spree_core 6.0.0.beta2 → 6.0.0.beta3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c2e491640b87a7c66d80915167c1b3e0e342ebc527f98ab6be473494850ed8c
-  data.tar.gz: 9507987225c9b98ea0676417742b9c22e338796d9d155f309f3d0f5262617f4d
+  metadata.gz: fb19660bc9b7017b74df8b6b92fc2522cb84ef62a6a015f817484528b7e8c992
+  data.tar.gz: bac9e0d41a47af2e5452406f1c0d1ac268b687ebdf1ade714742aa689e5cae0a
 SHA512:
-  metadata.gz: 25b1c9003b48955d08e1d26f0f64d630ae4eafb07043cd49bfb70b22736255b0315f85b6e6f22ab873fc2e24b64cb0a3a7c715ac77b522d58afe1190939f4b78
-  data.tar.gz: b7379fef995f651f02229b55260b8685a8e4318e7748be5f2a64aa0476a40577d877f1e32897a3d6542f47beee847e18a431bb027cc1237c189f2bde8e0c0493
+  metadata.gz: f0a322ff461f40b5d0a8eb5522fb5f6b45f0a1f7526e9e797f255a0779ddfeabf0db9bfe6629b341d4ed03f71591c76dc3435928cdf28b7d98029c1164c0efe6
+  data.tar.gz: bd3ef61d467f2b481120080350fbf0f7c661e9fe81123c24869978a5177240766454fe248fb35cfc967445fbf049aa2fc483a06884573c13e6c4a33b9fda0b4e

data/app/jobs/spree/payments/handle_webhook_job.rb

@@ -9,6 +9,7 @@ module Spree
 
       def perform(payment_method_id:, action:, payment_session_id:)
         payment_method = Spree::PaymentMethod.find(payment_method_id)
+        Spree::Current.store = payment_method.store
         payment_session = Spree::PaymentSession.find(payment_session_id)
 
         Spree.payments_handle_webhook_workflow.call(

data/app/jobs/spree/sample_data/load_job.rb

@@ -5,8 +5,13 @@ module Spree
     # loader needs an admin to own its imports and downloads product images,
     # so it can neither run before setup nor inside the setup request.
     class LoadJob < Spree::BaseJob
-      def perform
-        Spree::SampleData::Loader.call
+      # @param store_id [String, Integer, nil] the store to load into; the
+      #   default store when omitted
+      def perform(store_id = nil)
+        return Spree::SampleData::Loader.call if store_id.nil?
+
+        store = Spree::Store.find_by(id: store_id)
+        Spree::SampleData::Loader.call(store: store) if store
       end
     end
   end

data/app/jobs/spree/seller_transfers/execute_pending_job.rb

@@ -26,6 +26,7 @@ module Spree
         seller = Spree::Seller.find_by(id: seller_id)
         return if seller.nil? || !seller.payouts_enabled?
 
+        Spree::Current.store = seller.store
         provider = seller.store.payout_provider_instance
 
         # Earnings only — see the scope. A reversal is retryable the same way

data/app/mailers/spree/admin_user_mailer.rb

@@ -34,9 +34,9 @@ module Spree
     end
 
     # The dashboard SPA passes a validated redirect URL; the token is appended as
-    # a query param, falling back to the store URL.
+    # a query param, falling back to the dashboard's own reset page.
     def password_reset_url(token, store, redirect_url)
-      append_token(redirect_url.presence || store.formatted_url, token)
+      append_token(redirect_url.presence || "#{Spree::Stores::DashboardUrl.call(store: store)}/reset-password", token)
     end
   end
 end

data/app/models/concerns/spree/customer_methods.rb

@@ -64,7 +64,14 @@ module Spree
       has_many :promotion_rule_users, class_name: 'Spree::PromotionRuleUser', foreign_key: :customer_id, dependent: :destroy
       has_many :promotion_rules, through: :promotion_rule_users, class_name: 'Spree::PromotionRule'
       has_many :orders, foreign_key: :customer_id, class_name: 'Spree::Order'
-      has_many :carts, -> { incomplete }, foreign_key: :customer_id, class_name: 'Spree::Order'
+      # Open carts only. Since the Cart/Order split a cart lives on its own
+      # table and never becomes an order row, so an incomplete Order is a
+      # backoffice draft, not a cart. Completed carts stay behind as read-only
+      # audit records of a checkout and are reached through the order.
+      # No cascade on destroy, like #orders: a cart can be mid-checkout with
+      # money authorized against it, and erasure goes through
+      # Spree::Customers::Anonymize, which scrubs carts explicitly.
+      has_many :carts, -> { incomplete }, foreign_key: :customer_id, class_name: 'Spree::Cart', dependent: nil
       has_many :completed_orders, -> { complete }, foreign_key: :customer_id, class_name: 'Spree::Order'
       has_many :store_credits, class_name: 'Spree::StoreCredit', foreign_key: :customer_id, dependent: :destroy
       # Everything the customer has bought and can download. Scoped to completed
@@ -272,11 +279,20 @@ module Spree
     end
 
     # Returns the last incomplete spree order for the current store
+    # @deprecated Carts are {Spree::Cart} since 6.0, so an incomplete order is
+    #   a backoffice draft rather than the customer's cart. Use
+    #   +carts.where(store: store)+ for carts, or +orders.drafts+ for drafts.
+    #   Removed in Spree 6.1.
     # @param [Spree::Store] store
     # @param [Hash] options
     # @option options [Array<Symbol>] :includes
     # @return [Spree::Order]
     def last_incomplete_spree_order(store, options = {})
+      Spree::Deprecation.warn(
+        'Spree::CustomerMethods#last_incomplete_spree_order is deprecated and will be removed in Spree 6.1. ' \
+        'Carts are Spree::Cart since 6.0 and this returns draft orders; use #carts for the customer\'s carts.'
+      )
+
       orders.where(store: store).incomplete.not_canceled.
         includes(options[:includes]).
         order('created_at DESC').

data/app/models/concerns/spree/has_number.rb

@@ -99,9 +99,10 @@ module Spree
 
     # Advisory only — a concurrent writer can take the number between this
     # check and the insert, which is what the unique-index rescue below is
-    # for. Unscoped because the index is global.
+    # for. Checked on the base class, unscoped, because the index is global —
+    # it spans every STI subclass and soft-deleted row.
     def number_taken?(candidate)
-      self.class.unscoped.exists?(number: candidate)
+      self.class.base_class.unscoped.exists?(number: candidate)
     end
 
     # Last line of defence. The pre-check and the uniqueness validation both

data/app/models/concerns/spree/prefixed_id.rb

@@ -168,8 +168,11 @@ module Spree
         Spree::PrefixedId.decode_prefixed_id(prefixed_id)
       end
 
+      # Model-scoped decode: answers nil for another model's prefixed ID, like
+      # +find_by_prefix_id+. Use +Spree::PrefixedId.decode_prefixed_id+ when
+      # any model's ID is acceptable.
       def decode_prefixed_id(prefixed_id_string)
-        Spree::PrefixedId.decode_prefixed_id(prefixed_id_string)
+        decode_own_prefixed_id(prefixed_id_string)
       end
 
       # Find by prefixed ID first, falling back to integer id for backwards compatibility.

data/app/models/concerns/spree/purchase/totals.rb

@@ -35,8 +35,10 @@ module Spree
         # unsaved changes — callers legitimately hold dirty attributes while
         # a payment is destroyed (cart teardown, order merging), and this
         # must never disturb their in-memory state.
+        # updated_at moves with it, or the API validates a cached response
+        # against an unchanged timestamp and serves the pre-payment figure.
         settled = settled_payments_arel
-        self.class.where(id: id).update_all(payment_total: settled)
+        self.class.where(id: id).update_all(payment_total: settled, updated_at: Time.current)
         self.payment_total = self.class.where(id: id).pick(:payment_total)
       end
 

data/app/models/concerns/spree/ransackable_attributes.rb

@@ -1,10 +1,26 @@
 module Spree::RansackableAttributes
   extend ActiveSupport::Concern
+
+  # Ransack `auth_object` values for callers outside the back office. The
+  # allowlists below were written for staff; a shopper or a seller filtering
+  # on them would get a yes/no answer about data their responses never show.
+  RESTRICTED_AUDIENCES = %i[store seller].freeze
+
   included do
     class_attribute :whitelisted_ransackable_associations
     class_attribute :whitelisted_ransackable_attributes
     class_attribute :whitelisted_ransackable_scopes
 
+    # Associations the Store API may filter through. Empty by default: every
+    # hop is a join into data the storefront was never meant to query, and a
+    # join back to the model it came from lets one filter chain them forever.
+    class_attribute :storefront_ransackable_associations, default: []
+
+    # `{ store: [...], seller: [...] }` — attributes and scopes a restricted
+    # audience may not filter on, although staff may.
+    class_attribute :private_ransackable_attributes, default: {}
+    class_attribute :private_ransackable_scopes, default: {}
+
     class_attribute :default_ransackable_attributes
     # `position` is included so any `acts_as_list` model is sortable by it
     # without each subclass having to opt in. Ransack ignores attributes
@@ -12,19 +28,35 @@ module Spree::RansackableAttributes
     # without a position column.
     self.default_ransackable_attributes = %w[id name updated_at created_at position]
 
-    def self.ransackable_associations(*_args)
+    def self.ransackable_associations(auth_object = nil)
+      if Spree::RansackableAttributes.restricted_audience?(auth_object)
+        return auth_object.to_sym == :store ? storefront_ransackable_associations : []
+      end
+
       base = whitelisted_ransackable_associations || []
       base | Spree.ransack.custom_associations_for(self)
     end
 
-    def self.ransackable_attributes(*_args)
+    def self.ransackable_attributes(auth_object = nil)
       base = default_ransackable_attributes | (whitelisted_ransackable_attributes || [])
-      base | Spree.ransack.custom_attributes_for(self)
+      base |= Spree.ransack.custom_attributes_for(self)
+      return base unless Spree::RansackableAttributes.restricted_audience?(auth_object)
+
+      base - Array(private_ransackable_attributes[auth_object.to_sym])
     end
 
-    def self.ransackable_scopes(*_args)
-      base = whitelisted_ransackable_scopes || []
-      base | Spree.ransack.custom_scopes_for(self)
+    def self.ransackable_scopes(auth_object = nil)
+      base = (whitelisted_ransackable_scopes || []).map(&:to_s)
+      base |= Spree.ransack.custom_scopes_for(self).map(&:to_s)
+      return base unless Spree::RansackableAttributes.restricted_audience?(auth_object)
+
+      base - Array(private_ransackable_scopes[auth_object.to_sym])
     end
   end
+
+  # @param auth_object [Symbol, nil] the Ransack auth object a search ran with
+  # @return [Boolean] whether it names a caller outside the back office
+  def self.restricted_audience?(auth_object)
+    auth_object.respond_to?(:to_sym) && RESTRICTED_AUDIENCES.include?(auth_object.to_sym)
+  end
 end

data/app/models/concerns/spree/translatable_resource.rb

@@ -48,13 +48,12 @@ module Spree
       # Every record of this type belonging to +store+, for surfaces that read
       # a whole translatable resource type at once (the coverage grid).
       #
-      # +for_store+ resolves through the store's own association, so it is
-      # right for a store column (Product), a polymorphic owner (Policy) and
-      # genuinely global reference data alike (OptionType, which has no store
-      # dimension and returns everything by design). Its one blind spot is
-      # +Spree::Store+: with no `stores` association to follow it falls back to
-      # the UNSCOPED class, which would answer with every store in the
-      # installation, so that case is narrowed here.
+      # +for_store+ resolves through the store's own association, or through a
+      # model's own +for_store+ scope where there is none to follow (OptionType
+      # by its store column, OptionValue through its option type). Its one
+      # blind spot is +Spree::Store+: with no `stores` association to follow it
+      # falls back to the UNSCOPED class, which would answer with every store in
+      # the installation, so that case is narrowed here.
       #
       # @param store [Spree::Store]
       # @return [ActiveRecord::Relation]

data/app/models/concerns/spree/webhook_payload_redaction.rb

@@ -5,10 +5,13 @@ module Spree
   #
   # Some events must carry a live credential to their subscriber — a storefront
   # that owns its transactional emails needs the real password reset token to
-  # build the email. Delivering it over TLS to a merchant-configured endpoint is
-  # intended; keeping a readable copy in `spree_webhook_deliveries.payload` is
-  # not, because that column is queryable and is served back through the Admin
-  # API delivery log.
+  # build the email, and a mobile app needs the payment session client secret to
+  # confirm the payment. Delivering those over TLS to a merchant-configured
+  # endpoint is intended; keeping a readable copy in
+  # `spree_webhook_deliveries.payload` is not, because that column is queryable
+  # and is served back through the Admin API delivery log to any key holding
+  # `read_webhooks` — a scope an operator may grant precisely because it carries
+  # no access to payments or customers.
   #
   # Sensitive values are therefore replaced with {REDACTION_PLACEHOLDER} before
   # the record is written, and re-attached in memory at send time so the
@@ -16,29 +19,61 @@ module Spree
   module WebhookPayloadRedaction
     extend ActiveSupport::Concern
 
-    # Payload keys under `data` whose values are live credentials.
-    SENSITIVE_PAYLOAD_KEYS = %w[reset_token unsubscribe_token verification_token download_url].freeze
+    # Payload keys whose values are live credentials, at any depth under `data`.
+    #
+    # Payment session secrets are gateway-agnostic: `external_client_secret` is
+    # a core column and `external_data` is a free-form provider hash, so every
+    # provider that stores a confirmation credential there is covered.
+    #
+    # `token` is the guest cart credential (`X-Spree-Token`), which a placed
+    # order inherits; with it anyone can read and change the cart.
+    SENSITIVE_PAYLOAD_KEYS = %w[
+      token
+      reset_token
+      unsubscribe_token
+      verification_token
+      download_url
+      external_client_secret
+      client_secret
+      ephemeral_key_secret
+    ].freeze
+
+    # A gift card's `code` is what a shopper redeems, so it is spendable by
+    # whoever reads it. Only a gift card's own `code` is redacted — promotion,
+    # country and channel codes elsewhere in a payload are not credentials.
+    GIFT_CARD_CODE_KEY = 'code'
+    GIFT_CARD_NODE = 'gift_card'
+    GIFT_CARD_EVENT_PREFIX = 'gift_card.'
 
     REDACTION_PLACEHOLDER = '[REDACTED]'
 
+    # Separates the segments of a secret's path. Segments are escaped before
+    # they are joined, so a key that itself contains the separator still maps
+    # to one unambiguous path.
+    PATH_SEPARATOR = '.'
+
+    # The root both `data` keys share. A payload is persisted as JSON and read
+    # back with string keys, so the symbol and string roots must key their
+    # secrets identically or nothing restores after a round trip.
+    ROOT_SEGMENT = 'data'
+
+    # A path segment escapes the separator so it cannot be read as a boundary,
+    # and the escape character itself so the escaping stays reversible.
+    PATH_ESCAPES = { '\\' => '\\\\', PATH_SEPARATOR => "\\#{PATH_SEPARATOR}" }.freeze
+    PATH_ESCAPES_PATTERN = /[\\#{Regexp.escape(PATH_SEPARATOR)}]/.freeze
+
     # Splits a payload into the version safe to persist and the secrets held
     # back from it.
     #
     # @param payload [Hash] the full event payload
     # @return [Array(Hash, Hash)] redacted payload, and the extracted secrets
-    #   keyed as they appeared under `data`
+    #   keyed by their dotted path under `data`
     def self.split(payload)
       secrets = {}
+      gift_card_event = event_name_of(payload).start_with?(GIFT_CARD_EVENT_PREFIX)
 
       redacted = transform_data_hashes(payload) do |data|
-        data.to_h do |key, value|
-          if SENSITIVE_PAYLOAD_KEYS.include?(key.to_s) && value.present?
-            secrets[secret_key_for(key)] = value
-            [key, REDACTION_PLACEHOLDER]
-          else
-            [key, value]
-          end
-        end
+        redact(data, [ROOT_SEGMENT], secrets, gift_card_event)
       end
 
       secrets.empty? ? [payload, {}] : [redacted, secrets]
@@ -53,12 +88,84 @@ module Spree
       return payload if secrets.blank?
 
       transform_data_hashes(payload) do |data|
-        data.to_h do |key, value|
-          secret = secrets[secret_key_for(key)]
-          [key, secret.presence || value]
+        restore(data, [ROOT_SEGMENT], secrets)
+      end
+    end
+
+    # Walks a hash replacing sensitive values, recording each one against its
+    # path so two secrets sharing a key name (`client_secret` at the top level
+    # and inside `external_data`) cannot overwrite one another.
+    def self.redact(node, path, secrets, gift_card_event = false)
+      if node.is_a?(Array)
+        return node.each_with_index.map { |element, index| redact(element, path + [index.to_s], secrets, gift_card_event) }
+      end
+      return node unless node.is_a?(Hash)
+
+      node.to_h do |key, value|
+        key_path = path + [key.to_s]
+
+        if sensitive?(key, value) || gift_card_code?(key, value, path, gift_card_event)
+          secrets[secret_key_for(key_path)] = value
+          [key, REDACTION_PLACEHOLDER]
+        else
+          [key, redact(value, key_path, secrets, gift_card_event)]
         end
       end
     end
+    private_class_method :redact
+
+    # The mirror of {redact}. Only a slot still holding the placeholder is
+    # filled, so a real value the payload carries is never overwritten.
+    #
+    # Deliveries enqueued before path keying shipped carry secrets under a bare
+    # key name. Those only ever came from the top level of `data`, so the
+    # fallback is confined there — at depth it would fill every same-named slot
+    # in the tree with one secret.
+    def self.restore(node, path, secrets)
+      if node.is_a?(Array)
+        return node.each_with_index.map { |element, index| restore(element, path + [index.to_s], secrets) }
+      end
+      return node unless node.is_a?(Hash)
+
+      node.to_h do |key, value|
+        key_path = path + [key.to_s]
+        next [key, restore(value, key_path, secrets)] unless value == REDACTION_PLACEHOLDER
+
+        secret = secrets[secret_key_for(key_path)]
+        secret ||= secrets[key.to_s] if path.one?
+
+        [key, secret.presence || value]
+      end
+    end
+    private_class_method :restore
+
+    def self.sensitive?(key, value)
+      SENSITIVE_PAYLOAD_KEYS.include?(key.to_s) && scalar?(value)
+    end
+    private_class_method :sensitive?
+
+    # The `code` of a gift card: at the root of a gift card event's data, or
+    # on a `gift_card` node nested in another record (an order or cart that
+    # has one applied).
+    def self.gift_card_code?(key, value, path, gift_card_event)
+      return false unless key.to_s == GIFT_CARD_CODE_KEY && scalar?(value)
+      return true if gift_card_event && path == [ROOT_SEGMENT]
+
+      path.last == GIFT_CARD_NODE
+    end
+    private_class_method :gift_card_code?
+
+    def self.scalar?(value)
+      value.present? && !value.is_a?(Hash) && !value.is_a?(Array)
+    end
+    private_class_method :scalar?
+
+    def self.event_name_of(payload)
+      return '' unless payload.is_a?(Hash)
+
+      (payload[:name] || payload['name']).to_s
+    end
+    private_class_method :event_name_of
 
     # Applies +block+ to every `data` hash on the payload.
     #
@@ -77,11 +184,15 @@ module Spree
     end
     private_class_method :transform_data_hashes
 
-    # Secrets are keyed by name alone. They cross an ActiveJob serialization
+    # Secrets are keyed by path alone. They cross an ActiveJob serialization
     # boundary, which coerces symbol keys to strings, so the key form at split
     # time cannot be relied on to still match at merge time.
-    def self.secret_key_for(key)
-      key.to_s
+    #
+    # Each segment escapes the separator (and the escape character) before the
+    # join, so `['a.b', 'c']` and `['a', 'b', 'c']` stay distinct keys.
+    def self.secret_key_for(path)
+      path.map { |segment| segment.gsub(PATH_ESCAPES_PATTERN) { |character| PATH_ESCAPES[character] } }.
+        join(PATH_SEPARATOR)
     end
     private_class_method :secret_key_for
   end

data/app/models/spree/adjusters/promotion.rb

@@ -113,7 +113,7 @@ module Spree
       def line_item_candidates(line_item)
         @line_item_candidates ||= {}
         @line_item_candidates[line_item.id] ||= discount_actions(:line_item).filter_map do |action|
-          next unless action.promotion.line_item_actionable?(order, line_item)
+          next unless action.applies_to_line_item?(order, line_item)
 
           amount = action.compute_amount(line_item)
           next if amount.zero?

data/app/models/spree/authentication/lockout.rb

@@ -0,0 +1,34 @@
+module Spree
+  module Authentication
+    # The login lockout contract, for every place that checks a secret the
+    # account owner knows. A check that skips it becomes an unthrottled way to
+    # guess the password: a locked account is refused, a miss counts towards
+    # the lockout and a hit clears the count.
+    #
+    # Duck-typed, so a custom user class that implements none of the lockout
+    # hooks is checked without them.
+    module Lockout
+      module_function
+
+      # @param user [Object] the account whose secret is being checked
+      # @yieldreturn [Boolean] whether the secret matched
+      # @return [Symbol] +:locked+, +:valid+ or +:invalid+
+      def check(user)
+        return :locked if user.respond_to?(:locked?) && user.locked?
+
+        if yield
+          # Require the full contract before touching the counter — a custom
+          # user class may implement one hook but not the other.
+          if user.respond_to?(:failed_attempts) && user.respond_to?(:reset_failed_attempts!) &&
+             user.failed_attempts.to_i.positive?
+            user.reset_failed_attempts!
+          end
+          :valid
+        else
+          user.record_failed_attempt! if user.respond_to?(:record_failed_attempt!)
+          :invalid
+        end
+      end
+    end
+  end
+end

data/app/models/spree/authentication/strategies/email_password_strategy.rb

@@ -11,19 +11,11 @@ module Spree
 
           user = find_user_by_email(email)
           return failure('Invalid email or password') unless user
-          return failure('Account temporarily locked. Try again later.') if user.respond_to?(:locked?) && user.locked?
 
-          if validate_password(user, password)
-            # Require the full lockout contract before touching the counter — a
-            # custom customer_class may implement one hook but not the other.
-            if user.respond_to?(:failed_attempts) && user.respond_to?(:reset_failed_attempts!) &&
-               user.failed_attempts.to_i.positive?
-              user.reset_failed_attempts!
-            end
-            success(user)
-          else
-            user.record_failed_attempt! if user.respond_to?(:record_failed_attempt!)
-            failure('Invalid email or password')
+          case Spree::Authentication::Lockout.check(user) { validate_password(user, password) }
+          when :locked then failure('Account temporarily locked. Try again later.')
+          when :valid then success(user)
+          else failure('Invalid email or password')
           end
         rescue => e
           Rails.logger.error "EmailPasswordStrategy authentication failed: #{e.message}"

data/app/models/spree/authentication/strategies/oidc_strategy.rb

@@ -223,7 +223,7 @@ module Spree
         end
 
         def identity_info(claims)
-          claims.slice('email', 'name', 'gisel_name', 'family_name', 'picture')
+          claims.slice('email', 'name', 'given_name', 'family_name', 'picture')
         end
 
         # The key this provider is registered under — used as UserIdentity#provider

data/app/models/spree/claim.rb

@@ -33,6 +33,7 @@ module Spree
     has_many :claim_line_items, class_name: 'Spree::ClaimLineItem',
                                 dependent: :destroy, inverse_of: :claim
     has_many :refunds, class_name: 'Spree::Refund', as: :originator, dependent: :nullify
+    has_many :store_credits, class_name: 'Spree::StoreCredit', as: :originator, dependent: :nullify
 
     validates :claim_line_items, presence: true, on: :create
     validates :resolution, inclusion: { in: RESOLUTIONS }, allow_nil: true

data/app/models/spree/commission_line.rb

@@ -61,8 +61,10 @@ module Spree
     scope :for_line_items, -> { where.not(line_item_id: nil) }
     scope :for_fulfillments, -> { where.not(fulfillment_id: nil) }
 
-    self.whitelisted_ransackable_attributes = %w[amount tax_amount total currency kind rate]
-    self.whitelisted_ransackable_associations = %w[order seller commission_rate]
+    self.whitelisted_ransackable_attributes = %w[amount tax_amount total currency kind rate order_id]
+    # No `order`: filtering through it reaches the buyer's email and address,
+    # which a commissions-only caller may not read. `order_id` covers the lookup.
+    self.whitelisted_ransackable_associations = %w[seller commission_rate]
 
     extend Spree::DisplayMoney
     money_methods :amount, :tax_amount, :total

data/app/models/spree/commission_rule.rb

@@ -16,7 +16,7 @@ module Spree
   class CommissionRule < Spree.base_class
     include Spree::PreferenceSchema
 
-    has_prefix_id :crule
+    has_prefix_id :comrule
 
     # Retired rather than deleted, with its rate or on its own as an operator
     # edits a rate's conditions. A commission line is a settlement record, and

data/app/models/spree/coupon_code.rb

@@ -10,6 +10,7 @@ module Spree
 
     scope :used_with_code, ->(code) { used.where(code: code.downcase) }
     scope :with_order, ->(order_id) { where(order_id: order_id) }
+    scope :held_by, ->(owner) { owner.is_a?(Spree::Cart) ? where(cart_id: owner.id) : where(order_id: owner.id) }
     scope :in_promotions, ->(promotion_ids) { where(promotion_id: promotion_ids) }
     scope :not_in_promotions, ->(promotion_ids) { where.not(promotion_id: promotion_ids) }
 
@@ -38,9 +39,20 @@ module Spree
       used_with_code(code).any?
     end
 
+    # Attaches the code to the cart or order presenting it. The code is not
+    # spent here: it stays unused until an order is placed with it, so a code
+    # left on an abandoned cart can still be presented by someone else.
+    #
+    # @param owner [Spree::Cart, Spree::Order]
+    # @return [Boolean]
     def apply_order!(owner)
-      owner_key = owner.is_a?(Spree::Cart) ? :cart : :order
-      update(owner_key => owner, state: 'used')
+      cart = owner.is_a?(Spree::Cart) ? owner : nil
+      update(cart: cart, order: cart ? nil : owner)
+    end
+
+    # @return [Spree::Cart, Spree::Order, nil] the record currently holding this code
+    def holder
+      cart || order
     end
 
     def remove_from_order

data/app/models/spree/current.rb

@@ -5,6 +5,10 @@ module Spree
   # Fallback chains ensure sensible defaults when attributes are not explicitly set.
   class Current < ::ActiveSupport::CurrentAttributes
     attribute :store, :channel, :market, :currency, :locale, :content_locale, :tax_country, :price_lists, :applicable_catalogs, :applicable_catalog_groups, :quantity_rules_resolvers, :standing_companies, :global_pricing_context, :provider_cache, :integrations
+    # Latch for the cross-store leak tripwire — see #store= below. Lives here
+    # so it clears exactly when the store context does, which Rails does per
+    # request and per job.
+    attribute :store_scope_guard_armed
 
     # Scratch space for provider strategies to memoize a call across the
     # request — part of the delivery rate provider contract (nothing in core
@@ -17,6 +21,17 @@ module Spree
       super || (self.provider_cache = {})
     end
 
+    # Declaring a store context arms the cross-store leak tripwire for the
+    # rest of this unit of work — a request, a job, a webhook — so the guard
+    # follows the context rather than a list of entry points
+    # (docs/plans/6.0-store-context-and-first-run-setup.md). Work that never
+    # declares a store is left alone: it reads the default store through the
+    # fallback below, which is not a scoping claim to check.
+    def store=(value)
+      Spree::StoreScopeGuard.arm! if value
+      super
+    end
+
     # Returns the current store, falling back to the default store.
     # @return [Spree::Store]
     def store

data/app/models/spree/exchange.rb

@@ -32,6 +32,7 @@ module Spree
     has_many :exchange_line_items, class_name: 'Spree::ExchangeLineItem',
                                    dependent: :destroy, inverse_of: :exchange
     has_many :refunds, class_name: 'Spree::Refund', as: :originator, dependent: :nullify
+    has_many :store_credits, class_name: 'Spree::StoreCredit', as: :originator, dependent: :nullify
 
     validates :exchange_line_items, presence: true, on: :create
 

data/app/models/spree/export.rb

@@ -192,12 +192,13 @@ module Spree
         raise SellerScopeUnavailable, model_class unless model_class.respond_to?(:for_seller)
 
         scope = scope.for_seller(seller)
-        # A draft is either a checkout in flight or the operator's working
-        # document, and is not this seller's sale — the same exclusion every
-        # endpoint on the seller branch applies.
-        scope = scope.not_drafts if model_class.respond_to?(:not_drafts)
       end
 
+      # A draft is either a checkout in flight or the operator's working
+      # document, not a sale — the orders list and every seller endpoint leave
+      # drafts out too.
+      scope = scope.not_drafts if model_class.respond_to?(:not_drafts)
+
       # A staff-created export only contains what its creator may read; a
       # userless export (console, system jobs) is unfiltered.
       scope = scope.accessible_by(current_ability) if user.present?
@@ -219,7 +220,9 @@ module Spree
                                 [scope, params]
                               end
 
-      filtered_scope.ransack(params).result
+      # A seller's export filters as the seller's own listings do, so a
+      # condition on data the seller cannot read (the buyer's email) is ignored.
+      filtered_scope.ransack(params, auth_object: seller_id.present? ? :seller : nil).result
     end
 
     # `search_params` as a Hash — whether it is still the Hash a caller