spree_api 6.0.0.rc5 → 6.0.0.rc7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf869734311256969147c858239c279f8aec3faac383f6bf030937eedc9fc54e
-  data.tar.gz: e8a7fa2d529fd09e06f6d9b3ad7007e5122c2b56ad0a0e3b32ce8fccb0d4d073
+  metadata.gz: 982115017cd530a3474eddb5fadd2ab6bd770236d449c9a4b93488d45c485c16
+  data.tar.gz: c333427d0e3dc56730671eb612f44f4ced415f790f5eb4557c6cf2f7da5f6d34
 SHA512:
-  metadata.gz: ef0d1a79bbdcd73ce34176fbe9054090214f326458c2840ac0937582334f639a4907df1cfa7bae30b566976bec1770fa32f455369eded75a8fc456b01efcbb08
-  data.tar.gz: 439f5b98f55aab51ce2d07f037336b175dce46c5e3bc9383685beebe35c34a7d519c004cf2697f68821b52ce538023a3de0dd68ee3b2522062a119db8906b59c
+  metadata.gz: c5cff8de77ced4e66a5f935e7dd3fed912cb9b8141e0675ae6014fa594022d4db451ba0ae9ef4673aebb41d70b2592529ebf858fab1cdf94e476568b72ef0ab6
+  data.tar.gz: 2c71f0f8d3667f4e9e3ab61c7024d534abfb765a8c56f23daee05430fac53b303dac6463021f7e24c5cf690eba6226ef1c2824b1eb66cd665c4ee572214505f3

data/app/controllers/concerns/spree/api/v3/admin/auth_cookies.rb

@@ -27,6 +27,7 @@ module Spree
           end
 
           REFRESH_COOKIE_NAME = :spree_admin_refresh_token
+          OAUTH_NONCE_COOKIE_NAME = :spree_admin_oauth_nonce
           COOKIE_PATH = '/api/v3/admin/auth'.freeze
 
           private
@@ -48,6 +49,28 @@ module Spree
             cookies.signed[REFRESH_COOKIE_NAME].presence
           end
 
+          # Binds an SSO attempt to the browser that started it. The nonce
+          # signed into the state is kept here too, so a callback carrying a
+          # state minted in another browser — a login an attacker completed
+          # with their own account — is refused rather than signing the
+          # victim into it.
+          def set_oauth_nonce_cookie(nonce, expires_in:)
+            cookies.signed[OAUTH_NONCE_COOKIE_NAME] = base_cookie_attributes.merge(
+              value: nonce,
+              expires: expires_in.from_now,
+              path: COOKIE_PATH,
+              httponly: true
+            )
+          end
+
+          def oauth_nonce_from_cookie
+            cookies.signed[OAUTH_NONCE_COOKIE_NAME].presence
+          end
+
+          def clear_oauth_nonce_cookie
+            cookies.delete(OAUTH_NONCE_COOKIE_NAME, path: COOKIE_PATH)
+          end
+
           # Keyed off the request scheme, not the Rails env: Rails silently refuses to
           # write a Secure cookie on a non-SSL request, so a production app served over
           # plain http (local Docker image, http-only intranet) would never get the

data/app/controllers/concerns/spree/api/v3/admin/refund_authorization.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Handing money back is the `refunds` key's own authority, as it is on
+        # the nested refunds endpoint: a role that settles returns, claims and
+        # exchanges, or cancels orders, under `orders` does not thereby decide
+        # to refund them. The store back office's gate only — a seller refunds
+        # their own orders under the seller panel's `orders` key.
+        module RefundAuthorization
+          extend ActiveSupport::Concern
+
+          REFUND_PERMISSION = 'write_refunds'.freeze
+
+          private
+
+          def require_refund_permission!
+            return if holds_permission?(REFUND_PERMISSION)
+
+            render_missing_permission(REFUND_PERMISSION)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/admin_authentication.rb

@@ -77,6 +77,7 @@ module Spree
 
           owner = token.resource_owner
           return false unless owner.is_a?(Spree.admin_user_class)
+          return false if account_deactivated?(owner)
 
           @current_api_key = nil
           @current_user = owner

data/app/controllers/concerns/spree/api/v3/api_key_authentication.rb

@@ -67,7 +67,8 @@ module Spree
           return @publishable_api_key if defined?(@publishable_api_key)
 
           @publishable_api_key = Spree::StoreScopeGuard.skip do
-            extract_api_key ? Spree::ApiKey.active.publishable.find_by(token: extract_api_key) : nil
+            api_key = extract_api_key ? Spree::ApiKey.active.publishable.find_by(token: extract_api_key) : nil
+            api_key if store_present?(api_key)
           end
         end
 
@@ -78,10 +79,21 @@ module Spree
           return @secret_api_key if defined?(@secret_api_key)
 
           @secret_api_key = Spree::StoreScopeGuard.skip do
-            Spree::ApiKey.find_by_secret_token(extract_api_key)
+            api_key = Spree::ApiKey.find_by_secret_token(extract_api_key)
+            api_key if store_present?(api_key)
           end
         end
 
+        # A key selects its store, so a key whose store has been deleted no
+        # longer authenticates. Without this the request would run with no
+        # store at all, and fail deep in the first store-scoped query.
+        #
+        # @param api_key [Spree::ApiKey, nil]
+        # @return [Boolean]
+        def store_present?(api_key)
+          api_key&.store.present?
+        end
+
         # Marks the API key as used at most once per hour
         # to avoid unnecessary DB writes and job queue pressure on every request.
         # This follows the same approach as GitHub's personal access tokens.

data/app/controllers/concerns/spree/api/v3/cart_resolvable.rb

@@ -50,8 +50,15 @@ module Spree
         # Render the cart as JSON using the cart serializer. Rendering never
         # mutates: an action that wants unbuyable lines swept calls
         # +sweep_unbuyable_lines!+ itself first.
+        #
+        # Serialized from a fresh, lazily preloading read, since lazy
+        # preloading does not reach lines and fulfillments a write built. The
+        # warnings exist only in memory, so they are carried over.
         def render_cart(status: :ok)
-          render json: Spree.api.cart_serializer.new(@cart, params: serializer_params).to_h, status: status
+          cart = current_store.carts.where(id: @cart.id).preload_associations_lazily.take!
+          cart.warnings = @cart.warnings
+
+          render json: Spree.api.cart_serializer.new(cart, params: serializer_params).to_h, status: status
         end
 
         # Drops lines the customer can no longer buy — a discontinued product,
@@ -80,7 +87,13 @@ module Spree
         # storefront that knows nothing about groups still finds every order it
         # needs there.
         def render_order(status: :ok)
-          record = @cart.reload
+          # Read back through a lazily preloading relation rather than
+          # reloaded in place: a group's orders, and everything each of them
+          # renders, then load once for all of them instead of once per order.
+          purchases = @cart.is_a?(Spree::OrderGroup) ? current_store.order_groups : current_store.orders
+          # Chained through `where` first: an association collection drops the
+          # lazy flag when `find` rebuilds the query from the association.
+          record = purchases.where(id: @cart.id).preload_associations_lazily.take!
 
           render json: purchase_serializer_for(record).new(record, params: serializer_params).to_h, status: status
         end

data/app/controllers/concerns/spree/api/v3/digital_assets_resource.rb

@@ -0,0 +1,68 @@
+module Spree
+  module Api
+    module V3
+      # The downloadable files on one product, shared by the operator's and a
+      # seller's branch. Writes run through the digital asset workflows; each
+      # includer finds and authorizes the product in `set_parent`, names its
+      # serializer, and may add to the workflow arguments.
+      module DigitalAssetsResource
+        extend ActiveSupport::Concern
+
+        protected
+
+        def model_class
+          Spree::DigitalAsset
+        end
+
+        # Assets reach the product through `variants`, whose ORDER BY
+        # PostgreSQL rejects alongside the collection's DISTINCT.
+        def scope
+          super.reorder(created_at: :asc)
+        end
+
+        def scope_includes
+          [:variant, { attachment_attachment: :blob }]
+        end
+
+        # Not normalized: `provider_settings` may hold values shaped like
+        # prefixed ids.
+        def permitted_params
+          params.permit(*declared_permitted_attributes, *model_additional_permitted_attributes)
+        end
+
+        def create_workflow
+          Spree.digital_asset_create_workflow
+        end
+
+        def update_workflow
+          Spree.digital_asset_update_workflow
+        end
+
+        # An asset belongs to a variant, not directly to a store; the workflow
+        # resolves the variant through the product.
+        def create_workflow_arguments
+          { product: @parent, attributes: workflow_attributes }
+        end
+
+        def update_workflow_arguments
+          { digital_asset: @resource, attributes: workflow_attributes }
+        end
+
+        private
+
+        # `signed_id` and `variant_id` are declared `permit: false` because
+        # neither is a column: the workflow attaches the one and resolves the
+        # other through the product, so they travel beside the attributes.
+        def workflow_attributes
+          permitted_params.to_h.merge(params.permit(:signed_id, :variant_id).to_h)
+        end
+
+        # Only authorized, never saved: the workflow builds the record it
+        # writes. The variant is what an ability's conditions read.
+        def build_resource
+          model_class.new(variant: @parent.default_variant)
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/error_handler.rb

@@ -16,6 +16,9 @@ module Spree
           # Distinct from authentication_failed: the person proved who they are to
           # the identity provider, but no account here is authorized for them.
           account_not_provisioned: 'account_not_provisioned',
+          # The person proved who they are, but the account has been switched
+          # off (Spree::AccountDeactivation).
+          account_deactivated: 'account_deactivated',
           invalid_oauth_state: 'invalid_oauth_state',
           current_password_invalid: 'current_password_invalid',
           password_reset_token_invalid: 'password_reset_token_invalid',

data/app/controllers/concerns/spree/api/v3/jwt_authentication.rb

@@ -111,7 +111,7 @@ module Spree
 
           case user_type
           when USER_TYPE_ADMIN
-            Spree.admin_user_class.find(user_id)
+            admin_user_from(user_id)
           else
             customer_from(user_id)
           end
@@ -128,6 +128,32 @@ module Spree
           customer.respond_to?(:anonymized?) && customer.anonymized? ? nil : customer
         end
 
+        # A deactivated staff account stops answering to its old tokens on the
+        # next request, rather than when they expire.
+        def admin_user_from(user_id)
+          admin_user = Spree.admin_user_class.find(user_id)
+
+          account_deactivated?(admin_user) ? nil : admin_user
+        end
+
+        # Duck-typed, like the anonymized check above: a custom admin user
+        # class without Spree::AccountDeactivation is never refused.
+        def account_deactivated?(user)
+          user.respond_to?(:deactivated?) && user.deactivated?
+        end
+
+        # For a person who proved who they are: a password that matched, a
+        # provider that vouched for them, a reset or invitation link they hold.
+        # Anyone else gets the same answer as for any failed attempt, so this
+        # never tells a stranger which accounts are switched off.
+        def render_account_deactivated
+          render_error(
+            code: ErrorHandler::ERROR_CODES[:account_deactivated],
+            message: I18n.t('spree.api.account_deactivated'),
+            status: :forbidden
+          )
+        end
+
         def determine_user_type(user)
           if user.is_a?(Spree.admin_user_class)
             USER_TYPE_ADMIN

data/app/controllers/concerns/spree/api/v3/orders/fulfillment_actions.rb

@@ -72,8 +72,13 @@ module Spree
               )
 
               if changer.run!
+                # Read back through a lazily preloading query: what each parcel
+                # renders, its number included, then loads once for all of them.
+                order = current_store.orders.where(id: @order.id).preload_associations_lazily.take!
+                fulfillments = order.fulfillments.to_a
+
                 render json: {
-                  data: @order.reload.fulfillments.map { |fulfillment| serialize_resource(fulfillment) }
+                  data: fulfillments.map { |fulfillment| serialize_resource(fulfillment) }
                 }
               else
                 render_validation_error(changer.errors)

data/app/controllers/spree/api/v3/admin/allowed_origins_controller.rb

@@ -3,7 +3,10 @@ module Spree
     module V3
       module Admin
         class AllowedOriginsController < ResourceController
-          scoped_resource :settings
+          # A credential, not a setting: an allowed origin can read every
+          # admin's session through the cookie-authenticated refresh endpoint,
+          # so the list is managed under the same scope as API keys.
+          scoped_resource :api_keys
 
           request_params :allowed_origin do |body|
             body.attribute :origin, :string,

data/app/controllers/spree/api/v3/admin/auth_controller.rb

@@ -36,6 +36,8 @@ module Spree
 
             if result.success?
               user = result.value
+              return render_account_deactivated if account_deactivated?(user)
+
               refresh_token = Spree::RefreshToken.create_for(user, audience: JWT_AUDIENCE_ADMIN, request_env: request_env_for_token)
               set_refresh_cookie(refresh_token)
               render json: auth_response(user)
@@ -56,7 +58,16 @@ module Spree
           # anyone can log in — so it exposes only provider keys, kinds, labels
           # and authorization URLs.
           def providers
-            described = Spree.admin_authentication_strategies.describe { |key| issue_oauth_state(key) }
+            # The login page may load again while a sign-in is in flight, so a
+            # nonce the browser already holds is kept rather than replaced —
+            # replacing it would fail the callback of the state minted first.
+            nonce = oauth_nonce_from_cookie || SecureRandom.hex(16)
+            minted = false
+            described = Spree.admin_authentication_strategies.describe do |key|
+              minted = true
+              issue_oauth_state(key, nonce)
+            end
+            set_oauth_nonce_cookie(nonce, expires_in: OAUTH_STATE_EXPIRY) if minted
 
             render json: { providers: described }
           end
@@ -73,6 +84,9 @@ module Spree
           def callback
             return redirect_to_dashboard(error: ERROR_CODES[:invalid_oauth_state]) unless valid_oauth_state?
 
+            # Used once: a state that signed in cannot sign in again.
+            clear_oauth_nonce_cookie
+
             strategy = Spree.admin_authentication_strategies.build(
               params[:provider],
               params: params,
@@ -87,6 +101,8 @@ module Spree
               return redirect_to_dashboard(error: callback_error_code(strategy))
             end
 
+            return redirect_to_dashboard(error: ERROR_CODES[:account_deactivated]) if account_deactivated?(result.value)
+
             set_refresh_cookie(
               Spree::RefreshToken.create_for(result.value, audience: JWT_AUDIENCE_ADMIN, request_env: request_env_for_token)
             )
@@ -119,6 +135,14 @@ module Spree
             end
 
             user = refresh_token.user
+            # Deactivating deletes the account's refresh tokens; this catches a
+            # refresh already under way when that happened.
+            if account_deactivated?(user)
+              refresh_token.destroy
+              clear_refresh_cookie
+              return render_account_deactivated
+            end
+
             new_refresh_token = refresh_token.rotate!(request_env: request_env_for_token)
             set_refresh_cookie(new_refresh_token)
 
@@ -158,10 +182,11 @@ module Spree
           # expired value fails verification.
           #
           # The provider key is signed into the payload so a state minted for one
-          # provider cannot be replayed against another's callback.
-          def issue_oauth_state(provider)
+          # provider cannot be replayed against another's callback, and the
+          # nonce ties it to the browser holding the matching cookie.
+          def issue_oauth_state(provider, nonce)
             Rails.application.message_verifier(OAUTH_STATE_PURPOSE).generate(
-              { provider: provider.to_s, nonce: SecureRandom.hex(16) },
+              { provider: provider.to_s, nonce: nonce },
               expires_in: OAUTH_STATE_EXPIRY
             )
           end
@@ -173,8 +198,10 @@ module Spree
             # The verifier round-trips through JSON, so payload keys come back as strings.
             payload = Rails.application.message_verifier(OAUTH_STATE_PURPOSE).verified(state)
             return false unless payload.is_a?(Hash)
+            return false unless payload['provider'].to_s == params[:provider].to_s
 
-            payload['provider'].to_s == params[:provider].to_s
+            nonce = oauth_nonce_from_cookie
+            nonce.present? && ActiveSupport::SecurityUtils.secure_compare(payload['nonce'].to_s, nonce)
           end
 
           # Sends the browser back to the dashboard. On failure the login page

data/app/controllers/spree/api/v3/admin/commission_lines_controller.rb

@@ -23,8 +23,8 @@ module Spree
 
           # Reached through the store's own orders: the lines carry no store of
           # their own, and the order is what ties them to one.
-          def scope
-            super.where(order_id: current_store.orders.select(:id))
+          def store_scope
+            model_class.where(order_id: current_store.orders.select(:id))
           end
 
           # Every association the serializer reads, so a page of lines costs a

data/app/controllers/spree/api/v3/admin/custom_fields_controller.rb

@@ -66,18 +66,15 @@ module Spree
           # no-op), so the store boundary for customer parents is enforced by
           # the `authorize!(:update, @parent)` ability check above.
           #
-          # Fails closed: `Spree::Base.for_store` answers the bare class when the
-          # store has no association for the model, which would search every
-          # store's records.
+          # `Spree::Base.for_store` answers nothing for a model the store has
+          # no association for, so an unexpected parent type 404s rather than
+          # searching every store's records.
           def parent_relation
             klass = parent_lookup.klass
             return klass.where(id: current_store.id) if klass <= Spree::Store
             return klass if klass <= Spree.customer_class
 
-            relation = klass.for_store(current_store)
-            raise ActiveRecord::RecordNotFound, 'Parent resource not found' if relation.equal?(klass)
-
-            relation
+            klass.for_store(current_store)
           end
 
           # Product-family parents have no scope pair of their own — their

data/app/controllers/spree/api/v3/admin/customer_groups_controller.rb

@@ -25,6 +25,10 @@ module Spree
             Spree.api.admin_customer_group_serializer
           end
 
+          def collection_includes
+            [:customer_group_users]
+          end
+
           def permitted_params
             params.permit(*permitted_attributes)
           end

data/app/controllers/spree/api/v3/admin/customers/store_credits_controller.rb

@@ -18,7 +18,7 @@ module Spree
             # POST /api/v3/admin/customers/:customer_id/store_credits
             def create
               @resource = @parent.store_credits.new(store_credit_attributes)
-              @resource.created_by = try_spree_current_user
+              @resource.created_by = current_actor
               @resource.store ||= current_store
               authorize_resource!(@resource, :create)
 

data/app/controllers/spree/api/v3/admin/customers_controller.rb

@@ -12,9 +12,13 @@ module Spree
             body.attribute :first_name, :string
             body.attribute :last_name, :string
             body.attribute :phone, :string
-            body.attribute :password, :string,
+            # On create only: once the account exists its password is the
+            # customer's, changed by them or through their own reset email —
+            # never set by staff, who would otherwise be able to sign in as
+            # any customer.
+            body.attribute :password, :string, only: :create,
               description: 'Optional: a customer created without one claims the account through a password reset.'
-            body.attribute :password_confirmation, :string,
+            body.attribute :password_confirmation, :string, only: :create,
               description: 'Optional: a customer created without one claims the account through a password reset.'
             body.attribute :selected_locale, :string
             body.attribute :avatar_signed_id, :string, description: 'A `signed_id` from `files.upload()`.'
@@ -175,12 +179,12 @@ module Spree
           # Bulk add the given customers to the given groups. Idempotent —
           # customers already in a group are skipped at the model layer.
           def bulk_add_to_groups
-            apply_groups(:add_customers)
+            apply_groups(:add_customers_to)
           end
 
           # Bulk remove the given customers from the given groups.
           def bulk_remove_from_groups
-            apply_groups(:remove_customers)
+            apply_groups(:remove_customers_from)
           end
 
           protected
@@ -291,8 +295,9 @@ module Spree
           end
 
           # Authorises bulk group mutation, decodes prefixed IDs, then dispatches
-          # to `add_customers` / `remove_customers` per group. Returns the
-          # counts of records actually affected so the UI can show a toast.
+          # to `add_customers_to` / `remove_customers_from` for all groups at
+          # once. Returns the counts of records actually affected so the UI can
+          # show a toast.
           def apply_groups(method)
             authorize! :update, model_class
 
@@ -300,9 +305,9 @@ module Spree
             group_ids = decode_ids(params[:customer_group_ids])
 
             scoped_user_ids = scope.where(id: user_ids).pluck(:id)
-            scoped_groups = Spree::CustomerGroup.for_store(current_store).where(id: group_ids)
+            scoped_groups = Spree::CustomerGroup.for_store(current_store).where(id: group_ids).to_a
 
-            scoped_groups.find_each { |group| group.public_send(method, scoped_user_ids) }
+            Spree::CustomerGroup.public_send(method, scoped_groups, scoped_user_ids)
 
             render json: { customer_count: scoped_user_ids.size, customer_group_count: scoped_groups.size }
           end

data/app/controllers/spree/api/v3/admin/delivery_profiles/origin_groups_controller.rb

@@ -57,7 +57,7 @@ module Spree
             end
 
             def collection_includes
-              [:stock_locations]
+              [:stock_locations, :delivery_zones, :delivery_methods]
             end
 
             private

data/app/controllers/spree/api/v3/admin/delivery_profiles_controller.rb

@@ -74,7 +74,7 @@ module Spree
           end
 
           def collection_includes
-            [delivery_origin_groups: :stock_locations]
+            [:delivery_methods, :delivery_zones, { delivery_origin_groups: :stock_locations }]
           end
 
           private

data/app/controllers/spree/api/v3/admin/digital_links_controller.rb

@@ -5,7 +5,9 @@ module Spree
         class DigitalLinksController < ResourceController
           scoped_resource :orders
 
-          before_action :set_resource, only: [:reset]
+          # Redeclaring `set_resource` replaces the base class's filter rather
+          # than extending it, so every routed member action is listed here.
+          before_action :set_resource, only: [:show, :reset]
 
           # PATCH /api/v3/admin/digital_links/:id/reset
           #

data/app/controllers/spree/api/v3/admin/invitation_acceptances_controller.rb

@@ -37,6 +37,8 @@ module Spree
 
             user = resolve_or_create_invitee(@invitation)
             return if performed?
+            # Checked before accepting: a deactivated account gains no role.
+            return render_account_deactivated if account_deactivated?(user)
 
             @invitation.invitee = user
             result = Spree.invitation_accept_workflow.call(invitation: @invitation)

data/app/controllers/spree/api/v3/admin/me_controller.rb

@@ -103,6 +103,8 @@ module Spree
           # role would both disclose more than was handed over and mislead a
           # client that reads /me to decide what to attempt.
           def me_response
+            ActiveRecord::Associations::Preloader.new(records: [current_user], associations: { spree_roles: :resource }).call
+
             {
               user: admin_user_serializer.new(current_user, params: serializer_params).to_h,
               permissions: serialize_permissions(current_ability),

data/app/controllers/spree/api/v3/admin/option_types_controller.rb

@@ -42,6 +42,19 @@ module Spree
             [:option_values]
           end
 
+          # Values created or changed by this write were never loaded with
+          # their swatches, so fetch every value's image in one query before
+          # rendering.
+          def serialize_resource(resource)
+            if expand_list.include?('option_values')
+              ActiveRecord::Associations::Preloader.new(
+                records: resource.option_values.to_a,
+                associations: { image_attachment: :blob }
+              ).call
+            end
+            super
+          end
+
           def permitted_params
             params.permit(*permitted_attributes)
           end

data/app/controllers/spree/api/v3/admin/orders/claims_controller.rb

@@ -6,6 +6,7 @@ module Spree
           # Claims on a completed order.
           class ClaimsController < BaseController
             include Spree::Api::V3::Orders::ClaimActions
+            include Spree::Api::V3::Admin::RefundAuthorization
 
             # Claims are a subject of the `orders` catalog resource, so
             # `read_orders`/`write_orders` gate these endpoints. `:claims`
@@ -51,6 +52,7 @@ module Spree
             end
 
             before_action :set_resource, only: [:show, :update, :approve, :resolve, :deny, :cancel]
+            before_action :require_refund_permission!, only: :resolve, if: -> { params[:resolution].to_s.include?('refund') }
 
             # PATCH /api/v3/admin/orders/:order_id/claims/:id
             #

data/app/controllers/spree/api/v3/admin/orders/exchanges_controller.rb

@@ -7,6 +7,7 @@ module Spree
           # member action, because each carries different arguments.
           class ExchangesController < BaseController
             include Spree::Api::V3::Orders::ExchangeActions
+            include Spree::Api::V3::Admin::RefundAuthorization
 
             # Exchanges are a subject of the `orders` catalog resource, so
             # `read_orders`/`write_orders` gate these endpoints. `:exchanges`
@@ -49,6 +50,14 @@ module Spree
             end
 
             before_action :set_resource, only: [:show, :update, :approve, :receive, :fulfill, :cancel]
+            # Fulfilling settles the difference on the units that actually came
+            # back, a credit to the customer when the replacements cost less.
+            # That figure is only known once the tax rows are rewritten for
+            # those units, inside the fulfillment itself, so the gate cannot be
+            # narrowed on the announced difference: a line received at zero
+            # units would offset a credit still paid on another. Every
+            # fulfillment settles money, so all of them take the refund authority.
+            before_action :require_refund_permission!, only: :fulfill
 
             # PATCH /api/v3/admin/orders/:order_id/exchanges/:id
             #

data/app/controllers/spree/api/v3/admin/orders/fulfillments_controller.rb

@@ -186,7 +186,7 @@ module Spree
             def delivery_method_for_create
               return if create_params[:delivery_method_id].blank?
 
-              Spree::DeliveryMethod.accessible_by(current_ability, :show).find_by_prefix_id!(create_params[:delivery_method_id])
+              current_store.delivery_methods.accessible_by(current_ability, :show).find_by_prefix_id!(create_params[:delivery_method_id])
             end
 
             def source_fulfillment_for_create

data/app/controllers/spree/api/v3/admin/orders/payments_controller.rb

@@ -28,10 +28,13 @@ module Spree
             def create
               with_order_lock do
                 payment_method = current_store.payment_methods.accessible_by(current_ability, :show).find_by_prefix_id!(params[:payment_method_id])
-                @resource = @parent.payments.build(
-                  amount: params[:amount] || @parent.order_total_after_store_credit,
-                  payment_method: payment_method
-                )
+                # The default is what the order still owes, which is nothing
+                # once store credit covers it — a zero payment is refused the
+                # same way a zero amount is.
+                amount = money_param(:amount, @parent.currency) || @parent.order_total_after_store_credit
+                raise Spree::Money::InvalidFormat.new('must be greater than 0', field: :amount) unless amount.positive?
+
+                @resource = @parent.payments.build(amount: amount, payment_method: payment_method)
 
                 if params[:source_id].present? && payment_method.source_required?
                   @resource.source = find_source!(payment_method, params[:source_id])