spree_square 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e77dabce99dbae4bf55167dc863b5f8a01f49cdeeff5bdd1cf05b34ef55773f
-  data.tar.gz: '0709cf13b8ba11aecacae6314937acde7d98994a4f62982dbbcc5d37c120785b'
+  metadata.gz: 199628697d1e2ef689462c4e4895ec7a90a271e5663cb3de8777533b15cdee50
+  data.tar.gz: 4d0137620c684345e4c4fa32bc8b75381d45e4992f773174a60ea0009ab4d55b
 SHA512:
-  metadata.gz: a3290d9b771ac252b623f0180a1a8e16f5b7e679172cf9c2690c664b6129cde31e3eec13dd8f413f8f1bf85334755e00a04fd3b71eb89e895e1a0eb1cb5afe2e
-  data.tar.gz: 777e7a21465fd95d3e5e32eaeacc4a270f17be68a1e752ec7f5414794e338b0ae96ccae17eec73b73e0ee60105e4763da42672a7026cded812959fe8656bb171
+  metadata.gz: 96d1f3c46e20844a731be1d12a1616b2cd9f06d1be0160122615f491b5fc40ce6a0e865cb14eeb373c93b1c1e3f5e8fa460d0933c978f93fcc380d53576aabc7
+  data.tar.gz: 072bdfa3d7dee63493118d655ffaaa3df3e55cf9dc4dcddf39b6cb006057ef52218a2851f6444a2ea461de5bcaab3ef8c82edc36e8a589501ffa20defbe592df

data/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to this project are documented here.
 
+## 0.1.2
+
+- Two new demo menu items (a build-your-own bowl with stacked modifier lists, a combo meal with
+  entree/drink/side) with real Square modifier lists — the first end-to-end proof the modifier
+  system renders against real Square catalog data, not just specs.
+- Fixed a real bug: removing a modifier-bearing line item from the cart raised a foreign-key
+  violation (`spree_square_line_item_modifiers` had no `dependent: :destroy`).
+- Fixed a real bug: the Square Orders / Square Webhooks admin pages 500'd
+  (`undefined method 'new_admin_square_order_mapping_url'`) the moment either table was empty —
+  `Spree.admin.tables.register` defaults to expecting a `:new` route that doesn't exist on these
+  read-only, index-only resources. Added `new_resource: false` to both.
+- Fixed a real bug: installing on MySQL couldn't even run migrations — MySQL rejects a literal
+  `DEFAULT` value on `JSON`/`TEXT`/`BLOB` columns outright, which canceled every migration after
+  `CreateSpreeSquareWebhookEvents`/`CreateSpreeSquareCredentials` in migration order. Moved both
+  defaults (`WebhookEvent#payload`, `Credential#scopes`) to the model layer instead, verified
+  against a real MySQL 8.0 database.
+- Fixed a Brakeman warning: `WebhooksController` never actually had `protect_from_forgery`
+  configured (it doesn't inherit the host app's `ApplicationController`). Added it explicitly
+  with `:null_session` — correct for a signature-verified webhook endpoint with no session to
+  protect; `:exception` would break every real webhook delivery.
+
 ## 0.1.1
 
 - OAuth now requests `PAYMENTS_READ` in addition to the existing scopes. Without it, reading

data/app/controllers/spree_square/webhooks_controller.rb

@@ -4,7 +4,15 @@ module SpreeSquare
   # work synchronously: verify, record, ack, hand off to a job. Square treats
   # a slow or non-2xx response as a delivery failure and retries.
   class WebhooksController < ActionController::Base
-    skip_before_action :verify_authenticity_token, raise: false
+    # Explicit, not just `skip_before_action :verify_authenticity_token` —
+    # this controller doesn't inherit the host app's ApplicationController
+    # (which is where `protect_from_forgery` normally gets declared), so
+    # Brakeman's ForgerySetting check correctly flags it as never actually
+    # configured either way. `:null_session` degrades a forged/missing
+    # token to an empty session instead of raising — appropriate here since
+    # this endpoint is Square-signature-verified, not session-authenticated,
+    # so there's no session to protect in the first place.
+    protect_from_forgery with: :null_session
 
     def create
       raw_body = request.raw_post

data/app/models/spree/line_item_decorator.rb

@@ -5,6 +5,17 @@ module Spree
   # SpreeSquare-prefixed one) means nothing ever triggers loading this file
   # at all, silently, since nothing references the name Zeitwerk expects.
   module LineItemDecorator
+    def self.prepended(base)
+      # No `dependent: :destroy` here originally meant removing a line item
+      # that had modifier selections hit a foreign-key violation instead of
+      # actually removing it (spree_square_line_item_modifiers.line_item_id
+      # has no ON DELETE behavior beyond Postgres's RESTRICT default) — only
+      # surfaced once a real modifier-bearing item was added to a cart and
+      # then removed, which nothing exercised before.
+      base.has_many :square_line_item_modifiers, class_name: 'SpreeSquare::LineItemModifier',
+                                                   foreign_key: 'line_item_id', dependent: :destroy
+    end
+
     # Transient carrier for selected modifier ids from add-to-cart through to
     # SpreeSquare::Cart::AddItem, which reads it right after `super` to build
     # the persistent LineItemModifier snapshot rows. Never persisted itself —

data/app/models/spree_square/credential.rb

@@ -17,6 +17,13 @@ module SpreeSquare
 
     belongs_to :store, class_name: 'Spree::Store'
 
+    # Ruby-level, not a DB-level `default: []` on the migration — MySQL
+    # rejects a literal DEFAULT on a JSON column outright (see that
+    # migration's own comment). The :square_credential factory relies on
+    # this (never sets `scopes` explicitly), so it has to actually default
+    # to an empty array, not just avoid raising.
+    attribute :scopes, default: -> { [] }
+
     encrypts :access_token, :refresh_token
 
     validates :store, presence: true, uniqueness: true

data/app/models/spree_square/webhook_event.rb

@@ -5,6 +5,11 @@ module SpreeSquare
   class WebhookEvent < Spree.base_class
     self.table_name = 'spree_square_webhook_events'
 
+    # Ruby-level, not a DB-level `default: {}` on the migration — MySQL
+    # rejects a literal DEFAULT on a JSON column outright (see that
+    # migration's own comment). This works identically on every adapter.
+    attribute :payload, default: -> { {} }
+
     validates :square_event_id, presence: true, uniqueness: true
     validates :event_type, presence: true
 

data/config/brakeman.ignore

@@ -0,0 +1,28 @@
+{
+  "ignored_warnings": [
+    {
+      "warning_type": "Cross-Site Request Forgery",
+      "warning_code": 86,
+      "fingerprint": "1bed78a0df37b0520a169a67b62ba7df8b4af42e6f12844ac923bfde7958fc14",
+      "check_name": "ForgerySetting",
+      "message": "`protect_from_forgery` should be configured with `with: :exception`",
+      "file": "app/controllers/spree_square/webhooks_controller.rb",
+      "line": 15,
+      "link": "https://brakemanscanner.org/docs/warning_types/cross-site_request_forgery/",
+      "code": "protect_from_forgery(:with => :null_session)",
+      "render_path": null,
+      "location": {
+        "type": "controller",
+        "controller": "SpreeSquare::WebhooksController"
+      },
+      "user_input": null,
+      "confidence": "Medium",
+      "cwe_id": [
+        352
+      ],
+      "note": "Intentional, not a false positive to fix: this is a webhook endpoint authenticated by Square's HMAC signature (SpreeSquare::WebhookVerifier), not by a Rails session, so there's no session-based state for CSRF to protect in the first place. `:exception` (Brakeman's preferred default) would make every legitimate webhook POST raise ActionController::InvalidAuthenticityToken, since Square never sends a Rails CSRF token — that would break the endpoint entirely, not harden it. `:null_session` is the correct, standard Rails pattern for an unauthenticated-by-session API/webhook endpoint."
+    }
+  ],
+  "updated": "2026-08-13 23:32:22 +0530",
+  "brakeman_version": "8.0.5"
+}

data/config/initializers/spree_admin_square_tables.rb

@@ -1,5 +1,13 @@
 Rails.application.config.after_initialize do
-  Spree.admin.tables.register(:square_order_mappings, model_class: SpreeSquare::OrderMapping, search_param: :square_order_id_cont)
+  # new_resource: false — read-only support/diagnostic tables (no
+  # `:new`/`:create` route exists; only: [:index] in config/routes.rb). The
+  # default (true) crashes with a routing error the moment the table is
+  # ever empty, because the "no resource found" empty-state partial builds
+  # a `new_object_url` link unconditionally unless told not to. Found live
+  # via the sibling spree_doordash gem's own admin pages, which hit the
+  # same bug and fixed it in spree_admin_doordash_tables.rb.
+  Spree.admin.tables.register(:square_order_mappings, model_class: SpreeSquare::OrderMapping,
+                                                        search_param: :square_order_id_cont, new_resource: false)
 
   Spree.admin.tables.square_order_mappings.add :order_number,
     label: :order,
@@ -42,7 +50,8 @@ Rails.application.config.after_initialize do
     default: true,
     position: 50
 
-  Spree.admin.tables.register(:square_webhook_events, model_class: SpreeSquare::WebhookEvent, search_param: :event_type_cont)
+  Spree.admin.tables.register(:square_webhook_events, model_class: SpreeSquare::WebhookEvent,
+                                                        search_param: :event_type_cont, new_resource: false)
 
   Spree.admin.tables.square_webhook_events.add :event_type,
     label: :event_type,

data/db/migrate/20260809140001_create_spree_square_webhook_events.rb

@@ -12,7 +12,17 @@ class CreateSpreeSquareWebhookEvents < ActiveRecord::Migration[8.1]
       # JSON querying — application code only ever reads/writes it as a
       # plain Ruby hash, so the Postgres jsonb-vs-json performance distinction
       # doesn't apply.
-      t.json :payload, null: false, default: {}
+      #
+      # No `default: {}` here — MySQL rejects a literal DEFAULT on
+      # BLOB/TEXT/GEOMETRY/JSON columns outright ("BLOB, TEXT, GEOMETRY or
+      # JSON column 'payload' can't have a default value"), which silently
+      # canceled every migration after this one in CI's MySQL job — every
+      # spree_square_* table after this one in migration order was just
+      # missing. Found via a real MySQL CI failure, not from docs. The
+      # default now lives on the model instead (see WebhookEvent's own
+      # `attribute :payload, default: -> { {} }`), which works identically
+      # across every adapter.
+      t.json :payload, null: false
       t.datetime :processed_at
       t.string :status, null: false, default: 'pending' # pending, processed, failed
       t.text :error_message

data/db/migrate/20260810180001_create_spree_square_credentials.rb

@@ -18,7 +18,14 @@ class CreateSpreeSquareCredentials < ActiveRecord::Migration[8.1]
       t.datetime :refresh_token_expires_at
       # `t.json`, not `t.jsonb`/`array: true` — the extension's own dummy
       # app (spec/dummy) runs on SQLite, which supports neither.
-      t.json :scopes, default: [], null: false
+      #
+      # No `default: []` here — MySQL rejects a literal DEFAULT on JSON
+      # columns entirely, which canceled every migration after this one in
+      # CI's MySQL job. Default now lives on the model instead (see
+      # Credential's own `attribute :scopes, default: -> { [] }`) — the
+      # :square_credential factory relies on this default (never sets
+      # `scopes` explicitly), so this had to move, not just disappear.
+      t.json :scopes, null: false
 
       t.timestamps
     end

data/lib/spree_square/version.rb

@@ -1,5 +1,5 @@
 module SpreeSquare
-  VERSION = '0.1.1'.freeze
+  VERSION = '0.1.2'.freeze
 
   def gem_version
     Gem::Version.new(VERSION)

data/lib/tasks/spree_square_demo.rake

@@ -59,6 +59,42 @@ namespace :spree_square do
     menu.each do |category_name, items|
       items.each do |item|
         item_temp_id = "#item-#{item['image_slug']}"
+
+        # Modifier lists (Square has no true nested-modifier concept — a
+        # "build your own" item is just several independent modifier lists
+        # stacked on one item, each its own CatalogObject nested inline the
+        # same way ITEM_VARIATION is nested under item_data.variations
+        # above). modifier_list_info is what actually attaches a list to
+        # this item; the MODIFIER_LIST objects themselves go in the same
+        # top-level `objects` array as everything else in the batch.
+        modifier_list_info = Array(item['modifier_lists']).map.with_index do |mod_list, list_index|
+          list_temp_id = "#{item_temp_id}-modlist-#{list_index}"
+          objects << {
+            type: 'MODIFIER_LIST',
+            id: list_temp_id,
+            modifier_list_data: {
+              name: mod_list['name'],
+              selection_type: mod_list['selection_type'],
+              modifiers: mod_list['options'].map.with_index do |option, option_index|
+                {
+                  type: 'MODIFIER',
+                  id: "#{list_temp_id}-opt-#{option_index}",
+                  modifier_data: {
+                    name: option['name'],
+                    price_money: { amount: option['price_cents'], currency: 'USD' }
+                  }
+                }
+              end
+            }
+          }
+          {
+            modifier_list_id: list_temp_id,
+            min_selected_modifiers: mod_list['min_selected'],
+            max_selected_modifiers: mod_list['max_selected'],
+            enabled: true
+          }
+        end
+
         objects << {
           type: 'ITEM',
           id: item_temp_id,
@@ -82,8 +118,9 @@ namespace :spree_square do
                   price_money: { amount: item['price_cents'], currency: 'USD' }
                 }
               }
-            ]
-          }
+            ],
+            modifier_list_info: modifier_list_info
+          }.compact_blank
         }
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_square
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Amit Solanki
@@ -164,6 +164,7 @@ files:
 - app/views/spree/admin/square_webhook_events/index.html.erb
 - bin/importmap
 - bin/rails
+- config/brakeman.ignore
 - config/importmap.rb
 - config/initializers/spree.rb
 - config/initializers/spree_admin_square_navigation.rb