How to permit parameters for Spree API?

Question

How do I permit parameters for a Spree API request?

I added a new parameter, :note, in the following file:

spree_api/app/helpers/spree/api/api_helpers.rb

Spree::Api::ApiHelpers.module_eval do
   @@order_attributes = [
     :id, :number, :item_total, :total, :ship_total, :state, :adjustment_total,
     :user_id, :created_at, :updated_at, :completed_at, :payment_total,
     :shipment_state, :payment_state, :email, :special_instructions, :channel,
     :included_tax_total, :additional_tax_total,      :display_included_tax_total,
     :display_additional_tax_total, :tax_total, :currency, :notes
   ]
end

However, every time I send a :note parameter, I get the following response in my console:

Unpermitted parameters: id, number, item_total, total, state, adjustment_total, user_id, completed_at, payment_total, shipment_state, payment_state, created_at, updated_at, currency, additional_tax_total, channel, included_tax_total, notes

What's the correct way to add permitted params to a Spree API call?

I'm using the following gems:

spree (2.4.3.beta)
  spree_api (= 2.4.3.beta)

My Rails version is: Rails 4.1.8

Answer 1

Spree uses a variable per model for permitted parameters and for the api parameters defined in the gem itself, you can extend this in the spree config.

For order_attributes you would add the following line to add customer_id to the api response config/initializers/spree.rb:

Spree::Api::ApiHelpers.order_attributes << :customer_id

to add customer_id to the permitted_attributes you need to add to the permitted attributes variable.

Spree::PermittedAttributes.order_attributes << :customer_id