spree_api 6.0.0.rc5 → 6.0.0.rc7

data/app/controllers/spree/api/v3/admin/orders/returns_controller.rb

@@ -10,6 +10,7 @@ module Spree
           # an amount.
           class ReturnsController < BaseController
             include Spree::Api::V3::Orders::ReturnActions
+            include Spree::Api::V3::Admin::RefundAuthorization
 
             # Returns are a subject of the `orders` catalog resource (see
             # Spree::PermissionConfiguration), so `read_orders`/`write_orders`
@@ -57,6 +58,7 @@ module Spree
             end
 
             before_action :set_resource, only: [:show, :update, :approve, :receive, :refund, :cancel]
+            before_action :require_refund_permission!, only: :refund
 
             # PATCH /api/v3/admin/orders/:order_id/returns/:id
             #

data/app/controllers/spree/api/v3/admin/orders_controller.rb

@@ -4,6 +4,7 @@ module Spree
       module Admin
         class OrdersController < ResourceController
           include Spree::Api::V3::OrderLock
+          include Spree::Api::V3::Admin::RefundAuthorization
 
           scoped_resource :orders
 
@@ -86,6 +87,7 @@ module Spree
 
           skip_before_action :set_resource, only: [:index, :create]
           before_action :set_resource, only: [:show, :update, :destroy, :complete, :cancel, :approve, :resend_confirmation, :resend_digital_links, :po_document]
+          before_action :require_refund_permission!, only: :cancel, if: -> { params[:refund_payments].to_b }
 
           # POST /api/v3/admin/orders
           def create
@@ -231,7 +233,9 @@ module Spree
           # `fields` list names an order's attributes, and narrowing a group by
           # it can drop the very keys that say it is one.
           def serialize_completion(record)
-            return serialize_resource(record.reload) unless record.is_a?(Spree::OrderGroup)
+            # Read back lazily preloading, as #show is, so its fulfillments and
+            # their rows load once for all of them rather than per fulfillment.
+            return serialize_resource(Spree::Order.preload_associations_lazily.find(record.id)) unless record.is_a?(Spree::OrderGroup)
 
             Spree.api.admin_order_group_serializer.new(completed_group(record), params: serializer_params).to_h
           end
@@ -243,7 +247,7 @@ module Spree
               :customer, :ship_address, :bill_address,
               { payments: %i[payment_method source] },
               { orders: [:seller, :market, :gift_card, :customer, { line_items: { variant: :prices } }] }
-            ).find(group.id)
+            ).preload_associations_lazily.find(group.id)
           end
 
           # Override scope — Order uses SingleStoreResource (for_store).
@@ -298,8 +302,12 @@ module Spree
             # are loaded with their selected rate because the freight summary
             # reads it — otherwise a page of orders costs a query per
             # fulfillment for a field that is nil on every parcel order.
+            # Both addresses are named because they are two associations on
+            # one table, so a row that reads them separately costs a lookup
+            # each.
             [:customer, :channel, :seller, :external_references, :cancel_reason,
              :market, { fulfillments: %i[selected_delivery_rate external_references] },
+             :bill_address, :ship_address,
              { line_items: [:external_references, { variant: :prices }, { price_list: :catalog }] },
              { po_document_attachment: :blob }]
           end

data/app/controllers/spree/api/v3/admin/password_resets_controller.rb

@@ -36,7 +36,9 @@ module Spree
           def create
             user = Spree.admin_user_class.find_by(email: params[:email])
 
-            if user
+            # A deactivated account is treated as no account: no email is sent,
+            # and the response is the same 202.
+            if user && !account_deactivated?(user)
               event_name = 'admin_user.password_reset_requested'
               payload = user.event_payload_for(
                 event_name,
@@ -62,6 +64,10 @@ module Spree
               )
             end
 
+            # A link sent before the account was switched off must not change
+            # its password or sign it in.
+            return render_account_deactivated if account_deactivated?(user)
+
             if user.update(password: params[:password], password_confirmation: params[:password_confirmation])
               user.publish_event('admin_user.password_reset')
               # A password reset must kill every existing session — a stolen

data/app/controllers/spree/api/v3/admin/price_lists_controller.rb

@@ -123,8 +123,26 @@ module Spree
             [:price_adjustment_tiers]
           end
 
+          def serializer_params
+            return super unless action_name == 'index'
+
+            super.merge(page_counts)
+          end
+
           private
 
+          # One grouped count per figure for the whole page rather than two
+          # queries per list.
+          def page_counts
+            @page_counts ||= begin
+              price_list_ids = collection.map(&:id)
+              {
+                products_counts: Spree::PriceList.products_count_by_list(price_list_ids),
+                prices_counts: Spree::PriceList.prices_count_by_list(price_list_ids)
+              }
+            end
+          end
+
           # Loads the record without the action-derived authorization
           # `set_resource` runs (which would check `:activate` /
           # `:deactivate` — actions that abilities don't grant). The

data/app/controllers/spree/api/v3/admin/product_types_controller.rb

@@ -76,9 +76,21 @@ module Spree
           def permitted_params
             attrs = params.permit(*permitted_attributes)
             attrs = scope_delivery_profile(attrs)
+            attrs = scope_option_type_ids(attrs)
             scope_category_ids(attrs)
           end
 
+          # `option_type_ids=` resolves prefixed ids with no store scoping, so a
+          # type could otherwise seed another store's option types onto every
+          # product it is applied to.
+          def scope_option_type_ids(attrs)
+            return attrs if attrs[:option_type_ids].blank?
+
+            option_type_ids = decode_ids(attrs[:option_type_ids], Spree::OptionType)
+            attrs[:option_type_ids] = Spree::OptionType.for_store(current_store).where(id: option_type_ids).pluck(:id)
+            attrs
+          end
+
           # The template profile must belong to this store — a cross-store id
           # 404s instead of silently linking.
           def scope_delivery_profile(attrs)
@@ -93,7 +105,6 @@ module Spree
           # `category_ids=` resolves prefixed ids with no store scoping, so a
           # type in this store could otherwise be pointed at another store's
           # categories. Mirrors ProductsController#apply_categories.
-          # (OptionType is global — nothing to scope there.)
           def scope_category_ids(attrs)
             return attrs if attrs[:category_ids].blank?
 

data/app/controllers/spree/api/v3/admin/products/digital_assets_controller.rb

@@ -4,61 +4,19 @@ module Spree
       module Admin
         module Products
           class DigitalAssetsController < ResourceController
+            include Spree::Api::V3::DigitalAssetsResource
+
             scoped_resource :products
 
             request_params :digital_asset do |body|
-              # Names a blob rather than a column, so it is attached
-              # separately (+attach_uploaded_file+).
-              body.attribute :signed_id, :string,
-                permit: false,
-                description: "A `signed_id` from `files.upload()` with `visibility: 'private'`. Required for an uploaded file, omitted for a provider-backed asset. On update it replaces the file for everyone who already bought it."
-              # Resolved through the parent rather than assigned, so an asset
-              # can't be pointed at a variant of another product or store.
-              body.attribute :variant_id, :id,
-                permit: false,
-                description: "Defaults to the product's default variant when omitted."
+              body.include_attributes Spree::Api::V3::DigitalAssetRequestSchema
               # The model validates it names a registered provider.
               body.attribute :provider_type, :string,
-                description: 'A provider shorthand from the providers endpoint. Omit for an uploaded file.'
+                description: 'A provider shorthand from the providers endpoint. Omit for an uploaded file; a provider-backed asset sends no `signed_id`.'
               # Its keys are declared by the provider, so it lands verbatim
               # under one key in the asset's metadata.
               body.attribute :provider_settings, :hash,
                 description: "Values for the provider's settings schema, keyed by field name."
-              body.attribute :authorized_clicks, :integer,
-                nullable: true,
-                description: "Null means the store's download settings apply."
-              body.attribute :authorized_days, :integer,
-                nullable: true,
-                description: "Null means the store's download settings apply."
-            end
-
-            # PATCH /api/v3/admin/products/:product_id/digital_assets/:id
-            #
-            # Replacing the file keeps every already-issued link working, since
-            # links resolve through the asset rather than the blob.
-            def update
-              return render_private_storage_error unless uploaded_blob_private?
-
-              # The asset already exists, so attaching a replacement blob writes
-              # to the database immediately, while the update below renders a 422
-              # without raising when it fails. Wrap both so a failed update rolls
-              # the new attachment back rather than leaving the file swapped but
-              # the record unchanged.
-              model_class.transaction do
-                @resource.variant = requested_variant if params[:variant_id].present?
-                attach_uploaded_file(@resource)
-
-                super
-
-                raise ActiveRecord::Rollback if @resource.errors.any?
-              end
-            end
-
-            # POST /api/v3/admin/products/:product_id/digital_assets
-            def create
-              return render_private_storage_error unless uploaded_blob_private?
-
-              super
             end
 
             # GET /api/v3/admin/products/:product_id/digital_assets/providers
@@ -83,75 +41,13 @@ module Spree
 
             protected
 
-            def model_class
-              Spree::DigitalAsset
-            end
-
             def serializer_class
               Spree.api.admin_digital_asset_serializer
             end
 
             def set_parent
               @parent = current_store.products.find_by_prefix_id!(params[:product_id])
-              authorize!(:show, @parent)
-            end
-
-            # The parent association reaches assets through `variants`, which
-            # carries an ORDER BY on the variants table. Combined with the
-            # collection's DISTINCT, PostgreSQL rejects the query outright
-            # (ordering columns must appear in the select list), so order by
-            # the assets' own table instead. SQLite accepts either form, so
-            # this only fails on a real deployment.
-            def scope
-              super.reorder(created_at: :asc)
-            end
-
-            def scope_includes
-              [:variant, { attachment_attachment: :blob }]
-            end
-
-            def permitted_params
-              params.permit(*declared_permitted_attributes)
-            end
-
-            private
-
-            # A product without explicit variants keeps its file on the default
-            # variant, mirroring how the rest of the admin treats such products.
-            def build_resource
-              digital_asset = super
-              digital_asset.variant = requested_variant || @parent.default_variant
-              attach_uploaded_file(digital_asset)
-              digital_asset
-            end
-
-            # Scoped to the parent, not merely to the store: an asset reached
-            # through a product's route has no business pointing at another
-            # product's variant. An id from anywhere else is a 404.
-            def requested_variant
-              return if params[:variant_id].blank?
-
-              @parent.variants.find_by_prefix_id!(params[:variant_id])
-            end
-
-            def attach_uploaded_file(digital_asset)
-              return if params[:signed_id].blank?
-
-              digital_asset.attachment.attach(params[:signed_id])
-            end
-
-            # Attaching never moves a blob between storage services, so a file
-            # uploaded to the public bucket would stay publicly readable while
-            # looking attached. Refuse it rather than storing it wrongly.
-            def uploaded_blob_private?
-              return true if params[:signed_id].blank?
-
-              blob = ActiveStorage::Blob.find_signed(params[:signed_id])
-              blob.present? && blob.service_name.to_s == Spree.private_storage_service_name.to_s
-            end
-
-            def render_private_storage_error
-              render_validation_error(I18n.t('spree.digital_assets_attachment_must_be_private'))
+              authorize_parent!(@parent)
             end
           end
         end

data/app/controllers/spree/api/v3/admin/products/variants_controller.rb

@@ -28,8 +28,11 @@ module Spree
               authorize!(:show, @parent)
             end
 
+            # `active_stock_reservations` is what lets the quantifier count
+            # held stock in memory; without it the serializer's availability
+            # column sums reservations once per variant.
             def scope_includes
-              [:prices, stock_levels: :stock_location]
+              [:prices, { stock_levels: [:stock_location, :active_stock_reservations] }]
             end
 
             def create_workflow

data/app/controllers/spree/api/v3/admin/products_controller.rb

@@ -219,7 +219,7 @@ module Spree
 
             channels = scoped_channels
             product_ids = bulk_collection.distinct.ids
-            channels.find_each { |channel| channel.add_products(product_ids) }
+            channels.add_products(product_ids)
 
             render json: { product_count: product_ids.size, channel_count: channels.size }
           end
@@ -231,7 +231,7 @@ module Spree
 
             channels = scoped_channels
             product_ids = bulk_collection.distinct.ids
-            removed = channels.sum { |channel| channel.remove_products(product_ids) }
+            removed = channels.remove_products(product_ids)
 
             render json: { product_count: product_ids.size, channel_count: channels.size, removed: removed }
           end
@@ -293,6 +293,14 @@ module Spree
             { media: Spree::Media, variants: Spree::Variant }
           end
 
+          # A written product is serialized from a fresh read: lazy preloading
+          # does not reach records a write built, so the instance the workflow
+          # returned would query once per variant.
+          def serialize_resource(resource)
+            resource = scope.where(id: resource.id).preload_associations_lazily.take! if resource.lazy_preload_context.nil?
+            super
+          end
+
           # Use SearchProvider::Database for collection to handle price/best_selling
           # sorting correctly (counts before sorting, avoiding PG/Mobility issues).
           def collection
@@ -323,7 +331,24 @@ module Spree
           end
 
           def permitted_params
-            params.permit(*permitted_attributes).tap { |attrs| attrs.delete(:status) if review_status?(attrs[:status]) }
+            params.permit(*permitted_attributes).tap do |attrs|
+              attrs.delete(:status) if review_status?(attrs[:status])
+              scope_store_references(attrs)
+            end
+          end
+
+          # Read through the store here because the model only checks that the
+          # record exists: another store's type or tax category would otherwise
+          # be accepted, and the type would seed its option types onto the
+          # product.
+          STORE_REFERENCES = { product_type_id: :product_types, tax_category_id: :tax_categories }.freeze
+
+          def scope_store_references(attrs)
+            STORE_REFERENCES.each do |key, association|
+              next if attrs[key].blank?
+
+              attrs[key] = current_store.public_send(association).find_by_param!(attrs[key]).id
+            end
           end
 
           # A review status is an outcome, not a value to assign: `proposed`

data/app/controllers/spree/api/v3/admin/sellers/payouts_controller.rb

@@ -30,7 +30,8 @@ module Spree
                 # because another went through: the payout row exists and is
                 # failed or unresolved, and an operator reading "settled" would
                 # not know to go looking for it.
-                body = { data: settled.map { |payout| serialize_payout(payout) } }
+                transfer_counts = Spree::SellerTransfer.where(payout_id: settled.map(&:id)).group(:payout_id).count
+                body = { data: settled.map { |payout| serialize_payout(payout, transfer_counts) } }
                 body[:meta] = { failures: failures } if failures.any?
 
                 render json: body, status: :created
@@ -96,8 +97,8 @@ module Spree
               @seller.payable_currencies
             end
 
-            def serialize_payout(payout)
-              Spree.api.admin_seller_payout_serializer.new(payout, params: { store: current_store }).to_h
+            def serialize_payout(payout, transfer_counts)
+              Spree.api.admin_seller_payout_serializer.new(payout, params: { store: current_store, transfer_counts: transfer_counts }).to_h
             end
           end
         end

data/app/controllers/spree/api/v3/admin/stock_transfers_controller.rb

@@ -202,9 +202,10 @@ module Spree
           end
 
           # The listing and the detail page both read a transfer's totals off
-          # its lines.
+          # its lines. Both warehouses come from one table, so their external
+          # references are loaded here rather than once per warehouse.
           def scope_includes
-            [line_includes]
+            [{ source_location: :external_references, destination_location: :external_references }, line_includes]
           end
         end
       end

data/app/controllers/spree/api/v3/admin/store_controller.rb

@@ -65,6 +65,13 @@ module Spree
               description: 'Admits a seller as soon as they finish onboarding, with no operator review.'
             body.attribute :auto_approve_seller_products, :boolean,
               description: 'Puts a seller product on sale the moment it is submitted, with no review.'
+            body.attribute :seller_digital_assets_enabled, :boolean,
+              description: 'Lets sellers attach downloadable files to their own products.'
+            body.attribute :seller_digital_asset_content_types, :array, of: :string,
+              example: %w[application/pdf application/zip],
+              description: "The content types a seller's file may have, checked against the file's own signature where it has one. An entry names one type or, with `*` as the subtype, a whole family. The operator's own uploads are not restricted."
+            body.attribute :review_seller_digital_asset_changes, :boolean,
+              description: 'Sends a seller product already on sale back to review when the seller adds or replaces a file on it.'
             body.attribute :send_seller_transactional_emails, :boolean,
               description: 'When false, transactional seller emails (approval, payouts and so on) are not sent.'
             body.attribute :default_commission_tax_rate, :decimal,

data/app/controllers/spree/api/v3/admin/tags_controller.rb

@@ -63,22 +63,24 @@ module Spree
             false
           end
 
-          # Tagging filter. Store-owned taggables (`Spree::Product`,
-          # `Spree::Order`) tenant their taggings by `store_id` via
-          # `acts_as_taggable_tenant`, so their vocabulary is bounded to the
-          # current store with a single indexed `tenant` filter. Global
-          # taggables like the customer/user type carry no store, so their tags
-          # are not store-scoped here.
+          # Tagging filter. A taggable declaring `acts_as_taggable_tenant :store_id`
+          # stores the owning store on each tagging, so its vocabulary is bounded
+          # to the current store with a single indexed `tenant` filter. Taggables
+          # without a store tenant are not store-scoped here.
           def taggings_conditions
             conditions = { taggable_type: taggable_type, context: 'tags' }
             conditions[:tenant] = current_store.id.to_s if store_tenanted_taggable?
             conditions
           end
 
-          # True for taggables whose taggings carry a store `tenant`
-          # (`acts_as_taggable_tenant :store_id`), i.e. store-owned records.
           def store_tenanted_taggable?
-            %w[Spree::Product Spree::Order].include?(taggable_type)
+            taggable_class.try(:tenant_column).to_s == 'store_id'
+          end
+
+          # `taggable_type` is already matched against `Spree.taggable_types`,
+          # so only a registered class name is ever constantized.
+          def taggable_class
+            taggable_type.constantize
           end
 
           # Per-type scope check for API-key principals: a key listing product

data/app/controllers/spree/api/v3/admin/webhook_endpoints_controller.rb

@@ -21,7 +21,7 @@ module Spree
               description: 'Defaults to true on create. Prefer the disable and enable endpoints to pause one.'
             body.attribute :subscriptions, :array, of: :string,
               example: %w[order.placed order.canceled],
-              description: 'Event names this endpoint receives. An empty list or `["*"]` subscribes to every event; otherwise list exact names (`order.completed`) or patterns (`order.*`).'
+              description: 'Event names this endpoint receives. An empty list or `["*"]` subscribes to every event; otherwise list exact names (`order.completed`) or patterns with `*` in place of a segment (`order.*`, `*.created`). At most 200 entries of up to 100 characters.'
           end
 
           request_params 'WebhookEndpointDisableParams', action: :disable do |body|
@@ -112,8 +112,11 @@ module Spree
             )
           end
 
+          # Checked after the model's normalization, so what the gate sees is
+          # exactly what would be stored.
           def requested_credential_events
-            Spree::Events.catalog.credential_events(Array(permitted_params[:subscriptions]))
+            subscriptions = Spree::WebhookEndpoint.normalize_value_for(:subscriptions, permitted_params[:subscriptions])
+            Spree::Events.catalog.credential_events(subscriptions)
           end
 
           def repointed_credential_events

data/app/controllers/spree/api/v3/resource_controller.rb

@@ -248,8 +248,11 @@ module Spree
         end
 
         # Finds a single resource within scope using prefixed ID
+        # Loaded through the lazy-preload relation, as the collection is, so
+        # the serializer's walk over the record's children batches their
+        # associations instead of querying once per child.
         def find_resource
-          scope.find_by_prefix_id!(params[:id])
+          scope.preload_associations_lazily.find_by_prefix_id!(params[:id])
         end
 
         # Per-record authorization hook. A no-op in the shared base: the Store
@@ -481,13 +484,23 @@ module Spree
           base_scope = if @parent.present?
                          @parent.send(parent_association)
                        else
-                         model_class.for_store(current_store)
+                         store_scope
                        end
           base_scope = base_scope.includes(scope_includes) if scope_includes.any?
           base_scope = base_scope.preload_associations_lazily
           model_class.include?(Spree::TranslatableResource) ? base_scope.i18n : base_scope
         end
 
+        # The store's rows of this model when the resource has no parent. A
+        # model the store reaches through another record rather than an
+        # association of its own — a commission line through its order —
+        # names that path here, since `for_store` answers nothing for it.
+        #
+        # @return [ActiveRecord::Relation]
+        def store_scope
+          model_class.for_store(current_store)
+        end
+
         # Action names treated as reads. Override in subclasses with custom
         # read-only member/collection actions (e.g. add `analytics`, `types`)
         # so they map to the `:show` ability instead of a write.

data/app/controllers/spree/api/v3/seller/auth_controller.rb

@@ -52,6 +52,8 @@ module Spree
             return render_authentication_failed(result.error) unless result.success?
 
             user = result.value
+            return render_account_deactivated if account_deactivated?(user)
+
             # A store's own staff share this user class, so authenticating is
             # not enough: without a role on some seller there is no panel to
             # sign in to, and minting a token would hand out an audience the
@@ -101,6 +103,14 @@ module Spree
             end
 
             user = refresh_token.user
+            # Deactivating deletes the account's refresh tokens; this catches a
+            # refresh already under way when that happened.
+            if account_deactivated?(user)
+              refresh_token.destroy
+              clear_refresh_cookie
+              return render_account_deactivated
+            end
+
             # Membership can be revoked while a session is live; the refresh is
             # where that takes effect.
             unless user.seller_member?

data/app/controllers/spree/api/v3/seller/invitation_acceptances_controller.rb

@@ -46,6 +46,8 @@ module Spree
 
             user = resolve_or_create_invitee(@invitation)
             return if performed?
+            # Checked before accepting: a deactivated account gains no role.
+            return render_account_deactivated if account_deactivated?(user)
 
             @invitation.invitee = user
             result = Spree.invitation_accept_workflow.call(invitation: @invitation)

data/app/controllers/spree/api/v3/seller/me_controller.rb

@@ -58,6 +58,10 @@ module Spree
             {
               user: Spree.api.seller_account_serializer.new(current_user, params: serializer_params).to_h,
               sellers: serialized_sellers,
+              # The marketplace's own settings that shape what the panel lets a
+              # seller do, read before any seller is chosen since there is one
+              # store per installation.
+              store: Spree.api.seller_store_serializer.new(serializer_params[:store], params: serializer_params).to_h,
               # Both shapes, exactly as the admin `/me`: the panel's `<Can>`
               # reads CanCanCan rules, the key gate reads keys. Sending only
               # keys left `<Can>` answering false for everything on the seller

data/app/controllers/spree/api/v3/seller/orders_controller.rb

@@ -84,7 +84,7 @@ module Spree
               )
 
               if result.success?
-                render json: serialize_resource(@resource.reload)
+                render json: serialize_resource(reloaded_resource)
               else
                 render_service_error(@resource.errors.presence || result.error)
               end
@@ -115,7 +115,7 @@ module Spree
               next render_validation_error(invalid.errors) if invalid
 
               if @resource.update(addresses)
-                render json: serialize_resource(@resource.reload)
+                render json: serialize_resource(reloaded_resource)
               else
                 render_validation_error(@resource.errors)
               end
@@ -143,12 +143,20 @@ module Spree
             super.not_drafts
           end
 
+          # Both addresses are named because they are two associations on one
+          # table, so a row that reads them separately costs a lookup each.
           def collection_includes
-            [:line_items, :customer, :channel]
+            [:line_items, :customer, :channel, :bill_address, :ship_address]
           end
 
           private
 
+          # Read back as #show reads it, lazily preloading, so its
+          # fulfillments' rates and methods load once rather than per row.
+          def reloaded_resource
+            scope.preload_associations_lazily.find(@resource.id)
+          end
+
           # Either address, as a correction rather than a replacement: the
           # sent fields are laid over what the order already holds, so a
           # request naming one line does not blank out the country and

data/app/controllers/spree/api/v3/seller/password_resets_controller.rb

@@ -43,7 +43,8 @@ module Spree
             # admin who runs no seller has no panel to be sent to, and mailing
             # them a seller reset link would be an invitation to a session they
             # cannot hold.
-            if user&.seller_member?
+            # A deactivated account is treated as no account: no email is sent.
+            if user&.seller_member? && !account_deactivated?(user)
               user.publish_event(RESET_REQUESTED_EVENT, event_payload(user))
             end
 
@@ -60,6 +61,9 @@ module Spree
             # it can be revoked between the email being sent and the link being
             # opened, and signing in is what the success path does.
             return render_token_invalid unless user&.seller_member?
+            # A link sent before the account was switched off must not change
+            # its password or sign it in.
+            return render_account_deactivated if account_deactivated?(user)
 
             unless user.update(password: params[:password], password_confirmation: params[:password_confirmation])
               return render_errors(user.errors)