(@supplier) }
+        format.xml  { head :created, :location => supplier_url(@supplier) }
+      else
+        format.html { render :action => "new" }
+        format.xml  { render :xml => @supplier.errors.to_xml }
+      end
+    end
+  end
+
+  # PUT /suppliers/1
+  # PUT /suppliers/1.xml
+  def update
+    @supplier = Supplier.find(params[:id])
+    attrs = params[:supplier]
+
+    respond_to do |format|
+      # @todo fix by generating proper hidden input in html
+      attrs[:ftp_sync] ||= false
+      attrs[:mail_sync] ||= false
+      # don't set password to blank on saving
+      attrs = attrs.reject {|k,v| k == 'ftp_password' } if attrs[:ftp_password].blank?
+
+      if @supplier.update_attributes(attrs)
+        flash[:notice] = 'Supplier was successfully updated.'
+        format.html { redirect_to supplier_url(@supplier) }
+        format.xml  { head :ok }
+      else
+        format.html { render :action => "edit" }
+        format.xml  { render :xml => @supplier.errors.to_xml }
+      end
+    end
+  end
+
+  # DELETE /suppliers/1
+  # DELETE /suppliers/1.xml
+  def destroy
+    @supplier = Supplier.find(params[:id])
+    @supplier.destroy
+
+    respond_to do |format|
+      format.html { redirect_to suppliers_url }
+      format.xml  { head :ok }
+    end
+  end
+end