spree_api 6.0.3 → 6.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3f1aae2e30afb2db5577e3315cd2779ab8f273bfa114b7e369f7c0c8a519214d
-  data.tar.gz: 15e89346921cf2a0f21bdccd6050e7f4854d0aea5d17d0ef666d853ea475f769
+  metadata.gz: 5eaa75827fbded08b54001d86e1f068f30f011414f6b4530aab8db17830f5779
+  data.tar.gz: f50e306fd54087d3e3a05a97d599e63805fc56e4329dcb77839f940d0d127341
 SHA512:
-  metadata.gz: 555454b4f93a2ec776ebd7a1c6ea407bbc359b10493768c838d29617b0d58011a024168a2f384c4e2ad21a983a2f31e3989afce90d864c6f272f5bc13b7253ae
-  data.tar.gz: 0f00cda28bba945fc65e7509cfd61bd5626af3c91957e2f6dea5819e078593a7aad38152e5439495019bfdaece73cfaf65751313a10604f6af4f864176f84cb1
+  metadata.gz: e50bf307deb4e72c30d4f31ef0b70a65cfd225f799d2ffedc05e2e588a168869d81e6c60128353e9add061a4774da56da6a482a98ac32dd0456f32aa0f9aabd0
+  data.tar.gz: 9bce5f92eed950d2586ea278cfce9bd5797a67b13bffc7de5dc20811ca3ad219364c667cc67d384f034c3d98df4a5c576d3dff283f25ff71322aa7001d1456cd

data/app/controllers/concerns/spree/api/v3/idempotent.rb

@@ -94,8 +94,17 @@ module Spree
           "spree:idempotency:#{digest}"
         end
 
+        # Binds replay to the method, path, body and exact query bytes.
+        # Separate fixed-length digests prevent query/body delimiter collisions;
+        # requests without a query retain their existing cached fingerprint.
+        #
+        # @return [String] SHA-256 request fingerprint
         def request_fingerprint
-          Digest::SHA256.hexdigest("#{request.method}:#{request.path}:#{request.raw_post}")
+          fingerprint = Digest::SHA256.hexdigest("#{request.method}:#{request.path}:#{request.raw_post}")
+          return fingerprint if request.query_string.blank?
+
+          query_fingerprint = Digest::SHA256.hexdigest(request.query_string)
+          Digest::SHA256.hexdigest("#{fingerprint}:#{query_fingerprint}")
         end
       end
     end

data/app/controllers/concerns/spree/api/v3/security_headers.rb

@@ -14,6 +14,9 @@ module Spree
           response.headers['X-Content-Type-Options'] = 'nosniff'
           response.headers['X-Frame-Options'] = 'DENY'
           response.headers['X-Request-Id'] = request.request_id
+          # A dashboard on another origin reads the request ID for its
+          # developer inspector; browsers hide unlisted headers from scripts.
+          response.headers['Access-Control-Expose-Headers'] = 'X-Request-Id'
           response.headers['Referrer-Policy'] = 'strict-origin-when-cross-origin'
           response.headers['Permissions-Policy'] = 'camera=(), microphone=(), geolocation=()'
           response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains' if request.ssl?

data/app/controllers/spree/api/v3/admin/base_controller.rb

@@ -15,6 +15,37 @@ module Spree
           include Spree::Api::V3::StrictMoneyParams
           include Spree::Api::V3::Admin::ValidationDetails
           include Spree::Api::V3::Admin::EmbedPermissions
+
+          private
+
+          # For endpoints about the signed-in staffer rather than the store
+          # (/me, /updates, /diagnostics): a secret API key has no user, so it
+          # gets a 404 rather than a 500 from a nil user.
+          def require_current_user!
+            return if current_user
+
+            render_error(
+              code: ERROR_CODES[:record_not_found],
+              message: I18n.t('spree.me_no_current_user'),
+              status: :not_found
+            )
+          end
+
+          # For endpoints that reveal the running version and stack (/updates,
+          # /diagnostics): a staff member signed in to the dashboard and nobody
+          # else. A connected app acts as the admin who approved it, so it
+          # would pass every check written for that admin, whatever it was
+          # granted, and no scope stands for "fingerprint the deployment".
+          def require_staff_session!
+            return require_current_user! unless current_user
+            return if current_oauth_token.blank?
+
+            render_error(
+              code: ERROR_CODES[:access_denied],
+              message: 'This endpoint is for staff signed in to the dashboard, not for connected apps.',
+              status: :forbidden
+            )
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/admin/companies/memberships_controller.rb

@@ -14,18 +14,25 @@ module Spree
             before_action :authorize_parent_access!
 
             request_params :company_membership do |body|
+              body.attribute :customer_id, :string,
+                             example: 'cus_UkLWZg9DAJ',
+                             description: 'An existing customer, who becomes a member immediately. ' \
+                                          'Send this or `customer_email`.'
               body.attribute :customer_email, :string,
-                required: true, on: :create,
-                example: 'buyer@example.com',
-                description: 'An existing customer becomes a member immediately; an unknown email becomes an invitation, and the response is an invitation instead of a membership.'
+                             example: 'buyer@example.com',
+                             description: 'An existing customer becomes a member immediately; an unknown ' \
+                                          'email becomes an invitation, and the response is an invitation ' \
+                                          'instead of a membership. Send this or `customer_id`.'
               body.attribute :metadata, :hash
             end
 
             # POST /api/v3/admin/companies/:company_id/memberships
             def create
+              customer = member_customer
               result = Spree.company_add_member_service.call(
                 company: @parent,
-                email: params.require(:customer_email),
+                customer: customer,
+                email: customer ? nil : params.require(:customer_email),
                 metadata: permitted_params[:metadata]
               )
 
@@ -43,6 +50,16 @@ module Spree
 
             protected
 
+            # Through the ability, like every customer lookup here: a customer
+            # this role cannot see 404s rather than joining the company.
+            def member_customer
+              return if params[:customer_id].blank?
+
+              Spree.customer_class.
+                accessible_by(current_ability, :show).
+                find_by_prefix_id!(params[:customer_id])
+            end
+
             def model_class
               Spree::CompanyMembership
             end

data/app/controllers/spree/api/v3/admin/diagnostics_controller.rb

@@ -0,0 +1,46 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # The anonymised diagnostics report (Spree::Diagnostics) for bug
+        # reports. It reveals the running version and stack, so it answers
+        # signed-in staff who can manage the store and nobody else, like
+        # GET /updates: a secret API key gets a 404, a connected app a 403.
+        class DiagnosticsController < Admin::BaseController
+          skip_scope_check!
+
+          before_action :require_staff_session!
+
+          # Only a published @spree/* name and a version: anything else in
+          # the list is dropped rather than echoed into a public report.
+          PACKAGE = %r{\A(@spree/[a-z0-9-]{1,50})@(\d+\.\d+\.\d+[0-9A-Za-z.-]{0,20})\z}
+          PACKAGE_LIMIT = 20
+
+          # GET /api/v3/admin/diagnostics
+          def show
+            authorize! :manage, current_store
+
+            report = Spree::Diagnostics.report(store: current_store, extra_sections: dashboard_section + client_section)
+            render json: Spree.api.admin_diagnostics_serializer.new(report).to_h
+          end
+
+          private
+
+          # The caller's @spree/* packages, which the server can't see: the
+          # dashboard may be built and deployed apart from it.
+          def dashboard_section
+            rows = params[:packages].to_s.split(',').first(PACKAGE_LIMIT).filter_map { |package| PACKAGE.match(package)&.captures }
+            rows.any? ? [{ title: 'Dashboard', rows: rows.to_h }] : []
+          end
+
+          # The browser the report was opened in, which only this request knows.
+          def client_section
+            return [] if request.user_agent.blank?
+
+            [{ title: 'Client', rows: { 'User agent' => request.user_agent } }]
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/me_controller.rb

@@ -70,19 +70,6 @@ module Spree
             )
           end
 
-          # A request authenticated by a secret API key has no Spree user to
-          # describe/update, so it gets a 404 pointing at the key endpoint
-          # rather than a 500 from a nil user — mirroring ApiKeysController#current.
-          def require_current_user!
-            return if current_user
-
-            render_error(
-              code: ERROR_CODES[:record_not_found],
-              message: I18n.t('spree.me_no_current_user'),
-              status: :not_found
-            )
-          end
-
           # /me describes the signed-in user rather than a store, and the
           # dashboard reads it before any store is selected. A user who holds
           # no role on any store (not yet given one, or removed from all of

data/app/controllers/spree/api/v3/admin/media_controller.rb

@@ -55,6 +55,16 @@ module Spree
             Spree::Media
           end
 
+          # Sorting by file name or size orders by a subquery on the blob,
+          # which PostgreSQL rejects under SELECT DISTINCT. Nothing here can
+          # repeat a row: the filename filter joins each media row to its one
+          # attachment and that attachment's one blob, and every other filter,
+          # like the product scope's legacy default-variant branch, reads this
+          # table's own columns. The library inherits this.
+          def collection_distinct?
+            false
+          end
+
           def serializer_class
             Spree.api.admin_media_serializer
           end

data/app/controllers/spree/api/v3/admin/orders/items_controller.rb

@@ -56,12 +56,16 @@ module Spree
             # DELETE /api/v3/admin/orders/:order_id/items/:id
             def destroy
               with_order_lock do
-                Spree.order_remove_line_item_service.call(
+                result = Spree.order_remove_line_item_service.call(
                   order: @parent,
                   line_item: @resource
                 )
 
-                head :no_content
+                if result.success?
+                  head :no_content
+                else
+                  render_order_item_error(result, default_code: ERROR_CODES[:processing_error])
+                end
               end
             end
 

data/app/controllers/spree/api/v3/admin/sellers/invitations_controller.rb

@@ -10,15 +10,23 @@ module Spree
           # endpoint, and rooted the same way — at the seller's invitations, so
           # an id from another seller reads as missing rather than as denied.
           #
-          # Creating one is the `invite` action on the seller itself; what is
-          # here is the bookkeeping the operator needs when an offer went to
-          # the wrong address or never arrived.
+          # Creating one here adds someone to the team and leaves the seller's
+          # status alone, so it works for a seller already trading. The
+          # `invite` action on the seller is the lifecycle step that opens a
+          # pending seller for its first owner.
           class InvitationsController < Admin::BaseController
             scoped_resource :sellers
 
             before_action :set_seller
+            # Every write hands out or withdraws a way onto the team, so it
+            # needs the same right as changing the seller.
+            before_action :authorize_seller_update, only: [:create, :destroy, :resend]
             before_action :set_invitation, only: [:destroy, :resend]
 
+            request_params 'SellerInvitationCreateParams', action: :create do |body|
+              body.attribute :email, :string, required: true, example: 'teammate@example.com'
+            end
+
             # Pending only: an accepted invitation is a team member, which the
             # team endpoint lists.
             def index
@@ -27,6 +35,30 @@ module Spree
               render json: { data: invitations.map { |invitation| serialize(invitation) } }
             end
 
+            # A seller the marketplace turned away has no team to join, the
+            # same line the seller's own `invite` action draws.
+            def create
+              if @seller.rejected?
+                return render_error(
+                  code: ErrorHandler::ERROR_CODES[:processing_error],
+                  message: I18n.t('spree.invitation_seller_rejected'),
+                  status: :unprocessable_content
+                )
+              end
+
+              invitation = @seller.invitations.new(
+                email: params[:email],
+                role: @seller.default_user_role,
+                inviter: try_spree_current_user
+              )
+
+              if invitation.save
+                render json: serialize(invitation), status: :created
+              else
+                render_validation_error(invitation.errors)
+              end
+            end
+
             def destroy
               @invitation.destroy
               head :no_content
@@ -60,6 +92,10 @@ module Spree
               authorize! :show, @seller
             end
 
+            def authorize_seller_update
+              authorize! :update, @seller
+            end
+
             def set_invitation
               @invitation = @seller.invitations.pending.find_by_prefix_id!(params[:id])
             end

data/app/controllers/spree/api/v3/admin/sellers/team_controller.rb

@@ -11,9 +11,7 @@ module Spree
           # person was invited — which a seller by definition cannot do from
           # inside their own panel.
           #
-          # Inviting is not here: it is the `invite` action on the seller
-          # itself, which is a lifecycle workflow rather than bookkeeping on a
-          # team.
+          # Inviting someone is the invitations endpoint next to this one.
           class TeamController < Admin::BaseController
             scoped_resource :sellers
 

data/app/controllers/spree/api/v3/admin/sellers_controller.rb

@@ -18,6 +18,11 @@ module Spree
 
           before_action :set_resource, only: [:show, :update, :destroy, :invite, :approve, :suspend, :reject,
                                               :onboarding, :reopen_onboarding]
+          before_action :authorize_returns_address!, only: [:create, :update]
+
+          RETURNS_ADDRESS_DESCRIPTION = "Where customers send returns, written inline. It is the address of the seller's " \
+                                        'returns stock location, so it updates that location, or creates one for a seller ' \
+                                        'who has none. Names and `label` are ignored: a location has none.'.freeze
 
           # Enumerated rather than borrowing the legacy global list, which
           # permits :id, :user_id and :deleted_at — the first of which would
@@ -64,6 +69,11 @@ module Spree
               description: "The seller's own billing address, written inline. There is no `billing_address_id`: an address belongs to whoever it was created for, so it is never referenced by id." do |billing_address|
               billing_address.include_attributes Spree::Api::V3::AddressRequestSchema
             end
+            body.attribute :returns_address, :object,
+                           as: 'SellerAddressParams',
+                           description: RETURNS_ADDRESS_DESCRIPTION do |returns_address|
+              returns_address.include_attributes Spree::Api::V3::AddressRequestSchema
+            end
             body.attribute :custom_fields, :array, of: Spree::Api::V3::CustomFieldValueRequestSchema,
               description: 'Custom field values, each validated against its definition.'
           end
@@ -78,7 +88,10 @@ module Spree
 
           request_params 'SellerApproveParams', action: :approve do |body|
             body.attribute :override_requirements, :boolean,
-              description: 'Admits a seller whose onboarding checklist is unfinished: the operator\'s deliberate exception, which the `seller.approved` event records along with what was outstanding.'
+                           description: "Admits a seller whose onboarding checklist is unfinished: the operator's " \
+                                        'deliberate exception, which the `seller.approved` event records along with ' \
+                                        'what was outstanding. Also admits a `pending` or `invited` seller who never ' \
+                                        'started onboarding, which is refused without it.'
           end
 
           request_params 'SellerReopenOnboardingParams', action: :reopen_onboarding do |body|
@@ -235,6 +248,16 @@ module Spree
 
             @resource.roles.find_by_prefix_id!(params[:role_id])
           end
+
+          # The returns address is a stock location's, and writing a location
+          # needs `write_settings` (see StockLocationsController), which the
+          # `sellers` scope does not grant.
+          def authorize_returns_address!
+            return unless params.key?(:returns_address)
+            return if holds_permission?('write_settings')
+
+            render_missing_permission('write_settings')
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/admin/stock_levels_controller.rb

@@ -44,6 +44,10 @@ module Spree
                 example: -3,
                 description: 'A relative change, for feeds that report movements rather than levels. Each row needs `count_on_hand` or `adjustment`.'
               stock_level.attribute :backorderable, :boolean, nullable: true
+              stock_level.attribute :reason, :string,
+                                    nullable: true,
+                                    example: 'received',
+                                    description: 'Labels the movement in the stock history. Defaults to "Inventory feed".'
             end
           end
 
@@ -73,6 +77,15 @@ module Spree
             end
 
             result = Spree.stock_level_bulk_upsert_workflow.call(store: current_store, rows: rows)
+            if result.failure?
+              return render_error(
+                code: 'invalid_stock_levels',
+                message: result.error.to_s,
+                status: :unprocessable_content,
+                details: { rows: result.error.value[:rows] }
+              )
+            end
+
             render json: result.value
           end
 
@@ -173,7 +186,8 @@ module Spree
                 stock_location_id: location_ids[row[:stock_location_id]],
                 count_on_hand: row[:count_on_hand],
                 adjustment: row[:adjustment],
-                backorderable: row[:backorderable]
+                backorderable: row[:backorderable],
+                reason: row[:reason].presence
               }.compact
             end
           end

data/app/controllers/spree/api/v3/admin/updates_controller.rb

@@ -7,12 +7,13 @@ module Spree
         #
         # The only place the Admin API reveals the running Spree version, so it
         # answers signed-in staff who can manage the store and nobody else. A
-        # secret API key gets a 404, like GET /me: an integration key would
-        # otherwise fingerprint the deployment for anyone matching CVEs.
+        # secret API key gets a 404, like GET /me, and a connected app a 403: an
+        # integration credential would otherwise fingerprint the deployment for
+        # anyone matching CVEs.
         class UpdatesController < Admin::BaseController
           skip_scope_check!
 
-          before_action :require_current_user!
+          before_action :require_staff_session!
 
           # GET /api/v3/admin/updates
           def show
@@ -20,18 +21,6 @@ module Spree
 
             render json: Spree.api.admin_update_status_serializer.new(Spree::UpdateCheck.status).to_h
           end
-
-          private
-
-          def require_current_user!
-            return if current_user
-
-            render_error(
-              code: ERROR_CODES[:record_not_found],
-              message: I18n.t('spree.me_no_current_user'),
-              status: :not_found
-            )
-          end
         end
       end
     end

data/app/controllers/spree/api/v3/seller/products/media_controller.rb

@@ -0,0 +1,46 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        module Products
+          # Removing a file from one of this seller's own products.
+          #
+          # Delete only: the gallery's other writes ride the product update,
+          # which never removes a file it was not sent — so a form holding
+          # stale state cannot wipe a seller's pictures. Like the rest of a
+          # gallery edit, removal does not send an approved listing back to
+          # review.
+          class MediaController < Seller::ResourceController
+            scoped_resource :products
+
+            protected
+
+            def model_class
+              Spree::Media
+            end
+
+            # Rooted in the seller's own catalog, so another seller's product
+            # is a 404. Changing a product's gallery is a change to the
+            # product, so it needs `:update` on it.
+            def set_parent
+              @parent = current_seller.products.find_by_prefix_id!(params[:product_id])
+              authorize_parent!(@parent)
+            end
+
+            # The product's gallery, plus any file still pinned to its default
+            # variant from before galleries moved to the product — the same
+            # rows the product shows.
+            def scope
+              Spree::Media.where(viewable: @parent).or(
+                Spree::Media.where(viewable_type: 'Spree::Variant', viewable_id: @parent.default_variant&.id)
+              )
+            end
+
+            # The product's own authorization above is the check.
+            def authorize_resource!(resource = @resource, action = action_name.to_sym); end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/seller/products_controller.rb

@@ -62,8 +62,10 @@ module Spree
             # operator's endpoint: it would make the server fetch a URL the
             # caller chose.
             body.attribute :media, :array,
-              as: 'SellerProductMediaParams',
-              description: 'The gallery, as a whole: a file absent from the list is removed. `signed_id` attaches a fresh upload; `id` updates one already there.' do |media_item|
+                           as: 'SellerProductMediaParams',
+                           description: 'Files to add or update: `signed_id` attaches a fresh upload; ' \
+                                        '`id` updates one already there. A file left out stays; remove ' \
+                                        'one with `DELETE /products/{product_id}/media/{id}`.' do |media_item|
               media_item.attribute :id, :id
               media_item.attribute :signed_id, :string, description: 'A `signed_id` from `POST /files`.'
               media_item.include_attributes Spree::Api::V3::MediaRequestSchema

data/app/controllers/spree/api/v3/seller/profile_controller.rb

@@ -8,10 +8,10 @@ module Spree
         # `current_seller` — never an id from the request. A seller cannot
         # address another seller here even by guessing one.
         #
-        # What they may change is presentation, contact and addresses. Absent
-        # by design: `status` (the lifecycle belongs to the operator's
-        # workflows), the settlement and tax configuration, and `slug` — a
-        # seller renaming their own storefront address breaks every link
+        # What they may change is presentation, contact, addresses and holiday
+        # mode. Absent by design: `status` (the lifecycle belongs to the
+        # operator's workflows), the settlement and tax configuration, and
+        # `slug` — a seller renaming their own storefront address breaks every link
         # pointing at it.
         class ProfileController < Seller::BaseController
           # A singular resource, so this extends the plain base rather than
@@ -42,6 +42,9 @@ module Spree
             body.attribute :cover_photo_signed_id, :string,
               nullable: true,
               description: 'A `signed_id` from `POST /files`; `null` removes the image.'
+            body.attribute :holiday_mode_until, :datetime,
+                           nullable: true,
+                           description: 'Set while the seller is away: the catalog stays but stops selling. `null` ends holiday mode.'
             body.attribute :billing_address, :object, as: 'SellerAddressParams' do |billing_address|
               billing_address.include_attributes Spree::Api::V3::AddressRequestSchema
             end
@@ -133,8 +136,13 @@ module Spree
             end
           end
 
+          # Plus what extensions opened to sellers — never the operator-level
+          # list — so fields a plugin adds to the panel's profile form save.
           def permitted_params
-            normalize_params(params.permit(*declared_permitted_attributes))
+            normalize_params(
+              params.permit(*declared_permitted_attributes,
+                            *Array(Spree::Seller.try(:additional_seller_permitted_attributes)))
+            )
           end
 
           private

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -129,17 +129,20 @@ module Spree
             end
           end
 
-          # DELETE /api/v3/store/carts/:id
-          # Deletes/abandons the cart
+          # Abandons a cart after checking its completion claim under the row lock.
+          #
+          # @return [void]
           def destroy
             find_cart!
 
-            result = Spree.cart_destroy_service.call(cart: @cart)
+            with_order_lock do
+              result = Spree.cart_destroy_service.call(cart: @cart)
 
-            if result.success?
-              head :no_content
-            else
-              render_service_error(result.error.to_s)
+              if result.success?
+                head :no_content
+              else
+                render_service_error(result.error.to_s)
+              end
             end
           end
 

data/app/serializers/spree/api/v3/admin/company_membership_serializer.rb

@@ -4,6 +4,10 @@ module Spree
       module Admin
         class CompanyMembershipSerializer < V3::CompanyMembershipSerializer
           attributes created_at: :iso8601, updated_at: :iso8601
+
+          # The member as a customer, so a list can show their name, not only
+          # the email.
+          one :customer, resource: proc { Spree.api.admin_customer_serializer }, if: proc { expand?('customer') }
         end
       end
     end

data/app/serializers/spree/api/v3/admin/diagnostics_serializer.rb

@@ -0,0 +1,30 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # The diagnostics report (Spree::Diagnostics::Report). A computed
+        # value rather than a record, so it carries no id. `errors[].error_class`
+        # is an exception's class name on purpose: it is what a maintainer
+        # reads in a bug report, not a value any client branches on.
+        class DiagnosticsSerializer < V3::BaseSerializer
+          typelize generated_at: :string,
+                   spree_version: :string,
+                   markdown: :string,
+                   issue_url: :string,
+                   issue_prefilled: :boolean,
+                   sections: 'Array<{ key: string; title: string; rows: Array<{ label: string; value: string }> }>',
+                   errors: 'Array<{ error_class: string; source: string | null; frames: string[]; ' \
+                           'request_id: string | null; count: number; first_seen_at: string; last_seen_at: string }>'
+
+          _attributes.delete(:id)
+
+          attributes :spree_version, :sections, :errors, generated_at: :iso8601
+
+          attribute(:markdown, &:to_markdown)
+          attribute(:issue_url, &:issue_url)
+          attribute(:issue_prefilled, &:issue_prefilled?)
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/line_item_serializer.rb

@@ -28,7 +28,8 @@ module Spree
                    price_list_id: [:string, nullable: true],
                    price_list_name: [:string, nullable: true],
                    catalog_id: [:string, nullable: true],
-                   catalog_name: [:string, nullable: true]
+                   catalog_name: [:string, nullable: true],
+                   product_id: [:string, nullable: true]
 
           # price_source is operational provenance — admin-only, never on the
           # store serializer.
@@ -66,6 +67,10 @@ module Spree
 
           prefixed_id_attributes :tax_category
 
+          # So an order page can link each line to its product without
+          # expanding the variant.
+          prefixed_id_attributes :product
+
           # Override inherited associations to use admin serializers
           many :option_values, resource: proc { Spree.api.admin_option_value_serializer }
           many :digital_links, resource: proc { Spree.api.admin_digital_link_serializer }