spree_api 5.6.0.rc3 → 5.6.0.rc4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1029d16c5aff295ae773e0c605d1c2003157c4efcfdc5ac5f4ef6edf073b0d68
-  data.tar.gz: 8778b2415f90f19df1f7631ff6df0f4f2508ec8ba7d4116f81f76fecf81dae49
+  metadata.gz: ca50a0fac8c0d346157c3d42a2969414d5f4e8a392aae87176cb02069c828e21
+  data.tar.gz: dc56eff71e891ef304710a9a2f2bfc7c72be17a50d0a24ba1335b137ea817057
 SHA512:
-  metadata.gz: d7f0f2b4eabc6fc302f18b8cdd76d3213360ba927f3a1f5690253e7443baf4778464c1a3c395f1fa29827f1a2acdb66849e6738bc1af7e6fd0f9a910bcf09ecd
-  data.tar.gz: 8db65610da6e5ff6bc2dd736050c19d6c9624f64e48ba56b85d0c6bcc935f3ba1a00ff2080643b35cda5c7d05e0c83f3510c75c09926e483ae4b15c93bdc39a5
+  metadata.gz: e1097d160a66eac8cee1e1b9169f06781c4105ddb01fce2bf560bcf0c94aeb7e0f947bd36675e17e7b6532af02c47999d242f23fb8359abaa866d3257775afd0
+  data.tar.gz: a48b3317819fd03b05d71b016a7856b5c1a8da5d238080964dd9980b0eef328f2a712aed8a903efffde9a86ee1c902903495aee339d01e4a5e216fae0886ffb7

data/app/controllers/concerns/spree/api/v3/channel_resolution.rb

@@ -6,41 +6,87 @@ module Spree
       # read channel context without threading it through method args.
       #
       # Resolution order:
-      # 1. +X-Spree-Channel+ header value matched against +channels.code+ —
+      # 1. The authenticated publishable key's channel binding
+      #    (+Spree::ApiKey#channel+) — server-assigned, cannot be overridden;
+      #    a +X-Spree-Channel+ header naming a different channel is a 422
+      # 2. +X-Spree-Channel+ header value matched against +channels.code+ —
       #    or, if it looks like a prefixed ID (+ch_…+), against +channels.id+
       #    — scoped to the current store
-      # 2. +current_store.default_channel+
+      # 3. +current_store.default_channel+
       #
       # The concern is a no-op if no channel matches — callers fall back to
       # +Spree::Current.channel+'s store-default behavior.
+      #
+      # IMPORTANT: key-bound resolution requires +authenticate_api_key!+ to run
+      # BEFORE +set_current_channel+ — both Store API branches order their
+      # callbacks accordingly (prepended in Store::BaseController, inherited
+      # ahead of the include in Store::ResourceController).
       module ChannelResolution
         extend ActiveSupport::Concern
 
         CHANNEL_HEADER = 'X-Spree-Channel'.freeze
 
         included do
+          # Prepended: LocaleAndCurrency's set_locale/set_currency callbacks
+          # (registered up in V3::BaseController) consult Spree::Current's
+          # fallback chain, which must derive from the REQUEST's store — not
+          # the Store.default fallback — before they run.
+          prepend_before_action :set_current_store_context
           before_action :set_current_channel
         end
 
         protected
 
         def current_channel
-          @current_channel ||= channel_from_header || Spree::Current.channel
+          @current_channel ||= channel_from_api_key || channel_from_header || Spree::Current.channel
         end
 
         private
 
-        # Only write to Spree::Current when the header resolves a specific
-        # channel. The store-default fallback is handled lazily by
+        # Only write to Spree::Current when the key or header resolves a
+        # specific channel. The store-default fallback is handled lazily by
         # +Spree::Current.channel+ itself, which avoids one query per
-        # header-less API request.
+        # unbound, header-less API request.
+        def set_current_store_context
+          Spree::Current.store = current_store
+        end
+
         def set_current_channel
+          bound = channel_from_api_key
+
+          if bound
+            header = channel_from_header
+            if header && header.id != bound.id
+              render_error(
+                code: ErrorHandler::ERROR_CODES[:channel_mismatch],
+                message: Spree.t('api.errors.channel_mismatch', default: 'The requested channel does not match the channel this API key is bound to'),
+                status: :unprocessable_entity
+              )
+              return
+            end
+
+            unless bound.active?
+              render_error(
+                code: ErrorHandler::ERROR_CODES[:channel_inactive],
+                message: Spree.t('api.errors.channel_inactive', default: 'The channel this API key is bound to is not active'),
+                status: :forbidden
+              )
+              return
+            end
+          end
+
           # Memoize so a later +current_channel+ call (e.g. the storefront gate,
-          # serializer params) reuses this row instead of re-querying the header.
-          @current_channel = channel_from_header
+          # serializer params) reuses this row instead of re-querying.
+          @current_channel = bound || channel_from_header
           Spree::Current.channel = @current_channel if @current_channel
         end
 
+        def channel_from_api_key
+          return nil unless respond_to?(:current_api_key, true)
+
+          current_api_key&.channel
+        end
+
         def channel_from_header
           value = request.headers[CHANNEL_HEADER].presence
           return nil if value.blank?

data/app/controllers/concerns/spree/api/v3/error_handler.rb

@@ -21,6 +21,10 @@ module Spree
           record_not_found: 'record_not_found',
           resource_invalid: 'resource_invalid',
 
+          # Channel errors
+          channel_mismatch: 'channel_mismatch',
+          channel_inactive: 'channel_inactive',
+
           # Cart errors
           cart_not_found: 'cart_not_found',
           cart_cannot_transition: 'cart_cannot_transition',

data/app/controllers/spree/api/v3/admin/api_keys_controller.rb

@@ -87,14 +87,14 @@ module Spree
             end
           end
 
-          # `key_type` and `scopes` are create-only (scope immutability lives on
-          # Spree::ApiKey); update is limited to the human-facing `name`. Stripping
-          # them here keeps them out of mass assignment so a rename returns 200
-          # rather than 422.
+          # `key_type`, `scopes`, and `channel_id` are create-only (immutability
+          # lives on Spree::ApiKey); update is limited to the human-facing `name`.
+          # Stripping them here keeps them out of mass assignment so a rename
+          # returns 200 rather than 422.
           def permitted_params
             return params.permit(:name) if action_name == 'update'
 
-            params.permit(:name, :key_type, scopes: [])
+            params.permit(:name, :key_type, :channel_id, scopes: [])
           end
 
           private

data/app/controllers/spree/api/v3/store/base_controller.rb

@@ -14,8 +14,13 @@ module Spree
           # +allow_guest_storefront_access!+.
           include Spree::Api::V3::StorefrontGating
 
-          # Require publishable API key for all Store API requests
-          before_action :authenticate_api_key!
+          # Require publishable API key for all Store API requests. Prepended so
+          # the key is authenticated BEFORE ChannelResolution's
+          # +set_current_channel+ and the StorefrontGating 401 guard run —
+          # a channel-bound key must resolve its channel ahead of the gate, and
+          # this matches Store::ResourceController, where +authenticate_request!+
+          # is inherited ahead of both concerns.
+          prepend_before_action :authenticate_api_key!
         end
       end
     end

data/app/controllers/spree/api/v3/store/carts_controller.rb

@@ -141,8 +141,13 @@ module Spree
             Spree.api.cart_serializer
           end
 
+          # Channel-scoped: a storefront surface lists only its own channel's
+          # carts — without this, a blended DTC + wholesale storefront leaks
+          # the user's wholesale cart into the DTC surface (and vice versa).
+          # Explicit by-ID lookups (show/update) stay cross-channel so a shared
+          # checkout can load any cart the caller is authorized for.
           def scope
-            current_store.carts.where(user: current_user).order(updated_at: :desc)
+            current_store.carts.where(user: current_user, channel: current_channel).order(updated_at: :desc)
           end
 
           private

data/app/controllers/spree/api/v3/store/channel_controller.rb

@@ -0,0 +1,31 @@
+module Spree
+  module Api
+    module V3
+      module Store
+        # Exposes the channel context the request resolved to (bound key →
+        # X-Spree-Channel header → store default) so a storefront can read its
+        # own identity and access posture. Deliberately a singular resource:
+        # the Store API never enumerates a store's channels — that would leak
+        # the existence of gated surfaces (wholesale, POS) to anyone holding
+        # the publishable key.
+        class ChannelController < Store::BaseController
+          # A gated storefront must be able to read "this channel requires
+          # login" before authentication to render a sign-in wall instead of
+          # an error page.
+          allow_guest_storefront_access!
+
+          # GET /api/v3/store/channel
+          def show
+            render json: serialize_resource(current_channel)
+          end
+
+          protected
+
+          def serializer_class
+            Spree.api.channel_serializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/store/resource_controller.rb

@@ -9,6 +9,18 @@ module Spree
           include Spree::Api::V3::ChannelResolution
           include Spree::Api::V3::StorefrontGating
 
+          # The inherited +set_parent+/+set_resource+ callbacks were registered
+          # before the two concerns above, so they'd run resource lookups ahead
+          # of channel resolution (wrong channel scoping for X-Spree-Channel /
+          # key-bound requests) and ahead of the login gate (guests could probe
+          # resource existence on a gated channel via 404s). Re-register them so
+          # lookups always run inside the resolved channel context, behind the
+          # gate.
+          skip_before_action :set_parent
+          skip_before_action :set_resource
+          before_action :set_parent
+          before_action :set_resource, only: [:show, :update, :destroy]
+
           protected
 
           def authenticate_request!

data/app/jobs/spree/webhook_delivery_job.rb

@@ -13,10 +13,15 @@ module Spree
 
     # Accept optional second argument for backward compatibility with jobs
     # enqueued before this change was deployed.
-    def perform(delivery_id, _deprecated_secret_key = nil)
+    #
+    # `payload_secrets` carries credentials withheld from the persisted payload
+    # so the outgoing request body stays complete. See
+    # {Spree::WebhookPayloadRedaction}.
+    def perform(delivery_id, _deprecated_secret_key = nil, payload_secrets: nil)
       delivery = Spree::WebhookDelivery.find_by(id: delivery_id)
       return if delivery.nil?
 
+      delivery.payload_secrets = payload_secrets
       secret_key = delivery.webhook_endpoint.secret_key
       Spree::Webhooks::DeliverWebhook.call(delivery: delivery, secret_key: secret_key)
     end

data/app/serializers/spree/api/v3/admin/api_key_serializer.rb

@@ -18,12 +18,17 @@ module Spree
                    scopes: [:string, multi: true],
                    revoked_at: [:string, nullable: true],
                    last_used_at: [:string, nullable: true],
-                   created_by_email: [:string, nullable: true]
+                   created_by_email: [:string, nullable: true],
+                   channel_id: [:string, nullable: true]
 
           attributes :name, :key_type, :token_prefix, :scopes,
                      created_at: :iso8601, updated_at: :iso8601,
                      revoked_at: :iso8601, last_used_at: :iso8601
 
+          attribute :channel_id do |key|
+            key.channel&.prefixed_id
+          end
+
           # Returned only on the create response — `plaintext_token` is held in
           # memory on the model after `generate_token` and is never persisted
           # for secret keys, so we serialize it whenever it's available rather

data/app/serializers/spree/api/v3/admin/customer_group_serializer.rb

@@ -5,12 +5,11 @@ module Spree
         # Serializes Spree::CustomerGroup for the admin pickers
         # (e.g. promotion rule, customer-group filters). Surfaces only
         # what the admin UI needs to display + select rows.
-        class CustomerGroupSerializer < V3::BaseSerializer
-          typelize name: :string,
-                   description: 'string | null',
+        class CustomerGroupSerializer < V3::CustomerGroupSerializer
+          typelize description: 'string | null',
                    customers_count: :number
 
-          attributes :name, :description, :customers_count,
+          attributes :description, :customers_count,
                      created_at: :iso8601, updated_at: :iso8601
 
           # Members are paginated separately via `/customers?customer_group_id_in=…`

data/app/serializers/spree/api/v3/admin/webhook_delivery_serializer.rb

@@ -25,10 +25,15 @@ module Spree
 
           attributes :event_name, :event_id, :response_code, :execution_time,
                      :error_type, :request_errors, :response_body, :success,
-                     :payload,
                      created_at: :iso8601, updated_at: :iso8601,
                      delivered_at: :iso8601
 
+          # Redacted again on read: deliveries written before payload redaction
+          # shipped still hold live credentials in the column.
+          attribute :payload do |delivery|
+            Spree::WebhookPayloadRedaction.split(delivery.payload).first
+          end
+
           attribute :webhook_endpoint_id do |delivery|
             delivery.webhook_endpoint&.prefixed_id
           end

data/app/serializers/spree/api/v3/cart_serializer.rb

@@ -5,7 +5,7 @@ module Spree
       # Pre-purchase cart data with checkout progression info
       class CartSerializer < BaseSerializer
         typelize number: :string, current_step: :string, completed_steps: 'string[]', token: :string, email: [:string, nullable: true],
-                 customer_note: [:string, nullable: true], market_id: [:string, nullable: true],
+                 customer_note: [:string, nullable: true], market_id: [:string, nullable: true], channel_id: [:string, nullable: true],
                  currency: :string, locale: [:string, nullable: true], total_quantity: :number,
                  requirements: 'Array<{step: string, field: string, message: string}>',
                  item_total: [:string, nullable: true], display_item_total: [:string, nullable: true],
@@ -34,6 +34,13 @@ module Spree
           order.market&.prefixed_id
         end
 
+        # Which surface this cart belongs to — lets a multi-channel storefront
+        # verify a cookie-persisted cart against its own channel before
+        # adopting it (see the wholesale reference storefront's cart guard).
+        attribute :channel_id do |order|
+          order.channel&.prefixed_id
+        end
+
         attributes :number, :token, :email, :customer_note,
                    :currency, :locale, :total_quantity, :warnings
 

data/app/serializers/spree/api/v3/channel_serializer.rb

@@ -5,9 +5,17 @@ module Spree
         typelize name: :string,
                  code: :string,
                  active: :boolean,
-                 default: :boolean
+                 default: :boolean,
+                 storefront_access: :string,
+                 guest_checkout: :boolean
 
         attributes :name, :code, :active, :default
+
+        # Resolved (channel → store fallback) values — what a client should act
+        # on, as opposed to the raw nullable preferences on the admin serializer.
+        attribute :storefront_access, &:resolved_storefront_access
+
+        attribute :guest_checkout, &:resolved_guest_checkout
       end
     end
   end

data/app/serializers/spree/api/v3/customer_group_serializer.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V3
+      # Minimal customer-group shape for the Store API. Exposed on
+      # `customers/me` so a storefront can branch on membership (e.g. an
+      # approved wholesale buyer) — pricing itself always resolves
+      # server-side.
+      class CustomerGroupSerializer < BaseSerializer
+        typelize name: :string
+
+        attributes :name
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/customer_serializer.rb

@@ -37,6 +37,14 @@ module Spree
           store = params&.dig(:store) || Spree::Current.store
           user.newsletter_subscriber(store)
         end
+
+        # Membership signal for storefront branching (e.g. wholesale approval);
+        # scoped to the request store (params first — Spree::Current.store falls
+        # back to the DEFAULT store, wrong on sibling stores' domains) so other
+        # stores' memberships never leak.
+        many :customer_groups,
+             proc { |groups, params| groups.for_store(params&.dig(:store) || Spree::Current.store) },
+             resource: proc { Spree.api.customer_group_serializer }
       end
     end
   end

data/app/services/spree/webhooks/deliver_webhook.rb

@@ -56,7 +56,7 @@ module Spree
           'X-Spree-Webhook-Timestamp' => webhook_timestamp.to_s,
           'X-Spree-Webhook-Event' => @delivery.event_name
         }
-        body = @delivery.payload.to_json
+        body = payload_json
         http_options = { open_timeout: TIMEOUT, read_timeout: TIMEOUT, verify_mode: ssl_verify_mode }
 
         # SSRF protection is disabled in development so webhooks can reach
@@ -77,10 +77,14 @@ module Spree
       end
 
       def generate_signature
-        payload_json = @delivery.payload.to_json
         OpenSSL::HMAC.hexdigest('SHA256', @secret_key, "#{webhook_timestamp}.#{payload_json}")
       end
 
+      # Memoized so the signature is computed over exactly the bytes sent.
+      def payload_json
+        @payload_json ||= @delivery.deliverable_payload.to_json
+      end
+
       def webhook_timestamp
         @webhook_timestamp ||= Time.current.to_i
       end

data/app/subscribers/spree/webhook_event_subscriber.rb

@@ -56,13 +56,16 @@ module Spree
         )
       end
 
+      # Live credentials go over the wire but never into the delivery log.
+      persisted_payload, secrets = Spree::WebhookPayloadRedaction.split(payload)
+
       delivery = endpoint.webhook_deliveries.create!(
         event_name: event.name,
         event_id: event.id,
-        payload: payload
+        payload: persisted_payload
       )
 
-      Spree::WebhookDeliveryJob.perform_later(delivery.id)
+      Spree::WebhookDeliveryJob.perform_later(delivery.id, payload_secrets: secrets)
     rescue ActiveRecord::RecordNotUnique
       # Race condition: another thread already created this delivery — safe to ignore
     rescue StandardError => e

data/config/locales/en.yml

@@ -10,6 +10,8 @@ en:
       invalid_taxonomy_id: Invalid taxonomy id.
       must_specify_api_key: You must specify an API key.
       errors:
+        channel_inactive: The channel this API key is bound to is not active.
+        channel_mismatch: The requested channel does not match the channel this API key is bound to.
         guest_checkout_not_allowed: You must be signed in to complete checkout.
         storefront_login_required: Authentication required to access this store.
       negative_quantity: quantity is negative

data/config/routes.rb

@@ -20,6 +20,9 @@ Spree::Core::Engine.add_routes do
         resources :currencies, only: [:index]
         resources :locales, only: [:index]
 
+        # Current channel context (never a list — see Store::ChannelController)
+        resource :channel, only: [:show], controller: 'channel'
+
         # Catalog
         resources :products, only: [:index, :show] do
           collection do

data/lib/spree/api/dependencies.rb

@@ -112,6 +112,7 @@ module Spree
         fulfillment_serializer: 'Spree::Api::V3::FulfillmentSerializer',
         address_serializer: 'Spree::Api::V3::AddressSerializer',
         customer_serializer: 'Spree::Api::V3::CustomerSerializer',
+        customer_group_serializer: 'Spree::Api::V3::CustomerGroupSerializer',
         country_serializer: 'Spree::Api::V3::CountrySerializer',
         channel_serializer: 'Spree::Api::V3::ChannelSerializer',
         product_publication_serializer: 'Spree::Api::V3::ProductPublicationSerializer',

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc3
+  version: 5.6.0.rc4
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-19 00:00:00.000000000 Z
+date: 2026-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc3
+        version: 5.6.0.rc4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc3
+        version: 5.6.0.rc4
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -189,6 +189,7 @@ files:
 - app/controllers/spree/api/v3/store/carts/store_credits_controller.rb
 - app/controllers/spree/api/v3/store/carts_controller.rb
 - app/controllers/spree/api/v3/store/categories_controller.rb
+- app/controllers/spree/api/v3/store/channel_controller.rb
 - app/controllers/spree/api/v3/store/countries_controller.rb
 - app/controllers/spree/api/v3/store/currencies_controller.rb
 - app/controllers/spree/api/v3/store/customer/addresses_controller.rb
@@ -291,6 +292,7 @@ files:
 - app/serializers/spree/api/v3/credit_card_serializer.rb
 - app/serializers/spree/api/v3/currency_serializer.rb
 - app/serializers/spree/api/v3/custom_field_serializer.rb
+- app/serializers/spree/api/v3/customer_group_serializer.rb
 - app/serializers/spree/api/v3/customer_return_serializer.rb
 - app/serializers/spree/api/v3/customer_serializer.rb
 - app/serializers/spree/api/v3/delivery_method_serializer.rb
@@ -380,9 +382,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc3
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc4
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc3
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc4
 post_install_message:
 rdoc_options: []
 require_paths: