spree_api 5.6.1 → 6.0.0.beta1

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -5,6 +5,11 @@ module Spree
         class CartsController < Store::ResourceController
           include Spree::Api::V3::CartResolvable
           include Spree::Api::V3::OrderLock
+          # The cart accepts a `po_document` signed blob id.
+          include ActiveStorage::SetCurrent
+
+          # A tampered signed id would otherwise surface as a 500.
+          rescue_from ActiveSupport::MessageVerifier::InvalidSignature, with: :render_invalid_po_document
 
           skip_before_action :set_resource
           prepend_before_action :require_authentication!, only: [:index, :associate]
@@ -17,12 +22,16 @@ module Spree
           def show
             @cart = find_cart
 
-            if @cart.ship_address_id.present? && @cart.shipments.empty?
+            # Never under a live completion claim — the advance mutates under
+            # with_order_lock, and a read must not 409 against the fence.
+            if @cart.ship_address_id.present? && @cart.fulfillments.empty? && !@cart.completion_claimed?
               ActiveRecord::Base.connected_to(role: :writing) do
                 with_order_lock { Spree::Checkout::Advance.call(order: @cart) }
               end
             end
 
+            # The customer is returning to a cart that may have sat for days.
+            sweep_unbuyable_lines!
             render_cart
           end
 
@@ -73,7 +82,7 @@ module Spree
           def destroy
             find_cart!
 
-            result = Spree.cart_destroy_service.call(order: @cart)
+            result = Spree.cart_destroy_service.call(cart: @cart)
 
             if result.success?
               head :no_content
@@ -90,12 +99,14 @@ module Spree
           # is already the caller's own.
           def associate
             @cart = find_cart_for_association
-            authorize!(:update, @cart, cart_token)
+            authorize_storefront_write!(@cart, token: cart_token)
             require_cart_token!
 
-            result = Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true)
+            result = Spree.cart_associate_service.call(guest_cart: @cart, customer: current_user, guest_only: true)
 
             if result.success?
+              # Signing in hands back a cart built earlier, possibly long ago.
+              sweep_unbuyable_lines!
               render_cart
             else
               render_service_error(result.error.to_s)
@@ -107,13 +118,13 @@ module Spree
           # Idempotent: if the cart is already completed, falls back to the
           # orders scope and returns the completed order.
           def complete
-            find_cart!
+            find_cart!(include_completed: true)
 
             if @cart.guest_checkout_disallowed?
               return render_authentication_required('api.errors.guest_checkout_not_allowed', 'You must be signed in to complete checkout')
             end
 
-            result = Spree::Dependencies.carts_complete_service.constantize.call(cart: @cart)
+            result = Spree::Dependencies.carts_complete_workflow.constantize.call(cart: @cart)
 
             if result.success?
               @cart = result.value
@@ -125,14 +136,30 @@ module Spree
               )
             end
           rescue ActiveRecord::RecordNotFound
-            @cart = current_store.orders.complete.find_by_prefix_id!(params[:id])
-            authorize!(:show, @cart, cart_token)
+            # Gateway-race retry with the id the client got back: the webhook
+            # completed the cart and the client re-posts. Foreign prefixes never
+            # decode against carts, so this only fires for an order or group id
+            # (or a genuinely unknown one, which 404s below). A split checkout
+            # handed the client a group, so both have to resolve here.
+            @cart = find_completed_result!
+            authorize_storefront_read!(@cart, token: cart_token)
 
             render_order
           end
 
           protected
 
+          # The completed result behind an id the client is retrying with —
+          # either the single order a plain checkout produced, or the group a
+          # split one did.
+          #
+          # @return [Spree::Order, Spree::OrderGroup]
+          def find_completed_result!
+            current_store.orders.complete.find_by_prefix_id!(params[:id])
+          rescue ActiveRecord::RecordNotFound
+            current_store.order_groups.find_by_prefix_id!(params[:id])
+          end
+
           def model_class
             Spree::Order
           end
@@ -147,13 +174,24 @@ module Spree
           # Explicit by-ID lookups (show/update) stay cross-channel so a shared
           # checkout can load any cart the caller is authorized for.
           def scope
-            current_store.carts.where(user: current_user, channel: current_channel).order(updated_at: :desc)
+            storefront_access_policy.
+              scope(current_store.carts.incomplete.where(channel: current_channel)).
+              order(updated_at: :desc)
           end
 
           private
 
+          def render_invalid_po_document
+            render_error(
+              code: ERROR_CODES[:validation_error],
+              message: Spree.t(:po_document_invalid_signed_id),
+              status: :unprocessable_content
+            )
+          end
+
           def permitted_params
             params.permit(
+              *model_additional_permitted_attributes,
               :email,
               :customer_note,
               :market_id,
@@ -161,6 +199,12 @@ module Spree
               :locale,
               :shipping_address_id,
               :billing_address_id,
+              :preferred_stock_location_id,
+              :company_id,
+              # The buyer's own purchase-order reference, and the signed blob id
+              # of the document behind it (from POST .../carts/:id/po_document).
+              :po_number,
+              :po_document,
               :use_shipping,
               shipping_address: address_params,
               billing_address: address_params,
@@ -174,7 +218,8 @@ module Spree
               :id, :first_name, :last_name,
               :address1, :address2,
               :city, :postal_code, :phone, :company,
-              :country_iso, :state_abbr, :state_name, :quick_checkout
+              # country_iso and state_abbr are the legacy write names, accepted until 6.1.
+              :country_code, :country_iso, :state_code, :state_abbr, :state_name, :quick_checkout
             ]
           end
 
@@ -185,7 +230,7 @@ module Spree
           # Find incomplete cart for associate action.
           # Only finds guest carts (no user) or carts already owned by current user (idempotent).
           def find_cart_for_association
-            current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id])
+            current_store.carts.incomplete.where(customer: [nil, current_user]).find_by_prefix_id!(params[:id])
           end
 
           # Claiming a cart requires presenting its token, even when the caller
@@ -193,7 +238,7 @@ module Spree
           def require_cart_token!
             valid = cart_token.present? && cart_token == @cart.token
 
-            raise CanCan::AccessDenied.new(nil, :update, @cart) unless valid
+            raise Spree::Storefront::AccessDenied unless valid
           end
         end
       end

data/app/controllers/spree/api/v3/store/categories_controller.rb

@@ -15,6 +15,12 @@ module Spree
             Spree.api.category_serializer
           end
 
+          # Exclude automatic (rule-based) rows still living in spree_categories
+          # until the Phase 4 migration moves them to Collections (removed in 6.1).
+          def scope
+            super.manual
+          end
+
           # Find category by permalink or prefixed ID with i18n scope for SEO-friendly URLs
           # Falls back to default locale if category is not found in the current locale
           def find_resource
@@ -26,9 +32,6 @@ module Spree
             end
           end
 
-          def collection_includes
-            [:taxonomy]
-          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/collections/products_controller.rb

@@ -0,0 +1,59 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Collections
+          # Dedicated collection PLP. Reuses the ProductsController search flow;
+          # the collection is applied as an `in_collection` filter (not an AR
+          # pre-scope, so Meilisearch's own filtering/counting/pagination works),
+          # and the collection's sort_order is the default when the request omits `sort`.
+          class ProductsController < Spree::Api::V3::Store::ProductsController
+            protected
+
+            def collection
+              return @collection if @collection.present?
+
+              result = search_provider.search_and_filter(
+                scope: scope.includes(collection_includes).preload_associations_lazily,
+                query: search_query,
+                filters: (search_filters || {}).merge('in_collection' => current_collection.prefixed_id),
+                sort: sort_param.presence || collection_default_sort,
+                page: page,
+                limit: limit
+              )
+
+              @pagy = result.pagy
+              @collection = result.products
+            end
+
+            private
+
+            # The collection's sort_order rendered in the API sort format
+            # (e.g. 'price asc' -> 'price') — the PLP default when `sort` is omitted.
+            def collection_default_sort
+              sort_order = current_collection.sort_order
+              return sort_order unless sort_order.to_s.include?(' ')
+
+              field, direction = sort_order.split(' ', 2)
+              direction == 'desc' ? "-#{field}" : field
+            end
+
+            # Resolve by permalink or prefixed ID, mirroring CollectionsController#find_resource
+            # (including the default-locale fallback so a non-default-locale permalink still
+            # resolves the PLP the collection detail page can load).
+            def current_collection
+              @current_collection ||= begin
+                id = params[:collection_id]
+                if id.to_s.start_with?('coll_')
+                  current_store.collections.find_by_prefix_id!(id)
+                else
+                  find_with_fallback_default_locale { current_store.collections.i18n.find_by!(permalink: id) }
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/collections_controller.rb

@@ -0,0 +1,36 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        class CollectionsController < ResourceController
+          include Spree::Api::V3::HttpCaching
+
+          protected
+
+          def model_class
+            Spree::Collection
+          end
+
+          def serializer_class
+            Spree.api.collection_serializer
+          end
+
+          def scope
+            super.ordered
+          end
+
+          # Find by permalink or prefixed ID (SEO-friendly URLs), i18n-scoped with a
+          # fallback to the default locale — mirrors the Categories controller.
+          def find_resource
+            id = params[:id]
+            if id.to_s.start_with?('coll_')
+              scope.find_by_prefix_id!(id)
+            else
+              find_with_fallback_default_locale { scope.i18n.find_by!(permalink: id) }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/companies/addresses_controller.rb

@@ -0,0 +1,81 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Companies
+          # The node's address book, managed by its members. Every entry is
+          # reached through its node, so standing over that node is the only
+          # thing that authorizes reading or writing one.
+          class AddressesController < BaseController
+            include Spree::Api::V3::CompanyAddressWrites
+
+            # POST /api/v3/store/companies/:company_id/addresses
+            def create
+              result = Spree.address_create_service.call(
+                address_params: permitted_params,
+                owner: @parent,
+                **default_flags
+              )
+
+              if result.success?
+                render json: serialize_resource(result.value), status: :created
+              else
+                render_validation_error(result.value.errors)
+              end
+            end
+
+            # PATCH /api/v3/store/companies/:company_id/addresses/:id
+            def update
+              result = Spree.address_update_service.call(
+                address: @resource,
+                address_params: permitted_params,
+                **default_flags
+              )
+
+              if result.success?
+                render json: serialize_resource(result.value)
+              else
+                render_validation_error(result.value.errors)
+              end
+            end
+
+            # DELETE /api/v3/store/companies/:company_id/addresses/:id
+            def destroy
+              @resource.destroy!
+              head :no_content
+            rescue ActiveRecord::RecordNotDestroyed => e
+              render_validation_error(e.record.errors.presence || e.message)
+            end
+
+            protected
+
+            def model_class
+              Spree::Address
+            end
+
+            def serializer_class
+              Spree.api.address_serializer
+            end
+
+            # Reading a book and keeping one are different rights: the listing
+            # includes what this node inherits, writes stay with the node that
+            # owns the row. The Store API authorizes purely by what this scope
+            # returns, so widening it for every action would let a division
+            # member rename or re-point its parent's entries.
+            def scope
+              action_name == 'index' ? @parent.address_book : @parent.addresses
+            end
+
+            def parent_association
+              :addresses
+            end
+
+            def permitted_params
+              params.permit(:label, *Spree::Api::V3::AddressParams::ADDRESS_KEYS)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/companies/base_controller.rb

@@ -0,0 +1,24 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Companies
+          # Anything a member manages under a company node. The parent is
+          # resolved through the caller's standing, so a node they may not act
+          # for is a 404 rather than a readable record.
+          class BaseController < ResourceController
+            prepend_before_action :require_authentication!
+
+            protected
+
+            def set_parent
+              @parent = @company = storefront_access_policy.
+                        scope(current_store.companies).
+                        find_by_prefix_id!(params[:company_id])
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/companies/invitations_controller.rb

@@ -0,0 +1,50 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Companies
+          # The pending invitations into one node, visible to its members.
+          # Revocation is addressed directly by invitation id.
+          class InvitationsController < BaseController
+            # DELETE /api/v3/store/companies/:company_id/invitations/:id
+            #
+            # Revokes rather than erases: a spent token keeps refusing.
+            def destroy
+              if @resource.revoke!
+                head :no_content
+              else
+                render_error(
+                  code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:validation_error],
+                  message: Spree.t('company_invitations.not_pending'),
+                  status: :unprocessable_content
+                )
+              end
+            end
+
+            protected
+
+            def model_class
+              Spree::CompanyInvitation
+            end
+
+            def serializer_class
+              Spree.api.company_invitation_serializer
+            end
+
+            # The listing shows live invitations only, so spent rows cannot
+            # push pending ones off the first page. Addressing one by id still
+            # finds it, so revoking an already-spent invitation answers "not
+            # pending" rather than "no such invitation".
+            def scope
+              action_name == 'index' ? @parent.invitations.pending : @parent.invitations
+            end
+
+            def parent_association
+              :invitations
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/companies/members_controller.rb

@@ -0,0 +1,66 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Companies
+          # The people with standing over one node, listed and added by its
+          # members. Adding takes an email and does the right thing: a
+          # membership for an existing customer, an invitation otherwise —
+          # the same convergent behavior as the dashboard endpoint. Any member
+          # can invite; restraint is Enterprise's policy layer.
+          class MembersController < BaseController
+            # POST /api/v3/store/companies/:company_id/members
+            def create
+              result = Spree.company_add_member_service.call(
+                company: @parent,
+                email: params.require(:customer_email),
+                inviter: current_user
+              )
+
+              if result.success?
+                serializer = if result.value.is_a?(Spree::CompanyInvitation)
+                               Spree.api.company_invitation_serializer
+                             else
+                               serializer_class
+                             end
+                render json: serializer.new(result.value, params: serializer_params).to_h, status: :created
+              else
+                render_validation_error(result.value.errors)
+              end
+            end
+
+            # DELETE /api/v3/store/companies/:company_id/members/:id
+            def destroy
+              @resource.destroy!
+              head :no_content
+            rescue ActiveRecord::RecordNotDestroyed => e
+              render_validation_error(e.record.errors.presence || e.message)
+            end
+
+            protected
+
+            def model_class
+              Spree::CompanyMembership
+            end
+
+            def serializer_class
+              Spree.api.company_membership_serializer
+            end
+
+            def scope
+              @parent.memberships
+            end
+
+            def parent_association
+              :memberships
+            end
+
+            def collection_includes
+              [:customer]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/companies/orders_controller.rb

@@ -0,0 +1,28 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Companies
+          # Completed purchases across the node's subtree — every member sees
+          # them; per-member narrowing is Enterprise's policy layer.
+          class OrdersController < BaseController
+            protected
+
+            def model_class
+              Spree::Order
+            end
+
+            def serializer_class
+              Spree.api.order_serializer
+            end
+
+            def scope
+              current_store.orders.complete.
+                where(company_id: @parent.self_and_descendants.select(:id))
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/companies_controller.rb

@@ -0,0 +1,47 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # A company node, self-served by its members. Authorization is
+        # standing plus the storefront access policy — never CanCanCan, never
+        # roles: OSS lets any member act within their subtree, and Enterprise
+        # narrows through the policy class
+        # (docs/plans/6.0-b2b-companies-and-catalogs.md).
+        class CompaniesController < ResourceController
+          prepend_before_action :require_authentication!
+
+          # PATCH /api/v3/store/companies/:id
+          def update
+            authorize_storefront_write!(@resource)
+
+            if @resource.update(permitted_params)
+              render json: serialize_resource(@resource)
+            else
+              render_validation_error(@resource.errors)
+            end
+          end
+
+          protected
+
+          def model_class
+            Spree::Company
+          end
+
+          def serializer_class
+            Spree.api.company_serializer
+          end
+
+          # The nodes the caller has standing over — a node outside it is a
+          # 404, never a readable record.
+          def scope
+            storefront_access_policy.scope(current_store.companies)
+          end
+
+          def permitted_params
+            params.permit(:name)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/company_invitations_controller.rb

@@ -0,0 +1,90 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # The invitee's side of an invitation: look up and accept by plaintext
+        # token, unauthenticated. The token from the invite email IS the
+        # credential, and the acceptance page must load before the invitee has
+        # an account, even on a login-gated store — which is why this is the
+        # one part of the company surface not reached through a node.
+        #
+        # Members revoke through the node
+        # (Store::Companies::InvitationsController).
+        class CompanyInvitationsController < ResourceController
+          allow_guest_storefront_access!
+
+          # Both actions are token lookups, not prefixed-id reads — the
+          # standing scope would 404 the unauthenticated invitee.
+          skip_before_action :set_resource
+
+          # GET /api/v3/store/company_invitations/:token — what is being
+          # joined. Expired and revoked tokens 404.
+          def show
+            invitation = find_by_token!
+
+            render json: serialize_resource(invitation).merge(
+              'company_name' => invitation.company.name,
+              'store_name' => current_store.name
+            )
+          end
+
+          # POST /api/v3/store/company_invitations/:token/accept
+          #
+          # Takes a registration payload (the account is created through the
+          # customer-creation workflow, with the invited email), or an
+          # authenticated request from a customer the invitation then binds
+          # to. Returns the created membership.
+          def accept
+            invitation = find_by_token!
+
+            result = Spree.company_invitation_accept_service.call(
+              invitation: invitation,
+              customer: current_user,
+              customer_attributes: current_user ? nil : registration_params.to_h
+            )
+
+            if result.success?
+              render json: Spree.api.company_membership_serializer.new(
+                result.value, params: serializer_params
+              ).to_h, status: :created
+            elsif result.value.respond_to?(:errors) && result.value.errors.any?
+              render_validation_error(result.value.errors)
+            else
+              render_error(
+                code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:validation_error],
+                message: Spree.t('company_invitations.not_pending'),
+                status: :unprocessable_content
+              )
+            end
+          end
+
+
+          protected
+
+          def model_class
+            Spree::CompanyInvitation
+          end
+
+          def serializer_class
+            Spree.api.company_invitation_serializer
+          end
+
+
+          private
+
+          # Token lookup, scoped to the current store and to pending rows —
+          # a spent, revoked or expired token does not exist.
+          def find_by_token!
+            Spree::CompanyInvitation.pending.
+              where(company_id: current_store.companies.select(:id)).
+              find_by!(token: params[:token] || params[:id])
+          end
+
+          def registration_params
+            params.permit(:first_name, :last_name, :phone, :password, :password_confirmation)
+          end
+        end
+      end
+    end
+  end
+end