solidus_api 4.7.1 → 4.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92ccd1baa7331139315707fd902eeec5712a41d6563f713611c4c4c32beaff34
-  data.tar.gz: 2b93ffdf94c871ec54eaabda3c9c4b46e5108283e1d2aa99686dba426e811cf2
+  metadata.gz: f4ff5000b131bd3d2fce8bc9e81165d860447f4c5a94d5364852af656fa4de8d
+  data.tar.gz: b46b662948606c65253e766a0b207ea00ad473aa217811b70a0d4bdee2c69c8a
 SHA512:
-  metadata.gz: d91812f69f054d0536f3bd0bc34a7c028ded3d4172917348d587fbeac25b2a5bb7e2eab28f38d6ae72f82a0a781137c4c53372005c876c42abaf6b115ba9a95f
-  data.tar.gz: 2eb2ce76ec4d4a9892f7fa3fd99691f81376cdb0580f8ca39c227ba2f7c394ddb25b14c7e1180cbe931ad0c7f8d5d4d297988b576eabe7f5ca2e70451bbbc920
+  metadata.gz: 8519bddff6d7f9b5dc478d19a1ef09b7f68473a89f94ab044c5c45e462bf93e72986888f2a6e5bc2dd0075f43d41330da07e0e9ba6955f751720f24a61fffbed
+  data.tar.gz: d0ee7c6a4d2584a00bbeb88e8442c3d6985e1c6f66590007458744cd3f11a2a9bbe9a06b88eddcba449dd7cf0d8fa239e513380ae9df3466fffb0726c8391ca1

data/LICENSE

@@ -1,6 +1,9 @@
 Copyright (c) 2007-2014, Spree Commerce, Inc. and other contributors
 All rights reserved.
 
+Copyright (c) 2015-2026, Solidus contributors
+All rights reserved.
+
 Redistribution and use in source and binary forms, with or without modification,
 are permitted provided that the following conditions are met:
 

data/app/controllers/spree/api/base_controller.rb

@@ -7,7 +7,7 @@ module Spree
     class BaseController < ActionController::Base
       self.responder = Spree::Api::Responders::AppResponder
       respond_to :json
-      protect_from_forgery unless: -> { request.format.json? }
+      protect_from_forgery with: :exception, unless: -> { request.format.json? }
 
       include CanCan::ControllerAdditions
       include ActiveStorage::SetCurrent
@@ -122,7 +122,7 @@ module Spree
       end
 
       def requires_authentication?
-        Spree::Api::Config[:requires_authentication]
+        Spree::Api::Config.requires_authentication
       end
 
       def not_found

data/app/controllers/spree/api/checkouts_controller.rb

@@ -42,10 +42,12 @@ module Spree
       def update
         authorize! :update, @order, order_token
 
+        if can?(:admin, @order) && user_id.present?
+          user = Spree.user_class.accessible_by(current_ability, :show).find(user_id)
+        end
+
         if Spree::Config.order_update_attributes_class.new(@order, update_params, request_env: request.headers.env).call
-          if can?(:admin, @order) && user_id.present?
-            @order.associate_user!(Spree.user_class.find(user_id))
-          end
+          @order.associate_user!(user) if user
 
           return if after_update_attributes
 
@@ -105,10 +107,20 @@ module Spree
       end
 
       def update_order_state
-        @order.state = params[:state] if params[:state]
+        return unless params[:state]
+
+        unless Spree::Api::Config.allow_arbitrary_state_in_checkout || valid_checkout_step?(params[:state])
+          return respond_with(@order, default_template: "spree/api/orders/invalid_state", status: 422)
+        end
+
+        @order.state = params[:state]
         state_callback(:before)
       end
 
+      def valid_checkout_step?(step)
+        @order.passed_checkout_step?(step) || @order.state == step
+      end
+
       def state_callback(before_or_after = :before)
         method_name = :"#{before_or_after}_#{@order.state}"
         send(method_name) if respond_to?(method_name, true)

data/app/controllers/spree/api/orders_controller.rb

@@ -85,11 +85,13 @@ module Spree
       def update
         authorize! :update, @order, order_token
 
+        user_id = params[:order][:user_id]
+        if can?(:admin, @order) && user_id
+          user = Spree.user_class.accessible_by(current_ability, :show).find(user_id)
+        end
+
         if @order.contents.update_cart(order_params)
-          user_id = params[:order][:user_id]
-          if can?(:admin, @order) && user_id
-            @order.associate_user!(Spree.user_class.find(user_id))
-          end
+          @order.associate_user!(user) if user
           respond_with(@order, default_template: :show)
         else
           invalid_resource!(@order)
@@ -148,7 +150,7 @@ module Spree
       # @api public
       def determine_order_user
         if order_params[:user_id].present?
-          Spree.user_class.find(order_params[:user_id])
+          Spree.user_class.accessible_by(current_ability, :show).find(order_params[:user_id])
         else
           current_api_user
         end

data/app/controllers/spree/api/products_controller.rb

@@ -8,18 +8,12 @@ module Spree
           ids = params[:ids].split(",").flatten
           @products = product_scope.where(id: ids)
         else
-          products_includes = [
-            :variants,
-            :option_types,
-            :product_properties,
-            {classifications: :taxon}
-          ]
           @products = product_scope
             .ransack(params[:q])
             .result
-            .includes(products_includes)
         end
 
+        @products = @products.includes(products_includes)
         @products = paginate(@products.distinct)
         expires_in 15.minutes, public: true
         headers["Surrogate-Control"] = "max-age=#{15.minutes}"
@@ -108,6 +102,19 @@ module Spree
 
       private
 
+      def products_includes
+        [
+          :option_types,
+          :product_properties,
+          {classifications: :taxon},
+          {master: variants_includes},
+          {variants: variants_includes},
+          {variants_including_master: variants_includes}
+        ]
+      end
+
+      def variants_includes = {stock_items: :stock_location, images: Spree::Image.attachment_preloads}
+
       def product_params
         product_params = params.require(:product).permit(permitted_product_attributes)
         if product_params[:taxon_ids].present?

data/app/controllers/spree/api/shipments_controller.rb

@@ -93,7 +93,7 @@ module Spree
       end
 
       def transfer_to_location
-        @desired_stock_location = Spree::StockLocation.find(params[:stock_location_id])
+        @desired_stock_location = Spree::StockLocation.accessible_by(current_ability, :show).find(params[:stock_location_id])
         @desired_shipment = @original_shipment.order.shipments.build(stock_location: @desired_stock_location)
         transfer_to_shipment
       end

data/app/controllers/spree/api/stock_movements_controller.rb

@@ -34,6 +34,7 @@ module Spree
 
       def scope
         @stock_location.stock_movements.accessible_by(current_ability)
+          .includes(stock_item: {variant: [:product, :prices, :stock_items, :images, {option_values: :option_type}]})
       end
 
       def stock_movement_params

data/app/controllers/spree/api/users_controller.rb

@@ -5,6 +5,7 @@ class Spree::Api::UsersController < Spree::Api::BaseController
 
   def index
     user_scope = user_class.accessible_by(current_ability, :show)
+      .includes(bill_address: [:state, :country], ship_address: [:state, :country])
     if params[:ids]
       ids = params[:ids].split(",").flatten
       @users = user_scope.where(id: ids)
@@ -80,10 +81,16 @@ class Spree::Api::UsersController < Spree::Api::BaseController
   end
 
   def permitted_user_attributes
+    attributes = super
+
     if action_name == "create" || can?(:update_email, @user)
-      super | [:email]
-    else
-      super
+      attributes |= [:email]
     end
+
+    unless action_name == "create" || @user == current_api_user || can?(:update_password, @user)
+      attributes -= [:password, :password_confirmation]
+    end
+
+    attributes
   end
 end

data/app/controllers/spree/api/variants_controller.rb

@@ -89,8 +89,16 @@ module Spree
       end
 
       def include_list
-        [{option_values: :option_type}, :product, :prices, :images, {stock_items: :stock_location}]
+        [
+          {option_values: :option_type},
+          {product: {master: images_includes}},
+          :prices,
+          images_includes,
+          {stock_items: :stock_location}
+        ]
       end
+
+      def images_includes = {images: Spree::Image.attachment_preloads}
     end
   end
 end

data/app/views/spree/api/config/money.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.symbol(::Money.new(1, Spree::Config[:currency]).symbol)
+json.symbol(::Money.new(1, Spree::Config.currency).symbol)

data/app/views/spree/api/config/show.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.default_country_iso(Spree::Config[:default_country_iso])
+json.default_country_iso(Spree::Config.default_country_iso)

data/app/views/spree/api/orders/invalid_state.json.jbuilder

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+json.errors(state: [I18n.t(:invalid_state, scope: "spree.api.order")])

data/app/views/spree/api/stores/_store.json.jbuilder

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+json.call(store, *store_attributes)
+json.address do
+  if store.address
+    json.partial!("spree/api/addresses/address", address: store.address)
+  else
+    json.nil!
+  end
+end

data/app/views/spree/api/stores/index.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.stores(@stores) { |store| json.call(store, *store_attributes) }
+json.stores(@stores) { |store| json.partial!("spree/api/stores/store", store:) }

data/app/views/spree/api/stores/show.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.call(@store, *store_attributes)
+json.partial!("spree/api/stores/store", store: @store)

data/app/views/spree/api/variants/_big.json.jbuilder

@@ -6,7 +6,7 @@ json.cache! [I18n.locale, Spree::StockLocation.accessible_by(current_ability), v
   json.variant_properties(variant.variant_properties) do |variant_property|
     json.call(variant_property, *variant_property_attributes)
   end
-  json.stock_items(variant.stock_items.accessible_by(current_ability)) do |stock_item|
+  json.stock_items(variant.stock_items.select { can?(:read, _1) }) do |stock_item|
     json.call(stock_item, :id, :count_on_hand, :stock_location_id, :backorderable)
     json.available stock_item.available?
     json.stock_location_name(stock_item.stock_location.name)

data/config/locales/en.yml

@@ -12,6 +12,7 @@ en:
       order:
         expected_total_mismatch: Expected total does not match actual total.
         invalid_shipping_method: Invalid shipping method specified.
+        invalid_state: Invalid state specified.
         quantity_is_not_available: Quantity is not available for items in your order
       payment:
         credit_over_limit: This payment can only be credited up to %{limit}. Please specify an amount less than or equal to this number.

data/lib/spree/api.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "kaminari/activerecord"
 require "spree/core"
 
 require "spree/api/engine"

data/lib/spree/api_configuration.rb

@@ -2,6 +2,10 @@
 
 module Spree
   class ApiConfiguration < Preferences::Configuration
+    # @!attribute [rw] allow_arbitrary_state_in_api
+    #  @return [Boolean] When true, the API will allow arbitrary state transitions on orders (default: +false+)
+    preference :allow_arbitrary_state_in_checkout, :boolean, default: false
+
     preference :requires_authentication, :boolean, default: true
 
     preference :product_attributes, :array, default: [

data/openapi/solidus-api.oas.yml

@@ -6474,6 +6474,8 @@ components:
           type: string
         url:
           type: string
+        address:
+          $ref: '#/components/schemas/address'
     taxonomy:
       type: object
       properties:
@@ -6955,6 +6957,8 @@ components:
           type: string
         cart_tax_country_iso:
           type: string
+        address_attributes:
+          $ref: '#/components/schemas/address-input'
     taxonomy-input:
       type: object
       title: Taxonomy input

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_api
 version: !ruby/object:Gem::Version
-  version: 4.7.1
+  version: 4.8.0
 platform: ruby
 authors:
 - Solidus Team
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.1
+        version: 4.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.1
+        version: 4.8.0
 description: REST API for the Solidus e-commerce framework.
 email: contact@solidus.io
 executables: []
@@ -152,6 +152,7 @@ files:
 - app/views/spree/api/orders/expected_total_mismatch.json.jbuilder
 - app/views/spree/api/orders/index.json.jbuilder
 - app/views/spree/api/orders/invalid_shipping_method.json.jbuilder
+- app/views/spree/api/orders/invalid_state.json.jbuilder
 - app/views/spree/api/orders/mine.json.jbuilder
 - app/views/spree/api/orders/show.json.jbuilder
 - app/views/spree/api/payments/credit_over_limit.json.jbuilder
@@ -197,6 +198,7 @@ files:
 - app/views/spree/api/stock_movements/index.json.jbuilder
 - app/views/spree/api/stock_movements/show.json.jbuilder
 - app/views/spree/api/store_credit_events/mine.json.jbuilder
+- app/views/spree/api/stores/_store.json.jbuilder
 - app/views/spree/api/stores/index.json.jbuilder
 - app/views/spree/api/stores/show.json.jbuilder
 - app/views/spree/api/taxonomies/_nested.json.jbuilder
@@ -270,7 +272,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.8.23
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: REST API for the Solidus e-commerce framework.
 test_files: []