spree_api 5.6.0.rc6 → 5.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9f86ce456fb13e7e6f1fac5a39a1ad7f0a4befe5dc959a88c80b3bcaa3689b57
-  data.tar.gz: 4df7f39849201749a3b5a26337a009a36ab0b9fc4b4588d5d90accf859368ec7
+  metadata.gz: 4feafcfd958681a7548cc9a2e043d7748e98d40fb34426c2aac5cbdc17599472
+  data.tar.gz: fce6786a2b4f6a41c32a26c34510172032ad9d57095058729261ea90cfc28f1f
 SHA512:
-  metadata.gz: 7fa240df22e6815d24910c37e32b873a8dae7a4e0ded6c00430e7d895e287ae3ae6e78cb11fcbb52d4930f876e48e22bf8be7353eb317722789772a17ceb6aa9
-  data.tar.gz: b4623924dc7d63bb2abae38790fa31c5140392e6838cce8c1c530fd6314110856fcf55c8c5c8a2c01a81fff58a1a7106787a3f3615d1b0f0dd16af4b911c027c
+  metadata.gz: 975ceabf8977c54e813177f08cf270e8688dc64e6e446d176e46310696ffc8672dcfb940c19eb0f4c7eace5b765e5883932eca08d973c432e4389539b27709af
+  data.tar.gz: 9c0ad20112afb852ff2cedd8421f6853a5ce098b0feb435d6346ca015d1190ac891ac38138f98e526bfc973e6f16afb27aadc0917065c236d33ea4023fe34f30

data/app/controllers/spree/api/v3/admin/admin_users_controller.rb

@@ -60,7 +60,7 @@ module Spree
           end
 
           def collection_includes
-            [{ role_users: :role, avatar_attachment: :blob }]
+            [{ role_users: :role, avatar_attachment: :blob }, :stores]
           end
 
           # Restrict to users with a role assignment on the current store.

data/app/controllers/spree/api/v3/admin/channels_controller.rb

@@ -44,7 +44,8 @@ module Spree
           end
 
           def permitted_params
-            params.permit(:name, :code, :active, :default, :preferred_order_routing_strategy)
+            params.permit(:name, :code, :active, :default, :preferred_order_routing_strategy,
+                          :preferred_storefront_access, :preferred_guest_checkout)
           end
 
           private

data/app/controllers/spree/api/v3/admin/custom_field_definitions_controller.rb

@@ -25,7 +25,8 @@ module Spree
           # API → DB column rename lands in 6.0 and this controller stays flat.
           def permitted_params
             params.permit(:namespace, :key, :label, :field_type,
-                          :resource_type, :storefront_visible)
+                          :resource_type, :storefront_visible,
+                          :searchable, :sortable)
           end
         end
       end

data/app/controllers/spree/api/v3/admin/exports_controller.rb

@@ -106,17 +106,19 @@ module Spree
 
           # Returns the registered Export subclass matching `name`, or nil.
           #
-          # The constantize target comes from `available_types` (a trusted
-          # in-process registry), not from the request — `name` is only used
-          # to *select* an entry in the allowlist. This keeps the data flow
-          # from user input → trusted-string → `constantize` legible to
-          # static analyzers (CodeQL otherwise flags the inverse pattern of
-          # gating user input with `include?` before calling `constantize`).
+          # Takes the API shorthand (`"products"`), the same value the
+          # serializer emits. The fully-qualified class name is also accepted so
+          # a `type` read back from the API round-trips either way.
+          #
+          # The class comes from `available_types` (a trusted in-process
+          # registry), not from the request — `name` is only used to *select* an
+          # entry in the allowlist, which also keeps the data flow legible to
+          # static analyzers (no `constantize` on user input at all).
           def resolve_export_type(name)
             return nil if name.blank?
 
-            target = Spree::Export.available_types.map(&:to_s).find { |t| t == name.to_s }
-            target&.constantize
+            name = name.to_s
+            Spree::Export.available_types.find { |type| type.api_type == name || type.to_s == name }
           end
 
           private

data/app/controllers/spree/api/v3/admin/imports_controller.rb

@@ -150,13 +150,37 @@ module Spree
               )
             end
 
-            headers = klass.new.schema_fields.map { |field| field[:name] }
-            send_data ::CSV.generate_line(headers),
-                      filename: "#{klass.name.demodulize.underscore}_import_template.csv",
+            import = klass.new
+            send_data import.template_csv,
+                      filename: import.template_csv_filename,
                       type: 'text/csv',
                       disposition: 'attachment'
           end
 
+          # GET /api/v3/admin/imports/example?type=products
+          #
+          # Redirects to the populated example CSV for the type — the counterpart
+          # to `template` above. 404s for a type that ships no example file.
+          #
+          # The client can't build this URL itself: it is pinned to the
+          # installed Spree version, and exposing that version over the API
+          # would fingerprint the deployment for anyone matching CVEs. Resolving
+          # it here keeps the version server-side.
+          def example
+            klass = resolve_import_type(params[:type])
+            url = klass&.sample_csv_url
+
+            unless url
+              return render_error(
+                code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:record_not_found],
+                message: 'No example CSV for this import type',
+                status: :not_found
+              )
+            end
+
+            redirect_to url, allow_other_host: true, status: :found
+          end
+
           protected
 
           def model_class
@@ -215,15 +239,19 @@ module Spree
 
           # Returns the registered Import subclass matching `name`, or nil.
           #
-          # The constantize target comes from `available_types` (a trusted
-          # in-process registry), not from the request — `name` is only used
-          # to *select* an entry in the allowlist (same pattern as
+          # Takes the API shorthand (`"products"`), the same value the
+          # serializer emits. The fully-qualified class name is also accepted so
+          # a `type` read back from the API round-trips either way.
+          #
+          # The class comes from `available_types` (a trusted in-process
+          # registry), not from the request — `name` is only used to *select* an
+          # entry in the allowlist (same pattern as
           # ExportsController#resolve_export_type).
           def resolve_import_type(name)
             return nil if name.blank?
 
-            target = Spree::Import.available_types.map(&:to_s).find { |t| t == name.to_s }
-            target&.constantize
+            name = name.to_s
+            Spree::Import.available_types.find { |type| type.api_type == name || type.to_s == name }
           end
 
           private
@@ -241,7 +269,7 @@ module Spree
 
           def import_class
             case action_name
-            when 'create', 'template' then resolve_import_type(params[:type])
+            when 'create', 'template', 'example' then resolve_import_type(params[:type])
             else find_resource.class
             end
           end

data/app/controllers/spree/api/v3/store/customer/credit_cards_controller.rb

@@ -16,6 +16,13 @@ module Spree
               :credit_cards
             end
 
+            # Customers are global; a saved card belongs to the store-scoped
+            # payment method it was created against, so the nested collection is
+            # bound to the current store's payment methods.
+            def scope
+              @parent.credit_cards.where(payment_method_id: current_store.payment_methods.select(:id))
+            end
+
             def model_class
               Spree::CreditCard
             end

data/app/controllers/spree/api/v3/store/products/filters_controller.rb

@@ -44,7 +44,8 @@ module Spree
                 search_query,
                 search_filters&.sort_by(&:first)&.to_json,
                 max_updated,
-                product_count
+                product_count,
+                search_provider.metafield_schema.schema_version
               ]
 
               parts.compact.join('/')

data/app/serializers/spree/api/v3/admin/admin_user_serializer.rb

@@ -9,7 +9,8 @@ module Spree
                    full_name: [:string, nullable: true],
                    selected_locale: [:string, nullable: true],
                    avatar_url: [:string, nullable: true],
-                   roles: 'Array<{ id: string; name: string }>'
+                   roles: 'Array<{ id: string; name: string }>',
+                   stores: 'Array<{ id: string; name: string; code: string }>'
 
           attributes :email, :first_name, :last_name, :full_name, :selected_locale,
                      created_at: :iso8601, updated_at: :iso8601
@@ -30,6 +31,18 @@ module Spree
             scope = scope.where(resource: store) if store
             scope.includes(:role).map { |ru| { id: ru.role.prefixed_id, name: ru.role.name } }
           end
+
+          # Every store this user holds a role on (via `Spree::RoleUser`) —
+          # unlike `roles`, deliberately NOT scoped to the current store, so
+          # the dashboard store switcher can offer all accessible stores.
+          # Dedupe/sort happen in Ruby (not `.distinct.order`) so the staff
+          # index's `collection_includes` preload is used instead of firing
+          # an extra query per user.
+          attribute :stores do |user|
+            user.stores.uniq.sort_by(&:name).map do |store|
+              { id: store.prefixed_id, name: store.name, code: store.code }
+            end
+          end
         end
       end
     end

data/app/serializers/spree/api/v3/admin/custom_field_definition_serializer.rb

@@ -10,9 +10,13 @@ module Spree
                    label: :string,
                    field_type: Spree::Metafield::FIELD_TYPE_TOKENS,
                    resource_type: :string,
-                   storefront_visible: :boolean
+                   storefront_visible: :boolean,
+                   searchable: :boolean,
+                   sortable: :boolean,
+                   filter_key: :string
 
           attributes :namespace, :key, :label, :field_type, :resource_type, :storefront_visible,
+                     :searchable, :sortable, :filter_key,
                      created_at: :iso8601, updated_at: :iso8601
         end
       end

data/app/serializers/spree/api/v3/admin/media_serializer.rb

@@ -33,7 +33,12 @@ module Spree
             end
           end
 
-          attributes :metadata, :viewable_type
+          attributes :metadata
+
+          # `"product"` / `"variant"`, not the polymorphic class name.
+          attribute :viewable_type do |asset|
+            Spree::Base.polymorphic_api_type(asset.viewable_type)
+          end
         end
       end
     end

data/app/serializers/spree/api/v3/asset_serializer.rb

@@ -4,7 +4,10 @@ module Spree
   module Api
     module V3
       class AssetSerializer < BaseSerializer
-        typelize type: [:string, nullable: true], viewable_type: :string,
+        # `type` is not exposed: Spree::Image/Spree::Video were collapsed into
+        # Spree::Asset, so the STI column is a legacy vestige with no subclasses
+        # — `media_type` is the discriminator (see MediaSerializer).
+        typelize media_type: :string, viewable_type: :string,
                  viewable_id: :string, position: [:number, nullable: true],
                  alt: [:string, nullable: true]
 
@@ -12,7 +15,12 @@ module Spree
           asset.viewable&.prefixed_id
         end
 
-        attributes :type, :viewable_type, :position, :alt,
+        # `"product"` / `"variant"`, not the polymorphic class name.
+        attribute :viewable_type do |asset|
+          Spree::Base.polymorphic_api_type(asset.viewable_type)
+        end
+
+        attributes :media_type, :position, :alt,
                    created_at: :iso8601, updated_at: :iso8601
       end
     end

data/app/serializers/spree/api/v3/export_serializer.rb

@@ -7,9 +7,17 @@ module Spree
         typelize number: :string, type: [:string, nullable: true], format: [:string, nullable: true],
                  user_id: [:string, nullable: true]
 
-        attributes :number, :type, :format,
+        attributes :number, :format,
                    created_at: :iso8601, updated_at: :iso8601
 
+        # Wire shorthand (`"products"`), not the Ruby class name — clients
+        # shouldn't have to know or parse `Spree::Exports::Products`. Read from
+        # the STI column rather than the instance's class so a record loaded as
+        # the base Spree::Export still reports its real type.
+        attribute :type do |export|
+          Spree::Export.api_type_for(export.type)
+        end
+
         attribute :user_id do |export|
           export.user&.prefixed_id
         end

data/app/serializers/spree/api/v3/import_row_serializer.rb

@@ -8,13 +8,18 @@ module Spree
                  status: :string, validation_errors: [:string, nullable: true],
                  item_type: [:string, nullable: true], item_id: [:string, nullable: true]
 
-        attributes :row_number, :status, :validation_errors, :item_type,
+        attributes :row_number, :status, :validation_errors,
                    created_at: :iso8601, updated_at: :iso8601
 
         attribute :import_id do |row|
           row.import&.prefixed_id
         end
 
+        # `"product"` / `"variant"`, not the polymorphic class name.
+        attribute :item_type do |row|
+          Spree::Base.polymorphic_api_type(row.item_type)
+        end
+
         attribute :item_id do |row|
           row.item&.prefixed_id
         end

data/app/serializers/spree/api/v3/import_serializer.rb

@@ -8,15 +8,24 @@ module Spree
                  owner_type: [:string, nullable: true], owner_id: [:string, nullable: true],
                  user_id: [:string, nullable: true], rows_count: :number
 
-        attributes :number, :type, :rows_count,
+        attributes :number, :rows_count,
                    created_at: :iso8601, updated_at: :iso8601
 
+        # Wire shorthand (`"products"`), not the Ruby class name — clients
+        # shouldn't have to know or parse `Spree::Imports::Products`. Read from
+        # the STI column rather than the instance's class so a record loaded as
+        # the base Spree::Import still reports its real type.
+        attribute :type do |import|
+          Spree::Import.api_type_for(import.type)
+        end
+
         attribute :status do |import|
           import.status.to_s
         end
 
+        # `"store"` / `"vendor"`, not the polymorphic class name.
         attribute :owner_type do |import|
-          import.owner_type
+          Spree::Base.polymorphic_api_type(import.owner_type)
         end
 
         attribute :owner_id do |import|

data/app/serializers/spree/api/v3/invitation_serializer.rb

@@ -11,13 +11,26 @@ module Spree
                  role_id: [:string, nullable: true],
                  expires_at: [:string, nullable: true], accepted_at: [:string, nullable: true]
 
-        attributes :email, :resource_type, :inviter_type, :invitee_type,
+        attributes :email,
                    created_at: :iso8601, updated_at: :iso8601
 
         attribute :status do |invitation|
           invitation.status.to_s
         end
 
+        # `"store"` / `"admin_user"`, not the polymorphic class names.
+        attribute :resource_type do |invitation|
+          Spree::Base.polymorphic_api_type(invitation.resource_type)
+        end
+
+        attribute :inviter_type do |invitation|
+          Spree::Base.polymorphic_api_type(invitation.inviter_type)
+        end
+
+        attribute :invitee_type do |invitation|
+          Spree::Base.polymorphic_api_type(invitation.invitee_type)
+        end
+
         attribute :resource_id do |invitation|
           invitation.resource&.prefixed_id
         end

data/app/serializers/spree/api/v3/product_filter_sort_option_serializer.rb

@@ -2,9 +2,9 @@ module Spree
   module Api
     module V3
       class ProductFilterSortOptionSerializer < BaseSerializer
-        typelize id: :string
+        typelize id: :string, label: 'string | null'
 
-        attributes :id
+        attributes :id, :label
       end
     end
   end

data/app/serializers/spree/api/v3/report_serializer.rb

@@ -9,7 +9,13 @@ module Spree
                  currency: [:string, nullable: true],
                  date_from: [:string, nullable: true], date_to: [:string, nullable: true]
 
-        attributes :type, :currency
+        attributes :currency
+
+        # Wire shorthand (`"sales_total"`), not the Ruby class name — clients
+        # shouldn't have to know or parse `Spree::Reports::SalesTotal`.
+        attribute :type do |report|
+          Spree::Report.api_type_for(report.type)
+        end
 
         attribute :user_id do |report|
           report.user&.prefixed_id

data/app/serializers/spree/api/v3/stock_movement_serializer.rb

@@ -8,9 +8,14 @@ module Spree
                  originator_type: [:string, nullable: true], originator_id: [:string, nullable: true],
                  stock_item_id: [:string, nullable: true]
 
-        attributes :quantity, :action, :originator_type,
+        attributes :quantity, :action,
                    created_at: :iso8601, updated_at: :iso8601
 
+        # `"shipment"` / `"stock_transfer"`, not the polymorphic class name.
+        attribute :originator_type do |movement|
+          Spree::Base.polymorphic_api_type(movement.originator_type)
+        end
+
         attribute :originator_id do |movement|
           movement.originator&.prefixed_id
         end

data/app/serializers/spree/api/v3/stock_transfer_serializer.rb

@@ -4,12 +4,15 @@ module Spree
   module Api
     module V3
       class StockTransferSerializer < BaseSerializer
-        typelize number: [:string, nullable: true], type: [:string, nullable: true],
+        # `type` is not exposed: Spree::StockTransfer has no STI subclasses, so
+        # the column is a legacy vestige that is always nil. The admin
+        # serializer already omits it.
+        typelize number: [:string, nullable: true],
                  reference: [:string, nullable: true],
                  source_location_id: [:string, nullable: true],
                  destination_location_id: [:string, nullable: true]
 
-        attributes :number, :type, :reference,
+        attributes :number, :reference,
                    created_at: :iso8601, updated_at: :iso8601
 
         attribute :source_location_id do |transfer|

data/app/serializers/spree/api/v3/wishlist_item_serializer.rb

@@ -2,12 +2,17 @@ module Spree
   module Api
     module V3
       class WishlistItemSerializer < BaseSerializer
-        typelize variant_id: :string, wishlist_id: :string, quantity: :number
+        typelize variant_id: :string, wishlist_id: :string, quantity: :number,
+                 product_id: :string
 
         attribute :variant_id do |wished_item|
           wished_item.variant&.prefixed_id
         end
 
+        attribute :product_id do |wished_item|
+          wished_item.product&.prefixed_id
+        end
+
         attribute :wishlist_id do |wished_item|
           wished_item.wishlist&.prefixed_id
         end
@@ -15,6 +20,8 @@ module Spree
         attributes :quantity
 
         one :variant, resource: proc { Spree.api.variant_serializer }
+        one :product, resource: proc { Spree.api.product_serializer },
+            if: proc { expand?('product') }
       end
     end
   end

data/app/services/spree/api/v3/filters_aggregator.rb

@@ -36,7 +36,7 @@ module Spree
         end
 
         def sort_options
-          Spree::Taxon::SORT_ORDERS.map { |id| { id: to_api_sort(id) } }
+          Spree::Taxon::SORT_ORDERS.map { |id| { id: to_api_sort(id), label: nil } }
         end
 
         # Converts internal sort format ('price asc') to API format ('price', '-price')

data/config/routes.rb

@@ -205,6 +205,7 @@ Spree::Core::Engine.add_routes do
         resources :imports, only: [:index, :show, :create, :destroy] do
           collection do
             get :template
+            get :example
           end
           member do
             patch :complete_mapping

data/lib/spree/api/openapi/schema_helper.rb

@@ -155,6 +155,16 @@ module Spree
               },
               required: %w[id name]
             },
+            AdminUserStore: {
+              type: :object,
+              description: 'A store the staff member can access through a role assignment',
+              properties: {
+                id: { type: :string, description: 'Prefixed store ID', example: 'store_abc123' },
+                name: { type: :string, description: 'Store name', example: 'My Store' },
+                code: { type: :string, description: 'Store code', example: 'my-store' }
+              },
+              required: %w[id name code]
+            },
             PreferenceField: {
               type: :object,
               description: 'A single configurable preference on a payment method, promotion rule/action, or calculator. The frontend uses `type` + `default` to render a sensible input.',
@@ -305,6 +315,14 @@ module Spree
               items: { '$ref' => '#/components/schemas/AdminUserRoleAssignment' }
             }
           end
+
+          stores_key = props.key?('stores') ? 'stores' : :stores
+          if props[stores_key]
+            props[stores_key] = {
+              type: :array,
+              items: { '$ref' => '#/components/schemas/AdminUserStore' }
+            }
+          end
         end
 
         # Same Array<{...}> + Array<string> typelize hints that Typelizer

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc6
+  version: 5.6.1
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-23 00:00:00.000000000 Z
+date: 2026-07-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc6
+        version: 5.6.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc6
+        version: 5.6.1
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -384,9 +384,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc6
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.1
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc6
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.1
 post_install_message:
 rdoc_options: []
 require_paths: