spree_admin 5.5.0.rc1 → 5.5.0.rc3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f4bbbb1dd33ca70b641c0c4c687f4a8a36731ec816c3324930b44139d911bd6
-  data.tar.gz: d402abe10df4c9fe520db4f9b97fb17e33172238ff7e58b14f71b2754a9c09a5
+  metadata.gz: aeccd346505aa57fc41defc8eeaf544748167ea25808680cf7b4071ca5404bf5
+  data.tar.gz: 74f389f5a27205ba33b7a3b796463a0649f1ce5925aac036353e2aabd00d2594
 SHA512:
-  metadata.gz: 9931e85d7ade12bc71fd556f9014cb410ad03e205eedc6ba4c1bc03d3e5d38a32ddabd7a5b34114fe0cb1b58059d7b6ce36907c3515a866812609c9911989517
-  data.tar.gz: 8f9090d2f5d25c761f4f3ce74701fabd179b9947c21ce23ab64362ac67363ce77b63c624136a35bb02b2897d60fe72e716ac4e8539fdc032f5bc7c7cdbcab12c
+  metadata.gz: 8eb54e03b82a3cbd05549fbd8cf4d1902610fe1e7179608374ce0544f2c4364f274bd23a70da5e6b78bcec4cb072731523a305cb49166199143fa74585cca98d
+  data.tar.gz: 9d60a5a4842dd23af84e986858497f8ab2b93bd1b7f29ac939b40fea952d3fa44e437c3a1ca709024003c72fda4d7e771e9bc316d20618e1fa558001bea730c8

data/app/controllers/concerns/spree/admin/auth_rate_limiting.rb

@@ -0,0 +1,58 @@
+module Spree
+  module Admin
+    module AuthRateLimiting
+      extend ActiveSupport::Concern
+
+      class_methods do
+        # @param limit_preference [Symbol] e.g. :rate_limit_login / :rate_limit_password_reset
+        # @param redirect_to [Proc] evaluated in controller context to the path to bounce
+        #   back to when rate limited, e.g. `-> { new_session_path(resource_name) }`.
+        # @return [void]
+        def auth_rate_limit(limit_preference, redirect_to:)
+          limit  = Spree::Admin::RuntimeConfig[limit_preference] || 5
+          window = (Spree::Admin::RuntimeConfig[:rate_limit_window] || 60).seconds
+          prefix = limit_preference.to_s # unique namespace per controller/action
+
+          # By IP — always present; backstops blank-email floods.
+          rate_limit(
+            to: limit,
+            within: window,
+            by: -> { "#{prefix}-ip:#{request.remote_ip}" },
+            with: -> { admin_auth_rate_limit_response(redirect_to) },
+            store: Rails.cache,
+            only: :create
+          )
+
+          # By submitted email (case-insensitive). Falls back to per-IP bucketing when
+          # the email is blank, so blank submissions don't all share one global bucket.
+          rate_limit(
+            to: limit,
+            within: window,
+            by: lambda {
+              email = admin_auth_rate_limit_email
+              email.present? ? "#{prefix}-email:#{email}" : "#{prefix}-email-ip:#{request.remote_ip}"
+            },
+            with: -> { admin_auth_rate_limit_response(redirect_to) },
+            store: Rails.cache,
+            only: :create
+          )
+        end
+      end
+
+      private
+
+      # Email is read via Devise's `resource_params` so it works regardless of the
+      # configured admin user class / resource param key.
+      def admin_auth_rate_limit_email
+        resource_params[:email].to_s.strip.downcase.presence
+      rescue StandardError
+        nil
+      end
+
+      def admin_auth_rate_limit_response(redirect_path)
+        flash[:alert] = I18n.t('devise.failure.too_many_attempts')
+        redirect_to instance_exec(&redirect_path)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/api_keys_controller.rb

@@ -51,10 +51,11 @@ module Spree
       end
 
       def permitted_resource_params
-        permitted = params.require(:api_key).permit(permitted_api_key_attributes)
-        # key_type can only be set on create, not update
-        permitted.delete(:key_type) unless action_name == 'create'
-        permitted
+        # `key_type` and `scopes` are create-only (scope immutability lives on
+        # Spree::ApiKey); only the human-facing `name` is editable afterward.
+        return params.require(:api_key).permit(:name) unless action_name == 'create'
+
+        params.require(:api_key).permit(permitted_api_key_attributes)
       end
 
       def location_after_save

data/app/controllers/spree/admin/user_passwords_controller.rb

@@ -1,8 +1,12 @@
 module Spree
   module Admin
     class UserPasswordsController < defined?(Devise::PasswordsController) ? Devise::PasswordsController : Spree::Admin::BaseController
+      include Spree::Admin::AuthRateLimiting
+
       layout 'spree/minimal'
 
+      auth_rate_limit :rate_limit_password_reset, redirect_to: -> { new_password_path(resource_name) }
+
       def create
         self.resource = resource_class.send_reset_password_instructions(resource_params)
         yield resource if block_given?

data/app/controllers/spree/admin/user_sessions_controller.rb

@@ -1,8 +1,12 @@
 module Spree
   module Admin
     class UserSessionsController < defined?(Devise::SessionsController) ? Devise::SessionsController : Spree::Admin::BaseController
+      include Spree::Admin::AuthRateLimiting
+
       layout 'spree/minimal'
 
+      auth_rate_limit :rate_limit_login, redirect_to: -> { new_session_path(resource_name) }
+
       # We need to overwrite this action because `return_to` url may be in a different domain
       # So we need to pass `allow_other_host` option to `redirect_to` method
       def create

data/app/views/spree/admin/api_keys/_form.html.erb

@@ -25,20 +25,36 @@
   </div>
 </div>
 
-<div class="card mb-6" id="api-key-scopes" data-secret-only data-show-when-key-type="secret">
-  <div class="card-header">
-    <h5 class="card-title"><%= Spree.t('admin.api_keys.scopes', default: 'Scopes') %></h5>
-    <p class="text-sm text-gray-500 mt-1">
-      <%= Spree.t('admin.api_keys.scopes_description', default: 'Required for secret keys. Pick the narrowest set of scopes your integration needs.') %>
-    </p>
+<% if f.object.new_record? %>
+  <div class="card mb-6" id="api-key-scopes" data-secret-only data-show-when-key-type="secret">
+    <div class="card-header">
+      <h5 class="card-title"><%= Spree.t('admin.api_keys.scopes', default: 'Scopes') %></h5>
+      <p class="text-sm text-gray-500 mt-1">
+        <%= Spree.t('admin.api_keys.scopes_description', default: 'Required for secret keys. Pick the narrowest set of scopes your integration needs.') %>
+      </p>
+    </div>
+    <div class="card-body">
+      <% Spree::ApiKey::SCOPES.each do |scope| %>
+        <div class="custom-control form-checkbox mb-1">
+          <%= f.check_box :scopes, { multiple: true, class: 'custom-control-input', id: "api_key_scopes_#{scope}" }, scope, nil %>
+          <%= f.label "scopes_#{scope}", scope, class: 'custom-control-label font-mono text-sm' %>
+        </div>
+      <% end %>
+      <%= f.hidden_field :scopes, value: '', multiple: true %>
+    </div>
   </div>
-  <div class="card-body">
-    <% Spree::ApiKey::SCOPES.each do |scope| %>
-      <div class="custom-control form-checkbox mb-1">
-        <%= f.check_box :scopes, { multiple: true, class: 'custom-control-input', id: "api_key_scopes_#{scope}" }, scope, nil %>
-        <%= f.label "scopes_#{scope}", scope, class: 'custom-control-label font-mono text-sm' %>
-      </div>
-    <% end %>
-    <%= f.hidden_field :scopes, value: '', multiple: true %>
+<% elsif f.object.secret? %>
+  <div class="card mb-6">
+    <div class="card-header">
+      <h5 class="card-title"><%= Spree.t('admin.api_keys.scopes', default: 'Scopes') %></h5>
+      <p class="text-sm text-gray-500 mt-1">
+        <%= Spree.t('admin.api_keys.scopes_immutable', default: 'Scopes are fixed when the key is created. To change them, create a new key with the scopes you need and revoke this one.') %>
+      </p>
+    </div>
+    <div class="card-body">
+      <% f.object.scopes.each do |scope| %>
+        <span class="badge badge-light font-mono text-sm me-1 mb-1"><%= scope %></span>
+      <% end %>
+    </div>
   </div>
-</div>
+<% end %>

data/app/views/spree/admin/product_translations/index.html.erb

@@ -101,7 +101,7 @@
           <%= render 'spree/admin/shared/index_table_options', collection: @products %>
         </div>
       <% else %>
-        <%= render 'spree/admin/shared/no_resource_found', new_object_url: nil %>
+        <%= render 'spree/admin/shared/no_resource_found', new_object_url: nil, model_class: Spree::Product %>
       <% end %>
     </div>
   </div>

data/config/locales/en.yml

@@ -28,6 +28,7 @@ en:
         revoked_by: Revoked by
         scopes: Scopes
         scopes_description: Required for secret keys. Pick the narrowest set of scopes your integration needs.
+        scopes_immutable: Scopes are fixed when the key is created. To change them, create a new key with the scopes you need and revoke this one.
         secret_key_hidden: This secret key cannot be revealed. If you've lost it, revoke this key and create a new one.
         statuses:
           active: Active

data/lib/spree/admin/runtime_configuration.rb

@@ -17,6 +17,11 @@ module Spree
       preference :legacy_sidebar_navigation, :boolean, default: false
 
       preference :reports_line_items_limit, :integer, default: 1000
+
+      # Brute-force rate limiting for the admin dashboard auth endpoints (login / password reset).
+      preference :rate_limit_window, :integer, default: 60 # window in seconds
+      preference :rate_limit_login, :integer, default: 5 # per IP and per email
+      preference :rate_limit_password_reset, :integer, default: 3 # per IP and per email
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_admin
 version: !ruby/object:Gem::Version
-  version: 5.5.0.rc1
+  version: 5.5.0.rc3
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-10 00:00:00.000000000 Z
+date: 2026-06-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 5.5.0.rc1
+        version: 5.5.0.rc3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 5.5.0.rc1
+        version: 5.5.0.rc3
 - !ruby/object:Gem::Dependency
   name: active_link_to
   requirement: !ruby/object:Gem::Requirement
@@ -284,6 +284,7 @@ files:
 - app/assets/tailwind/spree/admin/views/_dashboard.css
 - app/assets/tailwind/spree/admin/views/_page-builder.css
 - app/controllers/concerns/spree/admin/analytics_concern.rb
+- app/controllers/concerns/spree/admin/auth_rate_limiting.rb
 - app/controllers/concerns/spree/admin/breadcrumb_concern.rb
 - app/controllers/concerns/spree/admin/bulk_operations_concern.rb
 - app/controllers/concerns/spree/admin/order_breadcrumb_concern.rb
@@ -1171,9 +1172,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.5.0.rc1
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.5.0.rc3
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.5.0.rc1
+  source_code_uri: https://github.com/spree/spree/tree/v5.5.0.rc3
 post_install_message:
 rdoc_options: []
 require_paths: