spree_api 2.0.9 → 2.0.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b4f74781ea0934c3fecc2b6bfabf934360efce72
-  data.tar.gz: fa04ae4fd788014ba5a0f23abf4ab5120fb04e68
+  metadata.gz: aa047ba09ae648902132c95077e64faad8eb1f63
+  data.tar.gz: e2fcbef05544ad3fd2f65f79fca38f175365800e
 SHA512:
-  metadata.gz: 016441c31d86a96ebc8a362c8c254bcf682aa164a1fb418d961884ad7e92351ae863deca84299ba88b52c5c78f08aad9bfdb66d8b92bb58da82168ad1296c6c3
-  data.tar.gz: 0f3762b3c07a6089b7055a68d2114234724ab2c0ab450702e40d0a77d66e953ac1596143b02e8d3bd7cd0c5619815df4d8c4b7f7e43af7140dc1ee7deda40a08
+  metadata.gz: 936aed8b8100f9f0e754109c74851a632abd2614e3c9a5951edf06aa782e7b00424bbebcb5665f45992a6295b66337dce4c64cc889e657d82656c2ac0a61ac21
+  data.tar.gz: f4af5a1402eebf511cb0911d26ff65877708f721682cc1e01452e7fb20cbe81ecb0f4e34741dfafa1c3ca35abe2ffc7f8281abcb27d69b59921c27d3faa989f4

data/CHANGELOG.md

@@ -1 +1 @@
-## Spree 2.0.9 (unreleased) ##
+## Spree 2.0.10 (unreleased) ##

data/app/controllers/spree/api/base_controller.rb

@@ -6,6 +6,8 @@ module Spree
       include Spree::Api::ControllerSetup
       include Spree::Core::ControllerHelpers::SSL
       include ::ActionController::Head
+      include ::ActionController::Redirecting
+      include Spree::Core::Engine.routes.url_helpers
 
       self.responder = Spree::Api::Responders::AppResponder
 
@@ -15,6 +17,7 @@ module Spree
 
       before_filter :set_content_type
       before_filter :check_for_user_or_api_key, :if => :requires_authentication?
+      before_filter :authorize_for_order, :if => Proc.new { order_token.present? }
       before_filter :authenticate_user
       after_filter  :set_jsonp_format
 
@@ -58,14 +61,14 @@ module Spree
         # User is already authenticated with Spree, make request this way instead.
         return true if @current_api_user = try_spree_current_user || !Spree::Api::Config[:requires_authentication]
 
-        if api_key.blank?
+        if api_key.blank? && order_token.blank?
           render "spree/api/errors/must_specify_api_key", :status => 401 and return
         end
       end
 
       def authenticate_user
         unless @current_api_user
-          if requires_authentication? || api_key.present?
+          if order_token.blank? && (requires_authentication? || api_key.present?)
             unless @current_api_user = Spree.user_class.find_by_spree_api_key(api_key.to_s)
               render "spree/api/errors/invalid_api_key", :status => 401 and return
             end
@@ -107,6 +110,10 @@ module Spree
       end
       helper_method :api_key
 
+      def order_token
+        request.headers["X-Spree-Order-Token"] || params[:order_token]
+      end
+
       def find_product(id)
         begin
           product_scope.find_by_permalink!(id.to_s)
@@ -128,6 +135,12 @@ module Spree
         scope.includes(:master)
       end
 
+      def authorize_for_order
+        @order = Spree::Order.find_by_number(params[:order_id] || params[:id])
+        unless @order.token == order_token
+          unauthorized
+        end
+      end
     end
   end
 end

data/app/controllers/spree/api/checkouts_controller.rb

@@ -32,8 +32,7 @@ module Spree
       end
 
       def show
-        load_order
-        respond_with(@order, default_template: 'spree/api/orders/show', status: 200)
+        redirect_to(api_order_path(params[:id]), status: 301)
       end
 
       def update

data/app/controllers/spree/api/line_items_controller.rb

@@ -4,7 +4,7 @@ module Spree
       respond_to :json
 
       def create
-        authorize! :read, order
+        authorize! :update, order, order_token
         @line_item = order.line_items.build(params[:line_item], :as => :api)
         if @line_item.save
           @order.ensure_updated_shipments
@@ -15,7 +15,7 @@ module Spree
       end
 
       def update
-        authorize! :read, order
+        authorize! :update, order, order_token
         @line_item = order.line_items.find(params[:id])
         if @line_item.update_attributes(params[:line_item], :as => :api)
           @order.ensure_updated_shipments
@@ -26,7 +26,7 @@ module Spree
       end
 
       def destroy
-        authorize! :read, order
+        authorize! :update, order, order_token
         @line_item = order.line_items.find(params[:id])
         @line_item.destroy
         respond_with(@line_item, :status => 204)

data/app/controllers/spree/api/products_controller.rb

@@ -95,8 +95,7 @@ module Spree
       def destroy
         authorize! :delete, Product
         @product = find_product(params[:id])
-        @product.update_attribute(:deleted_at, Time.now)
-        @product.variants_including_master.update_all(:deleted_at => Time.now)
+        @product.destroy
         respond_with(@product, :status => 204)
       end
 

data/app/helpers/spree/api/api_helpers.rb

@@ -32,7 +32,7 @@ module Spree
       end
 
       def order_attributes
-        [:id, :number, :item_total, :total, :ship_total, :state, :adjustment_total, :user_id, :created_at, :updated_at, :completed_at, :payment_total, :shipment_state, :payment_state, :email, :special_instructions, :token, :channel]
+        [:id, :number, :item_total, :total, :ship_total, :state, :adjustment_total, :user_id, :created_at, :updated_at, :completed_at, :payment_total, :shipment_state, :payment_state, :email, :special_instructions, :token, :channel, :currency]
       end
 
       def line_item_attributes

data/spec/controllers/spree/api/checkouts_controller_spec.rb

@@ -22,6 +22,16 @@ module Spree
       Spree::Config[:track_inventory_levels] = true
     end
 
+    context "GET 'show'" do
+      let(:order) { create(:order) }
+
+      it "redirects to Orders#show" do
+        api_get :show, :id => order.number
+        response.status.should == 301
+        response.should redirect_to("/api/orders/#{order.number}")
+      end
+    end
+
     context "POST 'create'" do
       it "creates a new order when no parameters are passed" do
         api_post :create

data/spec/controllers/spree/api/line_items_controller_spec.rb

@@ -10,11 +10,8 @@ module Spree
     let(:attributes) { [:id, :quantity, :price, :variant] }
     let(:resource_scoping) { { :order_id => order.to_param } }
 
-    before do
-      stub_authentication!
-    end
-
     it "can learn how to create a new line item" do
+      controller.stub :try_spree_current_user => current_api_user
       api_get :new
       json_response["attributes"].should == ["quantity", "price", "variant_id"]
       required_attributes = json_response["required_attributes"]
@@ -23,6 +20,7 @@ module Spree
 
     context "as the order owner" do
       before do
+        controller.stub :try_spree_current_user => current_api_user
         Order.any_instance.stub :user => current_api_user
       end
 
@@ -68,6 +66,11 @@ module Spree
     end
 
     context "as just another user" do
+      before do
+        user = create(:user)
+        controller.stub :try_spree_current_user => user
+      end
+
       it "cannot add a new line item to the order" do
         api_post :create, :line_item => { :variant_id => product.master.to_param, :quantity => 1 }
         assert_unauthorized!

data/spec/controllers/spree/api/users_controller_spec.rb

@@ -11,7 +11,9 @@ module Spree
     before { stub_authentication! }
 
     context "as a normal user" do
-      before { Spree::LegacyUser.stub :find_by_spree_api_key => user }
+      before do
+        controller.stub :current_api_user => user
+      end
 
       it "can get own details" do
         api_get :show, :id => user.id

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 2.0.9
+  version: 2.0.10
 platform: ruby
 authors:
 - Ryan Bigg
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-02-18 00:00:00.000000000 Z
+date: 2014-03-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree_core
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.0.9
+        version: 2.0.10
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.0.9
+        version: 2.0.10
 - !ruby/object:Gem::Dependency
   name: rabl
   requirement: !ruby/object:Gem::Requirement
@@ -246,7 +246,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.0
+rubygems_version: 2.2.2
 signing_key: 
 specification_version: 4
 summary: Spree's API