many important fixes

app/controllers/users/application_controller.rb

@@ -6,10 +6,12 @@ module Users
     private
 
     def user_authentication
-      if params[:auth_token].present?
-        user = User.find_by_authentication_token(params[:auth_token])
-        sign_in user if user
-        sign_out current_user if current_user && !user # Other token attempt of logged in user
+      auth_token = params[:auth_token].presence || request.headers['HTTP_AUTH_TOKEN'].presence
+      if auth_token.present?
+        user = User.find_by_authentication_token(auth_token)
+
+        #sign_out current_user if current_user && !user # Other token attempt of logged in user
+        bypass_sign_in user if user
       elsif request.format.html?
         return if Rails.env.test? and action_name == 'index'
         authenticate_user!
@@ -39,6 +41,7 @@ module Users
       case params[:product_orders]
       when String then JSON.parse(params[:product_orders]) rescue []
       when Hash then params[:product_orders].values
+      when Array then params[:product_orders]
       else
         []
       end

app/controllers/users/lists_controller.rb

@@ -2,6 +2,7 @@ module Users
   class ListsController < Users::ApplicationController
 
     def index
+      return current if params[:currentList].present?
       #lists = current_user.lists.include_relation(:supplier, :table)
       lists = List.for_user(current_user, page: params[:page], per_page: params[:per_page].presence || 25)
       #lists.include_relation(:supplier)
@@ -25,6 +26,13 @@ module Users
       render json: @table
     end
 
+    def orders
+      @list = List.find(params[:id])
+      return render json: {ok: false, status: 403}, status: 403 unless @list.user_ids.include?(current_user.id)
+      @list.orders.include_relations(:product_orders)
+      render json: @list.orders, serializer: Users::OrderSerializer, is_collection: true, include: %w[product_orders]
+    end
+
     def show
       @list ||= List.find(params[:id]) if params[:id]
       render json: {}, status: :not_found and return unless @list.present? && Array.wrap(@list.user_ids).include?(current_user.id)