From 68f7d4dd54f277f48989338b606fd5f37789665e Mon Sep 17 00:00:00 2001
From: Benjamin ter Kuile <bterkuile@gmail.com>
Date: Sat, 7 Mar 2020 11:11:06 -0500
Subject: [PATCH] cleanup switch_to supplier and make facebook image https

---
 README.md                                           | 11 +++++++++++
 app/abilities/suppliers/ability.rb                  |  1 -
 app/controllers/suppliers/application_controller.rb |  7 ++++---
 app/controllers/suppliers/suppliers_controller.rb   |  8 --------
 app/models/user.rb                                  |  2 +-
 config/routes.rb                                    |  1 -
 6 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/README.md b/README.md
index c32ade6b..80e215bc 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,17 @@
 Mozo server backend README
 =====================================
 
+TODO:
+------------------
+### Supplier app
+* model validations
+* ~foundation css~
+* entry funnel handling
+
+### User app
+* Supplier close as event that can be handled by users
+
+
 Application architecture
 -----------------------------------------------
 
diff --git a/app/abilities/suppliers/ability.rb b/app/abilities/suppliers/ability.rb
index 37e71cf8..157c0b38 100644
--- a/app/abilities/suppliers/ability.rb
+++ b/app/abilities/suppliers/ability.rb
@@ -14,7 +14,6 @@ class Suppliers::Ability
       can :mark_in_process, Order
       can :mark_delivered, Order
       can :cancel, Order
-      can :switch_to, Supplier
     end
   end
 end
diff --git a/app/controllers/suppliers/application_controller.rb b/app/controllers/suppliers/application_controller.rb
index df1850e4..3d9e3961 100644
--- a/app/controllers/suppliers/application_controller.rb
+++ b/app/controllers/suppliers/application_controller.rb
@@ -17,7 +17,6 @@ module Suppliers
     end
 
     # GET
-    #NOTE: temporary solution for development, if I am in production something is wrong
     def employee_and_supplier
       # database optimization, preloading
       FlatKeys.as_nested_structure(Supplier::PRELOAD_INCLUDES).last.each do |relation_name, includes|
@@ -43,12 +42,14 @@ module Suppliers
 
     def find_current_supplier!
       return current_supplier if current_supplier.present?
-      if session[:supplier_id]
-        supplier = Supplier.find(session[:supplier_id])
+      supplier_id = request.headers['HTTP_SUPPLIER_ID'].presence || session[:supplier_id].presence
+      if supplier_id and supplier_id != 'null' and supplier_id != 'undefined' # crying face icon! but javascript nulls and ruby presence are not brothers
+        supplier = Supplier.find(supplier_id)
         if supplier.employee_ids.include?(current_employee.id)
           @current_supplier = supplier
         else
           session[:supplier_id] = nil
+          raise CanCan::AccessDenied unless current_employee.active?
         end
       else
         @current_supplier = current_employee.suppliers.first
diff --git a/app/controllers/suppliers/suppliers_controller.rb b/app/controllers/suppliers/suppliers_controller.rb
index a6815847..68f58108 100644
--- a/app/controllers/suppliers/suppliers_controller.rb
+++ b/app/controllers/suppliers/suppliers_controller.rb
@@ -29,14 +29,6 @@ module Suppliers
       render json: current_supplier
     end
 
-    def switch_to
-      @switch_supplier = Supplier.find(params[:id])
-      #TODO sessions currently not working, just tokens
-      session[:supplier_id] = @switch_supplier.id if @switch_supplier.employee_ids.include? current_employee.id
-      render json: {ok: true}
-      #redirect_to supplier_root_path(other: '/my-account')
-    end
-
     def mark_as_open
       current_supplier.mark_as_open!
       head :ok
diff --git a/app/models/user.rb b/app/models/user.rb
index 90b5f5db..d02caf1c 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -78,7 +78,7 @@ class User
   def avatar
     return '' unless provider.present?
     case provider.to_sym
-    when :facebook then "http://graph.facebook.com/#{uid}/picture?type=square"
+    when :facebook then "https://graph.facebook.com/#{uid}/picture?type=square"
     when :instagram then auth_data['info'].try(:[], 'image')
     end
   end
diff --git a/config/routes.rb b/config/routes.rb
index 69e69d1c..4c853f2c 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -130,7 +130,6 @@ Qwaiter::Application.routes.draw do
     get 'employee_and_supplier', controller: 'application'
     resources :suppliers do
       member do
-        post :switch_to
         post :mark_as_open
         post :mark_as_closed
       end