spree_api 6.0.0.beta4 → 6.0.0.rc1

data/app/controllers/spree/api/v3/admin/email_templates/test_emails_controller.rb

@@ -0,0 +1,40 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module EmailTemplates
+          class TestEmailsController < Admin::BaseController
+            include Spree::Api::V3::Admin::EmailTemplateLookup
+
+            before_action :authorize_sample_data!
+
+            # POST /api/v3/admin/email_templates/:email_template_id/test_email
+            #
+            # Sends the template, rendered as the preview renders it, to the
+            # signed-in admin. Never to another address: the sample data comes
+            # from a real customer's records.
+            def create
+              authorize! :update, Spree::EmailTemplate
+              return render_no_recipient unless current_user
+
+              build_preview.call
+              Spree::EmailTemplateMailer.test_email(current_store, current_user.email, email_template.key, **preview_arguments).deliver_later
+
+              render json: { sent_to: current_user.email }, status: :accepted
+            end
+
+            private
+
+            def render_no_recipient
+              render_error(
+                code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:invalid_request],
+                message: I18n.t('spree.email_templates.test_email_needs_admin'),
+                status: :unprocessable_content
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/email_templates_controller.rb

@@ -0,0 +1,46 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # The customer email templates, layout and shared partials merchants
+        # may edit, addressed by their key with dots
+        # (`spree.order_mailer.confirm_email`). `language` picks the version:
+        # a language code, or `any` (the default) for every language.
+        class EmailTemplatesController < Admin::BaseController
+          include Spree::Api::V3::Admin::EmailTemplateLookup
+
+          skip_before_action :load_email_template, only: :index
+
+          # GET /api/v3/admin/email_templates
+          def index
+            authorize! :read, Spree::EmailTemplate
+
+            entries = Spree::EmailTemplates::Entry.all(current_store, locale: language)
+            render json: { data: serialize_collection(entries), meta: {} }
+          end
+
+          # GET /api/v3/admin/email_templates/:id
+          def show
+            authorize! :read, Spree::EmailTemplate
+
+            render json: serialize_email_template
+          end
+
+          # DELETE /api/v3/admin/email_templates/:id
+          #
+          # Goes back to Spree's default for this language. The store's version
+          # and its history are kept, so a revision can still be restored.
+          def destroy
+            authorize! :update, Spree::EmailTemplate
+
+            result = Spree.email_template_revert_workflow.call(
+              store: current_store, key: email_template.key, locale: language, actor: current_actor,
+              lock_version: params[:lock_version].presence
+            )
+            render_email_template_result(result)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/imports_controller.rb

@@ -312,8 +312,7 @@ module Spree
 
             render_error(
               code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:validation_error],
-              message: Spree.t(:cannot_modify_seller_import, scope: 'api',
-                               default: "This import belongs to a seller. It can be viewed here, but only the seller can retry or delete it."),
+              message: I18n.t('spree.api.cannot_modify_seller_import'),
               status: :unprocessable_content
             )
             true

data/app/controllers/spree/api/v3/admin/invitations_controller.rb

@@ -34,13 +34,6 @@ module Spree
             render json: serialize_resource(@resource)
           end
 
-          # Invitations are immutable post-create — UI calls `resend` for
-          # token rotation, `destroy` to revoke. Clearing the action set
-          # keeps the surface honest if a client ever fires PATCH directly.
-          def update
-            head :method_not_allowed
-          end
-
           protected
 
           def model_class

data/app/controllers/spree/api/v3/admin/me_controller.rb

@@ -53,7 +53,7 @@ module Spree
 
             render_error(
               code: ERROR_CODES[:record_not_found],
-              message: Spree.t(:me_no_current_user),
+              message: I18n.t('spree.me_no_current_user'),
               status: :not_found
             )
           end

data/app/controllers/spree/api/v3/admin/media_library_controller.rb

@@ -39,8 +39,8 @@ module Spree
             unless detach_requested?
               return render_error(
                 code: ERROR_CODES[:resource_invalid],
-                message: Spree.t(
-                  'api.errors.media_in_use',
+                message: I18n.t(
+                  'spree.api.errors.media_in_use',
                   places: references.filter_map(&:name).uniq.first(5).to_sentence
                 ),
                 status: :unprocessable_content,
@@ -55,7 +55,7 @@ module Spree
             # render_service_error would produce an empty message.
             render_error(
               code: ERROR_CODES[:processing_error],
-              message: Spree.t('api.errors.media_not_deleted'),
+              message: I18n.t('spree.api.errors.media_not_deleted'),
               status: :unprocessable_content
             )
           end
@@ -79,7 +79,7 @@ module Spree
             {
               kind: reference.kind,
               name: reference.name,
-              owner_type: reference.owner_type,
+              owner_type: Spree::Base.polymorphic_api_type(reference.owner_type),
               owner_id: reference.owner_id,
               field: reference.field
             }
@@ -145,7 +145,7 @@ module Spree
           def create_from_url
             render_error(
               code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:resource_invalid],
-              message: Spree.t('api.errors.media_url_import_requires_product'),
+              message: I18n.t('spree.api.errors.media_url_import_requires_product'),
               status: :unprocessable_content
             )
           end

data/app/controllers/spree/api/v3/admin/order_routing_rules_controller.rb

@@ -49,10 +49,6 @@ module Spree
                                    .find_by_prefix_id!(params[:channel_id])
           end
 
-          def parent_association
-            :order_routing_rules
-          end
-
           private
 
           def build_subclassed_resource(klass, attrs)

data/app/controllers/spree/api/v3/admin/orders/deliveries_controller.rb

@@ -27,11 +27,7 @@ module Spree
                   notify_customer: notify_customer?(mark_delivered_params[:notify_customer])
                 )
 
-                if result.success?
-                  render json: serialize_resource(result.value)
-                else
-                  render_result_error(result)
-                end
+                render_result(result)
               end
             end
 

data/app/controllers/spree/api/v3/admin/orders/discount_codes_controller.rb

@@ -70,7 +70,7 @@ module Spree
             def render_completed_order_error
               render_error(
                 code: ERROR_CODES[:discount_not_editable],
-                message: Spree.t('errors.messages.coupon_code_frozen_after_completion'),
+                message: I18n.t('spree.errors.messages.coupon_code_frozen_after_completion'),
                 status: :unprocessable_content
               )
             end

data/app/controllers/spree/api/v3/admin/orders/discounts_controller.rb

@@ -87,7 +87,7 @@ module Spree
             def render_promotion_row_error
               render_error(
                 code: ERROR_CODES[:discount_not_editable],
-                message: Spree.t('errors.messages.promotion_discount_not_editable'),
+                message: I18n.t('spree.errors.messages.promotion_discount_not_editable'),
                 status: :unprocessable_entity
               )
             end

data/app/controllers/spree/api/v3/admin/orders/fulfillments_controller.rb

@@ -21,17 +21,21 @@ module Spree
             # Manually registers a fulfillment on a completed order (external
             # carrier / 3PL sync), bypassing order routing. Moves the requested
             # line item quantities out of their routed fulfillments; when
-            # `items` is omitted, everything not yet shipped is moved. An
-            # explicit `cost` persists only with `status: 'shipped'` — pending
-            # fulfillments are re-priced by the rate engine.
+            # `items` is omitted, everything not yet shipped is moved. Exchange
+            # and claim replacements are moved only out of a named
+            # `source_fulfillment_id`, which is how a canceled replacement is
+            # sent again. An explicit `cost` persists only with
+            # `status: 'shipped'` — pending fulfillments are re-priced by the
+            # rate engine.
             def create
-              authorize!(:create, Spree::Shipment)
+              authorize!(:create, Spree::Fulfillment)
 
               with_order_lock do
                 result = Spree.fulfillment_create_workflow.call(
                   order: @order,
                   stock_location: stock_location_for_create,
                   items: items_for_create,
+                  source_fulfillment: source_fulfillment_for_create,
                   tracking: create_params[:tracking],
                   delivery_method: delivery_method_for_create,
                   cost: create_params[:cost],
@@ -39,11 +43,7 @@ module Spree
                   metadata: create_params[:metadata]&.to_h
                 )
 
-                if result.success?
-                  render json: serialize_resource(result.value), status: :created
-                else
-                  render_result_error(result)
-                end
+                render_result(result, status: :created)
               end
             end
 
@@ -59,11 +59,7 @@ module Spree
                   notify_customer: notify_customer?(mark_delivered_params[:notify_customer])
                 )
 
-                if result.success?
-                  render json: serialize_resource(result.value)
-                else
-                  render_result_error(result)
-                end
+                render_result(result)
               end
             end
 
@@ -105,7 +101,7 @@ module Spree
             end
 
             def create_params
-              @create_params ||= params.permit(:stock_location_id, :tracking, :delivery_method_id, :cost, :status, metadata: {}, items: [:item_id, :quantity])
+              @create_params ||= params.permit(:stock_location_id, :source_fulfillment_id, :tracking, :delivery_method_id, :cost, :status, metadata: {}, items: [:item_id, :quantity])
             end
 
             def mark_delivered_params
@@ -123,7 +119,13 @@ module Spree
             def delivery_method_for_create
               return if create_params[:delivery_method_id].blank?
 
-              Spree::ShippingMethod.accessible_by(current_ability, :show).find_by_prefix_id!(create_params[:delivery_method_id])
+              Spree::DeliveryMethod.accessible_by(current_ability, :show).find_by_prefix_id!(create_params[:delivery_method_id])
+            end
+
+            def source_fulfillment_for_create
+              return if create_params[:source_fulfillment_id].blank?
+
+              @order.fulfillments.find_by_prefix_id!(create_params[:source_fulfillment_id])
             end
 
             def items_for_create

data/app/controllers/spree/api/v3/admin/orders/gift_cards_controller.rb

@@ -53,17 +53,17 @@ module Spree
               gift_card = current_store.gift_cards.find_by(code: params[:code]&.downcase)
 
               if gift_card.nil?
-                render_error(code: ERROR_CODES[:gift_card_not_found], message: Spree.t(:gift_card_not_found), status: :not_found)
+                render_error(code: ERROR_CODES[:gift_card_not_found], message: I18n.t('spree.gift_card_not_found'), status: :not_found)
                 return
               end
 
               if gift_card.expired?
-                render_error(code: ERROR_CODES[:gift_card_expired], message: Spree.t(:gift_card_expired), status: :unprocessable_content)
+                render_error(code: ERROR_CODES[:gift_card_expired], message: I18n.t('spree.gift_card_expired'), status: :unprocessable_content)
                 return
               end
 
               if gift_card.redeemed?
-                render_error(code: ERROR_CODES[:gift_card_already_redeemed], message: Spree.t(:gift_card_already_redeemed), status: :unprocessable_content)
+                render_error(code: ERROR_CODES[:gift_card_already_redeemed], message: I18n.t('spree.gift_card_already_redeemed'), status: :unprocessable_content)
                 return
               end
 

data/app/controllers/spree/api/v3/admin/orders/labels_controller.rb

@@ -25,11 +25,7 @@ module Spree
               with_order_lock do
                 result = Spree.shipping_label_purchase_workflow.call(owner: @parent)
 
-                if result.success?
-                  render json: serialize_resource(result.value), status: :created
-                else
-                  render_result_error(result)
-                end
+                render_result(result, status: :created)
               end
             end
 
@@ -38,11 +34,7 @@ module Spree
               with_order_lock do
                 result = Spree.shipping_label_refund_workflow.call(shipping_label: @resource)
 
-                if result.success?
-                  render json: serialize_resource(result.value)
-                else
-                  render_result_error(result)
-                end
+                render_result(result)
               end
             end
 

data/app/controllers/spree/api/v3/admin/orders/payments_controller.rb

@@ -56,22 +56,14 @@ module Spree
 
               result = Spree.payment_capture_workflow.call(payment: @resource, amount: amount)
 
-              if result.success?
-                render json: serialize_resource(result.value)
-              else
-                render_result_error(result)
-              end
+              render_result(result)
             end
 
             # PATCH /api/v3/admin/orders/:order_id/payments/:id/void
             def void
               result = Spree.payment_void_workflow.call(payment: @resource)
 
-              if result.success?
-                render json: serialize_resource(result.value)
-              else
-                render_result_error(result)
-              end
+              render_result(result)
             end
 
             protected
@@ -84,10 +76,6 @@ module Spree
               Spree.api.admin_payment_serializer
             end
 
-            def parent_association
-              :payments
-            end
-
             def permitted_params
               params.permit(:amount, :payment_method_id, :source_id)
             end

data/app/controllers/spree/api/v3/admin/orders/refunds_controller.rb

@@ -33,11 +33,7 @@ module Spree
                 order: @parent
               )
 
-              if result.success?
-                render json: serialize_resource(result.value), status: :created
-              else
-                render_result_error(result)
-              end
+              render_result(result, status: :created)
             end
 
             protected

data/app/controllers/spree/api/v3/admin/orders_controller.rb

@@ -58,7 +58,7 @@ module Spree
           # are nested inside it.
           def complete
             with_order_lock do
-              result = Spree.order_complete_service.call(
+              result = Spree.order_complete_workflow.call(
                 order: @resource,
                 payment_pending: params[:payment_pending].to_b,
                 notify_customer: ActiveModel::Type::Boolean.new.cast(params[:notify_customer])
@@ -121,7 +121,7 @@ module Spree
             unless @resource.po_document.attached?
               return render_error(
                 code: ERROR_CODES[:validation_error],
-                message: Spree.t(:po_document_missing),
+                message: I18n.t('spree.po_document_missing'),
                 status: :unprocessable_content
               )
             end
@@ -247,7 +247,7 @@ module Spree
           def render_invalid_po_document
             render_error(
               code: ERROR_CODES[:validation_error],
-              message: Spree.t(:po_document_invalid_signed_id),
+              message: I18n.t('spree.po_document_invalid_signed_id'),
               status: :unprocessable_content
             )
           end

data/app/controllers/spree/api/v3/admin/password_resets_controller.rb

@@ -20,15 +20,17 @@ module Spree
             user = Spree.admin_user_class.find_by(email: params[:email])
 
             if user
-              redirect_url = trusted_redirect_url(user)
-              token = user.generate_token_for(:password_reset)
-              event_payload = { reset_token: token, email: user.email, store_id: current_store.prefixed_id }
-              event_payload[:redirect_url] = redirect_url if redirect_url.present?
-              user.publish_event('admin_user.password_reset_requested', event_payload)
+              event_name = 'admin_user.password_reset_requested'
+              payload = user.event_payload_for(
+                event_name,
+                reset_token: user.generate_token_for(:password_reset), store: current_store,
+                redirect_url: trusted_redirect_url(user).presence
+              )
+              user.publish_event(event_name, payload)
             end
 
             # Always return 202 to prevent email enumeration
-            render json: { message: Spree.t(:password_reset_requested, scope: :api) }, status: :accepted
+            render json: { message: I18n.t('spree.api.password_reset_requested') }, status: :accepted
           end
 
           # PATCH /api/v3/admin/password_resets/:id
@@ -38,7 +40,7 @@ module Spree
             unless user
               return render_error(
                 code: ERROR_CODES[:password_reset_token_invalid],
-                message: Spree.t(:password_reset_token_invalid, scope: :api),
+                message: I18n.t('spree.api.password_reset_token_invalid'),
                 status: :unprocessable_content
               )
             end

data/app/controllers/spree/api/v3/admin/price_lists_controller.rb

@@ -3,8 +3,7 @@ module Spree
     module V3
       module Admin
         # Admin CRUD for `Spree::PriceList`, plus the lifecycle transitions
-        # (`activate` / `deactivate`) and the spreadsheet's data feed
-        # (`prices`).
+        # (`activate` / `deactivate`).
         #
         # Everything writable on the list itself — name, schedule, match
         # policy, nested rules (`rules: [...]`), and individual price
@@ -25,7 +24,7 @@ module Spree
           # before_actions by method name, so this would otherwise
           # *replace* the parent's narrower filter and break the standard
           # actions. Wrapping it under a different name keeps both.
-          before_action :load_member_resource, only: [:activate, :deactivate, :prices]
+          before_action :load_member_resource, only: [:activate, :deactivate]
 
           # GET /api/v3/admin/price_lists/price_rule_types
           #
@@ -69,29 +68,6 @@ module Spree
             end
           end
 
-          # GET /api/v3/admin/price_lists/:id/prices
-          #
-          # The spreadsheet editor's data source. Returns every Price row
-          # in this list (filtered by `?currency=`), eager-loading
-          # `variant.product` + option values so each cell can render
-          # product name, variant options and SKU without N+1.
-          def prices
-            authorize! :read, @resource
-            currency = params[:currency].presence || current_store.default_currency
-            prices = @resource.prices
-                              .includes(variant: [:product, { option_values: :option_type }])
-                              .where(currency: currency)
-                              .joins(variant: :product)
-                              .order(Arel.sql("#{Spree::Product.table_name}.name ASC"))
-                              .order(Arel.sql("#{Spree::Variant.table_name}.position ASC"))
-                              .order(min_quantity: :asc)
-
-            render json: {
-              data: prices.map { |p| serialize_price(p) },
-              meta: { currency: currency, count: prices.size }
-            }
-          end
-
           protected
 
           def model_class
@@ -124,6 +100,7 @@ module Spree
           def permitted_params
             normalize_params(
               params.permit(
+                *model_additional_permitted_attributes,
                 :name, :description, :position,
                 :starts_at, :ends_at, :match_policy,
                 :price_adjustment_percentage, :adjust_compare_at,
@@ -138,36 +115,12 @@ module Spree
 
           # Loads the record without the action-derived authorization
           # `set_resource` runs (which would check `:activate` /
-          # `:deactivate` / `:prices` — actions that abilities don't
-          # grant). The per-action methods below explicitly call
-          # `authorize!` with the standard action that ability rules
-          # actually mention (`:update` / `:read`).
+          # `:deactivate` — actions that abilities don't grant). The
+          # per-action methods explicitly call `authorize!` with
+          # `:update`, which ability rules actually mention.
           def load_member_resource
             @resource = find_resource
           end
-
-          # Hand-rolled flat shape for the spreadsheet — keeps the payload
-          # narrow (no nested variant/product/option_value objects) and
-          # avoids paying for the admin Price serializer when we only need
-          # ~6 fields per row. The grouping the UI does (rows → product
-          # header) is driven entirely off `product_id`/`product_name`.
-          def serialize_price(price)
-            variant = price.variant
-            product = variant.product
-            {
-              id: price.prefixed_id,
-              variant_id: variant.prefixed_id,
-              product_id: product.prefixed_id,
-              product_name: product.name,
-              variant_label: variant.options_text.presence,
-              sku: variant.sku,
-              currency: price.currency,
-              min_quantity: price.min_quantity,
-              amount: price.amount&.to_s,
-              compare_at_amount: price.compare_at_amount&.to_s
-            }
-          end
-
         end
       end
     end

data/app/controllers/spree/api/v3/admin/prices_controller.rb

@@ -58,10 +58,6 @@ module Spree
             # validations (docs/plans/6.0-volume-pricing.md). Each branch is
             # guarded on the key its own failure carries, so a failure mode the
             # service grows later is not reported under one of these names.
-            #
-            # `I18n.t` rather than `Spree.t` for these: the models raise them
-            # under `activerecord.errors`, and `Spree.t` would scope the lookup
-            # to `spree.` and miss the key.
             if (invalid = result.error&.value.try(:[], :invalid_quantities))
               return render_error(
                 code: 'invalid_min_quantity',

data/app/controllers/spree/api/v3/admin/products/digital_assets_controller.rb

@@ -45,7 +45,7 @@ module Spree
 
               data = Spree.digital_asset_providers.map do |provider_class|
                 {
-                  type: provider_class.to_s,
+                  type: provider_class.api_type,
                   name: provider_class.provider_name,
                   requires_attachment: provider_class.requires_attachment?,
                   settings_schema: provider_class.settings_schema
@@ -70,10 +70,6 @@ module Spree
               authorize!(:show, @parent)
             end
 
-            def parent_association
-              :digital_assets
-            end
-
             # The parent association reaches assets through `variants`, which
             # carries an ORDER BY on the variants table. Combined with the
             # collection's DISTINCT, PostgreSQL rejects the query outright
@@ -138,7 +134,7 @@ module Spree
             end
 
             def render_private_storage_error
-              render_validation_error(Spree.t(:digital_assets_attachment_must_be_private))
+              render_validation_error(I18n.t('spree.digital_assets_attachment_must_be_private'))
             end
           end
         end

data/app/controllers/spree/api/v3/admin/products/variants_controller.rb

@@ -21,10 +21,6 @@ module Spree
               authorize!(:show, @parent)
             end
 
-            def parent_association
-              :variants
-            end
-
             def scope_includes
               [:prices, stock_levels: :stock_location]
             end

data/app/controllers/spree/api/v3/admin/products_controller.rb

@@ -54,7 +54,7 @@ module Spree
             unless Spree::Product::STATUSES.include?(params[:status].to_s)
               return render_error(
                 code: 'invalid_status',
-                message: Spree.t(:invalid_status, scope: 'errors.messages', default: 'Invalid status'),
+                message: I18n.t('spree.errors.messages.invalid_status'),
                 status: :unprocessable_content
               )
             end

data/app/controllers/spree/api/v3/admin/promotion_actions_controller.rb

@@ -71,10 +71,6 @@ module Spree
                                    .find_by_prefix_id!(params[:promotion_id])
           end
 
-          def parent_association
-            :promotion_actions
-          end
-
           private
 
           def build_subclassed_resource(klass, attrs)

data/app/controllers/spree/api/v3/admin/promotion_rules_controller.rb

@@ -45,10 +45,6 @@ module Spree
                                    .find_by_prefix_id!(params[:promotion_id])
           end
 
-          def parent_association
-            :promotion_rules
-          end
-
           private
 
           def build_subclassed_resource(klass, attrs)

data/app/controllers/spree/api/v3/admin/purchase_orders_controller.rb

@@ -31,7 +31,7 @@ module Spree
 
             render_error(
               code: 'invalid_status',
-              message: Spree.t('purchase_order.errors.only_draft_can_be_deleted'),
+              message: I18n.t('spree.purchase_order.errors.only_draft_can_be_deleted'),
               status: :unprocessable_content
             )
           end

data/app/controllers/spree/api/v3/admin/resource_controller.rb

@@ -84,7 +84,7 @@ module Spree
           def render_invalid_position
             render_error(
               code: ERROR_CODES[:validation_error],
-              message: Spree.t('api.errors.invalid_position', default: 'new_position must be an integer'),
+              message: I18n.t('spree.api.errors.invalid_position'),
               status: :unprocessable_content
             )
           end