spree_core 5.6.0.rc2 → 5.6.0.rc4

data/app/services/spree/addresses/update.rb

@@ -7,7 +7,16 @@ module Spree
       attr_accessor :country
 
       def call(address:, address_params:, **opts)
-        order = opts[:order]
+        ApplicationRecord.transaction do
+          perform(address: address, address_params: address_params, **opts)
+        end
+      rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotDestroyed => e
+        failure(e.record)
+      end
+
+      private
+
+      def perform(address:, address_params:, **opts)
         default_billing = address_params.key?(:is_default_billing) ? address_params.delete(:is_default_billing) : opts.fetch(:default_billing, false)
         default_shipping = address_params.key?(:is_default_shipping) ? address_params.delete(:is_default_shipping) : opts.fetch(:default_shipping, false)
         address_changes_except = opts.fetch(:address_changes_except, [])
@@ -35,24 +44,23 @@ module Spree
         return success(address) unless address_changed
 
         if address.editable?
-          if address.update(address_params)
-            if address.user.present?
-              assign_to_user_as_default(
-                user: address.user,
-                address_id: address.id,
-                default_billing: default_billing,
-                default_shipping: default_shipping
-              )
-            end
-
-            order.update(state: 'address') if order.present?
-
-            success(address)
-          else
-            failure(address)
+          address.update!(address_params)
+
+          if address.user.present?
+            assign_to_user_as_default(
+              user: address.user,
+              address_id: address.id,
+              default_billing: default_billing,
+              default_shipping: default_shipping
+            )
           end
+
+          reassign_incomplete_orders(address.id, address)
+
+          success(address)
         elsif new_address(address_params).valid?
-          address.destroy
+          old_address_id = address.id
+          address.destroy!
 
           if new_address.user.present?
             default_billing = address.user_default_billing? || default_billing
@@ -66,12 +74,7 @@ module Spree
             )
           end
 
-          if order.present?
-            order.ship_address = new_address if order.ship_address_id == address.id
-            order.bill_address = new_address if order.bill_address_id == address.id
-            order.state = 'address'
-            order.save
-          end
+          reassign_incomplete_orders(old_address_id, new_address)
 
           success(new_address)
         else
@@ -79,8 +82,6 @@ module Spree
         end
       end
 
-      private
-
       def prepare_address_params!(address, address_params)
         address_params[:user_id] = address&.user_id
         address_params[:country_id] ||= address.country_id
@@ -88,6 +89,12 @@ module Spree
         address_params.transform_values!(&:presence)
       end
 
+      def reassign_incomplete_orders(old_address_id, new_address)
+        orders = Spree::Order.incomplete.where(user_id: new_address.user_id)
+        orders.where(ship_address_id: old_address_id).update_all(ship_address_id: new_address.id, state: 'address', updated_at: Time.current)
+        orders.where(bill_address_id: old_address_id).update_all(bill_address_id: new_address.id, state: 'address', updated_at: Time.current)
+      end
+
       def defaults_changed?(address, default_billing, default_shipping)
         user = address.user
 

data/app/services/spree/sample_data/loader.rb

@@ -39,6 +39,9 @@ module Spree
               puts 'Loading sample customers...'
               load_customers
 
+              puts 'Loading wholesale demo data...'
+              load_ruby_file('wholesale')
+
               puts 'Loading sample orders...'
               load_ruby_file('orders')
 
@@ -76,9 +79,13 @@ module Spree
         Spree::SampleData::ImportRunner.call(csv_path: csv_path, import_class: Spree::Imports::Products)
       end
 
+      # Publishes the catalog to both surfaces: the public default channel and
+      # the gated wholesale channel (catalog parity; wholesale differentiation
+      # comes from the price list in +wholesale.rb+ and the channel's gate).
       def publish_sample_products
         store = Spree::Store.default
         store.default_channel.add_products(store.product_ids)
+        store.channels.find_by(code: Spree::Seeds::Channels::WHOLESALE_CODE)&.add_products(store.product_ids)
       end
 
       def load_categories

data/app/services/spree/seeds/all.rb

@@ -23,11 +23,13 @@ module Spree
 
             # store & stock location
             Stores.call
+            Channels.call
             StockLocations.call
             AdminUser.call
 
             # add store resources
             PaymentMethods.call
+            CustomerGroups.call
             ApiKeys.call
             AllowedOrigins.call
           end

data/app/services/spree/seeds/api_keys.rb

@@ -4,11 +4,15 @@ module Spree
       prepend Spree::ServiceModule::Base
 
       def call
-        store = Spree::Store.default
-        return unless store&.persisted?
+        Spree::Store.find_each do |store|
+          unless store.api_keys.active.publishable.where(channel_id: nil).exists?
+            store.api_keys.create!(name: 'Default', key_type: 'publishable')
+          end
 
-        unless store.api_keys.active.publishable.exists?
-          store.api_keys.create!(name: 'Default', key_type: 'publishable')
+          wholesale = store.channels.find_by(code: Channels::WHOLESALE_CODE)
+          if wholesale && !store.api_keys.active.publishable.where(channel: wholesale).exists?
+            store.api_keys.create!(name: 'Storefront (Wholesale)', key_type: 'publishable', channel: wholesale)
+          end
         end
       end
     end

data/app/services/spree/seeds/channels.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Seeds
+    # Seeds the gated Wholesale channel every store ships with by default —
+    # the reference "blended DTC + B2B" setup: the default channel stays
+    # public while wholesale requires login and forbids guest checkout.
+    # See docs/plans/5.6-store-channel-context-and-key-binding.md.
+    class Channels
+      prepend Spree::ServiceModule::Base
+
+      WHOLESALE_CODE = 'wholesale'.freeze
+
+      def call
+        Spree::Store.find_each do |store|
+          store.ensure_default_channel
+
+          store.channels.find_or_create_by!(code: WHOLESALE_CODE) do |channel|
+            channel.name = 'Wholesale'
+            channel.preferred_storefront_access = 'login_required'
+            channel.preferred_guest_checkout = false
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/spree/seeds/customer_groups.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Seeds
+    # The Wholesale group is the B2B approval primitive until 6.1 Company
+    # accounts land: membership marks an approved wholesale buyer and is what
+    # wholesale price lists key off.
+    class CustomerGroups
+      prepend Spree::ServiceModule::Base
+
+      WHOLESALE_NAME = 'Wholesale'.freeze
+
+      def call
+        Spree::Store.find_each do |store|
+          store.customer_groups.find_or_create_by!(name: WHOLESALE_NAME)
+        end
+      end
+    end
+  end
+end

data/config/locales/en.yml

@@ -691,6 +691,9 @@ en:
     analytics: Analytics
     and: and
     api_key: API Key
+    api_key_channel_immutable: cannot be changed after the key is created; create a new key bound to the channel you need and revoke this one
+    api_key_channel_must_belong_to_store: must belong to the same store as the key
+    api_key_channel_publishable_only: can only be set on publishable keys
     api_key_no_current_key: No API key authenticated this request
     api_key_scopes_immutable: cannot be changed after the key is created; create a new key with the scopes you need and revoke this one
     api_keys: API Keys
@@ -913,6 +916,7 @@ en:
     error_user_does_not_have_any_store_credits: User does not have any Store Credits available
     errors:
       messages:
+        cannot_delete_channel_with_active_api_keys: Channel cannot be deleted while active API keys are bound to it. Revoke those keys first.
         cannot_delete_default_channel: Default channel cannot be deleted. Promote another channel to default first.
         channel_store_mismatch: must belong to the same store
         invalid_order_routing_rule: is not a registered order routing rule

data/db/migrate/20260719000001_add_channel_id_to_spree_api_keys.rb

@@ -0,0 +1,5 @@
+class AddChannelIdToSpreeApiKeys < ActiveRecord::Migration[7.2]
+  def change
+    add_reference :spree_api_keys, :channel, null: true, if_not_exists: true
+  end
+end

data/db/sample_data/channels.rb

@@ -7,6 +7,17 @@ store.channels.find_or_create_by!(code: 'pos') do |channel|
   channel.name = 'Point of Sale'
 end
 
-store.channels.find_or_create_by!(code: 'wholesale') do |channel|
+# Normally seeded by Spree::Seeds::Channels; created here too so installs
+# seeded before the gated-wholesale seed existed still get the channel, and
+# upgraded with the gated posture when it's missing.
+wholesale = store.channels.find_or_create_by!(code: 'wholesale') do |channel|
   channel.name = 'Wholesale'
+  channel.preferred_storefront_access = 'login_required'
+  channel.preferred_guest_checkout = false
+end
+
+if wholesale.preferred_storefront_access.blank?
+  wholesale.preferred_storefront_access = 'login_required'
+  wholesale.preferred_guest_checkout = false
+  wholesale.save!
 end

data/db/sample_data/wholesale.rb

@@ -0,0 +1,59 @@
+# Wholesale demo setup on top of the gated channel seeded by
+# Spree::Seeds::Channels: an approved demo buyer and a customer-group price
+# list, so a fresh install can walk the whole B2B portal story — sign in as
+# the buyer, see wholesale prices, check out on the wholesale channel.
+store = Spree::Store.default
+
+wholesale_group = store.customer_groups.find_or_create_by!(name: Spree::Seeds::CustomerGroups::WHOLESALE_NAME)
+
+buyer = Spree.user_class.find_by(email: 'wholesale@example.com')
+if buyer.nil?
+  buyer = Spree.user_class.new(
+    email: 'wholesale@example.com',
+    password: 'spree123',
+    password_confirmation: 'spree123',
+    first_name: 'Wanda',
+    last_name: 'Wholesale'
+  )
+  buyer.save!
+end
+wholesale_group.add_customers([buyer.id])
+
+price_list = store.price_lists.find_or_create_by!(name: 'Wholesale') do |list|
+  list.description = 'Wholesale pricing for approved B2B buyers (40% off retail)'
+end
+
+unless price_list.price_rules.any? { |rule| rule.is_a?(Spree::PriceRules::CustomerGroupRule) }
+  # price_list must be assigned before the preference — the customer-group-id
+  # normalizer resolves groups through rule.store (delegated to price_list).
+  rule = Spree::PriceRules::CustomerGroupRule.new(price_list: price_list)
+  rule.preferred_customer_group_ids = [wholesale_group.id]
+  rule.save!
+end
+
+if price_list.prices.none?
+  currency = store.default_currency
+  now = Time.current
+  rows = Spree::Variant.joins(:product)
+                       .where(spree_products: { store_id: store.id })
+                       .joins(:prices)
+                       .where(spree_prices: { currency: currency, price_list_id: nil })
+                       .pluck(:id, Spree::Price.arel_table[:amount])
+                       .to_h # one row per variant — last base price wins
+                       .filter_map do |variant_id, amount|
+    next if amount.blank?
+
+    {
+      variant_id: variant_id,
+      price_list_id: price_list.id,
+      amount: (amount * 0.6).round(2),
+      currency: currency,
+      created_at: now,
+      updated_at: now
+    }
+  end
+
+  Spree::Price.insert_all(rows) if rows.any?
+end
+
+price_list.activate if price_list.can_activate?

data/lib/generators/spree/dummy/templates/rails/database.yml

@@ -75,6 +75,7 @@ development:
 test:
   adapter: sqlite3
   database: db/spree_test<%%= ENV['TEST_ENV_NUMBER'] %>.sqlite3
+  timeout: 10000
 production:
   adapter: sqlite3
   database: db/spree_production.sqlite3

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.6.0.rc2'.freeze
+  VERSION = '5.6.0.rc4'.freeze
 
   def self.version
     VERSION

data/lib/spree/events.rb

@@ -187,7 +187,7 @@ module Spree
       #
       # @return [Boolean]
       def enabled?
-        !@globally_disabled && !Thread.current[:spree_events_disabled]
+        !@globally_disabled && !RequestStore.store[:spree_events_disabled]
       end
 
       # Temporarily disable events within a block
@@ -202,11 +202,35 @@ module Spree
       #   end
       #
       def disable
-        previous = Thread.current[:spree_events_disabled]
-        Thread.current[:spree_events_disabled] = true
+        previous = RequestStore.store[:spree_events_disabled]
+        RequestStore.store[:spree_events_disabled] = true
         yield
       ensure
-        Thread.current[:spree_events_disabled] = previous
+        RequestStore.store[:spree_events_disabled] = previous
+      end
+
+      # Check if automatic lifecycle events (*.created/updated/deleted) are enabled
+      #
+      # @return [Boolean]
+      def lifecycle_enabled?
+        enabled? && !RequestStore.store[:spree_lifecycle_events_disabled]
+      end
+
+      # Temporarily disable automatic lifecycle events within a block
+      #
+      # Unlike {disable}, explicitly published events (`publish_event`) still
+      # flow — only the per-record *.created/updated/deleted callbacks are
+      # suppressed. Used by bulk operations that emit their own coarser events
+      # afterwards (e.g. one product event per imported group).
+      #
+      # @yield Block during which lifecycle events are disabled
+      # @return [Object] Return value of the block
+      def disable_lifecycle
+        previous = RequestStore.store[:spree_lifecycle_events_disabled]
+        RequestStore.store[:spree_lifecycle_events_disabled] = true
+        yield
+      ensure
+        RequestStore.store[:spree_lifecycle_events_disabled] = previous
       end
 
       # Globally disable events
@@ -233,13 +257,13 @@ module Spree
       #
       def enable
         previous_global = @globally_disabled
-        previous_thread = Thread.current[:spree_events_disabled]
+        previous_thread = RequestStore.store[:spree_events_disabled]
         @globally_disabled = false
-        Thread.current[:spree_events_disabled] = false
+        RequestStore.store[:spree_events_disabled] = false
         yield
       ensure
         @globally_disabled = previous_global
-        Thread.current[:spree_events_disabled] = previous_thread
+        RequestStore.store[:spree_events_disabled] = previous_thread
       end
 
       # Globally enable events

data/lib/spree/permitted_attributes.rb

@@ -91,7 +91,7 @@ module Spree
 
     @@allowed_origin_attributes = [:origin]
 
-    @@api_key_attributes = [:name, :key_type, { scopes: [] }]
+    @@api_key_attributes = [:name, :key_type, :channel_id, { scopes: [] }]
 
     @@asset_attributes = [:type, :viewable_id, :viewable_type, :attachment, :alt, :position, :url, :signed_id]
 

data/lib/spree/testing_support/lifecycle_events.rb

@@ -21,6 +21,18 @@ shared_examples_for 'lifecycle events' do |factory: nil, event_prefix: nil|
         expect(record).to receive(:publish_event).with("#{lifecycle_event_prefix}.updated")
         allow(record).to receive(:publish_event).with(anything)
 
+        # update_attribute, not update!: Spree::Shipment#update! shadows the
+        # Active Record method with the legacy state-recalculation API.
+        Timecop.travel(1.minute.from_now) do
+          record.update_attribute(:updated_at, Time.current)
+        end
+      end
+
+      it 'does not publish updated event on a bare touch' do
+        record = create(lifecycle_factory)
+        expect(record).not_to receive(:publish_event).with("#{lifecycle_event_prefix}.updated")
+        allow(record).to receive(:publish_event).with(anything)
+
         record.touch
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc2
+  version: 5.6.0.rc4
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-17 00:00:00.000000000 Z
+date: 2026-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -849,6 +849,7 @@ files:
 - app/helpers/spree/locale_helper.rb
 - app/helpers/spree/localized_names_helper.rb
 - app/helpers/spree/products_helper.rb
+- app/helpers/spree/rich_text_helper.rb
 - app/helpers/spree/shipment_helper.rb
 - app/javascript/spree/core/controllers/address_autocomplete_controller.js
 - app/javascript/spree/core/controllers/address_form_controller.js
@@ -935,6 +936,7 @@ files:
 - app/models/concerns/spree/user_reporting.rb
 - app/models/concerns/spree/user_roles.rb
 - app/models/concerns/spree/vat_price_calculation.rb
+- app/models/concerns/spree/webhook_payload_redaction.rb
 - app/models/spree/ability.rb
 - app/models/spree/address.rb
 - app/models/spree/adjustable/adjuster/base.rb
@@ -1342,14 +1344,15 @@ files:
 - app/services/spree/prices/bulk_upsert.rb
 - app/services/spree/products/auto_match_taxons.rb
 - app/services/spree/products/duplicator.rb
-- app/services/spree/products/prepare_nested_attributes.rb
 - app/services/spree/sample_data/import_runner.rb
 - app/services/spree/sample_data/loader.rb
 - app/services/spree/seeds/admin_user.rb
 - app/services/spree/seeds/all.rb
 - app/services/spree/seeds/allowed_origins.rb
 - app/services/spree/seeds/api_keys.rb
+- app/services/spree/seeds/channels.rb
 - app/services/spree/seeds/countries.rb
+- app/services/spree/seeds/customer_groups.rb
 - app/services/spree/seeds/default_reimbursement_types.rb
 - app/services/spree/seeds/digital_delivery.rb
 - app/services/spree/seeds/payment_methods.rb
@@ -1600,6 +1603,7 @@ files:
 - db/migrate/20260707000001_add_fingerprint_to_spree_credit_cards.rb
 - db/migrate/20260710000001_add_import_id_status_index_to_spree_import_rows.rb
 - db/migrate/20260711000001_add_preferences_to_spree_exports.rb
+- db/migrate/20260719000001_add_channel_id_to_spree_api_keys.rb
 - db/sample_data/channels.rb
 - db/sample_data/customers.csv
 - db/sample_data/markets.rb
@@ -1611,6 +1615,7 @@ files:
 - db/sample_data/products.csv
 - db/sample_data/promotions.rb
 - db/sample_data/shipping_methods.rb
+- db/sample_data/wholesale.rb
 - db/seeds.rb
 - lib/friendly_id/history_decorator.rb
 - lib/friendly_id/paranoia.rb
@@ -1860,9 +1865,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc2
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc4
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc2
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc4
 post_install_message:
 rdoc_options: []
 require_paths: