spree_dashboard 5.6.0 → 6.0.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b5b17eac49a94a1eb174e727b7e9b1326ef8ee9bf7cd333d743f74daa236f756
-  data.tar.gz: fa6829074bc825dd8fc4d0be95ad87c8de0ce3996169c20e61d8e3e6904216b1
+  metadata.gz: 28547ad04b0d9b667f01c7b88bb38bcb764a0c59130a6c7e5c37400306ff173c
+  data.tar.gz: ffc9d7d8ac62ce7f67348e3aee068842733b3f9c072d6ec3f834f0627960bb66
 SHA512:
-  metadata.gz: e0049da7bbfdefb533f56378474a7868b5cd639282a136510b9ae6d4796da48c269a9c0e182b304c86143ab5e0d40ea4d2abd66ea5bcf8225ffd78745db07638
-  data.tar.gz: 640fd44cbb5c8d7a55a31b47d227c88adf305c864651b8e6996da7722034c32df54446cb107513cc682ecde3660686aac89000aa24da3a76d3c28721f4d48db3
+  metadata.gz: 4f98563d15ff2b1849f5b263e5b4606da7993d77498dd490f48a2ba3a14c22ca5d70ff6187ac0ae7698f2ae1189e197ed0896202009f6dbae3c15d37889567ce
+  data.tar.gz: 8a66bfb48de8cec16458e267b558327c143923c359f7fd6efa16ce305fb7ef8c790c93211ce554559afd3a61672498715639054c959485b532b4058660d66412

data/LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2026-present, Vendo Sp. z o.o., Vendo Connect Inc.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

data/app/controllers/spree/dashboard/app_controller.rb

@@ -1,77 +1,16 @@
 module Spree
   module Dashboard
-    # Serves a built React Dashboard (`vite build` output) at /dashboard — the
-    # single-node topology: the SPA and the Admin API share one origin, so no
-    # CORS entries and Lax cookies. The dist directory comes from
-    # `Spree::Dashboard.dist_path` (the official Docker image sets it via
-    # SPREE_DASHBOARD_DIST_PATH); when unset, /dashboard 404s.
+    # Serves the built React Dashboard at /dashboard. Everything about how a
+    # bundle is served lives in SpaController; this names which bundle.
     #
-    # SPA semantics: real files are served with long-lived caching (Vite's
-    # `assets/` are content-hashed, so they're immutable); every other path
-    # falls back to index.html with no-cache so deploys take effect on the
-    # next navigation. No authentication — the bundle is public client code;
-    # the SPA authenticates its API calls itself.
-    class AppController < ActionController::Base
-      # GET-only file serving mutates nothing, but enable forgery protection
-      # anyway so the controller stays safe if an action is ever added.
-      protect_from_forgery with: :exception
-      # `verify_same_origin_request` blocks JavaScript responses to plain GET
-      # requests — protection against JSONP-style data leaks from dynamically
-      # generated JS. The Vite bundle is static public code that the SPA's own
-      # <script> tags must load, which is exactly that request shape.
-      skip_after_action :verify_same_origin_request
-
-      def show
-        root = dist_root
-        return head :not_found unless root
-
-        if (file = resolve_file(root, params[:path].to_s))
-          response.headers['Cache-Control'] = cache_control_for(params[:path].to_s)
-          send_file file, disposition: 'inline'
-        elsif (index = root.join('index.html')).file?
-          response.headers['Cache-Control'] = 'no-cache'
-          send_file index, type: 'text/html', disposition: 'inline'
-        else
-          head :not_found
-        end
-      end
-
+    # The dist directory comes from `Spree::Dashboard.dist_path` (the official
+    # Docker image sets it via SPREE_DASHBOARD_DIST_PATH); when unset,
+    # /dashboard 404s.
+    class AppController < SpaController
       private
 
-      def dist_root
-        path = Spree::Dashboard.dist_path
-        return if path.blank?
-
-        root = Pathname.new(path).expand_path
-        root if root.directory?
-      end
-
-      # Resolve a request path to a real file inside the dist directory.
-      # Defense in depth against traversal: reject null bytes, absolute
-      # paths, and any `.`/`..` segment before touching the filesystem, then
-      # verify the expanded path still lives under the dist root (which also
-      # covers symlinks pointing outside it).
-      def resolve_file(root, relative_path)
-        return if relative_path.blank? || relative_path.include?("\0")
-
-        relative = Pathname.new(relative_path)
-        return if relative.absolute?
-
-        segments = relative.each_filename.to_a
-        return if segments.empty? || segments.any? { |segment| segment == '.' || segment == '..' }
-
-        candidate = root.join(*segments).expand_path
-        return unless candidate.to_s.start_with?("#{root}#{File::SEPARATOR}")
-
-        candidate if candidate.file?
-      end
-
-      def cache_control_for(relative_path)
-        if relative_path.start_with?('assets/')
-          'public, max-age=31536000, immutable'
-        else
-          'public, max-age=3600'
-        end
+      def dist_path
+        Spree::Dashboard.dist_path
       end
     end
   end

data/app/controllers/spree/dashboard/spa_controller.rb

@@ -0,0 +1,86 @@
+module Spree
+  module Dashboard
+    # Serves a built Vite SPA from a directory on disk — the single-node
+    # topology, where the SPA and the API it calls share one origin, so no
+    # CORS entries and Lax cookies.
+    #
+    # Abstract: a subclass names the directory by implementing `dist_path`.
+    # Two panels ride on this — the operator's dashboard at /dashboard and the
+    # marketplace seller panel at /sellers — and they differ in nothing but
+    # that directory and their mount point.
+    #
+    # SPA semantics: real files are served with long-lived caching (Vite's
+    # `assets/` are content-hashed, so they're immutable); every other path
+    # falls back to index.html with no-cache so deploys take effect on the
+    # next navigation. No authentication — the bundle is public client code;
+    # the SPA authenticates its API calls itself.
+    class SpaController < ActionController::Base
+      # GET-only file serving mutates nothing, but enable forgery protection
+      # anyway so the controller stays safe if an action is ever added.
+      protect_from_forgery with: :exception
+      # `verify_same_origin_request` blocks JavaScript responses to plain GET
+      # requests — protection against JSONP-style data leaks from dynamically
+      # generated JS. The Vite bundle is static public code that the SPA's own
+      # <script> tags must load, which is exactly that request shape.
+      skip_after_action :verify_same_origin_request
+
+      def show
+        root = dist_root
+        return head :not_found unless root
+
+        if (file = resolve_file(root, params[:path].to_s))
+          response.headers['Cache-Control'] = cache_control_for(params[:path].to_s)
+          send_file file, disposition: 'inline'
+        elsif (index = root.join('index.html')).file?
+          response.headers['Cache-Control'] = 'no-cache'
+          send_file index, type: 'text/html', disposition: 'inline'
+        else
+          head :not_found
+        end
+      end
+
+      private
+
+      # @return [String, nil] directory holding the built bundle
+      def dist_path
+        raise NotImplementedError, "#{self.class} must implement #dist_path"
+      end
+
+      def dist_root
+        path = dist_path
+        return if path.blank?
+
+        root = Pathname.new(path).expand_path
+        root if root.directory?
+      end
+
+      # Resolve a request path to a real file inside the dist directory.
+      # Defense in depth against traversal: reject null bytes, absolute
+      # paths, and any `.`/`..` segment before touching the filesystem, then
+      # verify the expanded path still lives under the dist root (which also
+      # covers symlinks pointing outside it).
+      def resolve_file(root, relative_path)
+        return if relative_path.blank? || relative_path.include?("\0")
+
+        relative = Pathname.new(relative_path)
+        return if relative.absolute?
+
+        segments = relative.each_filename.to_a
+        return if segments.empty? || segments.any? { |segment| segment == '.' || segment == '..' }
+
+        candidate = root.join(*segments).expand_path
+        return unless candidate.to_s.start_with?("#{root}#{File::SEPARATOR}")
+
+        candidate if candidate.file?
+      end
+
+      def cache_control_for(relative_path)
+        if relative_path.start_with?('assets/')
+          'public, max-age=31536000, immutable'
+        else
+          'public, max-age=3600'
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/seller_panel/app_controller.rb

@@ -0,0 +1,18 @@
+module Spree
+  module SellerPanel
+    # Serves the built marketplace seller panel at /sellers.
+    #
+    # Same origin as the dashboard and the API on purpose: the two panels'
+    # refresh cookies are already isolated by name and path, so sharing a host
+    # saves every deployment a second hostname and certificate. A marketplace
+    # that wants sellers on their own domain deploys the bundle there and
+    # points SPREE_SELLER_PANEL_URL at it.
+    class AppController < Spree::Dashboard::SpaController
+      private
+
+      def dist_path
+        Spree::Dashboard.seller_panel_dist_path
+      end
+    end
+  end
+end

data/config/routes.rb

@@ -5,4 +5,10 @@ Spree::Core::Engine.add_routes do
   # being parsed as a response format.
   get '/dashboard', to: 'dashboard/app#show', as: :dashboard_app
   get '/dashboard/*path', to: 'dashboard/app#show', format: false
+
+  # Hosted seller panel, same topology as the dashboard above. Its own mount
+  # rather than a nested route: it is a separate app with its own bundle, and
+  # a marketplace that runs no seller panel leaves it unconfigured.
+  get '/sellers', to: 'seller_panel/app#show', as: :seller_panel_app
+  get '/sellers/*path', to: 'seller_panel/app#show', format: false
 end

data/lib/spree/dashboard.rb

@@ -12,6 +12,17 @@ module Spree
       def dist_path
         @dist_path.presence || ENV.fetch('SPREE_DASHBOARD_DIST_PATH', nil)
       end
+
+      # Directory holding a built marketplace seller panel, served at
+      # /sellers. A separate bundle rather than the dashboard's: it is a
+      # different app — its own entry point, router and API client — so
+      # pointing both mounts at one directory would serve sellers the
+      # operator's back office. Unset, /sellers responds 404.
+      attr_writer :seller_panel_dist_path
+
+      def seller_panel_dist_path
+        @seller_panel_dist_path.presence || ENV.fetch('SPREE_SELLER_PANEL_DIST_PATH', nil)
+      end
     end
   end
 end

metadata

@@ -1,40 +1,43 @@
 --- !ruby/object:Gem::Specification
 name: spree_dashboard
 version: !ruby/object:Gem::Version
-  version: 5.6.0
+  version: 6.0.0.beta1
 platform: ruby
 authors:
 - Vendo Connect Inc.
+- Vendo Sp. z o.o.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-23 00:00:00.000000000 Z
+date: 2026-09-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0
+        version: 6.0.0.beta1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '='
       - !ruby/object:Gem::Version
-        version: 5.6.0
-description: Serves a built Spree React Dashboard at /dashboard with SPA semantics
-  — the single-node topology where the dashboard and the Admin API share one origin.
-  Developer Preview; becomes the default admin delivery in Spree 6.
+        version: 6.0.0.beta1
+description: Serves a built Spree React Dashboard with your Rails server, simplest
+  way to deploy Spree API + Dashboard
 email: hello@spreecommerce.org
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- LICENSE
 - README.md
 - Rakefile
 - app/controllers/spree/dashboard/app_controller.rb
+- app/controllers/spree/dashboard/spa_controller.rb
+- app/controllers/spree/seller_panel/app_controller.rb
 - config/routes.rb
 - lib/spree/dashboard.rb
 - lib/spree/dashboard/engine.rb
@@ -44,9 +47,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0
+  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.0.beta1
   documentation_uri: https://spreecommerce.org/docs/developer/dashboard/deployment
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0
+  source_code_uri: https://github.com/spree/spree/tree/v6.0.0.beta1
 post_install_message:
 rdoc_options: []
 require_paths: