spree_api 6.0.1 → 6.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 88513caab1df4ae8256a450d38b98601d724763697f75cd6bbe92f20986fac7c
-  data.tar.gz: 87742481e6e84a33e11080d3c830ca960eb692a243fb6d1b6c926a43f7d951e0
+  metadata.gz: 3bc1eebac54270cff24aa58f2319414c1d2c3d3e2b62bc73ed1a99b3dcc8cef3
+  data.tar.gz: 63c9e47df2e22549f57a66be0af2bf781d35d44cfb42f70a7edacdc932f60dd2
 SHA512:
-  metadata.gz: 10e0aa59755c08b5d83f12080be796d2a4a8cd3cbb70e77a47d369853385dc78f3583296534b0482dc76816396a285f6b476c12cc0c1863eac45defedc646f71
-  data.tar.gz: fd76b27f733d1acf21c0deb06341cf2cde81de862dc1d1eaaefcb91f2ffb216bafd3c2f24d4f7a09f1a6dbe39d31f66b9e37584561c26e64563099c67a3592bb
+  metadata.gz: 4dc86cc7163081943b538408538ff9499ca25848f6bd3656933a8b79cc172d5a629e7cea4b0b22f5c55e22ba7a7b2fa342f8c360155b0759b879876f21d67972
+  data.tar.gz: ec1f8e51808bf0175f6c1ee135bc440cffcdff1e22eff9e920ac92e5d1610e22d8be00de38080d33acd629968b17c0f326b2c6a1651b3c7ee5643b7c5df52183

data/README.md

@@ -133,5 +133,6 @@ bundle exec rspec
 
 ## Documentation
 
-- [API Reference](https://docs.spreecommerce.org/api)
-- [Authentication Guide](https://docs.spreecommerce.org/developer/api/authentication)
+- [API Reference](https://spreecommerce.org/docs/api-reference)
+- [Store API authentication](https://spreecommerce.org/docs/api-reference/store-api/authentication)
+- [Admin API authentication](https://spreecommerce.org/docs/api-reference/admin-api/authentication)

data/app/controllers/concerns/spree/api/v3/admin/embed_permissions.rb

@@ -29,7 +29,12 @@ module Spree
             'gift_card' => 'read_gift_cards',
             'gift_cards' => 'read_gift_cards',
             'store_credit' => 'read_store_credits',
-            'store_credits' => 'read_store_credits'
+            'store_credits' => 'read_store_credits',
+            # The admin user serializer is nested in gift cards, task runs and
+            # tokens; its sessions carry IP addresses and its inviter is
+            # another staff member.
+            'sessions' => 'read_staff',
+            'inviter' => 'read_staff'
           }.freeze
 
           protected

data/app/controllers/spree/api/v3/admin/admin_users_controller.rb

@@ -72,6 +72,16 @@ module Spree
             [{ spree_roles: :resource, avatar_attachment: :blob }]
           end
 
+          # Sessions carry IP addresses and the inviter costs a query per row,
+          # so both are shown one person at a time.
+          ONE_AT_A_TIME_EXPANDS = %w[sessions inviter].freeze
+
+          def expand_list
+            return super unless action_name == 'index'
+
+            super.reject { |path| ONE_AT_A_TIME_EXPANDS.include?(path.split('.').first) }
+          end
+
           # Restrict to users with a role assignment on the current store.
           # `accessible_by` enforces CanCanCan on top. Deduplication happens via
           # an ID subquery rather than `SELECT DISTINCT *` — the users table is

data/app/serializers/spree/api/v3/admin/admin_user_serializer.rb

@@ -10,11 +10,29 @@ module Spree
                    selected_locale: [:string, nullable: true],
                    avatar_url: [:string, nullable: true],
                    roles: 'Array<{ id: string; name: string }>',
-                   stores: 'Array<{ id: string; name: string; code: string }>'
+                   stores: 'Array<{ id: string; name: string; code: string }>',
+                   status: [:string, enum: Spree::AdminUserMethods::STATUSES, enum_type_name: 'AdminUserStatus'],
+                   last_active_at: [:string, nullable: true],
+                   inviter: ['Actor', nullable: true]
 
-          attributes :email, :first_name, :last_name, :full_name, :selected_locale,
+          attributes :email, :first_name, :last_name, :full_name, :selected_locale, :status,
                      created_at: :iso8601, updated_at: :iso8601
 
+          attribute :last_active_at do |user|
+            user.try(:last_active_at)&.iso8601
+          end
+
+          # Carries IP addresses, so sent only to the caller who asks for it.
+          many :sessions,
+               resource: proc { Spree.api.admin_session_serializer },
+               source: ->(_params) { active_sessions },
+               if: proc { expand?('sessions') }
+
+          one :inviter,
+              resource: proc { Spree.api.admin_actor_serializer },
+              source: ->(params) { invited_by(params&.dig(:store)) },
+              if: proc { expand?('inviter') }
+
           attribute :avatar_url do |user|
             image_url_for(user.avatar)
           end

data/app/serializers/spree/api/v3/admin/payment_serializer.rb

@@ -16,7 +16,9 @@ module Spree
                    cvv_response_message: [:string, nullable: true],
                    gateway_dashboard_payment_url: [:string, nullable: true],
                    avs_risky: [:boolean, comment: 'Whether the card issuer reported that the billing address did not match.'],
-                   cvv_risky: [:boolean, comment: 'Whether the card issuer reported that the security code did not match.']
+                   cvv_risky: [:boolean, comment: 'Whether the card issuer reported that the security code did not match.'],
+                   can_void: [:boolean, comment: 'Whether the payment can be voided now, as decided by its payment method.'],
+                   can_capture: [:boolean, comment: 'Whether the payment can be captured now, as decided by its payment method.']
 
           attributes :metadata, :avs_response, :cvv_response_code, :cvv_response_message,
                      :gateway_dashboard_payment_url,
@@ -24,6 +26,8 @@ module Spree
 
           attribute(:avs_risky, &:is_avs_risky?)
           attribute(:cvv_risky, &:is_cvv_risky?)
+          attribute(:can_void, &:can_void?)
+          attribute(:can_capture, &:can_capture?)
 
           money_attributes :captured_amount
           typelize captured_amount: [:string, nullable: false]

data/app/serializers/spree/api/v3/admin/session_serializer.rb

@@ -0,0 +1,17 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # A signed-in session of a staff account ({Spree::RefreshToken}),
+        # without its token.
+        class SessionSerializer < V3::BaseSerializer
+          typelize ip_address: [:string, nullable: true],
+                   user_agent: [:string, nullable: true],
+                   last_active_at: :string
+
+          attributes :ip_address, :user_agent, last_active_at: :iso8601
+        end
+      end
+    end
+  end
+end

data/lib/spree/api/agent_workflow_endpoints.rb

@@ -95,8 +95,8 @@ module Spree
           path.gsub(/:([a-z_]+)/) { "{#{Regexp.last_match(1)}}" }
         end
 
-        # A packaged installation has no docs/ directory, and a body the
-        # document does not describe is simply passed through unchecked.
+        # A body the document does not describe is simply passed through
+        # unchecked.
         #
         # `AgentWriteSchemas` already holds this file parsed, so it is read
         # through there rather than a second time: the document is nearly a

data/lib/spree/api/agent_write_schemas.rb

@@ -33,12 +33,14 @@ module Spree
           self.for(key).keys
         end
 
-        # Where the generated document lives, relative to this engine. Resolved
-        # lazily: the engine class does not exist yet while this file loads.
+        # Where the generated document lives: `docs/` in a source checkout,
+        # or the copy the release packs into the gem. Resolved lazily: the
+        # engine class does not exist yet while this file loads.
         #
         # @return [Pathname]
         def spec_path
-          Spree::Api::Engine.root.join('..', '..', 'docs', 'api-reference', 'admin.yaml')
+          source = Spree::Api::Engine.root.join('..', '..', 'docs', 'api-reference', 'admin.yaml')
+          source.exist? ? source : Spree::Api::Engine.root.join('openapi', 'admin.yaml')
         end
 
         # The parsed document, for a reader that needs more of it than the
@@ -63,9 +65,7 @@ module Spree
         end
 
         # A missing or unparseable document is not a boot failure: the generic
-        # write tools simply offer nothing, which is the safe direction. An
-        # installation running from the packaged gems has no docs/ directory at
-        # all.
+        # write tools simply offer nothing, which is the safe direction.
         def load_schemas
           path = spec_path
           return {} unless File.exist?(path)

data/lib/spree/api/dependencies.rb

@@ -32,7 +32,7 @@ module Spree
            exchange exchange_line_item claim claim_line_item package_type policy tax_category tax_rate
            tax_identifier company company_membership company_invitation catalog catalog_price catalog_price_tier
            catalog_product price_list_product catalog_assignment catalog_quantity_rule catalog_product_term
-           catalog_order_minimum tax_exemption_certificate tax_exemption_reason admin_user actor seller_team_member product_submission
+           catalog_order_minimum tax_exemption_certificate tax_exemption_reason admin_user actor session seller_team_member product_submission
            seller seller_requirement seller_requirement_submission seller_requirement_status commission_rate
            commission_rule commission_line seller_transfer seller_payout seller_balance payment_split payment_capture_event address address_owner
            channel order_routing_rule product_publication market delivery_method delivery_method_service

data/lib/spree/api/oauth.rb

@@ -15,23 +15,11 @@ module Spree
     # which is why this lives in `spree_api` rather than in any one gem that
     # happens to need it.
     module Oauth
-      # Protected resources, each registered by the surface that owns it as a
-      # path relative to this application's own origin.
-      #
-      #   Spree::Api::Oauth.register_resource(:admin, '/api/v3/admin')
-      #
-      # A path rather than a full URL because the identifier must equal the
-      # URL the client was actually pointed at: the origin comes from the
-      # request where there is one, and from the application's configured
-      # URL options otherwise. A store's own `url` column is deliberately not
-      # consulted — it describes the storefront, which is frequently neither
-      # the host nor the scheme the Admin API answers on.
-      # Whether a redirect URI points at the machine the client runs on.
+      # Whether a redirect URI points at the machine the client runs on, by IP
+      # literal (`127.0.0.1`, `[::1]`).
       #
       # Decided by parsing the host as an address, the same way Doorkeeper
-      # does when it ignores the port of a loopback redirect — so `localhost`
-      # is deliberately not loopback here either, and a registration must use
-      # the IP literal for an ephemeral port to match.
+      # does when it ignores the port of a loopback redirect.
       #
       # @param uri [URI, String]
       # @return [Boolean]
@@ -44,6 +32,37 @@ module Spree
         false
       end
 
+      # Whether a redirect URI may use plain http: an IP-literal loopback, or
+      # `localhost` with an explicit port.
+      #
+      # Claude Code only ever calls back on `http://localhost:<port>`. Doorkeeper
+      # compares a `localhost` callback exactly, so the host must be lowercase
+      # and the port explicit: anything else could never match an
+      # authorization.
+      #
+      # @param uri [URI, String]
+      # @return [Boolean]
+      def self.local_redirect_uri?(uri)
+        uri = URI.parse(uri.to_s) unless uri.respond_to?(:host)
+        return true if loopback_uri?(uri)
+
+        uri.host == 'localhost' &&
+          (1..65_535).cover?(uri.port) && uri.port != uri.default_port
+      rescue StandardError
+        false
+      end
+
+      # Protected resources, each registered by the surface that owns it as a
+      # path relative to this application's own origin.
+      #
+      #   Spree::Api::Oauth.register_resource(:admin, '/api/v3/admin')
+      #
+      # A path rather than a full URL because the identifier must equal the
+      # URL the client was actually pointed at: the origin comes from the
+      # request where there is one, and from the application's configured
+      # URL options otherwise. A store's own `url` column is deliberately not
+      # consulted — it describes the storefront, which is frequently neither
+      # the host nor the scheme the Admin API answers on.
       mattr_accessor :resources, default: {}
 
       class << self
@@ -191,17 +210,18 @@ module Spree
 
             # A redirect URI is where authorization codes are delivered, so a
             # plain-http one hands them to anyone on the path — except a
-            # loopback one, which never leaves the machine. A terminal client
-            # listens on an ephemeral local port and has no certificate for
-            # it, so RFC 8252 §7.3 makes that the recommended shape, and
-            # refusing it would lock out Claude Code and Codex entirely.
+            # loopback or `localhost` one, which never leaves the machine. A
+            # terminal client listens on a local port and has no certificate
+            # for it. RFC 8252 §7.3 recommends the IP literal, but Claude Code
+            # only sends `localhost`, so refusing it would lock Claude Code
+            # out entirely.
             #
             # Passed as a callable so the exemption is per URI rather than
             # per environment: everything else still has to be https.
             force_ssl_in_redirect_uri do |uri|
               next false if Rails.env.development?
 
-              !Spree::Api::Oauth.loopback_uri?(uri)
+              !Spree::Api::Oauth.local_redirect_uri?(uri)
             end
 
             # RFC 8707. Registering the validator is what binds an audience

data/lib/typelizer/open_enums.rb

@@ -22,7 +22,7 @@ module Typelizer
     CLOSED_TYPE_NAMES = %w[CountryCode CurrencyCode LocaleCode WeightUnit DimensionUnit].freeze
 
     CLOSED_LIST_NAMES = %w[
-      ApiKeyType CaptureMethod CatalogAssignableType CatalogPriceSource ClaimResolution
+      AdminUserStatus ApiKeyType CaptureMethod CatalogAssignableType CatalogPriceSource ClaimResolution
       CollectionRuleMatchPolicy CollectionSortOrder CommissionKind CompanyInvitationStatus CompanyKind
       ConsentSource DataRequestKind DeliveryStatus DeliveryZoneMemberType DiscountKind DocumentNumberFormat
       EmailFont EmailTemplateKind FileUploadVisibility FulfillmentType MatchPolicy MediaType OptionTypeKind