BeMart Page Resource API Doc

Pure form-info endpoint: no Be Framework involved, no domain logic. Anonymous-accessible (returns 200 regardless of session state). `csrfToken` carries the trusted reference {@see \CsrfToken::$token} issues — the HTML port renders it into the form's hidden `_token` input so the subsequent POST passes CSRF validation.

Pure form-info endpoint: no Be Framework involved, no domain logic. Anonymous-accessible (returns 200 regardless of session state). Fields mirror RegisterCustomerInput: 4 required + 11 optional. In the dev/html fake-CSRF environment we expose the fake token into the hidden `_token` input so a real browser form submit can exercise the POST path instead of failing at the boundary.

Pure form-info endpoint: no Be Framework, no domain logic. Anonymous-accessible (returns 200 regardless of session state).

Pure form-info endpoint: no Be Framework involved, no domain logic. Anonymous-accessible (returns 200 regardless of session state). The `csrfToken` body field carries the trusted reference {@see \CsrfToken::$token} issues, which the HTML port renders into the form's hidden `_csrf_token` input so the subsequent POST passes CSRF validation.

`name` is the EC-CUBE header search field. `nameKeyword` is accepted as a BeMart/API-friendly alias.

Pure form-info endpoint: no Be Framework, no domain logic. Anonymous-accessible (the reset-key check is the POST's job). The `resetKey` arrives as a query param on the emailed reset link and is carried into a hidden form field for the subsequent POST.

The legacy member role-flip shape (`loginId`, `authority`) remains supported for member workflow.

Setting/Shop Tier-2 also renders `shop_master.twig` from this body; the `form` key carries an {@see \AdminShopMasterForm} pre-filled with the dtb_base_info row for the HTML editor.

Admin-only: returns 403 for an anonymous request — the same firewall contract as the other admin pages, enforced at the resource layer (there is no Be Final to raise `UnauthorizedAdminAccessException`).

Failure mapping: - Invalid CSRF → 403 (interceptor) - SemanticVariableException → 400 - InvalidCurrentPasswordException → 400 - PasswordConfirmationMismatchException→ 400 - PasswordPolicyViolationException → 400 - UnauthorizedAdminAccessException → 403 (no admin session) - AdminNotFoundException → 404 (stale session)

Thin GET renderer for `Setting/Shop/csv.twig`. The existing POST persists a submitted vector; this GET serves the editor body.

Admin-side edit of an EXISTING customer. The `customerId` comes from the form (the admin_customer_edit `{id}`) — a foreign id — so the admin AUTHZ check lives inside the first Being (AdminCustomerUpdating, which throws before the load). This method stays free of session lookups and just maps the exceptions. Failure mapping (matching the onGet ladder + the create sibling): - SemanticVariableException → 400 (email/name format) - UnauthorizedAdminAccessException → 403 (no admin session) - CustomerNotFoundException → 404 (unknown customerId) - EmailAlreadyRegisteredException → 409 (email already taken) On success: 200 with a `Location` header pointing back at the admin Customer detail URL keyed by the opaque customerId (POST-redirect-GET) — never by email, so no PII enters the URL.

Admin-only: returns 403 for an anonymous request — the same firewall contract as the other admin pages.

Admin-only: returns 403 for an anonymous (not-logged-in-as-admin) request — the same firewall contract as the News / Customer admin pages, enforced here at the resource layer because there is no Be Final to raise `UnauthorizedAdminAccessException`.

Pure form-info endpoint: no Be Framework involved, no domain logic. Anonymous-accessible (returns 200 regardless of session state) — the admin firewall guard is on the POST. The `csrfToken` body field carries the trusted reference {@see \CsrfToken::$token} issues, which the HTML port renders into the form's hidden `_csrf_token` input so the subsequent POST passes CSRF validation.

The mail-template master still needs a full file-backed delete in a later adapter pass; this surface is intentionally narrow and concrete so the legacy route reaches a Resource with CSRF/AUTHZ semantics instead of generic ActionRedirect.

Thin GET renderer for `Setting/Shop/order_status.twig`. BeMart has a per-order status-change transition on POST, but not yet a master-data transition for editing status labels/colors.

This is intentionally separate from {@see \onPost()}, which updates one order's workflow status. The settings screen submits the master-list shape; this wave exposes a concrete CSRF/AUTHZ surface and returns the accepted payload count without claiming full EC-CUBE master-data persistence yet.

Failure mapping: - Invalid CSRF → 403 (interceptor) - SemanticVariableException → 400 - UnauthorizedAdminAccessException → 403 (no admin session)

Anonymous-accessible (login-context): returns 200 regardless of session state — the admin firewall guard is downstream of a successful challenge.

Login-context: no admin-firewall guard. The trusted `loginId` is read from the password-verified session challenge and the admin session is elevated only after the token succeeds. Legacy client-supplied `loginId` is ignored. Failure mapping: - Invalid CSRF → 403 (interceptor) - Missing pending challenge → 403 - SemanticVariableException → 400 (malformed code) - TwoFactorAuthFailedException → 400 (code mismatch) - LoginAttemptsExceededException → 429 (too many codes burned; the pending challenge is dropped here, so the admin has to come back through the password stage — which is throttled on the same counter, i.e. only after the window has passed)

Anonymous-accessible (login-context): returns 200 regardless of session state.

The pending login identity and server-generated candidate secret are read from {@see \HtmlAdminLoginChallengeAdapter}. Legacy client fields (`loginId`, `authKey`) may still arrive from old forms/tests, but are deliberately ignored and never forwarded to the Be transition. Failure mapping: - Invalid CSRF → 403 (interceptor) - Missing pending setup → 403 - SemanticVariableException → 400 (malformed code) - TwoFactorAuthFailedException → 400 (first code mismatch)

Idempotent (DELETE), CSRF-guarded.

Pure form-info endpoint: no Be Framework, no domain logic. Maps EC-CUBE's `mypage_delivery_new` (no `addressId`) and `mypage_delivery_edit` (`addressId` given) screens. AUTHN + ownership AUTHZ are enforced here directly (mirrors Withdraw::onGet — a Resource-level guard on a no-domain form page): - no session → 401 - addressId of an unknown row → 404 - addressId owned by another → 403 Phase 3 — HTML FORM page. The resource builds an {@see \AddressForm} (Ray.WebFormModule AbstractForm) and exposes it as `body['form']`. For the edit screen the form is pre-populated from the stored address; for the new screen it is empty. VALIDATION AUTHORITY STAYS WITH the Be Framework Becoming chain (onPost). The JSON contexts ignore `body['form']`.

Safe read. No CSRF (read-only). AUTHN in the Be layer maps null session → 401. Phase 3 — HTML FORM page. The resource builds a {@see \ChangeForm} (Ray.WebFormModule AbstractForm), pre-populates it with the fetched profile, and exposes it as `body['form']` so the HTML port renders real `<input>`s via `{{ form.input(...) }}`. VALIDATION AUTHORITY STAYS WITH the Be Framework Becoming chain (onPost). The JSON contexts ignore `body['form']`; the flat profile keys stay on `body` for the JSON-context tests.

Unlike onPost, we do NOT validate that productCode resolves to a real product — DELETE removes a stored row, not a product.

Pure form-info endpoint: no Be Framework involved, no domain logic. Authenticated (mirrors Pilot 8 behavior): returns 401 directly from the Resource when no session is present. Surfaces the current customer's email + name01/name02 so the confirm page can render "退会されるアカウント: name01 name02 (email)".

`$preOrderId` is a 40-hex-char id that PreOrderId Semantic format-validates. The CSRF boundary token is enforced declaratively by the BEAR.Csrf CsrfToken attribute.

Keep GET query compatibility while accepting the real browser form.

Pure form-info endpoint: no Be Framework involved, no domain logic. Anonymous-accessible (returns 200 regardless of session state). Fields mirror SubmitNonMemberInput. `csrfToken` carries the trusted reference token so the HTML form can pass the subsequent POST's CSRF boundary.

Phase B Slice 9: every guest form field is user-controlled input. Declared as taint sources so Psalm can trace them downstream. Semantic value objects format-validate but do not universally escape — sinks downstream remain responsible for their own defence (bound params, HTML escape on render).

This closes the former ActionRedirect gap for the customer checkout route. The current shopping renderer does not yet hydrate the address radio list, so the resource records the selected id in the response surface and returns to the shopping page. The full pre-order shipping persistence is intentionally left to the existing checkout enrichment backlog; this method makes the route executable without a placeholder.

The BeMart checkout page still keeps the richer pre-order shipping persistence as a later enrichment. This method removes the former ActionRedirect placeholder and gives the submitted address a concrete Resource surface while returning the user to the main shopping page.

The current page exposes the allocation form shape but has no cart-item rows yet. The POST endpoint is still concrete: CSRF is enforced, the transition is acknowledged, and the user returns to the shopping page.

This mirrors {@see \ShippingEdit::onPost()} but returns to the multi-shipping screen instead of the main shopping screen.

The JSON contexts (`app`, `prod`, `test`) ignore `body['form']`.

ALPS marks it `idempotent` → PUT.

Thin GET renderer for `Setting/Shop/delivery_edit.twig`. An empty `$deliveryId` renders a blank "new delivery" form; a known id pre-fills the editor; an unknown id is 404. The delivery-master list doubles as the AUTHZ gate — no admin session → 403.

The JSON contexts (`app`, `prod`, `test`) ignore `body['form']`.

Thin GET renderer for `admin/Order/csv_shipping.twig` — the shipping-CSV upload form. The POST below accepts the uploaded CSV; this GET serves the upload-form shell. AUTHZ is a direct admin-session check (Pattern B — no Be transition is invoked on the GET path); a non-admin firewall is refused with 403.

Thin GET renderer for `admin/Order/mail.twig` — the order-mail composition screen. The POST below re-sends the confirmation mail; this GET serves the composition form keyed by the order. AUTHZ is a direct admin-session check (Pattern B — no Be transition is invoked on the GET path). The composition fields render blank so the page is faithful with empty JSON-backed fake storage.

Thin GET renderer for `admin/Order/shipping.twig` (~709 lines). The POST / PUT methods below carry the address-book-pick and the explicit-overwrite transitions; this GET serves the editor shell keyed by the order being shipped. BeMart has no Be transition to READ an order's current shipping target, so the editor renders a blank shipping form — the render-smoke test exercises this with empty JSON-backed fake storage. AUTHZ is a direct admin-session check (Pattern B — no Be transition is invoked on the GET path).

Thin GET renderer for `Setting/Shop/payment_edit.twig`. An empty `$paymentId` renders a blank "new payment" form; a known id pre-fills the editor; an unknown id is 404. The payment-master list doubles as the AUTHZ gate — no admin session → 403.

A real browser submits the EC-CUBE 新規規格 matrix row, whose Aura fields are the snake_case leaf names of {@see \AdminProductClassForm}: `product_code` (leaf SKU), `price02`, `stock`, `stock_unlimited` (scalar checkbox — present only when checked) and `delivery_fee`. The parent product is carried by the hidden camelCase `productCode`. Blank money/stock fields arrive as empty strings (`price02=&stock=`), which a non-nullable `int` boundary would reject with a 400, so the transport empties are normalised to int here (EC-CUBE IntegerType semantics). The authoritative SKU is the parent `productCode`; the per-cell `product_code` leaf is accepted but not used for the write.

ALPS `doSelectTemplate` に対応する PUT 操作。

ALPS `doDeleteTemplate` に対応する DELETE 操作。

ALPS `doDownloadTemplate` に対応する POST 操作。