spree_core 6.0.0.beta1 → 6.0.0.beta3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d404e43490b356a04bf850e09a644143d8f399c7f39c147301184fd11c2cfed5
-  data.tar.gz: 2b1a720b211b09a061c26b5bf1761510fdde20bf2d50ee9451fbab4a67939b0c
+  metadata.gz: fb19660bc9b7017b74df8b6b92fc2522cb84ef62a6a015f817484528b7e8c992
+  data.tar.gz: bac9e0d41a47af2e5452406f1c0d1ac268b687ebdf1ade714742aa689e5cae0a
 SHA512:
-  metadata.gz: 62dd3e3663ddf4b540127ae6bd526027adc294004e05f6069bf9041f36f5542c7daead8f747937094ddd73d8e19da153ff6ae214cc0c98ca6d7b80a6a8d2b8e8
-  data.tar.gz: b8c49e3df74336ea44676d186c1b376979541c85610baf04b575f82d80886c2850ab4245d4274eb887535c4081e028631766a1b2fa31788c302116de4aca596e
+  metadata.gz: f0a322ff461f40b5d0a8eb5522fb5f6b45f0a1f7526e9e797f255a0779ddfeabf0db9bfe6629b341d4ed03f71591c76dc3435928cdf28b7d98029c1164c0efe6
+  data.tar.gz: bd3ef61d467f2b481120080350fbf0f7c661e9fe81123c24869978a5177240766454fe248fb35cfc967445fbf049aa2fc483a06884573c13e6c4a33b9fda0b4e

data/app/jobs/spree/payments/handle_webhook_job.rb

@@ -9,6 +9,7 @@ module Spree
 
       def perform(payment_method_id:, action:, payment_session_id:)
         payment_method = Spree::PaymentMethod.find(payment_method_id)
+        Spree::Current.store = payment_method.store
         payment_session = Spree::PaymentSession.find(payment_session_id)
 
         Spree.payments_handle_webhook_workflow.call(

data/app/jobs/spree/sample_data/load_job.rb

@@ -0,0 +1,18 @@
+module Spree
+  module SampleData
+    # Loads the demo catalog, customers and orders in the background. Enqueued
+    # by first-run setup when the merchant ticks "load sample data": the
+    # loader needs an admin to own its imports and downloads product images,
+    # so it can neither run before setup nor inside the setup request.
+    class LoadJob < Spree::BaseJob
+      # @param store_id [String, Integer, nil] the store to load into; the
+      #   default store when omitted
+      def perform(store_id = nil)
+        return Spree::SampleData::Loader.call if store_id.nil?
+
+        store = Spree::Store.find_by(id: store_id)
+        Spree::SampleData::Loader.call(store: store) if store
+      end
+    end
+  end
+end

data/app/jobs/spree/seller_transfers/execute_pending_job.rb

@@ -26,6 +26,7 @@ module Spree
         seller = Spree::Seller.find_by(id: seller_id)
         return if seller.nil? || !seller.payouts_enabled?
 
+        Spree::Current.store = seller.store
         provider = seller.store.payout_provider_instance
 
         # Earnings only — see the scope. A reversal is retryable the same way

data/app/mailers/spree/admin_user_mailer.rb

@@ -34,9 +34,9 @@ module Spree
     end
 
     # The dashboard SPA passes a validated redirect URL; the token is appended as
-    # a query param, falling back to the store URL.
+    # a query param, falling back to the dashboard's own reset page.
     def password_reset_url(token, store, redirect_url)
-      append_token(redirect_url.presence || store.formatted_url, token)
+      append_token(redirect_url.presence || "#{Spree::Stores::DashboardUrl.call(store: store)}/reset-password", token)
     end
   end
 end

data/app/models/concerns/spree/acted_by.rb

@@ -0,0 +1,210 @@
+module Spree
+  # Declares a "who performed this action" association — the canceler of an
+  # order, the receiver of a stock delivery, the opener of a return.
+  #
+  #   class Spree::Order < Spree.base_class
+  #     include Spree::ActedBy
+  #     acted_by :created_by, :approver, :canceler
+  #   end
+  #
+  # Each name becomes an optional polymorphic `belongs_to` whose type column is
+  # validated against `Spree.actor_classes`, so a row can only ever name a
+  # registered actor — an admin user, an API key, or a class an extension
+  # registered. See docs/plans/6.0-action-actors.md.
+  #
+  # Association names, readers and writers are the ones a plain `belongs_to`
+  # would give, so the workflows that assign these (`order.canceler = canceler`)
+  # are untouched by the conversion.
+  module ActedBy
+    extend ActiveSupport::Concern
+
+    # Every model that declares at least one `acted_by` association, so a
+    # caller sweeping actor columns — the backfill task, a user's erasure —
+    # walks all of them without being handed a list.
+    #
+    # The registry fills as models load, so it eager-loads first: in
+    # development nothing is loaded until something references it, and a
+    # caller that silently skipped an unloaded model would leave a deleted
+    # person's id behind or half-finish an upgrade.
+    #
+    # Names are held rather than classes, and resolved on read, so a code
+    # reload does not leave the registry pointing at superseded copies of the
+    # same model.
+    #
+    # @return [Array<Class>]
+    def self.models
+      Rails.application&.eager_load! unless Rails.application&.config&.eager_load
+
+      registered_model_names.filter_map(&:safe_constantize)
+    end
+
+    # @api private
+    # @return [Set<String>]
+    def self.registered_model_names
+      @registered_model_names ||= Set.new
+    end
+
+    included do
+      # The names declared on this class, so the backfill task can ask a model
+      # what it records without being told. Inherited and extended per class,
+      # never assigned, so a subclass adding one does not blank its parent's.
+      class_attribute :acted_by_associations, default: [], instance_writer: false
+    end
+
+    # The class an actor column names, answering what the reader would resolve
+    # rather than what the column literally holds: a row the backfill has not
+    # reached carries an id and no type, and the reader resolves it through
+    # the admin user class. Serializers read this so `<name>_id` and
+    # `<name>_type` never disagree about the same row.
+    #
+    # @param name [Symbol, String] the acted_by association
+    # @return [String, nil]
+    def acted_by_type(name)
+      stored = self[:"#{name}_type"]
+      return stored if stored.present?
+
+      Spree.admin_user_class.to_s if self[:"#{name}_id"].present?
+    end
+
+    # The actor's prefixed id, encoded from the columns without loading the
+    # row — so a page of orders costs no query per actor it names. Paired with
+    # {#acted_by_type} so the id and the kind always describe the same row,
+    # including one the backfill has not reached.
+    #
+    # @param name [Symbol, String] the acted_by association
+    # @return [String, nil]
+    def acted_by_prefixed_id(name)
+      Spree::Base.polymorphic_prefixed_id(acted_by_type(name), self[:"#{name}_id"])
+    end
+
+    # Names the admin user class on every un-backfilled row of `record`'s
+    # lazily-preloaded group, so the association preloads as one query rather
+    # than one per row. Writes the in-memory attribute only; nothing is saved.
+    #
+    # @api private
+    # @param record [ActiveRecord::Base]
+    # @param name [Symbol] the acted_by association
+    # @return [void]
+    def self.assume_admin_actor_type(record, name)
+      type_column = :"#{name}_type"
+      admin_type = Spree.admin_user_class.to_s
+      group = record.try(:lazy_preload_context)&.records.presence || [record]
+
+      group.each do |sibling|
+        next unless sibling.instance_of?(record.class)
+        next if sibling[type_column].present? || sibling[:"#{name}_id"].blank?
+
+        sibling[type_column] = admin_type
+      end
+    end
+
+    # Both halves of an actor column, for a caller writing through
+    # `update_columns` or `update_all` rather than through the association —
+    # an id without its type names nothing, so the pair is produced together
+    # and never by hand.
+    #
+    #   changes.merge!(Spree::ActedBy.columns_for(:canceler, canceler))
+    #
+    # The actor is checked against the registry here because these writes go
+    # through `update_columns` / `update_all`, which skip validation — without
+    # it an unregistered actor persists as a row the model itself calls
+    # invalid.
+    #
+    # @param name [Symbol, String] the acted_by association
+    # @param actor [Object, nil]
+    # @raise [ArgumentError] when the actor's class is not registered
+    # @return [Hash{Symbol => Object, nil}]
+    def self.columns_for(name, actor)
+      type = actor && actor.class.polymorphic_name
+
+      if type.present? && Spree.actor_classes.exclude?(type)
+        raise ArgumentError, "#{type} is not a registered actor class — add it to Spree.actor_classes"
+      end
+
+      { :"#{name}_id" => actor&.id, :"#{name}_type" => type }
+    end
+
+    class_methods do
+      # @param names [Array<Symbol>] the association names to declare
+      # @return [void]
+      def acted_by(*names)
+        names = names.map(&:to_sym)
+        self.acted_by_associations = acted_by_associations + names
+        # An anonymous class — one built in a spec or a console — has no name
+        # to register, and a nil in the registry would break every later read.
+        Spree::ActedBy.registered_model_names << name_for_actor_registry if name_for_actor_registry
+
+        names.each do |name|
+          belongs_to name, polymorphic: true, optional: true
+
+          validate_actor_type(name)
+          define_transitional_actor_reader(name)
+        end
+      end
+
+      private
+
+      # STI subclasses register under the base class, whose table the backfill
+      # updates; an anonymous class registers nothing.
+      def name_for_actor_registry
+        base_class.name
+      end
+
+      def validate_actor_type(name)
+        type_column = :"#{name}_type"
+
+        validate do
+          value = self[type_column]
+          next if value.blank? || Spree.actor_classes.include?(value)
+
+          errors.add(type_column, :unregistered_actor,
+                     message: Spree.t('errors.messages.unregistered_actor'))
+        end
+      end
+
+      # Rows written before the type column existed carry an id and no type,
+      # which a polymorphic association reads as nil. Until the backfill task
+      # has run they resolve through the admin user class, the only thing they
+      # could ever have pointed at.
+      #
+      # The type is filled in on the in-memory attribute and the ordinary
+      # association reader does the rest, so the fallback keeps every benefit
+      # the association has — preloading included. Resolving it with a direct
+      # `find_by` instead would sidestep `ar_lazy_preload`, turning a page of
+      # 25 orders into 75 queries while the backfill is outstanding.
+      #
+      # Nothing is saved: `[]=` writes the attribute, and a record whose only
+      # change is this would still need an explicit save to persist it.
+      # Prepended rather than defined outright, so `super` reaches the
+      # generated reader.
+      #
+      # Removed in 6.1, once the backfill is a release behind.
+      def define_transitional_actor_reader(name)
+        transitional_actor_readers.module_eval do
+          define_method(name) do
+            return super() if self[:"#{name}_type"].present?
+            return super() if self[:"#{name}_id"].blank?
+
+            Spree::Deprecation.warn(
+              "#{self.class.name}##{name} resolved through #{Spree.admin_user_class} because " \
+              "#{name}_type is blank. Run `rake spree:upgrade:backfill_actor_types`; the fallback " \
+              'is removed in Spree 6.1.'
+            )
+
+            # Fill the type across the whole lazily-preloaded group, not just
+            # this record: the preloader batches on the type it finds, and
+            # filling one row at a time as each is read produces a query per
+            # row instead of one for the page.
+            Spree::ActedBy.assume_admin_actor_type(self, name)
+            super()
+          end
+        end
+      end
+
+      # The per-class module the transitional readers live in, prepended once.
+      def transitional_actor_readers
+        @transitional_actor_readers ||= Module.new.tap { |mod| prepend(mod) }
+      end
+    end
+  end
+end

data/app/models/concerns/spree/actor.rb

@@ -0,0 +1,51 @@
+module Spree
+  # What a model must answer to be recorded as the performer of an action.
+  #
+  # Included in the admin user class and in {Spree::ApiKey}; an extension's App
+  # or bot class includes it too and registers itself in
+  # `Spree.actor_classes` (see docs/plans/6.0-action-actors.md).
+  #
+  # Both methods have defaults that read whatever the including class already
+  # offers, so a class that names itself in one of the usual ways needs no
+  # override.
+  module Actor
+    extend ActiveSupport::Concern
+
+    # The kinds core itself registers, for the generated `ActorKind` type.
+    #
+    # A literal list rather than one derived from `Spree.actor_classes`: that
+    # registry is filled after serializer classes load, so deriving it would
+    # make the generated types depend on boot order and on which extensions
+    # are installed. The union stays open on the wire, so an extension's kind
+    # is still a valid value — it just does not autocomplete.
+    BUILT_IN_KINDS = %w[admin_user api_key].freeze
+
+    # How a timeline names this actor: a person's full name or email, an API
+    # key's name, an app's title.
+    #
+    # @return [String, nil]
+    def actor_label
+      %i[full_name name email].each do |method|
+        next unless respond_to?(method)
+
+        value = public_send(method)
+        value = value.to_s if value.present?
+        return value if value.present?
+      end
+
+      nil
+    end
+
+    # The wire shorthand for this actor's kind — `admin_user`, `api_key`, …
+    # The same derivation every polymorphic type column on the Admin API uses.
+    #
+    # Read from `polymorphic_name`, which is what the `*_type` column stores,
+    # so an STI subclass of an actor answers the same kind on the expansion
+    # as it does in the column beside it.
+    #
+    # @return [String]
+    def actor_kind
+      Spree::Base.polymorphic_api_type(self.class.polymorphic_name)
+    end
+  end
+end

data/app/models/concerns/spree/admin_user_methods.rb

@@ -2,6 +2,7 @@ module Spree
   module AdminUserMethods
     extend ActiveSupport::Concern
 
+    include Spree::Actor
     include Spree::PrefixedId
     include Spree::UserRoles
     include Spree::RansackableAttributes
@@ -33,15 +34,20 @@ module Spree
 
       # Associations
       has_many :identities, class_name: 'Spree::UserIdentity', as: :user, dependent: :destroy
-      has_many :canceled_orders, class_name: 'Spree::Order', foreign_key: :canceler_id
-      has_many :created_orders, class_name: 'Spree::Order', foreign_key: :created_by_id
-      has_many :approved_orders, class_name: 'Spree::Order', foreign_key: :approver_id
+      # The order operations became polymorphic in 6.0, so these read through
+      # the association rather than a bare foreign key: matching on the id
+      # alone would hand this user the rows an API key with the same numeric
+      # id performed. The rest still point at admin users only and convert in
+      # 6.1 (see docs/plans/6.0-action-actors.md).
+      has_many :canceled_orders, class_name: 'Spree::Order', as: :canceler
+      has_many :created_orders, class_name: 'Spree::Order', as: :created_by
+      has_many :approved_orders, class_name: 'Spree::Order', as: :approver
+      has_many :refunded_refunds, class_name: 'Spree::Refund', as: :refunder
+      has_many :created_returns, class_name: 'Spree::Return', as: :created_by
+      has_many :created_exchanges, class_name: 'Spree::Exchange', as: :created_by
+      has_many :created_claims, class_name: 'Spree::Claim', as: :created_by
       has_many :created_gift_cards, class_name: 'Spree::GiftCard', foreign_key: :created_by_id
       has_many :created_gift_card_batches, class_name: 'Spree::GiftCardBatch', foreign_key: :created_by_id
-      has_many :refunded_refunds, class_name: 'Spree::Refund', foreign_key: :refunder_id
-      has_many :created_returns, class_name: 'Spree::Return', foreign_key: :created_by_id
-      has_many :created_exchanges, class_name: 'Spree::Exchange', foreign_key: :created_by_id
-      has_many :created_claims, class_name: 'Spree::Claim', foreign_key: :created_by_id
       has_many :created_store_credits, class_name: 'Spree::StoreCredit', foreign_key: :created_by_id
       has_many :exports, class_name: 'Spree::Export', foreign_key: :user_id
       has_many :saved_reports, class_name: 'Spree::SavedReport', foreign_key: :user_id
@@ -79,28 +85,53 @@ module Spree
     def nullify_approver_id_in_approved_orders
       return if self.class != Spree.admin_user_class
 
-      approved_orders.update_all(approver_id: nil, updated_at: Time.current)
+      clear_actor(Spree::Order, :approver)
     end
 
     def cleanup_admin_user_resources
       return if self.class != Spree.admin_user_class
 
-      # resources to nullify
-      # TODO: we should change these associations to polymorphic and resolve this via standard rails association
-      # declarations with dependent: :nullify
-      canceled_orders.update_all(canceler_id: nil, updated_at: Time.current)
-      created_orders.update_all(created_by_id: nil, updated_at: Time.current)
+      # Every actor column that names this user, derived from the `acted_by`
+      # declarations rather than listed here, so the 6.1 conversion of the
+      # remaining associations needs no edit in this file.
+      clear_every_actor
+
+      # The plain foreign keys that are still admin-user-only. They join the
+      # loop above once they convert in 6.1.
       created_gift_cards.update_all(created_by_id: nil, updated_at: Time.current)
       created_gift_card_batches.update_all(created_by_id: nil, updated_at: Time.current)
-      refunded_refunds.update_all(refunder_id: nil, updated_at: Time.current)
-      created_returns.update_all(created_by_id: nil, updated_at: Time.current)
-      created_exchanges.update_all(created_by_id: nil, updated_at: Time.current)
-      created_claims.update_all(created_by_id: nil, updated_at: Time.current)
       created_store_credits.update_all(created_by_id: nil, updated_at: Time.current)
       saved_reports.update_all(user_id: nil, updated_at: Time.current)
 
       # resources to destroy
       exports.destroy_all
     end
+
+    # Erases this user from every actor column any model declares with
+    # `acted_by`.
+    def clear_every_actor
+      Spree::ActedBy.models.each do |model|
+        model.acted_by_associations.each { |name| clear_actor(model, name) }
+      end
+    end
+
+    # Erases this user from one polymorphic actor column, clearing both halves
+    # together — a type left behind names a class no id points at.
+    #
+    # Matched on the id with either this class or no class at all, because a
+    # row written before the type column existed carries only the id until
+    # `spree:upgrade:backfill_actor_types` runs. Skipping those would leave a
+    # deleted person's id on the record through exactly the upgrade window the
+    # backfill exists for. The id alone cannot collide here: it is paired with
+    # a type that is ours or absent, and absent meant an admin user.
+    #
+    # @param model [Class]
+    # @param name [Symbol] the acted_by association
+    def clear_actor(model, name)
+      model.
+        where(:"#{name}_id" => id).
+        where(:"#{name}_type" => [self.class.polymorphic_name, nil]).
+        update_all(Spree::ActedBy.columns_for(name, nil).merge(updated_at: Time.current))
+    end
   end
 end

data/app/models/concerns/spree/customer_methods.rb

@@ -64,7 +64,14 @@ module Spree
       has_many :promotion_rule_users, class_name: 'Spree::PromotionRuleUser', foreign_key: :customer_id, dependent: :destroy
       has_many :promotion_rules, through: :promotion_rule_users, class_name: 'Spree::PromotionRule'
       has_many :orders, foreign_key: :customer_id, class_name: 'Spree::Order'
-      has_many :carts, -> { incomplete }, foreign_key: :customer_id, class_name: 'Spree::Order'
+      # Open carts only. Since the Cart/Order split a cart lives on its own
+      # table and never becomes an order row, so an incomplete Order is a
+      # backoffice draft, not a cart. Completed carts stay behind as read-only
+      # audit records of a checkout and are reached through the order.
+      # No cascade on destroy, like #orders: a cart can be mid-checkout with
+      # money authorized against it, and erasure goes through
+      # Spree::Customers::Anonymize, which scrubs carts explicitly.
+      has_many :carts, -> { incomplete }, foreign_key: :customer_id, class_name: 'Spree::Cart', dependent: nil
       has_many :completed_orders, -> { complete }, foreign_key: :customer_id, class_name: 'Spree::Order'
       has_many :store_credits, class_name: 'Spree::StoreCredit', foreign_key: :customer_id, dependent: :destroy
       # Everything the customer has bought and can download. Scoped to completed
@@ -272,11 +279,20 @@ module Spree
     end
 
     # Returns the last incomplete spree order for the current store
+    # @deprecated Carts are {Spree::Cart} since 6.0, so an incomplete order is
+    #   a backoffice draft rather than the customer's cart. Use
+    #   +carts.where(store: store)+ for carts, or +orders.drafts+ for drafts.
+    #   Removed in Spree 6.1.
     # @param [Spree::Store] store
     # @param [Hash] options
     # @option options [Array<Symbol>] :includes
     # @return [Spree::Order]
     def last_incomplete_spree_order(store, options = {})
+      Spree::Deprecation.warn(
+        'Spree::CustomerMethods#last_incomplete_spree_order is deprecated and will be removed in Spree 6.1. ' \
+        'Carts are Spree::Cart since 6.0 and this returns draft orders; use #carts for the customer\'s carts.'
+      )
+
       orders.where(store: store).incomplete.not_canceled.
         includes(options[:includes]).
         order('created_at DESC').

data/app/models/concerns/spree/has_number.rb

@@ -99,9 +99,10 @@ module Spree
 
     # Advisory only — a concurrent writer can take the number between this
     # check and the insert, which is what the unique-index rescue below is
-    # for. Unscoped because the index is global.
+    # for. Checked on the base class, unscoped, because the index is global —
+    # it spans every STI subclass and soft-deleted row.
     def number_taken?(candidate)
-      self.class.unscoped.exists?(number: candidate)
+      self.class.base_class.unscoped.exists?(number: candidate)
     end
 
     # Last line of defence. The pre-check and the uniqueness validation both

data/app/models/concerns/spree/prefixed_id.rb

@@ -168,8 +168,11 @@ module Spree
         Spree::PrefixedId.decode_prefixed_id(prefixed_id)
       end
 
+      # Model-scoped decode: answers nil for another model's prefixed ID, like
+      # +find_by_prefix_id+. Use +Spree::PrefixedId.decode_prefixed_id+ when
+      # any model's ID is acceptable.
       def decode_prefixed_id(prefixed_id_string)
-        Spree::PrefixedId.decode_prefixed_id(prefixed_id_string)
+        decode_own_prefixed_id(prefixed_id_string)
       end
 
       # Find by prefixed ID first, falling back to integer id for backwards compatibility.

data/app/models/concerns/spree/purchase/payment_processing.rb

@@ -50,7 +50,7 @@ module Spree
       #
       # @return [Boolean]
       def confirmation_required?
-        Spree::Config[:always_include_confirm_step] ||
+        Spree::StorePreferences.read(store, :always_include_confirm_step) ||
           payments.valid.map(&:payment_method).compact.any?(&:confirmation_required?)
       end
 

data/app/models/concerns/spree/purchase/totals.rb

@@ -35,8 +35,10 @@ module Spree
         # unsaved changes — callers legitimately hold dirty attributes while
         # a payment is destroyed (cart teardown, order merging), and this
         # must never disturb their in-memory state.
+        # updated_at moves with it, or the API validates a cached response
+        # against an unchanged timestamp and serves the pre-payment figure.
         settled = settled_payments_arel
-        self.class.where(id: id).update_all(payment_total: settled)
+        self.class.where(id: id).update_all(payment_total: settled, updated_at: Time.current)
         self.payment_total = self.class.where(id: id).pick(:payment_total)
       end
 

data/app/models/concerns/spree/ransackable_attributes.rb

@@ -1,10 +1,26 @@
 module Spree::RansackableAttributes
   extend ActiveSupport::Concern
+
+  # Ransack `auth_object` values for callers outside the back office. The
+  # allowlists below were written for staff; a shopper or a seller filtering
+  # on them would get a yes/no answer about data their responses never show.
+  RESTRICTED_AUDIENCES = %i[store seller].freeze
+
   included do
     class_attribute :whitelisted_ransackable_associations
     class_attribute :whitelisted_ransackable_attributes
     class_attribute :whitelisted_ransackable_scopes
 
+    # Associations the Store API may filter through. Empty by default: every
+    # hop is a join into data the storefront was never meant to query, and a
+    # join back to the model it came from lets one filter chain them forever.
+    class_attribute :storefront_ransackable_associations, default: []
+
+    # `{ store: [...], seller: [...] }` — attributes and scopes a restricted
+    # audience may not filter on, although staff may.
+    class_attribute :private_ransackable_attributes, default: {}
+    class_attribute :private_ransackable_scopes, default: {}
+
     class_attribute :default_ransackable_attributes
     # `position` is included so any `acts_as_list` model is sortable by it
     # without each subclass having to opt in. Ransack ignores attributes
@@ -12,19 +28,35 @@ module Spree::RansackableAttributes
     # without a position column.
     self.default_ransackable_attributes = %w[id name updated_at created_at position]
 
-    def self.ransackable_associations(*_args)
+    def self.ransackable_associations(auth_object = nil)
+      if Spree::RansackableAttributes.restricted_audience?(auth_object)
+        return auth_object.to_sym == :store ? storefront_ransackable_associations : []
+      end
+
       base = whitelisted_ransackable_associations || []
       base | Spree.ransack.custom_associations_for(self)
     end
 
-    def self.ransackable_attributes(*_args)
+    def self.ransackable_attributes(auth_object = nil)
       base = default_ransackable_attributes | (whitelisted_ransackable_attributes || [])
-      base | Spree.ransack.custom_attributes_for(self)
+      base |= Spree.ransack.custom_attributes_for(self)
+      return base unless Spree::RansackableAttributes.restricted_audience?(auth_object)
+
+      base - Array(private_ransackable_attributes[auth_object.to_sym])
     end
 
-    def self.ransackable_scopes(*_args)
-      base = whitelisted_ransackable_scopes || []
-      base | Spree.ransack.custom_scopes_for(self)
+    def self.ransackable_scopes(auth_object = nil)
+      base = (whitelisted_ransackable_scopes || []).map(&:to_s)
+      base |= Spree.ransack.custom_scopes_for(self).map(&:to_s)
+      return base unless Spree::RansackableAttributes.restricted_audience?(auth_object)
+
+      base - Array(private_ransackable_scopes[auth_object.to_sym])
     end
   end
+
+  # @param auth_object [Symbol, nil] the Ransack auth object a search ran with
+  # @return [Boolean] whether it names a caller outside the back office
+  def self.restricted_audience?(auth_object)
+    auth_object.respond_to?(:to_sym) && RESTRICTED_AUDIENCES.include?(auth_object.to_sym)
+  end
 end

data/app/models/concerns/spree/translatable_resource.rb

@@ -48,13 +48,12 @@ module Spree
       # Every record of this type belonging to +store+, for surfaces that read
       # a whole translatable resource type at once (the coverage grid).
       #
-      # +for_store+ resolves through the store's own association, so it is
-      # right for a store column (Product), a polymorphic owner (Policy) and
-      # genuinely global reference data alike (OptionType, which has no store
-      # dimension and returns everything by design). Its one blind spot is
-      # +Spree::Store+: with no `stores` association to follow it falls back to
-      # the UNSCOPED class, which would answer with every store in the
-      # installation, so that case is narrowed here.
+      # +for_store+ resolves through the store's own association, or through a
+      # model's own +for_store+ scope where there is none to follow (OptionType
+      # by its store column, OptionValue through its option type). Its one
+      # blind spot is +Spree::Store+: with no `stores` association to follow it
+      # falls back to the UNSCOPED class, which would answer with every store in
+      # the installation, so that case is narrowed here.
       #
       # @param store [Spree::Store]
       # @return [ActiveRecord::Relation]