Class: SpreeCmCommissioner::PrivateSales::Authorize

Inherits:
Object
  • Object
show all
Extended by:
ServiceModuleThrowable
Includes:
Spree::ServiceModule::Base
Defined in:
app/services/spree_cm_commissioner/private_sales/authorize.rb

Overview

The only place a private sale URL becomes permission.

success(PrivateSale) | failure(nil, :missing_token | :invalid_token | :unauthorized_user)

Every entry point calls this — the private sale products endpoint, the inventory items endpoint and DraftOrder::Create. Nothing else looks a token up, so there is exactly one place to audit.

Class Method Summary collapse

Instance Method Summary collapse

Methods included from ServiceModuleThrowable

call!

Class Method Details

.error_message(reason) ⇒ Object

The sentence for one of the failure reasons above. It lives here because this is the class that produces them — every caller renders the same three, and they had drifted into keeping their own identical copies of this lookup.

An unmapped reason falls back to the invalid-token sentence rather than surfacing a raw symbol: these strings are shown to buyers.



20
21
22
23
24
25
 
# File 'app/services/spree_cm_commissioner/private_sales/authorize.rb', line 20

def self.error_message(reason)
  I18n.t(
    "spree_cm_commissioner.private_sales.#{reason}",
    default: I18n.t('spree_cm_commissioner.private_sales.invalid_token')
  )
end

Instance Method Details

#call(token:, user: nil) ⇒ Object 



27
28
29
30
31
32
33
34
35
36
37
38
 
# File 'app/services/spree_cm_commissioner/private_sales/authorize.rb', line 27

def call(token:, user: nil)
  return failure(nil, :missing_token) if token.blank?

  private_sale = SpreeCmCommissioner::PrivateSale.find_by(token: token)

  # Unknown, revoked and expired deliberately report the SAME failure. A caller must not be
  # able to learn from the response whether a token they guessed at ever existed.
  return failure(nil, :invalid_token) if private_sale.nil? || !private_sale.usable?
  return failure(nil, :unauthorized_user) unless private_sale.authorizes?(user)

  success(private_sale)
end