spree_api 5.6.0.rc4 → 5.6.0.rc6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca50a0fac8c0d346157c3d42a2969414d5f4e8a392aae87176cb02069c828e21
-  data.tar.gz: dc56eff71e891ef304710a9a2f2bfc7c72be17a50d0a24ba1335b137ea817057
+  metadata.gz: 9f86ce456fb13e7e6f1fac5a39a1ad7f0a4befe5dc959a88c80b3bcaa3689b57
+  data.tar.gz: 4df7f39849201749a3b5a26337a009a36ab0b9fc4b4588d5d90accf859368ec7
 SHA512:
-  metadata.gz: e1097d160a66eac8cee1e1b9169f06781c4105ddb01fce2bf560bcf0c94aeb7e0f947bd36675e17e7b6532af02c47999d242f23fb8359abaa866d3257775afd0
-  data.tar.gz: a48b3317819fd03b05d71b016a7856b5c1a8da5d238080964dd9980b0eef328f2a712aed8a903efffde9a86ee1c902903495aee339d01e4a5e216fae0886ffb7
+  metadata.gz: 7fa240df22e6815d24910c37e32b873a8dae7a4e0ded6c00430e7d895e287ae3ae6e78cb11fcbb52d4930f876e48e22bf8be7353eb317722789772a17ceb6aa9
+  data.tar.gz: b4623924dc7d63bb2abae38790fa31c5140392e6838cce8c1c530fd6314110856fcf55c8c5c8a2c01a81fff58a1a7106787a3f3615d1b0f0dd16af4b911c027c

data/app/controllers/concerns/spree/api/v3/http_caching.rb

@@ -22,10 +22,13 @@ module Spree
           current_user.nil?
         end
 
-        # Set Vary headers to ensure proper CDN caching by currency/locale
+        # Set Vary headers to ensure proper CDN caching by currency/locale/channel.
+        # X-Spree-Channel is included because the resolved channel changes the
+        # serialized body (price hiding + channel-scoped visibility), so a shared
+        # cache must not serve one channel's guest response to another channel.
         def set_vary_headers
           if guest_user?
-            response.headers['Vary'] = 'Accept, x-spree-currency, x-spree-locale'
+            response.headers['Vary'] = 'Accept, x-spree-currency, x-spree-locale, x-spree-channel'
           else
             response.headers['Cache-Control'] = 'private, no-store'
           end
@@ -67,14 +70,21 @@ module Spree
 
           expires_in expires_in, public: true
 
-          # Use Rails' stale? which handles ETag and Last-Modified
-          stale?(resource, public: true)
+          # Use Rails' stale? which handles ETag and Last-Modified. The channel
+          # is folded into the ETag so a shared cache never serves one channel's
+          # guest response to another; Last-Modified mirrors the resource's own
+          # timestamp as before.
+          stale?(
+            etag: [resource, cache_channel_fragment],
+            last_modified: resource.try(:updated_at),
+            public: true
+          )
         end
 
         private
 
         # Build a cache key for a collection
-        # Includes: latest updated_at, total count, query params, pagination, expand, currency, locale
+        # Includes: latest updated_at, total count, query params, pagination, expand, currency, locale, channel
         def collection_cache_key(collection)
           # For ActiveRecord collections use updated_at, for plain arrays use store's updated_at as proxy
           latest_updated_at = if collection.first&.respond_to?(:updated_at)
@@ -92,11 +102,22 @@ module Spree
             params[:page],
             params[:limit],
             current_currency,
-            current_locale
+            current_locale,
+            cache_channel_fragment
           ]
 
           parts.compact.join('/')
         end
+
+        # Identifies the resolved channel for cache-key purposes. The channel
+        # changes the serialized body (price hiding + channel-scoped visibility),
+        # so it must be part of the guest cache identity. Uses the same
+        # +current_channel+ source of truth as serialization/gating.
+        def cache_channel_fragment
+          return nil unless respond_to?(:current_channel, true)
+
+          current_channel&.id
+        end
       end
     end
   end

data/app/controllers/concerns/spree/api/v3/scoped_authorization.rb

@@ -56,10 +56,34 @@ module Spree
         private
 
         def authorize_api_key_scope!
-          return unless current_api_key
+          # Endpoints explicitly exempt from the scope mechanism (auth, me, public
+          # invitation acceptance, per-type-filtered exports, etc.) opt out first,
+          # before any key resolution or enforcement.
           return if self.class._scope_check_skipped
           return if self.class._scope_check_skipped_actions&.include?(action_name)
 
+          # Fail CLOSED, not open. A nil `current_api_key` legitimately means a
+          # non-secret-key request (JWT admin / publishable) authorized by other
+          # means, which correctly skips scope checks. But it ALSO happens when
+          # this guard runs before authentication resolved the key: a bare
+          # `return unless current_api_key` would then skip scope enforcement for
+          # an attacker-supplied secret key. So resolve the secret key in place
+          # here — never rely on before_action ordering. Only truly non-secret-key
+          # requests (nothing to resolve) are waved through.
+          resolve_current_api_key_for_scope_check!
+
+          unless current_api_key
+            return unless secret_key_request?
+
+            # A secret-key token was presented but did not resolve to a live key
+            # for this store — reject rather than silently skip the scope check.
+            return render_error(
+              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:invalid_token],
+              message: 'Valid secret API key required',
+              status: :unauthorized
+            )
+          end
+
           resource = scoped_resource_name
           # Fail closed: a controller authenticated by API key MUST declare
           # either `scoped_resource :name`, override `scoped_resource_name`,
@@ -77,6 +101,29 @@ module Spree
           )
         end
 
+        # True when the request presents a secret API key token (`sk_` prefix),
+        # regardless of whether authentication has resolved it into
+        # `current_api_key` yet. Used to keep the scope guard fail-closed even if
+        # it runs before the API key is loaded: a secret-key request whose key is
+        # still nil must be denied, never waved through.
+        def secret_key_request?
+          extract_api_key.to_s.start_with?(Spree::ApiKey::PREFIXES['secret'])
+        end
+
+        # Resolves the request's secret API key into `@current_api_key` if a
+        # secret-key token is present and it hasn't been resolved yet, so the scope
+        # check does not depend on `authenticate_admin!` having already run. Mirrors
+        # the secret-key resolution + store binding in AdminAuthentication, and is
+        # idempotent: when the key is already loaded (guard runs after auth) it does
+        # nothing.
+        def resolve_current_api_key_for_scope_check!
+          return if @current_api_key
+          return unless secret_key_request?
+
+          key = Spree::ApiKey.find_by_secret_token(extract_api_key)
+          @current_api_key = key if key && key.store_id == current_store.id
+        end
+
         # The resource name used in scope strings (`read_<name>` / `write_<name>`).
         # Defaults to the class-level `scoped_resource :name` declaration.
         # Override in controllers that resolve scope at request time (e.g. the
@@ -86,10 +133,15 @@ module Spree
           self.class._scoped_resource
         end
 
-        # Override in controllers with non-REST custom actions (e.g. dashboard
-        # `analytics` should map to a read).
+        # Maps the action to the scope kind. Consults the controller's
+        # `read_actions` (ResourceController's overridable list) when defined,
+        # so declaring a custom read-only action once — e.g. `types` — fixes
+        # both the CanCanCan action mapping and the required scope kind.
+        # Controllers outside the ResourceController hierarchy can still
+        # override `action_kind` directly (e.g. dashboard `analytics`).
         def action_kind
-          READ_ACTIONS.include?(action_name) ? 'read' : 'write'
+          read = respond_to?(:read_actions, true) ? read_actions : READ_ACTIONS
+          read.include?(action_name) ? 'read' : 'write'
         end
 
         # True when authorization derives from the API key's scopes rather

data/app/controllers/spree/api/v3/admin/base_controller.rb

@@ -4,9 +4,13 @@ module Spree
       module Admin
         class BaseController < Spree::Api::V3::BaseController
           include Spree::Api::V3::AdminAuthentication
-          include Spree::Api::V3::ScopedAuthorization
 
+          # Must be registered before ScopedAuthorization so authenticate_admin!
+          # resolves @current_api_key before authorize_api_key_scope! reads it —
+          # otherwise the scope guard short-circuits on a nil key and never runs.
           before_action :authenticate_admin!
+
+          include Spree::Api::V3::ScopedAuthorization
         end
       end
     end

data/app/controllers/spree/api/v3/admin/order_routing_rules_controller.rb

@@ -0,0 +1,65 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # CRUD for `Spree::OrderRoutingRule` STI subclasses, nested under the
+        # owning channel. Same shape as PromotionRulesController — the registry
+        # is `Spree.order_routing.rules` and the parent is a Channel.
+        class OrderRoutingRulesController < ResourceController
+          include Spree::Api::V3::Admin::SubclassedResource
+
+          scoped_resource :settings
+
+          subclassed_via -> { Spree.order_routing.rules },
+                         unknown_type_error: 'unknown_order_routing_rule_type'
+
+          def types
+            authorize! :read, model_class
+
+            render json: { data: model_class.subclasses_with_preference_schema }
+          end
+
+          protected
+
+          def model_class
+            Spree::OrderRoutingRule
+          end
+
+          def serializer_class
+            Spree.api.admin_order_routing_rule_serializer
+          end
+
+          def permitted_params
+            params.permit(:type, :active, :position, preferences: {})
+          end
+
+          # `types` is read-only discovery — maps to the read scope + :show ability.
+          def read_actions
+            super + %w[types]
+          end
+
+          def scope
+            super.ordered
+          end
+
+          def set_parent
+            return if action_name == 'types'
+
+            @parent = current_store.channels.accessible_by(current_ability, parent_ability_action)
+                                   .find_by_prefix_id!(params[:channel_id])
+          end
+
+          def parent_association
+            :order_routing_rules
+          end
+
+          private
+
+          def build_subclassed_resource(klass, attrs)
+            klass.new(attrs.merge(channel: @parent, store: @parent.store))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/payment_methods_controller.rb

@@ -51,6 +51,11 @@ module Spree
             params.permit(:name, :description, :active, :storefront_visible, :auto_capture, :position, metadata: {}, preferences: {})
           end
 
+          # `types` is read-only discovery — maps to the read scope + :show ability.
+          def read_actions
+            super + %w[types]
+          end
+
           private
 
           # New payment methods are created through the current store.

data/app/controllers/spree/api/v3/admin/promotion_actions_controller.rb

@@ -55,6 +55,11 @@ module Spree
             params.permit(:type, preferences: {})
           end
 
+          # `types`/`calculators` are read-only discovery — read scope + :show ability.
+          def read_actions
+            super + %w[types calculators]
+          end
+
           def set_parent
             return if %w[types calculators].include?(action_name)
 

data/app/controllers/spree/api/v3/admin/promotion_rules_controller.rb

@@ -33,6 +33,11 @@ module Spree
             params.permit(:type, preferences: {})
           end
 
+          # `types` is read-only discovery — maps to the read scope + :show ability.
+          def read_actions
+            super + %w[types]
+          end
+
           def set_parent
             return if action_name == 'types'
 

data/app/controllers/spree/api/v3/admin/store_controller.rb

@@ -42,6 +42,7 @@ module Spree
               :preferred_storefront_access,
               :preferred_storefront_url,
               :preferred_guest_checkout,
+              :preferred_order_routing_strategy,
               :mail_from_address,
               :customer_support_email,
               :new_order_notifications_email,

data/app/controllers/spree/api/v3/admin/tags_controller.rb

@@ -60,15 +60,24 @@ module Spree
             false
           end
 
-          # Tagging filter. `Spree::Order` carries a `tenant` (store_id) column
-          # via `acts_as_taggable_tenant`, so its tag vocabulary is bounded to
-          # the current store; other taggables fall back to the type filter.
+          # Tagging filter. Store-owned taggables (`Spree::Product`,
+          # `Spree::Order`) tenant their taggings by `store_id` via
+          # `acts_as_taggable_tenant`, so their vocabulary is bounded to the
+          # current store with a single indexed `tenant` filter. Global
+          # taggables like the customer/user type carry no store, so their tags
+          # are not store-scoped here.
           def taggings_conditions
             conditions = { taggable_type: taggable_type, context: 'tags' }
-            conditions[:tenant] = current_store.id.to_s if taggable_type == 'Spree::Order'
+            conditions[:tenant] = current_store.id.to_s if store_tenanted_taggable?
             conditions
           end
 
+          # True for taggables whose taggings carry a store `tenant`
+          # (`acts_as_taggable_tenant :store_id`), i.e. store-owned records.
+          def store_tenanted_taggable?
+            %w[Spree::Product Spree::Order].include?(taggable_type)
+          end
+
           # Per-type scope check for API-key principals: a key listing product
           # tags needs `read_products`, order tags `read_orders`, etc. JWT
           # admins are gated by store membership + CanCanCan, not scopes.

data/app/serializers/spree/api/v3/admin/order_routing_rule_serializer.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Serializes Spree::OrderRoutingRule (and its STI subclasses) for the
+        # per-channel routing-rules editor. Same shape as PromotionRule so the
+        # frontend renders both with the same schema-driven preference form.
+        class OrderRoutingRuleSerializer < BaseSerializer
+          typelize type: :string,
+                   channel_id: :string,
+                   position: :number,
+                   active: :boolean,
+                   preferences: 'Record<string, unknown>',
+                   preference_schema: "Array<{ key: string; type: string; default: unknown }>",
+                   label: :string,
+                   description: :string
+
+          attributes :position, :active
+          attributes created_at: :iso8601, updated_at: :iso8601
+
+          attribute :type do |rule|
+            rule.class.api_type
+          end
+
+          attribute :channel_id do |rule|
+            rule.channel&.prefixed_id
+          end
+
+          attribute :preferences, &:serialized_preferences
+          attribute :preference_schema, &:serialized_preference_schema
+
+          attribute :label, &:human_name
+          attribute :description, &:human_description
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/store_serializer.rb

@@ -21,6 +21,7 @@ module Spree
                    preferred_unit_system: :string,
                    preferred_storefront_access: :string,
                    preferred_guest_checkout: :boolean,
+                   preferred_order_routing_strategy: :string,
                    metadata: 'Record<string, unknown>'
 
           attributes :metadata,
@@ -39,6 +40,7 @@ module Spree
                      :preferred_unit_system,
                      :preferred_storefront_access,
                      :preferred_guest_checkout,
+                     :preferred_order_routing_strategy,
                      created_at: :iso8601, updated_at: :iso8601
 
           attribute :url, &:storefront_url

data/config/routes.rb

@@ -345,8 +345,15 @@ Spree::Core::Engine.add_routes do
             post :add_products
             post :remove_products
           end
+
+          resources :order_routing_rules, only: [:index, :show, :create, :update, :destroy]
         end
 
+        # Subclass discovery for the routing-rules editor, mirroring
+        # `/promotion_rules/types`. Top-level so the SPA can build the
+        # "Add rule" picker without a parent channel.
+        get 'order_routing_rules/types', to: 'order_routing_rules#types'
+
         # Variants (top-level, for search/autocomplete across all products)
         resources :variants, only: [:index, :show], concerns: :custom_fieldable
 

data/lib/spree/api/dependencies.rb

@@ -202,6 +202,7 @@ module Spree
         admin_admin_user_serializer: 'Spree::Api::V3::Admin::AdminUserSerializer',
         admin_address_serializer: 'Spree::Api::V3::Admin::AddressSerializer',
         admin_channel_serializer: 'Spree::Api::V3::Admin::ChannelSerializer',
+        admin_order_routing_rule_serializer: 'Spree::Api::V3::Admin::OrderRoutingRuleSerializer',
         admin_product_publication_serializer: 'Spree::Api::V3::Admin::ProductPublicationSerializer',
         admin_market_serializer: 'Spree::Api::V3::Admin::MarketSerializer',
         admin_shipping_method_serializer: 'Spree::Api::V3::Admin::DeliveryMethodSerializer',

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc4
+  version: 5.6.0.rc6
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-20 00:00:00.000000000 Z
+date: 2026-07-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc4
+        version: 5.6.0.rc6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc4
+        version: 5.6.0.rc6
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -142,6 +142,7 @@ files:
 - app/controllers/spree/api/v3/admin/me_controller.rb
 - app/controllers/spree/api/v3/admin/media_controller.rb
 - app/controllers/spree/api/v3/admin/option_types_controller.rb
+- app/controllers/spree/api/v3/admin/order_routing_rules_controller.rb
 - app/controllers/spree/api/v3/admin/orders/adjustments_controller.rb
 - app/controllers/spree/api/v3/admin/orders/base_controller.rb
 - app/controllers/spree/api/v3/admin/orders/fulfillments_controller.rb
@@ -252,6 +253,7 @@ files:
 - app/serializers/spree/api/v3/admin/newsletter_subscriber_serializer.rb
 - app/serializers/spree/api/v3/admin/option_type_serializer.rb
 - app/serializers/spree/api/v3/admin/option_value_serializer.rb
+- app/serializers/spree/api/v3/admin/order_routing_rule_serializer.rb
 - app/serializers/spree/api/v3/admin/order_serializer.rb
 - app/serializers/spree/api/v3/admin/payment_method_serializer.rb
 - app/serializers/spree/api/v3/admin/payment_serializer.rb
@@ -382,9 +384,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc4
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc6
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc4
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc6
 post_install_message:
 rdoc_options: []
 require_paths: