solidus_api 4.7.3 → 4.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eccdd48bcff16941d9551a3033ae485cc07f7d44c5c20261649d8d81d5075b68
-  data.tar.gz: 3eeb7c3954e19d82dc3ee4b55a1c860845f03e8f4d9f5a5cdab46940c7220469
+  metadata.gz: f4ff5000b131bd3d2fce8bc9e81165d860447f4c5a94d5364852af656fa4de8d
+  data.tar.gz: b46b662948606c65253e766a0b207ea00ad473aa217811b70a0d4bdee2c69c8a
 SHA512:
-  metadata.gz: 66b961c53c70065c4aa9d9678bf6af6592f9e66faa0821cac2fa362761483cae12f436dfd9754cf0de42c79df1bc86b301010ff6d4e45c7f6e0ff55c4771996e
-  data.tar.gz: 754d8fae5afee560ce720c863c15a02d2f21d12f85a4bff6e1b07c86b3cd0549e5a57bf4e7fa003fb2853bd79e042f4b93843b3edc62d6e32c2031ac5dd3337c
+  metadata.gz: 8519bddff6d7f9b5dc478d19a1ef09b7f68473a89f94ab044c5c45e462bf93e72986888f2a6e5bc2dd0075f43d41330da07e0e9ba6955f751720f24a61fffbed
+  data.tar.gz: d0ee7c6a4d2584a00bbeb88e8442c3d6985e1c6f66590007458744cd3f11a2a9bbe9a06b88eddcba449dd7cf0d8fa239e513380ae9df3466fffb0726c8391ca1

data/LICENSE

@@ -1,6 +1,9 @@
 Copyright (c) 2007-2014, Spree Commerce, Inc. and other contributors
 All rights reserved.
 
+Copyright (c) 2015-2026, Solidus contributors
+All rights reserved.
+
 Redistribution and use in source and binary forms, with or without modification,
 are permitted provided that the following conditions are met:
 

data/app/controllers/spree/api/addresses_controller.rb

@@ -15,7 +15,7 @@ module Spree
         authorize! :update, @order, order_token
         find_address
 
-        success = @order.contents.update_cart({"#{@order_source}_attributes" => address_params})
+        success = @order.update({"#{@order_source}_attributes" => address_params})
         @address = @order.send(@order_source)
 
         if success

data/app/controllers/spree/api/base_controller.rb

@@ -7,7 +7,7 @@ module Spree
     class BaseController < ActionController::Base
       self.responder = Spree::Api::Responders::AppResponder
       respond_to :json
-      protect_from_forgery unless: -> { request.format.json? }
+      protect_from_forgery with: :exception, unless: -> { request.format.json? }
 
       include CanCan::ControllerAdditions
       include ActiveStorage::SetCurrent
@@ -122,7 +122,7 @@ module Spree
       end
 
       def requires_authentication?
-        Spree::Api::Config[:requires_authentication]
+        Spree::Api::Config.requires_authentication
       end
 
       def not_found

data/app/controllers/spree/api/checkouts_controller.rb

@@ -42,10 +42,12 @@ module Spree
       def update
         authorize! :update, @order, order_token
 
+        if can?(:admin, @order) && user_id.present?
+          user = Spree.user_class.accessible_by(current_ability, :show).find(user_id)
+        end
+
         if Spree::Config.order_update_attributes_class.new(@order, update_params, request_env: request.headers.env).call
-          if can?(:admin, @order) && user_id.present?
-            @order.associate_user!(Spree.user_class.find(user_id))
-          end
+          @order.associate_user!(user) if user
 
           return if after_update_attributes
 

data/app/controllers/spree/api/orders_controller.rb

@@ -85,11 +85,13 @@ module Spree
       def update
         authorize! :update, @order, order_token
 
+        user_id = params[:order][:user_id]
+        if can?(:admin, @order) && user_id
+          user = Spree.user_class.accessible_by(current_ability, :show).find(user_id)
+        end
+
         if @order.contents.update_cart(order_params)
-          user_id = params[:order][:user_id]
-          if can?(:admin, @order) && user_id
-            @order.associate_user!(Spree.user_class.find(user_id))
-          end
+          @order.associate_user!(user) if user
           respond_with(@order, default_template: :show)
         else
           invalid_resource!(@order)
@@ -119,7 +121,6 @@ module Spree
         if params[:order]
           normalize_params
           prevent_customer_metadata_update
-          prevent_line_item_variant_update
           params.require(:order).permit(permitted_order_attributes)
         else
           {}
@@ -132,16 +133,6 @@ module Spree
         params[:order]&.delete(:customer_metadata)
       end
 
-      def prevent_line_item_variant_update
-        line_items_attributes = params[:order][:line_items_attributes]
-        return unless line_items_attributes
-
-        line_items_attributes = line_items_attributes.values unless line_items_attributes.is_a?(Array)
-        line_items_attributes.each do |line_item_attributes|
-          line_item_attributes.delete(:variant_id) if line_item_attributes[:id].present?
-        end
-      end
-
       def normalize_params
         if params[:order][:payments]
           payments_params = params[:order].delete(:payments)
@@ -159,7 +150,7 @@ module Spree
       # @api public
       def determine_order_user
         if order_params[:user_id].present?
-          Spree.user_class.find(order_params[:user_id])
+          Spree.user_class.accessible_by(current_ability, :show).find(order_params[:user_id])
         else
           current_api_user
         end

data/app/controllers/spree/api/products_controller.rb

@@ -8,20 +8,15 @@ module Spree
           ids = params[:ids].split(",").flatten
           @products = product_scope.where(id: ids)
         else
-          products_includes = [
-            :variants,
-            :option_types,
-            :product_properties,
-            {classifications: :taxon}
-          ]
           @products = product_scope
             .ransack(params[:q])
             .result
-            .includes(products_includes)
         end
 
+        @products = @products.includes(products_includes)
         @products = paginate(@products.distinct)
-        set_cache_headers
+        expires_in 15.minutes, public: true
+        headers["Surrogate-Control"] = "max-age=#{15.minutes}"
         respond_with(@products)
       end
 
@@ -30,7 +25,9 @@ module Spree
 
       def show
         @product = find_product(params[:id])
-        set_cache_headers(surrogate_key: "product_id=#{@product.id}")
+        expires_in 15.minutes, public: true
+        headers["Surrogate-Control"] = "max-age=#{15.minutes}"
+        headers["Surrogate-Key"] = "product_id=1"
         respond_with(@product)
       end
 
@@ -105,14 +102,19 @@ module Spree
 
       private
 
-      def set_cache_headers(surrogate_key: nil)
-        return if current_api_user
-
-        expires_in 15.minutes, public: true
-        headers["Surrogate-Control"] = "max-age=#{15.minutes}"
-        headers["Surrogate-Key"] = surrogate_key if surrogate_key
+      def products_includes
+        [
+          :option_types,
+          :product_properties,
+          {classifications: :taxon},
+          {master: variants_includes},
+          {variants: variants_includes},
+          {variants_including_master: variants_includes}
+        ]
       end
 
+      def variants_includes = {stock_items: :stock_location, images: Spree::Image.attachment_preloads}
+
       def product_params
         product_params = params.require(:product).permit(permitted_product_attributes)
         if product_params[:taxon_ids].present?

data/app/controllers/spree/api/shipments_controller.rb

@@ -93,16 +93,13 @@ module Spree
       end
 
       def transfer_to_location
-        @desired_stock_location = Spree::StockLocation.find(params[:stock_location_id])
+        @desired_stock_location = Spree::StockLocation.accessible_by(current_ability, :show).find(params[:stock_location_id])
         @desired_shipment = @original_shipment.order.shipments.build(stock_location: @desired_stock_location)
         transfer_to_shipment
       end
 
       def transfer_to_shipment
-        unless @desired_shipment
-          @desired_shipment = @original_shipment.order.shipments.find_by!(number: params[:target_shipment_number])
-          authorize! :update, @desired_shipment
-        end
+        @desired_shipment ||= Spree::Shipment.find_by!(number: params[:target_shipment_number])
 
         fulfilment_changer = Spree::FulfilmentChanger.new(
           current_shipment: @original_shipment,

data/app/controllers/spree/api/stock_movements_controller.rb

@@ -34,6 +34,7 @@ module Spree
 
       def scope
         @stock_location.stock_movements.accessible_by(current_ability)
+          .includes(stock_item: {variant: [:product, :prices, :stock_items, :images, {option_values: :option_type}]})
       end
 
       def stock_movement_params

data/app/controllers/spree/api/users_controller.rb

@@ -5,6 +5,7 @@ class Spree::Api::UsersController < Spree::Api::BaseController
 
   def index
     user_scope = user_class.accessible_by(current_ability, :show)
+      .includes(bill_address: [:state, :country], ship_address: [:state, :country])
     if params[:ids]
       ids = params[:ids].split(",").flatten
       @users = user_scope.where(id: ids)

data/app/controllers/spree/api/variants_controller.rb

@@ -89,8 +89,16 @@ module Spree
       end
 
       def include_list
-        [{option_values: :option_type}, :product, :prices, :images, {stock_items: :stock_location}]
+        [
+          {option_values: :option_type},
+          {product: {master: images_includes}},
+          :prices,
+          images_includes,
+          {stock_items: :stock_location}
+        ]
       end
+
+      def images_includes = {images: Spree::Image.attachment_preloads}
     end
   end
 end

data/app/views/spree/api/config/money.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.symbol(::Money.new(1, Spree::Config[:currency]).symbol)
+json.symbol(::Money.new(1, Spree::Config.currency).symbol)

data/app/views/spree/api/config/show.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.default_country_iso(Spree::Config[:default_country_iso])
+json.default_country_iso(Spree::Config.default_country_iso)

data/app/views/spree/api/line_items/_line_item.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, line_item, line_item_attributes, variant_attributes] do
+json.cache! [I18n.locale, line_item] do
   json.call(line_item, *line_item_attributes)
   json.single_display_amount(line_item.single_display_amount.to_s)
   json.display_amount(line_item.display_amount.to_s)

data/app/views/spree/api/orders/_order.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, order, order_attributes] do
+json.cache! [I18n.locale, order] do
   json.call(order, *order_attributes)
   json.display_item_total(order.display_item_total.to_s)
   json.total_quantity(order.line_items.to_a.sum(&:quantity))

data/app/views/spree/api/shipments/_big.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, shipment, shipment_attributes, line_item_attributes, order_attributes, variant_attributes] do
+json.cache! [I18n.locale, shipment] do
   json.call(shipment, *shipment_attributes)
   json.partial!("spree/api/shipments/small", shipment:)
   json.inventory_units(shipment.inventory_units) do |inventory_unit|

data/app/views/spree/api/shipments/_small.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, shipment, shipment_attributes] do
+json.cache! [I18n.locale, shipment] do
   json.call(shipment, *shipment_attributes)
   json.order_id(shipment.order.number)
   json.stock_location_name(shipment.stock_location.name)

data/app/views/spree/api/shipments/show.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, @shipment, shipment_attributes, variant_attributes] do
+json.cache! [I18n.locale, @shipment] do
   json.call(@shipment, *shipment_attributes)
   json.order_id(@shipment.order.number)
   json.stock_location_name(@shipment.stock_location.name)

data/app/views/spree/api/stores/_store.json.jbuilder

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+json.call(store, *store_attributes)
+json.address do
+  if store.address
+    json.partial!("spree/api/addresses/address", address: store.address)
+  else
+    json.nil!
+  end
+end

data/app/views/spree/api/stores/index.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.stores(@stores) { |store| json.call(store, *store_attributes) }
+json.stores(@stores) { |store| json.partial!("spree/api/stores/store", store:) }

data/app/views/spree/api/stores/show.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.call(@store, *store_attributes)
+json.partial!("spree/api/stores/store", store: @store)

data/app/views/spree/api/variants/_big.json.jbuilder

@@ -1,12 +1,12 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, Spree::StockLocation.accessible_by(current_ability), variant, variant_attributes] do
+json.cache! [I18n.locale, Spree::StockLocation.accessible_by(current_ability), variant] do
   json.call(variant, *variant_attributes)
   json.partial!("spree/api/variants/small", variant:)
   json.variant_properties(variant.variant_properties) do |variant_property|
     json.call(variant_property, *variant_property_attributes)
   end
-  json.stock_items(variant.stock_items.accessible_by(current_ability)) do |stock_item|
+  json.stock_items(variant.stock_items.select { can?(:read, _1) }) do |stock_item|
     json.call(stock_item, :id, :count_on_hand, :stock_location_id, :backorderable)
     json.available stock_item.available?
     json.stock_location_name(stock_item.stock_location.name)

data/app/views/spree/api/variants/_small.json.jbuilder

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-json.cache! [I18n.locale, current_pricing_options, variant, variant_attributes] do
+json.cache! [I18n.locale, current_pricing_options, variant] do
   json.call(variant, *variant_attributes)
   json.price(variant.price_for_options(current_pricing_options)&.amount)
   json.display_price(variant.price_for_options(current_pricing_options)&.money&.to_s)

data/lib/spree/api.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "kaminari/activerecord"
 require "spree/core"
 
 require "spree/api/engine"

data/openapi/solidus-api.oas.yml

@@ -6474,6 +6474,8 @@ components:
           type: string
         url:
           type: string
+        address:
+          $ref: '#/components/schemas/address'
     taxonomy:
       type: object
       properties:
@@ -6955,6 +6957,8 @@ components:
           type: string
         cart_tax_country_iso:
           type: string
+        address_attributes:
+          $ref: '#/components/schemas/address-input'
     taxonomy-input:
       type: object
       title: Taxonomy input

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_api
 version: !ruby/object:Gem::Version
-  version: 4.7.3
+  version: 4.8.0
 platform: ruby
 authors:
 - Solidus Team
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.3
+        version: 4.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.3
+        version: 4.8.0
 description: REST API for the Solidus e-commerce framework.
 email: contact@solidus.io
 executables: []
@@ -198,6 +198,7 @@ files:
 - app/views/spree/api/stock_movements/index.json.jbuilder
 - app/views/spree/api/stock_movements/show.json.jbuilder
 - app/views/spree/api/store_credit_events/mine.json.jbuilder
+- app/views/spree/api/stores/_store.json.jbuilder
 - app/views/spree/api/stores/index.json.jbuilder
 - app/views/spree/api/stores/show.json.jbuilder
 - app/views/spree/api/taxonomies/_nested.json.jbuilder
@@ -271,7 +272,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.8.23
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: REST API for the Solidus e-commerce framework.
 test_files: []