spree_api 5.6.0.rc1 → 5.6.0.rc2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 89ddc07a0f4f9334f2ecb79bf2283986e8078e5566d4a7b1c672fadd2f04453d
-  data.tar.gz: 1db32c6bf66382dc2786d1898aaaf5e6c3e1a04b721404fad423c37cc3e0326b
+  metadata.gz: 0b165c94c2975472728b228761cc6cb41f1a677a6368dc9a0be992b5840444cd
+  data.tar.gz: 1ee381dfe91a8ccc58e959cec117f1beb992dde08b6c04488e18ea45baf1ec3c
 SHA512:
-  metadata.gz: 001b8a751f6cd60f71ee162e4387570f8976bd47a3c6794f6d850ba42fe157c3850a137646fed9f6c22651e9d86bf08bad579f2a6854370442cc9dbec0ae1c3f
-  data.tar.gz: 6eb41a561383ce8ab469c21c1a341673164fadb3f5e738ccb7b0635bccd7ff56d6d280d30bcd3aa1bea852763b4f13908b96e45b071013736013c759f71f48fe
+  metadata.gz: 71038600173f2b56747b328f32fab9030ade806d07f3823e1e3e261098f85bdf24d54b0e8c7eb131e669a1f856bbb84c0d6cd3bba2974eef2739c87b73e27ddd
+  data.tar.gz: 8847edd08dbe74a437313d47add4fc557f5930dfdce57cca0b8812249e1f9ea40cc2416aef628e97a13a999777031bd6de381532a4093bceb6311f554854acb8

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -83,10 +83,15 @@ module Spree
           end
 
           # PATCH /api/v3/store/carts/:id/associate
-          # Associates a guest cart with the currently authenticated user
-          # Requires: JWT authentication + cart ID in URL
+          # Associates a guest cart with the currently authenticated user.
+          # Requires: JWT authentication + cart ID in URL + possession of the
+          # cart's token (x-spree-token). The token is the credential that
+          # authorizes claiming the cart, so it is required even when the cart
+          # is already the caller's own.
           def associate
             @cart = find_cart_for_association
+            authorize!(:update, @cart, cart_token)
+            require_cart_token!
 
             result = Spree.cart_associate_service.call(guest_order: @cart, user: current_user, guest_only: true)
 
@@ -177,6 +182,14 @@ module Spree
           def find_cart_for_association
             current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(params[:id])
           end
+
+          # Claiming a cart requires presenting its token, even when the caller
+          # already owns it — the token, not ownership, is the claim credential.
+          def require_cart_token!
+            valid = cart_token.present? && cart_token == @cart.token
+
+            raise CanCan::AccessDenied.new(nil, :update, @cart) unless valid
+          end
         end
       end
     end

data/app/controllers/spree/api/v3/store/newsletter_subscribers_controller.rb

@@ -7,7 +7,7 @@ module Spree
           rate_limit to: Spree::Api::Config[:rate_limit_register],
                      within: Spree::Api::Config[:rate_limit_window].seconds,
                      store: Rails.cache,
-                     only: [:create, :verify],
+                     only: [:create, :verify, :request_unsubscribe],
                      with: RATE_LIMIT_RESPONSE
 
           # POST /api/v3/store/newsletter_subscribers
@@ -53,6 +53,57 @@ module Spree
             render json: serialize_resource(subscriber)
           end
 
+          # DELETE /api/v3/store/newsletter_subscribers/:id
+          # Accepts either of:
+          #   - Authorization: Bearer <jwt> — logged-in customer destroying their own subscription
+          #   - ?token=<unsubscribe-token>  — bearer from `subscriber.generate_token_for(:unsubscribe)`,
+          #                                   typically clicked from an unsubscribe email
+          def destroy
+            subscriber = find_owned_subscriber || find_subscriber_by_unsubscribe_token
+
+            if subscriber.blank?
+              return render_error(
+                code: ERROR_CODES[:invalid_token],
+                message: Spree.t(:newsletter_unsubscribe_token_invalid, scope: :api),
+                status: :unprocessable_content
+              )
+            end
+
+            linked_user = subscriber.user
+            subscriber.destroy!
+
+            # Keep accepts_email_marketing in sync, but only when no subscriptions remain.
+            if linked_user&.accepts_email_marketing? && Spree::NewsletterSubscriber.where(user_id: linked_user.id).none?
+              linked_user.update(accepts_email_marketing: false)
+            end
+
+            head :no_content
+          end
+
+          # POST /api/v3/store/newsletter_subscribers/request_unsubscribe
+          # Publishes a `newsletter_subscriber.unsubscribe_requested` event carrying the unsubscribe token.
+          # Always returns 202 to prevent email enumeration.
+          def request_unsubscribe
+            subscriber = Spree::NewsletterSubscriber.for_store(current_store).find_by(email: params[:email])
+
+            if subscriber
+              payload = {
+                id: subscriber.prefixed_id,
+                email: subscriber.email,
+                unsubscribe_token: subscriber.generate_token_for(:unsubscribe),
+                store_id: current_store.prefixed_id,
+                customer_id: subscriber.user&.prefixed_id
+              }
+
+              redirect_url = validated_redirect_url
+              payload[:redirect_url] = redirect_url if redirect_url.present?
+
+              subscriber.publish_event('newsletter_subscriber.unsubscribe_requested', payload)
+            end
+
+            head :accepted
+          end
+
           protected
 
           def serializer_class
@@ -61,6 +112,22 @@ module Spree
 
           private
 
+          def find_owned_subscriber
+            return unless current_user
+
+            Spree::NewsletterSubscriber.
+              for_store(current_store).
+              accessible_by(current_ability, :destroy).
+              find_by_prefix_id(params[:id])
+          end
+
+          def find_subscriber_by_unsubscribe_token
+            return if params[:token].blank?
+
+            subscriber = Spree::NewsletterSubscriber.for_store(current_store).find_by_token_for(:unsubscribe, params[:token])
+            subscriber if subscriber&.prefixed_id == params[:id]
+          end
+
           # Drop redirect_url when it isn't in the store's allow-list — secure-by-default,
           # mirrors password_resets. Returning nil omits it from the webhook payload rather
           # than rejecting the request, so callers can't probe the allow-list via 4xx errors.

data/app/serializers/spree/api/v3/admin/customer_serializer.rb

@@ -85,6 +85,16 @@ module Spree
           one :bill_address, key: :default_billing_address, resource: proc { Spree.api.admin_address_serializer }, if: proc { expand?('default_billing_address') }
           one :ship_address, key: :default_shipping_address, resource: proc { Spree.api.admin_address_serializer }, if: proc { expand?('default_shipping_address') }
 
+          # Override the inherited always-on store association to gate it behind
+          # expand? — the admin customers index serializes many rows and an
+          # always-on association would fire one query per row.
+          one :newsletter_subscriber,
+              resource: proc { Spree.api.admin_newsletter_subscriber_serializer },
+              if: proc { expand?('newsletter_subscriber') } do |user, params|
+            store = params&.dig(:store) || Spree::Current.store
+            user.newsletter_subscriber(store)
+          end
+
           many :orders,
                resource: proc { Spree.api.admin_order_serializer },
                if: proc { expand?('orders') }

data/app/serializers/spree/api/v3/admin/newsletter_subscriber_serializer.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Admin API Newsletter Subscriber Serializer
+        # Back-office surface, nested under the admin customer serializer. Extends the
+        # customer-facing serializer so public fields stay in sync.
+        class NewsletterSubscriberSerializer < V3::NewsletterSubscriberSerializer
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/customer_serializer.rb

@@ -8,7 +8,8 @@ module Spree
                  full_name: :string,
                  phone: [:string, nullable: true], accepts_email_marketing: :boolean,
                  available_store_credit_total: :string, display_available_store_credit_total: :string,
-                 default_billing_address: { nullable: true }, default_shipping_address: { nullable: true }
+                 default_billing_address: { nullable: true }, default_shipping_address: { nullable: true },
+                 newsletter_subscriber: { nullable: true }
 
         attributes :email, :first_name, :last_name, :phone, :accepts_email_marketing
 
@@ -31,6 +32,11 @@ module Spree
         many :addresses, resource: proc { Spree.api.address_serializer }
         one :bill_address, key: :default_billing_address, resource: proc { Spree.api.address_serializer }
         one :ship_address, key: :default_shipping_address, resource: proc { Spree.api.address_serializer }
+
+        one :newsletter_subscriber, resource: proc { Spree.api.newsletter_subscriber_serializer } do |user, params|
+          store = params&.dig(:store) || Spree::Current.store
+          user.newsletter_subscriber(store)
+        end
       end
     end
   end

data/config/locales/en.yml

@@ -13,6 +13,7 @@ en:
         guest_checkout_not_allowed: You must be signed in to complete checkout.
         storefront_login_required: Authentication required to access this store.
       negative_quantity: quantity is negative
+      newsletter_unsubscribe_token_invalid: Newsletter unsubscribe token is invalid or has expired.
       newsletter_verification_token_invalid: Newsletter verification token is invalid or has expired.
       order:
         could_not_transition: The order could not be transitioned. Please fix the errors and try again.

data/config/routes.rb

@@ -59,10 +59,15 @@ Spree::Core::Engine.add_routes do
         # Customers
         resources :customers, only: [:create]
 
-        # Newsletter Subscriptions (guest-accessible: subscribe + verify by token)
-        resources :newsletter_subscribers, only: [:create] do
+        # Newsletter Subscriptions
+        # - create + verify + request_unsubscribe are guest-accessible
+        # - destroy accepts either an unsubscribe token (from email links) or JWT auth
+        # A signed-in customer reads their own subscription (and its id) off the
+        # `newsletter_subscriber` association on GET /customers/me.
+        resources :newsletter_subscribers, only: [:create, :destroy] do
           collection do
             post :verify
+            post :request_unsubscribe
           end
         end
 

data/lib/spree/api/dependencies.rb

@@ -172,6 +172,7 @@ module Spree
         admin_state_serializer: 'Spree::Api::V3::Admin::StateSerializer',
         admin_discount_serializer: 'Spree::Api::V3::Admin::DiscountSerializer',
         admin_customer_serializer: 'Spree::Api::V3::Admin::CustomerSerializer',
+        admin_newsletter_subscriber_serializer: 'Spree::Api::V3::Admin::NewsletterSubscriberSerializer',
         admin_order_serializer: 'Spree::Api::V3::Admin::OrderSerializer',
         admin_product_serializer: 'Spree::Api::V3::Admin::ProductSerializer',
         admin_variant_serializer: 'Spree::Api::V3::Admin::VariantSerializer',

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc1
+  version: 5.6.0.rc2
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-15 00:00:00.000000000 Z
+date: 2026-07-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc1
+        version: 5.6.0.rc2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc1
+        version: 5.6.0.rc2
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -248,6 +248,7 @@ files:
 - app/serializers/spree/api/v3/admin/line_item_serializer.rb
 - app/serializers/spree/api/v3/admin/market_serializer.rb
 - app/serializers/spree/api/v3/admin/media_serializer.rb
+- app/serializers/spree/api/v3/admin/newsletter_subscriber_serializer.rb
 - app/serializers/spree/api/v3/admin/option_type_serializer.rb
 - app/serializers/spree/api/v3/admin/option_value_serializer.rb
 - app/serializers/spree/api/v3/admin/order_serializer.rb
@@ -379,9 +380,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc1
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc2
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc1
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc2
 post_install_message:
 rdoc_options: []
 require_paths: