solidus_api 4.7.3 → 4.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eccdd48bcff16941d9551a3033ae485cc07f7d44c5c20261649d8d81d5075b68
-  data.tar.gz: 3eeb7c3954e19d82dc3ee4b55a1c860845f03e8f4d9f5a5cdab46940c7220469
+  metadata.gz: d263182b8d9ee2d2072f32c87022a1e0883b1522b898db8dadab534674cf70ce
+  data.tar.gz: 9c4036c14c41532ff348e3a444e8c720c589914ad3641f0e9f5132c21792c925
 SHA512:
-  metadata.gz: 66b961c53c70065c4aa9d9678bf6af6592f9e66faa0821cac2fa362761483cae12f436dfd9754cf0de42c79df1bc86b301010ff6d4e45c7f6e0ff55c4771996e
-  data.tar.gz: 754d8fae5afee560ce720c863c15a02d2f21d12f85a4bff6e1b07c86b3cd0549e5a57bf4e7fa003fb2853bd79e042f4b93843b3edc62d6e32c2031ac5dd3337c
+  metadata.gz: 5ee813760d0c3f5f2c1c15b276587ab109e8897b80ac71f014b064a5eb02628e07fbcab21c674539fd668d0b5e864d06eaf6e1600278978ec6565724ba99d869
+  data.tar.gz: 357c9e20c2accc9a98b78b408d440063b82fc2787f887061188981eb3fd788224cebdf3c76da59aa986f56b2894d9298833989c16252ac2aba3f3fa19098d8b6

data/LICENSE

@@ -1,6 +1,9 @@
 Copyright (c) 2007-2014, Spree Commerce, Inc. and other contributors
 All rights reserved.
 
+Copyright (c) 2015-2026, Solidus contributors
+All rights reserved.
+
 Redistribution and use in source and binary forms, with or without modification,
 are permitted provided that the following conditions are met:
 

data/app/controllers/spree/api/base_controller.rb

@@ -7,7 +7,7 @@ module Spree
     class BaseController < ActionController::Base
       self.responder = Spree::Api::Responders::AppResponder
       respond_to :json
-      protect_from_forgery unless: -> { request.format.json? }
+      protect_from_forgery with: :exception, unless: -> { request.format.json? }
 
       include CanCan::ControllerAdditions
       include ActiveStorage::SetCurrent
@@ -122,7 +122,7 @@ module Spree
       end
 
       def requires_authentication?
-        Spree::Api::Config[:requires_authentication]
+        Spree::Api::Config.requires_authentication
       end
 
       def not_found

data/app/controllers/spree/api/checkouts_controller.rb

@@ -42,10 +42,12 @@ module Spree
       def update
         authorize! :update, @order, order_token
 
+        if can?(:admin, @order) && user_id.present?
+          user = Spree.user_class.accessible_by(current_ability, :show).find(user_id)
+        end
+
         if Spree::Config.order_update_attributes_class.new(@order, update_params, request_env: request.headers.env).call
-          if can?(:admin, @order) && user_id.present?
-            @order.associate_user!(Spree.user_class.find(user_id))
-          end
+          @order.associate_user!(user) if user
 
           return if after_update_attributes
 

data/app/controllers/spree/api/orders_controller.rb

@@ -85,11 +85,13 @@ module Spree
       def update
         authorize! :update, @order, order_token
 
+        user_id = params[:order][:user_id]
+        if can?(:admin, @order) && user_id
+          user = Spree.user_class.accessible_by(current_ability, :show).find(user_id)
+        end
+
         if @order.contents.update_cart(order_params)
-          user_id = params[:order][:user_id]
-          if can?(:admin, @order) && user_id
-            @order.associate_user!(Spree.user_class.find(user_id))
-          end
+          @order.associate_user!(user) if user
           respond_with(@order, default_template: :show)
         else
           invalid_resource!(@order)
@@ -159,7 +161,7 @@ module Spree
       # @api public
       def determine_order_user
         if order_params[:user_id].present?
-          Spree.user_class.find(order_params[:user_id])
+          Spree.user_class.accessible_by(current_ability, :show).find(order_params[:user_id])
         else
           current_api_user
         end

data/app/controllers/spree/api/products_controller.rb

@@ -8,18 +8,12 @@ module Spree
           ids = params[:ids].split(",").flatten
           @products = product_scope.where(id: ids)
         else
-          products_includes = [
-            :variants,
-            :option_types,
-            :product_properties,
-            {classifications: :taxon}
-          ]
           @products = product_scope
             .ransack(params[:q])
             .result
-            .includes(products_includes)
         end
 
+        @products = @products.includes(products_includes)
         @products = paginate(@products.distinct)
         set_cache_headers
         respond_with(@products)
@@ -105,6 +99,19 @@ module Spree
 
       private
 
+      def products_includes
+        [
+          :option_types,
+          :product_properties,
+          {classifications: :taxon},
+          {master: variants_includes},
+          {variants: variants_includes},
+          {variants_including_master: variants_includes}
+        ]
+      end
+
+      def variants_includes = {stock_items: :stock_location, images: Spree::Image.attachment_preloads}
+
       def set_cache_headers(surrogate_key: nil)
         return if current_api_user
 

data/app/controllers/spree/api/shipments_controller.rb

@@ -93,7 +93,7 @@ module Spree
       end
 
       def transfer_to_location
-        @desired_stock_location = Spree::StockLocation.find(params[:stock_location_id])
+        @desired_stock_location = Spree::StockLocation.accessible_by(current_ability, :show).find(params[:stock_location_id])
         @desired_shipment = @original_shipment.order.shipments.build(stock_location: @desired_stock_location)
         transfer_to_shipment
       end

data/app/controllers/spree/api/stock_movements_controller.rb

@@ -34,6 +34,7 @@ module Spree
 
       def scope
         @stock_location.stock_movements.accessible_by(current_ability)
+          .includes(stock_item: {variant: [:product, :prices, :stock_items, :images, {option_values: :option_type}]})
       end
 
       def stock_movement_params

data/app/controllers/spree/api/users_controller.rb

@@ -5,6 +5,7 @@ class Spree::Api::UsersController < Spree::Api::BaseController
 
   def index
     user_scope = user_class.accessible_by(current_ability, :show)
+      .includes(bill_address: [:state, :country], ship_address: [:state, :country])
     if params[:ids]
       ids = params[:ids].split(",").flatten
       @users = user_scope.where(id: ids)

data/app/controllers/spree/api/variants_controller.rb

@@ -89,8 +89,16 @@ module Spree
       end
 
       def include_list
-        [{option_values: :option_type}, :product, :prices, :images, {stock_items: :stock_location}]
+        [
+          {option_values: :option_type},
+          {product: {master: images_includes}},
+          :prices,
+          images_includes,
+          {stock_items: :stock_location}
+        ]
       end
+
+      def images_includes = {images: Spree::Image.attachment_preloads}
     end
   end
 end

data/app/views/spree/api/config/money.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.symbol(::Money.new(1, Spree::Config[:currency]).symbol)
+json.symbol(::Money.new(1, Spree::Config.currency).symbol)

data/app/views/spree/api/config/show.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.default_country_iso(Spree::Config[:default_country_iso])
+json.default_country_iso(Spree::Config.default_country_iso)

data/app/views/spree/api/stores/_store.json.jbuilder

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+json.call(store, *store_attributes)
+json.address do
+  if store.address
+    json.partial!("spree/api/addresses/address", address: store.address)
+  else
+    json.nil!
+  end
+end

data/app/views/spree/api/stores/index.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.stores(@stores) { |store| json.call(store, *store_attributes) }
+json.stores(@stores) { |store| json.partial!("spree/api/stores/store", store:) }

data/app/views/spree/api/stores/show.json.jbuilder

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-json.call(@store, *store_attributes)
+json.partial!("spree/api/stores/store", store: @store)

data/app/views/spree/api/variants/_big.json.jbuilder

@@ -6,7 +6,7 @@ json.cache! [I18n.locale, Spree::StockLocation.accessible_by(current_ability), v
   json.variant_properties(variant.variant_properties) do |variant_property|
     json.call(variant_property, *variant_property_attributes)
   end
-  json.stock_items(variant.stock_items.accessible_by(current_ability)) do |stock_item|
+  json.stock_items(variant.stock_items.select { can?(:read, _1) }) do |stock_item|
     json.call(stock_item, :id, :count_on_hand, :stock_location_id, :backorderable)
     json.available stock_item.available?
     json.stock_location_name(stock_item.stock_location.name)

data/lib/spree/api.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "kaminari/activerecord"
 require "spree/core"
 
 require "spree/api/engine"

data/openapi/solidus-api.oas.yml

@@ -6474,6 +6474,8 @@ components:
           type: string
         url:
           type: string
+        address:
+          $ref: '#/components/schemas/address'
     taxonomy:
       type: object
       properties:
@@ -6955,6 +6957,8 @@ components:
           type: string
         cart_tax_country_iso:
           type: string
+        address_attributes:
+          $ref: '#/components/schemas/address-input'
     taxonomy-input:
       type: object
       title: Taxonomy input

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: solidus_api
 version: !ruby/object:Gem::Version
-  version: 4.7.3
+  version: 4.8.1
 platform: ruby
 authors:
 - Solidus Team
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.3
+        version: 4.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.7.3
+        version: 4.8.1
 description: REST API for the Solidus e-commerce framework.
 email: contact@solidus.io
 executables: []
@@ -198,6 +198,7 @@ files:
 - app/views/spree/api/stock_movements/index.json.jbuilder
 - app/views/spree/api/stock_movements/show.json.jbuilder
 - app/views/spree/api/store_credit_events/mine.json.jbuilder
+- app/views/spree/api/stores/_store.json.jbuilder
 - app/views/spree/api/stores/index.json.jbuilder
 - app/views/spree/api/stores/show.json.jbuilder
 - app/views/spree/api/taxonomies/_nested.json.jbuilder