spree_api 5.6.0.rc5 → 5.6.0.rc6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eee15468ad97bc5af5ed27d4e0ed4f4149c8b325efe81d9ef05d91af84094a27
-  data.tar.gz: c5d97420fb0bf65903f944487e102a57f957babdb7119dc2406307c0d45b2634
+  metadata.gz: 9f86ce456fb13e7e6f1fac5a39a1ad7f0a4befe5dc959a88c80b3bcaa3689b57
+  data.tar.gz: 4df7f39849201749a3b5a26337a009a36ab0b9fc4b4588d5d90accf859368ec7
 SHA512:
-  metadata.gz: e7783e8de7f1681b747863d5f9d161e1c5b8d05e1c087b5454332868fa81caaf7900e421fb60dabcca24b1d8ffbb99abf68338b0e85f13d6f456708e8c35e40f
-  data.tar.gz: 30aad9e4cc778ae8d11b1527053cf1f96f4fc75846ee48422152939a050a2506537824c1ffbeafc0b53dd8bd7c9c927ff39f5014ef462b9581c2f66a177d6ee7
+  metadata.gz: 7fa240df22e6815d24910c37e32b873a8dae7a4e0ded6c00430e7d895e287ae3ae6e78cb11fcbb52d4930f876e48e22bf8be7353eb317722789772a17ceb6aa9
+  data.tar.gz: b4623924dc7d63bb2abae38790fa31c5140392e6838cce8c1c530fd6314110856fcf55c8c5c8a2c01a81fff58a1a7106787a3f3615d1b0f0dd16af4b911c027c

data/app/controllers/concerns/spree/api/v3/http_caching.rb

@@ -22,10 +22,13 @@ module Spree
           current_user.nil?
         end
 
-        # Set Vary headers to ensure proper CDN caching by currency/locale
+        # Set Vary headers to ensure proper CDN caching by currency/locale/channel.
+        # X-Spree-Channel is included because the resolved channel changes the
+        # serialized body (price hiding + channel-scoped visibility), so a shared
+        # cache must not serve one channel's guest response to another channel.
         def set_vary_headers
           if guest_user?
-            response.headers['Vary'] = 'Accept, x-spree-currency, x-spree-locale'
+            response.headers['Vary'] = 'Accept, x-spree-currency, x-spree-locale, x-spree-channel'
           else
             response.headers['Cache-Control'] = 'private, no-store'
           end
@@ -67,14 +70,21 @@ module Spree
 
           expires_in expires_in, public: true
 
-          # Use Rails' stale? which handles ETag and Last-Modified
-          stale?(resource, public: true)
+          # Use Rails' stale? which handles ETag and Last-Modified. The channel
+          # is folded into the ETag so a shared cache never serves one channel's
+          # guest response to another; Last-Modified mirrors the resource's own
+          # timestamp as before.
+          stale?(
+            etag: [resource, cache_channel_fragment],
+            last_modified: resource.try(:updated_at),
+            public: true
+          )
         end
 
         private
 
         # Build a cache key for a collection
-        # Includes: latest updated_at, total count, query params, pagination, expand, currency, locale
+        # Includes: latest updated_at, total count, query params, pagination, expand, currency, locale, channel
         def collection_cache_key(collection)
           # For ActiveRecord collections use updated_at, for plain arrays use store's updated_at as proxy
           latest_updated_at = if collection.first&.respond_to?(:updated_at)
@@ -92,11 +102,22 @@ module Spree
             params[:page],
             params[:limit],
             current_currency,
-            current_locale
+            current_locale,
+            cache_channel_fragment
           ]
 
           parts.compact.join('/')
         end
+
+        # Identifies the resolved channel for cache-key purposes. The channel
+        # changes the serialized body (price hiding + channel-scoped visibility),
+        # so it must be part of the guest cache identity. Uses the same
+        # +current_channel+ source of truth as serialization/gating.
+        def cache_channel_fragment
+          return nil unless respond_to?(:current_channel, true)
+
+          current_channel&.id
+        end
       end
     end
   end

data/app/controllers/concerns/spree/api/v3/scoped_authorization.rb

@@ -56,10 +56,34 @@ module Spree
         private
 
         def authorize_api_key_scope!
-          return unless current_api_key
+          # Endpoints explicitly exempt from the scope mechanism (auth, me, public
+          # invitation acceptance, per-type-filtered exports, etc.) opt out first,
+          # before any key resolution or enforcement.
           return if self.class._scope_check_skipped
           return if self.class._scope_check_skipped_actions&.include?(action_name)
 
+          # Fail CLOSED, not open. A nil `current_api_key` legitimately means a
+          # non-secret-key request (JWT admin / publishable) authorized by other
+          # means, which correctly skips scope checks. But it ALSO happens when
+          # this guard runs before authentication resolved the key: a bare
+          # `return unless current_api_key` would then skip scope enforcement for
+          # an attacker-supplied secret key. So resolve the secret key in place
+          # here — never rely on before_action ordering. Only truly non-secret-key
+          # requests (nothing to resolve) are waved through.
+          resolve_current_api_key_for_scope_check!
+
+          unless current_api_key
+            return unless secret_key_request?
+
+            # A secret-key token was presented but did not resolve to a live key
+            # for this store — reject rather than silently skip the scope check.
+            return render_error(
+              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:invalid_token],
+              message: 'Valid secret API key required',
+              status: :unauthorized
+            )
+          end
+
           resource = scoped_resource_name
           # Fail closed: a controller authenticated by API key MUST declare
           # either `scoped_resource :name`, override `scoped_resource_name`,
@@ -77,6 +101,29 @@ module Spree
           )
         end
 
+        # True when the request presents a secret API key token (`sk_` prefix),
+        # regardless of whether authentication has resolved it into
+        # `current_api_key` yet. Used to keep the scope guard fail-closed even if
+        # it runs before the API key is loaded: a secret-key request whose key is
+        # still nil must be denied, never waved through.
+        def secret_key_request?
+          extract_api_key.to_s.start_with?(Spree::ApiKey::PREFIXES['secret'])
+        end
+
+        # Resolves the request's secret API key into `@current_api_key` if a
+        # secret-key token is present and it hasn't been resolved yet, so the scope
+        # check does not depend on `authenticate_admin!` having already run. Mirrors
+        # the secret-key resolution + store binding in AdminAuthentication, and is
+        # idempotent: when the key is already loaded (guard runs after auth) it does
+        # nothing.
+        def resolve_current_api_key_for_scope_check!
+          return if @current_api_key
+          return unless secret_key_request?
+
+          key = Spree::ApiKey.find_by_secret_token(extract_api_key)
+          @current_api_key = key if key && key.store_id == current_store.id
+        end
+
         # The resource name used in scope strings (`read_<name>` / `write_<name>`).
         # Defaults to the class-level `scoped_resource :name` declaration.
         # Override in controllers that resolve scope at request time (e.g. the

data/app/controllers/spree/api/v3/admin/base_controller.rb

@@ -4,9 +4,13 @@ module Spree
       module Admin
         class BaseController < Spree::Api::V3::BaseController
           include Spree::Api::V3::AdminAuthentication
-          include Spree::Api::V3::ScopedAuthorization
 
+          # Must be registered before ScopedAuthorization so authenticate_admin!
+          # resolves @current_api_key before authorize_api_key_scope! reads it —
+          # otherwise the scope guard short-circuits on a nil key and never runs.
           before_action :authenticate_admin!
+
+          include Spree::Api::V3::ScopedAuthorization
         end
       end
     end

data/app/controllers/spree/api/v3/admin/tags_controller.rb

@@ -60,15 +60,24 @@ module Spree
             false
           end
 
-          # Tagging filter. `Spree::Order` carries a `tenant` (store_id) column
-          # via `acts_as_taggable_tenant`, so its tag vocabulary is bounded to
-          # the current store; other taggables fall back to the type filter.
+          # Tagging filter. Store-owned taggables (`Spree::Product`,
+          # `Spree::Order`) tenant their taggings by `store_id` via
+          # `acts_as_taggable_tenant`, so their vocabulary is bounded to the
+          # current store with a single indexed `tenant` filter. Global
+          # taggables like the customer/user type carry no store, so their tags
+          # are not store-scoped here.
           def taggings_conditions
             conditions = { taggable_type: taggable_type, context: 'tags' }
-            conditions[:tenant] = current_store.id.to_s if taggable_type == 'Spree::Order'
+            conditions[:tenant] = current_store.id.to_s if store_tenanted_taggable?
             conditions
           end
 
+          # True for taggables whose taggings carry a store `tenant`
+          # (`acts_as_taggable_tenant :store_id`), i.e. store-owned records.
+          def store_tenanted_taggable?
+            %w[Spree::Product Spree::Order].include?(taggable_type)
+          end
+
           # Per-type scope check for API-key principals: a key listing product
           # tags needs `read_products`, order tags `read_orders`, etc. JWT
           # admins are gated by store membership + CanCanCan, not scopes.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc5
+  version: 5.6.0.rc6
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-22 00:00:00.000000000 Z
+date: 2026-07-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc5
+        version: 5.6.0.rc6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc5
+        version: 5.6.0.rc6
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -384,9 +384,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc5
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc6
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc5
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc6
 post_install_message:
 rdoc_options: []
 require_paths: