spree_api 6.0.0.beta2 → 6.0.0.beta3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66c29980b5060309f11b480faec57266dc0bf8423b03e820a365e346a7f5f8a7
-  data.tar.gz: 0b3f632bfaa9cb6158694e492c3c8266a7b4e5c05c942abad15ce45a99662aea
+  metadata.gz: d30acba1d9395e7575f92eefe7c86b5cd8c73eae44cceb1e178a853963e856c4
+  data.tar.gz: 562e93949b2a3e5b124c06896821d26554329f0e332faa8f9de2d35b6d40dc71
 SHA512:
-  metadata.gz: bde5239802c9065c5b69fd3473b424dc2245c446035ff5ee1dc9cc475ea1de6cfcfbeffd65d11659427df2de94883bed3ae671916605e30155eb7ae9291e7ffe
-  data.tar.gz: ad098d05870290fae2ac19c12cf4ed92d91584466723f7992f8ac45beba9669ee1ad1c4f2a3a61c1a292e66b6b2568e6b027b42ba959efcb8f7662e4a5774c8f
+  metadata.gz: 401bbdc3ddb5eb121c8ad9eac1d5341aa130c0f1f61135e54b14c8eabe577c1845442f28e20e4bf608e35d5dc5f757b25b4b41697dd1010c78ae9f2ede161362
+  data.tar.gz: e27e19331d0e63339aa5bd21586f1f4ed74b095689a3c31252faee126f9d896f3579cef931a6fa66afa5b6e0c001f7759f19838f3a2914de105090f598b4c2ae

data/app/controllers/concerns/spree/api/v3/admin/embed_permissions.rb

@@ -0,0 +1,55 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Keeps records another permission guards out of a response.
+        #
+        # An endpoint is gated on its own resource's key, but expanding an
+        # association pulls in whole records of another kind — a customer's
+        # orders, an order's payments, a gift card's customer. Without this a
+        # role cleared only for customers could read every order through
+        # `?expand=orders`. Each segment of an expand path is checked, so
+        # `orders.payments` needs both keys.
+        #
+        # Gift card codes are bearer credentials that ride along on every
+        # order, so serializers show them in full only to a caller who may read
+        # gift cards and masked to everyone else.
+        module EmbedPermissions
+          extend ActiveSupport::Concern
+
+          # Association name in an expand path => the catalog key it needs.
+          EXPANSION_PERMISSIONS = {
+            'order' => 'read_orders',
+            'orders' => 'read_orders',
+            'payment' => 'read_payments',
+            'payments' => 'read_payments',
+            'payment_splits' => 'read_payments',
+            'customer' => 'read_customers',
+            'customers' => 'read_customers',
+            'gift_card' => 'read_gift_cards',
+            'gift_cards' => 'read_gift_cards',
+            'store_credit' => 'read_store_credits',
+            'store_credits' => 'read_store_credits'
+          }.freeze
+
+          protected
+
+          def expand_list
+            super.select { |path| path.split('.').all? { |segment| expansion_permitted?(segment) } }
+          end
+
+          def serializer_params
+            super.merge(gift_card_codes: holds_permission?('read_gift_cards'))
+          end
+
+          private
+
+          def expansion_permitted?(segment)
+            key = EXPANSION_PERMISSIONS[segment]
+            key.nil? || holds_permission?(key)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/admin/role_grant_guard.rb

@@ -23,13 +23,13 @@ module Spree
           #   flow leaves it off (its gate is `manage Invitation`).
           # @return [Boolean] true if the request was rejected (caller should return)
           def reject_unauthorized_role_grant!(role_ids, require_role_management: false)
-            return false if role_ids.blank?
-
             # The management gate runs whenever a role mutation is attempted —
-            # before resolving ids — so passing unknown ids can't slip the
-            # reconciliation (which would still remove the user's current roles)
-            # past a caller without role-management authority.
+            # before resolving ids, and even for an empty list — so passing
+            # unknown ids, or none at all, can't slip the reconciliation (which
+            # would still remove the user's current roles) past a caller
+            # without role-management authority.
             return true if require_role_management && reject_without_role_management!
+            return false if role_ids.blank?
 
             roles = current_store.roles.where(id: role_ids.map(&:to_s)).to_a
             return false if roles.empty?
@@ -40,6 +40,30 @@ module Spree
             false
           end
 
+          # Removing a role is bounded like granting it: a caller may only take
+          # away authority they could hand out, so a staff member who can
+          # manage staff cannot strip the admin role from the store's owners.
+          # The store also keeps at least one admin, whoever asks.
+          #
+          # @param user [Object] whose roles are being removed
+          # @param roles [Array<Spree::Role>] the store roles being removed
+          # @return [Boolean] true if the request was rejected (caller should return)
+          def reject_unauthorized_role_removal!(user, roles)
+            return false if roles.empty?
+
+            if roles.any?(&:admin?)
+              return deny_role_grant!('You cannot remove the admin role.') unless caller_holds_admin_role?
+              return deny_role_grant!('The store must keep at least one admin.') if last_admin?(user)
+            end
+
+            return false if caller_holds_admin_role?
+
+            beyond_own = roles.reject { |role| excess_permission_keys(role.permissions).empty? }
+            return false if beyond_own.empty?
+
+            deny_role_grant!("You cannot remove roles beyond your own privileges: #{beyond_own.map(&:name).join(', ')}")
+          end
+
           # Rejects granting permission keys beyond the caller's own — used by
           # roles#create/#update on the requested `permissions` array.
           #
@@ -125,6 +149,11 @@ module Spree
               end
           end
 
+          def last_admin?(user)
+            admin_roles = current_store.roles.select(&:admin?)
+            Spree::RoleUser.where(role: admin_roles).where.not(user: user).none?
+          end
+
           def caller_holds_admin_role?
             return current_api_key.has_scope?('write_all') if scope_limited_principal?
 

data/app/controllers/concerns/spree/api/v3/current_password_confirmation.rb

@@ -13,12 +13,20 @@ module Spree
 
         private
 
+        # Runs under the login lockout, so a stolen session cannot use this
+        # check to guess the password: misses count towards the lockout, and a
+        # locked account is refused even with the right password.
+        #
         # @return [Boolean] whether `current_password` matches the signed-in
         #   account. False when the parameter is missing — an absent password
         #   is not a correct one.
         def valid_current_password?
           return false if params[:current_password].blank?
 
+          Spree::Authentication::Lockout.check(current_user) { current_password_matches? } == :valid
+        end
+
+        def current_password_matches?
           if current_user.respond_to?(:valid_password?)
             current_user.valid_password?(params[:current_password])
           elsif current_user.respond_to?(:authenticate)

data/app/controllers/concerns/spree/api/v3/orders/fulfillment_actions.rb

@@ -135,9 +135,22 @@ module Spree
           end
 
           # The attributes handed to the update workflow. The workflow assigns
-          # ids raw, so a branch that must narrow one resolves it here first.
+          # ids raw, so the stock location is resolved first, through the same
+          # lookup create and split use.
           def update_attributes
-            permitted_params.to_h
+            attributes = permitted_params.to_h
+
+            if attributes['stock_location_id'].present?
+              attributes['stock_location_id'] = find_stock_location!(attributes['stock_location_id']).id
+            end
+
+            attributes
+          end
+
+          # A stock location of the current store. A branch that must narrow it
+          # further (by ability, by seller) overrides this.
+          def find_stock_location!(id)
+            current_store.stock_locations.find_by_prefix_id!(id)
           end
 
           # What may be split out of this parcel, and where the split half

data/app/controllers/concerns/spree/api/v3/scoped_authorization.rb

@@ -204,6 +204,20 @@ module Spree
         def scope_limited_principal?
           current_api_key.present? && current_user.blank?
         end
+
+        # Whether the caller holds a catalog key beyond the one the action
+        # needs — for data another permission guards riding along in a
+        # response (an expanded association, an embedded record). Mirrors the
+        # key gate's two principals: a secret key carries scopes, a signed-in
+        # staffer carries their roles' catalog keys.
+        def holds_permission?(key)
+          return current_api_key.has_scope?(key) if scope_limited_principal?
+
+          ability = current_ability
+          return true unless ability.respond_to?(:permission_keys)
+
+          ability.permission_keys.include?(key.to_s)
+        end
       end
     end
   end

data/app/controllers/concerns/spree/api/v3/store/storefront_products.rb

@@ -0,0 +1,35 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # The products a storefront buyer may see: available now (or on
+        # pre-order) in the current currency, narrowed to the catalogs their
+        # company, customer group or channel resolve to. The product listing
+        # reads through it, and so does anything else that accepts a product
+        # or variant from the buyer, so an id cannot reach what the listing
+        # would never show.
+        module StorefrontProducts
+          extend ActiveSupport::Concern
+
+          private
+
+          # @param base [ActiveRecord::Relation] products to narrow; the store's by default
+          # @return [ActiveRecord::Relation<Spree::Product>]
+          def storefront_products(base = current_store.products)
+            Spree.products_for_context_service.call(
+              store: current_store,
+              channel: current_channel,
+              customer: current_user,
+              base: base.available(Time.current, Spree::Current.currency, include_preorderable: true)
+            ).value
+          end
+
+          # @return [ActiveRecord::Relation<Spree::Variant>]
+          def storefront_variants
+            Spree::Variant.where(product_id: storefront_products.reorder(nil).select(Spree::Product.arel_table[:id]))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/admin_users_controller.rb

@@ -24,6 +24,8 @@ module Spree
           # the account globally. The user keeps access to any other stores.
           def destroy
             authorize!(:destroy, @resource)
+            return if reject_unauthorized_role_removal!(@resource, @resource.spree_roles.for_resource(current_store).to_a)
+
             @resource.role_users.where(role: current_store.roles).destroy_all
             head :no_content
           end
@@ -42,6 +44,7 @@ module Spree
             # RoleManagement permission set, not by profile-edit rights.
             role_ids = role_ids_param if params.key?(:role_ids)
             return if role_ids && reject_unauthorized_role_grant!(role_ids, require_role_management: true)
+            return if role_ids && reject_unauthorized_role_removal!(@resource, removed_roles(role_ids))
 
             if @resource.update(identity_params)
               apply_role_ids(role_ids) if role_ids
@@ -89,6 +92,12 @@ module Spree
             ids.map { |id| Spree::PrefixedId.prefixed_id?(id) ? Spree::PrefixedId.decode_prefixed_id(id) : id }.compact
           end
 
+          # The store roles the user holds that `desired_role_ids` leaves out.
+          def removed_roles(desired_role_ids)
+            target = desired_role_ids.map(&:to_s)
+            @resource.spree_roles.for_resource(current_store).reject { |role| target.include?(role.id.to_s) }
+          end
+
           # Reconcile the user's roles on this store to match `desired_role_ids`.
           # Adds missing assignments and removes extras — no-op for unchanged.
           def apply_role_ids(desired_role_ids)

data/app/controllers/spree/api/v3/admin/base_controller.rb

@@ -13,6 +13,7 @@ module Spree
 
           include Spree::Api::V3::ScopedAuthorization
           include Spree::Api::V3::Admin::ValidationDetails
+          include Spree::Api::V3::Admin::EmbedPermissions
         end
       end
     end

data/app/controllers/spree/api/v3/admin/custom_fields_controller.rb

@@ -109,17 +109,22 @@ module Spree
             end.merge('customer' => Spree.customer_class.name, 'category' => 'Spree::Category')
           end
 
-          # Returns the first segment whose `<segment>_id` is present in params,
+          # Returns the first segment whose `<segment>_id` is in the route,
           # paired with its class and the raw id value, or nil. Memoized — read
           # by both `set_parent` and `scoped_resource_name`.
+          #
+          # Read from the path only: a `store_id` or `refund_id` added to the
+          # query string or body must not switch the parent to a type that is
+          # never routed here and has no store scope to narrow it.
           def parent_lookup
             return @parent_lookup if defined?(@parent_lookup)
 
-            match = parent_route_map.find { |segment, _| params[:"#{segment}_id"].present? }
+            route_params = request.path_parameters
+            match = parent_route_map.find { |segment, _| route_params[:"#{segment}_id"].present? }
             @parent_lookup =
               if match
                 segment, klass_name = match
-                ParentLookup.new(klass_name.constantize, params[:"#{segment}_id"], segment)
+                ParentLookup.new(klass_name.constantize, route_params[:"#{segment}_id"], segment)
               end
           end
         end

data/app/controllers/spree/api/v3/admin/customers_controller.rb

@@ -223,20 +223,6 @@ module Spree
             false
           end
 
-          # Mirrors the key gate's two principals: a secret key carries scopes,
-          # a signed-in staffer carries their roles' catalog keys.
-          #
-          # @param key [String]
-          # @return [Boolean]
-          def holds_permission?(key)
-            return current_api_key.has_scope?(key) if scope_limited_principal?
-
-            ability = current_ability
-            return true unless ability.respond_to?(:permission_keys)
-
-            ability.permission_keys.include?(key)
-          end
-
           # `export` maps to `:show`; `anonymize` is a destructive write, so it
           # maps to `:destroy` rather than `:update` — a role that may correct
           # a customer's name should not thereby be able to erase their history.

data/app/controllers/spree/api/v3/admin/gift_cards_controller.rb

@@ -13,6 +13,8 @@ module Spree
         class GiftCardsController < ResourceController
           scoped_resource :gift_cards
 
+          before_action :resolve_customer, only: [:create, :update]
+
           protected
 
           def model_class
@@ -24,8 +26,33 @@ module Spree
           end
 
           def permitted_params
-            params.permit(*model_additional_permitted_attributes, :code, :amount, :expires_at,
-                          :customer_id, :currency)
+            params.permit(*model_additional_permitted_attributes, :code, :amount, :expires_at, :currency).tap do |attributes|
+              attributes[:customer] = @customer if params.key?(:customer_id)
+            end
+          end
+
+          private
+
+          # Assigning a customer embeds their record in the response, so it is
+          # a read of customers: the caller must hold that permission, and the
+          # customer is resolved through their ability — never a raw id the
+          # model would look up across every customer.
+          def resolve_customer
+            return unless params.key?(:customer_id)
+            return @customer = nil if params[:customer_id].blank?
+
+            unless holds_permission?('read_customers')
+              return render_error(
+                code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
+                message: 'Missing permission: read_customers',
+                status: :forbidden,
+                details: { required_permission: 'read_customers' }
+              )
+            end
+
+            @customer = Spree.customer_class.
+                        accessible_by(current_ability, :show).
+                        find_by_prefix_id!(params[:customer_id])
           end
         end
       end

data/app/controllers/spree/api/v3/admin/invitation_acceptances_controller.rb

@@ -72,7 +72,10 @@ module Spree
           end
 
           def authenticate_existing(user)
-            return user if user.valid_password?(params[:password].to_s)
+            # Under the login lockout: otherwise this is an unthrottled way to
+            # guess an existing account's password with an invitation token.
+            verdict = Spree::Authentication::Lockout.check(user) { user.valid_password?(params[:password].to_s) }
+            return user if verdict == :valid
 
             render_error(
               code: ERROR_CODES[:authentication_failed],

data/app/controllers/spree/api/v3/admin/invitations/acceptance_links_controller.rb

@@ -0,0 +1,41 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module Invitations
+          # The acceptance link of a pending staff invitation.
+          #
+          # The link carries the token that creates the account and grants the
+          # role, so it is authorized like sending the invitation: the caller
+          # needs write access to staff and must be allowed to grant the
+          # invitation's role. Reading staff is not enough.
+          class AcceptanceLinksController < Admin::BaseController
+            include Spree::Api::V3::Admin::RoleGrantGuard
+
+            scoped_resource :staff
+
+            # GET /api/v3/admin/invitations/:invitation_id/acceptance_link
+            def show
+              invitation = Spree::Invitation.
+                           where(resource: current_store).
+                           pending.
+                           find_by_prefix_id!(params[:invitation_id])
+              authorize!(:update, invitation)
+              return if reject_unauthorized_role_grant!([invitation.role_id])
+
+              render json: Spree.api.admin_invitation_acceptance_link_serializer.new(
+                invitation, params: { store: current_store }
+              ).to_h
+            end
+
+            protected
+
+            def read_actions
+              []
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/me_controller.rb

@@ -58,6 +58,17 @@ module Spree
             )
           end
 
+          # /me describes the signed-in user rather than a store, and the
+          # dashboard reads it before any store is selected. A user who holds
+          # no role on any store (not yet given one, or removed from all of
+          # them) must still reach it, or they cannot finish signing in. A
+          # request that names a store keeps the membership check.
+          def require_store_membership!
+            return true if store_id_header.nil?
+
+            super
+          end
+
           def permitted_params
             params.permit(:selected_locale, :first_name, :last_name, :avatar)
           end

data/app/controllers/spree/api/v3/admin/orders/claims_controller.rb

@@ -18,7 +18,7 @@ module Spree
             #
             # Editable fields only — status moves through the member actions.
             def update
-              if @resource.update(permitted_params)
+              if @resource.update(update_attributes)
                 render json: serialize_resource(@resource.reload)
               else
                 render_validation_error(@resource.errors)
@@ -41,6 +41,19 @@ module Spree
 
             private
 
+            # The reason is resolved through the store rather than assigned
+            # raw, so another store's reads as missing.
+            def update_attributes
+              attributes = permitted_params.to_h.except('reason_id')
+
+              if params.key?(:reason_id)
+                attributes['reason'] =
+                  (current_store.claim_reasons.find_by_prefix_id!(params[:reason_id]) if params[:reason_id].present?)
+              end
+
+              attributes
+            end
+
             # The whole store's catalogue: an operator may promise anything
             # the store sells as a replacement.
             def replacement_variant_for(variant_id)

data/app/controllers/spree/api/v3/admin/orders/exchanges_controller.rb

@@ -19,7 +19,7 @@ module Spree
             #
             # Editable fields only — status moves through the member actions.
             def update
-              if @resource.update(permitted_params)
+              if @resource.update(update_attributes)
                 render json: serialize_resource(@resource.reload)
               else
                 render_validation_error(@resource.errors)
@@ -42,6 +42,27 @@ module Spree
 
             private
 
+            # The ids are resolved through the store rather than assigned raw,
+            # so another store's reason or warehouse reads as missing.
+            def update_attributes
+              attributes = permitted_params.to_h.except('reason_id', 'stock_location_id')
+
+              if params.key?(:reason_id)
+                attributes['reason'] =
+                  (current_store.return_reasons.find_by_prefix_id!(params[:reason_id]) if params[:reason_id].present?)
+              end
+
+              if params.key?(:stock_location_id)
+                attributes['stock_location'] =
+                  if params[:stock_location_id].present?
+                    current_store.stock_locations.accessible_by(current_ability, :show).
+                      find_by_prefix_id!(params[:stock_location_id])
+                  end
+              end
+
+              attributes
+            end
+
             # The whole store's catalogue, and any warehouse the caller may
             # see: an operator exchanges into anything the store sells.
             def replacement_variant_for(variant_id)

data/app/controllers/spree/api/v3/admin/orders/fulfillments_controller.rb

@@ -113,7 +113,7 @@ module Spree
             end
 
             def find_stock_location!(id)
-              Spree::StockLocation.accessible_by(current_ability, :show).find_by_prefix_id!(id)
+              current_store.stock_locations.accessible_by(current_ability, :show).find_by_prefix_id!(id)
             end
 
             def stock_location_for_create

data/app/controllers/spree/api/v3/admin/orders/returns_controller.rb

@@ -25,7 +25,7 @@ module Spree
             #
             # Editable fields only — status moves through the member actions.
             def update
-              if @resource.update(permitted_params)
+              if @resource.update(update_attributes)
                 render json: serialize_resource(@resource.reload)
               else
                 render_validation_error(@resource.errors)
@@ -55,6 +55,27 @@ module Spree
 
             private
 
+            # The ids are resolved through the store rather than assigned raw,
+            # so another store's reason or warehouse reads as missing.
+            def update_attributes
+              attributes = permitted_params.to_h.except('reason_id', 'stock_location_id')
+
+              if params.key?(:reason_id)
+                attributes['reason'] =
+                  (current_store.return_reasons.find_by_prefix_id!(params[:reason_id]) if params[:reason_id].present?)
+              end
+
+              if params.key?(:stock_location_id)
+                attributes['stock_location'] =
+                  if params[:stock_location_id].present?
+                    current_store.stock_locations.accessible_by(current_ability, :show).
+                      find_by_prefix_id!(params[:stock_location_id])
+                  end
+              end
+
+              attributes
+            end
+
             # Any of the store's warehouses the caller may see.
             def stock_location_for_create
               return nil if create_params[:stock_location_id].blank?

data/app/controllers/spree/api/v3/admin/orders_controller.rb

@@ -52,6 +52,10 @@ module Spree
           end
 
           # PATCH /api/v3/admin/orders/:id/complete
+          #
+          # An order holding several sellers' goods divides into one order per
+          # seller, so the group is what comes back — the orders it produced
+          # are nested inside it.
           def complete
             with_order_lock do
               result = Spree.order_complete_service.call(
@@ -61,7 +65,7 @@ module Spree
               )
 
               if result.success?
-                render json: serialize_resource(@resource.reload)
+                render json: serialize_completion(result.value)
               else
                 render_service_error(@resource.errors.presence || result.error, code: ERROR_CODES[:order_cannot_complete])
               end
@@ -149,6 +153,28 @@ module Spree
             Spree.api.admin_order_serializer
           end
 
+          # Completion answers with whatever it produced: one order, or the
+          # group a multi-seller order divided into.
+          #
+          # The group is rendered whole rather than through `filter_fields`: a
+          # `fields` list names an order's attributes, and narrowing a group by
+          # it can drop the very keys that say it is one.
+          def serialize_completion(record)
+            return serialize_resource(record.reload) unless record.is_a?(Spree::OrderGroup)
+
+            Spree.api.admin_order_group_serializer.new(completed_group(record), params: serializer_params).to_h
+          end
+
+          # Every child is rendered in full, so its associations are loaded once
+          # here rather than per order.
+          def completed_group(group)
+            Spree::OrderGroup.includes(
+              :customer, :ship_address, :bill_address,
+              { payments: %i[payment_method source] },
+              { orders: [:seller, :market, :gift_card, :customer, { line_items: { variant: :prices } }] }
+            ).find(group.id)
+          end
+
           # Override scope — Order uses SingleStoreResource (for_store).
           # Variant prices and each line's price list are named here rather
           # than via scope_includes, which this override bypasses; the

data/app/controllers/spree/api/v3/admin/password_resets_controller.rb

@@ -17,20 +17,10 @@ module Spree
 
           # POST /api/v3/admin/password_resets
           def create
-            redirect_url = params[:redirect_url]
-
-            # Validate redirect_url against allowed origins (secure by default).
-            # If no allowed origins are configured, redirect_url is silently ignored
-            # to prevent open redirect / token exfiltration attacks.
-            if redirect_url.present?
-              unless current_store.allowed_origins.exists? && current_store.allowed_origin?(redirect_url)
-                redirect_url = nil
-              end
-            end
-
             user = Spree.admin_user_class.find_by(email: params[:email])
 
             if user
+              redirect_url = trusted_redirect_url(user)
               token = user.generate_token_for(:password_reset)
               event_payload = { reset_token: token, email: user.email, store_id: current_store.prefixed_id }
               event_payload[:redirect_url] = redirect_url if redirect_url.present?
@@ -71,6 +61,36 @@ module Spree
 
           private
 
+          # The emailed link carries the reset token, so it may only point at
+          # the dashboard — never at a storefront origin, which anyone who can
+          # edit a store's allowed origins could add — and only when the
+          # account belongs to the store the request names. Anything else is
+          # ignored and the email links to the dashboard's own reset page.
+          #
+          # @return [String, nil]
+          def trusted_redirect_url(user)
+            redirect_url = params[:redirect_url].presence
+            return if redirect_url.blank?
+            return unless same_origin?(redirect_url, Spree::Stores::DashboardUrl.call(store: current_store))
+            return unless staff_of_current_store?(user)
+
+            redirect_url
+          end
+
+          def same_origin?(url, other)
+            first = URI.parse(url.to_s)
+            second = URI.parse(other.to_s)
+            first.host.present? && [first.scheme, first.host, first.port] == [second.scheme, second.host, second.port]
+          rescue URI::InvalidURIError
+            false
+          end
+
+          def staff_of_current_store?(user)
+            return false unless user.respond_to?(:spree_roles)
+
+            user.spree_roles.for_resource(current_store).exists?
+          end
+
           def auth_response(user)
             {
               token: generate_jwt(user, audience: JWT_AUDIENCE_ADMIN),