spree_api 6.0.0.beta1 → 6.0.0.beta3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd13b5167236c50754b03e48d4e7ab4ff5f1c24cdfd13b5a1ea45ff7a2961dd7
-  data.tar.gz: 77ab648d62775d22902a30ff8dbb4927fd0dab1b93668caad957c99a88bcd1fa
+  metadata.gz: d30acba1d9395e7575f92eefe7c86b5cd8c73eae44cceb1e178a853963e856c4
+  data.tar.gz: 562e93949b2a3e5b124c06896821d26554329f0e332faa8f9de2d35b6d40dc71
 SHA512:
-  metadata.gz: 36a716f02b07837cf6360d19cb914ef28a1de1e5cef02b0d6cb503bcc11d89afa6f00f36bd1613d0e9de6962197af6830c8068d03963ca257ac6f59c7ab2fa95
-  data.tar.gz: 388abb4801575690aa02e55a907a1851a1d88570a55681c60dc870f693a784024ed7d352e8fcedf493666bd2999269822e9d7abb579d13f3b8345ea9bb340ae2
+  metadata.gz: 401bbdc3ddb5eb121c8ad9eac1d5341aa130c0f1f61135e54b14c8eabe577c1845442f28e20e4bf608e35d5dc5f757b25b4b41697dd1010c78ae9f2ede161362
+  data.tar.gz: e27e19331d0e63339aa5bd21586f1f4ed74b095689a3c31252faee126f9d896f3579cef931a6fa66afa5b6e0c001f7759f19838f3a2914de105090f598b4c2ae

data/app/controllers/concerns/spree/api/v3/admin/embed_permissions.rb

@@ -0,0 +1,55 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Keeps records another permission guards out of a response.
+        #
+        # An endpoint is gated on its own resource's key, but expanding an
+        # association pulls in whole records of another kind — a customer's
+        # orders, an order's payments, a gift card's customer. Without this a
+        # role cleared only for customers could read every order through
+        # `?expand=orders`. Each segment of an expand path is checked, so
+        # `orders.payments` needs both keys.
+        #
+        # Gift card codes are bearer credentials that ride along on every
+        # order, so serializers show them in full only to a caller who may read
+        # gift cards and masked to everyone else.
+        module EmbedPermissions
+          extend ActiveSupport::Concern
+
+          # Association name in an expand path => the catalog key it needs.
+          EXPANSION_PERMISSIONS = {
+            'order' => 'read_orders',
+            'orders' => 'read_orders',
+            'payment' => 'read_payments',
+            'payments' => 'read_payments',
+            'payment_splits' => 'read_payments',
+            'customer' => 'read_customers',
+            'customers' => 'read_customers',
+            'gift_card' => 'read_gift_cards',
+            'gift_cards' => 'read_gift_cards',
+            'store_credit' => 'read_store_credits',
+            'store_credits' => 'read_store_credits'
+          }.freeze
+
+          protected
+
+          def expand_list
+            super.select { |path| path.split('.').all? { |segment| expansion_permitted?(segment) } }
+          end
+
+          def serializer_params
+            super.merge(gift_card_codes: holds_permission?('read_gift_cards'))
+          end
+
+          private
+
+          def expansion_permitted?(segment)
+            key = EXPANSION_PERMISSIONS[segment]
+            key.nil? || holds_permission?(key)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/admin/role_grant_guard.rb

@@ -23,13 +23,13 @@ module Spree
           #   flow leaves it off (its gate is `manage Invitation`).
           # @return [Boolean] true if the request was rejected (caller should return)
           def reject_unauthorized_role_grant!(role_ids, require_role_management: false)
-            return false if role_ids.blank?
-
             # The management gate runs whenever a role mutation is attempted —
-            # before resolving ids — so passing unknown ids can't slip the
-            # reconciliation (which would still remove the user's current roles)
-            # past a caller without role-management authority.
+            # before resolving ids, and even for an empty list — so passing
+            # unknown ids, or none at all, can't slip the reconciliation (which
+            # would still remove the user's current roles) past a caller
+            # without role-management authority.
             return true if require_role_management && reject_without_role_management!
+            return false if role_ids.blank?
 
             roles = current_store.roles.where(id: role_ids.map(&:to_s)).to_a
             return false if roles.empty?
@@ -40,6 +40,30 @@ module Spree
             false
           end
 
+          # Removing a role is bounded like granting it: a caller may only take
+          # away authority they could hand out, so a staff member who can
+          # manage staff cannot strip the admin role from the store's owners.
+          # The store also keeps at least one admin, whoever asks.
+          #
+          # @param user [Object] whose roles are being removed
+          # @param roles [Array<Spree::Role>] the store roles being removed
+          # @return [Boolean] true if the request was rejected (caller should return)
+          def reject_unauthorized_role_removal!(user, roles)
+            return false if roles.empty?
+
+            if roles.any?(&:admin?)
+              return deny_role_grant!('You cannot remove the admin role.') unless caller_holds_admin_role?
+              return deny_role_grant!('The store must keep at least one admin.') if last_admin?(user)
+            end
+
+            return false if caller_holds_admin_role?
+
+            beyond_own = roles.reject { |role| excess_permission_keys(role.permissions).empty? }
+            return false if beyond_own.empty?
+
+            deny_role_grant!("You cannot remove roles beyond your own privileges: #{beyond_own.map(&:name).join(', ')}")
+          end
+
           # Rejects granting permission keys beyond the caller's own — used by
           # roles#create/#update on the requested `permissions` array.
           #
@@ -125,6 +149,11 @@ module Spree
               end
           end
 
+          def last_admin?(user)
+            admin_roles = current_store.roles.select(&:admin?)
+            Spree::RoleUser.where(role: admin_roles).where.not(user: user).none?
+          end
+
           def caller_holds_admin_role?
             return current_api_key.has_scope?('write_all') if scope_limited_principal?
 

data/app/controllers/concerns/spree/api/v3/admin/stock_receipt_actions.rb

@@ -50,7 +50,7 @@ module Spree
               received_at: params[:received_at],
               reference: params[:reference],
               notes: params[:notes],
-              received_by: try_spree_current_user
+              received_by: current_actor
             }
           end
 

data/app/controllers/concerns/spree/api/v3/admin_authentication.rb

@@ -15,6 +15,17 @@ module Spree
           Spree::Api::V3::JwtAuthentication::JWT_AUDIENCE_ADMIN
         end
 
+        # A key-authenticated write records the key: it is the thing that gets
+        # named, scoped and revoked, so it is what an order's `canceler` or a
+        # receipt's `received_by` should point at. A JWT request records the
+        # admin. When both credentials are present the JWT user wins here too,
+        # matching how permissions resolve below.
+        #
+        # @return [Object, nil]
+        def current_actor
+          try_spree_current_user || @current_api_key
+        end
+
         # API-key-only requests bypass CanCanCan: the ScopedAuthorization
         # concern is the authoritative gate (read_/write_ scopes per resource).
         # JWT admin users keep CanCanCan abilities; if both credentials are

data/app/controllers/concerns/spree/api/v3/current_password_confirmation.rb

@@ -13,12 +13,20 @@ module Spree
 
         private
 
+        # Runs under the login lockout, so a stolen session cannot use this
+        # check to guess the password: misses count towards the lockout, and a
+        # locked account is refused even with the right password.
+        #
         # @return [Boolean] whether `current_password` matches the signed-in
         #   account. False when the parameter is missing — an absent password
         #   is not a correct one.
         def valid_current_password?
           return false if params[:current_password].blank?
 
+          Spree::Authentication::Lockout.check(current_user) { current_password_matches? } == :valid
+        end
+
+        def current_password_matches?
           if current_user.respond_to?(:valid_password?)
             current_user.valid_password?(params[:current_password])
           elsif current_user.respond_to?(:authenticate)

data/app/controllers/concerns/spree/api/v3/orders/claim_actions.rb

@@ -19,7 +19,7 @@ module Spree
 
           # PATCH .../claims/:id/approve
           def approve
-            run_workflow(Spree.claim_approve_workflow, approver: try_spree_current_user)
+            run_workflow(Spree.claim_approve_workflow, approver: current_actor)
           end
 
           # PATCH .../claims/:id/resolve — a refund, a replacement, or both.
@@ -29,7 +29,7 @@ module Spree
                          refund_method: params[:refund_method] || 'store_credit',
                          amount: params[:amount],
                          replacement_line_item_ids: replacement_line_item_ids,
-                         resolver: try_spree_current_user)
+                         resolver: current_actor)
           end
 
           # PATCH .../claims/:id/deny

data/app/controllers/concerns/spree/api/v3/orders/exchange_actions.rb

@@ -21,14 +21,14 @@ module Spree
 
           # PATCH .../exchanges/:id/approve
           def approve
-            run_workflow(Spree.exchange_approve_workflow, approver: try_spree_current_user)
+            run_workflow(Spree.exchange_approve_workflow, approver: current_actor)
           end
 
           # PATCH .../exchanges/:id/receive
           def receive
             run_workflow(Spree.exchange_receive_workflow,
                          items: items_for_receive,
-                         received_by: try_spree_current_user)
+                         received_by: current_actor)
           end
 
           # PATCH .../exchanges/:id/fulfill — sends the replacement, settling
@@ -36,7 +36,7 @@ module Spree
           def fulfill
             run_workflow(Spree.exchange_fulfill_workflow,
                          refund_method: params[:refund_method] || 'store_credit',
-                         refunder: try_spree_current_user)
+                         refunder: current_actor)
           end
 
           # PATCH .../exchanges/:id/cancel

data/app/controllers/concerns/spree/api/v3/orders/fulfillment_actions.rb

@@ -135,9 +135,22 @@ module Spree
           end
 
           # The attributes handed to the update workflow. The workflow assigns
-          # ids raw, so a branch that must narrow one resolves it here first.
+          # ids raw, so the stock location is resolved first, through the same
+          # lookup create and split use.
           def update_attributes
-            permitted_params.to_h
+            attributes = permitted_params.to_h
+
+            if attributes['stock_location_id'].present?
+              attributes['stock_location_id'] = find_stock_location!(attributes['stock_location_id']).id
+            end
+
+            attributes
+          end
+
+          # A stock location of the current store. A branch that must narrow it
+          # further (by ability, by seller) overrides this.
+          def find_stock_location!(id)
+            current_store.stock_locations.find_by_prefix_id!(id)
           end
 
           # What may be split out of this parcel, and where the split half

data/app/controllers/concerns/spree/api/v3/orders/post_sale_actions.rb

@@ -59,7 +59,7 @@ module Spree
               items: items_for_create,
               reason: reason_for_create,
               memo: create_params[:memo],
-              created_by: try_spree_current_user,
+              created_by: current_actor,
               **arguments
             )
 

data/app/controllers/concerns/spree/api/v3/orders/return_actions.rb

@@ -21,14 +21,14 @@ module Spree
 
           # PATCH .../returns/:id/approve
           def approve
-            run_workflow(Spree.return_approve_workflow, approver: try_spree_current_user)
+            run_workflow(Spree.return_approve_workflow, approver: current_actor)
           end
 
           # PATCH .../returns/:id/receive — what the warehouse actually counted.
           def receive
             run_workflow(Spree.return_receive_workflow,
                          items: items_for_receive,
-                         received_by: try_spree_current_user)
+                         received_by: current_actor)
           end
 
           # PATCH .../returns/:id/refund
@@ -36,7 +36,7 @@ module Spree
             run_workflow(Spree.return_refund_workflow,
                          amount: params[:amount],
                          refund_method: params[:refund_method] || 'original_payment',
-                         refunder: try_spree_current_user)
+                         refunder: current_actor)
           end
 
           # PATCH .../returns/:id/cancel

data/app/controllers/concerns/spree/api/v3/scoped_authorization.rb

@@ -204,6 +204,20 @@ module Spree
         def scope_limited_principal?
           current_api_key.present? && current_user.blank?
         end
+
+        # Whether the caller holds a catalog key beyond the one the action
+        # needs — for data another permission guards riding along in a
+        # response (an expanded association, an embedded record). Mirrors the
+        # key gate's two principals: a secret key carries scopes, a signed-in
+        # staffer carries their roles' catalog keys.
+        def holds_permission?(key)
+          return current_api_key.has_scope?(key) if scope_limited_principal?
+
+          ability = current_ability
+          return true unless ability.respond_to?(:permission_keys)
+
+          ability.permission_keys.include?(key.to_s)
+        end
       end
     end
   end

data/app/controllers/concerns/spree/api/v3/store/storefront_products.rb

@@ -0,0 +1,35 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # The products a storefront buyer may see: available now (or on
+        # pre-order) in the current currency, narrowed to the catalogs their
+        # company, customer group or channel resolve to. The product listing
+        # reads through it, and so does anything else that accepts a product
+        # or variant from the buyer, so an id cannot reach what the listing
+        # would never show.
+        module StorefrontProducts
+          extend ActiveSupport::Concern
+
+          private
+
+          # @param base [ActiveRecord::Relation] products to narrow; the store's by default
+          # @return [ActiveRecord::Relation<Spree::Product>]
+          def storefront_products(base = current_store.products)
+            Spree.products_for_context_service.call(
+              store: current_store,
+              channel: current_channel,
+              customer: current_user,
+              base: base.available(Time.current, Spree::Current.currency, include_preorderable: true)
+            ).value
+          end
+
+          # @return [ActiveRecord::Relation<Spree::Variant>]
+          def storefront_variants
+            Spree::Variant.where(product_id: storefront_products.reorder(nil).select(Spree::Product.arel_table[:id]))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/admin_users_controller.rb

@@ -24,6 +24,8 @@ module Spree
           # the account globally. The user keeps access to any other stores.
           def destroy
             authorize!(:destroy, @resource)
+            return if reject_unauthorized_role_removal!(@resource, @resource.spree_roles.for_resource(current_store).to_a)
+
             @resource.role_users.where(role: current_store.roles).destroy_all
             head :no_content
           end
@@ -42,6 +44,7 @@ module Spree
             # RoleManagement permission set, not by profile-edit rights.
             role_ids = role_ids_param if params.key?(:role_ids)
             return if role_ids && reject_unauthorized_role_grant!(role_ids, require_role_management: true)
+            return if role_ids && reject_unauthorized_role_removal!(@resource, removed_roles(role_ids))
 
             if @resource.update(identity_params)
               apply_role_ids(role_ids) if role_ids
@@ -89,6 +92,12 @@ module Spree
             ids.map { |id| Spree::PrefixedId.prefixed_id?(id) ? Spree::PrefixedId.decode_prefixed_id(id) : id }.compact
           end
 
+          # The store roles the user holds that `desired_role_ids` leaves out.
+          def removed_roles(desired_role_ids)
+            target = desired_role_ids.map(&:to_s)
+            @resource.spree_roles.for_resource(current_store).reject { |role| target.include?(role.id.to_s) }
+          end
+
           # Reconcile the user's roles on this store to match `desired_role_ids`.
           # Adds missing assignments and removes extras — no-op for unchanged.
           def apply_role_ids(desired_role_ids)

data/app/controllers/spree/api/v3/admin/api_keys_controller.rb

@@ -47,7 +47,7 @@ module Spree
             @resource = find_resource
             authorize!(:update, @resource)
 
-            @resource.revoke!(try_spree_current_user)
+            @resource.revoke!(current_actor)
             render json: serialize_resource(@resource)
           end
 
@@ -90,7 +90,7 @@ module Spree
           # happens in `before_validation :generate_token` on the model.
           def build_resource
             scope.new(permitted_params).tap do |key|
-              key.created_by = try_spree_current_user
+              key.created_by = current_actor
             end
           end
 

data/app/controllers/spree/api/v3/admin/base_controller.rb

@@ -13,6 +13,7 @@ module Spree
 
           include Spree::Api::V3::ScopedAuthorization
           include Spree::Api::V3::Admin::ValidationDetails
+          include Spree::Api::V3::Admin::EmbedPermissions
         end
       end
     end

data/app/controllers/spree/api/v3/admin/custom_fields_controller.rb

@@ -109,17 +109,22 @@ module Spree
             end.merge('customer' => Spree.customer_class.name, 'category' => 'Spree::Category')
           end
 
-          # Returns the first segment whose `<segment>_id` is present in params,
+          # Returns the first segment whose `<segment>_id` is in the route,
           # paired with its class and the raw id value, or nil. Memoized — read
           # by both `set_parent` and `scoped_resource_name`.
+          #
+          # Read from the path only: a `store_id` or `refund_id` added to the
+          # query string or body must not switch the parent to a type that is
+          # never routed here and has no store scope to narrow it.
           def parent_lookup
             return @parent_lookup if defined?(@parent_lookup)
 
-            match = parent_route_map.find { |segment, _| params[:"#{segment}_id"].present? }
+            route_params = request.path_parameters
+            match = parent_route_map.find { |segment, _| route_params[:"#{segment}_id"].present? }
             @parent_lookup =
               if match
                 segment, klass_name = match
-                ParentLookup.new(klass_name.constantize, params[:"#{segment}_id"], segment)
+                ParentLookup.new(klass_name.constantize, route_params[:"#{segment}_id"], segment)
               end
           end
         end

data/app/controllers/spree/api/v3/admin/customers_controller.rb

@@ -223,20 +223,6 @@ module Spree
             false
           end
 
-          # Mirrors the key gate's two principals: a secret key carries scopes,
-          # a signed-in staffer carries their roles' catalog keys.
-          #
-          # @param key [String]
-          # @return [Boolean]
-          def holds_permission?(key)
-            return current_api_key.has_scope?(key) if scope_limited_principal?
-
-            ability = current_ability
-            return true unless ability.respond_to?(:permission_keys)
-
-            ability.permission_keys.include?(key)
-          end
-
           # `export` maps to `:show`; `anonymize` is a destructive write, so it
           # maps to `:destroy` rather than `:update` — a role that may correct
           # a customer's name should not thereby be able to erase their history.

data/app/controllers/spree/api/v3/admin/gift_cards_controller.rb

@@ -13,6 +13,8 @@ module Spree
         class GiftCardsController < ResourceController
           scoped_resource :gift_cards
 
+          before_action :resolve_customer, only: [:create, :update]
+
           protected
 
           def model_class
@@ -24,8 +26,33 @@ module Spree
           end
 
           def permitted_params
-            params.permit(*model_additional_permitted_attributes, :code, :amount, :expires_at,
-                          :customer_id, :currency)
+            params.permit(*model_additional_permitted_attributes, :code, :amount, :expires_at, :currency).tap do |attributes|
+              attributes[:customer] = @customer if params.key?(:customer_id)
+            end
+          end
+
+          private
+
+          # Assigning a customer embeds their record in the response, so it is
+          # a read of customers: the caller must hold that permission, and the
+          # customer is resolved through their ability — never a raw id the
+          # model would look up across every customer.
+          def resolve_customer
+            return unless params.key?(:customer_id)
+            return @customer = nil if params[:customer_id].blank?
+
+            unless holds_permission?('read_customers')
+              return render_error(
+                code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
+                message: 'Missing permission: read_customers',
+                status: :forbidden,
+                details: { required_permission: 'read_customers' }
+              )
+            end
+
+            @customer = Spree.customer_class.
+                        accessible_by(current_ability, :show).
+                        find_by_prefix_id!(params[:customer_id])
           end
         end
       end

data/app/controllers/spree/api/v3/admin/invitation_acceptances_controller.rb

@@ -72,7 +72,10 @@ module Spree
           end
 
           def authenticate_existing(user)
-            return user if user.valid_password?(params[:password].to_s)
+            # Under the login lockout: otherwise this is an unthrottled way to
+            # guess an existing account's password with an invitation token.
+            verdict = Spree::Authentication::Lockout.check(user) { user.valid_password?(params[:password].to_s) }
+            return user if verdict == :valid
 
             render_error(
               code: ERROR_CODES[:authentication_failed],

data/app/controllers/spree/api/v3/admin/invitations/acceptance_links_controller.rb

@@ -0,0 +1,41 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module Invitations
+          # The acceptance link of a pending staff invitation.
+          #
+          # The link carries the token that creates the account and grants the
+          # role, so it is authorized like sending the invitation: the caller
+          # needs write access to staff and must be allowed to grant the
+          # invitation's role. Reading staff is not enough.
+          class AcceptanceLinksController < Admin::BaseController
+            include Spree::Api::V3::Admin::RoleGrantGuard
+
+            scoped_resource :staff
+
+            # GET /api/v3/admin/invitations/:invitation_id/acceptance_link
+            def show
+              invitation = Spree::Invitation.
+                           where(resource: current_store).
+                           pending.
+                           find_by_prefix_id!(params[:invitation_id])
+              authorize!(:update, invitation)
+              return if reject_unauthorized_role_grant!([invitation.role_id])
+
+              render json: Spree.api.admin_invitation_acceptance_link_serializer.new(
+                invitation, params: { store: current_store }
+              ).to_h
+            end
+
+            protected
+
+            def read_actions
+              []
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/me_controller.rb

@@ -58,6 +58,17 @@ module Spree
             )
           end
 
+          # /me describes the signed-in user rather than a store, and the
+          # dashboard reads it before any store is selected. A user who holds
+          # no role on any store (not yet given one, or removed from all of
+          # them) must still reach it, or they cannot finish signing in. A
+          # request that names a store keeps the membership check.
+          def require_store_membership!
+            return true if store_id_header.nil?
+
+            super
+          end
+
           def permitted_params
             params.permit(:selected_locale, :first_name, :last_name, :avatar)
           end

data/app/controllers/spree/api/v3/admin/orders/claims_controller.rb

@@ -18,7 +18,7 @@ module Spree
             #
             # Editable fields only — status moves through the member actions.
             def update
-              if @resource.update(permitted_params)
+              if @resource.update(update_attributes)
                 render json: serialize_resource(@resource.reload)
               else
                 render_validation_error(@resource.errors)
@@ -41,6 +41,19 @@ module Spree
 
             private
 
+            # The reason is resolved through the store rather than assigned
+            # raw, so another store's reads as missing.
+            def update_attributes
+              attributes = permitted_params.to_h.except('reason_id')
+
+              if params.key?(:reason_id)
+                attributes['reason'] =
+                  (current_store.claim_reasons.find_by_prefix_id!(params[:reason_id]) if params[:reason_id].present?)
+              end
+
+              attributes
+            end
+
             # The whole store's catalogue: an operator may promise anything
             # the store sells as a replacement.
             def replacement_variant_for(variant_id)

data/app/controllers/spree/api/v3/admin/orders/exchanges_controller.rb

@@ -19,7 +19,7 @@ module Spree
             #
             # Editable fields only — status moves through the member actions.
             def update
-              if @resource.update(permitted_params)
+              if @resource.update(update_attributes)
                 render json: serialize_resource(@resource.reload)
               else
                 render_validation_error(@resource.errors)
@@ -42,6 +42,27 @@ module Spree
 
             private
 
+            # The ids are resolved through the store rather than assigned raw,
+            # so another store's reason or warehouse reads as missing.
+            def update_attributes
+              attributes = permitted_params.to_h.except('reason_id', 'stock_location_id')
+
+              if params.key?(:reason_id)
+                attributes['reason'] =
+                  (current_store.return_reasons.find_by_prefix_id!(params[:reason_id]) if params[:reason_id].present?)
+              end
+
+              if params.key?(:stock_location_id)
+                attributes['stock_location'] =
+                  if params[:stock_location_id].present?
+                    current_store.stock_locations.accessible_by(current_ability, :show).
+                      find_by_prefix_id!(params[:stock_location_id])
+                  end
+              end
+
+              attributes
+            end
+
             # The whole store's catalogue, and any warehouse the caller may
             # see: an operator exchanges into anything the store sells.
             def replacement_variant_for(variant_id)

data/app/controllers/spree/api/v3/admin/orders/fulfillments_controller.rb

@@ -113,7 +113,7 @@ module Spree
             end
 
             def find_stock_location!(id)
-              Spree::StockLocation.accessible_by(current_ability, :show).find_by_prefix_id!(id)
+              current_store.stock_locations.accessible_by(current_ability, :show).find_by_prefix_id!(id)
             end
 
             def stock_location_for_create