spree_api 5.6.1 → 6.0.0.beta1

data/app/controllers/spree/api/v3/store/countries_controller.rb

@@ -2,16 +2,18 @@ module Spree
   module Api
     module V3
       module Store
+        # Deliberately uncached. The country list is reference data that only
+        # changes with the countries gem, so the conditional-GET machinery had
+        # nothing meaningful to key on: it fell back to the store's timestamp,
+        # which invalidates on every unrelated store edit while never noticing
+        # a change to the countries themselves.
         class CountriesController < Store::BaseController
           allow_guest_storefront_access!
-          include Spree::Api::V3::HttpCaching
 
           # GET /api/v3/store/countries
           def index
             countries = current_store.countries_from_markets
 
-            return unless cache_collection(countries)
-
             render json: {
               data: countries.map { |country| serialize_country(country) }
             }
@@ -19,9 +21,9 @@ module Spree
 
           # GET /api/v3/store/countries/:id
           def show
-            country = current_store.countries_from_markets.find_by!(iso: params[:id].upcase)
-
-            return unless cache_resource(country)
+            iso = params[:id].to_s.upcase
+            country = current_store.countries_from_markets.find { |candidate| candidate.iso == iso }
+            raise ActiveRecord::RecordNotFound if country.nil?
 
             render json: serialize_country(country)
           end

data/app/controllers/spree/api/v3/store/customer/addresses_controller.rb

@@ -63,8 +63,10 @@ module Spree
 
             def permitted_params
               params.permit(
+                *model_additional_permitted_attributes,
                 :first_name, :last_name, :address1, :address2, :city,
-                :postal_code, :phone, :company, :country_iso, :state_abbr, :state_name,
+                # country_iso and state_abbr are the legacy write names, accepted until 6.1.
+                :postal_code, :phone, :company, :country_code, :country_iso, :state_code, :state_abbr, :state_name,
                 :is_default_billing, :is_default_shipping
               )
             end

data/app/controllers/spree/api/v3/store/customer/data_requests_controller.rb

@@ -0,0 +1,78 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Customer
+          # A customer exercising their own GDPR rights: a copy of their data
+          # (Art. 15) or its erasure (Art. 17).
+          #
+          # Erasure asks for the account password. Wiping a person's history is
+          # irreversible, and an unattended session should not be enough to
+          # trigger it — the same bar the account already applies to changing
+          # an email address.
+          class DataRequestsController < ResourceController
+            include Spree::Api::V3::CurrentPasswordConfirmation
+
+            prepend_before_action :require_authentication!
+
+            # POST /api/v3/store/customers/me/data_requests
+            def create
+              return render_current_password_invalid if erasure? && !valid_current_password?
+
+              result = Spree::DataRequests::Create.call(
+                store: current_store,
+                customer: current_user,
+                kind: requested_kind
+              )
+
+              return render_result_error(result) unless result.success?
+
+              # 202: the request is accepted and the work happens elsewhere.
+              # Answering 201 would imply the export already exists.
+              render json: serialize_resource(result.value), status: :accepted
+            end
+
+            protected
+
+            def model_class
+              Spree::DataRequest
+            end
+
+            def serializer_class
+              Spree.api.data_request_serializer
+            end
+
+            def set_parent
+              @parent = current_user
+            end
+
+            def parent_association
+              :data_requests
+            end
+
+            # A person sees their own requests and no one else's. The store
+            # narrowing is restated because the parent branch of the base scope
+            # replaces `for_store` with the association, and a customer is
+            # global while their requests are not.
+            def scope
+              super.for_store(current_store).recent_first
+            end
+
+            private
+
+            # Anything that is not an explicit erasure is a request to read —
+            # the safe reading of an ambiguous parameter.
+            def requested_kind
+              erasure? ? Spree::DataRequest::ERASURE : Spree::DataRequest::ACCESS
+            end
+
+            def erasure?
+              params[:kind].to_s == Spree::DataRequest::ERASURE
+            end
+
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/customer/digital_links_controller.rb

@@ -0,0 +1,52 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Customer
+          # Everything the signed-in customer can download, across all their
+          # orders — the storefront's "my downloads" page. Individual links are
+          # also nested in each order, but a library is unusable that way.
+          class DigitalLinksController < ResourceController
+            prepend_before_action :require_authentication!
+
+            protected
+
+            def model_class
+              Spree::DigitalLink
+            end
+
+            def serializer_class
+              Spree.api.digital_link_serializer
+            end
+
+            def set_parent
+              @parent = current_user
+            end
+
+            def parent_association
+              :digital_links
+            end
+
+            # The `digital_links` association reaches links through orders and
+            # line items, so it carries a DISTINCT and inherits an ORDER BY on
+            # the line items' table. PostgreSQL rejects DISTINCT combined with
+            # an ORDER BY column outside the select list, so reorder by the
+            # links' own table — SQLite tolerates the inherited order, so this
+            # only surfaces on a real deployment.
+            def scope
+              super.where(spree_orders: { store_id: current_store.id })
+                   .reorder("#{Spree::DigitalLink.table_name}.created_at": :desc)
+            end
+
+            # The serializer asks each link whether it is still authorizable,
+            # which reads its order's store and its asset's limits — without
+            # both preloads that is four queries per row.
+            def scope_includes
+              [{ line_item: :order }, { digital_asset: { attachment_attachment: :blob } }]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/customer/orders_controller.rb

@@ -27,6 +27,12 @@ module Spree
             def scope
               super.for_store(current_store).complete
             end
+
+            # The withdrawal deadline reads both on every row, so without
+            # these an order history pays two queries per order.
+            def collection_includes
+              super + [:market, :fulfillments]
+            end
           end
         end
       end

data/app/controllers/spree/api/v3/store/customer/password_resets_controller.rb

@@ -29,7 +29,7 @@ module Spree
                 end
               end
 
-              user = Spree.user_class.find_by(email: params[:email])
+              user = Spree.customer_class.find_by(email: params[:email])
 
               if user
                 token = user.generate_token_for(:password_reset)
@@ -44,7 +44,7 @@ module Spree
 
             # PATCH /api/v3/store/password_resets/:id
             def update
-              user = Spree.user_class.find_by_password_reset_token(params[:id])
+              user = Spree.customer_class.find_by_password_reset_token(params[:id])
 
               unless user
                 return render_error(
@@ -59,7 +59,11 @@ module Spree
                 # Kill every existing session before minting the new one —
                 # a stolen refresh token must not survive a password reset.
                 Spree::RefreshToken.revoke_all_for(user)
-                refresh_token = Spree::RefreshToken.create_for(user, request_env: { ip_address: request.remote_ip, user_agent: request.user_agent&.truncate(255) })
+                refresh_token = Spree::RefreshToken.create_for(
+                  user,
+                  audience: JWT_AUDIENCE_STORE,
+                  request_env: { ip_address: request.remote_ip, user_agent: request.user_agent&.truncate(255) }
+                )
                 user.publish_event('customer.password_reset')
 
                 render json: {

data/app/controllers/spree/api/v3/store/customer/payment_setup_sessions_controller.rb

@@ -11,7 +11,7 @@ module Spree
 
             # POST /api/v3/store/customer/payment_setup_sessions
             def create
-              payment_method = current_store.payment_methods.find_by_prefix_id!(permitted_params[:payment_method_id])
+              payment_method = current_store.payment_methods.find_by_prefix_id!(params[:payment_method_id])
 
               @payment_setup_session = payment_method.create_payment_setup_session(
                 customer: current_user,
@@ -62,8 +62,8 @@ module Spree
               Spree.api.payment_setup_session_serializer
             end
 
-            def permitted_params
-              params.permit(Spree::PermittedAttributes.payment_setup_session_attributes)
+            def resource_permitted_attributes
+              [:payment_method_id, { external_data: {} }]
             end
 
             def complete_params

data/app/controllers/spree/api/v3/store/customer/store_credits_controller.rb

@@ -28,9 +28,6 @@ module Spree
               Spree.api.store_credit_serializer
             end
 
-            # Authorization is handled by set_parent scoping to current_user
-            def authorize_resource!(*)
-            end
           end
         end
       end

data/app/controllers/spree/api/v3/store/customer/tax_identifiers_controller.rb

@@ -0,0 +1,91 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Customer
+          # The signed-in customer's own tax registrations — one per kind, since a
+          # business can be registered under more than one regime.
+          #
+          # Reads come in two shapes: the list, for a checkout page offering the
+          # buyer a choice, and the singular one for reading or upserting a given
+          # kind without knowing whether it exists yet.
+          class TaxIdentifiersController < Store::BaseController
+            prepend_before_action :require_authentication!
+
+            # The singular endpoints address one registration, and a buyer can
+            # hold several. Without a kind, `first` picked whichever row the
+            # database happened to return — so a DELETE removed a registration
+            # the buyer never named and could not predict.
+            before_action :require_kind!, only: %i[show update destroy]
+
+            # GET /api/v3/store/customers/me/tax_identifiers
+            #
+            # Everything the buyer could choose between at checkout. Small and
+            # unpaginated by nature — a business has a handful of registrations,
+            # not a page of them.
+            def index
+              render json: { data: serialize_collection(current_user.tax_identifiers.to_a) }
+            end
+
+            # GET /api/v3/store/customers/me/tax_identifier
+            def show
+              return head :not_found if tax_identifier.nil?
+
+              render json: serialize_resource(tax_identifier)
+            end
+
+            # PUT /api/v3/store/customers/me/tax_identifier
+            #
+            # Upsert rather than create/update: a buyer has one registration of a
+            # kind, and asking the storefront to know whether it exists yet would
+            # be bookkeeping we can do ourselves.
+            def update
+              resource = current_user.tax_identifiers.find_or_initialize_by(kind: permitted_params[:kind])
+              resource.value = permitted_params[:value]
+
+              if resource.save
+                render json: serialize_resource(resource), status: resource.previously_new_record? ? :created : :ok
+              else
+                render_validation_error(resource.errors)
+              end
+            end
+
+            # DELETE /api/v3/store/customers/me/tax_identifier
+            def destroy
+              return head :not_found if tax_identifier.nil?
+
+              tax_identifier.destroy!
+              head :no_content
+            end
+
+            protected
+
+            def serializer_class
+              Spree.api.tax_identifier_serializer
+            end
+
+            def permitted_params
+              params.permit(:kind, :value)
+            end
+
+            private
+
+            def require_kind!
+              return if params[:kind].present?
+
+              render_error(
+                code: ERROR_CODES[:parameter_missing],
+                message: 'kind is required — name the registration to read, replace or remove',
+                status: :unprocessable_content
+              )
+            end
+
+            def tax_identifier
+              @tax_identifier ||= current_user.tax_identifiers.for_kind(params[:kind]).first
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/customers_controller.rb

@@ -3,19 +3,36 @@ module Spree
     module V3
       module Store
         class CustomersController < Store::BaseController
+          include Spree::Api::V3::CurrentPasswordConfirmation
+
           allow_guest_storefront_access!
-          rate_limit to: Spree::Api::Config[:rate_limit_register], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :create, with: RATE_LIMIT_RESPONSE
+          rate_limit to: Spree::Api::Config[:rate_limit_register], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :create, with: -> { render_rate_limited(limit: Spree::Api::Config[:rate_limit_register]) }
 
           skip_before_action :authenticate_user, only: [:create]
           prepend_before_action :require_authentication!, only: [:show, :update]
 
           # POST /api/v3/store/customers
+          # Registration runs through the customer_create_workflow seam
+          # (password requirement, newsletter-subscriber linking, registration
+          # policy hooks); token issuance is an HTTP session concern and
+          # stays here.
           def create
-            user = Spree.user_class.new(permitted_params.except(:current_password))
-
-            if user.save
-              link_matching_newsletter_subscriber!(user)
-              refresh_token = Spree::RefreshToken.create_for(user, request_env: {
+            result = Spree.customer_create_workflow.call(
+              store: current_store,
+              # Records that the storefront's terms box was ticked. Read from
+              # params rather than permitted: it is evidence the workflow acts
+              # on, not an attribute of the customer row.
+              terms_of_service: params[:terms_of_service],
+              # Where and from what the agreement was made. A consent record
+              # without them says only that someone ticked a box.
+              ip_address: request.remote_ip,
+              user_agent: request.user_agent,
+              **permitted_params.except(:current_password).to_h.symbolize_keys
+            )
+
+            if result.success?
+              user = result.value
+              refresh_token = Spree::RefreshToken.create_for(user, audience: JWT_AUDIENCE_STORE, request_env: {
                 ip_address: request.remote_ip,
                 user_agent: request.user_agent&.truncate(255)
               })
@@ -25,7 +42,7 @@ module Spree
                 user: user_serializer.new(user, params: serializer_params).to_h
               }, status: :created
             else
-              render_errors(user.errors)
+              render_result_error(result)
             end
           end
 
@@ -36,15 +53,10 @@ module Spree
 
           # PATCH /api/v3/store/customer
           def update
-            if sensitive_update? && !valid_current_password?
-              return render_error(
-                code: ErrorHandler::ERROR_CODES[:current_password_invalid],
-                message: Spree.t(:current_password_invalid, scope: :api),
-                status: :unprocessable_content
-              )
-            end
+            return render_current_password_invalid if sensitive_update? && !valid_current_password?
 
             update_params = permitted_params.except(:current_password)
+            current_user.consent_source = Spree::ConsentRecord::ACCOUNT
 
             if current_user.update(update_params)
               render json: serialize_resource(current_user)
@@ -82,26 +94,9 @@ module Spree
               params[:password].present?
           end
 
-          def valid_current_password?
-            return false if params[:current_password].blank?
-
-            if current_user.respond_to?(:valid_password?)
-              current_user.valid_password?(params[:current_password])
-            elsif current_user.respond_to?(:authenticate)
-              current_user.authenticate(params[:current_password]).present?
-            else
-              false
-            end
-          end
-
           def user_serializer
             Spree.api.customer_serializer
           end
-
-          def link_matching_newsletter_subscriber!(user)
-            subscriber = Spree::NewsletterSubscriber.find_by(email: user.email, store: current_store)
-            Spree::Newsletter::LinkUser.new(subscriber: subscriber, user: user).call
-          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/data_feeds_controller.rb

@@ -13,6 +13,17 @@ module Spree
 
             render xml: presenter.call
           end
+
+          protected
+
+          # Feed URLs carry only a slug (unique per store, not globally), and
+          # no credential accompanies the request — so feeds are served for
+          # the default store. This matches the pre-6.0 behavior in practice:
+          # the old finder resolved every host to the default store too. A
+          # store-carrying feed URL shape is future work.
+          def current_store
+            @current_store ||= Spree::Store.default
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/data_request_downloads_controller.rb

@@ -0,0 +1,58 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # Hands a completed export to the person who asked for it.
+        #
+        # Token-addressed rather than session-authenticated, and unauthenticated
+        # for the same reason the digital-link download is: the link arrives by
+        # email and has to work when clicked, including from a device that was
+        # never signed in. The token is the credential — long, unguessable, only
+        # ever sent to the address that made the request, and dead once the
+        # request expires.
+        class DataRequestDownloadsController < Store::BaseController
+          # Lets the Disk service build absolute URLs from the current request;
+          # remote services (S3 et al.) sign without it.
+          include ActiveStorage::SetCurrent
+
+          allow_guest_storefront_access!
+          skip_before_action :authenticate_api_key!
+
+          # GET /api/v3/store/data_requests/:token/download
+          def show
+            # Guarded rather than trusting the route to reject an empty
+            # segment: erasure clears the token, and a blank lookup matching a
+            # cleared row would hand back the very export it was meant to
+            # withdraw.
+            token = params[:token].presence
+            data_request = token && Spree::DataRequest.find_by(download_token: token)
+
+            unless data_request&.downloadable?
+              return render_error(
+                code: 'data_request_expired',
+                message: Spree.t('data_request_errors.download_unavailable'),
+                status: :forbidden
+              )
+            end
+
+            # Streamed rather than redirected to a storage URL. A redirect only
+            # carries `no-store` on itself — the browser then fetches the
+            # storage response separately, under whatever cache policy that
+            # bucket happens to have, and a person's entire personal-data
+            # export is not something to leave to that. Streaming also keeps
+            # the file behind this token check rather than behind a URL that
+            # outlives the request.
+            response.headers['Cache-Control'] = 'no-store'
+
+            send_data(
+              data_request.export_file.download,
+              filename: "#{data_request.number.downcase}.json",
+              type: 'application/json',
+              disposition: 'attachment'
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/delivery_methods_controller.rb

@@ -0,0 +1,108 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # Storefront delivery method discovery — primarily for pickup flows:
+        # list pickup-capable methods, then their pickup locations (merchant
+        # stock locations) or third-party pickup points near the customer.
+        class DeliveryMethodsController < ResourceController
+          # GET /api/v3/store/delivery_methods/:id/pickup_locations
+          # Pickup-enabled stock locations. With ?cart_id= the list is
+          # narrowed to locations that can fulfill the whole cart from local
+          # stock (package-scoped availability).
+          def pickup_locations
+            locations = find_resource.available_pickup_locations
+            # A channel-bound cart only collects from counters its channel is
+            # served by (docs/plans/6.0-channel-delivery.md).
+            if pickup_cart&.channel
+              locations = locations.merge(pickup_cart.channel.served_stock_locations)
+            end
+            locations = locations.select { |location| covers_cart?(location, pickup_cart) } if pickup_cart
+
+            render json: { data: locations.map { |location| Spree.api.stock_location_serializer.new(location, params: serializer_params).to_h } }
+          end
+
+          # GET /api/v3/store/delivery_methods/:id/pickup_points?latitude=&longitude=
+          def pickup_points
+            provider = find_resource.pickup_point_provider_instance
+            if provider.nil?
+              return render_error(code: ERROR_CODES[:record_not_found], message: Spree.t('errors.messages.no_pickup_point_provider'), status: :not_found)
+            end
+
+            latitude = params[:latitude].presence&.to_f
+            longitude = params[:longitude].presence&.to_f
+            if latitude.nil? || longitude.nil?
+              return render_error(code: ERROR_CODES[:parameter_missing], message: 'latitude and longitude are required', status: :bad_request)
+            end
+
+            points = provider.find_nearby(latitude: latitude, longitude: longitude)
+            render json: { data: points.map(&:to_pickup_point_data) }
+          end
+
+          protected
+
+          def model_class
+            Spree::DeliveryMethod
+          end
+
+          def serializer_class
+            Spree.api.delivery_method_serializer
+          end
+
+          def scope
+            scope = current_store.delivery_methods.storefront_visible
+            scope = filter_by_kind(scope, params[:fulfillment_type]) if params[:fulfillment_type].present?
+            scope
+          end
+
+          # Public filter values map onto provider class predicates — the
+          # string vocabulary is a wire convenience, not a stored column.
+          def filter_by_kind(scope, kind)
+            case kind
+            when 'digital' then scope.with_provider(:digital?)
+            when 'pickup' then scope.with_provider(:pickup?)
+            when 'pickup_point' then scope.with_provider(:pickup_point?)
+            when 'shipping'
+              shipping_providers = Spree.fulfillment_providers.reject { |p| p.digital? || p.pickup? || p.pickup_point? }
+              scope.where(fulfillment_provider: shipping_providers.map(&:to_s))
+            else
+              scope.none
+            end
+          end
+
+          private
+
+          # Coverage results depend on the cart's contents — the caller must
+          # prove access to it (owner JWT or the cart token), like every
+          # other cart read.
+          def pickup_cart
+            return @pickup_cart if defined?(@pickup_cart)
+            return @pickup_cart = nil if params[:cart_id].blank?
+
+            cart = current_store.carts.incomplete.find_by_prefix_id!(params[:cart_id])
+            authorize_storefront_read!(cart, token: request.headers['x-spree-token'])
+            @pickup_cart = cart
+          end
+
+          # 'local' policy: every cart item must be on hand at the location.
+          # 'any' policy: the location offers pickup regardless of local stock
+          # (the merchant transfers goods in).
+          # Only pickup-collectable items count toward local coverage — a
+          # tracked digital variant in a mixed cart is delivered by its own
+          # provider and must not disqualify a counter.
+          def covers_cart?(location, cart)
+            return true if location.pickup_stock_policy == 'any'
+
+            cart.line_items.includes(variant: :product).all? do |line_item|
+              next true if line_item.variant.digital?
+              next true unless line_item.variant.should_track_inventory?
+
+              stock_level = location.stock_level(line_item.variant)
+              stock_level.present? && stock_level.available_count >= line_item.quantity
+            end
+          end
+        end
+      end
+    end
+  end
+end