spree_api 5.6.1 → 6.0.0.beta2

data/app/controllers/spree/api/v3/admin/auth_controller.rb

@@ -4,13 +4,28 @@ module Spree
       module Admin
         class AuthController < Admin::BaseController
           include Spree::Api::V3::Admin::AuthCookies
+          include Spree::Api::V3::AuthenticationStrategies
 
           skip_scope_check!
 
-          rate_limit to: Spree::Api::Config[:rate_limit_login], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :create, with: RATE_LIMIT_RESPONSE
-          rate_limit to: Spree::Api::Config[:rate_limit_refresh], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :refresh, with: RATE_LIMIT_RESPONSE
-
-          skip_before_action :authenticate_admin!, only: [:create, :refresh, :logout]
+          # The SSO callback answers a browser navigation, so a throttled request
+          # must return the person to the login page rather than a JSON body they
+          # cannot act on. It also gets its own bucket: completing a sign-in must
+          # not be refused because the login form was submitted a few times.
+          RATE_LIMITED_CALLBACK_RESPONSE = -> { redirect_to_dashboard(error: 'rate_limit_exceeded') }
+
+          # Each declaration carries a distinct `name:` — without one, Rails
+          # keys every counter in this controller on the same
+          # (controller, client) cache entry, silently merging the budgets.
+          # The login page fetches providers on every load, so sharing the
+          # login budget would let ordinary page views — or an attacker
+          # hitting providers alone — lock staff out of signing in.
+          rate_limit to: Spree::Api::Config[:rate_limit_login], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :create, name: 'login', with: -> { render_rate_limited(limit: Spree::Api::Config[:rate_limit_login]) }
+          rate_limit to: Spree::Api::Config[:rate_limit_refresh], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :providers, name: 'providers', with: -> { render_rate_limited(limit: Spree::Api::Config[:rate_limit_refresh]) }
+          rate_limit to: Spree::Api::Config[:rate_limit_login], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :callback, name: 'callback', with: RATE_LIMITED_CALLBACK_RESPONSE
+          rate_limit to: Spree::Api::Config[:rate_limit_refresh], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: [:refresh, :logout], name: 'refresh', with: -> { render_rate_limited(limit: Spree::Api::Config[:rate_limit_refresh]) }
+
+          skip_before_action :authenticate_admin!, only: [:create, :refresh, :logout, :providers, :callback]
 
           # POST /api/v3/admin/auth/login
           def create
@@ -21,7 +36,7 @@ module Spree
 
             if result.success?
               user = result.value
-              refresh_token = Spree::RefreshToken.create_for(user, request_env: request_env_for_token)
+              refresh_token = Spree::RefreshToken.create_for(user, audience: JWT_AUDIENCE_ADMIN, request_env: request_env_for_token)
               set_refresh_cookie(refresh_token)
               render json: auth_response(user)
             else
@@ -33,6 +48,51 @@ module Spree
             end
           end
 
+          # GET /api/v3/admin/auth/providers
+          #
+          # Lists the registered authentication providers so the dashboard login
+          # page can render itself: the password form when :email is registered,
+          # a button per redirect provider. Unauthenticated — it is read before
+          # anyone can log in — so it exposes only provider keys, kinds, labels
+          # and authorization URLs.
+          def providers
+            described = Spree.admin_authentication_strategies.describe { |key| issue_oauth_state(key) }
+
+            render json: { providers: described }
+          end
+
+          # GET /api/v3/admin/auth/callback/:provider
+          #
+          # Completes a redirect (SSO) login.
+          #
+          # Reached by a full-page browser redirect from the identity provider, so
+          # it answers with a redirect rather than JSON — the browser must land on
+          # the dashboard, not on a response body. Success sets the same
+          # refresh-token cookie the password flow issues and the SPA mints its
+          # access token from it on load, so no token ever travels in a URL.
+          def callback
+            return redirect_to_dashboard(error: ERROR_CODES[:invalid_oauth_state]) unless valid_oauth_state?
+
+            strategy = Spree.admin_authentication_strategies.build(
+              params[:provider],
+              params: params,
+              request_env: request.headers.env,
+              user_class: Spree.admin_user_class
+            )
+            return redirect_to_dashboard(error: ERROR_CODES[:invalid_provider]) if strategy.nil?
+
+            result = strategy.callback
+
+            unless result.success?
+              return redirect_to_dashboard(error: callback_error_code(strategy))
+            end
+
+            set_refresh_cookie(
+              Spree::RefreshToken.create_for(result.value, audience: JWT_AUDIENCE_ADMIN, request_env: request_env_for_token)
+            )
+            redirect_to_dashboard
+          end
+
           # POST /api/v3/admin/auth/refresh
           def refresh
             refresh_token_value = refresh_token_from_cookie
@@ -45,7 +105,9 @@ module Spree
               )
             end
 
-            refresh_token = Spree::RefreshToken.active.find_by(token: refresh_token_value)
+            # Narrowed by audience: a token minted on another surface must not
+            # be exchangeable for an admin access token here.
+            refresh_token = Spree::RefreshToken.active.for_audience(JWT_AUDIENCE_ADMIN).find_by(token: refresh_token_value)
 
             if refresh_token.nil?
               clear_refresh_cookie
@@ -66,7 +128,11 @@ module Spree
           # POST /api/v3/admin/auth/logout
           def logout
             refresh_token_value = refresh_token_from_cookie
-            Spree::RefreshToken.active.find_by(token: refresh_token_value)&.destroy if refresh_token_value.present?
+            if refresh_token_value.present?
+              # No `active` scope — revoking an already-expired token should
+              # still delete the row rather than leave it for the sweeper.
+              Spree::RefreshToken.for_audience(JWT_AUDIENCE_ADMIN).find_by(token: refresh_token_value)&.destroy
+            end
 
             clear_refresh_cookie
             head :no_content
@@ -74,26 +140,76 @@ module Spree
 
           private
 
-          def authentication_strategy
-            provider = params[:provider].presence || 'email'
-            strategy_class = Spree.admin_authentication_strategies[provider]
+          # The callback answers a browser navigation, so even the API-wide
+          # throttle must return the person to the login page — a JSON 429
+          # would strand them on a raw error body.
+          def render_rate_limited(**)
+            return redirect_to_dashboard(error: 'rate_limit_exceeded') if action_name == 'callback'
 
-            unless strategy_class
-              render_error(
-                code: ERROR_CODES[:invalid_provider],
-                message: "Unsupported authentication provider: #{provider}",
-                status: :bad_request
-              )
-              return nil
-            end
+            super
+          end
 
-            strategy_class.new(
-              params: params,
-              request_env: request.headers.env,
-              user_class: Spree.admin_user_class
+          OAUTH_STATE_PURPOSE = 'spree/admin/oauth_state'.freeze
+          OAUTH_STATE_EXPIRY = 15.minutes
+
+          # Signed, self-expiring CSRF token handed to the identity provider and
+          # echoed back to the callback. Signing it means no server-side session
+          # storage — the token proves the redirect started here, and a forged or
+          # expired value fails verification.
+          #
+          # The provider key is signed into the payload so a state minted for one
+          # provider cannot be replayed against another's callback.
+          def issue_oauth_state(provider)
+            Rails.application.message_verifier(OAUTH_STATE_PURPOSE).generate(
+              { provider: provider.to_s, nonce: SecureRandom.hex(16) },
+              expires_in: OAUTH_STATE_EXPIRY
             )
           end
 
+          def valid_oauth_state?
+            state = params[:state]
+            return false if state.blank?
+
+            # The verifier round-trips through JSON, so payload keys come back as strings.
+            payload = Rails.application.message_verifier(OAUTH_STATE_PURPOSE).verified(state)
+            return false unless payload.is_a?(Hash)
+
+            payload['provider'].to_s == params[:provider].to_s
+          end
+
+          # Sends the browser back to the dashboard. On failure the login page
+          # reads +?error=+ and explains what happened; on success it has the
+          # refresh cookie and completes sign-in through its normal boot refresh.
+          def redirect_to_dashboard(error: nil)
+            target = dashboard_url
+            target = "#{target}/login?error=#{error}" if error.present?
+
+            redirect_to target, allow_other_host: true
+          end
+
+          # Where the React dashboard is hosted.
+          def dashboard_url
+            Spree::Stores::DashboardUrl.call(store: current_store)
+          end
+
+          # A technical SSO failure (missing code, token verification) must not be
+          # reported as "ask an administrator for an invitation".
+          def callback_error_code(strategy)
+            if strategy.respond_to?(:account_not_provisioned?) && strategy.account_not_provisioned?
+              ERROR_CODES[:account_not_provisioned]
+            else
+              ERROR_CODES[:authentication_failed]
+            end
+          end
+
+          def authentication_strategies
+            Spree.admin_authentication_strategies
+          end
+
+          def authentication_user_class
+            Spree.admin_user_class
+          end
+
           def serializer_params
             {
               store: current_store,

data/app/controllers/spree/api/v3/admin/base_controller.rb

@@ -3,6 +3,7 @@ module Spree
     module V3
       module Admin
         class BaseController < Spree::Api::V3::BaseController
+          include Spree::Api::V3::Admin::StoreContext
           include Spree::Api::V3::AdminAuthentication
 
           # Must be registered before ScopedAuthorization so authenticate_admin!
@@ -11,6 +12,7 @@ module Spree
           before_action :authenticate_admin!
 
           include Spree::Api::V3::ScopedAuthorization
+          include Spree::Api::V3::Admin::ValidationDetails
         end
       end
     end

data/app/controllers/spree/api/v3/admin/catalog_assignments_controller.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Withdrawing a catalog from an audience, addressed by assignment id.
+        class CatalogAssignmentsController < ResourceController
+          scoped_resource :products
+
+          protected
+
+          def model_class
+            Spree::CatalogAssignment
+          end
+
+          def serializer_class
+            Spree.api.admin_catalog_assignment_serializer
+          end
+
+          def scope
+            Spree::CatalogAssignment.where(catalog_id: current_store.catalogs.select(:id)).
+              accessible_by(current_ability, ability_action_for_request)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/catalogs/base_controller.rb

@@ -0,0 +1,29 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module Catalogs
+          # Anything nested under a catalog. The parent resolves through the
+          # store, so a catalog belonging to another tenant is a 404 rather
+          # than a readable record.
+          class BaseController < ResourceController
+            scoped_resource :products
+
+            protected
+
+            def set_parent
+              @parent = current_store.catalogs.
+                        accessible_by(current_ability, parent_ability_action).
+                        find_by_prefix_id!(params[:catalog_id])
+              @catalog = @parent
+            end
+
+            def authorize_parent_access!
+              authorize_parent!(@parent)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/catalogs/order_minimums_controller.rb

@@ -0,0 +1,40 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module Catalogs
+          # The least a whole order must come to under a catalog's agreement.
+          # One row per currency — never one amount with a currency beside
+          # it, because Spree holds no exchange rates.
+          class OrderMinimumsController < BaseController
+            before_action :authorize_parent_access!
+
+
+            protected
+
+            def model_class
+              Spree::CatalogOrderMinimum
+            end
+
+            def serializer_class
+              Spree.api.admin_catalog_order_minimum_serializer
+            end
+
+            def scope
+              @parent.order_minimums
+            end
+
+            def parent_association
+              :order_minimums
+            end
+
+            def permitted_params
+              params.permit(:currency, :amount)
+            end
+
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/catalogs/products_controller.rb

@@ -0,0 +1,107 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module Catalogs
+          # The products curated into a catalog's assortment — the uniform
+          # nested membership surface (see
+          # Spree::Api::V3::Admin::ProductMembership). A catalog decides what
+          # a buyer sees, never the order they see it in, so membership
+          # carries no position and listing is ordered by name.
+          class ProductsController < BaseController
+            include Spree::Api::V3::Admin::ProductMembership
+
+            before_action :authorize_parent_access!
+
+            protected
+
+            def serializer_class
+              Spree.api.admin_catalog_product_serializer
+            end
+
+            # The resolver rides along in the serializer params, preloaded
+            # with this page's variants: resolving row by row would be a query
+            # per product, and the answer is the same for every row on the
+            # page.
+            # `expanded_keys` is the same dot-notation matching the serializer's
+            # own `expand?` does, so the attribute never renders without the
+            # resolver that fills it.
+            def serializer_params
+              params = super
+              params = params.merge(catalog_price_resolver: catalog_price_resolver) if expanded_keys.include?('catalog_price')
+              params = params.merge(catalog_quantity_rules: quantity_rules_by_product) if expanded_keys.include?('quantity_rule')
+              params
+            end
+
+            # The page's quantity rules in one query, keyed by product. The
+            # rows are stored per variant and read per product, which is the
+            # roll-up the serializer does — on variants this page has already
+            # loaded (docs/plans/6.0-volume-pricing.md).
+            def quantity_rules_by_product
+              @quantity_rules_by_product ||= begin
+                variant_ids = priced_variants.map(&:id)
+                rules = variant_ids.any? ? @catalog.quantity_rules.where(variant_id: variant_ids).to_a : []
+                product_by_variant = priced_variants.to_h { |variant| [variant.id, variant.product_id] }
+
+                rules.group_by { |rule| product_by_variant[rule.variant_id] }
+              end
+            end
+
+            # Preloaded with every variant the page renders — each row now
+            # prices its variants individually, so preloading only the buy-box
+            # winner would leave the rest falling through to a query apiece
+            # (docs/plans/6.0-volume-pricing.md).
+            def catalog_price_resolver
+              @catalog_price_resolver ||=
+                Spree::Catalogs::ResolvePrices.new(catalog: @catalog, currency: current_currency).
+                tap { |resolver| resolver.preload(priced_variants) }
+            end
+
+            def priced_variants
+              Array(@collection).flat_map { |product| product.variants.to_a }
+            end
+
+            # Only what this page reads: the card's thumbnail, and every
+            # variant with the rows and option values the resolver and the
+            # variant rows need. `default_variant` is deliberately absent —
+            # it is a separate `belongs_to` with a cache of its own, so
+            # reading it here would re-query option values per row. Publications, stock levels and the default
+            # variant's own prices are deliberately absent — this endpoint
+            # serializes the membership shape, not a full admin product
+            # (docs/plans/6.0-volume-pricing.md).
+            def collection_includes
+              [
+                :primary_media,
+                { variants: [:prices, { option_values: :option_type }] }
+              ]
+            end
+
+            def scope
+              product_scope.
+                joins(:catalog_products).
+                where(Spree::CatalogProduct.table_name => { catalog_id: @catalog.id }).
+                order(:name)
+            end
+
+            # A product is curated at most once per catalog (unique
+            # [catalog_id, product_id]), so the join can't duplicate rows and
+            # DISTINCT is unnecessary.
+            def collection_distinct?
+              false
+            end
+
+            def add_member_products(products)
+              @catalog.add_products(products.map(&:id))
+            end
+
+            # Through the model, so an owned price list drops the rows it
+            # held for these products along with them.
+            def remove_member_products(products)
+              @catalog.remove_products(products.map(&:id))
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/catalogs/quantity_rules_controller.rb

@@ -0,0 +1,75 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module Catalogs
+          # A catalog's quantity terms — the narrowest of the three levels a
+          # buyer's rules resolve through. The catalog-wide default is a pair
+          # of fields on the catalog itself, so this surface is strictly the
+          # overrides.
+          #
+          # Rows are stored per variant and written as a whole set, because
+          # that is the grain a merchant states them at ("minimum 48 of this
+          # product") and the dashboard stages every edit behind the catalog's
+          # Save — a partial application would leave an agreement half-changed.
+          #
+          # There is no read action: the rules are read back on the assortment
+          # rows (`expand=quantity_rule` on this catalog's products), which
+          # already hold the variants they roll up
+          # (docs/plans/6.0-volume-pricing.md).
+          class QuantityRulesController < BaseController
+            before_action :authorize_parent_access!
+
+            # PUT /api/v3/admin/catalogs/:catalog_id/quantity_rules
+            #
+            # { terms: { "prod_abc": { minimum_order_quantity: 48,
+            #                          order_multiple: 24 } } }
+            #
+            # A product whose pair is both null has its terms cleared.
+            def upsert
+              authorize! :update, @catalog
+
+              result = Spree::Catalogs::SetProductTerms.call(catalog: @catalog, terms: resolved_terms)
+
+              if result.success?
+                head :no_content
+              else
+                render_service_error(result)
+              end
+            end
+
+            protected
+
+            def model_class
+              Spree::CatalogQuantityRule
+            end
+
+            def serializer_class
+              Spree.api.admin_catalog_quantity_rule_serializer
+            end
+
+            def scope
+              @catalog.quantity_rules
+            end
+
+            def parent_association
+              :quantity_rules
+            end
+
+            private
+
+            # Products resolve through this store, so an id belonging to
+            # another tenant is a 404 rather than a term written against a
+            # product the merchant does not sell.
+            def resolved_terms
+              params.require(:terms).to_unsafe_h.to_h do |product_id, values|
+                product = current_store.products.find_by_prefix_id!(product_id)
+                [product, values.to_h.symbolize_keys.slice(:minimum_order_quantity, :order_multiple)]
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end