spree_api 5.4.4 → 5.5.0.rc1

data/app/serializers/spree/api/v3/admin/stock_reservation_serializer.rb

@@ -0,0 +1,46 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        class StockReservationSerializer < V3::StockReservationSerializer
+          typelize stock_item_id: :string,
+                   line_item_id: :string,
+                   order_id: :string,
+                   variant_id: [:string, nullable: true],
+                   stock_location_id: [:string, nullable: true],
+                   quantity: :number,
+                   expires_at: :string,
+                   active: :boolean
+
+          attribute :stock_item_id do |reservation|
+            reservation.stock_item.prefixed_id
+          end
+
+          attribute :line_item_id do |reservation|
+            reservation.line_item.prefixed_id
+          end
+
+          attribute :order_id do |reservation|
+            reservation.order.prefixed_id
+          end
+
+          attribute :variant_id do |reservation|
+            reservation.stock_item&.variant&.prefixed_id
+          end
+
+          attribute :stock_location_id do |reservation|
+            reservation.stock_item&.stock_location&.prefixed_id
+          end
+
+          attributes :quantity, expires_at: :iso8601
+
+          attribute :active do |reservation|
+            reservation.active?
+          end
+
+          attributes created_at: :iso8601, updated_at: :iso8601
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/stock_transfer_serializer.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Inventory movement between two stock locations (or external →
+        # location for receives). The originating location is `nil` for
+        # receives (vendor stock arriving) and present for transfers.
+        class StockTransferSerializer < V3::BaseSerializer
+          typelize number: :string,
+                   reference: [:string, nullable: true],
+                   source_location_id: [:string, nullable: true],
+                   destination_location_id: [:string, nullable: true],
+                   metadata: 'Record<string, unknown>'
+
+          attributes :number, :reference, :metadata,
+                     created_at: :iso8601, updated_at: :iso8601
+
+          attribute :source_location_id do |stock_transfer|
+            stock_transfer.source_location&.prefixed_id
+          end
+
+          attribute :destination_location_id do |stock_transfer|
+            stock_transfer.destination_location&.prefixed_id
+          end
+
+          one :source_location,
+              resource: Spree.api.admin_stock_location_serializer,
+              if: proc { expand?('source_location') }
+
+          one :destination_location,
+              resource: Spree.api.admin_stock_location_serializer,
+              if: proc { expand?('destination_location') }
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/store_credit_category_serializer.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        class StoreCreditCategorySerializer < V3::BaseSerializer
+          typelize name: :string,
+                   non_expiring: :boolean
+
+          attributes :name,
+                     created_at: :iso8601, updated_at: :iso8601
+
+          attribute :non_expiring do |store_credit_category|
+            store_credit_category.non_expiring?
+          end
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/store_credit_serializer.rb

@@ -5,9 +5,13 @@ module Spree
         class StoreCreditSerializer < V3::StoreCreditSerializer
           typelize customer_id: [:string, nullable: true],
                    created_by_id: [:string, nullable: true],
-                   metadata: 'Record<string, unknown> | null'
+                   category_id: [:string, nullable: true],
+                   category_name: [:string, nullable: true],
+                   memo: [:string, nullable: true],
+                   metadata: 'Record<string, unknown>'
 
-          attributes created_at: :iso8601, updated_at: :iso8601
+          attributes :memo, :metadata,
+                     created_at: :iso8601, updated_at: :iso8601
 
           attribute :customer_id do |store_credit|
             store_credit.user&.prefixed_id
@@ -17,11 +21,13 @@ module Spree
             store_credit.created_by&.prefixed_id
           end
 
-          attribute :metadata do |store_credit|
-            store_credit.metadata.presence
+          attribute :category_id do |store_credit|
+            store_credit.category&.prefixed_id
           end
 
-          attributes created_at: :iso8601, updated_at: :iso8601
+          attribute :category_name do |store_credit|
+            store_credit.category_name
+          end
         end
       end
     end

data/app/serializers/spree/api/v3/admin/store_serializer.rb

@@ -0,0 +1,55 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        class StoreSerializer < V3::BaseSerializer
+          typelize name: :string, url: :string,
+                   default_currency: :string, default_locale: :string,
+                   supported_currencies: [:string, multi: true],
+                   supported_locales: [:string, multi: true],
+                   logo_url: [:string, nullable: true],
+                   mailer_logo_url: [:string, nullable: true],
+                   mail_from_address: [:string, nullable: true],
+                   customer_support_email: [:string, nullable: true],
+                   new_order_notifications_email: [:string, nullable: true],
+                   preferred_send_consumer_transactional_emails: :boolean,
+                   preferred_admin_locale: [:string, nullable: true],
+                   preferred_timezone: :string,
+                   preferred_weight_unit: :string,
+                   preferred_unit_system: :string,
+                   metadata: 'Record<string, unknown>'
+
+          attributes :metadata,
+                     :name,
+                     :default_currency,
+                     :default_locale,
+                     :mail_from_address,
+                     :customer_support_email,
+                     :new_order_notifications_email,
+                     :preferred_send_consumer_transactional_emails,
+                     :preferred_admin_locale,
+                     :preferred_timezone,
+                     :preferred_weight_unit,
+                     :preferred_unit_system,
+                     created_at: :iso8601, updated_at: :iso8601
+
+          attribute :url, &:storefront_url
+
+          attribute :supported_currencies do |store|
+            store.supported_currencies_list.map(&:iso_code)
+          end
+
+          attribute :supported_locales, &:supported_locales_list
+
+          attribute :logo_url do |store|
+            image_url_for(store.logo)
+          end
+
+          attribute :mailer_logo_url do |store|
+            image_url_for(store.mailer_logo)
+          end
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/tax_category_serializer.rb

@@ -3,10 +3,12 @@ module Spree
     module V3
       module Admin
         class TaxCategorySerializer < V3::BaseSerializer
-          typelize name: :string, tax_code: [:string, nullable: true],
+          typelize name: :string,
+                   tax_code: [:string, nullable: true],
+                   description: [:string, nullable: true],
                    is_default: :boolean
 
-          attributes :name, :tax_code, :is_default,
+          attributes :name, :tax_code, :description, :is_default,
                      created_at: :iso8601, updated_at: :iso8601
         end
       end

data/app/serializers/spree/api/v3/admin/variant_serializer.rb

@@ -6,16 +6,43 @@ module Spree
         # Full variant data including admin-only fields
         class VariantSerializer < V3::VariantSerializer
 
-          # Additional type hints for admin-only attributes
-          typelize position: :number, tax_category_id: [:string, nullable: true],
+          typelize product_name: :string,
+                   position: :number, tax_category_id: [:string, nullable: true],
                    cost_price: [:string, nullable: true], cost_currency: [:string, nullable: true],
-                   total_on_hand: [:number, nullable: true],
-                   deleted_at: [:string, nullable: true]
+                   barcode: [:string, nullable: true],
+                   weight_unit: [:string, nullable: true], dimensions_unit: [:string, nullable: true],
+                   available_stock: [:number, nullable: true],
+                   reserved_quantity: :number, total_on_hand: [:number, nullable: true],
+                   deleted_at: [:string, nullable: true],
+                   metadata: 'Record<string, unknown>'
 
-          # Admin-only attributes
-          attributes :position, :total_on_hand, :tax_category_id, :cost_price, :cost_currency, deleted_at: :iso8601,
+          attributes :metadata, :position, :cost_price, :cost_currency,
+                     :barcode, :weight_unit, :dimensions_unit, deleted_at: :iso8601,
                      created_at: :iso8601, updated_at: :iso8601
 
+          attribute :tax_category_id do |variant|
+            variant.tax_category&.prefixed_id
+          end
+
+          # Physical pool minus already-allocated units. In 5.5 allocated_count
+          # is always 0, so this equals SUM(stock_items.count_on_hand).
+          attribute :available_stock do |variant|
+            variant.available_stock.to_i if variant.should_track_inventory?
+          end
+
+          attribute :reserved_quantity do |variant|
+            variant.reserved_quantity.to_i
+          end
+
+          # Purchasable now: available_stock minus active reservations.
+          attribute :total_on_hand do |variant|
+            variant.total_on_hand.to_i if variant.should_track_inventory?
+          end
+
+          attribute :product_name do |variant|
+            variant.product&.name
+          end
+
           # Override inherited associations to use admin serializers
           one :primary_media,
               resource: Spree.api.admin_media_serializer,
@@ -37,6 +64,10 @@ module Spree
                key: :custom_fields,
                resource: Spree.api.admin_custom_field_serializer,
                if: proc { expand?('custom_fields') }
+
+          many :stock_items,
+               resource: Spree.api.admin_stock_item_serializer,
+               if: proc { expand?('stock_items') }
         end
       end
     end

data/app/serializers/spree/api/v3/admin/webhook_delivery_serializer.rb

@@ -25,15 +25,10 @@ module Spree
 
           attributes :event_name, :event_id, :response_code, :execution_time,
                      :error_type, :request_errors, :response_body, :success,
+                     :payload,
                      created_at: :iso8601, updated_at: :iso8601,
                      delivered_at: :iso8601
 
-          # Redacted again on read: deliveries written before payload redaction
-          # shipped still hold live credentials in the column.
-          attribute :payload do |delivery|
-            Spree::WebhookPayloadRedaction.split(delivery.payload).first
-          end
-
           attribute :webhook_endpoint_id do |delivery|
             delivery.webhook_endpoint&.prefixed_id
           end

data/app/serializers/spree/api/v3/admin/webhook_endpoint_serializer.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Admin API serializer for {Spree::WebhookEndpoint}.
+        #
+        # Never exposes `secret_key` outside of the create response (encrypted
+        # at rest, plaintext only in memory after generation). The full secret
+        # is delivered exactly once via {#secret_key} below — `nil` everywhere
+        # else.
+        class WebhookEndpointSerializer < V3::BaseSerializer
+          typelize name: [:string, nullable: true],
+                   url: :string,
+                   active: :boolean,
+                   subscriptions: [:string, multi: true],
+                   secret_key: [:string, nullable: true],
+                   disabled_at: [:string, nullable: true],
+                   disabled_reason: [:string, nullable: true],
+                   last_delivery_at: [:string, nullable: true],
+                   recent_delivery_count: :number,
+                   recent_failure_count: :number,
+                   total_delivery_count: :number,
+                   successful_delivery_count: :number,
+                   failed_delivery_count: :number
+
+          attributes :name, :url, :active, :subscriptions,
+                     :disabled_reason,
+                     created_at: :iso8601, updated_at: :iso8601,
+                     disabled_at: :iso8601
+
+          # Plaintext on the create response only — the model owns the
+          # "fresh-from-create" rule via `secret_key_for_response`. Every
+          # subsequent read serializes nil.
+          attribute :secret_key, &:secret_key_for_response
+
+          attribute :last_delivery_at do |endpoint|
+            value = endpoint.webhook_deliveries.maximum(:delivered_at)
+            value.respond_to?(:iso8601) ? value.iso8601 : value
+          end
+
+          attribute :recent_delivery_count do |endpoint|
+            endpoint.webhook_deliveries.where(created_at: 7.days.ago..).count
+          end
+
+          attribute :recent_failure_count do |endpoint|
+            endpoint.webhook_deliveries.where(created_at: 7.days.ago.., success: false).count
+          end
+
+          # Lifetime totals — back the health summary panel on the endpoint
+          # detail sheet (success % over all deliveries, like the legacy admin's
+          # `_summary.html.erb`).
+          attribute :total_delivery_count do |endpoint|
+            endpoint.webhook_deliveries.count
+          end
+
+          attribute :successful_delivery_count do |endpoint|
+            endpoint.webhook_deliveries.successful.count
+          end
+
+          attribute :failed_delivery_count do |endpoint|
+            endpoint.webhook_deliveries.failed.count
+          end
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/channel_serializer.rb

@@ -0,0 +1,14 @@
+module Spree
+  module Api
+    module V3
+      class ChannelSerializer < BaseSerializer
+        typelize name: :string,
+                 code: :string,
+                 active: :boolean,
+                 default: :boolean
+
+        attributes :name, :code, :active, :default
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/custom_field_serializer.rb

@@ -2,19 +2,18 @@ module Spree
   module Api
     module V3
       # Store API Custom Field Serializer
-      # Customer-facing custom field data (public metafields only)
+      # Customer-facing custom field data (storefront-visible only)
       class CustomFieldSerializer < BaseSerializer
-        typelize key: :string, label: :string, type: :string, value: :any
+        typelize key: :string,
+                 label: :string,
+                 type: [:string, deprecated: 'Use `field_type` instead. The legacy `type` field returns the Ruby STI class name (e.g. `Spree::Metafields::ShortText`) and will be removed in a future minor.'],
+                 field_type: Spree::Metafield::FIELD_TYPE_TOKENS,
+                 value: :any
 
-        attributes :label, :type
+        attributes :label, :type, :field_type
 
-        attribute :key do |metafield|
-          metafield.full_key
-        end
-
-        attribute :value do |metafield|
-          metafield.serialize_value
-        end
+        attribute :key, &:full_key
+        attribute :value, &:serialize_value
       end
     end
   end

data/app/serializers/spree/api/v3/customer_serializer.rb

@@ -5,12 +5,17 @@ module Spree
       # Customer-facing user data
       class CustomerSerializer < BaseSerializer
         typelize email: :string, first_name: [:string, nullable: true], last_name: [:string, nullable: true],
+                 full_name: :string,
                  phone: [:string, nullable: true], accepts_email_marketing: :boolean,
                  available_store_credit_total: :string, display_available_store_credit_total: :string,
                  default_billing_address: { nullable: true }, default_shipping_address: { nullable: true }
 
         attributes :email, :first_name, :last_name, :phone, :accepts_email_marketing
 
+        attribute :full_name do |user|
+          user.full_name.presence || user.email
+        end
+
         attribute :available_store_credit_total do |user, params|
           store = params&.dig(:store) || Spree::Current.store
           currency = params&.dig(:currency) || Spree::Current.currency || store&.default_currency

data/app/serializers/spree/api/v3/market_serializer.rb

@@ -5,10 +5,11 @@ module Spree
         typelize name: :string, currency: :string,
                  default_locale: :string,
                  supported_locales: [:string, multi: true],
+                 country_isos: [:string, multi: true],
                  tax_inclusive: :boolean,
                  default: :boolean
 
-        attributes :name, :currency, :default_locale, :tax_inclusive, :default
+        attributes :name, :currency, :default_locale, :tax_inclusive, :default, :country_isos
 
         attribute :supported_locales do |market|
           market.supported_locales_list

data/app/serializers/spree/api/v3/media_serializer.rb

@@ -19,13 +19,15 @@ module Spree
         end
 
         # Returns prefixed IDs of variants this media is associated with.
-        # Currently: single variant via viewable (legacy). In 6.0: multiple via VariantMedia join table.
+        # Two paths coexist in 5.5:
+        #   - legacy: asset.viewable IS the variant (direct upload, viewable_type 'Spree::Variant')
+        #   - new:    asset.variants — product-level asset linked via VariantMedia rows
+        # Both are reported so the admin can show a unified "assigned variants" list.
         attribute :variant_ids do |asset|
-          if asset.viewable_type == 'Spree::Variant'
-            [asset.viewable&.prefixed_id].compact
-          else
-            []
-          end
+          ids = []
+          ids << asset.viewable&.prefixed_id if asset.viewable_type == 'Spree::Variant' && asset.viewable
+          ids.concat(asset.variants.map(&:prefixed_id)) if asset.viewable_type == 'Spree::Product'
+          ids.compact.uniq
         end
 
         attributes :position, :alt, :media_type,

data/app/serializers/spree/api/v3/order_serializer.rb

@@ -5,7 +5,8 @@ module Spree
       # Post-purchase order data (completed orders)
       class OrderSerializer < BaseSerializer
         typelize number: :string, email: :string,
-                 customer_note: [:string, nullable: true], market_id: [:string, nullable: true],
+                 customer_note: [:string, nullable: true],
+                 market_id: [:string, nullable: true], channel_id: [:string, nullable: true],
                  currency: :string, locale: [:string, nullable: true], total_quantity: :number,
                  fulfillment_status: [:string, nullable: true], payment_status: [:string, nullable: true],
                  item_total: :string, display_item_total: :string,
@@ -28,6 +29,10 @@ module Spree
           order.market&.prefixed_id
         end
 
+        attribute :channel_id do |order|
+          order.channel&.prefixed_id
+        end
+
         attributes :number, :email, :customer_note,
                    :currency, :locale, :total_quantity,
                    :item_total, :display_item_total,

data/app/serializers/spree/api/v3/payment_method_serializer.rb

@@ -2,13 +2,22 @@ module Spree
   module Api
     module V3
       class PaymentMethodSerializer < BaseSerializer
-        typelize name: :string, description: [:string, nullable: true], type: :string, session_required: :boolean
+        typelize name: :string, description: [:string, nullable: true], type: :string,
+                 session_required: :boolean, source_required: :boolean
 
-        attributes :name, :description, :type
+        attributes :name, :description
+
+        attribute :type do |payment_method|
+          payment_method.class.api_type
+        end
 
         attribute :session_required do |payment_method|
           payment_method.session_required?
         end
+
+        attribute :source_required do |payment_method|
+          payment_method.source_required?
+        end
       end
     end
   end

data/app/serializers/spree/api/v3/product_publication_serializer.rb

@@ -0,0 +1,22 @@
+module Spree
+  module Api
+    module V3
+      class ProductPublicationSerializer < BaseSerializer
+        typelize product_id: :string,
+                 channel_id: :string,
+                 published_at: [:string, nullable: true],
+                 unpublished_at: [:string, nullable: true]
+
+        attributes published_at: :iso8601, unpublished_at: :iso8601
+
+        attribute :product_id do |publication|
+          publication.product&.prefixed_id
+        end
+
+        attribute :channel_id do |publication|
+          publication.channel&.prefixed_id
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/product_serializer.rb

@@ -5,6 +5,7 @@ module Spree
       # Customer-facing product data with limited fields
       class ProductSerializer < BaseSerializer
         typelize name: :string, description: [:string, nullable: true], description_html: [:string, nullable: true], slug: :string,
+                 meta_title: [:string, nullable: true],
                  meta_description: [:string, nullable: true], meta_keywords: [:string, nullable: true],
                  variant_count: :number,
                  default_variant_id: :string,
@@ -16,7 +17,7 @@ module Spree
                  tags: [:string, multi: true]
 
         attributes :name, :slug,
-                   :meta_description, :meta_keywords,
+                   :meta_title, :meta_description, :meta_keywords,
                    :variant_count,
                    available_on: :iso8601
 
@@ -99,6 +100,10 @@ module Spree
              resource: Spree.api.option_type_serializer,
              if: proc { expand?('option_types') }
 
+        many :option_values,
+             resource: Spree.api.option_value_serializer,
+             if: proc { expand?('option_values') }
+
         many :taxons,
              proc { |taxons, params|
                taxons.select { |t| t.taxonomy.store_id == params[:store].id }

data/app/serializers/spree/api/v3/stock_reservation_serializer.rb

@@ -0,0 +1,10 @@
+module Spree
+  module Api
+    module V3
+      # Minimal base; admin extends with full fields. Reservations have no
+      # customer-facing exposure today.
+      class StockReservationSerializer < BaseSerializer
+      end
+    end
+  end
+end

data/app/services/spree/webhooks/deliver_webhook.rb

@@ -56,7 +56,7 @@ module Spree
           'X-Spree-Webhook-Timestamp' => webhook_timestamp.to_s,
           'X-Spree-Webhook-Event' => @delivery.event_name
         }
-        body = payload_json
+        body = @delivery.payload.to_json
         http_options = { open_timeout: TIMEOUT, read_timeout: TIMEOUT, verify_mode: ssl_verify_mode }
 
         # SSRF protection is disabled in development so webhooks can reach
@@ -77,14 +77,10 @@ module Spree
       end
 
       def generate_signature
+        payload_json = @delivery.payload.to_json
         OpenSSL::HMAC.hexdigest('SHA256', @secret_key, "#{webhook_timestamp}.#{payload_json}")
       end
 
-      # Memoized so the signature is computed over exactly the bytes sent.
-      def payload_json
-        @payload_json ||= @delivery.deliverable_payload.to_json
-      end
-
       def webhook_timestamp
         @webhook_timestamp ||= Time.current.to_i
       end

data/app/subscribers/spree/webhook_event_subscriber.rb

@@ -50,16 +50,13 @@ module Spree
         )
       end
 
-      # Live credentials go over the wire but never into the delivery log.
-      persisted_payload, secrets = Spree::WebhookPayloadRedaction.split(payload)
-
       delivery = endpoint.webhook_deliveries.create!(
         event_name: event.name,
         event_id: event.id,
-        payload: persisted_payload
+        payload: payload
       )
 
-      Spree::WebhookDeliveryJob.perform_later(delivery.id, payload_secrets: secrets)
+      Spree::WebhookDeliveryJob.perform_later(delivery.id)
     rescue ActiveRecord::RecordNotUnique
       # Race condition: another thread already created this delivery — safe to ignore
     rescue StandardError => e

data/config/locales/en.yml

@@ -2,6 +2,7 @@
 en:
   spree:
     api:
+      cannot_delete: "%{model} cannot be deleted"
       current_password_invalid: Current password is invalid or missing
       gateway_error: 'There was a problem with the payment gateway: %{text}'
       invalid_api_key: Invalid API key (%{key}) specified.
@@ -9,6 +10,7 @@ en:
       invalid_taxonomy_id: Invalid taxonomy id.
       must_specify_api_key: You must specify an API key.
       negative_quantity: quantity is negative
+      newsletter_verification_token_invalid: Newsletter verification token is invalid or has expired.
       order:
         could_not_transition: The order could not be transitioned. Please fix the errors and try again.
         insufficient_quantity: An item in your cart has become unavailable.