Update permitted params for products

Use explicit product params to permit.
Removes #split_params as not needed because multiple select handles
sending multiple values correctly.

Author: chaimann

admin/app/controllers/solidus_admin/products_controller.rb

@@ -11,8 +11,6 @@ class ProductsController < SolidusAdmin::BaseController
     search_scope(:in_stock) { _1.where(id: Spree::Variant.in_stock.distinct.select(:product_id)) }
     search_scope(:out_of_stock) { _1.where.not(id: Spree::Variant.in_stock.distinct.select(:product_id)) }
 
-    before_action :split_params, only: [:update]
-
     def index
       products = apply_search_to(
         Spree::Product.includes(:master, :variants),
@@ -44,7 +42,7 @@ def show
     def update
       @product = Spree::Product.friendly.find(params[:id])
 
-      if @product.update(params.require(:product).permit!)
+      if @product.update(product_params)
         flash[:success] = t('spree.successfully_updated', resource: [
           Spree::Product.model_name.human,
           @product.name.inspect,
@@ -101,13 +99,12 @@ def activate
       redirect_to products_path, status: :see_other
     end
 
-    def split_params
-      if params[:product][:taxon_ids].present?
-        params[:product][:taxon_ids] = params[:product][:taxon_ids].split(',')
-      end
-      if params[:product][:option_type_ids].present?
-        params[:product][:option_type_ids] = params[:product][:option_type_ids].split(',')
-      end
+    private
+
+    def product_params
+      params.require(:product).permit(:name, :slug, :description, :meta_title, :meta_description, :meta_keywords, :gtin,
+        :condition, :price, :cost_price, :cost_currency, :sku, :shipping_category_id, :tax_category_id,
+        :available_on, :discontinue_on, :promotionable, option_type_ids: [], taxon_ids: [])
     end
   end
 end

admin/spec/requests/solidus_admin/products_spec.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe "SolidusAdmin::PropertiesController", type: :request do
+  let(:admin_user) { create(:admin_user) }
+
+  before do
+    allow_any_instance_of(SolidusAdmin::BaseController).to receive(:spree_current_user).and_return(admin_user)
+  end
+
+  describe "PATCH #update" do
+    let(:product) { create(:product) }
+    let(:params) do
+      {
+        name: "T-Shirt",
+        description: "Nice T-Shirt",
+        slug: "nice-t-shirt",
+        meta_title: "Nice T-Shirt",
+        meta_description: "It is a really nice T-Shirt",
+        meta_keywords: "tshirt, tee",
+        gtin: "12345",
+        condition: "new",
+        price: 100,
+        cost_price: 100,
+        cost_currency: "USD",
+        sku: "T123",
+        shipping_category_id: create(:shipping_category).id,
+        tax_category_id: create(:tax_category).id,
+        available_on: "2025-05-28".to_date,
+        discontinue_on: "2026-01-06".to_date,
+        promotionable: true,
+        option_type_ids: [create(:option_type).id, create(:option_type).id],
+        taxon_ids: [create(:taxon).id, create(:taxon).id],
+      }
+    end
+
+    it "updates product" do
+      patch solidus_admin.product_path(product), params: { product: params }
+      expect(response).to have_http_status(:see_other)
+      expect(product.reload).to have_attributes(params.except(Spree::Product::MASTER_ATTRIBUTES))
+      %i[gtin condition price cost_price cost_currency sku].each do |attr|
+        expect(product.public_send(attr)).to eq(params[attr])
+      end
+    end
+  end
+end