spree_api 5.6.0.rc2 → 5.6.0.rc3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0b165c94c2975472728b228761cc6cb41f1a677a6368dc9a0be992b5840444cd
-  data.tar.gz: 1ee381dfe91a8ccc58e959cec117f1beb992dde08b6c04488e18ea45baf1ec3c
+  metadata.gz: 1029d16c5aff295ae773e0c605d1c2003157c4efcfdc5ac5f4ef6edf073b0d68
+  data.tar.gz: 8778b2415f90f19df1f7631ff6df0f4f2508ec8ba7d4116f81f76fecf81dae49
 SHA512:
-  metadata.gz: 71038600173f2b56747b328f32fab9030ade806d07f3823e1e3e261098f85bdf24d54b0e8c7eb131e669a1f856bbb84c0d6cd3bba2974eef2739c87b73e27ddd
-  data.tar.gz: 8847edd08dbe74a437313d47add4fc557f5930dfdce57cca0b8812249e1f9ea40cc2416aef628e97a13a999777031bd6de381532a4093bceb6311f554854acb8
+  metadata.gz: d7f0f2b4eabc6fc302f18b8cdd76d3213360ba927f3a1f5690253e7443baf4778464c1a3c395f1fa29827f1a2acdb66849e6738bc1af7e6fd0f9a910bcf09ecd
+  data.tar.gz: 8db65610da6e5ff6bc2dd736050c19d6c9624f64e48ba56b85d0c6bcc935f3ba1a00ff2080643b35cda5c7d05e0c83f3510c75c09926e483ae4b15c93bdc39a5

data/app/controllers/concerns/spree/api/v3/admin/auth_cookies.rb

@@ -10,7 +10,7 @@ module Spree
         # CSRF protection:
         #   We deliberately do NOT use a CSRF token here. The threat model is fully
         #   covered by the combination of:
-        #     - SameSite=Lax (dev) / SameSite=None; Secure (prod) on the refresh cookie
+        #     - SameSite=Lax (http) / SameSite=None; Secure (https) on the refresh cookie
         #     - Spree::AllowedOrigin allowlist enforced via Rack::Cors with credentials: true
         #     - CORS preflight blocking cross-origin requests from non-allowlisted Origins
         #   A double-submit CSRF token would only add value if the AllowedOrigin allowlist
@@ -48,8 +48,14 @@ module Spree
             cookies.signed[REFRESH_COOKIE_NAME].presence
           end
 
+          # Keyed off the request scheme, not the Rails env: Rails silently refuses to
+          # write a Secure cookie on a non-SSL request, so a production app served over
+          # plain http (local Docker image, http-only intranet) would never get the
+          # refresh cookie at all. SameSite=None requires Secure, so http falls back to
+          # Lax — fine for same-site setups (ports don't factor into site identity);
+          # cross-site dashboards need https anyway.
           def base_cookie_attributes
-            if Rails.env.production?
+            if request.ssl?
               { secure: true, same_site: :none }
             else
               { secure: false, same_site: :lax }

data/app/controllers/spree/api/v3/admin/customers/addresses_controller.rb

@@ -7,17 +7,19 @@ module Spree
 
             # POST /api/v3/admin/customers/:customer_id/addresses
             def create
-              @resource = @parent.addresses.new(address_attrs)
-              authorize_resource!(@resource, :create)
+              authorize_resource!(Spree::Address.new(user_id: @parent.id), :create)
 
-              ApplicationRecord.transaction do
-                if @resource.save
-                  apply_default_flags(@resource)
-                  render json: serialize_resource(@resource.reload), status: :created
-                else
-                  render_validation_error(@resource.errors)
-                  raise ActiveRecord::Rollback
-                end
+              result = Spree.address_create_service.call(
+                address_params: address_attrs,
+                user: @parent,
+                default_billing: default_billing_flag,
+                default_shipping: default_shipping_flag
+              )
+
+              if result.success?
+                render json: serialize_resource(result.value), status: :created
+              else
+                render_validation_error(result.value.errors)
               end
             end
 
@@ -25,14 +27,17 @@ module Spree
             def update
               authorize_resource!(@resource)
 
-              ApplicationRecord.transaction do
-                if @resource.update(address_attrs)
-                  apply_default_flags(@resource)
-                  render json: serialize_resource(@resource.reload)
-                else
-                  render_validation_error(@resource.errors)
-                  raise ActiveRecord::Rollback
-                end
+              result = Spree.address_update_service.call(
+                address: @resource,
+                address_params: address_attrs,
+                default_billing: default_billing_flag,
+                default_shipping: default_shipping_flag
+              )
+
+              if result.success?
+                render json: serialize_resource(result.value)
+              else
+                render_validation_error(result.value.errors)
               end
             end
 
@@ -69,11 +74,12 @@ module Spree
               )
             end
 
-            def apply_default_flags(address)
-              updates = {}
-              updates[:bill_address_id] = address.id if ActiveModel::Type::Boolean.new.cast(params[:is_default_billing])
-              updates[:ship_address_id] = address.id if ActiveModel::Type::Boolean.new.cast(params[:is_default_shipping])
-              @parent.update!(updates) if updates.any?
+            def default_billing_flag
+              ActiveModel::Type::Boolean.new.cast(params[:is_default_billing])
+            end
+
+            def default_shipping_flag
+              ActiveModel::Type::Boolean.new.cast(params[:is_default_shipping])
             end
           end
         end

data/app/controllers/spree/api/v3/store/customer/addresses_controller.rb

@@ -35,6 +35,14 @@ module Spree
               end
             end
 
+            # DELETE /api/v3/store/customers/me/addresses/:id
+            def destroy
+              @resource.destroy!
+              head :no_content
+            rescue ActiveRecord::RecordNotDestroyed => e
+              render_validation_error(e.record.errors.presence || e.message)
+            end
+
             protected
 
             def set_parent

data/app/serializers/spree/api/v3/product_serializer.rb

@@ -48,7 +48,7 @@ module Spree
         attribute :description do |product|
           next if product.description.blank?
 
-          Nokogiri::HTML.fragment(product.description).text.squish
+          Spree::RichTextHelper.to_plain_text(product.description)
         end
 
         attribute :description_html do |product|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc2
+  version: 5.6.0.rc3
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-17 00:00:00.000000000 Z
+date: 2026-07-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc2
+        version: 5.6.0.rc3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc2
+        version: 5.6.0.rc3
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -380,9 +380,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc2
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc3
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc2
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc3
 post_install_message:
 rdoc_options: []
 require_paths: