updating part2, far from finished

app/controllers/suppliers/lists_controller.rb

@@ -73,7 +73,7 @@ module Suppliers
     # POST /lists
     # POST /lists.json
     def create
-      @list = List.new(params[:list])
+      @list = List.new(list_params)
       @list.supplier = current_supplier
 
       respond_to do |format|
@@ -102,7 +102,7 @@ module Suppliers
       @list = List.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @list.update_attributes(params[:list])
+        if @list.update_attributes(list_params)
           format.html { redirect_to [:suppliers, @list], notice: t('action.update.successfull', model: List.model_name.human) }
           format.json { head :no_content }
           format.js { head :no_content }
@@ -126,5 +126,11 @@ module Suppliers
         format.json { head :no_content }
       end
     end
+
+    private
+
+    def list_params
+      params.require(:list).permit(:state, :needs_help, :needs_payment, :closed_at, :join_requests, :price, :is_paid, :paid_at, :table_id, :section_id)
+    end
   end
 end

app/controllers/suppliers/product_categories_controller.rb

@@ -42,7 +42,7 @@ module Suppliers
     # POST /product_categories
     # POST /product_categories.json
     def create
-      @product_category = ProductCategory.new(params[:product_category])
+      @product_category = ProductCategory.new(product_category_params)
       @product_category.supplier = current_supplier
 
       respond_to do |format|
@@ -62,7 +62,7 @@ module Suppliers
       @product_category = ProductCategory.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @product_category.update_attributes(params[:product_category])
+        if @product_category.update_attributes(product_category_params)
           format.html { redirect_to [:suppliers, :product_categories], notice: t('action.update.successfull', model: ProductCategory.model_name.human) }
           format.json { head :no_content }
         else
@@ -92,5 +92,11 @@ module Suppliers
       CouchPotato.database.couchrest_database.bulk_save(@product_categories)
       render nothing: true
     end
+
+    private
+
+    def product_category_params
+      params.require(:product_category).permit(:name, :start_from, :end_on, :full_day, product_ids: [], week_days: [])
+    end
   end
 end

app/controllers/suppliers/products_controller.rb

@@ -43,12 +43,12 @@ module Suppliers
     # POST /products
     # POST /products.json
     def create
-      @product = Product.new(params[:product])
+      @product = Product.new(product_params)
       @product.supplier = current_supplier
 
       respond_to do |format|
         if @product.save
-          format.html { redirect_to [:suppliers, @product], notice: t('action.create.successfull', model: Product.model_name.human) }
+          format.html { redirect_to [:suppliers, :products], notice: t('action.create.successfull', model: Product.model_name.human) }
           format.json { render json: @product, status: :created, location: @product }
         else
           format.html { render action: "new" }
@@ -63,8 +63,8 @@ module Suppliers
       @product = Product.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @product.update_attributes(params[:product])
-          format.html { redirect_to [:suppliers, @product], notice: t('action.update.successfull', model: Product.model_name.human) }
+        if @product.update_attributes(product_params)
+          format.html { redirect_to [:suppliers, :products], notice: t('action.update.successfull', model: Product.model_name.human) }
           format.json { head :no_content }
         else
           format.html { render action: "edit" }
@@ -90,5 +90,11 @@ module Suppliers
       product_categories = ProductCategory.for_supplier_in_time(current_supplier, @time)
       render json: {categories: product_categories.map(&:to_client_format).select(&:present?)}
     end
+
+    private
+
+    def product_params
+      params.require(:product).permit(:name, :code, :price, product_category_ids: [])
+    end
   end
 end

app/controllers/suppliers/sections_controller.rb

@@ -54,7 +54,7 @@ module Suppliers
     # POST /sections
     # POST /sections.json
     def create
-      @section = Section.new(params[:section])
+      @section = Section.new(section_params)
       @section.supplier = current_supplier
 
       respond_to do |format|
@@ -74,7 +74,7 @@ module Suppliers
       @section = Section.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @section.update_attributes(params[:section])
+        if @section.update_attributes(section_params)
           format.html { redirect_to [:suppliers, @section], notice: t('action.update.successfull', model: Section.model_name.human) }
           format.json { head :no_content }
         else
@@ -157,5 +157,11 @@ module Suppliers
       @orders = @list ? @list.active_orders : []
       render layout: false
     end
+
+    private
+
+    def section_params
+      params.require(:section).permit(:title, :path, :width, :height)
+    end
   end
 end

app/controllers/suppliers/tables_controller.rb

@@ -43,7 +43,7 @@ module Suppliers
     # POST /tables
     # POST /tables.json
     def create
-      @table = Table.new(params[:table])
+      @table = Table.new(table_params)
       @table.supplier = current_supplier
 
       respond_to do |format|
@@ -63,8 +63,8 @@ module Suppliers
       @table= Table.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
 
       respond_to do |format|
-        if @table.update_attributes(params[:table])
-          format.html { redirect_to [:suppliers, @table], notice: t('action.update.successfull', model: Table.model_name.human) }
+        if @table.update_attributes(table_params)
+          format.html { redirect_to [:suppliers, @table.section || @table], notice: t('action.update.successfull', model: Table.model_name.human) }
           format.json { head :no_content }
           format.js { head :no_content }
         else
@@ -92,5 +92,11 @@ module Suppliers
       @tables.select!{|t| t.section_id == params[:section_id]} if params[:section_id].present?
       render layout: 'qr_sheet'
     end
+
+    private
+
+    def table_params
+      params.require(:table).permit(:number, :section_id, :position_x, :position_y)
+    end
   end
 end

app/models/product.rb

@@ -21,15 +21,25 @@ class Product
 
   def product_category_ids=(ids)
     @product_category_ids = ids.select(&:present?)
+    is_dirty
   end
 
 private
+
   def persist_product_category_ids
-    return unless @product_category_ids.present?
-    database.load(@product_category_ids).each do |product_category|
-      product_category.product_ids ||= []
-      product_category.product_ids |= [id]
-      product_category.save
+    @product_category_ids ||= []
+    existing_product_categories = product_categories
+
+    # do nothing if nothing has changed
+    return if @product_category_ids == existing_product_categories.map(&:id)
+
+    # clear removed product categories
+    existing_product_categories.reject{|pc| @product_category_ids.include?(pc.id) }.each{|pc| pc.remove_product(self) }
+
+
+    # Add product to newly added product categories
+    database.load(@product_category_ids - existing_product_categories.map(&:id)).each do |product_category|
+      product_category.add_product(self)
     end
   end
 

app/models/section.rb

@@ -130,6 +130,7 @@ class Section
     end
     return saves.all?
   end
+
   def arrange_tables_in_columns_of(n)
     return unless n.present?
     n = n.to_i

app/views/suppliers/products/_form.html.slim

@@ -13,6 +13,6 @@
         br
 
   .form-actions
-    = f.button :submit, class: 'btn-primary'
+    = f.button :submit, class: 'btn-primary save-product-button'
     '
     = link_to t("helpers.links.cancel"), suppliers_products_path, class: 'btn'

app/views/suppliers/products/index.html.slim

@@ -14,14 +14,14 @@
             th.actions data-t="helpers.actions.title" =t 'helpers.actions.title'
         tbody
           - @products.each do |product|
-            tr
+            tr class="product-row-#{product.id}"
               td.link= link_to product.name, [:suppliers, product]
               td= product.code
               td.currency=currency product.price
               td.link= product.category_links namespace: :suppliers 
               td.timestamp data-time=product.created_at.utc.iso8601
               td.actions
-                = link_to t('helpers.links.edit'), [:edit, :suppliers, product], class: 'btn btn-mini'
+                = link_to t('helpers.links.edit'), [:edit, :suppliers, product], class: 'btn btn-mini edit-resource-button'
                 '
                 = link_to t("helpers.links.destroy"), [:suppliers, product], method: :delete, data: {confirm: are_you_sure? }, class: 'btn btn-mini btn-danger'
     - else

app/views/suppliers/tables/_form.html.slim

@@ -9,6 +9,6 @@
     .controls
       = f.collection_select :section_id, current_supplier.sections, :id, :title, include_blank: "[#{t('supplier.tables.has_no_section')}]"
   .form-actions
-    = f.submit nil, class: 'btn btn-primary'
+    = f.submit nil, class: 'btn btn-primary save-table-button'
     '
     = link_to t("helpers.links.cancel"), suppliers_tables_path, class: 'btn'