spree_api 6.0.0.rc4 → 6.0.0.rc6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50559a5f0c0305cee4fbf43e8d145078d0f976ffeed8a40be46f19e4d1cca64d
-  data.tar.gz: '00688dd0b79f087aeee42271fd8678eacbaca3626115770fa29043cbbe3e3182'
+  metadata.gz: 9a4438212680676faa48449ff17a89b8ee1039a707cc68521a72b54aaa08be90
+  data.tar.gz: 0454d9e97dcebc99b1e00bef4a8793d760953f2bfffce98de7d0fb6e4064ae6e
 SHA512:
-  metadata.gz: d56fd3fd92f8bdd5257da98f842c366aa4ad324fcb5ef64c8cf44f007011144813da32af273828604db8cc2ce237fc17df51d633de6132594b41ab3002923c4d
-  data.tar.gz: 34e4d178767f8feccad3b96dbffb9ec02727bce30cdf106a19b9fca97c3af8f44272cf06b4a5facef4864ff3216860538c1a742cc2a1acc26a1589ea1c12b3d9
+  metadata.gz: d5695765e1b4f9dea758cba076d7f6fbdd0c1f9bb95e164bf9af94c5a310b989424516ed29057bb9bc6140d8acf1e327f7cd2024fba16bf6727b8089d98e2618
+  data.tar.gz: 3182e8e1f5b03612236658108788cb633aea6297487adb7d56aa88157301362839c423926969aa3a1205393b5630f9a923b1d8f546fe85daf7532362976446b9

data/app/controllers/concerns/spree/api/v3/admin/auth_cookies.rb

@@ -27,6 +27,7 @@ module Spree
           end
 
           REFRESH_COOKIE_NAME = :spree_admin_refresh_token
+          OAUTH_NONCE_COOKIE_NAME = :spree_admin_oauth_nonce
           COOKIE_PATH = '/api/v3/admin/auth'.freeze
 
           private
@@ -48,6 +49,28 @@ module Spree
             cookies.signed[REFRESH_COOKIE_NAME].presence
           end
 
+          # Binds an SSO attempt to the browser that started it. The nonce
+          # signed into the state is kept here too, so a callback carrying a
+          # state minted in another browser — a login an attacker completed
+          # with their own account — is refused rather than signing the
+          # victim into it.
+          def set_oauth_nonce_cookie(nonce, expires_in:)
+            cookies.signed[OAUTH_NONCE_COOKIE_NAME] = base_cookie_attributes.merge(
+              value: nonce,
+              expires: expires_in.from_now,
+              path: COOKIE_PATH,
+              httponly: true
+            )
+          end
+
+          def oauth_nonce_from_cookie
+            cookies.signed[OAUTH_NONCE_COOKIE_NAME].presence
+          end
+
+          def clear_oauth_nonce_cookie
+            cookies.delete(OAUTH_NONCE_COOKIE_NAME, path: COOKIE_PATH)
+          end
+
           # Keyed off the request scheme, not the Rails env: Rails silently refuses to
           # write a Secure cookie on a non-SSL request, so a production app served over
           # plain http (local Docker image, http-only intranet) would never get the

data/app/controllers/concerns/spree/api/v3/admin/refund_authorization.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Handing money back is the `refunds` key's own authority, as it is on
+        # the nested refunds endpoint: a role that settles returns, claims and
+        # exchanges, or cancels orders, under `orders` does not thereby decide
+        # to refund them. The store back office's gate only — a seller refunds
+        # their own orders under the seller panel's `orders` key.
+        module RefundAuthorization
+          extend ActiveSupport::Concern
+
+          REFUND_PERMISSION = 'write_refunds'.freeze
+
+          private
+
+          def require_refund_permission!
+            return if holds_permission?(REFUND_PERMISSION)
+
+            render_missing_permission(REFUND_PERMISSION)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/admin_authentication.rb

@@ -77,6 +77,7 @@ module Spree
 
           owner = token.resource_owner
           return false unless owner.is_a?(Spree.admin_user_class)
+          return false if account_deactivated?(owner)
 
           @current_api_key = nil
           @current_user = owner

data/app/controllers/concerns/spree/api/v3/allowed_redirect_url.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V3
+      # Reads the `redirect_url` a storefront passes for an emailed link.
+      #
+      # The link carries a live token, so a page outside the store's allowed
+      # origins would hand that token to whoever named the page. An address
+      # that does not match is dropped rather than refused, so callers cannot
+      # probe the allow-list through error responses.
+      module AllowedRedirectUrl
+        extend ActiveSupport::Concern
+
+        private
+
+        # @return [String, nil] the redirect URL when it matches one of the
+        #   store's allowed origins
+        def validated_redirect_url
+          redirect_url = params[:redirect_url]
+          return if redirect_url.blank?
+          return unless current_store.allowed_origin?(redirect_url)
+
+          redirect_url
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/api_key_authentication.rb

@@ -67,7 +67,8 @@ module Spree
           return @publishable_api_key if defined?(@publishable_api_key)
 
           @publishable_api_key = Spree::StoreScopeGuard.skip do
-            extract_api_key ? Spree::ApiKey.active.publishable.find_by(token: extract_api_key) : nil
+            api_key = extract_api_key ? Spree::ApiKey.active.publishable.find_by(token: extract_api_key) : nil
+            api_key if store_present?(api_key)
           end
         end
 
@@ -78,10 +79,21 @@ module Spree
           return @secret_api_key if defined?(@secret_api_key)
 
           @secret_api_key = Spree::StoreScopeGuard.skip do
-            Spree::ApiKey.find_by_secret_token(extract_api_key)
+            api_key = Spree::ApiKey.find_by_secret_token(extract_api_key)
+            api_key if store_present?(api_key)
           end
         end
 
+        # A key selects its store, so a key whose store has been deleted no
+        # longer authenticates. Without this the request would run with no
+        # store at all, and fail deep in the first store-scoped query.
+        #
+        # @param api_key [Spree::ApiKey, nil]
+        # @return [Boolean]
+        def store_present?(api_key)
+          api_key&.store.present?
+        end
+
         # Marks the API key as used at most once per hour
         # to avoid unnecessary DB writes and job queue pressure on every request.
         # This follows the same approach as GitHub's personal access tokens.

data/app/controllers/concerns/spree/api/v3/cart_resolvable.rb

@@ -11,10 +11,16 @@ module Spree
         # Find cart by prefixed ID and authorize read access (owner or guest
         # token). Completed carts are not carts anymore — they 404 unless the
         # caller opts in (idempotent completion, payment-session confirm races).
+        #
+        # Pass +token: nil+ to demand ownership. A guest token proves the
+        # caller holds this cart, which is the right bar for the cart's own
+        # contents and no higher — an endpoint reaching past the cart into
+        # something the account holds asks for the account instead.
+        #
         # @return [Spree::Cart]
-        def find_cart(include_completed: false)
+        def find_cart(include_completed: false, token: cart_token)
           @cart = resolve_cart(include_completed: include_completed)
-          authorize_storefront_read!(@cart, token: cart_token)
+          authorize_storefront_read!(@cart, token: token)
           @cart
         end
 
@@ -44,8 +50,15 @@ module Spree
         # Render the cart as JSON using the cart serializer. Rendering never
         # mutates: an action that wants unbuyable lines swept calls
         # +sweep_unbuyable_lines!+ itself first.
+        #
+        # Serialized from a fresh, lazily preloading read, since lazy
+        # preloading does not reach lines and fulfillments a write built. The
+        # warnings exist only in memory, so they are carried over.
         def render_cart(status: :ok)
-          render json: Spree.api.cart_serializer.new(@cart, params: serializer_params).to_h, status: status
+          cart = current_store.carts.where(id: @cart.id).preload_associations_lazily.take!
+          cart.warnings = @cart.warnings
+
+          render json: Spree.api.cart_serializer.new(cart, params: serializer_params).to_h, status: status
         end
 
         # Drops lines the customer can no longer buy — a discontinued product,
@@ -74,7 +87,13 @@ module Spree
         # storefront that knows nothing about groups still finds every order it
         # needs there.
         def render_order(status: :ok)
-          record = @cart.reload
+          # Read back through a lazily preloading relation rather than
+          # reloaded in place: a group's orders, and everything each of them
+          # renders, then load once for all of them instead of once per order.
+          purchases = @cart.is_a?(Spree::OrderGroup) ? current_store.order_groups : current_store.orders
+          # Chained through `where` first: an association collection drops the
+          # lazy flag when `find` rebuilds the query from the association.
+          record = purchases.where(id: @cart.id).preload_associations_lazily.take!
 
           render json: purchase_serializer_for(record).new(record, params: serializer_params).to_h, status: status
         end

data/app/controllers/concerns/spree/api/v3/digital_assets_resource.rb

@@ -0,0 +1,68 @@
+module Spree
+  module Api
+    module V3
+      # The downloadable files on one product, shared by the operator's and a
+      # seller's branch. Writes run through the digital asset workflows; each
+      # includer finds and authorizes the product in `set_parent`, names its
+      # serializer, and may add to the workflow arguments.
+      module DigitalAssetsResource
+        extend ActiveSupport::Concern
+
+        protected
+
+        def model_class
+          Spree::DigitalAsset
+        end
+
+        # Assets reach the product through `variants`, whose ORDER BY
+        # PostgreSQL rejects alongside the collection's DISTINCT.
+        def scope
+          super.reorder(created_at: :asc)
+        end
+
+        def scope_includes
+          [:variant, { attachment_attachment: :blob }]
+        end
+
+        # Not normalized: `provider_settings` may hold values shaped like
+        # prefixed ids.
+        def permitted_params
+          params.permit(*declared_permitted_attributes, *model_additional_permitted_attributes)
+        end
+
+        def create_workflow
+          Spree.digital_asset_create_workflow
+        end
+
+        def update_workflow
+          Spree.digital_asset_update_workflow
+        end
+
+        # An asset belongs to a variant, not directly to a store; the workflow
+        # resolves the variant through the product.
+        def create_workflow_arguments
+          { product: @parent, attributes: workflow_attributes }
+        end
+
+        def update_workflow_arguments
+          { digital_asset: @resource, attributes: workflow_attributes }
+        end
+
+        private
+
+        # `signed_id` and `variant_id` are declared `permit: false` because
+        # neither is a column: the workflow attaches the one and resolves the
+        # other through the product, so they travel beside the attributes.
+        def workflow_attributes
+          permitted_params.to_h.merge(params.permit(:signed_id, :variant_id).to_h)
+        end
+
+        # Only authorized, never saved: the workflow builds the record it
+        # writes. The variant is what an ability's conditions read.
+        def build_resource
+          model_class.new(variant: @parent.default_variant)
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/error_handler.rb

@@ -16,6 +16,9 @@ module Spree
           # Distinct from authentication_failed: the person proved who they are to
           # the identity provider, but no account here is authorized for them.
           account_not_provisioned: 'account_not_provisioned',
+          # The person proved who they are, but the account has been switched
+          # off (Spree::AccountDeactivation).
+          account_deactivated: 'account_deactivated',
           invalid_oauth_state: 'invalid_oauth_state',
           current_password_invalid: 'current_password_invalid',
           password_reset_token_invalid: 'password_reset_token_invalid',

data/app/controllers/concerns/spree/api/v3/jwt_authentication.rb

@@ -111,7 +111,7 @@ module Spree
 
           case user_type
           when USER_TYPE_ADMIN
-            Spree.admin_user_class.find(user_id)
+            admin_user_from(user_id)
           else
             customer_from(user_id)
           end
@@ -128,6 +128,32 @@ module Spree
           customer.respond_to?(:anonymized?) && customer.anonymized? ? nil : customer
         end
 
+        # A deactivated staff account stops answering to its old tokens on the
+        # next request, rather than when they expire.
+        def admin_user_from(user_id)
+          admin_user = Spree.admin_user_class.find(user_id)
+
+          account_deactivated?(admin_user) ? nil : admin_user
+        end
+
+        # Duck-typed, like the anonymized check above: a custom admin user
+        # class without Spree::AccountDeactivation is never refused.
+        def account_deactivated?(user)
+          user.respond_to?(:deactivated?) && user.deactivated?
+        end
+
+        # For a person who proved who they are: a password that matched, a
+        # provider that vouched for them, a reset or invitation link they hold.
+        # Anyone else gets the same answer as for any failed attempt, so this
+        # never tells a stranger which accounts are switched off.
+        def render_account_deactivated
+          render_error(
+            code: ErrorHandler::ERROR_CODES[:account_deactivated],
+            message: I18n.t('spree.api.account_deactivated'),
+            status: :forbidden
+          )
+        end
+
         def determine_user_type(user)
           if user.is_a?(Spree.admin_user_class)
             USER_TYPE_ADMIN

data/app/controllers/concerns/spree/api/v3/orders/fulfillment_actions.rb

@@ -72,8 +72,13 @@ module Spree
               )
 
               if changer.run!
+                # Read back through a lazily preloading query: what each parcel
+                # renders, its number included, then loads once for all of them.
+                order = current_store.orders.where(id: @order.id).preload_associations_lazily.take!
+                fulfillments = order.fulfillments.to_a
+
                 render json: {
-                  data: @order.reload.fulfillments.map { |fulfillment| serialize_resource(fulfillment) }
+                  data: fulfillments.map { |fulfillment| serialize_resource(fulfillment) }
                 }
               else
                 render_validation_error(changer.errors)

data/app/controllers/concerns/spree/api/v3/scoped_authorization.rb

@@ -159,11 +159,15 @@ module Spree
               "held=#{ability.permission_keys.join(',')}"
           end
 
+          render_missing_permission(required)
+        end
+
+        def render_missing_permission(permission)
           render_error(
             code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
-            message: "Missing permission: #{required}",
+            message: "Missing permission: #{permission}",
             status: :forbidden,
-            details: { required_permission: required }
+            details: { required_permission: permission }
           )
         end
 

data/app/controllers/spree/api/v3/admin/allowed_origins_controller.rb

@@ -3,7 +3,10 @@ module Spree
     module V3
       module Admin
         class AllowedOriginsController < ResourceController
-          scoped_resource :settings
+          # A credential, not a setting: an allowed origin can read every
+          # admin's session through the cookie-authenticated refresh endpoint,
+          # so the list is managed under the same scope as API keys.
+          scoped_resource :api_keys
 
           request_params :allowed_origin do |body|
             body.attribute :origin, :string,

data/app/controllers/spree/api/v3/admin/auth_controller.rb

@@ -36,6 +36,8 @@ module Spree
 
             if result.success?
               user = result.value
+              return render_account_deactivated if account_deactivated?(user)
+
               refresh_token = Spree::RefreshToken.create_for(user, audience: JWT_AUDIENCE_ADMIN, request_env: request_env_for_token)
               set_refresh_cookie(refresh_token)
               render json: auth_response(user)
@@ -56,7 +58,16 @@ module Spree
           # anyone can log in — so it exposes only provider keys, kinds, labels
           # and authorization URLs.
           def providers
-            described = Spree.admin_authentication_strategies.describe { |key| issue_oauth_state(key) }
+            # The login page may load again while a sign-in is in flight, so a
+            # nonce the browser already holds is kept rather than replaced —
+            # replacing it would fail the callback of the state minted first.
+            nonce = oauth_nonce_from_cookie || SecureRandom.hex(16)
+            minted = false
+            described = Spree.admin_authentication_strategies.describe do |key|
+              minted = true
+              issue_oauth_state(key, nonce)
+            end
+            set_oauth_nonce_cookie(nonce, expires_in: OAUTH_STATE_EXPIRY) if minted
 
             render json: { providers: described }
           end
@@ -73,6 +84,9 @@ module Spree
           def callback
             return redirect_to_dashboard(error: ERROR_CODES[:invalid_oauth_state]) unless valid_oauth_state?
 
+            # Used once: a state that signed in cannot sign in again.
+            clear_oauth_nonce_cookie
+
             strategy = Spree.admin_authentication_strategies.build(
               params[:provider],
               params: params,
@@ -87,6 +101,8 @@ module Spree
               return redirect_to_dashboard(error: callback_error_code(strategy))
             end
 
+            return redirect_to_dashboard(error: ERROR_CODES[:account_deactivated]) if account_deactivated?(result.value)
+
             set_refresh_cookie(
               Spree::RefreshToken.create_for(result.value, audience: JWT_AUDIENCE_ADMIN, request_env: request_env_for_token)
             )
@@ -119,6 +135,14 @@ module Spree
             end
 
             user = refresh_token.user
+            # Deactivating deletes the account's refresh tokens; this catches a
+            # refresh already under way when that happened.
+            if account_deactivated?(user)
+              refresh_token.destroy
+              clear_refresh_cookie
+              return render_account_deactivated
+            end
+
             new_refresh_token = refresh_token.rotate!(request_env: request_env_for_token)
             set_refresh_cookie(new_refresh_token)
 
@@ -158,10 +182,11 @@ module Spree
           # expired value fails verification.
           #
           # The provider key is signed into the payload so a state minted for one
-          # provider cannot be replayed against another's callback.
-          def issue_oauth_state(provider)
+          # provider cannot be replayed against another's callback, and the
+          # nonce ties it to the browser holding the matching cookie.
+          def issue_oauth_state(provider, nonce)
             Rails.application.message_verifier(OAUTH_STATE_PURPOSE).generate(
-              { provider: provider.to_s, nonce: SecureRandom.hex(16) },
+              { provider: provider.to_s, nonce: nonce },
               expires_in: OAUTH_STATE_EXPIRY
             )
           end
@@ -173,8 +198,10 @@ module Spree
             # The verifier round-trips through JSON, so payload keys come back as strings.
             payload = Rails.application.message_verifier(OAUTH_STATE_PURPOSE).verified(state)
             return false unless payload.is_a?(Hash)
+            return false unless payload['provider'].to_s == params[:provider].to_s
 
-            payload['provider'].to_s == params[:provider].to_s
+            nonce = oauth_nonce_from_cookie
+            nonce.present? && ActiveSupport::SecurityUtils.secure_compare(payload['nonce'].to_s, nonce)
           end
 
           # Sends the browser back to the dashboard. On failure the login page

data/app/controllers/spree/api/v3/admin/commission_lines_controller.rb

@@ -23,8 +23,8 @@ module Spree
 
           # Reached through the store's own orders: the lines carry no store of
           # their own, and the order is what ties them to one.
-          def scope
-            super.where(order_id: current_store.orders.select(:id))
+          def store_scope
+            model_class.where(order_id: current_store.orders.select(:id))
           end
 
           # Every association the serializer reads, so a page of lines costs a

data/app/controllers/spree/api/v3/admin/companies/addresses_controller.rb

@@ -61,8 +61,14 @@ module Spree
               Spree.api.admin_address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
+            # The listing includes what the node inherits: a division's orders may ship to its headquarters' sites,
+            # so staff placing one must be able to see them — while writes stay with the node that owns the row.
             def scope
-              @parent.addresses
+              action_name == 'index' ? @parent.address_book : @parent.addresses
             end
           end
         end

data/app/controllers/spree/api/v3/admin/custom_fields_controller.rb

@@ -64,16 +64,34 @@ module Spree
           # store can't read or write custom fields on another store's records.
           # Users are intentionally global in Spree (`User.for_store` is a
           # no-op), so the store boundary for customer parents is enforced by
-          # the `authorize!(:show, @parent)` ability check above.
+          # the `authorize!(:update, @parent)` ability check above.
+          #
+          # `Spree::Base.for_store` answers nothing for a model the store has
+          # no association for, so an unexpected parent type 404s rather than
+          # searching every store's records.
           def parent_relation
             klass = parent_lookup.klass
-            klass.respond_to?(:for_store) ? klass.for_store(current_store) : klass
+            return klass.where(id: current_store.id) if klass <= Spree::Store
+            return klass if klass <= Spree.customer_class
+
+            klass.for_store(current_store)
           end
 
           # Product-family parents have no scope pair of their own — their
           # custom fields are catalog data, gated by `products` like the rest
           # of the variant/option-type surface.
-          SCOPE_OVERRIDES = { 'option_type' => :products, 'variant' => :products }.freeze
+          # Parents whose own controller is gated by a scope other than their
+          # plural name share that controller's scope.
+          SCOPE_OVERRIDES = {
+            'option_type' => :products,
+            'variant' => :products,
+            'company' => :customers,
+            'stock_transfer' => :stock,
+            'purchase_order' => :purchasing,
+            'payment_method' => :settings,
+            'tax_rate' => :settings,
+            'store' => :settings
+          }.freeze
 
           # Per-parent scope check: a key holding `write_products` may write a
           # product's custom fields, `write_orders` may write an order's, etc.
@@ -104,12 +122,13 @@ module Spree
           # code reloads — `enabled_resources` is captured at boot and its
           # class references go stale. Aliases `'customer'` because the route
           # uses `customer_id` while user_class.model_name.element is `'user'`,
-          # and `'category'` because the routes expose taxons as categories
-          # (5.5 rename) while the model's element is still `'taxon'`.
+          # `'category'` because the routes expose taxons as categories
+          # (5.5 rename) while the model's element is still `'taxon'`, and
+          # `'medium'` because Rails singularizes the `media` route to `medium_id`.
           def parent_route_map
             @parent_route_map ||= Spree.custom_fields.enabled_resources.each_with_object({}) do |klass, m|
               m[klass.model_name.element.to_s] = klass.name
-            end.merge('customer' => Spree.customer_class.name, 'category' => 'Spree::Category')
+            end.merge('customer' => Spree.customer_class.name, 'category' => 'Spree::Category', 'medium' => 'Spree::Media')
           end
 
           # Returns the first segment whose `<segment>_id` is in the route,
@@ -117,8 +136,8 @@ module Spree
           # by both `set_parent` and `scoped_resource_name`.
           #
           # Read from the path only: a `store_id` or `refund_id` added to the
-          # query string or body must not switch the parent to a type that is
-          # never routed here and has no store scope to narrow it.
+          # query string or body must not switch the parent away from the record
+          # the route names.
           def parent_lookup
             return @parent_lookup if defined?(@parent_lookup)
 

data/app/controllers/spree/api/v3/admin/customer_groups_controller.rb

@@ -25,6 +25,10 @@ module Spree
             Spree.api.admin_customer_group_serializer
           end
 
+          def collection_includes
+            [:customer_group_users]
+          end
+
           def permitted_params
             params.permit(*permitted_attributes)
           end

data/app/controllers/spree/api/v3/admin/customers/addresses_controller.rb

@@ -69,6 +69,10 @@ module Spree
               Spree.api.admin_address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
             private
 
             def address_attrs

data/app/controllers/spree/api/v3/admin/customers/store_credits_controller.rb

@@ -18,7 +18,7 @@ module Spree
             # POST /api/v3/admin/customers/:customer_id/store_credits
             def create
               @resource = @parent.store_credits.new(store_credit_attributes)
-              @resource.created_by = try_spree_current_user
+              @resource.created_by = current_actor
               @resource.store ||= current_store
               authorize_resource!(@resource, :create)
 

data/app/controllers/spree/api/v3/admin/customers_controller.rb

@@ -12,9 +12,13 @@ module Spree
             body.attribute :first_name, :string
             body.attribute :last_name, :string
             body.attribute :phone, :string
-            body.attribute :password, :string,
+            # On create only: once the account exists its password is the
+            # customer's, changed by them or through their own reset email —
+            # never set by staff, who would otherwise be able to sign in as
+            # any customer.
+            body.attribute :password, :string, only: :create,
               description: 'Optional: a customer created without one claims the account through a password reset.'
-            body.attribute :password_confirmation, :string,
+            body.attribute :password_confirmation, :string, only: :create,
               description: 'Optional: a customer created without one claims the account through a password reset.'
             body.attribute :selected_locale, :string
             body.attribute :avatar_signed_id, :string, description: 'A `signed_id` from `files.upload()`.'
@@ -175,12 +179,12 @@ module Spree
           # Bulk add the given customers to the given groups. Idempotent —
           # customers already in a group are skipped at the model layer.
           def bulk_add_to_groups
-            apply_groups(:add_customers)
+            apply_groups(:add_customers_to)
           end
 
           # Bulk remove the given customers from the given groups.
           def bulk_remove_from_groups
-            apply_groups(:remove_customers)
+            apply_groups(:remove_customers_from)
           end
 
           protected
@@ -248,12 +252,7 @@ module Spree
             missing = EXPORT_PERMISSIONS.reject { |permission| holds_permission?(permission) }
             return true if missing.empty?
 
-            render_error(
-              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
-              message: "Missing permission: #{missing.first}",
-              status: :forbidden,
-              details: { required_permission: missing.first }
-            )
+            render_missing_permission(missing.first)
             false
           end
 
@@ -296,8 +295,9 @@ module Spree
           end
 
           # Authorises bulk group mutation, decodes prefixed IDs, then dispatches
-          # to `add_customers` / `remove_customers` per group. Returns the
-          # counts of records actually affected so the UI can show a toast.
+          # to `add_customers_to` / `remove_customers_from` for all groups at
+          # once. Returns the counts of records actually affected so the UI can
+          # show a toast.
           def apply_groups(method)
             authorize! :update, model_class
 
@@ -305,9 +305,9 @@ module Spree
             group_ids = decode_ids(params[:customer_group_ids])
 
             scoped_user_ids = scope.where(id: user_ids).pluck(:id)
-            scoped_groups = Spree::CustomerGroup.for_store(current_store).where(id: group_ids)
+            scoped_groups = Spree::CustomerGroup.for_store(current_store).where(id: group_ids).to_a
 
-            scoped_groups.find_each { |group| group.public_send(method, scoped_user_ids) }
+            Spree::CustomerGroup.public_send(method, scoped_groups, scoped_user_ids)
 
             render json: { customer_count: scoped_user_ids.size, customer_group_count: scoped_groups.size }
           end