solidus_api 4.6.2 → 4.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed9e0c8256d35198a7fe9cc5ae0c5ca23ddf2c1d96c2debfc8b8faed136740ca
-  data.tar.gz: 73a9a781462acef1a5acab160abf72e7efdfec3d98fa6a933d8d7c5c03cb9d00
+  metadata.gz: 92ccd1baa7331139315707fd902eeec5712a41d6563f713611c4c4c32beaff34
+  data.tar.gz: 2b93ffdf94c871ec54eaabda3c9c4b46e5108283e1d2aa99686dba426e811cf2
 SHA512:
-  metadata.gz: 8b9a570a1c125eab4c52d35d8738453be313ec86be2ddb943628015f8a577c9b51055f60b3df3468abdae56c11df8e7ca4b8fccfda6aaab60e26bbba2a4160b8
-  data.tar.gz: 73e352d81bdada984ff2ba8fcbd1656bcf335c868a08c7f304e657dccefaf5a176454e461134e8dde443a828d270ee9a76ee643cbb094072236218d284ba4391
+  metadata.gz: d91812f69f054d0536f3bd0bc34a7c028ded3d4172917348d587fbeac25b2a5bb7e2eab28f38d6ae72f82a0a781137c4c53372005c876c42abaf6b115ba9a95f
+  data.tar.gz: 2eb2ce76ec4d4a9892f7fa3fd99691f81376cdb0580f8ca39c227ba2f7c394ddb25b14c7e1180cbe931ad0c7f8d5d4d297988b576eabe7f5ca2e70451bbbc920

data/Rakefile

@@ -1,18 +1,18 @@
 # frozen_string_literal: true
 
-require 'rubygems'
-require 'rake'
-require 'rake/testtask'
-require 'rspec/core/rake_task'
-require 'spree/testing_support/dummy_app/rake_tasks'
-require 'bundler/gem_tasks'
+require "rubygems"
+require "rake"
+require "rake/testtask"
+require "rspec/core/rake_task"
+require "spree/testing_support/dummy_app/rake_tasks"
+require "bundler/gem_tasks"
 
 RSpec::Core::RakeTask.new
 task default: :spec
 
 DummyApp::RakeTasks.new(
   gem_root: File.expand_path(__dir__),
-  lib_name: 'solidus_api'
+  lib_name: "solidus_api"
 )
 
-task test_app: 'db:reset'
+task test_app: "db:reset"

data/app/controllers/spree/api/addresses_controller.rb

@@ -15,11 +15,12 @@ module Spree
         authorize! :update, @order, order_token
         find_address
 
-        if @order.update({ "#{@order_source}_attributes" => address_params })
-          @address = @order.send(@order_source)
+        success = @order.update({"#{@order_source}_attributes" => address_params})
+        @address = @order.send(@order_source)
+
+        if success
           respond_with(@address, default_template: :show)
         else
-          @address = @order.send(@order_source)
           invalid_resource!(@address)
         end
       end

data/app/controllers/spree/api/base_controller.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'spree/api/responders'
+require "spree/api/responders"
 
 module Spree
   module Api
@@ -19,7 +19,7 @@ module Spree
       self.admin_line_item_attributes = [:price, :variant_id, :sku]
 
       class_attribute :admin_metadata_attributes
-      self.admin_metadata_attributes = [{ admin_metadata: {} }]
+      self.admin_metadata_attributes = [{admin_metadata: {}}]
 
       before_action :deprecated_load_user
       before_action :authorize_for_order, if: proc { order_token.present? }
@@ -147,7 +147,7 @@ module Spree
       def bearer_token
         pattern = /^Bearer /
         header = request.headers["Authorization"]
-        header.gsub(pattern, '') if header.present? && header.match(pattern)
+        header.gsub(pattern, "") if header.present? && header.match(pattern)
       end
 
       def order_token
@@ -175,7 +175,7 @@ module Spree
       end
 
       def variants_associations
-        [{ option_values: :option_type }, :prices, :images]
+        [{option_values: :option_type}, :prices, :images]
       end
 
       def product_includes
@@ -202,16 +202,16 @@ module Spree
         render(
           json: {
             errors: [I18n.t(:quantity_is_not_available, scope: "spree.api.order")],
-            type: 'insufficient_stock'
+            type: "insufficient_stock"
           },
           status: :unprocessable_entity
         )
       end
 
       def paginate(resource)
-        resource.
-          page(params[:page]).
-          per(params[:per_page] || default_per_page)
+        resource
+          .page(params[:page])
+          .per(params[:per_page] || default_per_page)
       end
 
       def default_per_page
@@ -221,7 +221,7 @@ module Spree
       def invalid_transition(error)
         logger.error("invalid_transition #{error.event} from #{error.from} for #{error.object.class.name}. Error: #{error.inspect}")
 
-        render "spree/api/errors/could_not_transition", locals: { resource: error.object }, status: :unprocessable_entity
+        render "spree/api/errors/could_not_transition", locals: {resource: error.object}, status: :unprocessable_entity
       end
     end
   end

data/app/controllers/spree/api/checkouts_controller.rb

@@ -16,26 +16,26 @@ module Spree
       def next
         authorize! :update, @order, order_token
         if !expected_total_ok?(params[:expected_total])
-          respond_with(@order, default_template: 'spree/api/orders/expected_total_mismatch', status: 400)
+          respond_with(@order, default_template: "spree/api/orders/expected_total_mismatch", status: 400)
           return
         end
         @order.next!
-        respond_with(@order, default_template: 'spree/api/orders/show', status: 200)
+        respond_with(@order, default_template: "spree/api/orders/show", status: 200)
       end
 
       def advance
         authorize! :update, @order, order_token
         @order.contents.advance
-        respond_with(@order, default_template: 'spree/api/orders/show', status: 200)
+        respond_with(@order, default_template: "spree/api/orders/show", status: 200)
       end
 
       def complete
         authorize! :update, @order, order_token
         if !expected_total_ok?(params[:expected_total])
-          respond_with(@order, default_template: 'spree/api/orders/expected_total_mismatch', status: 400)
+          respond_with(@order, default_template: "spree/api/orders/expected_total_mismatch", status: 400)
         else
           @order.complete!
-          respond_with(@order, default_template: 'spree/api/orders/show', status: 200)
+          respond_with(@order, default_template: "spree/api/orders/show", status: 200)
         end
       end
 
@@ -51,7 +51,7 @@ module Spree
 
           if @order.completed? || @order.next!
             state_callback(:after)
-            respond_with(@order, default_template: 'spree/api/orders/show')
+            respond_with(@order, default_template: "spree/api/orders/show")
           end
         else
           invalid_resource!(@order)

data/app/controllers/spree/api/countries_controller.rb

@@ -6,11 +6,11 @@ module Spree
       skip_before_action :authenticate_user
 
       def index
-        @countries = Spree::Country.
-          accessible_by(current_ability).
-          ransack(params[:q]).
-          result.
-          order('name ASC')
+        @countries = Spree::Country
+          .accessible_by(current_ability)
+          .ransack(params[:q])
+          .result
+          .order("name ASC")
 
         country = Spree::Country.order("updated_at ASC").last
 

data/app/controllers/spree/api/coupon_codes_controller.rb

@@ -13,10 +13,10 @@ module Spree
         @handler = Spree::Config.promotions.coupon_code_handler_class.new(@order).apply
 
         if @handler.successful?
-          render 'spree/api/promotions/handler', status: 200
+          render "spree/api/promotions/handler", status: 200
         else
           logger.error("apply_coupon_code_error=#{@handler.error.inspect}")
-          render 'spree/api/promotions/handler', status: 422
+          render "spree/api/promotions/handler", status: 422
         end
       end
 
@@ -27,10 +27,10 @@ module Spree
         @handler = Spree::Config.promotions.coupon_code_handler_class.new(@order).remove
 
         if @handler.successful?
-          render 'spree/api/promotions/handler', status: 200
+          render "spree/api/promotions/handler", status: 200
         else
           logger.error("remove_coupon_code_error=#{@handler.error.inspect}")
-          render 'spree/api/promotions/handler', status: 422
+          render "spree/api/promotions/handler", status: 422
         end
       end
 

data/app/controllers/spree/api/customer_returns_controller.rb

@@ -22,11 +22,11 @@ module Spree
       def index
         authorize! :index, CustomerReturn
 
-        @customer_returns = @order.
-          customer_returns.
-          accessible_by(current_ability).
-          ransack(params[:q]).
-          result
+        @customer_returns = @order
+          .customer_returns
+          .accessible_by(current_ability)
+          .ransack(params[:q])
+          .result
 
         @customer_returns = paginate(@customer_returns)
 
@@ -66,17 +66,17 @@ module Spree
 
       def build_customer_return
         customer_return_attributes = customer_return_params
-        return_items_params = customer_return_attributes.
-          delete(:return_items_attributes)
+        return_items_params = customer_return_attributes
+          .delete(:return_items_attributes)
 
         @customer_return = CustomerReturn.new(customer_return_attributes)
 
         @customer_return.return_items = return_items_params.map do |item_params|
           return_item = if item_params[:id]
-                          Spree::ReturnItem.find(item_params[:id])
-                        else
-                          Spree::ReturnItem.new
-                        end
+            Spree::ReturnItem.find(item_params[:id])
+          else
+            Spree::ReturnItem.new
+          end
 
           return_item.assign_attributes(item_params)
 

data/app/controllers/spree/api/inventory_units_controller.rb

@@ -30,14 +30,14 @@ module Spree
       end
 
       def prepare_event
-        return unless @event = params[:fire]
+        return unless (@event = params[:fire])
 
         can_event = "can_#{@event}?"
 
         unless inventory_unit.respond_to?(can_event) &&
-               inventory_unit.send(can_event)
-          render json: { exception: "cannot transition to #{@event}" },
-                 status: 200
+            inventory_unit.send(can_event)
+          render json: {exception: "cannot transition to #{@event}"},
+            status: 200
           false
         end
       end

data/app/controllers/spree/api/line_items_controller.rb

@@ -55,16 +55,16 @@ module Spree
       end
 
       def line_items_attributes
-        { line_items_attributes: {
-            id: params[:id],
-            quantity: params[:line_item][:quantity],
-            options: line_item_params[:options] || {},
-            **extract_metadata
-        } }
+        {line_items_attributes: {
+          id: params[:id],
+          quantity: params[:line_item][:quantity],
+          options: line_item_params[:options] || {},
+          **extract_metadata
+        }}
       end
 
       def extract_metadata
-        metadata = { customer_metadata: line_item_params[:customer_metadata] }
+        metadata = {customer_metadata: line_item_params[:customer_metadata]}
 
         if current_user_roles&.include?("admin")
           metadata[:admin_metadata] = line_item_params[:admin_metadata]

data/app/controllers/spree/api/option_types_controller.rb

@@ -4,10 +4,10 @@ module Spree
   module Api
     class OptionTypesController < Spree::Api::BaseController
       def index
-        if params[:ids]
-          @option_types = Spree::OptionType.includes(:option_values).accessible_by(current_ability).where(id: params[:ids].split(','))
+        @option_types = if params[:ids]
+          Spree::OptionType.includes(:option_values).accessible_by(current_ability).where(id: params[:ids].split(","))
         else
-          @option_types = Spree::OptionType.includes(:option_values).accessible_by(current_ability).load.ransack(params[:q]).result
+          Spree::OptionType.includes(:option_values).accessible_by(current_ability).load.ransack(params[:q]).result
         end
         respond_with(@option_types)
       end

data/app/controllers/spree/api/option_values_controller.rb

@@ -4,10 +4,10 @@ module Spree
   module Api
     class OptionValuesController < Spree::Api::BaseController
       def index
-        if params[:ids]
-          @option_values = scope.where(id: params[:ids])
+        @option_values = if params[:ids]
+          scope.where(id: params[:ids])
         else
-          @option_values = scope.ransack(params[:q]).result.distinct
+          scope.ransack(params[:q]).result.distinct
         end
         respond_with(@option_values)
       end
@@ -45,10 +45,10 @@ module Spree
       private
 
       def scope
-        if params[:option_type_id]
-          @scope ||= Spree::OptionType.find(params[:option_type_id]).option_values.accessible_by(current_ability)
+        @scope ||= if params[:option_type_id]
+          Spree::OptionType.find(params[:option_type_id]).option_values.accessible_by(current_ability)
         else
-          @scope ||= Spree::OptionValue.accessible_by(current_ability).load
+          Spree::OptionValue.accessible_by(current_ability).load
         end
       end
 

data/app/controllers/spree/api/orders_controller.rb

@@ -11,6 +11,12 @@ module Spree
 
       class_attribute :admin_payment_attributes
       self.admin_payment_attributes = [:payment_method, :amount, :state, source: {}]
+      msg = "`Spree::Api::OrdersController.admin_payment_attributes` is deprecated."
+      deprecate(
+        admin_payment_attributes: msg,
+        "admin_payment_attributes=": msg,
+        deprecator: Spree.deprecator
+      )
 
       before_action :find_order, except: [:create, :mine, :current, :index]
       around_action :lock_order, except: [:create, :mine, :current, :index, :show]
@@ -58,7 +64,7 @@ module Spree
       def index
         authorize! :admin, Order
         orders_includes = [
-          { user: :store_credits },
+          {user: :store_credits},
           :line_items,
           :valid_store_credit_payments
         ]
@@ -91,8 +97,8 @@ module Spree
       end
 
       def current
-        if current_api_user && @order = current_api_user.last_incomplete_spree_order(store: current_store)
-          respond_with(@order, default_template: :show, locals: { root_object: @order })
+        if current_api_user && (@order = current_api_user.last_incomplete_spree_order(store: current_store))
+          respond_with(@order, default_template: :show, locals: {root_object: @order})
         else
           head :no_content
         end
@@ -122,7 +128,7 @@ module Spree
       def prevent_customer_metadata_update
         return unless @order&.completed? && cannot?(:admin, Spree::Order)
 
-        params[:order].delete(:customer_metadata) if params[:order]
+        params[:order]&.delete(:customer_metadata)
       end
 
       def normalize_params
@@ -149,7 +155,25 @@ module Spree
       end
 
       def permitted_order_attributes
-        can?(:admin, Spree::Order) ? (super + admin_order_attributes) : super
+        if can?(:admin, Spree::Order)
+          super + admin_order_attributes
+        else
+          # We need to remove the `:amount` attribute from payments_attributes
+          # for non-admin users. Unfortunately, order_attributes uses the
+          # checkout_payment_attributes instead of the payment_attributes, which
+          # needs to be able to set the amount.
+          #
+          # We're doing a deep_dup here to avoid modifying the original
+          # permitted attributes, which could have unintended side effects.
+          order_attributes = super.deep_dup
+
+          payments_attributes = order_attributes.find do |attribute|
+            attribute.is_a?(Hash) && attribute.has_key?(:payments_attributes)
+          end
+          payments_attributes[:payments_attributes] -= [:amount]
+
+          order_attributes
+        end
       end
 
       def permitted_shipment_attributes
@@ -161,6 +185,12 @@ module Spree
       end
 
       def permitted_payment_attributes
+        Spree.deprecator.warn(
+          "`Spree::Api::OrdersController#permitted_payment_attributes` is deprecated. " \
+          "This method was never actually used in this controller because " \
+          "permitted_order_attributes uses the permitted_checkout_payment_attributes " \
+          "method to determine the permitted attributes for payments."
+        )
         if can?(:admin, Spree::Payment)
           super + admin_payment_attributes
         else
@@ -169,13 +199,13 @@ module Spree
       end
 
       def find_order(_lock = false)
-        @order = Spree::Order.
-          includes(line_items: [:adjustments, { variant: :images }],
-                   payments: :payment_method,
-                   shipments: {
-                     shipping_rates: { shipping_method: :zones, taxes: :tax_rate }
-                   }).
-          find_by!(number: params[:id])
+        @order = Spree::Order
+          .includes(line_items: [:adjustments, {variant: :images}],
+            payments: :payment_method,
+            shipments: {
+              shipping_rates: {shipping_method: :zones, taxes: :tax_rate}
+            })
+          .find_by!(number: params[:id])
       end
 
       def order_id

data/app/controllers/spree/api/payments_controller.rb

@@ -3,6 +3,9 @@
 module Spree
   module Api
     class PaymentsController < Spree::Api::BaseController
+      class_attribute :admin_payment_attributes
+      self.admin_payment_attributes = [:amount]
+
       before_action :find_order
       around_action :lock_order, only: [:create, :update, :authorize, :capture, :purchase, :void]
       before_action :find_payment, only: [:update, :show, :authorize, :purchase, :capture, :void]
@@ -30,7 +33,7 @@ module Spree
       def update
         authorize! params[:action], @payment
         if !@payment.pending?
-          render 'update_forbidden', status: 403
+          render "update_forbidden", status: 403
         elsif @payment.update(payment_params)
           respond_with(@payment, default_template: :show)
         else
@@ -78,6 +81,14 @@ module Spree
       def payment_params
         params.require(:payment).permit(permitted_payment_attributes)
       end
+
+      def permitted_payment_attributes
+        if can?(:admin, Spree::Payment)
+          super + admin_payment_attributes
+        else
+          super
+        end
+      end
     end
   end
 end

data/app/controllers/spree/api/product_properties_controller.rb

@@ -7,11 +7,11 @@ module Spree
       before_action :product_property, only: [:show, :update, :destroy]
 
       def index
-        @product_properties = @product.
-          product_properties.
-          accessible_by(current_ability).
-          ransack(params[:q]).
-          result
+        @product_properties = @product
+          .product_properties
+          .accessible_by(current_ability)
+          .ransack(params[:q])
+          .result
 
         @product_properties = paginate(@product_properties)
 
@@ -60,7 +60,7 @@ module Spree
       def product_property
         if @product
           @product_property ||= @product.product_properties.find_by(id: params[:id])
-          @product_property ||= @product.product_properties.includes(:property).where(spree_properties: { name: params[:id] }).first!
+          @product_property ||= @product.product_properties.includes(:property).where(spree_properties: {name: params[:id]}).first!
           authorize! :show, @product_property
         end
       end

data/app/controllers/spree/api/products_controller.rb

@@ -12,17 +12,17 @@ module Spree
             :variants,
             :option_types,
             :product_properties,
-            { classifications: :taxon }
+            {classifications: :taxon}
           ]
           @products = product_scope
-                        .ransack(params[:q])
-                        .result
-                        .includes(products_includes)
+            .ransack(params[:q])
+            .result
+            .includes(products_includes)
         end
 
         @products = paginate(@products.distinct)
         expires_in 15.minutes, public: true
-        headers['Surrogate-Control'] = "max-age=#{15.minutes}"
+        headers["Surrogate-Control"] = "max-age=#{15.minutes}"
         respond_with(@products)
       end
 
@@ -32,8 +32,8 @@ module Spree
       def show
         @product = find_product(params[:id])
         expires_in 15.minutes, public: true
-        headers['Surrogate-Control'] = "max-age=#{15.minutes}"
-        headers['Surrogate-Key'] = "product_id=1"
+        headers["Surrogate-Control"] = "max-age=#{15.minutes}"
+        headers["Surrogate-Key"] = "product_id=1"
         respond_with(@product)
       end
 
@@ -75,7 +75,7 @@ module Spree
         params[:product][:available_on] ||= Time.current
         set_up_shipping_category
 
-        options = { variants_attrs: variants_params, options_attrs: option_types_params }
+        options = {variants_attrs: variants_params, options_attrs: option_types_params}
         @product = Core::Importer::Product.new(nil, product_params, options).create
 
         if @product.persisted?
@@ -89,7 +89,7 @@ module Spree
         @product = find_product(params[:id])
         authorize! :update, @product
 
-        options = { variants_attrs: variants_params, options_attrs: option_types_params }
+        options = {variants_attrs: variants_params, options_attrs: option_types_params}
         @product = Core::Importer::Product.new(@product, product_params, options).update
 
         if @product.errors.empty?
@@ -111,7 +111,7 @@ module Spree
       def product_params
         product_params = params.require(:product).permit(permitted_product_attributes)
         if product_params[:taxon_ids].present?
-          product_params[:taxon_ids] = product_params[:taxon_ids].split(',')
+          product_params[:taxon_ids] = product_params[:taxon_ids].split(",")
         end
         product_params
       end
@@ -133,7 +133,7 @@ module Spree
       end
 
       def set_up_shipping_category
-        if shipping_category = params[:product].delete(:shipping_category)
+        if (shipping_category = params[:product].delete(:shipping_category))
           id = Spree::ShippingCategory.find_or_create_by(name: shipping_category).id
           params[:product][:shipping_category_id] = id
         end

data/app/controllers/spree/api/return_authorizations_controller.rb

@@ -27,11 +27,11 @@ module Spree
       def index
         authorize! :admin, ReturnAuthorization
 
-        @return_authorizations = @order.
-          return_authorizations.
-          accessible_by(current_ability).
-          ransack(params[:q]).
-          result
+        @return_authorizations = @order
+          .return_authorizations
+          .accessible_by(current_ability)
+          .ransack(params[:q])
+          .result
 
         @return_authorizations = paginate(@return_authorizations)
 

data/app/controllers/spree/api/shipments_controller.rb

@@ -14,7 +14,7 @@ module Spree
           @shipments = Spree::Shipment
             .reverse_chronological
             .joins(:order)
-            .where(spree_orders: { user_id: current_api_user.id })
+            .where(spree_orders: {user_id: current_api_user.id})
             .includes(mine_includes)
             .ransack(params[:q]).result
 
@@ -57,7 +57,7 @@ module Spree
             @shipment.ready!
           else
             logger.error("cannot_ready_shipment shipment_state=#{@shipment.state}")
-            render('spree/api/shipments/cannot_ready_shipment', status: 422) && return
+            render("spree/api/shipments/cannot_ready_shipment", status: 422) && return
           end
         end
         respond_with(@shipment, default_template: :show)
@@ -66,7 +66,7 @@ module Spree
       def ship
         authorize! :ship, @shipment
         unless @shipment.shipped?
-          @shipment.suppress_mailer = (params[:send_mailer] == 'false')
+          @shipment.suppress_mailer = (params[:send_mailer] == "false")
           @shipment.ship!
         end
         respond_with(@shipment, default_template: :show)
@@ -75,7 +75,7 @@ module Spree
       def add
         quantity = params[:quantity].to_i
 
-        @shipment.order.contents.add(variant, quantity, { shipment: @shipment })
+        @shipment.order.contents.add(variant, quantity, {shipment: @shipment})
         respond_with(@shipment, default_template: :show)
       end
 
@@ -86,7 +86,7 @@ module Spree
           @shipment.errors.add(:base, :cannot_remove_items_shipment_state, state: @shipment.state)
           invalid_resource!(@shipment)
         else
-          @shipment.order.contents.remove(variant, quantity, { shipment: @shipment })
+          @shipment.order.contents.remove(variant, quantity, {shipment: @shipment})
           @shipment.reload if @shipment.persisted?
           respond_with(@shipment, default_template: :show)
         end
@@ -110,19 +110,19 @@ module Spree
         )
 
         if fulfilment_changer.run!
-          render json: { success: true, message: t('spree.api.shipment.transfer_success') }, status: :accepted
+          render json: {success: true, message: t("spree.api.shipment.transfer_success")}, status: :accepted
         else
-          render json: { success: false, message: fulfilment_changer.errors.full_messages.to_sentence }, status: :accepted
+          render json: {success: false, message: fulfilment_changer.errors.full_messages.to_sentence}, status: :accepted
         end
       end
 
       private
 
       def load_transfer_params
-        @original_shipment         = Spree::Shipment.find_by!(number: params[:original_shipment_number])
-        @order                     = @original_shipment.order
-        @variant                   = Spree::Variant.find(params[:variant_id])
-        @quantity                  = params[:quantity].to_i
+        @original_shipment = Spree::Shipment.find_by!(number: params[:original_shipment_number])
+        @order = @original_shipment.order
+        @variant = Spree::Variant.find(params[:variant_id])
+        @quantity = params[:quantity].to_i
         authorize! [:update, :destroy], @original_shipment
         authorize! :create, Shipment
       end