spree_api 6.0.0.beta4 → 6.0.0.rc2

data/app/controllers/spree/api/v3/admin/email_templates/publications_controller.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module EmailTemplates
+          class PublicationsController < Admin::BaseController
+            include Spree::Api::V3::Admin::EmailTemplateLookup
+
+            request_params 'EmailTemplateVersionParams' do |body|
+              body.include_attributes Spree::Api::V3::Admin::EmailTemplateLanguageRequestSchema
+              body.attribute :lock_version, :integer,
+                permit: false,
+                description: "The draft's `lock_version` as reviewed. A draft saved since is refused with 409."
+            end
+
+            before_action :authorize_sample_data!
+
+            # POST /api/v3/admin/email_templates/:email_template_id/publication
+            #
+            # Makes the draft live. A draft that does not render with sample data
+            # (for the layout or a partial: in any email using it) is refused with
+            # 422 and each problem's email and line.
+            def create
+              authorize! :update, Spree::EmailTemplate
+
+              result = Spree.email_template_publish_workflow.call(
+                store: current_store, key: email_template.key, locale: language, actor: current_actor,
+                lock_version: params[:lock_version].presence
+              )
+              render_email_template_result(result, status: :created)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/email_templates/restorations_controller.rb

@@ -0,0 +1,42 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module EmailTemplates
+          class RestorationsController < Admin::BaseController
+            include Spree::Api::V3::Admin::EmailTemplateLookup
+
+            request_params 'EmailTemplateRestoreParams' do |body|
+              body.include_attributes Spree::Api::V3::Admin::EmailTemplateLanguageRequestSchema
+              body.attribute :lock_version, :integer,
+                nullable: true,
+                permit: false,
+                description: "The open draft's `lock_version`, or null when there is none; checked as when saving."
+            end
+
+            # POST /api/v3/admin/email_templates/:email_template_id/revisions/:revision_id/restoration
+            #
+            # Copies the revision into the language's draft, to be published
+            # like any change. A language without a version of its own can
+            # restore one of the version for every language its customers get.
+            def create
+              authorize! :update, Spree::EmailTemplate
+
+              revision = Spree::EmailTemplateRevision.where(
+                email_template: current_store.email_templates.where(
+                  key: email_template.key, locale: [language, Spree::EmailTemplate::ANY_LOCALE]
+                )
+              ).find_by_prefix_id!(params[:revision_id])
+
+              result = Spree.email_template_restore_revision_workflow.call(
+                revision: revision, actor: current_actor, locale: language,
+                draft_version: params.key?(:lock_version) ? { lock_version: params[:lock_version] } : {}
+              )
+              render_email_template_result(result, status: :created)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/email_templates/revisions_controller.rb

@@ -0,0 +1,35 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module EmailTemplates
+          # The published versions of an email template in one language, newest
+          # first. Reverting keeps them, so they outlive the published version.
+          class RevisionsController < ResourceController
+            include Spree::Api::V3::Admin::EmailTemplateLookup
+
+            before_action { authorize! :read, Spree::EmailTemplate }
+
+            protected
+
+            def model_class
+              Spree::EmailTemplateRevision
+            end
+
+            def serializer_class
+              Spree.api.admin_email_template_revision_serializer
+            end
+
+            def scope
+              email_template_revisions.order(created_at: :desc)
+            end
+
+            def collection_includes
+              [:published_by]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/email_templates/sample_records_controller.rb

@@ -0,0 +1,33 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module EmailTemplates
+          class SampleRecordsController < Admin::BaseController
+            include Spree::Api::V3::Admin::EmailTemplateLookup
+
+            before_action :authorize_sample_data!
+
+            # GET /api/v3/admin/email_templates/:email_template_id/sample_records
+            #
+            # The store's five latest records the template can be previewed
+            # with (for the layout and partials, those of the email `email_key`
+            # names). Empty for an email that needs no record.
+            def index
+              authorize! :update, Spree::EmailTemplate
+
+              records = build_preview.email.sample_class.new(store: current_store).recent_records
+              render json: { data: records.map { |record| serializer_class.new(record, params: serializer_params).to_h } }
+            end
+
+            private
+
+            def serializer_class
+              Spree.api.admin_email_template_sample_record_serializer
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/email_templates/test_emails_controller.rb

@@ -0,0 +1,44 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module EmailTemplates
+          class TestEmailsController < Admin::BaseController
+            include Spree::Api::V3::Admin::EmailTemplateLookup
+
+            request_params 'EmailTemplatePreviewParams' do |body|
+              body.include_attributes Spree::Api::V3::Admin::EmailTemplatePreviewRequestSchema
+            end
+
+            before_action :authorize_sample_data!
+
+            # POST /api/v3/admin/email_templates/:email_template_id/test_email
+            #
+            # Sends the template, rendered as the preview renders it, to the
+            # signed-in admin. Never to another address: the sample data comes
+            # from a real customer's records.
+            def create
+              authorize! :update, Spree::EmailTemplate
+              return render_no_recipient unless current_user
+
+              build_preview.call
+              Spree::EmailTemplateMailer.test_email(current_store, current_user.email, email_template.key, **preview_arguments).deliver_later
+
+              render json: { sent_to: current_user.email }, status: :accepted
+            end
+
+            private
+
+            def render_no_recipient
+              render_error(
+                code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:invalid_request],
+                message: I18n.t('spree.email_templates.test_email_needs_admin'),
+                status: :unprocessable_content
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/email_templates_controller.rb

@@ -0,0 +1,46 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # The customer email templates, layout and shared partials merchants
+        # may edit, addressed by their key with dots
+        # (`spree.order_mailer.confirm_email`). `language` picks the version:
+        # a language code, or `any` (the default) for every language.
+        class EmailTemplatesController < Admin::BaseController
+          include Spree::Api::V3::Admin::EmailTemplateLookup
+
+          skip_before_action :load_email_template, only: :index
+
+          # GET /api/v3/admin/email_templates
+          def index
+            authorize! :read, Spree::EmailTemplate
+
+            entries = Spree::EmailTemplates::Entry.all(current_store, locale: language)
+            render json: { data: serialize_collection(entries), meta: {} }
+          end
+
+          # GET /api/v3/admin/email_templates/:id
+          def show
+            authorize! :read, Spree::EmailTemplate
+
+            render json: serialize_email_template
+          end
+
+          # DELETE /api/v3/admin/email_templates/:id
+          #
+          # Goes back to Spree's default for this language. The store's version
+          # and its history are kept, so a revision can still be restored.
+          def destroy
+            authorize! :update, Spree::EmailTemplate
+
+            result = Spree.email_template_revert_workflow.call(
+              store: current_store, key: email_template.key, locale: language, actor: current_actor,
+              lock_version: params[:lock_version].presence
+            )
+            render_email_template_result(result)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/exports_controller.rb

@@ -16,6 +16,26 @@ module Spree
           # readable ones instead of gating on a single scope.
           skip_scope_check! only: :index
 
+          request_params :export do |body|
+            body.attribute :type, :string,
+              required: true, on: :create,
+              example: 'products',
+              description: 'Which dataset to export, as its shorthand: `products`, `orders`, `customers`, `product_translations`, `gift_cards`, `coupon_codes`, `newsletter_subscribers`, `price_list_prices`, `purchase_orders`, or a type an extension registers.'
+            body.attribute :record_selection, :string,
+              choices: %w[filtered all],
+              example: 'filtered',
+              description: '`filtered` (the default) keeps `search_params`; `all` ignores them and exports every record in scope.'
+            body.attribute :results_url, :string,
+              example: 'https://admin.example.com/store_abc/exports',
+              description: "Absolute URL of your admin exports view; the export-done email uses it as the download button target. Only honored when it matches one of the store's allowed origins."
+            # Read from the raw params: a Ransack hash nests groupings, which
+            # `permit(search_params: {})` rejects.
+            body.attribute :search_params, :hash,
+              permit: false,
+              example: { name_cont: 'shirt' },
+              description: 'A Ransack query, with the predicates the list endpoint accepts. A `price_list_prices` export requires `price_list_id_eq` naming a price list of the current store, and refuses `record_selection: "all"`.'
+          end
+
           # We stream the CSV inline rather than redirecting to ActiveStorage's
           # signed-URL endpoint because the SPA's Vite proxy only forwards
           # `/api/*`. A cross-origin redirect to `/rails/active_storage/...`
@@ -92,13 +112,10 @@ module Spree
             klass.new(attrs)
           end
 
-          # `search_params` carries an arbitrary Ransack hash with nested
-          # groupings (`{ g: [{ name_cont: 'foo' }] }`). Rails' `permit(k: {})`
-          # rejects nested hashes, so we extract via `to_unsafe_h`. `:format`
-          # is intentionally dropped — only CSV is supported and Rails' request
-          # format would otherwise overwrite the model's enum.
+          # `:format` is intentionally dropped — only CSV is supported and Rails'
+          # request format would otherwise overwrite the model's enum.
           def permitted_params
-            attrs = params.permit(*model_additional_permitted_attributes, :type, :record_selection, :results_url)
+            attrs = params.permit(*permitted_attributes)
             raw = params[:search_params]
             attrs[:search_params] = raw.respond_to?(:to_unsafe_h) ? raw.to_unsafe_h : raw if raw.present?
             attrs

data/app/controllers/spree/api/v3/admin/files_controller.rb

@@ -0,0 +1,29 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        class FilesController < Admin::BaseController
+          include Spree::Api::V3::FileUploads
+
+          # The endpoint that uses a file checks its own scope (`write_customers`
+          # for an avatar, and so on), so this gate is the floor, not the only
+          # check. `write_products` covers the dominant flow, product media.
+          scoped_resource :products
+
+          skip_before_action :authenticate_user
+
+          # Permitted by Spree::Api::V3::FileUploads, shared with the seller branch.
+          request_params 'FileUploadCreateParams', action: :create do |body|
+            body.include_attributes Spree::Api::V3::FileUploadRequestSchema
+          end
+
+          private
+
+          def file_upload_serializer
+            Spree.api.admin_file_upload_serializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/gift_card_batches_controller.rb

@@ -11,6 +11,25 @@ module Spree
         class GiftCardBatchesController < ResourceController
           scoped_resource :gift_cards
 
+          request_params :gift_card_batch do |body|
+            body.attribute :prefix, :string,
+              required: true, on: :create,
+              example: 'WELCOME',
+              description: 'Lowercased and prepended to every generated code.'
+            body.attribute :amount, :decimal,
+              required: true, on: :create,
+              example: '25.00',
+              description: 'The amount of each card, greater than zero.'
+            body.attribute :codes_count, :integer,
+              required: true, on: :create,
+              example: 100,
+              description: 'How many cards to generate. Capped at `gift_card_batch_limit`; batches over `gift_card_batch_web_limit` generate in the background.'
+            body.attribute :currency, :currency,
+              example: 'USD',
+              description: 'ISO 4217 currency code. Defaults to the store currency.'
+            body.attribute :expires_at, :date, nullable: true, example: '2030-12-31'
+          end
+
           protected
 
           def model_class
@@ -22,7 +41,7 @@ module Spree
           end
 
           def permitted_params
-            params.permit(*model_additional_permitted_attributes, :prefix, :codes_count, :amount, :expires_at, :currency)
+            params.permit(*permitted_attributes)
           end
         end
       end

data/app/controllers/spree/api/v3/admin/gift_cards_controller.rb

@@ -13,6 +13,24 @@ module Spree
         class GiftCardsController < ResourceController
           scoped_resource :gift_cards
 
+          request_params :gift_card do |body|
+            body.attribute :amount, :decimal,
+              required: true, on: :create,
+              example: '25.00',
+              description: 'Greater than zero.'
+            body.attribute :currency, :currency,
+              example: 'USD',
+              description: 'ISO 4217 currency code. Defaults to the store currency.'
+            body.attribute :code, :string, example: 'WELCOME50', description: 'Generated when omitted.'
+            body.attribute :expires_at, :date, nullable: true, example: '2030-12-31'
+            # Resolved through the caller's ability by `resolve_customer`.
+            body.attribute :customer_id, :id,
+              nullable: true,
+              permit: false,
+              example: 'cus_UkLWZg9DAJ',
+              description: 'The customer the card belongs to. Needs the `read_customers` permission; null detaches it.'
+          end
+
           before_action :resolve_customer, only: [:create, :update]
 
           protected
@@ -26,7 +44,7 @@ module Spree
           end
 
           def permitted_params
-            params.permit(*model_additional_permitted_attributes, :code, :amount, :expires_at, :currency).tap do |attributes|
+            params.permit(*permitted_attributes).tap do |attributes|
               attributes[:customer] = @customer if params.key?(:customer_id)
             end
           end

data/app/controllers/spree/api/v3/admin/imports_controller.rb

@@ -17,10 +17,43 @@ module Spree
           # writable ones instead of gating on a single scope.
           skip_scope_check! only: :index
 
+          request_params :import do |body|
+            body.attribute :type, :string,
+              required: true, on: :create,
+              example: 'products',
+              description: 'Which dataset to import, as its shorthand: `products`, `customers`, `product_translations`, `price_list_prices`, `purchase_orders`, or a type an extension registers.'
+            body.attribute :attachment_signed_id, :string,
+              required: true, on: :create,
+              description: 'The `signed_id` of the uploaded CSV, from `files.upload()` with `visibility: "private"`.'
+            body.attribute :delimiter, :string,
+              choices: [',', ';', '|', "\t"],
+              example: ',',
+              description: 'CSV column separator. Defaults to a comma.'
+            body.attribute :results_url, :string,
+              example: 'https://admin.example.com/store_abc/settings/imports',
+              description: "Absolute URL of your admin imports view; the import-done email links back to it with `?import=<id>` appended. Only honored when it matches one of the store's allowed origins."
+            body.attribute :price_list_id, :id,
+              description: 'For `price_list_prices` imports: the price list the rows are merged into. Must belong to the current store; other types ignore it.'
+          end
+
+          request_params 'ImportCompleteMappingParams', action: :complete_mapping do |body|
+            body.attribute :mappings, :array,
+              description: 'Column assignments to apply before processing starts. Omit to accept the ones assigned on create.' do |mapping|
+              mapping.attribute :schema_field, :string,
+                required: true,
+                example: 'slug',
+                description: "A schema field name from the import's `schema_fields`."
+              mapping.attribute :file_column, :string,
+                nullable: true,
+                example: 'Product Handle',
+                description: 'The CSV header to read the field from; null unmaps the field.'
+            end
+          end
+
           # POST /api/v3/admin/imports
           #
-          # `attachment` is an ActiveStorage signed blob id obtained from
-          # POST /api/v3/admin/direct_uploads. On success the import advances
+          # `attachment_signed_id` is a signed id obtained from
+          # POST /api/v3/admin/files. On success the import advances
           # straight into `mapping` (auto-assigning file columns from the CSV
           # headers), so the response already carries the mapping payload.
           def create
@@ -48,12 +81,6 @@ module Spree
             else
               render_errors(@resource.errors)
             end
-          rescue ActiveSupport::MessageVerifier::InvalidSignature
-            render_error(
-              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:validation_error],
-              message: 'Invalid attachment signed id',
-              status: :unprocessable_content
-            )
           end
 
           # PATCH /api/v3/admin/imports/:id/complete_mapping
@@ -259,7 +286,7 @@ module Spree
           end
 
           def permitted_params
-            params.permit(*model_additional_permitted_attributes, :type, :attachment, :preferred_delimiter, :results_url, :price_list_id)
+            params.permit(*permitted_attributes)
           end
 
           # A price-list import writes into one list, named by its prefixed id.
@@ -312,8 +339,7 @@ module Spree
 
             render_error(
               code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:validation_error],
-              message: Spree.t(:cannot_modify_seller_import, scope: 'api',
-                               default: "This import belongs to a seller. It can be viewed here, but only the seller can retry or delete it."),
+              message: I18n.t('spree.api.cannot_modify_seller_import'),
               status: :unprocessable_content
             )
             true

data/app/controllers/spree/api/v3/admin/integrations_controller.rb

@@ -15,6 +15,18 @@ module Spree
           subclassed_via -> { Spree::Integration.registered_classes },
                          unknown_type_error: 'unknown_integration_type'
 
+          request_params :integration do |body|
+            body.attribute :type, :string,
+              required: true,
+              only: :create,
+              example: 'carrier',
+              description: 'Wire shorthand from the integration types endpoint.'
+            body.attribute :active, :boolean,
+              description: 'Activating runs the connection check, and a failed check is a 422.'
+            body.attribute :preferences, :hash,
+              description: 'Credential values. Secret preferences come back masked, and sending a masked value back keeps the stored secret.'
+          end
+
           # GET /api/v3/admin/integrations/types
           # Pure registry discovery — which integrations are installed and how
           # they're configured. Deliberately carries no per-store connected
@@ -47,7 +59,7 @@ module Spree
           end
 
           def permitted_params
-            params.permit(*model_additional_permitted_attributes, :type, :active, preferences: {})
+            params.permit(*permitted_attributes)
           end
 
           # `types` is read-only discovery — maps to the read scope.

data/app/controllers/spree/api/v3/admin/invitation_acceptances_controller.rb

@@ -10,6 +10,14 @@ module Spree
           skip_scope_check!
           skip_before_action :authenticate_admin!, only: [:lookup, :accept]
 
+          request_params 'InvitationAcceptParams', action: :accept do |body|
+            body.attribute :password, :string,
+              description: 'Required when the invitee has no account yet: it creates one. An existing account signs in without it.'
+            body.attribute :password_confirmation, :string
+            body.attribute :first_name, :string
+            body.attribute :last_name, :string
+          end
+
           rate_limit to: Spree::Api::Config[:rate_limit_login],
                      within: Spree::Api::Config[:rate_limit_window].seconds,
                      store: Rails.cache,
@@ -24,7 +32,6 @@ module Spree
           end
 
           # POST /api/v3/admin/auth/invitations/:id/accept?token=:token
-          # Body: { password?, password_confirmation?, first_name?, last_name? }
           def accept
             return unless load_invitation
 
@@ -99,7 +106,7 @@ module Spree
           end
 
           def signup_params(invitation)
-            params.permit(:password, :password_confirmation, :first_name, :last_name).
+            params.permit(*declared_permitted_attributes).
               merge(email: invitation.email)
           end
 

data/app/controllers/spree/api/v3/admin/invitations_controller.rb

@@ -13,6 +13,13 @@ module Spree
           # grantable separately from store configuration (6.0-admin-rbac.md).
           scoped_resource :staff
 
+          request_params :invitation do |body|
+            body.attribute :email, :string, required: true, on: :create
+            body.attribute :role_id, :id,
+              required: true, on: :create,
+              description: 'The role (`role_...`) the invitee gets on accepting.'
+          end
+
           # POST /api/v3/admin/invitations
           # Guards against inviting a new staff member straight into the admin
           # super-role unless the inviter already holds it.
@@ -34,13 +41,6 @@ module Spree
             render json: serialize_resource(@resource)
           end
 
-          # Invitations are immutable post-create — UI calls `resend` for
-          # token rotation, `destroy` to revoke. Clearing the action set
-          # keeps the surface honest if a client ever fires PATCH directly.
-          def update
-            head :method_not_allowed
-          end
-
           protected
 
           def model_class
@@ -72,7 +72,7 @@ module Spree
           # No extension union: an invitation carries only the role grant, which is
           # the authorization surface itself, not extensible resource data.
           def permitted_params
-            attrs = params.permit(:email, :role_id)
+            attrs = params.permit(*declared_permitted_attributes)
             if attrs[:role_id].present? && Spree::PrefixedId.prefixed_id?(attrs[:role_id])
               attrs[:role_id] = Spree::PrefixedId.decode_prefixed_id(attrs[:role_id])
             end

data/app/controllers/spree/api/v3/admin/locales_controller.rb

@@ -14,7 +14,7 @@ module Spree
           def index
             render json: {
               data: current_store.supported_locales.map do |locale|
-                Spree.api.locale_serializer.new(locale).to_h
+                Spree.api.admin_locale_serializer.new(locale).to_h
               end
             }
           end

data/app/controllers/spree/api/v3/admin/markets_controller.rb

@@ -13,6 +13,36 @@ module Spree
         class MarketsController < ResourceController
           scoped_resource :settings
 
+          request_params :market do |body|
+            body.attribute :name, :string,
+              required: true, on: :create,
+              example: 'Europe',
+              description: 'Display name, unique within the store.'
+            body.attribute :currency, :currency,
+              required: true, on: :create,
+              example: 'EUR',
+              description: 'ISO 4217 currency code.'
+            body.attribute :default_locale, :locale,
+              required: true, on: :create,
+              example: 'de',
+              description: 'Locale used as the market default. Always part of `supported_locales`.'
+            body.attribute :tax_inclusive, :boolean, description: 'Display prices with tax included.'
+            body.attribute :tax_provider, :string,
+              nullable: true,
+              example: 'internal',
+              description: 'Shorthand of the tax engine that prices this market, from the tax providers endpoint. Null uses the installation default.'
+            body.attribute :default, :boolean,
+              description: 'Setting true demotes the previous default market of the store.'
+            body.attribute :position, :integer, description: 'Sort order within the store; lower comes first.'
+            body.attribute :supported_locales, :array, of: :locale,
+              example: %w[de en],
+              description: 'Locales available in this market. The default locale is always included.'
+            body.attribute :country_codes, :array, of: :country,
+              required: true, on: :create,
+              example: %w[DE FR],
+              description: 'ISO 3166-1 alpha-2 codes of the countries in this market. At least one is required.'
+          end
+
           protected
 
           def model_class
@@ -30,15 +60,6 @@ module Spree
           def scope
             super.ordered
           end
-
-          def permitted_params
-            normalize_params(
-              params.permit(
-                :name, :currency, :default_locale, :tax_inclusive, :tax_provider,
-                :default, :position, supported_locales: [], country_codes: []
-              )
-            )
-          end
         end
       end
     end

data/app/controllers/spree/api/v3/admin/me_controller.rb

@@ -7,6 +7,15 @@ module Spree
 
           skip_scope_check!
 
+          request_params :me do |body|
+            body.attribute :selected_locale, :string, example: 'de', description: 'The dashboard display language.'
+            body.attribute :first_name, :string
+            body.attribute :last_name, :string
+            body.attribute :avatar_signed_id, :string,
+              nullable: true,
+              description: 'A `signed_id` from `files.upload()` to set the avatar, or null to remove it. Omit it to keep the current photo.'
+          end
+
           before_action :require_current_user!
 
           # GET /api/v3/admin/me
@@ -33,8 +42,8 @@ module Spree
           # name, admin UI language, and avatar) — it operates on `current_user`
           # directly, so it needs no per-record authorization. Distinct from
           # PATCH /admin_users/:id, which is store-scoped staff management of
-          # *other* users. `avatar` accepts an ActiveStorage direct-upload
-          # signed id to set the photo, or `null` to remove it.
+          # *other* users. `avatar_signed_id` takes a signed id from
+          # POST /files to set the photo, or `null` to remove it.
           def update
             if current_user.update(permitted_params)
               render json: me_response
@@ -53,7 +62,7 @@ module Spree
 
             render_error(
               code: ERROR_CODES[:record_not_found],
-              message: Spree.t(:me_no_current_user),
+              message: I18n.t('spree.me_no_current_user'),
               status: :not_found
             )
           end
@@ -70,7 +79,7 @@ module Spree
           end
 
           def permitted_params
-            params.permit(:selected_locale, :first_name, :last_name, :avatar)
+            params.permit(*declared_permitted_attributes)
           end
 
           def me_response