spree_api 6.0.0.beta1 → 6.0.0.beta3

data/app/controllers/spree/api/v3/admin/orders/refunds_controller.rb

@@ -26,7 +26,7 @@ module Spree
                 payment: payment,
                 amount: params[:amount],
                 reason: reason,
-                refunder: try_spree_current_user,
+                refunder: current_actor,
                 # Names which order is being refunded. Only matters when the
                 # payment is shared by a split checkout, where it covers several
                 # and the payment cannot say which one this is for.

data/app/controllers/spree/api/v3/admin/orders/returns_controller.rb

@@ -25,7 +25,7 @@ module Spree
             #
             # Editable fields only — status moves through the member actions.
             def update
-              if @resource.update(permitted_params)
+              if @resource.update(update_attributes)
                 render json: serialize_resource(@resource.reload)
               else
                 render_validation_error(@resource.errors)
@@ -55,6 +55,27 @@ module Spree
 
             private
 
+            # The ids are resolved through the store rather than assigned raw,
+            # so another store's reason or warehouse reads as missing.
+            def update_attributes
+              attributes = permitted_params.to_h.except('reason_id', 'stock_location_id')
+
+              if params.key?(:reason_id)
+                attributes['reason'] =
+                  (current_store.return_reasons.find_by_prefix_id!(params[:reason_id]) if params[:reason_id].present?)
+              end
+
+              if params.key?(:stock_location_id)
+                attributes['stock_location'] =
+                  if params[:stock_location_id].present?
+                    current_store.stock_locations.accessible_by(current_ability, :show).
+                      find_by_prefix_id!(params[:stock_location_id])
+                  end
+              end
+
+              attributes
+            end
+
             # Any of the store's warehouses the caller may see.
             def stock_location_for_create
               return nil if create_params[:stock_location_id].blank?

data/app/controllers/spree/api/v3/admin/orders_controller.rb

@@ -23,7 +23,7 @@ module Spree
             result = Spree.order_create_service.call(
               store: current_store,
               customer: resolve_customer,
-              created_by: try_spree_current_user,
+              created_by: current_actor,
               params: order_create_params
             )
 
@@ -52,6 +52,10 @@ module Spree
           end
 
           # PATCH /api/v3/admin/orders/:id/complete
+          #
+          # An order holding several sellers' goods divides into one order per
+          # seller, so the group is what comes back — the orders it produced
+          # are nested inside it.
           def complete
             with_order_lock do
               result = Spree.order_complete_service.call(
@@ -61,7 +65,7 @@ module Spree
               )
 
               if result.success?
-                render json: serialize_resource(@resource.reload)
+                render json: serialize_completion(result.value)
               else
                 render_service_error(@resource.errors.presence || result.error, code: ERROR_CODES[:order_cannot_complete])
               end
@@ -73,7 +77,7 @@ module Spree
             with_order_lock do
               result = Spree.order_cancel_workflow.call(
                 order: @resource,
-                canceler: try_spree_current_user,
+                canceler: current_actor,
                 reason: cancel_reason,
                 note: params[:cancel_note].presence,
                 refund_payments: params[:refund_payments].to_b,
@@ -92,7 +96,7 @@ module Spree
           # PATCH /api/v3/admin/orders/:id/approve
           def approve
             with_order_lock do
-              @resource.approved_by(try_spree_current_user)
+              @resource.approved_by(current_actor)
               render json: serialize_resource(@resource.reload)
             end
           end
@@ -149,12 +153,36 @@ module Spree
             Spree.api.admin_order_serializer
           end
 
+          # Completion answers with whatever it produced: one order, or the
+          # group a multi-seller order divided into.
+          #
+          # The group is rendered whole rather than through `filter_fields`: a
+          # `fields` list names an order's attributes, and narrowing a group by
+          # it can drop the very keys that say it is one.
+          def serialize_completion(record)
+            return serialize_resource(record.reload) unless record.is_a?(Spree::OrderGroup)
+
+            Spree.api.admin_order_group_serializer.new(completed_group(record), params: serializer_params).to_h
+          end
+
+          # Every child is rendered in full, so its associations are loaded once
+          # here rather than per order.
+          def completed_group(group)
+            Spree::OrderGroup.includes(
+              :customer, :ship_address, :bill_address,
+              { payments: %i[payment_method source] },
+              { orders: [:seller, :market, :gift_card, :customer, { line_items: { variant: :prices } }] }
+            ).find(group.id)
+          end
+
           # Override scope — Order uses SingleStoreResource (for_store).
-          # Variant prices are preloaded here rather than via scope_includes,
-          # which this override bypasses; the serializer reads them per row.
+          # Variant prices and each line's price list are named here rather
+          # than via scope_includes, which this override bypasses; the
+          # serializer reads both per row.
           def scope
             base = current_store.orders.accessible_by(current_ability, :show).
-                   includes(line_items: { variant: :prices }).preload_associations_lazily
+                   includes(line_items: [{ variant: :prices }, { price_list: :catalog }]).
+                   preload_associations_lazily
 
             # Transient completion drafts (status draft + cart_id set) belong
             # to in-flight checkouts, never to the admin. Admin drafts are the
@@ -190,7 +218,10 @@ module Spree
           # only its id is reported and that comes off the order's own column.
           # Variant prices ride along because the admin line-item serializer
           # reads the base catalog price for every row (the negotiated-price
-          # comparison); without it each line costs its own price query.
+          # comparison); without it each line costs its own price query. Each
+          # line's price list and its catalog are named for the same reason —
+          # stated rather than left to ar_lazy_preload, which happens to cover
+          # them today.
           def collection_includes
             # `market` is the withdrawal deadline's other input. Fulfillments
             # are loaded with their selected rate because the freight summary
@@ -198,7 +229,8 @@ module Spree
             # fulfillment for a field that is nil on every parcel order.
             [:customer, :channel, :seller, :external_references, :cancel_reason,
              :market, { fulfillments: :selected_delivery_rate },
-             { line_items: { variant: :prices } }, { po_document_attachment: :blob }]
+             { line_items: [{ variant: :prices }, { price_list: :catalog }] },
+             { po_document_attachment: :blob }]
           end
 
           # Read through the store's own vocabulary, so a reason belonging to

data/app/controllers/spree/api/v3/admin/password_resets_controller.rb

@@ -17,20 +17,10 @@ module Spree
 
           # POST /api/v3/admin/password_resets
           def create
-            redirect_url = params[:redirect_url]
-
-            # Validate redirect_url against allowed origins (secure by default).
-            # If no allowed origins are configured, redirect_url is silently ignored
-            # to prevent open redirect / token exfiltration attacks.
-            if redirect_url.present?
-              unless current_store.allowed_origins.exists? && current_store.allowed_origin?(redirect_url)
-                redirect_url = nil
-              end
-            end
-
             user = Spree.admin_user_class.find_by(email: params[:email])
 
             if user
+              redirect_url = trusted_redirect_url(user)
               token = user.generate_token_for(:password_reset)
               event_payload = { reset_token: token, email: user.email, store_id: current_store.prefixed_id }
               event_payload[:redirect_url] = redirect_url if redirect_url.present?
@@ -71,6 +61,36 @@ module Spree
 
           private
 
+          # The emailed link carries the reset token, so it may only point at
+          # the dashboard — never at a storefront origin, which anyone who can
+          # edit a store's allowed origins could add — and only when the
+          # account belongs to the store the request names. Anything else is
+          # ignored and the email links to the dashboard's own reset page.
+          #
+          # @return [String, nil]
+          def trusted_redirect_url(user)
+            redirect_url = params[:redirect_url].presence
+            return if redirect_url.blank?
+            return unless same_origin?(redirect_url, Spree::Stores::DashboardUrl.call(store: current_store))
+            return unless staff_of_current_store?(user)
+
+            redirect_url
+          end
+
+          def same_origin?(url, other)
+            first = URI.parse(url.to_s)
+            second = URI.parse(other.to_s)
+            first.host.present? && [first.scheme, first.host, first.port] == [second.scheme, second.host, second.port]
+          rescue URI::InvalidURIError
+            false
+          end
+
+          def staff_of_current_store?(user)
+            return false unless user.respond_to?(:spree_roles)
+
+            user.spree_roles.for_resource(current_store).exists?
+          end
+
           def auth_response(user)
             {
               token: generate_jwt(user, audience: JWT_AUDIENCE_ADMIN),

data/app/controllers/spree/api/v3/admin/price_lists_controller.rb

@@ -122,7 +122,7 @@ module Spree
           end
 
           def permitted_params
-            attrs = normalize_params(
+            normalize_params(
               params.permit(
                 :name, :description, :position,
                 :starts_at, :ends_at, :match_policy,
@@ -132,24 +132,6 @@ module Spree
                 prices: [:id, :variant_id, :currency, :min_quantity, :amount, :compare_at_amount]
               )
             )
-            reject_foreign_variants(attrs)
-          end
-
-          # The price rows resolve variant ids with no store scoping, so a
-          # list in this store could otherwise be populated with another
-          # store's variants. Drop any id that isn't in the current store
-          # before assignment.
-          def reject_foreign_variants(attrs)
-            if attrs[:prices].present?
-              incoming = Array(attrs[:prices])
-              store_variant_ids = current_store.variants.where(id: incoming.map { |r| r[:variant_id] }.compact).
-                                  pluck(:id).map(&:to_s).to_set
-              attrs[:prices] = incoming.select do |row|
-                row[:variant_id].blank? || store_variant_ids.include?(row[:variant_id].to_s)
-              end
-            end
-
-            attrs
           end
 
           private

data/app/controllers/spree/api/v3/admin/prices_controller.rb

@@ -58,6 +58,10 @@ module Spree
             # validations (docs/plans/6.0-volume-pricing.md). Each branch is
             # guarded on the key its own failure carries, so a failure mode the
             # service grows later is not reported under one of these names.
+            #
+            # `I18n.t` rather than `Spree.t` for these: the models raise them
+            # under `activerecord.errors`, and `Spree.t` would scope the lookup
+            # to `spree.` and miss the key.
             if (invalid = result.error&.value.try(:[], :invalid_quantities))
               return render_error(
                 code: 'invalid_min_quantity',
@@ -70,16 +74,34 @@ module Spree
             if (negative = result.error&.value.try(:[], :invalid_amounts))
               return render_error(
                 code: 'invalid_amount',
-                message: Spree.t('activerecord.errors.models.spree/price_list.attributes.base.negative_price').upcase_first,
+                message: I18n.t('activerecord.errors.models.spree/price_list.attributes.base.negative_price').upcase_first,
                 status: :unprocessable_content,
                 details: { rows: negative }
               )
             end
 
+            if (misplaced = result.error&.value.try(:[], :quantities_on_base_prices))
+              return render_error(
+                code: 'quantity_on_base_price',
+                message: I18n.t('activerecord.errors.models.spree/price_list.attributes.base.quantity_on_base_price').upcase_first,
+                status: :unprocessable_content,
+                details: { rows: misplaced }
+              )
+            end
+
+            if (duplicates = result.error&.value.try(:[], :duplicate_quantities))
+              return render_error(
+                code: 'duplicate_min_quantity',
+                message: I18n.t('activerecord.errors.models.spree/price_list.attributes.base.duplicate_quantity').upcase_first,
+                status: :unprocessable_content,
+                details: { rows: duplicates }
+              )
+            end
+
             if (over_cap = result.error&.value.try(:[], :over_cap))
               return render_error(
                 code: 'too_many_breaks',
-                message: Spree.t(
+                message: I18n.t(
                   'activerecord.errors.models.spree/price.attributes.min_quantity.too_many_breaks',
                   count: Spree::Price::MAXIMUM_BREAKS_PER_VARIANT
                 ).upcase_first,
@@ -88,6 +110,15 @@ module Spree
               )
             end
 
+            if (rising = result.error&.value.try(:[], :rising_ladders))
+              return render_error(
+                code: 'price_rises_with_quantity',
+                message: I18n.t('activerecord.errors.models.spree/price_list.attributes.base.price_rises_with_quantity').upcase_first,
+                status: :unprocessable_content,
+                details: { ladders: rising }
+              )
+            end
+
             render json: result.value
           end
 

data/app/controllers/spree/api/v3/admin/products_controller.rb

@@ -301,7 +301,7 @@ module Spree
           end
 
           def search_provider
-            @search_provider ||= Spree::SearchProvider::Database.new(current_store)
+            @search_provider ||= Spree::SearchProvider::Database.new(current_store, audience: nil)
           end
 
           # Tag changes can flip automatic-collection matches, and `Tags::Bulk*`

data/app/controllers/spree/api/v3/admin/resource_controller.rb

@@ -17,6 +17,7 @@ module Spree
           # include.
           include Spree::Api::V3::Admin::Concerns::ExternalReferences
           include Spree::Api::V3::Admin::ValidationDetails
+          include Spree::Api::V3::Admin::EmbedPermissions
 
           protected
 

data/app/controllers/spree/api/v3/admin/sellers/invitations/acceptance_links_controller.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module Sellers
+          module Invitations
+            # The acceptance link of a pending invitation onto a seller's team.
+            #
+            # The link carries the token that joins the team, so reading
+            # sellers is not enough: the caller must be able to change the
+            # seller, as when sending the invitation.
+            class AcceptanceLinksController < Admin::BaseController
+              scoped_resource :sellers
+
+              # GET /api/v3/admin/sellers/:seller_id/invitations/:invitation_id/acceptance_link
+              def show
+                seller = current_store.sellers.find_by_prefix_id!(params[:seller_id])
+                authorize!(:update, seller)
+                invitation = seller.invitations.pending.find_by_prefix_id!(params[:invitation_id])
+
+                render json: Spree.api.admin_invitation_acceptance_link_serializer.new(
+                  invitation, params: { store: current_store }
+                ).to_h
+              end
+
+              protected
+
+              def read_actions
+                []
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/setup_controller.rb

@@ -41,7 +41,7 @@ module Spree
           # POST /api/v3/admin/auth/setup
           # Body: { setup_token, email, password, password_confirmation?,
           #         first_name?, last_name?, store_name, country_code,
-          #         locale?, currency? }
+          #         locale?, currency?, sample_data? }
           # Currency defaults to the country's own; an unknown code is refused
           # rather than ignored, since the token is spent in the same request.
           def create
@@ -63,6 +63,10 @@ module Spree
               adopt_default_store(user, store)
             end
 
+            # Outside the lock: the loader needs the admin committed, and it
+            # runs for minutes, so it is queued rather than awaited.
+            Spree::SampleData::LoadJob.perform_later(store.id) if sample_data_requested?
+
             refresh_token = Spree::RefreshToken.create_for(user, audience: JWT_AUDIENCE_ADMIN, request_env: request_env_for_token)
             set_refresh_cookie(refresh_token)
             render json: auth_response(user)
@@ -167,6 +171,10 @@ module Spree
             )
           end
 
+          def sample_data_requested?
+            ActiveModel::Type::Boolean.new.cast(params[:sample_data]) == true
+          end
+
           def admin_user_params
             params.permit(:email, :password, :password_confirmation, :first_name, :last_name)
           end

data/app/controllers/spree/api/v3/admin/store_controller.rb

@@ -81,6 +81,7 @@ module Spree
               :preferred_storefront_access,
               :preferred_storefront_url,
               :preferred_guest_checkout,
+              :preferred_always_include_confirm_step,
               :preferred_company_field_enabled,
               :preferred_address_requires_company,
               :preferred_address_requires_phone,
@@ -104,6 +105,10 @@ module Spree
               :preferred_payout_provider,
               :preferred_default_payouts_schedule_interval,
               :preferred_default_minimum_payout_amount,
+              :preferred_auto_approve_sellers,
+              :preferred_auto_approve_seller_products,
+              :preferred_send_seller_transactional_emails,
+              :preferred_default_commission_tax_rate,
               :preferred_document_number_format,
               :preferred_order_number_prefix,
               :preferred_order_number_suffix,

data/app/controllers/spree/api/v3/admin/translations/batches_controller.rb

@@ -39,7 +39,7 @@ module Spree
               raw = params[:translations]
               return render_empty_batch_error unless raw.is_a?(Array) && raw.any?
 
-              batch = Spree::Translations::Batch.new(batch_params)
+              batch = Spree::Translations::Batch.new(batch_params, store: current_store)
               return unless require_batch_scopes!(batch)
 
               records = batch.process! { |record| authorize!(:update, record) }

data/app/controllers/spree/api/v3/admin/translations_controller.rb

@@ -43,7 +43,7 @@ module Spree
           # translation tables.
           def parent_relation
             klass = parent_lookup.klass
-            relation = klass.respond_to?(:for_store) ? klass.for_store(current_store) : klass
+            relation = klass.respond_to?(:translatable_scope) ? klass.translatable_scope(current_store) : klass.for_store(current_store)
 
             children = klass.try(:translatable_children)
             children ? relation.includes(children => :translations) : relation

data/app/controllers/spree/api/v3/admin/webhook_deliveries_controller.rb

@@ -42,6 +42,18 @@ module Spree
               params[:webhook_endpoint_id]
             )
           end
+
+          # The payload is the record the event is about, so it is shown only
+          # to a caller who could read that record; the webhooks permission
+          # alone sees the delivery's status and response.
+          def serializer_params
+            super.merge(
+              payload_visible: lambda { |delivery|
+                key = delivery.payload_permission_key
+                key.nil? || holds_permission?(key)
+              }
+            )
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/admin/webhook_endpoints_controller.rb

@@ -8,6 +8,8 @@ module Spree
         class WebhookEndpointsController < ResourceController
           scoped_resource :webhooks
 
+          before_action :reject_unauthorized_credential_subscription!, only: [:create, :update]
+
           # POST /api/v3/admin/webhook_endpoints/:id/send_test
           #
           # Fires a synthetic `webhook.test` delivery so admins can verify the
@@ -68,6 +70,31 @@ module Spree
           def permitted_params
             params.permit(*model_additional_permitted_attributes, :name, :url, :active, subscriptions: [])
           end
+
+          private
+
+          # Customer password reset tokens are account credentials, so the
+          # webhooks permission alone cannot subscribe an endpoint to them, or
+          # repoint an endpoint that already receives them.
+          def reject_unauthorized_credential_subscription!
+            return if holds_permission?('write_customers')
+
+            requested = Array(permitted_params[:subscriptions]) & Spree::WebhookEndpoint::CREDENTIAL_EVENTS
+            return if requested.empty? && !repoints_credential_endpoint?
+
+            render_error(
+              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
+              message: "Receiving #{Spree::WebhookEndpoint::CREDENTIAL_EVENTS.to_sentence} requires permission to manage customers",
+              status: :forbidden
+            )
+          end
+
+          def repoints_credential_endpoint?
+            return false unless action_name == 'update'
+            return false unless permitted_params.key?(:url) || permitted_params.key?(:subscriptions)
+
+            current_store.webhook_endpoints.find_by_prefix_id(params[:id])&.receives_credentials?
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/base_controller.rb

@@ -81,7 +81,10 @@ module Spree
           if errors.is_a?(ActiveModel::Errors)
             render_validation_error(errors)
           else
-            render_service_error(error)
+            # The unwrapped value, so a workflow's rejection symbol reaches
+            # the branch that translates it rather than the one that prints
+            # the wrapper.
+            render_service_error(errors)
           end
         end
 
@@ -93,10 +96,26 @@ module Spree
 
         alias try_spree_current_user spree_current_user
 
-        # CanCanCan ability
+        # Who performed this request, for the associations that record it —
+        # `canceler`, `approver`, `created_by` and their siblings. Answers the
+        # signed-in user here; the Admin branch prefers the authenticating
+        # secret key, because a key-made write must record the key rather than
+        # nobody (see docs/plans/6.0-action-actors.md).
+        #
+        # Deliberately not `current_api_key || current_user` at this level: on
+        # a Store API request the key is the storefront's publishable one, and
+        # a customer's own action is not the storefront's.
+        #
+        # @return [Object, nil] a member of Spree.actor_classes
+        def current_actor
+          try_spree_current_user
+        end
+
+        # CanCanCan ability, built from the swappable
+        # `Spree::Dependencies.ability_class` (Spree::Ability by default).
         # @return [Spree::Ability]
         def current_ability
-          @current_ability ||= Spree::Ability.new(current_user, ability_options)
+          @current_ability ||= Spree.ability_class.new(current_user, ability_options)
         end
 
         # Options passed to the CanCanCan ability

data/app/controllers/spree/api/v3/resource_controller.rb

@@ -176,10 +176,25 @@ module Spree
         def build_resource
           resource = resource_scope.new
           resource.assign_attributes(permitted_params) if create_workflow.nil?
-          resource.created_by = try_spree_current_user if resource.respond_to?(:created_by_id)
+          resource.created_by = creator_for(resource) if resource.respond_to?(:created_by_id)
           resource
         end
 
+        # The actor to stamp on a new record, or nil when this model cannot
+        # hold it. `created_by` is polymorphic on the order operations and
+        # still admin-user-only elsewhere until 6.1, so a key-authenticated
+        # create of a gift card records nobody rather than raising — the same
+        # thing it recorded before keys became actors.
+        def creator_for(resource)
+          actor = current_actor
+          return actor if actor.nil?
+
+          association = resource.class.reflect_on_association(:created_by)
+          return actor if association.nil? || association.polymorphic?
+
+          actor.is_a?(association.klass) ? actor : nil
+        end
+
         # The relation a new record is built on: a nested resource's parent
         # association, the store's own association for this model, or the
         # class itself for genuinely global data (countries, roles).
@@ -239,7 +254,7 @@ module Spree
 
           @search = scope.includes(collection_includes).
                     preload_associations_lazily.
-                    ransack(ransack_params)
+                    ransack(ransack_params, auth_object: ransack_auth_object)
           result = @search.result(distinct: collection_distinct?)
           pagy_options = { limit: limit, page: page }
           result = apply_collection_sort(result)
@@ -247,6 +262,16 @@ module Spree
           @collection
         end
 
+        # Who is filtering, as Ransack's auth object. Nil is the back office,
+        # which may use every allowlisted attribute; the Store and Seller
+        # branches name themselves so the models narrow what they may reach
+        # (see Spree::RansackableAttributes). Covers sorting too.
+        #
+        # @return [Symbol, nil]
+        def ransack_auth_object
+          nil
+        end
+
         # Override in subclass to disable distinct (e.g., for custom sorting with computed columns)
         # @return [Boolean] whether to apply distinct to the collection
         def collection_distinct?

data/app/controllers/spree/api/v3/seller/auth_controller.rb

@@ -136,7 +136,7 @@ module Spree
           def auth_response(user)
             {
               token: generate_jwt(user, audience: Spree::Api::V3::JwtAuthentication::JWT_AUDIENCE_SELLER),
-              user: Spree.api.seller_team_member_serializer.new(user, params: { store: user.sellers.first&.store }).to_h,
+              user: Spree.api.seller_account_serializer.new(user, params: { store: user.sellers.first&.store }).to_h,
               sellers: serialized_sellers(user)
             }
           end

data/app/controllers/spree/api/v3/seller/invitation_acceptances_controller.rb

@@ -94,7 +94,10 @@ module Spree
           end
 
           def authenticate_existing(user)
-            return user if user.valid_password?(params[:password].to_s)
+            # Under the login lockout: otherwise this is an unthrottled way to
+            # guess an existing account's password with an invitation token.
+            verdict = Spree::Authentication::Lockout.check(user) { user.valid_password?(params[:password].to_s) }
+            return user if verdict == :valid
 
             render_error(
               code: ErrorHandler::ERROR_CODES[:authentication_failed],
@@ -127,7 +130,7 @@ module Spree
           def auth_response(user)
             {
               token: generate_jwt(user, audience: Spree::Api::V3::JwtAuthentication::JWT_AUDIENCE_SELLER),
-              user: Spree.api.seller_team_member_serializer.new(
+              user: Spree.api.seller_account_serializer.new(
                 user, params: { store: @invitation.store }
               ).to_h,
               sellers: serialized_sellers(user)

data/app/controllers/spree/api/v3/seller/invitations/acceptance_links_controller.rb

@@ -0,0 +1,34 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        module Invitations
+          # The acceptance link of a pending invitation onto this seller's team.
+          #
+          # The link carries the token that joins the team, so it is authorized
+          # like inviting someone: write access to the seller profile. Rooted at
+          # `current_seller.invitations`, so another seller's invitation reads
+          # as missing.
+          class AcceptanceLinksController < Seller::BaseController
+            scoped_resource :seller_profile
+
+            # GET /api/v3/seller/invitations/:invitation_id/acceptance_link
+            def show
+              invitation = current_seller.invitations.pending.find_by_prefix_id!(params[:invitation_id])
+
+              render json: Spree.api.seller_invitation_acceptance_link_serializer.new(
+                invitation, params: { store: current_store }
+              ).to_h
+            end
+
+            protected
+
+            def read_actions
+              []
+            end
+          end
+        end
+      end
+    end
+  end
+end