spree_api 6.0.0.rc4 → 6.0.0.rc6

data/app/controllers/spree/api/v3/admin/delivery_profiles/origin_groups_controller.rb

@@ -57,7 +57,7 @@ module Spree
             end
 
             def collection_includes
-              [:stock_locations]
+              [:stock_locations, :delivery_zones, :delivery_methods]
             end
 
             private

data/app/controllers/spree/api/v3/admin/delivery_profiles_controller.rb

@@ -74,7 +74,7 @@ module Spree
           end
 
           def collection_includes
-            [delivery_origin_groups: :stock_locations]
+            [:delivery_methods, :delivery_zones, { delivery_origin_groups: :stock_locations }]
           end
 
           private

data/app/controllers/spree/api/v3/admin/gift_cards_controller.rb

@@ -59,14 +59,7 @@ module Spree
             return unless params.key?(:customer_id)
             return @customer = nil if params[:customer_id].blank?
 
-            unless holds_permission?('read_customers')
-              return render_error(
-                code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
-                message: 'Missing permission: read_customers',
-                status: :forbidden,
-                details: { required_permission: 'read_customers' }
-              )
-            end
+            return render_missing_permission('read_customers') unless holds_permission?('read_customers')
 
             @customer = Spree.customer_class.
                         accessible_by(current_ability, :show).

data/app/controllers/spree/api/v3/admin/invitation_acceptances_controller.rb

@@ -37,6 +37,8 @@ module Spree
 
             user = resolve_or_create_invitee(@invitation)
             return if performed?
+            # Checked before accepting: a deactivated account gains no role.
+            return render_account_deactivated if account_deactivated?(user)
 
             @invitation.invitee = user
             result = Spree.invitation_accept_workflow.call(invitation: @invitation)

data/app/controllers/spree/api/v3/admin/me_controller.rb

@@ -103,6 +103,8 @@ module Spree
           # role would both disclose more than was handed over and mislead a
           # client that reads /me to decide what to attempt.
           def me_response
+            ActiveRecord::Associations::Preloader.new(records: [current_user], associations: { spree_roles: :resource }).call
+
             {
               user: admin_user_serializer.new(current_user, params: serializer_params).to_h,
               permissions: serialize_permissions(current_ability),

data/app/controllers/spree/api/v3/admin/option_types_controller.rb

@@ -42,6 +42,19 @@ module Spree
             [:option_values]
           end
 
+          # Values created or changed by this write were never loaded with
+          # their swatches, so fetch every value's image in one query before
+          # rendering.
+          def serialize_resource(resource)
+            if expand_list.include?('option_values')
+              ActiveRecord::Associations::Preloader.new(
+                records: resource.option_values.to_a,
+                associations: { image_attachment: :blob }
+              ).call
+            end
+            super
+          end
+
           def permitted_params
             params.permit(*permitted_attributes)
           end

data/app/controllers/spree/api/v3/admin/orders/claims_controller.rb

@@ -6,6 +6,7 @@ module Spree
           # Claims on a completed order.
           class ClaimsController < BaseController
             include Spree::Api::V3::Orders::ClaimActions
+            include Spree::Api::V3::Admin::RefundAuthorization
 
             # Claims are a subject of the `orders` catalog resource, so
             # `read_orders`/`write_orders` gate these endpoints. `:claims`
@@ -51,6 +52,7 @@ module Spree
             end
 
             before_action :set_resource, only: [:show, :update, :approve, :resolve, :deny, :cancel]
+            before_action :require_refund_permission!, only: :resolve, if: -> { params[:resolution].to_s.include?('refund') }
 
             # PATCH /api/v3/admin/orders/:order_id/claims/:id
             #

data/app/controllers/spree/api/v3/admin/orders/exchanges_controller.rb

@@ -7,6 +7,7 @@ module Spree
           # member action, because each carries different arguments.
           class ExchangesController < BaseController
             include Spree::Api::V3::Orders::ExchangeActions
+            include Spree::Api::V3::Admin::RefundAuthorization
 
             # Exchanges are a subject of the `orders` catalog resource, so
             # `read_orders`/`write_orders` gate these endpoints. `:exchanges`
@@ -49,6 +50,14 @@ module Spree
             end
 
             before_action :set_resource, only: [:show, :update, :approve, :receive, :fulfill, :cancel]
+            # Fulfilling settles the difference on the units that actually came
+            # back, a credit to the customer when the replacements cost less.
+            # That figure is only known once the tax rows are rewritten for
+            # those units, inside the fulfillment itself, so the gate cannot be
+            # narrowed on the announced difference: a line received at zero
+            # units would offset a credit still paid on another. Every
+            # fulfillment settles money, so all of them take the refund authority.
+            before_action :require_refund_permission!, only: :fulfill
 
             # PATCH /api/v3/admin/orders/:order_id/exchanges/:id
             #

data/app/controllers/spree/api/v3/admin/orders/fulfillments_controller.rb

@@ -186,7 +186,7 @@ module Spree
             def delivery_method_for_create
               return if create_params[:delivery_method_id].blank?
 
-              Spree::DeliveryMethod.accessible_by(current_ability, :show).find_by_prefix_id!(create_params[:delivery_method_id])
+              current_store.delivery_methods.accessible_by(current_ability, :show).find_by_prefix_id!(create_params[:delivery_method_id])
             end
 
             def source_fulfillment_for_create

data/app/controllers/spree/api/v3/admin/orders/payments_controller.rb

@@ -28,10 +28,13 @@ module Spree
             def create
               with_order_lock do
                 payment_method = current_store.payment_methods.accessible_by(current_ability, :show).find_by_prefix_id!(params[:payment_method_id])
-                @resource = @parent.payments.build(
-                  amount: params[:amount] || @parent.order_total_after_store_credit,
-                  payment_method: payment_method
-                )
+                # The default is what the order still owes, which is nothing
+                # once store credit covers it — a zero payment is refused the
+                # same way a zero amount is.
+                amount = money_param(:amount, @parent.currency) || @parent.order_total_after_store_credit
+                raise Spree::Money::InvalidFormat.new('must be greater than 0', field: :amount) unless amount.positive?
+
+                @resource = @parent.payments.build(amount: amount, payment_method: payment_method)
 
                 if params[:source_id].present? && payment_method.source_required?
                   @resource.source = find_source!(payment_method, params[:source_id])

data/app/controllers/spree/api/v3/admin/orders/returns_controller.rb

@@ -10,6 +10,7 @@ module Spree
           # an amount.
           class ReturnsController < BaseController
             include Spree::Api::V3::Orders::ReturnActions
+            include Spree::Api::V3::Admin::RefundAuthorization
 
             # Returns are a subject of the `orders` catalog resource (see
             # Spree::PermissionConfiguration), so `read_orders`/`write_orders`
@@ -57,6 +58,7 @@ module Spree
             end
 
             before_action :set_resource, only: [:show, :update, :approve, :receive, :refund, :cancel]
+            before_action :require_refund_permission!, only: :refund
 
             # PATCH /api/v3/admin/orders/:order_id/returns/:id
             #

data/app/controllers/spree/api/v3/admin/orders_controller.rb

@@ -4,6 +4,7 @@ module Spree
       module Admin
         class OrdersController < ResourceController
           include Spree::Api::V3::OrderLock
+          include Spree::Api::V3::Admin::RefundAuthorization
 
           scoped_resource :orders
 
@@ -17,10 +18,12 @@ module Spree
           request_params :order do |body|
             body.external_references
             body.attribute :email, :string, example: 'customer@example.com'
-            body.attribute :customer_id, :id
+            body.attribute :customer_id, :id,
+              nullable: true,
+              description: 'Null detaches the customer, leaving a guest order under its `email`.'
             body.attribute :use_customer_default_address, :boolean,
               only: :create,
-              description: "With `customer_id`, copies the customer's saved billing and shipping addresses onto the order."
+              description: "Copies the saved default billing and shipping addresses onto the order. Sent with `company_id`, it takes that company's defaults, inherited from its parent nodes when the company holds none of its own; otherwise it takes the customer's."
             body.attribute :currency, :currency, example: 'USD'
             body.attribute :market_id, :id
             body.attribute :channel_id, :id, description: 'Defaults to the store primary channel when omitted.'
@@ -35,10 +38,10 @@ module Spree
               description: "The `signed_id` of the buyer's purchase order, from `files.upload()` with `visibility: 'private'`. Null removes the document the order carries."
             body.attribute :shipping_address_id, :id,
               only: :create,
-              description: 'An existing address of the customer.'
+              description: "An existing address from the customer's address book, or from the address book of the company the order is for."
             body.attribute :billing_address_id, :id,
               only: :create,
-              description: 'An existing address of the customer.'
+              description: "An existing address from the customer's address book, or from the address book of the company the order is for."
             body.attribute :preferred_stock_location_id, :id,
               description: "Stock location to prefer for fulfillment. Order Routing's built-in preferred-location rule ranks it first; routing falls back to the next rule when the location can't cover the cart."
             body.attribute :company_id, :id,
@@ -51,6 +54,8 @@ module Spree
             body.attribute :tags, :array, of: :string
             body.attribute :shipping_address, :object, shape: ADDRESS
             body.attribute :billing_address, :object, shape: ADDRESS
+            body.attribute :use_shipping, :boolean,
+              description: 'When true, copies the shipping address to the billing address.'
             body.attribute :items, :array,
               description: 'Line items to upsert, keyed by variant. An entry sets that variant\'s quantity, creating the line item when the order has none; `quantity: 0` removes it. Variants you do not send are left alone.' do |item|
               item.attribute :variant_id, :id, required: true
@@ -82,6 +87,7 @@ module Spree
 
           skip_before_action :set_resource, only: [:index, :create]
           before_action :set_resource, only: [:show, :update, :destroy, :complete, :cancel, :approve, :resend_confirmation, :resend_digital_links, :po_document]
+          before_action :require_refund_permission!, only: :cancel, if: -> { params[:refund_payments].to_b }
 
           # POST /api/v3/admin/orders
           def create
@@ -227,7 +233,9 @@ module Spree
           # `fields` list names an order's attributes, and narrowing a group by
           # it can drop the very keys that say it is one.
           def serialize_completion(record)
-            return serialize_resource(record.reload) unless record.is_a?(Spree::OrderGroup)
+            # Read back lazily preloading, as #show is, so its fulfillments and
+            # their rows load once for all of them rather than per fulfillment.
+            return serialize_resource(Spree::Order.preload_associations_lazily.find(record.id)) unless record.is_a?(Spree::OrderGroup)
 
             Spree.api.admin_order_group_serializer.new(completed_group(record), params: serializer_params).to_h
           end
@@ -239,7 +247,7 @@ module Spree
               :customer, :ship_address, :bill_address,
               { payments: %i[payment_method source] },
               { orders: [:seller, :market, :gift_card, :customer, { line_items: { variant: :prices } }] }
-            ).find(group.id)
+            ).preload_associations_lazily.find(group.id)
           end
 
           # Override scope — Order uses SingleStoreResource (for_store).
@@ -294,8 +302,12 @@ module Spree
             # are loaded with their selected rate because the freight summary
             # reads it — otherwise a page of orders costs a query per
             # fulfillment for a field that is nil on every parcel order.
+            # Both addresses are named because they are two associations on
+            # one table, so a row that reads them separately costs a lookup
+            # each.
             [:customer, :channel, :seller, :external_references, :cancel_reason,
              :market, { fulfillments: %i[selected_delivery_rate external_references] },
+             :bill_address, :ship_address,
              { line_items: [:external_references, { variant: :prices }, { price_list: :catalog }] },
              { po_document_attachment: :blob }]
           end
@@ -343,7 +355,9 @@ module Spree
           # Named rather than read from the action, since an upsert reaches
           # update from the create action.
           def order_update_params
-            resolve_company_param(normalize_params(params.permit(*request_params_schema.permit_list(:update))))
+            permitted = resolve_company_param(normalize_params(params.permit(*request_params_schema.permit_list(:update))))
+            permitted[:customer_id] = resolve_customer&.id if permitted.key?(:customer_id)
+            permitted
           end
 
           # An incidental lookup like any other: resolved through the store so

data/app/controllers/spree/api/v3/admin/package_types_controller.rb

@@ -27,9 +27,8 @@ module Spree
             body.attribute :length, :number, nullable: true
             body.attribute :width, :number, nullable: true
             body.attribute :height, :number, nullable: true
-            body.attribute :dimensions_unit, :string,
+            body.attribute :dimensions_unit, :dimension_unit,
               nullable: true,
-              choices: Spree::Variant::DIMENSION_UNITS,
               example: 'cm',
               description: "Unit the three dimensions are in; falls back to the store's unit system."
             body.attribute :weight, :number,
@@ -38,7 +37,7 @@ module Spree
             body.attribute :max_weight, :number,
               nullable: true,
               description: 'What the package can hold, not the same as its own weight.'
-            body.attribute :weight_unit, :string, nullable: true, choices: Spree::Variant::WEIGHT_UNITS, example: 'kg'
+            body.attribute :weight_unit, :weight_unit, nullable: true, example: 'kg'
             body.attribute :default, :boolean,
               description: 'The box every parcel quote is built on. Setting this demotes whichever row held it.'
             body.attribute :metadata, :hash

data/app/controllers/spree/api/v3/admin/password_resets_controller.rb

@@ -36,7 +36,9 @@ module Spree
           def create
             user = Spree.admin_user_class.find_by(email: params[:email])
 
-            if user
+            # A deactivated account is treated as no account: no email is sent,
+            # and the response is the same 202.
+            if user && !account_deactivated?(user)
               event_name = 'admin_user.password_reset_requested'
               payload = user.event_payload_for(
                 event_name,
@@ -62,6 +64,10 @@ module Spree
               )
             end
 
+            # A link sent before the account was switched off must not change
+            # its password or sign it in.
+            return render_account_deactivated if account_deactivated?(user)
+
             if user.update(password: params[:password], password_confirmation: params[:password_confirmation])
               user.publish_event('admin_user.password_reset')
               # A password reset must kill every existing session — a stolen

data/app/controllers/spree/api/v3/admin/price_lists_controller.rb

@@ -123,8 +123,26 @@ module Spree
             [:price_adjustment_tiers]
           end
 
+          def serializer_params
+            return super unless action_name == 'index'
+
+            super.merge(page_counts)
+          end
+
           private
 
+          # One grouped count per figure for the whole page rather than two
+          # queries per list.
+          def page_counts
+            @page_counts ||= begin
+              price_list_ids = collection.map(&:id)
+              {
+                products_counts: Spree::PriceList.products_count_by_list(price_list_ids),
+                prices_counts: Spree::PriceList.prices_count_by_list(price_list_ids)
+              }
+            end
+          end
+
           # Loads the record without the action-derived authorization
           # `set_resource` runs (which would check `:activate` /
           # `:deactivate` — actions that abilities don't grant). The

data/app/controllers/spree/api/v3/admin/product_types_controller.rb

@@ -76,9 +76,21 @@ module Spree
           def permitted_params
             attrs = params.permit(*permitted_attributes)
             attrs = scope_delivery_profile(attrs)
+            attrs = scope_option_type_ids(attrs)
             scope_category_ids(attrs)
           end
 
+          # `option_type_ids=` resolves prefixed ids with no store scoping, so a
+          # type could otherwise seed another store's option types onto every
+          # product it is applied to.
+          def scope_option_type_ids(attrs)
+            return attrs if attrs[:option_type_ids].blank?
+
+            option_type_ids = decode_ids(attrs[:option_type_ids], Spree::OptionType)
+            attrs[:option_type_ids] = Spree::OptionType.for_store(current_store).where(id: option_type_ids).pluck(:id)
+            attrs
+          end
+
           # The template profile must belong to this store — a cross-store id
           # 404s instead of silently linking.
           def scope_delivery_profile(attrs)
@@ -93,7 +105,6 @@ module Spree
           # `category_ids=` resolves prefixed ids with no store scoping, so a
           # type in this store could otherwise be pointed at another store's
           # categories. Mirrors ProductsController#apply_categories.
-          # (OptionType is global — nothing to scope there.)
           def scope_category_ids(attrs)
             return attrs if attrs[:category_ids].blank?
 

data/app/controllers/spree/api/v3/admin/products/digital_assets_controller.rb

@@ -4,61 +4,19 @@ module Spree
       module Admin
         module Products
           class DigitalAssetsController < ResourceController
+            include Spree::Api::V3::DigitalAssetsResource
+
             scoped_resource :products
 
             request_params :digital_asset do |body|
-              # Names a blob rather than a column, so it is attached
-              # separately (+attach_uploaded_file+).
-              body.attribute :signed_id, :string,
-                permit: false,
-                description: "A `signed_id` from `files.upload()` with `visibility: 'private'`. Required for an uploaded file, omitted for a provider-backed asset. On update it replaces the file for everyone who already bought it."
-              # Resolved through the parent rather than assigned, so an asset
-              # can't be pointed at a variant of another product or store.
-              body.attribute :variant_id, :id,
-                permit: false,
-                description: "Defaults to the product's default variant when omitted."
+              body.include_attributes Spree::Api::V3::DigitalAssetRequestSchema
               # The model validates it names a registered provider.
               body.attribute :provider_type, :string,
-                description: 'A provider shorthand from the providers endpoint. Omit for an uploaded file.'
+                description: 'A provider shorthand from the providers endpoint. Omit for an uploaded file; a provider-backed asset sends no `signed_id`.'
               # Its keys are declared by the provider, so it lands verbatim
               # under one key in the asset's metadata.
               body.attribute :provider_settings, :hash,
                 description: "Values for the provider's settings schema, keyed by field name."
-              body.attribute :authorized_clicks, :integer,
-                nullable: true,
-                description: "Null means the store's download settings apply."
-              body.attribute :authorized_days, :integer,
-                nullable: true,
-                description: "Null means the store's download settings apply."
-            end
-
-            # PATCH /api/v3/admin/products/:product_id/digital_assets/:id
-            #
-            # Replacing the file keeps every already-issued link working, since
-            # links resolve through the asset rather than the blob.
-            def update
-              return render_private_storage_error unless uploaded_blob_private?
-
-              # The asset already exists, so attaching a replacement blob writes
-              # to the database immediately, while the update below renders a 422
-              # without raising when it fails. Wrap both so a failed update rolls
-              # the new attachment back rather than leaving the file swapped but
-              # the record unchanged.
-              model_class.transaction do
-                @resource.variant = requested_variant if params[:variant_id].present?
-                attach_uploaded_file(@resource)
-
-                super
-
-                raise ActiveRecord::Rollback if @resource.errors.any?
-              end
-            end
-
-            # POST /api/v3/admin/products/:product_id/digital_assets
-            def create
-              return render_private_storage_error unless uploaded_blob_private?
-
-              super
             end
 
             # GET /api/v3/admin/products/:product_id/digital_assets/providers
@@ -83,75 +41,13 @@ module Spree
 
             protected
 
-            def model_class
-              Spree::DigitalAsset
-            end
-
             def serializer_class
               Spree.api.admin_digital_asset_serializer
             end
 
             def set_parent
               @parent = current_store.products.find_by_prefix_id!(params[:product_id])
-              authorize!(:show, @parent)
-            end
-
-            # The parent association reaches assets through `variants`, which
-            # carries an ORDER BY on the variants table. Combined with the
-            # collection's DISTINCT, PostgreSQL rejects the query outright
-            # (ordering columns must appear in the select list), so order by
-            # the assets' own table instead. SQLite accepts either form, so
-            # this only fails on a real deployment.
-            def scope
-              super.reorder(created_at: :asc)
-            end
-
-            def scope_includes
-              [:variant, { attachment_attachment: :blob }]
-            end
-
-            def permitted_params
-              params.permit(*declared_permitted_attributes)
-            end
-
-            private
-
-            # A product without explicit variants keeps its file on the default
-            # variant, mirroring how the rest of the admin treats such products.
-            def build_resource
-              digital_asset = super
-              digital_asset.variant = requested_variant || @parent.default_variant
-              attach_uploaded_file(digital_asset)
-              digital_asset
-            end
-
-            # Scoped to the parent, not merely to the store: an asset reached
-            # through a product's route has no business pointing at another
-            # product's variant. An id from anywhere else is a 404.
-            def requested_variant
-              return if params[:variant_id].blank?
-
-              @parent.variants.find_by_prefix_id!(params[:variant_id])
-            end
-
-            def attach_uploaded_file(digital_asset)
-              return if params[:signed_id].blank?
-
-              digital_asset.attachment.attach(params[:signed_id])
-            end
-
-            # Attaching never moves a blob between storage services, so a file
-            # uploaded to the public bucket would stay publicly readable while
-            # looking attached. Refuse it rather than storing it wrongly.
-            def uploaded_blob_private?
-              return true if params[:signed_id].blank?
-
-              blob = ActiveStorage::Blob.find_signed(params[:signed_id])
-              blob.present? && blob.service_name.to_s == Spree.private_storage_service_name.to_s
-            end
-
-            def render_private_storage_error
-              render_validation_error(I18n.t('spree.digital_assets_attachment_must_be_private'))
+              authorize_parent!(@parent)
             end
           end
         end

data/app/controllers/spree/api/v3/admin/products/variants_controller.rb

@@ -7,11 +7,10 @@ module Spree
             scoped_resource :products
 
             request_params :variant do |body|
+              body.extends Spree::Api::V3::Admin::VariantRequestSchema
               body.external_references
-              body.include_attributes Spree::Api::V3::VariantRequestSchema
-              body.attribute :options, :array, of: Spree::Api::V3::VariantOptionRequestSchema,
-                required: true, on: :create,
-                description: 'One pair per option type the variant takes part in (size, color). Option types and values are created when missing. On update, omit to leave the option values untouched.'
+              body.require_attributes :options, on: :create
+              body.describe_attribute :options, 'One pair per option type the variant takes part in (size, color). Option types and values are created when missing. On update, omit to leave the option values untouched.'
             end
 
             protected
@@ -29,8 +28,11 @@ module Spree
               authorize!(:show, @parent)
             end
 
+            # `active_stock_reservations` is what lets the quantifier count
+            # held stock in memory; without it the serializer's availability
+            # column sums reservations once per variant.
             def scope_includes
-              [:prices, stock_levels: :stock_location]
+              [:prices, { stock_levels: [:stock_location, :active_stock_reservations] }]
             end
 
             def create_workflow

data/app/controllers/spree/api/v3/admin/products_controller.rb

@@ -77,10 +77,8 @@ module Spree
             body.attribute :variants, :array,
               as: 'ProductVariantParams',
               description: 'Every purchasable attribute (sku, prices, stock, weight, dimensions) lives on variants. An entry without `options` upserts onto the default variant of a simple product; pass `id` to update an existing variant.' do |variant|
+              variant.extends Spree::Api::V3::Admin::VariantRequestSchema
               variant.attribute :id, :id
-              variant.include_attributes Spree::Api::V3::VariantRequestSchema
-              variant.attribute :options, :array, of: Spree::Api::V3::VariantOptionRequestSchema,
-                description: 'One pair per option type the variant takes part in (size, color). Option types and values are created when missing.'
             end
           end
 
@@ -221,7 +219,7 @@ module Spree
 
             channels = scoped_channels
             product_ids = bulk_collection.distinct.ids
-            channels.find_each { |channel| channel.add_products(product_ids) }
+            channels.add_products(product_ids)
 
             render json: { product_count: product_ids.size, channel_count: channels.size }
           end
@@ -233,7 +231,7 @@ module Spree
 
             channels = scoped_channels
             product_ids = bulk_collection.distinct.ids
-            removed = channels.sum { |channel| channel.remove_products(product_ids) }
+            removed = channels.remove_products(product_ids)
 
             render json: { product_count: product_ids.size, channel_count: channels.size, removed: removed }
           end
@@ -291,6 +289,18 @@ module Spree
             Spree.product_update_workflow
           end
 
+          def nested_permitted_models
+            { media: Spree::Media, variants: Spree::Variant }
+          end
+
+          # A written product is serialized from a fresh read: lazy preloading
+          # does not reach records a write built, so the instance the workflow
+          # returned would query once per variant.
+          def serialize_resource(resource)
+            resource = scope.where(id: resource.id).preload_associations_lazily.take! if resource.lazy_preload_context.nil?
+            super
+          end
+
           # Use SearchProvider::Database for collection to handle price/best_selling
           # sorting correctly (counts before sorting, avoiding PG/Mobility issues).
           def collection
@@ -321,7 +331,24 @@ module Spree
           end
 
           def permitted_params
-            params.permit(*permitted_attributes).tap { |attrs| attrs.delete(:status) if review_status?(attrs[:status]) }
+            params.permit(*permitted_attributes).tap do |attrs|
+              attrs.delete(:status) if review_status?(attrs[:status])
+              scope_store_references(attrs)
+            end
+          end
+
+          # Read through the store here because the model only checks that the
+          # record exists: another store's type or tax category would otherwise
+          # be accepted, and the type would seed its option types onto the
+          # product.
+          STORE_REFERENCES = { product_type_id: :product_types, tax_category_id: :tax_categories }.freeze
+
+          def scope_store_references(attrs)
+            STORE_REFERENCES.each do |key, association|
+              next if attrs[key].blank?
+
+              attrs[key] = current_store.public_send(association).find_by_param!(attrs[key]).id
+            end
           end
 
           # A review status is an outcome, not a value to assign: `proposed`

data/app/controllers/spree/api/v3/admin/sellers/payouts_controller.rb

@@ -30,7 +30,8 @@ module Spree
                 # because another went through: the payout row exists and is
                 # failed or unresolved, and an operator reading "settled" would
                 # not know to go looking for it.
-                body = { data: settled.map { |payout| serialize_payout(payout) } }
+                transfer_counts = Spree::SellerTransfer.where(payout_id: settled.map(&:id)).group(:payout_id).count
+                body = { data: settled.map { |payout| serialize_payout(payout, transfer_counts) } }
                 body[:meta] = { failures: failures } if failures.any?
 
                 render json: body, status: :created
@@ -96,8 +97,8 @@ module Spree
               @seller.payable_currencies
             end
 
-            def serialize_payout(payout)
-              Spree.api.admin_seller_payout_serializer.new(payout, params: { store: current_store }).to_h
+            def serialize_payout(payout, transfer_counts)
+              Spree.api.admin_seller_payout_serializer.new(payout, params: { store: current_store, transfer_counts: transfer_counts }).to_h
             end
           end
         end

data/app/controllers/spree/api/v3/admin/stock_transfers_controller.rb

@@ -202,9 +202,10 @@ module Spree
           end
 
           # The listing and the detail page both read a transfer's totals off
-          # its lines.
+          # its lines. Both warehouses come from one table, so their external
+          # references are loaded here rather than once per warehouse.
           def scope_includes
-            [line_includes]
+            [{ source_location: :external_references, destination_location: :external_references }, line_includes]
           end
         end
       end