spree_api 6.0.0.rc4 → 6.0.0.rc5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50559a5f0c0305cee4fbf43e8d145078d0f976ffeed8a40be46f19e4d1cca64d
-  data.tar.gz: '00688dd0b79f087aeee42271fd8678eacbaca3626115770fa29043cbbe3e3182'
+  metadata.gz: cf869734311256969147c858239c279f8aec3faac383f6bf030937eedc9fc54e
+  data.tar.gz: e8a7fa2d529fd09e06f6d9b3ad7007e5122c2b56ad0a0e3b32ce8fccb0d4d073
 SHA512:
-  metadata.gz: d56fd3fd92f8bdd5257da98f842c366aa4ad324fcb5ef64c8cf44f007011144813da32af273828604db8cc2ce237fc17df51d633de6132594b41ab3002923c4d
-  data.tar.gz: 34e4d178767f8feccad3b96dbffb9ec02727bce30cdf106a19b9fca97c3af8f44272cf06b4a5facef4864ff3216860538c1a742cc2a1acc26a1589ea1c12b3d9
+  metadata.gz: ef0d1a79bbdcd73ce34176fbe9054090214f326458c2840ac0937582334f639a4907df1cfa7bae30b566976bec1770fa32f455369eded75a8fc456b01efcbb08
+  data.tar.gz: 439f5b98f55aab51ce2d07f037336b175dce46c5e3bc9383685beebe35c34a7d519c004cf2697f68821b52ce538023a3de0dd68ee3b2522062a119db8906b59c

data/app/controllers/concerns/spree/api/v3/allowed_redirect_url.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V3
+      # Reads the `redirect_url` a storefront passes for an emailed link.
+      #
+      # The link carries a live token, so a page outside the store's allowed
+      # origins would hand that token to whoever named the page. An address
+      # that does not match is dropped rather than refused, so callers cannot
+      # probe the allow-list through error responses.
+      module AllowedRedirectUrl
+        extend ActiveSupport::Concern
+
+        private
+
+        # @return [String, nil] the redirect URL when it matches one of the
+        #   store's allowed origins
+        def validated_redirect_url
+          redirect_url = params[:redirect_url]
+          return if redirect_url.blank?
+          return unless current_store.allowed_origin?(redirect_url)
+
+          redirect_url
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/cart_resolvable.rb

@@ -11,10 +11,16 @@ module Spree
         # Find cart by prefixed ID and authorize read access (owner or guest
         # token). Completed carts are not carts anymore — they 404 unless the
         # caller opts in (idempotent completion, payment-session confirm races).
+        #
+        # Pass +token: nil+ to demand ownership. A guest token proves the
+        # caller holds this cart, which is the right bar for the cart's own
+        # contents and no higher — an endpoint reaching past the cart into
+        # something the account holds asks for the account instead.
+        #
         # @return [Spree::Cart]
-        def find_cart(include_completed: false)
+        def find_cart(include_completed: false, token: cart_token)
           @cart = resolve_cart(include_completed: include_completed)
-          authorize_storefront_read!(@cart, token: cart_token)
+          authorize_storefront_read!(@cart, token: token)
           @cart
         end
 

data/app/controllers/concerns/spree/api/v3/scoped_authorization.rb

@@ -159,11 +159,15 @@ module Spree
               "held=#{ability.permission_keys.join(',')}"
           end
 
+          render_missing_permission(required)
+        end
+
+        def render_missing_permission(permission)
           render_error(
             code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
-            message: "Missing permission: #{required}",
+            message: "Missing permission: #{permission}",
             status: :forbidden,
-            details: { required_permission: required }
+            details: { required_permission: permission }
           )
         end
 

data/app/controllers/spree/api/v3/admin/companies/addresses_controller.rb

@@ -61,8 +61,14 @@ module Spree
               Spree.api.admin_address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
+            # The listing includes what the node inherits: a division's orders may ship to its headquarters' sites,
+            # so staff placing one must be able to see them — while writes stay with the node that owns the row.
             def scope
-              @parent.addresses
+              action_name == 'index' ? @parent.address_book : @parent.addresses
             end
           end
         end

data/app/controllers/spree/api/v3/admin/custom_fields_controller.rb

@@ -64,16 +64,37 @@ module Spree
           # store can't read or write custom fields on another store's records.
           # Users are intentionally global in Spree (`User.for_store` is a
           # no-op), so the store boundary for customer parents is enforced by
-          # the `authorize!(:show, @parent)` ability check above.
+          # the `authorize!(:update, @parent)` ability check above.
+          #
+          # Fails closed: `Spree::Base.for_store` answers the bare class when the
+          # store has no association for the model, which would search every
+          # store's records.
           def parent_relation
             klass = parent_lookup.klass
-            klass.respond_to?(:for_store) ? klass.for_store(current_store) : klass
+            return klass.where(id: current_store.id) if klass <= Spree::Store
+            return klass if klass <= Spree.customer_class
+
+            relation = klass.for_store(current_store)
+            raise ActiveRecord::RecordNotFound, 'Parent resource not found' if relation.equal?(klass)
+
+            relation
           end
 
           # Product-family parents have no scope pair of their own — their
           # custom fields are catalog data, gated by `products` like the rest
           # of the variant/option-type surface.
-          SCOPE_OVERRIDES = { 'option_type' => :products, 'variant' => :products }.freeze
+          # Parents whose own controller is gated by a scope other than their
+          # plural name share that controller's scope.
+          SCOPE_OVERRIDES = {
+            'option_type' => :products,
+            'variant' => :products,
+            'company' => :customers,
+            'stock_transfer' => :stock,
+            'purchase_order' => :purchasing,
+            'payment_method' => :settings,
+            'tax_rate' => :settings,
+            'store' => :settings
+          }.freeze
 
           # Per-parent scope check: a key holding `write_products` may write a
           # product's custom fields, `write_orders` may write an order's, etc.
@@ -104,12 +125,13 @@ module Spree
           # code reloads — `enabled_resources` is captured at boot and its
           # class references go stale. Aliases `'customer'` because the route
           # uses `customer_id` while user_class.model_name.element is `'user'`,
-          # and `'category'` because the routes expose taxons as categories
-          # (5.5 rename) while the model's element is still `'taxon'`.
+          # `'category'` because the routes expose taxons as categories
+          # (5.5 rename) while the model's element is still `'taxon'`, and
+          # `'medium'` because Rails singularizes the `media` route to `medium_id`.
           def parent_route_map
             @parent_route_map ||= Spree.custom_fields.enabled_resources.each_with_object({}) do |klass, m|
               m[klass.model_name.element.to_s] = klass.name
-            end.merge('customer' => Spree.customer_class.name, 'category' => 'Spree::Category')
+            end.merge('customer' => Spree.customer_class.name, 'category' => 'Spree::Category', 'medium' => 'Spree::Media')
           end
 
           # Returns the first segment whose `<segment>_id` is in the route,
@@ -117,8 +139,8 @@ module Spree
           # by both `set_parent` and `scoped_resource_name`.
           #
           # Read from the path only: a `store_id` or `refund_id` added to the
-          # query string or body must not switch the parent to a type that is
-          # never routed here and has no store scope to narrow it.
+          # query string or body must not switch the parent away from the record
+          # the route names.
           def parent_lookup
             return @parent_lookup if defined?(@parent_lookup)
 

data/app/controllers/spree/api/v3/admin/customers/addresses_controller.rb

@@ -69,6 +69,10 @@ module Spree
               Spree.api.admin_address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
             private
 
             def address_attrs

data/app/controllers/spree/api/v3/admin/customers_controller.rb

@@ -248,12 +248,7 @@ module Spree
             missing = EXPORT_PERMISSIONS.reject { |permission| holds_permission?(permission) }
             return true if missing.empty?
 
-            render_error(
-              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
-              message: "Missing permission: #{missing.first}",
-              status: :forbidden,
-              details: { required_permission: missing.first }
-            )
+            render_missing_permission(missing.first)
             false
           end
 

data/app/controllers/spree/api/v3/admin/gift_cards_controller.rb

@@ -59,14 +59,7 @@ module Spree
             return unless params.key?(:customer_id)
             return @customer = nil if params[:customer_id].blank?
 
-            unless holds_permission?('read_customers')
-              return render_error(
-                code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
-                message: 'Missing permission: read_customers',
-                status: :forbidden,
-                details: { required_permission: 'read_customers' }
-              )
-            end
+            return render_missing_permission('read_customers') unless holds_permission?('read_customers')
 
             @customer = Spree.customer_class.
                         accessible_by(current_ability, :show).

data/app/controllers/spree/api/v3/admin/orders_controller.rb

@@ -17,10 +17,12 @@ module Spree
           request_params :order do |body|
             body.external_references
             body.attribute :email, :string, example: 'customer@example.com'
-            body.attribute :customer_id, :id
+            body.attribute :customer_id, :id,
+              nullable: true,
+              description: 'Null detaches the customer, leaving a guest order under its `email`.'
             body.attribute :use_customer_default_address, :boolean,
               only: :create,
-              description: "With `customer_id`, copies the customer's saved billing and shipping addresses onto the order."
+              description: "Copies the saved default billing and shipping addresses onto the order. Sent with `company_id`, it takes that company's defaults, inherited from its parent nodes when the company holds none of its own; otherwise it takes the customer's."
             body.attribute :currency, :currency, example: 'USD'
             body.attribute :market_id, :id
             body.attribute :channel_id, :id, description: 'Defaults to the store primary channel when omitted.'
@@ -35,10 +37,10 @@ module Spree
               description: "The `signed_id` of the buyer's purchase order, from `files.upload()` with `visibility: 'private'`. Null removes the document the order carries."
             body.attribute :shipping_address_id, :id,
               only: :create,
-              description: 'An existing address of the customer.'
+              description: "An existing address from the customer's address book, or from the address book of the company the order is for."
             body.attribute :billing_address_id, :id,
               only: :create,
-              description: 'An existing address of the customer.'
+              description: "An existing address from the customer's address book, or from the address book of the company the order is for."
             body.attribute :preferred_stock_location_id, :id,
               description: "Stock location to prefer for fulfillment. Order Routing's built-in preferred-location rule ranks it first; routing falls back to the next rule when the location can't cover the cart."
             body.attribute :company_id, :id,
@@ -51,6 +53,8 @@ module Spree
             body.attribute :tags, :array, of: :string
             body.attribute :shipping_address, :object, shape: ADDRESS
             body.attribute :billing_address, :object, shape: ADDRESS
+            body.attribute :use_shipping, :boolean,
+              description: 'When true, copies the shipping address to the billing address.'
             body.attribute :items, :array,
               description: 'Line items to upsert, keyed by variant. An entry sets that variant\'s quantity, creating the line item when the order has none; `quantity: 0` removes it. Variants you do not send are left alone.' do |item|
               item.attribute :variant_id, :id, required: true
@@ -343,7 +347,9 @@ module Spree
           # Named rather than read from the action, since an upsert reaches
           # update from the create action.
           def order_update_params
-            resolve_company_param(normalize_params(params.permit(*request_params_schema.permit_list(:update))))
+            permitted = resolve_company_param(normalize_params(params.permit(*request_params_schema.permit_list(:update))))
+            permitted[:customer_id] = resolve_customer&.id if permitted.key?(:customer_id)
+            permitted
           end
 
           # An incidental lookup like any other: resolved through the store so

data/app/controllers/spree/api/v3/admin/package_types_controller.rb

@@ -27,9 +27,8 @@ module Spree
             body.attribute :length, :number, nullable: true
             body.attribute :width, :number, nullable: true
             body.attribute :height, :number, nullable: true
-            body.attribute :dimensions_unit, :string,
+            body.attribute :dimensions_unit, :dimension_unit,
               nullable: true,
-              choices: Spree::Variant::DIMENSION_UNITS,
               example: 'cm',
               description: "Unit the three dimensions are in; falls back to the store's unit system."
             body.attribute :weight, :number,
@@ -38,7 +37,7 @@ module Spree
             body.attribute :max_weight, :number,
               nullable: true,
               description: 'What the package can hold, not the same as its own weight.'
-            body.attribute :weight_unit, :string, nullable: true, choices: Spree::Variant::WEIGHT_UNITS, example: 'kg'
+            body.attribute :weight_unit, :weight_unit, nullable: true, example: 'kg'
             body.attribute :default, :boolean,
               description: 'The box every parcel quote is built on. Setting this demotes whichever row held it.'
             body.attribute :metadata, :hash

data/app/controllers/spree/api/v3/admin/products/variants_controller.rb

@@ -7,11 +7,10 @@ module Spree
             scoped_resource :products
 
             request_params :variant do |body|
+              body.extends Spree::Api::V3::Admin::VariantRequestSchema
               body.external_references
-              body.include_attributes Spree::Api::V3::VariantRequestSchema
-              body.attribute :options, :array, of: Spree::Api::V3::VariantOptionRequestSchema,
-                required: true, on: :create,
-                description: 'One pair per option type the variant takes part in (size, color). Option types and values are created when missing. On update, omit to leave the option values untouched.'
+              body.require_attributes :options, on: :create
+              body.describe_attribute :options, 'One pair per option type the variant takes part in (size, color). Option types and values are created when missing. On update, omit to leave the option values untouched.'
             end
 
             protected

data/app/controllers/spree/api/v3/admin/products_controller.rb

@@ -77,10 +77,8 @@ module Spree
             body.attribute :variants, :array,
               as: 'ProductVariantParams',
               description: 'Every purchasable attribute (sku, prices, stock, weight, dimensions) lives on variants. An entry without `options` upserts onto the default variant of a simple product; pass `id` to update an existing variant.' do |variant|
+              variant.extends Spree::Api::V3::Admin::VariantRequestSchema
               variant.attribute :id, :id
-              variant.include_attributes Spree::Api::V3::VariantRequestSchema
-              variant.attribute :options, :array, of: Spree::Api::V3::VariantOptionRequestSchema,
-                description: 'One pair per option type the variant takes part in (size, color). Option types and values are created when missing.'
             end
           end
 
@@ -291,6 +289,10 @@ module Spree
             Spree.product_update_workflow
           end
 
+          def nested_permitted_models
+            { media: Spree::Media, variants: Spree::Variant }
+          end
+
           # Use SearchProvider::Database for collection to handle price/best_selling
           # sorting correctly (counts before sorting, avoiding PG/Mobility issues).
           def collection

data/app/controllers/spree/api/v3/admin/store_controller.rb

@@ -9,7 +9,7 @@ module Spree
             body.attribute :name, :string, example: 'My Store'
             body.attribute :admin_locale, :string, example: 'en'
             body.attribute :timezone, :string, example: 'Europe/Berlin'
-            body.attribute :weight_unit, :string, choices: Spree::Variant::WEIGHT_UNITS
+            body.attribute :weight_unit, :weight_unit
             body.attribute :unit_system, :string, choices: Spree::Store::UNIT_SYSTEMS
             body.attribute :storefront_access, :string,
               choices: Spree::Channel::Gating::STOREFRONT_ACCESS,

data/app/controllers/spree/api/v3/admin/variants_controller.rb

@@ -5,6 +5,30 @@ module Spree
         class VariantsController < ResourceController
           scoped_resource :products
 
+          SALES_CONTEXT = Spree::Api::V3::RequestSchema.shape('VariantSalesContextParams') do |query|
+            query.attribute :order_id, :id,
+              description: 'A draft order to sell to: lists only what its buyer can be sold on its channel, ' \
+                           'priced in its market. Needs `read_orders`, and cannot be combined with the fields below.'
+            query.attribute :market_id, :id,
+              description: 'Prices in this market and lists only variants with a price in its currency.'
+            query.attribute :channel_id, :id,
+              description: 'Lists only variants published on this channel. When a market, customer, company or ' \
+                           "currency is given without it, the store default channel applies; an order uses its own."
+            query.attribute :customer_id, :id,
+              description: "Narrows to the customer's catalogs and prices as they would pay. Needs `read_customers`."
+            query.attribute :company_id, :id,
+              description: "Narrows to the company's catalogs and prices under its agreement. Needs `read_customers`."
+            query.attribute :currency, :currency,
+              description: 'Lists only variants with a price in this currency. ' \
+                           "With `market_id` it must be the market's currency."
+          end
+          SALES_CONTEXT_PARAMS = (SALES_CONTEXT.fields.keys - [:order_id]).freeze
+
+          # A draft order's item picker asks with the order's market, channel and
+          # buyer, so it lists only what that buyer can be sold there, priced as
+          # they would pay.
+          before_action :load_sales_context, only: :index
+
           protected
 
           def model_class
@@ -19,7 +43,21 @@ module Spree
           # relation from scratch dropped `scope_includes`, so every listed
           # variant fell back to per-row price and stock queries.
           def scope
-            super.eligible.accessible_by(current_ability, ability_action_for_request)
+            variants = super.eligible.accessible_by(current_ability, ability_action_for_request)
+            @sales_context ? variants.where(id: @sales_context.sellable_variants.select(:id)) : variants
+          end
+
+          def serializer_params
+            return super unless @sales_context
+
+            super.merge(
+              currency: @sales_context.currency,
+              user: @sales_context.customer,
+              company: @sales_context.company,
+              market: @sales_context.market,
+              channel: @sales_context.channel,
+              country: @sales_context.country
+            )
           end
 
           # `active_stock_reservations` rides along with the stock levels:
@@ -33,6 +71,63 @@ module Spree
               { primary_media: [{ attachment_attachment: :blob }, { poster_attachment: :blob }] }
             ]
           end
+
+          private
+
+          def load_sales_context
+            requested = SALES_CONTEXT_PARAMS.select { |key| params[key].present? }
+            return if requested.empty? && params[:order_id].blank?
+
+            permission = required_sales_context_permission
+            return render_missing_permission(permission) if permission && !holds_permission?(permission)
+
+            if params[:order_id].present?
+              return refuse_order_with_context(requested) if requested.any?
+
+              @sales_context = Spree::SalesContext.from_order(context_order)
+            else
+              @sales_context = requested_sales_context
+              render_errors(@sales_context.errors) unless @sales_context.valid?
+            end
+          end
+
+          # An order already fixes its market, channel, buyer and currency, so
+          # naming them too could only disagree with it.
+          def refuse_order_with_context(requested)
+            render_error(
+              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:parameter_invalid],
+              message: I18n.t('spree.api.errors.order_sales_context_exclusive', params: requested.join(', ')),
+              status: :unprocessable_content,
+              details: { order_id: requested.map(&:to_s) }
+            )
+          end
+
+          def required_sales_context_permission
+            return 'read_orders' if params[:order_id].present?
+
+            'read_customers' if params[:customer_id].present? || params[:company_id].present?
+          end
+
+          def requested_sales_context
+            Spree::SalesContext.new(
+              store: current_store,
+              market: find_requested(current_store.markets, :market_id),
+              channel: find_requested(current_store.channels, :channel_id),
+              customer: find_requested(
+                Spree.customer_class.for_store(current_store).accessible_by(current_ability, :show), :customer_id
+              ),
+              company: find_requested(current_store.companies, :company_id),
+              currency: params[:currency]
+            )
+          end
+
+          def find_requested(relation, key)
+            relation.find_by_prefix_id!(params[key]) if params[key].present?
+          end
+
+          def context_order
+            current_store.orders.accessible_by(current_ability, :show).find_by_prefix_id!(params[:order_id])
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/oauth/authorizations_controller.rb

@@ -44,15 +44,26 @@ module Spree
           # and the merchant would approve on the wrong one.
           def consent_url
             query = params.permit(*FORWARDED_PARAMETERS).to_h.compact_blank.to_query
-            base = Spree::Stores::DashboardUrl.call(store: consent_store)
+            base = Spree::Stores::DashboardUrl.call(store: current_store)
 
-            "#{base}/#{consent_store.prefixed_id}/oauth/authorize?#{query}"
+            "#{base}/#{current_store.prefixed_id}/oauth/authorize?#{query}"
           end
 
-          # @return [Spree::Store]
-          def consent_store
-            @consent_store ||=
-              Spree::OauthApplication.find_by(uid: params[:client_id])&.store || current_store
+          # The client's store wins over the hostname's, and is looked up
+          # before the hostname is resolved at all: resolving it assigns the
+          # default store to Spree::Current, and an app scoping queries by
+          # that store would then never find another store's client.
+          #
+          # @return [Spree::Store, nil]
+          def current_store
+            @current_store ||= client_application&.store || super
+          end
+
+          # @return [Spree::OauthApplication, nil]
+          def client_application
+            return if params[:client_id].blank?
+
+            Spree::OauthApplication.find_by(uid: params[:client_id])
           end
         end
       end

data/app/controllers/spree/api/v3/resource_controller.rb

@@ -559,7 +559,17 @@ module Spree
         # declared on the model. Override +resource_permitted_attributes+ rather
         # than this, so the extension union is not lost.
         def permitted_attributes
-          resource_permitted_attributes + model_additional_permitted_attributes
+          with_nested_additional_permitted_attributes(resource_permitted_attributes) + model_additional_permitted_attributes
+        end
+
+        # Nested lists this resource writes, keyed by param name, mapped to the
+        # model each entry becomes — +{ media: Spree::Media }+ lets an
+        # extension's +Spree::Media.additional_permitted_attributes+ ride the
+        # product's +media+ entries, not only the media endpoint.
+        #
+        # @return [Hash{Symbol => Class}]
+        def nested_permitted_models
+          {}
         end
 
         # The resource's writable attributes: its `request_params`
@@ -580,13 +590,33 @@ module Spree
         def model_additional_permitted_attributes
           return [] unless respond_to?(:model_class, true)
 
-          model = model_class
-          return [] unless model.respond_to?(:additional_permitted_attributes)
-
-          Array(model.additional_permitted_attributes)
+          additional_permitted_attributes_for(model_class)
         rescue NotImplementedError
           []
         end
+
+        # What extensions declared writable on +model+. `Spree.base_class` is
+        # host-overridable, so the class_attribute may not be there at all.
+        #
+        # @param model [Class]
+        # @return [Array]
+        def additional_permitted_attributes_for(model)
+          Array(model.try(:additional_permitted_attributes))
+        end
+
+        def with_nested_additional_permitted_attributes(attributes)
+          return attributes if nested_permitted_models.empty?
+
+          attributes.map do |attribute|
+            next attribute unless attribute.is_a?(Hash)
+
+            attribute.to_h do |name, nested|
+              model = nested_permitted_models[name.to_sym]
+              additional = model ? additional_permitted_attributes_for(model) : []
+              [name, additional.any? && nested.is_a?(Array) ? nested + additional : nested]
+            end
+          end
+        end
       end
     end
   end

data/app/controllers/spree/api/v3/seller/package_types_controller.rb

@@ -28,12 +28,12 @@ module Spree
             body.attribute :length, :number, nullable: true
             body.attribute :width, :number, nullable: true
             body.attribute :height, :number, nullable: true
-            body.attribute :dimensions_unit, :string, nullable: true, choices: Spree::Variant::DIMENSION_UNITS
+            body.attribute :dimensions_unit, :dimension_unit, nullable: true
             body.attribute :weight, :number,
               nullable: true,
               description: "The empty package's own weight, added to every quote."
             body.attribute :max_weight, :number, nullable: true
-            body.attribute :weight_unit, :string, nullable: true, choices: Spree::Variant::WEIGHT_UNITS
+            body.attribute :weight_unit, :weight_unit, nullable: true
             body.attribute :default, :boolean,
               description: "Makes this the box this seller's parcels are quoted with. One default per seller, so it never displaces the marketplace's."
             body.attribute :metadata, :hash, nullable: true