spree_api 6.0.0.rc3 → 6.0.0.rc5

data/app/controllers/spree/api/v3/resource_controller.rb

@@ -268,6 +268,7 @@ module Spree
                     preload_associations_lazily.
                     ransack(ransack_params, auth_object: ransack_auth_object)
           result = @search.result(distinct: collection_distinct?)
+          result = result.with_translation_fallback_order if model_class.include?(Spree::TranslatableResource)
           pagy_options = { limit: limit, page: page }
           result = apply_collection_sort(result)
           @pagy, @collection = pagy(result, **pagy_options)
@@ -558,7 +559,17 @@ module Spree
         # declared on the model. Override +resource_permitted_attributes+ rather
         # than this, so the extension union is not lost.
         def permitted_attributes
-          resource_permitted_attributes + model_additional_permitted_attributes
+          with_nested_additional_permitted_attributes(resource_permitted_attributes) + model_additional_permitted_attributes
+        end
+
+        # Nested lists this resource writes, keyed by param name, mapped to the
+        # model each entry becomes — +{ media: Spree::Media }+ lets an
+        # extension's +Spree::Media.additional_permitted_attributes+ ride the
+        # product's +media+ entries, not only the media endpoint.
+        #
+        # @return [Hash{Symbol => Class}]
+        def nested_permitted_models
+          {}
         end
 
         # The resource's writable attributes: its `request_params`
@@ -579,13 +590,33 @@ module Spree
         def model_additional_permitted_attributes
           return [] unless respond_to?(:model_class, true)
 
-          model = model_class
-          return [] unless model.respond_to?(:additional_permitted_attributes)
-
-          Array(model.additional_permitted_attributes)
+          additional_permitted_attributes_for(model_class)
         rescue NotImplementedError
           []
         end
+
+        # What extensions declared writable on +model+. `Spree.base_class` is
+        # host-overridable, so the class_attribute may not be there at all.
+        #
+        # @param model [Class]
+        # @return [Array]
+        def additional_permitted_attributes_for(model)
+          Array(model.try(:additional_permitted_attributes))
+        end
+
+        def with_nested_additional_permitted_attributes(attributes)
+          return attributes if nested_permitted_models.empty?
+
+          attributes.map do |attribute|
+            next attribute unless attribute.is_a?(Hash)
+
+            attribute.to_h do |name, nested|
+              model = nested_permitted_models[name.to_sym]
+              additional = model ? additional_permitted_attributes_for(model) : []
+              [name, additional.any? && nested.is_a?(Array) ? nested + additional : nested]
+            end
+          end
+        end
       end
     end
   end

data/app/controllers/spree/api/v3/seller/package_types_controller.rb

@@ -28,12 +28,12 @@ module Spree
             body.attribute :length, :number, nullable: true
             body.attribute :width, :number, nullable: true
             body.attribute :height, :number, nullable: true
-            body.attribute :dimensions_unit, :string, nullable: true, choices: Spree::Variant::DIMENSION_UNITS
+            body.attribute :dimensions_unit, :dimension_unit, nullable: true
             body.attribute :weight, :number,
               nullable: true,
               description: "The empty package's own weight, added to every quote."
             body.attribute :max_weight, :number, nullable: true
-            body.attribute :weight_unit, :string, nullable: true, choices: Spree::Variant::WEIGHT_UNITS
+            body.attribute :weight_unit, :weight_unit, nullable: true
             body.attribute :default, :boolean,
               description: "Makes this the box this seller's parcels are quoted with. One default per seller, so it never displaces the marketplace's."
             body.attribute :metadata, :hash, nullable: true

data/app/controllers/spree/api/v3/seller/products_controller.rb

@@ -41,19 +41,6 @@ module Spree
             'archived' => -> { Spree.product_archive_workflow }
           }.freeze
 
-          # The operator's price shape, except `currency` may be left out: the
-          # store's currency is assumed (see `default_price_currencies`).
-          PRICE = Spree::Api::V3::RequestSchema.new do |schema|
-            schema.attribute :currency, :currency,
-              example: 'USD',
-              description: "Omit to price in the store's currency. A seller has no currency of their own."
-            schema.attribute :amount, :decimal,
-              required: true,
-              example: '24.00',
-              description: 'A canonical decimal string (`"1234.56"`: period decimal, no grouping). The API does not parse localized input.'
-            schema.attribute :compare_at_amount, :decimal, nullable: true, example: '30.00'
-          end
-
           scoped_resource :products
 
           request_params :product do |body|
@@ -69,7 +56,7 @@ module Spree
               description: "The marketplace's product type this product is listed against, from the product types endpoint. Null detaches it. Saving with a type seeds its option types onto the product."
             body.attribute :delivery_profile_id, :id,
               description: "Which of the marketplace's delivery profiles the product ships under. A new product sent without one lands on the profile marked default."
-            body.attribute :prices, :array, of: PRICE,
+            body.attribute :prices, :array, of: Spree::Api::V3::Seller::PriceRequestSchema,
               description: "Shorthand for a simple (no-options) product: per-currency prices that forward to the product's sole variant."
             # `external_url` stays out for the same reason it does on the
             # operator's endpoint: it would make the server fetch a URL the
@@ -83,56 +70,11 @@ module Spree
               media_item.attribute :variant_ids, :array, of: :id,
                 description: 'Replaces the variants this media is linked to. An empty list clears them.'
             end
-            # Narrower than the operator's variant set: `seller_id` would let a
-            # payload hand a variant to somebody else, and
-            # `tax_category_id`/`delivery_profile_id` are marketplace
-            # configuration.
             body.attribute :variants, :array,
-              as: 'SellerProductVariantParams',
+              as: 'ProductVariantParams',
               description: 'The variants, as a whole: one absent from the list is removed. Pass `id` to update an existing variant.' do |variant|
+              variant.extends Spree::Api::V3::Seller::VariantRequestSchema
               variant.attribute :id, :id
-              variant.attribute :sku, :string
-              variant.attribute :barcode, :string
-              variant.attribute :cost_price, :decimal, nullable: true
-              variant.attribute :cost_currency, :currency
-              variant.attribute :weight, :number, nullable: true
-              variant.attribute :height, :number, nullable: true
-              variant.attribute :width, :number, nullable: true
-              variant.attribute :depth, :number, nullable: true
-              variant.attribute :weight_unit, :string, choices: Spree::Variant::WEIGHT_UNITS
-              variant.attribute :dimensions_unit, :string, choices: Spree::Variant::DIMENSION_UNITS
-              variant.attribute :hs_code, :string
-              variant.attribute :customs_description, :string
-              variant.attribute :country_of_origin, :country
-              variant.attribute :minimum_order_quantity, :integer, nullable: true
-              variant.attribute :order_multiple, :integer, nullable: true
-              variant.attribute :purchase_unit, :string
-              variant.attribute :units_per_carton, :integer,
-                nullable: true,
-                description: 'How many units fill one carton.'
-              variant.attribute :carton_package_type_id, :id,
-                nullable: true,
-                description: 'The carton this variant is packed into: a package type of kind `carton`.'
-              variant.attribute :carton_weight, :number,
-                nullable: true,
-                description: "What one packed carton weighs, in the variant's weight unit."
-              variant.attribute :cartons_per_pallet, :integer,
-                nullable: true,
-                description: 'How many cartons stack on one pallet.'
-              variant.attribute :track_inventory, :boolean
-              variant.attribute :preorderable, :boolean
-              variant.attribute :preorder_ships_at, :datetime,
-                nullable: true,
-                description: 'The "ships by" date shown to customers while the variant is a pre-order. Null clears it.'
-              variant.attribute :backorder_limit, :integer,
-                nullable: true,
-                description: 'Maximum units sellable beyond available stock, capping backorders and pre-orders. Null is unlimited.'
-              variant.attribute :position, :integer
-              variant.attribute :options, :array, of: Spree::Api::V3::VariantOptionRequestSchema,
-                description: 'One pair per option type the variant takes part in (size, color).'
-              variant.attribute :prices, :array, of: PRICE, description: 'Per-currency prices. Upserted by currency.'
-              variant.attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
-                description: "Stock per location, at this seller's own locations only: a location belonging to anyone else is ignored."
             end
           end
 
@@ -270,6 +212,10 @@ module Spree
             Spree.product_update_workflow
           end
 
+          def nested_permitted_models
+            { media: Spree::Media, variants: Spree::Variant }
+          end
+
           # The workflow builds its own product, which would leave a seller's
           # listing unowned. Handing it one built through `current_seller.products`
           # keeps the seller on the record, whatever the payload claims.

data/app/controllers/spree/api/v3/seller/resource_controller.rb

@@ -69,12 +69,8 @@ module Spree
           # What extensions opened to sellers, never the operator-level list:
           # an attribute opened to operators must not become seller-writable
           # by accident.
-          def model_additional_permitted_attributes
-            return [] unless respond_to?(:model_class, true)
-
-            Array(model_class.try(:additional_seller_permitted_attributes))
-          rescue NotImplementedError
-            []
+          def additional_permitted_attributes_for(model)
+            Array(model.try(:additional_seller_permitted_attributes))
           end
 
           def authorize_resource!(resource = @resource, action = action_name.to_sym)

data/app/controllers/spree/api/v3/store/carts/addresses_controller.rb

@@ -0,0 +1,53 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Carts
+          # Every address this cart may be shipped or billed to, in one call:
+          # the buyer's own book, plus the book of the company the cart names
+          # — that node's entries and the ones it inherits from the nodes above
+          # it — limited to the countries the cart's market sells to.
+          #
+          # A checkout address step would otherwise merge two books and filter
+          # them by the market itself. Asking the cart keeps the picker and the
+          # checkout from ever disagreeing about what is usable.
+          #
+          # Signed in only, unlike the rest of the cart surface. What comes
+          # back is not the cart's own data but the books behind it — every
+          # address the buyer has saved, and their company's sites. A guest
+          # token says the caller holds this cart, which it may well do
+          # because the account holder adopted a cart the attacker started;
+          # it says nothing about the account. A genuine guest cart has
+          # neither book, so requiring the account costs nothing but the 401.
+          class AddressesController < Store::ResourceController
+            include Spree::Api::V3::CartResolvable
+
+            prepend_before_action :require_authentication!
+
+            protected
+
+            def set_parent
+              @parent = @cart = find_cart(token: nil)
+            end
+
+            def model_class
+              Spree::Address
+            end
+
+            def serializer_class
+              Spree.api.address_serializer
+            end
+
+            def collection_includes
+              [:owner]
+            end
+
+            def parent_association
+              :selectable_addresses
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -13,7 +13,7 @@ module Spree
 
           CART_ADDRESS = Spree::Api::V3::RequestSchema.shape('CartAddressParams') do |schema|
             schema.attribute :id, :id,
-              description: 'An existing address of the customer to use. The other fields are then ignored.'
+              description: "An existing address from the buyer's address book, or from the book of the company the cart is for. The other fields are then ignored."
             schema.include_attributes Spree::Api::V3::Store::AddressRequestSchema
           end
 
@@ -25,10 +25,10 @@ module Spree
             schema.attribute :currency, :currency
             schema.attribute :locale, :locale
             schema.attribute :shipping_address_id, :id,
-              description: 'An existing address to ship to.',
+              description: "An existing address to ship to, from the buyer's address book or from the book of the company the cart is for. List both with `GET /store/carts/:id/addresses`.",
               example: 'addr_abc123'
             schema.attribute :billing_address_id, :id,
-              description: 'An existing address to bill.',
+              description: "An existing address to bill, from the buyer's address book or from the book of the company the cart is for. List both with `GET /store/carts/:id/addresses`.",
               example: 'addr_def456'
             schema.attribute :preferred_stock_location_id, :id
             schema.attribute :company_id, :id, nullable: true, description: <<~TEXT.squish
@@ -123,7 +123,7 @@ module Spree
                 sweep_unavailable_coupon_code!
                 render_cart
               else
-                render_service_error(result.error, code: ERROR_CODES[:validation_error])
+                render_result_failure(result, code: ERROR_CODES[:validation_error])
               end
             end
           end
@@ -181,11 +181,10 @@ module Spree
             if result.success?
               @cart = result.value
               render_order
+            elsif result.error.to_s.present?
+              render_result_failure(result, code: ERROR_CODES[:cart_cannot_complete])
             else
-              render_service_error(
-                result.error.to_s.presence || 'Could not complete checkout',
-                code: ERROR_CODES[:cart_cannot_complete]
-              )
+              render_service_error('Could not complete checkout', code: ERROR_CODES[:cart_cannot_complete])
             end
           rescue ActiveRecord::RecordNotFound
             # Gateway-race retry with the id the client got back: the webhook

data/app/controllers/spree/api/v3/store/companies/addresses_controller.rb

@@ -69,6 +69,10 @@ module Spree
               Spree.api.address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
             # Reading a book and keeping one are different rights: the listing
             # includes what this node inherits, writes stay with the node that
             # owns the row. The Store API authorizes purely by what this scope

data/app/controllers/spree/api/v3/store/customer/addresses_controller.rb

@@ -64,6 +64,10 @@ module Spree
               Spree.api.address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
             def permitted_params
               params.permit(*permitted_attributes)
             end

data/app/controllers/spree/api/v3/store/customer/data_requests_controller.rb

@@ -10,14 +10,30 @@ module Spree
           # irreversible, and an unattended session should not be enough to
           # trigger it — the same bar the account already applies to changing
           # an email address.
+          #
+          # Nothing happens until the request is confirmed from the link emailed
+          # to the account's address (see DataRequestConfirmationsController),
+          # and the export link is never shown to this session.
           class DataRequestsController < ResourceController
             include Spree::Api::V3::CurrentPasswordConfirmation
+            include Spree::Api::V3::AllowedRedirectUrl
 
             prepend_before_action :require_authentication!
 
+            # Each request while one waits sends the confirmation email again.
+            rate_limit to: Spree::Api::Config[:rate_limit_password_reset],
+                       within: Spree::Api::Config[:rate_limit_window].seconds,
+                       store: Rails.cache,
+                       only: :create,
+                       with: RATE_LIMIT_RESPONSE
+
             request_params 'CreateDataRequestParams', action: :create do |body|
               body.attribute :kind, :string, choices: Spree::DataRequest::KINDS, description: 'Defaults to `access`.'
               body.attribute :current_password, :string, description: 'Required for `erasure`.'
+              body.attribute :redirect_url, :string,
+                format: :uri,
+                example: 'https://myshop.com/account/data-requests/confirm',
+                description: "The storefront page the confirmation link opens, with the token appended. Ignored unless it matches one of the store's allowed origins."
             end
 
             # POST /api/v3/store/customers/me/data_requests
@@ -27,7 +43,9 @@ module Spree
               result = Spree::DataRequests::Create.call(
                 store: current_store,
                 customer: current_user,
-                kind: requested_kind
+                kind: requested_kind,
+                confirm_by_email: true,
+                redirect_url: validated_redirect_url
               )
 
               return render_result_error(result) unless result.success?

data/app/controllers/spree/api/v3/store/customer/password_resets_controller.rb

@@ -6,6 +6,8 @@ module Spree
       module Store
         module Customer
           class PasswordResetsController < Store::BaseController
+            include Spree::Api::V3::AllowedRedirectUrl
+
             allow_guest_storefront_access!
             rate_limit to: Spree::Api::Config[:rate_limit_password_reset],
                        within: Spree::Api::Config[:rate_limit_window].seconds,
@@ -33,26 +35,13 @@ module Spree
 
             # POST /api/v3/store/password_resets
             def create
-              redirect_url = params[:redirect_url]
-
-              # Validate redirect_url against allowed origins (secure by default).
-              # If no allowed origins are configured, redirect_url is silently ignored
-              # to prevent open redirect / token exfiltration attacks.
-              if redirect_url.present?
-                if current_store.allowed_origins.exists? && current_store.allowed_origin?(redirect_url)
-                  # redirect_url is valid — keep it
-                else
-                  redirect_url = nil
-                end
-              end
-
               user = Spree.customer_class.find_by(email: params[:email])
 
               if user
                 event_name = 'customer.password_reset_requested'
                 payload = user.event_payload_for(
                   event_name,
-                  reset_token: user.generate_token_for(:password_reset), store: current_store, redirect_url: redirect_url.presence
+                  reset_token: user.generate_token_for(:password_reset), store: current_store, redirect_url: validated_redirect_url
                 )
                 user.publish_event(event_name, payload)
               end

data/app/controllers/spree/api/v3/store/data_request_confirmations_controller.rb

@@ -0,0 +1,23 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # Confirms a request a customer raised, from the page the emailed link
+        # opens. The page calls this when the person presses its button, never
+        # on load: some mail scanners open links and run the page's scripts.
+        class DataRequestConfirmationsController < DataRequestsController
+          # POST /api/v3/store/data_requests/:token/confirmation
+          def create
+            return render_confirmation_invalid(status: :unprocessable_content) unless data_request
+
+            result = Spree::DataRequests::Confirm.call(data_request: data_request)
+
+            return render_confirmation_invalid(status: :unprocessable_content) unless result.success?
+
+            render json: serialize_resource(result.value)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/data_requests_controller.rb

@@ -0,0 +1,56 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # A data request as seen by whoever holds its confirmation token: the
+        # person reading mail at the address the request names.
+        #
+        # Token-addressed rather than session-authenticated, because the link
+        # arrives by email and may be opened on a device that was never signed
+        # in. Besides the export email, it is the only place the export link is
+        # shown, since the token is what reached the address the request names.
+        class DataRequestsController < Store::BaseController
+          allow_guest_storefront_access!
+
+          # The response can carry a live link to a person's whole export, the
+          # same credential the download itself keeps out of shared caches.
+          before_action { response.headers['Cache-Control'] = 'no-store' }
+
+          # GET /api/v3/store/data_requests/:token
+          def show
+            return render_confirmation_invalid(status: :not_found) unless data_request
+
+            render json: serialize_resource(data_request)
+          end
+
+          protected
+
+          def serializer_class
+            Spree.api.data_request_serializer
+          end
+
+          def serializer_params
+            super.merge(download_url_visible: true)
+          end
+
+          private
+
+          def data_request
+            return @data_request if defined?(@data_request)
+
+            token = params[:token].presence
+            @data_request = token && Spree::DataRequest.for_store(current_store).find_by_token_for(:confirmation, token)
+          end
+
+          def render_confirmation_invalid(status:)
+            render_error(
+              code: ERROR_CODES[:invalid_token],
+              message: I18n.t('spree.data_request_errors.confirmation_invalid'),
+              status: status
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/newsletter_subscribers_controller.rb

@@ -3,6 +3,8 @@ module Spree
     module V3
       module Store
         class NewsletterSubscribersController < Store::BaseController
+          include Spree::Api::V3::AllowedRedirectUrl
+
           allow_guest_storefront_access!
           rate_limit to: Spree::Api::Config[:rate_limit_register],
                      within: Spree::Api::Config[:rate_limit_window].seconds,
@@ -139,17 +141,6 @@ module Spree
             subscriber = Spree::NewsletterSubscriber.for_store(current_store).find_by_token_for(:unsubscribe, params[:token])
             subscriber if subscriber&.prefixed_id == params[:id]
           end
-
-          # Drop redirect_url when it isn't in the store's allow-list — secure-by-default,
-          # mirrors password_resets. Returning nil omits it from the webhook payload rather
-          # than rejecting the request, so callers can't probe the allow-list via 4xx errors.
-          def validated_redirect_url
-            redirect_url = params[:redirect_url]
-            return nil if redirect_url.blank?
-            return nil unless current_store.allowed_origin?(redirect_url)
-
-            redirect_url
-          end
         end
       end
     end

data/app/request_schemas/spree/api/v3/admin/email_template_preview_request_schema.rb

@@ -25,6 +25,10 @@ module Spree
             Spree::Emails::Branding::COLORS.each { |name| branding.attribute name, :string, nullable: true }
             branding.attribute :font, :string, nullable: true, choices: Spree::Emails::Branding::FONTS.keys
           end
+          attribute :mailer_logo_signed_id, :string,
+            nullable: true,
+            permit: false,
+            description: 'An unsaved email logo: the signed id of an uploaded image, or null to preview without one.'
         end
       end
     end

data/app/request_schemas/spree/api/v3/admin/variant_request_schema.rb

@@ -0,0 +1,21 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # The shared variant attributes, plus the marketplace configuration
+        # only an operator sets.
+        class VariantRequestSchema < Spree::Api::V3::VariantRequestSchema
+          publishes 'VariantParams'
+
+          attribute :seller_id, :id
+          attribute :delivery_profile_id, :id, nullable: true
+          attribute :tax_category_id, :id
+          attribute :prices, :array, of: Spree::Api::V3::PriceRequestSchema,
+            description: 'Per-currency prices. Upserted by currency.'
+          attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
+            description: 'Stock per location. Upserted by location; omitted locations are removed.'
+        end
+      end
+    end
+  end
+end

data/app/request_schemas/spree/api/v3/seller/price_request_schema.rb

@@ -0,0 +1,20 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # The operator's price shape, except `currency` may be left out: the
+        # store's currency is assumed (see `default_price_currencies`).
+        class PriceRequestSchema < Spree::Api::V3::RequestSchema
+          attribute :currency, :currency,
+            example: 'USD',
+            description: "Omit to price in the store's currency. A seller has no currency of their own."
+          attribute :amount, :decimal,
+            required: true,
+            example: '24.00',
+            description: 'A canonical decimal string (`"1234.56"`: period decimal, no grouping). The API does not parse localized input.'
+          attribute :compare_at_amount, :decimal, nullable: true, example: '30.00'
+        end
+      end
+    end
+  end
+end

data/app/request_schemas/spree/api/v3/seller/variant_request_schema.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # The shared variant attributes. Narrower than the operator's set:
+        # `seller_id` would let a payload hand a variant to somebody else, and
+        # `tax_category_id`/`delivery_profile_id` are marketplace configuration.
+        class VariantRequestSchema < Spree::Api::V3::VariantRequestSchema
+          publishes 'VariantParams'
+
+          attribute :prices, :array, of: Spree::Api::V3::Seller::PriceRequestSchema,
+            description: 'Per-currency prices. Upserted by currency.'
+          attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
+            description: "Stock per location, at this seller's own locations only: a location belonging to anyone else is ignored."
+        end
+      end
+    end
+  end
+end

data/app/request_schemas/spree/api/v3/variant_request_schema.rb

@@ -1,9 +1,9 @@
 module Spree
   module Api
     module V3
-      # A variant's own attributes, shared by the variant endpoints and the
-      # variants nested in a product payload. Not published on its own: each
-      # endpoint includes these fields into its own type.
+      # A variant's own attributes, the ones a seller may write too. Each API
+      # publishes its own `VariantParams` from a subclass, which the variant
+      # endpoints and the variants nested in a product payload both extend.
       class VariantRequestSchema < Spree::Api::V3::RequestSchema
         attribute :sku, :string
         attribute :barcode, :string
@@ -13,14 +13,14 @@ module Spree
         attribute :height, :number, nullable: true
         attribute :width, :number, nullable: true
         attribute :depth, :number, nullable: true
-        attribute :weight_unit, :string, choices: Spree::Variant::WEIGHT_UNITS
-        attribute :dimensions_unit, :string, choices: Spree::Variant::DIMENSION_UNITS
+        attribute :weight_unit, :weight_unit, nullable: true, description: "Null falls back to the store's weight unit."
+        attribute :dimensions_unit, :dimension_unit, nullable: true, description: "Null falls back to the store's unit system."
         attribute :hs_code, :string
         attribute :customs_description, :string
         attribute :country_of_origin, :country
         attribute :minimum_order_quantity, :integer, nullable: true
         attribute :order_multiple, :integer, nullable: true
-        attribute :purchase_unit, :string
+        attribute :purchase_unit, :string, nullable: true, choices: Spree::Variant::PURCHASE_UNITS
         attribute :units_per_carton, :integer, nullable: true, description: 'How many units fill one carton.'
         attribute :carton_package_type_id, :id,
           nullable: true,
@@ -29,8 +29,6 @@ module Spree
           nullable: true,
           description: "What one packed carton weighs, in the variant's weight unit."
         attribute :cartons_per_pallet, :integer, nullable: true, description: 'How many cartons stack on one pallet.'
-        attribute :seller_id, :id
-        attribute :delivery_profile_id, :id, nullable: true
         attribute :track_inventory, :boolean
         attribute :preorderable, :boolean,
           description: "Sell this variant before it's in stock. Adds the pre-order label and ships-by promise; the cap comes from `backorder_limit`, an incoming stock count, or backorder."
@@ -40,12 +38,9 @@ module Spree
         attribute :backorder_limit, :integer,
           nullable: true,
           description: 'Maximum units sellable beyond available stock, capping backorders and pre-orders. Null is unlimited.'
-        attribute :tax_category_id, :id
         attribute :position, :integer
-        attribute :prices, :array, of: Spree::Api::V3::PriceRequestSchema,
-          description: 'Per-currency prices. Upserted by currency.'
-        attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
-          description: 'Stock per location. Upserted by location; omitted locations are removed.'
+        attribute :options, :array, of: Spree::Api::V3::VariantOptionRequestSchema,
+          description: 'One pair per option type the variant takes part in (size, color). Option types and values are created when missing.'
       end
     end
   end