Module: SpreeCmCommissioner::AnonymousBookingGuard

Extended by:

ActiveSupport::Concern

Included in:

Spree::Api::V2::Storefront::DraftOrdersController, Spree::Api::V2::Storefront::IntercityTaxi::DraftOrdersController, Spree::Api::V2::Storefront::QueueDraftOrdersController, Spree::Api::V2::Storefront::Transit::DraftOrdersController, Spree::Api::V2::Tenant::DraftOrdersController, Spree::Api::V2::Tenant::IntercityTaxi::DraftOrdersController, Spree::Api::V2::Tenant::Transit::DraftOrdersController

Defined in:

app/controllers/concerns/spree_cm_commissioner/anonymous_booking_guard.rb

Overview

Draft-order endpoints let a request through with no spree_current_user so guests can book — but only for products that opt into that via Product#allow_anonymous_booking. Include in any draft-order controller and call ensure_anonymous_booking_allowed!(products) before doing any writes, so a request for a login-required product fails fast with 401 (the app can then re-authenticate/open login and retry) instead of creating an order no signed-in account owns.