spree_core 5.6.0.rc4 → 5.6.0.rc6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 81bf3080a8d43c9bc6a6d76561c9fae751c9282a1e8b30dfb388ca6abe2511d7
-  data.tar.gz: 423cf415d52c180297db3e26b581ea4078cfcf0e7816fc3084d12034b3d74a87
+  metadata.gz: 2118af5f16565f54bbb6e6bc66ed0db0bd44e8ad250b226dca1f2ae6dfd50dc9
+  data.tar.gz: 85cf95c960549e5557cb62c51d3b22516ce91d19b2532001c613fe2da036229c
 SHA512:
-  metadata.gz: 351598372ce3b7d938815929ac76d050a45679aad1a4734c07a5642f932b81e0e688e0903538e2446c30516545083d2c6d52963b82598650d6e998606aeb8341
-  data.tar.gz: 258324d4c6e23afbe5702782daf6e19811af60136b4f93bbd99d27824830ee7211426fde12f1330175132b4c82c281cfc6295ca0d7cd6f2cc400cce5e3f7e729
+  metadata.gz: 629b648d7bcc536638305dc942cc5fe8a08ddf9bcba35a7a4e132e84c72f486c106af32711d887b3b67097b35cac9b8664b3f8667630a6d90f56b3e1f815c974
+  data.tar.gz: 1077ccfe23cf6e5c98bd565a559551a344dec7ce20d0e3fe83b06dc9a8be02e74c5107d8edc48d2c0397c24248197d9097fdbb77896ed07b8f7bcd5da9a0d568

data/app/jobs/spree/imports/base_job.rb

@@ -10,6 +10,19 @@ module Spree
     # taxon creation races).
     class BaseJob < Spree::BaseJob
       queue_as Spree.queues.imports
+
+      private
+
+      def with_store_content_locale(store, &block)
+        locale = store&.default_locale
+        return yield if locale.blank?
+
+        previous_content_locale = Spree::Current.content_locale
+        Spree::Current.content_locale = locale
+        I18n.with_locale(locale, &block)
+      ensure
+        Spree::Current.content_locale = previous_content_locale unless locale.blank?
+      end
     end
   end
 end

data/app/jobs/spree/imports/create_categories_job.rb

@@ -9,9 +9,11 @@ module Spree
       def perform(product_id, store_id, taxon_pretty_names)
         product = Spree::Product.find(product_id)
         store = Spree::Store.find(store_id)
-        taxons = taxon_pretty_names.filter_map { |taxon_pretty_name| find_or_create_taxon(store, taxon_pretty_name) }
 
-        product.taxons = taxons
+        with_store_content_locale(store) do
+          taxons = taxon_pretty_names.filter_map { |taxon_pretty_name| find_or_create_taxon(store, taxon_pretty_name) }
+          product.taxons = taxons
+        end
       end
 
       private

data/app/jobs/spree/imports/process_group_job.rb

@@ -25,43 +25,45 @@ module Spree
         import = Spree::Import.find(import_id)
         Spree::Current.store = import.store
 
-        mappings = import.mappings.mapped.to_a
-        schema_fields = import.schema_fields
-        large = import.large_import?
-        grouped = import.group_column.present? && mappings.any? { |m| m.schema_field == import.group_column }
-        started_at = Time.current
-        processed_rows = []
+        with_store_content_locale(import.store) do
+          mappings = import.mappings.mapped.to_a
+          schema_fields = import.schema_fields
+          large = import.large_import?
+          grouped = import.group_column.present? && mappings.any? { |m| m.schema_field == import.group_column }
+          started_at = Time.current
+          processed_rows = []
 
-        row_ids.each_slice(ROWS_BATCH_SIZE) do |ids|
-          # Skip rows already completed on a prior attempt so retries don't double-process them.
-          rows = import.rows.where(id: ids).pending_and_failed.order(:row_number).to_a
-          # Share the already-loaded import across rows: each row's processor reads
-          # `row.import` (store, ability, lookup cache), and without this every row
-          # lazily loads its own Import instance and rebuilds all of that per row.
-          rows.each { |row| row.association(:import).target = import }
+          row_ids.each_slice(ROWS_BATCH_SIZE) do |ids|
+            # Skip rows already completed on a prior attempt so retries don't double-process them.
+            rows = import.rows.where(id: ids).pending_and_failed.order(:row_number).to_a
+            # Share the already-loaded import across rows: each row's processor reads
+            # `row.import` (store, ability, lookup cache), and without this every row
+            # lazily loads its own Import instance and rebuilds all of that per row.
+            rows.each { |row| row.association(:import).target = import }
 
-          if large
-            Spree::Events.disable do
-              rows.each { |row| row.bulk_process!(mappings: mappings, schema_fields: schema_fields) }
-            end
-          elsif grouped
-            # A group is one product plus its variants: per-record lifecycle
-            # events (variant.created, price.created, product.updated per
-            # touch) are noise to subscribers — one product event is published
-            # for the whole group below. import_row.* events still flow.
-            Spree::Events.disable_lifecycle do
-              rows.each { |row| row.process!(mappings: mappings, schema_fields: schema_fields) }
-            end
-          else
-            rows.each do |row|
-              row.process!(mappings: mappings, schema_fields: schema_fields)
+            if large
+              Spree::Events.disable do
+                rows.each { |row| row.bulk_process!(mappings: mappings, schema_fields: schema_fields) }
+              end
+            elsif grouped
+              # A group is one product plus its variants: per-record lifecycle
+              # events (variant.created, price.created, product.updated per
+              # touch) are noise to subscribers — one product event is published
+              # for the whole group below. import_row.* events still flow.
+              Spree::Events.disable_lifecycle do
+                rows.each { |row| row.process!(mappings: mappings, schema_fields: schema_fields) }
+              end
+            else
+              rows.each do |row|
+                row.process!(mappings: mappings, schema_fields: schema_fields)
+              end
             end
+            processed_rows.concat(rows)
           end
-          processed_rows.concat(rows)
-        end
 
-        publish_group_events(processed_rows, started_at) if grouped
-        check_import_completion(import, large)
+          publish_group_events(processed_rows, started_at) if grouped
+          check_import_completion(import, large)
+        end
       end
 
       private

data/app/models/concerns/spree/webhook_payload_redaction.rb

@@ -17,7 +17,7 @@ module Spree
     extend ActiveSupport::Concern
 
     # Payload keys under `data` whose values are live credentials.
-    SENSITIVE_PAYLOAD_KEYS = %w[reset_token unsubscribe_token].freeze
+    SENSITIVE_PAYLOAD_KEYS = %w[reset_token unsubscribe_token verification_token].freeze
 
     REDACTION_PLACEHOLDER = '[REDACTED]'
 

data/app/models/spree/digital_link.rb

@@ -46,9 +46,15 @@ module Spree
 
     # This method should be called when a download is initiated.
     # It returns +true+ or +false+ depending on whether the authorization is granted.
+    #
+    # The access-limit check and the counter increment run inside a row lock so
+    # concurrent requests sharing the same token cannot each pass the cap before
+    # any of them increments the counter (TOCTOU race).
     def authorize!
       ActiveRecord::Base.connected_to(role: :writing) do
-        authorizable? && increment!(:access_counter, touch: true)
+        with_lock do
+          authorizable? && increment!(:access_counter, touch: true)
+        end
       end
     end
 

data/app/models/spree/gift_card_batch.rb

@@ -62,7 +62,7 @@ module Spree
 
     def generate_code
       loop do
-        code = "#{prefix.downcase}#{SecureRandom.hex(3).downcase}"
+        code = "#{prefix.downcase}#{SecureRandom.hex(8).downcase}"
         break code unless Spree::GiftCard.exists?(code: code) || @gift_cards_to_insert.detect { |gc| gc[:code] == code }
       end
     end

data/app/models/spree/order_routing_rule.rb

@@ -29,7 +29,15 @@ module Spree
 
     attribute :active, :boolean, default: true
 
+    # acts_as_list only assigns bottom positions in before_create — too late
+    # for the presence validation below, so API creates without an explicit
+    # position would 422. Default to the end of the channel's list instead.
+    before_validation :set_position_to_end, on: :create, if: -> { position.blank? && channel.present? }
+
     validates :type, :channel, presence: true
+    # One instance of each rule kind per channel — a duplicate signal would
+    # either be a no-op or fight itself in the reducer walk.
+    validates :type, uniqueness: { scope: [:channel_id, *spree_base_uniqueness_scope] }
     validates :position, presence: true, numericality: { only_integer: true }
     validate :channel_belongs_to_store
 
@@ -43,6 +51,25 @@ module Spree
 
     validate :type_must_be_registered
 
+    # @return [String] localized display name for the rule kind, used by admin pickers
+    def self.human_name
+      Spree.t("order_routing_rule_types.#{api_type}.name", default: api_type.titleize)
+    end
+
+    # @return [String] localized description for the rule kind
+    def self.human_description
+      Spree.t("order_routing_rule_types.#{api_type}.description", default: '')
+    end
+
+    # Feeds the `description` field of `subclasses_with_preference_schema`
+    # (the `/types` discovery payload), which only reads `.description`.
+    def self.description
+      human_description
+    end
+
+    def human_name = self.class.human_name
+    def human_description = self.class.human_description
+
     # Subclasses override. Returns an Array<LocationRanking> — one per location,
     # with rank=nil to abstain.
     #
@@ -53,8 +80,24 @@ module Spree
       raise NotImplementedError, "#{self.class} must implement #rank(order, locations)"
     end
 
+    # Routes Spree::PreferenceSchema's subclass discovery
+    # (`subclasses_with_preference_schema`, `find_by_api_type`) to the
+    # order-routing rule registry.
+    module ClassMethods
+      private
+
+      def registered_subclasses
+        Spree.order_routing.rules
+      end
+    end
+    extend ClassMethods
+
     private
 
+    def set_position_to_end
+      self.position = bottom_position_in_list + 1
+    end
+
     # The +type+ presence validation already covers blank; here we only reject
     # a present-but-unregistered STI type so arbitrary class names can't be
     # persisted via the +type+ column.

data/app/models/spree/permission_sets/configuration_management.rb

@@ -45,8 +45,9 @@ module Spree
         can :manage, Spree::ReimbursementType
         can :manage, Spree::ReturnReason
 
-        # Channels
+        # Channels + per-channel order routing rules
         can :manage, Spree::Channel
+        can :manage, Spree::OrderRoutingRule
 
         # Restrictions on immutable types
         cannot [:edit, :update], Spree::RefundReason, mutable: false

data/app/models/spree/product.rb

@@ -24,6 +24,7 @@ module Spree
 
     acts_as_paranoid
     acts_as_taggable_on :tags, :labels
+    acts_as_taggable_tenant :store_id
     normalizes :name, with: ->(value) { value&.to_s&.squish&.presence }
 
     include Spree::ProductScopes

data/config/locales/en.yml

@@ -1190,6 +1190,16 @@ en:
       strategies:
         legacy: Legacy
         rules: Rules (ordered)
+    order_routing_rule_types:
+      default_location:
+        description: Prefer the stock location marked as default
+        name: Default location
+      minimize_splits:
+        description: Prefer the location that can fulfill the most items on its own, avoiding split shipments
+        name: Minimize splits
+      preferred_location:
+        description: Fulfill from the location pinned on the order, when one is set
+        name: Preferred location
     order_summary: Order Summary
     order_total: Order Total
     orders: Orders

data/db/migrate/20260721000001_add_unique_type_index_to_spree_order_routing_rules.rb

@@ -0,0 +1,7 @@
+class AddUniqueTypeIndexToSpreeOrderRoutingRules < ActiveRecord::Migration[7.2]
+  def change
+    add_index :spree_order_routing_rules, [:channel_id, :type],
+              unique: true,
+              name: 'idx_order_routing_rules_channel_type'
+  end
+end

data/db/sample_data/wholesale.rb

@@ -20,7 +20,19 @@ end
 wholesale_group.add_customers([buyer.id])
 
 price_list = store.price_lists.find_or_create_by!(name: 'Wholesale') do |list|
-  list.description = 'Wholesale pricing for approved B2B buyers (40% off retail)'
+  list.description = 'Wholesale pricing for approved B2B buyers (40% off retail) on orders of 10+ per item'
+end
+
+# Case-pack minimum: the trade price applies only when a buyer orders at least
+# WHOLESALE_MIN_QUANTITY of a single item (VolumeRule matches per line item, not
+# per order). Below the threshold the buyer falls back to the retail price — no
+# hard checkout block. This is what makes the demo feel like real wholesale.
+wholesale_min_quantity = 10
+
+unless price_list.price_rules.any? { |rule| rule.is_a?(Spree::PriceRules::VolumeRule) }
+  volume_rule = Spree::PriceRules::VolumeRule.new(price_list: price_list)
+  volume_rule.preferred_min_quantity = wholesale_min_quantity
+  volume_rule.save!
 end
 
 unless price_list.price_rules.any? { |rule| rule.is_a?(Spree::PriceRules::CustomerGroupRule) }
@@ -31,29 +43,29 @@ unless price_list.price_rules.any? { |rule| rule.is_a?(Spree::PriceRules::Custom
   rule.save!
 end
 
-if price_list.prices.none?
-  currency = store.default_currency
-  now = Time.current
-  rows = Spree::Variant.joins(:product)
-                       .where(spree_products: { store_id: store.id })
-                       .joins(:prices)
-                       .where(spree_prices: { currency: currency, price_list_id: nil })
-                       .pluck(:id, Spree::Price.arel_table[:amount])
-                       .to_h # one row per variant — last base price wins
-                       .filter_map do |variant_id, amount|
+# Same paths the admin UI uses: add_products materializes a blank row per
+# variant × supported currency (skipping rows that already exist), then trade
+# prices (40% off that currency's own retail price) fill in wherever a base
+# price exists and the row is still blank. Both steps are idempotent, so
+# re-running sample data converges partial state — new products, newly
+# supported currencies, or a previously interrupted run — without clobbering
+# hand-edited amounts.
+price_list.add_products(store.products.ids)
+
+blank_prices = price_list.prices.where(amount: nil).pluck(:id, :variant_id, :currency)
+if blank_prices.any?
+  base_amounts = Spree::Price.where(price_list_id: nil, variant_id: blank_prices.map { |_, variant_id, _| variant_id }.uniq)
+                             .pluck(:variant_id, :currency, :amount)
+                             .each_with_object({}) { |(variant_id, currency, amount), memo| memo[[variant_id, currency]] = amount }
+
+  rows = blank_prices.filter_map do |id, variant_id, currency|
+    amount = base_amounts[[variant_id, currency]]
     next if amount.blank?
 
-    {
-      variant_id: variant_id,
-      price_list_id: price_list.id,
-      amount: (amount * 0.6).round(2),
-      currency: currency,
-      created_at: now,
-      updated_at: now
-    }
+    { id: id, variant_id: variant_id, currency: currency, amount: (amount * 0.6).round(2) }
   end
 
-  Spree::Price.insert_all(rows) if rows.any?
+  price_list.bulk_update_prices(rows) if rows.any?
 end
 
 price_list.activate if price_list.can_activate?

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.6.0.rc4'.freeze
+  VERSION = '5.6.0.rc6'.freeze
 
   def self.version
     VERSION

data/lib/spree/testing_support/factories/order_routing_rule_factory.rb

@@ -0,0 +1,14 @@
+FactoryBot.define do
+  # STI base can't be persisted (type must be a registered subclass), so the
+  # factory defaults to DefaultLocation. Channels seed all built-in kinds on
+  # create and `type` is unique per channel, so the factory clears the seeded
+  # list — specs get a pristine channel whose only rule is the one built here.
+  # Position defaults to the end of the channel's list via the model callback.
+  factory :order_routing_rule, class: Spree::OrderRouting::Rules::DefaultLocation do
+    channel { association(:channel).tap { |c| c.order_routing_rules.delete_all } }
+    store { channel.store }
+
+    factory :preferred_location_routing_rule, class: Spree::OrderRouting::Rules::PreferredLocation
+    factory :minimize_splits_routing_rule, class: Spree::OrderRouting::Rules::MinimizeSplits
+  end
+end

data/lib/spree/upgrades/5_5_to_5_6/manifest.yml

@@ -57,3 +57,13 @@ steps:
     notes: |
       Recomputes the descendant-inclusive products_count counter cache on every
       taxon in batches.
+
+  - id: product_tag_tenants
+    name: "Backfill tenant on product taggings"
+    task: "spree:upgrade:backfill_product_tag_tenants"
+    notes: |
+      Sets the tenant column on existing Spree::Product taggings from each
+      product's store_id, so product tag autocomplete is bounded to the owning
+      store (matching Spree::Order). New product taggings tenant themselves;
+      only rows created before the upgrade need this. Until it runs, older
+      product tags are hidden from the store-scoped tag vocabulary.

data/lib/tasks/product_tag_tenants.rake

@@ -0,0 +1,26 @@
+namespace :spree do
+  namespace :upgrade do
+    desc <<~DESC
+      Backfills the +tenant+ column on existing +Spree::Product+ taggings from
+      each product's +store_id+, so product tag vocabulary is bounded to the
+      owning store (matching +Spree::Order+, which already tenants its taggings).
+
+      Run once after upgrading to the release that adds
+      +acts_as_taggable_tenant :store_id+ to +Spree::Product+. New product
+      taggings get their tenant automatically; only rows created before the
+      upgrade need this. Idempotent — re-running only touches rows still
+      missing a tenant.
+    DESC
+    task backfill_product_tag_tenants: :environment do
+      taggings = ActsAsTaggableOn::Tagging.arel_table.name
+      products = Spree::Product.table_name
+
+      updated = ActsAsTaggableOn::Tagging.
+                where(taggable_type: 'Spree::Product', tenant: nil).
+                joins("INNER JOIN #{products} ON #{products}.id = #{taggings}.taggable_id").
+                update_all("tenant = #{products}.store_id")
+
+      puts "  Backfilled tenant on #{updated} product tagging(s)."
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc4
+  version: 5.6.0.rc6
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-20 00:00:00.000000000 Z
+date: 2026-07-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -1604,6 +1604,7 @@ files:
 - db/migrate/20260710000001_add_import_id_status_index_to_spree_import_rows.rb
 - db/migrate/20260711000001_add_preferences_to_spree_exports.rb
 - db/migrate/20260719000001_add_channel_id_to_spree_api_keys.rb
+- db/migrate/20260721000001_add_unique_type_index_to_spree_order_routing_rules.rb
 - db/sample_data/channels.rb
 - db/sample_data/customers.csv
 - db/sample_data/markets.rb
@@ -1748,6 +1749,7 @@ files:
 - lib/spree/testing_support/factories/options_factory.rb
 - lib/spree/testing_support/factories/order_factory.rb
 - lib/spree/testing_support/factories/order_promotion_factory.rb
+- lib/spree/testing_support/factories/order_routing_rule_factory.rb
 - lib/spree/testing_support/factories/payment_capture_event_factory.rb
 - lib/spree/testing_support/factories/payment_factory.rb
 - lib/spree/testing_support/factories/payment_method_factory.rb
@@ -1835,6 +1837,7 @@ files:
 - lib/tasks/markets.rake
 - lib/tasks/media.rake
 - lib/tasks/price_history.rake
+- lib/tasks/product_tag_tenants.rake
 - lib/tasks/products.rake
 - lib/tasks/publications.rake
 - lib/tasks/role_users.rake
@@ -1865,9 +1868,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc4
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc6
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc4
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc6
 post_install_message:
 rdoc_options: []
 require_paths: