spree_api 5.5.2 → 5.5.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d3239fe21ccaa81a45ba98e56cf9729a2a1e19717753acd2a2bc7942486ed65
-  data.tar.gz: 145a65f51b1cf39e0a0e8ed74e1c2a964abce29f2eac0bc6403894bb85ccbde2
+  metadata.gz: 25e42383bfb6759f7fd2f6831ab3d168ccfc049bae4a9c01e9dc8c63bb4a6bfc
+  data.tar.gz: a982087e479d23574fea03267796a054d79536fb7dc2fb7aa090452e7aab4f6e
 SHA512:
-  metadata.gz: f361c60828f3dc8d9e2d67191333ca91947ba5d8cc7c11cb3c93ca691c7cb151cd7db27d9b9fbadea1fcec190709de9de4b61a569bba0c00a9173037659bceba
-  data.tar.gz: 17634d38ca453b81aeac073b9cb77e81d6ed70b621e1f9aadd161060373cf0a70b44a10d91f910e0a5ffc0f28a93e83214e18bfcfaacd57572d702ed3b7d0c2d
+  metadata.gz: 7ee5ac82a202296ec6c83bf2d0a37b201f7905f6b7fa9caca1de5f8c4874717e44495cc37ef15bf5e545ae30a8464dccc8d9c70603836ab8a50e5752551e70f3
+  data.tar.gz: fa9e45fa9b4b269fb11143db92afe6786cfaa369d172ad8a7aae4e860f3efa48d5cde09785bc916cfb1fcfbed4eba38d1d5c74caa1cd7ff8cc962c2743dba367

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -83,10 +83,15 @@ module Spree
           end
 
           # PATCH /api/v3/store/carts/:id/associate
-          # Associates a guest cart with the currently authenticated user
-          # Requires: JWT authentication + cart ID in URL
+          # Associates a guest cart with the currently authenticated user.
+          # Requires: JWT authentication + cart ID in URL + possession of the
+          # cart's token (x-spree-token). The token is the credential that
+          # authorizes claiming the cart, so it is required even when the cart
+          # is already the caller's own.
           def associate
             @cart = find_cart_for_association
+            authorize!(:update, @cart, cart_token)
+            require_cart_token!
 
             result = Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true)
 
@@ -173,6 +178,14 @@ module Spree
           def find_cart_for_association
             current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id])
           end
+
+          # Claiming a cart requires presenting its token, even when the caller
+          # already owns it — the token, not ownership, is the claim credential.
+          def require_cart_token!
+            valid = cart_token.present? && cart_token == @cart.token
+
+            raise CanCan::AccessDenied.new(nil, :update, @cart) unless valid
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/products/filters_controller.rb

@@ -14,17 +14,18 @@ module Spree
                   filters: (search_filters || {}).merge('_category' => category)
                 )
 
-                {
-                  filters: result.filters,
-                  sort_options: result.sort_options,
-                  default_sort: result.default_sort,
-                  total_count: result.total_count
-                }
+                serialize_resource(result)
               end
 
               render json: json
             end
 
+            protected
+
+            def serializer_class
+              Spree.api.product_filters_serializer
+            end
+
             private
 
             def filters_cache_key

data/app/jobs/spree/webhook_delivery_job.rb

@@ -13,10 +13,15 @@ module Spree
 
     # Accept optional second argument for backward compatibility with jobs
     # enqueued before this change was deployed.
-    def perform(delivery_id, _deprecated_secret_key = nil)
+    #
+    # `payload_secrets` carries credentials withheld from the persisted payload
+    # so the outgoing request body stays complete. See
+    # {Spree::WebhookPayloadRedaction}.
+    def perform(delivery_id, _deprecated_secret_key = nil, payload_secrets: nil)
       delivery = Spree::WebhookDelivery.find_by(id: delivery_id)
       return if delivery.nil?
 
+      delivery.payload_secrets = payload_secrets
       secret_key = delivery.webhook_endpoint.secret_key
       Spree::Webhooks::DeliverWebhook.call(delivery: delivery, secret_key: secret_key)
     end

data/app/serializers/spree/api/v3/admin/webhook_delivery_serializer.rb

@@ -25,10 +25,15 @@ module Spree
 
           attributes :event_name, :event_id, :response_code, :execution_time,
                      :error_type, :request_errors, :response_body, :success,
-                     :payload,
                      created_at: :iso8601, updated_at: :iso8601,
                      delivered_at: :iso8601
 
+          # Redacted again on read: deliveries written before payload redaction
+          # shipped still hold live credentials in the column.
+          attribute :payload do |delivery|
+            Spree::WebhookPayloadRedaction.split(delivery.payload).first
+          end
+
           attribute :webhook_endpoint_id do |delivery|
             delivery.webhook_endpoint&.prefixed_id
           end

data/app/serializers/spree/api/v3/product_filter_availability_option_serializer.rb

@@ -0,0 +1,11 @@
+module Spree
+  module Api
+    module V3
+      class ProductFilterAvailabilityOptionSerializer < BaseSerializer
+        typelize id: [:string, enum: %w[in_stock out_of_stock]], count: :number
+
+        attributes :id, :count
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/product_filter_availability_serializer.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V3
+      class ProductFilterAvailabilitySerializer < BaseSerializer
+        typelize id: :string,
+                 type: "'availability'",
+                 options: [:ProductFilterAvailabilityOption, multi: true]
+
+        attributes :id, :type
+
+        many :options, resource: proc { Spree.api.product_filter_availability_option_serializer }
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/product_filter_category_option_serializer.rb

@@ -0,0 +1,14 @@
+module Spree
+  module Api
+    module V3
+      class ProductFilterCategoryOptionSerializer < BaseSerializer
+        typelize id: :string,
+                 name: :string,
+                 permalink: :string,
+                 count: :number
+
+        attributes :id, :name, :permalink, :count
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/product_filter_category_serializer.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V3
+      class ProductFilterCategorySerializer < BaseSerializer
+        typelize id: :string,
+                 type: "'category'",
+                 options: [:ProductFilterCategoryOption, multi: true]
+
+        attributes :id, :type
+
+        many :options, resource: proc { Spree.api.product_filter_category_option_serializer }
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/product_filter_option_serializer.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Api
+    module V3
+      class ProductFilterOptionSerializer < BaseSerializer
+        typelize id: :string,
+                 type: "'option'",
+                 name: :string,
+                 label: :string,
+                 kind: :string,
+                 options: [:ProductFilterOptionValue, multi: true]
+
+        attributes :id, :type, :name, :label, :kind
+
+        many :options, resource: proc { Spree.api.product_filter_option_value_serializer }
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/product_filter_option_value_serializer.rb

@@ -0,0 +1,17 @@
+module Spree
+  module Api
+    module V3
+      class ProductFilterOptionValueSerializer < BaseSerializer
+        typelize id: :string,
+                 name: :string,
+                 label: :string,
+                 position: :number,
+                 color_code: [:string, nullable: true],
+                 image_url: [:string, nullable: true],
+                 count: :number
+
+        attributes :id, :name, :label, :position, :color_code, :image_url, :count
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/product_filter_price_range_serializer.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V3
+      class ProductFilterPriceRangeSerializer < BaseSerializer
+        typelize id: :string,
+                 type: "'price_range'",
+                 min: :number,
+                 max: :number,
+                 currency: :string
+
+        attributes :id, :type, :min, :max, :currency
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/product_filter_sort_option_serializer.rb

@@ -0,0 +1,11 @@
+module Spree
+  module Api
+    module V3
+      class ProductFilterSortOptionSerializer < BaseSerializer
+        typelize id: :string
+
+        attributes :id
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/product_filters_serializer.rb

@@ -0,0 +1,36 @@
+module Spree
+  module Api
+    module V3
+      class ProductFiltersSerializer < BaseSerializer
+        typelize default_sort: :string,
+                 total_count: :number,
+                 filters: 'Array<ProductFilterPriceRange | ProductFilterAvailability | ProductFilterOption | ProductFilterCategory>',
+                 sort_options: [:ProductFilterSortOption, { multi: true }]
+
+        attributes :default_sort, :total_count
+
+        attribute :filters do |result|
+          result.filters.filter_map do |filter|
+            filter_type = filter[:type]
+            serializer_class = case filter_type
+                               when 'price_range'
+                                 Spree.api.product_filter_price_range_serializer
+                               when 'availability'
+                                 Spree.api.product_filter_availability_serializer
+                               when 'option'
+                                 Spree.api.product_filter_option_serializer
+                               when 'category'
+                                 Spree.api.product_filter_category_serializer
+                               else
+                                 raise ArgumentError, "Unknown filter type: #{filter_type.inspect}"
+                               end
+
+            serializer_class.new(filter, params: params).serializable_hash
+          end
+        end
+
+        many :sort_options, resource: proc { Spree.api.product_filter_sort_option_serializer }
+      end
+    end
+  end
+end

data/app/services/spree/webhooks/deliver_webhook.rb

@@ -56,7 +56,7 @@ module Spree
           'X-Spree-Webhook-Timestamp' => webhook_timestamp.to_s,
           'X-Spree-Webhook-Event' => @delivery.event_name
         }
-        body = @delivery.payload.to_json
+        body = payload_json
         http_options = { open_timeout: TIMEOUT, read_timeout: TIMEOUT, verify_mode: ssl_verify_mode }
 
         # SSRF protection is disabled in development so webhooks can reach
@@ -77,10 +77,14 @@ module Spree
       end
 
       def generate_signature
-        payload_json = @delivery.payload.to_json
         OpenSSL::HMAC.hexdigest('SHA256', @secret_key, "#{webhook_timestamp}.#{payload_json}")
       end
 
+      # Memoized so the signature is computed over exactly the bytes sent.
+      def payload_json
+        @payload_json ||= @delivery.deliverable_payload.to_json
+      end
+
       def webhook_timestamp
         @webhook_timestamp ||= Time.current.to_i
       end

data/app/subscribers/spree/webhook_event_subscriber.rb

@@ -50,13 +50,16 @@ module Spree
         )
       end
 
+      # Live credentials go over the wire but never into the delivery log.
+      persisted_payload, secrets = Spree::WebhookPayloadRedaction.split(payload)
+
       delivery = endpoint.webhook_deliveries.create!(
         event_name: event.name,
         event_id: event.id,
-        payload: payload
+        payload: persisted_payload
       )
 
-      Spree::WebhookDeliveryJob.perform_later(delivery.id)
+      Spree::WebhookDeliveryJob.perform_later(delivery.id, payload_secrets: secrets)
     rescue ActiveRecord::RecordNotUnique
       # Race condition: another thread already created this delivery — safe to ignore
     rescue StandardError => e

data/lib/spree/api/dependencies.rb

@@ -136,6 +136,15 @@ module Spree
         custom_field_serializer: 'Spree::Api::V3::CustomFieldSerializer',
         shipping_category_serializer: 'Spree::Api::V3::ShippingCategorySerializer',
         tax_category_serializer: 'Spree::Api::V3::TaxCategorySerializer',
+        product_filters_serializer: 'Spree::Api::V3::ProductFiltersSerializer',
+        product_filter_price_range_serializer: 'Spree::Api::V3::ProductFilterPriceRangeSerializer',
+        product_filter_availability_serializer: 'Spree::Api::V3::ProductFilterAvailabilitySerializer',
+        product_filter_availability_option_serializer: 'Spree::Api::V3::ProductFilterAvailabilityOptionSerializer',
+        product_filter_option_serializer: 'Spree::Api::V3::ProductFilterOptionSerializer',
+        product_filter_option_value_serializer: 'Spree::Api::V3::ProductFilterOptionValueSerializer',
+        product_filter_category_serializer: 'Spree::Api::V3::ProductFilterCategorySerializer',
+        product_filter_category_option_serializer: 'Spree::Api::V3::ProductFilterCategoryOptionSerializer',
+        product_filter_sort_option_serializer: 'Spree::Api::V3::ProductFilterSortOptionSerializer',
 
         # v3 event serializers (for models without Store API endpoints yet)
         asset_serializer: 'Spree::Api::V3::AssetSerializer',

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.5.2
+  version: 5.5.4
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-06 00:00:00.000000000 Z
+date: 2026-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.5.2
+        version: 5.5.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.5.2
+        version: 5.5.4
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -305,6 +305,15 @@ files:
 - app/serializers/spree/api/v3/policy_serializer.rb
 - app/serializers/spree/api/v3/price_history_serializer.rb
 - app/serializers/spree/api/v3/price_serializer.rb
+- app/serializers/spree/api/v3/product_filter_availability_option_serializer.rb
+- app/serializers/spree/api/v3/product_filter_availability_serializer.rb
+- app/serializers/spree/api/v3/product_filter_category_option_serializer.rb
+- app/serializers/spree/api/v3/product_filter_category_serializer.rb
+- app/serializers/spree/api/v3/product_filter_option_serializer.rb
+- app/serializers/spree/api/v3/product_filter_option_value_serializer.rb
+- app/serializers/spree/api/v3/product_filter_price_range_serializer.rb
+- app/serializers/spree/api/v3/product_filter_sort_option_serializer.rb
+- app/serializers/spree/api/v3/product_filters_serializer.rb
 - app/serializers/spree/api/v3/product_publication_serializer.rb
 - app/serializers/spree/api/v3/product_serializer.rb
 - app/serializers/spree/api/v3/promotion_serializer.rb
@@ -355,9 +364,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.5.2
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.5.4
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.5.2
+  source_code_uri: https://github.com/spree/spree/tree/v5.5.4
 post_install_message:
 rdoc_options: []
 require_paths: