solidus_api 4.6.1 → 4.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6e62ddc404fef2d9b6dc0b37973dedca61c1bb1b43f036a5976312779f19ae1b
-  data.tar.gz: 73a9a781462acef1a5acab160abf72e7efdfec3d98fa6a933d8d7c5c03cb9d00
+  metadata.gz: 8c41ea3214c59ad97011578151885acc73d3c9479c5498803ad1365091e7f954
+  data.tar.gz: 47c82eeefc719a30c191e5871a118f1d244a09c7ab6d8450a9e839d2bedd604b
 SHA512:
-  metadata.gz: e2e98605d92cc86873f479847bcb12f36e9c21c2c9bfd18c29d58c0c6a61a4ac8bf61fcb014015a80ba570d588568b9148d375ad49f5a46573d8e6559bcae45a
-  data.tar.gz: 73e352d81bdada984ff2ba8fcbd1656bcf335c868a08c7f304e657dccefaf5a176454e461134e8dde443a828d270ee9a76ee643cbb094072236218d284ba4391
+  metadata.gz: 05cdcecd7178d7123f472fc396528ac6ef05f2b04d2474b0a6fd5aef0c977489f474678be8721db9714dcc99cca1f23adb93056eaca63a423311c46f192da7c6
+  data.tar.gz: cbec85d5107e8654a9aee47a41df1b55c3ca5a9b0c4019eafe991c137c87579e39e1d663b428a82804e663a1614e14e6445c4d71172a9d3a7ea4815bedc6bf5a

data/app/controllers/spree/api/orders_controller.rb

@@ -11,6 +11,12 @@ module Spree
 
       class_attribute :admin_payment_attributes
       self.admin_payment_attributes = [:payment_method, :amount, :state, source: {}]
+      msg = "`Spree::Api::OrdersController.admin_payment_attributes` is deprecated."
+      deprecate(
+        admin_payment_attributes: msg,
+        "admin_payment_attributes=": msg,
+        deprecator: Spree.deprecator
+      )
 
       before_action :find_order, except: [:create, :mine, :current, :index]
       around_action :lock_order, except: [:create, :mine, :current, :index, :show]
@@ -149,7 +155,25 @@ module Spree
       end
 
       def permitted_order_attributes
-        can?(:admin, Spree::Order) ? (super + admin_order_attributes) : super
+        if can?(:admin, Spree::Order)
+          super + admin_order_attributes
+        else
+          # We need to remove the `:amount` attribute from payments_attributes
+          # for non-admin users. Unfortunately, order_attributes uses the
+          # checkout_payment_attributes instead of the payment_attributes, which
+          # needs to be able to set the amount.
+          #
+          # We're doing a deep_dup here to avoid modifying the original
+          # permitted attributes, which could have unintended side effects.
+          order_attributes = super.deep_dup
+
+          payments_attributes = order_attributes.find do |attribute|
+            attribute.is_a?(Hash) && attribute.has_key?(:payments_attributes)
+          end
+          payments_attributes[:payments_attributes] -= [:amount]
+
+          order_attributes
+        end
       end
 
       def permitted_shipment_attributes
@@ -161,6 +185,12 @@ module Spree
       end
 
       def permitted_payment_attributes
+        Spree.deprecator.warn(
+          "`Spree::Api::OrdersController#permitted_payment_attributes` is deprecated. " \
+          "This method was never actually used in this controller because " \
+          "permitted_order_attributes uses the permitted_checkout_payment_attributes " \
+          "method to determine the permitted attributes for payments."
+        )
         if can?(:admin, Spree::Payment)
           super + admin_payment_attributes
         else

data/app/controllers/spree/api/payments_controller.rb

@@ -3,6 +3,9 @@
 module Spree
   module Api
     class PaymentsController < Spree::Api::BaseController
+      class_attribute :admin_payment_attributes
+      self.admin_payment_attributes = [:amount]
+
       before_action :find_order
       around_action :lock_order, only: [:create, :update, :authorize, :capture, :purchase, :void]
       before_action :find_payment, only: [:update, :show, :authorize, :purchase, :capture, :void]
@@ -78,6 +81,14 @@ module Spree
       def payment_params
         params.require(:payment).permit(permitted_payment_attributes)
       end
+
+      def permitted_payment_attributes
+        if can?(:admin, Spree::Payment)
+          super + admin_payment_attributes
+        else
+          super
+        end
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_api
 version: !ruby/object:Gem::Version
-  version: 4.6.1
+  version: 4.6.3
 platform: ruby
 authors:
 - Solidus Team
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.6.1
+        version: 4.6.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.6.1
+        version: 4.6.3
 description: REST API for the Solidus e-commerce framework.
 email: contact@solidus.io
 executables: []
@@ -270,7 +270,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.8.23
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.10
 specification_version: 4
 summary: REST API for the Solidus e-commerce framework.
 test_files: []