Module: Spree::Api::V2::BaseControllerDecorator

Defined in:
app/controllers/spree/api/v2/base_controller_decorator.rb

Overview

Single enforcement point for blocked users on the API. Every authenticated v2 endpoint - storefront, tenant, organizer, platform - resolves its user through Spree::Api::V2::BaseController#spree_current_user, so guarding here covers them all, including the controllers that inherit BaseController directly rather than ResourceController.

403 rather than 401: the token is valid and the caller is authenticated, they are simply not allowed anymore. A 401 would tell clients to refresh the token, which would loop.

Constant Summary collapse

BLOCKED_ERROR =

Machine-readable, not translated, so clients can branch on it the same way they already branch on the authenticators' account_temporarily_deleted.

'account_blocked'.freeze

Class Method Summary collapse

Class Method Details

.prepended(base) ⇒ Object 



17
18
19
 
# File 'app/controllers/spree/api/v2/base_controller_decorator.rb', line 17

def self.prepended(base)
  base.before_action :reject_blocked_user
end