spree_core 6.0.0.beta2 → 6.0.0.beta3

data/app/models/spree/promotion/actions/create_line_items.rb

@@ -19,7 +19,33 @@ module Spree
 
         delegate :eligible?, to: :promotion
 
-        # Adds a line item to the Order if the promotion is eligible
+        # @return [Symbol]
+        def discount_scope
+          :line_item
+        end
+
+        # The gift is rarely the product the rules name ("buy a coffee maker,
+        # get a free tote"), so the rules decide whether the promotion applies
+        # and this action decides which lines it pays for.
+        #
+        # @param order [Spree::Order, Spree::Cart]
+        # @param line_item [Spree::LineItem]
+        # @return [Boolean]
+        def applies_to_line_item?(order, line_item)
+          gifted_item?(line_item) && qualifies_beyond_the_gift?(order)
+        end
+
+        # Covers the gifted units of the line at their own price, leaving any
+        # further units of the same variant the shopper bought themselves to be
+        # paid for.
+        #
+        # @param line_item [Spree::LineItem]
+        # @return [BigDecimal] never positive
+        def compute_amount(line_item)
+          line_item.price * gifted_quantity_of(line_item) * -1
+        end
+
+        # Tops the order up to the promised quantity and discounts it.
         #
         # This doesn't play right with Add to Cart events because at the moment
         # the item was added to cart the promo may not be eligible. However it
@@ -32,46 +58,26 @@ module Spree
         #   - Customer increases item quantity to 5 (order total goes to $50)
         #   - Now the order is eligible for the promo and the action should perform
         #
-        # Another complication is when the same line item created by the promo
-        # is also added to cart on a separate action.
-        #
-        # e.g.
-        #   - Promo adds 1 item A to cart if order total greater then $30
-        #   - Customer add 2 items B to cart, current order total is $40
-        #   - This action performs adding item A to cart since order is eligible
-        #   - Customer changes his mind and updates item B quantity to 1
-        #   - At this point order is no longer eligible and one might expect
-        #     that item A should be removed
-        #
-        # It doesn't remove items from the order here because there's no way
-        # it can know whether that item was added via this promo action or if
-        # it was manually populated somewhere else. In that case the item
-        # needs to be manually removed from the order by the customer
+        # A shopper who already has the gift variant is given theirs free rather
+        # than a duplicate, so the promotion still applies when it has nothing
+        # to add.
         def perform(options = {})
           order = options[:order]
           return unless eligible? order
+          return unless qualifies_beyond_the_gift?(order)
 
-          action_taken = false
-          promotion_action_line_items.each do |item|
-            current_quantity = order.quantity_of(item.variant)
-            next unless current_quantity < item.quantity && item_available?(item)
+          added = add_missing_line_items(order)
 
-            add_service = order.is_a?(Spree::Cart) ? Spree.cart_add_item_workflow : Spree.order_add_item_service
-            line_item = add_service.call(**{ (order.is_a?(Spree::Cart) ? :cart : :order) => order },
-                                                         variant: item.variant,
-                                                         quantity: item.quantity - current_quantity).value
-            action_taken = true if line_item.try(:valid?)
-          end
-          action_taken
+          apply_via_adjuster(options) || added
         end
 
         # Called by promotion handler when a promotion is removed
         # This will find any line item matching the ones defined in the PromotionAction
         # and remove the same quantity as was added by the PromotionAction.
-        # Should help to prevent some of cases listed above the #perform method
         def revert(options = {})
           order = options[:order]
           return if eligible?(order)
+          return unless order.promotions.include?(promotion)
 
           action_taken = false
           promotion_action_line_items.each do |item|
@@ -89,13 +95,69 @@ module Spree
         end
 
         # Checks that there's enough stock to add the line item to the order
-        def item_available?(item)
+        #
+        # @param item [Spree::PromotionActionLineItem]
+        # @param quantity [Integer] units wanted, defaulting to the whole gift
+        # @return [Boolean]
+        def item_available?(item, quantity = item.quantity)
           quantifier = Spree::Stock::Quantifier.new(item.variant)
-          quantifier.can_supply? item.quantity
+          quantifier.can_supply? quantity
         end
 
         private
 
+        # Whether this line holds a variant the promotion gives away.
+        def gifted_item?(line_item)
+          gifted_quantity_of(line_item).positive?
+        end
+
+        # A gift cannot be the thing that qualifies the order for the promotion
+        # giving it away: a rule naming the gift's own product would otherwise
+        # hand the item over to anyone who put it in their cart. The order has
+        # to hold a line the rules count with units this action is not already
+        # covering. A promotion with no rules qualifies on anything, so there is
+        # nothing for the gift to stand in for.
+        def qualifies_beyond_the_gift?(order)
+          return true if promotion.promotion_rules.empty?
+
+          order.line_items.any? do |line_item|
+            promotion.line_item_actionable?(order, line_item) &&
+              gifted_quantity_of(line_item) < line_item.quantity
+          end
+        end
+
+        # How many units of this line the promotion pays for — never more than
+        # the line holds, so a shopper buying three of a variant gifted once
+        # still pays for two. `quantity` is nullable and written by `upsert_all`,
+        # which skips validation, so a missing or negative one gifts nothing
+        # rather than raising or turning the discount into a surcharge.
+        #
+        # @param line_item [Spree::LineItem]
+        # @return [Integer]
+        def gifted_quantity_of(line_item)
+          gifted = promotion_action_line_items.detect { |item| item.variant_id == line_item.variant_id }
+          return 0 if gifted.nil?
+
+          [[line_item.quantity, gifted.quantity.to_i].min, 0].max
+        end
+
+        def add_missing_line_items(order)
+          added_results = promotion_action_line_items.map do |item|
+            missing = item.quantity.to_i - order.quantity_of(item.variant)
+            next false unless missing.positive? && item_available?(item, missing)
+
+            add_service = order.is_a?(Spree::Cart) ? Spree.cart_add_item_workflow : Spree.order_add_item_service
+            result = add_service.call(**{ (order.is_a?(Spree::Cart) ? :cart : :order) => order },
+                                      variant: item.variant,
+                                      quantity: missing)
+            result.success?
+          end
+
+          order.line_items.reload if added_results.any?
+
+          added_results.any?
+        end
+
         def promotion_variants_scope
           promotion.store.variants
         end

data/app/models/spree/promotion/rules/category.rb

@@ -21,18 +21,16 @@ module Spree
           'category'
         end
 
-        # Decode prefixed IDs before delegating to the generated setter (direct
-        # calls bypass PrefixedId's assign_attributes auto-resolver).
-        #
-        # Resolved through the promotion's own store, so an id belonging to
-        # another store raises rather than quietly linking — the promotion
-        # would otherwise discount against a catalog its store cannot see.
+        # Resolved through the promotion's own store, prefixed and raw ids
+        # alike, so an id belonging to another store raises rather than
+        # quietly linking — the promotion would otherwise discount against a
+        # catalog its store cannot see.
         def category_ids=(ids)
-          super(Array(ids).map do |id|
-            Spree::PrefixedId.prefixed_id?(id) ? promotion_categories_scope.find_by_param!(id).id : id
-          end)
+          super(ids_within_store(ids, promotion && promotion_categories_scope))
         end
 
+        validate :categories_belong_to_store
+
         #
         # Preferences
         #
@@ -140,6 +138,13 @@ module Spree
           promotion.store.categories
         end
 
+        def categories_belong_to_store
+          return if promotion.nil? || category_ids.empty?
+          return if (category_ids - promotion_categories_scope.where(id: category_ids).ids).empty?
+
+          errors.add(:categories, :invalid)
+        end
+
         # IDs of categories in rule including all their children
         def eligible_category_ids_including_children
           @eligible_category_ids_including_children ||= begin

data/app/models/spree/promotion/rules/product.rb

@@ -15,6 +15,15 @@ module Spree
 
         self.additional_permitted_attributes = [product_ids: []]
 
+        validate :products_belong_to_store
+
+        # Resolved through the promotion's own store, so another store's
+        # product raises rather than being linked and then served back with
+        # its admin data.
+        def product_ids=(ids)
+          super(ids_within_store(ids, promotion&.store&.products))
+        end
+
         #
         # Preferences
         #
@@ -86,11 +95,18 @@ module Spree
           ActiveSupport::Deprecation.warn(
             'Please use `product_ids=` instead.'
           )
-          self.product_ids = s
+          self.product_ids = s.to_s.split(',')
         end
 
         private
 
+        def products_belong_to_store
+          return if promotion.nil? || product_ids.empty?
+          return if (product_ids - promotion.store.products.where(id: product_ids).ids).empty?
+
+          errors.add(:products, :invalid)
+        end
+
         def add_products
           return if product_ids_to_add.nil?
 

data/app/models/spree/promotion.rb

@@ -317,7 +317,7 @@ module Spree
 
     def code_for_order(order)
       if multi_codes?
-        coupon_codes.find_by(order: order)&.code
+        coupon_codes.held_by(order).first&.code
       else
         code
       end

data/app/models/spree/promotion_action.rb

@@ -37,6 +37,17 @@ module Spree
       false
     end
 
+    # Whether this action's line-level discount may land on +line_item+.
+    # Promotion rules narrow it by default; an action that creates its own
+    # lines answers for itself.
+    #
+    # @param order [Spree::Order, Spree::Cart]
+    # @param line_item [Spree::LineItem]
+    # @return [Boolean]
+    def applies_to_line_item?(order, line_item)
+      promotion.line_item_actionable?(order, line_item)
+    end
+
     # Returns true if the promotion action is a free shipping action
     #
     # @return [Boolean]
@@ -53,7 +64,7 @@ module Spree
     def self.types_for_discount_scope(scope)
       case scope
       when :line_item
-        %w[Spree::Promotion::Actions::CreateItemAdjustments Spree::Promotion::Actions::CreateItemAdjustments]
+        %w[Spree::Promotion::Actions::CreateItemAdjustments Spree::Promotion::Actions::CreateLineItems]
       when :fulfillment
         %w[Spree::Promotion::Actions::FreeShipping Spree::Promotion::Actions::FreeShipping]
       when :order

data/app/models/spree/promotion_handler/coupon.rb

@@ -80,8 +80,7 @@ module Spree
           clear_persisted_coupon_code(coupon_code)
 
           if promotion.multi_codes?
-            coupon_code = promotion.coupon_codes.find_by(order: order)
-            coupon_code&.remove_from_order
+            promotion.coupon_codes.held_by(order).first&.remove_from_order
           else
             promotion.touch
           end
@@ -217,7 +216,10 @@ module Spree
         end
 
         if discount || created_line_items
-          handle_coupon_code(discount, coupon_code) if discount
+          if discount && !claim_coupon_code(discount, coupon_code)
+            release_coupon_code(order, coupon_code)
+            return set_error_code :coupon_code_used
+          end
 
           order.recalculate_totals!
           set_success_code :coupon_code_applied
@@ -236,8 +238,51 @@ module Spree
         end
       end
 
-      def handle_coupon_code(discount, coupon_code)
-        Spree::CouponCode.unused.find_by(promotion_id: discount.promotion_id, code: coupon_code)&.apply_order!(order)
+      # A single-use code is spent only when an order is placed with it, so a
+      # code sitting on another open cart is taken from it rather than
+      # refused: whoever presents it now gets the discount, and whoever places
+      # an order first keeps the code. A cart in the middle of checkout keeps
+      # it, and so does a draft order, since its totals are fixed and money
+      # may already be at the gateway.
+      #
+      # The holder is locked before the code, the same order checkout takes
+      # them in, so the two serialize instead of deadlocking.
+      #
+      # @return [Boolean] false when the code can no longer be claimed
+      def claim_coupon_code(discount, coupon_code)
+        record = Spree::CouponCode.find_by(promotion_id: discount.promotion_id, code: coupon_code)
+        return true if record.nil?
+
+        holder = record.holder
+        holder = nil if holder && same_record?(holder, order)
+
+        Spree::CouponCode.transaction do
+          holder&.lock!
+          record.lock!
+          next false if record.used? || !same_holder?(record.holder, holder) || !releasable?(holder)
+
+          release_coupon_code(holder, coupon_code) if holder
+          record.apply_order!(order)
+        end
+      end
+
+      # Gift cards are turned off so a holder paying with one keeps it.
+      def release_coupon_code(holder, coupon_code)
+        self.class.new(holder, enable_gift_cards: false).remove(coupon_code)
+      end
+
+      def releasable?(holder)
+        return true if holder.nil?
+
+        holder.is_a?(Spree::Cart) && holder.completed_at.nil? && !holder.completion_claimed?
+      end
+
+      def same_record?(holder, other)
+        holder.class == other.class && holder.id == other.id
+      end
+
+      def same_holder?(current, expected)
+        current.nil? || same_record?(current, expected || order)
       end
 
       # Whether the coupon handler should also handle gift card codes.

data/app/models/spree/promotion_rule.rb

@@ -55,6 +55,20 @@ module Spree
 
     private
 
+    # Resolves ids, prefixed or raw, through the promotion's store, so another
+    # store's record raises instead of being linked. A rule built before its
+    # promotion is known passes the ids through; its validation checks them.
+    #
+    # @param ids [Array<String, Integer>]
+    # @param scope [ActiveRecord::Relation, nil] the store's records
+    # @return [Array<Integer>]
+    def ids_within_store(ids, scope)
+      ids = Array(ids).reject(&:blank?)
+      return ids if scope.nil?
+
+      ids.map { |id| Spree::PrefixedId.prefixed_id?(id) ? scope.find_by_param!(id).id : scope.find(id).id }
+    end
+
     def eligibility_error_message(key, options = {})
       Spree.t(key, Hash[scope: [:eligibility_errors, :messages]].merge(options))
     end

data/app/models/spree/return.rb

@@ -111,21 +111,31 @@ module Spree
       end
     end
 
+    # Whether the warehouse has reported on this return.
+    #
+    # @return [Boolean]
+    def counted?
+      received? || refunded?
+    end
+
     # What the customer is owed for the items being returned.
     def refund_total
-      return_line_items.sum(&:pre_tax_amount)
+      return_line_items.sum(&:refund_amount)
     end
 
-    # What a refund from this return paid for, line by line. Counts what the
-    # warehouse received rather than what the customer announced, so it agrees
-    # with the amount {Spree::Returns::Refund} works out for itself.
+    # What a refund from this return paid for, line by line. Only ever what
+    # the warehouse counted: the seller's clawback is built from this, and a
+    # line nobody counted earned nothing back.
     #
     # @return [Hash{Integer => BigDecimal}] line item id => amount
     def refunded_line_amounts
+      return {} unless counted?
+
       return_line_items.each_with_object(Hash.new(0)) do |line, amounts|
-        next if line.quantity.to_i.zero? || line.received_quantity.to_i.zero?
+        amount = line.refund_amount
+        next if amount.zero?
 
-        amounts[line.line_item_id] += (line.pre_tax_amount / line.quantity) * line.received_quantity.to_i
+        amounts[line.line_item_id] += amount
       end
     end
 

data/app/models/spree/return_line_item.rb

@@ -19,6 +19,25 @@ module Spree
 
     delegate :order, :currency, to: :return
 
+    # What this line refunds. Once the warehouse has counted, only the units
+    # that arrived are paid for — a customer who announced three and sent two
+    # is owed two — and before the count there is nothing to go on but the
+    # announced quantity.
+    #
+    # Rounded to the currency, because this is the ceiling a refund is checked
+    # against as well as the figure the dialog offers: a third of $29.99 taken
+    # three times is not $29.99 until it is.
+    #
+    # @return [BigDecimal]
+    def refund_amount
+      return pre_tax_amount unless self.return.counted?
+      return 0.to_d if quantity.to_i.zero?
+
+      Spree::Money::Rounding.to_currency(
+        (pre_tax_amount / quantity) * received_quantity.to_i, currency
+      )
+    end
+
     def display_pre_tax_amount
       Spree::Money.new(pre_tax_amount, currency: currency)
     end

data/app/models/spree/search_provider/database.rb

@@ -7,6 +7,14 @@ module Spree
         'best_selling' => :by_best_selling
       }.freeze
 
+      # @param store [Spree::Store]
+      # @param audience [Symbol, nil] who filters: `:store` (shoppers) limits
+      #   filters to what the storefront may query; `nil` is the back office
+      def initialize(store, audience: :store)
+        super(store)
+        @audience = audience
+      end
+
       def search_and_filter(scope:, query: nil, filters: {}, sort: nil, page: 1, limit: 25)
         filters = filters.is_a?(Hash) ? filters.dup : {}
         option_value_ids = filters.delete('with_option_value_ids') || filters.delete(:with_option_value_ids)
@@ -72,7 +80,7 @@ module Spree
 
         ransack_filters = sanitize_filters(filters)
         if ransack_filters.present?
-          search = scope.ransack(ransack_filters)
+          search = scope.ransack(ransack_filters, auth_object: @audience)
           scope = search.result(distinct: true)
         end
 
@@ -127,7 +135,7 @@ module Spree
             end
           }.join(',')
 
-          scope.ransack(s: ransack_sort).result
+          scope.ransack({ s: ransack_sort }, auth_object: @audience).result
         end
       end
 

data/app/models/spree/seller_payout.rb

@@ -58,7 +58,9 @@ module Spree
     scope :owed, -> { where(status: %w[pending processing]) }
 
     self.whitelisted_ransackable_attributes = %w[amount currency status provider reference period_start period_end created_at seller_id]
-    self.whitelisted_ransackable_associations = %w[seller transfers]
+    # No `transfers`: they lead on to the order and its buyer, which a
+    # payouts-only caller may not read.
+    self.whitelisted_ransackable_associations = %w[seller]
 
     extend Spree::DisplayMoney
     money_methods :amount

data/app/models/spree/seller_transfer.rb

@@ -112,7 +112,9 @@ module Spree
     end
 
     self.whitelisted_ransackable_attributes = %w[amount currency kind status provider reference created_at seller_id order_id payout_id]
-    self.whitelisted_ransackable_associations = %w[seller order payout refund]
+    # No `order`: filtering through it reaches the buyer's email and address,
+    # which a payouts-only caller may not read. `order_id` covers the lookup.
+    self.whitelisted_ransackable_associations = %w[seller payout refund]
 
     extend Spree::DisplayMoney
     money_methods :amount

data/app/models/spree/store_credit.rb

@@ -25,6 +25,8 @@ module Spree
     include Spree::DeprecatedCustomerAlias
     belongs_to :created_by, class_name: Spree.admin_user_class.to_s, foreign_key: 'created_by_id', optional: true
     belongs_to :originator, polymorphic: true, optional: true
+    belongs_to :refunded_order, class_name: 'Spree::Order', optional: true,
+                                inverse_of: :store_credit_refunds
 
     has_many :store_credit_events, class_name: 'Spree::StoreCreditEvent'
     has_many :payments, as: :source, class_name: 'Spree::Payment'
@@ -111,6 +113,8 @@ module Spree
     self.whitelisted_ransackable_attributes = %w[customer_id created_by_id amount currency memo]
     self.whitelisted_ransackable_associations = %w[customer created_by]
     self.whitelisted_ransackable_scopes = %w[outstanding from_gift_card]
+    # Staff notes and who issued the credit are back-office data.
+    self.private_ransackable_attributes = { store: %w[memo created_by_id] }
 
     # Two-state scopes: see Spree::Base.ransack_flag? for why the cast is
     # opted out of here and done inside each scope instead.

data/app/models/spree/translations/batch.rb

@@ -38,8 +38,10 @@ module Spree
       attr_reader :records
 
       # @param entries [Array<Hash>] [{ resource_type:, resource_id:, values: { locale => { field => value } } }]
-      def initialize(entries)
+      # @param store [Spree::Store] the store every record must belong to
+      def initialize(entries, store: Spree::Store.current)
         @entries = Array(entries)
+        @store = store
         @records = []
       end
 
@@ -86,7 +88,7 @@ module Spree
         klass = resource_class(entry[:resource_type])
         raise EntryError.new("Unknown translatable resource type: #{entry[:resource_type]}", index) if klass.nil?
 
-        relation = klass.respond_to?(:for_store) ? klass.for_store(Spree::Store.current) : klass
+        relation = klass.respond_to?(:translatable_scope) ? klass.translatable_scope(@store) : klass.for_store(@store)
         relation.find_by_prefix_id!(entry[:resource_id])
       rescue ActiveRecord::RecordNotFound
         raise EntryError.new("Resource not found: #{entry[:resource_id]}", index)

data/app/models/spree/user_identity.rb

@@ -9,15 +9,19 @@ module Spree
 
     validates :provider, inclusion: {
       in: lambda { |_record|
-        (Spree.store_authentication_strategies.keys + Spree.admin_authentication_strategies.keys).uniq.map(&:to_s)
+        (
+          Spree.store_authentication_strategies.keys +
+          Spree.admin_authentication_strategies.keys +
+          Spree.seller_authentication_strategies.keys
+        ).uniq.map(&:to_s)
       }
     }
 
-    # Store provider-specific data
-    # info: JSON field with provider-specific data (name, avatar, etc)
-    # access_token: encrypted OAuth access token
-    # refresh_token: encrypted OAuth refresh token
-    # expires_at: token expiration timestamp
+    # Keys may come from config or from encrypted credentials. Rows written before
+    # encryption was enabled stay readable and are encrypted on their next write.
+    if ActiveRecord::Encryption.config.has_primary_key?
+      encrypts :access_token, :refresh_token, support_unencrypted_data: true
+    end
 
     # Find or create user from OAuth data
     def self.find_or_create_from_oauth(provider:, uid:, info:, tokens: {}, user_class: nil)

data/app/models/spree/variant.rb

@@ -330,6 +330,7 @@ module Spree
                                                  carton_package_type_id carton_weight cartons_per_pallet]
     self.whitelisted_ransackable_scopes = %i(product_name_or_sku_cont search_by_product_name_or_sku search
                                              available_at_stock_location)
+    self.private_ransackable_attributes = { store: %w[cost_price cost_currency deleted_at] }
 
     def self.product_name_or_sku_cont(query)
       sanitized_query = ActiveRecord::Base.sanitize_sql_like(query.to_s.downcase.strip)
@@ -604,8 +605,11 @@ module Spree
     # @param opt_type_position [Integer] the position of the option type
     # @return [void]
     def set_option_value(opt_name, opt_value, opt_type_position = nil)
-      option_type = Spree::OptionType.where(name: opt_name.parameterize).first_or_initialize do |o|
+      # The product's own store: option types are store-owned, and matching one
+      # by name elsewhere would attach and extend another store's type.
+      option_type = Spree::OptionType.for_store(product.store).where(name: opt_name.parameterize).first_or_initialize do |o|
         o.name = o.label = opt_name
+        o.store = product.store
         o.save!
       end
 
@@ -1190,10 +1194,11 @@ module Spree
     end
 
     # Only the product's own store's locations — a new variant must not grow
-    # stock items in every other store's warehouses.
+    # stock items in every other store's warehouses — and of those, a seller's
+    # location only stocks what that seller sells.
     def create_stock_levels
       locations = product&.store ? product.store.stock_locations : StockLocation.all
-      locations.where(propagate_all_variants: true).each do |stock_location|
+      locations.where(propagate_all_variants: true, seller_id: [nil, resolved_seller_id].uniq).each do |stock_location|
         stock_location.propagate_variant(self)
       end
     end

data/app/models/spree/webhook_delivery.rb

@@ -26,6 +26,34 @@ module Spree
     # Ransack configuration
     self.whitelisted_ransackable_attributes = %w[event_name response_code execution_time success delivered_at created_at]
 
+    # Event subjects whose permission is not found by class name alone.
+    PAYLOAD_SUBJECT_CLASSES = {
+      'cart' => 'Spree::Order',
+      'customer' => -> { Spree.customer_class },
+      'newsletter_subscriber' => -> { Spree.customer_class }
+    }.freeze
+
+    # Event subjects whose payload holds no record of anyone's data.
+    PUBLIC_PAYLOAD_SUBJECTS = %w[webhook].freeze
+
+    # The catalog key a caller needs to read this delivery's payload. The
+    # payload is the full record the event is about — an order's addresses, a
+    # customer's email — so reading the log is no wider than reading the
+    # record. A subject no permission scope covers falls back to customer
+    # access, since an unknown payload may hold personal data.
+    #
+    # @return [String, nil] nil when anyone who can read the log may see it
+    def payload_permission_key
+      subject = event_name.to_s.split('.').first.to_s
+      return if PUBLIC_PAYLOAD_SUBJECTS.include?(subject)
+
+      source = PAYLOAD_SUBJECT_CLASSES[subject]
+      klass = source.respond_to?(:call) ? source.call : (source || "Spree::#{subject.camelize}").to_s.safe_constantize
+      scope = Spree.permissions.scope_for_resource(klass)
+
+      scope ? "read_#{scope.name}" : 'read_customers'
+    end
+
     # Check if the delivery was successful
     #
     # @return [Boolean]

data/app/models/spree/webhook_endpoint.rb

@@ -50,11 +50,18 @@ module Spree
     # Number of consecutive failed deliveries before auto-disabling
     AUTO_DISABLE_THRESHOLD = 15
 
+    # Events whose payload carries a live customer credential (a password
+    # reset token). Receiving one is as good as holding the customer's account,
+    # so they reach only an endpoint that names them — never through `*` or a
+    # pattern — and the API asks for customer write access to point one at them.
+    CREDENTIAL_EVENTS = %w[customer.password_reset_requested].freeze
+
     # Check if this endpoint is subscribed to a specific event
     #
     # @param event_name [String] the event name to check
     # @return [Boolean]
     def subscribed_to?(event_name)
+      return subscriptions.to_a.include?(event_name) if CREDENTIAL_EVENTS.include?(event_name)
       return true if subscriptions.blank? || subscriptions.include?('*')
 
       subscriptions.any? do |subscription|
@@ -67,6 +74,13 @@ module Spree
       end
     end
 
+    # Whether this endpoint receives customer credentials.
+    #
+    # @return [Boolean]
+    def receives_credentials?
+      (subscriptions.to_a & CREDENTIAL_EVENTS).any?
+    end
+
     # Returns all events this endpoint is subscribed to
     #
     # @return [Array<String>]