solidus_api 4.7.1 → 4.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92ccd1baa7331139315707fd902eeec5712a41d6563f713611c4c4c32beaff34
-  data.tar.gz: 2b93ffdf94c871ec54eaabda3c9c4b46e5108283e1d2aa99686dba426e811cf2
+  metadata.gz: a09ac9341a0721a7b5cd1ee955557b6659e0baa689adcd3abfc0b73b6e96cfc0
+  data.tar.gz: 473737cd41360507d3d6eacffcbf64d6dffb65d05c8d3d6b85b934ebcc2a1137
 SHA512:
-  metadata.gz: d91812f69f054d0536f3bd0bc34a7c028ded3d4172917348d587fbeac25b2a5bb7e2eab28f38d6ae72f82a0a781137c4c53372005c876c42abaf6b115ba9a95f
-  data.tar.gz: 2eb2ce76ec4d4a9892f7fa3fd99691f81376cdb0580f8ca39c227ba2f7c394ddb25b14c7e1180cbe931ad0c7f8d5d4d297988b576eabe7f5ca2e70451bbbc920
+  metadata.gz: ed264bfc8321d2072db352b6820fbbcee2c72918f500279e940fe7f11ff329442baf4c657eb7ddf67870fd44eeb7966044cf55033f032d29ecb1516d14d5dd6d
+  data.tar.gz: 6f220657fb6b51d027586734957b61ae6e8b22f68acfc9637a7c983ce56f5b6e0684e4ad5e6b893b62472430c8f99dac15930b0826dd7869f1c4baf29a7929b0

data/app/controllers/spree/api/checkouts_controller.rb

@@ -105,10 +105,20 @@ module Spree
       end
 
       def update_order_state
-        @order.state = params[:state] if params[:state]
+        return unless params[:state]
+
+        unless Spree::Api::Config.allow_arbitrary_state_in_checkout || valid_checkout_step?(params[:state])
+          return respond_with(@order, default_template: "spree/api/orders/invalid_state", status: 422)
+        end
+
+        @order.state = params[:state]
         state_callback(:before)
       end
 
+      def valid_checkout_step?(step)
+        @order.passed_checkout_step?(step) || @order.state == step
+      end
+
       def state_callback(before_or_after = :before)
         method_name = :"#{before_or_after}_#{@order.state}"
         send(method_name) if respond_to?(method_name, true)

data/app/controllers/spree/api/users_controller.rb

@@ -80,10 +80,16 @@ class Spree::Api::UsersController < Spree::Api::BaseController
   end
 
   def permitted_user_attributes
+    attributes = super
+
     if action_name == "create" || can?(:update_email, @user)
-      super | [:email]
-    else
-      super
+      attributes |= [:email]
     end
+
+    unless action_name == "create" || @user == current_api_user || can?(:update_password, @user)
+      attributes -= [:password, :password_confirmation]
+    end
+
+    attributes
   end
 end

data/app/views/spree/api/orders/invalid_state.json.jbuilder

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.errors(state: [I18n.t(:invalid_state, scope: "spree.api.order")])

data/config/locales/en.yml

@@ -12,6 +12,7 @@ en:
       order:
         expected_total_mismatch: Expected total does not match actual total.
         invalid_shipping_method: Invalid shipping method specified.
+        invalid_state: Invalid state specified.
         quantity_is_not_available: Quantity is not available for items in your order
       payment:
         credit_over_limit: This payment can only be credited up to %{limit}. Please specify an amount less than or equal to this number.

data/lib/spree/api_configuration.rb

@@ -2,6 +2,10 @@
 
 module Spree
   class ApiConfiguration < Preferences::Configuration
+    # @!attribute [rw] allow_arbitrary_state_in_api
+    #  @return [Boolean] When true, the API will allow arbitrary state transitions on orders (default: +false+)
+    preference :allow_arbitrary_state_in_checkout, :boolean, default: false
+
     preference :requires_authentication, :boolean, default: true
 
     preference :product_attributes, :array, default: [

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_api
 version: !ruby/object:Gem::Version
-  version: 4.7.1
+  version: 4.7.2
 platform: ruby
 authors:
 - Solidus Team
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.1
+        version: 4.7.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.1
+        version: 4.7.2
 description: REST API for the Solidus e-commerce framework.
 email: contact@solidus.io
 executables: []
@@ -152,6 +152,7 @@ files:
 - app/views/spree/api/orders/expected_total_mismatch.json.jbuilder
 - app/views/spree/api/orders/index.json.jbuilder
 - app/views/spree/api/orders/invalid_shipping_method.json.jbuilder
+- app/views/spree/api/orders/invalid_state.json.jbuilder
 - app/views/spree/api/orders/mine.json.jbuilder
 - app/views/spree/api/orders/show.json.jbuilder
 - app/views/spree/api/payments/credit_over_limit.json.jbuilder