spree_core 6.0.0.rc4 → 6.0.0.rc6

data/app/workflows/spree/payments/capture.rb

@@ -23,6 +23,7 @@ module Spree
         @amount = capture_amount(amount)
 
         step :ensure_capturable
+        step :ensure_within_payment_amount
         # Veto point — fraud holds, manual review. Before any money moves.
         run_hooks :validate
         run_hooks :before_capture
@@ -69,6 +70,17 @@ module Spree
         failure(payment, :payment_not_capturable)
       end
 
+      # A capture takes some or all of what was authorized, never more: a
+      # gateway may let a larger figure through, and the books would then
+      # carry a capture the authorization never covered. Nor nothing, or less
+      # than nothing — every caller gets the same rule, not only the API.
+      def ensure_within_payment_amount
+        failure(payment, :capture_amount_not_positive) unless @amount.positive?
+        return if @amount <= payment.amount
+
+        failure(payment, :capture_exceeds_payment_amount)
+      end
+
       def claim
         halt!(payment) unless payment.started_processing!
       rescue Spree::Core::GatewayError => error

data/app/workflows/spree/products/nested_attributes.rb

@@ -195,6 +195,10 @@ module Spree
       # accumulate copies. Omitting an entry leaves it alone; removal is the
       # nested digital_assets DELETE endpoint's job.
       #
+      # Delegates to the digital asset workflows, so a file written as part of
+      # a product payload passes the same gate — and the same :validate
+      # handlers — as one written through the digital assets endpoint.
+      #
       # @param product [Spree::Product]
       # @param digital_assets_params [Array<Hash>, nil]
       # @return [void]
@@ -203,38 +207,18 @@ module Spree
 
         digital_assets_params.each do |raw|
           attrs = (raw.respond_to?(:to_h) ? raw.to_h : raw).with_indifferent_access
-
           asset_id = attrs.delete(:id)
-          signed_id = attrs.delete(:signed_id)
-          variant_id = attrs.delete(:variant_id)
-
-          # An id patches an existing asset; without one this is a new asset on
-          # the named variant (or the default). A patch for an asset that is
-          # gone is skipped rather than recreated.
-          if asset_id.present?
-            asset = product.digital_assets.find_by_param(asset_id) || next
-          else
-            target = variant_id.present? ? product.variants.find_by_param!(variant_id) : product.default_variant
-            next unless target
 
-            asset = target.digital_assets.build
-          end
-
-          asset.assign_attributes(attrs)
-
-          if signed_id.present?
-            # Attaching never moves a blob between storage services, so a file
-            # uploaded to the public bucket would stay publicly readable. Refuse
-            # it rather than attaching it wrongly.
-            blob = ActiveStorage::Blob.find_signed(signed_id)
-            unless blob && blob.service_name.to_s == Spree.private_storage_service_name.to_s
-              asset.errors.add(:attachment, :digital_assets_attachment_must_be_private, message: I18n.t('spree.digital_assets_attachment_must_be_private'))
-              raise ActiveRecord::RecordInvalid.new(asset)
+          result =
+            if asset_id.present?
+              # A patch for an asset that is gone is skipped rather than recreated.
+              asset = product.digital_assets.find_by_param(asset_id) || next
+              Spree.digital_asset_update_workflow.call(digital_asset: asset, attributes: attrs)
+            else
+              Spree.digital_asset_create_workflow.call(product: product, attributes: attrs)
             end
 
-            asset.attachment.attach(signed_id)
-          end
-          asset.save!
+          raise ActiveRecord::RecordInvalid, result.value if result.failure?
         end
       end
     end

data/app/workflows/spree/products/propose.rb

@@ -13,16 +13,20 @@ module Spree
 
       # @param product [Spree::Product]
       # @param submitted_by [Spree.admin_user_class, nil] who asked
+      # @param reason [String, nil] why a listing already on sale goes back to
+      #   review — what changed on it. Recorded on the submission row. Without
+      #   one, only a draft or a rejected product can be submitted.
       # @return [Spree::ServiceModule::Result] value is the product
-      def perform(product:, submitted_by: nil)
+      def perform(product:, submitted_by: nil, reason: nil)
         super
 
         # Only a listing that is being worked on can be submitted. Guarding
         # `active?` alone let an archived product through — and with
         # auto-approval on, a withdrawn listing went straight back on sale
         # without anybody reviewing it. Re-submitting one already in review
-        # is equally meaningless.
-        unless product.draft? || product.rejected?
+        # is equally meaningless. An active listing reopens review only when
+        # the caller says what changed, which no seller-facing action does.
+        unless product.draft? || product.rejected? || (reason.present? && product.active?)
           reject!(:cannot_propose, message: I18n.t('activerecord.errors.models.spree/product.attributes.base.cannot_propose'))
         end
 
@@ -51,7 +55,8 @@ module Spree
       # one: the trail is how many times this was asked for, and rewriting
       # the last answer would erase that.
       def open_submission
-        product.submissions.create!(status: 'pending', submitted_by: submitted_by)
+        product.submissions.create!(status: 'pending', submitted_by: submitted_by,
+                                    metadata: reason.present? ? { 'reason' => reason } : {})
       end
 
       def auto_approve?

data/app/workflows/spree/stock_levels/bulk_upsert.rb

@@ -35,9 +35,10 @@ module Spree
         # means the later line, not the sum of both.
         deduped = keyed.reverse.uniq { |row| [row[:variant_id].to_s, row[:stock_location_id].to_s] }.reverse
 
+        existing = existing_stock_levels(deduped)
         count = 0
         Spree::StockLevel.transaction do
-          deduped.each { |row| count += 1 if apply_row(row) }
+          deduped.each { |row| count += 1 if apply_row(row, existing) }
         end
 
         success(stock_level_count: count)
@@ -52,27 +53,41 @@ module Spree
       # happens to name — including another merchant's. One caller decoding
       # ids correctly does not make the workflow safe for the next one.
       def resolve(rows)
-        variants = scoped_ids(store_variants, Spree::Variant, rows.map { |row| row[:variant_id] })
-        locations = scoped_ids(store_stock_locations, Spree::StockLocation,
-                               rows.map { |row| row[:stock_location_id] })
+        @variants = scoped_records(store_variants, Spree::Variant, rows.map { |row| row[:variant_id] })
+        @stock_locations = scoped_records(store_stock_locations, Spree::StockLocation,
+                                          rows.map { |row| row[:stock_location_id] })
+        @variants_by_id = @variants.values.index_by(&:id)
+        @stock_locations_by_id = @stock_locations.values.index_by(&:id)
 
         rows.map do |row|
           row.merge(
-            variant_id: variants[row[:variant_id]],
-            stock_location_id: locations[row[:stock_location_id]]
+            variant_id: @variants[row[:variant_id]]&.id,
+            stock_location_id: @stock_locations[row[:stock_location_id]]&.id
           ).compact
         end
       end
 
       # Accepts a prefixed id or a raw one: the Admin API speaks prefixed,
       # while the importer and seeds hold records they already loaded.
-      def scoped_ids(scope, model, values)
+      #
+      # @return [Hash{Object => ActiveRecord::Base}] each value as given => this store's record
+      def scoped_records(scope, model, values)
         decoded = values.compact.uniq.index_with do |value|
           model.decode_own_prefixed_id(value) || value
         end
-        found = scope.where(id: decoded.values.compact).pluck(:id).map(&:to_s).to_set
+        found = scope.where(id: decoded.values.compact).index_by { |record| record.id.to_s }
+
+        decoded.transform_values { |id| found[id.to_s] if id }.compact
+      end
 
-        decoded.transform_values { |id| id if id && found.include?(id.to_s) }
+      # Every shelf the feed names, in one query rather than one per row.
+      # Lowest id wins, as an unordered lookup per pair would return.
+      def existing_stock_levels(rows)
+        Spree::StockLevel.
+          where(variant_id: rows.map { |row| row[:variant_id] }.uniq,
+                stock_location_id: rows.map { |row| row[:stock_location_id] }.uniq).
+          order(id: :desc).
+          index_by { |stock_level| [stock_level.variant_id.to_s, stock_level.stock_location_id.to_s] }
       end
 
       def store_variants
@@ -83,10 +98,10 @@ module Spree
         @store.stock_locations
       end
 
-      def apply_row(row)
-        stock_level = Spree::StockLevel.find_or_initialize_by(
-          variant_id: row[:variant_id], stock_location_id: row[:stock_location_id]
-        )
+      def apply_row(row, existing)
+        stock_level = existing[[row[:variant_id].to_s, row[:stock_location_id].to_s]] || Spree::StockLevel.new
+        stock_level.variant = @variants_by_id.fetch(row[:variant_id])
+        stock_level.stock_location = @stock_locations_by_id.fetch(row[:stock_location_id])
         stock_level.backorderable = row[:backorderable] if row.key?(:backorderable)
         stock_level.save! if stock_level.new_record? || stock_level.changed?
 

data/app/workflows/spree/variants/nested_attributes.rb

@@ -48,6 +48,8 @@ module Spree
         return if prices_params.nil?
 
         currencies = []
+        # Loaded once so each currency's write finds its row in memory.
+        variant.prices.load if variant.persisted?
 
         Array(prices_params).each do |raw|
           price = raw.to_h.with_indifferent_access
@@ -59,7 +61,8 @@ module Spree
 
         return unless variant.persisted?
 
-        variant.prices.base_prices.where.not(currency: currencies).destroy_all
+        stale = variant.prices.select { |price| price.persisted? && price.price_list_id.nil? && currencies.exclude?(price.currency) }
+        variant.prices.destroy(*stale) if stale.any?
       end
 
       # @param variant [Spree::Variant]
@@ -68,22 +71,44 @@ module Spree
       def apply_stock_levels(variant, stock_levels_params)
         return if stock_levels_params.blank?
 
-        Array(stock_levels_params).each do |raw|
-          row = raw.to_h.with_indifferent_access
-          next if row[:stock_location_id].blank?
+        rows = Array(stock_levels_params).map { |raw| raw.to_h.with_indifferent_access }
+        rows.reject! { |row| row[:stock_location_id].blank? }
+        return if rows.empty?
 
-          # Scoped through the product's own store: Spree::StockLocation
-          # lookup is global, so an id belonging to another store would
-          # otherwise put this variant's stock in that store's warehouse.
-          location = stock_location_for(variant, row[:stock_location_id])
+        locations = stock_locations_by_param(variant, rows.map { |row| row[:stock_location_id] })
+        # Loaded once so each row's write finds its level in memory.
+        variant.stock_levels.load if variant.persisted?
+
+        rows.each do |row|
+          location = locations[row[:stock_location_id].to_s]
           next if location.nil?
 
           variant.set_stock(row[:count_on_hand], row[:backorderable], location)
         end
+
+        # A count change locks and reloads its level, so the locations the
+        # response's stock figures read are loaded for every level afterwards.
+        ActiveRecord::Associations::Preloader.new(records: variant.stock_levels.to_a, associations: :stock_location).call
       end
 
-      def stock_location_for(variant, param)
-        variant.product&.store&.stock_locations&.find_by_param(param)
+      # Resolves every stock location the payload names in one read. Scoped
+      # through the product's own store: Spree::StockLocation lookup is
+      # global, so an id belonging to another store would otherwise put this
+      # variant's stock in that store's warehouse. A store keeps few
+      # locations, so loading them beats a lookup per row.
+      #
+      # @return [Hash{String => Spree::StockLocation}] keyed by both the
+      #   prefixed id and the raw id, which is what the payload may carry
+      def stock_locations_by_param(variant, params)
+        scope = variant.product&.store&.stock_locations
+        return {} if scope.nil? || params.empty?
+
+        wanted = params.map(&:to_s).uniq
+        scope.each_with_object({}) do |location, memo|
+          [location.prefixed_id.to_s, location.id.to_s].each do |key|
+            memo[key] = location if wanted.include?(key)
+          end
+        end
       end
     end
   end

data/config/locales/en.yml

@@ -463,6 +463,9 @@ en:
               required_for_carton_purchase_unit: is required when the purchase unit is cartons
         spree/webhook_endpoint:
           attributes:
+            subscriptions:
+              invalid_pattern: 'must hold event names or patterns such as order.* or *.created (rejected: %{entries})'
+              too_many: can hold at most %{count} entries
             url:
               internal_address_not_allowed: must not point to an internal or private network address
               invalid_url: must be a valid http or https URL
@@ -685,6 +688,8 @@ en:
     canceler: Canceler
     cannot_be_destroyed: Order cannot be destroyed.
     capture: Capture
+    capture_amount_not_positive: The capture amount must be greater than zero.
+    capture_exceeds_payment_amount: The capture amount cannot exceed the payment amount.
     cart: Cart
     cart_already_updated: The cart has already been updated.
     cart_completion_in_progress: The cart is being completed. Please retry in a moment.
@@ -765,6 +770,7 @@ en:
     created_at: Created at
     credit_card: Credit Card
     currency: Currency
+    currency_does_not_match_market: must be %{currency}, the currency of the chosen market
     currency_not_supported_by_store: is not supported by this store
     custom_field_definitions: Custom Field Definitions
     custom_fields: Custom Fields
@@ -773,7 +779,9 @@ en:
       anonymize_failed: The erasure could not be completed and nothing was changed
     customers: Customers
     data_request_errors:
+      address_changed: The account's email address changed after this request was made
       already_anonymized: This customer's personal data has already been erased
+      confirmation_invalid: This confirmation link has expired or is no longer valid
       download_unavailable: This download link has expired or is no longer valid
       not_pending: This request has already been processed
     default: Default
@@ -814,6 +822,11 @@ en:
       digital_delivery: Digital Delivery
     digital_assets: Digital assets
     digital_assets_attachment_must_be_private: Upload the file to private storage before attaching it
+    digital_assets_content_type_list_invalid: 'Not a content type: %{types}. Use the type/subtype form, such as application/pdf'
+    digital_assets_content_type_not_accepted: "%{content_type} files are not accepted on this marketplace"
+    digital_assets_provider_takes_no_file: This file is delivered by the marketplace's own system, so a replacement file cannot be uploaded
+    digital_assets_sellers_disabled: This marketplace does not let sellers add or change digital files
+    digital_assets_upload_not_found: The uploaded file could not be found. Upload it again
     discontinued: Discontinued
     discontinued_variants_present: Some line items in this order have products that are no longer available.
     display_delivery_range: Delivery in %{delivery_range} business days
@@ -1016,6 +1029,7 @@ en:
     line_items: Line items
     link: Link
     locale: Locale
+    locale_not_supported_by_market: is not offered by the chosen market
     locale_not_supported_by_store: is not supported by this store
     locales_not_listed: 'includes locales Spree does not support: %{codes}'
     manual: Manual

data/db/migrate/20261022000001_store_credit_actor_polymorphic.rb

@@ -0,0 +1,13 @@
+# Makes a store credit's issuer polymorphic, so a credit issued with a secret
+# API key — a return an integration refunds to store credit — records the key
+# rather than failing. See docs/plans/6.0-action-actors.md.
+class StoreCreditActorPolymorphic < ActiveRecord::Migration[8.1]
+  def change
+    # Nullable with no default: the type is data, filled by
+    # `rake spree:upgrade:backfill_actor_types`. Until it runs, the
+    # transitional reader resolves these rows through the admin user class.
+    add_column :spree_store_credits, :created_by_type, :string
+    add_index :spree_store_credits, [:created_by_type, :created_by_id],
+              name: 'index_spree_store_credits_on_created_by_actor'
+  end
+end

data/db/migrate/20261023100001_add_deactivated_at_to_spree_admin_users.rb

@@ -0,0 +1,7 @@
+# Lets a staff account be switched off without deleting it, so records that
+# name it as their actor keep their history. See Spree::AccountDeactivation.
+class AddDeactivatedAtToSpreeAdminUsers < ActiveRecord::Migration[8.1]
+  def change
+    add_column :spree_admin_users, :deactivated_at, :datetime
+  end
+end

data/lib/generators/spree/dummy/templates/rails/test.rb

@@ -77,4 +77,91 @@ Dummy::Application.configure do
   config.active_record.encryption.key_derivation_salt = 'spree-test-key-derivation-salt'
 
   routes.default_url_options = { host: 'localhost', port: 3000 }
+
+  # An N+1 inside an API request fails the example instead of being logged,
+  # so a serializer or model method that queries once per record cannot land
+  # unnoticed. Wrap a deliberately repeated lookup in Prosopite.pause.
+  if defined?(Prosopite)
+    # Hooked from Spree's own test app rather than declared in the
+    # controller, so a host application that bundles Prosopite for itself is
+    # never opted into Spree's guard. Prepended so the lookups made by the
+    # authentication and parent callbacks are scanned too.
+    config.to_prepare do
+      if defined?(Spree::Api::V3::BaseController)
+        Spree::Api::V3::BaseController.prepend_around_action { |_controller, action| Prosopite.scan(&action) }
+      end
+    end
+
+    Prosopite.rails_logger = true
+    # Raise only under RSpec, where a report belongs to the example that
+    # caused it. The same dummy app serves a real server for the SDK and
+    # browser suites, and there a raise becomes a 500 the client cannot act
+    # on — those runs log instead. SPREE_N_PLUS_ONE_GUARD overrides either
+    # way ('raise', 'log').
+    running_specs = ENV.key?('TEST_ENV_NUMBER') || $PROGRAM_NAME.end_with?('rspec')
+    guard_mode = ENV.fetch('SPREE_N_PLUS_ONE_GUARD') { running_specs ? 'raise' : 'log' }
+    Prosopite.raise = guard_mode == 'raise'
+
+    # The Rails cleaner keeps only the host app's frames, which hides the
+    # serializer or model line that issued the repeated query.
+    Prosopite.backtrace_cleaner = ActiveSupport::BacktraceCleaner.new.tap do |cleaner|
+      cleaner.add_silencer { |line| line.include?('/gems/') || line.include?('/rspec') }
+    end
+
+    # The guard covers what a request reads. Writes run their callbacks one
+    # record at a time by design — a `dependent: :destroy` cascade, a number
+    # or uniqueness probe per created row — so statements issued under a
+    # save or destroy are not reported.
+    Prosopite.allow_stack_paths = [
+      %r{active_record/persistence\.rb:\d+:in '[^']*#(save|save!|destroy|destroy!|touch)'},
+      # A touch is a write too, and Spree overrides `touch` in its own
+      # concern, so the frame is Spree's rather than Active Record's.
+      %r{active_record/timestamp\.rb:\d+:in '[^']*#touch'},
+      %r{/spree/publishable\.rb:\d+:in '[^']*#touch'},
+      %r{/paranoia\.rb:\d+:in '[^']*destroy'},
+      # Validations run before the persistence frame starts, so a uniqueness
+      # or ladder probe on the row being saved needs its own entry.
+      %r{active_record/validations\.rb:\d+:in '[^']*#(save|save!)'},
+      # after_commit callbacks are the same per-record write work, deferred
+      # until the transaction that wrote the rows ends.
+      %r{active_record/transactions\.rb:\d+:in '[^']*#committed!'},
+      # Locking a row re-reads it, once per row the caller is about to write.
+      %r{active_record/locking/pessimistic\.rb:\d+:in '[^']*#lock!'},
+      # A product payload writes each nested variant and media row through its
+      # own workflow — SKU probe, option lookup, blob resolution — once per row.
+      %r{/spree/products/nested_attributes\.rb:\d+:in '[^']*#(write_variant|apply_media)'},
+      # A settlement is swept per currency, and each sweep writes its own payout.
+      %r{/spree/seller_payouts/sweep\.rb:\d+:in '[^']*#collect_transfers'},
+      # A split checkout re-sums and then places each seller's order it just
+      # wrote, one workflow run per order.
+      %r{/spree/carts/split_by_seller\.rb:\d+:in '[^']*#resum_totals'},
+      %r{/spree/orders/complete\.rb:\d+:in '[^']*#place_sibling'},
+      # Each requested line is priced, stock-checked, saved and taxed as it
+      # is written.
+      %r{/spree/carts/upsert_items\.rb:\d+:in '[^']*#apply_item'}
+    ]
+
+    # A purchase's billing and shipping addresses, and a transfer's two
+    # warehouses, are two links into one table read through the same code,
+    # so one record reads as a repeat. Lists still load each link in one
+    # query for the whole page.
+    Prosopite.ignore_queries = [
+      /FROM [`"]?(spree_addresses|spree_stock_locations)[`"]? WHERE (.+ AND )?[`"]?\1[`"]?\.[`"]?id[`"]? (=|IN)/
+    ]
+
+    # Prosopite fingerprints through pg_query, which rejects SQLite's `?`
+    # binds, so SQLite borrows the text normalizer written for MySQL. That
+    # normalizer blanks anything double-quoted, which is a string literal in
+    # MySQL but an identifier in SQLite — left alone it erases every table
+    # name, collapsing unrelated queries into one fingerprint and reporting
+    # a single record's distinct associations as an N+1. Re-quoting
+    # identifiers as backticks first keeps table names in the fingerprint.
+    Prosopite.singleton_class.prepend(Module.new do
+      def fingerprint(query)
+        return super unless ActiveRecord::Base.connection_db_config.adapter == 'sqlite3'
+
+        mysql_fingerprint(query.gsub(/"([^"]*)"/) { "`#{Regexp.last_match(1)}`" })
+      end
+    end)
+  end
 end

data/lib/spree/checkout/default_requirements.rb

@@ -107,7 +107,11 @@ module Spree
       end
 
       def completion_line_items
-        @completion_line_items ||= @cart.line_items.includes(variant: :product).to_a
+        # Everything the discontinuation and stock checks read, for every line
+        # at once.
+        @completion_line_items ||= @cart.line_items.includes(
+          variant: [{ product: %i[store product_publications] }, { stock_levels: %i[stock_location active_stock_reservations] }]
+        ).to_a
       end
 
       def delivery_step_required?
@@ -125,7 +129,13 @@ module Spree
       # What checkout has to collect, which is the whole total unless an
       # arrangement collects only part of it up front.
       def payment_satisfied?
-        @cart.payments.valid.sum(:amount) >= @cart.amount_due_at_checkout
+        paid = if @cart.read_association_in_memory?(:payments)
+                 @cart.payments.reject(&:has_invalid_status?).sum(BigDecimal('0'), &:amount)
+               else
+                 @cart.payments.valid.sum(:amount)
+               end
+
+        paid >= @cart.amount_due_at_checkout
       end
 
       # Advisory rather than completion-only: the buyer has to be told the

data/lib/spree/core/dependencies.rb

@@ -186,6 +186,11 @@ module Spree
         # handler sees a nested payload and the variants endpoint alike
         variant_create_workflow: 'Spree::Variants::Create',
         variant_update_workflow: 'Spree::Variants::Update',
+
+        # digital assets — the operator's and the seller's endpoints and the
+        # nested list on a product write all run through these
+        digital_asset_create_workflow: 'Spree::DigitalAssets::Create',
+        digital_asset_update_workflow: 'Spree::DigitalAssets::Update',
         product_archive_workflow: 'Spree::Products::Archive',
         product_draft_workflow: 'Spree::Products::Draft',
 

data/lib/spree/core/engine.rb

@@ -506,6 +506,7 @@ module Spree
           Spree::Address,
           Spree::Claim,
           Spree::Collection,
+          Spree::Company,
           Spree::CreditCard,
           Spree::Exchange,
           Spree::GiftCard,
@@ -521,6 +522,7 @@ module Spree
           Spree::Product,
           Spree::ProductType,
           Spree::Promotion,
+          Spree::PurchaseOrder,
           Spree::Refund,
           Spree::Return,
           Spree::Fulfillment,

data/lib/spree/core/permissions/default_catalog.rb

@@ -165,7 +165,7 @@ module Spree
           [Spree::Store, Spree::PaymentMethod, Spree::Gateway,
            Spree::DeliveryZone, Spree::DeliveryZoneMember,
            Spree::StockLocation, Spree::DeliveryProfile,
-           Spree::Market, Spree::TaxCategory, Spree::TaxRate, Spree::AllowedOrigin,
+           Spree::Market, Spree::TaxCategory, Spree::TaxRate,
            Spree::RefundReason, Spree::ReturnReason, Spree::ClaimReason,
            Spree::OrderCancellationReason, Spree::TaxExemptionReason, Spree::Channel,
            Spree::OrderRoutingRule, Spree::CustomFieldDefinition, Spree::Policy]
@@ -201,7 +201,12 @@ module Spree
         })
         catalog.register_scope(:integrations, group: :settings, resources: -> { [Spree::Integration] })
 
-        catalog.register_scope(:api_keys, group: :access, resources: -> { [Spree::ApiKey] })
+        # The CORS allowlist is a credential as much as a key is: an origin on
+        # it may call the cookie-authenticated refresh endpoint from a browser
+        # and read back any signed-in admin's access token. So it sits with
+        # API keys rather than settings, under a scope a delegated OAuth token
+        # never holds.
+        catalog.register_scope(:api_keys, group: :access, resources: -> { [Spree::ApiKey, Spree::AllowedOrigin] })
         # Connecting an AI agent hands a third party a standing credential to
         # the store, so it is its own permission rather than part of settings
         # — a merchandiser who may edit a delivery zone is not thereby someone

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '6.0.0.rc4'.freeze
+  VERSION = '6.0.0.rc6'.freeze
 
   def self.version
     VERSION

data/lib/spree/reporting/default_vocabulary.rb

@@ -541,7 +541,7 @@ module Spree
                     # and tax category per row and throw all of it away.
                     hydrate: lambda { |store, ids, _params|
                       currency = Spree::Current.currency || store.default_currency
-                      products = store.products.with_deleted.includes(:primary_media).where(id: ids)
+                      products = store.products.with_deleted.includes(:primary_media, default_variant: :prices).where(id: ids)
                       products.to_h do |product|
                         amount = product.default_variant&.amount_in(currency)
                         [product.id, {

data/lib/spree/testing_support/factories/data_request_factory.rb

@@ -9,6 +9,10 @@ FactoryBot.define do
       kind { Spree::DataRequest::ERASURE }
     end
 
+    trait :awaiting_confirmation do
+      status { 'awaiting_confirmation' }
+    end
+
     trait :completed do
       status { 'completed' }
       completed_at { Time.current }

data/lib/spree/testing_support/factories/product_factory.rb

@@ -15,8 +15,11 @@ FactoryBot.define do
     end
     after(:create) do |product|
       if product.store&.default_channel && product.product_publications.empty?
-        Spree::ProductPublication.create!(
-          product: product,
+        # Built through the association, not Spree::ProductPublication.create!:
+        # the `empty?` above loads and caches the collection, so a row written
+        # around it leaves the product holding an association that reads empty
+        # while the table has the row.
+        product.product_publications.create!(
           channel: product.store.default_channel,
           published_at: product.available_on,
           unpublished_at: product.discontinue_on
@@ -69,8 +72,11 @@ FactoryBot.define do
       # keep passing. Production callers must publish explicitly via the
       # Admin SDK / Dashboard create form.
       if product.store&.default_channel && product.product_publications.empty?
-        Spree::ProductPublication.create!(
-          product: product,
+        # Built through the association, not Spree::ProductPublication.create!:
+        # the `empty?` above loads and caches the collection, so a row written
+        # around it leaves the product holding an association that reads empty
+        # while the table has the row.
+        product.product_publications.create!(
           channel: product.store.default_channel,
           published_at: product.available_on,
           unpublished_at: product.discontinue_on

data/lib/spree/testing_support/factories/store_factory.rb

@@ -1,6 +1,9 @@
 FactoryBot.define do
   factory :store, class: Spree::Store do
-    sequence(:code)        { |i| "spree_#{i}" }
+    # The suite-wide default store outlives the process that created it, while
+    # a sequence restarts with every process, so the code also steps past
+    # whatever is already in the database.
+    sequence(:code)        { |i| "spree_#{i + Spree::Store.unscoped.count}" }
     name                   { 'Spree Test Store' }
     url                    { 'www.example.com' }
     mail_from_address      { 'no-reply@example.com' }

data/lib/spree/upgrades/5_6_to_6_0/manifest.yml

@@ -819,3 +819,13 @@ steps:
       Run AFTER the steps that create or move attachments (media, categories,
       returns), so their files are covered. Idempotent — files that already
       have a store are skipped.
+
+  - id: backfill_tagging_tenants
+    name: "Stamp the store on taggings written without one"
+    task: "spree:upgrade:backfill_tagging_tenants"
+    notes: |
+      Tags added through the bulk endpoints carried no store on their
+      taggings, and the admin tag list filters by it, so those tags were
+      missing from the list. This stamps the store of the record on every
+      tagging without one, for each taggable that keeps its taggings per
+      store. Idempotent — taggings that already carry a store are skipped.

data/lib/tasks/backfill_tagging_tenants.rake

@@ -0,0 +1,35 @@
+namespace :spree do
+  namespace :upgrade do
+    desc <<~DESC
+      Stamps the store on taggings written without one, for every taggable
+      that keeps its taggings per store. Tags added through the bulk endpoints
+      before Spree 6.0 carried no store, and the admin tag list filters by it,
+      so those tags were missing from the list. Idempotent — taggings that
+      already carry a store are skipped.
+    DESC
+    task backfill_tagging_tenants: :environment do
+      total = 0
+
+      Spree.taggable_types.map(&:constantize).each do |taggable|
+        column = taggable.try(:tenant_column)
+        next if column.blank?
+
+        count = 0
+        ActsAsTaggableOn::Tagging.where(taggable_type: taggable.polymorphic_name, tenant: nil).in_batches do |taggings|
+          tenants = taggable.unscoped.where(id: taggings.select(:taggable_id)).pluck(:id, column).to_h
+
+          tenants.compact.group_by { |_id, tenant| tenant }.each do |tenant, pairs|
+            count += taggings.where(taggable_id: pairs.map(&:first)).update_all(tenant: tenant.to_s)
+          end
+        end
+
+        next if count.zero?
+
+        total += count
+        puts "  #{taggable.name}: #{count} tagging(s) stamped with the #{column}."
+      end
+
+      puts total.zero? ? '  Nothing to backfill.' : "  Backfilled #{total} tagging(s)."
+    end
+  end
+end