spree_api 5.4.2 → 5.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4b295d2c49585c2fd0368b2b31bb782e19b77af7c4580e243896257151f5fd47
-  data.tar.gz: fea6f271b52ec0218ab2991e4bdaaa496d465a1fc2af7ada90bfee238de2216a
+  metadata.gz: 60cd4bf73d495ad9c5070f9c589f0e2d7bc4403ea35d01d79f3d00c2208fde26
+  data.tar.gz: 5e0517af8dee47eb2c69b465050ddf2db9309bde1130540caa440c076773cfc9
 SHA512:
-  metadata.gz: d256c6250da995fd8762ed02f924e0d8f4c97fc3f39c3d94c9fc21b43b2d1878da871c0baff222e33d8d5c42b043878f6ec6aeea7baee6e3963fadb7bc6449b4
-  data.tar.gz: 4c30eff24e0d890cc2cb967e7f6cb0c476783324ea9724d46dc4fb3532bcd37400e81d07640e1e3b764e283ca3bf23c7f3148d7183060eb47b94ce238c129775
+  metadata.gz: 2db9f9ca93c76a1a195219c5af06abcce880cb538d517982700836e9b973b992d14e8ac9c6d77249787fff658410f243e84cdf3b4cd885f376d46e3f03501148
+  data.tar.gz: be380eaca399b016e832c5af98985c3183c34a1a8f9d83b8f1354bd9403287e1cc0a22fffabf1f82a05f553c15f34fcc4baf6b339199dfef74b7edeb60cd65e9

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -82,10 +82,15 @@ module Spree
           end
 
           # PATCH /api/v3/store/carts/:id/associate
-          # Associates a guest cart with the currently authenticated user
-          # Requires: JWT authentication + cart ID in URL
+          # Associates a guest cart with the currently authenticated user.
+          # Requires: JWT authentication + cart ID in URL + possession of the
+          # cart's token (x-spree-token). The token is the credential that
+          # authorizes claiming the cart, so it is required even when the cart
+          # is already the caller's own.
           def associate
             @cart = find_cart_for_association
+            authorize!(:update, @cart, cart_token)
+            require_cart_token!
 
             result = Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true)
 
@@ -172,6 +177,14 @@ module Spree
           def find_cart_for_association
             current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id])
           end
+
+          # Claiming a cart requires presenting its token, even when the caller
+          # already owns it — the token, not ownership, is the claim credential.
+          def require_cart_token!
+            valid = cart_token.present? && cart_token == @cart.token
+
+            raise CanCan::AccessDenied.new(nil, :update, @cart) unless valid
+          end
         end
       end
     end

data/app/jobs/spree/webhook_delivery_job.rb

@@ -8,10 +8,15 @@ module Spree
 
     # Accept optional second argument for backward compatibility with jobs
     # enqueued before this change was deployed.
-    def perform(delivery_id, _deprecated_secret_key = nil)
+    #
+    # `payload_secrets` carries credentials withheld from the persisted payload
+    # so the outgoing request body stays complete. See
+    # {Spree::WebhookPayloadRedaction}.
+    def perform(delivery_id, _deprecated_secret_key = nil, payload_secrets: nil)
       delivery = Spree::WebhookDelivery.find_by(id: delivery_id)
       return if delivery.nil?
 
+      delivery.payload_secrets = payload_secrets
       secret_key = delivery.webhook_endpoint.secret_key
       Spree::Webhooks::DeliverWebhook.call(delivery: delivery, secret_key: secret_key)
     end

data/app/serializers/spree/api/v3/admin/webhook_delivery_serializer.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Admin API serializer for {Spree::WebhookDelivery}.
+        #
+        # Surface the delivery log so admins can audit + retry failed webhook
+        # attempts. Includes the request payload + response body so they can
+        # inspect what was sent and what the endpoint returned.
+        class WebhookDeliverySerializer < V3::BaseSerializer
+          typelize event_name: :string,
+                   event_id: [:string, nullable: true],
+                   response_code: [:number, nullable: true],
+                   execution_time: [:number, nullable: true],
+                   error_type: [:string, nullable: true],
+                   request_errors: [:string, nullable: true],
+                   response_body: [:string, nullable: true],
+                   success: [:boolean, nullable: true],
+                   delivered_at: [:string, nullable: true],
+                   payload: 'Record<string, unknown>',
+                   webhook_endpoint_id: :string,
+                   webhook_endpoint_url: :string
+
+          attributes :event_name, :event_id, :response_code, :execution_time,
+                     :error_type, :request_errors, :response_body, :success,
+                     created_at: :iso8601, updated_at: :iso8601,
+                     delivered_at: :iso8601
+
+          # Redacted again on read: deliveries written before payload redaction
+          # shipped still hold live credentials in the column.
+          attribute :payload do |delivery|
+            Spree::WebhookPayloadRedaction.split(delivery.payload).first
+          end
+
+          attribute :webhook_endpoint_id do |delivery|
+            delivery.webhook_endpoint&.prefixed_id
+          end
+
+          # Delegated from the parent endpoint — saves callers from having to
+          # join the endpoint payload to show "where did this delivery go?".
+          attribute :webhook_endpoint_url do |delivery|
+            delivery.webhook_endpoint&.url
+          end
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/product_serializer.rb

@@ -56,7 +56,7 @@ module Spree
         end
 
         attribute :tags do |product|
-          product.taggings.map(&:tag)
+          product.tags.map(&:name) # not pluck as we preload tags
         end
 
         # Price object - calculated price with price list resolution

data/app/services/spree/webhooks/deliver_webhook.rb

@@ -56,7 +56,7 @@ module Spree
           'X-Spree-Webhook-Timestamp' => webhook_timestamp.to_s,
           'X-Spree-Webhook-Event' => @delivery.event_name
         }
-        body = @delivery.payload.to_json
+        body = payload_json
         http_options = { open_timeout: TIMEOUT, read_timeout: TIMEOUT, verify_mode: ssl_verify_mode }
 
         # SSRF protection is disabled in development so webhooks can reach
@@ -77,10 +77,14 @@ module Spree
       end
 
       def generate_signature
-        payload_json = @delivery.payload.to_json
         OpenSSL::HMAC.hexdigest('SHA256', @secret_key, "#{webhook_timestamp}.#{payload_json}")
       end
 
+      # Memoized so the signature is computed over exactly the bytes sent.
+      def payload_json
+        @payload_json ||= @delivery.deliverable_payload.to_json
+      end
+
       def webhook_timestamp
         @webhook_timestamp ||= Time.current.to_i
       end

data/app/subscribers/spree/webhook_event_subscriber.rb

@@ -50,13 +50,16 @@ module Spree
         )
       end
 
+      # Live credentials go over the wire but never into the delivery log.
+      persisted_payload, secrets = Spree::WebhookPayloadRedaction.split(payload)
+
       delivery = endpoint.webhook_deliveries.create!(
         event_name: event.name,
         event_id: event.id,
-        payload: payload
+        payload: persisted_payload
       )
 
-      Spree::WebhookDeliveryJob.perform_later(delivery.id)
+      Spree::WebhookDeliveryJob.perform_later(delivery.id, payload_secrets: secrets)
     rescue ActiveRecord::RecordNotUnique
       # Race condition: another thread already created this delivery — safe to ignore
     rescue StandardError => e

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.4.2
+  version: 5.4.4
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-27 00:00:00.000000000 Z
+date: 2026-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.4.2
+        version: 5.4.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.4.2
+        version: 5.4.4
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -180,6 +180,7 @@ files:
 - app/serializers/spree/api/v3/admin/store_credit_serializer.rb
 - app/serializers/spree/api/v3/admin/tax_category_serializer.rb
 - app/serializers/spree/api/v3/admin/variant_serializer.rb
+- app/serializers/spree/api/v3/admin/webhook_delivery_serializer.rb
 - app/serializers/spree/api/v3/asset_serializer.rb
 - app/serializers/spree/api/v3/base_serializer.rb
 - app/serializers/spree/api/v3/cart_serializer.rb
@@ -263,9 +264,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.4.2
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.4.4
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.4.2
+  source_code_uri: https://github.com/spree/spree/tree/v5.4.4
 post_install_message:
 rdoc_options: []
 require_paths: