Install the Merchant Profile Backend API

Edit on GitHub

This document describes how to install the Merchant Profile Backend API, which lets merchant users manage the profile of their merchant through the merchant-profile resource and Back Office users manage any merchant profile through the merchant-profiles resource of the Backend API.

Prerequisites

Install the required features:

NAME VERSION INSTALLATION GUIDE
Spryker Core 202608.0 Install the Spryker Core feature
Marketplace Merchant 202608.0 Install the Marketplace Merchant feature
API Platform required

The resources are generated by API Platform, their endpoints are protected by API Platform security, and the merchant behind a token is resolved by the API Platform request pipeline. The resources are not available on the legacy Glue infrastructure. If your project does not use API Platform yet, follow Integrate API Platform and Integrate API Platform security first.

Merchant users authenticate with the merchant-user scope. To register the plugins that provide it, follow the Optional: Enable merchant user authentication step of the Backend API authentication integration guide. To restrict merchant users to the data of their merchant, follow Integrate Persistent ACL for merchant API endpoints.

Install feature core

1) Install the required modules

Install the required modules using Composer:

composer require \
  spryker/merchant-profile:"^1.11.0" \
  spryker/merchant-user:"^1.10.0" \
  spryker/api-platform:"^1.30.0" \
  spryker/oauth-backend-api:"^1.8.0" \
  spryker/user:"^3.33.0" \
  --update-with-dependencies
What each version provides
MODULE MINIMUM VERSION PROVIDES
spryker/merchant-profile ^1.11.0 The merchant-profile and merchant-profiles resources and the validator plugins for the merchant user route
spryker/merchant-user ^1.10.0 Resolving the merchant user behind an access token, including merchant users of merchants that are not approved yet
spryker/api-platform ^1.30.0 The ROLE_MERCHANT_USER and ROLE_BACK_OFFICE_USER roles derived from the token scopes
spryker/oauth-backend-api ^1.8.0 The POST /token endpoint that issues merchant user and Back Office user tokens
spryker/user ^3.33.0 Establishing the acting user on Backend API requests
Verification

Make sure the following modules have been installed:

MODULE EXPECTED DIRECTORY
MerchantProfile vendor/spryker/merchant-profile
MerchantUser vendor/spryker/merchant-user
ApiPlatform vendor/spryker/api-platform
OauthBackendApi vendor/spryker/oauth-backend-api
User vendor/spryker/user

2) Set up transfer objects

Generate the transfer classes:

console transfer:generate
Verification

Make sure the following transfers have been created:

TRANSFER TYPE EVENT PATH
MerchantProfileValidationRequest class created src/Generated/Shared/Transfer/MerchantProfileValidationRequestTransfer.php
MerchantProfileValidationResponse class created src/Generated/Shared/Transfer/MerchantProfileValidationResponseTransfer.php

3) Set up behavior

On the merchant-profile resource, a merchant user is held to the rules of the Merchant Portal profile page. The rules are validator plugins; register them:

PLUGIN SPECIFICATION PREREQUISITES NAMESPACE
StoreLocaleMerchantProfileValidatorPlugin Rejects a merchantUrls or localizedAttributes entry whose locale doesn’t belong to a store of the merchant. Spryker\Glue\MerchantProfile\Plugin\MerchantProfile
HtmlTagWhitelistMerchantProfileValidatorPlugin Rejects a localized text containing an HTML tag other than h1 to h6, br, and p. Spryker\Glue\MerchantProfile\Plugin\MerchantProfile

src/Pyz/Glue/MerchantProfile/MerchantProfileDependencyProvider.php

<?php

namespace Pyz\Glue\MerchantProfile;

use Spryker\Glue\MerchantProfile\MerchantProfileDependencyProvider as SprykerMerchantProfileDependencyProvider;
use Spryker\Glue\MerchantProfile\Plugin\MerchantProfile\HtmlTagWhitelistMerchantProfileValidatorPlugin;
use Spryker\Glue\MerchantProfile\Plugin\MerchantProfile\StoreLocaleMerchantProfileValidatorPlugin;

class MerchantProfileDependencyProvider extends SprykerMerchantProfileDependencyProvider
{
    /**
     * @return array<\Spryker\Glue\MerchantExtension\Dependency\Plugin\MerchantProfileValidatorPluginInterface>
     */
    protected function getMerchantProfileValidatorPlugins(): array
    {
        return [
            new StoreLocaleMerchantProfileValidatorPlugin(),
            new HtmlTagWhitelistMerchantProfileValidatorPlugin(),
        ];
    }
}

The plugins apply to the merchant-profile resource only; the merchant-profiles resource of the Back Office user carries none of these rules, as the Back Office merchant form doesn’t. To add a project-specific rule, implement Spryker\Glue\MerchantExtension\Dependency\Plugin\MerchantProfileValidatorPluginInterface and register the plugin in the same method. The allowed HTML tags and the URL prefix segment that is prepended to submitted merchant URLs (merchant in /de/merchant/spryker) are configured in Spryker\Glue\MerchantProfile\MerchantProfileConfig.

4) Generate the API resources

The resources are auto-discovered from the module; no plugin registration is needed. Generate the resource classes and rebuild the Backend API container:

vendor/bin/glue api:generate
console cache:empty-all
Verification

Make sure the following classes have been generated:

CLASS PATH
MerchantProfileBackendResource src/Generated/Api/Backend/MerchantProfileBackendResource.php
MerchantProfilesBackendResource src/Generated/Api/Backend/MerchantProfilesBackendResource.php

Authenticate as a Back Office user and retrieve the profile of a merchant:

GET https://glue-backend.mysprykershop.com/merchant-profiles/MER000001

Make sure the response contains the merchant profile. Then authenticate as a merchant user of an approved merchant and make sure that:

  • GET https://glue-backend.mysprykershop.com/merchant-profile returns the profile of the merchant the user is assigned to.
  • GET https://glue-backend.mysprykershop.com/merchant-profiles/MER000001 returns a 403 response.
  • PATCH https://glue-backend.mysprykershop.com/merchant-profile with a localizedAttributes entry whose localeName doesn’t belong to a store of the merchant returns a 422 response.

For the request details, see Retrieve merchant profiles and Update merchant profiles.