spree_api 6.0.3 → 6.0.4

data/app/serializers/spree/api/v3/admin/seller_serializer.rb

@@ -55,6 +55,11 @@ module Spree
           # so the minimum-products requirement asks the same question free.
           attributes :products_count
 
+          # What is live and what waits on the operator's review, read in the
+          # same query as the total above.
+          typelize(Spree::Product::ALL_STATUSES.to_h { |status| [status.to_sym, :number] })
+          attribute :products_count_by_status, &:products_count_by_status
+
           attributes :users_count
 
           # How far through the marketplace's checklist this seller is — what
@@ -78,6 +83,11 @@ module Spree
               resource: proc { Spree.api.admin_address_serializer },
               if: proc { |seller| seller.returns_address.present? }
 
+          # The stock location the returns address is read from. The address
+          # is not the seller's own to write — it is edited on this location.
+          typelize returns_location_id: [:string, nullable: true]
+          prefixed_id_attributes :returns_location
+
           expandable_custom_fields admin: true
         end
       end

data/app/serializers/spree/api/v3/product_category_serializer.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Api
+    module V3
+      class ProductCategorySerializer < BaseSerializer
+        typelize product_id: [:string, nullable: true],
+                 category_id: [:string, nullable: true]
+
+        attribute :product_id do |product_category|
+          prefixed_id_for(Spree::Product, product_category.product_id)
+        end
+
+        attribute :category_id do |product_category|
+          prefixed_id_for(Spree::Category, product_category.category_id)
+        end
+
+        private
+
+        def prefixed_id_for(klass, id)
+          return nil if id.nil?
+
+          "#{klass._prefix_id_prefix}_#{Spree::PrefixedId::SQIDS.encode([id])}"
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/product_collection_serializer.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Api
+    module V3
+      class ProductCollectionSerializer < BaseSerializer
+        typelize product_id: [:string, nullable: true],
+                 collection_id: [:string, nullable: true]
+
+        attribute :product_id do |product_collection|
+          prefixed_id_for(Spree::Product, product_collection.product_id)
+        end
+
+        attribute :collection_id do |product_collection|
+          prefixed_id_for(Spree::Collection, product_collection.collection_id)
+        end
+
+        private
+
+        def prefixed_id_for(klass, id)
+          return nil if id.nil?
+
+          "#{klass._prefix_id_prefix}_#{Spree::PrefixedId::SQIDS.encode([id])}"
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/seller/order_line_item_serializer.rb

@@ -13,7 +13,7 @@ module Spree
         class OrderLineItemSerializer < V3::BaseSerializer
           typelize name: :string, sku: [:string, nullable: true], options_text: [:string, nullable: true],
                    quantity: :number, currency: [:string, enum: Spree::Money::Rounding::CURRENCY_CODES, enum_type_name: 'CurrencyCode'], variant_id: [:string, nullable: true],
-                   thumbnail_url: [:string, nullable: true]
+                   thumbnail_url: [:string, nullable: true], product_id: [:string, nullable: true]
 
           attributes :name, :options_text, :quantity, :currency
 
@@ -22,7 +22,7 @@ module Spree
           money_attributes :discounted_amount,
                            :additional_tax_total, :total
 
-          prefixed_id_attributes :variant
+          prefixed_id_attributes :variant, :product
 
           # How a seller finds the item on their own shelf.
           attribute :sku do |line_item|

data/config/routes.rb

@@ -285,6 +285,7 @@ Spree::Core::Engine.add_routes do
         patch 'me', to: 'me#update'
 
         resource :updates, only: :show
+        resource :diagnostics, only: :show
 
         # Store Settings
         resource :store, only: [:show, :update], controller: 'store' do
@@ -610,7 +611,7 @@ Spree::Core::Engine.add_routes do
           # The operator is the only one who can repair a seller whose team
           # has locked itself out, which the seller's own panel cannot do.
           resources :team, only: [:index, :destroy], controller: 'sellers/team'
-          resources :invitations, only: [:index, :destroy], controller: 'sellers/invitations' do
+          resources :invitations, only: [:index, :create, :destroy], controller: 'sellers/invitations' do
             patch :resend, on: :member
             resource :acceptance_link, only: [:show], controller: 'sellers/invitations/acceptance_links'
           end
@@ -930,6 +931,7 @@ Spree::Core::Engine.add_routes do
 
           resources :digital_assets, controller: 'products/digital_assets',
                                      only: [:index, :create, :show, :update, :destroy]
+          resources :media, controller: 'products/media', only: [:destroy]
         end
 
 

data/lib/spree/api/agent_resource_map.rb

@@ -71,16 +71,23 @@ module Spree
       # one, because the scope belongs to the resource being imported or
       # exported — creating a product import is a product write, and reading
       # its rows exposes the uploaded data. A single static key cannot say
-      # that, so these are registered read-only under the broadest key the
-      # controller can demand, and the write path stays with the endpoint.
+      # that, so these open to a caller holding the scope of any one type,
+      # in the kind the controller asks for: `read_` for an export, `write_`
+      # for an import. The endpoint then keeps to the types that key covers.
+      #
+      # Creating one stays with create_import and create_export; reading,
+      # listing and deleting go to the endpoint.
       DYNAMIC_SCOPE_RESOURCES = {
-        'imports' => { model_name: 'Spree::Import', permission: 'read_settings',
+        'imports' => { model_name: 'Spree::Import', access_kind: 'write',
                        serializer_name: 'Spree::Api::V3::Admin::ImportSerializer',
                        dashboard_path: '/settings/imports' },
-        'exports' => { model_name: 'Spree::Export', permission: 'read_settings',
+        'exports' => { model_name: 'Spree::Export', access_kind: 'read',
                        serializer_name: 'Spree::Api::V3::Admin::ExportSerializer' }
       }.freeze
 
+      # The operations the generic tools reach on those resources.
+      DYNAMIC_SCOPE_ACTIONS = %i[index show destroy].freeze
+
       class << self
         # Registers this walk as how the core map fills itself, and marks the
         # map stale so the next reader gets a fresh one. Called on every code
@@ -102,7 +109,11 @@ module Spree
           registered = resolve_collisions(controllers.filter_map { |controller| derive(controller) })
           registered.each { |entry| map.register(**entry) }
 
-          DYNAMIC_SCOPE_RESOURCES.each { |key, attributes| map.register(key: key, **attributes) }
+          DYNAMIC_SCOPE_RESOURCES.each do |key, attributes|
+            map.register(key: key, permission: nil, **attributes.except(:access_kind),
+                         api_paths: dynamic_scope_paths(attributes[:model_name]),
+                         access_permissions: type_permissions(attributes[:model_name], attributes[:access_kind]))
+          end
 
           registered.size + DYNAMIC_SCOPE_RESOURCES.size
         end
@@ -183,6 +194,7 @@ module Spree
           create_workflow = workflow_key(instance, :create_workflow)
           update_workflow = workflow_key(instance, :update_workflow)
           writable = AgentWriteSchemas.attribute_names(key)
+          api_paths = api_paths_for(controller)
 
           {
             key: key,
@@ -190,7 +202,8 @@ module Spree
             permission: "read_#{scope}",
             serializer_name: serializer.name,
             dashboard_path: DASHBOARD_PATHS[key],
-            api_paths: api_paths_for(controller),
+            api_paths: api_paths,
+            index_paths: Array(api_paths[:index]),
             write_permission: write_permission_for(model, scope, create_workflow, update_workflow, writable, controller),
             writable_attributes: writable,
             create_workflow_key: create_workflow,
@@ -219,6 +232,25 @@ module Spree
 
         private
 
+        # The read and delete paths of the controller serving an import or
+        # export. Without them the generic tools refused every one, though
+        # create_export tells the agent to read the export with get_resource.
+        def dynamic_scope_paths(model_name)
+          controller = controllers.find { |candidate| model_for(candidate)&.name == model_name }
+          return {} if controller.nil?
+
+          api_paths_for(controller).slice(*DYNAMIC_SCOPE_ACTIONS)
+        end
+
+        # The catalog keys that open an import or export of each registered
+        # type. A type with no scope of its own needs `read_all` or
+        # `write_all`, which no catalog key stands for, so it adds none.
+        def type_permissions(model_name, kind)
+          model_name.constantize.available_types.
+            filter_map { |type| type.required_scope.presence && "#{kind}_#{type.required_scope}" }.
+            uniq.select { |key| Spree.permissions.key?(key) }
+        end
+
         # What the controller does with its own collection. A controller that
         # disables DISTINCT has a reason — Postgres refuses it beside an
         # ORDER BY the select list does not carry — and a search tool adding
@@ -273,7 +305,10 @@ module Spree
               # nothing about depth — so a resource served both at the top
               # level and under a parent kept whichever won on scope, and a
               # tool was handed a path with an unfillable `:parent_id` in it.
-              api_paths: shallowest_paths(candidates)
+              api_paths: shallowest_paths(candidates),
+              # Every collection path, not only the shallowest, so a search
+              # under a parent reaches the controller that lists its records.
+              index_paths: candidates.flat_map { |entry| entry[:index_paths] }.uniq
             )
           end
         end

data/lib/spree/api/dependencies.rb

@@ -38,7 +38,7 @@ module Spree
            channel order_routing_rule product_publication market delivery_method delivery_method_service
            stock_location stock_reservation delivery_rate freight_summary freight_summary_line payment_method
            credit_card store_credit store_credit_event customer_group payment_source digital_asset digital_link
-           store setup_task update_status api_key oauth_application oauth_access_token oauth_consent_request oauth_redirect
+           store setup_task update_status diagnostics api_key oauth_application oauth_access_token oauth_consent_request oauth_redirect
            oauth_protected_resource allowed_origin webhook_endpoint webhook_event webhook_delivery invitation
            invitation_acceptance_link role permission export saved_report import import_row import_mapping promotion
            maintenance_task_run

data/lib/spree/api/testing_support/openapi.rb

@@ -2,6 +2,7 @@ require 'spree/api/testing_support/v3/base'
 require 'spree/api/testing_support/agent_tools'
 require 'spree/api/testing_support/deterministic_openapi'
 require 'spree/api/testing_support/filter_parameters'
+require 'spree/api/testing_support/sdk_method'
 
 module Spree
   module Api
@@ -165,7 +166,7 @@ module Spree
       # and in its Rakefile, `require 'spree/api/testing_support/openapi_tasks'`
       # for `rake spree:openapi:generate`.
       module Openapi
-        HELPERS = [RequestBody, FilterParameters, AdminScope, AdminOperation, AgentTools].freeze
+        HELPERS = [RequestBody, FilterParameters, AdminScope, AdminOperation, AgentTools, SdkMethod].freeze
 
         class << self
           # @param config [RSpec::Core::Configuration]

data/lib/spree/api/testing_support/sdk_method.rb

@@ -0,0 +1,34 @@
+module Spree
+  module Api
+    module TestingSupport
+      # rswag helper for what an operation is called in the SDK client
+      # `spree sdk generate` writes for an extension. By default a method is
+      # named after the path (`PATCH /quotes/{id}/send` → `quotes.send`), and
+      # an `operationId` renames it, but the `operationId` also names the
+      # operation's agent tool. This names the SDK method alone:
+      #
+      #   delete 'Remove a file from a quote' do
+      #     sdk_method :remove_attachment                    # quotes.removeAttachment
+      #   end
+      #
+      #   post 'Upload a file for a quote request' do
+      #     sdk_method :presign_attachment, namespace: :quotes  # not carts.…
+      #   end
+      #
+      # See docs/plans/6.0-sdk-extensions.md.
+      module SdkMethod
+        METHOD_KEY = :'x-spree-sdk-method'
+        NAMESPACE_KEY = :'x-spree-sdk-namespace'
+
+        # @param name [Symbol, String] the method, snake_case or camelCase
+        # @param namespace [Symbol, String, nil] the client namespace it goes in,
+        #   instead of the path's resource
+        # @return [void]
+        def sdk_method(name, namespace: nil)
+          metadata[:operation][METHOD_KEY] = name.to_s
+          metadata[:operation][NAMESPACE_KEY] = namespace.to_s if namespace
+        end
+      end
+    end
+  end
+end