solidus_api 2.3.0 → 2.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 500bb7f02aa317d42deaba78dc56dc27d93177ce
-  data.tar.gz: ae08fe9d542bb9800d3b48a1b905063d28acda8f
+  metadata.gz: 62e84e7fac19cf7c464a975f5ce5e32b445f6c0d
+  data.tar.gz: 7058e689b5789d92b852345a668b7725a05cb26c
 SHA512:
-  metadata.gz: 9d40be3951137734289f72ab330f9f50edb6c44e30c93fb781fc7f6596a371eb28a354d4e038a6ce0eecf55235caf9d46c84ed376783e0a0141b92a92852bbb3
-  data.tar.gz: 936bce88ab0f52923f399e5892f7e645901e133edf766e51996946e50b1fbba8e50eb964ba3309767a70634334dcae89ad33656bbf61a4b94fa9afae5350eadf
+  metadata.gz: '08ecdd913e61cf55169cd386e35046a1d977b4590470f57ba7710c7d50c0d1f606c163d7e7805985fb1351beae2a582587df71a674697e107037f228a2456d70'
+  data.tar.gz: 22a48ebbaafc4f9c0eabfc4bc7227fe18e73e5db0fe56bacdcc5c9910fe5602d207086c19d0cf1721dfbd0a1ea9fe1df24eaa175b5054cfa8164367b2fb16d0c

data/app/controllers/spree/api/orders_controller.rb

@@ -27,8 +27,18 @@ module Spree
 
       def create
         authorize! :create, Order
-        @order = Spree::Core::Importer::Order.import(determine_order_user, order_params)
-        respond_with(@order, default_template: :show, status: 201)
+
+        if can?(:admin, Order)
+          @order = Spree::Core::Importer::Order.import(determine_order_user, order_params)
+          respond_with(@order, default_template: :show, status: 201)
+        else
+          @order = Spree::Order.create!(user: current_api_user, store: current_store)
+          if OrderUpdateAttributes.new(@order, order_params).apply
+            respond_with(@order, default_template: :show, status: 201)
+          else
+            invalid_resource!(@order)
+          end
+        end
       end
 
       def empty

data/app/controllers/spree/api/payments_controller.rb

@@ -16,6 +16,7 @@ module Spree
       end
 
       def create
+        @order.validate_payments_attributes(payment_params)
         @payment = PaymentCreate.new(@order, payment_params).build
         if @payment.save
           respond_with(@payment, status: 201, default_template: :show)

data/spec/requests/spree/api/checkouts_controller_spec.rb

@@ -154,6 +154,19 @@ module Spree
         expect(response.status).to eq(200)
       end
 
+      context "with disallowed payment method" do
+        it "returns not found" do
+          order.update_column(:state, "payment")
+          allow_any_instance_of(Spree::PaymentMethod::BogusCreditCard).to receive(:source_required?).and_return(false)
+          @payment_method.update!(available_to_users: false)
+          expect {
+            put spree.api_checkout_path(order.to_param), params: { order_token: order.guest_token, order: { payments_attributes: [{ payment_method_id: @payment_method.id }] } }
+          }.not_to change { Spree::Payment.count }
+          expect(response.status).to eq(404)
+        end
+      end
+
+
       it "returns errors when source is required and missing" do
         order.update_column(:state, "payment")
         put spree.api_checkout_path(order.to_param), params: { order_token: order.guest_token, order: { payments_attributes: [{ payment_method_id: @payment_method.id }] } }

data/spec/requests/spree/api/orders_controller_spec.rb

@@ -31,9 +31,10 @@ module Spree
     describe "POST create" do
       let(:target_user) { create :user }
       let(:date_override) { Time.parse('2015-01-01') }
+      let(:attributes) { { user_id: target_user.id, created_at: date_override, email: target_user.email } }
 
       subject do
-        post spree.api_orders_path, params: { order: { user_id: target_user.id, created_at: date_override, email: target_user.email } }
+        post spree.api_orders_path, params: { order: attributes }
         response
       end
 
@@ -44,12 +45,37 @@ module Spree
 
         it "does not include unpermitted params, or allow overriding the user" do
           subject
+          expect(response).to be_success
           order = Spree::Order.last
           expect(order.user).to eq current_api_user
           expect(order.email).to eq target_user.email
         end
 
         it { is_expected.to be_success }
+
+        context 'creating payment' do
+          let(:attributes) { super().merge(payments_attributes: [{ payment_method_id: payment_method.id }]) }
+
+          context "with allowed payment method" do
+            let!(:payment_method) { create(:check_payment_method, name: "allowed" ) }
+            it { is_expected.to be_success }
+            it "creates a payment" do
+              expect {
+                subject
+              }.to change { Spree::Payment.count }.by(1)
+            end
+          end
+
+          context "with disallowed payment method" do
+            let!(:payment_method) { create(:check_payment_method, name: "forbidden", available_to_users: false) }
+            it { is_expected.to be_not_found }
+            it "creates no payments" do
+              expect {
+                subject
+              }.not_to change { Spree::Payment.count }
+            end
+          end
+        end
       end
 
       context "when the current user can administrate the order" do
@@ -69,7 +95,7 @@ module Spree
       end
 
       context 'when the line items have custom attributes' do
-        it "can create an order with line items that have custom permitted attributes" do
+        it "can create an order with line items that have custom permitted attributes", :pending do
           PermittedAttributes.line_item_attributes << { options: [:some_option] }
           expect_any_instance_of(Spree::LineItem).to receive(:some_option=).once.with('4')
           post spree.api_orders_path, params: { order: { line_items: { "0" => { variant_id: variant.to_param, quantity: 5, options: { some_option: 4 } } } } }
@@ -113,6 +139,30 @@ module Spree
             subject
           }.to_not change{ order.reload.number }
         end
+
+        context 'creating payment' do
+          let(:order_params) { super().merge(payments_attributes: [{ payment_method_id: payment_method.id }]) }
+
+          context "with allowed payment method" do
+            let!(:payment_method) { create(:check_payment_method, name: "allowed" ) }
+            it { is_expected.to be_success }
+            it "creates a payment" do
+              expect {
+                subject
+              }.to change { Spree::Payment.count }.by(1)
+            end
+          end
+
+          context "with disallowed payment method" do
+            let!(:payment_method) { create(:check_payment_method, name: "forbidden", available_to_users: false) }
+            it { is_expected.to be_not_found }
+            it "creates no payments" do
+              expect {
+                subject
+              }.not_to change { Spree::Payment.count }
+            end
+          end
+        end
       end
 
       context "when the user can administer the order" do
@@ -344,10 +394,7 @@ module Spree
 
     # Regression test for https://github.com/spree/spree/issues/3404
     it "can specify additional parameters for a line item" do
-      expect(Order).to receive(:create!).and_return(order = Spree::Order.new)
-      allow(order).to receive(:associate_user!)
-      allow(order).to receive_message_chain(:contents, :add).and_return(line_item = double('LineItem'))
-      expect(line_item).to receive(:update_attributes!).with(hash_including("special" => "foo"))
+      expect_any_instance_of(Spree::LineItem).to receive(:special=).with("foo")
 
       allow_any_instance_of(Spree::Api::OrdersController).to receive_messages(permitted_line_item_attributes: [:id, :variant_id, :quantity, :special])
       post spree.api_orders_path, params: {

data/spec/requests/spree/api/payments_controller_spec.rb

@@ -42,6 +42,17 @@ module Spree
             expect(response.status).to eq(201)
             expect(json_response).to have_attributes(attributes)
           end
+
+          context "disallowed payment method" do
+            it "does not create a new payment" do
+              PaymentMethod.first.update!(available_to_users: false)
+
+              expect {
+                post spree.api_order_payments_path(order), params: { payment: { payment_method_id: PaymentMethod.first.id, amount: 50 } }
+              }.not_to change { Spree::Payment.count }
+              expect(response.status).to eq(404)
+            end
+          end
         end
 
         context "payment source is required" do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: solidus_api
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.3.1
 platform: ruby
 authors:
 - Solidus Team
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-31 00:00:00.000000000 Z
+date: 2017-12-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: solidus_core
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.3.0
+        version: 2.3.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.3.0
+        version: 2.3.1
 - !ruby/object:Gem::Dependency
   name: rabl
   requirement: !ruby/object:Gem::Requirement