solidus_api 4.7.1 → 4.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92ccd1baa7331139315707fd902eeec5712a41d6563f713611c4c4c32beaff34
-  data.tar.gz: 2b93ffdf94c871ec54eaabda3c9c4b46e5108283e1d2aa99686dba426e811cf2
+  metadata.gz: eccdd48bcff16941d9551a3033ae485cc07f7d44c5c20261649d8d81d5075b68
+  data.tar.gz: 3eeb7c3954e19d82dc3ee4b55a1c860845f03e8f4d9f5a5cdab46940c7220469
 SHA512:
-  metadata.gz: d91812f69f054d0536f3bd0bc34a7c028ded3d4172917348d587fbeac25b2a5bb7e2eab28f38d6ae72f82a0a781137c4c53372005c876c42abaf6b115ba9a95f
-  data.tar.gz: 2eb2ce76ec4d4a9892f7fa3fd99691f81376cdb0580f8ca39c227ba2f7c394ddb25b14c7e1180cbe931ad0c7f8d5d4d297988b576eabe7f5ca2e70451bbbc920
+  metadata.gz: 66b961c53c70065c4aa9d9678bf6af6592f9e66faa0821cac2fa362761483cae12f436dfd9754cf0de42c79df1bc86b301010ff6d4e45c7f6e0ff55c4771996e
+  data.tar.gz: 754d8fae5afee560ce720c863c15a02d2f21d12f85a4bff6e1b07c86b3cd0549e5a57bf4e7fa003fb2853bd79e042f4b93843b3edc62d6e32c2031ac5dd3337c

data/app/controllers/spree/api/addresses_controller.rb

@@ -15,7 +15,7 @@ module Spree
         authorize! :update, @order, order_token
         find_address
 
-        success = @order.update({"#{@order_source}_attributes" => address_params})
+        success = @order.contents.update_cart({"#{@order_source}_attributes" => address_params})
         @address = @order.send(@order_source)
 
         if success

data/app/controllers/spree/api/checkouts_controller.rb

@@ -105,10 +105,20 @@ module Spree
       end
 
       def update_order_state
-        @order.state = params[:state] if params[:state]
+        return unless params[:state]
+
+        unless Spree::Api::Config.allow_arbitrary_state_in_checkout || valid_checkout_step?(params[:state])
+          return respond_with(@order, default_template: "spree/api/orders/invalid_state", status: 422)
+        end
+
+        @order.state = params[:state]
         state_callback(:before)
       end
 
+      def valid_checkout_step?(step)
+        @order.passed_checkout_step?(step) || @order.state == step
+      end
+
       def state_callback(before_or_after = :before)
         method_name = :"#{before_or_after}_#{@order.state}"
         send(method_name) if respond_to?(method_name, true)

data/app/controllers/spree/api/orders_controller.rb

@@ -119,6 +119,7 @@ module Spree
         if params[:order]
           normalize_params
           prevent_customer_metadata_update
+          prevent_line_item_variant_update
           params.require(:order).permit(permitted_order_attributes)
         else
           {}
@@ -131,6 +132,16 @@ module Spree
         params[:order]&.delete(:customer_metadata)
       end
 
+      def prevent_line_item_variant_update
+        line_items_attributes = params[:order][:line_items_attributes]
+        return unless line_items_attributes
+
+        line_items_attributes = line_items_attributes.values unless line_items_attributes.is_a?(Array)
+        line_items_attributes.each do |line_item_attributes|
+          line_item_attributes.delete(:variant_id) if line_item_attributes[:id].present?
+        end
+      end
+
       def normalize_params
         if params[:order][:payments]
           payments_params = params[:order].delete(:payments)

data/app/controllers/spree/api/products_controller.rb

@@ -21,8 +21,7 @@ module Spree
         end
 
         @products = paginate(@products.distinct)
-        expires_in 15.minutes, public: true
-        headers["Surrogate-Control"] = "max-age=#{15.minutes}"
+        set_cache_headers
         respond_with(@products)
       end
 
@@ -31,9 +30,7 @@ module Spree
 
       def show
         @product = find_product(params[:id])
-        expires_in 15.minutes, public: true
-        headers["Surrogate-Control"] = "max-age=#{15.minutes}"
-        headers["Surrogate-Key"] = "product_id=1"
+        set_cache_headers(surrogate_key: "product_id=#{@product.id}")
         respond_with(@product)
       end
 
@@ -108,6 +105,14 @@ module Spree
 
       private
 
+      def set_cache_headers(surrogate_key: nil)
+        return if current_api_user
+
+        expires_in 15.minutes, public: true
+        headers["Surrogate-Control"] = "max-age=#{15.minutes}"
+        headers["Surrogate-Key"] = surrogate_key if surrogate_key
+      end
+
       def product_params
         product_params = params.require(:product).permit(permitted_product_attributes)
         if product_params[:taxon_ids].present?

data/app/controllers/spree/api/shipments_controller.rb

@@ -99,7 +99,10 @@ module Spree
       end
 
       def transfer_to_shipment
-        @desired_shipment ||= Spree::Shipment.find_by!(number: params[:target_shipment_number])
+        unless @desired_shipment
+          @desired_shipment = @original_shipment.order.shipments.find_by!(number: params[:target_shipment_number])
+          authorize! :update, @desired_shipment
+        end
 
         fulfilment_changer = Spree::FulfilmentChanger.new(
           current_shipment: @original_shipment,

data/app/controllers/spree/api/users_controller.rb

@@ -80,10 +80,16 @@ class Spree::Api::UsersController < Spree::Api::BaseController
   end
 
   def permitted_user_attributes
+    attributes = super
+
     if action_name == "create" || can?(:update_email, @user)
-      super | [:email]
-    else
-      super
+      attributes |= [:email]
     end
+
+    unless action_name == "create" || @user == current_api_user || can?(:update_password, @user)
+      attributes -= [:password, :password_confirmation]
+    end
+
+    attributes
   end
 end

data/app/views/spree/api/line_items/_line_item.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, line_item] do
+json.cache! [I18n.locale, line_item, line_item_attributes, variant_attributes] do
   json.call(line_item, *line_item_attributes)
   json.single_display_amount(line_item.single_display_amount.to_s)
   json.display_amount(line_item.display_amount.to_s)

data/app/views/spree/api/orders/_order.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, order] do
+json.cache! [I18n.locale, order, order_attributes] do
   json.call(order, *order_attributes)
   json.display_item_total(order.display_item_total.to_s)
   json.total_quantity(order.line_items.to_a.sum(&:quantity))

data/app/views/spree/api/orders/invalid_state.json.jbuilder

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.errors(state: [I18n.t(:invalid_state, scope: "spree.api.order")])

data/app/views/spree/api/shipments/_big.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, shipment] do
+json.cache! [I18n.locale, shipment, shipment_attributes, line_item_attributes, order_attributes, variant_attributes] do
   json.call(shipment, *shipment_attributes)
   json.partial!("spree/api/shipments/small", shipment:)
   json.inventory_units(shipment.inventory_units) do |inventory_unit|

data/app/views/spree/api/shipments/_small.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, shipment] do
+json.cache! [I18n.locale, shipment, shipment_attributes] do
   json.call(shipment, *shipment_attributes)
   json.order_id(shipment.order.number)
   json.stock_location_name(shipment.stock_location.name)

data/app/views/spree/api/shipments/show.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, @shipment] do
+json.cache! [I18n.locale, @shipment, shipment_attributes, variant_attributes] do
   json.call(@shipment, *shipment_attributes)
   json.order_id(@shipment.order.number)
   json.stock_location_name(@shipment.stock_location.name)

data/app/views/spree/api/variants/_big.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, Spree::StockLocation.accessible_by(current_ability), variant] do
+json.cache! [I18n.locale, Spree::StockLocation.accessible_by(current_ability), variant, variant_attributes] do
   json.call(variant, *variant_attributes)
   json.partial!("spree/api/variants/small", variant:)
   json.variant_properties(variant.variant_properties) do |variant_property|

data/app/views/spree/api/variants/_small.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, current_pricing_options, variant] do
+json.cache! [I18n.locale, current_pricing_options, variant, variant_attributes] do
   json.call(variant, *variant_attributes)
   json.price(variant.price_for_options(current_pricing_options)&.amount)
   json.display_price(variant.price_for_options(current_pricing_options)&.money&.to_s)

data/config/locales/en.yml

@@ -12,6 +12,7 @@ en:
       order:
         expected_total_mismatch: Expected total does not match actual total.
         invalid_shipping_method: Invalid shipping method specified.
+        invalid_state: Invalid state specified.
         quantity_is_not_available: Quantity is not available for items in your order
       payment:
         credit_over_limit: This payment can only be credited up to %{limit}. Please specify an amount less than or equal to this number.

data/lib/spree/api_configuration.rb

@@ -2,6 +2,10 @@
 
 module Spree
   class ApiConfiguration < Preferences::Configuration
+    # @!attribute [rw] allow_arbitrary_state_in_api
+    #  @return [Boolean] When true, the API will allow arbitrary state transitions on orders (default: +false+)
+    preference :allow_arbitrary_state_in_checkout, :boolean, default: false
+
     preference :requires_authentication, :boolean, default: true
 
     preference :product_attributes, :array, default: [

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_api
 version: !ruby/object:Gem::Version
-  version: 4.7.1
+  version: 4.7.3
 platform: ruby
 authors:
 - Solidus Team
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.1
+        version: 4.7.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.1
+        version: 4.7.3
 description: REST API for the Solidus e-commerce framework.
 email: contact@solidus.io
 executables: []
@@ -152,6 +152,7 @@ files:
 - app/views/spree/api/orders/expected_total_mismatch.json.jbuilder
 - app/views/spree/api/orders/index.json.jbuilder
 - app/views/spree/api/orders/invalid_shipping_method.json.jbuilder
+- app/views/spree/api/orders/invalid_state.json.jbuilder
 - app/views/spree/api/orders/mine.json.jbuilder
 - app/views/spree/api/orders/show.json.jbuilder
 - app/views/spree/api/payments/credit_over_limit.json.jbuilder