spree_api 6.0.0.beta1 → 6.0.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd13b5167236c50754b03e48d4e7ab4ff5f1c24cdfd13b5a1ea45ff7a2961dd7
-  data.tar.gz: 77ab648d62775d22902a30ff8dbb4927fd0dab1b93668caad957c99a88bcd1fa
+  metadata.gz: 66c29980b5060309f11b480faec57266dc0bf8423b03e820a365e346a7f5f8a7
+  data.tar.gz: 0b3f632bfaa9cb6158694e492c3c8266a7b4e5c05c942abad15ce45a99662aea
 SHA512:
-  metadata.gz: 36a716f02b07837cf6360d19cb914ef28a1de1e5cef02b0d6cb503bcc11d89afa6f00f36bd1613d0e9de6962197af6830c8068d03963ca257ac6f59c7ab2fa95
-  data.tar.gz: 388abb4801575690aa02e55a907a1851a1d88570a55681c60dc870f693a784024ed7d352e8fcedf493666bd2999269822e9d7abb579d13f3b8345ea9bb340ae2
+  metadata.gz: bde5239802c9065c5b69fd3473b424dc2245c446035ff5ee1dc9cc475ea1de6cfcfbeffd65d11659427df2de94883bed3ae671916605e30155eb7ae9291e7ffe
+  data.tar.gz: ad098d05870290fae2ac19c12cf4ed92d91584466723f7992f8ac45beba9669ee1ad1c4f2a3a61c1a292e66b6b2568e6b027b42ba959efcb8f7662e4a5774c8f

data/app/controllers/concerns/spree/api/v3/admin/stock_receipt_actions.rb

@@ -50,7 +50,7 @@ module Spree
               received_at: params[:received_at],
               reference: params[:reference],
               notes: params[:notes],
-              received_by: try_spree_current_user
+              received_by: current_actor
             }
           end
 

data/app/controllers/concerns/spree/api/v3/admin_authentication.rb

@@ -15,6 +15,17 @@ module Spree
           Spree::Api::V3::JwtAuthentication::JWT_AUDIENCE_ADMIN
         end
 
+        # A key-authenticated write records the key: it is the thing that gets
+        # named, scoped and revoked, so it is what an order's `canceler` or a
+        # receipt's `received_by` should point at. A JWT request records the
+        # admin. When both credentials are present the JWT user wins here too,
+        # matching how permissions resolve below.
+        #
+        # @return [Object, nil]
+        def current_actor
+          try_spree_current_user || @current_api_key
+        end
+
         # API-key-only requests bypass CanCanCan: the ScopedAuthorization
         # concern is the authoritative gate (read_/write_ scopes per resource).
         # JWT admin users keep CanCanCan abilities; if both credentials are

data/app/controllers/concerns/spree/api/v3/orders/claim_actions.rb

@@ -19,7 +19,7 @@ module Spree
 
           # PATCH .../claims/:id/approve
           def approve
-            run_workflow(Spree.claim_approve_workflow, approver: try_spree_current_user)
+            run_workflow(Spree.claim_approve_workflow, approver: current_actor)
           end
 
           # PATCH .../claims/:id/resolve — a refund, a replacement, or both.
@@ -29,7 +29,7 @@ module Spree
                          refund_method: params[:refund_method] || 'store_credit',
                          amount: params[:amount],
                          replacement_line_item_ids: replacement_line_item_ids,
-                         resolver: try_spree_current_user)
+                         resolver: current_actor)
           end
 
           # PATCH .../claims/:id/deny

data/app/controllers/concerns/spree/api/v3/orders/exchange_actions.rb

@@ -21,14 +21,14 @@ module Spree
 
           # PATCH .../exchanges/:id/approve
           def approve
-            run_workflow(Spree.exchange_approve_workflow, approver: try_spree_current_user)
+            run_workflow(Spree.exchange_approve_workflow, approver: current_actor)
           end
 
           # PATCH .../exchanges/:id/receive
           def receive
             run_workflow(Spree.exchange_receive_workflow,
                          items: items_for_receive,
-                         received_by: try_spree_current_user)
+                         received_by: current_actor)
           end
 
           # PATCH .../exchanges/:id/fulfill — sends the replacement, settling
@@ -36,7 +36,7 @@ module Spree
           def fulfill
             run_workflow(Spree.exchange_fulfill_workflow,
                          refund_method: params[:refund_method] || 'store_credit',
-                         refunder: try_spree_current_user)
+                         refunder: current_actor)
           end
 
           # PATCH .../exchanges/:id/cancel

data/app/controllers/concerns/spree/api/v3/orders/post_sale_actions.rb

@@ -59,7 +59,7 @@ module Spree
               items: items_for_create,
               reason: reason_for_create,
               memo: create_params[:memo],
-              created_by: try_spree_current_user,
+              created_by: current_actor,
               **arguments
             )
 

data/app/controllers/concerns/spree/api/v3/orders/return_actions.rb

@@ -21,14 +21,14 @@ module Spree
 
           # PATCH .../returns/:id/approve
           def approve
-            run_workflow(Spree.return_approve_workflow, approver: try_spree_current_user)
+            run_workflow(Spree.return_approve_workflow, approver: current_actor)
           end
 
           # PATCH .../returns/:id/receive — what the warehouse actually counted.
           def receive
             run_workflow(Spree.return_receive_workflow,
                          items: items_for_receive,
-                         received_by: try_spree_current_user)
+                         received_by: current_actor)
           end
 
           # PATCH .../returns/:id/refund
@@ -36,7 +36,7 @@ module Spree
             run_workflow(Spree.return_refund_workflow,
                          amount: params[:amount],
                          refund_method: params[:refund_method] || 'original_payment',
-                         refunder: try_spree_current_user)
+                         refunder: current_actor)
           end
 
           # PATCH .../returns/:id/cancel

data/app/controllers/spree/api/v3/admin/api_keys_controller.rb

@@ -47,7 +47,7 @@ module Spree
             @resource = find_resource
             authorize!(:update, @resource)
 
-            @resource.revoke!(try_spree_current_user)
+            @resource.revoke!(current_actor)
             render json: serialize_resource(@resource)
           end
 
@@ -90,7 +90,7 @@ module Spree
           # happens in `before_validation :generate_token` on the model.
           def build_resource
             scope.new(permitted_params).tap do |key|
-              key.created_by = try_spree_current_user
+              key.created_by = current_actor
             end
           end
 

data/app/controllers/spree/api/v3/admin/orders/refunds_controller.rb

@@ -26,7 +26,7 @@ module Spree
                 payment: payment,
                 amount: params[:amount],
                 reason: reason,
-                refunder: try_spree_current_user,
+                refunder: current_actor,
                 # Names which order is being refunded. Only matters when the
                 # payment is shared by a split checkout, where it covers several
                 # and the payment cannot say which one this is for.

data/app/controllers/spree/api/v3/admin/orders_controller.rb

@@ -23,7 +23,7 @@ module Spree
             result = Spree.order_create_service.call(
               store: current_store,
               customer: resolve_customer,
-              created_by: try_spree_current_user,
+              created_by: current_actor,
               params: order_create_params
             )
 
@@ -73,7 +73,7 @@ module Spree
             with_order_lock do
               result = Spree.order_cancel_workflow.call(
                 order: @resource,
-                canceler: try_spree_current_user,
+                canceler: current_actor,
                 reason: cancel_reason,
                 note: params[:cancel_note].presence,
                 refund_payments: params[:refund_payments].to_b,
@@ -92,7 +92,7 @@ module Spree
           # PATCH /api/v3/admin/orders/:id/approve
           def approve
             with_order_lock do
-              @resource.approved_by(try_spree_current_user)
+              @resource.approved_by(current_actor)
               render json: serialize_resource(@resource.reload)
             end
           end
@@ -150,11 +150,13 @@ module Spree
           end
 
           # Override scope — Order uses SingleStoreResource (for_store).
-          # Variant prices are preloaded here rather than via scope_includes,
-          # which this override bypasses; the serializer reads them per row.
+          # Variant prices and each line's price list are named here rather
+          # than via scope_includes, which this override bypasses; the
+          # serializer reads both per row.
           def scope
             base = current_store.orders.accessible_by(current_ability, :show).
-                   includes(line_items: { variant: :prices }).preload_associations_lazily
+                   includes(line_items: [{ variant: :prices }, { price_list: :catalog }]).
+                   preload_associations_lazily
 
             # Transient completion drafts (status draft + cart_id set) belong
             # to in-flight checkouts, never to the admin. Admin drafts are the
@@ -190,7 +192,10 @@ module Spree
           # only its id is reported and that comes off the order's own column.
           # Variant prices ride along because the admin line-item serializer
           # reads the base catalog price for every row (the negotiated-price
-          # comparison); without it each line costs its own price query.
+          # comparison); without it each line costs its own price query. Each
+          # line's price list and its catalog are named for the same reason —
+          # stated rather than left to ar_lazy_preload, which happens to cover
+          # them today.
           def collection_includes
             # `market` is the withdrawal deadline's other input. Fulfillments
             # are loaded with their selected rate because the freight summary
@@ -198,7 +203,8 @@ module Spree
             # fulfillment for a field that is nil on every parcel order.
             [:customer, :channel, :seller, :external_references, :cancel_reason,
              :market, { fulfillments: :selected_delivery_rate },
-             { line_items: { variant: :prices } }, { po_document_attachment: :blob }]
+             { line_items: [{ variant: :prices }, { price_list: :catalog }] },
+             { po_document_attachment: :blob }]
           end
 
           # Read through the store's own vocabulary, so a reason belonging to

data/app/controllers/spree/api/v3/admin/setup_controller.rb

@@ -41,7 +41,7 @@ module Spree
           # POST /api/v3/admin/auth/setup
           # Body: { setup_token, email, password, password_confirmation?,
           #         first_name?, last_name?, store_name, country_code,
-          #         locale?, currency? }
+          #         locale?, currency?, sample_data? }
           # Currency defaults to the country's own; an unknown code is refused
           # rather than ignored, since the token is spent in the same request.
           def create
@@ -63,6 +63,10 @@ module Spree
               adopt_default_store(user, store)
             end
 
+            # Outside the lock: the loader needs the admin committed, and it
+            # runs for minutes, so it is queued rather than awaited.
+            Spree::SampleData::LoadJob.perform_later if sample_data_requested?
+
             refresh_token = Spree::RefreshToken.create_for(user, audience: JWT_AUDIENCE_ADMIN, request_env: request_env_for_token)
             set_refresh_cookie(refresh_token)
             render json: auth_response(user)
@@ -167,6 +171,10 @@ module Spree
             )
           end
 
+          def sample_data_requested?
+            ActiveModel::Type::Boolean.new.cast(params[:sample_data]) == true
+          end
+
           def admin_user_params
             params.permit(:email, :password, :password_confirmation, :first_name, :last_name)
           end

data/app/controllers/spree/api/v3/admin/store_controller.rb

@@ -81,6 +81,7 @@ module Spree
               :preferred_storefront_access,
               :preferred_storefront_url,
               :preferred_guest_checkout,
+              :preferred_always_include_confirm_step,
               :preferred_company_field_enabled,
               :preferred_address_requires_company,
               :preferred_address_requires_phone,

data/app/controllers/spree/api/v3/base_controller.rb

@@ -93,6 +93,21 @@ module Spree
 
         alias try_spree_current_user spree_current_user
 
+        # Who performed this request, for the associations that record it —
+        # `canceler`, `approver`, `created_by` and their siblings. Answers the
+        # signed-in user here; the Admin branch prefers the authenticating
+        # secret key, because a key-made write must record the key rather than
+        # nobody (see docs/plans/6.0-action-actors.md).
+        #
+        # Deliberately not `current_api_key || current_user` at this level: on
+        # a Store API request the key is the storefront's publishable one, and
+        # a customer's own action is not the storefront's.
+        #
+        # @return [Object, nil] a member of Spree.actor_classes
+        def current_actor
+          try_spree_current_user
+        end
+
         # CanCanCan ability
         # @return [Spree::Ability]
         def current_ability

data/app/controllers/spree/api/v3/resource_controller.rb

@@ -176,10 +176,25 @@ module Spree
         def build_resource
           resource = resource_scope.new
           resource.assign_attributes(permitted_params) if create_workflow.nil?
-          resource.created_by = try_spree_current_user if resource.respond_to?(:created_by_id)
+          resource.created_by = creator_for(resource) if resource.respond_to?(:created_by_id)
           resource
         end
 
+        # The actor to stamp on a new record, or nil when this model cannot
+        # hold it. `created_by` is polymorphic on the order operations and
+        # still admin-user-only elsewhere until 6.1, so a key-authenticated
+        # create of a gift card records nobody rather than raising — the same
+        # thing it recorded before keys became actors.
+        def creator_for(resource)
+          actor = current_actor
+          return actor if actor.nil?
+
+          association = resource.class.reflect_on_association(:created_by)
+          return actor if association.nil? || association.polymorphic?
+
+          actor.is_a?(association.klass) ? actor : nil
+        end
+
         # The relation a new record is built on: a nested resource's parent
         # association, the store's own association for this model, or the
         # class itself for genuinely global data (countries, roles).

data/app/controllers/spree/api/v3/seller/orders_controller.rb

@@ -43,7 +43,7 @@ module Spree
             with_order_lock do
               result = Spree.order_cancel_workflow.call(
                 order: @resource,
-                canceler: try_spree_current_user,
+                canceler: current_actor,
                 reason: cancel_reason,
                 note: params[:cancel_note].presence,
                 refund_payments: params[:refund_payments].to_b,

data/app/serializers/spree/api/v3/admin/actor_serializer.rb

@@ -0,0 +1,28 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Whoever performed an action — an admin user, an API key, or a class
+        # an extension registered in `Spree.actor_classes`.
+        #
+        # One shape for every kind, so a client renders "cancelled by" the same
+        # way whether a person clicked the button or a warehouse connector
+        # called the endpoint. See docs/plans/6.0-action-actors.md.
+        class ActorSerializer < V3::BaseSerializer
+          typelize type: [:string, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
+                   label: [:string, nullable: true]
+
+          # `admin_user` / `api_key`, never the Ruby class name.
+          attribute :type do |actor|
+            actor.actor_kind
+          end
+
+          # What a timeline shows: a person's name or email, a key's name.
+          attribute :label do |actor|
+            actor.actor_label
+          end
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/api_key_serializer.rb

@@ -19,6 +19,8 @@ module Spree
                    revoked_at: [:string, nullable: true],
                    last_used_at: [:string, nullable: true],
                    created_by_email: [:string, nullable: true],
+                   created_by_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
+                   created_by_label: [:string, nullable: true],
                    channel_id: [:string, nullable: true]
 
           attributes :name, :key_type, :token_prefix, :scopes,
@@ -37,8 +39,19 @@ module Spree
             key.plaintext_token
           end
 
+          # A key can be minted by another key, which has no email — so the
+          # address is answered only for the actors that have one, and
+          # `created_by_label` is what a list column should render.
           attribute :created_by_email do |key|
-            key.created_by&.email
+            key.created_by.try(:email)
+          end
+
+          attribute :created_by_type do |key|
+            Spree::Base.polymorphic_api_type(key.created_by_type)
+          end
+
+          attribute :created_by_label do |key|
+            key.created_by.try(:actor_label)
           end
         end
       end

data/app/serializers/spree/api/v3/admin/claim_serializer.rb

@@ -7,13 +7,12 @@ module Spree
         class ClaimSerializer < V3::ClaimSerializer
           typelize memo: [:string, nullable: true],
                    metadata: 'Record<string, unknown>',
-                   created_by_id: [:string, nullable: true]
+                   created_by_id: [:string, nullable: true],
+                   created_by_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind']
 
           attributes :memo, :metadata, created_at: :iso8601, updated_at: :iso8601
 
-          attribute :created_by_id do |claim|
-            claim.created_by&.prefixed_id
-          end
+          actor_attributes :created_by
 
           many :claim_line_items,
                resource: proc { Spree.api.admin_claim_line_item_serializer },

data/app/serializers/spree/api/v3/admin/exchange_serializer.rb

@@ -8,7 +8,8 @@ module Spree
           typelize memo: [:string, nullable: true],
                    metadata: 'Record<string, unknown>',
                    stock_location_id: [:string, nullable: true],
-                   created_by_id: [:string, nullable: true]
+                   created_by_id: [:string, nullable: true],
+                   created_by_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind']
 
           attributes :memo, :metadata, created_at: :iso8601, updated_at: :iso8601
 
@@ -16,9 +17,7 @@ module Spree
             exchange.stock_location&.prefixed_id
           end
 
-          attribute :created_by_id do |exchange|
-            exchange.created_by&.prefixed_id
-          end
+          actor_attributes :created_by
 
           many :exchange_line_items,
                resource: proc { Spree.api.admin_exchange_line_item_serializer },

data/app/serializers/spree/api/v3/admin/line_item_serializer.rb

@@ -20,7 +20,11 @@ module Spree
                    cost_price: [:string, nullable: true],
                    tax_category_id: [:string, nullable: true],
                    price_source: [:string, nullable: true],
-                   catalog_price: [:string, nullable: true]
+                   catalog_price: [:string, nullable: true],
+                   price_list_id: [:string, nullable: true],
+                   price_list_name: [:string, nullable: true],
+                   catalog_id: [:string, nullable: true],
+                   catalog_name: [:string, nullable: true]
 
           # price_source is operational provenance — admin-only, never on the
           # store serializer.
@@ -33,6 +37,29 @@ module Spree
             line_item.variant&.amount_in(line_item.currency)&.to_s
           end
 
+          # Which agreement priced this line. The list id is stamped on the
+          # row and never re-resolved (the same reason `catalog_price` above
+          # is a base price); the catalog is whichever one owns that list
+          # now, so moving a list between catalogs re-labels past orders.
+          # Empty on a shop-price or hand-negotiated line. Names ride along
+          # beside the ids so a page of lines does not cost a request each to
+          # label, as `company_name` already does.
+          attribute :price_list_id do |line_item|
+            line_item.price_list&.prefixed_id
+          end
+
+          attribute :price_list_name do |line_item|
+            line_item.price_list&.name
+          end
+
+          attribute :catalog_id do |line_item|
+            line_item.price_list&.catalog&.prefixed_id
+          end
+
+          attribute :catalog_name do |line_item|
+            line_item.price_list&.catalog&.name
+          end
+
           attribute :cost_price do |line_item|
             line_item.cost_price&.to_s
           end

data/app/serializers/spree/api/v3/admin/order_serializer.rb

@@ -49,7 +49,10 @@ module Spree
                    store_owner_notification_delivered: :boolean,
                    internal_note: [:string, nullable: true], internal_note_html: [:string, nullable: true],
                    approver_id: [:string, nullable: true],
+                   approver_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
                    canceler_id: [:string, nullable: true], created_by_id: [:string, nullable: true],
+                   canceler_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
+                   created_by_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
                    customer_id: [:string, nullable: true],
                    preferred_stock_location_id: [:string, nullable: true],
                    canceled_at: [:string, nullable: true], approved_at: [:string, nullable: true],
@@ -128,13 +131,10 @@ module Spree
             order.internal_note.presence
           end
 
-          attribute :approver_id do |order|
-            order.approver&.prefixed_id
-          end
-
-          attribute :canceler_id do |order|
-            order.canceler&.prefixed_id
-          end
+          # Who approved, cancelled and opened it — a member of staff, or the
+          # API key an integration called with. An order cancelled through a
+          # secret key names the key.
+          actor_attributes :approver, :canceler, :created_by
 
           attribute :cancel_reason_id do |order|
             order.cancel_reason&.prefixed_id
@@ -147,10 +147,6 @@ module Spree
             order.cancel_reason&.name
           end
 
-          attribute :created_by_id do |order|
-            order.created_by&.prefixed_id
-          end
-
           attribute :customer_id do |order|
             order.customer&.prefixed_id
           end
@@ -189,23 +185,10 @@ module Spree
               resource: proc { Spree.api.admin_customer_serializer },
               if: proc { expand?('customer') }
 
-          # Staff actors, not customers — these point at Spree.admin_user_class.
-          one :approver,
-              resource: proc { Spree.api.admin_admin_user_serializer },
-              if: proc { expand?('approver') }
-
-          one :canceler,
-              resource: proc { Spree.api.admin_admin_user_serializer },
-              if: proc { expand?('canceler') }
-
           one :cancel_reason,
               resource: proc { Spree.api.admin_order_cancellation_reason_serializer },
               if: proc { expand?('cancel_reason') }
 
-          one :created_by,
-              resource: proc { Spree.api.admin_admin_user_serializer },
-              if: proc { expand?('created_by') }
-
 
           many :returns,
                resource: proc { Spree.api.admin_return_serializer },

data/app/serializers/spree/api/v3/admin/refund_serializer.rb

@@ -5,11 +5,17 @@ module Spree
         class RefundSerializer < V3::RefundSerializer
           typelize payment_id: [:string, nullable: true],
                    refund_reason_id: [:string, nullable: true],
+                   refunder_id: [:string, nullable: true],
+                   refunder_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
                    metadata: 'Record<string, unknown>'
 
           attributes :metadata,
                      created_at: :iso8601, updated_at: :iso8601
 
+          # Who issued it — an admin user, or the API key an integration
+          # refunded through.
+          actor_attributes :refunder
+
           one :payment,
               resource: proc { Spree.api.admin_payment_serializer },
               if: proc { expand?('payment') }

data/app/serializers/spree/api/v3/admin/return_serializer.rb

@@ -10,6 +10,7 @@ module Spree
                    documents: "Array<{ kind: string; url: string }>",
                    stock_location_id: [:string, nullable: true],
                    created_by_id: [:string, nullable: true],
+                   created_by_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
                    refunded_total: :string,
                    refundable_total: :string
 
@@ -19,9 +20,7 @@ module Spree
             return_record.stock_location&.prefixed_id
           end
 
-          attribute :created_by_id do |return_record|
-            return_record.created_by&.prefixed_id
-          end
+          actor_attributes :created_by
 
           attribute :refunded_total do |return_record|
             return_record.refunded_total.to_s

data/app/serializers/spree/api/v3/admin/saved_report_serializer.rb

@@ -20,11 +20,10 @@ module Spree
             report.user&.prefixed_id
           end
 
+          # The same "name, else email" rule every actor answers, so a report's
+          # author and an order's canceler read alike.
           attribute :author_name do |report|
-            user = report.user
-            next nil unless user
-
-            user.full_name.presence || user.email
+            report.user&.actor_label
           end
         end
       end

data/app/serializers/spree/api/v3/admin/stock_receipt_serializer.rb

@@ -12,6 +12,7 @@ module Spree
                    receivable_type: [:string, enum: %w[purchase_order stock_transfer]],
                    receivable_id: :string,
                    received_by_id: 'string | null',
+                   received_by_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
                    items_count: :number,
                    quantity_accepted_total: :number,
                    quantity_rejected_total: :number,
@@ -31,9 +32,7 @@ module Spree
             receipt.receivable&.prefixed_id
           end
 
-          attribute :received_by_id do |receipt|
-            receipt.received_by.try(:prefixed_id)
-          end
+          actor_attributes :received_by
 
           attribute :items_count do |receipt|
             receipt.items.size

data/app/serializers/spree/api/v3/admin/store_serializer.rb

@@ -22,6 +22,7 @@ module Spree
                    preferred_unit_system: :string,
                    preferred_storefront_access: :string,
                    preferred_guest_checkout: :boolean,
+                   preferred_always_include_confirm_step: :boolean,
                    preferred_company_field_enabled: :boolean,
                    preferred_address_requires_company: :boolean,
                    preferred_address_requires_phone: :boolean,
@@ -69,6 +70,7 @@ module Spree
                      :preferred_unit_system,
                      :preferred_storefront_access,
                      :preferred_guest_checkout,
+                     :preferred_always_include_confirm_step,
                      :preferred_company_field_enabled,
                      :preferred_address_requires_company,
                      :preferred_address_requires_phone,

data/app/serializers/spree/api/v3/base_serializer.rb

@@ -27,6 +27,28 @@ module Spree
           end
         end
 
+        # Declares the wire form of an `acted_by` association: the actor's
+        # prefixed id, the kind of actor it is, and the expansion. Both
+        # halves read off the columns, so naming an actor costs no query and
+        # the id and the kind always describe the same row (see
+        # docs/plans/6.0-action-actors.md).
+        #
+        # Declare the matching `typelize` entries alongside, as with any
+        # other attribute.
+        def self.actor_attributes(*names)
+          names.each do |name|
+            attribute(:"#{name}_id") { |object| object.acted_by_prefixed_id(name) }
+
+            attribute(:"#{name}_type") do |object|
+              Spree::Base.polymorphic_api_type(object.acted_by_type(name))
+            end
+
+            one name,
+                resource: proc { Spree.api.admin_actor_serializer },
+                if: proc { expand?(name.to_s) }
+          end
+        end
+
         # Plain decimal notation. BigDecimal renders 0.06 as "0.6e-1", which
         # is what a client would otherwise print beside a unit.
         #

data/lib/spree/api/configuration.rb

@@ -3,25 +3,30 @@ require 'spree/core/preferences/runtime_configuration'
 module Spree
   module Api
     class Configuration < Spree::Preferences::RuntimeConfiguration
-      preference :jwt_expiration, :integer, default: 3600 # 1 hour in seconds (customer/store JWT default)
-      preference :admin_jwt_expiration, :integer, default: 300 # 5 minutes — admin tokens have higher blast radius
-      preference :jwt_secret_key, :string, default: nil
-      preference :refresh_token_expiry, :integer, default: 2_592_000 # 30 days in seconds
+      preference :jwt_expiration, :integer, default: 3600, env: 'SPREE_JWT_EXPIRATION' # 1 hour in seconds (customer/store JWT default)
+      preference :admin_jwt_expiration, :integer, default: 300, env: 'SPREE_ADMIN_JWT_EXPIRATION' # 5 minutes — admin tokens have higher blast radius
+      # SPREE_JWT_SECRET_KEY resolves inside the preference, so it sits ahead of
+      # the Rails credentials fallback in Spree::Api::V3::JwtAuthentication —
+      # an operator who sets it means it. The older, unprefixed JWT_SECRET_KEY
+      # keeps its place behind credentials so existing deployments are
+      # unaffected.
+      preference :jwt_secret_key, :string, default: nil, env: 'SPREE_JWT_SECRET_KEY'
+      preference :refresh_token_expiry, :integer, default: 2_592_000, env: 'SPREE_REFRESH_TOKEN_EXPIRY' # 30 days in seconds
 
       # Rate limiting
-      preference :rate_limit_per_key, :integer, default: 300 # per publishable API key + client IP (per visitor)
-      preference :rate_limit_per_secret_key, :integer, default: 600 # per secret API key, across the whole API
-      preference :rate_limit_window, :integer, default: 60 # window in seconds
-      preference :rate_limit_login, :integer, default: 5 # per IP
-      preference :rate_limit_register, :integer, default: 3 # per IP
-      preference :rate_limit_refresh, :integer, default: 10 # per IP
-      preference :rate_limit_password_reset, :integer, default: 3 # per IP
+      preference :rate_limit_per_key, :integer, default: 300, env: 'SPREE_RATE_LIMIT_PER_KEY' # per publishable API key + client IP (per visitor)
+      preference :rate_limit_per_secret_key, :integer, default: 600, env: 'SPREE_RATE_LIMIT_PER_SECRET_KEY' # per secret API key, across the whole API
+      preference :rate_limit_window, :integer, default: 60, env: 'SPREE_RATE_LIMIT_WINDOW' # window in seconds
+      preference :rate_limit_login, :integer, default: 5, env: 'SPREE_RATE_LIMIT_LOGIN' # per IP
+      preference :rate_limit_register, :integer, default: 3, env: 'SPREE_RATE_LIMIT_REGISTER' # per IP
+      preference :rate_limit_refresh, :integer, default: 10, env: 'SPREE_RATE_LIMIT_REFRESH' # per IP
+      preference :rate_limit_password_reset, :integer, default: 3, env: 'SPREE_RATE_LIMIT_PASSWORD_RESET' # per IP
 
       # Request body size limit in bytes
-      preference :max_request_body_size, :integer, default: 102_400 # 100KB
+      preference :max_request_body_size, :integer, default: 102_400, env: 'SPREE_MAX_REQUEST_BODY_SIZE' # 100KB
 
-      preference :webhooks_enabled, :boolean, default: true
-      preference :webhooks_verify_ssl, :boolean, default: !Rails.env.development?
+      preference :webhooks_enabled, :boolean, default: true, env: 'SPREE_WEBHOOKS_ENABLED'
+      preference :webhooks_verify_ssl, :boolean, default: !Rails.env.development?, env: 'SPREE_WEBHOOKS_VERIFY_SSL'
     end
   end
 end

data/lib/spree/api/dependencies.rb

@@ -181,6 +181,7 @@ module Spree
         admin_catalog_order_minimum_serializer: 'Spree::Api::V3::Admin::CatalogOrderMinimumSerializer',
         admin_tax_exemption_certificate_serializer: 'Spree::Api::V3::Admin::TaxExemptionCertificateSerializer',
         admin_admin_user_serializer: 'Spree::Api::V3::Admin::AdminUserSerializer',
+        admin_actor_serializer: 'Spree::Api::V3::Admin::ActorSerializer',
         admin_seller_team_member_serializer: 'Spree::Api::V3::Admin::SellerTeamMemberSerializer',
         seller_serializer: 'Spree::Api::V3::SellerSerializer',
         seller_profile_serializer: 'Spree::Api::V3::Seller::ProfileSerializer',

data/lib/spree/api/engine.rb

@@ -24,6 +24,12 @@ module Spree
         Spree.subscribers << Spree::WebhookEventSubscriber
       end
 
+      # Runs after initializers so an explicitly assigned preference — which
+      # wins over the environment — is never rejected for a stale env var.
+      config.after_initialize do
+        Spree::Api::Configuration.validate_env!(Spree::Api::Config)
+      end
+
       # Warn in production if no dedicated JWT secret key is configured
       config.after_initialize do
         next unless Rails.env.production?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 6.0.0.beta1
+  version: 6.0.0.beta2
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-15 00:00:00.000000000 Z
+date: 2026-09-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.beta1
+        version: 6.0.0.beta2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.beta1
+        version: 6.0.0.beta2
 description: Spree Commerce Store / Admin API and HTTP webhooks
 email:
 - hello@spreecommerce.org
@@ -393,6 +393,7 @@ files:
 - app/models/spree/api_key_ability.rb
 - app/serializers/concerns/spree/api/v3/admin/translatable.rb
 - app/serializers/spree/api/v3/address_serializer.rb
+- app/serializers/spree/api/v3/admin/actor_serializer.rb
 - app/serializers/spree/api/v3/admin/address_serializer.rb
 - app/serializers/spree/api/v3/admin/admin_user_serializer.rb
 - app/serializers/spree/api/v3/admin/allowed_origin_serializer.rb
@@ -698,9 +699,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.0.beta1
+  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.0.beta2
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v6.0.0.beta1
+  source_code_uri: https://github.com/spree/spree/tree/v6.0.0.beta2
 post_install_message:
 rdoc_options: []
 require_paths: