spree_api 5.6.1 → 6.0.0.beta2

data/app/serializers/spree/api/v3/tax_identifier_serializer.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V3
+      # The buyer's own tax registration. Deliberately just the kind and the
+      # number: the validation verdict is the platform's bookkeeping, and showing
+      # a customer that their number came back unverified invites support
+      # tickets about a check they cannot influence.
+      class TaxIdentifierSerializer < BaseSerializer
+        typelize kind: [:string, comment: 'Tax identifier kind, keyed to a registered validator. Built-in: eu_vat. Extensions may register more.'], value: :string
+
+        attributes :kind, :value
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/tax_line_serializer.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V3
+      # A single tax charge (typed row) on a line item, fulfillment or fee.
+      class TaxLineSerializer < BaseSerializer
+        typelize label: :string, rate: :string, included: :boolean,
+                 amount: [:string, nullable: true], display_amount: [:string, nullable: true],
+                 tax_rate_id: [:string, nullable: true], line_item_id: [:string, nullable: true],
+                 fulfillment_id: [:string, nullable: true], fee_id: [:string, nullable: true]
+
+        attributes :label, :included
+
+        attribute :rate do |record|
+          record.rate&.to_s
+        end
+
+        attribute :tax_rate_id do |record|
+          record.tax_rate&.prefixed_id
+        end
+
+        attribute :line_item_id do |record|
+          record.line_item&.prefixed_id
+        end
+
+        attribute :fulfillment_id do |record|
+          record.fulfillment&.prefixed_id
+        end
+
+        attribute :fee_id do |record|
+          record.fee&.prefixed_id
+        end
+
+        money_attributes :amount, :display_amount
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/variant_serializer.rb

@@ -10,8 +10,12 @@ module Spree
                  purchasable: :boolean, in_stock: :boolean, backorderable: :boolean, preorder: :boolean,
                  preorder_ships_at: [:string, nullable: true],
                  weight: [:number, nullable: true], height: [:number, nullable: true], width: [:number, nullable: true], depth: [:number, nullable: true],
+                 weight_unit: [:string, enum: Spree::Variant::WEIGHT_UNITS], dimensions_unit: [:string, enum: Spree::Variant::DIMENSION_UNITS],
                  price: 'Price',
-                 original_price: ['Price', nullable: true]
+                 original_price: ['Price', nullable: true],
+                 minimum_order_quantity: :number, order_multiple: :number,
+                 purchase_unit: [:string, enum: Spree::Variant::PURCHASE_UNITS], units_per_carton: ['number | null'],
+                 seller_id: [:string, nullable: true]
 
         attribute :product_id do |variant|
           variant.product&.prefixed_id
@@ -62,6 +66,37 @@ module Spree
           variant.depth&.to_f
         end
 
+        # Resolved, not the raw columns: a variant that states no unit of its
+        # own is measured in the store's, so the numbers above are meaningless
+        # without this. Always present for the same reason the quantity rules
+        # below are — a caller should not have to fetch the store to read a
+        # weight.
+        attribute :weight_unit, &:weight_unit
+
+        attribute :dimensions_unit, &:dimensions_unit
+
+        # The buyer's RESOLVED rules — their catalog terms over the variant's
+        # base — so a storefront draws the right stepper without knowing
+        # which of the two answered. Always present: an unrestricted variant
+        # reads 1 and 1, which is a valid stepper rather than a special case.
+        attribute :minimum_order_quantity do |variant|
+          quantity_rule_for(variant).minimum
+        end
+
+        attribute :order_multiple do |variant|
+          quantity_rule_for(variant).multiple
+        end
+
+        # What the buyer is quoted in. Stored quantities stay units at every
+        # level; this only says how to present them.
+        attribute :purchase_unit do |variant|
+          variant.purchase_unit.presence || 'unit'
+        end
+
+        attribute :units_per_carton do |variant|
+          variant.units_per_carton
+        end
+
         # Price object - calculated price with price list resolution
         attribute :price do |variant|
           price = price_for(variant)
@@ -79,6 +114,21 @@ module Spree
           end
         end
 
+        # Who sells this variant — one answer, resolved on the model, so a
+        # storefront never learns whether it came from the product (an owned
+        # listing) or the row itself (a master shared by several sellers). Nil
+        # is first-party. Shoppers comparing offers on one page group by this,
+        # so it is a plain attribute rather than an expand.
+        attribute :seller_id do |variant|
+          variant.resolved_seller&.prefixed_id
+        end
+
+        one :seller,
+            resource: proc { Spree.api.seller_serializer },
+            if: proc { expand?('seller') } do |variant|
+          variant.resolved_seller
+        end
+
         # Conditional associations
         one :primary_media,
             resource: proc { Spree.api.media_serializer },
@@ -91,7 +141,7 @@ module Spree
 
         many :option_values, resource: proc { Spree.api.option_value_serializer }
 
-        many :public_metafields,
+        many :storefront_custom_fields,
              key: :custom_fields,
              resource: proc { Spree.api.custom_field_serializer },
              if: proc { expand?('custom_fields') }

data/app/serializers/spree/api/v3/wishlist_item_serializer.rb

@@ -5,16 +5,16 @@ module Spree
         typelize variant_id: :string, wishlist_id: :string, quantity: :number,
                  product_id: :string
 
-        attribute :variant_id do |wished_item|
-          wished_item.variant&.prefixed_id
+        attribute :variant_id do |wishlist_item|
+          wishlist_item.variant&.prefixed_id
         end
 
-        attribute :product_id do |wished_item|
-          wished_item.product&.prefixed_id
+        attribute :product_id do |wishlist_item|
+          wishlist_item.product&.prefixed_id
         end
 
-        attribute :wishlist_id do |wished_item|
-          wished_item.wishlist&.prefixed_id
+        attribute :wishlist_id do |wishlist_item|
+          wishlist_item.wishlist&.prefixed_id
         end
 
         attributes :quantity

data/app/serializers/spree/api/v3/wishlist_serializer.rb

@@ -14,7 +14,7 @@ module Spree
           wishlist.is_private?
         end
 
-        many :wished_items,
+        many :wishlist_items,
              key: :items,
              resource: proc { Spree.api.wishlist_item_serializer },
              if: proc { expand?('items') }

data/app/services/spree/api/v3/filters_aggregator.rb

@@ -4,13 +4,15 @@ module Spree
       class FiltersAggregator
         # @param scope [ActiveRecord::Relation] Base product scope (fully filtered, including option values)
         # @param currency [String] Currency for price range
-        # @param category [Spree::Category, nil] Optional category for default_sort and category filtering context
+        # @param category [Spree::Category, nil] Optional category — drives the child-category facet only (NOT default_sort)
+        # @param sort_order [String, nil] Optional grouping sort_order (space format, e.g. a collection's 'price asc') that drives default_sort
         # @param option_value_ids [Array<String>] Currently selected option value prefixed IDs (for disjunctive facet counts)
         # @param scope_before_options [ActiveRecord::Relation] Scope before option value filters (for disjunctive counts)
-        def initialize(scope:, currency:, category: nil, option_value_ids: [], scope_before_options: nil)
+        def initialize(scope:, currency:, category: nil, sort_order: nil, option_value_ids: [], scope_before_options: nil)
           @scope = scope
           @currency = currency
           @category = category
+          @sort_order = sort_order
           @option_value_ids = option_value_ids
           @scope_before_options = scope_before_options || scope
         end
@@ -19,7 +21,7 @@ module Spree
           {
             filters: build_filters,
             sort_options: sort_options,
-            default_sort: to_api_sort(@category&.sort_order || 'manual'),
+            default_sort: to_api_sort(@sort_order || 'manual'),
             total_count: @scope.distinct.count
           }
         end
@@ -36,7 +38,7 @@ module Spree
         end
 
         def sort_options
-          Spree::Taxon::SORT_ORDERS.map { |id| { id: to_api_sort(id), label: nil } }
+          Spree::Collection::SORT_ORDERS.map { |id| { id: to_api_sort(id), label: nil } }
         end
 
         # Converts internal sort format ('price asc') to API format ('price', '-price')
@@ -93,7 +95,7 @@ module Spree
             Spree::OptionValue
               .where(option_type_id: type_ids)
               .order(:position)
-              .pluck(:id, :option_type_id, :name, :presentation, :position, :color_code)
+              .pluck(:id, :option_type_id, :name, :label, :position, :color_code)
           end
           return [] if ov_rows.empty?
 
@@ -143,15 +145,15 @@ module Spree
             .count("#{var_table}.product_id")
         end
 
-        # Load translated presentations for option values.
-        # Returns { option_value_id => translated_presentation } or empty hash when using the content locale.
+        # Load translated labels for option values.
+        # Returns { option_value_id => translated_label } or empty hash when using the content locale.
         def load_option_value_translations(ov_ids)
           locale = Spree::Current.locale || I18n.locale.to_s
           return {} if locale.to_s == Spree::Current.content_locale
 
           Spree::OptionValue::Translation
             .where(spree_option_value_id: ov_ids, locale: locale)
-            .pluck(:spree_option_value_id, :presentation)
+            .pluck(:spree_option_value_id, :label)
             .to_h
         end
 
@@ -163,17 +165,17 @@ module Spree
             rows = ov_rows_by_type[option_type.id]
             next if rows.blank?
 
-            # rows: [id, option_type_id, name, presentation, position, color_code]
-            options = rows.filter_map do |id, _, name, presentation, position, color_code|
+            # rows: [id, option_type_id, name, label, position, color_code]
+            options = rows.filter_map do |id, _, name, label, position, color_code|
               count = counts[id] || 0
               next if count.zero?
 
-              label = ov_translations[id] || presentation
+              display_label = ov_translations[id] || label
 
               {
                 id: encode_prefixed_id(:optval, id),
                 name: name,
-                label: label,
+                label: display_label,
                 position: position,
                 color_code: color_code,
                 image_url: image_urls[id],

data/app/services/spree/webhooks/deliver_webhook.rb

@@ -12,38 +12,66 @@ module Spree
         new(delivery: delivery, secret_key: secret_key).call
       end
 
+      # Callables invoked with (headers, delivery) before every webhook POST —
+      # merge into the hash to add outbound headers (e.g. W3C trace context
+      # propagation). Registrations live on a reloadable class: register from
+      # a `config.to_prepare` block so they survive code reloads.
+      #
+      # @return [Array<#call>] the mutable decorator list
+      def self.header_decorators
+        @header_decorators ||= []
+      end
+
+      # @param delivery [Spree::WebhookDelivery] the pending delivery to send
+      # @param secret_key [String] endpoint secret used to sign the payload
       def initialize(delivery:, secret_key:)
         @delivery = delivery
         @secret_key = secret_key
       end
 
+      # Sends the webhook and records the outcome on the delivery. Transport
+      # failures are captured on the record rather than raised, so a broken
+      # endpoint never breaks the caller.
+      #
+      # @return [Spree::WebhookDelivery] the completed delivery
       def call
-        start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-
-        response = make_request
-        execution_time = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round
-
-        @delivery.complete!(
-          response_code: response.code.to_i,
-          execution_time: execution_time,
-          response_body: response.body.to_s.truncate(10_000)
-        )
-      rescue Net::OpenTimeout, Net::ReadTimeout => e
-        execution_time = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round
-        Rails.error.report(e, context: { webhook_delivery_id: @delivery.id, url: @delivery.url })
-        @delivery.complete!(
-          execution_time: execution_time,
-          error_type: 'timeout',
-          request_errors: e.message
-        )
-      rescue StandardError => e
-        execution_time = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round
-        Rails.error.report(e, context: { webhook_delivery_id: @delivery.id, url: @delivery.url })
-        @delivery.complete!(
-          execution_time: execution_time,
-          error_type: 'connection_error',
-          request_errors: e.message
-        )
+        ActiveSupport::Notifications.instrument(
+          'deliver.spree_webhooks',
+          event_name: @delivery.event_name,
+          url_host: url_host
+        ) do |payload|
+          start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+
+          begin
+            response = make_request
+            execution_time = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round
+
+            payload[:response_code] = response.code.to_i
+            @delivery.complete!(
+              response_code: response.code.to_i,
+              execution_time: execution_time,
+              response_body: response.body.to_s.truncate(10_000)
+            )
+          rescue Net::OpenTimeout, Net::ReadTimeout => e
+            execution_time = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round
+            Rails.error.report(e, context: { webhook_delivery_id: @delivery.id, url: @delivery.url })
+            payload[:error_type] = 'timeout'
+            @delivery.complete!(
+              execution_time: execution_time,
+              error_type: 'timeout',
+              request_errors: e.message
+            )
+          rescue StandardError => e
+            execution_time = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round
+            Rails.error.report(e, context: { webhook_delivery_id: @delivery.id, url: @delivery.url })
+            payload[:error_type] = 'connection_error'
+            @delivery.complete!(
+              execution_time: execution_time,
+              error_type: 'connection_error',
+              request_errors: e.message
+            )
+          end
+        end
       end
 
       private
@@ -56,6 +84,8 @@ module Spree
           'X-Spree-Webhook-Timestamp' => webhook_timestamp.to_s,
           'X-Spree-Webhook-Event' => @delivery.event_name
         }
+        self.class.header_decorators.each { |decorator| decorator.call(headers, @delivery) }
+
         body = payload_json
         http_options = { open_timeout: TIMEOUT, read_timeout: TIMEOUT, verify_mode: ssl_verify_mode }
 
@@ -89,6 +119,12 @@ module Spree
         @webhook_timestamp ||= Time.current.to_i
       end
 
+      def url_host
+        URI.parse(@delivery.url).host
+      rescue URI::InvalidURIError
+        nil
+      end
+
       def ssl_verify_mode
         if Spree::Api::Config.webhooks_verify_ssl
           OpenSSL::SSL::VERIFY_PEER

data/app/subscribers/spree/webhook_event_subscriber.rb

@@ -12,15 +12,19 @@ module Spree
   #
   # @example
   #   # Webhooks are automatically delivered when events are published
-  #   Spree::Events.publish('order.completed', order: order)
+  #   Spree::Events.publish('order.placed', order: order)
   #
   class WebhookEventSubscriber < Spree::Subscriber
     subscribes_to '*'
 
-    # Admin auth events carry live credentials (password reset tokens) and have
-    # no legitimate external consumer — core delivers those emails itself.
-    # Never forward them to webhook endpoints, including '*' subscriptions.
-    NON_DELIVERABLE_EVENTS = %w[admin_user.password_reset_requested].freeze
+    # Admin and seller auth events carry live credentials (password reset
+    # tokens) and have no legitimate external consumer — core delivers those
+    # emails itself. Never forward them to webhook endpoints, including '*'
+    # subscriptions.
+    NON_DELIVERABLE_EVENTS = %w[
+      admin_user.password_reset_requested
+      seller_user.password_reset_requested
+    ].freeze
 
     def handle(event)
       return unless Spree::Api::Config.webhooks_enabled

data/config/brakeman.ignore

@@ -21,4 +21,4 @@
     }
   ],
   "brakeman_version": "7.1.0"
-}
+}

data/config/initializers/typelizer.rb

@@ -23,9 +23,10 @@ Rails.application.config.after_initialize do
     # Serializers that exist only for Admin API or events — no Store API controller
     store_excluded = %w[
       Asset CartPromotion OrderPromotion
-      StockItem StockMovement StockTransfer ShippingCategory
-      Reimbursement Report Export Import ImportRow
-      TaxCategory CustomerReturn
+      StockLevel StockMovement StockTransfer
+      Report Export Import ImportRow
+      TaxCategory Exchange ExchangeLineItem
+      SupplierEvent PurchaseOrderEvent StockReceiptEvent
     ].to_set
 
     # Store SDK — no prefix, package provides namespace
@@ -33,7 +34,7 @@ Rails.application.config.after_initialize do
       c.output_dir = api_root.join('../../packages/sdk/src/types/generated')
       c.reject_class = ->(serializer:) {
         name = serializer.name.to_s
-        name.include?('::Admin::') ||
+        name.include?('::Admin::') || name.include?('::Seller::') ||
           store_excluded.include?(name.sub(/\ASpree::Api::V3::/, '').sub(/Serializer\z/, ''))
       }
       c.serializer_name_mapper = ->(serializer) {
@@ -53,5 +54,51 @@ Rails.application.config.after_initialize do
           .sub(/Serializer\z/, '')
       }
     end
+
+    # Seller SDK — the seller panel's own branch.
+    #
+    # Emits every `::Seller::` serializer PLUS the store-level serializers a
+    # seller serializer nests. Seller serializers extend store ones (a
+    # seller's product renders its media, variants and categories through the
+    # public shapes — those are exactly what a seller may see of their own
+    # record), so the referenced types have to exist in this package too. Admin
+    # avoids the same problem by shipping an admin twin of every store
+    # serializer it references; the seller branch is deliberately thinner and
+    # borrows the store shapes as-is.
+    #
+    # Store-level names are emitted only when a seller serializer reaches
+    # them — the `store_nested_for_seller` set — so this package does not
+    # grow into a second copy of the whole store SDK.
+    #
+    # A name the seller branch declares itself must NOT be listed here: both
+    # map to the same bare type name, so listing it emits the export twice and
+    # the package stops compiling. Media and Variant are declared on the seller
+    # branch; Category and CustomField are not, but the store product
+    # serializer this branch inherits references them, so their types still
+    # have to exist in the package.
+    store_nested_for_seller = %w[
+      Address Category CustomField OptionType OptionValue Price PriceHistory Seller
+    ].to_set
+
+    config.writer(:seller) do |c|
+      c.output_dir = api_root.join('../../packages/seller-sdk/src/types/generated')
+      c.reject_class = ->(serializer:) {
+        name = serializer.name.to_s
+        # Everything on the seller branch is in.
+        next false if name.include?('::Seller::')
+        # Nothing from the admin branch, ever.
+        next true if name.include?('::Admin::')
+
+        # A store-level serializer is in only if a seller serializer nests it.
+        bare = name.sub(/\ASpree::Api::V3::/, '').sub(/Serializer\z/, '')
+        !store_nested_for_seller.include?(bare)
+      }
+      c.serializer_name_mapper = ->(serializer) {
+        serializer.name.to_s
+          .sub(/\ASpree::Api::V3::Seller::/, '')
+          .sub(/\ASpree::Api::V3::/, '')
+          .sub(/Serializer\z/, '')
+      }
+    end
   end
 end

data/config/locales/en.yml

@@ -10,9 +10,14 @@ en:
       invalid_taxonomy_id: Invalid taxonomy id.
       must_specify_api_key: You must specify an API key.
       errors:
+        automatic_collection_curation: Products of an automatic collection are managed by its rules and can't be curated manually
         channel_inactive: The channel this API key is bound to is not active.
         channel_mismatch: The requested channel does not match the channel this API key is bound to.
         guest_checkout_not_allowed: You must be signed in to complete checkout.
+        media_not_deleted: "The file could not be deleted. Nothing was changed."
+        media_in_use: "This file is still in use (%{places}). Pass detach=true to remove it everywhere and delete it, or clear those places first."
+        media_url_import_requires_product: Importing media from a URL needs a product to import it into. Upload the file instead, or post it to a product's media.
+        store_mismatch: The requested store does not match the store this API key belongs to.
         storefront_login_required: Authentication required to access this store.
       negative_quantity: quantity is negative
       newsletter_unsubscribe_token_invalid: Newsletter unsubscribe token is invalid or has expired.