spree_api_v1 4.5.0

data/app/controllers/spree/api/v1/states_controller.rb

@@ -0,0 +1,36 @@
+module Spree
+  module Api
+    module V1
+      class StatesController < Spree::Api::V1::BaseController
+        skip_before_action :authenticate_user
+
+        def index
+          @states = scope.ransack(params[:q]).result.includes(:country)
+
+          if params[:page] || params[:per_page]
+            @states = @states.page(params[:page]).per(params[:per_page])
+          end
+
+          state = @states.last
+          respond_with(@states) if stale?(state)
+        end
+
+        def show
+          @state = scope.find(params[:id])
+          respond_with(@state)
+        end
+
+        private
+
+        def scope
+          if params[:country_id]
+            @country = Country.accessible_by(current_ability, :show).find(params[:country_id])
+            @country.states.accessible_by(current_ability).order('name ASC')
+          else
+            State.accessible_by(current_ability).order('name ASC')
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v1/stock_items_controller.rb

@@ -0,0 +1,82 @@
+module Spree
+  module Api
+    module V1
+      class StockItemsController < Spree::Api::V1::BaseController
+        before_action :stock_location, except: [:update, :destroy]
+
+        def index
+          @stock_items = scope.ransack(params[:q]).result.page(params[:page]).per(params[:per_page])
+          respond_with(@stock_items)
+        end
+
+        def show
+          @stock_item = scope.find(params[:id])
+          respond_with(@stock_item)
+        end
+
+        def create
+          authorize! :create, StockItem
+
+          count_on_hand = 0
+          if params[:stock_item].key?(:count_on_hand)
+            count_on_hand = params[:stock_item][:count_on_hand].to_i
+          end
+
+          @stock_item = scope.new(stock_item_params)
+          if @stock_item.save
+            @stock_item.adjust_count_on_hand(count_on_hand)
+            respond_with(@stock_item, status: 201, default_template: :show)
+          else
+            invalid_resource!(@stock_item)
+          end
+        end
+
+        def update
+          @stock_item = StockItem.accessible_by(current_ability, :update).find(params[:id])
+
+          if params[:stock_item].key?(:backorderable)
+            @stock_item.backorderable = params[:stock_item][:backorderable]
+            @stock_item.save
+          end
+
+          count_on_hand = 0
+          if params[:stock_item].key?(:count_on_hand)
+            count_on_hand = params[:stock_item][:count_on_hand].to_i
+            params[:stock_item].delete(:count_on_hand)
+          end
+
+          updated = params[:stock_item][:force] ? @stock_item.set_count_on_hand(count_on_hand)
+          : @stock_item.adjust_count_on_hand(count_on_hand)
+
+          if updated
+            respond_with(@stock_item, status: 200, default_template: :show)
+          else
+            invalid_resource!(@stock_item)
+          end
+        end
+
+        def destroy
+          @stock_item = StockItem.accessible_by(current_ability, :destroy).find(params[:id])
+          @stock_item.destroy
+          respond_with(@stock_item, status: 204)
+        end
+
+        private
+
+        def stock_location
+          render 'spree/api/v1/shared/stock_location_required', status: 422 and return unless params[:stock_location_id]
+          @stock_location ||= StockLocation.accessible_by(current_ability, :show).find(params[:stock_location_id])
+        end
+
+        def scope
+          includes = { variant: [{ option_values: :option_type }, :product] }
+          @stock_location.stock_items.accessible_by(current_ability, :show).includes(includes)
+        end
+
+        def stock_item_params
+          params.require(:stock_item).permit(permitted_stock_item_attributes)
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v1/stock_locations_controller.rb

@@ -0,0 +1,53 @@
+module Spree
+  module Api
+    module V1
+      class StockLocationsController < Spree::Api::V1::BaseController
+        def index
+          authorize! :index, StockLocation
+          @stock_locations = StockLocation.accessible_by(current_ability).order('name ASC').
+                             ransack(params[:q]).result.page(params[:page]).per(params[:per_page])
+          respond_with(@stock_locations)
+        end
+
+        def show
+          respond_with(stock_location)
+        end
+
+        def create
+          authorize! :create, StockLocation
+          @stock_location = StockLocation.new(stock_location_params)
+          if @stock_location.save
+            respond_with(@stock_location, status: 201, default_template: :show)
+          else
+            invalid_resource!(@stock_location)
+          end
+        end
+
+        def update
+          authorize! :update, stock_location
+          if stock_location.update(stock_location_params)
+            respond_with(stock_location, status: 200, default_template: :show)
+          else
+            invalid_resource!(stock_location)
+          end
+        end
+
+        def destroy
+          authorize! :destroy, stock_location
+          stock_location.destroy
+          respond_with(stock_location, status: 204)
+        end
+
+        private
+
+        def stock_location
+          @stock_location ||= StockLocation.accessible_by(current_ability, :show).find(params[:id])
+        end
+
+        def stock_location_params
+          params.require(:stock_location).permit(permitted_stock_location_attributes)
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v1/stock_movements_controller.rb

@@ -0,0 +1,45 @@
+module Spree
+  module Api
+    module V1
+      class StockMovementsController < Spree::Api::V1::BaseController
+        before_action :stock_location, except: [:update, :destroy]
+
+        def index
+          authorize! :index, StockMovement
+          @stock_movements = scope.ransack(params[:q]).result.page(params[:page]).per(params[:per_page])
+          respond_with(@stock_movements)
+        end
+
+        def show
+          @stock_movement = scope.find(params[:id])
+          respond_with(@stock_movement)
+        end
+
+        def create
+          authorize! :create, StockMovement
+          @stock_movement = scope.new(stock_movement_params)
+          if @stock_movement.save
+            respond_with(@stock_movement, status: 201, default_template: :show)
+          else
+            invalid_resource!(@stock_movement)
+          end
+        end
+
+        private
+
+        def stock_location
+          render 'spree/api/v1/shared/stock_location_required', status: 422 and return unless params[:stock_location_id]
+          @stock_location ||= StockLocation.accessible_by(current_ability, :show).find(params[:stock_location_id])
+        end
+
+        def scope
+          @stock_location.stock_movements.accessible_by(current_ability, :show)
+        end
+
+        def stock_movement_params
+          params.require(:stock_movement).permit(permitted_stock_movement_attributes)
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v1/stores_controller.rb

@@ -0,0 +1,56 @@
+module Spree
+  module Api
+    module V1
+      class StoresController < Spree::Api::V1::BaseController
+        before_action :get_store, except: [:index, :create]
+
+        def index
+          authorize! :index, Store
+          @stores = Store.accessible_by(current_ability).all
+          respond_with(@stores)
+        end
+
+        def create
+          authorize! :create, Store
+          @store = Store.new(store_params)
+          @store.code = params[:store][:code]
+          if @store.save
+            respond_with(@store, status: 201, default_template: :show)
+          else
+            invalid_resource!(@store)
+          end
+        end
+
+        def update
+          authorize! :update, @store
+          if @store.update(store_params)
+            respond_with(@store, status: 200, default_template: :show)
+          else
+            invalid_resource!(@store)
+          end
+        end
+
+        def show
+          authorize! :show, @store
+          respond_with(@store)
+        end
+
+        def destroy
+          authorize! :destroy, @store
+          @store.destroy
+          respond_with(@store, status: 204)
+        end
+
+        private
+
+        def get_store
+          @store = Store.find(params[:id])
+        end
+
+        def store_params
+          params.require(:store).permit(permitted_store_attributes)
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v1/taxonomies_controller.rb

@@ -0,0 +1,67 @@
+module Spree
+  module Api
+    module V1
+      class TaxonomiesController < Spree::Api::V1::BaseController
+        def index
+          respond_with(taxonomies)
+        end
+
+        def show
+          respond_with(taxonomy)
+        end
+
+        # Because JSTree wants parameters in a *slightly* different format
+        def jstree
+          show
+        end
+
+        def new; end
+
+        def create
+          authorize! :create, Taxonomy
+          @taxonomy = current_store.taxonomies.new(taxonomy_params)
+          if @taxonomy.save
+            respond_with(@taxonomy, status: 201, default_template: :show)
+          else
+            invalid_resource!(@taxonomy)
+          end
+        end
+
+        def update
+          authorize! :update, taxonomy
+          if taxonomy.update(taxonomy_params)
+            respond_with(taxonomy, status: 200, default_template: :show)
+          else
+            invalid_resource!(taxonomy)
+          end
+        end
+
+        def destroy
+          authorize! :destroy, taxonomy
+          taxonomy.destroy
+          respond_with(taxonomy, status: 204)
+        end
+
+        private
+
+        def taxonomies
+          @taxonomies = Taxonomy.accessible_by(current_ability).order('name').includes(root: :children).
+                        ransack(params[:q]).result.
+                        page(params[:page]).per(params[:per_page])
+        end
+
+        def taxonomy
+          @taxonomy ||= Taxonomy.accessible_by(current_ability, :show).find(params[:id])
+        end
+
+        def taxonomy_params
+          if params[:taxonomy] && !params[:taxonomy].empty?
+            params.require(:taxonomy).permit(permitted_taxonomy_attributes)
+          else
+            {}
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v1/taxons_controller.rb

@@ -0,0 +1,100 @@
+module Spree
+  module Api
+    module V1
+      class TaxonsController < Spree::Api::V1::BaseController
+        def index
+          @taxons = if taxonomy
+                      taxonomy.root.children
+                    elsif params[:ids]
+                      Spree::Taxon.includes(:children).accessible_by(current_ability).where(id: params[:ids].split(','))
+                    else
+                      Spree::Taxon.includes(:children).accessible_by(current_ability).order(:taxonomy_id, :lft)
+                    end
+          @taxons = @taxons.ransack(params[:q]).result
+          @taxons = @taxons.page(params[:page]).per(params[:per_page])
+          respond_with(@taxons)
+        end
+
+        def show
+          @taxon = taxon
+          respond_with(@taxon)
+        end
+
+        def jstree
+          show
+        end
+
+        def new; end
+
+        def create
+          authorize! :create, Taxon
+          @taxon = Spree::Taxon.new(taxon_params)
+          @taxon.taxonomy_id = params[:taxonomy_id]
+          taxonomy = Spree::Taxonomy.find_by(id: params[:taxonomy_id])
+
+          if taxonomy.nil?
+            @taxon.errors.add(:taxonomy_id, I18n.t('spree.api.invalid_taxonomy_id'))
+            invalid_resource!(@taxon) and return
+          end
+
+          @taxon.parent_id = taxonomy.root_id unless params[:taxon][:parent_id]
+
+          if @taxon.save
+            respond_with(@taxon, status: 201, default_template: :show)
+          else
+            invalid_resource!(@taxon)
+          end
+        end
+
+        def update
+          authorize! :update, taxon
+          if taxon.update(taxon_params)
+            respond_with(taxon, status: 200, default_template: :show)
+          else
+            invalid_resource!(taxon)
+          end
+        end
+
+        def destroy
+          authorize! :destroy, taxon
+          taxon.destroy
+          respond_with(taxon, status: 204)
+        end
+
+        def products
+          # Returns the products sorted by their position with the classification
+          # Products#index does not do the sorting.
+          taxon = Spree::Taxon.find(params[:id])
+          @products = taxon.products.ransack(params[:q]).result
+          @products = @products.page(params[:page]).per(params[:per_page] || 500)
+          render 'spree/api/v1/products/index'
+        end
+
+        private
+
+        def taxonomy
+          if params[:taxonomy_id].present?
+            @taxonomy ||=
+              if defined?(SpreeGlobalize)
+                Spree::Taxonomy.includes(:translations, taxons: [:translations]).accessible_by(current_ability, :show).find(params[:taxonomy_id])
+              else
+                Spree::Taxonomy.accessible_by(current_ability, :show).find(params[:taxonomy_id])
+              end
+          end
+        end
+
+        def taxon
+          @taxon ||= taxonomy.taxons.accessible_by(current_ability, :show).find(params[:id])
+        end
+
+        def taxon_params
+          if params[:taxon] && !params[:taxon].empty?
+            params.require(:taxon).permit(permitted_taxon_attributes)
+          else
+            {}
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v1/users_controller.rb

@@ -0,0 +1,97 @@
+module Spree
+  module Api
+    module V1
+      class UsersController < Spree::Api::V1::BaseController
+        rescue_from Spree::Core::DestroyWithOrdersError, with: :error_during_processing
+
+        def index
+          users
+
+          if params[:ids]
+            load_users_by_ids
+          elsif params.dig(:q, :ship_address_firstname_start)
+            load_users_by_address
+          elsif params.dig(:q, :email_start)
+            load_users_by_email
+          end
+
+          prepare_index_response
+          respond_with(@users)
+        end
+
+        def users
+          @users ||= Spree.user_class.accessible_by(current_ability, :show)
+        end
+
+        def load_users_by_ids
+          @users = @users.where(id: params[:ids])
+        end
+
+        def load_users_by_address
+          address_params = params[:q][:ship_address_firstname_start] ||
+            params[:q][:ship_address_lastname_start] ||
+            params[:q][:bill_address_firstname_start] ||
+            params[:q][:bill_address_lastname_start]
+          @users = @users.with_email_or_address(params[:q][:email_start], address_params)
+        end
+
+        def load_users_by_email
+          @users = @users.with_email(params[:q][:email_start])
+        end
+
+        def paginate_users
+          @users = @users.page(params[:page]).per(params[:per_page])
+        end
+
+        def prepare_index_response
+          paginate_users
+          expires_in 15.minutes, public: true
+          headers['Surrogate-Control'] = "max-age=#{15.minutes}"
+        end
+
+        def show
+          respond_with(user)
+        end
+
+        def new; end
+
+        def create
+          authorize! :create, Spree.user_class
+          @user = Spree.user_class.new(user_params)
+          if @user.save
+            respond_with(@user, status: 201, default_template: :show)
+          else
+            invalid_resource!(@user)
+          end
+        end
+
+        def update
+          authorize! :update, user
+          if user.update(user_params)
+            respond_with(user, status: 200, default_template: :show)
+          else
+            invalid_resource!(user)
+          end
+        end
+
+        def destroy
+          authorize! :destroy, user
+          user.destroy
+          respond_with(user, status: 204)
+        end
+
+        private
+
+        def user
+          @user ||= Spree.user_class.accessible_by(current_ability, :show).find(params[:id])
+        end
+
+        def user_params
+          params.require(:user).permit(permitted_user_attributes |
+                                         [bill_address_attributes: permitted_address_attributes,
+                                          ship_address_attributes: permitted_address_attributes])
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v1/variants_controller.rb

@@ -0,0 +1,81 @@
+module Spree
+  module Api
+    module V1
+      class VariantsController < Spree::Api::V1::BaseController
+        before_action :product
+
+        def create
+          authorize! :create, Variant
+          @variant = scope.new(variant_params)
+          if @variant.save
+            respond_with(@variant, status: 201, default_template: :show)
+          else
+            invalid_resource!(@variant)
+          end
+        end
+
+        def destroy
+          @variant = scope.accessible_by(current_ability, :destroy).find(params[:id])
+          @variant.destroy
+          respond_with(@variant, status: 204)
+        end
+
+        # The lazyloaded associations here are pretty much attached to which nodes
+        # we render on the view so we better update it any time a node is included
+        # or removed from the views.
+        def index
+          @variants = scope.includes(*variant_includes).for_currency_and_available_price_amount.
+                      ransack(params[:q]).result.page(params[:page]).per(params[:per_page])
+          respond_with(@variants)
+        end
+
+        def new; end
+
+        def show
+          @variant = scope.includes(*variant_includes).find(params[:id])
+          respond_with(@variant)
+        end
+
+        def update
+          @variant = scope.accessible_by(current_ability, :update).find(params[:id])
+          if @variant.update(variant_params)
+            respond_with(@variant, status: 200, default_template: :show)
+          else
+            invalid_resource!(@product)
+          end
+        end
+
+        private
+
+        def product
+          if params[:product_id]
+            @product ||= Spree::Product.accessible_by(current_ability, :show).
+                         friendly.find(params[:product_id])
+          end
+        end
+
+        def scope
+          variants = if @product
+                       @product.variants_including_master
+                     else
+                       Variant
+                     end
+
+          if current_ability.can?(:manage, Variant) && params[:show_deleted]
+            variants = variants.with_deleted
+          end
+
+          variants.eligible.accessible_by(current_ability)
+        end
+
+        def variant_params
+          params.require(:variant).permit(permitted_variant_attributes)
+        end
+
+        def variant_includes
+          [{ option_values: :option_type }, :product, :default_price, :images, { stock_items: :stock_location }]
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v1/zones_controller.rb

@@ -0,0 +1,55 @@
+module Spree
+  module Api
+    module V1
+      class ZonesController < Spree::Api::V1::BaseController
+        def create
+          authorize! :create, Zone
+          @zone = Spree::Zone.new(zone_params)
+          if @zone.save
+            respond_with(@zone, status: 201, default_template: :show)
+          else
+            invalid_resource!(@zone)
+          end
+        end
+
+        def destroy
+          authorize! :destroy, zone
+          zone.destroy
+          respond_with(zone, status: 204)
+        end
+
+        def index
+          @zones = Zone.accessible_by(current_ability).order('name ASC').ransack(params[:q]).result.page(params[:page]).per(params[:per_page])
+          respond_with(@zones)
+        end
+
+        def show
+          respond_with(zone)
+        end
+
+        def update
+          authorize! :update, zone
+          if zone.update(zone_params)
+            respond_with(zone, status: 200, default_template: :show)
+          else
+            invalid_resource!(zone)
+          end
+        end
+
+        private
+
+        def zone_params
+          attrs = params.require(:zone).permit!.to_h
+          if attrs[:zone_members]
+            attrs[:zone_members_attributes] = attrs.delete(:zone_members)
+          end
+          attrs
+        end
+
+        def zone
+          @zone ||= Spree::Zone.accessible_by(current_ability, :show).find(params[:id])
+        end
+      end
+    end
+  end
+end