spree_core 6.0.0.rc2 → 6.0.0.rc4

data/lib/spree/agent_tools/workflow_tool.rb

@@ -0,0 +1,654 @@
+module Spree
+  module AgentTools
+    # One agent tool per exposed workflow.
+    #
+    # Every back-office write already goes through a workflow, so there is
+    # nothing to hand-write: the allowlist names a `Spree::Dependencies` key
+    # and a permission, {WorkflowSchema} reads the argument contract off the
+    # workflow's own `perform`, and this class resolves the arguments, injects
+    # the principal, takes the lock the controller takes and shapes the result.
+    #
+    # Generated classes are anonymous subclasses cached per dependency key, so
+    # a host app that swaps `Spree.order_cancel_workflow` for its own class
+    # keeps the tool and gets the replacement's schema.
+    class WorkflowTool < Spree::AgentTool
+      class_attribute :dependency_key, instance_accessor: false
+      class_attribute :schema_except, instance_accessor: false, default: [].freeze
+      class_attribute :summary_override, instance_accessor: false
+
+      class << self
+        # Builds (and caches) the tool class for one exposed workflow.
+        #
+        # @param dependency_key [Symbol] a `Spree::Dependencies` key
+        # @param permission [String] the `write_*` key gating it
+        # @param except [Array<Symbol>] parameters to hide
+        # @param summary [#call, nil] overrides the generated confirmation line
+        # @return [Class<WorkflowTool>, nil] nil when the key does not resolve
+        def for(dependency_key, permission:, except: [], summary: nil)
+          workflow_class = resolve_workflow(dependency_key)
+          return if workflow_class.nil?
+
+          # Keyed by what actually shapes the class, including the workflow's
+          # own source location and mtime: a tool's parameters are read off
+          # `perform`, so editing a workflow in development has to produce a
+          # new tool rather than serve the schema built before the reload.
+          # That is the same reason the registry stores names and not classes.
+          #
+          # A summary override is a callable with no stable identity, so its
+          # presence is part of the key but the object is not — otherwise
+          # every reload would leave a permanent entry behind.
+          cache_key = [dependency_key, workflow_class.name, source_fingerprint(workflow_class),
+                       permission, except, !summary.nil?]
+          cached = cache[cache_key]
+          return cached if cached && cached.summary_override.equal?(summary)
+
+          cache[cache_key] = build(dependency_key, workflow_class, permission, except, summary)
+        end
+
+        # @return [void]
+        def clear_cache!
+          @cache = {}
+        end
+
+        # Identifies the source a tool's schema was read from, so an edit in
+        # development invalidates the generated class. Nil in a packaged gem
+        # whose source is not on disk, which simply means the key never
+        # changes there — correct, since the source cannot change either.
+        #
+        # @return [Array, nil]
+        def source_fingerprint(workflow_class)
+          file, = workflow_class.instance_method(:perform).source_location
+          return if file.nil?
+
+          [file, File.mtime(file)]
+        rescue StandardError
+          nil
+        end
+
+        # The tool name for a dependency key: the workflow's dotted identity
+        # with dots as underscores, because MCP names allow only letters,
+        # digits, underscore and hyphen.
+        #
+        # @param workflow_class [Class]
+        # @return [String]
+        def tool_name_for(workflow_class)
+          workflow_class.workflow_key.tr('.', '_')
+        end
+
+        # @return [Class, nil]
+        def resolve_workflow(dependency_key)
+          Spree.public_send(dependency_key)
+        rescue NoMethodError, NameError
+          nil
+        end
+
+        # The workflow's own leading comment, first paragraph — what the class
+        # says it does, in the author's words rather than a second description
+        # kept in step by hand.
+        #
+        # @param workflow_class [Class]
+        # @return [String]
+        def description_for(workflow_class)
+          paragraph = leading_comment(workflow_class)
+          return "Runs the #{workflow_class.workflow_key.tr('.', ' ')} workflow." if paragraph.blank?
+
+          paragraph
+        end
+
+        private
+
+        def cache
+          @cache ||= {}
+        end
+
+        def build(dependency_key, workflow_class, permission_key, except, summary)
+          derived_schema = WorkflowSchema.new(workflow_class, except: except)
+          derived_name = tool_name_for(workflow_class)
+          derived_description = description_for(workflow_class)
+
+          Class.new(self) do
+            self.dependency_key = dependency_key
+            self.schema_except = except.freeze
+            self.summary_override = summary
+
+            tool_name derived_name
+            description derived_description
+            permission permission_key
+            mutating!
+
+            derived_schema.parameters.each do |parameter|
+              param parameter[:name],
+                    type: parameter[:json_type].to_sym,
+                    items: parameter[:item_type]&.to_sym,
+                    description: parameter[:description],
+                    required: parameter[:required]
+            end
+          end
+        end
+
+        def leading_comment(workflow_class)
+          location = Object.const_source_location(workflow_class.name)
+          return if location.nil?
+
+          file, line = location
+          return unless file && File.exist?(file)
+
+          lines = File.readlines(file)
+          comment = []
+          index = line - 2
+          while index >= 0 && lines[index].strip.start_with?('#')
+            comment.unshift(lines[index].strip.delete_prefix('#').strip)
+            index -= 1
+          end
+          # First paragraph only — the rest is design rationale for readers of
+          # the class, not for a model choosing between tools.
+          comment.take_while(&:present?).join(' ').presence
+        end
+      end
+
+      # @return [Class] the workflow this tool runs, resolved now so a host
+      #   app's replacement is picked up without a restart
+      def workflow_class
+        self.class.resolve_workflow(self.class.dependency_key)
+      end
+
+      # @return [WorkflowSchema]
+      def schema
+        @schema ||= WorkflowSchema.new(workflow_class, except: self.class.schema_except)
+      end
+
+      # Runs the workflow with the caller's arguments.
+      #
+      # Model-typed arguments arrive as prefixed ids and are resolved through
+      # the resource map under the context's store, so another store's id is
+      # simply not found. Principal parameters are never accepted from the
+      # caller — they are filled from the authenticated principal.
+      #
+      # @return [Hash] the result handed back to the model
+      def call(**arguments)
+        resolved = resolve_arguments(arguments)
+        return resolved if resolved.is_a?(Hash) && resolved[:error]
+
+        # The endpoint runs this workflow behind its own routing,
+        # authentication, authorization and serializer, so when there is one
+        # the request goes through it rather than beside it.
+        return dispatch(resolved) if endpoint
+
+        refusal = unauthorized_create || unauthorized_record(resolved)
+        return refusal if refusal
+
+        keywords = resolved.merge(principal_arguments).merge(context_arguments)
+
+        run(keywords, subject: subject_record(resolved))
+      rescue ArgumentError => e
+        { error: e.message }
+      end
+
+      # @return [Spree::AgentTools::WorkflowEndpoints::Entry, nil]
+      def endpoint
+        return @endpoint if defined?(@endpoint)
+
+        @endpoint = WorkflowEndpoints.find(self.class.dependency_key)
+      end
+
+      # One line saying what this tool did, for the client's confirmation
+      # prompt and the assistant's approval card.
+      #
+      # @param arguments [Hash]
+      # @return [String]
+      def summary(arguments, subject: nil)
+        return self.class.summary_override.call(context, arguments) if self.class.summary_override
+
+        action = workflow_class.workflow_key.tr('.', ' ').humanize
+        subject ||= subject_record(arguments)
+        [action, label_for(subject)].compact.join(' ')
+      end
+
+      private
+
+      # Runs the workflow by calling the operation that runs it.
+      #
+      # The path's `:id` is the record the write is about; a parent segment
+      # (`:order_id` on a payment) is read from that record rather than asked
+      # for, since the caller named the payment and the order follows from it.
+      # Everything else travels in the body under the name the endpoint
+      # documents, which is not always the workflow's keyword — a
+      # cancellation's `note:` is `cancel_note` on the wire.
+      def dispatch(resolved)
+        subject = subject_record(resolved)
+        path, missing = endpoint_path(subject, resolved)
+        return { error: missing } if missing
+
+        response = ApiDispatch.new(context).call(
+          method: endpoint.verb.downcase.to_sym, path: path, body: dispatch_body(resolved)
+        )
+        return { error: response.error_message } unless response.success?
+
+        { summary: summary(resolved, subject: subject),
+          record: payload_summary(response.data) }.compact
+      end
+
+      def endpoint_path(subject, resolved)
+        values = {}
+
+        endpoint.path_params.each do |segment|
+          record = segment == 'id' ? subject : parent_for(segment, subject, resolved)
+          return [nil, "This tool needs a #{segment.sub(/_id\z/, '').humanize.downcase} it was not given."] if
+            record.nil?
+
+          values[segment] = record.prefixed_id
+        end
+
+        [endpoint.path_for(values), nil]
+      end
+
+      # A parent segment names an association: `:order_id` on a payment is
+      # `payment.order`. A record the caller named for that association is
+      # preferred, so a split payment is refunded against the order the
+      # caller meant.
+      def parent_for(segment, subject, resolved)
+        name = segment.sub(/_id\z/, '')
+        named = resolved[name.to_sym]
+        return named if named.is_a?(ActiveRecord::Base)
+
+        from_subject = subject.try(name)
+        return from_subject if from_subject
+
+        # A keyword whose name does not match the segment but whose record is
+        # what the segment addresses: a label's `owner:` is the fulfillment in
+        # `/fulfillments/:fulfillment_id`, and the same tool reaches a return
+        # through `/returns/:return_id`.
+        records(resolved).find { |record| record.class.name.demodulize.underscore == name }
+      end
+
+      # What the operation accepts, under its own names. A record resolved for
+      # a path segment is already in the path; anything else the endpoint does
+      # not document is left out rather than sent and ignored.
+      def dispatch_body(resolved)
+        accepted = endpoint.body_keys
+        return {} if accepted.empty?
+
+        resolved.each_with_object({}) do |(name, value), body|
+          # An `attributes` hash is not a field of the body — it IS the body.
+          # The endpoint documents its keys one by one, so it merges in
+          # rather than travelling under a name of its own.
+          if name.to_s == 'attributes' && value.is_a?(Hash)
+            body.merge!(value.transform_keys(&:to_s))
+            next
+          end
+
+          key = body_key_for(name, accepted)
+          next if key.nil?
+
+          body[key] = value.is_a?(ActiveRecord::Base) ? value.prefixed_id : value
+        end
+      end
+
+      # The endpoint's name for a workflow keyword.
+      #
+      # Exact first, then the `_id` form a record takes on the wire. Failing
+      # both, the one accepted key that ENDS in the keyword: a cancellation's
+      # `reason:` is `cancel_reason_id` and its `note:` is `cancel_note`,
+      # qualified by the action rather than the resource. Matched on the
+      # suffix rather than by guessing the qualifier, and only when exactly
+      # one key matches — two would make the choice a coin toss, and a
+      # silently misplaced value is worse than a refusal.
+      def body_key_for(name, accepted)
+        exact = [name.to_s, "#{name}_id"].find { |candidate| accepted.include?(candidate) }
+        return exact if exact
+
+        suffixed = accepted.select { |key| key.end_with?("_#{name}", "_#{name}_id") }
+        suffixed.first if suffixed.one?
+      end
+
+      # A record as the endpoint returned it, summarised the way a record read
+      # from the map would be.
+      def payload_summary(data)
+        return unless data.is_a?(Hash)
+
+        entry = ResourceMap.all.find { |candidate| candidate.key == data['object'] } ||
+                subject_entry
+        return { id: data['id'] } if entry.nil?
+
+        RecordSummary.from_payload(entry: entry, payload: data)
+      end
+
+      # Holding `write_orders` says an admin may change orders; it does not say
+      # they may change *this* one. A host app narrows that with a
+      # record-level rule, the Admin API honours it, and a workflow tool must
+      # too — otherwise an agent writes records its user could not touch by
+      # clicking. Every record the workflow was handed is checked, not just the
+      # subject, since a cancellation reason from another seller is as much a
+      # leak as the order itself.
+      def unauthorized_record(arguments)
+        # A create's own action is checked against the class above; the records
+        # it was handed are collaborators (a supplier, a stock location), so
+        # they are checked for the read-and-use they actually get.
+        action = ability_action == :create ? :show : ability_action
+
+        records(arguments).each do |record|
+          refusal = unauthorized(action, record)
+          return refusal if refusal
+        end
+
+        nil
+      end
+
+      # A create workflow has no record to check yet — the workflow builds it
+      # — so the Admin API's `authorize_resource!(@resource, :create)` has no
+      # counterpart here. Authorize against the class instead, which is what a
+      # record-level rule on a create would be evaluated against anyway.
+      #
+      # @return [Hash, nil]
+      def unauthorized_create
+        return unless ability_action == :create
+
+        # A key whose model does not resolve leaves nothing to authorize
+        # against, and `can?(:create, nil)` answers true — so the check would
+        # pass for exactly the workflow nobody can vouch for. The attribute
+        # filter is keyed off the same lookup and would also fall open, which
+        # is the tenancy hole it exists to close.
+        model = created_model
+        return { error: 'This tool cannot be used: its workflow names a resource that does not exist.' } if model.nil?
+        return if context.can?(:create, model)
+
+        { error: "You do not have permission to create this #{model.model_name.human.downcase}." }
+      end
+
+      # What the workflow creates, named by its own key: `products.create`
+      # creates a product. A key whose model cannot be resolved falls back to
+      # the subject check alone rather than guessing.
+      #
+      # @return [Class, nil]
+      def created_model
+        @created_model ||= "Spree::#{workflow_class.workflow_key.split('.').first.classify}".safe_constantize
+      end
+
+      # Which CanCanCan action this workflow amounts to. The stock catalog
+      # grants writes as `:manage`, which covers everything — but an ability
+      # may be replaced, and a host app that grants `:update` without
+      # `:destroy` means it: a deletion checked as an update would go through.
+      #
+      # @return [Symbol]
+      def ability_action
+        case workflow_class.workflow_key.split('.').last
+        when 'destroy' then :destroy
+        when 'create' then :create
+        else :update
+        end
+      end
+
+      # Only what the caller named. The store and the principal are injected
+      # from the credential, so checking them would ask whether the caller may
+      # "update" their own store or their own user — which an order-desk role
+      # legitimately may not, and which has nothing to do with the write they
+      # actually asked for.
+      def records(arguments)
+        arguments.values.select { |value| value.is_a?(ActiveRecord::Base) }
+      end
+
+      # The record the write is about, for the lock and the confirmation line.
+      def subject_record(arguments)
+        records(arguments).first
+      end
+
+      def run(keywords, subject: nil)
+        result = with_subject_lock(subject) { workflow_class.call(**keywords) }
+
+        if result.success?
+          { summary: summary(keywords, subject: result.value.is_a?(ActiveRecord::Base) ? result.value : subject),
+            record: record_result(result.value) }
+        else
+          { error: error_text(result) }
+        end
+      end
+
+      # The same row lock the admin controllers take for an order-subject
+      # workflow. Taken generically: whichever record the workflow is acting
+      # on is the one that must not change underneath it.
+      def with_subject_lock(subject, &)
+        return yield unless subject.respond_to?(:with_lock) && subject.persisted?
+
+        subject.with_lock(&)
+      end
+
+      def record_result(value)
+        return unless value.is_a?(ActiveRecord::Base)
+
+        entry = ResourceMap.all.find { |candidate| value.is_a?(candidate.model_class) }
+        return { id: value.try(:prefixed_id) } if entry.nil?
+
+        RecordSummary.call(entry: entry, record: value)
+      end
+
+      # The workflow's own refusal, in its own words, so the model can correct
+      # itself instead of retrying blind.
+      def error_text(result)
+        error = result.error
+        errors = error.respond_to?(:value) ? error.value : error
+
+        return errors.full_messages.to_sentence if errors.respond_to?(:full_messages) && errors.any?
+        return error.to_s if error.present?
+
+        'The workflow refused the change.'
+      end
+
+      # Who acted, for the workflow keywords that record it.
+      #
+      # Only where the record can actually hold this principal. Several
+      # models still declare `created_by` / `reviewed_by` as a plain
+      # `belongs_to` on the admin-user class rather than through `acted_by`,
+      # and handing those an API key raises AssociationTypeMismatch deep
+      # inside the workflow — a protocol-level failure where the honest
+      # outcome is simply an unattributed record.
+      def principal_arguments
+        principal = context.principal
+        schema.principal_parameters.
+          select { |name| principal_storable?(name, principal) }.
+          index_with { principal }
+      end
+
+      # @return [Boolean]
+      def principal_storable?(name, principal)
+        association = subject_model&.reflect_on_association(name)
+        return true if association.nil? || association.polymorphic?
+
+        expected = association.klass
+        principal.is_a?(expected)
+      rescue NameError
+        true
+      end
+
+      # The model this workflow writes, for checking what its associations
+      # will accept. Nil when the key names nothing resolvable.
+      def subject_model
+        return @subject_model if defined?(@subject_model)
+
+        @subject_model = created_model
+      rescue StandardError
+        @subject_model = nil
+      end
+
+      # Tenancy comes from the credential, never from a parameter.
+      def context_arguments
+        schema.context_parameters.index_with { context.store }
+      end
+
+      # Turns the caller's JSON arguments into what `perform` expects,
+      # resolving every model-typed parameter from its prefixed id.
+      #
+      # @return [Hash, Hash{Symbol => String}] keywords, or an `{error:}` result
+      def resolve_arguments(arguments)
+        resolved = {}
+
+        schema.parameters.each do |parameter|
+          name = parameter[:name]
+          next unless arguments.key?(name)
+
+          value = arguments[name]
+          next if value.nil?
+
+          if parameter[:model_name]
+            record = find_record(parameter[:model_name], value)
+            return { error: "No #{parameter[:model_name].demodulize.underscore.humanize.downcase} found for #{name} #{value.inspect}." } if record.nil?
+
+            resolved[name] = record
+          elsif parameter[:item_type] == 'object'
+            rows, refusal = resolve_rows(name, value)
+            return refusal if refusal
+
+            resolved[name] = rows
+          elsif parameter[:json_type] == 'object'
+            filtered, refusal = permitted_attributes(value)
+            return refusal if refusal
+
+            resolved[name] = filtered
+          else
+            resolved[name] = value
+          end
+        end
+
+        resolved
+      end
+
+      # Only the attributes the Admin API itself would accept for the record
+      # this workflow writes.
+      #
+      # A workflow is an internal service that has always trusted its caller,
+      # so it assigns the hash it is handed. The REST controllers filter first
+      # — `permitted_params` is a fixed list that never includes a tenancy
+      # key — and a tool must do the same before a workflow sees the payload.
+      # Without it a caller naming `store_id` writes into another merchant's
+      # store, since the workflow assigns the hash after setting tenancy.
+      #
+      # Unknown keys are named back rather than dropped, matching
+      # `ResourceWrite` so a model that guessed a field learns the real one.
+      #
+      # @return [Array(Hash, nil), Array(nil, Hash)]
+      def permitted_attributes(attributes)
+        return [attributes, nil] unless attributes.is_a?(Hash)
+
+        entry = subject_entry
+        if entry.nil?
+          # No entry means no list of what the Admin API would accept, and
+          # forwarding the hash unchecked is what let a caller name
+          # `store_id` and write into another merchant's store.
+          return [nil, { error: 'This tool cannot be used: its resource is not one an agent may write.' }]
+        end
+
+        attributes = attributes.transform_keys(&:to_s)
+        allowed = entry.writable_attribute_names
+        return [attributes, nil] if allowed.blank?
+
+        rejected = attributes.keys - allowed
+        return [attributes, nil] if rejected.empty?
+
+        [nil, { error: "#{entry.key} does not accept #{rejected.to_sentence}. " \
+                       "Accepted attributes: #{allowed.to_sentence}." }]
+      end
+
+      # The map entry for what this workflow writes, which owns the list of
+      # attributes the Admin API accepts for it.
+      #
+      # @return [ResourceMap::Entry, nil]
+      def subject_entry
+        return @subject_entry if defined?(@subject_entry)
+
+        model = created_model || subject_model
+        @subject_entry = model && ResourceMap.all.find { |candidate| candidate.model_name == model.name }
+      rescue StandardError
+        @subject_entry = nil
+      end
+
+      # A list of hashes — a purchase order's or stock transfer's `items:` —
+      # names records by prefixed id inside each row, and the workflow builds
+      # associations from them. Without resolving those the association is
+      # handed a string and the record fails validation with "must exist",
+      # which reads to the model as a bad id rather than a missing step.
+      #
+      # @return [Array(Array<Hash>, nil), Array(nil, Hash)]
+      def resolve_rows(name, value)
+        rows = Array(value).map do |row|
+          next row unless row.is_a?(Hash)
+
+          resolved_row = {}
+          row.each do |field, field_value|
+            model_name = nested_model_name(field)
+
+            if model_name && field_value.is_a?(String)
+              record = find_record(model_name, field_value)
+              if record.nil?
+                return [nil, { error: "No #{field} found for #{field_value.inspect} in #{name}." }]
+              end
+
+              resolved_row[field.to_sym] = record
+            else
+              resolved_row[field.to_sym] = field_value
+            end
+          end
+          resolved_row
+        end
+
+        [rows, nil]
+      end
+
+      # Which model a row's field names, taken from the resource map so only
+      # something the caller may already read can be referenced.
+      #
+      # @return [String, nil]
+      def nested_model_name(field)
+        entry = Spree::AgentTools::ResourceMap.find(field.to_s.pluralize)
+        return unless entry
+        return unless context.permitted?(entry.permission)
+
+        entry.model_class.name
+      end
+
+      # Resolves a prefixed id within the caller's store, through the resource
+      # map — so tenancy is answered the same way every read is.
+      #
+      # A model the map does not hold is one with no store scoping of its own
+      # (a certificate belongs to a company, a submission to a seller). Those
+      # resolve through the mapped parent, so the id still has to belong to
+      # this store; a model with neither is not resolvable and the caller is
+      # told so rather than being handed another store's record.
+      def find_record(model_name, value)
+        relation = store_scoped_relation(model_name)
+        return if relation.nil?
+
+        relation.find_by_prefix_id(value)
+      rescue StandardError
+        nil
+      end
+
+      def store_scoped_relation(model_name)
+        entry = ResourceMap.all.find { |candidate| candidate.model_name == model_name }
+        return entry.scope_for(context) if entry
+
+        parent_scoped_relation(model_name.constantize)
+      end
+
+      # Narrows an unscoped model through whichever of its parents the map
+      # knows, so `certificate` is looked up among this store's companies'
+      # certificates rather than every store's.
+      def parent_scoped_relation(model_class)
+        model_class.reflect_on_all_associations(:belongs_to).each do |association|
+          next if association.polymorphic?
+
+          entry = ResourceMap.all.find { |candidate| candidate.model_name == association.klass.name }
+          next if entry.nil?
+
+          return model_class.where(association.foreign_key => entry.scope_for(context).select(:id))
+        end
+
+        nil
+      end
+
+      def label_for(record)
+        return if record.nil?
+
+        record.try(:number) || record.try(:name) || record.try(:prefixed_id)
+      end
+    end
+  end
+end

data/lib/spree/agent_tools.rb

@@ -0,0 +1,24 @@
+require 'spree/agent_tools/registry'
+require 'spree/agent_tools/context'
+require 'spree/agent_tools/resource_map'
+require 'spree/agent_tools/api_dispatch'
+require 'spree/agent_tools/membership_map'
+require 'spree/agent_tools/workflow_endpoints'
+require 'spree/agent_tools/record_summary'
+require 'spree/agent_tools/workflow_schema'
+require 'spree/agent_tools/workflow_tool'
+require 'spree/agent_tools/default_catalog'
+
+module Spree
+  # The agent-tool contract: what an MCP client or the dashboard assistant may
+  # do on a merchant's behalf, and under whose authority.
+  #
+  # Nothing here talks to a model or a protocol. A tool is a name, a
+  # description, a JSON parameter schema, a permission key, a mutating flag
+  # and an executor — see {Spree::AgentTool} — and the adapters in `spree_mcp`
+  # and the dashboard assistant turn that into their own vocabulary.
+  #
+  # See docs/plans/6.0-mcp-server.md.
+  module AgentTools
+  end
+end

data/lib/spree/core/configuration.rb

@@ -157,7 +157,7 @@ module Spree
       preference :track_inventory_levels, :boolean, default: true, deprecated: 'Set it on the store instead' # Determines whether to track on_hand values for variants / products.
       preference :track_price_history, :boolean, default: true, deprecated: 'Set it on the store instead' # Records price changes for Omnibus Directive compliance. Disable for non-EU stores.
       preference :price_history_retention_days, :integer, default: 30, deprecated: 'Set it on the store instead' # Days to retain price history records. Used by spree:price_history:prune rake task.
-      # SPREE_UPDATE_CHECK_DISABLED turns it off as well.
+      # SPREE_UPDATE_CHECK_DISABLED turns it off as well; it never runs in the test environment or on CI.
       preference :update_check_enabled, :boolean, default: true
       preference :use_user_locale, :boolean, default: true, deprecated: true