spree_api 6.0.0.rc5 → 6.0.0.rc7

data/app/controllers/spree/api/v3/seller/products/digital_assets_controller.rb

@@ -0,0 +1,67 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        module Products
+          # The downloadable files on one of this seller's own products.
+          #
+          # Uploaded files only: a provider is the operator's own code
+          # reaching into their internal systems, so a seller can neither pick
+          # one nor read its settings. An asset the operator set up with one
+          # is still listed, since it is part of what the seller's product
+          # delivers.
+          #
+          # The marketplace's rules for a seller's file — whether sellers may
+          # upload at all, which content types, and whether an approved
+          # listing goes back to review — apply because the workflow is told
+          # who is writing.
+          class DigitalAssetsController < Seller::ResourceController
+            include Spree::Api::V3::DigitalAssetsResource
+
+            scoped_resource :products
+
+            request_params :digital_asset do |body|
+              body.include_attributes Spree::Api::V3::DigitalAssetRequestSchema
+              body.require_attributes :signed_id, on: :create
+            end
+
+            # DELETE /api/v3/seller/products/:product_id/digital_assets/:id
+            #
+            # Removing a file is covered by the same switch as adding one: a
+            # marketplace that keeps digital files to itself keeps the ones it
+            # attached to a seller's product.
+            def destroy
+              unless current_store.preferred_seller_digital_assets_enabled
+                return render_validation_error(I18n.t('spree.digital_assets_sellers_disabled'))
+              end
+
+              super
+            end
+
+            protected
+
+            def serializer_class
+              Spree.api.seller_digital_asset_serializer
+            end
+
+            def create_workflow_arguments
+              super.merge(seller: current_seller, submitted_by: current_user)
+            end
+
+            def update_workflow_arguments
+              super.merge(seller: current_seller, submitted_by: current_user)
+            end
+
+            # Rooted in the seller's own catalog, so another seller's product
+            # is a 404. Changing a product's files is a change to the product,
+            # so writes need `:update` on it, not just `:show`.
+            def set_parent
+              @parent = current_seller.products.find_by_prefix_id!(params[:product_id])
+              authorize_parent!(@parent)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/seller/products_controller.rb

@@ -142,8 +142,10 @@ module Spree
                                                   submitted_by: try_spree_current_user)
 
               # A product Propose refused is untouched; one it accepted is in
-              # review or already through it.
-              product.reload.status != was
+              # review or already through it. The saved value, not the
+              # attribute: a refused update leaves the new status unsaved on
+              # the record, and a rolled-back one restores what was stored.
+              product.status_in_database != was
             }
           end
 

data/app/controllers/spree/api/v3/seller/team_controller.rb

@@ -86,7 +86,7 @@ module Spree
           private
 
           def members
-            @members ||= current_seller.users.to_a
+            @members ||= current_seller.users.with_attached_avatar.to_a
           end
 
           def set_member

data/app/controllers/spree/api/v3/store/carts/store_credits_controller.rb

@@ -8,7 +8,7 @@ module Spree
             include Spree::Api::V3::OrderLock
 
             before_action :require_authentication!
-            before_action :find_cart!
+            before_action :find_owned_cart!
             before_action :stringify_numeric_amount, only: :create
 
             request_params 'ApplyStoreCreditParams', action: :create do |body|
@@ -50,6 +50,14 @@ module Spree
 
             private
 
+            # The balance spent here is the cart owner's, so a guest token —
+            # which only proves the caller holds this cart — is not enough:
+            # the signed-in customer must be the owner.
+            def find_owned_cart!
+              @cart = resolve_cart(include_completed: false)
+              authorize_storefront_write!(@cart, token: nil)
+            end
+
             # 5.6 storefronts sent a JSON number; read it through its text so no
             # float reaches the money math.
             def stringify_numeric_amount

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -112,6 +112,7 @@ module Spree
           # Auto-advances to the next checkout step when possible.
           def update
             find_cart!
+            authorize_address_book_access!
 
             with_order_lock do
               result = Spree.carts_update_service.call(
@@ -238,6 +239,19 @@ module Spree
 
           # Find incomplete cart for associate action.
           # Only finds guest carts (no user) or carts already owned by current user (idempotent).
+          ADDRESS_BOOK_PARAMS = %i[shipping_address billing_address shipping_address_id billing_address_id].freeze
+
+          # A typed address on a customer's cart is saved into that customer's
+          # address book and may become their default, and an address id names
+          # an entry of that book. The guest token proves the caller holds the
+          # cart, not the account, so those writes need the owner.
+          def authorize_address_book_access!
+            return if @cart.customer.nil?
+            return unless ADDRESS_BOOK_PARAMS.any? { |key| params.key?(key) }
+
+            authorize_storefront_write!(@cart, token: nil)
+          end
+
           def find_cart_for_association
             current_store.carts.incomplete.where(customer: [nil, current_user]).find_by_prefix_id!(params[:id])
           end

data/app/controllers/spree/api/v3/store/customers_controller.rb

@@ -31,7 +31,8 @@ module Spree
 
           request_params 'UpdateCustomerParams', action: :update do |body|
             body.attribute :email, :string, format: :email, example: 'customer@example.com'
-            body.attribute :password, :string
+            body.attribute :password, :string,
+              description: 'Changing it signs the customer out everywhere: every refresh token is revoked, so sign in again once the access token expires.'
             body.attribute :password_confirmation, :string
             body.attribute :current_password, :string,
               description: 'Required when changing the email or the password.'
@@ -75,6 +76,7 @@ module Spree
 
           # GET /api/v3/store/customer
           def show
+            preload_default_addresses
             render json: serialize_resource(current_user)
           end
 
@@ -86,6 +88,10 @@ module Spree
             current_user.consent_source = Spree::ConsentRecord::ACCOUNT
 
             if current_user.update(update_params)
+              # A password change is how a customer takes a stolen session
+              # back, so no refresh token issued before it may outlive it —
+              # the reset flow does the same.
+              Spree::RefreshToken.revoke_all_for(current_user) if update_params[:password].present?
               render json: serialize_resource(current_user)
             else
               render_errors(current_user.errors)
@@ -115,6 +121,12 @@ module Spree
 
           private
 
+          # Both default addresses live in one table, so they are fetched in one
+          # query rather than one each.
+          def preload_default_addresses
+            ActiveRecord::Associations::Preloader.new(records: [current_user], associations: %i[bill_address ship_address]).call
+          end
+
           def sensitive_update?
             (params[:email].present? && params[:email] != current_user.email) ||
               params[:password].present?

data/app/controllers/spree/api/v3/store/delivery_methods_controller.rb

@@ -93,7 +93,7 @@ module Spree
           def covers_cart?(location, cart)
             return true if location.pickup_stock_policy == 'any'
 
-            cart.line_items.includes(variant: :product).all? do |line_item|
+            pickup_line_items(cart).all? do |line_item|
               next true if line_item.variant.digital?
               next true unless line_item.variant.should_track_inventory?
 
@@ -101,6 +101,11 @@ module Spree
               stock_level.present? && stock_level.available_count >= line_item.quantity
             end
           end
+
+          # Loaded once for every location the cart is checked against.
+          def pickup_line_items(cart)
+            @pickup_line_items ||= cart.line_items.includes(variant: [:delivery_profile, { product: %i[delivery_profile store] }]).to_a
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/products/filters_controller.rb

@@ -5,6 +5,7 @@ module Spree
         module Products
           class FiltersController < Store::BaseController
             include Spree::Api::V3::Store::SearchProviderSupport
+            include Spree::Api::V3::Store::StorefrontProducts
 
             def index
               json = Rails.cache.fetch(filters_cache_key, expires_in: 15.minutes) do
@@ -30,8 +31,8 @@ module Spree
 
             def filters_cache_key
               products_table = Spree::Product.table_name
-              stats = current_store.products.available(Time.current, current_currency, include_preorderable: true)
-                        .pick(Arel.sql("MAX(#{products_table}.updated_at)"), Arel.sql("COUNT(DISTINCT #{products_table}.id)"))
+              stats = storefront_products.
+                        pick(Arel.sql("MAX(#{products_table}.updated_at)"), Arel.sql("COUNT(DISTINCT #{products_table}.id)"))
               max_updated = stats&.first&.to_i
               product_count = stats&.last || 0
 
@@ -41,6 +42,7 @@ module Spree
                 current_currency,
                 current_locale,
                 (hide_prices? ? 'prices_hidden' : nil),
+                buyer_catalog_fragment,
                 category&.cache_key_with_version,
                 collection&.cache_key_with_version,
                 search_query,
@@ -53,11 +55,24 @@ module Spree
               parts.compact.join('/')
             end
 
+            # The buyer's catalogs partition the cache: a facet payload built
+            # for one assortment must not be served to a buyer who sees
+            # another, or it would describe products their listing never
+            # returns.
+            def buyer_catalog_fragment
+              catalogs = Spree::Catalog.for_buyer(store: current_store, customer: current_user, channel: current_channel)
+              return if catalogs.empty?
+
+              # Versioned, since adding or removing a product touches the
+              # catalog without touching the product count or timestamps.
+              catalogs.map(&:cache_key_with_version).sort.join('/')
+            end
+
             def filters_scope
               # Mirror ProductsController#scope so facet counts describe the
               # same product set the listing returns (coming-soon pre-orders
-              # included).
-              scope = current_store.products.available(Time.current, current_currency, include_preorderable: true)
+              # included) — narrowed to the buyer's catalogs like the listing.
+              scope = storefront_products
               scope = scope.in_category(category) if category.present?
               scope = scope.in_collection(collection) if collection.present?
               scope

data/app/request_schemas/spree/api/v3/digital_asset_request_schema.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Api
+    module V3
+      # What a downloadable file on a product carries, whichever panel writes
+      # it. The operator's endpoint adds the provider fields on top.
+      class DigitalAssetRequestSchema < Spree::Api::V3::RequestSchema
+        # Names a blob rather than a column, so it is attached separately.
+        attribute :signed_id, :string,
+          permit: false,
+          description: "A `signed_id` from `files.upload()` with `visibility: 'private'`. On update it replaces the file for everyone who already bought it. A seller's file must be of a content type the marketplace accepts, checked against the file's own signature where it has one."
+        # Resolved through the parent rather than assigned, so an asset can't
+        # be pointed at a variant of another product or store.
+        attribute :variant_id, :id,
+          permit: false,
+          description: "On create, defaults to the product's default variant when omitted. On update, omitting it keeps the current variant."
+        attribute :authorized_clicks, :integer,
+          nullable: true,
+          description: "Null means the store's download settings apply."
+        attribute :authorized_days, :integer,
+          nullable: true,
+          description: "Null means the store's download settings apply."
+      end
+    end
+  end
+end

data/app/serializers/concerns/spree/api/v3/digital_asset_details.rb

@@ -0,0 +1,70 @@
+module Spree
+  module Api
+    module V3
+      # What a panel shows about a downloadable file: its size, the limits
+      # that apply to it, and a short-lived link to check what was uploaded.
+      # Shared by the operator's and a seller's serializer, so both panels
+      # read the same fields.
+      module DigitalAssetDetails
+        extend ActiveSupport::Concern
+
+        # The store whose download settings apply: the request's, or the
+        # asset's own outside a request.
+        #
+        # @param digital_asset [Spree::DigitalAsset]
+        # @param params [Hash, nil] the serializer params
+        # @return [Spree::Store]
+        def self.store_for(digital_asset, params)
+          params&.dig(:store) || Spree::Current.store || digital_asset.store
+        end
+
+        included do
+          typelize byte_size: [:number, nullable: true],
+                   authorized_clicks: [:number, nullable: true],
+                   authorized_days: [:number, nullable: true],
+                   effective_authorized_clicks: :number,
+                   effective_authorized_days: :number,
+                   provider_type: [:string, nullable: true, comment: 'Digital asset provider; null is an uploaded file. Built-in: file. Extensions may register more.'],
+                   provider_name: [:string, comment: 'Digital asset provider name. Built-in: File. Extensions may register more.'],
+                   download_url: [:string, nullable: true]
+
+          attributes :authorized_clicks, :authorized_days, :byte_size
+          attributes created_at: :iso8601, updated_at: :iso8601
+
+          api_type_attributes :provider_type
+
+          # Human-readable source for the listing. Blank provider_type is the
+          # uploaded-file default, so this reads "File" there.
+          attribute :provider_name do |digital_asset|
+            digital_asset.provider_class.provider_name
+          end
+
+          # Lets a merchant check what they actually uploaded. Short-lived and
+          # panel-only: this is the file itself, not a customer's download
+          # grant, so it carries no counter and spends nobody's allowance.
+          # Nil for a provider-backed asset (no file to preview) and outside a
+          # request (the Disk service needs a host only a controller supplies).
+          attribute :download_url do |digital_asset, params|
+            next nil unless digital_asset.downloadable?
+
+            store = DigitalAssetDetails.store_for(digital_asset, params)
+            begin
+              digital_asset.download_url(expires_in: store.preferred_digital_asset_link_expire_time.seconds)
+            rescue ArgumentError
+              nil
+            end
+          end
+
+          # The limits actually applied, after the store-settings fallback.
+          attribute :effective_authorized_clicks do |digital_asset, params|
+            digital_asset.effective_authorized_clicks(DigitalAssetDetails.store_for(digital_asset, params))
+          end
+
+          attribute :effective_authorized_days do |digital_asset, params|
+            digital_asset.effective_authorized_days(DigitalAssetDetails.store_for(digital_asset, params))
+          end
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/delivery_origin_group_serializer.rb

@@ -19,11 +19,11 @@ module Spree
           end
 
           attribute :delivery_zones_count do |record|
-            record.delivery_zones.count
+            record.delivery_zones.size
           end
 
           attribute :delivery_methods_count do |record|
-            record.delivery_methods.count
+            record.delivery_methods.size
           end
         end
       end

data/app/serializers/spree/api/v3/admin/delivery_profile_serializer.rb

@@ -47,16 +47,14 @@ module Spree
             end
           end
 
-          attribute :products_count do |record|
-            record.products.count
-          end
+          attribute :products_count, &:products_count
 
           attribute :delivery_methods_count do |record|
-            record.delivery_methods.count
+            record.delivery_methods.size
           end
 
           attribute :delivery_zones_count do |record|
-            record.delivery_zones.count
+            record.delivery_zones.size
           end
         end
       end

data/app/serializers/spree/api/v3/admin/digital_asset_serializer.rb

@@ -5,55 +5,11 @@ module Spree
     module V3
       module Admin
         class DigitalAssetSerializer < V3::DigitalAssetSerializer
-          typelize byte_size: [:number, nullable: true],
-                   authorized_clicks: [:number, nullable: true],
-                   authorized_days: [:number, nullable: true],
-                   effective_authorized_clicks: :number,
-                   effective_authorized_days: :number,
-                   provider_type: [:string, nullable: true, comment: 'Digital asset provider; null is an uploaded file. Built-in: file. Extensions may register more.'],
-                   provider_name: [:string, comment: 'Digital asset provider name. Built-in: File. Extensions may register more.'],
-                   provider_settings: 'Record<string, unknown>',
-                   download_url: [:string, nullable: true]
+          include Spree::Api::V3::DigitalAssetDetails
 
-          attributes :authorized_clicks, :authorized_days, :byte_size, :provider_settings
-          attributes created_at: :iso8601, updated_at: :iso8601
+          typelize provider_settings: 'Record<string, unknown>'
 
-          api_type_attributes :provider_type
-
-          # Human-readable source for the admin listing. Blank provider_type is
-          # the uploaded-file default, so this reads "File" there.
-          attribute :provider_name do |digital_asset|
-            digital_asset.provider_class.provider_name
-          end
-
-          # Lets a merchant check what they actually uploaded. Short-lived and
-          # admin-only: this is the file itself, not a customer's download
-          # grant, so it carries no counter and spends nobody's allowance.
-          # Nil for a provider-backed asset (no file to preview) and outside a
-          # request (the Disk service needs a host only a controller supplies).
-          attribute :download_url do |digital_asset, params|
-            next nil unless digital_asset.downloadable?
-
-            store = params&.dig(:store) || Spree::Current.store || digital_asset.store
-            begin
-              digital_asset.download_url(expires_in: store.preferred_digital_asset_link_expire_time.seconds)
-            rescue ArgumentError
-              nil
-            end
-          end
-
-          # The limits actually applied, after the store-settings fallback. The
-          # request's store answers it — an admin request always carries one;
-          # the asset's own store covers serialization outside a request.
-          attribute :effective_authorized_clicks do |digital_asset, params|
-            store = params&.dig(:store) || Spree::Current.store || digital_asset.store
-            digital_asset.effective_authorized_clicks(store)
-          end
-
-          attribute :effective_authorized_days do |digital_asset, params|
-            store = params&.dig(:store) || Spree::Current.store || digital_asset.store
-            digital_asset.effective_authorized_days(store)
-          end
+          attributes :provider_settings
         end
       end
     end

data/app/serializers/spree/api/v3/admin/newsletter_subscriber_serializer.rb

@@ -8,6 +8,7 @@ module Spree
         # Back-office surface, nested under the admin customer serializer. Extends the
         # customer-facing serializer so public fields stay in sync.
         class NewsletterSubscriberSerializer < V3::NewsletterSubscriberSerializer
+          prefixed_id_attributes :customer
         end
       end
     end

data/app/serializers/spree/api/v3/admin/price_history_serializer.rb

@@ -13,7 +13,7 @@ module Spree
                    created_at: :string
 
           attribute :variant_id do |price_history|
-            price_history.variant.prefixed_id
+            Spree::Variant.prefixed_id_for(price_history.variant_id)
           end
 
           attribute :price_id do |price_history|

data/app/serializers/spree/api/v3/admin/price_list_serializer.rb

@@ -34,13 +34,18 @@ module Spree
           attribute :currently_active, &:currently_active?
 
           # Cheap counts so the index can render "12 products / 36 prices"
-          # without forcing each row to expand the children.
+          # without forcing each row to expand the children. The index counts
+          # the whole page at once; a single list asks for its own.
           attribute :products_count do |pl|
-            pl.products.count
+            counts = params[:products_counts]
+
+            (counts || Spree::PriceList.products_count_by_list(pl.id)).fetch(pl.id, 0)
           end
 
           attribute :prices_count do |pl|
-            pl.prices.count
+            counts = params[:prices_counts]
+
+            counts ? counts.fetch(pl.id, 0) : pl.prices.count
           end
 
           # Always expanded: a list's bands are the rest of the sentence its

data/app/serializers/spree/api/v3/admin/price_serializer.rb

@@ -17,7 +17,7 @@ module Spree
           attributes :min_quantity
 
           attribute :variant_id do |price|
-            price&.variant&.prefixed_id
+            Spree::Variant.prefixed_id_for(price&.variant_id)
           end
 
           attributes created_at: :iso8601, updated_at: :iso8601

data/app/serializers/spree/api/v3/admin/seller_payout_serializer.rb

@@ -32,8 +32,8 @@ module Spree
           #
           # Read from a count the controller made for the whole page when there
           # is one; a single payout read falls back to asking for its own.
-          attribute(:transfers_count) do |payout, params|
-            counts = params && params[:transfer_counts]
+          attribute(:transfers_count) do |payout|
+            counts = params[:transfer_counts]
 
             counts ? counts.fetch(payout.id, 0) : payout.transfers.count
           end

data/app/serializers/spree/api/v3/admin/seller_serializer.rb

@@ -54,9 +54,7 @@ module Spree
           # so the minimum-products requirement asks the same question free.
           attributes :products_count
 
-          attribute :users_count do |seller|
-            seller.users.size
-          end
+          attributes :users_count
 
           # How far through the marketplace's checklist this seller is — what
           # the list's progress column and the profile's badge render. The

data/app/serializers/spree/api/v3/admin/store_credit_serializer.rb

@@ -7,6 +7,7 @@ module Spree
 
           typelize customer_id: [:string, nullable: true],
                    created_by_id: [:string, nullable: true],
+                   created_by_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
                    memo: [:string, nullable: true],
                    amount: [:string, nullable: false], amount_used: [:string, nullable: false],
                    amount_remaining: [:string, nullable: false],
@@ -27,7 +28,8 @@ module Spree
           # money_attributes types its fields nullable for gated guests; the
           # Admin API never gates prices.
           typelize amount_authorized: [:string, nullable: false]
-          prefixed_id_attributes :customer, :created_by
+          prefixed_id_attributes :customer
+          actor_attributes :created_by
 
           # Why the credit exists: the return, exchange, claim or gift card
           # that issued it, or null when an admin issued it by hand. The type
@@ -50,10 +52,6 @@ module Spree
           one :customer,
               resource: proc { Spree.api.admin_customer_serializer },
               if: proc { expand?('customer') }
-
-          one :created_by,
-              resource: proc { Spree.api.admin_admin_user_serializer },
-              if: proc { expand?('created_by') }
         end
       end
     end

data/app/serializers/spree/api/v3/base_serializer.rb

@@ -154,9 +154,14 @@ module Spree
 
         def self.preference_type_hint(schema, name)
           types = Array(schema['type'])
-          hint = TYPELIZER_TYPES.fetch((types - ['null']).first, :unknown)
           options = {}
           options[:nullable] = true if types.include?('null')
+          if types.include?('array')
+            hint = TYPELIZER_TYPES.fetch(Array(schema.dig('items', 'type')).first, :unknown)
+            options[:multi] = true
+          else
+            hint = TYPELIZER_TYPES.fetch((types - ['null']).first, :unknown)
+          end
           if schema['enum']
             options[:enum] = schema['enum'].compact
             options[:enum_type_name] = PREFERENCE_LIST_NAMES[name.to_sym] if PREFERENCE_LIST_NAMES.key?(name.to_sym)

data/app/serializers/spree/api/v3/newsletter_subscriber_serializer.rb

@@ -16,7 +16,11 @@ module Spree
           subscriber.verified_at&.iso8601
         end
 
-        prefixed_id_attributes :customer
+        # Shown to the account's owner only: for anyone else, posting an email
+        # must not tell them whether an account exists for it.
+        attribute :customer_id do |subscriber|
+          subscriber.customer&.prefixed_id if current_user && subscriber.customer_id == current_user.id
+        end
       end
     end
   end

data/app/serializers/spree/api/v3/seller/digital_asset_serializer.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Spree
+  module Api
+    module V3
+      module Seller
+        # A downloadable file on a seller's own product. Leaves out the
+        # provider's settings: they configure the operator's own systems, not
+        # the seller's listing.
+        class DigitalAssetSerializer < V3::DigitalAssetSerializer
+          include Spree::Api::V3::DigitalAssetDetails
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/seller/payout_serializer.rb

@@ -22,8 +22,8 @@ module Spree
           # How many earnings this settlement covers. Read from a count the
           # controller made for the whole page when there is one; a single
           # payout read falls back to asking for its own.
-          attribute(:transfers_count) do |payout, params|
-            counts = params && params[:transfer_counts]
+          attribute(:transfers_count) do |payout|
+            counts = params[:transfer_counts]
 
             counts ? counts.fetch(payout.id, 0) : payout.transfers.count
           end

data/app/serializers/spree/api/v3/seller/store_serializer.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # What a seller may know about the marketplace they sell on: its name,
+        # and the settings that shape what the panel lets them do.
+        class StoreSerializer < V3::BaseSerializer
+          typelize name: :string
+
+          attributes :name
+
+          preference_attributes Spree::Store, :seller_digital_assets_enabled, :seller_digital_asset_content_types,
+                                              :review_seller_digital_asset_changes
+        end
+      end
+    end
+  end
+end