spree_api 6.0.0.beta2 → 6.0.0.beta3

data/app/controllers/spree/api/v3/store/products_controller.rb

@@ -5,6 +5,7 @@ module Spree
         class ProductsController < ResourceController
           include Spree::Api::V3::HttpCaching
           include Spree::Api::V3::Store::SearchProviderSupport
+          include Spree::Api::V3::Store::StorefrontProducts
 
           protected
 
@@ -28,19 +29,12 @@ module Spree
             end
           end
 
+          # Catalog narrowing for the buyer: their company's effective
+          # catalogs, their group's, or the channel default — union of
+          # assortments, resolved in one place
+          # (docs/plans/6.0-b2b-companies-and-catalogs.md).
           def scope
-            base = super.available(Time.current, Spree::Current.currency, include_preorderable: true)
-
-            # Catalog narrowing for the buyer: their company's effective
-            # catalogs, their group's, or the channel default — union of
-            # assortments, resolved in one place
-            # (docs/plans/6.0-b2b-companies-and-catalogs.md).
-            Spree.products_for_context_service.call(
-              store: current_store,
-              channel: current_channel,
-              customer: current_user,
-              base: base
-            ).value
+            storefront_products(super)
           end
 
           # these scopes are not automatically picked by ar_lazy_preload gem and we need to explicitly include them

data/app/controllers/spree/api/v3/store/resource_controller.rb

@@ -28,6 +28,10 @@ module Spree
           def authenticate_request!
             authenticate_api_key!
           end
+
+          def ransack_auth_object
+            :store
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/wishlist_items_controller.rb

@@ -3,6 +3,8 @@ module Spree
     module V3
       module Store
         class WishlistItemsController < ResourceController
+          include Spree::Api::V3::Store::StorefrontProducts
+
           prepend_before_action :require_authentication!
 
           protected
@@ -29,6 +31,15 @@ module Spree
           def resource_permitted_attributes
             [:variant_id, :quantity]
           end
+
+          # The item renders its variant and product, so the variant must be
+          # one the buyer could find in the listing — not a draft, another
+          # catalog's product, or an id guessed from the sequence.
+          def permitted_params
+            @permitted_params ||= super.tap do |attributes|
+              attributes[:variant_id] = storefront_variants.find_by_prefix_id!(params[:variant_id]).id if params.key?(:variant_id)
+            end
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/webhooks/fulfillments_controller.rb

@@ -15,7 +15,6 @@ module Spree
         # sender's timeout.
         class FulfillmentsController < ActionController::API
           include ActionController::RateLimiting
-          include Spree::Core::ControllerHelpers::Store
 
           # Must render — instance_exec'd in a before_action, where only
           # render/redirect halts the chain.
@@ -31,12 +30,17 @@ module Spree
                      with: RATE_LIMIT_RESPONSE
 
           def create
-            integration = current_store.integrations.active.find_by_prefix_id!(params[:integration_id])
+            # By id alone: providers call back without an API key or store
+            # header, so the request cannot name the store — the record does.
+            # The signature check below, against the record's own secret, is
+            # what authenticates the request.
+            integration = Spree::Integration.active.find_by_prefix_id!(params[:integration_id])
+            Spree::Current.store = integration.store
 
             event = integration.parse_webhook_event(request.raw_post, request.headers)
             return head :ok if event.nil?
 
-            delivery = find_delivery(event[:tracking_code])
+            delivery = find_delivery(integration.store, event[:tracking_code])
             return head :ok if delivery.nil?
 
             Spree.delivery_update_tracking_workflow.call(
@@ -57,7 +61,7 @@ module Spree
           private
 
           # Scoped to the store the verified integration belongs to — a
-          # tracking code can never address another tenant's parcel — and to
+          # tracking code can never address another store's parcel — and to
           # consignments whose parcel was not canceled, so a recycled code
           # cannot reopen an old one. The newest wins when a code was reused.
           # Carriers reuse tracking numbers across years, so a code can match
@@ -67,14 +71,14 @@ module Spree
           # database. The newest survivor wins.
           CANDIDATE_LIMIT = 20
 
-          def find_delivery(tracking_code)
+          def find_delivery(store, tracking_code)
             return if tracking_code.blank?
 
             # Paged rather than capped: a tracking number reused across
             # canceled owners would otherwise fill the window and hide the
             # live delivery behind them, and the webhook would be
             # acknowledged without applying the carrier's update.
-            current_store.deliveries.
+            store.deliveries.
               where(tracking_number: tracking_code).
               order(created_at: :desc, id: :desc).
               includes(:owner).

data/app/controllers/spree/api/v3/webhooks/payments_controller.rb

@@ -4,7 +4,6 @@ module Spree
       module Webhooks
         class PaymentsController < ActionController::API
           include ActionController::RateLimiting
-          include Spree::Core::ControllerHelpers::Store
 
           # Must render — instance_exec'd in a before_action, where only
           # render/redirect halts the chain.
@@ -24,7 +23,12 @@ module Spree
           # Verifies the webhook signature synchronously (returns 401 if invalid),
           # then enqueues async processing and returns 200 immediately.
           def create
-            payment_method = current_store.payment_methods.find_by_prefix_id!(params[:payment_method_id])
+            # By id alone: providers call back without an API key or store
+            # header, so the request cannot name the store — the record does.
+            # The signature check below, against the record's own secret, is
+            # what authenticates the request.
+            payment_method = Spree::PaymentMethod.find_by_prefix_id!(params[:payment_method_id])
+            Spree::Current.store = payment_method.store
 
             # Signature verification must be synchronous — invalid = 401
             result = payment_method.parse_webhook_event(request.raw_post, request.headers)

data/app/controllers/spree/api/v3/webhooks/payouts_controller.rb

@@ -19,7 +19,6 @@ module Spree
         # database writes, well inside any sender's timeout.
         class PayoutsController < ActionController::API
           include ActionController::RateLimiting
-          include Spree::Core::ControllerHelpers::Store
 
           # Must render — instance_exec'd in a before_action, where only
           # render/redirect halts the chain.
@@ -35,7 +34,12 @@ module Spree
                      with: RATE_LIMIT_RESPONSE
 
           def create
-            payment_method = current_store.payment_methods.find_by_prefix_id!(params[:payment_method_id])
+            # By id alone: providers call back without an API key or store
+            # header, so the request cannot name the store — the record does.
+            # The signature check below, against the record's own secret, is
+            # what authenticates the request.
+            payment_method = Spree::PaymentMethod.find_by_prefix_id!(params[:payment_method_id])
+            Spree::Current.store = payment_method.store
             return head :not_found unless payment_method.respond_to?(:handle_payout_webhook)
 
             payment_method.handle_payout_webhook(request.raw_post, request.headers)

data/app/jobs/spree/webhook_delivery_job.rb

@@ -2,11 +2,19 @@
 
 module Spree
   class WebhookDeliveryJob < Spree::BaseJob
+    # Raised when the endpoint answered with anything other than 2xx, timed
+    # out or could not be reached, so the delivery is sent again with backoff.
+    class DeliveryFailed < StandardError; end
+
     queue_as Spree.queues.webhooks
 
-    # Webhook delivery hits external endpoints; broad retry covers network timeouts,
-    # 5xx, DNS failures, etc.
+    # Delivery is retry-safe: each attempt overwrites the outcome on the same
+    # delivery record, and receivers deduplicate on the event id.
     retry_on StandardError, wait: :polynomially_longer, attempts: 5
+    # The outcome of the last attempt is already on the delivery record, so an
+    # exhausted retry is not re-raised into the queue backend.
+    retry_on DeliveryFailed, wait: :polynomially_longer, attempts: 5 do |_job, _error|
+    end
     # Must come after `retry_on StandardError` so DeserializationError lands in discard
     # (ActiveJob handler lookup is reverse-declaration-order).
     discard_on ActiveJob::DeserializationError
@@ -21,9 +29,15 @@ module Spree
       delivery = Spree::WebhookDelivery.find_by(id: delivery_id)
       return if delivery.nil?
 
+      endpoint = delivery.webhook_endpoint
+      return if endpoint.nil?
+      # A retry stops once the endpoint was switched off, by hand or by auto-disable.
+      return if executions > 1 && !endpoint.active?
+
       delivery.payload_secrets = payload_secrets
-      secret_key = delivery.webhook_endpoint.secret_key
-      Spree::Webhooks::DeliverWebhook.call(delivery: delivery, secret_key: secret_key)
+      Spree::Webhooks::DeliverWebhook.call(delivery: delivery, secret_key: endpoint.secret_key)
+
+      raise DeliveryFailed, "Webhook delivery #{delivery.prefixed_id} failed" if delivery.failed?
     end
   end
 end

data/app/serializers/spree/api/v3/admin/gift_card_serializer.rb

@@ -18,6 +18,12 @@ module Spree
 
           attributes created_at: :iso8601, updated_at: :iso8601
 
+          # A bearer credential: in full only to a caller who may read gift
+          # cards, masked when the card rides along on an order.
+          attribute :code do |gift_card|
+            params[:gift_card_codes] ? gift_card.display_code : gift_card.masked_code
+          end
+
           attribute :customer_id do |gift_card|
             gift_card.customer&.prefixed_id
           end

data/app/serializers/spree/api/v3/admin/invitation_acceptance_link_serializer.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # The acceptance link of one staff invitation, served on its own so the
+        # token never travels with the invitation listing.
+        class InvitationAcceptanceLinkSerializer < V3::BaseSerializer
+          typelize acceptance_url: :string
+
+          attributes :acceptance_url
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/invitation_serializer.rb

@@ -13,7 +13,6 @@ module Spree
                    role_name: :string,
                    inviter_email: :string,
                    expires_at: :string,
-                   acceptance_url: :string,
                    invitee_exists: :boolean,
                    store: '{ id: string; name: string }'
 
@@ -34,16 +33,6 @@ module Spree
             invitation.inviter.email
           end
 
-          # Absolute URL when a dashboard origin is configured, otherwise the
-          # path so the SPA can prepend `window.location.origin`.
-          attribute :acceptance_url do |invitation|
-            if Spree::Config[:dashboard_url].present?
-              Rails.application.routes.url_helpers.admin_invitation_acceptance_url(invitation)
-            else
-              "/accept-invitation/#{invitation.prefixed_id}?token=#{invitation.token}"
-            end
-          end
-
           # Drives the SPA's sign-in vs sign-up branch on the acceptance page.
           # Looked up by email so an admin who's already on another store sees
           # the password prompt, not a fresh account form.

data/app/serializers/spree/api/v3/admin/order_group_serializer.rb

@@ -13,6 +13,8 @@ module Spree
                    cart_id: 'string | null',
                    seller_count: :number,
                    includes_first_party: :boolean,
+                   confirmation_delivered: :boolean,
+                   store_owner_notification_delivered: :boolean,
                    created_at: :string, updated_at: :string
 
           attribute :customer_id do |group|
@@ -34,6 +36,11 @@ module Spree
             group.includes_first_party?
           end
 
+          # A split checkout is confirmed once, from here — every child order
+          # places silently, so their own flags are false and only the group
+          # can answer whether the customer was told.
+          attributes :confirmation_delivered, :store_owner_notification_delivered
+
           attributes :created_at, :updated_at
 
           # Re-declared against the admin serializers. Inheriting the store

data/app/serializers/spree/api/v3/admin/store_serializer.rb

@@ -42,6 +42,10 @@ module Spree
                    preferred_payout_provider: 'string | null',
                    preferred_default_payouts_schedule_interval: :string,
                    preferred_default_minimum_payout_amount: :number,
+                   preferred_auto_approve_sellers: :boolean,
+                   preferred_auto_approve_seller_products: :boolean,
+                   preferred_send_seller_transactional_emails: :boolean,
+                   preferred_default_commission_tax_rate: :number,
                    preferred_document_number_format: :string,
                    preferred_order_number_prefix: :string,
                    preferred_order_number_suffix: :string,
@@ -90,6 +94,10 @@ module Spree
                      :preferred_payout_provider,
                      :preferred_default_payouts_schedule_interval,
                      :preferred_default_minimum_payout_amount,
+                     :preferred_auto_approve_sellers,
+                     :preferred_auto_approve_seller_products,
+                     :preferred_send_seller_transactional_emails,
+                     :preferred_default_commission_tax_rate,
                      :preferred_document_number_format,
                      :preferred_order_number_prefix,
                      :preferred_order_number_suffix,

data/app/serializers/spree/api/v3/admin/webhook_delivery_serializer.rb

@@ -19,7 +19,7 @@ module Spree
                    response_body: [:string, nullable: true],
                    success: [:boolean, nullable: true],
                    delivered_at: [:string, nullable: true],
-                   payload: 'Record<string, unknown>',
+                   payload: ['Record<string, unknown>', nullable: true],
                    webhook_endpoint_id: :string,
                    webhook_endpoint_url: :string
 
@@ -29,8 +29,12 @@ module Spree
                      delivered_at: :iso8601
 
           # Redacted again on read: deliveries written before payload redaction
-          # shipped still hold live credentials in the column.
+          # shipped still hold live credentials in the column. Null when the
+          # caller cannot read the record the event is about.
           attribute :payload do |delivery|
+            visible = params[:payload_visible]
+            next nil if visible && !visible.call(delivery)
+
             Spree::WebhookPayloadRedaction.split(delivery.payload).first
           end
 

data/app/serializers/spree/api/v3/gift_card_serializer.rb

@@ -17,8 +17,10 @@ module Spree
                  expired: :boolean,
                  active: :boolean
 
+        # A bearer credential: masked when the order is shown to someone other
+        # than its buyer (a company's other members).
         attribute :code do |gift_card|
-          gift_card.display_code
+          params[:hide_credentials] ? gift_card.masked_code : gift_card.display_code
         end
 
         attribute :status do |gift_card|

data/app/serializers/spree/api/v3/line_item_serializer.rb

@@ -71,7 +71,8 @@ module Spree
             if: proc { expand?('seller') }
 
         many :option_values, resource: proc { Spree.api.option_value_serializer }
-        many :digital_links, resource: proc { Spree.api.digital_link_serializer }
+        # Download links carry a bearer token; only the buyer gets them.
+        many :digital_links, resource: proc { Spree.api.digital_link_serializer }, if: proc { !params[:hide_credentials] }
         # Tax hangs off its adjustable, never off the cart or order: the
         # exactly-one-adjustable rule makes the nested view complete, and the
         # owner already carries the tax totals.

data/app/serializers/spree/api/v3/market_serializer.rb

@@ -6,11 +6,16 @@ module Spree
                  default_locale: :string,
                  supported_locales: [:string, multi: true],
                  country_codes: [:string, multi: true],
+                 country_isos: [:string, multi: true],
                  tax_inclusive: :boolean,
                  default: :boolean
 
         attributes :name, :currency, :default_locale, :tax_inclusive, :default, :country_codes
 
+        # @deprecated Storefronts shipped against this name; use +country_codes+.
+        #   Removed in 6.1.
+        attribute :country_isos, &:country_codes
+
         attribute :supported_locales do |market|
           market.supported_locales_list
         end

data/app/serializers/spree/api/v3/product_filters_serializer.rb

@@ -12,6 +12,9 @@ module Spree
         attribute :filters do |result|
           result.filters.filter_map do |filter|
             filter_type = filter[:type]
+            # A price range is prices; a gated guest sees none.
+            next if filter_type == 'price_range' && params[:hide_prices]
+
             serializer_class = case filter_type
                                when 'price_range'
                                  Spree.api.product_filter_price_range_serializer

data/app/serializers/spree/api/v3/seller/account_serializer.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # The signed-in person's own account, as `/me` answers it.
+        #
+        # Extends the team member shape rather than widening it: `selected_locale`
+        # is a preference its owner sets, and the team list serializes colleagues
+        # with the parent — where publishing each member's chosen language would
+        # tell the whole team something none of them asked to share.
+        class AccountSerializer < Seller::TeamMemberSerializer
+          typelize selected_locale: [:string, nullable: true]
+
+          attributes :selected_locale
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/seller/invitation_acceptance_link_serializer.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # The acceptance link of one seller-team invitation, served on its own
+        # so the token never travels with the invitation listing.
+        class InvitationAcceptanceLinkSerializer < V3::BaseSerializer
+          typelize acceptance_url: :string
+
+          attributes :acceptance_url
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/seller/invitation_serializer.rb

@@ -5,8 +5,7 @@ module Spree
         class InvitationSerializer < V3::BaseSerializer
           typelize email: :string, status: [:string, enum: Spree::Invitation.statuses, enum_type_name: 'InvitationStatus'],
                    expires_at: [:string, nullable: true],
-                   accepted_at: [:string, nullable: true],
-                   acceptance_url: :string
+                   accepted_at: [:string, nullable: true]
 
           attributes :email,
                      created_at: :iso8601, expires_at: :iso8601, accepted_at: :iso8601
@@ -14,14 +13,6 @@ module Spree
           attribute :status do |invitation|
             invitation.status.to_s
           end
-
-          attribute :acceptance_url do |invitation|
-            if Spree::Config[:seller_panel_url].present? || Spree::Config[:dashboard_url].present?
-              Rails.application.routes.url_helpers.admin_invitation_acceptance_url(invitation)
-            else
-              "/accept-invitation/#{invitation.prefixed_id}?token=#{invitation.token}"
-            end
-          end
         end
       end
     end

data/app/services/spree/api/v3/filters_aggregator.rb

@@ -51,8 +51,11 @@ module Spree
 
 
         def price_filter
-          # Remove ordering to avoid PostgreSQL DISTINCT + ORDER BY conflicts
-          prices = Spree::Price.for_products(@scope.reorder(''), @currency)
+          # Remove ordering to avoid PostgreSQL DISTINCT + ORDER BY conflicts.
+          # Base prices only: a price list's rows are for its own audience
+          # (a company's contract, a draft or scheduled list), and the range is
+          # shown to everyone.
+          prices = Spree::Price.base_prices.for_products(@scope.reorder(''), @currency)
           min = prices.minimum(:amount)
           max = prices.maximum(:amount)
           return nil if min.nil? || max.nil?

data/config/routes.rb

@@ -273,6 +273,7 @@ Spree::Core::Engine.add_routes do
           member do
             patch :resend
           end
+          resource :acceptance_link, only: [:show], controller: 'invitations/acceptance_links'
         end
         resources :api_keys, only: [:index, :show, :create, :update, :destroy] do
           collection do
@@ -590,6 +591,7 @@ Spree::Core::Engine.add_routes do
             member do
               patch :resend
             end
+            resource :acceptance_link, only: [:show], controller: 'sellers/invitations/acceptance_links'
           end
 
           # What this seller submitted about the requirements, and the
@@ -875,6 +877,10 @@ Spree::Core::Engine.add_routes do
         patch 'auth/password_resets/:id', to: 'password_resets#update'
 
         get 'me', to: 'me#show'
+        # Self-service edits to the signed-in person's own account — their
+        # name, photo and panel language. Distinct from `profile`, which is
+        # the seller business they act for.
+        patch 'me', to: 'me#update'
 
         # Singular: the seller in play is always `current_seller`.
         resource :profile, only: [:show, :update], controller: 'profile'
@@ -896,6 +902,7 @@ Spree::Core::Engine.add_routes do
           member do
             patch :resend
           end
+          resource :acceptance_link, only: [:show], controller: 'invitations/acceptance_links'
         end
 
         resources :products, only: [:index, :show, :create, :update, :destroy] do

data/lib/spree/api/dependencies.rb

@@ -187,7 +187,9 @@ module Spree
         seller_profile_serializer: 'Spree::Api::V3::Seller::ProfileSerializer',
         seller_policy_serializer: 'Spree::Api::V3::Seller::PolicySerializer',
         seller_team_member_serializer: 'Spree::Api::V3::Seller::TeamMemberSerializer',
+        seller_account_serializer: 'Spree::Api::V3::Seller::AccountSerializer',
         seller_invitation_serializer: 'Spree::Api::V3::Seller::InvitationSerializer',
+        seller_invitation_acceptance_link_serializer: 'Spree::Api::V3::Seller::InvitationAcceptanceLinkSerializer',
         seller_product_serializer: 'Spree::Api::V3::Seller::ProductSerializer',
         seller_product_type_serializer: 'Spree::Api::V3::Seller::ProductTypeSerializer',
         seller_delivery_profile_serializer: 'Spree::Api::V3::Seller::DeliveryProfileSerializer',
@@ -267,6 +269,7 @@ module Spree
         admin_webhook_endpoint_serializer: 'Spree::Api::V3::Admin::WebhookEndpointSerializer',
         admin_webhook_delivery_serializer: 'Spree::Api::V3::Admin::WebhookDeliverySerializer',
         admin_invitation_serializer: 'Spree::Api::V3::Admin::InvitationSerializer',
+        admin_invitation_acceptance_link_serializer: 'Spree::Api::V3::Admin::InvitationAcceptanceLinkSerializer',
         admin_role_serializer: 'Spree::Api::V3::Admin::RoleSerializer',
         admin_permission_serializer: 'Spree::Api::V3::Admin::PermissionSerializer',
         admin_export_serializer: 'Spree::Api::V3::Admin::ExportSerializer',

data/lib/spree/api/openapi/schema_helper.rb

@@ -250,8 +250,8 @@ module Spree
         #
         # The seller branch has no API-key credential, so its AuthResponse is
         # neither the store's nor the admin's: signing in returns the JWT, the
-        # team member who signed in, and the sellers they may act for — the
-        # panel cannot make another request until it has picked one.
+        # person who signed in, and the sellers they may act for — the panel
+        # cannot make another request until it has picked one.
         def seller_schemas
           schemas = common_schemas
 
@@ -259,7 +259,10 @@ module Spree
             type: :object,
             properties: {
               token: { type: :string, description: 'JWT access token, `seller_api` audience' },
-              user: { '$ref' => '#/components/schemas/TeamMember' },
+              # `Account`, not `TeamMember`: the panel adopts the signed-in
+              # person's saved language from this payload, which is what
+              # carries the choice to a second browser.
+              user: { '$ref' => '#/components/schemas/Account' },
               sellers: {
                 type: :array,
                 description: 'The sellers this user may act for. Pick one and send its `id` as `X-Spree-Seller-Id` on every subsequent request.',
@@ -309,7 +312,10 @@ module Spree
               type: :object,
               description: 'The signed-in user, the sellers they may act for, and what they may do on the selected one',
               properties: {
-                user: { '$ref' => '#/components/schemas/TeamMember' },
+                # `Account`, not `TeamMember`: the person reading their own
+                # record also sees the panel language they chose, which the
+                # team list does not publish about a colleague.
+                user: { '$ref' => '#/components/schemas/Account' },
                 sellers: { type: :array, items: { '$ref' => '#/components/schemas/SellerMeSummary' } },
                 permissions: { type: :array, items: { '$ref' => '#/components/schemas/PermissionRule' } },
                 permission_keys: {