fix: product edit save not working

Author: jakubsindelar-mountfieldcz

CLAUDE.md

@@ -171,8 +171,14 @@ await user.load((loader) => loader.load('orders'))
 // Role check — role middleware handles this, but in code:
 // admin implicitly has supplier access (check middleware/role.ts)
 
-// Method spoofing for DELETE/PUT in HTML forms:
-// <input type="hidden" name="_method" value="DELETE">
+// Method spoofing works ONLY from the query string — never from the body:
+//   POST /supplier/products/16?_method=PUT   ✅
+//   POST /supplier/products/16 + `_method: 'PUT'` field in the body   ❌ 404
+// The bodyparser is router middleware, so it runs AFTER route matching —
+// `_method` in the body is invisible to the router. From Inertia always issue a
+// real router.put()/form.put()/router.delete(); it works with forceFormData too
+// (unlike PHP, the Adonis bodyparser parses multipart on PUT/PATCH/DELETE), and
+// the Inertia middleware upgrades the 302 redirect to 303 for you.
 ```
 
 ### Vue / Inertia Patterns

inertia/pages/supplier/products/edit.vue

@@ -141,13 +141,14 @@ function onDescriptionEnter() {
 function submit() {
   if (submitDisabled.value) return
 
+  // Must be a real PUT — AdonisJS only honours `_method` spoofing from the query
+  // string, never from the request body, and the body is parsed after routing.
   form
     .transform((data) => ({
       ...data,
-      _method: 'PUT',
       allergenIds: JSON.stringify(data.allergenIds),
     }))
-    .post(`/supplier/products/${props.product.id}`, {
+    .put(`/supplier/products/${props.product.id}`, {
       forceFormData: true,
       preserveScroll: true,
       onFinish: () => {

tests/e2e/supplier_products.spec.ts

@@ -54,6 +54,43 @@ test.describe('Supplier products flow', () => {
     await expect(saveButton).toBeEnabled()
   })
 
+  test('saving the edit form persists the change', async ({ page }) => {
+    const createdName = `E2E Editace ${Date.now()}`
+    const renamedTo = `${createdName} upraveno`
+
+    await loginAs(page, 'supplier')
+
+    // Work on an own product so the seeded catalogue stays untouched.
+    await page.goto('/supplier/products/new')
+    await page.locator('#product-name').fill(createdName)
+    await page.locator('#product-description').fill('E2E editace produktu')
+    await page.getByRole('combobox').first().click()
+    await page.getByRole('option', { name: 'Nealko' }).click()
+    await page.locator('input[type="file"]').setInputFiles({
+      name: 'e2e-edit.png',
+      mimeType: 'image/png',
+      buffer: Buffer.from(
+        'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAusB9WlH0JkAAAAASUVORK5CYII=',
+        'base64'
+      ),
+    })
+    await page.getByRole('button', { name: 'Vytvořit produkt' }).click()
+    await expect(page).toHaveURL(/\/supplier\/stock\?preselect=\d+/)
+
+    const productId = page.url().match(/preselect=(\d+)/)![1]
+
+    await page.goto(`/supplier/products/${productId}/edit`)
+    await page.locator('#edit-product-name').fill(renamedTo)
+    await page.getByRole('button', { name: 'Uložit změny' }).click()
+
+    await expect(page).toHaveURL(/\/supplier\/stock$/)
+    await expect(page.getByText(`Produkt „${renamedTo}“ byl upraven.`)).toBeVisible()
+
+    // The change must really be persisted, not just flashed.
+    await page.goto(`/supplier/products/${productId}/edit`)
+    await expect(page.locator('#edit-product-name')).toHaveValue(renamedTo)
+  })
+
   test('supplier products category tags keep white text color', async ({ page }) => {
     await loginAs(page, 'supplier')
     await page.goto('/supplier/products')

tests/functional/web/supplier.spec.ts

@@ -195,6 +195,57 @@ test.group('Web Supplier - products', (group) => {
     assert.isNotNull(product)
   })
 
+  test('updating product via PUT persists changes and redirects to stock', async ({
+    client,
+    assert,
+  }) => {
+    const supplier = await UserFactory.apply('supplier').create()
+    const category = await CategoryFactory.create()
+    const product = await ProductFactory.merge({
+      categoryId: category.id,
+      displayName: 'Před úpravou',
+    }).create()
+
+    const response = await client
+      .put(`/supplier/products/${product.id}`)
+      .loginAs(supplier)
+      .withCsrfToken()
+      .field('displayName', 'Po úpravě')
+      .field('description', 'Nový popis')
+      .field('categoryId', category.id)
+      .field('barcode', '987654321')
+      .field('allergenIds', JSON.stringify([]))
+      .redirects(0)
+
+    response.assertStatus(302)
+    assert.equal(response.header('location'), '/supplier/stock')
+
+    await product.refresh()
+    assert.equal(product.displayName, 'Po úpravě')
+    assert.equal(product.description, 'Nový popis')
+    assert.equal(product.barcode, '987654321')
+  })
+
+  test('product update is not routable as POST with _method in the body', async ({ client }) => {
+    // AdonisJS only honours `_method` spoofing from the query string, and the
+    // bodyparser runs after route matching — so a body-only `_method` 404s.
+    const supplier = await UserFactory.apply('supplier').create()
+    const category = await CategoryFactory.create()
+    const product = await ProductFactory.merge({ categoryId: category.id }).create()
+
+    const response = await client
+      .post(`/supplier/products/${product.id}`)
+      .loginAs(supplier)
+      .withCsrfToken()
+      .field('displayName', 'Spoofed')
+      .field('description', 'Spoofed')
+      .field('categoryId', category.id)
+      .field('_method', 'PUT')
+      .redirects(0)
+
+    response.assertStatus(404)
+  })
+
   test('stock page returns preselect value from query string', async ({ client, assert }) => {
     const supplier = await UserFactory.apply('supplier').create()
     const response = await client