spree_api 5.6.1 → 6.0.0.beta1

data/app/controllers/concerns/spree/api/v3/seller/seller_context.rb

@@ -0,0 +1,127 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # Resolves which seller a request acts as.
+        #
+        # The inverse of the admin branch's store context: there, the store is
+        # named by a header or a key and falls back to the default. Here the
+        # seller is named by the header, membership is checked against it, and
+        # the store is *derived* from the seller — never sent, never defaulted.
+        # A request that names no seller the caller belongs to has no tenant at
+        # all, which is an error rather than a default.
+        #
+        # Included into both branch anchors (BaseController and
+        # ResourceController) — parallel chains, so a concern on one is not on
+        # the other.
+        module SellerContext
+          extend ActiveSupport::Concern
+
+          SELLER_HEADER = 'X-Spree-Seller-Id'.freeze
+
+          # Prepended, like the admin branch's store context, because the
+          # shared base chain reads the store while setting up locale and
+          # currency — before any ordinary callback runs.
+          #
+          # Resolving a seller needs the caller, so this identifies them first
+          # by calling `authenticate_user`, which is idempotent and is the same
+          # method the authentication callback runs later. That later callback
+          # remains the authority on whether the request may proceed; this only
+          # establishes the tenant early enough for the chain beneath it.
+          included do
+            prepend_before_action :set_current_seller_context
+          end
+
+          # The seller this request acts as, or nil when the header names none
+          # the caller belongs to.
+          #
+          # @return [Spree::Seller, nil]
+          # `||=` rather than a `defined?` memo on purpose: a nil must not
+          # stick. The locale/currency chain reads `current_store` — and so
+          # this — before authentication has run, and caching that first miss
+          # would leave a controller which skips the context callback
+          # (MeController) permanently seller-less even with a valid header.
+          def current_seller
+            @current_seller ||= resolve_current_seller
+          end
+
+          # Derived from the seller, so a seller can never widen their reach by
+          # sending a store header.
+          #
+          # Falls back to the default store only when no seller resolved — such
+          # a request is already being rejected, and the chain beneath this
+          # (locale and currency setup) reads the store before the rejection
+          # renders. Nothing tenant-bearing is served through the fallback.
+          #
+          # @return [Spree::Store, nil]
+          def current_store
+            current_seller&.store || Spree::Store.default
+          end
+
+          # The orders this seller has actually sold.
+          #
+          # A draft is either a checkout still in flight or the operator's own
+          # working document. Neither is this seller's, so neither is reachable
+          # from any endpoint on this branch — including the nested ones, which
+          # is why this lives here rather than in one controller's `scope`.
+          #
+          # @return [ActiveRecord::Relation]
+          def current_seller_orders
+            current_seller.orders.not_drafts
+          end
+
+          private
+
+          def set_current_seller_context
+            # Identify the caller before resolving their seller. Safe to call
+            # here: it only populates @current_user, and the authentication
+            # callback still decides whether an unidentified request proceeds.
+            authenticate_user
+
+            # Assigned even when nil: leaving the previous request's value on a
+            # reused thread would expose another tenant to anything reading it
+            # before the rejection lands.
+            Spree::Current.store = current_store
+
+            # An unauthenticated request has no seller to resolve, and saying
+            # so is authentication's job — let it answer with a 401 rather than
+            # reporting a missing tenant.
+            return true if current_user.nil?
+
+            require_current_seller!
+          end
+
+          def require_current_seller!
+            return true if current_seller
+
+            render_error(
+              code: ErrorHandler::ERROR_CODES[:access_denied],
+              message: Spree.t(:seller_access_denied),
+              status: :forbidden
+            )
+            false
+          end
+
+          # Membership is holding a role the seller owns — the same question
+          # the store back office asks, pointed at a different resource. A
+          # header naming a seller the caller has no role on resolves to
+          # nothing, so it reads as "no such seller" rather than "denied",
+          # which is also what stops the header being used to enumerate.
+          def resolve_current_seller
+            return nil if seller_id_header.blank?
+            return nil unless current_user.respond_to?(:sellers)
+
+            id = Spree::Seller.decode_own_prefixed_id(seller_id_header)
+            return nil if id.blank?
+
+            current_user.sellers.find_by(id: id)
+          end
+
+          def seller_id_header
+            request.headers[SELLER_HEADER]
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/seller_authentication.rb

@@ -0,0 +1,40 @@
+module Spree
+  module Api
+    module V3
+      # Authentication for the marketplace seller panel.
+      #
+      # Deliberately not a subclass or variant of AdminAuthentication: a seller
+      # holds no secret API key (keys are store-bound and grant `manage :all`),
+      # so this surface is JWT-only and the key path simply does not exist here.
+      module SellerAuthentication
+        extend ActiveSupport::Concern
+
+        included do
+          after_action :set_no_store_cache
+        end
+
+        protected
+
+        # Rejects an admin or storefront token before any seller is resolved.
+        def expected_audience
+          Spree::Api::V3::JwtAuthentication::JWT_AUDIENCE_SELLER
+        end
+
+        # Capability comes from the roles the seller holds *on this seller*.
+        # Passing the resource is what stops a store role — or the store's
+        # `admin` super-role — being read here (see Spree::Ability).
+        def ability_options
+          { store: current_store, resource: current_seller }
+        end
+
+        def authenticate_seller!
+          require_authentication!
+        end
+
+        def set_no_store_cache
+          response.headers['Cache-Control'] = 'private, no-store'
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/storefront_access.rb

@@ -0,0 +1,38 @@
+module Spree
+  module Api
+    module V3
+      # Storefront access checks backed by Spree::Storefront::AccessPolicy —
+      # the Store API's replacement for CanCanCan. Ownership scoping remains
+      # the primary enforcement; these helpers cover the checks a scope cannot
+      # express (guest-token access to a specific cart or order).
+      module StorefrontAccess
+        extend ActiveSupport::Concern
+
+        protected
+
+        def storefront_access_policy
+          @storefront_access_policy ||= Spree.storefront_access_policy_class.new(
+            user: current_user,
+            store: current_store
+          )
+        end
+
+        # @raise [Spree::Storefront::AccessDenied] when the caller can neither
+        #   prove ownership nor (for carts/orders) present the guest token
+        def authorize_storefront_read!(record, token: nil)
+          return if storefront_access_policy.readable?(record, token: token)
+
+          raise Spree::Storefront::AccessDenied
+        end
+
+        # @raise [Spree::Storefront::AccessDenied] when unreadable — or, for
+        #   carts and orders, already completed
+        def authorize_storefront_write!(record, token: nil)
+          return if storefront_access_policy.writable?(record, token: token)
+
+          raise Spree::Storefront::AccessDenied
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/streams_shipping_label.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V3
+      # Serving a label file, shared by every surface that offers one — the
+      # operator's, the seller's and the customer's return download.
+      #
+      # The bytes are streamed rather than redirected to storage, so the
+      # credentials that reached the action are what protects the file. The
+      # one exception is a label whose file is still being fetched from the
+      # carrier: until it lands, the carrier's own copy stands in.
+      #
+      # Deliberately carries no scope of its own — the caller has already
+      # fetched and authorized the label.
+      module StreamsShippingLabel
+        extend ActiveSupport::Concern
+
+        # @param shipping_label [Spree::ShippingLabel]
+        # @yield when there is nothing to serve, so each surface answers in
+        #   its own vocabulary (a 404 for a customer, a 422 for staff)
+        def stream_shipping_label(shipping_label, &on_missing)
+          if shipping_label.file.attached?
+            send_data(
+              shipping_label.file.download,
+              filename: shipping_label.download_filename,
+              type: shipping_label.file.content_type || 'application/octet-stream',
+              disposition: 'attachment'
+            )
+          elsif shipping_label.file_pending?
+            redirect_to shipping_label.file_url, allow_other_host: true
+          else
+            on_missing.call
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/tax_identifier_validation.rb

@@ -0,0 +1,41 @@
+module Spree
+  module Api
+    module V3
+      # The re-check action, shared by every surface where a registration is
+      # managed: nested under a customer, under a company, and the seller's
+      # own panel.
+      #
+      # Separate from the number-changed path, which the model stamps and a
+      # subscriber queues. This is staff asking "is it still valid now" — a
+      # number verified last year may have been deregistered since — so it
+      # queues a check without the number having changed.
+      module TaxIdentifierValidation
+        extend ActiveSupport::Concern
+
+        def validate
+          authorize_resource!(@resource, :update)
+
+          # A kind can be format-checked here and still have no registry to
+          # ask — core ships exactly that for EU VAT — so the message says
+          # what is missing rather than claiming nothing is registered.
+          unless @resource.validatable?
+            render_error(
+              code: 'tax_id_not_validatable',
+              message: "No registry validator is installed for tax identifier kind '#{@resource.kind}'",
+              status: :unprocessable_content
+            )
+            return
+          end
+
+          # Marked pending before the job is queued, not after: the job can
+          # finish first, and writing 'pending' afterwards would bury the
+          # verdict it just recorded.
+          @resource.update_columns(validation_status: 'pending', validated_at: nil, updated_at: Time.current)
+          Spree::TaxIdentifiers::ValidateJob.perform_later(@resource.id)
+
+          render json: serialize_resource(@resource.reload), status: :accepted
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/admin_users_controller.rb

@@ -10,7 +10,9 @@ module Spree
         class AdminUsersController < ResourceController
           include Spree::Api::V3::Admin::RoleGrantGuard
 
-          scoped_resource :settings
+          # Staff management is the escalation path — its own scope pair,
+          # grantable separately from store configuration (6.0-admin-rbac.md).
+          scoped_resource :staff
 
           # POST is not exposed — staff are created via invitations.
           def create
@@ -22,7 +24,7 @@ module Spree
           # the account globally. The user keeps access to any other stores.
           def destroy
             authorize!(:destroy, @resource)
-            @resource.role_users.where(resource: current_store).destroy_all
+            @resource.role_users.where(role: current_store.roles).destroy_all
             head :no_content
           end
 
@@ -60,7 +62,7 @@ module Spree
           end
 
           def collection_includes
-            [{ role_users: :role, avatar_attachment: :blob }, :stores]
+            [{ spree_roles: :resource, avatar_attachment: :blob }]
           end
 
           # Restrict to users with a role assignment on the current store.
@@ -69,10 +71,7 @@ module Spree
           # host-app-defined and may contain `json` columns, which Postgres
           # cannot compare for equality.
           def scope
-            staff_ids = model_class.
-              joins(:role_users).
-              where(Spree::RoleUser.table_name => { resource: current_store }).
-              select(:id)
+            staff_ids = model_class.joins(:spree_roles).merge(current_store.roles).select(:id)
 
             model_class.
               where(id: staff_ids).
@@ -93,17 +92,15 @@ module Spree
           # Reconcile the user's roles on this store to match `desired_role_ids`.
           # Adds missing assignments and removes extras — no-op for unchanged.
           def apply_role_ids(desired_role_ids)
-            current = @resource.role_users.where(resource: current_store).pluck(:role_id).map(&:to_s)
+            store_roles = current_store.roles
+            current = @resource.role_users.where(role: store_roles).pluck(:role_id).map(&:to_s)
             target = desired_role_ids.map(&:to_s)
 
-            (target - current).each do |role_id|
-              role = Spree::Role.find_by(id: role_id)
-              @resource.role_users.find_or_create_by!(role: role, resource: current_store) if role
+            store_roles.where(id: target - current).each do |role|
+              @resource.role_users.find_or_create_by!(role: role)
             end
 
-            (current - target).each do |role_id|
-              @resource.role_users.where(role_id: role_id, resource: current_store).destroy_all
-            end
+            @resource.role_users.where(role: store_roles.where(id: current - target)).destroy_all
           end
         end
       end

data/app/controllers/spree/api/v3/admin/allowed_origins_controller.rb

@@ -16,7 +16,7 @@ module Spree
           end
 
           def permitted_params
-            params.permit(:origin)
+            params.permit(*model_additional_permitted_attributes, :origin)
           end
         end
       end

data/app/controllers/spree/api/v3/admin/api_keys_controller.rb

@@ -3,6 +3,8 @@ module Spree
     module V3
       module Admin
         class ApiKeysController < ResourceController
+          include Spree::Api::V3::Admin::RoleGrantGuard
+
           # Dedicated scope — key management is credential-administration, not
           # store configuration. A `write_settings` key must not be able to
           # revoke or destroy higher-privileged keys.
@@ -13,14 +15,19 @@ module Spree
           skip_scope_check! only: :current
 
           # POST /api/v3/admin/api_keys
-          # Prevents scope amplification: a key minted via a secret API key can
-          # only carry scopes that key already holds. A JWT admin is governed by
-          # CanCanCan (not scopes) and may grant any valid scope — so when a JWT
-          # user authenticated the request, `current_ability` ignores the API key
-          # (see AdminAuthentication#current_ability) and we skip the scope cap
-          # too, even if an `X-Spree-Api-Key` header was also sent.
+          # Prevents scope amplification for BOTH principals: a key minted via a
+          # secret API key can only carry scopes that key already holds, and a
+          # JWT staffer can only mint scopes within their own roles' permission
+          # keys (admin-role holders are unbounded). Scopes and role permissions
+          # share the catalog vocabulary, so both compare as expanded key sets.
           def create
-            if scope_limited_principal? && (excess = requested_scopes.reject { |s| current_api_key.has_scope?(s) }).any?
+            if scope_limited_principal?
+              excess = requested_scopes.reject { |s| current_api_key.has_scope?(s) }
+            else
+              excess = excess_permission_keys(requested_scopes)
+            end
+
+            if excess.any?
               return render_error(
                 code: ERROR_CODES[:access_denied],
                 message: "Cannot grant scopes beyond your own: #{excess.join(', ')}",
@@ -91,6 +98,8 @@ module Spree
           # lives on Spree::ApiKey); update is limited to the human-facing `name`.
           # Stripping them here keeps them out of mass assignment so a rename
           # returns 200 rather than 422.
+          # No extension union: an API key's scopes and type are the authorization
+          # surface itself, not extensible resource data.
           def permitted_params
             return params.permit(:name) if action_name == 'update'
 

data/app/controllers/spree/api/v3/admin/auth_controller.rb

@@ -4,13 +4,28 @@ module Spree
       module Admin
         class AuthController < Admin::BaseController
           include Spree::Api::V3::Admin::AuthCookies
+          include Spree::Api::V3::AuthenticationStrategies
 
           skip_scope_check!
 
-          rate_limit to: Spree::Api::Config[:rate_limit_login], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :create, with: RATE_LIMIT_RESPONSE
-          rate_limit to: Spree::Api::Config[:rate_limit_refresh], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :refresh, with: RATE_LIMIT_RESPONSE
-
-          skip_before_action :authenticate_admin!, only: [:create, :refresh, :logout]
+          # The SSO callback answers a browser navigation, so a throttled request
+          # must return the person to the login page rather than a JSON body they
+          # cannot act on. It also gets its own bucket: completing a sign-in must
+          # not be refused because the login form was submitted a few times.
+          RATE_LIMITED_CALLBACK_RESPONSE = -> { redirect_to_dashboard(error: 'rate_limit_exceeded') }
+
+          # Each declaration carries a distinct `name:` — without one, Rails
+          # keys every counter in this controller on the same
+          # (controller, client) cache entry, silently merging the budgets.
+          # The login page fetches providers on every load, so sharing the
+          # login budget would let ordinary page views — or an attacker
+          # hitting providers alone — lock staff out of signing in.
+          rate_limit to: Spree::Api::Config[:rate_limit_login], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :create, name: 'login', with: -> { render_rate_limited(limit: Spree::Api::Config[:rate_limit_login]) }
+          rate_limit to: Spree::Api::Config[:rate_limit_refresh], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :providers, name: 'providers', with: -> { render_rate_limited(limit: Spree::Api::Config[:rate_limit_refresh]) }
+          rate_limit to: Spree::Api::Config[:rate_limit_login], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :callback, name: 'callback', with: RATE_LIMITED_CALLBACK_RESPONSE
+          rate_limit to: Spree::Api::Config[:rate_limit_refresh], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: [:refresh, :logout], name: 'refresh', with: -> { render_rate_limited(limit: Spree::Api::Config[:rate_limit_refresh]) }
+
+          skip_before_action :authenticate_admin!, only: [:create, :refresh, :logout, :providers, :callback]
 
           # POST /api/v3/admin/auth/login
           def create
@@ -21,7 +36,7 @@ module Spree
 
             if result.success?
               user = result.value
-              refresh_token = Spree::RefreshToken.create_for(user, request_env: request_env_for_token)
+              refresh_token = Spree::RefreshToken.create_for(user, audience: JWT_AUDIENCE_ADMIN, request_env: request_env_for_token)
               set_refresh_cookie(refresh_token)
               render json: auth_response(user)
             else
@@ -33,6 +48,51 @@ module Spree
             end
           end
 
+          # GET /api/v3/admin/auth/providers
+          #
+          # Lists the registered authentication providers so the dashboard login
+          # page can render itself: the password form when :email is registered,
+          # a button per redirect provider. Unauthenticated — it is read before
+          # anyone can log in — so it exposes only provider keys, kinds, labels
+          # and authorization URLs.
+          def providers
+            described = Spree.admin_authentication_strategies.describe { |key| issue_oauth_state(key) }
+
+            render json: { providers: described }
+          end
+
+          # GET /api/v3/admin/auth/callback/:provider
+          #
+          # Completes a redirect (SSO) login.
+          #
+          # Reached by a full-page browser redirect from the identity provider, so
+          # it answers with a redirect rather than JSON — the browser must land on
+          # the dashboard, not on a response body. Success sets the same
+          # refresh-token cookie the password flow issues and the SPA mints its
+          # access token from it on load, so no token ever travels in a URL.
+          def callback
+            return redirect_to_dashboard(error: ERROR_CODES[:invalid_oauth_state]) unless valid_oauth_state?
+
+            strategy = Spree.admin_authentication_strategies.build(
+              params[:provider],
+              params: params,
+              request_env: request.headers.env,
+              user_class: Spree.admin_user_class
+            )
+            return redirect_to_dashboard(error: ERROR_CODES[:invalid_provider]) if strategy.nil?
+
+            result = strategy.callback
+
+            unless result.success?
+              return redirect_to_dashboard(error: callback_error_code(strategy))
+            end
+
+            set_refresh_cookie(
+              Spree::RefreshToken.create_for(result.value, audience: JWT_AUDIENCE_ADMIN, request_env: request_env_for_token)
+            )
+            redirect_to_dashboard
+          end
+
           # POST /api/v3/admin/auth/refresh
           def refresh
             refresh_token_value = refresh_token_from_cookie
@@ -45,7 +105,9 @@ module Spree
               )
             end
 
-            refresh_token = Spree::RefreshToken.active.find_by(token: refresh_token_value)
+            # Narrowed by audience: a token minted on another surface must not
+            # be exchangeable for an admin access token here.
+            refresh_token = Spree::RefreshToken.active.for_audience(JWT_AUDIENCE_ADMIN).find_by(token: refresh_token_value)
 
             if refresh_token.nil?
               clear_refresh_cookie
@@ -66,7 +128,11 @@ module Spree
           # POST /api/v3/admin/auth/logout
           def logout
             refresh_token_value = refresh_token_from_cookie
-            Spree::RefreshToken.active.find_by(token: refresh_token_value)&.destroy if refresh_token_value.present?
+            if refresh_token_value.present?
+              # No `active` scope — revoking an already-expired token should
+              # still delete the row rather than leave it for the sweeper.
+              Spree::RefreshToken.for_audience(JWT_AUDIENCE_ADMIN).find_by(token: refresh_token_value)&.destroy
+            end
 
             clear_refresh_cookie
             head :no_content
@@ -74,26 +140,76 @@ module Spree
 
           private
 
-          def authentication_strategy
-            provider = params[:provider].presence || 'email'
-            strategy_class = Spree.admin_authentication_strategies[provider]
+          # The callback answers a browser navigation, so even the API-wide
+          # throttle must return the person to the login page — a JSON 429
+          # would strand them on a raw error body.
+          def render_rate_limited(**)
+            return redirect_to_dashboard(error: 'rate_limit_exceeded') if action_name == 'callback'
 
-            unless strategy_class
-              render_error(
-                code: ERROR_CODES[:invalid_provider],
-                message: "Unsupported authentication provider: #{provider}",
-                status: :bad_request
-              )
-              return nil
-            end
+            super
+          end
 
-            strategy_class.new(
-              params: params,
-              request_env: request.headers.env,
-              user_class: Spree.admin_user_class
+          OAUTH_STATE_PURPOSE = 'spree/admin/oauth_state'.freeze
+          OAUTH_STATE_EXPIRY = 15.minutes
+
+          # Signed, self-expiring CSRF token handed to the identity provider and
+          # echoed back to the callback. Signing it means no server-side session
+          # storage — the token proves the redirect started here, and a forged or
+          # expired value fails verification.
+          #
+          # The provider key is signed into the payload so a state minted for one
+          # provider cannot be replayed against another's callback.
+          def issue_oauth_state(provider)
+            Rails.application.message_verifier(OAUTH_STATE_PURPOSE).generate(
+              { provider: provider.to_s, nonce: SecureRandom.hex(16) },
+              expires_in: OAUTH_STATE_EXPIRY
             )
           end
 
+          def valid_oauth_state?
+            state = params[:state]
+            return false if state.blank?
+
+            # The verifier round-trips through JSON, so payload keys come back as strings.
+            payload = Rails.application.message_verifier(OAUTH_STATE_PURPOSE).verified(state)
+            return false unless payload.is_a?(Hash)
+
+            payload['provider'].to_s == params[:provider].to_s
+          end
+
+          # Sends the browser back to the dashboard. On failure the login page
+          # reads +?error=+ and explains what happened; on success it has the
+          # refresh cookie and completes sign-in through its normal boot refresh.
+          def redirect_to_dashboard(error: nil)
+            target = dashboard_url
+            target = "#{target}/login?error=#{error}" if error.present?
+
+            redirect_to target, allow_other_host: true
+          end
+
+          # Where the React dashboard is hosted.
+          def dashboard_url
+            Spree::Stores::DashboardUrl.call(store: current_store)
+          end
+
+          # A technical SSO failure (missing code, token verification) must not be
+          # reported as "ask an administrator for an invitation".
+          def callback_error_code(strategy)
+            if strategy.respond_to?(:account_not_provisioned?) && strategy.account_not_provisioned?
+              ERROR_CODES[:account_not_provisioned]
+            else
+              ERROR_CODES[:authentication_failed]
+            end
+          end
+
+          def authentication_strategies
+            Spree.admin_authentication_strategies
+          end
+
+          def authentication_user_class
+            Spree.admin_user_class
+          end
+
           def serializer_params
             {
               store: current_store,

data/app/controllers/spree/api/v3/admin/base_controller.rb

@@ -3,6 +3,7 @@ module Spree
     module V3
       module Admin
         class BaseController < Spree::Api::V3::BaseController
+          include Spree::Api::V3::Admin::StoreContext
           include Spree::Api::V3::AdminAuthentication
 
           # Must be registered before ScopedAuthorization so authenticate_admin!
@@ -11,6 +12,7 @@ module Spree
           before_action :authenticate_admin!
 
           include Spree::Api::V3::ScopedAuthorization
+          include Spree::Api::V3::Admin::ValidationDetails
         end
       end
     end

data/app/controllers/spree/api/v3/admin/catalog_assignments_controller.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Withdrawing a catalog from an audience, addressed by assignment id.
+        class CatalogAssignmentsController < ResourceController
+          scoped_resource :products
+
+          protected
+
+          def model_class
+            Spree::CatalogAssignment
+          end
+
+          def serializer_class
+            Spree.api.admin_catalog_assignment_serializer
+          end
+
+          def scope
+            Spree::CatalogAssignment.where(catalog_id: current_store.catalogs.select(:id)).
+              accessible_by(current_ability, ability_action_for_request)
+          end
+        end
+      end
+    end
+  end
+end