Access control for shared suppliers

[kidhab]

Sharedlists provides a database of suppliers and their articles. The Foodsoft can connect to this database and automaticalle import/ update a suppliers articles from the Sharedlists database.

Currently all available suppliers from Sharedlists will be shown at the Foodsoft instance. That is not ideal in case of a multicoop Foodsoft setup (running multiple Foodsoft instances from the same codebase and configuration):

There are suppliers that are only usefull for a single foodcoop or suppliers with different price models per foodcoop (e.g. depending on the distance of the delivery).

It would be nice to have some kind of access control for shared suppliers with the aim that a foodcoop only sees suppliers that are enabled for them.

What would the best way to implement this?

As far as I can see this are the most relevant parts from the Foodsoft and Sharedlists:

https://github.com/foodcoops/foodsoft/blob/master/app/views/suppliers/shared_suppliers.html.haml
https://github.com/foodcoops/foodsoft/blob/master/app/controllers/suppliers_controller.rb#L62
https://github.com/foodcoops/foodsoft/blob/master/app/models/shared_supplier.rb
https://github.com/foodcoops/sharedlists/blob/main/db/schema.rb#L35

[yksflip]

Hey kidhab,
thanks for rising this issue.
Lentschi proposes a different approach in the foodcoopsAT fork (foodcoopsat/foodsoft_hackathon#20). It allows each foodcoop to share their supplier or add shared suppliers from other foodcoop instances via a simple json endpoint (a seperate sharedlist application is not necessary anymore). I think this would also cope the case you described.

[wvengen]

Great idea. I thinkg @yksflip's remark is valid for many smaller suppliers. But for large suppliers, like wholesale retailers (e.g. Odin in NL), I don't think this will work: there are thousands of products, and no foodcoop includes all products (this would be too much work not useful for the foodcoop maintaining it, and Foodsoft doesn't handle this well or not at all). So I think we still need a way to pick and choose + sync products from an external supplier.

There could be alternative approaches, e.g. talking directly to a wholesale retailer's website or API, and synchronising with that.

[yksflip]

Correct me if I'm wrong, but I thought this was about filtering what shared suppliers should be displayed and I think this might get obsolote with the new sharelist approach.
But what you mention @wvengen is still relevant. I still think a shared list instance could be replaced with a seperate foodsoft instance just offering suppliers to be shared. Or are there big performance differences between foodsoft and sharedlist? I never looked too much into sharedlist myself.

@kidhab maybe we could have a discussion (together with @lentschi ?) on how to continue with the shared suppliers in foodsoft, as it seems to me that you've got some experience with it.

[wvengen]

Or are there big performance differences between foodsoft and sharedlist?

(updated) there are certain areas (like order management, or upload with synchronise), but when just importing articles I think it would be doable. Given large enough timeouts on upload processing, one can upload huge files to replace supplier articles. Enable Delete articles not in uploaded file. and make sure Keep current units, recompute unit quantity and price is disabled.

An alternative approach is to not only allow Foodsoft to synchronise with another Foodsoft instance, but also with supplier websites. I think this would be really nice for wholesale suppliers (and allow foodcoops to use their own login, possibly with prices and availability tailored to the relationship between Foodcoop and supplier) - but for later, after Foodsoft sync.

[lentschi]

@kidhab maybe we could have a discussion (together with @lentschi ?) on how to continue with the shared suppliers in foodsoft, as it seems to me that you've got some experience with it.

Sure, I'd be up for a discussion about that. 👍 (I actually tried to reach you, @kidhab, through the forum, but probably I addressed the wrong account or something)