From c22f97550c038f4d7aef776eeda6cb87f3959893 Mon Sep 17 00:00:00 2001
From: Ryan Parr <ryan@ryanmparr.com>
Date: Mon, 30 May 2022 15:57:55 +0200
Subject: [PATCH 1/4] Fix context description

This is related to roles, not stock locations.
---
 backend/spec/controllers/spree/admin/users_controller_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/spec/controllers/spree/admin/users_controller_spec.rb b/backend/spec/controllers/spree/admin/users_controller_spec.rb
index 37d710f6eea..649d3f08c81 100644
--- a/backend/spec/controllers/spree/admin/users_controller_spec.rb
+++ b/backend/spec/controllers/spree/admin/users_controller_spec.rb
@@ -321,7 +321,7 @@ def user
       end
     end
 
-    context "when the user can manage only some stock locations" do
+    context "when the user can manage only some roles" do
       stub_authorization! do |_user|
         can :manage, Spree.user_class
         can :manage, Spree::Role

From 44322f6915dfa8318d26fbe49f626e784a98a738 Mon Sep 17 00:00:00 2001
From: Ryan Parr <ryan@ryanmparr.com>
Date: Mon, 30 May 2022 15:59:14 +0200
Subject: [PATCH 2/4] Add controller spec for clearing stock locations

This provides spec parity for other HABTM relationships.
---
 .../spec/controllers/spree/admin/users_controller_spec.rb  | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/backend/spec/controllers/spree/admin/users_controller_spec.rb b/backend/spec/controllers/spree/admin/users_controller_spec.rb
index 649d3f08c81..0144f7fa6c3 100644
--- a/backend/spec/controllers/spree/admin/users_controller_spec.rb
+++ b/backend/spec/controllers/spree/admin/users_controller_spec.rb
@@ -406,6 +406,13 @@ def user
         put :update, params: { id: user.id, user: { stock_location_ids: [location2.id] } }
         expect(user.reload.stock_locations).to eq([location2])
       end
+
+      it "can clear stock locations" do
+        user.stock_locations << Spree::StockLocation.create(name: "my_location")
+        expect {
+          put :update, params: { id: user.id, user: { name: "Bob Bloggs", stock_location_ids: [""] } }
+        }.to change { user.reload.stock_locations.to_a }.to([])
+      end
     end
 
     context "when the user cannot manage stock locations" do

From 7e07ec8f81dfd02c2aa9682139030ed45d834853 Mon Sep 17 00:00:00 2001
From: Ryan Parr <ryan@ryanmparr.com>
Date: Mon, 30 May 2022 16:01:45 +0200
Subject: [PATCH 3/4] Add hidden field for user stock locations

This will allow for removing all user-stock location relations.
Without this, once a user has an associated stock location, they
must ALWAYS have at least one.
---
 backend/app/views/spree/admin/users/_form.html.erb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/app/views/spree/admin/users/_form.html.erb b/backend/app/views/spree/admin/users/_form.html.erb
index b3121576823..64d79b1f6e0 100644
--- a/backend/app/views/spree/admin/users/_form.html.erb
+++ b/backend/app/views/spree/admin/users/_form.html.erb
@@ -40,6 +40,7 @@
         <%= label_tag nil, plural_resource_name(Spree::StockLocation) %>
         <ul>
           <% if can?(:manage, Spree::UserStockLocation) %>
+            <%= hidden_field_tag('user[stock_location_ids][]', nil) %>
             <% @stock_locations.each do |stock_location| %>
               <li>
                 <label>

From 28d532cece520d0a207b378fde42b98f5b316409 Mon Sep 17 00:00:00 2001
From: Ryan Parr <ryan@ryanmparr.com>
Date: Mon, 30 May 2022 16:04:01 +0200
Subject: [PATCH 4/4] Add context for restricted stock management

This mirrors the user roles specs, and tests the fixed behavior
around user stock locations.
---
 backend/spec/features/admin/users_spec.rb | 35 +++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/backend/spec/features/admin/users_spec.rb b/backend/spec/features/admin/users_spec.rb
index 03d68951030..8763874ef41 100644
--- a/backend/spec/features/admin/users_spec.rb
+++ b/backend/spec/features/admin/users_spec.rb
@@ -229,6 +229,41 @@
       expect(page).to have_text 'Account updated'
     end
 
+    context 'when :can_restrict_stock_management is true' do
+      custom_authorization! do |_user|
+        can [:show], Spree::StockLocation
+      end
+
+      before do
+        stub_spree_preferences(Spree::Config, can_restrict_stock_management: true)
+      end
+
+      let!(:stock_location) { create(:stock_location, name: "location_1") }
+
+      it 'can edit user stock locations' do
+        click_link 'Account'
+
+        check 'user_spree_stock_locations_location_1'
+        click_button 'Update'
+        expect(page).to have_text 'Account updated'
+        expect(find_field('user_spree_stock_locations_location_1')).to be_checked
+      end
+
+      it 'can delete user stock locations' do
+        user_a.stock_locations << Spree::StockLocation.create(name: "dummy")
+        click_link 'Account'
+
+        user_a.stock_locations.each do |location|
+          uncheck "user_spree_stock_locations_#{location.name}"
+        end
+
+        click_button 'Update'
+        expect(page).to have_text 'Account updated'
+        expect(find_field('user_spree_stock_locations_dummy')).not_to be_checked
+        expect(user_a.reload.stock_locations).to be_empty
+      end
+    end
+
     context 'without password permissions' do
       custom_authorization! do |_user|
         cannot [:update_password], Spree.user_class