spree_api 6.0.0.rc3 → 6.0.0.rc5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2bf002c9d8182f8a69971d92c1ba84a2fe26571baefa007570c1a6e30761bd48
-  data.tar.gz: 78504b7007e37077c04a3b75b33644ad3e127670d7ec221888743bac8f25c9aa
+  metadata.gz: cf869734311256969147c858239c279f8aec3faac383f6bf030937eedc9fc54e
+  data.tar.gz: e8a7fa2d529fd09e06f6d9b3ad7007e5122c2b56ad0a0e3b32ce8fccb0d4d073
 SHA512:
-  metadata.gz: ab37287b927bcbcc8c0e79ecfad9795608390098243660a2bd0b79a0c8b104b72a0f7485b1b67790b5f7b0978ea3af18349b7870b50c85edfdeb1702e1eca87a
-  data.tar.gz: 2317c9ac3b2cd0aecdcf432d9c83dab6ec44b077b078c960ddda56b9a066a41080841779c2a1bd6838bfb2fe07c71b03d3e6b34b8ad37681df20f61bdd637c98
+  metadata.gz: ef0d1a79bbdcd73ce34176fbe9054090214f326458c2840ac0937582334f639a4907df1cfa7bae30b566976bec1770fa32f455369eded75a8fc456b01efcbb08
+  data.tar.gz: 439f5b98f55aab51ce2d07f037336b175dce46c5e3bc9383685beebe35c34a7d519c004cf2697f68821b52ce538023a3de0dd68ee3b2522062a119db8906b59c

data/app/controllers/concerns/spree/api/v3/admin/email_template_lookup.rb

@@ -60,12 +60,17 @@ module Spree
 
           # An unsaved subject and body are previewed only when sent, so an
           # empty body still previews as empty. `branding` previews unsaved
-          # colors and font.
+          # colors and font, `mailer_logo_signed_id` an unsaved logo (null
+          # removes it, as it does when saving the store).
           def preview_arguments
             arguments = params.permit(:record_id, :subject, :body).to_h.symbolize_keys
             arguments[:locale] = language
             arguments[:email_key] = params[:email_key].to_s.tr('.', '/').presence
             arguments[:branding] = params.fetch(:branding, {}).permit(*Spree::Emails::Branding.attribute_names).to_h
+            if params.key?(:mailer_logo_signed_id)
+              signed_id = params[:mailer_logo_signed_id].presence&.to_s
+              arguments.merge!(mailer_logo_signed_id: signed_id, mailer_logo_cleared: signed_id.nil?)
+            end
             arguments
           end
 

data/app/controllers/concerns/spree/api/v3/admin/reporting_authorization.rb

@@ -3,22 +3,31 @@ module Spree
     module V3
       module Admin
         # Per-member authorization for the reporting vocabulary. Metrics,
-        # dimensions and counters all declare a `subject` (checked for JWT
-        # staff through CanCanCan) paired with a `key_scope` (checked for
-        # secret keys), so one predicate answers for every member and every
+        # dimensions and counters all declare a `key_scope` paired with a
+        # `subject`, so one predicate answers for every member and every
         # surface that lists them — the schema, a query, the home screen's
         # counters — filters by the same rule.
+        #
+        # Asked of the credential rather than of its owner. Branching on
+        # `current_api_key` measured an OAuth grant against the approving
+        # staff member's whole role, because a token authenticates as that
+        # person and carries no key: a grant for `read_reports` alone could
+        # group a report by customer and read names, emails and spend.
+        # `holds_permission?` is the narrowed answer for all three
+        # principals — a key's scopes, a grant's, or the role when someone is
+        # acting directly at the dashboard.
         module ReportingAuthorization
           extend ActiveSupport::Concern
 
           private
 
           def member_allowed?(member)
-            if current_api_key.present?
-              member.key_scope.blank? || current_api_key.has_scope?(member.key_scope)
-            else
-              member.subject.nil? || can?(:read, member.subject.call)
-            end
+            return false unless member.key_scope.blank? || holds_permission?(member.key_scope)
+
+            # The permission says whether this kind of data is in scope at
+            # all; a host app's record-level rule can still narrow which of
+            # it this person sees.
+            member.subject.nil? || can?(:read, member.subject.call)
           end
         end
       end

data/app/controllers/concerns/spree/api/v3/admin/store_context.rb

@@ -60,6 +60,13 @@ module Spree
           def resolve_admin_store
             return secret_api_key.store if secret_api_key
 
+            # An OAuth client is registered for one store and consented to on
+            # that store, so its token names the tenancy as surely as a secret
+            # key does. Reading the header instead would let a client name
+            # another merchant's store on a grant that never covered it.
+            oauth_store = respond_to?(:admin_oauth_token, true) && admin_oauth_token&.application&.store
+            return oauth_store if oauth_store
+
             if store_id_header
               Spree::Store.find_by_prefix_id(store_id_header)
             else

data/app/controllers/concerns/spree/api/v3/admin_authentication.rb

@@ -50,6 +50,11 @@ module Spree
             return true
           end
 
+          # Then an OAuth token, which carries both the admin who granted it
+          # and the store its client was registered for, so neither a JWT's
+          # store-membership check nor a key's store selection applies.
+          return true if authenticate_admin_oauth_token
+
           # Fall back to JWT authentication, then bind the admin to the store
           # they hold a role on (the token itself is store-agnostic).
           return false unless require_authentication!
@@ -59,6 +64,62 @@ module Spree
 
         private
 
+        # An OAuth bearer token, accepted only when it was issued for this
+        # API. A token names the resources it may be used against (RFC 8707),
+        # and a client asking for one endpoint must not receive a credential
+        # good across the rest — so a token naming only the MCP endpoint is
+        # refused here, and the MCP controller refuses one naming only this.
+        #
+        # @return [Boolean] true when the request is now authenticated
+        def authenticate_admin_oauth_token
+          token = admin_oauth_token
+          return false if token.nil?
+
+          owner = token.resource_owner
+          return false unless owner.is_a?(Spree.admin_user_class)
+
+          @current_api_key = nil
+          @current_user = owner
+          true
+        end
+
+        # @return [Spree::OauthAccessToken, nil]
+        def admin_oauth_token
+          return @admin_oauth_token if defined?(@admin_oauth_token)
+
+          @admin_oauth_token = begin
+            token = Spree::OauthAccessToken.by_token(oauth_bearer_value)
+            token if token&.accessible? && admin_audience_matches?(token)
+          end
+        end
+
+        # Split rather than matched: a regex with `\s+(.+)` backtracks on a
+        # header of many spaces, and this one is attacker-supplied on an
+        # unauthenticated request.
+        #
+        # @return [String, nil]
+        def oauth_bearer_value
+          scheme, value = request.headers['Authorization'].to_s.split(' ', 2)
+          return unless scheme&.casecmp?('Bearer')
+
+          value.to_s.strip.presence
+        end
+
+        # Compared by path, because the origin a client was given varies with
+        # how the installation is reached — a tunnel, a proxy, a custom
+        # domain — while the path it names does not. An unbound token is
+        # refused rather than trusted.
+        def admin_audience_matches?(token)
+          expected = Spree::Api::Oauth.resources[:admin]
+          return false if expected.blank?
+
+          token.resource.to_s.split.any? do |indicator|
+            URI.parse(indicator).path == expected
+          rescue URI::InvalidURIError
+            false
+          end
+        end
+
         # Rejects an authenticated JWT admin who has no role on +current_store+.
         # API-key principals are already store-bound and skip this check.
         def require_store_membership!

data/app/controllers/concerns/spree/api/v3/allowed_redirect_url.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V3
+      # Reads the `redirect_url` a storefront passes for an emailed link.
+      #
+      # The link carries a live token, so a page outside the store's allowed
+      # origins would hand that token to whoever named the page. An address
+      # that does not match is dropped rather than refused, so callers cannot
+      # probe the allow-list through error responses.
+      module AllowedRedirectUrl
+        extend ActiveSupport::Concern
+
+        private
+
+        # @return [String, nil] the redirect URL when it matches one of the
+        #   store's allowed origins
+        def validated_redirect_url
+          redirect_url = params[:redirect_url]
+          return if redirect_url.blank?
+          return unless current_store.allowed_origin?(redirect_url)
+
+          redirect_url
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/cart_resolvable.rb

@@ -11,10 +11,16 @@ module Spree
         # Find cart by prefixed ID and authorize read access (owner or guest
         # token). Completed carts are not carts anymore — they 404 unless the
         # caller opts in (idempotent completion, payment-session confirm races).
+        #
+        # Pass +token: nil+ to demand ownership. A guest token proves the
+        # caller holds this cart, which is the right bar for the cart's own
+        # contents and no higher — an endpoint reaching past the cart into
+        # something the account holds asks for the account instead.
+        #
         # @return [Spree::Cart]
-        def find_cart(include_completed: false)
+        def find_cart(include_completed: false, token: cart_token)
           @cart = resolve_cart(include_completed: include_completed)
-          authorize_storefront_read!(@cart, token: cart_token)
+          authorize_storefront_read!(@cart, token: token)
           @cart
         end
 

data/app/controllers/concerns/spree/api/v3/error_handler.rb

@@ -90,6 +90,11 @@ module Spree
           # Request errors
           request_too_large: 'request_too_large',
 
+          # Tax engine errors — the same two codes the completion workflow
+          # reports, so a client sees one vocabulary wherever tax failed.
+          tax_provider_unavailable: 'tax_provider_unavailable',
+          tax_calculation_refused: 'tax_calculation_refused',
+
           # General errors
           processing_error: 'processing_error',
           invalid_request: 'invalid_request'
@@ -101,6 +106,12 @@ module Spree
           rescue_from CanCan::AccessDenied, with: :handle_access_denied
           rescue_from Spree::Storefront::AccessDenied, with: :handle_access_denied
           rescue_from Spree::Core::GatewayError, with: :handle_gateway_error
+          # The backstop for every path that prices tax. Cart updates and
+          # completion answer for themselves, with a message shaped to what the
+          # customer was doing; anything else — adding an item, changing a
+          # quantity, a recalculation — reaches here rather than escaping as a
+          # 500 with an HTML body that a storefront cannot tell from a bug.
+          rescue_from Spree::Tax::ProviderError, with: :handle_tax_provider_error
           rescue_from ActionController::ParameterMissing, with: :handle_parameter_missing
           rescue_from ActiveRecord::RecordInvalid, with: :handle_record_invalid
           rescue_from Spree::Preferences::InvalidPreferences, with: :handle_invalid_preferences
@@ -171,6 +182,25 @@ module Spree
           end
         end
 
+        # Renders a failed workflow or service result. A tax engine failure the
+        # workflow caught itself (so it could roll the cart back) answers as
+        # handle_tax_provider_error would have: 503 for an outage, the one
+        # status the SDK retries, and 422 for a refusal. Anything else is
+        # rendered with +code+.
+        #
+        # @param result [Spree::ServiceModule::Result]
+        # @param code [String] the error code for any other failure
+        def render_result_failure(result, code:)
+          case result.error.code
+          when ERROR_CODES[:tax_provider_unavailable]
+            render_error(code: ERROR_CODES[:tax_provider_unavailable], message: result.error.to_s, status: :service_unavailable)
+          when ERROR_CODES[:tax_calculation_refused]
+            render_error(code: ERROR_CODES[:tax_calculation_refused], message: result.error.to_s, status: :unprocessable_content)
+          else
+            render_service_error(result.error, code: code)
+          end
+        end
+
         # Legacy support - redirect to new error handling
         def render_errors(errors, status = :unprocessable_content)
           code = infer_error_code(errors, status)
@@ -235,6 +265,25 @@ module Spree
           )
         end
 
+        # Refused and unavailable are different instructions to the customer, so
+        # they keep different codes: one names something to fix, the other is
+        # worth retrying. Avalara's own wording is passed through for a refusal
+        # because it names the problem better than we can; an outage says only
+        # that, since its detail is about our endpoint and belongs in the error
+        # tracker.
+        def handle_tax_provider_error(exception)
+          Rails.error.report(exception, context: error_context, source: 'spree.api.v3')
+
+          refused = exception.is_a?(Spree::Tax::CalculationRefused)
+          render_error(
+            code: refused ? ERROR_CODES[:tax_calculation_refused] : ERROR_CODES[:tax_provider_unavailable],
+            message: refused ? exception.message.to_s : I18n.t('spree.cart_line_item.tax_unavailable'),
+            # A refusal is the request's fault, an outage is not. 503 is also
+            # the one the SDK retries — it retries on status, not on our code.
+            status: refused ? :unprocessable_content : :service_unavailable
+          )
+        end
+
         def handle_parameter_missing(exception)
           Rails.error.report(exception, context: error_context, source: 'spree.api.v3')
           render_error(

data/app/controllers/concerns/spree/api/v3/params_normalizer.rb

@@ -27,7 +27,9 @@ module Spree
           ActionController::Parameters.new(hash).permit!
         end
 
-        def resolve_prefixed_ids(hash)
+        # @param owner [Class, nil] the model whose associations name these
+        #   keys, so `variant_id` is checked against `Spree::Variant`
+        def resolve_prefixed_ids(hash, owner = (model_class if respond_to?(:model_class, true)))
           hash.each_with_object({}.with_indifferent_access) do |(key, value), result|
             result[key] = case
                           # Preferences declare which of their values are ids
@@ -36,19 +38,49 @@ module Spree
                           when key.to_s == 'preferences'
                             value
                           when key.to_s.end_with?('_id') && prefixed_id?(value)
-                            decode_prefixed_id(value)
+                            decode_prefixed_id(value, key, owner)
                           when key.to_s.end_with?('_ids') && value.is_a?(Array)
-                            value.map { |v| prefixed_id?(v) ? decode_prefixed_id(v) : v }
+                            value.map { |v| prefixed_id?(v) ? decode_prefixed_id(v, key, owner) : v }
                           when value.is_a?(Hash)
-                            resolve_prefixed_ids(value)
+                            resolve_prefixed_ids(value, nested_owner(key, owner))
                           when value.is_a?(Array)
-                            value.map { |v| v.is_a?(Hash) ? resolve_prefixed_ids(v) : v }
+                            nested = nested_owner(key, owner)
+                            value.map { |v| v.is_a?(Hash) ? resolve_prefixed_ids(v, nested) : v }
                           else
                             value
                           end
           end
         end
 
+        # The model a nested hash or array of hashes describes, so the keys
+        # inside it are checked against the right associations: an order's
+        # `items` are line items, whose `variant_id` is a variant.
+        #
+        # A payload name is a public contract and does not always match the
+        # association — `items` is `line_items` — so a controller whose
+        # names differ declares the mapping in {nested_param_models}.
+        def nested_owner(key, owner)
+          return if owner.nil?
+
+          declared = nested_param_models[key.to_s]
+          return declared if declared
+
+          name = key.to_s
+          reflection = owner.try(:reflect_on_association, name) ||
+                       owner.try(:reflect_on_association, name.singularize)
+          reflection&.klass
+        rescue StandardError
+          nil
+        end
+
+        # Payload key => the model its rows describe, for the keys that do not
+        # name an association of their own.
+        #
+        # @return [Hash{String => Class}]
+        def nested_param_models
+          {}
+        end
+
         def normalize_nested_attributes(hash, klass = model_class)
           return hash unless klass.respond_to?(:nested_attributes_options)
 
@@ -83,8 +115,45 @@ module Spree
           Spree::PrefixedId.prefixed_id?(value)
         end
 
-        def decode_prefixed_id(prefixed_id_string)
-          Spree::PrefixedId.decode_prefixed_id(prefixed_id_string) || prefixed_id_string
+        # A prefixed id is decoded only when its prefix is the one the column
+        # expects. The sqid alphabet is shared, so `prod_` and `variant_`
+        # decode to the same integers: without this an order asked for a
+        # product answered 201 and held a line item for whatever variant
+        # happened to carry that number.
+        #
+        # An id of the wrong kind is left as it was. The association then
+        # fails to find it, which is a 404 or a validation error naming the
+        # field — the same answer any other unknown id gets, rather than a
+        # quiet write of the wrong record.
+        def decode_prefixed_id(prefixed_id_string, key = nil, owner = nil)
+          target = association_class(key, owner)
+
+          decoded = if target.respond_to?(:decode_own_prefixed_id)
+                      target.decode_own_prefixed_id(prefixed_id_string)
+                    else
+                      Spree::PrefixedId.decode_prefixed_id(prefixed_id_string)
+                    end
+
+          decoded || prefixed_id_string
+        end
+
+        # What `variant_id` points at, read from the owner's own association
+        # rather than guessed from the name — `reason_id` is a different class
+        # on a cancellation than on a refund.
+        def association_class(key, owner)
+          return if key.nil? || owner.nil?
+
+          name = key.to_s.sub(/_ids?\z/, '')
+          # `category_ids` names `has_many :categories`, so the singular form
+          # finds nothing and the id went through unchecked — the same hole
+          # the singular `_id` case had.
+          reflection = owner.try(:reflect_on_association, name) ||
+                       owner.try(:reflect_on_association, name.pluralize)
+          return if reflection.nil? || reflection.polymorphic?
+
+          reflection.klass
+        rescue StandardError
+          nil
         end
       end
     end

data/app/controllers/concerns/spree/api/v3/scoped_authorization.rb

@@ -98,7 +98,17 @@ module Spree
             # A `jwt_only` skip exempts the JWT/publishable principal we now know
             # this is (no secret key resolved) — shell data the dashboard reads
             # without a specific scope.
-            return if scope_check_skipped_for_action? && self.class._scope_check_skip_jwt_only
+            #
+            # Not a delegated credential, though. The exemption exists because
+            # a signed-in staff member is already bounded by their role, and an
+            # OAuth grant is bounded by something narrower that this would skip
+            # — it carries no API key, so it was taking the human's exemption
+            # and reading settings its scopes never covered.
+            if scope_check_skipped_for_action? && self.class._scope_check_skip_jwt_only
+              return if current_oauth_token.blank?
+
+              return authorize_staff_permission!
+            end
 
             # JWT staff pass through the same key gate as secret keys: their
             # roles' catalog keys play the role scopes play for keys, so both
@@ -142,18 +152,22 @@ module Spree
           # fallback, host-registered types) defer to CanCanCan's `authorize!`
           # — the caller stays gated per subject, just not by key.
           return unless Spree.permissions.key?(required)
-          return if ability.permission_keys.include?(required)
+          return if staff_permission_keys.include?(required)
 
           Rails.logger.info do
             "[Spree] Access denied: user=#{current_user.id} required=#{required} " \
               "held=#{ability.permission_keys.join(',')}"
           end
 
+          render_missing_permission(required)
+        end
+
+        def render_missing_permission(permission)
           render_error(
             code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
-            message: "Missing permission: #{required}",
+            message: "Missing permission: #{permission}",
             status: :forbidden,
-            details: { required_permission: required }
+            details: { required_permission: permission }
           )
         end
 
@@ -216,7 +230,54 @@ module Spree
           ability = current_ability
           return true unless ability.respond_to?(:permission_keys)
 
-          ability.permission_keys.include?(key.to_s)
+          staff_permission_keys.include?(key.to_s)
+        end
+
+        # What a staff principal may do here, as catalog keys.
+        #
+        # Usually their roles' keys. When the request arrived on a delegated
+        # credential — an OAuth token a staff member approved for an agent or
+        # an app — the grant's scopes narrow that set: the person consented to
+        # part of their authority, not all of it. The grant can only ever
+        # subtract, so approving a client never widens what its owner holds.
+        #
+        # @return [Array<String>]
+        def staff_permission_keys
+          @staff_permission_keys ||= begin
+            ability = current_ability
+            held = ability.respond_to?(:permission_keys) ? ability.permission_keys.map(&:to_s) : []
+            granted = delegated_permission_keys
+            granted.nil? ? held : held & granted
+          end
+        end
+
+        # The scopes of the delegated credential this request arrived on, or
+        # nil when the staff member is acting directly (a dashboard session).
+        #
+        # Controllers that accept an OAuth token override
+        # `current_oauth_token`; everything else inherits nil and is unchanged.
+        #
+        # @return [Array<String>, nil]
+        def delegated_permission_keys
+          token = current_oauth_token
+          return nil if token.blank?
+
+          Spree.permissions.expand_keys(token.scopes.to_a)
+        end
+
+        # The delegated credential this request arrived on.
+        #
+        # Resolved here rather than overridden per controller: this module is
+        # included after the authentication concerns, so an override in one of
+        # them loses to this definition and the narrowing silently stops
+        # happening — which is how a token scoped to `read_products` once
+        # created one.
+        #
+        # @return [Spree::OauthAccessToken, nil]
+        def current_oauth_token
+          return nil unless respond_to?(:admin_oauth_token, true)
+
+          admin_oauth_token
         end
       end
     end

data/app/controllers/spree/api/v3/admin/companies/addresses_controller.rb

@@ -61,8 +61,14 @@ module Spree
               Spree.api.admin_address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
+            # The listing includes what the node inherits: a division's orders may ship to its headquarters' sites,
+            # so staff placing one must be able to see them — while writes stay with the node that owns the row.
             def scope
-              @parent.addresses
+              action_name == 'index' ? @parent.address_book : @parent.addresses
             end
           end
         end

data/app/controllers/spree/api/v3/admin/companies/tax_exemption_certificates_controller.rb

@@ -12,9 +12,8 @@ module Spree
             request_params :tax_exemption_certificate do |body|
               body.attribute :certificate_number, :string, required: true, on: :create,
                 example: 'DE-RESALE-7'
-              body.attribute :reason_code, :string, required: true, on: :create,
-                example: 'resale',
-                description: "Becomes the tax provider's entity use code."
+              body.attribute :tax_exemption_reason_id, :id, required: true, on: :create,
+                description: "One of the store's active tax exemption reasons. The tax provider receives its `code`."
               body.attribute :issuing_authority, :string, nullable: true, example: 'Finanzamt Berlin'
               body.attribute :issued_at, :datetime, nullable: true
               body.attribute :expires_at, :datetime, nullable: true
@@ -100,11 +99,18 @@ module Spree
             end
 
             def collection_includes
-              [{ document_attachment: :blob }]
+              [:tax_exemption_reason, { document_attachment: :blob }]
             end
 
+            # Read through the store, so another store's reason is a 404
+            # rather than a certificate pointing across stores.
             def permitted_params
-              params.permit(*declared_permitted_attributes)
+              attributes = params.permit(*declared_permitted_attributes)
+              return attributes if attributes[:tax_exemption_reason_id].blank?
+
+              attributes.except(:tax_exemption_reason_id).merge(
+                tax_exemption_reason: current_store.tax_exemption_reasons.find_by_prefix_id!(attributes[:tax_exemption_reason_id])
+              )
             end
 
             def build_resource

data/app/controllers/spree/api/v3/admin/concerns/external_references.rb

@@ -75,6 +75,9 @@ module Spree
 
               @resource = existing
               authorize_resource!(@resource, :update)
+              # This runs before a nested controller's own parent check, and
+              # rendering here ends the request before it would run.
+              authorize_parent!(@parent) if @parent.present?
               normalize_upsert_params!
               update
             end

data/app/controllers/spree/api/v3/admin/custom_fields_controller.rb

@@ -64,16 +64,37 @@ module Spree
           # store can't read or write custom fields on another store's records.
           # Users are intentionally global in Spree (`User.for_store` is a
           # no-op), so the store boundary for customer parents is enforced by
-          # the `authorize!(:show, @parent)` ability check above.
+          # the `authorize!(:update, @parent)` ability check above.
+          #
+          # Fails closed: `Spree::Base.for_store` answers the bare class when the
+          # store has no association for the model, which would search every
+          # store's records.
           def parent_relation
             klass = parent_lookup.klass
-            klass.respond_to?(:for_store) ? klass.for_store(current_store) : klass
+            return klass.where(id: current_store.id) if klass <= Spree::Store
+            return klass if klass <= Spree.customer_class
+
+            relation = klass.for_store(current_store)
+            raise ActiveRecord::RecordNotFound, 'Parent resource not found' if relation.equal?(klass)
+
+            relation
           end
 
           # Product-family parents have no scope pair of their own — their
           # custom fields are catalog data, gated by `products` like the rest
           # of the variant/option-type surface.
-          SCOPE_OVERRIDES = { 'option_type' => :products, 'variant' => :products }.freeze
+          # Parents whose own controller is gated by a scope other than their
+          # plural name share that controller's scope.
+          SCOPE_OVERRIDES = {
+            'option_type' => :products,
+            'variant' => :products,
+            'company' => :customers,
+            'stock_transfer' => :stock,
+            'purchase_order' => :purchasing,
+            'payment_method' => :settings,
+            'tax_rate' => :settings,
+            'store' => :settings
+          }.freeze
 
           # Per-parent scope check: a key holding `write_products` may write a
           # product's custom fields, `write_orders` may write an order's, etc.
@@ -104,12 +125,13 @@ module Spree
           # code reloads — `enabled_resources` is captured at boot and its
           # class references go stale. Aliases `'customer'` because the route
           # uses `customer_id` while user_class.model_name.element is `'user'`,
-          # and `'category'` because the routes expose taxons as categories
-          # (5.5 rename) while the model's element is still `'taxon'`.
+          # `'category'` because the routes expose taxons as categories
+          # (5.5 rename) while the model's element is still `'taxon'`, and
+          # `'medium'` because Rails singularizes the `media` route to `medium_id`.
           def parent_route_map
             @parent_route_map ||= Spree.custom_fields.enabled_resources.each_with_object({}) do |klass, m|
               m[klass.model_name.element.to_s] = klass.name
-            end.merge('customer' => Spree.customer_class.name, 'category' => 'Spree::Category')
+            end.merge('customer' => Spree.customer_class.name, 'category' => 'Spree::Category', 'medium' => 'Spree::Media')
           end
 
           # Returns the first segment whose `<segment>_id` is in the route,
@@ -117,8 +139,8 @@ module Spree
           # by both `set_parent` and `scoped_resource_name`.
           #
           # Read from the path only: a `store_id` or `refund_id` added to the
-          # query string or body must not switch the parent to a type that is
-          # never routed here and has no store scope to narrow it.
+          # query string or body must not switch the parent away from the record
+          # the route names.
           def parent_lookup
             return @parent_lookup if defined?(@parent_lookup)
 

data/app/controllers/spree/api/v3/admin/customers/addresses_controller.rb

@@ -69,6 +69,10 @@ module Spree
               Spree.api.admin_address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
             private
 
             def address_attrs

data/app/controllers/spree/api/v3/admin/customers_controller.rb

@@ -248,12 +248,7 @@ module Spree
             missing = EXPORT_PERMISSIONS.reject { |permission| holds_permission?(permission) }
             return true if missing.empty?
 
-            render_error(
-              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
-              message: "Missing permission: #{missing.first}",
-              status: :forbidden,
-              details: { required_permission: missing.first }
-            )
+            render_missing_permission(missing.first)
             false
           end