spree_core 5.6.0.rc1 → 5.6.0.rc2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c8058b9d81b22cf12abe2193023f52faa57b5d757b99e0359e4592415b00a434
-  data.tar.gz: 13d6653cb85ab1364290621d668ed291aecbff9442ce205803595fe316ed4ea7
+  metadata.gz: df2eef5a82cf40bca9b5c518b663153584a72dc1dadf05880a5c2ce344766394
+  data.tar.gz: 48771116e279ccb8c5ed4f83896a60e8063b74cb8785ff51953c9d8446a804f2
 SHA512:
-  metadata.gz: ecbab7dc49344e7c228237344ff01b7addacb6309e0e70cc6a42510823265cfd97827c2a00fb9c990a90b6ace535529b2d60e11c0b45bce745d3185a8422851a
-  data.tar.gz: a2657923c327254ee18b0b222aff4b6b7c3075b26d4c9ff001f66d3b2ad5b35f7daf6d36b5d16161cfaf62613707722ae8dcf55549c2a5c811c3333638240bab
+  metadata.gz: 3a27318377cb47ae53d0405a9a034642119446d4507f03c68966cd550cf41430dcdb0cc3ff7c67f8bf1435b695816c26f92b73e525f2ead42eaf83070c019f40
+  data.tar.gz: 1ac22bf54e39352eede750b630b7e2d6ca6a0d4713c776f0efd20e9cf552f3689b24b154c0694db3ae0edabba37a0bc1c7ad91aa5a0e84cca62aa5cc459d48f7

data/app/models/concerns/spree/user_methods.rb

@@ -59,6 +59,9 @@ module Spree
       before_validation :clone_billing_address, if: :use_billing?
       before_destroy :check_completed_orders
 
+      after_save_commit :sync_newsletter_subscription_with_marketing_consent,
+                        if: :saved_change_to_accepts_email_marketing?
+
       attr_accessor :use_billing
 
       has_person_name
@@ -281,6 +284,14 @@ module Spree
       end
     end
 
+    # @param store [Spree::Store] store to scope the lookup to; defaults to the current store
+    # @return [Spree::NewsletterSubscriber, nil] this user's newsletter subscriber for the given store
+    def newsletter_subscriber(store = Spree::Current.store)
+      return unless store
+
+      Spree::NewsletterSubscriber.for_store(store).find_by(user_id: id)
+    end
+
     private
 
     def check_completed_orders
@@ -308,5 +319,14 @@ module Spree
       self.login = email
       save
     end
+
+    def sync_newsletter_subscription_with_marketing_consent
+      if accepts_email_marketing?
+        Spree::NewsletterSubscriber.subscribe(email: email, user: self)
+      else
+        # Only remove the subscriber for the current store, mirroring the store-scoped subscribe path.
+        newsletter_subscriber&.destroy
+      end
+    end
   end
 end

data/app/models/spree/newsletter_subscriber.rb

@@ -9,6 +9,10 @@ module Spree
 
     has_secure_token :verification_token
 
+    generates_token_for :unsubscribe do
+      email
+    end
+
     #
     # Associations
     #

data/app/models/spree/permission_sets/default_customer.rb

@@ -58,6 +58,9 @@ module Spree
         # Gift card management - users can view their own gift cards
         can :read, Spree::GiftCard, user_id: user.id
 
+        # Newsletter subscription management — customers manage their own newsletter subscribers
+        can [:show, :destroy], Spree::NewsletterSubscriber, user_id: user.id
+
         # Wishlist management
         can :manage, Spree::Wishlist, user_id: user.id
         can :show, Spree::Wishlist do |wishlist|

data/app/models/spree/user_identity.rb

@@ -5,10 +5,10 @@ module Spree
     belongs_to :user, polymorphic: true, optional: false
 
     validates :provider, presence: true
-    validates :uid, presence: true, uniqueness: { scope: [:provider, :user_type] }
+    validates :uid, presence: true, uniqueness: { scope: %i[provider user_type] }
 
     validates :provider, inclusion: {
-      in: ->(_record) {
+      in: lambda { |_record|
         (Spree.store_authentication_strategies.keys + Spree.admin_authentication_strategies.keys).uniq.map(&:to_s)
       }
     }
@@ -27,14 +27,7 @@ module Spree
       identity = find_by(provider: provider, uid: uid, user_type: user_type)
 
       if identity
-        # Update existing identity with fresh tokens
-        identity.update(
-          info: info,
-          access_token: tokens[:access_token],
-          refresh_token: tokens[:refresh_token],
-          expires_at: tokens[:expires_at]
-        )
-        identity.user
+        refresh_identity(identity, info: info, tokens: tokens).user
       else
         # Create new user and identity
         create_user_from_oauth(
@@ -45,28 +38,46 @@ module Spree
           user_class: user_class
         )
       end
+    rescue ActiveRecord::RecordNotUnique
+      refresh_identity(
+        find_by!(provider: provider, uid: uid, user_type: user_type),
+        info: info,
+        tokens: tokens
+      ).user
     end
 
-    def self.create_user_from_oauth(provider:, uid:, info:, tokens: {}, user_class: nil)
-      user_class ||= Spree.user_class
-
-      user = user_class.create!(
-        email: info[:email] || generate_temp_email(provider, uid),
-        password: SecureRandom.hex(32), # Random password for OAuth users
-        first_name: info[:first_name],
-        last_name: info[:last_name]
-      )
-
-      user.identities.create!(
-        provider: provider,
-        uid: uid,
+    def self.refresh_identity(identity, info:, tokens: {})
+      identity.update(
         info: info,
         access_token: tokens[:access_token],
         refresh_token: tokens[:refresh_token],
         expires_at: tokens[:expires_at]
       )
+      identity
+    end
+
+    def self.create_user_from_oauth(provider:, uid:, info:, tokens: {}, user_class: nil)
+      user_class ||= Spree.user_class
+
+      transaction do
+        user = user_class.create!(
+          email: info[:email] || generate_temp_email(provider, uid),
+          password: SecureRandom.hex(32), # Random password for OAuth users
+          first_name: info[:first_name],
+          last_name: info[:last_name]
+        )
 
-      user
+        user.identities.create!(
+          provider: provider,
+          uid: uid,
+          info: info,
+          access_token: tokens[:access_token],
+          refresh_token: tokens[:refresh_token],
+          expires_at: tokens[:expires_at]
+        )
+
+        user
+      end
     end
 
     def self.generate_temp_email(provider, uid)

data/app/services/spree/newsletter/subscribe.rb

@@ -39,6 +39,7 @@ module Spree
           id: subscriber.prefixed_id,
           email: subscriber.email,
           verification_token: subscriber.verification_token,
+          unsubscribe_token: subscriber.generate_token_for(:unsubscribe),
           store_id: current_store.prefixed_id,
           customer_id: subscriber.user&.prefixed_id
         }

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.6.0.rc1'.freeze
+  VERSION = '5.6.0.rc2'.freeze
 
   def self.version
     VERSION

data/lib/spree/core.rb

@@ -180,6 +180,22 @@ module Spree
     ->(locale) { locale.name == Spree::Current.content_locale }
   end
 
+  # Stable anonymous identifier for this Spree installation. Generated once,
+  # persisted in the preferences store and reused afterwards. It identifies the
+  # installation only
+  #
+  # Deliberately not memoized: the persisted preference is the single source
+  # of truth, so processes that race to generate the first value converge on
+  # the winning row at the next read instead of each holding a different id
+  # for their lifetime.
+  #
+  # @return [String] UUID
+  def self.install_id
+    store = Spree::Preferences::Store.instance
+    store.get('spree/install_id') { nil }.presence ||
+      SecureRandom.uuid.tap { |id| store.set('spree/install_id', id) }
+  end
+
   # Used to configure Spree.
   #
   # Example:

data/lib/spree/testing_support/factories/order_factory.rb

@@ -94,7 +94,7 @@ FactoryBot.define do
         factory :completed_order_with_store_credit_payment do
           after(:create) do |order|
             store_credit = create(:store_credit, amount: order.total, store: order.store, user: order.user)
-            payment_method = create(:store_credit_payment_method, stores: [order.store])
+            payment_method = create(:store_credit_payment_method, store: order.store)
 
             create(:store_credit_payment, amount: order.total, order: order, source: store_credit, payment_method: payment_method)
           end

data/lib/spree/testing_support/factories/payment_factory.rb

@@ -5,7 +5,7 @@ FactoryBot.define do
     state         { 'checkout' }
     response_code { "BGS-#{SecureRandom.hex(6)}" }
 
-    payment_method { create(:credit_card_payment_method, stores: [order.store]) }
+    payment_method { create(:credit_card_payment_method, store: order.store) }
     association(:source, factory: :credit_card)
 
     factory :payment_with_refund do
@@ -16,7 +16,7 @@ FactoryBot.define do
     end
 
     factory :custom_payment, class: Spree::Payment do
-      payment_method { create(:custom_payment_method, stores: [order.store]) }
+      payment_method { create(:custom_payment_method, store: order.store) }
       source { create(:payment_source, user: order.user, payment_method: payment_method) }
     end
   end
@@ -29,7 +29,7 @@ FactoryBot.define do
   end
 
   factory :store_credit_payment, class: Spree::Payment, parent: :payment do
-    payment_method { create(:store_credit_payment_method, stores: [order.store]) }
+    payment_method { create(:store_credit_payment_method, store: order.store) }
     source { create(:store_credit, store: order.store, user: order.user) }
   end
 end

data/lib/spree/testing_support/factories/payment_session_factory.rb

@@ -1,7 +1,7 @@
 FactoryBot.define do
   factory :payment_session, class: 'Spree::PaymentSession' do
     order
-    payment_method { create(:credit_card_payment_method, stores: [order.store]) }
+    payment_method { create(:credit_card_payment_method, store: order.store) }
     amount { order.total }
     currency { order.currency }
     status { 'pending' }
@@ -39,7 +39,7 @@ FactoryBot.define do
 
     factory :bogus_payment_session, class: 'Spree::PaymentSessions::Bogus' do
       type { 'Spree::PaymentSessions::Bogus' }
-      payment_method { create(:bogus_payment_method, stores: [order.store]) }
+      payment_method { create(:bogus_payment_method, store: order.store) }
       external_id { "bogus_#{SecureRandom.hex(12)}" }
       external_data { { 'client_secret' => "bogus_secret_#{SecureRandom.hex(8)}" } }
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc1
+  version: 5.6.0.rc2
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-15 00:00:00.000000000 Z
+date: 2026-07-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -1860,9 +1860,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc1
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc2
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc1
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc2
 post_install_message:
 rdoc_options: []
 require_paths: