spree_api 5.6.0.rc1 → 5.6.0.rc3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 89ddc07a0f4f9334f2ecb79bf2283986e8078e5566d4a7b1c672fadd2f04453d
-  data.tar.gz: 1db32c6bf66382dc2786d1898aaaf5e6c3e1a04b721404fad423c37cc3e0326b
+  metadata.gz: 1029d16c5aff295ae773e0c605d1c2003157c4efcfdc5ac5f4ef6edf073b0d68
+  data.tar.gz: 8778b2415f90f19df1f7631ff6df0f4f2508ec8ba7d4116f81f76fecf81dae49
 SHA512:
-  metadata.gz: 001b8a751f6cd60f71ee162e4387570f8976bd47a3c6794f6d850ba42fe157c3850a137646fed9f6c22651e9d86bf08bad579f2a6854370442cc9dbec0ae1c3f
-  data.tar.gz: 6eb41a561383ce8ab469c21c1a341673164fadb3f5e738ccb7b0635bccd7ff56d6d280d30bcd3aa1bea852763b4f13908b96e45b071013736013c759f71f48fe
+  metadata.gz: d7f0f2b4eabc6fc302f18b8cdd76d3213360ba927f3a1f5690253e7443baf4778464c1a3c395f1fa29827f1a2acdb66849e6738bc1af7e6fd0f9a910bcf09ecd
+  data.tar.gz: 8db65610da6e5ff6bc2dd736050c19d6c9624f64e48ba56b85d0c6bcc935f3ba1a00ff2080643b35cda5c7d05e0c83f3510c75c09926e483ae4b15c93bdc39a5

data/app/controllers/concerns/spree/api/v3/admin/auth_cookies.rb

@@ -10,7 +10,7 @@ module Spree
         # CSRF protection:
         #   We deliberately do NOT use a CSRF token here. The threat model is fully
         #   covered by the combination of:
-        #     - SameSite=Lax (dev) / SameSite=None; Secure (prod) on the refresh cookie
+        #     - SameSite=Lax (http) / SameSite=None; Secure (https) on the refresh cookie
         #     - Spree::AllowedOrigin allowlist enforced via Rack::Cors with credentials: true
         #     - CORS preflight blocking cross-origin requests from non-allowlisted Origins
         #   A double-submit CSRF token would only add value if the AllowedOrigin allowlist
@@ -48,8 +48,14 @@ module Spree
             cookies.signed[REFRESH_COOKIE_NAME].presence
           end
 
+          # Keyed off the request scheme, not the Rails env: Rails silently refuses to
+          # write a Secure cookie on a non-SSL request, so a production app served over
+          # plain http (local Docker image, http-only intranet) would never get the
+          # refresh cookie at all. SameSite=None requires Secure, so http falls back to
+          # Lax — fine for same-site setups (ports don't factor into site identity);
+          # cross-site dashboards need https anyway.
           def base_cookie_attributes
-            if Rails.env.production?
+            if request.ssl?
               { secure: true, same_site: :none }
             else
               { secure: false, same_site: :lax }

data/app/controllers/spree/api/v3/admin/customers/addresses_controller.rb

@@ -7,17 +7,19 @@ module Spree
 
             # POST /api/v3/admin/customers/:customer_id/addresses
             def create
-              @resource = @parent.addresses.new(address_attrs)
-              authorize_resource!(@resource, :create)
+              authorize_resource!(Spree::Address.new(user_id: @parent.id), :create)
 
-              ApplicationRecord.transaction do
-                if @resource.save
-                  apply_default_flags(@resource)
-                  render json: serialize_resource(@resource.reload), status: :created
-                else
-                  render_validation_error(@resource.errors)
-                  raise ActiveRecord::Rollback
-                end
+              result = Spree.address_create_service.call(
+                address_params: address_attrs,
+                user: @parent,
+                default_billing: default_billing_flag,
+                default_shipping: default_shipping_flag
+              )
+
+              if result.success?
+                render json: serialize_resource(result.value), status: :created
+              else
+                render_validation_error(result.value.errors)
               end
             end
 
@@ -25,14 +27,17 @@ module Spree
             def update
               authorize_resource!(@resource)
 
-              ApplicationRecord.transaction do
-                if @resource.update(address_attrs)
-                  apply_default_flags(@resource)
-                  render json: serialize_resource(@resource.reload)
-                else
-                  render_validation_error(@resource.errors)
-                  raise ActiveRecord::Rollback
-                end
+              result = Spree.address_update_service.call(
+                address: @resource,
+                address_params: address_attrs,
+                default_billing: default_billing_flag,
+                default_shipping: default_shipping_flag
+              )
+
+              if result.success?
+                render json: serialize_resource(result.value)
+              else
+                render_validation_error(result.value.errors)
               end
             end
 
@@ -69,11 +74,12 @@ module Spree
               )
             end
 
-            def apply_default_flags(address)
-              updates = {}
-              updates[:bill_address_id] = address.id if ActiveModel::Type::Boolean.new.cast(params[:is_default_billing])
-              updates[:ship_address_id] = address.id if ActiveModel::Type::Boolean.new.cast(params[:is_default_shipping])
-              @parent.update!(updates) if updates.any?
+            def default_billing_flag
+              ActiveModel::Type::Boolean.new.cast(params[:is_default_billing])
+            end
+
+            def default_shipping_flag
+              ActiveModel::Type::Boolean.new.cast(params[:is_default_shipping])
             end
           end
         end

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -83,10 +83,15 @@ module Spree
           end
 
           # PATCH /api/v3/store/carts/:id/associate
-          # Associates a guest cart with the currently authenticated user
-          # Requires: JWT authentication + cart ID in URL
+          # Associates a guest cart with the currently authenticated user.
+          # Requires: JWT authentication + cart ID in URL + possession of the
+          # cart's token (x-spree-token). The token is the credential that
+          # authorizes claiming the cart, so it is required even when the cart
+          # is already the caller's own.
           def associate
             @cart = find_cart_for_association
+            authorize!(:update, @cart, cart_token)
+            require_cart_token!
 
             result = Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true)
 
@@ -177,6 +182,14 @@ module Spree
           def find_cart_for_association
             current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id])
           end
+
+          # Claiming a cart requires presenting its token, even when the caller
+          # already owns it — the token, not ownership, is the claim credential.
+          def require_cart_token!
+            valid = cart_token.present? && cart_token == @cart.token
+
+            raise CanCan::AccessDenied.new(nil, :update, @cart) unless valid
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/customer/addresses_controller.rb

@@ -35,6 +35,14 @@ module Spree
               end
             end
 
+            # DELETE /api/v3/store/customers/me/addresses/:id
+            def destroy
+              @resource.destroy!
+              head :no_content
+            rescue ActiveRecord::RecordNotDestroyed => e
+              render_validation_error(e.record.errors.presence || e.message)
+            end
+
             protected
 
             def set_parent

data/app/controllers/spree/api/v3/store/newsletter_subscribers_controller.rb

@@ -7,7 +7,7 @@ module Spree
           rate_limit to: Spree::Api::Config[:rate_limit_register],
                      within: Spree::Api::Config[:rate_limit_window].seconds,
                      store: Rails.cache,
-                     only: [:create, :verify],
+                     only: [:create, :verify, :request_unsubscribe],
                      with: RATE_LIMIT_RESPONSE
 
           # POST /api/v3/store/newsletter_subscribers
@@ -53,6 +53,57 @@ module Spree
             render json: serialize_resource(subscriber)
           end
 
+          # DELETE /api/v3/store/newsletter_subscribers/:id
+          # Accepts either of:
+          #   - Authorization: Bearer <jwt> — logged-in customer destroying their own subscription
+          #   - ?token=<unsubscribe-token>  — bearer from `subscriber.generate_token_for(:unsubscribe)`,
+          #                                   typically clicked from an unsubscribe email
+          def destroy
+            subscriber = find_owned_subscriber || find_subscriber_by_unsubscribe_token
+
+            if subscriber.blank?
+              return render_error(
+                code: ERROR_CODES[:invalid_token],
+                message: Spree.t(:newsletter_unsubscribe_token_invalid, scope: :api),
+                status: :unprocessable_content
+              )
+            end
+
+            linked_user = subscriber.user
+            subscriber.destroy!
+
+            # Keep accepts_email_marketing in sync, but only when no subscriptions remain.
+            if linked_user&.accepts_email_marketing? && Spree::NewsletterSubscriber.where(user_id: linked_user.id).none?
+              linked_user.update(accepts_email_marketing: false)
+            end
+
+            head :no_content
+          end
+
+          # POST /api/v3/store/newsletter_subscribers/request_unsubscribe
+          # Publishes a `newsletter_subscriber.unsubscribe_requested` event carrying the unsubscribe token.
+          # Always returns 202 to prevent email enumeration.
+          def request_unsubscribe
+            subscriber = Spree::NewsletterSubscriber.for_store(current_store).find_by(email: params[:email])
+
+            if subscriber
+              payload = {
+                id: subscriber.prefixed_id,
+                email: subscriber.email,
+                unsubscribe_token: subscriber.generate_token_for(:unsubscribe),
+                store_id: current_store.prefixed_id,
+                customer_id: subscriber.user&.prefixed_id
+              }
+
+              redirect_url = validated_redirect_url
+              payload[:redirect_url] = redirect_url if redirect_url.present?
+
+              subscriber.publish_event('newsletter_subscriber.unsubscribe_requested', payload)
+            end
+
+            head :accepted
+          end
+
           protected
 
           def serializer_class
@@ -61,6 +112,22 @@ module Spree
 
           private
 
+          def find_owned_subscriber
+            return unless current_user
+
+            Spree::NewsletterSubscriber.
+              for_store(current_store).
+              accessible_by(current_ability, :destroy).
+              find_by_prefix_id(params[:id])
+          end
+
+          def find_subscriber_by_unsubscribe_token
+            return if params[:token].blank?
+
+            subscriber = Spree::NewsletterSubscriber.for_store(current_store).find_by_token_for(:unsubscribe, params[:token])
+            subscriber if subscriber&.prefixed_id == params[:id]
+          end
+
           # Drop redirect_url when it isn't in the store's allow-list — secure-by-default,
           # mirrors password_resets. Returning nil omits it from the webhook payload rather
           # than rejecting the request, so callers can't probe the allow-list via 4xx errors.

data/app/serializers/spree/api/v3/admin/customer_serializer.rb

@@ -85,6 +85,16 @@ module Spree
           one :bill_address, key: :default_billing_address, resource: proc { Spree.api.admin_address_serializer }, if: proc { expand?('default_billing_address') }
           one :ship_address, key: :default_shipping_address, resource: proc { Spree.api.admin_address_serializer }, if: proc { expand?('default_shipping_address') }
 
+          # Override the inherited always-on store association to gate it behind
+          # expand? — the admin customers index serializes many rows and an
+          # always-on association would fire one query per row.
+          one :newsletter_subscriber,
+              resource: proc { Spree.api.admin_newsletter_subscriber_serializer },
+              if: proc { expand?('newsletter_subscriber') } do |user, params|
+            store = params&.dig(:store) || Spree::Current.store
+            user.newsletter_subscriber(store)
+          end
+
           many :orders,
                resource: proc { Spree.api.admin_order_serializer },
                if: proc { expand?('orders') }

data/app/serializers/spree/api/v3/admin/newsletter_subscriber_serializer.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Admin API Newsletter Subscriber Serializer
+        # Back-office surface, nested under the admin customer serializer. Extends the
+        # customer-facing serializer so public fields stay in sync.
+        class NewsletterSubscriberSerializer < V3::NewsletterSubscriberSerializer
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/customer_serializer.rb

@@ -8,7 +8,8 @@ module Spree
                  full_name: :string,
                  phone: [:string, nullable: true], accepts_email_marketing: :boolean,
                  available_store_credit_total: :string, display_available_store_credit_total: :string,
-                 default_billing_address: { nullable: true }, default_shipping_address: { nullable: true }
+                 default_billing_address: { nullable: true }, default_shipping_address: { nullable: true },
+                 newsletter_subscriber: { nullable: true }
 
         attributes :email, :first_name, :last_name, :phone, :accepts_email_marketing
 
@@ -31,6 +32,11 @@ module Spree
         many :addresses, resource: proc { Spree.api.address_serializer }
         one :bill_address, key: :default_billing_address, resource: proc { Spree.api.address_serializer }
         one :ship_address, key: :default_shipping_address, resource: proc { Spree.api.address_serializer }
+
+        one :newsletter_subscriber, resource: proc { Spree.api.newsletter_subscriber_serializer } do |user, params|
+          store = params&.dig(:store) || Spree::Current.store
+          user.newsletter_subscriber(store)
+        end
       end
     end
   end

data/app/serializers/spree/api/v3/product_serializer.rb

@@ -48,7 +48,7 @@ module Spree
         attribute :description do |product|
           next if product.description.blank?
 
-          Nokogiri::HTML.fragment(product.description).text.squish
+          Spree::RichTextHelper.to_plain_text(product.description)
         end
 
         attribute :description_html do |product|

data/config/locales/en.yml

@@ -13,6 +13,7 @@ en:
         guest_checkout_not_allowed: You must be signed in to complete checkout.
         storefront_login_required: Authentication required to access this store.
       negative_quantity: quantity is negative
+      newsletter_unsubscribe_token_invalid: Newsletter unsubscribe token is invalid or has expired.
       newsletter_verification_token_invalid: Newsletter verification token is invalid or has expired.
       order:
         could_not_transition: The order could not be transitioned. Please fix the errors and try again.

data/config/routes.rb

@@ -59,10 +59,15 @@ Spree::Core::Engine.add_routes do
         # Customers
         resources :customers, only: [:create]
 
-        # Newsletter Subscriptions (guest-accessible: subscribe + verify by token)
-        resources :newsletter_subscribers, only: [:create] do
+        # Newsletter Subscriptions
+        # - create + verify + request_unsubscribe are guest-accessible
+        # - destroy accepts either an unsubscribe token (from email links) or JWT auth
+        # A signed-in customer reads their own subscription (and its id) off the
+        # `newsletter_subscriber` association on GET /customers/me.
+        resources :newsletter_subscribers, only: [:create, :destroy] do
           collection do
             post :verify
+            post :request_unsubscribe
           end
         end
 

data/lib/spree/api/dependencies.rb

@@ -172,6 +172,7 @@ module Spree
         admin_state_serializer: 'Spree::Api::V3::Admin::StateSerializer',
         admin_discount_serializer: 'Spree::Api::V3::Admin::DiscountSerializer',
         admin_customer_serializer: 'Spree::Api::V3::Admin::CustomerSerializer',
+        admin_newsletter_subscriber_serializer: 'Spree::Api::V3::Admin::NewsletterSubscriberSerializer',
         admin_order_serializer: 'Spree::Api::V3::Admin::OrderSerializer',
         admin_product_serializer: 'Spree::Api::V3::Admin::ProductSerializer',
         admin_variant_serializer: 'Spree::Api::V3::Admin::VariantSerializer',

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc1
+  version: 5.6.0.rc3
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-15 00:00:00.000000000 Z
+date: 2026-07-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc1
+        version: 5.6.0.rc3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc1
+        version: 5.6.0.rc3
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -248,6 +248,7 @@ files:
 - app/serializers/spree/api/v3/admin/line_item_serializer.rb
 - app/serializers/spree/api/v3/admin/market_serializer.rb
 - app/serializers/spree/api/v3/admin/media_serializer.rb
+- app/serializers/spree/api/v3/admin/newsletter_subscriber_serializer.rb
 - app/serializers/spree/api/v3/admin/option_type_serializer.rb
 - app/serializers/spree/api/v3/admin/option_value_serializer.rb
 - app/serializers/spree/api/v3/admin/order_serializer.rb
@@ -379,9 +380,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc1
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc3
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc1
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc3
 post_install_message:
 rdoc_options: []
 require_paths: