spree_api 6.0.2 → 6.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3bc1eebac54270cff24aa58f2319414c1d2c3d3e2b62bc73ed1a99b3dcc8cef3
-  data.tar.gz: 63c9e47df2e22549f57a66be0af2bf781d35d44cfb42f70a7edacdc932f60dd2
+  metadata.gz: 3f1aae2e30afb2db5577e3315cd2779ab8f273bfa114b7e369f7c0c8a519214d
+  data.tar.gz: 15e89346921cf2a0f21bdccd6050e7f4854d0aea5d17d0ef666d853ea475f769
 SHA512:
-  metadata.gz: 4dc86cc7163081943b538408538ff9499ca25848f6bd3656933a8b79cc172d5a629e7cea4b0b22f5c55e22ba7a7b2fa342f8c360155b0759b879876f21d67972
-  data.tar.gz: ec1f8e51808bf0175f6c1ee135bc440cffcdff1e22eff9e920ac92e5d1610e22d8be00de38080d33acd629968b17c0f326b2c6a1651b3c7ee5643b7c5df52183
+  metadata.gz: 555454b4f93a2ec776ebd7a1c6ea407bbc359b10493768c838d29617b0d58011a024168a2f384c4e2ad21a983a2f31e3989afce90d864c6f272f5bc13b7253ae
+  data.tar.gz: 0f00cda28bba945fc65e7509cfd61bd5626af3c91957e2f6dea5819e078593a7aad38152e5439495019bfdaece73cfaf65751313a10604f6af4f864176f84cb1

data/app/controllers/concerns/spree/api/v3/admin/embed_permissions.rb

@@ -13,7 +13,9 @@ module Spree
         #
         # Gift card codes are bearer credentials that ride along on every
         # order, so serializers show them in full only to a caller who may read
-        # gift cards and masked to everyone else.
+        # gift cards and masked to everyone else. Customer records embedded in
+        # a rule (a promotion's or a price list's customer rule) are shown only
+        # to a caller who may read customers; the rule keeps its `customer_ids`.
         module EmbedPermissions
           extend ActiveSupport::Concern
 
@@ -44,7 +46,8 @@ module Spree
           end
 
           def serializer_params
-            super.merge(gift_card_codes: holds_permission?('read_gift_cards'))
+            super.merge(gift_card_codes: holds_permission?('read_gift_cards'),
+                        customer_records: holds_permission?('read_customers'))
           end
 
           private

data/app/controllers/spree/api/v3/admin/products_controller.rb

@@ -156,6 +156,28 @@ module Spree
             run_review_workflow(Spree.product_reject_workflow, reason: params[:reason])
           end
 
+          # PATCH /api/v3/admin/products/:id/activate
+          #
+          # Puts one product on sale.
+          def activate
+            run_status_workflow(Spree.product_activate_workflow, 'active')
+          end
+
+          # PATCH /api/v3/admin/products/:id/archive
+          #
+          # Takes one product off sale, archived; activating it again puts it
+          # back on sale.
+          def archive
+            run_status_workflow(Spree.product_archive_workflow, 'archived')
+          end
+
+          # PATCH /api/v3/admin/products/:id/draft
+          #
+          # Takes one product off sale, back to a draft.
+          def draft
+            run_status_workflow(Spree.product_draft_workflow, 'draft')
+          end
+
           # POST /api/v3/admin/products/bulk_status_update
           # Body: { ids: [...], status: 'draft' | 'active' | 'archived' }
           def bulk_status_update
@@ -363,6 +385,40 @@ module Spree
 
           private
 
+          # Unlike bulk_status_update, which writes the column, these run the
+          # status workflow, so its hooks and its event fire. A product in
+          # review is refused: its next status is a decision, made through
+          # approve or reject (docs/plans/6.0-seller-product-submission.md).
+          #
+          # A product already in that status is answered as it is: running the
+          # workflow again would publish its event again, and every webhook
+          # subscriber would see the move twice.
+          def run_status_workflow(workflow, status)
+            @resource = find_resource
+            authorize!(:update, @resource)
+
+            return render json: serialize_resource(@resource) if @resource.status == status
+
+            if @resource.in_review?
+              return render_error(
+                code: 'product_in_review',
+                message: I18n.t('spree.errors.messages.product_in_review'),
+                status: :unprocessable_content
+              )
+            end
+
+            # Not under a row lock taken here: that would wrap the workflow in
+            # a transaction, and it publishes its event once its own
+            # transaction is done, which an outer one would no longer be.
+            result = workflow.call(product: @resource)
+
+            if result.success?
+              render json: serialize_resource(@resource.reload)
+            else
+              render_service_error(@resource.errors.presence || result.error)
+            end
+          end
+
           # Approving and rejecting are edits to the catalog, so they answer to
           # the same key as any other product write.
           def run_review_workflow(workflow, **arguments)

data/app/serializers/spree/api/v3/admin/admin_user_serializer.rb

@@ -9,8 +9,6 @@ module Spree
                    full_name: [:string, nullable: true],
                    selected_locale: [:string, nullable: true],
                    avatar_url: [:string, nullable: true],
-                   roles: 'Array<{ id: string; name: string }>',
-                   stores: 'Array<{ id: string; name: string; code: string }>',
                    status: [:string, enum: Spree::AdminUserMethods::STATUSES, enum_type_name: 'AdminUserStatus'],
                    last_active_at: [:string, nullable: true],
                    inviter: ['Actor', nullable: true]
@@ -45,6 +43,7 @@ module Spree
           # we fall back to `Spree::Current.store` if not.
           # Filtered in Ruby rather than with `for_resource`, so the staff
           # index's preloaded roles are used instead of a query per user.
+          typelize({ id: :string, name: :string }, multi: true)
           attribute :roles do |user, params|
             store = params&.dig(:store) || Spree::Current.store
             roles = user.spree_roles.to_a
@@ -57,6 +56,7 @@ module Spree
           # store switcher can offer all accessible stores. Read off the same
           # preloaded roles, and deduped/sorted in Ruby, so the staff index
           # spends no extra query per user.
+          typelize({ id: :string, name: :string, code: :string }, multi: true)
           attribute :stores do |user|
             stores = user.spree_roles.filter_map { |role| role.resource if role.resource.is_a?(Spree::Store) }
 

data/app/serializers/spree/api/v3/admin/delivery_profile_serializer.rb

@@ -8,7 +8,6 @@ module Spree
                    digital: :boolean,
                    offers_pickup: :boolean, offers_shipping: :boolean,
                    stock_location_ids: [:string, multi: true],
-                   origin_groups: ['Array<{ id: string; name: string | null; position: number | null; stock_location_ids: Array<string> }>'],
                    products_count: :number, delivery_methods_count: :number,
                    delivery_zones_count: :number
 
@@ -36,6 +35,8 @@ module Spree
 
           # Origin groups partition the profile's fulfillment origins; zones
           # and methods reference one. A null name renders as "All locations".
+          typelize({ id: :string, name: [:string, { nullable: true }], position: [:number, { nullable: true }],
+                    stock_location_ids: 'string[]' }, multi: true)
           attribute :origin_groups do |record|
             record.delivery_origin_groups.map do |group|
               {

data/app/serializers/spree/api/v3/admin/fulfillment_serializer.rb

@@ -17,7 +17,6 @@ module Spree
                    tax_total: [:string, nullable: false]
 
           typelize metadata: 'Record<string, unknown>',
-                   documents: "Array<{ kind: string; url: string }>",
                    provider_generates_labels: :boolean,
                    order_id: [:string, nullable: true],
                    stock_location_id: [:string, nullable: true]
@@ -31,6 +30,7 @@ module Spree
 
           # Customs forms and other paperwork the provider produced beside the
           # label; the labels themselves are listed under +labels+.
+          typelize({ kind: :string, url: :string }, multi: true)
           attribute :documents do |fulfillment|
             fulfillment.provider.documents(fulfillment).map(&:as_json)
           end

data/app/serializers/spree/api/v3/admin/import_serializer.rb

@@ -10,7 +10,6 @@ module Spree
                    failed_rows_count: :number,
                    processing_errors: [:string, nullable: true],
                    delimiter: :string,
-                   schema_fields: 'Array<{ name: string; label: string; required: boolean }>',
                    csv_headers: [:string, multi: true],
                    sample_row: 'Record<string, string | null>',
                    original_filename: [:string, nullable: true],
@@ -58,6 +57,7 @@ module Spree
             import.rows_status_counts['failed'] || 0
           end
 
+          typelize({ name: :string, label: :string, required: :boolean }, multi: true)
           attribute :schema_fields do |import|
             import.schema_fields.map do |field|
               { name: field[:name], label: field[:label], required: field[:required].present? }

data/app/serializers/spree/api/v3/admin/invitation_serializer.rb

@@ -13,8 +13,7 @@ module Spree
                    role_name: :string,
                    inviter_email: :string,
                    expires_at: :string,
-                   invitee_exists: :boolean,
-                   store: '{ id: string; name: string }'
+                   invitee_exists: :boolean
 
           attributes :email, :status,
                      created_at: :iso8601, updated_at: :iso8601, expires_at: :iso8601
@@ -43,6 +42,7 @@ module Spree
           # Minimal store identity for the unauthenticated acceptance page's
           # title ("Join <store>"). Full Store would over-expose internals to
           # a public landing page; this is the smallest shape that renders.
+          typelize({ id: :string, name: :string })
           attribute :store do |invitation|
             { id: invitation.store.prefixed_id, name: invitation.store.name }
           end

data/app/serializers/spree/api/v3/admin/price_rule_serializer.rb

@@ -34,10 +34,12 @@ module Spree
                resource: proc { Spree.api.admin_channel_serializer },
                if: proc { |rule| rule.respond_to?(:channels) }
 
+          # Only for a caller who may read customers; see the promotion rule
+          # serializer.
           many :users,
                key: :customers,
                resource: proc { Spree.api.admin_customer_serializer },
-               if: proc { |rule| rule.respond_to?(:users) }
+               if: proc { |rule| rule.respond_to?(:users) && params[:customer_records] }
         end
       end
     end

data/app/serializers/spree/api/v3/admin/product_serializer.rb

@@ -17,6 +17,7 @@ module Spree
                    product_type_id: [:string, nullable: true],
                    delivery_profile_id: [:string, nullable: true],
                    seller_name: [:string, nullable: true],
+                   total_on_hand: [:number, nullable: true],
                    price: ['Price', nullable: true],
                    deleted_at: [:string, nullable: true],
                    metadata: 'Record<string, unknown>',
@@ -49,6 +50,13 @@ module Spree
 
           prefixed_id_attributes :product_type, :tax_category
 
+          # Null when any variant is not tracked: its stock is unlimited, which
+          # is not a number to send.
+          attribute :total_on_hand do |product|
+            total = product.total_on_hand
+            total.to_i unless total.infinite?
+          end
+
           attribute :price do |product|
             price = price_for(product.default_variant)
             Spree.api.admin_price_serializer.new(price, params: params).to_h if price&.persisted?

data/app/serializers/spree/api/v3/admin/promotion_action_serializer.rb

@@ -13,8 +13,7 @@ module Spree
           typelize type: [:string, comment: 'Action type. Built-in: create_adjustment, create_item_adjustments, create_line_items, free_shipping. Extensions may register more.'],
                    promotion_id: :string,
                    preferences: 'Record<string, unknown>',
-                   calculator: 'TypedPromotionCalculator | null',
-                   line_items: 'Array<{ variant_id: string; quantity: number }> | null'
+                   calculator: 'TypedPromotionCalculator | null'
 
           attributes created_at: :iso8601, updated_at: :iso8601
 
@@ -44,6 +43,7 @@ module Spree
           # Line items the action will add for CreateLineItems. variant_id
           # is prefixed for consistency with the rest of the API. Null on
           # actions that don't have the association.
+          typelize({ variant_id: :string, quantity: :number }, multi: true, nullable: true)
           attribute :line_items do |action|
             next nil unless action.respond_to?(:promotion_action_line_items)
 

data/app/serializers/spree/api/v3/admin/promotion_rule_serializer.rb

@@ -61,9 +61,12 @@ module Spree
                resource: proc { Spree.api.admin_category_serializer },
                if: proc { |rule| rule.respond_to?(:categories) }
 
+          # Only for a caller who may read customers: a promotion is readable
+          # under `read_promotions`, and a customer rule would otherwise carry
+          # every targeted customer's email and notes along with it.
           many :customers,
                resource: proc { Spree.api.admin_customer_serializer },
-               if: proc { |rule| rule.respond_to?(:customers) }
+               if: proc { |rule| rule.respond_to?(:customers) && params[:customer_records] }
 
           many :customer_groups,
                resource: proc { Spree.api.admin_customer_group_serializer },

data/app/serializers/spree/api/v3/admin/promotion_serializer.rb

@@ -34,6 +34,19 @@ module Spree
           attribute :rule_ids do |promotion|
             promotion.promotion_rules.map(&:prefixed_id)
           end
+
+          # The rows under the same names the write accepts, on request: a
+          # reader holding only `rule_ids` cannot tell what a promotion does
+          # without a request per rule.
+          many :promotion_rules,
+               key: :rules,
+               resource: proc { Spree.api.admin_promotion_rule_serializer },
+               if: proc { expand?('rules') }
+
+          many :promotion_actions,
+               key: :actions,
+               resource: proc { Spree.api.admin_promotion_action_serializer },
+               if: proc { expand?('actions') }
         end
       end
     end

data/app/serializers/spree/api/v3/admin/return_serializer.rb

@@ -11,7 +11,6 @@ module Spree
 
           typelize memo: [:string, nullable: true],
                    metadata: 'Record<string, unknown>',
-                   documents: "Array<{ kind: string; url: string }>",
                    stock_location_id: [:string, nullable: true],
                    created_by_id: [:string, nullable: true],
                    created_by_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
@@ -39,6 +38,7 @@ module Spree
 
           # Paperwork the provider produced beside the label: a cross-border
           # return is declared like any other export.
+          typelize({ kind: :string, url: :string }, multi: true)
           attribute :documents do |return_record|
             return_record.provider.documents(return_record).map(&:as_json)
           end

data/app/serializers/spree/api/v3/admin/seller_requirement_status_serializer.rb

@@ -14,10 +14,11 @@ module Spree
                    description: [:string, nullable: true],
                    required: :boolean, position: :number, status: [:string, enum: Spree::SellerRequirementStatus::STATUSES, enum_type_name: 'SellerRequirementState'],
                    blocking: :boolean, action_url: [:string, nullable: true],
-                   blocker: ['{ state: string; message: string | null } | null'],
                    required_policy_name: [:string, nullable: true]
 
-          attributes :id, :kind, :name, :description, :required, :position, :status, :action_url, :blocker
+          attributes :id, :kind, :name, :description, :required, :position, :status, :action_url
+          typelize({ state: :string, message: [:string, { nullable: true }] }, nullable: true)
+          attribute :blocker, &:blocker
 
           # Whether this stands between the seller and approval. Serialized
           # rather than left to each client to derive, so the dashboard's

data/app/serializers/spree/api/v3/admin/seller_serializer.rb

@@ -20,7 +20,6 @@ module Spree
                    deleted_at: [:string, nullable: true],
                    on_holiday: :boolean, sellable: :boolean,
                    products_count: :number, users_count: :number,
-                   onboarding_progress: '{ done: number; total: number }',
                    onboarding_complete: :boolean,
                    metadata: 'Record<string, unknown> | null'
 
@@ -63,7 +62,8 @@ module Spree
           # requirements themselves, with their submissions, stay on the
           # heavier `onboarding` action; a list of sellers needs the number,
           # not the rows behind it.
-          attributes :onboarding_progress
+          typelize({ done: :number, total: :number })
+          attribute :onboarding_progress, &:onboarding_progress
 
           attribute :onboarding_complete, &:onboarding_complete?
 

data/app/serializers/spree/api/v3/fulfillment_serializer.rb

@@ -7,7 +7,6 @@ module Spree
                  fulfillment_type: [:string, enum: %w[shipping digital pickup pickup_point], enum_type_name: 'FulfillmentType'],
                  tracking: [:string, nullable: true], tracking_url: [:string, nullable: true],
                  fulfilled_at: [:string, nullable: true], delivered_at: [:string, nullable: true], unpriced: :boolean,
-                 items: 'Array<{ item_id: string; variant_id: string; quantity: number }>',
                  pickup_point_data: ['Record<string, unknown>', nullable: true],
                  selected_delivery_rate_id: [:string, nullable: true]
 
@@ -40,6 +39,7 @@ module Spree
 
         # Which items (and how many) are in this fulfillment.
         # A line item can be split across fulfillments with different quantities.
+        typelize({ item_id: :string, variant_id: :string, quantity: :number }, multi: true)
         attribute :items do |fulfillment|
           fulfillment.manifest.filter_map do |item|
             next unless item.line_item

data/app/serializers/spree/api/v3/seller/import_serializer.rb

@@ -16,7 +16,6 @@ module Spree
                    failed_rows_count: :number,
                    processing_errors: [:string, nullable: true],
                    delimiter: :string,
-                   schema_fields: 'Array<{ name: string; label: string; required: boolean }>',
                    csv_headers: [:string, multi: true],
                    sample_row: 'Record<string, string | null>',
                    original_filename: [:string, nullable: true],
@@ -52,6 +51,7 @@ module Spree
             import.rows_status_counts['failed'] || 0
           end
 
+          typelize({ name: :string, label: :string, required: :boolean }, multi: true)
           attribute :schema_fields do |import|
             import.schema_fields.map do |field|
               { name: field[:name], label: field[:label], required: field[:required].present? }

data/app/serializers/spree/api/v3/seller/invitation_serializer.rb

@@ -7,8 +7,7 @@ module Spree
                    expires_at: [:string, nullable: true],
                    accepted_at: [:string, nullable: true],
                    inviter_email: :string,
-                   invitee_exists: [:boolean, optional: true],
-                   seller: '{ id: string; name: string }'
+                   invitee_exists: [:boolean, optional: true]
 
           attributes :email,
                      created_at: :iso8601, expires_at: :iso8601, accepted_at: :iso8601
@@ -29,6 +28,7 @@ module Spree
 
           # The smallest shape the acceptance page's title ("Join <seller>")
           # needs; the page is public, so nothing more of the seller goes out.
+          typelize({ id: :string, name: :string })
           attribute :seller do |invitation|
             { id: invitation.resource.prefixed_id, name: invitation.resource.name }
           end

data/app/serializers/spree/api/v3/seller/product_serializer.rb

@@ -18,12 +18,20 @@ module Spree
           typelize status: [:string, enum: Spree::Product.statuses, enum_type_name: 'ProductStatus'], metadata: 'Record<string, unknown>',
                    product_type_id: [:string, nullable: true],
                    delivery_profile_id: [:string, nullable: true],
+                   total_on_hand: [:number, nullable: true],
                    submission: ['ProductSubmission', nullable: true]
 
           attributes :status, :metadata, created_at: :iso8601, updated_at: :iso8601
 
           prefixed_id_attributes :product_type, :delivery_profile
 
+          # Null when any variant is not tracked: its stock is unlimited, which
+          # is not a number to send.
+          attribute :total_on_hand do |product|
+            total = product.total_on_hand
+            total.to_i unless total.infinite?
+          end
+
           many :variants,
                resource: proc { Spree.api.seller_variant_serializer },
                if: proc { expand?('variants') }

data/app/serializers/spree/api/v3/seller/requirement_status_serializer.rb

@@ -10,13 +10,14 @@ module Spree
                    description: [:string, nullable: true],
                    required: :boolean, position: :number, status: [:string, enum: Spree::SellerRequirementStatus::STATUSES, enum_type_name: 'SellerRequirementState'],
                    blocking: :boolean, action_url: [:string, nullable: true],
-                   blocker: ['{ state: string; message: string | null } | null'],
                    accepts_submissions: :boolean, requires_file: :boolean,
                    accepted_content_types: [:string, multi: true],
                    required_policy_name: [:string, nullable: true],
                    terms_html: [:string, nullable: true]
 
-          attributes :id, :kind, :name, :description, :required, :position, :status, :action_url, :blocker
+          attributes :id, :kind, :name, :description, :required, :position, :status, :action_url
+          typelize({ state: :string, message: [:string, { nullable: true }] }, nullable: true)
+          attribute :blocker, &:blocker
 
           attribute :blocking, &:blocking?
 

data/config/initializers/typelizer.rb

@@ -1,6 +1,8 @@
-# Disable automatic type generation on boot — types are generated manually
-# via `bundle exec rake typelizer:generate`. Set ENABLE_TYPELIZER=1 to enable.
-ENV["DISABLE_TYPELIZER"] ||= "true" unless ENV["ENABLE_TYPELIZER"]
+# Types are generated only by `bundle exec rake typelizer:generate`, which sets
+# TYPELIZER=true before booting; the engine's `spree.api.typelizer` initializer
+# keeps Typelizer from generating on its own.
+
+require 'spree/api/typelizer_generation'
 
 Rails.application.config.after_initialize do
   api_root = Spree::Api::Engine.root
@@ -10,22 +12,11 @@ Rails.application.config.after_initialize do
     config.comments = true
     config.listen = false
 
-    # Teach typelizer's Alba plugin about custom Alba types (see alba.rb);
-    # unmapped typed attributes crash generation.
-    config.plugin_configs = {
-      alba: {
-        ts_mapper: Typelizer::SerializerPlugins::Alba::ALBA_TS_MAPPER.merge(
-          'iso8601' => { type: :string },
-          'string' => { type: :string }
-        )
-      }
-    }
+    config.plugin_configs = Spree::Api::TypelizerGeneration.plugin_configs
 
     # Serializers that exist only for the Admin API. Event serializers stay in:
     # they describe the `data` of the typed webhook events the Store SDK ships.
-    store_excluded = %w[
-      Asset CartPromotion OrderPromotion Report TaxCategory
-    ].to_set
+    store_excluded = Spree::Api::TypelizerGeneration::STORE_EXCLUDED
 
     # Store SDK — no prefix, package provides namespace
     config.writer(:store) do |c|
@@ -74,9 +65,7 @@ Rails.application.config.after_initialize do
     # branch; Category and CustomField are not, but the store product
     # serializer this branch inherits references them, so their types still
     # have to exist in the package.
-    store_nested_for_seller = %w[
-      Category CustomField OptionType OptionValue Seller
-    ].to_set
+    store_nested_for_seller = Spree::Api::TypelizerGeneration::SELLER_STORE_TYPES
 
     config.writer(:seller) do |c|
       c.output_dir = api_root.join('../../packages/seller-sdk/src/types/generated')

data/config/routes.rb

@@ -366,6 +366,11 @@ Spree::Core::Engine.add_routes do
             # (docs/plans/6.0-seller-product-submission.md).
             patch :approve
             patch :reject
+            # One product's status, through the workflow that publishes its
+            # event; bulk_status_update writes the column for many at once.
+            patch :activate
+            patch :archive
+            patch :draft
           end
           collection do
             post :bulk_status_update