spree_api 6.0.0.beta4 → 6.0.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cbd216e65a6f6ce291a04b750595491f827262d4de353562ac43fa51d69c376e
-  data.tar.gz: ed6181390f17841dc63104e068e6812d936dc29d3896c8366ea27cebc6817274
+  metadata.gz: 3816f80ebaf4e6b8bc42854938340dce8bc17f6190d55337a7e08950fedf7fb1
+  data.tar.gz: 42034e2f05201a30da2d13345b761e1376523ecf98f64668de3538de772a19f2
 SHA512:
-  metadata.gz: 50b7fd005e9f4c80d83c1be99a3e4abf9c84a947e5b801fae461a4596b3e5005a376c2fbb1a6e9aeea063492cdc3548116cfdca5621b551598fbcbac1635fb4c
-  data.tar.gz: '00699269b7d5c5c53d2154a32784c48a8e42a9a2759c05e387fb2218a5725249ab52179861f69b0afa217c5fe429a855fcc3077b9d21dce2efcfea6317cad20e'
+  metadata.gz: f315aff41e1e8731961bfa6cf18bba36428e222aa11ed341b66c9b74bee863eb53b5cece23b361a73a036f5d744e25037e25ec1a49004653a8a7f0448f29a10c
+  data.tar.gz: 34d2faa68118ec0bba15cf75b5711ade7aa0b1d817606180a3e7fb2a57bfdb816799f2911b83b41833f07251f0781d9d5e9046251eb6068356956839b38fc59e

data/Rakefile

@@ -67,39 +67,12 @@ namespace :rswag do
 end
 
 namespace :typelizer do
-  desc 'Generate TypeScript types for both Store and Admin SDKs'
+  desc 'Generate TypeScript types for every SDK (runs in spree_emails, where all serializers load)'
   task :generate do
-    ENV['RAILS_ENV'] ||= 'test'
-    ENV['DISABLE_TYPELIZER'] = 'false'
-
-    require File.expand_path('spec/dummy/config/environment', __dir__)
-
-    # Eager load serializers so typelizer can find them
-    serializers_path = File.expand_path('app/serializers/spree/api/v3', __dir__)
-    Rails.autoloaders.main.eager_load_dir(serializers_path)
-
-    require 'typelizer/generator'
-
-    # Writer config is in config/initializers/typelizer.rb
-    Typelizer::Generator.call(force: true)
-
-    # Post-process: convert `type Foo = {` to `interface Foo {` for declaration merging support.
-    # This lets SDK consumers extend generated types via `declare module '@spree/sdk' { interface Product { ... } }`.
-    api_root = Spree::Api::Engine.root
-    [
-      api_root.join('../../packages/sdk/src/types/generated'),
-      api_root.join('../../packages/admin-sdk/src/types/generated')
-    ].each do |dir|
-      Dir[File.join(dir, '*.ts')].each do |file|
-        next if File.basename(file) == 'index.ts'
-
-        content = File.read(file)
-        updated = content.gsub(/^type (\w+) = \{/, 'interface \1 {')
-        File.write(file, updated) if updated != content
-      end
+    emails_dir = File.expand_path('../emails', __dir__)
+    Bundler.with_unbundled_env do
+      sh "cd #{emails_dir} && bundle exec rake typelizer:generate"
     end
-
-    puts "Generated types → packages/sdk/src/types/generated/ & packages/admin-sdk/src/types/generated/"
   end
 
   desc 'Clean and regenerate TypeScript types'

data/app/controllers/concerns/spree/api/v3/admin/email_template_lookup.rb

@@ -0,0 +1,139 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Finds the editable email template a request is about, from its
+        # dotted key, for the language the request names.
+        module EmailTemplateLookup
+          extend ActiveSupport::Concern
+
+          included do
+            scoped_resource :email_templates
+
+            before_action :load_email_template
+
+            rescue_from Spree::EmailTemplates::NoSampleRecord, with: :render_no_sample
+            rescue_from Liquid::Error, MRML::Error, with: :render_render_error
+          end
+
+          private
+
+          attr_reader :email_template
+
+          def load_email_template
+            @email_template = Spree::EmailTemplates::Entry.for_id(
+              current_store, params[:email_template_id] || params[:id], locale: language
+            )
+          end
+
+          # A language code, or "any" for the version every language uses. Named
+          # `language` rather than `locale`, which picks the response's language.
+          def language
+            @language ||= params[:language].to_s.strip.presence || Spree::EmailTemplate::ANY_LOCALE
+          end
+
+          def serialize_email_template(reload: false)
+            load_email_template if reload
+            Spree.api.admin_email_template_serializer.new(email_template, params: serializer_params).to_h
+          end
+
+          def serializer_class
+            Spree.api.admin_email_template_serializer
+          end
+
+          # Renders the template as it stands after a workflow ran, or why the
+          # workflow refused.
+          def render_email_template_result(result, status: :ok)
+            return render_stale_draft if result.error&.value == :stale
+            return render_template_problems(result.value) if result.error&.value == :invalid_template
+            return render_result_error(result) unless result.success?
+
+            render json: serialize_email_template(reload: true), status: status
+          end
+
+          # Every published version of the template in the requested language.
+          def email_template_revisions
+            Spree::EmailTemplateRevision.where(
+              email_template: current_store.email_templates.for_key(email_template.key, language)
+            )
+          end
+
+          # An unsaved subject and body are previewed only when sent, so an
+          # empty body still previews as empty. `branding` previews unsaved
+          # colors and font.
+          def preview_arguments
+            arguments = params.permit(:record_id, :subject, :body).to_h.symbolize_keys
+            arguments[:locale] = language
+            arguments[:email_key] = params[:email_key].to_s.tr('.', '/').presence
+            arguments[:branding] = params.fetch(:branding, {}).permit(*Spree::Emails::Branding.attribute_names).to_h
+            arguments
+          end
+
+          # Samples show a real record of the store (the latest order, a
+          # company), so previewing one needs permission to read it.
+          def authorize_sample_data!
+            missing = sample_classes.flat_map { |sample| Array(sample.try(:required_permissions)) }.uniq.
+                      reject { |key| holds_permission?(key) }
+            return if missing.empty?
+
+            render_error(
+              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:access_denied],
+              message: I18n.t('spree.email_templates.sample_needs_permission', permissions: missing.to_sentence),
+              status: :forbidden,
+              details: { required_scope: missing.first }
+            )
+          end
+
+          # A preview shows one email; publishing the layout or a partial
+          # renders every email, so it needs what all of their samples need.
+          def sample_classes
+            if action_name == 'create' && controller_name == 'publications' && !email_template.definition.email?
+              Spree.editable_email_templates.emails.map(&:sample_class)
+            else
+              [build_preview.email.sample_class]
+            end
+          end
+
+          def build_preview
+            Spree::EmailTemplates::Preview.new(store: current_store, key: email_template.key, strict: true, **preview_arguments)
+          end
+
+          def render_template_problems(problems)
+            problems = problems.map { |problem| problem.merge(email: problem[:email].tr('/', '.')) }
+
+            render_error(
+              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:email_template_invalid],
+              message: problems.map { |problem| problem[:message] }.uniq.to_sentence,
+              status: :unprocessable_content,
+              details: { problems: problems }
+            )
+          end
+
+          # Attributed to the template being edited, whose lines the editor marks.
+          def render_render_error(error)
+            render_template_problems([{ email: email_template.id, message: error.message, line: error.try(:line_number) }])
+          end
+
+          def render_no_sample(error)
+            render_error(
+              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:email_template_no_sample],
+              message: error.message,
+              status: :unprocessable_content
+            )
+          end
+
+          def render_stale_draft
+            saved_by = email_template.draft&.updated_by&.actor_label
+
+            render_error(
+              code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:email_template_stale],
+              message: I18n.t('spree.email_templates.stale_draft', name: saved_by || I18n.t('spree.email_templates.another_admin')),
+              status: :conflict,
+              details: { updated_by: saved_by }
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v3/admin/store_context.rb

@@ -44,7 +44,7 @@ module Spree
             if secret_api_key && store_id_header && secret_api_key.store&.prefixed_id != store_id_header
               render_error(
                 code: ErrorHandler::ERROR_CODES[:access_denied],
-                message: Spree.t('api.errors.store_mismatch', default: 'The requested store does not match the store this API key belongs to.'),
+                message: I18n.t('spree.api.errors.store_mismatch'),
                 status: :forbidden
               )
               return

data/app/controllers/concerns/spree/api/v3/admin/subclassed_resource.rb

@@ -103,7 +103,7 @@ module Spree
           def render_unknown_type
             render_error(
               code: self.class.unknown_type_error_code,
-              message: Spree.t("api.#{self.class.unknown_type_error_code}",
+              message: I18n.t("spree.api.#{self.class.unknown_type_error_code}",
                                default: 'Unknown type'),
               status: :unprocessable_content
             )

data/app/controllers/concerns/spree/api/v3/cart_resolvable.rb

@@ -57,6 +57,13 @@ module Spree
           @cart = @cart.remove_out_of_stock_items!
         end
 
+        # Drops a batch coupon code the cart no longer holds. Unlike the line
+        # sweep this runs after writes too, since an API client may rely on
+        # write responses alone to learn why its discount went.
+        def sweep_unavailable_coupon_code!
+          @cart = @cart.remove_unavailable_coupon_code!
+        end
+
         # Render what the checkout produced (for the complete action).
         #
         # A checkout spanning several sellers produced a group of orders rather

data/app/controllers/concerns/spree/api/v3/channel_resolution.rb

@@ -59,7 +59,7 @@ module Spree
             if header && header.id != bound.id
               render_error(
                 code: ErrorHandler::ERROR_CODES[:channel_mismatch],
-                message: Spree.t('api.errors.channel_mismatch', default: 'The requested channel does not match the channel this API key is bound to'),
+                message: I18n.t('spree.api.errors.channel_mismatch'),
                 status: :unprocessable_entity
               )
               return
@@ -68,7 +68,7 @@ module Spree
             unless bound.active?
               render_error(
                 code: ErrorHandler::ERROR_CODES[:channel_inactive],
-                message: Spree.t('api.errors.channel_inactive', default: 'The channel this API key is bound to is not active'),
+                message: I18n.t('spree.api.errors.channel_inactive'),
                 status: :forbidden
               )
               return

data/app/controllers/concerns/spree/api/v3/current_password_confirmation.rb

@@ -39,7 +39,7 @@ module Spree
         def render_current_password_invalid
           render_error(
             code: ErrorHandler::ERROR_CODES[:current_password_invalid],
-            message: Spree.t(:current_password_invalid, scope: :api),
+            message: I18n.t('spree.api.current_password_invalid'),
             status: :unprocessable_content
           )
         end

data/app/controllers/concerns/spree/api/v3/error_handler.rb

@@ -74,6 +74,11 @@ module Spree
           # Export errors
           export_not_ready: 'export_not_ready',
 
+          # Email template errors
+          email_template_stale: 'email_template_stale',
+          email_template_invalid: 'email_template_invalid',
+          email_template_no_sample: 'email_template_no_sample',
+
           # Rate limiting errors
           rate_limit_exceeded: 'rate_limit_exceeded',
 
@@ -155,7 +160,7 @@ module Spree
             # Workflows reject with a symbol naming the reason. Translate it,
             # falling back to the symbol so a missing key is visible rather
             # than silently blank.
-            render_error(code: code, message: Spree.t(error, default: error.to_s.humanize), status: status)
+            render_error(code: code, message: I18n.t("spree.#{error}", default: error.to_s.humanize), status: status)
           else
             render_error(code: code, message: error.to_s, status: status)
           end
@@ -311,7 +316,7 @@ module Spree
                     model_name&.humanize || 'record'
                   end
 
-          Spree.t(:record_not_found, scope: 'api', model: label)
+          I18n.t('spree.api.record_not_found', model: label)
         end
 
         # Extract clean model name from exception

data/app/controllers/concerns/spree/api/v3/http_caching.rb

@@ -11,6 +11,33 @@ module Spree
       module HttpCaching
         extend ActiveSupport::Concern
 
+        # Every request header that changes a publicly cacheable response.
+        # A shared cache (CDN, reverse proxy) keys stored responses on these,
+        # so a header missing here lets one visitor's response be served to
+        # another:
+        # - +Accept+ — response format
+        # - +X-Spree-Api-Key+ — the publishable key selects the store (and
+        #   may bind a channel)
+        # - +Authorization+ — a customer JWT turns the response private
+        #   (customer-group prices, gated catalog); without it a guest
+        #   response could be served to a signed-in customer
+        # - +X-Spree-Country+ — selects the market (currency, prices, tax
+        #   display, availability)
+        # - +X-Spree-Currency+ / +X-Spree-Locale+ — currency and language
+        # - +X-Spree-Channel+ — price hiding + channel-scoped visibility
+        #
+        # Query-param equivalents (+?country=+, +?currency=+, +?locale=+)
+        # are part of the URL and so already part of every cache key.
+        VARY_HEADERS = %w[
+          Accept
+          X-Spree-Api-Key
+          Authorization
+          X-Spree-Country
+          X-Spree-Currency
+          X-Spree-Locale
+          X-Spree-Channel
+        ].freeze
+
         included do
           after_action :set_vary_headers
         end
@@ -22,13 +49,11 @@ module Spree
           current_user.nil?
         end
 
-        # Set Vary headers to ensure proper CDN caching by currency/locale/channel.
-        # X-Spree-Channel is included because the resolved channel changes the
-        # serialized body (price hiding + channel-scoped visibility), so a shared
-        # cache must not serve one channel's guest response to another channel.
+        # Set Vary so a shared cache stores one guest response per
+        # store/market/currency/locale/channel combination (see VARY_HEADERS).
         def set_vary_headers
           if guest_user?
-            response.headers['Vary'] = 'Accept, x-spree-currency, x-spree-locale, x-spree-channel'
+            response.headers['Vary'] = VARY_HEADERS.join(', ')
           else
             response.headers['Cache-Control'] = 'private, no-store'
           end
@@ -70,12 +95,12 @@ module Spree
 
           expires_in expires_in, public: true
 
-          # Use Rails' stale? which handles ETag and Last-Modified. The channel
-          # is folded into the ETag so a shared cache never serves one channel's
-          # guest response to another; Last-Modified mirrors the resource's own
-          # timestamp as before.
+          # Use Rails' stale? which handles ETag and Last-Modified. The request
+          # context (currency, locale, market, channel) is folded into the ETag
+          # so a revalidation never 304s across contexts; Last-Modified mirrors
+          # the resource's own timestamp as before.
           stale?(
-            etag: [resource, cache_channel_fragment],
+            etag: [resource, current_currency, current_locale, cache_market_fragment, cache_channel_fragment],
             last_modified: resource.try(:updated_at),
             public: true
           )
@@ -84,7 +109,7 @@ module Spree
         private
 
         # Build a cache key for a collection
-        # Includes: latest updated_at, total count, query params, pagination, expand, currency, locale, channel
+        # Includes: latest updated_at, total count, query params, pagination, expand, currency, locale, market, channel
         def collection_cache_key(collection)
           # For ActiveRecord collections use updated_at, for plain arrays use store's updated_at as proxy
           latest_updated_at = if collection.first&.respond_to?(:updated_at)
@@ -103,12 +128,20 @@ module Spree
             params[:limit],
             current_currency,
             current_locale,
+            cache_market_fragment,
             cache_channel_fragment
           ]
 
           parts.compact.join('/')
         end
 
+        # Identifies the resolved market (from X-Spree-Country / ?country=).
+        # The market drives tax display and availability as well as currency,
+        # so it is part of the guest cache identity.
+        def cache_market_fragment
+          Spree::Current.market&.id
+        end
+
         # Identifies the resolved channel for cache-key purposes. The channel
         # changes the serialized body (price hiding + channel-scoped visibility),
         # so it must be part of the guest cache identity. Uses the same

data/app/controllers/concerns/spree/api/v3/idempotent.rb

@@ -29,6 +29,8 @@ module Spree
             return
           end
 
+          return yield if caller_identity.nil?
+
           cache_key = idempotency_cache_key(key)
           cached = Rails.cache.read(cache_key)
 
@@ -36,7 +38,7 @@ module Spree
             if cached[:fingerprint] != request_fingerprint
               render_error(
                 code: ErrorHandler::ERROR_CODES[:idempotency_key_reused],
-                message: Spree.t(:idempotency_key_reused),
+                message: I18n.t('spree.idempotency_key_reused'),
                 status: :unprocessable_content
               )
               return
@@ -66,17 +68,30 @@ module Spree
           MUTATING_METHODS.include?(request.method)
         end
 
+        def caller_identity
+          return @caller_identity if defined?(@caller_identity)
+
+          credentials = []
+
+          credentials << ['secret_key', Spree::ApiKey.compute_token_digest(extract_api_key)] if secret_key_request?
+
+          bearer_token = extract_token
+          credentials << ['bearer', Digest::SHA256.hexdigest(bearer_token)] if bearer_token.present?
+
+          credentials << ['order_token', Digest::SHA256.hexdigest(order_token)] if order_token.present?
+
+          @caller_identity = credentials.presence
+        end
+
         def idempotency_cache_key(key)
-          credential = request.headers['X-Spree-Api-Key'].presence ||
-                       spree_current_user&.id ||
-                       request.remote_ip
           # The resolved store partitions the namespace: a staff JWT spans
           # stores, and replaying one store's cached response for a request
           # aimed at another would cross store boundaries. The resolved
           # store — not the raw header — so a header naming the default store
           # and no header at all land in the same partition, as they resolve
           # to the same store.
-          "spree:idempotency:#{Digest::SHA256.hexdigest("#{credential}\0#{current_store&.id}\0#{key}")}"
+          digest = Digest::SHA256.hexdigest([*caller_identity.flatten, current_store&.id, key].join("\0"))
+          "spree:idempotency:#{digest}"
         end
 
         def request_fingerprint

data/app/controllers/concerns/spree/api/v3/items_payload.rb

@@ -45,7 +45,7 @@ module Spree
         # `return_line_items`).
         def render_invalid_items
           errors = ActiveModel::Errors.new(@resource || model_class.new)
-          errors.add(:base, :invalid_items, message: Spree.t('errors.messages.items_not_a_list'))
+          errors.add(:base, :invalid_items, message: I18n.t('spree.errors.messages.items_not_a_list'))
           render_validation_error(errors)
         end
       end

data/app/controllers/concerns/spree/api/v3/order_lock.rb

@@ -29,7 +29,7 @@ module Spree
             if order.is_a?(Spree::Cart) && order.completion_claimed?
               next render_error(
                 code: 'completion_in_progress',
-                message: Spree.t(:cart_completion_in_progress),
+                message: I18n.t('spree.cart_completion_in_progress'),
                 status: :conflict
               )
             end
@@ -51,7 +51,7 @@ module Spree
           Rails.error.report(exception, context: { order_id: (@order || @parent || @cart)&.id }, source: 'spree.api.v3')
           render_error(
             code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:cart_already_updated],
-            message: Spree.t(:cart_already_updated),
+            message: I18n.t('spree.cart_already_updated'),
             status: :conflict
           )
         end

data/app/controllers/concerns/spree/api/v3/orders/delivery_actions.rb

@@ -28,11 +28,7 @@ module Spree
                 **resource_permitted_attributes.index_with { |key| delivery_params[key] }
               )
 
-              if result.success?
-                render json: serialize_resource(result.value), status: :created
-              else
-                render_result_error(result)
-              end
+              render_result(result, status: :created)
             end
           end
 

data/app/controllers/concerns/spree/api/v3/orders/fulfillment_actions.rb

@@ -45,11 +45,7 @@ module Spree
                 **fulfill_workflow_options
               )
 
-              if result.success?
-                render json: serialize_resource(result.value)
-              else
-                render_result_error(result)
-              end
+              render_result(result)
             end
           end
 
@@ -60,11 +56,7 @@ module Spree
             with_order_lock do
               result = Spree.fulfillment_cancel_workflow.call(fulfillment: @resource)
 
-              if result.success?
-                render json: serialize_resource(result.value)
-              else
-                render_result_error(result)
-              end
+              render_result(result)
             end
           end
 

data/app/controllers/concerns/spree/api/v3/orders/post_sale_actions.rb

@@ -28,11 +28,7 @@ module Spree
           def run_workflow(workflow, **arguments)
             result = workflow.call(workflow_record_key => @resource, **arguments)
 
-            if result.success?
-              render json: serialize_resource(result.value)
-            else
-              render_result_error(result)
-            end
+            render_result(result)
           end
 
           # @return [Symbol] the keyword this entity's workflows take it under
@@ -63,11 +59,7 @@ module Spree
               **arguments
             )
 
-            if result.success?
-              render json: serialize_resource(result.value), status: :created
-            else
-              render_result_error(result)
-            end
+            render_result(result, status: :created)
           end
         end
       end

data/app/controllers/concerns/spree/api/v3/orders/shipping_label_actions.rb

@@ -31,7 +31,7 @@ module Spree
             stream_shipping_label(@resource) do
               render_error(
                 code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:validation_error],
-                message: Spree.t('shipping_labels.errors.no_file_url'),
+                message: I18n.t('spree.shipping_labels.errors.no_file_url'),
                 status: :unprocessable_content
               )
             end
@@ -45,7 +45,7 @@ module Spree
             unless @resource.uploaded?
               return render_error(
                 code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:validation_error],
-                message: Spree.t('shipping_labels.errors.purchased_not_deletable'),
+                message: I18n.t('spree.shipping_labels.errors.purchased_not_deletable'),
                 status: :unprocessable_content
               )
             end
@@ -104,11 +104,7 @@ module Spree
                 **label_permitted_keys.index_with { |key| label_params[key] }
               )
 
-              if result.success?
-                render json: serialize_resource(result.value), status: :created
-              else
-                render_result_error(result)
-              end
+              render_result(result, status: :created)
             end
           end
 
@@ -117,7 +113,7 @@ module Spree
           def render_invalid_signature
             render_error(
               code: Spree::Api::V3::ErrorHandler::ERROR_CODES[:parameter_invalid],
-              message: Spree.t('shipping_labels.errors.file_required'),
+              message: I18n.t('spree.shipping_labels.errors.file_required'),
               status: :unprocessable_content
             )
           end

data/app/controllers/concerns/spree/api/v3/permission_serialization.rb

@@ -6,6 +6,7 @@ module Spree
       # branches answer different audiences, but the frontend permission model
       # is one implementation, so its input has to be too.
       #
+      # - Subjects are short names (`product`), not Ruby class names.
       # - Rule order is preserved so the frontend matcher can apply
       #   CanCanCan's "last matching rule wins" semantics.
       # - Per-record conditions are NOT serialized (they often reference
@@ -23,12 +24,19 @@ module Spree
             {
               allow: rule.base_behavior,
               actions: Array(rule.actions).map(&:to_s),
-              subjects: Array(rule.subjects).map { |subject| subject.is_a?(Class) ? subject.name : subject.to_s },
+              subjects: Array(rule.subjects).map { |subject| serialize_subject(subject) },
               has_conditions: rule_has_conditions?(rule)
             }
           end
         end
 
+        # A model subject travels as its short name (`product`, `customer`),
+        # never the Ruby class; `all` and symbol subjects (`dashboard`) pass
+        # through as they are.
+        def serialize_subject(subject)
+          subject.is_a?(Class) ? Spree::Base.polymorphic_api_type(subject.name) : subject.to_s
+        end
+
         def serialize_permission_keys(ability)
           ability.respond_to?(:permission_keys) ? ability.permission_keys : []
         end

data/app/controllers/concerns/spree/api/v3/seller/seller_context.rb

@@ -96,7 +96,7 @@ module Spree
 
             render_error(
               code: ErrorHandler::ERROR_CODES[:access_denied],
-              message: Spree.t(:seller_access_denied),
+              message: I18n.t('spree.seller_access_denied'),
               status: :forbidden
             )
             false

data/app/controllers/concerns/spree/api/v3/store/storefront_products.rb

@@ -5,9 +5,10 @@ module Spree
         # The products a storefront buyer may see: available now (or on
         # pre-order) in the current currency, narrowed to the catalogs their
         # company, customer group or channel resolve to. The product listing
-        # reads through it, and so does anything else that accepts a product
-        # or variant from the buyer, so an id cannot reach what the listing
-        # would never show.
+        # and wishlist items read through it, so an id cannot reach what the
+        # listing would never show. Carts narrow through
+        # {Spree::Cart#orderable_variants} instead, which asks the same
+        # catalogs about the cart's own buyer and company.
         module StorefrontProducts
           extend ActiveSupport::Concern
 
@@ -26,7 +27,7 @@ module Spree
 
           # @return [ActiveRecord::Relation<Spree::Variant>]
           def storefront_variants
-            Spree::Variant.where(product_id: storefront_products.reorder(nil).select(Spree::Product.arel_table[:id]))
+            Spree::Variant.for_products(storefront_products)
           end
         end
       end