close #953 upgrade to spree 4.6

Gemfile.lock

@@ -53,10 +53,9 @@ PATH
       rqrcode (~> 2.0)
       searchkick (~> 5.1)
       simple_calendar (~> 2.4)
-      spree (>= 4.5.0)
-      spree_api_v1 (>= 4.5.0)
-      spree_auth_devise (>= 4.5.0)
-      spree_backend (>= 4.5.0)
+      spree (>= 4.6.0)
+      spree_auth_devise (>= 4.6.0)
+      spree_backend (>= 4.6.0)
       spree_extension
       spree_multi_vendor (>= 2.4.1)
       telegram-bot
@@ -349,8 +348,11 @@ GEM
     flatpickr (4.6.13.0)
     font-awesome-sass (6.4.2)
       sassc (~> 2.0)
-    friendly_id (5.5.0)
+    friendly_id (5.4.2)
       activerecord (>= 4.0.0)
+    friendly_id-mobility (1.0.4)
+      friendly_id (>= 5.0.0, < 5.5)
+      mobility (>= 1.0.1, < 2.0)
     gapic-common (0.20.0)
       faraday (>= 1.9, < 3.a)
       faraday-retry (>= 1.0, < 3.a)
@@ -495,6 +497,12 @@ GEM
     mini_mime (1.1.5)
     mini_portile2 (2.8.4)
     minitest (5.20.0)
+    mobility (1.2.9)
+      i18n (>= 0.6.10, < 2)
+      request_store (~> 1.0)
+    mobility-ransack (1.2.2)
+      mobility (>= 1.0.1, < 2.0)
+      ransack (>= 1.8.0, < 5.0)
     monetize (1.12.0)
       money (~> 6.12)
     money (6.16.0)
@@ -557,8 +565,6 @@ GEM
     public_suffix (5.0.3)
     puma (6.4.0)
       nio4r (~> 2.0)
-    rabl (0.16.1)
-      activesupport (>= 2.3.14)
     racc (1.7.1)
     rack (2.2.8)
     rack-test (2.1.0)
@@ -606,6 +612,8 @@ GEM
     redis-client (0.17.0)
       connection_pool
     regexp_parser (2.8.2)
+    request_store (1.5.1)
+      rack (>= 1.4)
     responders (3.1.1)
       actionpack (>= 5.2)
       railties (>= 5.2)
@@ -703,26 +711,21 @@ GEM
     simplecov_json_formatter (0.1.4)
     simpleidn (0.2.1)
       unf (~> 0.1.4)
-    spree (4.5.3)
-      spree_api (= 4.5.3)
-      spree_cli (= 4.5.3)
-      spree_core (= 4.5.3)
-    spree_api (4.5.3)
+    spree (4.6.3)
+      spree_api (= 4.6.3)
+      spree_cli (= 4.6.3)
+      spree_core (= 4.6.3)
+    spree_api (4.6.3)
       bcrypt (~> 3.1)
       doorkeeper (~> 5.3)
       jsonapi-serializer (~> 2.1)
-      spree_core (= 4.5.3)
-    spree_api_v1 (4.5.0)
-      rabl (~> 0.14, >= 0.14.2)
-      responders
-      spree (>= 4.4.0.rc1)
-      spree_extension
+      spree_core (= 4.6.3)
     spree_auth_devise (4.6.0)
       devise (~> 4.7)
       devise-encryptable (= 0.2.0)
       spree_core (>= 4.5.0)
       spree_extension
-    spree_backend (4.5.1)
+    spree_backend (4.6.1)
       babel-transpiler (~> 0.7)
       bootstrap (~> 4.0)
       flag-icons-rails (~> 3.4)
@@ -736,35 +739,38 @@ GEM
       responders
       sass-rails (>= 5)
       select2-rails (~> 4.0.6)
-      spree (>= 4.4.0)
+      spree (>= 4.6.0)
       sprockets (~> 4.0)
       tinymce-rails (~> 5.0)
-    spree_cli (4.5.3)
+    spree_cli (4.6.3)
       thor (~> 1.0)
-    spree_core (4.5.3)
-      actionpack (>= 6.1)
-      actionview (>= 6.1)
+    spree_core (4.6.3)
+      actionpack (>= 6.1, < 7.1)
+      actionview (>= 6.1, < 7.1)
       active_storage_validations (~> 0.9, <= 0.9.5)
-      activejob (>= 6.1)
+      activejob (>= 6.1, < 7.1)
       activemerchant (~> 1.67)
-      activemodel (>= 6.1)
-      activerecord (>= 6.1)
+      activemodel (>= 6.1, < 7.1)
+      activerecord (>= 6.1, < 7.1)
       activerecord-typedstore
-      activestorage (>= 6.1)
-      activesupport (>= 6.1)
+      activestorage (>= 6.1, < 7.1)
+      activesupport (>= 6.1, < 7.1)
       acts_as_list (>= 0.8)
       auto_strip_attributes (~> 2.6)
       awesome_nested_set (~> 3.3, >= 3.3.1)
       cancancan (~> 3.2)
       carmen (>= 1.0)
       friendly_id (~> 5.2, >= 5.2.1)
+      friendly_id-mobility (~> 1.0.4)
       highline (~> 2.0)
       image_processing (~> 1.2)
       kaminari (~> 1.2)
+      mobility (~> 1.2.9)
+      mobility-ransack (~> 1.2.1)
       monetize (~> 1.9)
       money (~> 6.13)
       paranoia (~> 2.4)
-      railties (>= 6.1)
+      railties (>= 6.1, < 7.1)
       ransack (>= 2.3, < 3.0)
       rexml
       state_machines-activemodel (~> 0.7)

app/services/spree_cm_commissioner/webhooks/subscribers/handle_request_decorator.rb

@@ -9,7 +9,12 @@ def self.prepended(_base)
         # override
         def request
           @request ||=
-            SpreeCmCommissioner::Webhooks::Subscribers::MakeRequest.new(url: url, api_key: api_key, webhook_payload_body: body_with_event_metadata)
+            Spree::Webhooks::Subscribers::MakeRequest.new(
+              signature: event.signature_for(body_with_event_metadata),
+              url: url,
+              api_key: api_key,
+              webhook_payload_body: body_with_event_metadata
+            )
         end
       end
     end

app/services/spree_cm_commissioner/webhooks/subscribers/make_request.rb

@@ -6,16 +6,17 @@ module Subscribers
       class MakeRequest < Spree::Webhooks::Subscribers::MakeRequest
         attr_reader :api_key
 
-        def initialize(url:, api_key:, webhook_payload_body:)
+        def initialize(signature:, url:, api_key:, webhook_payload_body:)
           @api_key = api_key
-          super(url: url, webhook_payload_body: webhook_payload_body)
+          super(signature: signature, url: url, webhook_payload_body: webhook_payload_body)
         end
 
         def headers
           headers = {}
 
           headers['Content-Type'] = 'application/json'
           headers['X-Api-Key'] = api_key if api_key.present?
+          headers['X-Spree-Hmac-SHA256'] = @signature
 
           headers
         end

config/initializers/spree_permitted_attributes.rb

@@ -5,25 +5,28 @@ module PermittedAttributes
       from_date
       to_date
     ]
+
     @@user_attributes += %i[
       first_name
       last_name
       dob gender
       phone_number
       profile
     ]
+
     @@taxon_attributes += %i[
       category_icon
       custom_redirect_url
       to_date
       from_date kind
     ]
 
-    @@store_attributes = [
+    @@store_attributes += [
       :preferred_telegram_order_alert_chat_id,
       :preferred_telegram_order_request_alert_chat_id,
       { default_notification_image_attributes: {} }
     ]
+
     @@checkout_attributes += %i[
       phone_number
       country_code

lib/spree_cm_commissioner.rb

@@ -1,5 +1,4 @@
 require 'spree'
-require 'spree_api_v1'
 require 'spree_backend'
 require 'spree_auth_devise'
 require 'spree_multi_vendor'

spec/models/spree/webhooks/subscriber_spec.rb

@@ -25,6 +25,20 @@
     end
   end
 
+  describe '#secret_key' do
+    it 'does not generate secret_key on build' do
+      subscriber = build(:cm_webhook_subscriber)
+
+      expect(subscriber.secret_key).to be_nil
+    end
+
+    it 'generate secret_key on create' do
+      subscriber = create(:cm_webhook_subscriber)
+
+      expect(subscriber.secret_key).not_to be_nil
+    end
+  end
+
   describe '#matches?' do
     let(:order) { build(:order) }
     let(:rule1) { build(:cm_webhook_subscriber_order_vendors_rule) }

spec/services/spree/webhooks/subscribers/handle_request_spec.rb

@@ -0,0 +1,26 @@
+require "spec_helper"
+
+RSpec.describe Spree::Webhooks::Subscribers::HandleRequest do
+  let(:subscriber) { create(:cm_webhook_subscriber) }
+
+  describe '#request' do
+    subject { described_class.new(event_name: 'any.event', subscriber: subscriber, webhook_payload_body: '{"id": "fake"}') }
+
+    let(:fake_payload_body) { subject.send(:body_with_event_metadata) }
+    let(:event) { subject.send(:event) }
+
+    it 'construct make_request instance with singature' do
+      signature = event.signature_for(fake_payload_body)
+
+      expect(Spree::Webhooks::Subscribers::MakeRequest).to receive(:new)
+        .with(
+          signature: signature,
+          url: subscriber.url,
+          api_key: subscriber.api_key,
+          webhook_payload_body: fake_payload_body
+        )
+
+      subject.request
+    end
+  end
+end

spec/services/spree_cm_commissioner/webhooks/subscribers/make_request_spec.rb

@@ -0,0 +1,13 @@
+require "spec_helper"
+
+RSpec.describe SpreeCmCommissioner::Webhooks::Subscribers::MakeRequest do
+  describe '#headers' do
+    let(:request ) {  described_class.new(signature: 'fake-signature', url: 'fake-url.com/create', api_key: 'fake-api-key', webhook_payload_body: {"id": "fake"}) }
+
+    subject { request.headers }
+
+    it { is_expected.to include('Content-Type' => 'application/json') }
+    it { is_expected.to include('X-Api-Key' => 'fake-api-key') }
+    it { is_expected.to include('X-Spree-Hmac-SHA256' => 'fake-signature') }
+  end
+end

spree_cm_commissioner.gemspec

@@ -20,9 +20,8 @@ Gem::Specification.new do |s|
   s.require_path = 'lib'
   s.requirements << 'none'
 
-  spree_opts = '>= 4.5.0'
+  spree_opts = '>= 4.6.0'
   s.add_dependency 'spree', spree_opts
-  s.add_dependency 'spree_api_v1', spree_opts # latest spree_multi_vendor 2.4.0 still depends on the Spree v1 API
   s.add_dependency 'spree_auth_devise', spree_opts
   s.add_dependency 'spree_backend', spree_opts
   s.add_dependency 'spree_multi_vendor', '>= 2.4.1'