spree_legacy_api_v2 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: a0ad06cfe87057ca7696604c808ea23b46cb7e42a6e9619fa76e218307e64ab1
+  data.tar.gz: 3067eedec49aca26f5ef0ef30e486bcbde39e993da0679925e22da568eaf7353
+SHA512:
+  metadata.gz: d5d933f75f967e8dcf40b3c7a32b1a9239bb0a3944781b12435423a56740270491da3059e6e4c121d393f795c8b44d044937aef6f696634de1f2756637f678a8
+  data.tar.gz: 03ed42ab16c493f4913f5d09b4eb1a7c3fa5da474c62a7d70d4b44ae775f484c20d76a8da18e82f8e2795fd41063ad199a265764880b36b63adb57f8c42cbe23

data/README.md

@@ -0,0 +1,47 @@
+# Spree Legacy API v2
+
+> **⚠️ DEPRECATED**: This gem provides the legacy API v2 endpoints for Spree Commerce. We recommend using **API v3**.
+
+## Overview
+
+This gem contains the legacy Storefront API v2 and Platform API v2 endpoints that were previously part of `spree_api`. These APIs are now deprecated in favor of the new API v3, which is much simpler, faster and more secure.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'spree_legacy_api_v2'
+```
+
+And run the following command:
+
+```bash
+bundle exec rake spree_legacy_api_v2:install
+```
+
+This will install the database migrations and run them.
+
+## Migration Guide
+
+### Storefront API
+
+The new Store API v3 provides similar functionality with improved consistency:
+
+| Legacy v2 Endpoint | New v3 Endpoint |
+|-------------------|-----------------|
+| `GET /api/v2/storefront/products` | `GET /api/v3/store/products` |
+| `GET /api/v2/storefront/cart` | `GET /api/v3/store/orders/:id` |
+| `POST /api/v2/storefront/cart/add_item` | `POST /api/v3/store/orders/:id/line_items` |
+| `GET /api/v2/storefront/account` | `GET /api/v3/store/customers` |
+
+### Key Differences
+
+1. **Serialization**: API v3 uses Alba serializers (faster, simpler) instead of JSONAPI::Serializer
+2. **Response Format**: API v3 returns simple JSON objects instead of JSONAPI format
+3. **Authentication**: API v3 requires publishable key authentication for Store API and uses JWT tokens for user authentication
+4. **TypeScript Types**: API v3 automatically generates TypeScript types via Typelizer
+
+## License
+
+Spree is released under the [AGPL-3.0-or-later](https://www.gnu.org/licenses/agpl-3.0.html) and [BSD-3-Clause](https://opensource.org/licenses/BSD-3-Clause) licenses.

data/Rakefile

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'bundler'
+Bundler::GemHelper.install_tasks
+
+require 'rspec/core/rake_task'
+require 'spree/testing_support/extension_rake'
+
+RSpec::Core::RakeTask.new
+
+task :default do
+  if Dir['spec/dummy'].empty?
+    Rake::Task[:test_app].invoke
+    Dir.chdir('../../')
+  end
+  Rake::Task[:spec].invoke
+end
+
+desc 'Generates a dummy app for testing'
+task :test_app do
+  ENV['LIB_NAME'] = 'spree_legacy_api_v2'
+  Rake::Task['extension:test_app'].invoke
+end

data/app/controllers/concerns/spree/api/v2/caching.rb

@@ -0,0 +1,40 @@
+module Spree
+  module Api
+    module V2
+      module Caching
+        extend ActiveSupport::Concern
+
+        def collection_cache_key(collection)
+          params.delete(:page) if params[:page] == 1
+
+          cache_key_parts = [
+            collection.cache_key_with_version,
+            resource_includes,
+            sparse_fields,
+            serializer_params_cache_key,
+            params[:sort]&.strip,
+            params[:page]&.to_s&.strip,
+            params[:per_page]&.to_s&.strip,
+          ]
+          cache_key_parts += additional_cache_key_parts if defined?(additional_cache_key_parts)
+          cache_key_parts = cache_key_parts.flatten.join('-')
+
+          Digest::MD5.hexdigest(cache_key_parts)
+        end
+
+        def collection_cache_opts
+          {
+            namespace: Spree::Api::Config[:api_v2_collection_cache_namespace],
+            expires_in: Spree::Api::Config[:api_v2_collection_cache_ttl],
+          }
+        end
+
+        def serializer_params_cache_key
+          serializer_params.values.map do |param|
+            param.try(:cache_key) || param.try(:flatten).try(:join, '-') || param.try(:to_s)
+          end.compact.join('-')
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v2/coupon_codes_helper.rb

@@ -0,0 +1,29 @@
+module Spree
+  module Api
+    module V2
+      module CouponCodesHelper
+        def select_coupon_codes
+          params[:coupon_code].present? ? [params[:coupon_code]] : check_coupon_codes
+        end
+
+        def check_coupon_codes
+          spree_current_order.promotions.coupons.map(&:code)
+        end
+
+        def select_error(coupon_codes)
+          result = coupon_handler.new(spree_current_order).remove(coupon_codes.first)
+          result.error
+        end
+
+        def select_errors(coupon_codes)
+          results = []
+          coupon_codes.each do |coupon_code|
+            results << coupon_handler.new(spree_current_order).remove(coupon_code)
+          end
+
+          results.select(&:error)
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v2/number_resource.rb

@@ -0,0 +1,11 @@
+module Spree
+  module Api
+    module V2
+      module NumberResource
+        def resource
+          @resource ||= scope.find_by(number: params[:id]) || scope.find(params[:id])
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v2/platform/nested_set_reposition_concern.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V2
+      module Platform
+        module NestedSetRepositionConcern
+          def reposition
+            spree_authorize! :update, resource if spree_current_user.present?
+
+            @new_parent = scope.find(permitted_resource_params[:new_parent_id])
+            new_index = permitted_resource_params[:new_position_idx].to_i
+
+            if resource.move_to_child_with_index(@new_parent, new_index)
+              # If successful reposition call the custom method for handling success.
+              successful_reposition_actions
+            elsif resource.errors.any?
+              # If there are errors output them to the response
+              render_error_payload(resource.errors.full_messages.to_sentence)
+            else
+              # If the user drops the re-positioned item in the same location it came from
+              # we just render the serialized payload, nothing has changed, we don't need to
+              # render any errors, or fire any custom success methods.
+              render_serialized_payload { serialize_resource(resource) }
+            end
+          end
+
+          private
+
+          def successful_reposition_actions
+            # Call a separate method for a successful reposition so this can be easily overridden
+            # if a more complex set of events need to occur after a successful reposition.
+            render_serialized_payload { serialize_resource(resource) }
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v2/platform/promotion_calculator_params.rb

@@ -0,0 +1,17 @@
+module Spree
+  module Api
+    module V2
+      module Platform
+        module PromotionCalculatorParams
+          private
+
+          def calculator_params
+            [:preferred_flat_percent, :preferred_amount, :preferred_first_item, :preferred_additional_item,
+             :preferred_max_items, :preferred_percent, :preferred_minimal_amount, :preferred_normal_amount,
+             :preferred_discount_amount, :preferred_currency, :preferred_base_amount, :preferred_base_percent, { preferred_tiers: {} }]
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v2/platform/promotion_rule_params.rb

@@ -0,0 +1,16 @@
+module Spree
+  module Api
+    module V2
+      module Platform
+        module PromotionRuleParams
+          private
+
+          def rule_params
+            [:preferred_match_policy, :preferred_country_id, :preferred_amount_min, :preferred_operator_min, :preferred_amount_max,
+             :preferred_operator_max, { taxon_ids: [], user_ids: [], product_ids: [], preferred_eligible_values: {} }]
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v2/product_list_includes.rb

@@ -0,0 +1,21 @@
+module Spree
+  module Api
+    module V2
+      # These includes are not picked automatically by ar_lazy_preload gem so we need to specify them manually.
+      module ProductListIncludes
+        def product_list_includes
+          {
+            option_types: [],
+            product_properties: [],
+            metafields: [],
+            variant_images: [],
+            tags: [],
+            taxons: [:taxonomy],
+            master: [:prices, :images, { stock_items: :stock_location }, metafields: [], option_values: []],
+            variants: [:prices, :images, { stock_items: :stock_location }, metafields: [], option_values: []]
+          }
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v2/storefront/metadata_controller_concern.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module MetadataControllerConcern
+          protected
+
+          def ensure_valid_metadata
+            if params[:public_metadata].present? && !params[:public_metadata].is_a?(ActionController::Parameters) ||
+                params[:private_metadata].present? && !params[:private_metadata].is_a?(ActionController::Parameters)
+              render_error_payload(I18n.t(:invalid_params, scope: 'spree.api.v2.metadata'))
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v2/storefront/order_concern.rb

@@ -0,0 +1,49 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module OrderConcern
+          private
+
+          def render_order(result)
+            if result.success?
+              render_serialized_payload { serialized_current_order }
+            else
+              render_error_payload(result.error&.value || result.value)
+            end
+          end
+
+          def ensure_order
+            raise ActiveRecord::RecordNotFound if spree_current_order.nil?
+          end
+
+          def order_token
+            request.headers['X-Spree-Order-Token'] || params[:order_token]
+          end
+
+          def spree_current_order
+            @spree_current_order ||= find_spree_current_order
+          end
+
+          def find_spree_current_order
+            Spree.api.storefront_current_order_finder.new.execute(
+              store: current_store,
+              user: spree_current_user,
+              token: order_token,
+              currency: current_currency
+            )
+          end
+
+          def serialized_current_order
+            serialize_resource(spree_current_order)
+          end
+
+          def serialize_order(order)
+            Spree::Deprecation.warn('OrderConcern#serialize_order is deprecated and will be removed in Spree 5.5. Please use `serialize_resource` method')
+            serialize_resource(order)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/oauth_applications_controller.rb

@@ -0,0 +1,23 @@
+module Spree
+  module Admin
+    class OauthApplicationsController < ResourceController
+      include Spree::Admin::SettingsConcern
+
+      before_action :set_default_scopes, only: [:new, :edit]
+
+      private
+
+      def create_turbo_stream_enabled?
+        true
+      end
+
+      def set_default_scopes
+        @object.scopes = 'admin' if @object.scopes.blank?
+      end
+
+      def permitted_resource_params
+        params.require(:oauth_application).permit(:name, :scopes)
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/base_controller.rb

@@ -0,0 +1,233 @@
+module Spree
+  module Api
+    module V2
+      class BaseController < ActionController::API
+        include ActiveStorage::SetCurrent
+        include CanCan::ControllerAdditions
+        include Spree::Core::ControllerHelpers::StrongParameters
+        include Spree::Core::ControllerHelpers::Store
+        include Spree::Core::ControllerHelpers::Locale
+        include Spree::Core::ControllerHelpers::Currency
+
+        rescue_from ActiveRecord::RecordNotFound, with: :record_not_found
+        rescue_from CanCan::AccessDenied, with: :access_denied
+        rescue_from Doorkeeper::Errors::DoorkeeperError, with: :access_denied_401
+        rescue_from Spree::Core::GatewayError, with: :gateway_error
+        rescue_from ActionController::ParameterMissing, with: :error_during_processing
+        if defined?(JSONAPI::Serializer::UnsupportedIncludeError)
+          rescue_from JSONAPI::Serializer::UnsupportedIncludeError, with: :error_during_processing
+        end
+        rescue_from ArgumentError, with: :error_during_processing
+        rescue_from ActionDispatch::Http::Parameters::ParseError, with: :error_during_processing
+
+        # Returns the content type for the API
+        # @return [String] The content type, eg 'application/vnd.api+json'
+        def content_type
+          Spree::Api::Config[:api_v2_content_type]
+        end
+
+        protected
+
+        def serialize_collection(collection)
+          collection_serializer.new(
+            collection,
+            collection_options(collection).merge(params: serializer_params)
+          ).serializable_hash
+        end
+
+        def serialize_resource(resource)
+          resource_serializer.new(
+            resource,
+            params: serializer_params,
+            include: resource_includes,
+            fields: sparse_fields
+          ).serializable_hash
+        end
+
+        # Returns a paginated collection
+        # @return [Array] The paginated collection
+        def paginated_collection
+          @paginated_collection ||= collection_paginator.new(sorted_collection, params).call
+        end
+
+        # Returns the collection paginator
+        # @return [Class] The collection paginator class, default is Spree::Shared::Paginate
+        def collection_paginator
+          Spree.api.storefront_collection_paginator
+        end
+
+        # Renders a serialized payload with the given status code
+        # @param status [Integer] HTTP status code to return, eg 200, 201, 204
+        # @yield [Hash] The serialized data to render
+        def render_serialized_payload(status = 200)
+          render json: yield, status: status, content_type: content_type
+        end
+
+        # Renders a serialized error payload with the given status code
+        # @param status [Integer] HTTP status code to return
+        # @yield [Hash] The serialized data to render
+        def render_error_payload(error, status = 422)
+          json = if error.is_a?(ActiveModel::Errors)
+                   { error: error.full_messages.to_sentence, errors: error.messages }
+                 elsif error.is_a?(Struct)
+                   { error: error.to_s, errors: error.to_h }
+                 else
+                   { error: error }
+                 end
+
+          render json: json, status: status, content_type: content_type
+        end
+
+        # Renders a serialized result payload with the given status code
+        # @param result [Object] The result to render
+        # @param ok_status [Integer] HTTP status code to return if the result is successful, eg 200, 201, 204
+        def render_result(result, ok_status = 200)
+          if result.success?
+            render_serialized_payload(ok_status) { serialize_resource(result.value) }
+          else
+            render_error_payload(result.error)
+          end
+        end
+
+        # Returns the current Spree user
+        # @return [Spree.user_class] The current Spree user
+        def spree_current_user
+          return nil unless doorkeeper_token
+          return @spree_current_user if defined?(@spree_current_user)
+
+          @spree_current_user ||= ActiveRecord::Base.connected_to(role: :writing) do
+            doorkeeper_authorize!
+            doorkeeper_token.resource_owner
+          end
+        end
+
+        alias try_spree_current_user spree_current_user  # for compatibility with spree_legacy_frontend
+
+        # Authorizes the current Spree user for the given action and subject
+        # @param action [Symbol] The action to authorize
+        # @param subject [Object] The subject to authorize
+        # @param args [Array] Additional arguments to pass to the authorize! method
+        # @return [void]
+        def spree_authorize!(action, subject, *args)
+          authorize!(action, subject, *args)
+        end
+
+        # Raises an AccessDenied error if the current Spree user is nil
+        # @raise [CanCan::AccessDenied] If the current Spree user is nil
+        def require_spree_current_user
+          raise CanCan::AccessDenied if spree_current_user.nil?
+        end
+
+        # Needs to be overridden so that we use Spree's Ability rather than anyone else's.
+        def current_ability
+          @current_ability ||= Spree.ability_class.new(spree_current_user, ability_options)
+        end
+
+        # this method can be extended in extensions or developer applications
+        # @return [Hash] The ability options
+        def ability_options
+          { store: current_store }
+        end
+
+        # Returns the requested includes
+        # @return [Array] The requested includes
+        def request_includes
+          # if API user wants to receive only the bare-minimum
+          # the API will return only the main resource without any included
+          if params[:include]&.blank?
+            []
+          elsif params[:include].present?
+            params[:include].split(',')
+          end
+        end
+
+        # Returns the resource includes, useful to avoid N+1 queries
+        # @return [Array] The resource includes, eg [:images, :variants]
+        def resource_includes
+          (request_includes || default_resource_includes).map(&:intern)
+        end
+
+        # overwrite this method in your controllers to set JSON API default include value
+        # https://jsonapi.org/format/#fetching-includes
+        # eg.:
+        # %w[images variants]
+        # ['variant.images', 'line_items']
+        def default_resource_includes
+          []
+        end
+
+        # Returns the JSON API sparse fields
+        # @return [Hash] The sparse fields, eg { product: [:name, :description] }
+        def sparse_fields
+          return unless params[:fields]&.respond_to?(:each)
+
+          fields = {}
+          params[:fields].
+            select { |_, v| v.is_a?(String) }.
+            each { |type, values| fields[type.intern] = values.split(',').map(&:intern) }
+          fields.presence
+        end
+
+        # Returns the serializer global params
+        # all of these params are passed down to the serializer
+        # @return [Hash] The serializer params
+        def serializer_params
+          {
+            currency: current_currency,
+            locale: current_locale,
+            price_options: current_price_options,
+            store: current_store,
+            user: spree_current_user,
+            image_transformation: params[:image_transformation],
+            taxon_image_transformation: params[:taxon_image_transformation]
+          }
+        end
+
+        # Renders a 404 error payload
+        # @param exception [Exception] The exception to render
+        # @return [void]
+        def record_not_found(exception)
+          Rails.error.report(exception, context: { user_id: spree_current_user&.id }, source: 'spree.api')
+
+          render_error_payload(I18n.t(:resource_not_found, scope: 'spree.api'), 404)
+        end
+
+        # Renders a 403 error payload
+        # @param exception [Exception] The exception to render
+        # @return [void]
+        def access_denied(exception)
+          Rails.error.report(exception, context: { user_id: spree_current_user&.id }, source: 'spree.api')
+
+          render_error_payload(exception.message, 403)
+        end
+
+        # Renders a 401 error payload
+        # @param exception [Exception] The exception to render
+        # @return [void]
+        def access_denied_401(exception)
+          render_error_payload(exception.message, 401)
+        end
+
+        # Renders a 500 error payload when a payment gateway error occurs
+        # @param exception [Exception] The exception to render
+        # @return [void]
+        def gateway_error(exception)
+          Rails.error.report(exception, context: { user_id: spree_current_user&.id }, source: 'spree.api')
+
+          render_error_payload(exception.message)
+        end
+
+        # Renders a 400 error payload when an error occurs during parameter parsing
+        # @param exception [Exception] The exception to render
+        # @return [void]
+        def error_during_processing(exception)
+          Rails.error.report(exception, context: { user_id: spree_current_user&.id }, source: 'spree.api')
+
+          message = exception.respond_to?(:original_message) ? exception.original_message : exception.message
+
+          render_error_payload(message, 400)
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/data_feeds/google_controller.rb

@@ -0,0 +1,24 @@
+module Spree
+  module Api
+    module V2
+      module DataFeeds
+        class GoogleController < ::Spree::Api::V2::BaseController
+          def rss_feed
+            send_data data_feeds_google_rss_service.value[:file], filename: 'products.rss', type: 'text/xml'
+          end
+
+          private
+
+          def settings
+            @settings ||= Spree::DataFeed::Google.find_by!(store: current_store, slug: params[:slug], active: true)
+          end
+
+          def data_feeds_google_rss_service
+            Spree.data_feeds_google_rss_service.new.call(settings)
+          end
+        end
+      end
+    end
+  end
+end
+

data/app/controllers/spree/api/v2/platform/addresses_controller.rb

@@ -0,0 +1,23 @@
+module Spree
+  module Api
+    module V2
+      module Platform
+        class AddressesController < ResourceController
+          private
+
+          def model_class
+            Spree::Address
+          end
+
+          def scope_includes
+            [:country, :state, :user]
+          end
+
+          def resource_serializer
+            Spree.api.platform_address_serializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/platform/adjustments_controller.rb

@@ -0,0 +1,23 @@
+module Spree
+  module Api
+    module V2
+      module Platform
+        class AdjustmentsController < ResourceController
+          private
+
+          def model_class
+            Spree::Adjustment
+          end
+
+          def scope_includes
+            [:order, :adjustable]
+          end
+
+          def resource_serializer
+            Spree.api.platform_adjustment_serializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/platform/classifications_controller.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Api
+    module V2
+      module Platform
+        class ClassificationsController < ResourceController
+          private
+
+          def model_class
+            Spree::Classification
+          end
+
+          def scope_includes
+            [
+              taxon: [],
+              product: [:variants_including_master, :master, { variants: [:prices] }]
+            ]
+          end
+
+          def resource_serializer
+            Spree.api.platform_classification_serializer
+          end
+        end
+      end
+    end
+  end
+end