spree_api 5.5.3 → 5.6.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e6fe1449422b9662417af9cc9e31ea0b9dc08624e7ad70b0a0e1570cf0f98698
-  data.tar.gz: b859292883306b7128b3057e2df54a298469ea94cb246bb064e58b16e21d9f3c
+  metadata.gz: 89ddc07a0f4f9334f2ecb79bf2283986e8078e5566d4a7b1c672fadd2f04453d
+  data.tar.gz: 1db32c6bf66382dc2786d1898aaaf5e6c3e1a04b721404fad423c37cc3e0326b
 SHA512:
-  metadata.gz: d4b81e56588d8ea4afa9756d6d3d128ff11222fd3fe34acf52ffc1715e83a87e58b4749f8b0dcfc7254fedad589133c15b5c828ae1e501b4f94df0bdc753afd3
-  data.tar.gz: 4b28146ceb74aa7114c2ffea51f1fa4b107f5a65c48ed331c59354da6bd5bf99ed38242a298643832622a14e69958c8b4038af72c338430dc5c6ff72acc5b810
+  metadata.gz: 001b8a751f6cd60f71ee162e4387570f8976bd47a3c6794f6d850ba42fe157c3850a137646fed9f6c22651e9d86bf08bad579f2a6854370442cc9dbec0ae1c3f
+  data.tar.gz: 6eb41a561383ce8ab469c21c1a341673164fadb3f5e738ccb7b0635bccd7ff56d6d280d30bcd3aa1bea852763b4f13908b96e45b071013736013c759f71f48fe

data/app/controllers/concerns/spree/api/v3/admin/role_grant_guard.rb

@@ -78,13 +78,15 @@ module Spree
           end
 
           # The caller's store-scoped role names, fetched once per request.
+          # Scoped by store_id so the caller's own privileges are recognized even
+          # when their role is held on a non-store resource bound to this store.
           def caller_role_names
             return @caller_role_names if defined?(@caller_role_names)
 
             user = try_spree_current_user
             @caller_role_names =
               if user.respond_to?(:role_users)
-                user.role_users.where(resource: current_store).joins(:role).
+                user.role_users.where(store: current_store).joins(:role).
                   pluck("#{Spree::Role.table_name}.name")
               else
                 []

data/app/controllers/concerns/spree/api/v3/admin_authentication.rb

@@ -64,7 +64,7 @@ module Spree
         def current_user_member_of_store?
           return false unless current_user.respond_to?(:role_users)
 
-          current_user.role_users.exists?(resource: current_store)
+          current_user.role_users.exists?(store: current_store)
         end
 
         def set_no_store_cache

data/app/controllers/concerns/spree/api/v3/channel_resolution.rb

@@ -35,8 +35,10 @@ module Spree
         # +Spree::Current.channel+ itself, which avoids one query per
         # header-less API request.
         def set_current_channel
-          channel = channel_from_header
-          Spree::Current.channel = channel if channel
+          # Memoize so a later +current_channel+ call (e.g. the storefront gate,
+          # serializer params) reuses this row instead of re-querying the header.
+          @current_channel = channel_from_header
+          Spree::Current.channel = @current_channel if @current_channel
         end
 
         def channel_from_header

data/app/controllers/concerns/spree/api/v3/locale_and_currency.rb

@@ -114,9 +114,12 @@ module Spree
 
         private
 
-        # Sets +I18n.locale+ and +Spree::Current.locale+ from the resolved locale.
+        # Sets +I18n.locale+ and +Spree::Current.locale+ from the resolved
+        # locale, and records the request's content locale — the store's
+        # default locale, in which base (untranslated) columns are authored.
         def set_locale
           Spree::Current.locale = current_locale
+          Spree::Current.content_locale = current_store&.default_locale
           I18n.locale = current_locale
         end
 

data/app/controllers/concerns/spree/api/v3/storefront_gating.rb

@@ -0,0 +1,65 @@
+module Spree
+  module Api
+    module V3
+      # Enforces channel-level storefront access gating on the Store API.
+      # The posture is resolved from the request's channel
+      # (+Spree::Channel#resolved_storefront_access+, with store fallback):
+      #
+      # - +login_required+ → 401 on every gated read for unauthenticated requests
+      # - +prices_hidden+  → price fields serialized as +null+ for guests
+      #
+      # "Guest" means no authenticated customer (publishable key or guest cart
+      # token without a customer JWT). Logged-in customers are never gated.
+      module StorefrontGating
+        extend ActiveSupport::Concern
+
+        included do
+          before_action :enforce_storefront_login_required!
+        end
+
+        class_methods do
+          # Opts a controller out of the +login_required+ gate. Use for endpoints
+          # that must stay reachable before authentication — sign in / register,
+          # password reset, and pre-login reference data (countries, currencies,
+          # locales, markets, newsletter, tokenized digital downloads).
+          def allow_guest_storefront_access!
+            skip_before_action :enforce_storefront_login_required!, raise: false
+          end
+        end
+
+        protected
+
+        # @return [Boolean] whether prices must be hidden from this request.
+        def hide_prices?
+          try_spree_current_user.blank? && !!current_channel&.storefront_prices_hidden?
+        end
+
+        # Injects the price-hiding flag so the shared +price_for+/+price_in+
+        # serializer helpers null prices for gated guests.
+        def serializer_params
+          super.merge(hide_prices: hide_prices?)
+        end
+
+        # Renders a 401 with the shared +authentication_required+ error code.
+        # @param message_key [String] i18n key for the error message
+        # @param default_message [String] fallback when the key is missing
+        def render_authentication_required(message_key, default_message)
+          render_error(
+            code: ErrorHandler::ERROR_CODES[:authentication_required],
+            message: Spree.t(message_key, default: default_message),
+            status: :unauthorized
+          )
+        end
+
+        private
+
+        def enforce_storefront_login_required!
+          return if try_spree_current_user.present?
+          return unless current_channel&.storefront_login_required?
+
+          render_authentication_required('api.errors.storefront_login_required', 'Authentication required to access this store')
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/admin_users_controller.rb

@@ -60,7 +60,7 @@ module Spree
           end
 
           def collection_includes
-            [{ role_users: :role }]
+            [{ role_users: :role, avatar_attachment: :blob }]
           end
 
           # Restrict to users with a role assignment on the current store.

data/app/controllers/spree/api/v3/admin/categories/products_controller.rb

@@ -0,0 +1,98 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module Categories
+          # Manages the products classified under a category — the manual
+          # membership half of the old Rails admin's taxon "Products" panel.
+          # Listing is ordered by the classification position so the merchant's
+          # manual ordering round-trips; +reposition+ persists a drag-to-reorder.
+          class ProductsController < ResourceController
+            scoped_resource :products
+
+            # Skip the base single-resource load — membership actions resolve
+            # the product against the category's scope themselves (set_product).
+            skip_before_action :set_resource
+            before_action :set_product, only: [:destroy, :reposition]
+
+            # POST /api/v3/admin/categories/:category_id/products
+            # Body: { product_id: 'prod_…' }
+            def create
+              product = product_scope.find_by_prefix_id!(params[:product_id])
+              Spree::Taxons::AddProducts.call(taxons: [@category], products: [product])
+              render json: serialize_resource(product), status: :created
+            end
+
+            # DELETE /api/v3/admin/categories/:category_id/products/:id
+            # Bulk removal goes through the existing
+            # POST /products/bulk_remove_from_categories ({ ids, category_ids }).
+            def destroy
+              Spree::Taxons::RemoveProducts.call(taxons: [@category], products: [@product])
+              head :no_content
+            end
+
+            # PATCH /api/v3/admin/categories/:category_id/products/:id/reposition
+            # Body: { new_position: 0 } — 0-based index among the category's products.
+            # @product is already constrained to the category's scope, so a
+            # classification always exists.
+            def reposition
+              position = integer_param(:new_position)
+              return render_invalid_position if position.nil?
+
+              classification_for(@product).insert_at(position + 1)
+              head :no_content
+            end
+
+            protected
+
+            def model_class
+              Spree::Product
+            end
+
+            def serializer_class
+              Spree.api.admin_product_serializer
+            end
+
+            # The category's products, ordered by classification position.
+            def scope
+              product_scope.
+                joins(:classifications).
+                where(Spree::Classification.table_name => { taxon_id: @category.id }).
+                order(Spree::Classification.table_name => { position: :asc })
+            end
+
+            # A product is classified at most once per taxon (unique [taxon_id,
+            # product_id]), so the join can't duplicate rows — DISTINCT is
+            # unnecessary and breaks Postgres ("ORDER BY position must appear in
+            # the select list of a DISTINCT query").
+            def collection_distinct?
+              false
+            end
+
+            # Loads the parent category (runs before the base set_resource).
+            def set_parent
+              @category = Spree::Category.accessible_by(current_ability, :update).
+                          for_store(current_store).
+                          find_by_prefix_id!(params[:category_id])
+              authorize_parent!(@category)
+            end
+
+            private
+
+            def set_product
+              @product = scope.find_by_prefix_id!(params[:id])
+            end
+
+            def product_scope
+              current_store.products.accessible_by(current_ability, :show)
+            end
+
+            def classification_for(product)
+              Spree::Classification.find_by(taxon_id: @category.id, product_id: product.id)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/categories_controller.rb

@@ -2,9 +2,46 @@ module Spree
   module Api
     module V3
       module Admin
+        # Admin CRUD for categories — the hierarchical product classification
+        # half of today's dual-purpose Taxon. Rule-based / automatic taxons
+        # (the "collection" half moving to Spree::Collection in 6.0) are
+        # excluded from this API entirely (see +scope+), and none of the
+        # collection-bound attributes (automatic, sort_order, rules) are
+        # readable or writable here.
         class CategoriesController < ResourceController
           scoped_resource :categories
 
+          # PATCH /api/v3/admin/categories/:id/reposition
+          # Body: { new_parent_id: 'ctg_…' (omit for top level), new_position: 0 }
+          # Moves the category to a new parent (or the top level) and/or index.
+          def reposition
+            category = find_resource
+            authorize! :update, category
+
+            position = integer_param(:new_position)
+            return render_invalid_position if position.nil?
+
+            # Operate on a base Taxon instance (unscoped): the Category default
+            # i18n scope interferes with awesome_nested_set's lft/rgt reads, so
+            # the move silently no-ops on a scoped instance.
+            node = scope.find(category.id)
+            parent = reposition_parent
+
+            if parent
+              # move_to_child_with_index positions among the parent's children.
+              node.move_to_child_with_index(scope.find(parent.id), reposition_index(category, position, siblings_of(parent)))
+            else
+              move_to_root_at_index(node, reposition_index(category, position, siblings_of(nil)))
+            end
+            render json: serialize_resource(category.reload)
+          rescue CollectiveIdea::Acts::NestedSet::Move::ImpossibleMove => e
+            render_error(
+              code: ERROR_CODES[:validation_error],
+              message: e.message,
+              status: :unprocessable_content
+            )
+          end
+
           protected
 
           def model_class
@@ -15,8 +52,71 @@ module Spree
             Spree.api.admin_category_serializer
           end
 
-          def scope
-            super.where(taxonomy: current_store.taxonomies)
+          # Category-half attributes only. Deliberately excludes the
+          # collection-bound fields (automatic, sort_order, rules_match_policy,
+          # taxon_rules) and taxonomy_id — those belong to Spree::Collection
+          # (6.0) and Taxonomy is being dropped. A prefixed parent_id resolves
+          # within scope (so a parent from another store or an automatic taxon
+          # can't be targeted).
+          def permitted_params
+            permitted = params.permit(
+              :name, :description, :permalink,
+              :meta_title, :meta_description, :meta_keywords,
+              :hide_from_nav, :image, :square_image,
+              # Inline custom field values keyed by definition id. The model
+              # setter (Spree::Metafields#custom_fields=) validates each entry
+              # against its definition. `value` is permitted as a scalar AND as
+              # `value: []` / `value: {}` so JSON metafields round-trip whether
+              # the parsed payload is an array or an object, while
+              # text/number/boolean ship scalars.
+              custom_fields: [:id, :custom_field_definition_id, :value, { value: [] }, { value: {} }]
+            )
+            permitted[:parent] = scope.find_by_prefix_id!(params[:parent_id]) if params[:parent_id].present?
+            permitted
+          end
+
+          private
+
+          # Target parent for a reposition — the requested category, or nil to
+          # promote to the top level.
+          # @return [Spree::Category, nil]
+          def reposition_parent
+            scope.find_by_prefix_id!(params[:new_parent_id]) if params[:new_parent_id].present?
+          end
+
+          # The siblings among which the node is being placed, in tree order:
+          # the parent's children, or the store's root categories at the top
+          # level.
+          # @return [ActiveRecord::Relation]
+          def siblings_of(parent)
+            parent ? parent.children : scope.where(parent_id: nil).order(:lft)
+          end
+
+          # Clamp the requested 0-based index into the valid range so an
+          # out-of-range index appends to the end instead of dereferencing a nil
+          # sibling. The category can occupy indices 0..N where N is the count of
+          # its *other* siblings; index N places it last.
+          # @return [Integer]
+          def reposition_index(category, position, siblings)
+            others = siblings.where.not(id: category.id).count
+            position.clamp(0, others)
+          end
+
+          # Positions the node at +index+ among the store's root categories.
+          # awesome_nested_set's move_to_child_with_index(:root, ...) can't be
+          # used here: its +roots+ are global (every parentless taxon across all
+          # stores and taxonomies), whereas we order only this store's manual
+          # roots (the +scope+). So position relative to the target root sibling.
+          def move_to_root_at_index(node, index)
+            others = scope.where(parent_id: nil).where.not(id: node.id).order(:lft).to_a
+            target = others[index]
+            if target
+              node.move_to_left_of(target)
+            elsif others.any?
+              node.move_to_right_of(others.last)
+            else
+              node.move_to_root
+            end
           end
         end
       end

data/app/controllers/spree/api/v3/admin/customers_controller.rb

@@ -74,12 +74,18 @@ module Spree
             super.with_order_aggregates
           end
 
+          # `customer_groups` is preloaded because the serializer's always-on
+          # `customer_group_ids` attribute reads it for every row.
           def collection_includes
-            [:rich_text_internal_note, taggings: :tag]
+            [:rich_text_internal_note, :customer_groups, taggings: :tag]
           end
 
           private
 
+          def scope_includes
+            [:customer_groups, :store_credits]
+          end
+
           # Mirrors the products controller's resource-named key so SPA toasts
           # can substitute `{customer_count}` instead of the generic
           # `{record_count}` shipped by `Spree::Api::V3::BulkOperations`.
@@ -92,7 +98,7 @@ module Spree
               :email, :first_name, :last_name, :phone,
               :password, :password_confirmation, :selected_locale,
               :avatar, :accepts_email_marketing, :internal_note,
-              metadata: {}, tags: []
+              metadata: {}, tags: [], customer_group_ids: []
             )
           end
 

data/app/controllers/spree/api/v3/admin/exports_controller.rb

@@ -87,6 +87,8 @@ module Spree
               store: current_store,
               user: try_spree_current_user
             )
+            # The done email's download button target — allowed origins only.
+            attrs[:results_url] = validated_allowed_origin_url(attrs[:results_url])
             klass.new(attrs)
           end
 
@@ -96,7 +98,7 @@ module Spree
           # is intentionally dropped — only CSV is supported and Rails' request
           # format would otherwise overwrite the model's enum.
           def permitted_params
-            attrs = params.permit(:type, :record_selection)
+            attrs = params.permit(:type, :record_selection, :results_url)
             raw = params[:search_params]
             attrs[:search_params] = raw.respond_to?(:to_unsafe_h) ? raw.to_unsafe_h : raw if raw.present?
             attrs

data/app/controllers/spree/api/v3/admin/import_rows_controller.rb

@@ -0,0 +1,49 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Row listing for one import — the failure report
+        # (`GET /admin/imports/:import_id/rows?q[status_eq]=failed`).
+        # Read-only; gated like its parent surface by the write scope of the
+        # imported resource, since rows expose the uploaded data.
+        class ImportRowsController < ResourceController
+          protected
+
+          def model_class
+            Spree::ImportRow
+          end
+
+          def serializer_class
+            Spree.api.admin_import_row_serializer
+          end
+
+          def parent_association
+            :rows
+          end
+
+          def set_parent
+            @parent = parent_import
+            authorize_parent!(@parent)
+          end
+
+          # Resolved through the imports scope so store isolation matches the
+          # parent surface; memoized because the API-key scope gate also needs
+          # it (it runs before set_parent).
+          def parent_import
+            @parent_import ||= Spree::Import.for_store(current_store).
+                               accessible_by(current_ability, :show).
+                               find_by_prefix_id!(params[:import_id])
+          end
+
+          def action_kind
+            'write'
+          end
+
+          def scoped_resource_name
+            parent_import.class.required_scope || :all
+          end
+        end
+      end
+    end
+  end
+end