spree_api 6.0.0.rc4 → 6.0.0.rc5

data/app/controllers/spree/api/v3/seller/products_controller.rb

@@ -41,19 +41,6 @@ module Spree
             'archived' => -> { Spree.product_archive_workflow }
           }.freeze
 
-          # The operator's price shape, except `currency` may be left out: the
-          # store's currency is assumed (see `default_price_currencies`).
-          PRICE = Spree::Api::V3::RequestSchema.new do |schema|
-            schema.attribute :currency, :currency,
-              example: 'USD',
-              description: "Omit to price in the store's currency. A seller has no currency of their own."
-            schema.attribute :amount, :decimal,
-              required: true,
-              example: '24.00',
-              description: 'A canonical decimal string (`"1234.56"`: period decimal, no grouping). The API does not parse localized input.'
-            schema.attribute :compare_at_amount, :decimal, nullable: true, example: '30.00'
-          end
-
           scoped_resource :products
 
           request_params :product do |body|
@@ -69,7 +56,7 @@ module Spree
               description: "The marketplace's product type this product is listed against, from the product types endpoint. Null detaches it. Saving with a type seeds its option types onto the product."
             body.attribute :delivery_profile_id, :id,
               description: "Which of the marketplace's delivery profiles the product ships under. A new product sent without one lands on the profile marked default."
-            body.attribute :prices, :array, of: PRICE,
+            body.attribute :prices, :array, of: Spree::Api::V3::Seller::PriceRequestSchema,
               description: "Shorthand for a simple (no-options) product: per-currency prices that forward to the product's sole variant."
             # `external_url` stays out for the same reason it does on the
             # operator's endpoint: it would make the server fetch a URL the
@@ -83,56 +70,11 @@ module Spree
               media_item.attribute :variant_ids, :array, of: :id,
                 description: 'Replaces the variants this media is linked to. An empty list clears them.'
             end
-            # Narrower than the operator's variant set: `seller_id` would let a
-            # payload hand a variant to somebody else, and
-            # `tax_category_id`/`delivery_profile_id` are marketplace
-            # configuration.
             body.attribute :variants, :array,
-              as: 'SellerProductVariantParams',
+              as: 'ProductVariantParams',
               description: 'The variants, as a whole: one absent from the list is removed. Pass `id` to update an existing variant.' do |variant|
+              variant.extends Spree::Api::V3::Seller::VariantRequestSchema
               variant.attribute :id, :id
-              variant.attribute :sku, :string
-              variant.attribute :barcode, :string
-              variant.attribute :cost_price, :decimal, nullable: true
-              variant.attribute :cost_currency, :currency
-              variant.attribute :weight, :number, nullable: true
-              variant.attribute :height, :number, nullable: true
-              variant.attribute :width, :number, nullable: true
-              variant.attribute :depth, :number, nullable: true
-              variant.attribute :weight_unit, :string, choices: Spree::Variant::WEIGHT_UNITS
-              variant.attribute :dimensions_unit, :string, choices: Spree::Variant::DIMENSION_UNITS
-              variant.attribute :hs_code, :string
-              variant.attribute :customs_description, :string
-              variant.attribute :country_of_origin, :country
-              variant.attribute :minimum_order_quantity, :integer, nullable: true
-              variant.attribute :order_multiple, :integer, nullable: true
-              variant.attribute :purchase_unit, :string
-              variant.attribute :units_per_carton, :integer,
-                nullable: true,
-                description: 'How many units fill one carton.'
-              variant.attribute :carton_package_type_id, :id,
-                nullable: true,
-                description: 'The carton this variant is packed into: a package type of kind `carton`.'
-              variant.attribute :carton_weight, :number,
-                nullable: true,
-                description: "What one packed carton weighs, in the variant's weight unit."
-              variant.attribute :cartons_per_pallet, :integer,
-                nullable: true,
-                description: 'How many cartons stack on one pallet.'
-              variant.attribute :track_inventory, :boolean
-              variant.attribute :preorderable, :boolean
-              variant.attribute :preorder_ships_at, :datetime,
-                nullable: true,
-                description: 'The "ships by" date shown to customers while the variant is a pre-order. Null clears it.'
-              variant.attribute :backorder_limit, :integer,
-                nullable: true,
-                description: 'Maximum units sellable beyond available stock, capping backorders and pre-orders. Null is unlimited.'
-              variant.attribute :position, :integer
-              variant.attribute :options, :array, of: Spree::Api::V3::VariantOptionRequestSchema,
-                description: 'One pair per option type the variant takes part in (size, color).'
-              variant.attribute :prices, :array, of: PRICE, description: 'Per-currency prices. Upserted by currency.'
-              variant.attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
-                description: "Stock per location, at this seller's own locations only: a location belonging to anyone else is ignored."
             end
           end
 
@@ -270,6 +212,10 @@ module Spree
             Spree.product_update_workflow
           end
 
+          def nested_permitted_models
+            { media: Spree::Media, variants: Spree::Variant }
+          end
+
           # The workflow builds its own product, which would leave a seller's
           # listing unowned. Handing it one built through `current_seller.products`
           # keeps the seller on the record, whatever the payload claims.

data/app/controllers/spree/api/v3/seller/resource_controller.rb

@@ -69,12 +69,8 @@ module Spree
           # What extensions opened to sellers, never the operator-level list:
           # an attribute opened to operators must not become seller-writable
           # by accident.
-          def model_additional_permitted_attributes
-            return [] unless respond_to?(:model_class, true)
-
-            Array(model_class.try(:additional_seller_permitted_attributes))
-          rescue NotImplementedError
-            []
+          def additional_permitted_attributes_for(model)
+            Array(model.try(:additional_seller_permitted_attributes))
           end
 
           def authorize_resource!(resource = @resource, action = action_name.to_sym)

data/app/controllers/spree/api/v3/store/carts/addresses_controller.rb

@@ -0,0 +1,53 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Carts
+          # Every address this cart may be shipped or billed to, in one call:
+          # the buyer's own book, plus the book of the company the cart names
+          # — that node's entries and the ones it inherits from the nodes above
+          # it — limited to the countries the cart's market sells to.
+          #
+          # A checkout address step would otherwise merge two books and filter
+          # them by the market itself. Asking the cart keeps the picker and the
+          # checkout from ever disagreeing about what is usable.
+          #
+          # Signed in only, unlike the rest of the cart surface. What comes
+          # back is not the cart's own data but the books behind it — every
+          # address the buyer has saved, and their company's sites. A guest
+          # token says the caller holds this cart, which it may well do
+          # because the account holder adopted a cart the attacker started;
+          # it says nothing about the account. A genuine guest cart has
+          # neither book, so requiring the account costs nothing but the 401.
+          class AddressesController < Store::ResourceController
+            include Spree::Api::V3::CartResolvable
+
+            prepend_before_action :require_authentication!
+
+            protected
+
+            def set_parent
+              @parent = @cart = find_cart(token: nil)
+            end
+
+            def model_class
+              Spree::Address
+            end
+
+            def serializer_class
+              Spree.api.address_serializer
+            end
+
+            def collection_includes
+              [:owner]
+            end
+
+            def parent_association
+              :selectable_addresses
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -13,7 +13,7 @@ module Spree
 
           CART_ADDRESS = Spree::Api::V3::RequestSchema.shape('CartAddressParams') do |schema|
             schema.attribute :id, :id,
-              description: 'An existing address of the customer to use. The other fields are then ignored.'
+              description: "An existing address from the buyer's address book, or from the book of the company the cart is for. The other fields are then ignored."
             schema.include_attributes Spree::Api::V3::Store::AddressRequestSchema
           end
 
@@ -25,10 +25,10 @@ module Spree
             schema.attribute :currency, :currency
             schema.attribute :locale, :locale
             schema.attribute :shipping_address_id, :id,
-              description: 'An existing address to ship to.',
+              description: "An existing address to ship to, from the buyer's address book or from the book of the company the cart is for. List both with `GET /store/carts/:id/addresses`.",
               example: 'addr_abc123'
             schema.attribute :billing_address_id, :id,
-              description: 'An existing address to bill.',
+              description: "An existing address to bill, from the buyer's address book or from the book of the company the cart is for. List both with `GET /store/carts/:id/addresses`.",
               example: 'addr_def456'
             schema.attribute :preferred_stock_location_id, :id
             schema.attribute :company_id, :id, nullable: true, description: <<~TEXT.squish

data/app/controllers/spree/api/v3/store/companies/addresses_controller.rb

@@ -69,6 +69,10 @@ module Spree
               Spree.api.address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
             # Reading a book and keeping one are different rights: the listing
             # includes what this node inherits, writes stay with the node that
             # owns the row. The Store API authorizes purely by what this scope

data/app/controllers/spree/api/v3/store/customer/addresses_controller.rb

@@ -64,6 +64,10 @@ module Spree
               Spree.api.address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
             def permitted_params
               params.permit(*permitted_attributes)
             end

data/app/controllers/spree/api/v3/store/customer/data_requests_controller.rb

@@ -10,14 +10,30 @@ module Spree
           # irreversible, and an unattended session should not be enough to
           # trigger it — the same bar the account already applies to changing
           # an email address.
+          #
+          # Nothing happens until the request is confirmed from the link emailed
+          # to the account's address (see DataRequestConfirmationsController),
+          # and the export link is never shown to this session.
           class DataRequestsController < ResourceController
             include Spree::Api::V3::CurrentPasswordConfirmation
+            include Spree::Api::V3::AllowedRedirectUrl
 
             prepend_before_action :require_authentication!
 
+            # Each request while one waits sends the confirmation email again.
+            rate_limit to: Spree::Api::Config[:rate_limit_password_reset],
+                       within: Spree::Api::Config[:rate_limit_window].seconds,
+                       store: Rails.cache,
+                       only: :create,
+                       with: RATE_LIMIT_RESPONSE
+
             request_params 'CreateDataRequestParams', action: :create do |body|
               body.attribute :kind, :string, choices: Spree::DataRequest::KINDS, description: 'Defaults to `access`.'
               body.attribute :current_password, :string, description: 'Required for `erasure`.'
+              body.attribute :redirect_url, :string,
+                format: :uri,
+                example: 'https://myshop.com/account/data-requests/confirm',
+                description: "The storefront page the confirmation link opens, with the token appended. Ignored unless it matches one of the store's allowed origins."
             end
 
             # POST /api/v3/store/customers/me/data_requests
@@ -27,7 +43,9 @@ module Spree
               result = Spree::DataRequests::Create.call(
                 store: current_store,
                 customer: current_user,
-                kind: requested_kind
+                kind: requested_kind,
+                confirm_by_email: true,
+                redirect_url: validated_redirect_url
               )
 
               return render_result_error(result) unless result.success?

data/app/controllers/spree/api/v3/store/customer/password_resets_controller.rb

@@ -6,6 +6,8 @@ module Spree
       module Store
         module Customer
           class PasswordResetsController < Store::BaseController
+            include Spree::Api::V3::AllowedRedirectUrl
+
             allow_guest_storefront_access!
             rate_limit to: Spree::Api::Config[:rate_limit_password_reset],
                        within: Spree::Api::Config[:rate_limit_window].seconds,
@@ -33,26 +35,13 @@ module Spree
 
             # POST /api/v3/store/password_resets
             def create
-              redirect_url = params[:redirect_url]
-
-              # Validate redirect_url against allowed origins (secure by default).
-              # If no allowed origins are configured, redirect_url is silently ignored
-              # to prevent open redirect / token exfiltration attacks.
-              if redirect_url.present?
-                if current_store.allowed_origins.exists? && current_store.allowed_origin?(redirect_url)
-                  # redirect_url is valid — keep it
-                else
-                  redirect_url = nil
-                end
-              end
-
               user = Spree.customer_class.find_by(email: params[:email])
 
               if user
                 event_name = 'customer.password_reset_requested'
                 payload = user.event_payload_for(
                   event_name,
-                  reset_token: user.generate_token_for(:password_reset), store: current_store, redirect_url: redirect_url.presence
+                  reset_token: user.generate_token_for(:password_reset), store: current_store, redirect_url: validated_redirect_url
                 )
                 user.publish_event(event_name, payload)
               end

data/app/controllers/spree/api/v3/store/data_request_confirmations_controller.rb

@@ -0,0 +1,23 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # Confirms a request a customer raised, from the page the emailed link
+        # opens. The page calls this when the person presses its button, never
+        # on load: some mail scanners open links and run the page's scripts.
+        class DataRequestConfirmationsController < DataRequestsController
+          # POST /api/v3/store/data_requests/:token/confirmation
+          def create
+            return render_confirmation_invalid(status: :unprocessable_content) unless data_request
+
+            result = Spree::DataRequests::Confirm.call(data_request: data_request)
+
+            return render_confirmation_invalid(status: :unprocessable_content) unless result.success?
+
+            render json: serialize_resource(result.value)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/data_requests_controller.rb

@@ -0,0 +1,56 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # A data request as seen by whoever holds its confirmation token: the
+        # person reading mail at the address the request names.
+        #
+        # Token-addressed rather than session-authenticated, because the link
+        # arrives by email and may be opened on a device that was never signed
+        # in. Besides the export email, it is the only place the export link is
+        # shown, since the token is what reached the address the request names.
+        class DataRequestsController < Store::BaseController
+          allow_guest_storefront_access!
+
+          # The response can carry a live link to a person's whole export, the
+          # same credential the download itself keeps out of shared caches.
+          before_action { response.headers['Cache-Control'] = 'no-store' }
+
+          # GET /api/v3/store/data_requests/:token
+          def show
+            return render_confirmation_invalid(status: :not_found) unless data_request
+
+            render json: serialize_resource(data_request)
+          end
+
+          protected
+
+          def serializer_class
+            Spree.api.data_request_serializer
+          end
+
+          def serializer_params
+            super.merge(download_url_visible: true)
+          end
+
+          private
+
+          def data_request
+            return @data_request if defined?(@data_request)
+
+            token = params[:token].presence
+            @data_request = token && Spree::DataRequest.for_store(current_store).find_by_token_for(:confirmation, token)
+          end
+
+          def render_confirmation_invalid(status:)
+            render_error(
+              code: ERROR_CODES[:invalid_token],
+              message: I18n.t('spree.data_request_errors.confirmation_invalid'),
+              status: status
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/newsletter_subscribers_controller.rb

@@ -3,6 +3,8 @@ module Spree
     module V3
       module Store
         class NewsletterSubscribersController < Store::BaseController
+          include Spree::Api::V3::AllowedRedirectUrl
+
           allow_guest_storefront_access!
           rate_limit to: Spree::Api::Config[:rate_limit_register],
                      within: Spree::Api::Config[:rate_limit_window].seconds,
@@ -139,17 +141,6 @@ module Spree
             subscriber = Spree::NewsletterSubscriber.for_store(current_store).find_by_token_for(:unsubscribe, params[:token])
             subscriber if subscriber&.prefixed_id == params[:id]
           end
-
-          # Drop redirect_url when it isn't in the store's allow-list — secure-by-default,
-          # mirrors password_resets. Returning nil omits it from the webhook payload rather
-          # than rejecting the request, so callers can't probe the allow-list via 4xx errors.
-          def validated_redirect_url
-            redirect_url = params[:redirect_url]
-            return nil if redirect_url.blank?
-            return nil unless current_store.allowed_origin?(redirect_url)
-
-            redirect_url
-          end
         end
       end
     end

data/app/request_schemas/spree/api/v3/admin/variant_request_schema.rb

@@ -0,0 +1,21 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # The shared variant attributes, plus the marketplace configuration
+        # only an operator sets.
+        class VariantRequestSchema < Spree::Api::V3::VariantRequestSchema
+          publishes 'VariantParams'
+
+          attribute :seller_id, :id
+          attribute :delivery_profile_id, :id, nullable: true
+          attribute :tax_category_id, :id
+          attribute :prices, :array, of: Spree::Api::V3::PriceRequestSchema,
+            description: 'Per-currency prices. Upserted by currency.'
+          attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
+            description: 'Stock per location. Upserted by location; omitted locations are removed.'
+        end
+      end
+    end
+  end
+end

data/app/request_schemas/spree/api/v3/seller/price_request_schema.rb

@@ -0,0 +1,20 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # The operator's price shape, except `currency` may be left out: the
+        # store's currency is assumed (see `default_price_currencies`).
+        class PriceRequestSchema < Spree::Api::V3::RequestSchema
+          attribute :currency, :currency,
+            example: 'USD',
+            description: "Omit to price in the store's currency. A seller has no currency of their own."
+          attribute :amount, :decimal,
+            required: true,
+            example: '24.00',
+            description: 'A canonical decimal string (`"1234.56"`: period decimal, no grouping). The API does not parse localized input.'
+          attribute :compare_at_amount, :decimal, nullable: true, example: '30.00'
+        end
+      end
+    end
+  end
+end

data/app/request_schemas/spree/api/v3/seller/variant_request_schema.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # The shared variant attributes. Narrower than the operator's set:
+        # `seller_id` would let a payload hand a variant to somebody else, and
+        # `tax_category_id`/`delivery_profile_id` are marketplace configuration.
+        class VariantRequestSchema < Spree::Api::V3::VariantRequestSchema
+          publishes 'VariantParams'
+
+          attribute :prices, :array, of: Spree::Api::V3::Seller::PriceRequestSchema,
+            description: 'Per-currency prices. Upserted by currency.'
+          attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
+            description: "Stock per location, at this seller's own locations only: a location belonging to anyone else is ignored."
+        end
+      end
+    end
+  end
+end

data/app/request_schemas/spree/api/v3/variant_request_schema.rb

@@ -1,9 +1,9 @@
 module Spree
   module Api
     module V3
-      # A variant's own attributes, shared by the variant endpoints and the
-      # variants nested in a product payload. Not published on its own: each
-      # endpoint includes these fields into its own type.
+      # A variant's own attributes, the ones a seller may write too. Each API
+      # publishes its own `VariantParams` from a subclass, which the variant
+      # endpoints and the variants nested in a product payload both extend.
       class VariantRequestSchema < Spree::Api::V3::RequestSchema
         attribute :sku, :string
         attribute :barcode, :string
@@ -13,14 +13,14 @@ module Spree
         attribute :height, :number, nullable: true
         attribute :width, :number, nullable: true
         attribute :depth, :number, nullable: true
-        attribute :weight_unit, :string, choices: Spree::Variant::WEIGHT_UNITS
-        attribute :dimensions_unit, :string, choices: Spree::Variant::DIMENSION_UNITS
+        attribute :weight_unit, :weight_unit, nullable: true, description: "Null falls back to the store's weight unit."
+        attribute :dimensions_unit, :dimension_unit, nullable: true, description: "Null falls back to the store's unit system."
         attribute :hs_code, :string
         attribute :customs_description, :string
         attribute :country_of_origin, :country
         attribute :minimum_order_quantity, :integer, nullable: true
         attribute :order_multiple, :integer, nullable: true
-        attribute :purchase_unit, :string
+        attribute :purchase_unit, :string, nullable: true, choices: Spree::Variant::PURCHASE_UNITS
         attribute :units_per_carton, :integer, nullable: true, description: 'How many units fill one carton.'
         attribute :carton_package_type_id, :id,
           nullable: true,
@@ -29,8 +29,6 @@ module Spree
           nullable: true,
           description: "What one packed carton weighs, in the variant's weight unit."
         attribute :cartons_per_pallet, :integer, nullable: true, description: 'How many cartons stack on one pallet.'
-        attribute :seller_id, :id
-        attribute :delivery_profile_id, :id, nullable: true
         attribute :track_inventory, :boolean
         attribute :preorderable, :boolean,
           description: "Sell this variant before it's in stock. Adds the pre-order label and ships-by promise; the cap comes from `backorder_limit`, an incoming stock count, or backorder."
@@ -40,12 +38,9 @@ module Spree
         attribute :backorder_limit, :integer,
           nullable: true,
           description: 'Maximum units sellable beyond available stock, capping backorders and pre-orders. Null is unlimited.'
-        attribute :tax_category_id, :id
         attribute :position, :integer
-        attribute :prices, :array, of: Spree::Api::V3::PriceRequestSchema,
-          description: 'Per-currency prices. Upserted by currency.'
-        attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
-          description: 'Stock per location. Upserted by location; omitted locations are removed.'
+        attribute :options, :array, of: Spree::Api::V3::VariantOptionRequestSchema,
+          description: 'One pair per option type the variant takes part in (size, color). Option types and values are created when missing.'
       end
     end
   end

data/app/serializers/spree/api/v3/address_owner_serializer.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V3
+      # Which address book an entry came out of. A checkout offering the
+      # buyer's own addresses beside their company's sites has to label the
+      # two, and the owner is the only thing that tells a warehouse from
+      # somebody's flat.
+      class AddressOwnerSerializer < BaseSerializer
+        typelize type: [:string, enum: %w[customer company seller], enum_type_name: 'AddressOwnerType'],
+                 name: [:string, nullable: true]
+
+        attribute :type do |owner|
+          Spree::Base.polymorphic_api_type(owner.class.to_s)
+        end
+
+        # What to call the book. A company node answers with its own name, so
+        # a division's own sites and the headquarters sites it inherits are
+        # told apart rather than filed under one heading. A customer's book is
+        # the caller's own and needs no name — "your addresses" is the client's
+        # word for it, in the shopper's language.
+        attribute :name do |owner|
+          owner.name if owner.is_a?(Spree::Company)
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/address_serializer.rb

@@ -12,7 +12,7 @@ module Spree
                  country_iso: [:string, deprecated: 'Use `country_code`. Removed in 6.1.'],
                  country_name: :string,
                  quick_checkout: :boolean, is_default_billing: :boolean, is_default_shipping: :boolean,
-                 label: [:string, nullable: true]
+                 label: [:string, nullable: true], owner: { nullable: true }
 
         # What the address is filed under in whichever book owns it — a
         # customer's ("Home") or a company node's ("Northern Warehouse").
@@ -31,6 +31,10 @@ module Spree
         attribute :state_name do |address|
           address.state_name.presence || address.state&.name
         end
+
+        # The address book the entry belongs to. Null for an address in no
+        # book: one a guest typed in, or the copy a placed order keeps.
+        one :owner, resource: proc { Spree.api.address_owner_serializer }
       end
     end
   end

data/app/serializers/spree/api/v3/admin/address_owner_serializer.rb

@@ -0,0 +1,10 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        class AddressOwnerSerializer < V3::AddressOwnerSerializer
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/address_serializer.rb

@@ -7,8 +7,6 @@ module Spree
           %i[state_abbr country_iso].each { |key| _attributes.delete(key) }
 
           typelize customer_id: [:string, nullable: true],
-                   owner_id: [:string, nullable: true],
-                   owner_type: [:string, nullable: true],
                    latitude: [:number, nullable: true],
                    longitude: [:number, nullable: true],
                    metadata: 'Record<string, unknown>'
@@ -29,14 +27,7 @@ module Spree
 
           prefixed_id_attributes customer_id: :customer_owner
 
-          # Who the row belongs to — a customer's book, a company node's, or a
-          # seller's billing address. `customer_id` above stays as the
-          # customer-only shorthand the customers surface reads.
-          prefixed_id_attributes :owner
-
-          attribute :owner_type do |address|
-            Spree::Base.polymorphic_api_type(address.owner_type)
-          end
+          one :owner, resource: proc { Spree.api.admin_address_owner_serializer }
         end
       end
     end

data/app/serializers/spree/api/v3/admin/api_key_serializer.rb

@@ -12,7 +12,7 @@ module Spree
         # via {#plaintext_token} below — it is `nil` everywhere else.
         class ApiKeySerializer < V3::BaseSerializer
           typelize name: :string,
-                   key_type: [:string, enum: Spree::ApiKey::KEY_TYPES],
+                   key_type: [:string, enum: Spree::ApiKey::KEY_TYPES, enum_type_name: 'ApiKeyType'],
                    token_prefix: [:string, nullable: true],
                    plaintext_token: [:string, nullable: true],
                    scopes: [:string, multi: true],

data/app/serializers/spree/api/v3/admin/catalog_assignment_serializer.rb

@@ -3,7 +3,7 @@ module Spree
     module V3
       module Admin
         class CatalogAssignmentSerializer < V3::BaseSerializer
-          typelize catalog_id: :string, assignable_type: :string, assignable_id: :string,
+          typelize catalog_id: :string, assignable_type: [:string, enum: Spree::CatalogAssignment::ASSIGNABLE_TYPES.map { |type| Spree::Base.polymorphic_api_type(type) }, enum_type_name: 'CatalogAssignableType'], assignable_id: :string,
                    assignable_name: [:string, nullable: true]
 
           attributes created_at: :iso8601

data/app/serializers/spree/api/v3/admin/catalog_price_serializer.rb

@@ -17,7 +17,7 @@ module Spree
           _attributes.delete(:id)
 
           typelize id: 'string | null', label: 'string | null', sku: 'string | null',
-                   currency: [:string, enum: Spree::Money::Rounding::CURRENCY_CODES, enum_type_name: 'CurrencyCode'], source: [:string, enum: Spree::CatalogPrice::SOURCES], break_count: :number
+                   currency: [:string, enum: Spree::Money::Rounding::CURRENCY_CODES, enum_type_name: 'CurrencyCode'], source: [:string, enum: Spree::CatalogPrice::SOURCES, enum_type_name: 'CatalogPriceSource'], break_count: :number
 
           # The variant this prices, so a row can name what it is showing —
           # a product's variants can be priced differently, and one figure

data/app/serializers/spree/api/v3/admin/collection_rule_serializer.rb

@@ -8,7 +8,7 @@ module Spree
         # wire shorthand (e.g. "tag"), matching every other typed-rule
         # serializer and what the writer accepts.
         class CollectionRuleSerializer < BaseSerializer
-          typelize type: [:string, comment: 'Rule type. Built-in: tag, available_on, sale. Extensions may register more.'], value: [:string, nullable: true], match_policy: [:string, enum: Spree::CollectionRule::MATCH_POLICIES]
+          typelize type: [:string, comment: 'Rule type. Built-in: tag, available_on, sale. Extensions may register more.'], value: [:string, nullable: true], match_policy: [:string, enum: Spree::CollectionRule::MATCH_POLICIES, enum_type_name: 'CollectionRuleMatchPolicy']
 
           attributes :value, :match_policy