POST /api/v1/checkout/ always converted the customer's entire
multi-store cart into orders. Add an optional store_uuids field to
CheckoutSerializer — when given, checkout() only processes those
stores' cart groups and only clears their items, leaving the rest of
the cart intact for a later checkout. Omitted, behavior is unchanged
(whole cart checks out).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
checkout() decrements stock_quantity/increments sold_count per order
item, but cancellation never reversed it, so a cancelled order's stock
stayed permanently reduced. Add _restock_order_items(), called from
_transition() on the CANCELLED transition, using F() expressions to
reverse both counters atomically; wrap _transition() itself in
@transaction.atomic so the status change and restock can't partially
apply.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Seller sets this at registration (default 60 min). Exposed on store
list/detail, the seller's own store, cart groups (GET /api/v1/cart/),
and order/order-group responses, so the checkout page's estimated
delivery time no longer needs a frontend mock.
Also document CartSerializer's groups/grand_total for swagger (were
untyped SerializerMethodFields showing as opaque strings) since that's
the endpoint carrying this new field to the checkout page.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Several views using IsAuthenticatedOrTokenMatchesOASRequirements were
missing scope entries for methods they actually expose (GET on
list/retrieve-only viewsets, PUT/PATCH/DELETE on ModelViewSets), and
two had a stale POST entry for a method that doesn't exist
(SellerStoreWorkingHoursView, OrderGroupViewSet). Fixes:
- SellerStoreView, SellerStoreWorkingHoursView (apps/stores/views.py)
- AddressViewSet (apps/locations/views.py)
- SellerReviewViewSet (apps/reviews/views.py)
- SellerProductViewSet (apps/catalog/views.py)
- OrderGroupViewSet, OrderViewSet, SellerOrderViewSet,
NotificationViewSet (apps/orders/views.py)
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
CartItemView was registered on both /cart/items/ and
/cart/items/{item_uuid}/, so swagger listed POST/PATCH/DELETE on both
paths even though 3 of those 6 combinations raised a TypeError at
runtime (missing/unexpected item_uuid). Split into CartItemView (POST,
list path) and CartItemDetailView (PATCH/DELETE, detail path).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
django-filter was already installed and set as DEFAULT_FILTER_BACKENDS
but unused everywhere. Replace hand-rolled get_queryset filtering with
FilterSet classes (stores/catalog/locations/reviews) and
filterset_fields (orders status). drf-spectacular auto-documents these
for swagger, so the manual OpenApiParameter declarations for the
migrated fields are removed (stores keeps lat/lng manual since
geo-distance isn't a plain filter).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Django 6 + DRF resource server against the Gooyal accounts OAuth2 service,
matching the Winsoo ecosystem's conventions. Covers locations, stores,
catalog, cart, checkout/orders (with the multi-store-cart split and the
status stepper), reviews, and notifications, plus a demo-data seed command.
Payment integration (wallet debits, online gateway, seller payouts) is
intentionally left out here — see feature/payment.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
