spree_api 5.6.0.rc3 → 5.6.0.rc5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1029d16c5aff295ae773e0c605d1c2003157c4efcfdc5ac5f4ef6edf073b0d68
-  data.tar.gz: 8778b2415f90f19df1f7631ff6df0f4f2508ec8ba7d4116f81f76fecf81dae49
+  metadata.gz: eee15468ad97bc5af5ed27d4e0ed4f4149c8b325efe81d9ef05d91af84094a27
+  data.tar.gz: c5d97420fb0bf65903f944487e102a57f957babdb7119dc2406307c0d45b2634
 SHA512:
-  metadata.gz: d7f0f2b4eabc6fc302f18b8cdd76d3213360ba927f3a1f5690253e7443baf4778464c1a3c395f1fa29827f1a2acdb66849e6738bc1af7e6fd0f9a910bcf09ecd
-  data.tar.gz: 8db65610da6e5ff6bc2dd736050c19d6c9624f64e48ba56b85d0c6bcc935f3ba1a00ff2080643b35cda5c7d05e0c83f3510c75c09926e483ae4b15c93bdc39a5
+  metadata.gz: e7783e8de7f1681b747863d5f9d161e1c5b8d05e1c087b5454332868fa81caaf7900e421fb60dabcca24b1d8ffbb99abf68338b0e85f13d6f456708e8c35e40f
+  data.tar.gz: 30aad9e4cc778ae8d11b1527053cf1f96f4fc75846ee48422152939a050a2506537824c1ffbeafc0b53dd8bd7c9c927ff39f5014ef462b9581c2f66a177d6ee7

data/app/controllers/concerns/spree/api/v3/channel_resolution.rb

@@ -6,41 +6,87 @@ module Spree
       # read channel context without threading it through method args.
       #
       # Resolution order:
-      # 1. +X-Spree-Channel+ header value matched against +channels.code+ —
+      # 1. The authenticated publishable key's channel binding
+      #    (+Spree::ApiKey#channel+) — server-assigned, cannot be overridden;
+      #    a +X-Spree-Channel+ header naming a different channel is a 422
+      # 2. +X-Spree-Channel+ header value matched against +channels.code+ —
       #    or, if it looks like a prefixed ID (+ch_…+), against +channels.id+
       #    — scoped to the current store
-      # 2. +current_store.default_channel+
+      # 3. +current_store.default_channel+
       #
       # The concern is a no-op if no channel matches — callers fall back to
       # +Spree::Current.channel+'s store-default behavior.
+      #
+      # IMPORTANT: key-bound resolution requires +authenticate_api_key!+ to run
+      # BEFORE +set_current_channel+ — both Store API branches order their
+      # callbacks accordingly (prepended in Store::BaseController, inherited
+      # ahead of the include in Store::ResourceController).
       module ChannelResolution
         extend ActiveSupport::Concern
 
         CHANNEL_HEADER = 'X-Spree-Channel'.freeze
 
         included do
+          # Prepended: LocaleAndCurrency's set_locale/set_currency callbacks
+          # (registered up in V3::BaseController) consult Spree::Current's
+          # fallback chain, which must derive from the REQUEST's store — not
+          # the Store.default fallback — before they run.
+          prepend_before_action :set_current_store_context
           before_action :set_current_channel
         end
 
         protected
 
         def current_channel
-          @current_channel ||= channel_from_header || Spree::Current.channel
+          @current_channel ||= channel_from_api_key || channel_from_header || Spree::Current.channel
         end
 
         private
 
-        # Only write to Spree::Current when the header resolves a specific
-        # channel. The store-default fallback is handled lazily by
+        # Only write to Spree::Current when the key or header resolves a
+        # specific channel. The store-default fallback is handled lazily by
         # +Spree::Current.channel+ itself, which avoids one query per
-        # header-less API request.
+        # unbound, header-less API request.
+        def set_current_store_context
+          Spree::Current.store = current_store
+        end
+
         def set_current_channel
+          bound = channel_from_api_key
+
+          if bound
+            header = channel_from_header
+            if header && header.id != bound.id
+              render_error(
+                code: ErrorHandler::ERROR_CODES[:channel_mismatch],
+                message: Spree.t('api.errors.channel_mismatch', default: 'The requested channel does not match the channel this API key is bound to'),
+                status: :unprocessable_entity
+              )
+              return
+            end
+
+            unless bound.active?
+              render_error(
+                code: ErrorHandler::ERROR_CODES[:channel_inactive],
+                message: Spree.t('api.errors.channel_inactive', default: 'The channel this API key is bound to is not active'),
+                status: :forbidden
+              )
+              return
+            end
+          end
+
           # Memoize so a later +current_channel+ call (e.g. the storefront gate,
-          # serializer params) reuses this row instead of re-querying the header.
-          @current_channel = channel_from_header
+          # serializer params) reuses this row instead of re-querying.
+          @current_channel = bound || channel_from_header
           Spree::Current.channel = @current_channel if @current_channel
         end
 
+        def channel_from_api_key
+          return nil unless respond_to?(:current_api_key, true)
+
+          current_api_key&.channel
+        end
+
         def channel_from_header
           value = request.headers[CHANNEL_HEADER].presence
           return nil if value.blank?

data/app/controllers/concerns/spree/api/v3/error_handler.rb

@@ -21,6 +21,10 @@ module Spree
           record_not_found: 'record_not_found',
           resource_invalid: 'resource_invalid',
 
+          # Channel errors
+          channel_mismatch: 'channel_mismatch',
+          channel_inactive: 'channel_inactive',
+
           # Cart errors
           cart_not_found: 'cart_not_found',
           cart_cannot_transition: 'cart_cannot_transition',

data/app/controllers/concerns/spree/api/v3/scoped_authorization.rb

@@ -86,10 +86,15 @@ module Spree
           self.class._scoped_resource
         end
 
-        # Override in controllers with non-REST custom actions (e.g. dashboard
-        # `analytics` should map to a read).
+        # Maps the action to the scope kind. Consults the controller's
+        # `read_actions` (ResourceController's overridable list) when defined,
+        # so declaring a custom read-only action once — e.g. `types` — fixes
+        # both the CanCanCan action mapping and the required scope kind.
+        # Controllers outside the ResourceController hierarchy can still
+        # override `action_kind` directly (e.g. dashboard `analytics`).
         def action_kind
-          READ_ACTIONS.include?(action_name) ? 'read' : 'write'
+          read = respond_to?(:read_actions, true) ? read_actions : READ_ACTIONS
+          read.include?(action_name) ? 'read' : 'write'
         end
 
         # True when authorization derives from the API key's scopes rather

data/app/controllers/spree/api/v3/admin/api_keys_controller.rb

@@ -87,14 +87,14 @@ module Spree
             end
           end
 
-          # `key_type` and `scopes` are create-only (scope immutability lives on
-          # Spree::ApiKey); update is limited to the human-facing `name`. Stripping
-          # them here keeps them out of mass assignment so a rename returns 200
-          # rather than 422.
+          # `key_type`, `scopes`, and `channel_id` are create-only (immutability
+          # lives on Spree::ApiKey); update is limited to the human-facing `name`.
+          # Stripping them here keeps them out of mass assignment so a rename
+          # returns 200 rather than 422.
           def permitted_params
             return params.permit(:name) if action_name == 'update'
 
-            params.permit(:name, :key_type, scopes: [])
+            params.permit(:name, :key_type, :channel_id, scopes: [])
           end
 
           private

data/app/controllers/spree/api/v3/admin/order_routing_rules_controller.rb

@@ -0,0 +1,65 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # CRUD for `Spree::OrderRoutingRule` STI subclasses, nested under the
+        # owning channel. Same shape as PromotionRulesController — the registry
+        # is `Spree.order_routing.rules` and the parent is a Channel.
+        class OrderRoutingRulesController < ResourceController
+          include Spree::Api::V3::Admin::SubclassedResource
+
+          scoped_resource :settings
+
+          subclassed_via -> { Spree.order_routing.rules },
+                         unknown_type_error: 'unknown_order_routing_rule_type'
+
+          def types
+            authorize! :read, model_class
+
+            render json: { data: model_class.subclasses_with_preference_schema }
+          end
+
+          protected
+
+          def model_class
+            Spree::OrderRoutingRule
+          end
+
+          def serializer_class
+            Spree.api.admin_order_routing_rule_serializer
+          end
+
+          def permitted_params
+            params.permit(:type, :active, :position, preferences: {})
+          end
+
+          # `types` is read-only discovery — maps to the read scope + :show ability.
+          def read_actions
+            super + %w[types]
+          end
+
+          def scope
+            super.ordered
+          end
+
+          def set_parent
+            return if action_name == 'types'
+
+            @parent = current_store.channels.accessible_by(current_ability, parent_ability_action)
+                                   .find_by_prefix_id!(params[:channel_id])
+          end
+
+          def parent_association
+            :order_routing_rules
+          end
+
+          private
+
+          def build_subclassed_resource(klass, attrs)
+            klass.new(attrs.merge(channel: @parent, store: @parent.store))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/payment_methods_controller.rb

@@ -51,6 +51,11 @@ module Spree
             params.permit(:name, :description, :active, :storefront_visible, :auto_capture, :position, metadata: {}, preferences: {})
           end
 
+          # `types` is read-only discovery — maps to the read scope + :show ability.
+          def read_actions
+            super + %w[types]
+          end
+
           private
 
           # New payment methods are created through the current store.

data/app/controllers/spree/api/v3/admin/promotion_actions_controller.rb

@@ -55,6 +55,11 @@ module Spree
             params.permit(:type, preferences: {})
           end
 
+          # `types`/`calculators` are read-only discovery — read scope + :show ability.
+          def read_actions
+            super + %w[types calculators]
+          end
+
           def set_parent
             return if %w[types calculators].include?(action_name)
 

data/app/controllers/spree/api/v3/admin/promotion_rules_controller.rb

@@ -33,6 +33,11 @@ module Spree
             params.permit(:type, preferences: {})
           end
 
+          # `types` is read-only discovery — maps to the read scope + :show ability.
+          def read_actions
+            super + %w[types]
+          end
+
           def set_parent
             return if action_name == 'types'
 

data/app/controllers/spree/api/v3/admin/store_controller.rb

@@ -42,6 +42,7 @@ module Spree
               :preferred_storefront_access,
               :preferred_storefront_url,
               :preferred_guest_checkout,
+              :preferred_order_routing_strategy,
               :mail_from_address,
               :customer_support_email,
               :new_order_notifications_email,

data/app/controllers/spree/api/v3/store/base_controller.rb

@@ -14,8 +14,13 @@ module Spree
           # +allow_guest_storefront_access!+.
           include Spree::Api::V3::StorefrontGating
 
-          # Require publishable API key for all Store API requests
-          before_action :authenticate_api_key!
+          # Require publishable API key for all Store API requests. Prepended so
+          # the key is authenticated BEFORE ChannelResolution's
+          # +set_current_channel+ and the StorefrontGating 401 guard run —
+          # a channel-bound key must resolve its channel ahead of the gate, and
+          # this matches Store::ResourceController, where +authenticate_request!+
+          # is inherited ahead of both concerns.
+          prepend_before_action :authenticate_api_key!
         end
       end
     end

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -141,8 +141,13 @@ module Spree
             Spree.api.cart_serializer
           end
 
+          # Channel-scoped: a storefront surface lists only its own channel's
+          # carts — without this, a blended DTC + wholesale storefront leaks
+          # the user's wholesale cart into the DTC surface (and vice versa).
+          # Explicit by-ID lookups (show/update) stay cross-channel so a shared
+          # checkout can load any cart the caller is authorized for.
           def scope
-            current_store.carts.where(user: current_user).order(updated_at: :desc)
+            current_store.carts.where(user: current_user, channel: current_channel).order(updated_at: :desc)
           end
 
           private

data/app/controllers/spree/api/v3/store/channel_controller.rb

@@ -0,0 +1,31 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # Exposes the channel context the request resolved to (bound key →
+        # X-Spree-Channel header → store default) so a storefront can read its
+        # own identity and access posture. Deliberately a singular resource:
+        # the Store API never enumerates a store's channels — that would leak
+        # the existence of gated surfaces (wholesale, POS) to anyone holding
+        # the publishable key.
+        class ChannelController < Store::BaseController
+          # A gated storefront must be able to read "this channel requires
+          # login" before authentication to render a sign-in wall instead of
+          # an error page.
+          allow_guest_storefront_access!
+
+          # GET /api/v3/store/channel
+          def show
+            render json: serialize_resource(current_channel)
+          end
+
+          protected
+
+          def serializer_class
+            Spree.api.channel_serializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/resource_controller.rb

@@ -9,6 +9,18 @@ module Spree
           include Spree::Api::V3::ChannelResolution
           include Spree::Api::V3::StorefrontGating
 
+          # The inherited +set_parent+/+set_resource+ callbacks were registered
+          # before the two concerns above, so they'd run resource lookups ahead
+          # of channel resolution (wrong channel scoping for X-Spree-Channel /
+          # key-bound requests) and ahead of the login gate (guests could probe
+          # resource existence on a gated channel via 404s). Re-register them so
+          # lookups always run inside the resolved channel context, behind the
+          # gate.
+          skip_before_action :set_parent
+          skip_before_action :set_resource
+          before_action :set_parent
+          before_action :set_resource, only: [:show, :update, :destroy]
+
           protected
 
           def authenticate_request!

data/app/jobs/spree/webhook_delivery_job.rb

@@ -13,10 +13,15 @@ module Spree
 
     # Accept optional second argument for backward compatibility with jobs
     # enqueued before this change was deployed.
-    def perform(delivery_id, _deprecated_secret_key = nil)
+    #
+    # `payload_secrets` carries credentials withheld from the persisted payload
+    # so the outgoing request body stays complete. See
+    # {Spree::WebhookPayloadRedaction}.
+    def perform(delivery_id, _deprecated_secret_key = nil, payload_secrets: nil)
       delivery = Spree::WebhookDelivery.find_by(id: delivery_id)
       return if delivery.nil?
 
+      delivery.payload_secrets = payload_secrets
       secret_key = delivery.webhook_endpoint.secret_key
       Spree::Webhooks::DeliverWebhook.call(delivery: delivery, secret_key: secret_key)
     end

data/app/serializers/spree/api/v3/admin/api_key_serializer.rb

@@ -18,12 +18,17 @@ module Spree
                    scopes: [:string, multi: true],
                    revoked_at: [:string, nullable: true],
                    last_used_at: [:string, nullable: true],
-                   created_by_email: [:string, nullable: true]
+                   created_by_email: [:string, nullable: true],
+                   channel_id: [:string, nullable: true]
 
           attributes :name, :key_type, :token_prefix, :scopes,
                      created_at: :iso8601, updated_at: :iso8601,
                      revoked_at: :iso8601, last_used_at: :iso8601
 
+          attribute :channel_id do |key|
+            key.channel&.prefixed_id
+          end
+
           # Returned only on the create response — `plaintext_token` is held in
           # memory on the model after `generate_token` and is never persisted
           # for secret keys, so we serialize it whenever it's available rather

data/app/serializers/spree/api/v3/admin/customer_group_serializer.rb

@@ -5,12 +5,11 @@ module Spree
         # Serializes Spree::CustomerGroup for the admin pickers
         # (e.g. promotion rule, customer-group filters). Surfaces only
         # what the admin UI needs to display + select rows.
-        class CustomerGroupSerializer < V3::BaseSerializer
-          typelize name: :string,
-                   description: 'string | null',
+        class CustomerGroupSerializer < V3::CustomerGroupSerializer
+          typelize description: 'string | null',
                    customers_count: :number
 
-          attributes :name, :description, :customers_count,
+          attributes :description, :customers_count,
                      created_at: :iso8601, updated_at: :iso8601
 
           # Members are paginated separately via `/customers?customer_group_id_in=…`

data/app/serializers/spree/api/v3/admin/order_routing_rule_serializer.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Serializes Spree::OrderRoutingRule (and its STI subclasses) for the
+        # per-channel routing-rules editor. Same shape as PromotionRule so the
+        # frontend renders both with the same schema-driven preference form.
+        class OrderRoutingRuleSerializer < BaseSerializer
+          typelize type: :string,
+                   channel_id: :string,
+                   position: :number,
+                   active: :boolean,
+                   preferences: 'Record<string, unknown>',
+                   preference_schema: "Array<{ key: string; type: string; default: unknown }>",
+                   label: :string,
+                   description: :string
+
+          attributes :position, :active
+          attributes created_at: :iso8601, updated_at: :iso8601
+
+          attribute :type do |rule|
+            rule.class.api_type
+          end
+
+          attribute :channel_id do |rule|
+            rule.channel&.prefixed_id
+          end
+
+          attribute :preferences, &:serialized_preferences
+          attribute :preference_schema, &:serialized_preference_schema
+
+          attribute :label, &:human_name
+          attribute :description, &:human_description
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/store_serializer.rb

@@ -21,6 +21,7 @@ module Spree
                    preferred_unit_system: :string,
                    preferred_storefront_access: :string,
                    preferred_guest_checkout: :boolean,
+                   preferred_order_routing_strategy: :string,
                    metadata: 'Record<string, unknown>'
 
           attributes :metadata,
@@ -39,6 +40,7 @@ module Spree
                      :preferred_unit_system,
                      :preferred_storefront_access,
                      :preferred_guest_checkout,
+                     :preferred_order_routing_strategy,
                      created_at: :iso8601, updated_at: :iso8601
 
           attribute :url, &:storefront_url

data/app/serializers/spree/api/v3/admin/webhook_delivery_serializer.rb

@@ -25,10 +25,15 @@ module Spree
 
           attributes :event_name, :event_id, :response_code, :execution_time,
                      :error_type, :request_errors, :response_body, :success,
-                     :payload,
                      created_at: :iso8601, updated_at: :iso8601,
                      delivered_at: :iso8601
 
+          # Redacted again on read: deliveries written before payload redaction
+          # shipped still hold live credentials in the column.
+          attribute :payload do |delivery|
+            Spree::WebhookPayloadRedaction.split(delivery.payload).first
+          end
+
           attribute :webhook_endpoint_id do |delivery|
             delivery.webhook_endpoint&.prefixed_id
           end

data/app/serializers/spree/api/v3/cart_serializer.rb

@@ -5,7 +5,7 @@ module Spree
       # Pre-purchase cart data with checkout progression info
       class CartSerializer < BaseSerializer
         typelize number: :string, current_step: :string, completed_steps: 'string[]', token: :string, email: [:string, nullable: true],
-                 customer_note: [:string, nullable: true], market_id: [:string, nullable: true],
+                 customer_note: [:string, nullable: true], market_id: [:string, nullable: true], channel_id: [:string, nullable: true],
                  currency: :string, locale: [:string, nullable: true], total_quantity: :number,
                  requirements: 'Array<{step: string, field: string, message: string}>',
                  item_total: [:string, nullable: true], display_item_total: [:string, nullable: true],
@@ -34,6 +34,13 @@ module Spree
           order.market&.prefixed_id
         end
 
+        # Which surface this cart belongs to — lets a multi-channel storefront
+        # verify a cookie-persisted cart against its own channel before
+        # adopting it (see the wholesale reference storefront's cart guard).
+        attribute :channel_id do |order|
+          order.channel&.prefixed_id
+        end
+
         attributes :number, :token, :email, :customer_note,
                    :currency, :locale, :total_quantity, :warnings
 

data/app/serializers/spree/api/v3/channel_serializer.rb

@@ -5,9 +5,17 @@ module Spree
         typelize name: :string,
                  code: :string,
                  active: :boolean,
-                 default: :boolean
+                 default: :boolean,
+                 storefront_access: :string,
+                 guest_checkout: :boolean
 
         attributes :name, :code, :active, :default
+
+        # Resolved (channel → store fallback) values — what a client should act
+        # on, as opposed to the raw nullable preferences on the admin serializer.
+        attribute :storefront_access, &:resolved_storefront_access
+
+        attribute :guest_checkout, &:resolved_guest_checkout
       end
     end
   end

data/app/serializers/spree/api/v3/customer_group_serializer.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V3
+      # Minimal customer-group shape for the Store API. Exposed on
+      # `customers/me` so a storefront can branch on membership (e.g. an
+      # approved wholesale buyer) — pricing itself always resolves
+      # server-side.
+      class CustomerGroupSerializer < BaseSerializer
+        typelize name: :string
+
+        attributes :name
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/customer_serializer.rb

@@ -37,6 +37,14 @@ module Spree
           store = params&.dig(:store) || Spree::Current.store
           user.newsletter_subscriber(store)
         end
+
+        # Membership signal for storefront branching (e.g. wholesale approval);
+        # scoped to the request store (params first — Spree::Current.store falls
+        # back to the DEFAULT store, wrong on sibling stores' domains) so other
+        # stores' memberships never leak.
+        many :customer_groups,
+             proc { |groups, params| groups.for_store(params&.dig(:store) || Spree::Current.store) },
+             resource: proc { Spree.api.customer_group_serializer }
       end
     end
   end

data/app/services/spree/webhooks/deliver_webhook.rb

@@ -56,7 +56,7 @@ module Spree
           'X-Spree-Webhook-Timestamp' => webhook_timestamp.to_s,
           'X-Spree-Webhook-Event' => @delivery.event_name
         }
-        body = @delivery.payload.to_json
+        body = payload_json
         http_options = { open_timeout: TIMEOUT, read_timeout: TIMEOUT, verify_mode: ssl_verify_mode }
 
         # SSRF protection is disabled in development so webhooks can reach
@@ -77,10 +77,14 @@ module Spree
       end
 
       def generate_signature
-        payload_json = @delivery.payload.to_json
         OpenSSL::HMAC.hexdigest('SHA256', @secret_key, "#{webhook_timestamp}.#{payload_json}")
       end
 
+      # Memoized so the signature is computed over exactly the bytes sent.
+      def payload_json
+        @payload_json ||= @delivery.deliverable_payload.to_json
+      end
+
       def webhook_timestamp
         @webhook_timestamp ||= Time.current.to_i
       end

data/app/subscribers/spree/webhook_event_subscriber.rb

@@ -56,13 +56,16 @@ module Spree
         )
       end
 
+      # Live credentials go over the wire but never into the delivery log.
+      persisted_payload, secrets = Spree::WebhookPayloadRedaction.split(payload)
+
       delivery = endpoint.webhook_deliveries.create!(
         event_name: event.name,
         event_id: event.id,
-        payload: payload
+        payload: persisted_payload
       )
 
-      Spree::WebhookDeliveryJob.perform_later(delivery.id)
+      Spree::WebhookDeliveryJob.perform_later(delivery.id, payload_secrets: secrets)
     rescue ActiveRecord::RecordNotUnique
       # Race condition: another thread already created this delivery — safe to ignore
     rescue StandardError => e

data/config/locales/en.yml

@@ -10,6 +10,8 @@ en:
       invalid_taxonomy_id: Invalid taxonomy id.
       must_specify_api_key: You must specify an API key.
       errors:
+        channel_inactive: The channel this API key is bound to is not active.
+        channel_mismatch: The requested channel does not match the channel this API key is bound to.
         guest_checkout_not_allowed: You must be signed in to complete checkout.
         storefront_login_required: Authentication required to access this store.
       negative_quantity: quantity is negative

data/config/routes.rb

@@ -20,6 +20,9 @@ Spree::Core::Engine.add_routes do
         resources :currencies, only: [:index]
         resources :locales, only: [:index]
 
+        # Current channel context (never a list — see Store::ChannelController)
+        resource :channel, only: [:show], controller: 'channel'
+
         # Catalog
         resources :products, only: [:index, :show] do
           collection do
@@ -342,8 +345,15 @@ Spree::Core::Engine.add_routes do
             post :add_products
             post :remove_products
           end
+
+          resources :order_routing_rules, only: [:index, :show, :create, :update, :destroy]
         end
 
+        # Subclass discovery for the routing-rules editor, mirroring
+        # `/promotion_rules/types`. Top-level so the SPA can build the
+        # "Add rule" picker without a parent channel.
+        get 'order_routing_rules/types', to: 'order_routing_rules#types'
+
         # Variants (top-level, for search/autocomplete across all products)
         resources :variants, only: [:index, :show], concerns: :custom_fieldable
 

data/lib/spree/api/dependencies.rb

@@ -112,6 +112,7 @@ module Spree
         fulfillment_serializer: 'Spree::Api::V3::FulfillmentSerializer',
         address_serializer: 'Spree::Api::V3::AddressSerializer',
         customer_serializer: 'Spree::Api::V3::CustomerSerializer',
+        customer_group_serializer: 'Spree::Api::V3::CustomerGroupSerializer',
         country_serializer: 'Spree::Api::V3::CountrySerializer',
         channel_serializer: 'Spree::Api::V3::ChannelSerializer',
         product_publication_serializer: 'Spree::Api::V3::ProductPublicationSerializer',
@@ -201,6 +202,7 @@ module Spree
         admin_admin_user_serializer: 'Spree::Api::V3::Admin::AdminUserSerializer',
         admin_address_serializer: 'Spree::Api::V3::Admin::AddressSerializer',
         admin_channel_serializer: 'Spree::Api::V3::Admin::ChannelSerializer',
+        admin_order_routing_rule_serializer: 'Spree::Api::V3::Admin::OrderRoutingRuleSerializer',
         admin_product_publication_serializer: 'Spree::Api::V3::Admin::ProductPublicationSerializer',
         admin_market_serializer: 'Spree::Api::V3::Admin::MarketSerializer',
         admin_shipping_method_serializer: 'Spree::Api::V3::Admin::DeliveryMethodSerializer',

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc3
+  version: 5.6.0.rc5
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-19 00:00:00.000000000 Z
+date: 2026-07-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc3
+        version: 5.6.0.rc5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc3
+        version: 5.6.0.rc5
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -142,6 +142,7 @@ files:
 - app/controllers/spree/api/v3/admin/me_controller.rb
 - app/controllers/spree/api/v3/admin/media_controller.rb
 - app/controllers/spree/api/v3/admin/option_types_controller.rb
+- app/controllers/spree/api/v3/admin/order_routing_rules_controller.rb
 - app/controllers/spree/api/v3/admin/orders/adjustments_controller.rb
 - app/controllers/spree/api/v3/admin/orders/base_controller.rb
 - app/controllers/spree/api/v3/admin/orders/fulfillments_controller.rb
@@ -189,6 +190,7 @@ files:
 - app/controllers/spree/api/v3/store/carts/store_credits_controller.rb
 - app/controllers/spree/api/v3/store/carts_controller.rb
 - app/controllers/spree/api/v3/store/categories_controller.rb
+- app/controllers/spree/api/v3/store/channel_controller.rb
 - app/controllers/spree/api/v3/store/countries_controller.rb
 - app/controllers/spree/api/v3/store/currencies_controller.rb
 - app/controllers/spree/api/v3/store/customer/addresses_controller.rb
@@ -251,6 +253,7 @@ files:
 - app/serializers/spree/api/v3/admin/newsletter_subscriber_serializer.rb
 - app/serializers/spree/api/v3/admin/option_type_serializer.rb
 - app/serializers/spree/api/v3/admin/option_value_serializer.rb
+- app/serializers/spree/api/v3/admin/order_routing_rule_serializer.rb
 - app/serializers/spree/api/v3/admin/order_serializer.rb
 - app/serializers/spree/api/v3/admin/payment_method_serializer.rb
 - app/serializers/spree/api/v3/admin/payment_serializer.rb
@@ -291,6 +294,7 @@ files:
 - app/serializers/spree/api/v3/credit_card_serializer.rb
 - app/serializers/spree/api/v3/currency_serializer.rb
 - app/serializers/spree/api/v3/custom_field_serializer.rb
+- app/serializers/spree/api/v3/customer_group_serializer.rb
 - app/serializers/spree/api/v3/customer_return_serializer.rb
 - app/serializers/spree/api/v3/customer_serializer.rb
 - app/serializers/spree/api/v3/delivery_method_serializer.rb
@@ -380,9 +384,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc3
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc5
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc3
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc5
 post_install_message:
 rdoc_options: []
 require_paths: