spree_api 5.6.0.rc4 → 5.6.0.rc5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca50a0fac8c0d346157c3d42a2969414d5f4e8a392aae87176cb02069c828e21
-  data.tar.gz: dc56eff71e891ef304710a9a2f2bfc7c72be17a50d0a24ba1335b137ea817057
+  metadata.gz: eee15468ad97bc5af5ed27d4e0ed4f4149c8b325efe81d9ef05d91af84094a27
+  data.tar.gz: c5d97420fb0bf65903f944487e102a57f957babdb7119dc2406307c0d45b2634
 SHA512:
-  metadata.gz: e1097d160a66eac8cee1e1b9169f06781c4105ddb01fce2bf560bcf0c94aeb7e0f947bd36675e17e7b6532af02c47999d242f23fb8359abaa866d3257775afd0
-  data.tar.gz: a48b3317819fd03b05d71b016a7856b5c1a8da5d238080964dd9980b0eef328f2a712aed8a903efffde9a86ee1c902903495aee339d01e4a5e216fae0886ffb7
+  metadata.gz: e7783e8de7f1681b747863d5f9d161e1c5b8d05e1c087b5454332868fa81caaf7900e421fb60dabcca24b1d8ffbb99abf68338b0e85f13d6f456708e8c35e40f
+  data.tar.gz: 30aad9e4cc778ae8d11b1527053cf1f96f4fc75846ee48422152939a050a2506537824c1ffbeafc0b53dd8bd7c9c927ff39f5014ef462b9581c2f66a177d6ee7

data/app/controllers/concerns/spree/api/v3/scoped_authorization.rb

@@ -86,10 +86,15 @@ module Spree
           self.class._scoped_resource
         end
 
-        # Override in controllers with non-REST custom actions (e.g. dashboard
-        # `analytics` should map to a read).
+        # Maps the action to the scope kind. Consults the controller's
+        # `read_actions` (ResourceController's overridable list) when defined,
+        # so declaring a custom read-only action once — e.g. `types` — fixes
+        # both the CanCanCan action mapping and the required scope kind.
+        # Controllers outside the ResourceController hierarchy can still
+        # override `action_kind` directly (e.g. dashboard `analytics`).
         def action_kind
-          READ_ACTIONS.include?(action_name) ? 'read' : 'write'
+          read = respond_to?(:read_actions, true) ? read_actions : READ_ACTIONS
+          read.include?(action_name) ? 'read' : 'write'
         end
 
         # True when authorization derives from the API key's scopes rather

data/app/controllers/spree/api/v3/admin/order_routing_rules_controller.rb

@@ -0,0 +1,65 @@
+module Spree
+  module Api
+    module V3
+      module Admin
+        # CRUD for `Spree::OrderRoutingRule` STI subclasses, nested under the
+        # owning channel. Same shape as PromotionRulesController — the registry
+        # is `Spree.order_routing.rules` and the parent is a Channel.
+        class OrderRoutingRulesController < ResourceController
+          include Spree::Api::V3::Admin::SubclassedResource
+
+          scoped_resource :settings
+
+          subclassed_via -> { Spree.order_routing.rules },
+                         unknown_type_error: 'unknown_order_routing_rule_type'
+
+          def types
+            authorize! :read, model_class
+
+            render json: { data: model_class.subclasses_with_preference_schema }
+          end
+
+          protected
+
+          def model_class
+            Spree::OrderRoutingRule
+          end
+
+          def serializer_class
+            Spree.api.admin_order_routing_rule_serializer
+          end
+
+          def permitted_params
+            params.permit(:type, :active, :position, preferences: {})
+          end
+
+          # `types` is read-only discovery — maps to the read scope + :show ability.
+          def read_actions
+            super + %w[types]
+          end
+
+          def scope
+            super.ordered
+          end
+
+          def set_parent
+            return if action_name == 'types'
+
+            @parent = current_store.channels.accessible_by(current_ability, parent_ability_action)
+                                   .find_by_prefix_id!(params[:channel_id])
+          end
+
+          def parent_association
+            :order_routing_rules
+          end
+
+          private
+
+          def build_subclassed_resource(klass, attrs)
+            klass.new(attrs.merge(channel: @parent, store: @parent.store))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v3/admin/payment_methods_controller.rb

@@ -51,6 +51,11 @@ module Spree
             params.permit(:name, :description, :active, :storefront_visible, :auto_capture, :position, metadata: {}, preferences: {})
           end
 
+          # `types` is read-only discovery — maps to the read scope + :show ability.
+          def read_actions
+            super + %w[types]
+          end
+
           private
 
           # New payment methods are created through the current store.

data/app/controllers/spree/api/v3/admin/promotion_actions_controller.rb

@@ -55,6 +55,11 @@ module Spree
             params.permit(:type, preferences: {})
           end
 
+          # `types`/`calculators` are read-only discovery — read scope + :show ability.
+          def read_actions
+            super + %w[types calculators]
+          end
+
           def set_parent
             return if %w[types calculators].include?(action_name)
 

data/app/controllers/spree/api/v3/admin/promotion_rules_controller.rb

@@ -33,6 +33,11 @@ module Spree
             params.permit(:type, preferences: {})
           end
 
+          # `types` is read-only discovery — maps to the read scope + :show ability.
+          def read_actions
+            super + %w[types]
+          end
+
           def set_parent
             return if action_name == 'types'
 

data/app/controllers/spree/api/v3/admin/store_controller.rb

@@ -42,6 +42,7 @@ module Spree
               :preferred_storefront_access,
               :preferred_storefront_url,
               :preferred_guest_checkout,
+              :preferred_order_routing_strategy,
               :mail_from_address,
               :customer_support_email,
               :new_order_notifications_email,

data/app/serializers/spree/api/v3/admin/order_routing_rule_serializer.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Spree
+  module Api
+    module V3
+      module Admin
+        # Serializes Spree::OrderRoutingRule (and its STI subclasses) for the
+        # per-channel routing-rules editor. Same shape as PromotionRule so the
+        # frontend renders both with the same schema-driven preference form.
+        class OrderRoutingRuleSerializer < BaseSerializer
+          typelize type: :string,
+                   channel_id: :string,
+                   position: :number,
+                   active: :boolean,
+                   preferences: 'Record<string, unknown>',
+                   preference_schema: "Array<{ key: string; type: string; default: unknown }>",
+                   label: :string,
+                   description: :string
+
+          attributes :position, :active
+          attributes created_at: :iso8601, updated_at: :iso8601
+
+          attribute :type do |rule|
+            rule.class.api_type
+          end
+
+          attribute :channel_id do |rule|
+            rule.channel&.prefixed_id
+          end
+
+          attribute :preferences, &:serialized_preferences
+          attribute :preference_schema, &:serialized_preference_schema
+
+          attribute :label, &:human_name
+          attribute :description, &:human_description
+        end
+      end
+    end
+  end
+end

data/app/serializers/spree/api/v3/admin/store_serializer.rb

@@ -21,6 +21,7 @@ module Spree
                    preferred_unit_system: :string,
                    preferred_storefront_access: :string,
                    preferred_guest_checkout: :boolean,
+                   preferred_order_routing_strategy: :string,
                    metadata: 'Record<string, unknown>'
 
           attributes :metadata,
@@ -39,6 +40,7 @@ module Spree
                      :preferred_unit_system,
                      :preferred_storefront_access,
                      :preferred_guest_checkout,
+                     :preferred_order_routing_strategy,
                      created_at: :iso8601, updated_at: :iso8601
 
           attribute :url, &:storefront_url

data/config/routes.rb

@@ -345,8 +345,15 @@ Spree::Core::Engine.add_routes do
             post :add_products
             post :remove_products
           end
+
+          resources :order_routing_rules, only: [:index, :show, :create, :update, :destroy]
         end
 
+        # Subclass discovery for the routing-rules editor, mirroring
+        # `/promotion_rules/types`. Top-level so the SPA can build the
+        # "Add rule" picker without a parent channel.
+        get 'order_routing_rules/types', to: 'order_routing_rules#types'
+
         # Variants (top-level, for search/autocomplete across all products)
         resources :variants, only: [:index, :show], concerns: :custom_fieldable
 

data/lib/spree/api/dependencies.rb

@@ -202,6 +202,7 @@ module Spree
         admin_admin_user_serializer: 'Spree::Api::V3::Admin::AdminUserSerializer',
         admin_address_serializer: 'Spree::Api::V3::Admin::AddressSerializer',
         admin_channel_serializer: 'Spree::Api::V3::Admin::ChannelSerializer',
+        admin_order_routing_rule_serializer: 'Spree::Api::V3::Admin::OrderRoutingRuleSerializer',
         admin_product_publication_serializer: 'Spree::Api::V3::Admin::ProductPublicationSerializer',
         admin_market_serializer: 'Spree::Api::V3::Admin::MarketSerializer',
         admin_shipping_method_serializer: 'Spree::Api::V3::Admin::DeliveryMethodSerializer',

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_api
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc4
+  version: 5.6.0.rc5
 platform: ruby
 authors:
 - Vendo Connect Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-20 00:00:00.000000000 Z
+date: 2026-07-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rswag-specs
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc4
+        version: 5.6.0.rc5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0.rc4
+        version: 5.6.0.rc5
 description: Spree's API
 email:
 - hello@spreecommerce.org
@@ -142,6 +142,7 @@ files:
 - app/controllers/spree/api/v3/admin/me_controller.rb
 - app/controllers/spree/api/v3/admin/media_controller.rb
 - app/controllers/spree/api/v3/admin/option_types_controller.rb
+- app/controllers/spree/api/v3/admin/order_routing_rules_controller.rb
 - app/controllers/spree/api/v3/admin/orders/adjustments_controller.rb
 - app/controllers/spree/api/v3/admin/orders/base_controller.rb
 - app/controllers/spree/api/v3/admin/orders/fulfillments_controller.rb
@@ -252,6 +253,7 @@ files:
 - app/serializers/spree/api/v3/admin/newsletter_subscriber_serializer.rb
 - app/serializers/spree/api/v3/admin/option_type_serializer.rb
 - app/serializers/spree/api/v3/admin/option_value_serializer.rb
+- app/serializers/spree/api/v3/admin/order_routing_rule_serializer.rb
 - app/serializers/spree/api/v3/admin/order_serializer.rb
 - app/serializers/spree/api/v3/admin/payment_method_serializer.rb
 - app/serializers/spree/api/v3/admin/payment_serializer.rb
@@ -382,9 +384,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc4
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc5
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc4
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc5
 post_install_message:
 rdoc_options: []
 require_paths: