spree_api 6.0.0.rc4 → 6.0.0.rc6

data/app/controllers/spree/api/v3/store/carts/addresses_controller.rb

@@ -0,0 +1,53 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        module Carts
+          # Every address this cart may be shipped or billed to, in one call:
+          # the buyer's own book, plus the book of the company the cart names
+          # — that node's entries and the ones it inherits from the nodes above
+          # it — limited to the countries the cart's market sells to.
+          #
+          # A checkout address step would otherwise merge two books and filter
+          # them by the market itself. Asking the cart keeps the picker and the
+          # checkout from ever disagreeing about what is usable.
+          #
+          # Signed in only, unlike the rest of the cart surface. What comes
+          # back is not the cart's own data but the books behind it — every
+          # address the buyer has saved, and their company's sites. A guest
+          # token says the caller holds this cart, which it may well do
+          # because the account holder adopted a cart the attacker started;
+          # it says nothing about the account. A genuine guest cart has
+          # neither book, so requiring the account costs nothing but the 401.
+          class AddressesController < Store::ResourceController
+            include Spree::Api::V3::CartResolvable
+
+            prepend_before_action :require_authentication!
+
+            protected
+
+            def set_parent
+              @parent = @cart = find_cart(token: nil)
+            end
+
+            def model_class
+              Spree::Address
+            end
+
+            def serializer_class
+              Spree.api.address_serializer
+            end
+
+            def collection_includes
+              [:owner]
+            end
+
+            def parent_association
+              :selectable_addresses
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/carts/store_credits_controller.rb

@@ -8,7 +8,7 @@ module Spree
             include Spree::Api::V3::OrderLock
 
             before_action :require_authentication!
-            before_action :find_cart!
+            before_action :find_owned_cart!
             before_action :stringify_numeric_amount, only: :create
 
             request_params 'ApplyStoreCreditParams', action: :create do |body|
@@ -50,6 +50,14 @@ module Spree
 
             private
 
+            # The balance spent here is the cart owner's, so a guest token —
+            # which only proves the caller holds this cart — is not enough:
+            # the signed-in customer must be the owner.
+            def find_owned_cart!
+              @cart = resolve_cart(include_completed: false)
+              authorize_storefront_write!(@cart, token: nil)
+            end
+
             # 5.6 storefronts sent a JSON number; read it through its text so no
             # float reaches the money math.
             def stringify_numeric_amount

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -13,7 +13,7 @@ module Spree
 
           CART_ADDRESS = Spree::Api::V3::RequestSchema.shape('CartAddressParams') do |schema|
             schema.attribute :id, :id,
-              description: 'An existing address of the customer to use. The other fields are then ignored.'
+              description: "An existing address from the buyer's address book, or from the book of the company the cart is for. The other fields are then ignored."
             schema.include_attributes Spree::Api::V3::Store::AddressRequestSchema
           end
 
@@ -25,10 +25,10 @@ module Spree
             schema.attribute :currency, :currency
             schema.attribute :locale, :locale
             schema.attribute :shipping_address_id, :id,
-              description: 'An existing address to ship to.',
+              description: "An existing address to ship to, from the buyer's address book or from the book of the company the cart is for. List both with `GET /store/carts/:id/addresses`.",
               example: 'addr_abc123'
             schema.attribute :billing_address_id, :id,
-              description: 'An existing address to bill.',
+              description: "An existing address to bill, from the buyer's address book or from the book of the company the cart is for. List both with `GET /store/carts/:id/addresses`.",
               example: 'addr_def456'
             schema.attribute :preferred_stock_location_id, :id
             schema.attribute :company_id, :id, nullable: true, description: <<~TEXT.squish
@@ -112,6 +112,7 @@ module Spree
           # Auto-advances to the next checkout step when possible.
           def update
             find_cart!
+            authorize_address_book_access!
 
             with_order_lock do
               result = Spree.carts_update_service.call(
@@ -238,6 +239,19 @@ module Spree
 
           # Find incomplete cart for associate action.
           # Only finds guest carts (no user) or carts already owned by current user (idempotent).
+          ADDRESS_BOOK_PARAMS = %i[shipping_address billing_address shipping_address_id billing_address_id].freeze
+
+          # A typed address on a customer's cart is saved into that customer's
+          # address book and may become their default, and an address id names
+          # an entry of that book. The guest token proves the caller holds the
+          # cart, not the account, so those writes need the owner.
+          def authorize_address_book_access!
+            return if @cart.customer.nil?
+            return unless ADDRESS_BOOK_PARAMS.any? { |key| params.key?(key) }
+
+            authorize_storefront_write!(@cart, token: nil)
+          end
+
           def find_cart_for_association
             current_store.carts.incomplete.where(customer: [nil, current_user]).find_by_prefix_id!(params[:id])
           end

data/app/controllers/spree/api/v3/store/companies/addresses_controller.rb

@@ -69,6 +69,10 @@ module Spree
               Spree.api.address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
             # Reading a book and keeping one are different rights: the listing
             # includes what this node inherits, writes stay with the node that
             # owns the row. The Store API authorizes purely by what this scope

data/app/controllers/spree/api/v3/store/customer/addresses_controller.rb

@@ -64,6 +64,10 @@ module Spree
               Spree.api.address_serializer
             end
 
+            def collection_includes
+              [:owner]
+            end
+
             def permitted_params
               params.permit(*permitted_attributes)
             end

data/app/controllers/spree/api/v3/store/customer/data_requests_controller.rb

@@ -10,14 +10,30 @@ module Spree
           # irreversible, and an unattended session should not be enough to
           # trigger it — the same bar the account already applies to changing
           # an email address.
+          #
+          # Nothing happens until the request is confirmed from the link emailed
+          # to the account's address (see DataRequestConfirmationsController),
+          # and the export link is never shown to this session.
           class DataRequestsController < ResourceController
             include Spree::Api::V3::CurrentPasswordConfirmation
+            include Spree::Api::V3::AllowedRedirectUrl
 
             prepend_before_action :require_authentication!
 
+            # Each request while one waits sends the confirmation email again.
+            rate_limit to: Spree::Api::Config[:rate_limit_password_reset],
+                       within: Spree::Api::Config[:rate_limit_window].seconds,
+                       store: Rails.cache,
+                       only: :create,
+                       with: RATE_LIMIT_RESPONSE
+
             request_params 'CreateDataRequestParams', action: :create do |body|
               body.attribute :kind, :string, choices: Spree::DataRequest::KINDS, description: 'Defaults to `access`.'
               body.attribute :current_password, :string, description: 'Required for `erasure`.'
+              body.attribute :redirect_url, :string,
+                format: :uri,
+                example: 'https://myshop.com/account/data-requests/confirm',
+                description: "The storefront page the confirmation link opens, with the token appended. Ignored unless it matches one of the store's allowed origins."
             end
 
             # POST /api/v3/store/customers/me/data_requests
@@ -27,7 +43,9 @@ module Spree
               result = Spree::DataRequests::Create.call(
                 store: current_store,
                 customer: current_user,
-                kind: requested_kind
+                kind: requested_kind,
+                confirm_by_email: true,
+                redirect_url: validated_redirect_url
               )
 
               return render_result_error(result) unless result.success?

data/app/controllers/spree/api/v3/store/customer/password_resets_controller.rb

@@ -6,6 +6,8 @@ module Spree
       module Store
         module Customer
           class PasswordResetsController < Store::BaseController
+            include Spree::Api::V3::AllowedRedirectUrl
+
             allow_guest_storefront_access!
             rate_limit to: Spree::Api::Config[:rate_limit_password_reset],
                        within: Spree::Api::Config[:rate_limit_window].seconds,
@@ -33,26 +35,13 @@ module Spree
 
             # POST /api/v3/store/password_resets
             def create
-              redirect_url = params[:redirect_url]
-
-              # Validate redirect_url against allowed origins (secure by default).
-              # If no allowed origins are configured, redirect_url is silently ignored
-              # to prevent open redirect / token exfiltration attacks.
-              if redirect_url.present?
-                if current_store.allowed_origins.exists? && current_store.allowed_origin?(redirect_url)
-                  # redirect_url is valid — keep it
-                else
-                  redirect_url = nil
-                end
-              end
-
               user = Spree.customer_class.find_by(email: params[:email])
 
               if user
                 event_name = 'customer.password_reset_requested'
                 payload = user.event_payload_for(
                   event_name,
-                  reset_token: user.generate_token_for(:password_reset), store: current_store, redirect_url: redirect_url.presence
+                  reset_token: user.generate_token_for(:password_reset), store: current_store, redirect_url: validated_redirect_url
                 )
                 user.publish_event(event_name, payload)
               end

data/app/controllers/spree/api/v3/store/customers_controller.rb

@@ -31,7 +31,8 @@ module Spree
 
           request_params 'UpdateCustomerParams', action: :update do |body|
             body.attribute :email, :string, format: :email, example: 'customer@example.com'
-            body.attribute :password, :string
+            body.attribute :password, :string,
+              description: 'Changing it signs the customer out everywhere: every refresh token is revoked, so sign in again once the access token expires.'
             body.attribute :password_confirmation, :string
             body.attribute :current_password, :string,
               description: 'Required when changing the email or the password.'
@@ -75,6 +76,7 @@ module Spree
 
           # GET /api/v3/store/customer
           def show
+            preload_default_addresses
             render json: serialize_resource(current_user)
           end
 
@@ -86,6 +88,10 @@ module Spree
             current_user.consent_source = Spree::ConsentRecord::ACCOUNT
 
             if current_user.update(update_params)
+              # A password change is how a customer takes a stolen session
+              # back, so no refresh token issued before it may outlive it —
+              # the reset flow does the same.
+              Spree::RefreshToken.revoke_all_for(current_user) if update_params[:password].present?
               render json: serialize_resource(current_user)
             else
               render_errors(current_user.errors)
@@ -115,6 +121,12 @@ module Spree
 
           private
 
+          # Both default addresses live in one table, so they are fetched in one
+          # query rather than one each.
+          def preload_default_addresses
+            ActiveRecord::Associations::Preloader.new(records: [current_user], associations: %i[bill_address ship_address]).call
+          end
+
           def sensitive_update?
             (params[:email].present? && params[:email] != current_user.email) ||
               params[:password].present?

data/app/controllers/spree/api/v3/store/data_request_confirmations_controller.rb

@@ -0,0 +1,23 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # Confirms a request a customer raised, from the page the emailed link
+        # opens. The page calls this when the person presses its button, never
+        # on load: some mail scanners open links and run the page's scripts.
+        class DataRequestConfirmationsController < DataRequestsController
+          # POST /api/v3/store/data_requests/:token/confirmation
+          def create
+            return render_confirmation_invalid(status: :unprocessable_content) unless data_request
+
+            result = Spree::DataRequests::Confirm.call(data_request: data_request)
+
+            return render_confirmation_invalid(status: :unprocessable_content) unless result.success?
+
+            render json: serialize_resource(result.value)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/data_requests_controller.rb

@@ -0,0 +1,56 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # A data request as seen by whoever holds its confirmation token: the
+        # person reading mail at the address the request names.
+        #
+        # Token-addressed rather than session-authenticated, because the link
+        # arrives by email and may be opened on a device that was never signed
+        # in. Besides the export email, it is the only place the export link is
+        # shown, since the token is what reached the address the request names.
+        class DataRequestsController < Store::BaseController
+          allow_guest_storefront_access!
+
+          # The response can carry a live link to a person's whole export, the
+          # same credential the download itself keeps out of shared caches.
+          before_action { response.headers['Cache-Control'] = 'no-store' }
+
+          # GET /api/v3/store/data_requests/:token
+          def show
+            return render_confirmation_invalid(status: :not_found) unless data_request
+
+            render json: serialize_resource(data_request)
+          end
+
+          protected
+
+          def serializer_class
+            Spree.api.data_request_serializer
+          end
+
+          def serializer_params
+            super.merge(download_url_visible: true)
+          end
+
+          private
+
+          def data_request
+            return @data_request if defined?(@data_request)
+
+            token = params[:token].presence
+            @data_request = token && Spree::DataRequest.for_store(current_store).find_by_token_for(:confirmation, token)
+          end
+
+          def render_confirmation_invalid(status:)
+            render_error(
+              code: ERROR_CODES[:invalid_token],
+              message: I18n.t('spree.data_request_errors.confirmation_invalid'),
+              status: status
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/delivery_methods_controller.rb

@@ -93,7 +93,7 @@ module Spree
           def covers_cart?(location, cart)
             return true if location.pickup_stock_policy == 'any'
 
-            cart.line_items.includes(variant: :product).all? do |line_item|
+            pickup_line_items(cart).all? do |line_item|
               next true if line_item.variant.digital?
               next true unless line_item.variant.should_track_inventory?
 
@@ -101,6 +101,11 @@ module Spree
               stock_level.present? && stock_level.available_count >= line_item.quantity
             end
           end
+
+          # Loaded once for every location the cart is checked against.
+          def pickup_line_items(cart)
+            @pickup_line_items ||= cart.line_items.includes(variant: [:delivery_profile, { product: %i[delivery_profile store] }]).to_a
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/newsletter_subscribers_controller.rb

@@ -3,6 +3,8 @@ module Spree
     module V3
       module Store
         class NewsletterSubscribersController < Store::BaseController
+          include Spree::Api::V3::AllowedRedirectUrl
+
           allow_guest_storefront_access!
           rate_limit to: Spree::Api::Config[:rate_limit_register],
                      within: Spree::Api::Config[:rate_limit_window].seconds,
@@ -139,17 +141,6 @@ module Spree
             subscriber = Spree::NewsletterSubscriber.for_store(current_store).find_by_token_for(:unsubscribe, params[:token])
             subscriber if subscriber&.prefixed_id == params[:id]
           end
-
-          # Drop redirect_url when it isn't in the store's allow-list — secure-by-default,
-          # mirrors password_resets. Returning nil omits it from the webhook payload rather
-          # than rejecting the request, so callers can't probe the allow-list via 4xx errors.
-          def validated_redirect_url
-            redirect_url = params[:redirect_url]
-            return nil if redirect_url.blank?
-            return nil unless current_store.allowed_origin?(redirect_url)
-
-            redirect_url
-          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/products/filters_controller.rb

@@ -5,6 +5,7 @@ module Spree
         module Products
           class FiltersController < Store::BaseController
             include Spree::Api::V3::Store::SearchProviderSupport
+            include Spree::Api::V3::Store::StorefrontProducts
 
             def index
               json = Rails.cache.fetch(filters_cache_key, expires_in: 15.minutes) do
@@ -30,8 +31,8 @@ module Spree
 
             def filters_cache_key
               products_table = Spree::Product.table_name
-              stats = current_store.products.available(Time.current, current_currency, include_preorderable: true)
-                        .pick(Arel.sql("MAX(#{products_table}.updated_at)"), Arel.sql("COUNT(DISTINCT #{products_table}.id)"))
+              stats = storefront_products.
+                        pick(Arel.sql("MAX(#{products_table}.updated_at)"), Arel.sql("COUNT(DISTINCT #{products_table}.id)"))
               max_updated = stats&.first&.to_i
               product_count = stats&.last || 0
 
@@ -41,6 +42,7 @@ module Spree
                 current_currency,
                 current_locale,
                 (hide_prices? ? 'prices_hidden' : nil),
+                buyer_catalog_fragment,
                 category&.cache_key_with_version,
                 collection&.cache_key_with_version,
                 search_query,
@@ -53,11 +55,24 @@ module Spree
               parts.compact.join('/')
             end
 
+            # The buyer's catalogs partition the cache: a facet payload built
+            # for one assortment must not be served to a buyer who sees
+            # another, or it would describe products their listing never
+            # returns.
+            def buyer_catalog_fragment
+              catalogs = Spree::Catalog.for_buyer(store: current_store, customer: current_user, channel: current_channel)
+              return if catalogs.empty?
+
+              # Versioned, since adding or removing a product touches the
+              # catalog without touching the product count or timestamps.
+              catalogs.map(&:cache_key_with_version).sort.join('/')
+            end
+
             def filters_scope
               # Mirror ProductsController#scope so facet counts describe the
               # same product set the listing returns (coming-soon pre-orders
-              # included).
-              scope = current_store.products.available(Time.current, current_currency, include_preorderable: true)
+              # included) — narrowed to the buyer's catalogs like the listing.
+              scope = storefront_products
               scope = scope.in_category(category) if category.present?
               scope = scope.in_collection(collection) if collection.present?
               scope

data/app/request_schemas/spree/api/v3/admin/variant_request_schema.rb

@@ -0,0 +1,21 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # The shared variant attributes, plus the marketplace configuration
+        # only an operator sets.
+        class VariantRequestSchema < Spree::Api::V3::VariantRequestSchema
+          publishes 'VariantParams'
+
+          attribute :seller_id, :id
+          attribute :delivery_profile_id, :id, nullable: true
+          attribute :tax_category_id, :id
+          attribute :prices, :array, of: Spree::Api::V3::PriceRequestSchema,
+            description: 'Per-currency prices. Upserted by currency.'
+          attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
+            description: 'Stock per location. Upserted by location; omitted locations are removed.'
+        end
+      end
+    end
+  end
+end

data/app/request_schemas/spree/api/v3/digital_asset_request_schema.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Api
+    module V3
+      # What a downloadable file on a product carries, whichever panel writes
+      # it. The operator's endpoint adds the provider fields on top.
+      class DigitalAssetRequestSchema < Spree::Api::V3::RequestSchema
+        # Names a blob rather than a column, so it is attached separately.
+        attribute :signed_id, :string,
+          permit: false,
+          description: "A `signed_id` from `files.upload()` with `visibility: 'private'`. On update it replaces the file for everyone who already bought it. A seller's file must be of a content type the marketplace accepts, checked against the file's own signature where it has one."
+        # Resolved through the parent rather than assigned, so an asset can't
+        # be pointed at a variant of another product or store.
+        attribute :variant_id, :id,
+          permit: false,
+          description: "On create, defaults to the product's default variant when omitted. On update, omitting it keeps the current variant."
+        attribute :authorized_clicks, :integer,
+          nullable: true,
+          description: "Null means the store's download settings apply."
+        attribute :authorized_days, :integer,
+          nullable: true,
+          description: "Null means the store's download settings apply."
+      end
+    end
+  end
+end

data/app/request_schemas/spree/api/v3/seller/price_request_schema.rb

@@ -0,0 +1,20 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # The operator's price shape, except `currency` may be left out: the
+        # store's currency is assumed (see `default_price_currencies`).
+        class PriceRequestSchema < Spree::Api::V3::RequestSchema
+          attribute :currency, :currency,
+            example: 'USD',
+            description: "Omit to price in the store's currency. A seller has no currency of their own."
+          attribute :amount, :decimal,
+            required: true,
+            example: '24.00',
+            description: 'A canonical decimal string (`"1234.56"`: period decimal, no grouping). The API does not parse localized input.'
+          attribute :compare_at_amount, :decimal, nullable: true, example: '30.00'
+        end
+      end
+    end
+  end
+end

data/app/request_schemas/spree/api/v3/seller/variant_request_schema.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # The shared variant attributes. Narrower than the operator's set:
+        # `seller_id` would let a payload hand a variant to somebody else, and
+        # `tax_category_id`/`delivery_profile_id` are marketplace configuration.
+        class VariantRequestSchema < Spree::Api::V3::VariantRequestSchema
+          publishes 'VariantParams'
+
+          attribute :prices, :array, of: Spree::Api::V3::Seller::PriceRequestSchema,
+            description: 'Per-currency prices. Upserted by currency.'
+          attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
+            description: "Stock per location, at this seller's own locations only: a location belonging to anyone else is ignored."
+        end
+      end
+    end
+  end
+end

data/app/request_schemas/spree/api/v3/variant_request_schema.rb

@@ -1,9 +1,9 @@
 module Spree
   module Api
     module V3
-      # A variant's own attributes, shared by the variant endpoints and the
-      # variants nested in a product payload. Not published on its own: each
-      # endpoint includes these fields into its own type.
+      # A variant's own attributes, the ones a seller may write too. Each API
+      # publishes its own `VariantParams` from a subclass, which the variant
+      # endpoints and the variants nested in a product payload both extend.
       class VariantRequestSchema < Spree::Api::V3::RequestSchema
         attribute :sku, :string
         attribute :barcode, :string
@@ -13,14 +13,14 @@ module Spree
         attribute :height, :number, nullable: true
         attribute :width, :number, nullable: true
         attribute :depth, :number, nullable: true
-        attribute :weight_unit, :string, choices: Spree::Variant::WEIGHT_UNITS
-        attribute :dimensions_unit, :string, choices: Spree::Variant::DIMENSION_UNITS
+        attribute :weight_unit, :weight_unit, nullable: true, description: "Null falls back to the store's weight unit."
+        attribute :dimensions_unit, :dimension_unit, nullable: true, description: "Null falls back to the store's unit system."
         attribute :hs_code, :string
         attribute :customs_description, :string
         attribute :country_of_origin, :country
         attribute :minimum_order_quantity, :integer, nullable: true
         attribute :order_multiple, :integer, nullable: true
-        attribute :purchase_unit, :string
+        attribute :purchase_unit, :string, nullable: true, choices: Spree::Variant::PURCHASE_UNITS
         attribute :units_per_carton, :integer, nullable: true, description: 'How many units fill one carton.'
         attribute :carton_package_type_id, :id,
           nullable: true,
@@ -29,8 +29,6 @@ module Spree
           nullable: true,
           description: "What one packed carton weighs, in the variant's weight unit."
         attribute :cartons_per_pallet, :integer, nullable: true, description: 'How many cartons stack on one pallet.'
-        attribute :seller_id, :id
-        attribute :delivery_profile_id, :id, nullable: true
         attribute :track_inventory, :boolean
         attribute :preorderable, :boolean,
           description: "Sell this variant before it's in stock. Adds the pre-order label and ships-by promise; the cap comes from `backorder_limit`, an incoming stock count, or backorder."
@@ -40,12 +38,9 @@ module Spree
         attribute :backorder_limit, :integer,
           nullable: true,
           description: 'Maximum units sellable beyond available stock, capping backorders and pre-orders. Null is unlimited.'
-        attribute :tax_category_id, :id
         attribute :position, :integer
-        attribute :prices, :array, of: Spree::Api::V3::PriceRequestSchema,
-          description: 'Per-currency prices. Upserted by currency.'
-        attribute :stock_levels, :array, of: Spree::Api::V3::StockLevelRequestSchema,
-          description: 'Stock per location. Upserted by location; omitted locations are removed.'
+        attribute :options, :array, of: Spree::Api::V3::VariantOptionRequestSchema,
+          description: 'One pair per option type the variant takes part in (size, color). Option types and values are created when missing.'
       end
     end
   end