From 4bea58805a28fc38074556059ab3916d03e9820b Mon Sep 17 00:00:00 2001
From: Yan <yanaung.nyein@code2lab.com>
Date: Thu, 5 Apr 2018 17:18:02 +0630
Subject: [PATCH 1/5] merge edit for master

---
 config/secrets.yml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/config/secrets.yml b/config/secrets.yml
index eaac38a9..111e1843 100755
--- a/config/secrets.yml
+++ b/config/secrets.yml
@@ -12,13 +12,8 @@
 
 development:
   secret_key_base: b61d85f8ed2a1a9e0eeece3443b3e8f838d002cc1d9f32115d8e93db920e2957adfedc57501d44741211538f3108b742cdeada87d5bfae796c53da1f90a3cd61  
-<<<<<<< HEAD
   sx_provision_url: connect.smartsales.dev/api #connect.smartsales.dev/api #connect.smartsales.asia/api  #provision.zsai.ws/api   
   server_mode: cloud
-=======
-  sx_provision_url: connect.smartsales.asia/api #connect.smartsales.dev/api #connect.smartsales.asia/api  #provision.zsai.ws/api   
-  server_mode: application
->>>>>>> fe01948dd322688f7d59acd0d002b569dbbd40e2
   cipher_type: AES-256-CBC
   sx_key: Wh@t1$C2L
 

From 37694fd47de1544e0b97949a0b04614595eea7a2 Mon Sep 17 00:00:00 2001
From: Aung Myo <aungmyo.zaw@code2lab.com>
Date: Sat, 7 Apr 2018 12:43:29 +0630
Subject: [PATCH 2/5] =?UTF-8?q?-=E1=80=93=20=03?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/views/origami/dashboard/index.html.erb | 2 --
 1 file changed, 2 deletions(-)

diff --git a/app/views/origami/dashboard/index.html.erb b/app/views/origami/dashboard/index.html.erb
index 228da935..d7722e16 100644
--- a/app/views/origami/dashboard/index.html.erb
+++ b/app/views/origami/dashboard/index.html.erb
@@ -192,8 +192,6 @@
  <button type="button" data-href="<%=origami_second_display_index_path%>" target="_blank" id="second_view" class="btn action-btn bg-blue waves-effect second_view hidden" style="height: 45px">Customer View</button>
 <script>
 
-
-
   $(".cashier_view").on('click', function() {
     window.location.href = '/origami';
   });

From 7b28d56738bf2a7d9a1fe5e6d0f553b2df862e77 Mon Sep 17 00:00:00 2001
From: Aung Myo <aungmyo.zaw@code2lab.com>
Date: Sat, 7 Apr 2018 14:23:11 +0630
Subject: [PATCH 3/5] update addorder js after git issuse fixed

---
 app/assets/javascripts/addorder.js | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/app/assets/javascripts/addorder.js b/app/assets/javascripts/addorder.js
index e49f7446..30ed8af2 100755
--- a/app/assets/javascripts/addorder.js
+++ b/app/assets/javascripts/addorder.js
@@ -266,11 +266,22 @@ $(function() {
       $('.set_order').attr('data-min-qty',item_sets[field]["min_selectable_qty"]);
 
       value = item_sets[field]["instances"];
-
       $(value).each(function(i){
+        if (type != -1 && modify_order != -1) {
+          url = '../../../../api/restaurant/menu_item_instances/'+value[i]["id"];
+          console.log("ssssssss")
+        }
+        if(modify_order == -1 && type != -1){
+          url = '../../api/restaurant/menu_item_instances/'+value[i]["id"] ;  
+          console.log("aaaaaa")       
+        }
+        if (type ==-1 && modify_order == -1){
+          url   = '../../api/restaurant/menu_item_instances/'+value[i]["id"];
+          console.log("cccccccccc")
+        }
         $.ajax({
           type: "GET",
-            url: '../../api/restaurant/menu_item_instances/'+value[i]["id"],
+            url: url,
             data: {id:value[i]},
             success:function(result){
 
@@ -370,7 +381,7 @@ $(function() {
         //   $(this).removeAttr('data-options');
         //   $('#instance_option').text('')
         // }else {
-          if (rowCount.length+1 <= max_qty) {
+          if (setCount.length+1 <= max_qty) {
             sub_total       = $('#set_total_price').text();
             name            = $(this).data('name');
             price           = $(this).data('price');
@@ -1317,9 +1328,18 @@ console.log(d_option)
  }
 
  function customer_display_view(data,status) {
+  if (type != -1 && modify_order != -1) {
+    url = '../../../../origami/customer_view';
+  }
+  if(modify_order == -1 && type != -1){
+    url = '../../origami/customer_view';           
+  }
+  if (type ==-1 && modify_order == -1){
+    url = '../../origami/customer_view';
+  }
    $.ajax({
           type: "POST",
-          url: '../../origami/customer_view',
+          url: url,
           data: {"data":data,"status":status},
           dataType: "json",
            success:function(result){         

From 14b33a6f8d73bc201d47db22ce1b8b372a2957c4 Mon Sep 17 00:00:00 2001
From: Aung Myo <aungmyo.zaw@code2lab.com>
Date: Sat, 7 Apr 2018 15:53:24 +0630
Subject: [PATCH 4/5] add kitchen role for oqs

---
 README.md                               |  3 +
 app/controllers/home_controller.rb      |  3 +
 app/controllers/oqs/edit_controller.rb  |  1 +
 app/controllers/oqs/home_controller.rb  |  4 +-
 app/controllers/oqs/print_controller.rb |  1 +
 app/models/ability.rb                   | 83 +++++++++++++++++++++++++
 6 files changed, 92 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 18eaed7b..6aab5a8a 100755
--- a/README.md
+++ b/README.md
@@ -164,6 +164,9 @@ For CloseCashierCustomisePdf in lookups
 3) settings/lookups => { type:tax_profiles, name: Doemal, value: doemal }
 /* Tax Profile Group Types in lookups */
 
+Add Kitchen Role of  Employee 
+   => 1) settings/lookups => { type:employee_roles, name: Kitchen, value:kitchen }
+
 * ToDo list
 
 1. Migration
diff --git a/app/controllers/home_controller.rb b/app/controllers/home_controller.rb
index d2b0ad36..e720444f 100755
--- a/app/controllers/home_controller.rb
+++ b/app/controllers/home_controller.rb
@@ -70,6 +70,9 @@ class HomeController < ApplicationController
       elsif @employee.role == "account"
         session[:session_token] = @employee.token_session
         redirect_to reports_dailysale_index_path
+      elsif @employee.role == "kitchen"
+        session[:session_token] = @employee.token_session
+        redirect_to oqs_root_path
       else
          render :index
       end
diff --git a/app/controllers/oqs/edit_controller.rb b/app/controllers/oqs/edit_controller.rb
index ccef4e4a..3da6c31e 100644
--- a/app/controllers/oqs/edit_controller.rb
+++ b/app/controllers/oqs/edit_controller.rb
@@ -1,4 +1,5 @@
 class Oqs::EditController < BaseOqsController
+  authorize_resource :class => false
   def index
   	assigned_item_id = params[:id]
     @link_type = params[:type]
diff --git a/app/controllers/oqs/home_controller.rb b/app/controllers/oqs/home_controller.rb
index 19d4c17f..23d6341e 100755
--- a/app/controllers/oqs/home_controller.rb
+++ b/app/controllers/oqs/home_controller.rb
@@ -1,8 +1,6 @@
 class Oqs::HomeController < BaseOqsController
+  authorize_resource :class => false
   def index
-
-  	
-
     # Query for OQS with delivery status false
   	# @queue_items_details = queue_items_query(false)
 
diff --git a/app/controllers/oqs/print_controller.rb b/app/controllers/oqs/print_controller.rb
index baa4af40..d4218666 100755
--- a/app/controllers/oqs/print_controller.rb
+++ b/app/controllers/oqs/print_controller.rb
@@ -1,4 +1,5 @@
 class Oqs::PrintController < ApplicationController
+  authorize_resource :class => false
   # Print Order Item
   def print
     if ENV["SERVER_MODE"] != "cloud" #no print in cloud server
diff --git a/app/models/ability.rb b/app/models/ability.rb
index 0b1edcc3..801b501b 100755
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -98,6 +98,22 @@ class Ability
         can :create, :split_bill
         can :update_sale, :split_bill
 
+        #oqs Home
+        can :index, :home
+        can :index, :show
+        can :get_order_items, :home
+        can :get_items_by_oqs, :home
+        can :update_delivery_status, :home
+        can :queue_items_query, :home
+        can :completed_order, :home
+        can :queue_items_count_query, :home
+
+        can :index, :edit
+        can :update, :edit
+
+        can :print, :print
+        can :print_order_summary, :print
+
     elsif user.role == "cashier"
         
         # can :overall_void, :void
@@ -144,6 +160,22 @@ class Ability
         can :index, :split_bill
         can :create, :split_bill
         can :update_sale, :split_bill
+
+        #oqs Home
+        can :index, :home
+        can :index, :show
+        can :get_order_items, :home
+        can :get_items_by_oqs, :home
+        can :update_delivery_status, :home
+        can :queue_items_query, :home
+        can :completed_order, :home
+        can :queue_items_count_query, :home
+
+        can :index, :edit
+        can :update, :edit
+
+        can :print, :print
+        can :print_order_summary, :print
                                                
     elsif user.role == "account"
 
@@ -201,6 +233,23 @@ class Ability
         can :index, :split_bill
         can :create, :split_bill
         can :update_sale, :split_bill
+
+        #oqs Home
+        can :index, :home
+        can :index, :show
+        can :get_order_items, :home
+        can :get_items_by_oqs, :home
+        can :update_delivery_status, :home
+        can :queue_items_query, :home
+        can :completed_order, :home
+        can :queue_items_count_query, :home
+
+        can :index, :edit
+        can :update, :edit
+
+        can :print, :print
+        can :print_order_summary, :print
+
      elsif user.role == "waiter"
         can :index, :home
         can :show, :home  
@@ -227,6 +276,40 @@ class Ability
         #ability for split_bill
         can :index, :split_bill
         can :create, :split_bill
+
+        #oqs Home
+        can :index, :home
+        can :index, :show
+        can :get_order_items, :home
+        can :get_items_by_oqs, :home
+        can :update_delivery_status, :home
+        can :queue_items_query, :home
+        can :completed_order, :home
+        can :queue_items_count_query, :home
+
+        can :index, :edit
+        can :update, :edit
+
+        can :print, :print
+        can :print_order_summary, :print
+
+    elsif user.role == "kitchen"
+    
+    #oqs Home
+        can :index, :home
+        can :index, :show
+        can :get_order_items, :home
+        can :get_items_by_oqs, :home
+        can :update_delivery_status, :home
+        can :queue_items_query, :home
+        can :completed_order, :home
+        can :queue_items_count_query, :home
+
+        can :index, :edit
+        can :update, :edit
+
+        can :print, :print
+        can :print_order_summary, :print
     end
   end
 end

From cb3f9c4cd73da6f900444e69f83d89d650c1a442 Mon Sep 17 00:00:00 2001
From: Yan <yanaung.nyein@code2lab.com>
Date: Mon, 9 Apr 2018 09:58:22 +0630
Subject: [PATCH 5/5] remove skip auth from api and check user modified

---
 .../api/restaurant/item_sets_controller.rb     |  1 -
 .../restaurant/menu_categories_controller.rb   |  3 +--
 .../api/restaurant/menu_controller.rb          |  1 -
 .../menu_item_attributes_controller.rb         |  3 +--
 .../menu_item_instances_controller.rb          |  3 +--
 app/controllers/base_origami_controller.rb     | 18 +++++++++++++-----
 app/controllers/concerns/token_verification.rb |  2 +-
 7 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/app/controllers/api/restaurant/item_sets_controller.rb b/app/controllers/api/restaurant/item_sets_controller.rb
index a7ad9efc..99581550 100755
--- a/app/controllers/api/restaurant/item_sets_controller.rb
+++ b/app/controllers/api/restaurant/item_sets_controller.rb
@@ -1,5 +1,4 @@
 class Api::Restaurant::ItemSetsController < Api::ApiController
-
   #Description
   # Pull the default menu details and also other available (active) menus
   # Input Params - order_id
diff --git a/app/controllers/api/restaurant/menu_categories_controller.rb b/app/controllers/api/restaurant/menu_categories_controller.rb
index f1f3e6d0..644a38a8 100755
--- a/app/controllers/api/restaurant/menu_categories_controller.rb
+++ b/app/controllers/api/restaurant/menu_categories_controller.rb
@@ -1,5 +1,4 @@
-class Api::Restaurant::MenuCategoriesController < Api::ApiController
- skip_before_action  :authenticate
+class Api::Restaurant::MenuCategoriesController < Api::ApiController 
   #Description
   # Pull the default menu details and also other available (active) menus
   # Input Params - order_id
diff --git a/app/controllers/api/restaurant/menu_controller.rb b/app/controllers/api/restaurant/menu_controller.rb
index ad8ad7f9..96ba3cc0 100755
--- a/app/controllers/api/restaurant/menu_controller.rb
+++ b/app/controllers/api/restaurant/menu_controller.rb
@@ -1,5 +1,4 @@
 class Api::Restaurant::MenuController < Api::ApiController
-  skip_before_action  :authenticate
   #Description
   # Pull the default menu details and also other available (active) menus
   # Input Params - order_id
diff --git a/app/controllers/api/restaurant/menu_item_attributes_controller.rb b/app/controllers/api/restaurant/menu_item_attributes_controller.rb
index 37719c37..d0469924 100755
--- a/app/controllers/api/restaurant/menu_item_attributes_controller.rb
+++ b/app/controllers/api/restaurant/menu_item_attributes_controller.rb
@@ -1,5 +1,4 @@
-class Api::Restaurant::MenuItemAttributesController < Api::ApiController
-	skip_before_action  :authenticate
+class Api::Restaurant::MenuItemAttributesController < Api::ApiController	
   #Description
   # Pull the default menu details and also other available (active) menus
   # Input Params - order_id
diff --git a/app/controllers/api/restaurant/menu_item_instances_controller.rb b/app/controllers/api/restaurant/menu_item_instances_controller.rb
index be38f782..cfe75b19 100755
--- a/app/controllers/api/restaurant/menu_item_instances_controller.rb
+++ b/app/controllers/api/restaurant/menu_item_instances_controller.rb
@@ -1,5 +1,4 @@
-class Api::Restaurant::MenuItemInstancesController < Api::ApiController
-  skip_before_action  :authenticate
+class Api::Restaurant::MenuItemInstancesController < Api::ApiController  
   #Description
   # Pull the default menu details and also other available (active) menus
   # Input Params - order_id
diff --git a/app/controllers/base_origami_controller.rb b/app/controllers/base_origami_controller.rb
index b627ae01..66cc2880 100755
--- a/app/controllers/base_origami_controller.rb
+++ b/app/controllers/base_origami_controller.rb
@@ -15,9 +15,17 @@ class BaseOrigamiController < ActionController::Base
     redirect_to origami_dashboard_path
   end
 
-  def check_user
-    if current_user.nil?
-      redirect_to root_path
+  def check_user   
+    if check_mobile     
+      if current_user.nil?
+        return render status: 401, json: {
+          message: "User using other device!"          
+        }.to_json
+      end
+    else 
+      if current_user.nil?
+        redirect_to root_path    
+      end
     end
   end
 
@@ -41,8 +49,8 @@ class BaseOrigamiController < ActionController::Base
     authenticate_with_http_token do |token, options|   
       if token
         session[:webview] = true
-      end
-      session[:session_token] = token
+        session[:session_token] = token
+      end            
     end
     
     if session[:webview] && request.user_agent =~ /android|blackberry|iphone|ipad|ipod|iemobile|mobile|webos/i
diff --git a/app/controllers/concerns/token_verification.rb b/app/controllers/concerns/token_verification.rb
index 66658b6a..1d700c8b 100755
--- a/app/controllers/concerns/token_verification.rb
+++ b/app/controllers/concerns/token_verification.rb
@@ -9,7 +9,7 @@ module TokenVerification
 
   protected
   # Authenticate the user with token based authentication
-  def authenticate
+  def authenticate    
     authenticate_token || render_unauthorized
   end