spree_api 5.6.1 → 6.0.0.beta1

data/app/controllers/spree/api/v3/store/digital_links_controller.rb

@@ -0,0 +1,105 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        class DigitalLinksController < Store::BaseController
+          # Lets the Disk service build absolute URLs from the current request;
+          # remote services (S3 et al.) sign without it.
+          include ActiveStorage::SetCurrent
+
+          allow_guest_storefront_access!
+          skip_before_action :authenticate_api_key!
+          before_action :set_resource
+
+          # GET /api/v3/store/digital_links/:token
+          #
+          # Hands the customer their deliverable: a redirect to a short-lived
+          # signed URL (an uploaded file, an external link) or an inline body (a
+          # license key). The provider decides which; this controller only
+          # settles authorization and renders the shape.
+          def show
+            if (delivery = authorized_delivery)
+              @resource.publish_event('digital_link.downloaded')
+              render_delivery(delivery)
+            else
+              render_error(
+                code: ERROR_CODES[:digital_link_expired],
+                message: 'Download link expired or invalid',
+                status: :forbidden
+              )
+            end
+          end
+
+          private
+
+          # Everything that can refuse is settled before the click is spent: the
+          # link must permit a download, the window must be open, the provider
+          # must actually produce a deliverable (a provider that errors or has
+          # nothing refuses cleanly), and only then is the click consumed under
+          # the lock. So a dry provider or a missing file never burns an
+          # allowance.
+          #
+          # @return [Spree::DigitalDelivery, nil]
+          def authorized_delivery
+            return unless @resource.authorizable?
+
+            window = signed_url_window
+            return if window <= 0
+
+            delivery = safe_deliver(window)
+            return unless delivery&.present?
+            return unless @resource.authorize!
+
+            delivery
+          end
+
+          # A provider is external I/O; an exception must refuse, not 500, and
+          # must not spend the click (it hasn't been spent yet at this point).
+          def safe_deliver(window)
+            @resource.digital_asset.deliver(@resource, expires_in: window)
+          rescue StandardError => e
+            Rails.logger.error("Digital delivery failed for #{@resource.prefixed_id}: #{e.class}: #{e.message}")
+            nil
+          end
+
+          def render_delivery(delivery)
+            if delivery.redirect?
+              redirect_to delivery.redirect_url, allow_other_host: true
+            else
+              send_data delivery.inline_value,
+                        type: delivery.content_type.presence || 'application/octet-stream',
+                        disposition: 'inline'
+            end
+          end
+
+          # The signed URL is a bearer credential, so it must never outlive the
+          # link that authorized it — otherwise an expired link keeps handing
+          # out working URLs for the rest of the store's window.
+          def signed_url_window
+            window = current_store.preferred_digital_asset_link_expire_time.seconds
+            return window unless (expiry = @resource.expires_at)
+
+            [window, expiry - Time.current].min
+          end
+
+          # The download token is the request's credential and selects the
+          # store (tokens are globally unique via has_secure_token) — no
+          # publishable key accompanies emailed download links, so there is no
+          # other credential to derive store context from.
+          def set_resource
+            @resource = digital_link_scope.find_by!(token: params[:token])
+            Spree::Current.store = current_store
+          end
+
+          def digital_link_scope
+            Spree::DigitalLink
+          end
+
+          def current_store
+            @current_store ||= @resource&.store || super
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/markets/countries_controller.rb

@@ -3,28 +3,24 @@ module Spree
     module V3
       module Store
         module Markets
+          # Uncached for the same reason as the top-level countries endpoint.
           class CountriesController < Store::BaseController
             allow_guest_storefront_access!
-            include Spree::Api::V3::HttpCaching
 
             before_action :load_market
 
             # GET /api/v3/store/markets/:market_id/countries
             def index
-              countries = @market.countries.order(:name)
-
-              return unless cache_collection(countries)
-
               render json: {
-                data: countries.map { |country| serialize_country(country) }
+                data: @market.countries.map { |country| serialize_country(country) }
               }
             end
 
             # GET /api/v3/store/markets/:market_id/countries/:id
             def show
-              country = @market.countries.find_by!(iso: params[:id].upcase)
-
-              return unless cache_resource(country)
+              iso = params[:id].to_s.upcase
+              country = @market.countries.find { |candidate| candidate.iso == iso }
+              raise ActiveRecord::RecordNotFound if country.nil?
 
               render json: serialize_country(country)
             end

data/app/controllers/spree/api/v3/store/markets_controller.rb

@@ -8,7 +8,7 @@ module Spree
 
           # GET /api/v3/store/markets
           def index
-            markets = current_store.markets.includes(:countries).order(:position)
+            markets = current_store.markets.includes(:market_countries).ordered
 
             return unless cache_collection(markets)
 
@@ -19,7 +19,7 @@ module Spree
 
           # GET /api/v3/store/markets/:id
           def show
-            market = current_store.markets.includes(:countries).find_by_prefix_id!(params[:id])
+            market = current_store.markets.includes(:market_countries).find_by_prefix_id!(params[:id])
 
             return unless cache_resource(market)
 
@@ -28,8 +28,8 @@ module Spree
 
           # GET /api/v3/store/markets/resolve?country=DE
           def resolve
-            country_iso = params[:country]&.upcase
-            country = Spree::Country.find_by!(iso: country_iso)
+            country_code = params[:country]&.upcase
+            country = Spree::Country.find_by_iso!(country_code)
             market = current_store.market_for_country(country)
 
             raise ActiveRecord::RecordNotFound unless market

data/app/controllers/spree/api/v3/store/newsletter_subscribers_controller.rb

@@ -8,13 +8,13 @@ module Spree
                      within: Spree::Api::Config[:rate_limit_window].seconds,
                      store: Rails.cache,
                      only: [:create, :verify, :request_unsubscribe],
-                     with: RATE_LIMIT_RESPONSE
+                     with: -> { render_rate_limited(limit: Spree::Api::Config[:rate_limit_register]) }
 
           # POST /api/v3/store/newsletter_subscribers
           def create
             subscriber = Spree::NewsletterSubscriber.subscribe(
               email: params[:email],
-              user: current_user,
+              customer: current_user,
               store: current_store,
               redirect_url: validated_redirect_url
             )
@@ -69,12 +69,12 @@ module Spree
               )
             end
 
-            linked_user = subscriber.user
+            linked_customer = subscriber.customer
             subscriber.destroy!
 
             # Keep accepts_email_marketing in sync, but only when no subscriptions remain.
-            if linked_user&.accepts_email_marketing? && Spree::NewsletterSubscriber.where(user_id: linked_user.id).none?
-              linked_user.update(accepts_email_marketing: false)
+            if linked_customer&.accepts_email_marketing? && Spree::NewsletterSubscriber.where(customer_id: linked_customer.id).none?
+              linked_customer.update(accepts_email_marketing: false)
             end
 
             head :no_content
@@ -92,7 +92,7 @@ module Spree
                 email: subscriber.email,
                 unsubscribe_token: subscriber.generate_token_for(:unsubscribe),
                 store_id: current_store.prefixed_id,
-                customer_id: subscriber.user&.prefixed_id
+                customer_id: subscriber.customer&.prefixed_id
               }
 
               redirect_url = validated_redirect_url
@@ -115,9 +115,8 @@ module Spree
           def find_owned_subscriber
             return unless current_user
 
-            Spree::NewsletterSubscriber.
-              for_store(current_store).
-              accessible_by(current_ability, :destroy).
+            storefront_access_policy.
+              scope(Spree::NewsletterSubscriber.for_store(current_store)).
               find_by_prefix_id(params[:id])
           end
 

data/app/controllers/spree/api/v3/store/orders/claims_controller.rb

@@ -0,0 +1,94 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Orders
+          # Customer self-service claims — reporting a damaged, missing or
+          # wrong item. Approving, denying and resolving are the merchant's,
+          # through the Admin API.
+          #
+          # Whether a customer may file a claim is store policy and belongs in
+          # a `claims.create.validate` hook rather than here.
+          class ClaimsController < Store::ResourceController
+            def create
+              result = Spree.claim_create_workflow.call(
+                order: @parent,
+                items: items_for_create,
+                reason: reason_for_create,
+                memo: create_params[:memo]
+              )
+
+              if result.success?
+                render json: serialize_resource(result.value), status: :created
+              else
+                render_result_error(result)
+              end
+            end
+
+            protected
+
+            def model_class
+              Spree::Claim
+            end
+
+            def serializer_class
+              Spree.api.claim_serializer
+            end
+
+            def scope
+              @parent.claims.order(created_at: :desc)
+            end
+
+            def collection_includes
+              [{ claim_line_items: :variant }]
+            end
+
+            def set_parent
+              cart_pk = Spree::Cart.decode_own_prefixed_id(params[:order_id])
+              @parent = if cart_pk
+                          order_scope.find_by!(cart_id: cart_pk)
+                        else
+                          order_scope.find_by_prefix_id!(params[:order_id])
+                        end
+            end
+
+            # Authorization is the parent order's — see the returns
+            # controller for why a second record-level check is wrong here.
+            def set_resource
+              @resource = find_resource
+            end
+
+            def order_scope
+              storefront_access_policy.scope(current_store.orders.complete, token: order_token)
+            end
+
+            def create_params
+              @create_params ||= params.permit(:memo, :reason_id,
+                                               items: [:line_item_id, :quantity, :description])
+            end
+
+            private
+
+            def items_for_create
+              Array(create_params[:items]).map do |item|
+                {
+                  line_item: @parent.line_items.find_by_prefix_id!(item[:line_item_id]),
+                  quantity: item[:quantity].to_i,
+                  description: item[:description]
+                }
+              end
+            end
+
+            # Read through the store so a reason belonging to another store
+            # 404s rather than being silently attached.
+            def reason_for_create
+              return nil if create_params[:reason_id].blank?
+
+              current_store.claim_reasons.find_by_prefix_id!(create_params[:reason_id])
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/orders/returns_controller.rb

@@ -0,0 +1,116 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Orders
+          # Customer self-service returns. A customer can open a return and
+          # see the ones they opened; everything after that — approving,
+          # receiving, refunding — is the merchant's to do through the Admin
+          # API.
+          #
+          # Whether a customer may open a return at all is store policy, and
+          # belongs in a `returns.create.validate` hook rather than here.
+          class ReturnsController < Store::ResourceController
+            include Spree::Api::V3::StreamsShippingLabel
+
+            # Re-declaring the filter replaces the inherited options, so the
+            # standard actions are listed alongside the label download.
+            before_action :set_resource, only: [:show, :update, :destroy, :label]
+
+            # GET /api/v3/store/orders/:order_id/returns/:id/label
+            #
+            # The customer's return label, streamed to whoever owns the order.
+            # The label row itself is never serialized to the storefront —
+            # its cost and provider ids are merchant data — only the file.
+            def label
+              shipping_label = @resource.active_shipping_label
+              return head :not_found if shipping_label.nil?
+
+              stream_shipping_label(shipping_label) { head :not_found }
+            end
+
+            def create
+              result = Spree.return_create_workflow.call(
+                order: @parent,
+                items: items_for_create,
+                reason: reason_for_create,
+                memo: create_params[:memo]
+              )
+
+              if result.success?
+                render json: serialize_resource(result.value), status: :created
+              else
+                render_result_error(result)
+              end
+            end
+
+            protected
+
+            def model_class
+              Spree::Return
+            end
+
+            def serializer_class
+              Spree.api.return_serializer
+            end
+
+            def scope
+              @parent.returns.order(created_at: :desc)
+            end
+
+            def collection_includes
+              [{ return_line_items: :variant }]
+            end
+
+            # Authorization is the parent order's: set_parent already proved
+            # this customer owns it (by JWT or guest token), and the scope is
+            # that order's own returns.
+            def set_resource
+              @resource = find_resource
+            end
+
+            def read_actions
+              %w[index show label]
+            end
+
+            # The order is the customer's own — by JWT or by guest token,
+            # mirroring Store::OrdersController.
+            def set_parent
+              cart_pk = Spree::Cart.decode_own_prefixed_id(params[:order_id])
+              @parent = if cart_pk
+                          order_scope.find_by!(cart_id: cart_pk)
+                        else
+                          order_scope.find_by_prefix_id!(params[:order_id])
+                        end
+            end
+
+            def order_scope
+              storefront_access_policy.scope(current_store.orders.complete, token: order_token)
+            end
+
+            def create_params
+              @create_params ||= params.permit(:memo, :reason_id, items: [:fulfillment_item_id, :quantity])
+            end
+
+            private
+
+            def items_for_create
+              Array(create_params[:items]).map do |item|
+                {
+                  fulfillment_item: @parent.fulfillment_items.find_by_prefix_id!(item[:fulfillment_item_id]),
+                  quantity: item[:quantity].to_i
+                }
+              end
+            end
+
+            def reason_for_create
+              return nil if create_params[:reason_id].blank?
+
+              current_store.return_reasons.find_by_prefix_id!(create_params[:reason_id])
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/orders/tax_identifiers_controller.rb

@@ -0,0 +1,46 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Orders
+          # Read-only: an order's registration is the snapshot taken when it was
+          # placed, and an invoice has to keep saying what it said.
+          class TaxIdentifiersController < Store::BaseController
+            # GET /api/v3/store/orders/:order_id/tax_identifier
+            def show
+              return head :not_found if order.tax_identifier.nil?
+
+              render json: serialize_resource(order.tax_identifier)
+            end
+
+            protected
+
+            def serializer_class
+              Spree.api.tax_identifier_serializer
+            end
+
+            private
+
+            # The order is the customer's own — by JWT or by guest token,
+            # mirroring Store::Orders::ReturnsController. The scope is the
+            # enforcement: an order the caller does not own is simply not found.
+            def order
+              @order ||= begin
+                cart_pk = Spree::Cart.decode_own_prefixed_id(params[:order_id])
+                if cart_pk
+                  order_scope.find_by!(cart_id: cart_pk)
+                else
+                  order_scope.find_by_prefix_id!(params[:order_id])
+                end
+              end
+            end
+
+            def order_scope
+              storefront_access_policy.scope(current_store.orders.complete, token: order_token)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/orders_controller.rb

@@ -13,30 +13,27 @@ module Spree
 
           private
 
+          # The cart's prefixed id stays the client's stable checkout handle:
+          # after completion it resolves here to the order created from that
+          # cart (Order#cart_id is unique; the order copies the cart token).
           def find_order!
-            @order = scope.find_by_prefix_id!(params[:id])
-            authorize!(:show, @order, order_token)
+            cart_pk = Spree::Cart.decode_own_prefixed_id(params[:id])
+            @order = cart_pk ? scope.find_by!(cart_id: cart_pk) : scope.find_by_prefix_id!(params[:id])
           end
 
+          # `market` and `fulfillments` are the withdrawal deadline's inputs and
+          # the serializer emits it on every response, so they are preloaded
+          # here rather than through `collection_includes` — this controller
+          # loads through `find_order!`, which never touches a collection.
           def scope
-            base = current_store.orders.complete
-
-            if current_user.present?
-              base.where(user: current_user)
-            elsif order_token.present?
-              base.where(token: order_token)
-            else
-              base.none
-            end
+            storefront_access_policy.
+              scope(current_store.orders.complete, token: order_token).
+              includes(:market, :fulfillments)
           end
 
           def serializer_class
             Spree.api.order_serializer
           end
-
-          def order_token
-            request.headers['x-spree-token']
-          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/products/filters_controller.rb

@@ -11,7 +11,7 @@ module Spree
                 result = search_provider.filters(
                   scope: filters_scope,
                   query: search_query,
-                  filters: (search_filters || {}).merge('_category' => category)
+                  filters: (search_filters || {}).merge('_category' => category, '_collection' => collection)
                 )
 
                 serialize_resource(result)
@@ -41,11 +41,12 @@ module Spree
                 current_currency,
                 current_locale,
                 category&.cache_key_with_version,
+                collection&.cache_key_with_version,
                 search_query,
                 search_filters&.sort_by(&:first)&.to_json,
                 max_updated,
                 product_count,
-                search_provider.metafield_schema.schema_version
+                search_provider.custom_field_schema.schema_version
               ]
 
               parts.compact.join('/')
@@ -57,13 +58,19 @@ module Spree
               # included).
               scope = current_store.products.available(Time.current, current_currency, include_preorderable: true)
               scope = scope.in_category(category) if category.present?
-              scope.accessible_by(current_ability, :show)
+              scope = scope.in_collection(collection) if collection.present?
+              scope
             end
 
             def category
               category_id = params[:category_id]
               @category ||= category_id.present? ? current_store.categories.find_by_param(category_id) : nil
             end
+
+            def collection
+              collection_id = params[:collection_id]
+              @collection ||= collection_id.present? ? current_store.collections.find_by_param(collection_id) : nil
+            end
           end
         end
       end

data/app/controllers/spree/api/v3/store/products_controller.rb

@@ -29,16 +29,35 @@ module Spree
           end
 
           def scope
-            super.available(Time.current, Spree::Current.currency, include_preorderable: true)
+            base = super.available(Time.current, Spree::Current.currency, include_preorderable: true)
+
+            # Catalog narrowing for the buyer: their company's effective
+            # catalogs, their group's, or the channel default — union of
+            # assortments, resolved in one place
+            # (docs/plans/6.0-b2b-companies-and-catalogs.md).
+            Spree.products_for_context_service.call(
+              store: current_store,
+              channel: current_channel,
+              customer: current_user,
+              base: base
+            ).value
           end
 
           # these scopes are not automatically picked by ar_lazy_preload gem and we need to explicitly include them
           def scope_includes
             [
-              product_publications: [],
-              primary_media: [attachment_attachment: :blob],
-              master: [:prices, stock_items: [:stock_location, :active_stock_reservations]],
-              variants: [:prices, stock_items: [:stock_location, :active_stock_reservations]]
+              # `seller` is declared on both sides rather than left to lazy
+              # preloading: the buy box asks every variant who is selling it,
+              # and a variant with no seller of its own asks its product — so a
+              # listing would otherwise depend on ambient behaviour to avoid an
+              # N+1 on whichever of the two answers.
+              :seller,
+              {
+                product_publications: [],
+                primary_media: [attachment_attachment: :blob, poster_attachment: :blob],
+                default_variant: [:prices, stock_levels: [:stock_location, :active_stock_reservations]],
+                variants: [:prices, :seller, stock_levels: [:stock_location, :active_stock_reservations]]
+              }
             ]
           end
 
@@ -48,7 +67,7 @@ module Spree
             return @collection if @collection.present?
 
             result = search_provider.search_and_filter(
-              scope: scope.includes(collection_includes).preload_associations_lazily.accessible_by(current_ability, :show),
+              scope: scope.includes(collection_includes).preload_associations_lazily,
               query: search_query,
               filters: search_filters,
               sort: sort_param,

data/app/controllers/spree/api/v3/store/resource_controller.rb

@@ -6,8 +6,10 @@ module Spree
         # inheritance branches (V3::BaseController vs V3::ResourceController);
         # any concern added here MUST also be added to Store::BaseController.
         class ResourceController < Spree::Api::V3::ResourceController
+          include Spree::Api::V3::KeyStoreContext
           include Spree::Api::V3::ChannelResolution
           include Spree::Api::V3::StorefrontGating
+          include Spree::Api::V3::StorefrontAccess
 
           # The inherited +set_parent+/+set_resource+ callbacks were registered
           # before the two concerns above, so they'd run resource lookups ahead

data/app/controllers/spree/api/v3/store/sellers_controller.rb

@@ -0,0 +1,43 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # Public seller profiles.
+        #
+        # Read-only, and scoped to sellers a shopper can actually buy from: one
+        # still onboarding, suspended or away has nothing to show a customer,
+        # and listing them would advertise sellers whose products cannot be
+        # bought.
+        class SellersController < ResourceController
+          include Spree::Api::V3::HttpCaching
+
+          protected
+
+          def model_class
+            Spree::Seller
+          end
+
+          def serializer_class
+            Spree.api.seller_serializer
+          end
+
+          def scope
+            super.sellable
+          end
+
+          # By slug or prefixed ID, so a storefront can route
+          # `/sellers/sparks-audio` without holding an id.
+          def find_resource
+            id = params[:id]
+
+            if id.to_s.start_with?('sel_')
+              scope.find_by_prefix_id!(id)
+            else
+              scope.find_by!(slug: id)
+            end
+          end
+        end
+      end
+    end
+  end
+end