spree_api 6.0.0.beta1 → 6.0.0.beta3

data/app/serializers/spree/api/v3/admin/line_item_serializer.rb

@@ -20,7 +20,11 @@ module Spree
                    cost_price: [:string, nullable: true],
                    tax_category_id: [:string, nullable: true],
                    price_source: [:string, nullable: true],
-                   catalog_price: [:string, nullable: true]
+                   catalog_price: [:string, nullable: true],
+                   price_list_id: [:string, nullable: true],
+                   price_list_name: [:string, nullable: true],
+                   catalog_id: [:string, nullable: true],
+                   catalog_name: [:string, nullable: true]
 
           # price_source is operational provenance — admin-only, never on the
           # store serializer.
@@ -33,6 +37,29 @@ module Spree
             line_item.variant&.amount_in(line_item.currency)&.to_s
           end
 
+          # Which agreement priced this line. The list id is stamped on the
+          # row and never re-resolved (the same reason `catalog_price` above
+          # is a base price); the catalog is whichever one owns that list
+          # now, so moving a list between catalogs re-labels past orders.
+          # Empty on a shop-price or hand-negotiated line. Names ride along
+          # beside the ids so a page of lines does not cost a request each to
+          # label, as `company_name` already does.
+          attribute :price_list_id do |line_item|
+            line_item.price_list&.prefixed_id
+          end
+
+          attribute :price_list_name do |line_item|
+            line_item.price_list&.name
+          end
+
+          attribute :catalog_id do |line_item|
+            line_item.price_list&.catalog&.prefixed_id
+          end
+
+          attribute :catalog_name do |line_item|
+            line_item.price_list&.catalog&.name
+          end
+
           attribute :cost_price do |line_item|
             line_item.cost_price&.to_s
           end

data/app/serializers/spree/api/v3/admin/order_group_serializer.rb

@@ -13,6 +13,8 @@ module Spree
                    cart_id: 'string | null',
                    seller_count: :number,
                    includes_first_party: :boolean,
+                   confirmation_delivered: :boolean,
+                   store_owner_notification_delivered: :boolean,
                    created_at: :string, updated_at: :string
 
           attribute :customer_id do |group|
@@ -34,6 +36,11 @@ module Spree
             group.includes_first_party?
           end
 
+          # A split checkout is confirmed once, from here — every child order
+          # places silently, so their own flags are false and only the group
+          # can answer whether the customer was told.
+          attributes :confirmation_delivered, :store_owner_notification_delivered
+
           attributes :created_at, :updated_at
 
           # Re-declared against the admin serializers. Inheriting the store

data/app/serializers/spree/api/v3/admin/order_serializer.rb

@@ -49,7 +49,10 @@ module Spree
                    store_owner_notification_delivered: :boolean,
                    internal_note: [:string, nullable: true], internal_note_html: [:string, nullable: true],
                    approver_id: [:string, nullable: true],
+                   approver_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
                    canceler_id: [:string, nullable: true], created_by_id: [:string, nullable: true],
+                   canceler_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
+                   created_by_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
                    customer_id: [:string, nullable: true],
                    preferred_stock_location_id: [:string, nullable: true],
                    canceled_at: [:string, nullable: true], approved_at: [:string, nullable: true],
@@ -128,13 +131,10 @@ module Spree
             order.internal_note.presence
           end
 
-          attribute :approver_id do |order|
-            order.approver&.prefixed_id
-          end
-
-          attribute :canceler_id do |order|
-            order.canceler&.prefixed_id
-          end
+          # Who approved, cancelled and opened it — a member of staff, or the
+          # API key an integration called with. An order cancelled through a
+          # secret key names the key.
+          actor_attributes :approver, :canceler, :created_by
 
           attribute :cancel_reason_id do |order|
             order.cancel_reason&.prefixed_id
@@ -147,10 +147,6 @@ module Spree
             order.cancel_reason&.name
           end
 
-          attribute :created_by_id do |order|
-            order.created_by&.prefixed_id
-          end
-
           attribute :customer_id do |order|
             order.customer&.prefixed_id
           end
@@ -189,23 +185,10 @@ module Spree
               resource: proc { Spree.api.admin_customer_serializer },
               if: proc { expand?('customer') }
 
-          # Staff actors, not customers — these point at Spree.admin_user_class.
-          one :approver,
-              resource: proc { Spree.api.admin_admin_user_serializer },
-              if: proc { expand?('approver') }
-
-          one :canceler,
-              resource: proc { Spree.api.admin_admin_user_serializer },
-              if: proc { expand?('canceler') }
-
           one :cancel_reason,
               resource: proc { Spree.api.admin_order_cancellation_reason_serializer },
               if: proc { expand?('cancel_reason') }
 
-          one :created_by,
-              resource: proc { Spree.api.admin_admin_user_serializer },
-              if: proc { expand?('created_by') }
-
 
           many :returns,
                resource: proc { Spree.api.admin_return_serializer },

data/app/serializers/spree/api/v3/admin/refund_serializer.rb

@@ -5,11 +5,17 @@ module Spree
         class RefundSerializer < V3::RefundSerializer
           typelize payment_id: [:string, nullable: true],
                    refund_reason_id: [:string, nullable: true],
+                   refunder_id: [:string, nullable: true],
+                   refunder_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
                    metadata: 'Record<string, unknown>'
 
           attributes :metadata,
                      created_at: :iso8601, updated_at: :iso8601
 
+          # Who issued it — an admin user, or the API key an integration
+          # refunded through.
+          actor_attributes :refunder
+
           one :payment,
               resource: proc { Spree.api.admin_payment_serializer },
               if: proc { expand?('payment') }

data/app/serializers/spree/api/v3/admin/return_serializer.rb

@@ -10,6 +10,7 @@ module Spree
                    documents: "Array<{ kind: string; url: string }>",
                    stock_location_id: [:string, nullable: true],
                    created_by_id: [:string, nullable: true],
+                   created_by_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
                    refunded_total: :string,
                    refundable_total: :string
 
@@ -19,9 +20,7 @@ module Spree
             return_record.stock_location&.prefixed_id
           end
 
-          attribute :created_by_id do |return_record|
-            return_record.created_by&.prefixed_id
-          end
+          actor_attributes :created_by
 
           attribute :refunded_total do |return_record|
             return_record.refunded_total.to_s

data/app/serializers/spree/api/v3/admin/saved_report_serializer.rb

@@ -20,11 +20,10 @@ module Spree
             report.user&.prefixed_id
           end
 
+          # The same "name, else email" rule every actor answers, so a report's
+          # author and an order's canceler read alike.
           attribute :author_name do |report|
-            user = report.user
-            next nil unless user
-
-            user.full_name.presence || user.email
+            report.user&.actor_label
           end
         end
       end

data/app/serializers/spree/api/v3/admin/stock_receipt_serializer.rb

@@ -12,6 +12,7 @@ module Spree
                    receivable_type: [:string, enum: %w[purchase_order stock_transfer]],
                    receivable_id: :string,
                    received_by_id: 'string | null',
+                   received_by_type: [:string, nullable: true, enum: Spree::Actor::BUILT_IN_KINDS, enum_type_name: 'ActorKind'],
                    items_count: :number,
                    quantity_accepted_total: :number,
                    quantity_rejected_total: :number,
@@ -31,9 +32,7 @@ module Spree
             receipt.receivable&.prefixed_id
           end
 
-          attribute :received_by_id do |receipt|
-            receipt.received_by.try(:prefixed_id)
-          end
+          actor_attributes :received_by
 
           attribute :items_count do |receipt|
             receipt.items.size

data/app/serializers/spree/api/v3/admin/store_serializer.rb

@@ -22,6 +22,7 @@ module Spree
                    preferred_unit_system: :string,
                    preferred_storefront_access: :string,
                    preferred_guest_checkout: :boolean,
+                   preferred_always_include_confirm_step: :boolean,
                    preferred_company_field_enabled: :boolean,
                    preferred_address_requires_company: :boolean,
                    preferred_address_requires_phone: :boolean,
@@ -41,6 +42,10 @@ module Spree
                    preferred_payout_provider: 'string | null',
                    preferred_default_payouts_schedule_interval: :string,
                    preferred_default_minimum_payout_amount: :number,
+                   preferred_auto_approve_sellers: :boolean,
+                   preferred_auto_approve_seller_products: :boolean,
+                   preferred_send_seller_transactional_emails: :boolean,
+                   preferred_default_commission_tax_rate: :number,
                    preferred_document_number_format: :string,
                    preferred_order_number_prefix: :string,
                    preferred_order_number_suffix: :string,
@@ -69,6 +74,7 @@ module Spree
                      :preferred_unit_system,
                      :preferred_storefront_access,
                      :preferred_guest_checkout,
+                     :preferred_always_include_confirm_step,
                      :preferred_company_field_enabled,
                      :preferred_address_requires_company,
                      :preferred_address_requires_phone,
@@ -88,6 +94,10 @@ module Spree
                      :preferred_payout_provider,
                      :preferred_default_payouts_schedule_interval,
                      :preferred_default_minimum_payout_amount,
+                     :preferred_auto_approve_sellers,
+                     :preferred_auto_approve_seller_products,
+                     :preferred_send_seller_transactional_emails,
+                     :preferred_default_commission_tax_rate,
                      :preferred_document_number_format,
                      :preferred_order_number_prefix,
                      :preferred_order_number_suffix,

data/app/serializers/spree/api/v3/admin/webhook_delivery_serializer.rb

@@ -19,7 +19,7 @@ module Spree
                    response_body: [:string, nullable: true],
                    success: [:boolean, nullable: true],
                    delivered_at: [:string, nullable: true],
-                   payload: 'Record<string, unknown>',
+                   payload: ['Record<string, unknown>', nullable: true],
                    webhook_endpoint_id: :string,
                    webhook_endpoint_url: :string
 
@@ -29,8 +29,12 @@ module Spree
                      delivered_at: :iso8601
 
           # Redacted again on read: deliveries written before payload redaction
-          # shipped still hold live credentials in the column.
+          # shipped still hold live credentials in the column. Null when the
+          # caller cannot read the record the event is about.
           attribute :payload do |delivery|
+            visible = params[:payload_visible]
+            next nil if visible && !visible.call(delivery)
+
             Spree::WebhookPayloadRedaction.split(delivery.payload).first
           end
 

data/app/serializers/spree/api/v3/base_serializer.rb

@@ -27,6 +27,28 @@ module Spree
           end
         end
 
+        # Declares the wire form of an `acted_by` association: the actor's
+        # prefixed id, the kind of actor it is, and the expansion. Both
+        # halves read off the columns, so naming an actor costs no query and
+        # the id and the kind always describe the same row (see
+        # docs/plans/6.0-action-actors.md).
+        #
+        # Declare the matching `typelize` entries alongside, as with any
+        # other attribute.
+        def self.actor_attributes(*names)
+          names.each do |name|
+            attribute(:"#{name}_id") { |object| object.acted_by_prefixed_id(name) }
+
+            attribute(:"#{name}_type") do |object|
+              Spree::Base.polymorphic_api_type(object.acted_by_type(name))
+            end
+
+            one name,
+                resource: proc { Spree.api.admin_actor_serializer },
+                if: proc { expand?(name.to_s) }
+          end
+        end
+
         # Plain decimal notation. BigDecimal renders 0.06 as "0.6e-1", which
         # is what a client would otherwise print beside a unit.
         #

data/app/serializers/spree/api/v3/gift_card_serializer.rb

@@ -17,8 +17,10 @@ module Spree
                  expired: :boolean,
                  active: :boolean
 
+        # A bearer credential: masked when the order is shown to someone other
+        # than its buyer (a company's other members).
         attribute :code do |gift_card|
-          gift_card.display_code
+          params[:hide_credentials] ? gift_card.masked_code : gift_card.display_code
         end
 
         attribute :status do |gift_card|

data/app/serializers/spree/api/v3/line_item_serializer.rb

@@ -71,7 +71,8 @@ module Spree
             if: proc { expand?('seller') }
 
         many :option_values, resource: proc { Spree.api.option_value_serializer }
-        many :digital_links, resource: proc { Spree.api.digital_link_serializer }
+        # Download links carry a bearer token; only the buyer gets them.
+        many :digital_links, resource: proc { Spree.api.digital_link_serializer }, if: proc { !params[:hide_credentials] }
         # Tax hangs off its adjustable, never off the cart or order: the
         # exactly-one-adjustable rule makes the nested view complete, and the
         # owner already carries the tax totals.

data/app/serializers/spree/api/v3/market_serializer.rb

@@ -6,11 +6,16 @@ module Spree
                  default_locale: :string,
                  supported_locales: [:string, multi: true],
                  country_codes: [:string, multi: true],
+                 country_isos: [:string, multi: true],
                  tax_inclusive: :boolean,
                  default: :boolean
 
         attributes :name, :currency, :default_locale, :tax_inclusive, :default, :country_codes
 
+        # @deprecated Storefronts shipped against this name; use +country_codes+.
+        #   Removed in 6.1.
+        attribute :country_isos, &:country_codes
+
         attribute :supported_locales do |market|
           market.supported_locales_list
         end

data/app/serializers/spree/api/v3/product_filters_serializer.rb

@@ -12,6 +12,9 @@ module Spree
         attribute :filters do |result|
           result.filters.filter_map do |filter|
             filter_type = filter[:type]
+            # A price range is prices; a gated guest sees none.
+            next if filter_type == 'price_range' && params[:hide_prices]
+
             serializer_class = case filter_type
                                when 'price_range'
                                  Spree.api.product_filter_price_range_serializer

data/app/serializers/spree/api/v3/seller/account_serializer.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # The signed-in person's own account, as `/me` answers it.
+        #
+        # Extends the team member shape rather than widening it: `selected_locale`
+        # is a preference its owner sets, and the team list serializes colleagues
+        # with the parent — where publishing each member's chosen language would
+        # tell the whole team something none of them asked to share.
+        class AccountSerializer < Seller::TeamMemberSerializer
+          typelize selected_locale: [:string, nullable: true]
+
+          attributes :selected_locale
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/seller/invitation_acceptance_link_serializer.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V3
+      module Seller
+        # The acceptance link of one seller-team invitation, served on its own
+        # so the token never travels with the invitation listing.
+        class InvitationAcceptanceLinkSerializer < V3::BaseSerializer
+          typelize acceptance_url: :string
+
+          attributes :acceptance_url
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/seller/invitation_serializer.rb

@@ -5,8 +5,7 @@ module Spree
         class InvitationSerializer < V3::BaseSerializer
           typelize email: :string, status: [:string, enum: Spree::Invitation.statuses, enum_type_name: 'InvitationStatus'],
                    expires_at: [:string, nullable: true],
-                   accepted_at: [:string, nullable: true],
-                   acceptance_url: :string
+                   accepted_at: [:string, nullable: true]
 
           attributes :email,
                      created_at: :iso8601, expires_at: :iso8601, accepted_at: :iso8601
@@ -14,14 +13,6 @@ module Spree
           attribute :status do |invitation|
             invitation.status.to_s
           end
-
-          attribute :acceptance_url do |invitation|
-            if Spree::Config[:seller_panel_url].present? || Spree::Config[:dashboard_url].present?
-              Rails.application.routes.url_helpers.admin_invitation_acceptance_url(invitation)
-            else
-              "/accept-invitation/#{invitation.prefixed_id}?token=#{invitation.token}"
-            end
-          end
         end
       end
     end

data/app/services/spree/api/v3/filters_aggregator.rb

@@ -51,8 +51,11 @@ module Spree
 
 
         def price_filter
-          # Remove ordering to avoid PostgreSQL DISTINCT + ORDER BY conflicts
-          prices = Spree::Price.for_products(@scope.reorder(''), @currency)
+          # Remove ordering to avoid PostgreSQL DISTINCT + ORDER BY conflicts.
+          # Base prices only: a price list's rows are for its own audience
+          # (a company's contract, a draft or scheduled list), and the range is
+          # shown to everyone.
+          prices = Spree::Price.base_prices.for_products(@scope.reorder(''), @currency)
           min = prices.minimum(:amount)
           max = prices.maximum(:amount)
           return nil if min.nil? || max.nil?

data/config/routes.rb

@@ -273,6 +273,7 @@ Spree::Core::Engine.add_routes do
           member do
             patch :resend
           end
+          resource :acceptance_link, only: [:show], controller: 'invitations/acceptance_links'
         end
         resources :api_keys, only: [:index, :show, :create, :update, :destroy] do
           collection do
@@ -590,6 +591,7 @@ Spree::Core::Engine.add_routes do
             member do
               patch :resend
             end
+            resource :acceptance_link, only: [:show], controller: 'sellers/invitations/acceptance_links'
           end
 
           # What this seller submitted about the requirements, and the
@@ -875,6 +877,10 @@ Spree::Core::Engine.add_routes do
         patch 'auth/password_resets/:id', to: 'password_resets#update'
 
         get 'me', to: 'me#show'
+        # Self-service edits to the signed-in person's own account — their
+        # name, photo and panel language. Distinct from `profile`, which is
+        # the seller business they act for.
+        patch 'me', to: 'me#update'
 
         # Singular: the seller in play is always `current_seller`.
         resource :profile, only: [:show, :update], controller: 'profile'
@@ -896,6 +902,7 @@ Spree::Core::Engine.add_routes do
           member do
             patch :resend
           end
+          resource :acceptance_link, only: [:show], controller: 'invitations/acceptance_links'
         end
 
         resources :products, only: [:index, :show, :create, :update, :destroy] do

data/lib/spree/api/configuration.rb

@@ -3,25 +3,30 @@ require 'spree/core/preferences/runtime_configuration'
 module Spree
   module Api
     class Configuration < Spree::Preferences::RuntimeConfiguration
-      preference :jwt_expiration, :integer, default: 3600 # 1 hour in seconds (customer/store JWT default)
-      preference :admin_jwt_expiration, :integer, default: 300 # 5 minutes — admin tokens have higher blast radius
-      preference :jwt_secret_key, :string, default: nil
-      preference :refresh_token_expiry, :integer, default: 2_592_000 # 30 days in seconds
+      preference :jwt_expiration, :integer, default: 3600, env: 'SPREE_JWT_EXPIRATION' # 1 hour in seconds (customer/store JWT default)
+      preference :admin_jwt_expiration, :integer, default: 300, env: 'SPREE_ADMIN_JWT_EXPIRATION' # 5 minutes — admin tokens have higher blast radius
+      # SPREE_JWT_SECRET_KEY resolves inside the preference, so it sits ahead of
+      # the Rails credentials fallback in Spree::Api::V3::JwtAuthentication —
+      # an operator who sets it means it. The older, unprefixed JWT_SECRET_KEY
+      # keeps its place behind credentials so existing deployments are
+      # unaffected.
+      preference :jwt_secret_key, :string, default: nil, env: 'SPREE_JWT_SECRET_KEY'
+      preference :refresh_token_expiry, :integer, default: 2_592_000, env: 'SPREE_REFRESH_TOKEN_EXPIRY' # 30 days in seconds
 
       # Rate limiting
-      preference :rate_limit_per_key, :integer, default: 300 # per publishable API key + client IP (per visitor)
-      preference :rate_limit_per_secret_key, :integer, default: 600 # per secret API key, across the whole API
-      preference :rate_limit_window, :integer, default: 60 # window in seconds
-      preference :rate_limit_login, :integer, default: 5 # per IP
-      preference :rate_limit_register, :integer, default: 3 # per IP
-      preference :rate_limit_refresh, :integer, default: 10 # per IP
-      preference :rate_limit_password_reset, :integer, default: 3 # per IP
+      preference :rate_limit_per_key, :integer, default: 300, env: 'SPREE_RATE_LIMIT_PER_KEY' # per publishable API key + client IP (per visitor)
+      preference :rate_limit_per_secret_key, :integer, default: 600, env: 'SPREE_RATE_LIMIT_PER_SECRET_KEY' # per secret API key, across the whole API
+      preference :rate_limit_window, :integer, default: 60, env: 'SPREE_RATE_LIMIT_WINDOW' # window in seconds
+      preference :rate_limit_login, :integer, default: 5, env: 'SPREE_RATE_LIMIT_LOGIN' # per IP
+      preference :rate_limit_register, :integer, default: 3, env: 'SPREE_RATE_LIMIT_REGISTER' # per IP
+      preference :rate_limit_refresh, :integer, default: 10, env: 'SPREE_RATE_LIMIT_REFRESH' # per IP
+      preference :rate_limit_password_reset, :integer, default: 3, env: 'SPREE_RATE_LIMIT_PASSWORD_RESET' # per IP
 
       # Request body size limit in bytes
-      preference :max_request_body_size, :integer, default: 102_400 # 100KB
+      preference :max_request_body_size, :integer, default: 102_400, env: 'SPREE_MAX_REQUEST_BODY_SIZE' # 100KB
 
-      preference :webhooks_enabled, :boolean, default: true
-      preference :webhooks_verify_ssl, :boolean, default: !Rails.env.development?
+      preference :webhooks_enabled, :boolean, default: true, env: 'SPREE_WEBHOOKS_ENABLED'
+      preference :webhooks_verify_ssl, :boolean, default: !Rails.env.development?, env: 'SPREE_WEBHOOKS_VERIFY_SSL'
     end
   end
 end

data/lib/spree/api/dependencies.rb

@@ -181,12 +181,15 @@ module Spree
         admin_catalog_order_minimum_serializer: 'Spree::Api::V3::Admin::CatalogOrderMinimumSerializer',
         admin_tax_exemption_certificate_serializer: 'Spree::Api::V3::Admin::TaxExemptionCertificateSerializer',
         admin_admin_user_serializer: 'Spree::Api::V3::Admin::AdminUserSerializer',
+        admin_actor_serializer: 'Spree::Api::V3::Admin::ActorSerializer',
         admin_seller_team_member_serializer: 'Spree::Api::V3::Admin::SellerTeamMemberSerializer',
         seller_serializer: 'Spree::Api::V3::SellerSerializer',
         seller_profile_serializer: 'Spree::Api::V3::Seller::ProfileSerializer',
         seller_policy_serializer: 'Spree::Api::V3::Seller::PolicySerializer',
         seller_team_member_serializer: 'Spree::Api::V3::Seller::TeamMemberSerializer',
+        seller_account_serializer: 'Spree::Api::V3::Seller::AccountSerializer',
         seller_invitation_serializer: 'Spree::Api::V3::Seller::InvitationSerializer',
+        seller_invitation_acceptance_link_serializer: 'Spree::Api::V3::Seller::InvitationAcceptanceLinkSerializer',
         seller_product_serializer: 'Spree::Api::V3::Seller::ProductSerializer',
         seller_product_type_serializer: 'Spree::Api::V3::Seller::ProductTypeSerializer',
         seller_delivery_profile_serializer: 'Spree::Api::V3::Seller::DeliveryProfileSerializer',
@@ -266,6 +269,7 @@ module Spree
         admin_webhook_endpoint_serializer: 'Spree::Api::V3::Admin::WebhookEndpointSerializer',
         admin_webhook_delivery_serializer: 'Spree::Api::V3::Admin::WebhookDeliverySerializer',
         admin_invitation_serializer: 'Spree::Api::V3::Admin::InvitationSerializer',
+        admin_invitation_acceptance_link_serializer: 'Spree::Api::V3::Admin::InvitationAcceptanceLinkSerializer',
         admin_role_serializer: 'Spree::Api::V3::Admin::RoleSerializer',
         admin_permission_serializer: 'Spree::Api::V3::Admin::PermissionSerializer',
         admin_export_serializer: 'Spree::Api::V3::Admin::ExportSerializer',

data/lib/spree/api/engine.rb

@@ -24,6 +24,12 @@ module Spree
         Spree.subscribers << Spree::WebhookEventSubscriber
       end
 
+      # Runs after initializers so an explicitly assigned preference — which
+      # wins over the environment — is never rejected for a stale env var.
+      config.after_initialize do
+        Spree::Api::Configuration.validate_env!(Spree::Api::Config)
+      end
+
       # Warn in production if no dedicated JWT secret key is configured
       config.after_initialize do
         next unless Rails.env.production?

data/lib/spree/api/openapi/schema_helper.rb

@@ -250,8 +250,8 @@ module Spree
         #
         # The seller branch has no API-key credential, so its AuthResponse is
         # neither the store's nor the admin's: signing in returns the JWT, the
-        # team member who signed in, and the sellers they may act for — the
-        # panel cannot make another request until it has picked one.
+        # person who signed in, and the sellers they may act for — the panel
+        # cannot make another request until it has picked one.
         def seller_schemas
           schemas = common_schemas
 
@@ -259,7 +259,10 @@ module Spree
             type: :object,
             properties: {
               token: { type: :string, description: 'JWT access token, `seller_api` audience' },
-              user: { '$ref' => '#/components/schemas/TeamMember' },
+              # `Account`, not `TeamMember`: the panel adopts the signed-in
+              # person's saved language from this payload, which is what
+              # carries the choice to a second browser.
+              user: { '$ref' => '#/components/schemas/Account' },
               sellers: {
                 type: :array,
                 description: 'The sellers this user may act for. Pick one and send its `id` as `X-Spree-Seller-Id` on every subsequent request.',
@@ -309,7 +312,10 @@ module Spree
               type: :object,
               description: 'The signed-in user, the sellers they may act for, and what they may do on the selected one',
               properties: {
-                user: { '$ref' => '#/components/schemas/TeamMember' },
+                # `Account`, not `TeamMember`: the person reading their own
+                # record also sees the panel language they chose, which the
+                # team list does not publish about a colleague.
+                user: { '$ref' => '#/components/schemas/Account' },
                 sellers: { type: :array, items: { '$ref' => '#/components/schemas/SellerMeSummary' } },
                 permissions: { type: :array, items: { '$ref' => '#/components/schemas/PermissionRule' } },
                 permission_keys: {