spree_api 6.0.0.beta2 → 6.0.0.beta3

data/app/controllers/spree/api/v3/admin/price_lists_controller.rb

@@ -122,7 +122,7 @@ module Spree
           end
 
           def permitted_params
-            attrs = normalize_params(
+            normalize_params(
               params.permit(
                 :name, :description, :position,
                 :starts_at, :ends_at, :match_policy,
@@ -132,24 +132,6 @@ module Spree
                 prices: [:id, :variant_id, :currency, :min_quantity, :amount, :compare_at_amount]
               )
             )
-            reject_foreign_variants(attrs)
-          end
-
-          # The price rows resolve variant ids with no store scoping, so a
-          # list in this store could otherwise be populated with another
-          # store's variants. Drop any id that isn't in the current store
-          # before assignment.
-          def reject_foreign_variants(attrs)
-            if attrs[:prices].present?
-              incoming = Array(attrs[:prices])
-              store_variant_ids = current_store.variants.where(id: incoming.map { |r| r[:variant_id] }.compact).
-                                  pluck(:id).map(&:to_s).to_set
-              attrs[:prices] = incoming.select do |row|
-                row[:variant_id].blank? || store_variant_ids.include?(row[:variant_id].to_s)
-              end
-            end
-
-            attrs
           end
 
           private

data/app/controllers/spree/api/v3/admin/prices_controller.rb

@@ -58,6 +58,10 @@ module Spree
             # validations (docs/plans/6.0-volume-pricing.md). Each branch is
             # guarded on the key its own failure carries, so a failure mode the
             # service grows later is not reported under one of these names.
+            #
+            # `I18n.t` rather than `Spree.t` for these: the models raise them
+            # under `activerecord.errors`, and `Spree.t` would scope the lookup
+            # to `spree.` and miss the key.
             if (invalid = result.error&.value.try(:[], :invalid_quantities))
               return render_error(
                 code: 'invalid_min_quantity',
@@ -70,16 +74,34 @@ module Spree
             if (negative = result.error&.value.try(:[], :invalid_amounts))
               return render_error(
                 code: 'invalid_amount',
-                message: Spree.t('activerecord.errors.models.spree/price_list.attributes.base.negative_price').upcase_first,
+                message: I18n.t('activerecord.errors.models.spree/price_list.attributes.base.negative_price').upcase_first,
                 status: :unprocessable_content,
                 details: { rows: negative }
               )
             end
 
+            if (misplaced = result.error&.value.try(:[], :quantities_on_base_prices))
+              return render_error(
+                code: 'quantity_on_base_price',
+                message: I18n.t('activerecord.errors.models.spree/price_list.attributes.base.quantity_on_base_price').upcase_first,
+                status: :unprocessable_content,
+                details: { rows: misplaced }
+              )
+            end
+
+            if (duplicates = result.error&.value.try(:[], :duplicate_quantities))
+              return render_error(
+                code: 'duplicate_min_quantity',
+                message: I18n.t('activerecord.errors.models.spree/price_list.attributes.base.duplicate_quantity').upcase_first,
+                status: :unprocessable_content,
+                details: { rows: duplicates }
+              )
+            end
+
             if (over_cap = result.error&.value.try(:[], :over_cap))
               return render_error(
                 code: 'too_many_breaks',
-                message: Spree.t(
+                message: I18n.t(
                   'activerecord.errors.models.spree/price.attributes.min_quantity.too_many_breaks',
                   count: Spree::Price::MAXIMUM_BREAKS_PER_VARIANT
                 ).upcase_first,
@@ -88,6 +110,15 @@ module Spree
               )
             end
 
+            if (rising = result.error&.value.try(:[], :rising_ladders))
+              return render_error(
+                code: 'price_rises_with_quantity',
+                message: I18n.t('activerecord.errors.models.spree/price_list.attributes.base.price_rises_with_quantity').upcase_first,
+                status: :unprocessable_content,
+                details: { ladders: rising }
+              )
+            end
+
             render json: result.value
           end
 

data/app/controllers/spree/api/v3/admin/products_controller.rb

@@ -301,7 +301,7 @@ module Spree
           end
 
           def search_provider
-            @search_provider ||= Spree::SearchProvider::Database.new(current_store)
+            @search_provider ||= Spree::SearchProvider::Database.new(current_store, audience: nil)
           end
 
           # Tag changes can flip automatic-collection matches, and `Tags::Bulk*`

data/app/controllers/spree/api/v3/admin/resource_controller.rb

@@ -17,6 +17,7 @@ module Spree
           # include.
           include Spree::Api::V3::Admin::Concerns::ExternalReferences
           include Spree::Api::V3::Admin::ValidationDetails
+          include Spree::Api::V3::Admin::EmbedPermissions
 
           protected
 

data/app/controllers/spree/api/v3/admin/sellers/invitations/acceptance_links_controller.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module Sellers
+          module Invitations
+            # The acceptance link of a pending invitation onto a seller's team.
+            #
+            # The link carries the token that joins the team, so reading
+            # sellers is not enough: the caller must be able to change the
+            # seller, as when sending the invitation.
+            class AcceptanceLinksController < Admin::BaseController
+              scoped_resource :sellers
+
+              # GET /api/v3/admin/sellers/:seller_id/invitations/:invitation_id/acceptance_link
+              def show
+                seller = current_store.sellers.find_by_prefix_id!(params[:seller_id])
+                authorize!(:update, seller)
+                invitation = seller.invitations.pending.find_by_prefix_id!(params[:invitation_id])
+
+                render json: Spree.api.admin_invitation_acceptance_link_serializer.new(
+                  invitation, params: { store: current_store }
+                ).to_h
+              end
+
+              protected
+
+              def read_actions
+                []
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/setup_controller.rb

@@ -65,7 +65,7 @@ module Spree
 
             # Outside the lock: the loader needs the admin committed, and it
             # runs for minutes, so it is queued rather than awaited.
-            Spree::SampleData::LoadJob.perform_later if sample_data_requested?
+            Spree::SampleData::LoadJob.perform_later(store.id) if sample_data_requested?
 
             refresh_token = Spree::RefreshToken.create_for(user, audience: JWT_AUDIENCE_ADMIN, request_env: request_env_for_token)
             set_refresh_cookie(refresh_token)

data/app/controllers/spree/api/v3/admin/store_controller.rb

@@ -105,6 +105,10 @@ module Spree
               :preferred_payout_provider,
               :preferred_default_payouts_schedule_interval,
               :preferred_default_minimum_payout_amount,
+              :preferred_auto_approve_sellers,
+              :preferred_auto_approve_seller_products,
+              :preferred_send_seller_transactional_emails,
+              :preferred_default_commission_tax_rate,
               :preferred_document_number_format,
               :preferred_order_number_prefix,
               :preferred_order_number_suffix,

data/app/controllers/spree/api/v3/admin/translations/batches_controller.rb

@@ -39,7 +39,7 @@ module Spree
               raw = params[:translations]
               return render_empty_batch_error unless raw.is_a?(Array) && raw.any?
 
-              batch = Spree::Translations::Batch.new(batch_params)
+              batch = Spree::Translations::Batch.new(batch_params, store: current_store)
               return unless require_batch_scopes!(batch)
 
               records = batch.process! { |record| authorize!(:update, record) }

data/app/controllers/spree/api/v3/admin/translations_controller.rb

@@ -43,7 +43,7 @@ module Spree
           # translation tables.
           def parent_relation
             klass = parent_lookup.klass
-            relation = klass.respond_to?(:for_store) ? klass.for_store(current_store) : klass
+            relation = klass.respond_to?(:translatable_scope) ? klass.translatable_scope(current_store) : klass.for_store(current_store)
 
             children = klass.try(:translatable_children)
             children ? relation.includes(children => :translations) : relation

data/app/controllers/spree/api/v3/admin/webhook_deliveries_controller.rb

@@ -42,6 +42,18 @@ module Spree
               params[:webhook_endpoint_id]
             )
           end
+
+          # The payload is the record the event is about, so it is shown only
+          # to a caller who could read that record; the webhooks permission
+          # alone sees the delivery's status and response.
+          def serializer_params
+            super.merge(
+              payload_visible: lambda { |delivery|
+                key = delivery.payload_permission_key
+                key.nil? || holds_permission?(key)
+              }
+            )
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/admin/webhook_endpoints_controller.rb

@@ -8,6 +8,8 @@ module Spree
         class WebhookEndpointsController < ResourceController
           scoped_resource :webhooks
 
+          before_action :reject_unauthorized_credential_subscription!, only: [:create, :update]
+
           # POST /api/v3/admin/webhook_endpoints/:id/send_test
           #
           # Fires a synthetic `webhook.test` delivery so admins can verify the
@@ -68,6 +70,31 @@ module Spree
           def permitted_params
             params.permit(*model_additional_permitted_attributes, :name, :url, :active, subscriptions: [])
           end
+
+          private
+
+          # Customer password reset tokens are account credentials, so the
+          # webhooks permission alone cannot subscribe an endpoint to them, or
+          # repoint an endpoint that already receives them.
+          def reject_unauthorized_credential_subscription!
+            return if holds_permission?('write_customers')
+
+            requested = Array(permitted_params[:subscriptions]) & Spree::WebhookEndpoint::CREDENTIAL_EVENTS
+            return if requested.empty? && !repoints_credential_endpoint?
+
+            render_error(
+              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
+              message: "Receiving #{Spree::WebhookEndpoint::CREDENTIAL_EVENTS.to_sentence} requires permission to manage customers",
+              status: :forbidden
+            )
+          end
+
+          def repoints_credential_endpoint?
+            return false unless action_name == 'update'
+            return false unless permitted_params.key?(:url) || permitted_params.key?(:subscriptions)
+
+            current_store.webhook_endpoints.find_by_prefix_id(params[:id])&.receives_credentials?
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/base_controller.rb

@@ -81,7 +81,10 @@ module Spree
           if errors.is_a?(ActiveModel::Errors)
             render_validation_error(errors)
           else
-            render_service_error(error)
+            # The unwrapped value, so a workflow's rejection symbol reaches
+            # the branch that translates it rather than the one that prints
+            # the wrapper.
+            render_service_error(errors)
           end
         end
 
@@ -108,10 +111,11 @@ module Spree
           try_spree_current_user
         end
 
-        # CanCanCan ability
+        # CanCanCan ability, built from the swappable
+        # `Spree::Dependencies.ability_class` (Spree::Ability by default).
         # @return [Spree::Ability]
         def current_ability
-          @current_ability ||= Spree::Ability.new(current_user, ability_options)
+          @current_ability ||= Spree.ability_class.new(current_user, ability_options)
         end
 
         # Options passed to the CanCanCan ability

data/app/controllers/spree/api/v3/resource_controller.rb

@@ -254,7 +254,7 @@ module Spree
 
           @search = scope.includes(collection_includes).
                     preload_associations_lazily.
-                    ransack(ransack_params)
+                    ransack(ransack_params, auth_object: ransack_auth_object)
           result = @search.result(distinct: collection_distinct?)
           pagy_options = { limit: limit, page: page }
           result = apply_collection_sort(result)
@@ -262,6 +262,16 @@ module Spree
           @collection
         end
 
+        # Who is filtering, as Ransack's auth object. Nil is the back office,
+        # which may use every allowlisted attribute; the Store and Seller
+        # branches name themselves so the models narrow what they may reach
+        # (see Spree::RansackableAttributes). Covers sorting too.
+        #
+        # @return [Symbol, nil]
+        def ransack_auth_object
+          nil
+        end
+
         # Override in subclass to disable distinct (e.g., for custom sorting with computed columns)
         # @return [Boolean] whether to apply distinct to the collection
         def collection_distinct?

data/app/controllers/spree/api/v3/seller/auth_controller.rb

@@ -136,7 +136,7 @@ module Spree
           def auth_response(user)
             {
               token: generate_jwt(user, audience: Spree::Api::V3::JwtAuthentication::JWT_AUDIENCE_SELLER),
-              user: Spree.api.seller_team_member_serializer.new(user, params: { store: user.sellers.first&.store }).to_h,
+              user: Spree.api.seller_account_serializer.new(user, params: { store: user.sellers.first&.store }).to_h,
               sellers: serialized_sellers(user)
             }
           end

data/app/controllers/spree/api/v3/seller/invitation_acceptances_controller.rb

@@ -94,7 +94,10 @@ module Spree
           end
 
           def authenticate_existing(user)
-            return user if user.valid_password?(params[:password].to_s)
+            # Under the login lockout: otherwise this is an unthrottled way to
+            # guess an existing account's password with an invitation token.
+            verdict = Spree::Authentication::Lockout.check(user) { user.valid_password?(params[:password].to_s) }
+            return user if verdict == :valid
 
             render_error(
               code: ErrorHandler::ERROR_CODES[:authentication_failed],
@@ -127,7 +130,7 @@ module Spree
           def auth_response(user)
             {
               token: generate_jwt(user, audience: Spree::Api::V3::JwtAuthentication::JWT_AUDIENCE_SELLER),
-              user: Spree.api.seller_team_member_serializer.new(
+              user: Spree.api.seller_account_serializer.new(
                 user, params: { store: @invitation.store }
               ).to_h,
               sellers: serialized_sellers(user)

data/app/controllers/spree/api/v3/seller/invitations/acceptance_links_controller.rb

@@ -0,0 +1,34 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        module Invitations
+          # The acceptance link of a pending invitation onto this seller's team.
+          #
+          # The link carries the token that joins the team, so it is authorized
+          # like inviting someone: write access to the seller profile. Rooted at
+          # `current_seller.invitations`, so another seller's invitation reads
+          # as missing.
+          class AcceptanceLinksController < Seller::BaseController
+            scoped_resource :seller_profile
+
+            # GET /api/v3/seller/invitations/:invitation_id/acceptance_link
+            def show
+              invitation = current_seller.invitations.pending.find_by_prefix_id!(params[:invitation_id])
+
+              render json: Spree.api.seller_invitation_acceptance_link_serializer.new(
+                invitation, params: { store: current_store }
+              ).to_h
+            end
+
+            protected
+
+            def read_actions
+              []
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/seller/me_controller.rb

@@ -20,11 +20,32 @@ module Spree
             render json: me_response
           end
 
+          # Self-service update of the signed-in person's own account — the
+          # name and photo their team sees, and the panel's language. It
+          # operates on `current_user` directly, so it needs no per-record
+          # authorization, and no seller role either: this is theirs whichever
+          # seller they are acting for.
+          #
+          # Distinct from PATCH /profile, which writes the seller business.
+          # `avatar` accepts an ActiveStorage direct-upload signed id to set
+          # the photo, or `null` to remove it.
+          def update
+            if current_user.update(permitted_params)
+              render json: me_response
+            else
+              render_validation_error(current_user.errors)
+            end
+          end
+
           private
 
+          def permitted_params
+            params.permit(:selected_locale, :first_name, :last_name, :avatar)
+          end
+
           def me_response
             {
-              user: Spree.api.seller_team_member_serializer.new(current_user, params: serializer_params).to_h,
+              user: Spree.api.seller_account_serializer.new(current_user, params: serializer_params).to_h,
               sellers: serialized_sellers,
               # Both shapes, exactly as the admin `/me`: the panel's `<Can>`
               # reads CanCanCan rules, the key gate reads keys. Sending only
@@ -44,7 +65,9 @@ module Spree
           # Empty until a seller is named: capability is per seller, so there is
           # no meaningful answer spanning all of them. A bare ability (no
           # resource) serializes to nothing rather than raising, so the panel
-          # can call `/me` before choosing a seller.
+          # can call `/me` before choosing a seller. Deliberately the core
+          # class, not `Spree.ability_class`: a custom ability may add rules
+          # after `super`, and those must not leak into the no-seller answer.
           def seller_ability
             return Spree::Ability.new(nil) if current_seller.nil?
 

data/app/controllers/spree/api/v3/seller/orders_controller.rb

@@ -77,7 +77,11 @@ module Spree
             # each lay their fields over the same snapshot, and the later one
             # would undo the earlier one's lines.
             with_order_lock do
-              if @resource.update(address_params)
+              addresses = corrected_addresses
+              invalid = addresses.values.find(&:invalid?)
+              next render_validation_error(invalid.errors) if invalid
+
+              if @resource.update(addresses)
                 render json: serialize_resource(@resource.reload)
               else
                 render_validation_error(@resource.errors)
@@ -115,9 +119,10 @@ module Spree
           # Either address, as a correction rather than a replacement: the
           # sent fields are laid over what the order already holds, so a
           # request naming one line does not blank out the country and
-          # postcode beside it. The nested writer builds a fresh address row
-          # either way, which is what keeps a shared customer address book
-          # entry from being rewritten by an order-level fix.
+          # postcode beside it. Written as a fresh ownerless snapshot straight
+          # onto the order — never through the buyer's nested writer, which
+          # files the address in their book and makes it their default for
+          # every later checkout on the marketplace.
           def sent_addresses
             @sent_addresses ||= params.permit(
               shipping_address: address_permitted_keys,
@@ -125,32 +130,22 @@ module Spree
             ).slice(:shipping_address, :billing_address).reject { |_key, value| value.blank? }
           end
 
-          def address_params
-            permitted = sent_addresses
-
-            {}.tap do |attributes|
-              if permitted[:shipping_address].present?
-                attributes[:ship_address_attributes] =
-                  merged_address(@resource.ship_address, permitted[:shipping_address])
+          def corrected_addresses
+            {}.tap do |addresses|
+              if sent_addresses[:shipping_address].present?
+                addresses[:ship_address] = corrected_address(@resource.ship_address, sent_addresses[:shipping_address])
               end
 
-              if permitted[:billing_address].present?
-                attributes[:bill_address_attributes] =
-                  merged_address(@resource.bill_address, permitted[:billing_address])
+              if sent_addresses[:billing_address].present?
+                addresses[:bill_address] = corrected_address(@resource.bill_address, sent_addresses[:billing_address])
               end
             end
           end
 
-          def merged_address(address, sent)
-            current = address ? address.attributes.slice(*address_attribute_names) : {}
-            current.merge(sent.to_h)
-          end
-
-          # The permitted keys that are real columns; the rest are the writer
-          # aliases a client may send, which have no value to carry over.
-          def address_attribute_names
-            @address_attribute_names ||=
-              address_permitted_keys.map(&:to_s) & Spree::Address.column_names
+          def corrected_address(address, sent)
+            # No label: an address-book label means nothing on an order's copy,
+            # and labels are unique per owner, which an ownerless copy lacks.
+            (address&.snapshot || Spree::Address.new).tap { |copy| copy.assign_attributes(sent.to_h.except('label', :label)) }
           end
 
           def address_permitted_keys

data/app/controllers/spree/api/v3/seller/password_resets_controller.rb

@@ -128,7 +128,7 @@ module Spree
           def auth_response(user)
             {
               token: generate_jwt(user, audience: Spree::Api::V3::JwtAuthentication::JWT_AUDIENCE_SELLER),
-              user: Spree.api.seller_team_member_serializer.new(
+              user: Spree.api.seller_account_serializer.new(
                 user, params: { store: seller_store(user) }
               ).to_h,
               sellers: serialized_sellers(user)

data/app/controllers/spree/api/v3/seller/resource_controller.rb

@@ -18,6 +18,10 @@ module Spree
             authenticate_seller!
           end
 
+          def ransack_auth_object
+            :seller
+          end
+
           # Every collection is rooted in the seller's own records.
           #
           # The inherited implementation roots at `for_store(current_store)`,

data/app/controllers/spree/api/v3/store/carts/items_controller.rb

@@ -97,12 +97,15 @@ module Spree
             end
 
             # Extension attributes ride in `options`, which is how AddItem
-            # forwards per-line-item values onto the record.
+            # forwards per-line-item values onto the record. Only those reach
+            # it: anything else in `options` is internal to AddItem (the
+            # fulfillment an admin pins a line to) and not the shopper's to set.
             def item_options
-              keys = Spree::LineItem.additional_permitted_attributes.flat_map { |a| a.is_a?(Hash) ? a.keys : a }
-              extras = permitted_params.to_h.slice(*keys.map(&:to_s)).symbolize_keys
+              keys = Spree::LineItem.additional_permitted_attributes.flat_map { |a| a.is_a?(Hash) ? a.keys : a }.map(&:to_s)
 
-              (permitted_params[:options] || {}).to_h.symbolize_keys.merge(extras)
+              (permitted_params[:options] || {}).to_h.slice(*keys).
+                merge(permitted_params.to_h.slice(*keys)).
+                symbolize_keys
             end
 
             def permitted_params

data/app/controllers/spree/api/v3/store/carts/payment_sessions_controller.rb

@@ -13,7 +13,16 @@ module Spree
             # POST /api/v3/store/carts/:cart_id/payment_sessions
             def create
               with_order_lock do
-                payment_method = current_store.payment_methods.find_by_prefix_id!(permitted_params[:payment_method_id])
+                payment_method = current_store.payment_methods.active.storefront_visible.
+                                 find_by_prefix_id!(permitted_params[:payment_method_id])
+
+                unless payment_method.available_for_order?(@cart)
+                  return render_error(
+                    code: 'payment_method_unavailable',
+                    message: Spree.t('api.v3.payments.method_unavailable'),
+                    status: :unprocessable_content
+                  )
+                end
 
                 @payment_session = payment_method.create_payment_session(
                   order: @cart,

data/app/controllers/spree/api/v3/store/carts/payments_controller.rb

@@ -11,7 +11,11 @@ module Spree
             # POST /api/v3/store/carts/:cart_id/payments
             # Creates a payment for non-session payment methods (e.g. Check, Cash on Delivery, Bank Transfer)
             def create
-              payment_method = current_store.payment_methods.find_by_prefix_id!(params[:payment_method_id])
+              # The same methods the cart offers: a disabled or staff-only
+              # method (an offline one marks the order paid) must not be
+              # reachable by naming its id.
+              payment_method = current_store.payment_methods.active.storefront_visible.
+                               find_by_prefix_id!(params[:payment_method_id])
 
               if payment_method.session_required?
                 return render_error(

data/app/controllers/spree/api/v3/store/companies/members_controller.rb

@@ -4,26 +4,25 @@ module Spree
       module Store
         module Companies
           # The people with standing over one node, listed and added by its
-          # members. Adding takes an email and does the right thing: a
-          # membership for an existing customer, an invitation otherwise —
-          # the same convergent behavior as the dashboard endpoint. Any member
-          # can invite; restraint is Enterprise's policy layer.
+          # members. Adding takes an email and always sends an invitation,
+          # even to an existing customer: a member typing an address cannot
+          # vouch that it is the person they mean, so the invitee accepts with
+          # the emailed token. The response is the same whether or not the
+          # email has an account. Any member can invite; restraint is
+          # Enterprise's policy layer.
           class MembersController < BaseController
             # POST /api/v3/store/companies/:company_id/members
             def create
               result = Spree.company_add_member_service.call(
                 company: @parent,
                 email: params.require(:customer_email),
-                inviter: current_user
+                inviter: current_user,
+                require_acceptance: true
               )
 
               if result.success?
-                serializer = if result.value.is_a?(Spree::CompanyInvitation)
-                               Spree.api.company_invitation_serializer
-                             else
-                               serializer_class
-                             end
-                render json: serializer.new(result.value, params: serializer_params).to_h, status: :created
+                render json: Spree.api.company_invitation_serializer.new(result.value, params: serializer_params).to_h,
+                       status: :created
               else
                 render_validation_error(result.value.errors)
               end

data/app/controllers/spree/api/v3/store/companies/orders_controller.rb

@@ -20,6 +20,12 @@ module Spree
               current_store.orders.complete.
                 where(company_id: @parent.self_and_descendants.select(:id))
             end
+
+            # These are other members' orders: gift card codes and download
+            # links are the buyer's credentials, not the company's.
+            def serializer_params
+              super.merge(hide_credentials: true)
+            end
           end
         end
       end

data/app/controllers/spree/api/v3/store/products/filters_controller.rb

@@ -40,6 +40,7 @@ module Spree
                 current_store.id,
                 current_currency,
                 current_locale,
+                (hide_prices? ? 'prices_hidden' : nil),
                 category&.cache_key_with_version,
                 collection&.cache_key_with_version,
                 search_query,