spree_core 6.0.2 → 6.0.3

data/lib/spree/core/engine.rb

@@ -10,6 +10,7 @@ module Spree
                                :dependencies,
                                :payment_methods,
                                :adjusters,
+                               :cart_copiers,
                                :media_viewable_types,
                                :default_tax_provider,
                                :tax_providers,
@@ -79,7 +80,7 @@ module Spree
         %i[subscribers actor_classes commission_rules delivery_method_rules seller_requirements
            delivery_rate_providers tax_providers pricing_providers inventory_providers
            payout_providers digital_asset_providers delivery_profile_types pickup_point_providers
-           maintenance_tasks].each do |registry|
+           maintenance_tasks cart_copiers].each do |registry|
           app.config.spree[registry] = []
         end
         app.config.spree.line_item_comparison_hooks = Set.new

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '6.0.2'.freeze
+  VERSION = '6.0.3'.freeze
 
   def self.version
     VERSION

data/lib/spree/core.rb

@@ -323,6 +323,22 @@ module Spree
   # @return [Array<Class>]
   singleton_class.delegate :tax_providers, :tax_providers=, to: :spree_config
 
+  # Extensions that copy their own cart data onto the order a cart becomes.
+  # Each entry is a class with a class-level +call(cart:, order:,
+  # line_item_map:)+ (a class, so it is re-resolved when code reloads in
+  # development; see {.refresh_provider_registries!}), where the map
+  # pairs each cart line item with its copy on the order. Both copies run them
+  # — checkout ({Spree::Carts::Complete}) and the draft-order copy
+  # ({Spree::Orders::CreateFromCart}) — inside their transaction, once the
+  # order's line items exist, so an entry that raises rolls the order back.
+  #
+  # Append, never assign, so an extension does not drop what another added:
+  #
+  #   Spree.cart_copiers << MyApp::CopyEngravings
+  #
+  # @return [Array<Class>]
+  singleton_class.delegate :cart_copiers, :cart_copiers=, to: :spree_config
+
   # Pricing engines a store can be pointed at. Connector gems append their own,
   # so a merchant picks from what is actually installed.
   #
@@ -400,7 +416,8 @@ module Spree
   def self.refresh_provider_registries!
     [Rails.application.config.spree.delivery_rate_providers,
      Rails.application.config.spree.fulfillment_providers,
-     Rails.application.config.spree.pickup_point_providers].compact.each do |registry|
+     Rails.application.config.spree.pickup_point_providers,
+     Rails.application.config.spree.cart_copiers].compact.each do |registry|
       registry.map! { |entry| entry.is_a?(Module) && entry.name ? entry.name.constantize : entry }
     end
   end
@@ -603,7 +620,7 @@ module Spree
     def core_dependency?(name)
       return false unless defined?(Spree::Dependencies)
 
-      Spree::Dependencies.class::INJECTION_POINTS.include?(name) ||
+      Spree::Dependencies.injection_point?(name) ||
         Spree::Dependencies.class::LEGACY_WORKFLOW_KEYS.key?(name) ||
         Spree::Dependencies.class::LEGACY_SERVICE_KEYS.key?(name) ||
         Spree::Dependencies.class::RENAMED_SERVICE_KEYS.key?(name)

data/lib/spree/testing_support/extension_rake.rb

@@ -1,5 +1,17 @@
 require 'spree/testing_support/common_rake'
 
+# `rake spree:openapi:generate` writes the extension's openapi/*.yaml from its
+# rswag specs, and `rake spree:sdk:serializer_types` the response types of a
+# package that extends the SDKs (both run by `spree sdk generate`).
+begin
+  require 'spree/api/testing_support/openapi_tasks'
+  require 'spree/api/sdk_types_task'
+  Spree::Api::SdkTypesTask.new
+rescue LoadError
+  # An extension without spree_api has no API to document. These files load
+  # nothing else, so this is the only thing that can be missing.
+end
+
 desc 'Generates a dummy app for testing an extension'
 namespace :extension do
   task :test_app, [:options] do |_t, args|

data/lib/spree/upgrades/5_6_to_6_0/manifest.yml

@@ -662,6 +662,40 @@ steps:
       hold a secret are skipped, and the legacy tables stay in place as a
       rollback path until they are dropped in 6.1.
 
+  - id: migrate_paypal_payments
+    name: "Give PayPal payments taken before 6.0 the PayPal order id"
+    task_class: "SpreePaypalCheckout::MaintenanceTasks::MigratePayments"
+    optional: true
+    notes: |
+      Only runs when spree_paypal_checkout is installed; skipped otherwise.
+
+      The 0.x gem stored a PayPal payment's capture id as its response code.
+      In 6.0 the response code is always the PayPal order id, which is how a
+      payment session finds its payment, and the capture id lives in the
+      payment's metadata. This step rewrites each older payment to that shape,
+      finding its order through the payment session that took it or, for the
+      older checkout flow, through spree_paypal_checkout_orders.
+
+      Run it before dropping spree_paypal_checkout_orders: that table is the
+      only link from those older payments to their PayPal order. A payment it
+      cannot match is logged by id, counted, and left as it was; refund it in
+      PayPal. Supports a dry run, and is idempotent.
+
+  - id: register_paypal_webhooks
+    name: "Register each PayPal payment method's webhook"
+    task: "spree:upgrade:register_paypal_webhooks"
+    optional: true
+    notes: |
+      Only runs when spree_paypal_checkout is installed; skipped otherwise.
+
+      PayPal webhooks register themselves in 6.0 and are always verified with
+      the webhook's id. This finds or creates the webhook for each PayPal
+      method's URL, replaces the events of one created by hand under the 0.x
+      guide, and stores its id. Until it runs, methods created before the
+      upgrade reject every webhook delivery.
+
+      Idempotent.
+
   - id: backfill_import_export_tenancy
     name: "Place every import in a store, and a seller where one ran it"
     task: "spree:upgrade:backfill_import_export_tenancy"

data/lib/tasks/dependencies.rake

@@ -42,7 +42,7 @@ namespace :spree do
       puts "\n[#{name}]"
 
       # Calculate max width for alignment
-      max_name_width = deps.class::INJECTION_POINTS.map(&:length).max
+      max_name_width = deps.injection_points.map(&:length).max
 
       deps.current_values.each do |dep|
         status = dep[:overridden] ? ' [OVERRIDDEN]' : ''
@@ -63,7 +63,7 @@ namespace :spree do
 
     def validate_dependencies(name, deps)
       errors = []
-      deps.class::INJECTION_POINTS.each do |point|
+      deps.injection_points.each do |point|
         deps.send("#{point}_class")
         print "\e[32m.\e[0m"
       rescue NameError => e

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 6.0.2
+  version: 6.0.3
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-11-02 00:00:00.000000000 Z
+date: 2026-11-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -422,6 +422,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: ostruct
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: tracking_number
   requirement: !ruby/object:Gem::Requirement
@@ -1550,6 +1564,7 @@ files:
 - app/workflows/spree/products/nested_attributes.rb
 - app/workflows/spree/products/propose.rb
 - app/workflows/spree/products/reject.rb
+- app/workflows/spree/products/status_transition.rb
 - app/workflows/spree/products/update.rb
 - app/workflows/spree/purchase_orders/cancel.rb
 - app/workflows/spree/purchase_orders/close.rb
@@ -1987,6 +2002,7 @@ files:
 - lib/generators/spree/api_resource/api_resource_generator.rb
 - lib/generators/spree/api_resource/templates/admin_controller.rb.tt
 - lib/generators/spree/api_resource/templates/admin_controller_spec.rb.tt
+- lib/generators/spree/api_resource/templates/admin_integration_spec.rb.tt
 - lib/generators/spree/api_resource/templates/admin_serializer.rb.tt
 - lib/generators/spree/api_resource/templates/factory.rb.tt
 - lib/generators/spree/api_resource/templates/permissions.en.yml.tt
@@ -2019,13 +2035,13 @@ files:
 - lib/spree/agent_tools/api_dispatch.rb
 - lib/spree/agent_tools/context.rb
 - lib/spree/agent_tools/default_catalog.rb
+- lib/spree/agent_tools/legacy_tools.rb
 - lib/spree/agent_tools/membership_map.rb
+- lib/spree/agent_tools/operation_catalog.rb
+- lib/spree/agent_tools/operation_tool.rb
 - lib/spree/agent_tools/record_summary.rb
 - lib/spree/agent_tools/registry.rb
 - lib/spree/agent_tools/resource_map.rb
-- lib/spree/agent_tools/workflow_endpoints.rb
-- lib/spree/agent_tools/workflow_schema.rb
-- lib/spree/agent_tools/workflow_tool.rb
 - lib/spree/category_permalink_deduplicator.rb
 - lib/spree/checkout/default_requirements.rb
 - lib/spree/checkout/registry.rb
@@ -2334,9 +2350,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.2
+  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.3
   documentation_uri: https://spreecommerce.org/docs/
-  source_code_uri: https://github.com/spree/spree/tree/v6.0.2
+  source_code_uri: https://github.com/spree/spree/tree/v6.0.3
 post_install_message:
 rdoc_options: []
 require_paths:

data/lib/spree/agent_tools/workflow_endpoints.rb

@@ -1,88 +0,0 @@
-module Spree
-  module AgentTools
-    # Which Admin API operation runs each workflow an agent may call.
-    #
-    # A contract like {ResourceMap} and {MembershipMap}: core declares the
-    # shape, and `spree_api` fills it by reading its own routes and
-    # controllers, so a workflow that gains an endpoint is dispatched without
-    # anyone editing a list.
-    #
-    # A workflow with no entry runs in this process instead. That is not a
-    # fallback to be relied on — it means the capability has no endpoint yet,
-    # and the tool is the only way to reach it.
-    module WorkflowEndpoints
-      # @!attribute verb
-      #   @return [String] 'POST', 'PATCH'
-      # @!attribute path
-      #   @return [String] with `:name` segments still in it
-      # @!attribute body_keys
-      #   @return [Array<String>] what the operation's request body accepts,
-      #     read from the generated OpenAPI document — which is where the
-      #     renames live (a cancellation's `reason:` keyword is
-      #     `cancel_reason_id` on the wire)
-      Entry = Struct.new(:verb, :path, :body_keys, keyword_init: true) do
-        # The dynamic segments, in the order the path names them.
-        #
-        # @return [Array<String>]
-        def path_params
-          @path_params ||= path.scan(/:([a-z_]+)/).flatten
-        end
-
-        # @param values [Hash] path parameter name => id
-        # @return [String]
-        def path_for(values)
-          path.gsub(/:([a-z_]+)/) { values.fetch(Regexp.last_match(1)).to_s }
-        end
-      end
-
-      class << self
-        # @param key [Symbol] a `Spree::Dependencies` workflow key
-        # @return [Entry, nil]
-        def find(key)
-          derive!
-          entries[key.to_sym]
-        end
-
-        # @return [Hash{Symbol => Entry}]
-        def all
-          derive!
-          entries
-        end
-
-        def register(key:, verb:, path:, body_keys: [])
-          entries[key.to_sym] = Entry.new(verb: verb.to_s.upcase, path: path,
-                                          body_keys: body_keys.map(&:to_s))
-        end
-
-        def reset!
-          @entries = {}
-          @derived = false
-        end
-
-        # What has been registered so far, without deriving — for the
-        # deriver itself, which must not ask for what it is producing.
-        #
-        # @return [Hash{Symbol => Entry}]
-        def registered
-          entries
-        end
-
-        # Filled on first read rather than at boot: deriving it loads every
-        # admin controller, which a developer who never runs an agent should
-        # not pay for on each code reload.
-        def derive!
-          return if @derived
-
-          @derived = true
-          Spree::Api::AgentWorkflowEndpoints.install if defined?(Spree::Api::AgentWorkflowEndpoints)
-        end
-
-        private
-
-        def entries
-          @entries ||= {}
-        end
-      end
-    end
-  end
-end

data/lib/spree/agent_tools/workflow_schema.rb

@@ -1,279 +0,0 @@
-module Spree
-  module AgentTools
-    # Reads a workflow's argument contract and turns it into a JSON parameter
-    # schema an agent can fill in.
-    #
-    # Nothing here is hand-maintained. `Method#parameters` on `perform` names
-    # every keyword and says which are required; the YARD `@param` block above
-    # it gives each one a type and a sentence of prose. Both already exist on
-    # every workflow, because the house style requires them — so a workflow
-    # gains a parameter and the tool's schema gains it in the same commit.
-    class WorkflowSchema
-      # A workflow that cannot be exposed as written. Raised at derivation time
-      # so the contract spec fails in CI rather than an agent meeting a broken
-      # tool in production.
-      class UndocumentedParameterError < StandardError
-        def initialize(workflow_class, names)
-          super("#{workflow_class} exposes #{names.join(', ')} without a YARD @param — " \
-                'every parameter of an exposed workflow needs a documented type')
-        end
-      end
-
-      # Tenancy, which comes from the credential and never from the caller.
-      # A workflow that takes `store:` is given the context's store; offering
-      # it would invite a model to name another merchant's store, and the
-      # answer to "which store" is the API key or the signed-in admin.
-      CONTEXT_PARAMETERS = %i[store].freeze
-
-      # Actor keywords a workflow takes whose association has not been
-      # converted to `acted_by` yet — the 6.1 half of
-      # docs/plans/6.0-action-actors.md. They are principals by the same
-      # reasoning as the converted ones, so they are injected too; each drops
-      # off this list as its association converts, and the registry below then
-      # carries it.
-      UNCONVERTED_PRINCIPAL_PARAMETERS = %i[
-        reviewer reviewed_by rejected_by suspended_by verified_by reopened_by
-      ].freeze
-
-      # YARD type to JSON type. A model type is handled separately — it becomes
-      # a prefixed-id string resolved through the resource map.
-      PRIMITIVES = {
-        'String' => 'string',
-        'Symbol' => 'string',
-        'Time' => 'string',
-        'DateTime' => 'string',
-        'Date' => 'string',
-        'Boolean' => 'boolean',
-        'TrueClass' => 'boolean',
-        'FalseClass' => 'boolean',
-        'Integer' => 'integer',
-        'Numeric' => 'number',
-        'Float' => 'number',
-        'BigDecimal' => 'number',
-        'Hash' => 'object',
-        'Array' => 'array'
-      }.freeze
-
-      # @return [Class] the workflow this schema describes
-      attr_reader :workflow_class
-
-      # @param workflow_class [Class]
-      # @param except [Array<Symbol>] parameters to leave out of the schema
-      def initialize(workflow_class, except: [])
-        @workflow_class = workflow_class
-        @except = except.map(&:to_sym)
-      end
-
-      # Every parameter the caller may supply, in `perform` order.
-      #
-      # @return [Array<Hash>] `{name:, required:, json_type:, model_name:, description:}`
-      def parameters
-        @parameters ||= begin
-          documented = docs
-          undocumented = keywords.keys - documented.keys - injected_parameters - @except
-          raise UndocumentedParameterError.new(workflow_class, undocumented) if undocumented.any?
-
-          keywords.filter_map do |name, required|
-            next if @except.include?(name) || injected_parameters.include?(name)
-
-            build_parameter(name, required, documented.fetch(name))
-          end
-        end
-      end
-
-      # The principal keywords this workflow accepts, so the adapter knows
-      # which to inject.
-      #
-      # @return [Array<Symbol>]
-      def principal_parameters
-        keywords.keys & self.class.principal_parameter_names
-      end
-
-      # The tenancy keywords this workflow accepts.
-      #
-      # @return [Array<Symbol>]
-      def context_parameters
-        keywords.keys & CONTEXT_PARAMETERS
-      end
-
-      # Everything filled from the context rather than by the caller.
-      #
-      # @return [Array<Symbol>]
-      def injected_parameters
-        self.class.principal_parameter_names + CONTEXT_PARAMETERS
-      end
-
-      private
-
-      # `perform`'s keywords, mapped to whether they are required.
-      #
-      # @return [Hash{Symbol => Boolean}]
-      def keywords
-        @keywords ||= workflow_class.instance_method(:perform).parameters.filter_map do |kind, name|
-          [name, kind == :keyreq] if %i[key keyreq].include?(kind)
-        end.to_h
-      end
-
-      def build_parameter(name, required, doc)
-        types = doc[:types]
-        model_name = types.filter_map { |type| model_name_for(type) }.first
-
-        json_type = model_name ? 'string' : json_type_for(types)
-
-        {
-          name: name,
-          required: required,
-          model_name: model_name,
-          json_type: json_type,
-          item_type: json_type == 'array' ? item_type_for(types) : nil,
-          description: description_for(doc[:description], model_name)
-        }
-      end
-
-      def description_for(text, model_name)
-        return text if model_name.blank?
-
-        prefix = "Prefixed id of the #{model_name.demodulize.underscore.humanize.downcase}"
-        text.present? ? "#{prefix} — #{text}" : prefix
-      end
-
-      # A Spree model, addressed by prefixed id, as its canonical class name.
-      # A YARD block may name a deprecated alias (`Spree::ShippingMethod` for
-      # `Spree::DeliveryMethod`), and the alias is a constant pointing at the
-      # same class — so resolve the constant and ask it for its own name
-      # rather than trusting the spelling.
-      #
-      # `Spree.admin_user_class` and the bare `Object` of a principal
-      # parameter never reach here: those parameters are stripped first.
-      #
-      # @return [String, nil]
-      def model_name_for(type)
-        return unless type.start_with?('Spree::')
-
-        constant = type.safe_constantize
-        return unless constant.is_a?(Class) && constant < ActiveRecord::Base
-
-        constant.name
-      end
-
-      # What an array holds, read from the documented type: `Array<Hash>` holds
-      # objects, and anything else is treated as strings — the common case for
-      # a list of names or codes.
-      def item_type_for(types)
-        inner = types.filter_map { |type| type[/\AArray<(.+)>\z/, 1] }.first
-
-        PRIMITIVES[inner] || 'string'
-      end
-
-      def json_type_for(types)
-        concrete = types.reject { |type| type == 'nil' }
-        # `Array<Hash>` and friends — the outer container is what JSON sees.
-        concrete = concrete.map { |type| type.split('<').first }
-        concrete.filter_map { |type| PRIMITIVES[type] }.first || 'string'
-      end
-
-      # The YARD block above `perform`, parsed from the workflow's own source.
-      #
-      # Read from source rather than through the YARD gem: the gem is a
-      # development dependency, and this has to work in production, where the
-      # tool list is built on every request.
-      #
-      # @return [Hash{Symbol => Hash}]
-      def docs
-        @docs ||= self.class.parse_docs(workflow_class)
-      end
-
-      class << self
-        # Every keyword that names who acted, so none is ever offered to a
-        # caller as a free parameter.
-        #
-        # Read from {Spree::ActedBy} rather than listed here: the macro already
-        # records each actor association per model, exactly so a caller
-        # sweeping them walks all of them without being handed a list. A model
-        # that gains an actor gains it here in the same commit, and a name
-        # nobody declares cannot linger.
-        #
-        # @return [Array<Symbol>]
-        def principal_parameter_names
-          declared = if defined?(Spree::ActedBy)
-                       Spree::ActedBy.models.flat_map(&:acted_by_associations).map(&:to_sym)
-                     else
-                       []
-                     end
-
-          (declared | UNCONVERTED_PRINCIPAL_PARAMETERS).uniq
-        end
-
-        # Parsed once per workflow class and cached, because a tool list is
-        # built for every MCP request and the source never changes at runtime.
-        #
-        # @param workflow_class [Class]
-        # @return [Hash{Symbol => Hash}] `{types: [String], description: String}`
-        def parse_docs(workflow_class)
-          file, = workflow_class.instance_method(:perform).source_location
-          key = [workflow_class.name, file, (File.mtime(file) if file && File.exist?(file))]
-
-          cache[key] ||= parse_source(workflow_class)
-        end
-
-        # @return [void]
-        def clear_cache!
-          @cache = {}
-        end
-
-        private
-
-        def cache
-          @cache ||= {}
-        end
-
-        def parse_source(workflow_class)
-          source = comment_above_perform(workflow_class)
-          return {} if source.blank?
-
-          parse_param_tags(source)
-        end
-
-        # The comment block immediately above `def perform`, joined so a
-        # `@param` whose prose wraps onto the next line keeps it.
-        def comment_above_perform(workflow_class)
-          location = workflow_class.instance_method(:perform).source_location
-          return if location.nil?
-
-          file, line = location
-          return unless File.exist?(file)
-
-          lines = File.readlines(file)
-          comment = []
-          index = line - 2
-          while index >= 0 && lines[index].strip.start_with?('#')
-            comment.unshift(lines[index].strip.delete_prefix('#').strip)
-            index -= 1
-          end
-          comment
-        end
-
-        def parse_param_tags(comment_lines)
-          tags = {}
-          current = nil
-
-          comment_lines.each do |line|
-            if (match = line.match(/\A@param\s+(\w+)\s+\[([^\]]*)\]\s*(.*)\z/))
-              current = match[1].to_sym
-              tags[current] = {
-                types: match[2].split(',').map(&:strip).reject(&:empty?),
-                description: match[3].strip
-              }
-            elsif line.start_with?('@')
-              current = nil
-            elsif current && line.present?
-              tags[current][:description] = [tags[current][:description], line].reject(&:blank?).join(' ')
-            end
-          end
-
-          tags
-        end
-      end
-    end
-  end
-end