spree_api 5.6.1 → 6.0.0.beta2

data/app/controllers/spree/api/v3/admin/dashboard_controller.rb

@@ -2,23 +2,31 @@ module Spree
   module Api
     module V3
       module Admin
+        # Point-in-time counts registered on Spree.reporting: what needs the
+        # merchant's attention right now, for the home screen's card and the
+        # sidebar's badges. Time-series analytics live in the semantic
+        # reporting endpoint (ReportingController).
         class DashboardController < Admin::BaseController
-          scoped_resource :dashboard
+          include ReportingAuthorization
 
-          # GET /api/v3/admin/dashboard/analytics
-          def analytics
-            date_from = (params[:date_from] || 30.days.ago).to_time.beginning_of_day
-            date_to = (params[:date_to] || Time.current).to_time.end_of_day
-            currency = params[:currency] || current_store.default_currency
+          scoped_resource :dashboard
 
-            serializer = DashboardAnalyticsSerializer.new(
+          # GET /api/v3/admin/dashboard/counters
+          #
+          # Filtered to the counters this caller may read, so a limited role
+          # gets a shorter list rather than a refused card.
+          def counters
+            channel = requested_channel
+            evaluated = Spree::Reporting::Counters.new(
               store: current_store,
-              currency: currency,
-              time_range: date_from..date_to,
-              params: serializer_params
+              channel: channel,
+              allowed: ->(counter) { member_allowed?(counter) }
             )
 
-            render json: serializer.to_h
+            render json: {
+              channel_id: channel&.prefixed_id,
+              counters: DashboardCounterSerializer.new(evaluated.to_a).serializable_hash
+            }
           end
 
           private
@@ -27,15 +35,11 @@ module Spree
             'read'
           end
 
-          def serializer_params
-            {
-              store: current_store,
-              locale: current_locale,
-              currency: current_currency,
-              user: current_user,
-              includes: [],
-              expand: []
-            }
+          # Optional channel scoping — omitted means all channels.
+          def requested_channel
+            return if params[:channel_id].blank?
+
+            current_store.channels.find_by_prefix_id!(params[:channel_id])
           end
         end
       end

data/app/controllers/spree/api/v3/admin/data_requests_controller.rb

@@ -0,0 +1,60 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # The store's log of GDPR data subject requests — what was asked for,
+        # by whom, and whether it was answered.
+        #
+        # Read-only plus create. A request is a record of something that
+        # happened, so editing one would falsify the audit trail the record
+        # exists to provide; erasing the log of an erasure is worse still.
+        class DataRequestsController < ResourceController
+          scoped_resource :customers
+
+          def create
+            authorize! :create, Spree::DataRequest
+
+            result = Spree::DataRequests::Create.call(
+              store: current_store,
+              customer: customer,
+              kind: params[:kind],
+              requested_by: try_spree_current_user
+            )
+
+            return render_result_error(result) unless result.success?
+
+            render json: serialize_resource(result.value), status: :accepted
+          end
+
+          protected
+
+          def model_class
+            Spree::DataRequest
+          end
+
+          def serializer_class
+            Spree.api.admin_data_request_serializer
+          end
+
+          def scope
+            super.recent_first
+          end
+
+          def collection_includes
+            [:customer]
+          end
+
+          private
+
+          # Customers are global in Spree — they shop across a multi-store
+          # installation on one account — so there is no store association to
+          # narrow this through. `authorize!` above is what gates the caller,
+          # and the request records which store it was raised at.
+          def customer
+            @customer ||= Spree.customer_class.find_by_prefix_id!(params[:customer_id])
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/delivery_method_rules_controller.rb

@@ -0,0 +1,54 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        class DeliveryMethodRulesController < ResourceController
+          scoped_resource :delivery_methods
+
+          # GET /api/v3/admin/delivery_method_rules/types
+          # Registered rule kinds with preference schemas for admin pickers.
+          def types
+            authorize! :create, Spree::DeliveryMethodRule
+
+            data = Spree.delivery_method_rules.map do |klass|
+              {
+                type: klass.api_type,
+                name: klass.human_name,
+                description: klass.human_description,
+                preference_schema: klass.serialized_preference_schema,
+                # Association-backed config (e.g. `product_ids`) a rule accepts
+                # beyond its preferences, so admin UIs can render the right
+                # editor without hardcoding rule types.
+                association_fields: association_fields_for(klass)
+              }
+            end
+
+            render json: { data: data }
+          end
+
+          protected
+
+          def model_class
+            Spree::DeliveryMethodRule
+          end
+
+          def serializer_class
+            Spree.api.admin_delivery_method_rule_serializer
+          end
+
+          private
+
+          # `additional_permitted_attributes` entries are either bare symbols
+          # or `{ product_ids: [] }`-style hashes; both reduce to field names.
+          def association_fields_for(klass)
+            return [] unless klass.respond_to?(:additional_permitted_attributes)
+
+            klass.additional_permitted_attributes.flat_map do |attribute|
+              attribute.is_a?(Hash) ? attribute.keys : attribute
+            end.map(&:to_s)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/delivery_methods/rules_controller.rb

@@ -0,0 +1,114 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module DeliveryMethods
+          # Eligibility rules nested under a delivery method. `type` is the
+          # wire shorthand from GET /delivery_method_rules/types.
+          class RulesController < ResourceController
+            scoped_resource :delivery_methods
+
+            def create
+              rule_class = Spree.delivery_method_rules.detect do |klass|
+                klass.api_type == params[:type].to_s
+              end
+
+              if rule_class.nil?
+                return render_error(
+                  code: ERROR_CODES[:validation_error],
+                  message: Spree.t('errors.messages.invalid_delivery_method_rule'),
+                  status: :unprocessable_entity
+                )
+              end
+
+              @resource = rule_class.new(delivery_method: parent, active: active_param)
+              assign_rule_preferences(@resource)
+              assign_rule_products(@resource)
+              assign_extension_attributes(@resource)
+              authorize_resource!(@resource, :create)
+
+              if @resource.save
+                render json: serialize_resource(@resource), status: :created
+              else
+                render_validation_error(@resource.errors)
+              end
+            end
+
+            def update
+              @resource.active = active_param unless params[:active].nil?
+              assign_rule_preferences(@resource)
+              assign_rule_products(@resource)
+              assign_extension_attributes(@resource)
+
+              if @resource.save
+                render json: serialize_resource(@resource)
+              else
+                render_validation_error(@resource.errors)
+              end
+            end
+
+            protected
+
+            def model_class
+              Spree::DeliveryMethodRule
+            end
+
+            def serializer_class
+              Spree.api.admin_delivery_method_rule_serializer
+            end
+
+            def scope
+              parent.delivery_method_rules
+            end
+
+            def permitted_params
+              params.permit(*model_additional_permitted_attributes, :type, :active, preferences: {}, product_ids: [])
+            end
+
+            private
+
+            def parent
+              @parent ||= current_store.delivery_methods.accessible_by(current_ability, :update).find_by_prefix_id!(params[:delivery_method_id])
+            end
+
+            def active_param
+              params[:active].nil? ? true : params[:active].to_b
+            end
+
+            # This controller assigns each field by hand rather than mass-assigning,
+            # so attributes an extension contributed have to be forwarded too or
+            # permitting them would have no effect.
+            def assign_extension_attributes(rule)
+              keys = model_additional_permitted_attributes.flat_map { |a| a.is_a?(Hash) ? a.keys : a }
+              return if keys.empty?
+
+              rule.assign_attributes(permitted_params.to_h.slice(*keys.map(&:to_s)))
+            end
+
+            def assign_rule_preferences(rule)
+              (permitted_params[:preferences] || {}).each do |key, value|
+                next unless rule.has_preference?(key)
+
+                rule.set_preference(key, value)
+              end
+            end
+
+            # Association-backed rule config (ExcludedProductsRule). Products are
+            # looked up within the rule's store and through the caller's ability;
+            # ids that resolve to nothing are dropped rather than failing the
+            # save, since an unreachable product cannot become an exclusion. A
+            # nil param leaves the selection untouched; an empty array clears it.
+            def assign_rule_products(rule)
+              ids = permitted_params[:product_ids]
+              return if ids.nil? || !rule.respond_to?(:products)
+
+              rule.products = rule.store.products.
+                              accessible_by(current_ability, :show).
+                              where(id: decode_prefixed_ids(ids))
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/delivery_methods_controller.rb

@@ -0,0 +1,243 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        class DeliveryMethodsController < ResourceController
+          scoped_resource :delivery_methods
+
+          # GET /api/v3/admin/delivery_methods/calculators
+          # Registered delivery calculator classes with their preference
+          # schemas, so admin UIs can render configuration forms.
+          def calculators
+            authorize! :create, model_class
+
+            data = Spree::DeliveryMethod.calculators.map do |calculator_class|
+              {
+                type: calculator_class.api_type,
+                name: calculator_class.description,
+                preference_schema: calculator_class.respond_to?(:serialized_preference_schema) ? calculator_class.serialized_preference_schema : []
+              }
+            end
+
+            render json: { data: data }
+          end
+
+          # GET /api/v3/admin/delivery_methods/fulfillment_providers
+          # Registered FulfillmentProvider strategies with their class
+          # predicates, so admin UIs render capability hints from the
+          # registry, not JS constants.
+          def fulfillment_providers
+            authorize! :create, model_class
+
+            data = Spree.fulfillment_providers.map do |provider_class|
+              {
+                type: provider_class.to_s,
+                name: provider_class.provider_name,
+                integration_class: provider_class.integration_class,
+                integration_type: integration_api_type(provider_class),
+                available: provider_class.available_for_store?(current_store),
+                digital: provider_class.digital?,
+                pickup: provider_class.pickup?,
+                pickup_point: provider_class.pickup_point?,
+                requires_address: provider_class.new.requires_address?
+              }
+            end
+
+            render json: { data: data }
+          end
+
+          # GET /api/v3/admin/delivery_methods/rate_providers
+          # Registered DeliveryRateProvider strategies. Providers whose
+          # integration isn't connected come back with `available: false` so
+          # the dashboard can offer connecting it inline — DeliveryMethod
+          # still rejects an unavailable provider on save. `service_catalog`
+          # feeds the carrier-services picker (empty = free-form).
+          def rate_providers
+            authorize! :create, model_class
+
+            data = Spree.delivery_rate_providers.map do |provider_class|
+              integration = provider_class.integration_class.presence &&
+                current_store.integrations.active.find_by(type: provider_class.integration_class)
+              catalog = provider_class.service_catalog(integration)
+
+              {
+                type: provider_class.to_s,
+                name: provider_class.provider_name,
+                integration_class: provider_class.integration_class,
+                integration_type: integration_api_type(provider_class),
+                available: provider_class.available_for_store?(current_store),
+                requires_address: provider_class.requires_address?,
+                uses_calculator: provider_class.uses_calculator?,
+                service_catalog: catalog.services,
+                # Present when the provider could not list services (e.g. a
+                # credential tier without access) — the picker shows it
+                # instead of an empty list.
+                service_catalog_error: catalog.error_message
+              }
+            end
+
+            render json: { data: data, default: Spree::DeliveryMethod::DEFAULT_RATE_PROVIDER }
+          end
+
+          def create
+            @resource = model_class.new(assignable_params)
+            authorize_resource!(@resource, :create)
+            assign_calculator(@resource)
+
+            if @resource.errors.empty? && @resource.save
+              render json: serialize_resource(@resource), status: :created
+            else
+              render_validation_error(@resource.errors)
+            end
+          end
+
+          def update
+            @resource.assign_attributes(assignable_params)
+            assign_calculator(@resource)
+
+            if @resource.errors.empty? && @resource.save
+              render json: serialize_resource(@resource)
+            else
+              render_validation_error(@resource.errors)
+            end
+          end
+
+          protected
+
+          # Wire shorthand of the provider's integration (`easy_post`), so the
+          # dashboard can tie a provider to the integration it needs without
+          # translating Ruby class names client-side.
+          def integration_api_type(provider_class)
+            klass = provider_class.integration_class.presence&.safe_constantize
+            klass&.api_type
+          end
+
+          def model_class
+            Spree::DeliveryMethod
+          end
+
+          def serializer_class
+            Spree.api.admin_delivery_method_serializer
+          end
+
+          # A single POST/PATCH can ship eligibility rules and carrier service
+          # rows alongside the basics; `DeliveryMethod#rules=` / `#services=`
+          # reconcile to the desired set, so the dashboard saves the whole
+          # sheet in one round-trip.
+          def permitted_params
+            params.permit(
+              *model_additional_permitted_attributes,
+              :name, :admin_name, :code, :fulfillment_provider,
+              :pickup_point_provider, :rate_provider, :storefront_visible, :tracking_url,
+              :available_to_sellers,
+              :estimated_transit_business_days_min, :estimated_transit_business_days_max,
+              :tax_category_id, :calculator_type, :markup_flat, :markup_percent,
+              :delivery_profile_id, :delivery_origin_group_id, :delivery_zone_id,
+              stock_location_ids: [], calculator_preferences: {},
+              rules: rule_attributes,
+              services: [:id, :carrier, :service, :label, :markup_flat, :markup_percent, :position]
+            )
+          end
+
+          def rule_attributes
+            [:id, :type, :active, { preferences: {} }, *subclassed_rule_attributes]
+          end
+
+          # Association-backed rule config declares itself on the rule class
+          # (e.g. `[product_ids: []]`), so plugin-defined rules need no change
+          # here.
+          def subclassed_rule_attributes
+            Spree.delivery_method_rules.flat_map do |klass|
+              klass.respond_to?(:additional_permitted_attributes) ? klass.additional_permitted_attributes : []
+            end.uniq
+          end
+
+          def collection_includes
+            [:calculator, :tax_category, :delivery_zone, :delivery_profile, :delivery_method_rules, :seller]
+          end
+
+          private
+
+          # Resolves prefixed-ID params to records; calculator handled separately.
+          def assignable_params
+            attributes = permitted_params.except(:tax_category_id, :delivery_profile_id, :delivery_origin_group_id, :delivery_zone_id, :stock_location_ids, :calculator_type, :calculator_preferences)
+            if params.key?(:tax_category_id)
+              attributes[:tax_category] = params[:tax_category_id].present? ? Spree::TaxCategory.accessible_by(current_ability, :show).find_by_prefix_id!(params[:tax_category_id]) : nil
+            end
+            if params.key?(:delivery_profile_id)
+              attributes[:delivery_profile] = current_store.delivery_profiles.accessible_by(current_ability, :show).find_by_prefix_id!(params[:delivery_profile_id])
+            end
+            if params.key?(:delivery_origin_group_id) && params[:delivery_origin_group_id].present?
+              attributes[:delivery_origin_group] = current_store.delivery_origin_groups.accessible_by(current_ability, :show).find_by_prefix_id!(params[:delivery_origin_group_id])
+            end
+            if params.key?(:delivery_zone_id)
+              attributes[:delivery_zone] = params[:delivery_zone_id].present? ? current_store.delivery_zones.accessible_by(current_ability, :show).find_by_prefix_id!(params[:delivery_zone_id]) : nil
+            end
+            if params.key?(:stock_location_ids)
+              attributes[:pickup_locations] = Array(params[:stock_location_ids]).map { |id| current_store.stock_locations.accessible_by(current_ability, :show).find_by_prefix_id!(id) }
+            end
+            attributes[:rules] = resolved_rule_rows if params.key?(:rules)
+            attributes
+          end
+
+          # `DeliveryMethod#rules=` decodes prefixed ids but applies no store
+          # or ability scoping, so resolve association-backed config here — a
+          # product the caller cannot reach 404s rather than silently linking.
+          def resolved_rule_rows
+            Array(permitted_params[:rules]).map do |row|
+              row = row.to_h
+              row['product_ids'].blank? ? row : row.merge('product_ids' => accessible_product_ids(row['product_ids']))
+            end
+          end
+
+          # Keeps only the products this caller can reach in this store, and
+          # plucks ids rather than hydrating rows to read them back. Ids that
+          # resolve to nothing — another store's, or a product deleted while
+          # the sheet was open — are dropped: they cannot become an exclusion,
+          # and failing the whole save over one would leave the merchant stuck
+          # with no way to clear it. Mirrors how price lists filter membership.
+          def accessible_product_ids(ids)
+            current_store.products.
+              accessible_by(current_ability, :show).
+              where(id: decode_prefixed_ids(ids)).
+              pluck(:id)
+          end
+
+          def assign_calculator(delivery_method)
+            calculator_type = permitted_params[:calculator_type]
+            preferences = permitted_params[:calculator_preferences]
+
+            if calculator_type.present? && delivery_method.calculator&.class&.api_type != calculator_type
+              selected_calculator_class = Spree::DeliveryMethod.calculators.find do |klass|
+                klass.api_type == calculator_type
+              end
+              unless selected_calculator_class
+                delivery_method.errors.add(:calculator_type, :invalid)
+                return
+              end
+
+              delivery_method.calculator = selected_calculator_class.new
+            end
+
+            return if preferences.blank?
+
+            # A payload may carry preferences without naming a calculator —
+            # editing the amount on a method that already has one, or creating
+            # with the default. The model only builds the default calculator
+            # at validation, so without this the preferences land on nothing
+            # and the amount the merchant typed is silently replaced by a free
+            # rate.
+            delivery_method.ensure_calculator
+            return if delivery_method.calculator.nil?
+
+            preferences.each do |key, value|
+              next unless delivery_method.calculator.has_preference?(key)
+
+              delivery_method.calculator.set_preference(key, value)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/delivery_profiles/origin_groups_controller.rb

@@ -0,0 +1,80 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module DeliveryProfiles
+          # Origin groups of one delivery profile. `stock_location_ids`
+          # replaces the group's full membership; empty means every store
+          # location. Deleting a group cascades to its zones and methods;
+          # only the profile's last group refuses to go.
+          class OriginGroupsController < ResourceController
+            scoped_resource :settings
+
+            def create
+              @resource = scope.new(assignable_params)
+              authorize_resource!(@resource, :create)
+
+              if @resource.save
+                render json: serialize_resource(@resource), status: :created
+              else
+                render_validation_error(@resource.errors)
+              end
+            end
+
+            def update
+              @resource.assign_attributes(assignable_params)
+
+              if @resource.save
+                render json: serialize_resource(@resource)
+              else
+                render_validation_error(@resource.errors)
+              end
+            end
+
+            protected
+
+            def model_class
+              Spree::DeliveryOriginGroup
+            end
+
+            def serializer_class
+              Spree.api.admin_delivery_origin_group_serializer
+            end
+
+            def scope
+              parent_profile.delivery_origin_groups.ordered
+            end
+
+            def permitted_params
+              params.permit(*model_additional_permitted_attributes, :name, :position, stock_location_ids: [])
+            end
+
+            def collection_includes
+              [:stock_locations]
+            end
+
+            private
+
+            def parent_profile
+              @parent_profile ||= current_store.delivery_profiles.
+                accessible_by(current_ability, :show).
+                find_by_prefix_id!(params[:delivery_profile_id])
+            end
+
+            def assignable_params
+              attributes = permitted_params.except(:stock_location_ids)
+
+              if params.key?(:stock_location_ids)
+                attributes[:stock_locations] = Array(params[:stock_location_ids]).map do |id|
+                  current_store.stock_locations.accessible_by(current_ability, :show).find_by_prefix_id!(id)
+                end
+              end
+
+              attributes
+            end
+          end
+        end
+      end
+    end
+  end
+end