spree_api 6.0.0.rc2 → 6.0.0.rc4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 06aac9de6a57402c698fb881a27df504047b5a488e9bdc87b472af681115d5f8
-  data.tar.gz: fa3c078090e803d00a5fa1b947b594175d8c5657d90e9490f074a57b814f7dd3
+  metadata.gz: 50559a5f0c0305cee4fbf43e8d145078d0f976ffeed8a40be46f19e4d1cca64d
+  data.tar.gz: '00688dd0b79f087aeee42271fd8678eacbaca3626115770fa29043cbbe3e3182'
 SHA512:
-  metadata.gz: c3d0ab4516f51aaa3e3c062e35fc1267c2c90191948e5b0d0dc5a7d6fba6b7ce5020cc66ac563ea9ae49c3948d13cf8a2245b655678fb14806612409d3f7cae3
-  data.tar.gz: ac4aae51601b99ab1e4985c521a6edd4dae0613ec68f7950f837cf6fa4181a3c258fd9765206443e1a1b590e2584ce64fb2a93174dd9276a73bc526446a02111
+  metadata.gz: d56fd3fd92f8bdd5257da98f842c366aa4ad324fcb5ef64c8cf44f007011144813da32af273828604db8cc2ce237fc17df51d633de6132594b41ab3002923c4d
+  data.tar.gz: 34e4d178767f8feccad3b96dbffb9ec02727bce30cdf106a19b9fca97c3af8f44272cf06b4a5facef4864ff3216860538c1a742cc2a1acc26a1589ea1c12b3d9

data/app/controllers/concerns/spree/api/v3/admin/email_template_lookup.rb

@@ -60,12 +60,17 @@ module Spree
 
           # An unsaved subject and body are previewed only when sent, so an
           # empty body still previews as empty. `branding` previews unsaved
-          # colors and font.
+          # colors and font, `mailer_logo_signed_id` an unsaved logo (null
+          # removes it, as it does when saving the store).
           def preview_arguments
             arguments = params.permit(:record_id, :subject, :body).to_h.symbolize_keys
             arguments[:locale] = language
             arguments[:email_key] = params[:email_key].to_s.tr('.', '/').presence
             arguments[:branding] = params.fetch(:branding, {}).permit(*Spree::Emails::Branding.attribute_names).to_h
+            if params.key?(:mailer_logo_signed_id)
+              signed_id = params[:mailer_logo_signed_id].presence&.to_s
+              arguments.merge!(mailer_logo_signed_id: signed_id, mailer_logo_cleared: signed_id.nil?)
+            end
             arguments
           end
 

data/app/controllers/concerns/spree/api/v3/admin/reporting_authorization.rb

@@ -3,22 +3,31 @@ module Spree
     module V3
       module Admin
         # Per-member authorization for the reporting vocabulary. Metrics,
-        # dimensions and counters all declare a `subject` (checked for JWT
-        # staff through CanCanCan) paired with a `key_scope` (checked for
-        # secret keys), so one predicate answers for every member and every
+        # dimensions and counters all declare a `key_scope` paired with a
+        # `subject`, so one predicate answers for every member and every
         # surface that lists them — the schema, a query, the home screen's
         # counters — filters by the same rule.
+        #
+        # Asked of the credential rather than of its owner. Branching on
+        # `current_api_key` measured an OAuth grant against the approving
+        # staff member's whole role, because a token authenticates as that
+        # person and carries no key: a grant for `read_reports` alone could
+        # group a report by customer and read names, emails and spend.
+        # `holds_permission?` is the narrowed answer for all three
+        # principals — a key's scopes, a grant's, or the role when someone is
+        # acting directly at the dashboard.
         module ReportingAuthorization
           extend ActiveSupport::Concern
 
           private
 
           def member_allowed?(member)
-            if current_api_key.present?
-              member.key_scope.blank? || current_api_key.has_scope?(member.key_scope)
-            else
-              member.subject.nil? || can?(:read, member.subject.call)
-            end
+            return false unless member.key_scope.blank? || holds_permission?(member.key_scope)
+
+            # The permission says whether this kind of data is in scope at
+            # all; a host app's record-level rule can still narrow which of
+            # it this person sees.
+            member.subject.nil? || can?(:read, member.subject.call)
           end
         end
       end

data/app/controllers/concerns/spree/api/v3/admin/store_context.rb

@@ -60,6 +60,13 @@ module Spree
           def resolve_admin_store
             return secret_api_key.store if secret_api_key
 
+            # An OAuth client is registered for one store and consented to on
+            # that store, so its token names the tenancy as surely as a secret
+            # key does. Reading the header instead would let a client name
+            # another merchant's store on a grant that never covered it.
+            oauth_store = respond_to?(:admin_oauth_token, true) && admin_oauth_token&.application&.store
+            return oauth_store if oauth_store
+
             if store_id_header
               Spree::Store.find_by_prefix_id(store_id_header)
             else

data/app/controllers/concerns/spree/api/v3/admin_authentication.rb

@@ -50,6 +50,11 @@ module Spree
             return true
           end
 
+          # Then an OAuth token, which carries both the admin who granted it
+          # and the store its client was registered for, so neither a JWT's
+          # store-membership check nor a key's store selection applies.
+          return true if authenticate_admin_oauth_token
+
           # Fall back to JWT authentication, then bind the admin to the store
           # they hold a role on (the token itself is store-agnostic).
           return false unless require_authentication!
@@ -59,6 +64,62 @@ module Spree
 
         private
 
+        # An OAuth bearer token, accepted only when it was issued for this
+        # API. A token names the resources it may be used against (RFC 8707),
+        # and a client asking for one endpoint must not receive a credential
+        # good across the rest — so a token naming only the MCP endpoint is
+        # refused here, and the MCP controller refuses one naming only this.
+        #
+        # @return [Boolean] true when the request is now authenticated
+        def authenticate_admin_oauth_token
+          token = admin_oauth_token
+          return false if token.nil?
+
+          owner = token.resource_owner
+          return false unless owner.is_a?(Spree.admin_user_class)
+
+          @current_api_key = nil
+          @current_user = owner
+          true
+        end
+
+        # @return [Spree::OauthAccessToken, nil]
+        def admin_oauth_token
+          return @admin_oauth_token if defined?(@admin_oauth_token)
+
+          @admin_oauth_token = begin
+            token = Spree::OauthAccessToken.by_token(oauth_bearer_value)
+            token if token&.accessible? && admin_audience_matches?(token)
+          end
+        end
+
+        # Split rather than matched: a regex with `\s+(.+)` backtracks on a
+        # header of many spaces, and this one is attacker-supplied on an
+        # unauthenticated request.
+        #
+        # @return [String, nil]
+        def oauth_bearer_value
+          scheme, value = request.headers['Authorization'].to_s.split(' ', 2)
+          return unless scheme&.casecmp?('Bearer')
+
+          value.to_s.strip.presence
+        end
+
+        # Compared by path, because the origin a client was given varies with
+        # how the installation is reached — a tunnel, a proxy, a custom
+        # domain — while the path it names does not. An unbound token is
+        # refused rather than trusted.
+        def admin_audience_matches?(token)
+          expected = Spree::Api::Oauth.resources[:admin]
+          return false if expected.blank?
+
+          token.resource.to_s.split.any? do |indicator|
+            URI.parse(indicator).path == expected
+          rescue URI::InvalidURIError
+            false
+          end
+        end
+
         # Rejects an authenticated JWT admin who has no role on +current_store+.
         # API-key principals are already store-bound and skip this check.
         def require_store_membership!

data/app/controllers/concerns/spree/api/v3/error_handler.rb

@@ -90,6 +90,11 @@ module Spree
           # Request errors
           request_too_large: 'request_too_large',
 
+          # Tax engine errors — the same two codes the completion workflow
+          # reports, so a client sees one vocabulary wherever tax failed.
+          tax_provider_unavailable: 'tax_provider_unavailable',
+          tax_calculation_refused: 'tax_calculation_refused',
+
           # General errors
           processing_error: 'processing_error',
           invalid_request: 'invalid_request'
@@ -101,6 +106,12 @@ module Spree
           rescue_from CanCan::AccessDenied, with: :handle_access_denied
           rescue_from Spree::Storefront::AccessDenied, with: :handle_access_denied
           rescue_from Spree::Core::GatewayError, with: :handle_gateway_error
+          # The backstop for every path that prices tax. Cart updates and
+          # completion answer for themselves, with a message shaped to what the
+          # customer was doing; anything else — adding an item, changing a
+          # quantity, a recalculation — reaches here rather than escaping as a
+          # 500 with an HTML body that a storefront cannot tell from a bug.
+          rescue_from Spree::Tax::ProviderError, with: :handle_tax_provider_error
           rescue_from ActionController::ParameterMissing, with: :handle_parameter_missing
           rescue_from ActiveRecord::RecordInvalid, with: :handle_record_invalid
           rescue_from Spree::Preferences::InvalidPreferences, with: :handle_invalid_preferences
@@ -171,6 +182,25 @@ module Spree
           end
         end
 
+        # Renders a failed workflow or service result. A tax engine failure the
+        # workflow caught itself (so it could roll the cart back) answers as
+        # handle_tax_provider_error would have: 503 for an outage, the one
+        # status the SDK retries, and 422 for a refusal. Anything else is
+        # rendered with +code+.
+        #
+        # @param result [Spree::ServiceModule::Result]
+        # @param code [String] the error code for any other failure
+        def render_result_failure(result, code:)
+          case result.error.code
+          when ERROR_CODES[:tax_provider_unavailable]
+            render_error(code: ERROR_CODES[:tax_provider_unavailable], message: result.error.to_s, status: :service_unavailable)
+          when ERROR_CODES[:tax_calculation_refused]
+            render_error(code: ERROR_CODES[:tax_calculation_refused], message: result.error.to_s, status: :unprocessable_content)
+          else
+            render_service_error(result.error, code: code)
+          end
+        end
+
         # Legacy support - redirect to new error handling
         def render_errors(errors, status = :unprocessable_content)
           code = infer_error_code(errors, status)
@@ -235,6 +265,25 @@ module Spree
           )
         end
 
+        # Refused and unavailable are different instructions to the customer, so
+        # they keep different codes: one names something to fix, the other is
+        # worth retrying. Avalara's own wording is passed through for a refusal
+        # because it names the problem better than we can; an outage says only
+        # that, since its detail is about our endpoint and belongs in the error
+        # tracker.
+        def handle_tax_provider_error(exception)
+          Rails.error.report(exception, context: error_context, source: 'spree.api.v3')
+
+          refused = exception.is_a?(Spree::Tax::CalculationRefused)
+          render_error(
+            code: refused ? ERROR_CODES[:tax_calculation_refused] : ERROR_CODES[:tax_provider_unavailable],
+            message: refused ? exception.message.to_s : I18n.t('spree.cart_line_item.tax_unavailable'),
+            # A refusal is the request's fault, an outage is not. 503 is also
+            # the one the SDK retries — it retries on status, not on our code.
+            status: refused ? :unprocessable_content : :service_unavailable
+          )
+        end
+
         def handle_parameter_missing(exception)
           Rails.error.report(exception, context: error_context, source: 'spree.api.v3')
           render_error(

data/app/controllers/concerns/spree/api/v3/params_normalizer.rb

@@ -27,7 +27,9 @@ module Spree
           ActionController::Parameters.new(hash).permit!
         end
 
-        def resolve_prefixed_ids(hash)
+        # @param owner [Class, nil] the model whose associations name these
+        #   keys, so `variant_id` is checked against `Spree::Variant`
+        def resolve_prefixed_ids(hash, owner = (model_class if respond_to?(:model_class, true)))
           hash.each_with_object({}.with_indifferent_access) do |(key, value), result|
             result[key] = case
                           # Preferences declare which of their values are ids
@@ -36,19 +38,49 @@ module Spree
                           when key.to_s == 'preferences'
                             value
                           when key.to_s.end_with?('_id') && prefixed_id?(value)
-                            decode_prefixed_id(value)
+                            decode_prefixed_id(value, key, owner)
                           when key.to_s.end_with?('_ids') && value.is_a?(Array)
-                            value.map { |v| prefixed_id?(v) ? decode_prefixed_id(v) : v }
+                            value.map { |v| prefixed_id?(v) ? decode_prefixed_id(v, key, owner) : v }
                           when value.is_a?(Hash)
-                            resolve_prefixed_ids(value)
+                            resolve_prefixed_ids(value, nested_owner(key, owner))
                           when value.is_a?(Array)
-                            value.map { |v| v.is_a?(Hash) ? resolve_prefixed_ids(v) : v }
+                            nested = nested_owner(key, owner)
+                            value.map { |v| v.is_a?(Hash) ? resolve_prefixed_ids(v, nested) : v }
                           else
                             value
                           end
           end
         end
 
+        # The model a nested hash or array of hashes describes, so the keys
+        # inside it are checked against the right associations: an order's
+        # `items` are line items, whose `variant_id` is a variant.
+        #
+        # A payload name is a public contract and does not always match the
+        # association — `items` is `line_items` — so a controller whose
+        # names differ declares the mapping in {nested_param_models}.
+        def nested_owner(key, owner)
+          return if owner.nil?
+
+          declared = nested_param_models[key.to_s]
+          return declared if declared
+
+          name = key.to_s
+          reflection = owner.try(:reflect_on_association, name) ||
+                       owner.try(:reflect_on_association, name.singularize)
+          reflection&.klass
+        rescue StandardError
+          nil
+        end
+
+        # Payload key => the model its rows describe, for the keys that do not
+        # name an association of their own.
+        #
+        # @return [Hash{String => Class}]
+        def nested_param_models
+          {}
+        end
+
         def normalize_nested_attributes(hash, klass = model_class)
           return hash unless klass.respond_to?(:nested_attributes_options)
 
@@ -83,8 +115,45 @@ module Spree
           Spree::PrefixedId.prefixed_id?(value)
         end
 
-        def decode_prefixed_id(prefixed_id_string)
-          Spree::PrefixedId.decode_prefixed_id(prefixed_id_string) || prefixed_id_string
+        # A prefixed id is decoded only when its prefix is the one the column
+        # expects. The sqid alphabet is shared, so `prod_` and `variant_`
+        # decode to the same integers: without this an order asked for a
+        # product answered 201 and held a line item for whatever variant
+        # happened to carry that number.
+        #
+        # An id of the wrong kind is left as it was. The association then
+        # fails to find it, which is a 404 or a validation error naming the
+        # field — the same answer any other unknown id gets, rather than a
+        # quiet write of the wrong record.
+        def decode_prefixed_id(prefixed_id_string, key = nil, owner = nil)
+          target = association_class(key, owner)
+
+          decoded = if target.respond_to?(:decode_own_prefixed_id)
+                      target.decode_own_prefixed_id(prefixed_id_string)
+                    else
+                      Spree::PrefixedId.decode_prefixed_id(prefixed_id_string)
+                    end
+
+          decoded || prefixed_id_string
+        end
+
+        # What `variant_id` points at, read from the owner's own association
+        # rather than guessed from the name — `reason_id` is a different class
+        # on a cancellation than on a refund.
+        def association_class(key, owner)
+          return if key.nil? || owner.nil?
+
+          name = key.to_s.sub(/_ids?\z/, '')
+          # `category_ids` names `has_many :categories`, so the singular form
+          # finds nothing and the id went through unchecked — the same hole
+          # the singular `_id` case had.
+          reflection = owner.try(:reflect_on_association, name) ||
+                       owner.try(:reflect_on_association, name.pluralize)
+          return if reflection.nil? || reflection.polymorphic?
+
+          reflection.klass
+        rescue StandardError
+          nil
         end
       end
     end

data/app/controllers/concerns/spree/api/v3/scoped_authorization.rb

@@ -98,7 +98,17 @@ module Spree
             # A `jwt_only` skip exempts the JWT/publishable principal we now know
             # this is (no secret key resolved) — shell data the dashboard reads
             # without a specific scope.
-            return if scope_check_skipped_for_action? && self.class._scope_check_skip_jwt_only
+            #
+            # Not a delegated credential, though. The exemption exists because
+            # a signed-in staff member is already bounded by their role, and an
+            # OAuth grant is bounded by something narrower that this would skip
+            # — it carries no API key, so it was taking the human's exemption
+            # and reading settings its scopes never covered.
+            if scope_check_skipped_for_action? && self.class._scope_check_skip_jwt_only
+              return if current_oauth_token.blank?
+
+              return authorize_staff_permission!
+            end
 
             # JWT staff pass through the same key gate as secret keys: their
             # roles' catalog keys play the role scopes play for keys, so both
@@ -142,7 +152,7 @@ module Spree
           # fallback, host-registered types) defer to CanCanCan's `authorize!`
           # — the caller stays gated per subject, just not by key.
           return unless Spree.permissions.key?(required)
-          return if ability.permission_keys.include?(required)
+          return if staff_permission_keys.include?(required)
 
           Rails.logger.info do
             "[Spree] Access denied: user=#{current_user.id} required=#{required} " \
@@ -216,7 +226,54 @@ module Spree
           ability = current_ability
           return true unless ability.respond_to?(:permission_keys)
 
-          ability.permission_keys.include?(key.to_s)
+          staff_permission_keys.include?(key.to_s)
+        end
+
+        # What a staff principal may do here, as catalog keys.
+        #
+        # Usually their roles' keys. When the request arrived on a delegated
+        # credential — an OAuth token a staff member approved for an agent or
+        # an app — the grant's scopes narrow that set: the person consented to
+        # part of their authority, not all of it. The grant can only ever
+        # subtract, so approving a client never widens what its owner holds.
+        #
+        # @return [Array<String>]
+        def staff_permission_keys
+          @staff_permission_keys ||= begin
+            ability = current_ability
+            held = ability.respond_to?(:permission_keys) ? ability.permission_keys.map(&:to_s) : []
+            granted = delegated_permission_keys
+            granted.nil? ? held : held & granted
+          end
+        end
+
+        # The scopes of the delegated credential this request arrived on, or
+        # nil when the staff member is acting directly (a dashboard session).
+        #
+        # Controllers that accept an OAuth token override
+        # `current_oauth_token`; everything else inherits nil and is unchanged.
+        #
+        # @return [Array<String>, nil]
+        def delegated_permission_keys
+          token = current_oauth_token
+          return nil if token.blank?
+
+          Spree.permissions.expand_keys(token.scopes.to_a)
+        end
+
+        # The delegated credential this request arrived on.
+        #
+        # Resolved here rather than overridden per controller: this module is
+        # included after the authentication concerns, so an override in one of
+        # them loses to this definition and the narrowing silently stops
+        # happening — which is how a token scoped to `read_products` once
+        # created one.
+        #
+        # @return [Spree::OauthAccessToken, nil]
+        def current_oauth_token
+          return nil unless respond_to?(:admin_oauth_token, true)
+
+          admin_oauth_token
         end
       end
     end

data/app/controllers/concerns/spree/api/v3/store/search_provider_support.rb

@@ -18,12 +18,11 @@ module Spree
           private
 
           def search_query
-            params.dig(:q, :search)
+            search_params['search']
           end
 
           def search_filters
-            q = params[:q]&.to_unsafe_h || params[:q] || {}
-            q = q.to_h if q.respond_to?(:to_h) && !q.is_a?(Hash)
+            q = search_params
             # Decode Stripe-style prefixed IDs in `*_id_in`/`id_eq`/etc. so
             # SPA + storefront filters can pass `prod_…` keys; the search
             # provider hands the filter hash straight to Ransack on the
@@ -31,6 +30,12 @@ module Spree
             decode_prefixed_id_predicates(q.except('search')).presence
           end
 
+          # A `q` sent as anything but a hash (`q=foo`) filters nothing.
+          def search_params
+            q = params[:q]
+            q.respond_to?(:to_unsafe_h) ? q.to_unsafe_h : {}
+          end
+
           def search_provider
             @search_provider ||= Spree.search_provider.constantize.new(current_store)
           end

data/app/controllers/spree/api/v3/admin/companies/tax_exemption_certificates_controller.rb

@@ -12,9 +12,8 @@ module Spree
             request_params :tax_exemption_certificate do |body|
               body.attribute :certificate_number, :string, required: true, on: :create,
                 example: 'DE-RESALE-7'
-              body.attribute :reason_code, :string, required: true, on: :create,
-                example: 'resale',
-                description: "Becomes the tax provider's entity use code."
+              body.attribute :tax_exemption_reason_id, :id, required: true, on: :create,
+                description: "One of the store's active tax exemption reasons. The tax provider receives its `code`."
               body.attribute :issuing_authority, :string, nullable: true, example: 'Finanzamt Berlin'
               body.attribute :issued_at, :datetime, nullable: true
               body.attribute :expires_at, :datetime, nullable: true
@@ -100,11 +99,18 @@ module Spree
             end
 
             def collection_includes
-              [{ document_attachment: :blob }]
+              [:tax_exemption_reason, { document_attachment: :blob }]
             end
 
+            # Read through the store, so another store's reason is a 404
+            # rather than a certificate pointing across stores.
             def permitted_params
-              params.permit(*declared_permitted_attributes)
+              attributes = params.permit(*declared_permitted_attributes)
+              return attributes if attributes[:tax_exemption_reason_id].blank?
+
+              attributes.except(:tax_exemption_reason_id).merge(
+                tax_exemption_reason: current_store.tax_exemption_reasons.find_by_prefix_id!(attributes[:tax_exemption_reason_id])
+              )
             end
 
             def build_resource

data/app/controllers/spree/api/v3/admin/concerns/external_references.rb

@@ -75,6 +75,9 @@ module Spree
 
               @resource = existing
               authorize_resource!(@resource, :update)
+              # This runs before a nested controller's own parent check, and
+              # rendering here ends the request before it would run.
+              authorize_parent!(@parent) if @parent.present?
               normalize_upsert_params!
               update
             end

data/app/controllers/spree/api/v3/admin/exports_controller.rb

@@ -75,10 +75,16 @@ module Spree
             [:user, { attachment_attachment: :blob }]
           end
 
+          # Narrowed to the kinds this caller may read.
+          #
+          # Filtered for every principal that carries a ceiling, not only a
+          # secret key: an OAuth token resolves as a staff user with no key,
+          # so testing for one let an agent list every export in the store —
+          # including that customer and gift-card exports exist — whatever the
+          # merchant consented to. A staff member on a narrow role was
+          # unfiltered for the same reason.
           def scope
             collection = super
-            return collection unless scope_limited_principal?
-
             collection.where(type: readable_export_types)
           end
 
@@ -144,10 +150,16 @@ module Spree
             action_name == 'create' ? resolve_export_type(params[:type]) : find_resource.class
           end
 
+          # `read_all` is not a catalog key, so it is asked of a secret key
+          # directly; every shipped export declares a required scope, and an
+          # extension type that declares none is readable only by a key that
+          # holds everything.
           def readable_export_types
             Spree::Export.available_types.select do |type|
               required = type.required_scope
-              required ? current_api_key.has_scope?("read_#{required}") : current_api_key.has_scope?('read_all')
+              next current_api_key&.has_scope?('read_all') if required.blank?
+
+              holds_permission?("read_#{required}")
             end.map(&:to_s)
           end
         end

data/app/controllers/spree/api/v3/admin/imports_controller.rb

@@ -247,10 +247,15 @@ module Spree
             [:user, :mappings, { attachment_attachment: :blob }]
           end
 
+          # Narrowed to the kinds this caller may write.
+          #
+          # Filtered for every principal that carries a ceiling, not only a
+          # secret key — see the matching note on Admin::ExportsController.
+          # It matters more here: an import row carries `sample_row`, a real
+          # line from the uploaded file, so an unfiltered list handed a
+          # read-only agent live customer data rather than only metadata.
           def scope
             collection = super
-            return collection unless scope_limited_principal?
-
             collection.where(type: writable_import_types)
           end
 
@@ -363,10 +368,14 @@ module Spree
             end
           end
 
+          # `write_all` is not a catalog key, so it is asked of a secret key
+          # directly; every shipped import declares a required scope.
           def writable_import_types
             Spree::Import.available_types.select do |type|
               required = type.required_scope
-              required ? current_api_key.has_scope?("write_#{required}") : current_api_key.has_scope?('write_all')
+              next current_api_key&.has_scope?('write_all') if required.blank?
+
+              holds_permission?("write_#{required}")
             end.map(&:to_s)
           end
 

data/app/controllers/spree/api/v3/admin/markets_controller.rb

@@ -26,7 +26,9 @@ module Spree
               required: true, on: :create,
               example: 'de',
               description: 'Locale used as the market default. Always part of `supported_locales`.'
-            body.attribute :tax_inclusive, :boolean, description: 'Display prices with tax included.'
+            body.attribute :tax_inclusive, :boolean,
+              description: 'Whether the prices entered for this market include tax. True charges every customer the ' \
+                           'price as entered, with their tax inside it; false adds tax at checkout.'
             body.attribute :tax_provider, :string,
               nullable: true,
               example: 'internal',

data/app/controllers/spree/api/v3/admin/me_controller.rb

@@ -45,6 +45,8 @@ module Spree
           # *other* users. `avatar_signed_id` takes a signed id from
           # POST /files to set the photo, or `null` to remove it.
           def update
+            return refuse_delegated_write if current_oauth_token.present?
+
             if current_user.update(permitted_params)
               render json: me_response
             else
@@ -54,6 +56,20 @@ module Spree
 
           private
 
+          # A grant acts *for* a staff member, not *as* one. This action is
+          # unguarded because it was only ever the person at the keyboard
+          # editing their own profile — but a delegated credential reaches it
+          # too, and the name it could rewrite is the one audit trails show
+          # as the actor. There is no catalog permission for "edit my own
+          # profile", so the answer is that an agent has no business here.
+          def refuse_delegated_write
+            render_error(
+              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
+              message: 'A connected agent cannot change the profile of the person who connected it.',
+              status: :forbidden
+            )
+          end
+
           # A request authenticated by a secret API key has no Spree user to
           # describe/update, so it gets a 404 pointing at the key endpoint
           # rather than a 500 from a nil user — mirroring ApiKeysController#current.
@@ -82,11 +98,15 @@ module Spree
             params.permit(*declared_permitted_attributes)
           end
 
+          # What this credential may do, which is not always what its owner
+          # may do: a grant narrows the approver's role, so reporting the
+          # role would both disclose more than was handed over and mislead a
+          # client that reads /me to decide what to attempt.
           def me_response
             {
               user: admin_user_serializer.new(current_user, params: serializer_params).to_h,
               permissions: serialize_permissions(current_ability),
-              permission_keys: serialize_permission_keys(current_ability)
+              permission_keys: staff_permission_keys
             }
           end