spree_core 6.0.0.beta1 → 6.0.0.beta2

data/lib/spree/core/configuration.rb

@@ -40,23 +40,23 @@ module Spree
       # case seller invitations fall back to the dashboard origin.
       preference :seller_panel_url, :string, default: nil, env: 'SPREE_SELLER_PANEL_URL'
       preference :allow_checkout_on_gateway_error, :boolean, default: false, deprecated: 'Nothing reads this in Spree 6 — completion checks whether payments cover the total, so a failed gateway call never completes an order'
-      preference :allow_empty_price_amount, :boolean, default: false
+      preference :allow_empty_price_amount, :boolean, default: false, env: 'SPREE_ALLOW_EMPTY_PRICE_AMOUNT'
       preference :alternative_shipping_phone, :boolean, default: false, deprecated: 'Nothing reads this in Spree 6'
-      preference :always_include_confirm_step, :boolean, default: false # Ensures confirmation step is always in checkout_progress bar, but does not force a confirm step if your payment methods do not support it.
-      preference :always_use_translations, :boolean, default: false
+      preference :always_include_confirm_step, :boolean, default: false, deprecated: 'Use the always_include_confirm_step preference in the Spree::Store model'
+      preference :always_use_translations, :boolean, default: false, env: 'SPREE_ALWAYS_USE_TRANSLATIONS'
       preference :auto_capture, :boolean, default: true, deprecated: 'Set it on the store instead' # automatically capture the credit card (as opposed to just authorize and capture later)
       preference :auto_capture_on_dispatch, :boolean, default: false, deprecated: 'Set it on the store instead' # Captures payment on dispatch rather than at checkout.
       preference :company, :boolean, default: false, deprecated: 'Use the company_field_enabled preference in the Spree::Store model' # Request company field for billing and shipping addr
-      preference :credit_to_new_allocation, :boolean, default: false
-      preference :disable_migration_check, :boolean, default: false # when turned on disables the startup warning about missing engine migrations
+      preference :credit_to_new_allocation, :boolean, default: false, env: 'SPREE_CREDIT_TO_NEW_ALLOCATION'
+      preference :disable_migration_check, :boolean, default: false, env: 'SPREE_DISABLE_MIGRATION_CHECK' # when turned on disables the startup warning about missing engine migrations
       preference :disable_sku_validation, :boolean, default: false, deprecated: 'Set it on the store instead' # when turned on disables the built-in SKU uniqueness validation
       preference :disable_store_presence_validation, :boolean, default: false, deprecated: true # when turned off disables Store presence validation for Products and Payment Methods
-      preference :events_log_enabled, :boolean, default: true # Log all Spree events to Rails logger
+      preference :events_log_enabled, :boolean, default: true, env: 'SPREE_EVENTS_LOG_ENABLED' # Log all Spree events to Rails logger
       preference :expedited_exchanges, :boolean, default: false, deprecated: 'Exchanges are their own record in Spree 6 — see Spree::Exchange and the Exchanges::Fulfill workflow'
       preference :expedited_exchanges_days_window, :integer, default: 14, deprecated: 'Exchanges are their own record in Spree 6 — see Spree::Exchange and the Exchanges::Fulfill workflow'
-      preference :geocode_addresses, :boolean, default: true
-      preference :images_save_from_url_job_attempts, :integer, default: 5
-      preference :max_image_download_size, :integer, default: 20_971_520 # 20 MB in bytes
+      preference :geocode_addresses, :boolean, default: true, env: 'SPREE_GEOCODE_ADDRESSES'
+      preference :images_save_from_url_job_attempts, :integer, default: 5, env: 'SPREE_IMAGES_SAVE_FROM_URL_JOB_ATTEMPTS'
+      preference :max_image_download_size, :integer, default: 20_971_520, env: 'SPREE_MAX_IMAGE_DOWNLOAD_SIZE' # 20 MB in bytes
 
       # Preprocessed product image variant sizes at 2x retina resolution.
       # These variants are generated on upload to reduce runtime processing.
@@ -113,12 +113,12 @@ module Spree
       end
 
       # Maximum size of an uploaded product video, in bytes.
-      preference :max_video_upload_size, :integer, default: 524_288_000 # 500 MB
+      preference :max_video_upload_size, :integer, default: 524_288_000, env: 'SPREE_MAX_VIDEO_UPLOAD_SIZE' # 500 MB
 
       # Maximum size of a document a seller uploads for an onboarding
       # requirement, in bytes. Small on purpose: these are certificates and
       # registrations, and an unbounded upload is a way to fill a disk.
-      preference :max_seller_document_upload_size, :integer, default: 20_971_520 # 20 MB
+      preference :max_seller_document_upload_size, :integer, default: 20_971_520, env: 'SPREE_MAX_SELLER_DOCUMENT_UPLOAD_SIZE' # 20 MB
       preference :non_expiring_credit_types, :array, default: [], deprecated: 'Nothing reads this in Spree 6 — store credits no longer carry a category, and expiry lives on Spree::GiftCard'
       preference :products_per_page, :integer, default: 12, deprecated: 'Nothing reads this in Spree 6 — pass per_page to the API instead'
       preference :restock_inventory, :boolean, default: true, deprecated: 'Restocking is decided per line item by Spree::ReturnLineItem#resellable'
@@ -132,9 +132,9 @@ module Spree
       # into failures (what this repo's API test suite runs); 'off' disables.
       preference :store_scope_guard, :string, default: 'log', env: 'SPREE_STORE_SCOPE_GUARD'
       # Tiered cart-expiry reaper (docs/plans/6.0-cart-order-split.md Decision 5)
-      preference :guest_cart_expiry_days, :integer, default: 30
-      preference :customer_cart_expiry_days, :integer, default: 90
-      preference :empty_cart_expiry_hours, :integer, default: 48
+      preference :guest_cart_expiry_days, :integer, default: 30, env: 'SPREE_GUEST_CART_EXPIRY_DAYS'
+      preference :customer_cart_expiry_days, :integer, default: 90, env: 'SPREE_CUSTOMER_CART_EXPIRY_DAYS'
+      preference :empty_cart_expiry_hours, :integer, default: 48, env: 'SPREE_EMPTY_CART_EXPIRY_HOURS'
       preference :show_variant_full_price, :boolean, default: false, deprecated: 'Nothing reads this in Spree 6 — a storefront decides how it renders prices'
       preference :show_products_without_price, :boolean, default: false, deprecated: 'Set it on the store instead'
       preference :tax_using_ship_address, :boolean, default: true, deprecated: 'Set it on the store instead'
@@ -149,33 +149,33 @@ module Spree
       preference :storefront_pages_path, :string, default: 'pages', deprecated: 'Nothing reads this in Spree 6 — storefront routes are owned by the storefront'
 
       # coupon codes
-      preference :coupon_codes_web_limit, :integer, default: 500 # number of coupon codes to be generated in the web process, more than this will be generated in a background job
-      preference :coupon_codes_total_limit, :integer, default: 5000 # the maximum number of coupon codes to be generated
+      preference :coupon_codes_web_limit, :integer, default: 500, env: 'SPREE_COUPON_CODES_WEB_LIMIT' # number of coupon codes to be generated in the web process, more than this will be generated in a background job
+      preference :coupon_codes_total_limit, :integer, default: 5000, env: 'SPREE_COUPON_CODES_TOTAL_LIMIT' # the maximum number of coupon codes to be generated
 
       # password reset
-      preference :admin_password_reset_expires_in, :integer, default: 15 # admin password reset token expiration time in minutes
-      preference :customer_password_reset_expires_in, :integer, default: 15 # password reset token expiration time in minutes
+      preference :admin_password_reset_expires_in, :integer, default: 15, env: 'SPREE_ADMIN_PASSWORD_RESET_EXPIRES_IN' # admin password reset token expiration time in minutes
+      preference :customer_password_reset_expires_in, :integer, default: 15, env: 'SPREE_CUSTOMER_PASSWORD_RESET_EXPIRES_IN' # password reset token expiration time in minutes
 
       # account lockout
-      preference :max_failed_login_attempts, :integer, default: 5 # failed login attempts before an account is locked
-      preference :lockout_duration, :integer, default: 1800 # lockout duration in seconds (30 minutes)
+      preference :max_failed_login_attempts, :integer, default: 5, env: 'SPREE_MAX_FAILED_LOGIN_ATTEMPTS' # failed login attempts before an account is locked
+      preference :lockout_duration, :integer, default: 1800, env: 'SPREE_LOCKOUT_DURATION' # lockout duration in seconds (30 minutes)
 
       # password policy
       # NIST 800-63B recommends a length floor with no composition rules (no forced
       # symbols/digits, which push users toward predictable substitutions).
-      preference :minimum_password_length, :integer, default: 8
+      preference :minimum_password_length, :integer, default: 8, env: 'SPREE_MINIMUM_PASSWORD_LENGTH'
       # bcrypt silently truncates past 72 bytes — without a cap a long passphrase and
       # its 72-byte prefix are the same password. A correctness guard, not policy.
-      preference :maximum_password_length, :integer, default: ActiveModel::SecurePassword::MAX_PASSWORD_LENGTH_ALLOWED
+      preference :maximum_password_length, :integer, default: ActiveModel::SecurePassword::MAX_PASSWORD_LENGTH_ALLOWED, env: 'SPREE_MAXIMUM_PASSWORD_LENGTH'
       # To replace the policy itself, assign Spree.password_validator — a class,
       # not a preference.
 
       # gift cards
-      preference :gift_card_batch_web_limit, :integer, default: 500 # number of gift card codes to be generated in the web process, more than this will be generated in a background job
-      preference :gift_card_batch_limit, :integer, default: 50_000
+      preference :gift_card_batch_web_limit, :integer, default: 500, env: 'SPREE_GIFT_CARD_BATCH_WEB_LIMIT' # number of gift card codes to be generated in the web process, more than this will be generated in a background job
+      preference :gift_card_batch_limit, :integer, default: 50_000, env: 'SPREE_GIFT_CARD_BATCH_LIMIT'
 
       # imports
-      preference :large_import_threshold, :integer, default: 500 # imports with more rows than this skip per-row UI broadcasts and use bulk processing
+      preference :large_import_threshold, :integer, default: 500, env: 'SPREE_LARGE_IMPORT_THRESHOLD' # imports with more rows than this skip per-row UI broadcasts and use bulk processing
 
     end
   end

data/lib/spree/core/engine.rb

@@ -45,6 +45,7 @@ module Spree
                                :reports,
                                :translatable_resources,
                                :taggable_types,
+                               :actor_classes,
                                :custom_fields,
                                :reporting,
                                :analytics_events,
@@ -88,6 +89,12 @@ module Spree
         Spree::Deprecation = ActiveSupport::Deprecation.new('6.0', 'Spree')
       end
 
+      # Runs after initializers so an explicitly assigned preference — which
+      # wins over the environment — is never rejected for a stale env var.
+      config.after_initialize do
+        Spree::Core::Configuration.validate_env!(Spree::Config)
+      end
+
       # I18n's config lives in fiber/thread-local storage that survives across
       # requests on reused server threads, so a request that never assigns its
       # own locale would render in whatever locale the previous request on the
@@ -105,6 +112,13 @@ module Spree
         app.config.spree.subscribers = []
       end
 
+      # Seeded before application initializers so an extension registering an
+      # actor class has something to append to. The defaults are unioned in
+      # after initialization, where Spree.admin_user_class is finally known.
+      initializer 'spree.register.actor_classes', before: :load_config_initializers do |app|
+        app.config.spree.actor_classes = []
+      end
+
       initializer 'spree.register.calculators', before: :after_initialize do |app|
       end
 
@@ -525,6 +539,19 @@ module Spree
           Spree.customer_class.to_s
         ]
 
+        # Models that may be recorded as having performed an action — the
+        # vocabulary an `acted_by` association's `*_type` column is validated
+        # against. Extend in an app initializer to register an App or bot
+        # class, which must include Spree::Actor:
+        #   Rails.application.config.spree.actor_classes << 'MyApp::App'.
+        #
+        # Unioned rather than assigned, so what an initializer registered
+        # above survives.
+        Rails.application.config.spree.actor_classes |= [
+          Spree.admin_user_class.to_s,
+          'Spree::ApiKey'
+        ]
+
         Rails.application.config.spree.custom_fields.types = [
           Spree::CustomFields::ShortText,
           Spree::CustomFields::LongText,

data/lib/spree/core/preferences/runtime_configuration.rb

@@ -1,6 +1,21 @@
 module Spree
   module Preferences
+    # Raised when an environment variable backing a preference holds a value
+    # that does not parse as the declared type.
+    class InvalidEnvironmentValue < StandardError
+      def initialize(variable, value, type, expected = nil)
+        article = type == :integer ? 'an' : 'a'
+        expected ||= "#{article} #{type}"
+        super("#{variable}=#{value.inspect} is not valid for #{article} #{type} setting. Expected #{expected}.")
+      end
+    end
+
     class RuntimeConfiguration
+      # Deliberately not ActiveModel::Type::Boolean: it casts "no", "Off" and
+      # every unrecognised string — a typo included — to true.
+      BOOLEAN_TRUE = %w[true 1 yes on].freeze
+      BOOLEAN_FALSE = %w[false 0 no off].freeze
+
       def initialize
         load_defaults
       end
@@ -71,10 +86,12 @@ module Spree
         # set in an initializer or at runtime always wins over the
         # environment; the env var only fills an unset preference.
         #
+        # @param type [Symbol] declared type, used to coerce the env var
         # @param env [String, nil] environment variable backing this setting
-        def preference(name, _type, default: nil, deprecated: false, env: nil)
+        def preference(name, type, default: nil, deprecated: false, env: nil)
           defaults[name] = default
           deprecations[name] = deprecated
+          types[name] = type
           env_vars[name] = env if env
 
           attr_writer name
@@ -88,7 +105,12 @@ module Spree
               value = instance_variable_get(ivar)
               return value unless value.nil?
 
-              ENV[env].presence || default
+              raw = ENV[env]
+              return default if raw.nil? || raw.empty?
+
+              # Memoized into the ivar so coercion runs once per process, not
+              # once per read — these sit on the request path.
+              instance_variable_set(ivar, self.class.coerce_env(env, raw, type))
             end
           else
             attr_reader name
@@ -103,10 +125,62 @@ module Spree
           @deprecations ||= {}
         end
 
+        # @return [Hash{Symbol => Symbol}] declared type per preference
+        def types
+          @types ||= {}
+        end
+
         # @return [Hash{Symbol => String}] preferences backed by an env var
         def env_vars
           @env_vars ||= {}
         end
+
+        # Reads every env-backed preference so a malformed value fails at boot
+        # rather than on the first request that happens to read it. Reading
+        # also memoizes the coerced value, so this doubles as a warm-up.
+        #
+        # @param instance [RuntimeConfiguration] configuration to validate
+        # @raise [Spree::Preferences::InvalidEnvironmentValue]
+        # @return [void]
+        def validate_env!(instance)
+          env_vars.each_key { |name| instance.public_send(name) }
+          nil
+        end
+
+        # Env vars arrive as strings, so an uncoerced `SPREE_X=false` would be
+        # the truthy String "false". Coercion is strict: a value that does not
+        # parse raises rather than falling back to the default, since a typo'd
+        # setting silently reverting is worse than a failed boot.
+        #
+        # @param variable [String] name of the environment variable
+        # @param value [String] raw value read from the environment
+        # @param type [Symbol] declared preference type
+        # @return [Object] the coerced value
+        def coerce_env(variable, value, type)
+          case type
+          when :boolean then coerce_env_boolean(variable, value)
+          when :integer then coerce_env_number(variable, value, type) { Integer(value, 10) }
+          when :decimal then coerce_env_number(variable, value, type) { BigDecimal(value) }
+          when :array then value.split(',').map(&:strip).reject(&:empty?)
+          else value
+          end
+        end
+
+        private
+
+        def coerce_env_boolean(variable, value)
+          normalized = value.strip.downcase
+          return true if BOOLEAN_TRUE.include?(normalized)
+          return false if BOOLEAN_FALSE.include?(normalized)
+
+          raise InvalidEnvironmentValue.new(variable, value, :boolean, "#{BOOLEAN_TRUE.join(', ')}, #{BOOLEAN_FALSE.join(', ')}")
+        end
+
+        def coerce_env_number(variable, value, type)
+          yield
+        rescue ArgumentError, TypeError
+          raise InvalidEnvironmentValue.new(variable, value, type)
+        end
       end
     end
   end

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '6.0.0.beta1'.freeze
+  VERSION = '6.0.0.beta2'.freeze
 
   def self.version
     VERSION

data/lib/spree/core.rb

@@ -625,6 +625,25 @@ module Spree
     Rails.application.config.spree.taggable_types = value
   end
 
+  # Class-name strings for the models that may be recorded as having performed
+  # an action — what an `acted_by` association's `*_type` column is allowed to
+  # hold. The admin user class and `Spree::ApiKey` ship registered; an
+  # extension adds its own App or bot class in an initializer:
+  #
+  #   Spree.actor_classes << 'MyApp::App'
+  #
+  # A class listed here includes {Spree::Actor}, so a timeline can name it.
+  # See docs/plans/6.0-action-actors.md.
+  #
+  # @return [Array<String>]
+  def self.actor_classes
+    Rails.application.config.spree.actor_classes
+  end
+
+  def self.actor_classes=(value)
+    Rails.application.config.spree.actor_classes = value
+  end
+
 
   # Registry of the Getting Started onboarding tasks shown on the admin
   # dashboard. See {Spree::SetupTasks} for the extension API.
@@ -903,6 +922,14 @@ require 'spree/reporting'
 require 'spree/events'
 require 'spree/store_scope_guard'
 
+# Not autoloaded from app/: the registry keeps registered steps in
+# class-level state, which a reload would discard.
+require 'spree/checkout/step'
+require 'spree/checkout/requirement'
+require 'spree/checkout/registry'
+require 'spree/checkout/default_requirements'
+require 'spree/checkout/requirements'
+
 require 'spree/core/controller_helpers/store'
 
 require 'spree/core/preferences/store'

data/lib/spree/testing_support/factories/user_factory.rb

@@ -18,7 +18,6 @@ FactoryBot.define do
 
   factory :admin_user, class: Spree.admin_user_class do
     email                 { generate(:random_email) }
-    login                 { email }
     password              { 'secret123' }
     password_confirmation { password }
     first_name { FFaker::Name.first_name }

data/lib/tasks/backfill_actor_types.rake

@@ -0,0 +1,35 @@
+namespace :spree do
+  namespace :upgrade do
+    desc <<~DESC
+      Names the admin user class on every "who did this" row written before
+      those associations became polymorphic (Spree 6.0). Rows with an actor id
+      and no actor type could only ever have pointed at an admin user, so the
+      type is filled in and the transitional reader stops being needed.
+
+      Runs over whatever each model declares with `acted_by`, so the 6.1
+      conversion of the remaining associations reuses this task unchanged.
+      Idempotent: a row that already carries a type is skipped.
+    DESC
+    task backfill_actor_types: :environment do
+      actor_type = Spree.admin_user_class.to_s
+      total = 0
+
+      Spree::ActedBy.models.each do |model|
+        model.acted_by_associations.each do |name|
+          count = model.
+                  where.not(:"#{name}_id" => nil).
+                  where(:"#{name}_type" => nil).
+                  in_batches.
+                  sum { |batch| batch.update_all(:"#{name}_type" => actor_type) }
+
+          next if count.zero?
+
+          total += count
+          puts "  #{model.table_name}.#{name}: #{count} row(s) set to #{actor_type}."
+        end
+      end
+
+      puts total.zero? ? '  Nothing to backfill.' : "  Backfilled #{total} actor reference(s)."
+    end
+  end
+end

data/lib/tasks/store_settings.rake

@@ -6,6 +6,7 @@ namespace :spree do
     # intent and is never copied.
     MOVED_SETTINGS = {
       address_requires_phone: { default: false },
+      always_include_confirm_step: { default: false },
       company: { default: false, store_preference: :company_field_enabled },
       default_stock_reservation_ttl_minutes: { default: 10, store_preference: :stock_reservation_ttl_minutes },
       disable_sku_validation: { default: false },

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 6.0.0.beta1
+  version: 6.0.0.beta2
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-15 00:00:00.000000000 Z
+date: 2026-09-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -670,6 +670,7 @@ files:
 - app/jobs/spree/products/refresh_metrics_job.rb
 - app/jobs/spree/products/touch_categories_job.rb
 - app/jobs/spree/products/touch_taxons_job.rb
+- app/jobs/spree/sample_data/load_job.rb
 - app/jobs/spree/search_provider/index_job.rb
 - app/jobs/spree/search_provider/remove_job.rb
 - app/jobs/spree/seller_payouts/sweep_due_job.rb
@@ -693,6 +694,8 @@ files:
 - app/mailers/spree/webhook_mailer.rb
 - app/models/acts_as_taggable_on/tag_decorator.rb
 - app/models/concerns/spree/account_lockout.rb
+- app/models/concerns/spree/acted_by.rb
+- app/models/concerns/spree/actor.rb
 - app/models/concerns/spree/admin_user_methods.rb
 - app/models/concerns/spree/calculated_adjustments.rb
 - app/models/concerns/spree/calculator/currency_amounts.rb
@@ -824,11 +827,6 @@ files:
 - app/models/spree/channel.rb
 - app/models/spree/channel/gating.rb
 - app/models/spree/channel_stock_location.rb
-- app/models/spree/checkout/default_requirements.rb
-- app/models/spree/checkout/registry.rb
-- app/models/spree/checkout/requirement.rb
-- app/models/spree/checkout/requirements.rb
-- app/models/spree/checkout/step.rb
 - app/models/spree/claim.rb
 - app/models/spree/claim_line_item.rb
 - app/models/spree/claim_reason.rb
@@ -1787,6 +1785,7 @@ files:
 - db/migrate/20260912120000_index_reporting_lifetime_and_promotion_columns.rb
 - db/migrate/20260914000001_add_settlement_to_spree_seller_transfers.rb
 - db/migrate/20260914230000_add_store_to_spree_option_types.rb
+- db/migrate/20260916000001_order_operation_actors_polymorphic.rb
 - db/sample_data/channels.rb
 - db/sample_data/collections.rb
 - db/sample_data/custom_field_definitions.rb
@@ -1840,6 +1839,11 @@ files:
 - lib/mobility/plugins/store_based_fallbacks.rb
 - lib/spree/analytics.rb
 - lib/spree/category_permalink_deduplicator.rb
+- lib/spree/checkout/default_requirements.rb
+- lib/spree/checkout/registry.rb
+- lib/spree/checkout/requirement.rb
+- lib/spree/checkout/requirements.rb
+- lib/spree/checkout/step.rb
 - lib/spree/core.rb
 - lib/spree/core/configuration.rb
 - lib/spree/core/controller_helpers/store.rb
@@ -2052,6 +2056,7 @@ files:
 - lib/spree/validators.rb
 - lib/spree/workflow.rb
 - lib/spree_core.rb
+- lib/tasks/backfill_actor_types.rake
 - lib/tasks/backfill_custom_field_definition_stores.rake
 - lib/tasks/backfill_import_export_tenancy.rake
 - lib/tasks/backfill_library_media_placements.rake
@@ -2122,9 +2127,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.0.beta1
+  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.0.beta2
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v6.0.0.beta1
+  source_code_uri: https://github.com/spree/spree/tree/v6.0.0.beta2
 post_install_message:
 rdoc_options: []
 require_paths: