spree_core 6.0.0.beta1 → 6.0.0.beta3

data/app/models/concerns/spree/webhook_payload_redaction.rb

@@ -5,10 +5,13 @@ module Spree
   #
   # Some events must carry a live credential to their subscriber — a storefront
   # that owns its transactional emails needs the real password reset token to
-  # build the email. Delivering it over TLS to a merchant-configured endpoint is
-  # intended; keeping a readable copy in `spree_webhook_deliveries.payload` is
-  # not, because that column is queryable and is served back through the Admin
-  # API delivery log.
+  # build the email, and a mobile app needs the payment session client secret to
+  # confirm the payment. Delivering those over TLS to a merchant-configured
+  # endpoint is intended; keeping a readable copy in
+  # `spree_webhook_deliveries.payload` is not, because that column is queryable
+  # and is served back through the Admin API delivery log to any key holding
+  # `read_webhooks` — a scope an operator may grant precisely because it carries
+  # no access to payments or customers.
   #
   # Sensitive values are therefore replaced with {REDACTION_PLACEHOLDER} before
   # the record is written, and re-attached in memory at send time so the
@@ -16,29 +19,61 @@ module Spree
   module WebhookPayloadRedaction
     extend ActiveSupport::Concern
 
-    # Payload keys under `data` whose values are live credentials.
-    SENSITIVE_PAYLOAD_KEYS = %w[reset_token unsubscribe_token verification_token download_url].freeze
+    # Payload keys whose values are live credentials, at any depth under `data`.
+    #
+    # Payment session secrets are gateway-agnostic: `external_client_secret` is
+    # a core column and `external_data` is a free-form provider hash, so every
+    # provider that stores a confirmation credential there is covered.
+    #
+    # `token` is the guest cart credential (`X-Spree-Token`), which a placed
+    # order inherits; with it anyone can read and change the cart.
+    SENSITIVE_PAYLOAD_KEYS = %w[
+      token
+      reset_token
+      unsubscribe_token
+      verification_token
+      download_url
+      external_client_secret
+      client_secret
+      ephemeral_key_secret
+    ].freeze
+
+    # A gift card's `code` is what a shopper redeems, so it is spendable by
+    # whoever reads it. Only a gift card's own `code` is redacted — promotion,
+    # country and channel codes elsewhere in a payload are not credentials.
+    GIFT_CARD_CODE_KEY = 'code'
+    GIFT_CARD_NODE = 'gift_card'
+    GIFT_CARD_EVENT_PREFIX = 'gift_card.'
 
     REDACTION_PLACEHOLDER = '[REDACTED]'
 
+    # Separates the segments of a secret's path. Segments are escaped before
+    # they are joined, so a key that itself contains the separator still maps
+    # to one unambiguous path.
+    PATH_SEPARATOR = '.'
+
+    # The root both `data` keys share. A payload is persisted as JSON and read
+    # back with string keys, so the symbol and string roots must key their
+    # secrets identically or nothing restores after a round trip.
+    ROOT_SEGMENT = 'data'
+
+    # A path segment escapes the separator so it cannot be read as a boundary,
+    # and the escape character itself so the escaping stays reversible.
+    PATH_ESCAPES = { '\\' => '\\\\', PATH_SEPARATOR => "\\#{PATH_SEPARATOR}" }.freeze
+    PATH_ESCAPES_PATTERN = /[\\#{Regexp.escape(PATH_SEPARATOR)}]/.freeze
+
     # Splits a payload into the version safe to persist and the secrets held
     # back from it.
     #
     # @param payload [Hash] the full event payload
     # @return [Array(Hash, Hash)] redacted payload, and the extracted secrets
-    #   keyed as they appeared under `data`
+    #   keyed by their dotted path under `data`
     def self.split(payload)
       secrets = {}
+      gift_card_event = event_name_of(payload).start_with?(GIFT_CARD_EVENT_PREFIX)
 
       redacted = transform_data_hashes(payload) do |data|
-        data.to_h do |key, value|
-          if SENSITIVE_PAYLOAD_KEYS.include?(key.to_s) && value.present?
-            secrets[secret_key_for(key)] = value
-            [key, REDACTION_PLACEHOLDER]
-          else
-            [key, value]
-          end
-        end
+        redact(data, [ROOT_SEGMENT], secrets, gift_card_event)
       end
 
       secrets.empty? ? [payload, {}] : [redacted, secrets]
@@ -53,12 +88,84 @@ module Spree
       return payload if secrets.blank?
 
       transform_data_hashes(payload) do |data|
-        data.to_h do |key, value|
-          secret = secrets[secret_key_for(key)]
-          [key, secret.presence || value]
+        restore(data, [ROOT_SEGMENT], secrets)
+      end
+    end
+
+    # Walks a hash replacing sensitive values, recording each one against its
+    # path so two secrets sharing a key name (`client_secret` at the top level
+    # and inside `external_data`) cannot overwrite one another.
+    def self.redact(node, path, secrets, gift_card_event = false)
+      if node.is_a?(Array)
+        return node.each_with_index.map { |element, index| redact(element, path + [index.to_s], secrets, gift_card_event) }
+      end
+      return node unless node.is_a?(Hash)
+
+      node.to_h do |key, value|
+        key_path = path + [key.to_s]
+
+        if sensitive?(key, value) || gift_card_code?(key, value, path, gift_card_event)
+          secrets[secret_key_for(key_path)] = value
+          [key, REDACTION_PLACEHOLDER]
+        else
+          [key, redact(value, key_path, secrets, gift_card_event)]
         end
       end
     end
+    private_class_method :redact
+
+    # The mirror of {redact}. Only a slot still holding the placeholder is
+    # filled, so a real value the payload carries is never overwritten.
+    #
+    # Deliveries enqueued before path keying shipped carry secrets under a bare
+    # key name. Those only ever came from the top level of `data`, so the
+    # fallback is confined there — at depth it would fill every same-named slot
+    # in the tree with one secret.
+    def self.restore(node, path, secrets)
+      if node.is_a?(Array)
+        return node.each_with_index.map { |element, index| restore(element, path + [index.to_s], secrets) }
+      end
+      return node unless node.is_a?(Hash)
+
+      node.to_h do |key, value|
+        key_path = path + [key.to_s]
+        next [key, restore(value, key_path, secrets)] unless value == REDACTION_PLACEHOLDER
+
+        secret = secrets[secret_key_for(key_path)]
+        secret ||= secrets[key.to_s] if path.one?
+
+        [key, secret.presence || value]
+      end
+    end
+    private_class_method :restore
+
+    def self.sensitive?(key, value)
+      SENSITIVE_PAYLOAD_KEYS.include?(key.to_s) && scalar?(value)
+    end
+    private_class_method :sensitive?
+
+    # The `code` of a gift card: at the root of a gift card event's data, or
+    # on a `gift_card` node nested in another record (an order or cart that
+    # has one applied).
+    def self.gift_card_code?(key, value, path, gift_card_event)
+      return false unless key.to_s == GIFT_CARD_CODE_KEY && scalar?(value)
+      return true if gift_card_event && path == [ROOT_SEGMENT]
+
+      path.last == GIFT_CARD_NODE
+    end
+    private_class_method :gift_card_code?
+
+    def self.scalar?(value)
+      value.present? && !value.is_a?(Hash) && !value.is_a?(Array)
+    end
+    private_class_method :scalar?
+
+    def self.event_name_of(payload)
+      return '' unless payload.is_a?(Hash)
+
+      (payload[:name] || payload['name']).to_s
+    end
+    private_class_method :event_name_of
 
     # Applies +block+ to every `data` hash on the payload.
     #
@@ -77,11 +184,15 @@ module Spree
     end
     private_class_method :transform_data_hashes
 
-    # Secrets are keyed by name alone. They cross an ActiveJob serialization
+    # Secrets are keyed by path alone. They cross an ActiveJob serialization
     # boundary, which coerces symbol keys to strings, so the key form at split
     # time cannot be relied on to still match at merge time.
-    def self.secret_key_for(key)
-      key.to_s
+    #
+    # Each segment escapes the separator (and the escape character) before the
+    # join, so `['a.b', 'c']` and `['a', 'b', 'c']` stay distinct keys.
+    def self.secret_key_for(path)
+      path.map { |segment| segment.gsub(PATH_ESCAPES_PATTERN) { |character| PATH_ESCAPES[character] } }.
+        join(PATH_SEPARATOR)
     end
     private_class_method :secret_key_for
   end

data/app/models/spree/adjusters/promotion.rb

@@ -113,7 +113,7 @@ module Spree
       def line_item_candidates(line_item)
         @line_item_candidates ||= {}
         @line_item_candidates[line_item.id] ||= discount_actions(:line_item).filter_map do |action|
-          next unless action.promotion.line_item_actionable?(order, line_item)
+          next unless action.applies_to_line_item?(order, line_item)
 
           amount = action.compute_amount(line_item)
           next if amount.zero?

data/app/models/spree/api_key.rb

@@ -2,6 +2,7 @@ module Spree
   class ApiKey < Spree.base_class
     has_prefix_id :key  # Spree-specific: api key
 
+    include Spree::Actor
     include Spree::SingleStoreResource
 
     KEY_TYPES = %w[publishable secret].freeze
@@ -124,10 +125,11 @@ module Spree
 
     # Revokes this API key by setting +revoked_at+ to the current time.
     #
-    # @param user [Object, nil] the user who performed the revocation
+    # @param actor [Object, nil] who performed the revocation — an admin user
+    #   or another API key (see Spree.actor_classes)
     # @return [Boolean] true if the update succeeded
-    def revoke!(user = nil)
-      update!(revoked_at: Time.current, revoked_by: user)
+    def revoke!(actor = nil)
+      update!(revoked_at: Time.current, revoked_by: actor)
     end
 
     # Whether this key carries the given scope. `write_*` implies the matching

data/app/models/spree/authentication/lockout.rb

@@ -0,0 +1,34 @@
+module Spree
+  module Authentication
+    # The login lockout contract, for every place that checks a secret the
+    # account owner knows. A check that skips it becomes an unthrottled way to
+    # guess the password: a locked account is refused, a miss counts towards
+    # the lockout and a hit clears the count.
+    #
+    # Duck-typed, so a custom user class that implements none of the lockout
+    # hooks is checked without them.
+    module Lockout
+      module_function
+
+      # @param user [Object] the account whose secret is being checked
+      # @yieldreturn [Boolean] whether the secret matched
+      # @return [Symbol] +:locked+, +:valid+ or +:invalid+
+      def check(user)
+        return :locked if user.respond_to?(:locked?) && user.locked?
+
+        if yield
+          # Require the full contract before touching the counter — a custom
+          # user class may implement one hook but not the other.
+          if user.respond_to?(:failed_attempts) && user.respond_to?(:reset_failed_attempts!) &&
+             user.failed_attempts.to_i.positive?
+            user.reset_failed_attempts!
+          end
+          :valid
+        else
+          user.record_failed_attempt! if user.respond_to?(:record_failed_attempt!)
+          :invalid
+        end
+      end
+    end
+  end
+end

data/app/models/spree/authentication/strategies/email_password_strategy.rb

@@ -11,19 +11,11 @@ module Spree
 
           user = find_user_by_email(email)
           return failure('Invalid email or password') unless user
-          return failure('Account temporarily locked. Try again later.') if user.respond_to?(:locked?) && user.locked?
 
-          if validate_password(user, password)
-            # Require the full lockout contract before touching the counter — a
-            # custom customer_class may implement one hook but not the other.
-            if user.respond_to?(:failed_attempts) && user.respond_to?(:reset_failed_attempts!) &&
-               user.failed_attempts.to_i.positive?
-              user.reset_failed_attempts!
-            end
-            success(user)
-          else
-            user.record_failed_attempt! if user.respond_to?(:record_failed_attempt!)
-            failure('Invalid email or password')
+          case Spree::Authentication::Lockout.check(user) { validate_password(user, password) }
+          when :locked then failure('Account temporarily locked. Try again later.')
+          when :valid then success(user)
+          else failure('Invalid email or password')
           end
         rescue => e
           Rails.logger.error "EmailPasswordStrategy authentication failed: #{e.message}"

data/app/models/spree/authentication/strategies/oidc_strategy.rb

@@ -223,7 +223,7 @@ module Spree
         end
 
         def identity_info(claims)
-          claims.slice('email', 'name', 'gisel_name', 'family_name', 'picture')
+          claims.slice('email', 'name', 'given_name', 'family_name', 'picture')
         end
 
         # The key this provider is registered under — used as UserIdentity#provider

data/app/models/spree/catalog.rb

@@ -14,8 +14,9 @@ module Spree
   # catalog to those companies or divisions rather than to a group.
   #
   # Within whichever audience answered, visibility is the union of its
-  # catalogs' assortments and pricing takes the price list of the nearest
-  # assignment first (docs/plans/6.0-b2b-companies-and-catalogs.md).
+  # catalogs' assortments; pricing walks the assigning nodes nearest first and
+  # within one node charges the best price any of its catalogs gives
+  # (docs/plans/6.0-b2b-companies-and-catalogs.md).
   class Catalog < Spree.base_class
     has_prefix_id :cat
 
@@ -97,6 +98,17 @@ module Spree
     # @param company [Spree::Company, nil]
     # @return [Array<Spree::Catalog>]
     def self.for_company(company)
+      groups_for_company(company).flatten
+    end
+
+    # The same catalogs, grouped by the node that assigns them, nearest first.
+    # Only pricing needs the boundaries: catalogs sharing a node rank equally
+    # and the best price among them wins, while a nearer node outranks a
+    # further one. Everything else takes the flat {.for_company}.
+    #
+    # @param company [Spree::Company, nil]
+    # @return [Array<Array<Spree::Catalog>>]
+    def self.groups_for_company(company)
       return [] if company.nil?
 
       nodes = company.self_and_ancestors
@@ -110,9 +122,15 @@ module Spree
                     includes(:catalog).
                     group_by(&:assignable_id)
 
-      nodes.flat_map do |node|
-        Array(assignments[node.id]).map(&:catalog).select(&:active?).sort_by { |catalog| catalog.position.to_i }
-      end.uniq
+      # A catalog assigned to a node and to an ancestor answers from the nearer.
+      seen = Set.new
+
+      nodes.filter_map do |node|
+        group = Array(assignments[node.id]).map(&:catalog).
+                select { |catalog| catalog.active? && seen.add?(catalog.id) }.
+                sort_by { |catalog| catalog.position.to_i }
+        group.presence
+      end
     end
 
     # The catalogs assigned to any of the given customer groups, by position.
@@ -151,18 +169,30 @@ module Spree
     # @param channel [Spree::Channel, nil]
     # @return [Array<Spree::Catalog>]
     def self.for_context(store:, company: nil, user: nil, channel: nil)
+      groups_for_context(store: store, company: company, user: user, channel: channel).flatten
+    end
+
+    # The same resolution, grouped by precedence rank ({.groups_for_company}).
+    # Only the company axis has more than one rank.
+    #
+    # @return [Array<Array<Spree::Catalog>>]
+    def self.groups_for_context(store:, company: nil, user: nil, channel: nil)
       return [] if store.nil?
 
-      catalogs = store.catalogs.for_company(company)
+      groups = store.catalogs.groups_for_company(company)
+
       # Only when the company axis found nothing: a buyer purchasing for a
       # company is on that company's agreement, and adding their personal
       # segment's catalogs on top would price one buyer under two agreements
       # at once.
-      if catalogs.empty? && user
-        groups = user.try(:customer_groups)&.where(store_id: store.id) || []
-        catalogs = store.catalogs.for_customer_groups(groups)
+      if groups.empty? && user
+        customer_groups = user.try(:customer_groups)&.where(store_id: store.id) || []
+        groups = [store.catalogs.for_customer_groups(customer_groups).presence].compact
       end
-      catalogs = [channel&.default_catalog].compact.select(&:active?) if catalogs.empty?
+
+      groups = [[channel&.default_catalog].compact.select(&:active?).presence].compact if groups.empty?
+
+      catalogs = groups.flatten
       # Pricing reads each catalog's price list, and the list's contextual
       # rules decide whether it applies to the quantity being bought; without
       # this the walk is one query per catalog again, plus one per list.
@@ -171,7 +201,7 @@ module Spree
           records: catalogs, associations: { price_list: [:price_rules, :price_adjustment_tiers] }
         ).call
       end
-      catalogs
+      groups
     end
 
     # The catalogs applying to a buyer, resolving the company for them when
@@ -190,15 +220,22 @@ module Spree
     # @param channel [Spree::Channel, nil]
     # @return [Array<Spree::Catalog>]
     def self.for_buyer(store:, customer: nil, company: nil, channel: nil)
+      groups_for_buyer(store: store, customer: customer, company: company, channel: channel).flatten
+    end
+
+    # {.for_buyer}, grouped by precedence rank. What pricing walks.
+    #
+    # @return [Array<Array<Spree::Catalog>>]
+    def self.groups_for_buyer(store:, customer: nil, company: nil, channel: nil)
       return [] if store.nil?
 
       if store == Spree::Current.store
         company ||= Spree::Current.standing_company_for(customer)
         channel ||= Spree::Current.channel
-        Spree::Current.catalogs_for(company: company, user: customer, channel: channel)
+        Spree::Current.catalog_groups_for(company: company, user: customer, channel: channel)
       else
         company ||= Spree::Company.sole_standing_for(store: store, customer: customer)
-        for_context(store: store, company: company, user: customer, channel: channel)
+        groups_for_context(store: store, company: company, user: customer, channel: channel)
       end
     end
 

data/app/models/spree/claim.rb

@@ -10,6 +10,7 @@ module Spree
     has_prefix_id :claim
 
     has_spree_number prefix: 'CLM'
+    include Spree::ActedBy
     include Spree::NumberIdentifier
     include Spree::SingleStoreResource
     include Spree::HasStatus
@@ -27,11 +28,12 @@ module Spree
     belongs_to :store, class_name: 'Spree::Store'
     belongs_to :order, class_name: 'Spree::Order', inverse_of: :claims
     belongs_to :reason, class_name: 'Spree::ClaimReason', optional: true, inverse_of: :claims
-    belongs_to :created_by, class_name: Spree.admin_user_class.to_s, optional: true
+    acted_by :created_by
 
     has_many :claim_line_items, class_name: 'Spree::ClaimLineItem',
                                 dependent: :destroy, inverse_of: :claim
     has_many :refunds, class_name: 'Spree::Refund', as: :originator, dependent: :nullify
+    has_many :store_credits, class_name: 'Spree::StoreCredit', as: :originator, dependent: :nullify
 
     validates :claim_line_items, presence: true, on: :create
     validates :resolution, inclusion: { in: RESOLUTIONS }, allow_nil: true

data/app/models/spree/commission_line.rb

@@ -61,8 +61,10 @@ module Spree
     scope :for_line_items, -> { where.not(line_item_id: nil) }
     scope :for_fulfillments, -> { where.not(fulfillment_id: nil) }
 
-    self.whitelisted_ransackable_attributes = %w[amount tax_amount total currency kind rate]
-    self.whitelisted_ransackable_associations = %w[order seller commission_rate]
+    self.whitelisted_ransackable_attributes = %w[amount tax_amount total currency kind rate order_id]
+    # No `order`: filtering through it reaches the buyer's email and address,
+    # which a commissions-only caller may not read. `order_id` covers the lookup.
+    self.whitelisted_ransackable_associations = %w[seller commission_rate]
 
     extend Spree::DisplayMoney
     money_methods :amount, :tax_amount, :total

data/app/models/spree/commission_rule.rb

@@ -16,7 +16,7 @@ module Spree
   class CommissionRule < Spree.base_class
     include Spree::PreferenceSchema
 
-    has_prefix_id :crule
+    has_prefix_id :comrule
 
     # Retired rather than deleted, with its rate or on its own as an operator
     # edits a rate's conditions. A commission line is a settlement record, and

data/app/models/spree/coupon_code.rb

@@ -10,6 +10,7 @@ module Spree
 
     scope :used_with_code, ->(code) { used.where(code: code.downcase) }
     scope :with_order, ->(order_id) { where(order_id: order_id) }
+    scope :held_by, ->(owner) { owner.is_a?(Spree::Cart) ? where(cart_id: owner.id) : where(order_id: owner.id) }
     scope :in_promotions, ->(promotion_ids) { where(promotion_id: promotion_ids) }
     scope :not_in_promotions, ->(promotion_ids) { where.not(promotion_id: promotion_ids) }
 
@@ -38,9 +39,20 @@ module Spree
       used_with_code(code).any?
     end
 
+    # Attaches the code to the cart or order presenting it. The code is not
+    # spent here: it stays unused until an order is placed with it, so a code
+    # left on an abandoned cart can still be presented by someone else.
+    #
+    # @param owner [Spree::Cart, Spree::Order]
+    # @return [Boolean]
     def apply_order!(owner)
-      owner_key = owner.is_a?(Spree::Cart) ? :cart : :order
-      update(owner_key => owner, state: 'used')
+      cart = owner.is_a?(Spree::Cart) ? owner : nil
+      update(cart: cart, order: cart ? nil : owner)
+    end
+
+    # @return [Spree::Cart, Spree::Order, nil] the record currently holding this code
+    def holder
+      cart || order
     end
 
     def remove_from_order

data/app/models/spree/current.rb

@@ -4,7 +4,11 @@ module Spree
   # All attributes are automatically reset between requests by Rails.
   # Fallback chains ensure sensible defaults when attributes are not explicitly set.
   class Current < ::ActiveSupport::CurrentAttributes
-    attribute :store, :channel, :market, :currency, :locale, :content_locale, :tax_country, :price_lists, :applicable_catalogs, :quantity_rules_resolvers, :standing_companies, :global_pricing_context, :provider_cache, :integrations
+    attribute :store, :channel, :market, :currency, :locale, :content_locale, :tax_country, :price_lists, :applicable_catalogs, :applicable_catalog_groups, :quantity_rules_resolvers, :standing_companies, :global_pricing_context, :provider_cache, :integrations
+    # Latch for the cross-store leak tripwire — see #store= below. Lives here
+    # so it clears exactly when the store context does, which Rails does per
+    # request and per job.
+    attribute :store_scope_guard_armed
 
     # Scratch space for provider strategies to memoize a call across the
     # request — part of the delivery rate provider contract (nothing in core
@@ -17,6 +21,17 @@ module Spree
       super || (self.provider_cache = {})
     end
 
+    # Declaring a store context arms the cross-store leak tripwire for the
+    # rest of this unit of work — a request, a job, a webhook — so the guard
+    # follows the context rather than a list of entry points
+    # (docs/plans/6.0-store-context-and-first-run-setup.md). Work that never
+    # declares a store is left alone: it reads the default store through the
+    # fallback below, which is not a scoping claim to check.
+    def store=(value)
+      Spree::StoreScopeGuard.arm! if value
+      super
+    end
+
     # Returns the current store, falling back to the default store.
     # @return [Spree::Store]
     def store
@@ -103,16 +118,22 @@ module Spree
     # @param channel [Spree::Channel, nil]
     # @return [Array<Spree::Catalog>]
     def catalogs_for(company: nil, user: nil, channel: nil)
-      channel ||= self.channel
-      # Normalized before the key is built, not just before the query: the
-      # key is an id, so an admin and a customer sharing one would otherwise
-      # share an entry and whichever resolved first would decide for both.
-      # Only a customer has customer-group catalogs to resolve.
-      user = nil unless user.is_a?(Spree.customer_class)
-
-      key = [store&.id, company&.id, user&.id, channel&.id]
-      applicable_catalogs[key] ||= Spree::Catalog.for_context(
-        store: store, company: company, user: user, channel: channel
+      key = catalog_memo_key(company: company, user: user, channel: channel)
+      applicable_catalogs[key] ||= catalog_groups_for(company: company, user: user, channel: channel).flatten
+    end
+
+    # The same catalogs grouped by precedence rank, which is what pricing
+    # walks ({Spree::Catalog.groups_for_company}). The resolved form — the
+    # flat set above is a cached flattening of it, never a second resolution.
+    #
+    # @param company [Spree::Company, nil]
+    # @param user [Object, nil]
+    # @param channel [Spree::Channel, nil]
+    # @return [Array<Array<Spree::Catalog>>]
+    def catalog_groups_for(company: nil, user: nil, channel: nil)
+      key = catalog_memo_key(company: company, user: user, channel: channel)
+      applicable_catalog_groups[key] ||= Spree::Catalog.groups_for_context(
+        store: store, company: company, user: normalized_catalog_user(user), channel: channel || self.channel
       )
     end
 
@@ -121,6 +142,11 @@ module Spree
       super || (self.applicable_catalogs = {})
     end
 
+    # @return [Hash]
+    def applicable_catalog_groups
+      super || (self.applicable_catalog_groups = {})
+    end
+
     # The quantity-rule resolver for a buyer in this request, keyed the same
     # way their catalogs are.
     #
@@ -133,8 +159,7 @@ module Spree
     # @param channel [Spree::Channel, nil]
     # @return [Spree::Catalogs::ResolveQuantityRules]
     def quantity_rules_resolver_for(company: nil, user: nil, channel: nil)
-      channel ||= self.channel
-      key = [store&.id, company&.id, user&.id, channel&.id]
+      key = catalog_memo_key(company: company, user: user, channel: channel)
       quantity_rules_resolvers[key] ||= Spree::Catalogs::ResolveQuantityRules.new(
         catalogs_for(company: company, user: user, channel: channel)
       )
@@ -176,6 +201,7 @@ module Spree
     # @return [void]
     def reset_catalog_memos
       self.applicable_catalogs = nil
+      self.applicable_catalog_groups = nil
       self.quantity_rules_resolvers = nil
       self.standing_companies = nil
       self.price_lists = nil
@@ -194,5 +220,22 @@ module Spree
         )
       end
     end
+
+    private
+
+    # One key for every buyer-derived memo, so they cannot drift apart.
+    #
+    # @return [Array]
+    def catalog_memo_key(company: nil, user: nil, channel: nil)
+      [store&.id, company&.id, normalized_catalog_user(user)&.id, (channel || self.channel)&.id]
+    end
+
+    # Normalized before the key is built, not just before the query: the key
+    # is an id, so an admin and a customer sharing one would share an entry.
+    #
+    # @return [Object, nil]
+    def normalized_catalog_user(user)
+      user if user.is_a?(Spree.customer_class)
+    end
   end
 end

data/app/models/spree/exchange.rb

@@ -11,6 +11,7 @@ module Spree
     has_prefix_id :exch
 
     has_spree_number prefix: 'EX'
+    include Spree::ActedBy
     include Spree::NumberIdentifier
     include Spree::SingleStoreResource
     include Spree::HasStatus
@@ -26,11 +27,12 @@ module Spree
     belongs_to :order, class_name: 'Spree::Order', inverse_of: :exchanges
     belongs_to :stock_location, class_name: 'Spree::StockLocation'
     belongs_to :reason, class_name: 'Spree::ReturnReason', optional: true, inverse_of: :exchanges
-    belongs_to :created_by, class_name: Spree.admin_user_class.to_s, optional: true
+    acted_by :created_by
 
     has_many :exchange_line_items, class_name: 'Spree::ExchangeLineItem',
                                    dependent: :destroy, inverse_of: :exchange
     has_many :refunds, class_name: 'Spree::Refund', as: :originator, dependent: :nullify
+    has_many :store_credits, class_name: 'Spree::StoreCredit', as: :originator, dependent: :nullify
 
     validates :exchange_line_items, presence: true, on: :create
 

data/app/models/spree/export.rb

@@ -192,12 +192,13 @@ module Spree
         raise SellerScopeUnavailable, model_class unless model_class.respond_to?(:for_seller)
 
         scope = scope.for_seller(seller)
-        # A draft is either a checkout in flight or the operator's working
-        # document, and is not this seller's sale — the same exclusion every
-        # endpoint on the seller branch applies.
-        scope = scope.not_drafts if model_class.respond_to?(:not_drafts)
       end
 
+      # A draft is either a checkout in flight or the operator's working
+      # document, not a sale — the orders list and every seller endpoint leave
+      # drafts out too.
+      scope = scope.not_drafts if model_class.respond_to?(:not_drafts)
+
       # A staff-created export only contains what its creator may read; a
       # userless export (console, system jobs) is unfiltered.
       scope = scope.accessible_by(current_ability) if user.present?
@@ -219,7 +220,9 @@ module Spree
                                 [scope, params]
                               end
 
-      filtered_scope.ransack(params).result
+      # A seller's export filters as the seller's own listings do, so a
+      # condition on data the seller cannot read (the buyer's email) is ignored.
+      filtered_scope.ransack(params, auth_object: seller_id.present? ? :seller : nil).result
     end
 
     # `search_params` as a Hash — whether it is still the Hash a caller