spree_api 5.5.3 → 5.6.0.rc1

data/app/controllers/spree/api/v3/admin/store_controller.rb

@@ -39,6 +39,9 @@ module Spree
               :preferred_timezone,
               :preferred_weight_unit,
               :preferred_unit_system,
+              :preferred_storefront_access,
+              :preferred_storefront_url,
+              :preferred_guest_checkout,
               :mail_from_address,
               :customer_support_email,
               :new_order_notifications_email,

data/app/controllers/spree/api/v3/admin/translatable_resources_controller.rb

@@ -0,0 +1,38 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Self-describing discovery of every translatable resource and its
+        # translatable fields (the Spree.translatable_resources registry made
+        # public). Lets the dashboard render translation editors and the
+        # centralized translations grid generically, with no per-model code.
+        class TranslatableResourcesController < Admin::BaseController
+          scoped_resource :settings
+
+          # Public resource types with a dedicated nested read route
+          # (`…/:id/translations`). Other registered types are writable via the
+          # batch endpoint and readable inline (e.g. option values are returned
+          # as children of an option type), so the dashboard must not GET a
+          # standalone matrix for them. Keep in sync with the `:translatable`
+          # route concern mounts in `spree/api/config/routes.rb`.
+          READABLE_RESOURCE_TYPES = %w[product category option_type].freeze
+
+          # GET /api/v3/admin/translatable_resources
+          def index
+            data = Spree::Translations.registry.map do |entry|
+              entry.merge('readable' => READABLE_RESOURCE_TYPES.include?(entry['resource_type']))
+            end
+
+            render json: { data: data }
+          end
+
+          private
+
+          def action_kind
+            'read'
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/translations/batches_controller.rb

@@ -0,0 +1,113 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        module Translations
+          # Atomically upserts translations across MANY records of (possibly)
+          # different translatable resource types in a single request. Powers
+          # the dashboard's combined editors (e.g. an option type + all its
+          # option values saved in one go).
+          #
+          # The body is a flat list of independent registry writes — NOT a
+          # nested/parent-owns-children payload. Each entry names its own
+          # resource_type + resource_id, so the controller stays free of
+          # per-model branching.
+          #
+          # POST /api/v3/admin/translations/batch
+          # Body:
+          #   { "translations": [
+          #       { "resource_type": "option_type",  "resource_id": "opt_…",
+          #         "values": { "de": { "label": "Größe" } } },
+          #       { "resource_type": "option_value", "resource_id": "optval_…",
+          #         "values": { "de": { "label": "Klein" } } }
+          #   ] }
+          #
+          # All entries succeed or none do — a validation failure on any entry
+          # rolls back the whole transaction and returns per-entry detail.
+          # The orchestration (resolve → upsert → rollback) lives in
+          # Spree::Translations::Batch; the controller only handles params,
+          # authorization, and rendering.
+          class BatchesController < Admin::BaseController
+            # The batch spans heterogeneous resource types, so a single static
+            # scope can't gate it. We verify the API key holds the matching
+            # write_<resource> scope for EVERY entry (see require_batch_scopes!),
+            # which is stricter than the static check and keeps the audit model.
+            skip_scope_check!
+
+            # POST /api/v3/admin/translations/batch
+            def create
+              raw = params[:translations]
+              return render_empty_batch_error unless raw.is_a?(Array) && raw.any?
+
+              batch = Spree::Translations::Batch.new(batch_params)
+              return unless require_batch_scopes!(batch)
+
+              records = batch.process! { |record| authorize!(:update, record) }
+              render json: { data: records.map { |record| serialize_translations(record) } }
+            rescue Spree::Translations::Batch::EntryError => e
+              render_error(
+                code: ERROR_CODES[:validation_error],
+                message: e.message,
+                status: :unprocessable_content,
+                details: { translations: { e.index.to_s => [e.message] } }
+              )
+            end
+
+            private
+
+            # For API-key callers, require write_<resource> for every distinct
+            # resource type in the batch. JWT callers bypass (current_api_key is
+            # nil) and rely on the per-record authorize!(:update, record) above.
+            # Returns false (and renders 403) when a scope is missing.
+            def require_batch_scopes!(batch)
+              return true unless current_api_key
+
+              missing = batch.required_scopes.reject { |scope| current_api_key.has_scope?(scope) }
+              return true if missing.empty?
+
+              render_error(
+                code: ERROR_CODES[:access_denied],
+                message: "API key lacks scope(s): #{missing.join(', ')}",
+                status: :forbidden,
+                details: { required_scopes: missing }
+              )
+              false
+            end
+
+            # [{ resource_type:, resource_id:, values: { locale => { field => value } } }]
+            def batch_params
+              Array(params[:translations]).map do |entry|
+                permitted = entry.respond_to?(:permit) ? entry.permit(:resource_type, :resource_id, values: {}) : entry
+                values = permitted[:values]
+                {
+                  resource_type: permitted[:resource_type].to_s,
+                  resource_id: permitted[:resource_id].to_s,
+                  values: values.respond_to?(:to_unsafe_h) ? values.to_unsafe_h : (values || {}).to_h
+                }
+              end
+            end
+
+            def render_empty_batch_error
+              render_error(
+                code: ERROR_CODES[:validation_error],
+                message: 'translations must be a non-empty array',
+                status: :unprocessable_content
+              )
+            end
+
+            # Write echo: matrix + locale envelope, no discovery fields/children.
+            def serialize_translations(record)
+              Spree.api.admin_resource_translations_serializer.new(
+                record, params: serializer_params.merge(fields: false, envelope: true)
+              ).to_h
+            end
+
+            def action_kind
+              'write'
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/translations_controller.rb

@@ -0,0 +1,106 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Read-only translation matrix for any parent in the
+        # +Spree.translatable_resources+ registry. Mounted via the
+        # +:translatable+ route concern; the parent class is inferred from
+        # whichever +<segment>_id+ route param matches a registered translatable
+        # resource. One controller serves every model.
+        #
+        # Writes go through the batch endpoint (+POST /admin/translations/batch+)
+        # — a single atomic surface that also handles multi-record saves (an
+        # option type plus all its option values). There is no per-resource
+        # write here.
+        class TranslationsController < ResourceController
+          # This controller acts on the @parent (set by set_parent), never on a
+          # @resource of its own, so the base set_resource lookup (which needs a
+          # model_class) must not run.
+          skip_before_action :set_resource
+          before_action :ensure_translatable!
+
+          # GET /api/v3/admin/<parent>/<parent_id>/translations
+          # Returns the matrix + discovery fields, with nested translatable
+          # children (e.g. an option type's values) so an editor fetches the
+          # whole tree in one read.
+          def index
+            render json: { data: serialize_translations(@parent) }
+          end
+
+          protected
+
+          def set_parent
+            raise ActiveRecord::RecordNotFound, 'Parent resource not found' unless parent_lookup
+
+            @parent = parent_relation.find_by_prefix_id!(parent_lookup.value)
+            authorize!(:show, @parent)
+          end
+
+          # Resolves the parent within the current store so a token for one
+          # store can't read or write another store's translations. Preloads
+          # translatable children + their translation rows so the nested matrix
+          # read (e.g. an option type's values) avoids an N+1 over the child
+          # translation tables.
+          def parent_relation
+            klass = parent_lookup.klass
+            relation = klass.respond_to?(:for_store) ? klass.for_store(current_store) : klass
+
+            children = klass.try(:translatable_children)
+            children ? relation.includes(children => :translations) : relation
+          end
+
+          # Per-parent scope check: reading a product's translations needs
+          # `read_products`, a category's `read_categories`, etc.
+          def scoped_resource_name
+            parent_lookup&.segment&.pluralize&.to_sym
+          end
+
+          # Translatable by class hierarchy, not strict equality, so a subclass
+          # instance (e.g. Spree::Category < Spree::Taxon) passes when its base
+          # is registered.
+          def ensure_translatable!
+            # Compare by class NAME, not object identity: in dev the registry is
+            # populated at boot, but the model constants are reloaded on edits,
+            # so `is_a?(registered_class)` fails against a stale class object even
+            # when @parent's live class (or an ancestor) matches by name. Walk the
+            # ancestor names so a subclass (Spree::Category < Spree::Taxon) passes.
+            registered = Spree.translatable_resources.map(&:name).to_set
+            translatable = @parent.class.ancestors.any? { |ancestor| registered.include?(ancestor.name) }
+            raise ActiveRecord::RecordNotFound unless translatable
+          end
+
+          ParentLookup = Struct.new(:klass, :value, :segment)
+
+          # Maps route segment ('product', 'category', …) to model class name.
+          # Class names (not objects) survive dev-mode reloads. Aliases
+          # 'category' because routes expose taxons as categories (5.5 rename)
+          # while the model element is still 'taxon'.
+          def parent_route_map
+            @parent_route_map ||= Spree.translatable_resources.each_with_object({}) do |klass, m|
+              m[klass.model_name.element.to_s] = klass.name
+            end.merge('category' => 'Spree::Taxon')
+          end
+
+          def parent_lookup
+            return @parent_lookup if defined?(@parent_lookup)
+
+            match = parent_route_map.find { |segment, _| params[:"#{segment}_id"].present? }
+            @parent_lookup =
+              if match
+                segment, klass_name = match
+                ParentLookup.new(klass_name.constantize, params[:"#{segment}_id"], segment)
+              end
+          end
+
+          # Full read shape: matrix + discovery fields + nested children +
+          # the locale envelope.
+          def serialize_translations(record)
+            Spree.api.admin_resource_translations_serializer.new(
+              record, params: serializer_params.merge(fields: true, envelope: true)
+            ).to_h
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/resource_controller.rb

@@ -114,8 +114,6 @@ module Spree
                        model_class.new(permitted_params)
                      end
           resource.store = current_store if resource.respond_to?(:store_id) && resource.store_id.blank?
-          # very ugly code we need to still support for promotion/payment_method until we migrate them into single store in spree 6.0
-          resource.store_ids = [current_store.id] if resource.respond_to?(:store_ids) && resource.store_ids.blank? && !resource.respond_to?(:store_id)
           resource.created_by = try_spree_current_user if resource.respond_to?(:created_by_id)
           resource
         end

data/app/controllers/spree/api/v3/store/auth_controller.rb

@@ -3,6 +3,7 @@ module Spree
     module V3
       module Store
         class AuthController < Store::BaseController
+          allow_guest_storefront_access!
           # Tighter rate limits for auth endpoints (per IP to prevent brute force)
           rate_limit to: Spree::Api::Config[:rate_limit_login], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :create, with: RATE_LIMIT_RESPONSE
           rate_limit to: Spree::Api::Config[:rate_limit_refresh], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :refresh, with: RATE_LIMIT_RESPONSE
@@ -87,7 +88,8 @@ module Spree
               locale: current_locale,
               currency: current_currency,
               user: current_user,
-              includes: []
+              includes: [],
+              hide_prices: hide_prices?
             }
           end
 

data/app/controllers/spree/api/v3/store/base_controller.rb

@@ -8,6 +8,11 @@ module Spree
           # this here keeps the +X-Spree-Channel+ header from accidentally
           # narrowing admin queries.
           include Spree::Api::V3::ChannelResolution
+          # Mirrors Store::ResourceController. Both branches must carry the gate so
+          # login_required / prices_hidden apply to every Store endpoint, not just
+          # ResourceController ones. Public endpoints opt out with
+          # +allow_guest_storefront_access!+.
+          include Spree::Api::V3::StorefrontGating
 
           # Require publishable API key for all Store API requests
           before_action :authenticate_api_key!

data/app/controllers/spree/api/v3/store/carts/fulfillments_controller.rb

@@ -25,9 +25,7 @@ module Spree
                 fulfillment = @cart.shipments.find_by_prefix_id!(params[:id])
 
                 if permitted_params[:selected_delivery_rate_id].present?
-                  delivery_rate = fulfillment.shipping_rates.find_by_prefix_id!(permitted_params[:selected_delivery_rate_id])
-                  fulfillment.selected_shipping_rate_id = delivery_rate.id
-                  fulfillment.save!
+                  fulfillment.selected_delivery_rate_id = permitted_params[:selected_delivery_rate_id]
                 end
 
                 # Auto-advance (e.g. delivery → payment) after rate selection.

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -104,6 +104,10 @@ module Spree
           def complete
             find_cart!
 
+            if @cart.guest_checkout_disallowed?
+              return render_authentication_required('api.errors.guest_checkout_not_allowed', 'You must be signed in to complete checkout')
+            end
+
             result = Spree::Dependencies.carts_complete_service.constantize.call(cart: @cart)
 
             if result.success?

data/app/controllers/spree/api/v3/store/countries_controller.rb

@@ -3,6 +3,7 @@ module Spree
     module V3
       module Store
         class CountriesController < Store::BaseController
+          allow_guest_storefront_access!
           include Spree::Api::V3::HttpCaching
 
           # GET /api/v3/store/countries

data/app/controllers/spree/api/v3/store/currencies_controller.rb

@@ -3,6 +3,7 @@ module Spree
     module V3
       module Store
         class CurrenciesController < Store::BaseController
+          allow_guest_storefront_access!
           include Spree::Api::V3::HttpCaching
 
           # GET /api/v3/store/currencies

data/app/controllers/spree/api/v3/store/customer/password_resets_controller.rb

@@ -6,6 +6,7 @@ module Spree
       module Store
         module Customer
           class PasswordResetsController < Store::BaseController
+            allow_guest_storefront_access!
             rate_limit to: Spree::Api::Config[:rate_limit_password_reset],
                        within: Spree::Api::Config[:rate_limit_window].seconds,
                        store: Rails.cache,
@@ -32,7 +33,7 @@ module Spree
 
               if user
                 token = user.generate_token_for(:password_reset)
-                event_payload = { reset_token: token, email: user.email }
+                event_payload = { reset_token: token, email: user.email, store_id: current_store.prefixed_id }
                 event_payload[:redirect_url] = redirect_url if redirect_url.present?
                 user.publish_event('customer.password_reset_requested', event_payload)
               end
@@ -55,6 +56,9 @@ module Spree
 
               if user.update(password: params[:password], password_confirmation: params[:password_confirmation])
                 jwt = generate_jwt(user)
+                # Kill every existing session before minting the new one —
+                # a stolen refresh token must not survive a password reset.
+                Spree::RefreshToken.revoke_all_for(user)
                 refresh_token = Spree::RefreshToken.create_for(user, request_env: { ip_address: request.remote_ip, user_agent: request.user_agent&.truncate(255) })
                 user.publish_event('customer.password_reset')
 

data/app/controllers/spree/api/v3/store/customers_controller.rb

@@ -3,6 +3,7 @@ module Spree
     module V3
       module Store
         class CustomersController < Store::BaseController
+          allow_guest_storefront_access!
           rate_limit to: Spree::Api::Config[:rate_limit_register], within: Spree::Api::Config[:rate_limit_window].seconds, store: Rails.cache, only: :create, with: RATE_LIMIT_RESPONSE
 
           skip_before_action :authenticate_user, only: [:create]
@@ -64,7 +65,8 @@ module Spree
               locale: current_locale,
               currency: current_currency,
               user: current_user,
-              includes: []
+              includes: [],
+              hide_prices: hide_prices?
             }
           end
 

data/app/controllers/spree/api/v3/store/digitals_controller.rb

@@ -3,6 +3,7 @@ module Spree
     module V3
       module Store
         class DigitalsController < Store::BaseController
+          allow_guest_storefront_access!
           skip_before_action :authenticate_api_key!
           before_action :set_resource
 

data/app/controllers/spree/api/v3/store/locales_controller.rb

@@ -3,24 +3,19 @@ module Spree
     module V3
       module Store
         class LocalesController < Store::BaseController
+          allow_guest_storefront_access!
           include Spree::Api::V3::HttpCaching
 
           # GET /api/v3/store/locales
           def index
-            locales = current_store.supported_locales_list
+            locales = current_store.supported_locales
 
             return unless cache_collection(locales)
 
             render json: {
-              data: locales.map { |code| Spree.api.locale_serializer.new(OpenStruct.new(code: code, name: locale_name(code))).to_h }
+              data: locales.map { |locale| Spree.api.locale_serializer.new(locale).to_h }
             }
           end
-
-          private
-
-          def locale_name(code)
-            I18n.t('spree.i18n.this_file_language', locale: code, default: code)
-          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/markets/countries_controller.rb

@@ -4,6 +4,7 @@ module Spree
       module Store
         module Markets
           class CountriesController < Store::BaseController
+            allow_guest_storefront_access!
             include Spree::Api::V3::HttpCaching
 
             before_action :load_market

data/app/controllers/spree/api/v3/store/markets_controller.rb

@@ -3,6 +3,7 @@ module Spree
     module V3
       module Store
         class MarketsController < Store::BaseController
+          allow_guest_storefront_access!
           include Spree::Api::V3::HttpCaching
 
           # GET /api/v3/store/markets

data/app/controllers/spree/api/v3/store/newsletter_subscribers_controller.rb

@@ -3,6 +3,7 @@ module Spree
     module V3
       module Store
         class NewsletterSubscribersController < Store::BaseController
+          allow_guest_storefront_access!
           rate_limit to: Spree::Api::Config[:rate_limit_register],
                      within: Spree::Api::Config[:rate_limit_window].seconds,
                      store: Rails.cache,

data/app/controllers/spree/api/v3/store/products/filters_controller.rb

@@ -30,7 +30,7 @@ module Spree
 
             def filters_cache_key
               products_table = Spree::Product.table_name
-              stats = current_store.products.available(Time.current, current_currency)
+              stats = current_store.products.available(Time.current, current_currency, include_preorderable: true)
                         .pick(Arel.sql("MAX(#{products_table}.updated_at)"), Arel.sql("COUNT(DISTINCT #{products_table}.id)"))
               max_updated = stats&.first&.to_i
               product_count = stats&.last || 0
@@ -51,7 +51,10 @@ module Spree
             end
 
             def filters_scope
-              scope = current_store.products.available(Time.current, current_currency)
+              # Mirror ProductsController#scope so facet counts describe the
+              # same product set the listing returns (coming-soon pre-orders
+              # included).
+              scope = current_store.products.available(Time.current, current_currency, include_preorderable: true)
               scope = scope.in_category(category) if category.present?
               scope.accessible_by(current_ability, :show)
             end

data/app/controllers/spree/api/v3/store/products_controller.rb

@@ -29,7 +29,7 @@ module Spree
           end
 
           def scope
-            super.available(Time.current, Spree::Current.currency)
+            super.available(Time.current, Spree::Current.currency, include_preorderable: true)
           end
 
           # these scopes are not automatically picked by ar_lazy_preload gem and we need to explicitly include them

data/app/controllers/spree/api/v3/store/resource_controller.rb

@@ -7,6 +7,7 @@ module Spree
         # any concern added here MUST also be added to Store::BaseController.
         class ResourceController < Spree::Api::V3::ResourceController
           include Spree::Api::V3::ChannelResolution
+          include Spree::Api::V3::StorefrontGating
 
           protected
 

data/app/serializers/concerns/spree/api/v3/admin/translatable.rb

@@ -0,0 +1,38 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Adds the opt-in per-locale translation matrix to an admin serializer
+        # for a model that includes +Spree::TranslatableResource+. Include it in
+        # every translatable resource's admin serializer (product, option type,
+        # category, …) so the +?expand=translations+ surface stays consistent
+        # and defined in one place.
+        #
+        # @example
+        #   class ProductSerializer < V3::ProductSerializer
+        #     include Spree::Api::V3::Admin::Translatable
+        #   end
+        module Translatable
+          extend ActiveSupport::Concern
+
+          included do
+            # locale code => { field => value, translated_field_count } — mirrors
+            # the hand-written LocaleTranslations shape, inlined so the generated
+            # types need no import from the hand-written barrel.
+            typelize translations: 'Record<string, Record<string, string | number | null>>'
+
+            # Full per-locale translation matrix { locale => { field => value } }.
+            # Opt-in via ?expand=translations — the matrix (non-default locales ×
+            # translatable fields × translation-table joins) is wasteful on list
+            # views, so it is never rendered by default. params[:expand] is part
+            # of the HTTP cache key, so expanded/non-expanded responses cache
+            # separately. Writes go through the dedicated /translations endpoint.
+            attribute :translations, if: proc { expand?('translations') } do |record|
+              Spree::Translations.matrix_for(record)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/admin_user_serializer.rb

@@ -7,11 +7,17 @@ module Spree
                    first_name: [:string, nullable: true],
                    last_name: [:string, nullable: true],
                    full_name: [:string, nullable: true],
+                   selected_locale: [:string, nullable: true],
+                   avatar_url: [:string, nullable: true],
                    roles: 'Array<{ id: string; name: string }>'
 
-          attributes :email, :first_name, :last_name, :full_name,
+          attributes :email, :first_name, :last_name, :full_name, :selected_locale,
                      created_at: :iso8601, updated_at: :iso8601
 
+          attribute :avatar_url do |user|
+            image_url_for(user.avatar)
+          end
+
           # Roles assigned to this user *for the current store*. Each store
           # gets its own role set via `Spree::RoleUser`, so this attribute is
           # scoped against `current_store` rather than returning every role

data/app/serializers/spree/api/v3/admin/category_serializer.rb

@@ -5,11 +5,13 @@ module Spree
         # Admin API Category Serializer
         # Full category data including admin-only fields
         class CategorySerializer < V3::CategorySerializer
-          typelize pretty_name: :string, lft: :number, rgt: :number, sort_order: :string,
+          include Spree::Api::V3::Admin::Translatable
+
+          typelize pretty_name: :string, lft: :number, rgt: :number, products_count: :number,
                    metadata: 'Record<string, unknown>'
 
-          # Admin-only attributes
-          attributes :metadata, :pretty_name, :lft, :rgt, created_at: :iso8601, updated_at: :iso8601
+          attributes :metadata, :pretty_name, :lft, :rgt, :products_count,
+                     created_at: :iso8601, updated_at: :iso8601
 
           # Override inherited associations to use admin serializers
           one :parent,

data/app/serializers/spree/api/v3/admin/channel_serializer.rb

@@ -4,9 +4,13 @@ module Spree
       module Admin
         class ChannelSerializer < V3::ChannelSerializer
           typelize store_id: :string,
-                   preferred_order_routing_strategy: [:string, nullable: true]
+                   preferred_order_routing_strategy: [:string, nullable: true],
+                   preferred_storefront_access: [:string, nullable: true],
+                   preferred_guest_checkout: [:boolean, nullable: true]
 
           attributes :preferred_order_routing_strategy,
+                     :preferred_storefront_access,
+                     :preferred_guest_checkout,
                      created_at: :iso8601, updated_at: :iso8601
         end
       end

data/app/serializers/spree/api/v3/admin/customer_serializer.rb

@@ -17,7 +17,8 @@ module Spree
                    display_total_spent: :string,
                    last_order_completed_at: [:string, nullable: true],
                    default_billing_address_id: [:string, nullable: true],
-                   default_shipping_address_id: [:string, nullable: true]
+                   default_shipping_address_id: [:string, nullable: true],
+                   customer_group_ids: [:string, multi: true]
 
           # Admin-only attributes
           attributes :login, :metadata,
@@ -41,7 +42,7 @@ module Spree
           end
 
           attribute :tags do |user|
-            user.tag_list.to_a
+            user.tags.map(&:name) # not pluck as we preload tags
           end
 
           attribute :internal_note_html do |user|
@@ -92,6 +93,10 @@ module Spree
                resource: proc { Spree.api.admin_store_credit_serializer },
                if: proc { expand?('store_credits') }
 
+          attribute :customer_group_ids do |user|
+            user.customer_groups.map(&:prefixed_id)
+          end
+
           many :customer_groups,
                resource: proc { Spree.api.admin_customer_group_serializer },
                if: proc { expand?('customer_groups') }

data/app/serializers/spree/api/v3/admin/discount_serializer.rb

@@ -3,6 +3,10 @@ module Spree
     module V3
       module Admin
         class DiscountSerializer < V3::DiscountSerializer
+          # The Admin API has no guest gating — money fields inherited from the
+          # store serializer are always present, so override their nullability.
+          typelize amount: [:string, nullable: false], display_amount: [:string, nullable: false]
+
           attributes created_at: :iso8601, updated_at: :iso8601
         end
       end