solidus_api 4.7.0 → 4.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b3b5709205727d156db5fe2eab1630cf75936dcb112d1efc18d53b22420e222
-  data.tar.gz: 73a8d9ac7878bc327954083e3589d8e9a7c43d93574999f171ca6ec993fea6da
+  metadata.gz: a09ac9341a0721a7b5cd1ee955557b6659e0baa689adcd3abfc0b73b6e96cfc0
+  data.tar.gz: 473737cd41360507d3d6eacffcbf64d6dffb65d05c8d3d6b85b934ebcc2a1137
 SHA512:
-  metadata.gz: 1fa69f967c9233e7e3f8685bc5f95ce79349d71eae0479ea4273394a3c9d640d593949cc01c59fbce3d1c1c05c096dfaa9062a3145706644f3387e0155fd9e20
-  data.tar.gz: e8e38fe6122c2414df31f7f27e0252bc2fe3fd32f42bf24bdde674470e7c7fe9f317f9be86beba8a316b4546818cff1c3545c941ce848f5aaf9b004d519979ec
+  metadata.gz: ed264bfc8321d2072db352b6820fbbcee2c72918f500279e940fe7f11ff329442baf4c657eb7ddf67870fd44eeb7966044cf55033f032d29ecb1516d14d5dd6d
+  data.tar.gz: 6f220657fb6b51d027586734957b61ae6e8b22f68acfc9637a7c983ce56f5b6e0684e4ad5e6b893b62472430c8f99dac15930b0826dd7869f1c4baf29a7929b0

data/app/controllers/spree/api/checkouts_controller.rb

@@ -105,10 +105,20 @@ module Spree
       end
 
       def update_order_state
-        @order.state = params[:state] if params[:state]
+        return unless params[:state]
+
+        unless Spree::Api::Config.allow_arbitrary_state_in_checkout || valid_checkout_step?(params[:state])
+          return respond_with(@order, default_template: "spree/api/orders/invalid_state", status: 422)
+        end
+
+        @order.state = params[:state]
         state_callback(:before)
       end
 
+      def valid_checkout_step?(step)
+        @order.passed_checkout_step?(step) || @order.state == step
+      end
+
       def state_callback(before_or_after = :before)
         method_name = :"#{before_or_after}_#{@order.state}"
         send(method_name) if respond_to?(method_name, true)

data/app/controllers/spree/api/orders_controller.rb

@@ -11,6 +11,12 @@ module Spree
 
       class_attribute :admin_payment_attributes
       self.admin_payment_attributes = [:payment_method, :amount, :state, source: {}]
+      msg = "`Spree::Api::OrdersController.admin_payment_attributes` is deprecated."
+      deprecate(
+        admin_payment_attributes: msg,
+        "admin_payment_attributes=": msg,
+        deprecator: Spree.deprecator
+      )
 
       before_action :find_order, except: [:create, :mine, :current, :index]
       around_action :lock_order, except: [:create, :mine, :current, :index, :show]
@@ -149,7 +155,25 @@ module Spree
       end
 
       def permitted_order_attributes
-        can?(:admin, Spree::Order) ? (super + admin_order_attributes) : super
+        if can?(:admin, Spree::Order)
+          super + admin_order_attributes
+        else
+          # We need to remove the `:amount` attribute from payments_attributes
+          # for non-admin users. Unfortunately, order_attributes uses the
+          # checkout_payment_attributes instead of the payment_attributes, which
+          # needs to be able to set the amount.
+          #
+          # We're doing a deep_dup here to avoid modifying the original
+          # permitted attributes, which could have unintended side effects.
+          order_attributes = super.deep_dup
+
+          payments_attributes = order_attributes.find do |attribute|
+            attribute.is_a?(Hash) && attribute.has_key?(:payments_attributes)
+          end
+          payments_attributes[:payments_attributes] -= [:amount]
+
+          order_attributes
+        end
       end
 
       def permitted_shipment_attributes
@@ -161,6 +185,12 @@ module Spree
       end
 
       def permitted_payment_attributes
+        Spree.deprecator.warn(
+          "`Spree::Api::OrdersController#permitted_payment_attributes` is deprecated. " \
+          "This method was never actually used in this controller because " \
+          "permitted_order_attributes uses the permitted_checkout_payment_attributes " \
+          "method to determine the permitted attributes for payments."
+        )
         if can?(:admin, Spree::Payment)
           super + admin_payment_attributes
         else

data/app/controllers/spree/api/payments_controller.rb

@@ -3,6 +3,9 @@
 module Spree
   module Api
     class PaymentsController < Spree::Api::BaseController
+      class_attribute :admin_payment_attributes
+      self.admin_payment_attributes = [:amount]
+
       before_action :find_order
       around_action :lock_order, only: [:create, :update, :authorize, :capture, :purchase, :void]
       before_action :find_payment, only: [:update, :show, :authorize, :purchase, :capture, :void]
@@ -78,6 +81,14 @@ module Spree
       def payment_params
         params.require(:payment).permit(permitted_payment_attributes)
       end
+
+      def permitted_payment_attributes
+        if can?(:admin, Spree::Payment)
+          super + admin_payment_attributes
+        else
+          super
+        end
+      end
     end
   end
 end

data/app/controllers/spree/api/users_controller.rb

@@ -80,10 +80,16 @@ class Spree::Api::UsersController < Spree::Api::BaseController
   end
 
   def permitted_user_attributes
+    attributes = super
+
     if action_name == "create" || can?(:update_email, @user)
-      super | [:email]
-    else
-      super
+      attributes |= [:email]
     end
+
+    unless action_name == "create" || @user == current_api_user || can?(:update_password, @user)
+      attributes -= [:password, :password_confirmation]
+    end
+
+    attributes
   end
 end

data/app/views/spree/api/orders/invalid_state.json.jbuilder

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.errors(state: [I18n.t(:invalid_state, scope: "spree.api.order")])

data/config/locales/en.yml

@@ -12,6 +12,7 @@ en:
       order:
         expected_total_mismatch: Expected total does not match actual total.
         invalid_shipping_method: Invalid shipping method specified.
+        invalid_state: Invalid state specified.
         quantity_is_not_available: Quantity is not available for items in your order
       payment:
         credit_over_limit: This payment can only be credited up to %{limit}. Please specify an amount less than or equal to this number.

data/lib/spree/api_configuration.rb

@@ -2,6 +2,10 @@
 
 module Spree
   class ApiConfiguration < Preferences::Configuration
+    # @!attribute [rw] allow_arbitrary_state_in_api
+    #  @return [Boolean] When true, the API will allow arbitrary state transitions on orders (default: +false+)
+    preference :allow_arbitrary_state_in_checkout, :boolean, default: false
+
     preference :requires_authentication, :boolean, default: true
 
     preference :product_attributes, :array, default: [

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: solidus_api
 version: !ruby/object:Gem::Version
-  version: 4.7.0
+  version: 4.7.2
 platform: ruby
 authors:
 - Solidus Team
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-15 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jbuilder
@@ -58,14 +57,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.0
+        version: 4.7.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.0
+        version: 4.7.2
 description: REST API for the Solidus e-commerce framework.
 email: contact@solidus.io
 executables: []
@@ -153,6 +152,7 @@ files:
 - app/views/spree/api/orders/expected_total_mismatch.json.jbuilder
 - app/views/spree/api/orders/index.json.jbuilder
 - app/views/spree/api/orders/invalid_shipping_method.json.jbuilder
+- app/views/spree/api/orders/invalid_state.json.jbuilder
 - app/views/spree/api/orders/mine.json.jbuilder
 - app/views/spree/api/orders/show.json.jbuilder
 - app/views/spree/api/payments/credit_over_limit.json.jbuilder
@@ -257,7 +257,6 @@ licenses:
 - BSD-3-Clause
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -272,8 +271,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.8.23
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 4.0.10
 specification_version: 4
 summary: REST API for the Solidus e-commerce framework.
 test_files: []