spree_api 6.0.0.rc5 → 6.0.0.rc6

data/app/services/spree/api/v3/filters_aggregator.rb

@@ -251,30 +251,75 @@ module Spree
         def category_filter
           return nil if @category.nil?
 
-          # Get child categories at the next depth level
-          child_categories = @category.children.order(:lft).select do |child|
-            # Only include categories that have products in the current scope
-            @scope.in_category(child).exists?
+          children = @category.children.order(:lft).to_a
+          return nil if children.empty?
+
+          counts = product_counts_by_child_category(children)
+          # A child with nothing in the current scope is not offered as a
+          # filter, which is what the per-child `exists?` decided before.
+          options = children.filter_map do |child|
+            count = counts[child.id]
+            next if count.nil? || count.zero?
+
+            {
+              id: child.prefixed_id,
+              name: child.name,
+              permalink: child.permalink,
+              count: count
+            }
           end
 
-          return nil if child_categories.empty?
+          return nil if options.empty?
 
-          {
-            id: 'categories',
-            type: 'category',
-            options: child_categories.map { |c| category_option_data(c) }
-          }
+          { id: 'categories', type: 'category', options: options }
         end
 
-        def category_option_data(category)
-          count = @scope.in_category(category).distinct.count
+        # Distinct product counts for each child category, counting its whole
+        # subtree, in one query rather than two per child (an existence probe
+        # and a count). A category sidebar is drawn on every filtered
+        # storefront request, so the per-child pair is paid on each one.
+        #
+        # @param children [Array<Spree::Category>]
+        # @return [Hash{Integer => Integer}] child category id => product count
+        def product_counts_by_child_category(children)
+          descendant_ids_by_child = descendant_ids_for(children)
+          all_descendant_ids = descendant_ids_by_child.values.flatten.uniq
+          return {} if all_descendant_ids.empty?
+
+          product_categories = Spree::ProductCategory.table_name
+          # product id => the categories it sits in, narrowed to this subtree
+          pairs = @scope.reorder('').joins(:product_categories).
+                  where("#{product_categories}.category_id" => all_descendant_ids).
+                  distinct.
+                  pluck("#{product_categories}.category_id", "#{product_categories}.product_id")
+
+          product_ids_by_category = Hash.new { |hash, key| hash[key] = [] }
+          pairs.each { |category_id, product_id| product_ids_by_category[category_id] << product_id }
+
+          descendant_ids_by_child.transform_values do |descendant_ids|
+            descendant_ids.flat_map { |id| product_ids_by_category[id] }.uniq.size
+          end
+        end
 
-          {
-            id: category.prefixed_id,
-            name: category.name,
-            permalink: category.permalink,
-            count: count
-          }
+        # Every child's subtree ids in one query. A nested set stores a
+        # subtree as an `lft`/`rgt` range, so one read of the categories
+        # spanned by the children answers for all of them — asking each child
+        # separately is a query per filter option.
+        #
+        # @param children [Array<Spree::Category>]
+        # @return [Hash{Integer => Array<Integer>}] child id => subtree ids
+        def descendant_ids_for(children)
+          bounds = children.to_h { |child| [child.id, (child.lft..child.rgt)] }
+
+          rows = Spree::Category.
+                 where(store_id: children.first.store_id).
+                 where(lft: children.map(&:lft).min..children.map(&:rgt).max).
+                 pluck(:id, :lft)
+
+          children.to_h do |child|
+            range = bounds[child.id]
+            [child.id, rows.filter_map { |id, lft| id if range.cover?(lft) }]
+          end
         end
       end
     end

data/config/locales/en.yml

@@ -2,6 +2,7 @@
 en:
   spree:
     api:
+      account_deactivated: This account has been deactivated. Contact an administrator to restore access.
       cannot_delete: "%{model} cannot be deleted"
       cannot_modify_seller_import: This import belongs to a seller. It can be viewed here, but only the seller can retry or delete it.
       current_password_invalid: Current password is invalid or missing

data/config/routes.rb

@@ -910,6 +910,9 @@ Spree::Core::Engine.add_routes do
             post :bulk_status_update
             delete :bulk_destroy
           end
+
+          resources :digital_assets, controller: 'products/digital_assets',
+                                     only: [:index, :create, :show, :update, :destroy]
         end
 
 

data/lib/spree/api/dependencies.rb

@@ -51,8 +51,8 @@ module Spree
            order_line_item fulfillment fulfillment_item delivery delivery_rate shipping_label return
            return_line_item exchange exchange_line_item claim claim_line_item reason package_type stock_location
            requirement_custom_field tax_identifier requirement_status import import_row import_mapping
-           requirement_submission export transfer payout balance payment_split price price_history file_upload
-           file_upload_target].freeze
+           requirement_submission export transfer payout balance payment_split price price_history file_upload digital_asset
+           file_upload_target store].freeze
 
       INJECTION_POINTS_WITH_DEFAULTS = {
         **STORE_SERIALIZERS.to_h { |name| [:"#{name}_serializer", "Spree::Api::V3::#{name.to_s.camelize}Serializer"] },

data/lib/spree/api/engine.rb

@@ -49,6 +49,12 @@ module Spree
         app.middleware.insert_before Rack::Runtime, Spree::Api::Middleware::RequestSizeLimit
       end
 
+      # Outside ShowExceptions, so an unknown API path's 404 carries it too.
+      initializer 'spree.api.no_index' do |app|
+        require_relative 'middleware/no_index'
+        app.middleware.insert_before Rack::Runtime, Spree::Api::Middleware::NoIndex
+      end
+
       # The resources agents may read and write are derived from the admin
       # controllers themselves (see Spree::Api::AgentResourceMap). Marked
       # stale on every reload rather than rebuilt: deriving it eager-loads the

data/lib/spree/api/middleware/no_index.rb

@@ -0,0 +1,33 @@
+module Spree
+  module Api
+    module Middleware
+      # Marks every API response as not for search engines. Store API JSON is
+      # public and gets indexed once a crawler finds a link to it, where it
+      # competes with the storefront's own pages; tokened URLs such as digital
+      # downloads travel in emails, which is exactly how crawlers find them.
+      #
+      # A middleware rather than a controller callback: it also covers the
+      # OAuth and webhook controllers that do not inherit from the API base
+      # controller, and the 404 Rails renders for an unknown API path. Scoped
+      # by path because the same application may serve pages that must stay
+      # indexable.
+      class NoIndex
+        def initialize(app)
+          @app = app
+        end
+
+        def call(env)
+          status, headers, body = @app.call(env)
+          headers['x-robots-tag'] = 'noindex, nofollow' if api_request?(env)
+          [status, headers, body]
+        end
+
+        private
+
+        def api_request?(env)
+          env['PATH_INFO']&.start_with?('/api/')
+        end
+      end
+    end
+  end
+end

data/lib/spree/api/openapi/schema_helper.rb

@@ -329,6 +329,7 @@ module Spree
                 # team list does not publish about a colleague.
                 user: { '$ref' => '#/components/schemas/Account' },
                 sellers: { type: :array, items: { '$ref' => '#/components/schemas/SellerMeSummary' } },
+                store: { '$ref' => '#/components/schemas/Store' },
                 permissions: { type: :array, items: { '$ref' => '#/components/schemas/PermissionRule' } },
                 permission_keys: {
                   type: :array,
@@ -337,7 +338,7 @@ module Spree
                   example: %w[read_products write_products]
                 }
               },
-              required: %w[user sellers permissions permission_keys]
+              required: %w[user sellers store permissions permission_keys]
             },
             OnboardingProgress: {
               type: :object,

data/lib/spree/api/testing_support/v3/base.rb

@@ -178,6 +178,24 @@ shared_examples 'returns 422 Unprocessable Entity' do
   end
 end
 
+# Prosopite reports a statement only once it repeats, and most specs create a
+# single record, so a list endpoint's N+1 stays invisible unless the spec
+# renders several rows. Include this in every `GET #index` block with a
+# `subject` that performs the request and a `let!` creating at least two
+# records the serializer will render:
+#
+#   it_behaves_like 'a list without N+1 queries' do
+#     let!(:records) { create_list(:product, 3, store: store) }
+#   end
+shared_examples 'a list without N+1 queries' do
+  it 'renders several records without repeating a query' do
+    subject
+
+    expect(response).to have_http_status(:ok)
+    expect(json_response['data'].size).to be >= 2
+  end
+end
+
 shared_examples 'requires API key' do
   context 'without API key' do
     let(:headers) { {} }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 6.0.0.rc5
+  version: 6.0.0.rc6
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-22 00:00:00.000000000 Z
+date: 2026-10-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.rc5
+        version: 6.0.0.rc6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.0.rc5
+        version: 6.0.0.rc6
 description: Spree Commerce Store / Admin API and HTTP webhooks
 email:
 - hello@spreecommerce.org
@@ -68,6 +68,7 @@ files:
 - app/controllers/concerns/spree/api/v3/admin/product_listing.rb
 - app/controllers/concerns/spree/api/v3/admin/product_membership.rb
 - app/controllers/concerns/spree/api/v3/admin/receivable_actions.rb
+- app/controllers/concerns/spree/api/v3/admin/refund_authorization.rb
 - app/controllers/concerns/spree/api/v3/admin/reporting_authorization.rb
 - app/controllers/concerns/spree/api/v3/admin/role_grant_guard.rb
 - app/controllers/concerns/spree/api/v3/admin/stock_receipt_actions.rb
@@ -83,6 +84,7 @@ files:
 - app/controllers/concerns/spree/api/v3/channel_resolution.rb
 - app/controllers/concerns/spree/api/v3/company_address_writes.rb
 - app/controllers/concerns/spree/api/v3/current_password_confirmation.rb
+- app/controllers/concerns/spree/api/v3/digital_assets_resource.rb
 - app/controllers/concerns/spree/api/v3/error_handler.rb
 - app/controllers/concerns/spree/api/v3/file_uploads.rb
 - app/controllers/concerns/spree/api/v3/http_caching.rb
@@ -315,6 +317,7 @@ files:
 - app/controllers/spree/api/v3/seller/payouts_controller.rb
 - app/controllers/spree/api/v3/seller/policies_controller.rb
 - app/controllers/spree/api/v3/seller/product_types_controller.rb
+- app/controllers/spree/api/v3/seller/products/digital_assets_controller.rb
 - app/controllers/spree/api/v3/seller/products_controller.rb
 - app/controllers/spree/api/v3/seller/profile_controller.rb
 - app/controllers/spree/api/v3/seller/reasons_controller.rb
@@ -411,6 +414,7 @@ files:
 - app/request_schemas/spree/api/v3/admin/tax_identifier_request_schema.rb
 - app/request_schemas/spree/api/v3/admin/variant_request_schema.rb
 - app/request_schemas/spree/api/v3/custom_field_value_request_schema.rb
+- app/request_schemas/spree/api/v3/digital_asset_request_schema.rb
 - app/request_schemas/spree/api/v3/file_upload_request_schema.rb
 - app/request_schemas/spree/api/v3/media_request_schema.rb
 - app/request_schemas/spree/api/v3/price_request_schema.rb
@@ -422,6 +426,7 @@ files:
 - app/request_schemas/spree/api/v3/variant_option_request_schema.rb
 - app/request_schemas/spree/api/v3/variant_request_schema.rb
 - app/serializers/concerns/spree/api/v3/admin/translatable.rb
+- app/serializers/concerns/spree/api/v3/digital_asset_details.rb
 - app/serializers/concerns/spree/api/v3/purchase_summary.rb
 - app/serializers/spree/api/v3/address_owner_serializer.rb
 - app/serializers/spree/api/v3/address_serializer.rb
@@ -678,6 +683,7 @@ files:
 - app/serializers/spree/api/v3/seller/delivery_rate_serializer.rb
 - app/serializers/spree/api/v3/seller/delivery_serializer.rb
 - app/serializers/spree/api/v3/seller/delivery_zone_serializer.rb
+- app/serializers/spree/api/v3/seller/digital_asset_serializer.rb
 - app/serializers/spree/api/v3/seller/exchange_line_item_serializer.rb
 - app/serializers/spree/api/v3/seller/exchange_serializer.rb
 - app/serializers/spree/api/v3/seller/export_serializer.rb
@@ -713,6 +719,7 @@ files:
 - app/serializers/spree/api/v3/seller/state_serializer.rb
 - app/serializers/spree/api/v3/seller/stock_level_serializer.rb
 - app/serializers/spree/api/v3/seller/stock_location_serializer.rb
+- app/serializers/spree/api/v3/seller/store_serializer.rb
 - app/serializers/spree/api/v3/seller/tax_identifier_serializer.rb
 - app/serializers/spree/api/v3/seller/team_member_serializer.rb
 - app/serializers/spree/api/v3/seller/transfer_serializer.rb
@@ -800,6 +807,7 @@ files:
 - lib/spree/api/engine.rb
 - lib/spree/api/enum_types.rb
 - lib/spree/api/extension_fields.rb
+- lib/spree/api/middleware/no_index.rb
 - lib/spree/api/middleware/request_size_limit.rb
 - lib/spree/api/oauth.rb
 - lib/spree/api/openapi/filter_documentation.rb
@@ -823,9 +831,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.0.rc5
+  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.0.rc6
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v6.0.0.rc5
+  source_code_uri: https://github.com/spree/spree/tree/v6.0.0.rc6
 post_install_message:
 rdoc_options: []
 require_paths: