spree_api 6.0.0 → 6.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 02e3a969bdbac77ab7eba1edb5986472deb10d660fbad8b2c51df6e586f97709
-  data.tar.gz: c3f880037bc5751de97fbccdbcacae67d643c8ddf8aefa66a3ac804d488645a7
+  metadata.gz: 3bc1eebac54270cff24aa58f2319414c1d2c3d3e2b62bc73ed1a99b3dcc8cef3
+  data.tar.gz: 63c9e47df2e22549f57a66be0af2bf781d35d44cfb42f70a7edacdc932f60dd2
 SHA512:
-  metadata.gz: cb6694163e15d45f56831fc65547a3a5728f022dd2d1e0610ea758b844ef05b1a5fd80340fad8cb4b75ef2f525582cd423212a052da3406e2e241822137c64ed
-  data.tar.gz: 423fe47f6ce5d99bd55eea7613e2594bc3d4c382eee23dd47ff28e1b2b1f43f678c8034c96e12ef6dafd30fa537d946a3f13d0e9c899bdf0f005c93c62c89df5
+  metadata.gz: 4dc86cc7163081943b538408538ff9499ca25848f6bd3656933a8b79cc172d5a629e7cea4b0b22f5c55e22ba7a7b2fa342f8c360155b0759b879876f21d67972
+  data.tar.gz: ec1f8e51808bf0175f6c1ee135bc440cffcdff1e22eff9e920ac92e5d1610e22d8be00de38080d33acd629968b17c0f326b2c6a1651b3c7ee5643b7c5df52183

data/README.md

@@ -133,5 +133,6 @@ bundle exec rspec
 
 ## Documentation
 
-- [API Reference](https://docs.spreecommerce.org/api)
-- [Authentication Guide](https://docs.spreecommerce.org/developer/api/authentication)
+- [API Reference](https://spreecommerce.org/docs/api-reference)
+- [Store API authentication](https://spreecommerce.org/docs/api-reference/store-api/authentication)
+- [Admin API authentication](https://spreecommerce.org/docs/api-reference/admin-api/authentication)

data/app/controllers/concerns/spree/api/v3/admin/embed_permissions.rb

@@ -29,7 +29,12 @@ module Spree
             'gift_card' => 'read_gift_cards',
             'gift_cards' => 'read_gift_cards',
             'store_credit' => 'read_store_credits',
-            'store_credits' => 'read_store_credits'
+            'store_credits' => 'read_store_credits',
+            # The admin user serializer is nested in gift cards, task runs and
+            # tokens; its sessions carry IP addresses and its inviter is
+            # another staff member.
+            'sessions' => 'read_staff',
+            'inviter' => 'read_staff'
           }.freeze
 
           protected

data/app/controllers/spree/api/v3/admin/admin_users_controller.rb

@@ -72,6 +72,16 @@ module Spree
             [{ spree_roles: :resource, avatar_attachment: :blob }]
           end
 
+          # Sessions carry IP addresses and the inviter costs a query per row,
+          # so both are shown one person at a time.
+          ONE_AT_A_TIME_EXPANDS = %w[sessions inviter].freeze
+
+          def expand_list
+            return super unless action_name == 'index'
+
+            super.reject { |path| ONE_AT_A_TIME_EXPANDS.include?(path.split('.').first) }
+          end
+
           # Restrict to users with a role assignment on the current store.
           # `accessible_by` enforces CanCanCan on top. Deduplication happens via
           # an ID subquery rather than `SELECT DISTINCT *` — the users table is

data/app/controllers/spree/api/v3/admin/invitation_acceptances_controller.rb

@@ -12,7 +12,7 @@ module Spree
 
           request_params 'InvitationAcceptParams', action: :accept do |body|
             body.attribute :password, :string,
-              description: 'Required when the invitee has no account yet: it creates one. An existing account signs in without it.'
+              description: 'Creates the account when the invitee has none yet. An existing account confirms it is theirs with it, unless the request is already signed in as that account.'
             body.attribute :password_confirmation, :string
             body.attribute :first_name, :string
             body.attribute :last_name, :string
@@ -74,10 +74,14 @@ module Spree
           # implicit: we look the user up by `invitation.email`, never by a
           # client-supplied email. The token is the credential.
           def resolve_or_create_invitee(invitation)
-            existing = Spree.admin_user_class.find_by(email: invitation.email)
-            return authenticate_existing(existing) if existing
+            existing = invitation.invitee_account
+            return create_new_invitee(invitation) unless existing
 
-            create_new_invitee(invitation)
+            # Someone already signed in as the invitee has proven who they are.
+            authenticate_user
+            return existing if current_user == existing
+
+            authenticate_existing(existing)
           end
 
           def authenticate_existing(user)

data/app/controllers/spree/api/v3/admin/sellers_controller.rb

@@ -195,7 +195,7 @@ module Spree
           # every seller on the page, so it loads once. Applied to the scope
           # rather than the collection so a single-seller read gets it too.
           def scope_includes
-            [:billing_address, :requirement_submissions, { stock_locations: [] },
+            [:billing_address, :requirement_submissions, :external_references, { stock_locations: [] },
              { store: :seller_requirements, logo_attachment: :blob, cover_photo_attachment: :blob }]
           end
 

data/app/controllers/spree/api/v3/admin/store_controller.rb

@@ -7,8 +7,15 @@ module Spree
 
           request_params :store do |body|
             body.attribute :name, :string, example: 'My Store'
-            body.attribute :admin_locale, :string, example: 'en'
-            body.attribute :timezone, :string, example: 'Europe/Berlin'
+            body.attribute :seo_title, :string,
+              nullable: true,
+              description: "The storefront's default page title, in the store's default language. Translate it through the translations endpoints."
+            body.attribute :meta_description, :string,
+              nullable: true,
+              description: "The storefront's default meta description, in the store's default language."
+            body.attribute :admin_locale, :locale, nullable: true, example: 'en',
+              description: 'The language the dashboard opens in for every staff member; null lets each use their own.'
+            body.attribute :timezone, :time_zone, example: 'Europe/Berlin'
             body.attribute :weight_unit, :weight_unit
             body.attribute :unit_system, :string, choices: Spree::Store::UNIT_SYSTEMS
             body.attribute :storefront_access, :string,
@@ -143,17 +150,19 @@ module Spree
           # GET /api/v3/admin/store
           def show
             authorize! :show, current_store
-            render json: serialize_store
+            render json: in_default_locale { serialize_store }
           end
 
           # PATCH /api/v3/admin/store
           def update
             authorize! :update, current_store
 
-            if current_store.update(permitted_params)
-              render json: serialize_store
-            else
-              render_validation_error(current_store.errors)
+            in_default_locale do
+              if current_store.update(permitted_params)
+                render json: serialize_store
+              else
+                render_validation_error(current_store.errors)
+              end
             end
           end
 
@@ -177,6 +186,13 @@ module Spree
 
           private
 
+          # Settings hold the store's default-language values, whatever locale
+          # the request resolved to. Other languages are written through the
+          # translations endpoints.
+          def in_default_locale(&)
+            Mobility.with_locale(current_store.default_locale, &)
+          end
+
           def describe(provider_classes)
             provider_classes.map do |provider_class|
               {

data/app/controllers/spree/api/v3/seller/invitation_acceptances_controller.rb

@@ -24,7 +24,7 @@ module Spree
 
           request_params 'InvitationAcceptParams', action: :accept do |body|
             body.attribute :password, :string,
-              description: 'Sets the password of a new account, or confirms the password of an existing one.'
+              description: 'Sets the password of a new account, or confirms the password of an existing one, unless the request is already signed in as that account.'
             body.attribute :password_confirmation, :string
             body.attribute :first_name, :string, description: 'Used only when the invitation creates a new account.'
             body.attribute :last_name, :string, description: 'Used only when the invitation creates a new account.'
@@ -35,7 +35,7 @@ module Spree
             return unless load_invitation
 
             render json: Spree.api.seller_invitation_serializer.new(
-              @invitation, params: { store: @invitation.store }
+              @invitation, params: { store: @invitation.store, acceptance: true }
             ).serializable_hash
           end
 
@@ -97,10 +97,14 @@ module Spree
           # implicit: we look the user up by `invitation.email`, never by a
           # client-supplied email. The token is the credential.
           def resolve_or_create_invitee(invitation)
-            existing = Spree.admin_user_class.find_by(email: invitation.email)
-            return authenticate_existing(existing) if existing
+            existing = invitation.invitee_account
+            return create_new_invitee(invitation) unless existing
 
-            create_new_invitee(invitation)
+            # Someone already signed in as the invitee has proven who they are.
+            authenticate_user
+            return existing if current_user == existing
+
+            authenticate_existing(existing)
           end
 
           def authenticate_existing(user)
@@ -151,6 +155,12 @@ module Spree
             user.sellers.map { |seller| { id: seller.prefixed_id, name: seller.name, status: seller.status } }
           end
 
+          # The plain v3 base expects a storefront token; the session this
+          # page may carry is a seller panel one.
+          def expected_audience
+            Spree::Api::V3::JwtAuthentication::JWT_AUDIENCE_SELLER
+          end
+
           def request_env_for_token
             { ip_address: request.remote_ip, user_agent: request.user_agent&.truncate(255) }
           end

data/app/controllers/spree/api/v3/store/customers_controller.rb

@@ -111,6 +111,7 @@ module Spree
               currency: current_currency,
               user: current_user,
               includes: [],
+              expand: expand_list,
               hide_prices: hide_prices?
             }
           end

data/app/controllers/spree/api/v3/store/store_controller.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # Exposes the store the request resolved to, so a storefront can render
+        # its name and default SEO metadata in the requested locale.
+        class StoreController < Store::BaseController
+          # A gated storefront still needs a page title on its sign-in wall.
+          allow_guest_storefront_access!
+
+          # GET /api/v3/store/store
+          def show
+            render json: serialize_resource(current_store)
+          end
+
+          protected
+
+          def serializer_class
+            Spree.api.store_serializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/address_serializer.rb

@@ -35,6 +35,8 @@ module Spree
         # The address book the entry belongs to. Null for an address in no
         # book: one a guest typed in, or the copy a placed order keeps.
         one :owner, resource: proc { Spree.api.address_owner_serializer }
+
+        expandable_custom_fields
       end
     end
   end

data/app/serializers/spree/api/v3/admin/address_serializer.rb

@@ -28,6 +28,8 @@ module Spree
           prefixed_id_attributes customer_id: :customer_owner
 
           one :owner, resource: proc { Spree.api.admin_address_owner_serializer }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/admin_user_serializer.rb

@@ -10,11 +10,29 @@ module Spree
                    selected_locale: [:string, nullable: true],
                    avatar_url: [:string, nullable: true],
                    roles: 'Array<{ id: string; name: string }>',
-                   stores: 'Array<{ id: string; name: string; code: string }>'
+                   stores: 'Array<{ id: string; name: string; code: string }>',
+                   status: [:string, enum: Spree::AdminUserMethods::STATUSES, enum_type_name: 'AdminUserStatus'],
+                   last_active_at: [:string, nullable: true],
+                   inviter: ['Actor', nullable: true]
 
-          attributes :email, :first_name, :last_name, :full_name, :selected_locale,
+          attributes :email, :first_name, :last_name, :full_name, :selected_locale, :status,
                      created_at: :iso8601, updated_at: :iso8601
 
+          attribute :last_active_at do |user|
+            user.try(:last_active_at)&.iso8601
+          end
+
+          # Carries IP addresses, so sent only to the caller who asks for it.
+          many :sessions,
+               resource: proc { Spree.api.admin_session_serializer },
+               source: ->(_params) { active_sessions },
+               if: proc { expand?('sessions') }
+
+          one :inviter,
+              resource: proc { Spree.api.admin_actor_serializer },
+              source: ->(params) { invited_by(params&.dig(:store)) },
+              if: proc { expand?('inviter') }
+
           attribute :avatar_url do |user|
             image_url_for(user.avatar)
           end

data/app/serializers/spree/api/v3/admin/category_serializer.rb

@@ -28,9 +28,7 @@ module Spree
                resource: proc { Spree.api.admin_category_serializer },
                if: proc { expand?('ancestors') }
 
-          many :custom_fields,
-               resource: proc { Spree.api.admin_custom_field_serializer },
-               if: proc { expand?('custom_fields') }
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/claim_serializer.rb

@@ -26,6 +26,8 @@ module Spree
           one :reason, resource: proc { Spree.api.admin_claim_reason_serializer }, if: proc { expand?('reason') }
           one :order, resource: proc { Spree.api.admin_order_serializer }, if: proc { expand?('order') }
           many :refunds, resource: proc { Spree.api.admin_refund_serializer }, if: proc { expand?('refunds') }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/collection_serializer.rb

@@ -18,10 +18,7 @@ module Spree
                resource: proc { Spree.api.admin_collection_rule_serializer },
                if: proc { expand?('rules') }
 
-          # Override inherited custom_fields to use the admin serializer.
-          many :custom_fields,
-               resource: proc { Spree.api.admin_custom_field_serializer },
-               if: proc { expand?('custom_fields') }
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/company_serializer.rb

@@ -30,6 +30,8 @@ module Spree
           many :memberships,
                resource: proc { Spree.api.admin_company_membership_serializer },
                if: proc { expand?('memberships') }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/credit_card_serializer.rb

@@ -11,6 +11,8 @@ module Spree
 
           attributes :metadata,
                      created_at: :iso8601, updated_at: :iso8601
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/customer_serializer.rb

@@ -99,6 +99,8 @@ module Spree
           many :companies,
                resource: proc { Spree.api.admin_company_serializer },
                if: proc { expand?('companies') }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/delivery_method_serializer.rb

@@ -59,6 +59,8 @@ module Spree
             calculator = record.calculator
             { type: calculator.class.api_type, preferences: calculator.serialized_preferences } if calculator
           end
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/fulfillment_serializer.rb

@@ -61,6 +61,7 @@ module Spree
               resource: proc { Spree.api.admin_order_serializer },
               if: proc { expand?('order') }
 
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/gift_card_serializer.rb

@@ -51,6 +51,8 @@ module Spree
           many :orders,
                resource: proc { Spree.api.admin_order_serializer },
                if: proc { expand?('orders') }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/invitation_serializer.rb

@@ -37,7 +37,7 @@ module Spree
           # Looked up by email so an admin who's already on another store sees
           # the password prompt, not a fresh account form.
           attribute :invitee_exists do |invitation|
-            Spree.admin_user_class.exists?(email: invitation.email)
+            invitation.invitee_account.present?
           end
 
           # Minimal store identity for the unauthenticated acceptance page's

data/app/serializers/spree/api/v3/admin/line_item_serializer.rb

@@ -85,6 +85,7 @@ module Spree
               resource: proc { Spree.api.admin_tax_category_serializer },
               if: proc { expand?('tax_category') }
 
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/media_serializer.rb

@@ -86,6 +86,8 @@ module Spree
           attribute :viewable_type do |asset|
             Spree::Base.polymorphic_api_type(asset.viewable_type)
           end
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/newsletter_subscriber_serializer.rb

@@ -9,6 +9,8 @@ module Spree
         # customer-facing serializer so public fields stay in sync.
         class NewsletterSubscriberSerializer < V3::NewsletterSubscriberSerializer
           prefixed_id_attributes :customer
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/option_type_serializer.rb

@@ -13,6 +13,8 @@ module Spree
           many :option_values,
                resource: proc { Spree.api.admin_option_value_serializer },
                if: proc { expand?('option_values') }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/option_value_serializer.rb

@@ -11,6 +11,8 @@ module Spree
           one :option_type,
               resource: proc { Spree.api.admin_option_type_serializer },
               if: proc { expand?('option_type') }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/order_serializer.rb

@@ -198,6 +198,8 @@ module Spree
           typelize freight_summary: [:FreightSummary, nullable: true]
 
           one :freight_summary, resource: proc { Spree.api.admin_freight_summary_serializer }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/payment_method_serializer.rb

@@ -25,6 +25,8 @@ module Spree
           attribute(:logo_url) { |payment_method| payment_method.class.logo_url }
           attribute(:docs_url) { |payment_method| payment_method.class.docs_url }
           attribute(:third_party) { |payment_method| payment_method.class.third_party? }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/payment_serializer.rb

@@ -16,7 +16,9 @@ module Spree
                    cvv_response_message: [:string, nullable: true],
                    gateway_dashboard_payment_url: [:string, nullable: true],
                    avs_risky: [:boolean, comment: 'Whether the card issuer reported that the billing address did not match.'],
-                   cvv_risky: [:boolean, comment: 'Whether the card issuer reported that the security code did not match.']
+                   cvv_risky: [:boolean, comment: 'Whether the card issuer reported that the security code did not match.'],
+                   can_void: [:boolean, comment: 'Whether the payment can be voided now, as decided by its payment method.'],
+                   can_capture: [:boolean, comment: 'Whether the payment can be captured now, as decided by its payment method.']
 
           attributes :metadata, :avs_response, :cvv_response_code, :cvv_response_message,
                      :gateway_dashboard_payment_url,
@@ -24,6 +26,8 @@ module Spree
 
           attribute(:avs_risky, &:is_avs_risky?)
           attribute(:cvv_risky, &:is_cvv_risky?)
+          attribute(:can_void, &:can_void?)
+          attribute(:can_capture, &:can_capture?)
 
           money_attributes :captured_amount
           typelize captured_amount: [:string, nullable: false]
@@ -45,7 +49,7 @@ module Spree
                            Spree.api.admin_payment_source_serializer
                          end
 
-            serializer.new(payment.source).to_h
+            serializer.new(payment.source, params: nested_params('source')).to_h
           end
 
           many :capture_events,
@@ -65,6 +69,8 @@ module Spree
           many :payment_splits,
                resource: proc { Spree.api.admin_payment_split_serializer },
                if: proc { expand?('payment_splits') }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/payment_source_serializer.rb

@@ -7,6 +7,8 @@ module Spree
 
           attributes :metadata,
                      created_at: :iso8601, updated_at: :iso8601
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/product_serializer.rb

@@ -108,9 +108,7 @@ module Spree
                resource: proc { Spree.api.admin_collection_serializer },
                if: proc { expand?('collections') }
 
-          many :custom_fields,
-               resource: proc { Spree.api.admin_custom_field_serializer },
-               if: proc { expand?('custom_fields') }
+          expandable_custom_fields admin: true
 
           many :product_publications,
                resource: proc { Spree.api.admin_product_publication_serializer },

data/app/serializers/spree/api/v3/admin/return_serializer.rb

@@ -49,6 +49,8 @@ module Spree
 
           # Where the inbound parcel is, as the carrier last reported it.
           many :deliveries, resource: proc { Spree.api.admin_delivery_serializer }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/seller_payout_serializer.rb

@@ -17,7 +17,8 @@ module Spree
                    reference: 'string | null',
                    period_start: 'string | null',
                    period_end: 'string | null',
-                   transfers_count: :number
+                   transfers_count: :number,
+                   metadata: 'Record<string, unknown>'
 
           attributes :status, :currency, :reference, :metadata,
                      period_start: :iso8601, period_end: :iso8601,

data/app/serializers/spree/api/v3/admin/seller_serializer.rb

@@ -6,6 +6,8 @@ module Spree
         # shopper also gets, plus the operational state and the settlement and
         # tax configuration only the operator sets.
         class SellerSerializer < V3::SellerSerializer
+          include Concerns::ExternalReferencesAttribute
+
           typelize status: [:string, enum: Spree::Seller.statuses, enum_type_name: 'SellerStatus'],
                    legal_name: [:string, nullable: true],
                    registration_number: [:string, nullable: true],
@@ -75,6 +77,8 @@ module Spree
           one :returns_address,
               resource: proc { Spree.api.admin_address_serializer },
               if: proc { |seller| seller.returns_address.present? }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/session_serializer.rb

@@ -0,0 +1,17 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # A signed-in session of a staff account ({Spree::RefreshToken}),
+        # without its token.
+        class SessionSerializer < V3::BaseSerializer
+          typelize ip_address: [:string, nullable: true],
+                   user_agent: [:string, nullable: true],
+                   last_active_at: :string
+
+          attributes :ip_address, :user_agent, last_active_at: :iso8601
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/store_credit_serializer.rb

@@ -52,6 +52,8 @@ module Spree
           one :customer,
               resource: proc { Spree.api.admin_customer_serializer },
               if: proc { expand?('customer') }
+
+          expandable_custom_fields admin: true
         end
       end
     end

data/app/serializers/spree/api/v3/admin/store_serializer.rb

@@ -2,10 +2,10 @@ module Spree
   module Api
     module V3
       module Admin
-        class StoreSerializer < V3::BaseSerializer
-          typelize name: :string, url: :string, code: :string, api_url: :string,
+        class StoreSerializer < V3::StoreSerializer
+          typelize url: :string, code: :string, api_url: :string,
                    default_currency: [:string, enum: Spree::Money::Rounding::CURRENCY_CODES, enum_type_name: 'CurrencyCode'], default_locale: [:string, enum: Spree::Locales::ALL, enum_type_name: 'LocaleCode'],
-                   default_country_code: [:string, nullable: true],
+                   default_country_code: [:string, nullable: true, enum: Spree::IsoData.country_codes, enum_type_name: 'CountryCode'],
                    supported_currencies: [:string, multi: true, enum: Spree::Money::Rounding::CURRENCY_CODES, enum_type_name: 'CurrencyCode'],
                    supported_locales: [:string, multi: true, enum: Spree::Locales::ALL, enum_type_name: 'LocaleCode'],
                    available_locales: [:string, multi: true, enum: Spree::Locales::ALL, enum_type_name: 'LocaleCode'],
@@ -20,7 +20,6 @@ module Spree
                    metadata: 'Record<string, unknown>'
 
           attributes :metadata,
-                     :name,
                      :code,
                      :default_currency,
                      :default_locale,

data/app/serializers/spree/api/v3/admin/variant_serializer.rb

@@ -112,9 +112,7 @@ module Spree
                resource: proc { Spree.api.admin_price_serializer },
                if: proc { expand?('prices') }
 
-          many :custom_fields,
-               resource: proc { Spree.api.admin_custom_field_serializer },
-               if: proc { expand?('custom_fields') }
+          expandable_custom_fields admin: true
 
           many :stock_levels,
                resource: proc { Spree.api.admin_stock_level_serializer },