spree_core 5.5.0.rc1 → 5.5.0.rc2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '017291169758b3fc4f9791b940c3264c91df65cd9197621ca0cafd8e3ade2ba1'
-  data.tar.gz: a4f6cfd15c25ce054ce792d545eaf6db7e815b023d66348b4c44d5a226abb3c2
+  metadata.gz: 7d9453fadded9ac66f0b64ac5af7ca30a78516088edafa569cd18bcf0b541e1f
+  data.tar.gz: 72af3c8a53371f288c2084d2eed1e1f6635d0f2273bcb49f40adc626fe96d4c2
 SHA512:
-  metadata.gz: 83d3c2a6c3b13d4c508ab4f4c5c15deb544eb3ba7da48ddd966d872d76ec301f7b87093bc0eb42bd12fe1507575ca09b82919796b079a4aa4e66d71d76dd6332
-  data.tar.gz: 4453580426836b0b3333309c1eaadabf4bca2fa1fbd8cea51ab1fc1b59c9e02409d098f63e7c77e5dcce222746263d53e021ec3f1b724fd2daa71c623ca573d0
+  metadata.gz: 073262b0c991fdbae6c780957052d84ee297abfc6b438b6b1476bc301fc69af8c67ed9904a89e080a14309ac26b86352ad4627f934c0b972c649d520f105c936
+  data.tar.gz: 4c581530147dac6e5b3ea79c655a9c739f40f6ce10b55adcdd5abe46d02073a96268e27a64790cc93c607dfe60cc3aef2c62ded74ad4daa3635135ce21847293

data/app/models/spree/api_key.rb

@@ -12,6 +12,7 @@ module Spree
     SCOPES = %w[
       read_orders write_orders
       read_products write_products
+      read_promotions write_promotions
       read_customers write_customers
       read_payments write_payments
       read_fulfillments write_fulfillments
@@ -20,10 +21,9 @@ module Spree
       read_store_credits write_store_credits
       read_stock write_stock
       read_categories write_categories
-      read_custom_field_definitions write_custom_field_definitions
-      read_exports write_exports
       read_settings write_settings
       read_webhooks write_webhooks
+      read_api_keys write_api_keys
       read_dashboard
       read_all write_all
     ].freeze
@@ -55,8 +55,8 @@ module Spree
     validates :token_digest, presence: true, uniqueness: true, if: :secret?
     validates :token_prefix, presence: true, if: :secret?
     validates :store, presence: true
-    validates :scopes, presence: true, if: :secret?
-    validate :validate_known_scopes, if: :secret?
+    validates :scopes, presence: true, if: -> { secret? && scopes_enforceable? }
+    validate :validate_known_scopes, if: -> { secret? && scopes_enforceable? }
 
     before_validation :generate_token, on: :create
 
@@ -133,6 +133,13 @@ module Spree
 
     private
 
+    # Enforce the scope vocabulary on create and whenever scopes change, but
+    # not on unrelated updates — revoking a key minted under an older
+    # vocabulary (scopes since removed or renamed) must never fail validation.
+    def scopes_enforceable?
+      new_record? || scopes_changed?
+    end
+
     def validate_known_scopes
       invalid = scopes - SCOPES
       errors.add(:scopes, "contains unknown scopes: #{invalid.join(', ')}") if invalid.any?

data/app/models/spree/current.rb

@@ -32,10 +32,10 @@ module Spree
     end
 
     # Returns the current locale.
-    # Fallback: market default locale -> store default locale.
+    # Fallback: market default locale -> store default locale -> I18n default.
     # @return [String] locale code, e.g. +"en"+, +"de"+
     def locale
-      super || market&.default_locale || store&.default_locale
+      super || market&.default_locale.presence || store&.default_locale.presence || I18n.default_locale.to_s
     end
 
     # Returns the current tax zone.

data/app/models/spree/export.rb

@@ -216,6 +216,21 @@ module Spree
         Spree.export_types
       end
 
+      # Admin API scope family gating this export type — an export is a bulk
+      # read, so an API key needs `read_<required_scope>` to create, view, and
+      # download it. Derived from the class name
+      # (Spree::Exports::Customers => :customers); override in subclasses whose
+      # records are gated by a different scope (e.g. coupon codes =>
+      # :promotions). Returns nil on the base class, so unmapped types are
+      # only accessible to `read_all`/`write_all` keys.
+      #
+      # @return [Symbol, nil]
+      def required_scope
+        return nil if self == Spree::Export
+
+        to_s.demodulize.underscore.to_sym
+      end
+
       def available_models
         available_types.map(&:model_class)
       end

data/app/models/spree/exports/coupon_codes.rb

@@ -1,6 +1,10 @@
 module Spree
   module Exports
     class CouponCodes < Spree::Export
+      def self.required_scope
+        :promotions
+      end
+
       def csv_headers
         Spree::CSV::CouponCodePresenter::HEADERS
       end

data/app/models/spree/exports/newsletter_subscribers.rb

@@ -1,6 +1,10 @@
 module Spree
   module Exports
     class NewsletterSubscribers < Spree::Export
+      def self.required_scope
+        :customers
+      end
+
       def scope_includes
         [:user, { metafields: :metafield_definition }]
       end

data/app/models/spree/exports/product_translations.rb

@@ -1,6 +1,10 @@
 module Spree
   module Exports
     class ProductTranslations < Spree::Export
+      def self.required_scope
+        :products
+      end
+
       def scope_includes
         []
       end

data/app/models/spree/order_routing/strategy/rules.rb

@@ -13,7 +13,9 @@ module Spree
           locations = eligible_locations
           return [] if locations.empty?
 
-          ordered = Reducer.new(applicable_rules.to_a, order: order).rank_all(locations)
+          ordered = Spree::OrderRouting::Strategy::Reducer
+            .new(applicable_rules.to_a, order: order)
+            .rank_all(locations)
           return [] if ordered.empty?
 
           packages = build_packages(ordered)

data/config/locales/en.yml

@@ -578,6 +578,7 @@ en:
       invalid_token: Invalid authentication token.
       locked: Your account is locked.
       timeout: Your session expired, please sign in again to continue.
+      too_many_attempts: Too many attempts. Please wait a moment and try again.
       unauthenticated: You need to sign in or sign up before continuing.
       unconfirmed: You have to confirm your account before continuing.
     mailer:

data/db/migrate/20260612000001_change_spree_user_identities_info_to_jsonb.rb

@@ -0,0 +1,13 @@
+class ChangeSpreeUserIdentitiesInfoToJsonb < ActiveRecord::Migration[7.2]
+  def up
+    change_table :spree_user_identities do |t|
+      t.change :info, :jsonb, using: 'info::jsonb' if t.respond_to?(:jsonb)
+    end
+  end
+
+  def down
+    change_table :spree_user_identities do |t|
+      t.change :info, :json, using: 'info::json' if t.respond_to?(:jsonb)
+    end
+  end
+end

data/lib/generators/spree/api_resource/templates/store_serializer.rb.tt

@@ -1,10 +1,13 @@
+<%# Decimal columns serialize as strings on the wire (Alba's oj_rails backend
+    casts BigDecimal via as_json), so they must be typed :string — only
+    integer/float are real JSON numbers. -%>
 <% typelizable = attributes.reject(&:reference?).select { |a| %i[boolean integer decimal float].include?(a.type) } -%>
 module Spree
   module Api
     module V3
       class <%= bare_class_name %>Serializer < BaseSerializer
 <% if typelizable.any? -%>
-        typelize <%= typelizable.map { |a| "#{a.name}: :#{a.type == :boolean ? 'boolean' : 'number'}" }.join(', ') %>
+        typelize <%= typelizable.map { |a| type = a.type == :boolean ? 'boolean' : (a.type == :decimal ? 'string' : 'number'); "#{a.name}: :#{type}" }.join(', ') %>
 
 <% end -%>
         attributes <%= permitted_attribute_names.map { |a| ":#{a}" }.join(', ') %>

data/lib/generators/spree/subscriber/subscriber_generator.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+module Spree
+  # spree:subscriber — scaffold an event subscriber and register it.
+  #
+  #   bin/rails g spree:subscriber OmsOrderSync order.completed order.canceled
+  #   bin/rails g spree:subscriber MyApp::BrandSync brand.created brand.updated
+  #   bin/rails g spree:subscriber CriticalSync order.completed --sync
+  #
+  # Subscribers are not auto-discovered — they must be appended to the
+  # Spree.subscribers array. Forgetting that step produces a silent no-op,
+  # so this generator also maintains the registration in
+  # config/initializers/spree.rb with an idempotent line per subscriber.
+  class SubscriberGenerator < Rails::Generators::NamedBase
+    desc 'Creates a Spree event subscriber and registers it in an initializer'
+
+    # Every Spree app ships config/initializers/spree.rb (created by
+    # spree:install) — registrations go there rather than into a second
+    # initializer file.
+    INITIALIZER_PATH = 'config/initializers/spree.rb'
+    REGISTRATION_ANCHOR = "Rails.application.config.after_initialize do\n"
+
+    argument :events, type: :array, default: [], banner: 'event.name event.name'
+
+    class_option :sync,
+                 type: :boolean,
+                 default: false,
+                 desc: 'Run the subscriber synchronously (async: false) instead of via ActiveJob'
+
+    class_option :skip_spec,
+                 type: :boolean,
+                 default: false,
+                 desc: "Don't generate a spec file"
+
+    def self.source_paths
+      [File.expand_path('templates', __dir__), *superclass.source_paths]
+    end
+
+    def create_subscriber_file
+      template 'subscriber.rb.tt', File.join('app/subscribers', class_path, "#{subscriber_file_name}.rb")
+    end
+
+    def register_subscriber
+      if File.exist?(destination_path(INITIALIZER_PATH))
+        content = File.read(destination_path(INITIALIZER_PATH))
+        if content.include?(registration_line.strip)
+          say_status :identical, "#{INITIALIZER_PATH} (#{subscriber_class_name} already registered)", :blue
+        elsif content.include?(REGISTRATION_ANCHOR)
+          inject_into_file INITIALIZER_PATH, registration_line, after: REGISTRATION_ANCHOR
+        else
+          append_to_file INITIALIZER_PATH, registration_block
+        end
+      else
+        create_file INITIALIZER_PATH, registration_block.lstrip
+      end
+    end
+
+    def create_spec_file
+      return if options[:skip_spec]
+
+      template 'subscriber_spec.rb.tt', File.join('spec/subscribers', class_path, "#{subscriber_file_name}_spec.rb")
+    end
+
+    def warn_about_missing_events
+      return if events.any?
+
+      say_status :note, "no events given — edit `subscribes_to` in the generated subscriber (e.g. 'order.completed')", :yellow
+    end
+
+    private
+
+    # "OmsOrderSync" and "OmsOrderSyncSubscriber" both produce
+    # OmsOrderSyncSubscriber / oms_order_sync_subscriber.
+    def bare_subscriber_name
+      base = class_name.demodulize.sub(/Subscriber\z/, '')
+      "#{base}Subscriber"
+    end
+
+    def subscriber_file_name
+      bare_subscriber_name.underscore
+    end
+
+    def subscriber_class_name
+      (class_path.map { |part| part.camelize } + [bare_subscriber_name]).join('::')
+    end
+
+    def namespace_modules
+      class_path.map(&:camelize)
+    end
+
+    def subscribes_to_arguments
+      listed = events.any? ? events.map { |e| "'#{e}'" } : ["'TODO.replace_with_event_name'"]
+      listed << 'async: false' if options[:sync]
+      listed.join(', ')
+    end
+
+    def registration_line
+      "  Spree.subscribers << #{subscriber_class_name}\n"
+    end
+
+    def registration_block
+      <<~RUBY
+
+        # Event subscribers must be registered explicitly — Spree does not
+        # auto-discover classes in app/subscribers/.
+        Rails.application.config.after_initialize do
+        #{registration_line.chomp}
+        end
+      RUBY
+    end
+
+    def destination_path(relative)
+      File.join(destination_root, relative)
+    end
+  end
+end

data/lib/generators/spree/subscriber/templates/subscriber.rb.tt

@@ -0,0 +1,17 @@
+<% namespace_modules.each_with_index do |mod, i| -%>
+<%= '  ' * i %>module <%= mod %>
+<% end -%>
+<% depth = namespace_modules.size -%>
+<%= '  ' * depth %>class <%= bare_subscriber_name %> < Spree::Subscriber
+<%= '  ' * (depth + 1) %>subscribes_to <%= subscribes_to_arguments %>
+
+<%= '  ' * (depth + 1) %>def handle(event)
+<%= '  ' * (depth + 2) %># Event payloads carry prefixed IDs — look records up with find_by_prefix_id:
+<%= '  ' * (depth + 2) %>#
+<%= '  ' * (depth + 2) %>#   record = Spree::Order.find_by_prefix_id(event.payload['id'])
+<%= '  ' * (depth + 2) %>#   return unless record
+<%= '  ' * (depth + 1) %>end
+<%= '  ' * depth %>end
+<% namespace_modules.each_with_index do |_, i| -%>
+<%= '  ' * (namespace_modules.size - 1 - i) %>end
+<% end -%>

data/lib/generators/spree/subscriber/templates/subscriber_spec.rb.tt

@@ -0,0 +1,9 @@
+require 'rails_helper'
+
+RSpec.describe <%= subscriber_class_name %> do
+  it 'handles <%= events.first || 'the subscribed event' %>' do
+    event = Spree::Event.new(name: <%= (events.first || 'some.event').inspect %>, payload: { 'id' => 'prefixed_id_here' })
+
+    expect { described_class.new.handle(event) }.not_to raise_error
+  end
+end

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.5.0.rc1'.freeze
+  VERSION = '5.5.0.rc2'.freeze
 
   def self.version
     VERSION

data/lib/tasks/cli.rake

@@ -12,8 +12,9 @@ namespace :spree do
     task create_api_key: :environment do
       name = ENV.fetch('NAME')
       key_type = ENV.fetch('KEY_TYPE')
+      scopes = ENV.fetch('SCOPES', '').split(',').map(&:strip).reject(&:empty?)
       store = Spree::Store.default
-      key = store.api_keys.create!(name: name, key_type: key_type)
+      key = store.api_keys.create!(name: name, key_type: key_type, scopes: scopes)
       print key.plaintext_token
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.5.0.rc1
+  version: 5.5.0.rc2
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-10 00:00:00.000000000 Z
+date: 2026-06-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -1565,6 +1565,7 @@ files:
 - db/migrate/20260601000001_create_spree_product_publications.rb
 - db/migrate/20260601000002_add_store_id_to_spree_products.rb
 - db/migrate/20260602000001_add_default_to_spree_channels.rb
+- db/migrate/20260612000001_change_spree_user_identities_info_to_jsonb.rb
 - db/sample_data/channels.rb
 - db/sample_data/customers.csv
 - db/sample_data/markets.rb
@@ -1612,6 +1613,9 @@ files:
 - lib/generators/spree/model/templates/model.rb.tt
 - lib/generators/spree/model_decorator/model_decorator_generator.rb
 - lib/generators/spree/model_decorator/templates/model_decorator.rb.tt
+- lib/generators/spree/subscriber/subscriber_generator.rb
+- lib/generators/spree/subscriber/templates/subscriber.rb.tt
+- lib/generators/spree/subscriber/templates/subscriber_spec.rb.tt
 - lib/mobility/plugins/store_based_fallbacks.rb
 - lib/spree/analytics.rb
 - lib/spree/core.rb
@@ -1812,9 +1816,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.5.0.rc1
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.5.0.rc2
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.5.0.rc1
+  source_code_uri: https://github.com/spree/spree/tree/v5.5.0.rc2
 post_install_message:
 rdoc_options: []
 require_paths: