reactioncommerce · aaronjudd · May 17, 2017 · Mar 1, 2017 · Mar 1, 2017 · Mar 2, 2017
diff --git a/.bithoundrc b/.bithoundrc
@@ -59,7 +59,14 @@
     "mute": [
       "wdio-mocha-framework",
       "griddle-react",
-      "nodemailer"
+      "nodemailer",
+      "twilio",
+      "react-addons-create-fragment",
+      "react-addons-pure-render-mixin",
+      "react-addons-test-utils",
+      "react-dom",
+      "react",
+      "transliteration"
     ],
     "unused-ignores": [
       "jquery",

diff --git a/.meteor/packages b/.meteor/packages
@@ -11,14 +11,14 @@ meteor-base@1.0.4             # Packages every Meteor app needs to have
 mobile-experience@1.0.4       # Packages for a great mobile UX
 blaze-html-templates@1.0.4    # Compile .html files into Meteor Blaze views
 es5-shim@4.6.15               # ECMAScript 5 compatibility for older browsers.
-ecmascript@0.7.2              # Enable ECMAScript2015+ syntax in app code
+ecmascript@0.7.3              # Enable ECMAScript2015+ syntax in app code
 audit-argument-checks@1.0.7   # ensure meteor method argument validation
 browser-policy@1.1.0          # security-related policies enforced by newer browsers
 juliancwirko:postcss          # CSS post-processing plugin (replaces standard-minifier-css)
 abernix:standard-minifier-js  # a minifier plugin used for Meteor apps by default
 session@1.1.7                 # ReactiveDict whose contents are preserved across Hot Code Push
-tracker@1.1.2                 # Meteor transparent reactive programming library
-mongo@1.1.16
+tracker@1.1.3                 # Meteor transparent reactive programming library
+mongo@1.1.17
 random@1.0.10
 reactive-var@1.0.11
 reactive-dict@1.1.8
@@ -36,8 +36,8 @@ mdg:validated-method
 shell-server@0.2.3
 
 # Meteor Auth Packages
-accounts-base@1.2.16
-accounts-password@1.3.5
+accounts-base@1.2.17
+accounts-password@1.3.6
 accounts-facebook@1.1.1
 accounts-google@1.1.2
 accounts-twitter@1.2.1
@@ -63,9 +63,7 @@ jeremy:stripe
 jparker:gravatar
 juliancwirko:s-alert
 juliancwirko:s-alert-stackslide
-kadira:blaze-layout
 kadira:dochead
-kadira:flow-router-ssr
 matb33:collection-hooks
 meteorhacks:ssr
 meteorhacks:subs-manager
@@ -74,7 +72,7 @@ ongoworks:security
 raix:ui-dropped-event
 risul:moment-timezone
 tmeasday:publish-counts
-vsivsi:job-collection
+vsivsi:job-collection@1.4.0
 react-meteor-data
 percolate:migrations
 gadicc:blaze-react-component

diff --git a/.meteor/release b/.meteor/release
@@ -1 +1 @@
-METEOR@1.4.4.1
+METEOR@1.4.4.2
diff --git a/.meteor/versions b/.meteor/versions
@@ -1,14 +1,14 @@
 abernix:minifier-js@1.3.19
 abernix:standard-minifier-js@1.3.19
-accounts-base@1.2.16
+accounts-base@1.2.17
 accounts-facebook@1.1.1
 accounts-google@1.1.2
 accounts-oauth@1.1.15
-accounts-password@1.3.5
+accounts-password@1.3.6
 accounts-twitter@1.2.1
 alanning:roles@1.2.16
 aldeed:autoform@5.8.1
-aldeed:browser-tests@0.1.0
+aldeed:browser-tests@0.1.1
 aldeed:collection2@2.10.0
 aldeed:collection2-core@1.2.0
 aldeed:schema-deny@1.1.0
@@ -55,8 +55,7 @@ cfs:ui@0.1.3
 cfs:upload-http@0.0.20
 cfs:worker@0.1.4
 check@1.2.5
-chuangbo:cookie@1.1.0
-coffeescript@1.11.1_4
+coffeescript@1.12.3_1
 dburles:factory@1.1.0
 ddp@1.2.5
 ddp-client@1.3.4
@@ -65,20 +64,20 @@ ddp-rate-limiter@1.0.7
 ddp-server@1.3.14
 deps@1.0.12
 diff-sequence@1.0.7
-dispatch:mocha@0.3.0
+dispatch:mocha@0.4.1
 dispatch:run-as-user@1.1.1
 ecmascript@0.7.3
 ecmascript-runtime@0.3.15
 ejson@1.0.13
-email@1.2.0
+email@1.2.1
 es5-shim@4.6.15
 facebook-config-ui@1.0.0
 facebook-oauth@1.3.0
 fastclick@1.0.13
 gadicc:blaze-react-component@1.4.0
 geojson-utils@1.0.10
 google-config-ui@1.0.0
-google-oauth@1.2.3
+google-oauth@1.2.4
 hot-code-push@1.0.4
 html-tools@1.0.11
 htmljs@1.0.11
@@ -93,9 +92,7 @@ jquery@1.11.10
 juliancwirko:postcss@1.2.0
 juliancwirko:s-alert@3.2.0
 juliancwirko:s-alert-stackslide@3.1.3
-kadira:blaze-layout@2.3.0
 kadira:dochead@1.5.0
-kadira:flow-router-ssr@3.13.0
 launch-screen@1.1.1
 less@2.7.9
 livedata@1.0.18
@@ -106,20 +103,16 @@ mdg:validated-method@1.1.0
 mdg:validation-error@0.5.1
 meteor@1.6.1
 meteor-base@1.0.4
-meteorhacks:fast-render@2.16.0
-meteorhacks:inject-data@2.0.0
-meteorhacks:meteorx@1.4.1
-meteorhacks:picker@1.0.3
 meteorhacks:ssr@2.2.0
 meteorhacks:subs-manager@1.6.4
 minifier-css@1.2.16
-minimongo@1.0.21
+minimongo@1.0.23
 mobile-experience@1.0.4
 mobile-status-bar@1.0.14
 modules@0.8.2
 modules-runtime@0.7.10
 momentjs:moment@2.17.1
-mongo@1.1.16
+mongo@1.1.17
 mongo-id@1.0.6
 mongo-livedata@1.0.12
 mrt:later@1.6.1
@@ -131,7 +124,7 @@ oauth-encryption@1.2.1
 oauth1@1.1.11
 oauth2@1.1.11
 observe-sequence@1.0.16
-ongoworks:security@2.0.1
+ongoworks:security@2.1.0
 ordered-dict@1.0.9
 percolate:migrations@0.9.8
 practicalmeteor:chai@2.1.0_1
@@ -162,7 +155,7 @@ templating-runtime@1.3.2
 templating-tools@1.1.2
 tmeasday:check-npm-versions@0.3.1
 tmeasday:publish-counts@0.8.0
-tracker@1.1.2
+tracker@1.1.3
 twitter-config-ui@1.0.0
 twitter-oauth@1.2.0
 ui@1.0.13

diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-FROM reactioncommerce/base:v1.3.0
+FROM reactioncommerce/base:v1.3.1
 
 # Default environment variables
 ENV ROOT_URL "http://localhost"

diff --git a/README.md b/README.md
@@ -2,24 +2,24 @@
 
 [![bitHound Overall Score](https://www.bithound.io/github/reactioncommerce/reaction/badges/score.svg)](https://www.bithound.io/github/reactioncommerce/reaction) [![bitHound Dev Dependencies](https://www.bithound.io/github/reactioncommerce/reaction/badges/devDependencies.svg)](https://www.bithound.io/github/reactioncommerce/reaction/9a858eb459d7260d5ae59124c2b364bc791a3e70/dependencies/npm) [![bitHound Code](https://www.bithound.io/github/reactioncommerce/reaction/badges/code.svg)](https://www.bithound.io/github/reactioncommerce/reaction) [![Circle CI](https://circleci.com/gh/reactioncommerce/reaction.svg?style=svg)](https://circleci.com/gh/reactioncommerce/reaction) [![Gitter](https://badges.gitter.im/JoinChat.svg)](https://gitter.im/reactioncommerce/reaction?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 
-Reaction is an event-driven, real-time reactive commerce platform built with JavaScript (ES6). It plays nicely with npm and Docker, and is based entirely on JavaScript, CSS, and HTML. 
+Reaction is an event-driven, real-time reactive commerce platform built with JavaScript (ES6). It plays nicely with npm and Docker, and is based entirely on JavaScript, CSS, and HTML.
 
 ![Reaction v.1.0.0](https://raw.githubusercontent.com/reactioncommerce/reaction-docs/master/assets/rc-desktop.png)
 
 ## Features
 
 Reaction’s out-of-the-box core features include:
 
-* Drag-and-drop merchandising
-* Order processing
-* Payments
-* Shipping
-* Taxes
-* Discounts
-* Analytics
-* Integration with dozens of third-party apps
+-   Drag-and-drop merchandising
+-   Order processing
+-   Payments
+-   Shipping
+-   Taxes
+-   Discounts
+-   Analytics
+-   Integration with dozens of third-party apps
 
-And, since anything in our codebase can be extended, overwritten, or installed as a package, you may also develop, scale, and customize anything on our platform.
+Since anything in our codebase can be extended, overwritten, or installed as a package, you may also develop, scale, and customize anything on our platform.
 
 ## Installation
 
@@ -32,61 +32,53 @@ cd reaction
 reaction
 ```
 
-_Reaction requires Meteor, Git, MongoDB, OS Specific Build Tools, and (optionally) ImageMagick. See our [Requirements Docs](https://docs.reactioncommerce.com/reaction-docs/master/requirements) for requirements installation information._
+Reaction requires Meteor, Git, MongoDB, OS Specific Build Tools, and (optionally) ImageMagick.
 
-For more information on setup and configuration, check out the [installation](https://docs.reactioncommerce.com/reaction-docs/development/installation) and [configuration](https://docs.reactioncommerce.com/reaction-docs/development/configuration) docs.
-
-## Participation
-
-If you are interested in participating in the development of Reaction, that's really great!
+See our [Requirements Docs](https://docs.reactioncommerce.com/reaction-docs/master/requirements) for requirements that you may need to install for Reaction.
 
-Our [community guidelines](https://docs.reactioncommerce.com/reaction-docs/master/guidelines) can be found in our [documentation](https://docs.reactioncommerce.com/). This is a good place to start getting more familar with Reaction.
-
-The [Reaction Gitter channel](https://gitter.im/reactioncommerce/reaction) and [forum](http://discourse.reactioncommerce.com/) are good places to engage with core contributors and the community.
+For more information on setup and configuration, check out the [installation](https://docs.reactioncommerce.com/reaction-docs/development/installation) and [configuration](https://docs.reactioncommerce.com/reaction-docs/development/configuration) docs.
 
 ### Planning
 
-For a high level review our roadmap, take a look at the [Reaction features page](http://reactioncommerce.com/features).
+For an overview of our roadmap, visit our [Features & Roadmap page](https://reactioncommerce.com/roadmap).
 
-For a kanban-esque, hardcore, real time progress overview of all Reaction Commerce projects use our [project board](https://waffle.io/reactioncommerce/reaction).
+You will find the roadmap defined as projects on the [Reaction repository's project page](https://github.com/reactioncommerce/reaction/projects).
 
-### Testing
-
-Testing is another great way to contribute. If you do discover a bug, [create an issue](https://github.com/reactioncommerce/reaction/issues/new) to report it.
-
-Integration tests can be run at the command line with `reaction test`. Use `npm run-script test-local` to run local tests.
+Specific features in progress are found on the [Reaction repository's milestones page](https://github.com/reactioncommerce/reaction/milestones).
 
 ### Documentation
 
-The Reaction documentation source is located in the [reaction-docs](https://github.com/reactioncommerce/reaction-docs) repository, while the documentation site is the [reactioncommerce/redoc](https://github.com/reactioncommerce/redoc) application.
+Multiple branches, release documentation is found at <https://docs.reactioncommerce.com>
 
+The Reaction documentation source is located in the [reaction-docs](https://github.com/reactioncommerce/reaction-docs) repository, while the documentation site is the [reactioncommerce/redoc](https://github.com/reactioncommerce/redoc) application.
 
-### Deployment
+### Contributing
 
-We require that all releases are deployable as [Docker](https://www.docker.com/) containers.  Athough we haven't tested out other methods of deployment, our community has documented deployment strategies for [Heroku](https://github.com/reactioncommerce/reaction/issues/1363), AWS, [Digital Ocean](https://gist.github.com/jshimko/745ca66748846551692e24c267a56060), and Galaxy.
+Star us on GitHub, it helps!
 
-##### Docker
+If you are interested in participating in the development of Reaction, that's really great!  
 
-Docker images are pushed when Reaction sucessfully builds and passes all tests on the `master` or `development` branches. These images are released on [Reaction Commerce Docker Hub](https://hub.docker.com/u/reactioncommerce/). There are two images available: [reactioncommerce:prequel](https://hub.docker.com/r/reactioncommerce/prequel/) - the latest `development` image and [reactioncommerce:reaction](https://hub.docker.com/r/reactioncommerce/reaction/), the `master` image.
+The [Reaction Gitter channel](https://gitter.im/reactioncommerce/reaction) and [forum](https://forums.reactioncommerce.com/) are good places to engage with core contributors, the community, and to get familiar with Reaction. Our [community guidelines](https://docs.reactioncommerce.com/reaction-docs/master/guidelines) can be found in our [documentation](https://docs.reactioncommerce.com/).
 
+Check out the [issues](https://github.com/reactioncommerce/reaction/issues) page, and if you find something you want to work on, let us know in the comments. If you're interested in a particular [project](https://github.com/reactioncommerce/reaction/projects) and you aren’t sure where to begin, feel free to ask. Start small!
 
-### Contributing
+If your contribution doesn't fit with an existing issue, go ahead and [create an issue](https://github.com/reactioncommerce/reaction/issues/new) before submitting a [Pull Request](https://help.github.com/articles/about-pull-requests/). This will allow the Reaction team to give feedback if necessary.
 
-Want to contribute? That's great! [Here's how you can get started](https://guides.github.com/activities/contributing-to-open-source/#contributing).
+Pull Requests should:
 
-Check out our Issues page, and if you find something you want to work on, let us know in the comments. If you're interested in a particular [project](https://github.com/reactioncommerce/reaction/projects) and you aren’t sure where to begin, feel free to ask. Start small!
+-   Be very focused in scope. Smaller scopes are easier for us to digest and approve.
+-   Note any existing associated issues.
+-   Lint and adhere to the [Reaction style guide](https://docs.reactioncommerce.com/reaction-docs/master/styleguide).
+-   Pass both [acceptance tests and unit testing](https://docs.reactioncommerce.com/reaction-docs/master/testing-reaction).
 
-If your contribution doesn't fit with an existing issue, go ahead and [create an issue](https://github.com/reactioncommerce/reaction/issues/new) before submitting a [Pull Request](https://help.github.com/articles/about-pull-requests/). This will allow the Reaction team to give feedback if necessary. 
+### Testing
 
-Pull Requests should:
+Testing is another great way to contribute. If you do discover a bug, [create an issue](https://github.com/reactioncommerce/reaction/issues/new) to report it.
 
--   Include an associated issue
--   Comply with the Contributor License Agreement
--   Adhere to the [Reaction style guide](https://docs.reactioncommerce.com/reaction-docs/master/styleguide)
--   Pass both [acceptance tests and unit testing](https://docs.reactioncommerce.com/reaction-docs/master/testing-reaction)
+Integration tests can be run at the command line with `reaction test`.
 
-Be sure to read our [Community Guidelines](https://docs.reactioncommerce.com/reaction-docs/master/guidelines) to get more familiar with Reaction. And if you have any questions or comments, feel free to reach out via [Gitter](https://gitter.im/reactioncommerce/reaction) or our [forums](http://discourse.reactioncommerce.com/). 
+### Deployment
 
-### What's Next
+We ensure that all releases are deployable as [Docker](https://www.docker.com/) containers.  While we don't regularly test other methods of deployment, our community has documented deployment strategies for AWS, [Digital Ocean](https://gist.github.com/jshimko/745ca66748846551692e24c267a56060), and Galaxy.
 
-For an overview of our roadmap, visit our [Features & Roadmap page](https://reactioncommerce.com/roadmap). Or, if you'd like to see what we're doing in real time, check out our [Project Board](https://waffle.io/reactioncommerce/reaction). You can also see what we're doing [by project](https://github.com/reactioncommerce/reaction/projects) or [by release date](https://github.com/reactioncommerce/reaction/milestones).
+For an introduction to Docker deployment, [the Reaction deployment guide](https://docs.reactioncommerce.com/reaction-docs/master/deploying) has detailed examples. Reaction Commerce also offers a managed deployment platform integrated with the Reaction command line.
diff --git a/client/modules/accounts/templates/members/member.js b/client/modules/accounts/templates/members/member.js
@@ -80,8 +80,11 @@ Template.memberSettings.helpers({
           // Get all permissions, add them to an array
           if (registryItem.permissions) {
             for (const permission of registryItem.permissions) {
-              permission.shopId = shopId;
-              permissions.push(permission);
+              // check needed because of non-object perms in the permissions array (e.g "admin", "owner")
+              if (typeof permission === "object") {
+                permission.shopId = shopId;
+                permissions.push(permission);
+              }
             }
           }
 

diff --git a/client/modules/core/helpers/apps.js b/client/modules/core/helpers/apps.js
@@ -47,11 +47,6 @@ export function Apps(optionHash) {
   const reactionApps = [];
   let options = {};
 
-  // remove audience permissions for owner
-  if (Reaction.hasOwnerAccess() && optionHash.audience) {
-    delete optionHash.audience;
-  }
-
   // allow for object or option.hash
   if (optionHash) {
     if (optionHash.hash) {
@@ -66,6 +61,11 @@ export function Apps(optionHash) {
     options.shopId = Reaction.getShopId();
   }
 
+  // remove audience permissions for owner (still needed here for older/legacy calls)
+  if (Reaction.hasOwnerAccess() && options.audience) {
+    delete options.audience;
+  }
+
   //
   // build filter to only get matching registry elements
   //
@@ -89,24 +89,33 @@ export function Apps(optionHash) {
     }
   }
 
-  // fetch the packages
+  delete filter["registry.audience"]; // Temporarily remove "audience" key (see comment below)
+
+  // TODO: Review fix for filter on Packages.find(filter)
+  // The current "filter" setup uses "audience" field which is not present in the registry array in most (if not all) docs
+  // in the Packages coll.
+  // For now, the audience checks (after the Package.find call) filters out the registry items based on permissions. But
+  // part of the filtering should have been handled by the Package.find call, if the "audience" filter works as it should.
   Packages.find(filter).forEach((app) => {
     const matchingRegistry = _.filter(app.registry, function (item) {
-      const itemFilter = registryFilter;
+      const itemFilter = _.cloneDeep(registryFilter);
 
       // check audience permissions only if they exist as part of optionHash and are part of the registry item
       // ideally all routes should use it, safe for backwards compatibility though
       // owner bypasses permissions
-      if (!Reaction.hasOwnerAccess() && item.audience && registryFilter.audience) {
+      if (!Reaction.hasOwnerAccess() && item.permissions && registryFilter.audience) {
         let hasAccess;
 
         for (const permission of registryFilter.audience) {
-          if (item.audience.indexOf(permission) > -1) {
-            hasAccess = true;
-          }
-          // make sure user also has audience perms
-          if (Roles.userIsInRole(Meteor.userId(), permission, Reaction.getShopId())) {
+          // This checks that the registry item contains a permissions matches with the user's permission for the shop
+          const hasPermissionToRegistryItem = item.permissions.indexOf(permission) > -1;
+          // This checks that the user's permission set have the right value that is on the registry item
+          const hasRoleAccessForShop = Roles.userIsInRole(Meteor.userId(), permission, Reaction.getShopId());
+
+          // both checks must pass for access to be granted
+          if (hasPermissionToRegistryItem && hasRoleAccessForShop) {
             hasAccess = true;
+            break;
           }
         }
 

diff --git a/client/modules/core/main.js b/client/modules/core/main.js
@@ -197,10 +197,15 @@ export default {
   },
 
   getUserPreferences(packageName, preference, defaultValue) {
-    const profile = Meteor.user().profile;
-    if (profile && profile.preferences && profile.preferences[packageName] && profile.preferences[packageName][preference]) {
-      return profile.preferences[packageName][preference];
+    const user = Meteor.user();
+
+    if (user) {
+      const profile = Meteor.user().profile;
+      if (profile && profile.preferences && profile.preferences[packageName] && profile.preferences[packageName][preference]) {
+        return profile.preferences[packageName][preference];
+      }
     }
+
     return defaultValue || undefined;
   },