spree_core 5.4.3 → 5.5.0.rc1

data/lib/generators/spree/model/model_generator.rb

@@ -2,20 +2,86 @@ require "rails/generators/active_record/model/model_generator"
 
 module Spree
   class ModelGenerator < ActiveRecord::Generators::ModelGenerator
-
     def self.source_paths
-      paths = superclass.source_paths
-      paths << File.expand_path('templates', __dir__)
-      paths.flatten
+      [File.expand_path('templates', __dir__), *superclass.source_paths]
     end
 
-    class_option :parent, type: :string, default: "Spree::Base", desc: "The parent class for the generated model"
+    class_option :parent,
+                 type: :string,
+                 default: 'Spree.base_class',
+                 desc: 'The parent class expression for the generated model'
+
+    class_option :id_prefix,
+                 type: :string,
+                 desc: 'Prefix for prefixed IDs (default: snake_cased class name, e.g. brand)'
+
+    class_option :paranoid,
+                 type: :boolean,
+                 default: false,
+                 desc: 'Enable acts_as_paranoid soft-delete (adds deleted_at column + index)'
+
+    class_option :metafields,
+                 type: :boolean,
+                 default: false,
+                 desc: 'Include Spree::Metafields and Spree::Metadata concerns'
 
-    desc 'Creates a new Spree model'
+    desc 'Creates a new Spree model with prefixed IDs and Spree.base_class parent'
 
-    # Override to prevent module file from being created
     def create_module_file
       return
     end
+
+    no_tasks do
+      def id_prefix
+        options[:id_prefix] || file_name
+      end
+
+      def paranoid?
+        options[:paranoid]
+      end
+
+      def metafields?
+        options[:metafields]
+      end
+
+      def class_path
+        ['spree']
+      end
+
+      def table_name
+        "spree_#{super.delete_prefix('spree_')}"
+      end
+
+      # Resolution: explicit class hint in attribute spec → Spree.user_class
+      # for user-named columns → Spree.admin_user_class for admin-user-named
+      # columns → Spree::<CamelCasedName> default. The Rails attribute parser
+      # splits on `:` so explicit hints can only be unqualified names; users
+      # needing a namespace edit the generated belongs_to.
+      def belongs_to_class_name_expr(attribute)
+        explicit = attribute.attr_options.keys.find { |k| k.to_s.match?(/\A(::)?[A-Z]/) }
+        return "'#{explicit}'" if explicit
+
+        case attribute.name
+        when 'user', 'user_id'
+          '"::#{Spree.user_class}"'
+        when 'admin_user', 'admin_user_id', 'created_by', 'created_by_id',
+             'approver', 'approver_id', 'canceler', 'canceler_id'
+          '"::#{Spree.admin_user_class}"'
+        else
+          "'Spree::#{attribute.name.camelize}'"
+        end
+      end
+
+      def column_default_for(attribute)
+        return nil unless attribute.attr_options.key?(:default)
+
+        value = attribute.attr_options[:default]
+        case value
+        when true, false, nil then value.inspect
+        when Numeric then value.to_s
+        else value.to_s.inspect
+        end
+      end
+    end
   end
 end

data/lib/generators/spree/model/templates/create_table_migration.rb.tt

@@ -0,0 +1,40 @@
+class <%= migration_class_name %> < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
+  def change
+    create_table :<%= table_name %><%= primary_key_type %> do |t|
+<% attributes.reject(&:reference?).reject(&:virtual?).each do |attribute| -%>
+<% if attribute.password_digest? -%>
+      t.string :password_digest, null: false
+<% elsif attribute.token? -%>
+      t.string :<%= attribute.name %>, null: false
+<% else -%>
+<% default_expr = column_default_for(attribute) -%>
+      t.<%= attribute.type %> :<%= attribute.name %>, null: false<%= ", default: #{default_expr}" if default_expr %>
+<% end -%>
+<% end -%>
+<% attributes.select(&:reference?).each do |attribute| -%>
+      t.references :<%= attribute.name %>, null: false, index: true, foreign_key: false<%= ', polymorphic: true' if attribute.polymorphic? %>
+<% end -%>
+<% if paranoid? -%>
+      t.datetime :deleted_at
+
+<% end -%>
+<% if options[:timestamps] -%>
+      t.timestamps
+<% end -%>
+    end
+<% attributes.select(&:token?).each do |attribute| -%>
+    add_index :<%= table_name %>, :<%= attribute.name %>, unique: true,
+              name: 'index_<%= table_name %>_on_<%= attribute.name %>'
+<% end -%>
+<% attributes.select(&:has_uniq_index?).reject(&:token?).each do |attribute| -%>
+    add_index :<%= table_name %>, :<%= attribute.name %>, unique: true,
+              name: 'index_<%= table_name %>_on_<%= attribute.name %>'
+<% end -%>
+<% attributes.select { |a| a.has_index? && !a.has_uniq_index? && !a.reference? && !a.token? }.each do |attribute| -%>
+    add_index :<%= table_name %>, :<%= attribute.name %>
+<% end -%>
+<% if paranoid? -%>
+    add_index :<%= table_name %>, :deleted_at
+<% end -%>
+  end
+end

data/lib/generators/spree/model/templates/model.rb.tt

@@ -1,7 +1,22 @@
 module Spree
-  class <%= class_name.demodulize %> < <%= parent_class_name.classify %>
+  class <%= class_name.demodulize %> < <%= parent_class_name %>
+<% if metafields? -%>
+    include Spree::Metafields
+    include Spree::Metadata
+
+<% end -%>
+<% if paranoid? -%>
+    acts_as_paranoid
+
+<% end -%>
+    has_prefix_id :<%= id_prefix %>
+
 <% attributes.select(&:reference?).each do |attribute| -%>
-    belongs_to :<%= attribute.name %><%= ", polymorphic: true" if attribute.polymorphic? %>
+<% if attribute.polymorphic? -%>
+    belongs_to :<%= attribute.name %>, polymorphic: true
+<% else -%>
+    belongs_to :<%= attribute.name %>, class_name: <%= belongs_to_class_name_expr(attribute) %>
+<% end -%>
 <% end -%>
 <% attributes.select(&:rich_text?).each do |attribute| -%>
     has_rich_text :<%= attribute.name %>
@@ -18,5 +33,16 @@ module Spree
 <% if attributes.any?(&:password_digest?) -%>
     has_secure_password
 <% end -%>
+<% required_attrs = attributes.reject { |a| a.reference? || a.type == :boolean || a.token? || a.attachment? || a.attachments? || a.rich_text? || a.password_digest? } -%>
+<% if required_attrs.any? %>
+<% required_attrs.each do |attr| -%>
+    validates :<%= attr.name %>, presence: true<% if attr.has_uniq_index? %>, uniqueness: { scope: spree_base_uniqueness_scope }<% end %>
+
+<% end -%>
+<% end -%>
+<% ransackable = attributes.reject { |a| a.reference? || a.attachment? || a.attachments? || a.rich_text? || a.token? || a.password_digest? }.map(&:name) -%>
+    self.whitelisted_ransackable_attributes = %w[<%= ransackable.join(' ') %>]
+    self.whitelisted_ransackable_associations = %w[]
+    self.whitelisted_ransackable_scopes = %w[]
   end
 end

data/lib/spree/core/configuration.rb

@@ -25,6 +25,10 @@ module Spree
       # Alphabetized to more easily lookup particular preferences
       preference :address_requires_state, :boolean, default: true, deprecated: true # should state/state_name be required
       preference :address_requires_phone, :boolean, default: false # Determines whether we require phone in address
+      # Origin where the admin SPA is hosted (e.g. `https://admin.shop.com`).
+      # Used by admin mailers; falls back to `http://localhost:5173` in dev
+      # and the store's storefront URL otherwise. Set this in production.
+      preference :admin_url, :string, default: nil
       preference :allow_checkout_on_gateway_error, :boolean, default: false
       preference :allow_empty_price_amount, :boolean, default: false
       preference :allow_guest_checkout, :boolean, default: true, deprecated: true # this is only used in the rails frontend, and is not implemented in API
@@ -88,6 +92,9 @@ module Spree
       preference :require_master_price, :boolean, default: false
       preference :restock_inventory, :boolean, default: true # Determines if a return item is restocked automatically once it has been received
       preference :return_eligibility_number_of_days, :integer, default: 365
+      preference :reserve_stock_on, :string, default: 'checkout' # 'checkout' (default) or 'cart' — landing in 6.0 alongside Cart/Order split
+      preference :stock_reservations_enabled, :boolean, default: true # Hold stock during checkout to prevent overselling
+      preference :default_stock_reservation_ttl_minutes, :integer, default: 10 # Fallback TTL when a Store doesn't override
       preference :send_core_emails, :boolean, default: true, deprecated: true # Default mail headers settings
       preference :shipping_instructions, :boolean, deprecated: true
       preference :show_only_complete_orders_by_default, :boolean, deprecated: true

data/lib/spree/core/controller_helpers/auth.rb

@@ -3,7 +3,6 @@ module Spree
     module ControllerHelpers
       module Auth
         extend ActiveSupport::Concern
-        include Spree::Core::TokenGenerator
 
         included do
           if defined?(helper_method)
@@ -20,17 +19,6 @@ module Spree
           @current_ability ||= Spree.ability_class.new(try_spree_current_user, { store: current_store })
         end
 
-        def current_oauth_token
-          Spree::Deprecation.warn('Spree::Current.oauth_token is deprecated and will be removed in Spree 5.5')
-
-          get_last_access_token = ->(user) { Spree::OauthAccessToken.active_for(user).where(expires_in: nil).last }
-          create_access_token = ->(user) { Spree::OauthAccessToken.create!(resource_owner: user) }
-          user = try_spree_current_user
-          return unless user
-
-          @current_oauth_token ||= get_last_access_token.call(user) || create_access_token.call(user)
-        end
-
         # this will work for devise out of the box
         # for other auth systems you will need to override this method
         def store_location(location = nil)

data/lib/spree/core/controller_helpers/currency.rb

@@ -7,7 +7,6 @@ module Spree
         included do
           if defined?(helper_method)
             helper_method :supported_currencies
-            helper_method :supported_currencies_for_all_stores
             helper_method :current_currency
             helper_method :supported_currency?
             helper_method :currency_param
@@ -38,22 +37,6 @@ module Spree
           @supported_currencies ||= current_store&.supported_currencies_list
         end
 
-        # Returns the list of supported currencies for all stores.
-        # @deprecated This method will be removed in Spree 5.5.
-        # @return [Array<String>] the list of supported currencies, eg. `["USD", "EUR"]`
-        def supported_currencies_for_all_stores
-          Spree::Deprecation.warn(
-            'supported_currencies_for_all_stores is deprecated and will be removed in Spree 5.5.'
-          )
-
-          @supported_currencies_for_all_stores ||= begin
-            (
-              Spree::Store.pluck(:supported_currencies).map { |c| c&.split(',') }.flatten + Spree::Store.pluck(:default_currency)
-            ).
-              compact.uniq.map { |code| ::Money::Currency.find(code.strip) }
-          end
-        end
-
         # Checks if the given currency is supported.
         # @param currency_iso_code [String] the ISO code of the currency, eg. `USD`
         # @return [Boolean] `true` if the currency is supported, `false` otherwise

data/lib/spree/core/controller_helpers/order.rb

@@ -7,7 +7,6 @@ module Spree
         included do
           if defined?(helper_method)
             helper_method :current_order
-            helper_method :simple_current_order
           end
         end
 
@@ -15,24 +14,6 @@ module Spree
           @order_token ||= cookies.signed[:token] || params[:order_token]
         end
 
-        # @deprecated Use `current_order` instead. This method will be removed in Spree 5.5.
-        def simple_current_order
-          Spree::Deprecation.warn(
-            'simple_current_order is deprecated and will be removed in Spree 5.5. Use current_order instead.'
-          )
-
-          return @simple_current_order if @simple_current_order
-
-          @simple_current_order = find_order_by_token_or_user
-
-          if @simple_current_order
-            @simple_current_order.last_ip_address = ip_address
-            return @simple_current_order
-          else
-            @simple_current_order = current_store.orders.new
-          end
-        end
-
         # The current incomplete order from the token for use in cart and during checkout
         def current_order(options = {})
           options[:create_order_if_necessary] ||= false

data/lib/spree/core/dependencies.rb

@@ -44,6 +44,9 @@ module Spree
         # order
         order_approve_service: 'Spree::Orders::Approve',
         order_cancel_service: 'Spree::Orders::Cancel',
+        order_complete_service: 'Spree::Orders::Complete',
+        order_create_service: 'Spree::Orders::Create',
+        order_update_service: 'Spree::Orders::Update',
         order_updater: 'Spree::OrderUpdater',
 
         # shipment
@@ -62,7 +65,7 @@ module Spree
         posts_sorter: nil,
         products_sorter: 'Spree::Products::Sort',
         # paginator
-        collection_paginator: 'Spree::Shared::Paginate',
+        collection_paginator: nil,
 
         # coupons
         # TODO: we should split this service into 2 separate - Add and Remove
@@ -80,7 +83,7 @@ module Spree
         credit_cards_destroy_service: 'Spree::CreditCards::Destroy',
 
         # classifications
-        classification_reposition_service: 'Spree::Classifications::Reposition',
+        classification_reposition_service: nil,
 
         # line items
         line_item_create_service: 'Spree::LineItems::Create',

data/lib/spree/core/engine.rb

@@ -11,6 +11,7 @@ module Spree
                                :payment_methods,
                                :adjusters,
                                :stock_splitters,
+                               :order_routing,
                                :promotions,
                                :pricing,
                                :line_item_comparison_hooks,
@@ -25,6 +26,7 @@ module Spree
                                :page_blocks,
                                :reports,
                                :translatable_resources,
+                               :taggable_types,
                                :metafields,
                                :analytics_events,
                                :analytics_event_handlers,
@@ -35,6 +37,7 @@ module Spree
       SpreeCalculators = Struct.new(:shipping_methods, :tax_rates, :promotion_actions_create_adjustments, :promotion_actions_create_item_adjustments)
       PromoEnvironment = Struct.new(:rules, :actions)
       PricingEnvironment = Struct.new(:rules)
+      OrderRoutingEnvironment = Struct.new(:strategies, :rules)
       SpreeValidators = Struct.new(:addresses)
       MetafieldsEnvironment = Struct.new(:types, :enabled_resources)
       isolate_namespace Spree
@@ -75,6 +78,15 @@ module Spree
       initializer 'spree.register.adjustable_adjusters' do |app|
       end
 
+      # Seed the order routing registries early so engines and apps can append
+      # their own strategies / rule kinds from initializer files. Core's defaults
+      # are concatenated in after_initialize below.
+      initializer 'spree.register.order_routing', before: :load_config_initializers do |app|
+        app.config.spree.order_routing = OrderRoutingEnvironment.new
+        app.config.spree.order_routing.strategies = []
+        app.config.spree.order_routing.rules = []
+      end
+
       initializer 'spree.register.metafields' do |app|
         app.config.spree.metafields = MetafieldsEnvironment.new
         app.config.spree.metafields.types = []
@@ -133,6 +145,23 @@ module Spree
           Spree::Adjustable::Adjuster::Tax
         ]
 
+        # Selectable order routing strategies. The internal Reducer collaborator
+        # is intentionally NOT listed — it is not a Strategy::Base. Plugins add
+        # their own (or remove Legacy) via this array.
+        Rails.application.config.spree.order_routing.strategies.concat [
+          Spree::OrderRouting::Strategy::Rules,
+          Spree::OrderRouting::Strategy::Legacy
+        ]
+
+        # Available order routing rule kinds. STI dispatches at runtime via the
+        # +type+ column; this array is the curated allowlist that drives admin
+        # pickers and the rule +type+ validation. Plugins append their own.
+        Rails.application.config.spree.order_routing.rules.concat [
+          Spree::OrderRouting::Rules::PreferredLocation,
+          Spree::OrderRouting::Rules::MinimizeSplits,
+          Spree::OrderRouting::Rules::DefaultLocation
+        ]
+
         Rails.application.config.spree.calculators.promotion_actions_create_adjustments = [
           Spree::Calculator::FlatPercentItemTotal,
           Spree::Calculator::FlatRate,
@@ -161,12 +190,18 @@ module Spree
           Spree::Promotion::Rules::OptionValue,
         ]
 
+        # Default registry. MarketRule is included so existing installs
+        # don't lose access to saved rule rows in the admin. ZoneRule is
+        # intentionally excluded — Zones are being removed in 6.0 (see
+        # docs/plans/6.0-tax-provider.md) and we don't want to invest
+        # in admin UI for a model on its way out. The class itself
+        # stays so legacy data continues to load; it just doesn't show
+        # up in the "Add rule" picker.
         Rails.application.config.spree.pricing.rules.concat [
-          Spree::PriceRules::ZoneRule,
-          Spree::PriceRules::MarketRule,
           Spree::PriceRules::UserRule,
           Spree::PriceRules::CustomerGroupRule,
-          Spree::PriceRules::VolumeRule
+          Spree::PriceRules::VolumeRule,
+          Spree::PriceRules::MarketRule
         ]
 
         Rails.application.config.spree.promotions.actions = [
@@ -216,6 +251,18 @@ module Spree
           Spree::Policy
         ]
 
+        # Resources that expose tags via `acts_as_taggable_on :tags`. The
+        # Admin API's `/tags` autocomplete endpoint accepts these as
+        # `taggable_type`, and the SPA `<TagCombobox>` targets them by name.
+        # Extend in an app initializer (after :load_config_initializers) to
+        # surface custom taggables — e.g.
+        #   Rails.application.config.spree.taggable_types << 'MyApp::Vendor'.
+        Rails.application.config.spree.taggable_types = [
+          'Spree::Product',
+          'Spree::Order',
+          Spree.user_class.to_s
+        ]
+
         Rails.application.config.spree.metafields.types = [
           Spree::Metafields::ShortText,
           Spree::Metafields::LongText,
@@ -301,12 +348,12 @@ module Spree
         ]
 
         # Pre-load authentication strategy classes to avoid reflection at request time
-        Rails.application.config.spree.store_authentication_strategies = {
+        Rails.application.config.spree.store_authentication_strategies = Spree::Authentication::StrategyRegistry.new(
           email: Spree::Authentication::Strategies::EmailPasswordStrategy
-        }
-        Rails.application.config.spree.admin_authentication_strategies = {
+        )
+        Rails.application.config.spree.admin_authentication_strategies = Spree::Authentication::StrategyRegistry.new(
           email: Spree::Authentication::Strategies::EmailPasswordStrategy
-        }
+        )
       end
 
       initializer 'spree.promo.register.promotions.actions' do |app|

data/lib/spree/core/permission_configuration.rb

@@ -105,6 +105,21 @@ module Spree
       @role_permissions = {}
     end
 
+    # Returns a deep copy of this configuration. Useful for snapshotting
+    # state before a test mutates it; restore with {#replace}.
+    def dup
+      copy = super
+      copy.instance_variable_set(:@role_permissions, @role_permissions.deep_dup)
+      copy
+    end
+
+    # Replaces this configuration's state with a deep copy of `other`'s.
+    # Pair with {#dup} to snapshot/restore around code that mutates the
+    # global Spree.permissions config.
+    def replace(other)
+      @role_permissions = other.instance_variable_get(:@role_permissions).deep_dup
+    end
+
     private
 
     def normalize_role_name(role_name)

data/lib/spree/core/preferences/masking.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Spree
+  module Preferences
+    # Masks `:password`-typed preferences so secrets (API keys, OAuth
+    # tokens, signing secrets, …) never leave the server in plaintext.
+    #
+    # The mask token is a bullet sequence followed by the last 4
+    # characters of the original value — Stripe's "stored, here's the
+    # last 4" pattern.
+    module Masking
+      TOKEN = '••••'
+
+      # @param value [Object] the preference value to mask
+      # @return [String, nil] masked string, or nil if value is blank
+      def self.mask(value)
+        return nil if value.blank?
+
+        "#{TOKEN}#{value.to_s.last(4)}"
+      end
+
+      # @param value [Object] a value previously returned by `mask`
+      # @return [Boolean] true if value carries the mask token
+      def self.masked?(value)
+        value.is_a?(String) && value.start_with?(TOKEN)
+      end
+
+      # Serializes a Preferable's `preferences` hash for the wire,
+      # masking `:password` values. Keys are stringified to match the
+      # wire shape expected by JSON clients — schema entries built by
+      # `compute_preference_schema` cache `:key_string` to avoid a
+      # `to_s` allocation per field per request.
+      #
+      # @param preferable [#preferences, #preference_schema, nil] any object
+      #   that includes `Spree::Preferences::Preferable` and `Spree::PreferenceSchema`
+      # @return [Hash{String => Object}]
+      def self.serialize(preferable)
+        return {} if preferable.nil?
+
+        preferable.preference_schema.each_with_object({}) do |field, hash|
+          value = preferable.preferences[field[:key]]
+          hash[field[:key_string] || field[:key].to_s] = field[:type] == :password ? mask(value) : value
+        end
+      end
+    end
+  end
+end

data/lib/spree/core/preferences/preferable_class_methods.rb

@@ -18,7 +18,13 @@ module Spree::Preferences
       end
 
       define_method preference_setter_method(name) do |value|
-        value = parse_on_set.call(value) if parse_on_set.is_a?(Proc)
+        if parse_on_set.is_a?(Proc)
+          # Procs that accept more than one arg opt into receiving the
+          # owning record so they can scope (e.g. `normalize_id_preference`
+          # rejecting cross-store IDs). `arity.abs > 1` covers both the
+          # `(value, owner)` and `(value, owner = nil)` shapes.
+          value = parse_on_set.arity.abs > 1 ? parse_on_set.call(value, self) : parse_on_set.call(value)
+        end
         value = convert_preference_value(value, type, nullable: nullable)
         preferences[name] = value
 

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.4.3'.freeze
+  VERSION = '5.5.0.rc1'.freeze
 
   def self.version
     VERSION

data/lib/spree/core.rb

@@ -112,7 +112,8 @@ module Spree
       webhooks: :default,
       payment_webhooks: :default,
       api_keys: :default,
-      search: :default
+      search: :default,
+      stock_reservations: :default
     )
   end
 
@@ -241,6 +242,14 @@ module Spree
     Rails.application.config.spree.stock_splitters = value
   end
 
+  def self.order_routing
+    Rails.application.config.spree.order_routing
+  end
+
+  def self.order_routing=(value)
+    Rails.application.config.spree.order_routing = value
+  end
+
   def self.promotions
     Rails.application.config.spree.promotions
   end
@@ -289,6 +298,21 @@ module Spree
     Rails.application.config.spree.taxon_rules = value
   end
 
+  # Class-name strings (`'Spree::Product'`, `'Spree::Order'`,
+  # `Spree.user_class.to_s`, plus any registered by apps) for resources that
+  # expose tags via `acts_as_taggable_on :tags`. Used by the Admin API
+  # `/tags` autocomplete endpoint to validate `taggable_type`. Apps extend
+  # the list in an initializer:
+  #
+  #   Spree.taggable_types << 'MyApp::Vendor'
+  def self.taggable_types
+    Rails.application.config.spree.taggable_types
+  end
+
+  def self.taggable_types=(value)
+    Rails.application.config.spree.taggable_types = value
+  end
+
   def self.reports
     Rails.application.config.spree.reports
   end
@@ -338,6 +362,36 @@ module Spree
     Rails.application.config.spree.pricing = value
   end
 
+  # Registry of authentication strategy classes for the Store API.
+  # @return [Spree::Authentication::StrategyRegistry]
+  # @example Registering a third-party identity provider
+  #   Spree.store_authentication_strategies.add(:auth0, MyApp::Auth::Auth0Strategy)
+  # @example Removing a strategy
+  #   Spree.store_authentication_strategies.remove(:email)
+  def self.store_authentication_strategies
+    Rails.application.config.spree.store_authentication_strategies
+  end
+
+  # @param value [Spree::Authentication::StrategyRegistry] the registry to use for Store API authentication dispatch
+  # @return [Spree::Authentication::StrategyRegistry] the assigned registry
+  def self.store_authentication_strategies=(value)
+    Rails.application.config.spree.store_authentication_strategies = value
+  end
+
+  # Registry of authentication strategy classes for the Admin API.
+  # @return [Spree::Authentication::StrategyRegistry]
+  # @example Registering an SSO strategy for admin users
+  #   Spree.admin_authentication_strategies.add(:okta, MyApp::Auth::OktaStrategy)
+  def self.admin_authentication_strategies
+    Rails.application.config.spree.admin_authentication_strategies
+  end
+
+  # @param value [Spree::Authentication::StrategyRegistry] the registry to use for Admin API authentication dispatch
+  # @return [Spree::Authentication::StrategyRegistry] the assigned registry
+  def self.admin_authentication_strategies=(value)
+    Rails.application.config.spree.admin_authentication_strategies = value
+  end
+
   def self.analytics
     @analytics ||= AnalyticsConfig.new
   end
@@ -425,8 +479,6 @@ module Spree
   end
 
   module Core
-    autoload :TokenGenerator, 'spree/core/token_generator'
-
     class GatewayError < RuntimeError; end
     class DestroyWithOrdersError < StandardError; end
   end
@@ -444,14 +496,12 @@ require 'spree/localized_number'
 require 'spree/money'
 require 'spree/permitted_attributes'
 require 'spree/service_module'
-require 'spree/database_type_utilities'
 require 'spree/analytics'
 require 'spree/events'
 require 'spree/webhooks'
 
 require 'spree/core/partials'
 require 'spree/core/controller_helpers/auth'
-require 'spree/core/controller_helpers/common'
 require 'spree/core/controller_helpers/order'
 require 'spree/core/controller_helpers/store'
 require 'spree/core/controller_helpers/strong_parameters'
@@ -462,6 +512,7 @@ require 'spree/core/controller_helpers/turbo'
 require 'spree/core/preferences/store'
 require 'spree/core/preferences/scoped_store'
 require 'spree/core/preferences/runtime_configuration'
+require 'spree/core/preferences/masking'
 
 require 'spree/core/permission_configuration'
 require 'spree/core/ransack_configuration'