spree_core 6.0.2 → 6.0.3

data/lib/spree/agent_tools/operation_tool.rb

@@ -0,0 +1,189 @@
+module Spree
+  module AgentTools
+    # One agent tool per Admin API operation in {OperationCatalog}.
+    #
+    # Everything about the tool is the operation's: its name, its prose, its
+    # arguments and the request it sends. The arguments are the path segments
+    # and the request body under the names the document gives them, so a call
+    # is a request with no translation step between what the model was shown
+    # and what the endpoint receives. The endpoint runs its own routing,
+    # authentication, scope check, record-level ability and workflow.
+    #
+    # Generated classes are cached per entry, so a catalog rebuilt after a
+    # code reload produces new tools rather than serving stale ones.
+    #
+    # See docs/plans/6.0-agent-tools-from-openapi.md.
+    class OperationTool < Spree::AgentTool
+      class_attribute :operation, instance_accessor: false
+
+      class << self
+        # @param entry [OperationCatalog::Entry]
+        # @return [Class<OperationTool>]
+        def for(entry)
+          # By identity: an entry is rebuilt, as a new object, whenever the
+          # catalog is, and hashing one walks its whole request schema.
+          cache[entry] ||= Class.new(self) do
+            self.operation = entry
+
+            tool_name entry.name
+            description entry.description
+            permission entry.permission
+            mutating! if entry.mutating
+          end
+        end
+
+        # @return [Hash] JSON Schema for the arguments, read by the adapters
+        def input_schema
+          @input_schema ||= operation.input_schema
+        end
+
+        # @return [void]
+        def clear_cache!
+          @cache = {}
+        end
+
+        private
+
+        def cache
+          @cache ||= {}.compare_by_identity
+        end
+      end
+
+      delegate :operation, to: :class
+
+      # @return [Hash] the result handed back to the model
+      def call(**arguments)
+        arguments, notes = map_legacy_arguments(arguments.transform_keys(&:to_s))
+
+        segments = operation.path_params.index_with { |segment| arguments[segment] }
+        derive_parents(segments)
+        path = operation.path_for(segments)
+        # Only what the path needs is checked here. What the body requires is
+        # the endpoint's to refuse, in its own words.
+        if path.nil?
+          unfilled = segments.select { |_segment, value| value.blank? }.keys
+          return { error: "#{tool_name} needs #{unfilled.to_sentence}.", deprecations: notes.presence }.compact
+        end
+
+        values, refusal = body_for(arguments)
+        return refusal.merge(deprecations: notes.presence).compact if refusal
+
+        response = dispatch(path, values)
+        return { error: response.error_message, deprecations: notes.presence }.compact unless response.success?
+
+        # A read opted in to the catalog answers with what it read, filtered
+        # like every other record that leaves for a model.
+        return { summary: operation.summary, data: sanitized(response.data) } if operation.read?
+
+        record = payload_summary(response.data)
+        named = record&.dig(:title).presence || record&.dig(:id).presence || record&.dig('id').presence
+        { summary: named ? "#{operation.summary} #{named}" : summary(arguments), record: record,
+          deprecations: notes.presence }.compact
+      end
+
+      # The line a client shows before the call runs: the operation's own
+      # summary and the records it names.
+      #
+      # @param arguments [Hash]
+      # @return [String]
+      def summary(arguments)
+        arguments, = map_legacy_arguments(arguments.transform_keys(&:to_s))
+        named = operation.path_params.filter_map { |segment| arguments[segment] }
+        [operation.summary, named.reverse.join(' ').presence].compact.join(' ')
+      end
+
+      private
+
+      # 6.0.0 names (`order`, `reason`) mapped to the operation's (`id`,
+      # `cancel_reason_id`), with a note per name so the model learns the new
+      # one. A name the endpoint never read is dropped and said to be.
+      def map_legacy_arguments(arguments)
+        renames = operation.legacy_parameters
+        return [arguments, []] if renames.blank?
+
+        notes = []
+        mapped = arguments.each_with_object({}) do |(name, value), result|
+          next result[name] = value unless renames.key?(name)
+
+          target = renames[name]
+          if target == :merge && value.is_a?(Hash)
+            notes << "#{name} is deprecated: send its fields as arguments of their own."
+            result.merge!(value.transform_keys(&:to_s)) { |_key, given, _merged| given }
+          elsif target.nil? || target == :merge
+            notes << "#{name} is not something #{tool_name} sets, and was ignored."
+          else
+            notes << "#{name} is deprecated: use #{target}."
+            result[target] = value unless result.key?(target)
+          end
+        end
+
+        [mapped, notes]
+      end
+
+      # A parent segment the caller left out, read off a record the call
+      # does name — a payment's order, a fulfillment's order — through the
+      # resource map, under the caller's store. Only a record the caller may
+      # read is consulted; anything else stays unfilled and is asked for.
+      def derive_parents(segments)
+        missing = operation.parent_keys.keys.select { |segment| segments[segment].blank? }
+        return if missing.empty?
+
+        records = segments.compact_blank.to_a.reverse.filter_map { |segment, id| record_for(segment, id) }
+        missing.reverse_each do |segment|
+          parent = records.lazy.filter_map { |record| record.try(segment.delete_suffix('_id')) }.first
+          next if parent.nil?
+
+          segments[segment] = parent.try(:prefixed_id)
+          records << parent
+        end
+      end
+
+      def record_for(segment, id)
+        key = segment == 'id' ? operation.resource_key : operation.segment_keys[segment]
+        entry = key && ResourceMap.find(key)
+        return if entry.nil? || !context.permitted?(entry.permission)
+
+        entry.scope_for(context).find_by_prefix_id(id)
+      rescue StandardError
+        nil
+      end
+
+      def dispatch(path, values)
+        dispatcher = ApiDispatch.new(context)
+        return dispatcher.call(method: :get, path: path, params: values || {}) if operation.read?
+
+        dispatcher.call(method: operation.verb.to_sym, path: path, body: values)
+      end
+
+      # What travels as the body, or a read's query: every argument that is
+      # not a path segment, checked against the document so a guessed field is
+      # named back rather than dropped behind a success.
+      def body_for(arguments)
+        body = arguments.except(*operation.path_params)
+        return [nil, nil] if body.empty?
+
+        accepted = operation.body_properties.keys
+        unknown = body.keys - accepted
+        return [body, nil] if unknown.empty?
+
+        [nil, { error: "#{tool_name} does not accept #{unknown.to_sentence}.",
+                accepted_arguments: (operation.path_params + accepted).sort }]
+      end
+
+      # The record the endpoint returned, compacted and filtered the way a
+      # record read from the map is.
+      def payload_summary(data)
+        return unless data.is_a?(Hash)
+
+        entry = operation.resource_key && ResourceMap.find(operation.resource_key)
+        return sanitized(data).slice('id').presence if entry.nil?
+
+        RecordSummary.from_payload(entry: entry, payload: data)
+      end
+
+      def sanitized(data)
+        RecordSummary.sanitize(data, operation.resource_key)
+      end
+    end
+  end
+end

data/lib/spree/agent_tools/registry.rb

@@ -18,10 +18,9 @@ module Spree
     # of their own — they are gated per resource instead — so the registry
     # cannot be the only thing keeping them apart.
     #
-    # Writes are not registered as classes. A back-office write already is a
-    # workflow, so the registry exposes workflows by their `Spree::Dependencies`
-    # key and derives each tool from the workflow's own `perform` signature —
-    # see {#expose_workflows}.
+    # Writes are not registered as classes. Every Admin API action an admin
+    # key may call is already a tool, built from its OpenAPI operation by
+    # {OperationCatalog} — see docs/plans/6.0-agent-tools-from-openapi.md.
     class Registry
       include Enumerable
 
@@ -61,38 +60,54 @@ module Spree
         to_a.each(&)
       end
 
-      # Exposes workflows as write tools, keyed by `Spree::Dependencies` key so
-      # the tool follows whatever class the host app has registered:
-      #
-      #   Spree.admin_agent_tools.expose_workflows(
-      #     order_cancel_workflow: 'write_orders',
-      #     product_activate_workflow: 'write_products'
-      #   )
-      #
-      # A value may be the permission key on its own, or a hash carrying it
-      # alongside `except:` (parameters to hide, such as a deprecated one) and
-      # `summary:` (a callable overriding the generated confirmation line).
+      # @deprecated Admin API operations are agent tools on their own, built
+      #   from the OpenAPI document, so there is nothing to expose. A
+      #   workflow behind a documented endpoint is that endpoint's tool; one
+      #   without is not offered. Recorded and otherwise ignored, and removed
+      #   in 7.0.
       #
       # @param exposures [Hash{Symbol => String, Hash}]
       # @return [self]
       def expose_workflows(**exposures)
-        exposures.each do |dependency_key, options|
-          options = { permission: options } if options.is_a?(String) || options.is_a?(Symbol)
-          @exposed_workflows[dependency_key.to_sym] = {
-            permission: options.fetch(:permission).to_s,
-            except: Array(options[:except]).map(&:to_sym),
-            summary: options[:summary]
-          }
-        end
+        Spree::Deprecation.warn(
+          'Spree.admin_agent_tools.expose_workflows is deprecated and has no effect: every documented ' \
+          'Admin API action is an agent tool, built from its OpenAPI operation. A workflow reaches agents ' \
+          'through an admin endpoint whose rswag spec is generated into the openapi/admin.yaml your gem ships. ' \
+          'See docs/plans/6.0-agent-tools-from-openapi.md.'
+        )
+
+        @exposed_workflows.merge!(exposures.transform_keys(&:to_sym))
         self
       end
 
-      # @return [Hash{Symbol => Hash}] every exposed workflow, by dependency key
+      # @deprecated see {#expose_workflows}
+      # @return [Hash{Symbol => Hash}] what was passed to {#expose_workflows}
       attr_reader :exposed_workflows
 
       # @return [Array<Class<Spree::AgentTool>>]
       def to_a
-        registered_classes + workflow_tool_classes
+        registered = registered_classes
+        registered + operation_tool_classes(registered.map(&:tool_name))
+      end
+
+      # A tool this caller may use, by name — including a 6.0.0 name that is
+      # no longer listed but still answers through 6.0.x, so a client that
+      # learned it keeps working.
+      #
+      # @param name [String]
+      # @param context [Spree::AgentTools::Context]
+      # @return [Spree::AgentTool, nil]
+      def find_for(name, context)
+        name = name.to_s
+        tool_class = registered_classes.find { |klass| klass.tool_name == name }
+        if tool_class.nil? && operations?
+          entry = Spree::AgentTools::OperationCatalog.find(name)
+          tool_class = entry && Spree::AgentTools::OperationTool.for(entry)
+        end
+        return if tool_class.nil? || (tool_class.try(:audience) && tool_class.audience != audience)
+
+        tool = tool_class.new(context)
+        tool if tool.permitted?
       end
 
       # Tools this caller may actually use, instantiated for their context.
@@ -118,14 +133,33 @@ module Spree
         end
       end
 
-      # One generated tool class per exposed workflow whose dependency key
-      # still resolves. A key an extension removed simply stops being offered
-      # rather than breaking the whole catalog.
-      def workflow_tool_classes
-        @exposed_workflows.filter_map do |dependency_key, options|
-          Spree::AgentTools::WorkflowTool.for(dependency_key, **options)
+      # One tool per operation the catalog lists. Operations are back-office
+      # actions, so only the admin surface offers them.
+      #
+      # A registered tool keeps its name: an operation claiming the same one
+      # would make an MCP server refuse the whole list. The contract spec
+      # fails on such a clash; at runtime it is logged, once per name.
+      def operation_tool_classes(taken)
+        return [] unless operations?
+
+        Spree::AgentTools::OperationCatalog.all.filter_map do |entry|
+          next Spree::AgentTools::OperationTool.for(entry) unless taken.include?(entry.name)
+
+          warn_shadowed(entry.name)
+          nil
         end
       end
+
+      def warn_shadowed(name)
+        @shadowed ||= Set.new
+        return unless @shadowed.add?(name)
+
+        Rails.logger.warn("[Spree] agent tool #{name} is registered by hand; the operation of that name is not offered")
+      end
+
+      def operations?
+        audience == :admin
+      end
     end
   end
 end

data/lib/spree/agent_tools/resource_map.rb

@@ -16,6 +16,10 @@ module Spree
       # than quietly leaking another store's records.
       UnscopedResourceError = Class.new(StandardError)
 
+      # The parent segment of a nested path: `/promotions/:promotion_id/promotion_rules`
+      # names `promotions`.
+      PARENT_SEGMENT = %r{/(?<parent>[a-z_]+)/:[a-z_]+_id(?:/|\z)}
+
       Entry = Struct.new(:key, :model_name, :permission, :serializer_name,
                          :dashboard_path, :scope_name, :write_permission,
                          :writable_attributes, :create_workflow_key, :update_workflow_key,
@@ -29,9 +33,38 @@ module Spree
           Array(api_paths).to_h[action.to_sym]
         end
 
-        # @return [Boolean] whether a tool can dispatch to this resource
+        # Whether a tool can dispatch to this resource's collection on its own.
+        #
+        # A resource reached only under a parent is not: the tool has no
+        # parent id to put in the path, and dispatching the template as it
+        # stands answered "Promotion not found" for a search of promotion
+        # rules, which a model repeats as a fact about the store.
+        #
+        # @return [Boolean]
         def dispatchable?
-          api_path(:index).present?
+          api_path(:index).present? && !nested?(:index)
+        end
+
+        # Whether the path a tool would dispatch `action` to runs under a
+        # parent. Asked per action, because a resource can be listed at the
+        # top level and written under its parent (`/variants`,
+        # `/products/:product_id/variants`).
+        #
+        # @param action [Symbol]
+        # @return [Boolean]
+        def nested?(action = :index)
+          parent_key(action).present?
+        end
+
+        # The resource key of the parent `action`'s path runs under, read
+        # from the route rather than guessed from the model, so a renamed
+        # nested route (`/orders/:order_id/items`) still names `orders`. The
+        # innermost parent, for a path nested twice.
+        #
+        # @param action [Symbol]
+        # @return [String, nil]
+        def parent_key(action = :index)
+          api_path(action).to_s.scan(PARENT_SEGMENT).flatten.last
         end
 
         # Whether a search may add DISTINCT.
@@ -67,6 +100,42 @@ module Spree
           Array(writable_attributes).map(&:to_s).sort
         end
 
+        # The record a nested resource is reached through — `order_id` for an
+        # order's items, discounts and fees — or nil for a top-level one.
+        #
+        # @param action [Symbol]
+        # @return [String, nil]
+        def parent_param(action)
+          Array(api_path(action)&.scan(/:([a-z_]+)/)).flatten.reject { |name| name == 'id' }.first
+        end
+
+        # The operation's path with its segments filled, or nil when a nested
+        # resource was not given the record it lives under.
+        #
+        # Each value is percent-encoded so it stays one segment: a `?` or `/`
+        # in an id would otherwise send the call to a different route than
+        # the one the tool checked and the approver was shown. A path with a
+        # segment left unfilled — a resource nested two levels deep — is nil
+        # too, rather than dispatched with a placeholder in it.
+        #
+        # @param action [Symbol]
+        # @param id [String, nil]
+        # @param parent_id [String, nil]
+        # @return [String, nil]
+        def path_for(action, id: nil, parent_id: nil)
+          path = api_path(action)
+          return if path.blank?
+
+          path = path.sub(':id', ERB::Util.url_encode(id.to_s)) if id.present?
+          parent = parent_param(action)
+          if parent
+            return if parent_id.blank?
+
+            path = path.sub(":#{parent}", ERB::Util.url_encode(parent_id.to_s))
+          end
+          path unless path.match?(/:[a-z_]+/)
+        end
+
         # The associations the show operation will include when asked, read
         # from the serializer that renders it.
         #
@@ -92,14 +161,68 @@ module Spree
         end
 
         def expand_names_in(klass)
-          file = Object.const_source_location(klass.name)&.first
-          return [] if file.nil? || !File.exist?(file)
+          file = serializer_file(klass)
+          return [] if file.nil?
 
-          File.read(file).scan(/expand\?\('([a-z_]+)'\)/).flatten
+          # Comment lines are skipped: the base serializer explains `expand?`
+          # with an example, which put `variants` on every resource's list.
+          code = File.readlines(file).reject { |line| line.lstrip.start_with?('#') }.join
+          code.scan(/expand\?\('([a-z_]+)'\)/).flatten
         rescue StandardError
           []
         end
 
+        # The file the autoloader maps the class to, under whichever engine
+        # holds it. `const_source_location` is the fallback: it names the file
+        # that first touched the constant, which for a serializer another one
+        # inherits from was the subclass's file.
+        def serializer_file(klass)
+          relative = "#{klass.name.underscore}.rb"
+          found = Rails.autoloaders.main.dirs.lazy.map { |dir| File.join(dir, relative) }.find { |path| File.exist?(path) }
+          found || Object.const_source_location(klass.name)&.first.then { |path| path if path && File.exist?(path) }
+        end
+
+        # The STI family this resource is, when its rows are selected by a
+        # `type` the model's own registry resolves — payment methods, seller
+        # requirements, promotion rules. Nil for an ordinary resource.
+        #
+        # @return [Class, nil]
+        def typed_family
+          typed_family_class(model_class)
+        end
+
+        # The STI family behind each list-valued attribute whose rows carry a
+        # `type` — a promotion's `rules` and `actions`, a price list's
+        # `rules`. The attribute is the short name the write accepts; the
+        # association behind it carries the model's prefix
+        # (`promotion_rules`), which is how the two are matched.
+        #
+        # @return [Hash{String => Class}] attribute => family class
+        def nested_typed_families
+          nested_collection_shapes.each_with_object({}) do |(name, fields), families|
+            next unless fields.any? { |field| field['name'] == 'type' }
+
+            family = typed_family_class(typed_association_for(name)&.klass)
+            families[name] = family if family
+          end
+        rescue StandardError
+          {}
+        end
+
+        def typed_association_for(name)
+          reflections = model_class.reflect_on_all_associations(:has_many)
+          reflections.find { |reflection| reflection.name.to_s == name } ||
+            reflections.find { |reflection| reflection.name.to_s.end_with?("_#{name}") }
+        end
+
+        def typed_family_class(klass)
+          return unless klass.respond_to?(:subclass_registry) && klass.subclass_registry
+
+          klass
+        rescue StandardError
+          nil
+        end
+
         # The shape of each attribute that carries a list of records — a
         # product's `variants`, an order's `items`.
         #

data/lib/spree/agent_tools.rb

@@ -3,10 +3,10 @@ require 'spree/agent_tools/context'
 require 'spree/agent_tools/resource_map'
 require 'spree/agent_tools/api_dispatch'
 require 'spree/agent_tools/membership_map'
-require 'spree/agent_tools/workflow_endpoints'
 require 'spree/agent_tools/record_summary'
-require 'spree/agent_tools/workflow_schema'
-require 'spree/agent_tools/workflow_tool'
+require 'spree/agent_tools/legacy_tools'
+require 'spree/agent_tools/operation_catalog'
+require 'spree/agent_tools/operation_tool'
 require 'spree/agent_tools/default_catalog'
 
 module Spree

data/lib/spree/core/dependencies_helper.rb

@@ -12,43 +12,48 @@ module Spree
       injection_points = base::INJECTION_POINTS_WITH_DEFAULTS.keys.freeze
       base.const_set(:INJECTION_POINTS, injection_points)
 
-      injection_points.each do |point|
-        # Original getter - returns raw value (string, class, or proc result)
-        # BACKWARDS COMPATIBLE: Spree::Dependencies.foo.constantize still works
-        base.attr_reader(point)
-
-        # Setter with override tracking
-        # BACKWARDS COMPATIBLE: Spree::Dependencies.foo = "MyClass" still works
-        base.define_method("#{point}=") do |value|
-          @overrides ||= {}
-          @overrides[point] = {
-            value: value,
-            source: find_caller_source,
-            set_at: Time.current
-          }
-          # Clear memoized class when value changes
-          remove_instance_variable("@#{point}_resolved") if instance_variable_defined?("@#{point}_resolved")
-          instance_variable_set("@#{point}", value)
-        end
-
-        # Returns resolved class with memoization
-        # Usage: Spree::Dependencies.foo_class or Spree.foo
-        base.define_method("#{point}_class") do
-          return instance_variable_get("@#{point}_resolved") if instance_variable_defined?("@#{point}_resolved")
-
-          value = send(point)
-          resolved = case value
-                     when String then value.constantize
-                     when Proc then value.call.then { |v| v.is_a?(String) ? v.constantize : v }
-                     else value
-                     end
-          # An injection point may legitimately have no default — the class is
-          # supplied by an optional gem (search_product_presenter). Leave it
-          # unmemoized so installing the gem later still takes effect.
-          return nil if resolved.nil?
-          instance_variable_set("@#{point}_resolved", resolved)
-          resolved
-        end
+      injection_points.each { |point| define_injection_point(base, point) }
+    end
+
+    # Defines the reader, the tracked setter and the resolving `_class` reader
+    # for one injection point, on a class (core points) or on one instance's
+    # singleton class (points an extension registers).
+    def self.define_injection_point(target, point)
+      # Original getter - returns raw value (string, class, or proc result)
+      # BACKWARDS COMPATIBLE: Spree::Dependencies.foo.constantize still works
+      target.attr_reader(point)
+
+      # Setter with override tracking
+      # BACKWARDS COMPATIBLE: Spree::Dependencies.foo = "MyClass" still works
+      target.define_method("#{point}=") do |value|
+        @overrides ||= {}
+        @overrides[point] = {
+          value: value,
+          source: find_caller_source,
+          set_at: Time.current
+        }
+        # Clear memoized class when value changes
+        remove_instance_variable("@#{point}_resolved") if instance_variable_defined?("@#{point}_resolved")
+        instance_variable_set("@#{point}", value)
+      end
+
+      # Returns resolved class with memoization
+      # Usage: Spree::Dependencies.foo_class or Spree.foo
+      target.define_method("#{point}_class") do
+        return instance_variable_get("@#{point}_resolved") if instance_variable_defined?("@#{point}_resolved")
+
+        value = send(point)
+        resolved = case value
+                   when String then value.constantize
+                   when Proc then value.call.then { |v| v.is_a?(String) ? v.constantize : v }
+                   else value
+                   end
+        # An injection point may legitimately have no default — the class is
+        # supplied by an optional gem (search_product_presenter). Leave it
+        # unmemoized so installing the gem later still takes effect.
+        return nil if resolved.nil?
+        instance_variable_set("@#{point}_resolved", resolved)
+        resolved
       end
     end
 
@@ -56,6 +61,53 @@ module Spree
       set_default_values
     end
 
+    # Adds an injection point an extension owns, so its own workflows and
+    # services can be swapped by a host app exactly like core's:
+    #
+    #   Spree::Dependencies.register(:quote_send_workflow, 'MyExtension::Quotes::Send')
+    #   Spree.quote_send_workflow # => MyExtension::Quotes::Send
+    #
+    # Register from an initializer. A host app that sets the key afterwards
+    # replaces the default, as with any core key. Registering a key that
+    # already exists raises, so two gems cannot silently claim one name.
+    #
+    # @param point [Symbol, String]
+    # @param default [String, Class, Proc] class name preferred, so the
+    #   class loads on first use
+    # @return [Symbol] the key
+    def register(point, default)
+      point = point.to_sym
+      raise ArgumentError, "#{point} is already a dependency" if injection_point?(point)
+      # `cart_add_item_workflow_class` would shadow the resolving reader core
+      # defines for `cart_add_item_workflow`, a key `Spree` already answers
+      # itself (`search_provider`) would never be read, and an existing
+      # setter would lose its own behaviour to the tracked one.
+      names = [point, "#{point}_class", "#{point}="]
+      if [self, Spree].any? { |owner| names.any? { |name| owner.respond_to?(name, true) } }
+        raise ArgumentError, "#{point} would replace an existing method"
+      end
+
+      # Evaluated first, so a default that raises leaves nothing registered.
+      value = default.respond_to?(:call) ? default.call : default
+      registered_points[point] = default
+      Spree::DependenciesHelper.define_injection_point(singleton_class, point)
+      instance_variable_set("@#{point}", value)
+      point
+    end
+
+    # Core's injection points plus the ones extensions registered.
+    #
+    # @return [Array<Symbol>]
+    def injection_points
+      self.class::INJECTION_POINTS + registered_points.keys
+    end
+
+    # @param point [Symbol, String]
+    # @return [Boolean]
+    def injection_point?(point)
+      injection_points.include?(point.to_sym)
+    end
+
     # Returns hash of all overridden dependencies with metadata
     def overrides
       @overrides || {}
@@ -73,8 +125,8 @@ module Spree
 
     # Returns array of all dependencies with current values and metadata
     def current_values
-      self.class::INJECTION_POINTS.map do |point|
-        default = self.class::INJECTION_POINTS_WITH_DEFAULTS[point]
+      injection_points.map do |point|
+        default = self.class::INJECTION_POINTS_WITH_DEFAULTS.fetch(point) { registered_points[point] }
         default_val = default.respond_to?(:call) ? default.call : default
         current = send(point)
 
@@ -94,7 +146,7 @@ module Spree
     # Raises Spree::DependencyError if any dependency is invalid
     def validate!
       errors = []
-      self.class::INJECTION_POINTS.each do |point|
+      injection_points.each do |point|
         send("#{point}_class")
       rescue NameError => e
         errors << { name: point, value: send(point), error: e.message }
@@ -106,6 +158,10 @@ module Spree
 
     private
 
+    def registered_points
+      @registered_points ||= {}
+    end
+
     def set_default_values
       self.class::INJECTION_POINTS_WITH_DEFAULTS.each do |injection_point, default_value|
         value = default_value.respond_to?(:call) ? default_value.call : default_value