spree_api 5.3.4 → 5.4.0.beta

data/app/controllers/spree/api/v3/store/cart_controller.rb

@@ -0,0 +1,82 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        class CartController < Store::BaseController
+          include Spree::Api::V3::OrderConcern
+
+          before_action :require_authentication!, only: [:associate]
+
+          # POST /api/v3/store/cart
+          # Creates a new shopping cart (order)
+          # Can be created by guests or authenticated customers
+          def create
+            @cart = Spree::Order.create!(
+              store: current_store,
+              currency: current_currency,
+              user: current_user # nil for guests
+            )
+
+            render json: serialize_resource(@cart), status: :created
+          end
+
+          # GET /api/v3/store/cart
+          # Returns current incomplete order (cart)
+          # Returns 404 if no cart exists - use POST /cart to create one
+          # Authorize via order_token param or JWT Bearer token
+          def show
+            @cart = find_cart
+
+            render json: serialize_resource(@cart)
+          end
+
+          # PATCH /api/v3/store/cart/associate
+          # Associates a guest cart with the currently authenticated user
+          # Requires: JWT authentication + order token (header or param)
+          def associate
+            @cart = find_cart_by_token
+
+            result = Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true)
+
+            if result.success?
+              render json: serialize_resource(@cart)
+            else
+              render_service_error(result.error.to_s)
+            end
+          end
+
+          protected
+
+          def serializer_class
+            Spree.api.order_serializer
+          end
+
+          private
+
+          # Find incomplete cart by order token for associate action
+          # Only finds guest carts (no user) or carts already owned by current user (idempotent)
+          def find_cart_by_token
+            current_store.orders.incomplete.where(user: [ nil, current_user ]).find_by!(token: order_token)
+          end
+
+          def find_cart
+            scope = current_store.orders.incomplete
+
+            # Try order_token first (guest checkout)
+            if order_token.present?
+              return scope.find_by!(token: order_token)
+            end
+
+            # Then try JWT authenticated user
+            if current_user.present?
+              cart = scope.where(user: current_user).order(created_at: :desc).first
+              return cart if cart
+            end
+
+            raise ActiveRecord::RecordNotFound.new(nil, 'Spree::Order')
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/countries_controller.rb

@@ -0,0 +1,31 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        class CountriesController < Store::BaseController
+          # GET /api/v3/store/countries
+          def index
+            countries = current_store.countries_from_markets
+
+            render json: {
+              data: countries.map { |country| serialize_country(country) }
+            }
+          end
+
+          # GET /api/v3/store/countries/:id
+          def show
+            country = current_store.countries_from_markets.find_by!(iso: params[:id].upcase)
+
+            render json: serialize_country(country)
+          end
+
+          private
+
+          def serialize_country(country)
+            Spree.api.country_serializer.new(country, params: serializer_params).to_h
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/currencies_controller.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        class CurrenciesController < Store::BaseController
+          # GET /api/v3/store/currencies
+          def index
+            currencies = current_store.supported_currencies_list
+
+            render json: {
+              data: currencies.map { |currency| Spree.api.currency_serializer.new(currency).to_h }
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/customer/account_controller.rb

@@ -0,0 +1,38 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Customer
+          class AccountController < Store::BaseController
+            prepend_before_action :require_authentication!
+
+            # GET /api/v3/store/customer
+            def show
+              render json: serialize_resource(current_user)
+            end
+
+            # PATCH /api/v3/store/customer
+            def update
+              if current_user.update(permitted_params)
+                render json: serialize_resource(current_user)
+              else
+                render_errors(current_user.errors)
+              end
+            end
+
+            protected
+
+            def serializer_class
+              Spree.api.customer_serializer
+            end
+
+            def permitted_params
+              params.permit(:email, :password, :password_confirmation, :first_name, :last_name,
+                            :accepts_email_marketing, :phone)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/customer/addresses_controller.rb

@@ -0,0 +1,85 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Customer
+          class AddressesController < ResourceController
+            prepend_before_action :require_authentication!
+            before_action :set_resource, only: [:show, :update, :destroy, :mark_as_default]
+
+            # POST /api/v3/store/customer/addresses
+            def create
+              result = Spree.address_create_service.call(
+                address_params: permitted_params,
+                user: current_user
+              )
+
+              if result.success?
+                render json: serialize_resource(result.value), status: :created
+              else
+                render_errors(result.value.errors)
+              end
+            end
+
+            # PATCH /api/v3/store/customer/addresses/:id/mark_as_default
+            def mark_as_default
+              kind = params[:kind].to_s
+
+              unless %w[billing shipping].include?(kind)
+                return render_error(
+                  code: ERROR_CODES[:invalid_request],
+                  message: 'kind must be billing or shipping',
+                  status: :unprocessable_content
+                )
+              end
+
+              attribute = kind == 'billing' ? :bill_address_id : :ship_address_id
+              current_user.update!(attribute => @resource.id)
+
+              render json: serialize_resource(@resource.reload)
+            end
+
+            # PATCH /api/v3/store/customer/addresses/:id
+            def update
+              result = Spree.address_update_service.call(
+                address: @resource,
+                address_params: permitted_params
+              )
+
+              if result.success?
+                render json: serialize_resource(result.value)
+              else
+                render_errors(result.value.errors)
+              end
+            end
+
+            protected
+
+            def set_parent
+              @parent = current_user
+            end
+
+            def parent_association
+              :addresses
+            end
+
+            def model_class
+              Spree::Address
+            end
+
+            def serializer_class
+              Spree.api.address_serializer
+            end
+
+            def permitted_params
+              params.permit(
+                :firstname, :lastname, :address1, :address2, :city,
+                :zipcode, :phone, :company, :country_iso, :state_abbr, :state_name
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/customer/credit_cards_controller.rb

@@ -0,0 +1,31 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Customer
+          class CreditCardsController < ResourceController
+            prepend_before_action :require_authentication!
+
+            protected
+
+            def set_parent
+              @parent = current_user
+            end
+
+            def parent_association
+              :credit_cards
+            end
+
+            def model_class
+              Spree::CreditCard
+            end
+
+            def serializer_class
+              Spree.api.credit_card_serializer
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/customer/gift_cards_controller.rb

@@ -0,0 +1,36 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Customer
+          class GiftCardsController < ResourceController
+            prepend_before_action :require_authentication!
+
+            protected
+
+            def set_parent
+              @parent = current_user
+            end
+
+            def parent_association
+              :gift_cards
+            end
+
+            def model_class
+              Spree::GiftCard
+            end
+
+            def serializer_class
+              Spree.api.gift_card_serializer
+            end
+
+            # Override scope to filter by current store and order by created_at desc
+            def scope
+              super.where(store: current_store).order(created_at: :desc)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/customer/orders_controller.rb

@@ -0,0 +1,35 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Customer
+          class OrdersController < ResourceController
+            prepend_before_action :require_authentication!
+
+            protected
+
+            def model_class
+              Spree::Order
+            end
+
+            def serializer_class
+              Spree.api.order_serializer
+            end
+
+            def set_parent
+              @parent = current_user
+            end
+
+            def parent_association
+              :orders
+            end
+
+            def scope
+              super.for_store(current_store)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/customer/payment_setup_sessions_controller.rb

@@ -0,0 +1,83 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Customer
+          class PaymentSetupSessionsController < ResourceController
+            prepend_before_action :require_authentication!
+
+            skip_before_action :set_resource
+            before_action :set_payment_setup_session, only: [:show, :complete]
+
+            # POST /api/v3/store/customer/payment_setup_sessions
+            def create
+              payment_method = current_store.payment_methods.find_by_prefix_id!(permitted_params[:payment_method_id])
+
+              @payment_setup_session = payment_method.create_payment_setup_session(
+                customer: current_user,
+                external_data: permitted_params[:external_data] || {}
+              )
+
+              if @payment_setup_session.persisted?
+                render json: serialize_resource(@payment_setup_session), status: :created
+              else
+                render_errors(@payment_setup_session.errors)
+              end
+            end
+
+            # GET /api/v3/store/customer/payment_setup_sessions/:id
+            def show
+              render json: serialize_resource(@payment_setup_session)
+            end
+
+            # PATCH /api/v3/store/customer/payment_setup_sessions/:id/complete
+            def complete
+              @payment_setup_session.payment_method.complete_payment_setup_session(
+                setup_session: @payment_setup_session,
+                params: complete_params
+              )
+
+              if @payment_setup_session.errors.empty?
+                render json: serialize_resource(@payment_setup_session.reload)
+              else
+                render_errors(@payment_setup_session.errors)
+              end
+            end
+
+            protected
+
+            def set_parent
+              @parent = current_user
+            end
+
+            def parent_association
+              :payment_setup_sessions
+            end
+
+            def model_class
+              Spree::PaymentSetupSession
+            end
+
+            def serializer_class
+              Spree.api.payment_setup_session_serializer
+            end
+
+            def permitted_params
+              params.permit(Spree::PermittedAttributes.payment_setup_session_attributes)
+            end
+
+            def complete_params
+              params.permit({ external_data: {} })
+            end
+
+            private
+
+            def set_payment_setup_session
+              @payment_setup_session = current_user.payment_setup_sessions.find_by_prefix_id!(params[:id])
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/digitals_controller.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        class DigitalsController < Store::BaseController
+          skip_before_action :authenticate_api_key!
+          before_action :set_resource
+
+          # GET /api/v3/store/digitals/:token
+          def show
+            if @resource.authorize!
+              send_data @resource.digital.attachment.download,
+                        filename: @resource.digital.attachment.filename.to_s,
+                        type: @resource.digital.attachment.content_type
+            else
+              render_error(
+                code: ERROR_CODES[:digital_link_expired],
+                message: 'Download link expired or invalid',
+                status: :forbidden
+              )
+            end
+          end
+
+          private
+
+          def set_resource
+            @resource = digital_link_scope.find_by!(token: params[:token])
+          end
+
+          def digital_link_scope
+            current_store.digital_links
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/locales_controller.rb

@@ -0,0 +1,24 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        class LocalesController < Store::BaseController
+          # GET /api/v3/store/locales
+          def index
+            locales = current_store.supported_locales_list
+
+            render json: {
+              data: locales.map { |code| Spree.api.locale_serializer.new(OpenStruct.new(code: code, name: locale_name(code))).to_h }
+            }
+          end
+
+          private
+
+          def locale_name(code)
+            I18n.t('spree.i18n.this_file_language', locale: code, default: code)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/orders/coupon_codes_controller.rb

@@ -0,0 +1,68 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Orders
+          class CouponCodesController < ResourceController
+            include Spree::Api::V3::OrderConcern
+
+            before_action :authorize_order_access!
+            skip_before_action :set_resource
+
+            # POST  /api/v3/store/orders/:order_id/coupon_codes
+            # Apply a coupon code to the order
+            def create
+              @parent.coupon_code = permitted_params[:code]
+
+              coupon_handler.apply
+
+              if coupon_handler.successful?
+                render_order(status: :created)
+              else
+                render_errors(coupon_handler.error)
+              end
+            end
+
+            # DELETE  /api/v3/store/orders/:order_id/coupon_codes/:id
+            # Remove a coupon code from the order
+            # :id is the promotion prefix_id (e.g., promo_xxx)
+            def destroy
+              @resource = scope.find_by_prefix_id!(params[:id])
+              coupon_code = @resource.code.presence || @resource.name
+
+              coupon_handler.remove(coupon_code)
+
+              if coupon_handler.successful?
+                render_order
+              else
+                render_errors(coupon_handler.error)
+              end
+            end
+
+            protected
+
+            def parent_association
+              :order_promotions
+            end
+
+            def coupon_handler
+              @coupon_handler ||= Spree.coupon_handler.new(@parent)
+            end
+
+            def permitted_params
+              params.permit(:code)
+            end
+
+            def model_class
+              Spree::OrderPromotion
+            end
+
+            def serializer_class
+              Spree.api.order_promotion_serializer
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/orders/line_items_controller.rb

@@ -0,0 +1,87 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Orders
+          class LineItemsController < ResourceController
+            include Spree::Api::V3::OrderConcern
+
+            skip_before_action :set_resource
+            before_action :authorize_order_access!
+
+            # POST  /api/v3/store/orders/:order_id/line_items
+            def create
+              result = Spree.cart_add_item_service.call(
+                order: @parent,
+                variant: variant,
+                quantity: permitted_params[:quantity] || 1,
+                options: permitted_params[:options] || {}
+              )
+
+              if result.success?
+                render_order(status: :created)
+              else
+                render_service_error(result.error, code: ERROR_CODES[:insufficient_stock])
+              end
+            end
+
+            # PATCH  /api/v3/store/orders/:order_id/line_items/:id
+            def update
+              @line_item = scope.find_by_prefix_id!(params[:id])
+
+              if permitted_params[:quantity].present?
+                result = Spree.cart_set_item_quantity_service.call(
+                  order: @parent,
+                  line_item: @line_item,
+                  quantity: permitted_params[:quantity]
+                )
+
+                if result.success?
+                  render_order
+                else
+                  render_service_error(result.error, code: ERROR_CODES[:invalid_quantity])
+                end
+              else
+                render_order
+              end
+            end
+
+            # DELETE  /api/v3/store/orders/:order_id/line_items/:id
+            def destroy
+              @line_item = scope.find_by_prefix_id!(params[:id])
+
+              Spree.cart_remove_line_item_service.call(
+                order: @parent,
+                line_item: @line_item
+              )
+
+              render_order
+            end
+
+            protected
+
+            def parent_association
+              :line_items
+            end
+
+            def variant
+              @variant ||= current_store.variants.accessible_by(current_ability).find_by_prefix_id!(permitted_params[:variant_id])
+            end
+
+            def model_class
+              Spree::LineItem
+            end
+
+            def serializer_class
+              Spree.api.line_item_serializer
+            end
+
+            def permitted_params
+              params.permit(Spree::PermittedAttributes.line_item_attributes + [{ options: {} }])
+            end
+          end
+        end
+      end
+    end
+  end
+end