solidus_api 4.7.2 → 4.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a09ac9341a0721a7b5cd1ee955557b6659e0baa689adcd3abfc0b73b6e96cfc0
-  data.tar.gz: 473737cd41360507d3d6eacffcbf64d6dffb65d05c8d3d6b85b934ebcc2a1137
+  metadata.gz: f4ff5000b131bd3d2fce8bc9e81165d860447f4c5a94d5364852af656fa4de8d
+  data.tar.gz: b46b662948606c65253e766a0b207ea00ad473aa217811b70a0d4bdee2c69c8a
 SHA512:
-  metadata.gz: ed264bfc8321d2072db352b6820fbbcee2c72918f500279e940fe7f11ff329442baf4c657eb7ddf67870fd44eeb7966044cf55033f032d29ecb1516d14d5dd6d
-  data.tar.gz: 6f220657fb6b51d027586734957b61ae6e8b22f68acfc9637a7c983ce56f5b6e0684e4ad5e6b893b62472430c8f99dac15930b0826dd7869f1c4baf29a7929b0
+  metadata.gz: 8519bddff6d7f9b5dc478d19a1ef09b7f68473a89f94ab044c5c45e462bf93e72986888f2a6e5bc2dd0075f43d41330da07e0e9ba6955f751720f24a61fffbed
+  data.tar.gz: d0ee7c6a4d2584a00bbeb88e8442c3d6985e1c6f66590007458744cd3f11a2a9bbe9a06b88eddcba449dd7cf0d8fa239e513380ae9df3466fffb0726c8391ca1

data/LICENSE

@@ -1,6 +1,9 @@
 Copyright (c) 2007-2014, Spree Commerce, Inc. and other contributors
 All rights reserved.
 
+Copyright (c) 2015-2026, Solidus contributors
+All rights reserved.
+
 Redistribution and use in source and binary forms, with or without modification,
 are permitted provided that the following conditions are met:
 

data/app/controllers/spree/api/base_controller.rb

@@ -7,7 +7,7 @@ module Spree
     class BaseController < ActionController::Base
       self.responder = Spree::Api::Responders::AppResponder
       respond_to :json
-      protect_from_forgery unless: -> { request.format.json? }
+      protect_from_forgery with: :exception, unless: -> { request.format.json? }
 
       include CanCan::ControllerAdditions
       include ActiveStorage::SetCurrent
@@ -122,7 +122,7 @@ module Spree
       end
 
       def requires_authentication?
-        Spree::Api::Config[:requires_authentication]
+        Spree::Api::Config.requires_authentication
       end
 
       def not_found

data/app/controllers/spree/api/checkouts_controller.rb

@@ -42,10 +42,12 @@ module Spree
       def update
         authorize! :update, @order, order_token
 
+        if can?(:admin, @order) && user_id.present?
+          user = Spree.user_class.accessible_by(current_ability, :show).find(user_id)
+        end
+
         if Spree::Config.order_update_attributes_class.new(@order, update_params, request_env: request.headers.env).call
-          if can?(:admin, @order) && user_id.present?
-            @order.associate_user!(Spree.user_class.find(user_id))
-          end
+          @order.associate_user!(user) if user
 
           return if after_update_attributes
 

data/app/controllers/spree/api/orders_controller.rb

@@ -85,11 +85,13 @@ module Spree
       def update
         authorize! :update, @order, order_token
 
+        user_id = params[:order][:user_id]
+        if can?(:admin, @order) && user_id
+          user = Spree.user_class.accessible_by(current_ability, :show).find(user_id)
+        end
+
         if @order.contents.update_cart(order_params)
-          user_id = params[:order][:user_id]
-          if can?(:admin, @order) && user_id
-            @order.associate_user!(Spree.user_class.find(user_id))
-          end
+          @order.associate_user!(user) if user
           respond_with(@order, default_template: :show)
         else
           invalid_resource!(@order)
@@ -148,7 +150,7 @@ module Spree
       # @api public
       def determine_order_user
         if order_params[:user_id].present?
-          Spree.user_class.find(order_params[:user_id])
+          Spree.user_class.accessible_by(current_ability, :show).find(order_params[:user_id])
         else
           current_api_user
         end

data/app/controllers/spree/api/products_controller.rb

@@ -8,18 +8,12 @@ module Spree
           ids = params[:ids].split(",").flatten
           @products = product_scope.where(id: ids)
         else
-          products_includes = [
-            :variants,
-            :option_types,
-            :product_properties,
-            {classifications: :taxon}
-          ]
           @products = product_scope
             .ransack(params[:q])
             .result
-            .includes(products_includes)
         end
 
+        @products = @products.includes(products_includes)
         @products = paginate(@products.distinct)
         expires_in 15.minutes, public: true
         headers["Surrogate-Control"] = "max-age=#{15.minutes}"
@@ -108,6 +102,19 @@ module Spree
 
       private
 
+      def products_includes
+        [
+          :option_types,
+          :product_properties,
+          {classifications: :taxon},
+          {master: variants_includes},
+          {variants: variants_includes},
+          {variants_including_master: variants_includes}
+        ]
+      end
+
+      def variants_includes = {stock_items: :stock_location, images: Spree::Image.attachment_preloads}
+
       def product_params
         product_params = params.require(:product).permit(permitted_product_attributes)
         if product_params[:taxon_ids].present?

data/app/controllers/spree/api/shipments_controller.rb

@@ -93,7 +93,7 @@ module Spree
       end
 
       def transfer_to_location
-        @desired_stock_location = Spree::StockLocation.find(params[:stock_location_id])
+        @desired_stock_location = Spree::StockLocation.accessible_by(current_ability, :show).find(params[:stock_location_id])
         @desired_shipment = @original_shipment.order.shipments.build(stock_location: @desired_stock_location)
         transfer_to_shipment
       end

data/app/controllers/spree/api/stock_movements_controller.rb

@@ -34,6 +34,7 @@ module Spree
 
       def scope
         @stock_location.stock_movements.accessible_by(current_ability)
+          .includes(stock_item: {variant: [:product, :prices, :stock_items, :images, {option_values: :option_type}]})
       end
 
       def stock_movement_params

data/app/controllers/spree/api/users_controller.rb

@@ -5,6 +5,7 @@ class Spree::Api::UsersController < Spree::Api::BaseController
 
   def index
     user_scope = user_class.accessible_by(current_ability, :show)
+      .includes(bill_address: [:state, :country], ship_address: [:state, :country])
     if params[:ids]
       ids = params[:ids].split(",").flatten
       @users = user_scope.where(id: ids)

data/app/controllers/spree/api/variants_controller.rb

@@ -89,8 +89,16 @@ module Spree
       end
 
       def include_list
-        [{option_values: :option_type}, :product, :prices, :images, {stock_items: :stock_location}]
+        [
+          {option_values: :option_type},
+          {product: {master: images_includes}},
+          :prices,
+          images_includes,
+          {stock_items: :stock_location}
+        ]
       end
+
+      def images_includes = {images: Spree::Image.attachment_preloads}
     end
   end
 end

data/app/views/spree/api/config/money.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.symbol(::Money.new(1, Spree::Config[:currency]).symbol)
+json.symbol(::Money.new(1, Spree::Config.currency).symbol)

data/app/views/spree/api/config/show.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.default_country_iso(Spree::Config[:default_country_iso])
+json.default_country_iso(Spree::Config.default_country_iso)

data/app/views/spree/api/stores/_store.json.jbuilder

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+json.call(store, *store_attributes)
+json.address do
+  if store.address
+    json.partial!("spree/api/addresses/address", address: store.address)
+  else
+    json.nil!
+  end
+end

data/app/views/spree/api/stores/index.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.stores(@stores) { |store| json.call(store, *store_attributes) }
+json.stores(@stores) { |store| json.partial!("spree/api/stores/store", store:) }

data/app/views/spree/api/stores/show.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.call(@store, *store_attributes)
+json.partial!("spree/api/stores/store", store: @store)

data/app/views/spree/api/variants/_big.json.jbuilder

@@ -6,7 +6,7 @@ json.cache! [I18n.locale, Spree::StockLocation.accessible_by(current_ability), v
   json.variant_properties(variant.variant_properties) do |variant_property|
     json.call(variant_property, *variant_property_attributes)
   end
-  json.stock_items(variant.stock_items.accessible_by(current_ability)) do |stock_item|
+  json.stock_items(variant.stock_items.select { can?(:read, _1) }) do |stock_item|
     json.call(stock_item, :id, :count_on_hand, :stock_location_id, :backorderable)
     json.available stock_item.available?
     json.stock_location_name(stock_item.stock_location.name)

data/lib/spree/api.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "kaminari/activerecord"
 require "spree/core"
 
 require "spree/api/engine"

data/openapi/solidus-api.oas.yml

@@ -6474,6 +6474,8 @@ components:
           type: string
         url:
           type: string
+        address:
+          $ref: '#/components/schemas/address'
     taxonomy:
       type: object
       properties:
@@ -6955,6 +6957,8 @@ components:
           type: string
         cart_tax_country_iso:
           type: string
+        address_attributes:
+          $ref: '#/components/schemas/address-input'
     taxonomy-input:
       type: object
       title: Taxonomy input

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_api
 version: !ruby/object:Gem::Version
-  version: 4.7.2
+  version: 4.8.0
 platform: ruby
 authors:
 - Solidus Team
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.2
+        version: 4.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.2
+        version: 4.8.0
 description: REST API for the Solidus e-commerce framework.
 email: contact@solidus.io
 executables: []
@@ -198,6 +198,7 @@ files:
 - app/views/spree/api/stock_movements/index.json.jbuilder
 - app/views/spree/api/stock_movements/show.json.jbuilder
 - app/views/spree/api/store_credit_events/mine.json.jbuilder
+- app/views/spree/api/stores/_store.json.jbuilder
 - app/views/spree/api/stores/index.json.jbuilder
 - app/views/spree/api/stores/show.json.jbuilder
 - app/views/spree/api/taxonomies/_nested.json.jbuilder
@@ -271,7 +272,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.8.23
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: REST API for the Solidus e-commerce framework.
 test_files: []