shopperlabs/shopper v3.0.0-rc.8 on GitHub

Important

This is the eighth release candidate of Shopper 3.0. It is a security release: it closes authorization gaps in admin components that relied on the permission of the button that opens them, and limits the dashboard sales widgets to users who can browse orders. Upgrade from any earlier 3.0 release candidate.

Installation

"minimum-stability": "RC",
"prefer-stable": true

composer require shopper/framework:^3.0.0-rc

Bug Fixes

fix(admin): authorize the category tree, record forms, variant writes and dashboard widgets (#694)

ReOrderCategories rendered the category tree without any check, so a guest who reached the slide-over got the whole tree back. It now requires categories.edit in mount(), and the reorder action of the category index checks the same permission.

BrandForm, CategoryForm, SupplierForm and AttributeForm accepted either create or edit when they opened, so a role allowed to create could open any existing record. They now require edit for an existing record and create for a new one.

GenerateVariants checks products.variants.delete before removing variants and products.variants.create before adding new ones, and SaveProductVariantsAction looks each variant up through its product, so an id from another product fails. Variant stock and price changes (Variant, Pricing, ManagePricing) require products.variants.edit instead of products.edit.

The customers selected on a discount are loaded through the customers scope, so a staff account id sent by the browser returns nothing. The SidebarComponent properties are locked, so the browser can no longer change the sidebar class or view.

system.dashboard grants access to the back office, not to sales data. The revenue chart, top selling products and recent orders widgets now require orders.browse, and each stat card shows only when the user can browse its resource (orders, products, customers).

Upgrading

composer update "shopper/*" -W

This release has no dependency change. -W still moves laravelcm/livewire-slide-overs to 2.1.1 if you upgrade from rc.6 or earlier.

A custom role now needs:

categories.edit to reorder categories.
<resource>.edit to open an existing brand, category, supplier or attribute, and <resource>.create to create one.
products.variants.edit to change a variant's stock or prices.
products.variants.create and products.variants.delete when generating variants adds or removes some.
orders.browse to see the revenue chart, top selling products, recent orders and the revenue and orders cards on the dashboard. The products and customers cards need products.browse and customers.browse.

The administrator role already has every permission.

@shopperlabs/shopper-types 3.0.0-rc.8 is published under the beta tag. The SDK has no change in this release and stays at 1.0.0-rc.3.

Contributors

@mckenziearts

Full Changelog: v3.0.0-rc.7...v3.0.0-rc.8