solidus_core 2.10.3 → 2.11.4

data/lib/spree/permission_sets/configuration_display.rb

@@ -5,20 +5,20 @@ module Spree
     class ConfigurationDisplay < PermissionSets::Base
       def activate!
           can [:edit, :admin], :general_settings
-          can [:display, :admin], Spree::TaxCategory
-          can [:display, :admin], Spree::TaxRate
-          can [:display, :admin], Spree::Zone
-          can [:display, :admin], Spree::Country
-          can [:display, :admin], Spree::State
-          can [:display, :admin], Spree::PaymentMethod
-          can [:display, :admin], Spree::Taxonomy
-          can [:display, :admin], Spree::ShippingMethod
-          can [:display, :admin], Spree::ShippingCategory
-          can [:display, :admin], Spree::StockLocation
-          can [:display, :admin], Spree::StockMovement
-          can [:display, :admin], Spree::RefundReason
-          can [:display, :admin], Spree::ReimbursementType
-          can [:display, :admin], Spree::ReturnReason
+          can [:read, :admin], Spree::TaxCategory
+          can [:read, :admin], Spree::TaxRate
+          can [:read, :admin], Spree::Zone
+          can [:read, :admin], Spree::Country
+          can [:read, :admin], Spree::State
+          can [:read, :admin], Spree::PaymentMethod
+          can [:read, :admin], Spree::Taxonomy
+          can [:read, :admin], Spree::ShippingMethod
+          can [:read, :admin], Spree::ShippingCategory
+          can [:read, :admin], Spree::StockLocation
+          can [:read, :admin], Spree::StockMovement
+          can [:read, :admin], Spree::RefundReason
+          can [:read, :admin], Spree::ReimbursementType
+          can [:read, :admin], Spree::ReturnReason
       end
     end
   end

data/lib/spree/permission_sets/default_customer.rb

@@ -4,11 +4,11 @@ module Spree
   module PermissionSets
     class DefaultCustomer < PermissionSets::Base
       def activate!
-        can :display, Country
-        can :display, OptionType
-        can :display, OptionValue
+        can :read, Country
+        can :read, OptionType
+        can :read, OptionValue
         can :create, Order
-        can [:read, :update], Order, Order.where(user: user) do |order, token|
+        can [:show, :update], Order, Order.where(user: user) do |order, token|
           order.user == user || (order.guest_token.present? && token == order.guest_token)
         end
         cannot :update, Order do |order|
@@ -17,20 +17,20 @@ module Spree
         can :create, ReturnAuthorization do |return_authorization|
           return_authorization.order.user == user
         end
-        can [:display, :update], CreditCard, user_id: user.id
-        can :display, Product
-        can :display, ProductProperty
-        can :display, Property
+        can [:read, :update], CreditCard, user_id: user.id
+        can :read, Product
+        can :read, ProductProperty
+        can :read, Property
         can :create, Spree.user_class
-        can [:read, :update, :update_email], Spree.user_class, id: user.id
-        can :display, State
-        can :display, StockItem, stock_location: { active: true }
-        can :display, StockLocation, active: true
-        can :display, Taxon
-        can :display, Taxonomy
+        can [:show, :update, :update_email], Spree.user_class, id: user.id
+        can :read, State
+        can :read, StockItem, stock_location: { active: true }
+        can :read, StockLocation, active: true
+        can :read, Taxon
+        can :read, Taxonomy
         can [:save_in_address_book, :remove_from_address_book], Spree.user_class, id: user.id
-        can [:display, :view_out_of_stock], Variant
-        can :display, Zone
+        can [:read, :view_out_of_stock], Variant
+        can :read, Zone
       end
     end
   end

data/lib/spree/permission_sets/order_display.rb

@@ -4,17 +4,17 @@ module Spree
   module PermissionSets
     class OrderDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin, :edit, :cart], Spree::Order
-        can [:display, :admin], Spree::Payment
-        can [:display, :admin], Spree::Shipment
-        can [:display, :admin], Spree::Adjustment
-        can [:display, :admin], Spree::LineItem
-        can [:display, :admin], Spree::ReturnAuthorization
-        can [:display, :admin], Spree::CustomerReturn
-        can [:display, :admin], Spree::OrderCancellations
-        can [:display, :admin], Spree::Reimbursement
-        can [:display, :admin], Spree::ReturnItem
-        can [:display, :admin], Spree::Refund
+        can [:read, :admin, :edit, :cart], Spree::Order
+        can [:read, :admin], Spree::Payment
+        can [:read, :admin], Spree::Shipment
+        can [:read, :admin], Spree::Adjustment
+        can [:read, :admin], Spree::LineItem
+        can [:read, :admin], Spree::ReturnAuthorization
+        can [:read, :admin], Spree::CustomerReturn
+        can [:read, :admin], Spree::OrderCancellations
+        can [:read, :admin], Spree::Reimbursement
+        can [:read, :admin], Spree::ReturnItem
+        can [:read, :admin], Spree::Refund
       end
     end
   end

data/lib/spree/permission_sets/order_management.rb

@@ -4,7 +4,7 @@ module Spree
   module PermissionSets
     class OrderManagement < PermissionSets::Base
       def activate!
-        can :display, Spree::ReimbursementType
+        can :read, Spree::ReimbursementType
         can :manage, Spree::Order
         can :manage, Spree::Payment
         can :manage, Spree::Shipment

data/lib/spree/permission_sets/product_display.rb

@@ -4,15 +4,15 @@ module Spree
   module PermissionSets
     class ProductDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin, :edit], Spree::Product
-        can [:display, :admin], Spree::Image
-        can [:display, :admin], Spree::Variant
-        can [:display, :admin], Spree::OptionValue
-        can [:display, :admin], Spree::ProductProperty
-        can [:display, :admin], Spree::OptionType
-        can [:display, :admin], Spree::Property
-        can [:display, :admin], Spree::Taxonomy
-        can [:display, :admin], Spree::Taxon
+        can [:read, :admin, :edit], Spree::Product
+        can [:read, :admin], Spree::Image
+        can [:read, :admin], Spree::Variant
+        can [:read, :admin], Spree::OptionValue
+        can [:read, :admin], Spree::ProductProperty
+        can [:read, :admin], Spree::OptionType
+        can [:read, :admin], Spree::Property
+        can [:read, :admin], Spree::Taxonomy
+        can [:read, :admin], Spree::Taxon
       end
     end
   end

data/lib/spree/permission_sets/promotion_display.rb

@@ -4,11 +4,11 @@ module Spree
   module PermissionSets
     class PromotionDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin, :edit], Spree::Promotion
-        can [:display, :admin], Spree::PromotionRule
-        can [:display, :admin], Spree::PromotionAction
-        can [:display, :admin], Spree::PromotionCategory
-        can [:display, :admin], Spree::PromotionCode
+        can [:read, :admin, :edit], Spree::Promotion
+        can [:read, :admin], Spree::PromotionRule
+        can [:read, :admin], Spree::PromotionAction
+        can [:read, :admin], Spree::PromotionCategory
+        can [:read, :admin], Spree::PromotionCode
       end
     end
   end

data/lib/spree/permission_sets/restricted_stock_display.rb

@@ -4,8 +4,8 @@ module Spree
   module PermissionSets
     class RestrictedStockDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin], Spree::StockItem, stock_location_id: location_ids
-        can :display, Spree::StockLocation, id: location_ids
+        can [:read, :admin], Spree::StockItem, stock_location_id: location_ids
+        can :read, Spree::StockLocation, id: location_ids
       end
 
       private

data/lib/spree/permission_sets/restricted_stock_management.rb

@@ -5,7 +5,7 @@ module Spree
     class RestrictedStockManagement < PermissionSets::Base
       def activate!
         can :manage, Spree::StockItem, stock_location_id: location_ids
-        can :display, Spree::StockLocation, id: location_ids
+        can :read, Spree::StockLocation, id: location_ids
       end
 
       private

data/lib/spree/permission_sets/stock_display.rb

@@ -4,8 +4,8 @@ module Spree
   module PermissionSets
     class StockDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin], Spree::StockItem
-        can :display, Spree::StockLocation
+        can [:read, :admin], Spree::StockItem
+        can :read, Spree::StockLocation
       end
     end
   end

data/lib/spree/permission_sets/stock_management.rb

@@ -5,7 +5,7 @@ module Spree
     class StockManagement < PermissionSets::Base
       def activate!
         can :manage, Spree::StockItem
-        can :display, Spree::StockLocation
+        can :read, Spree::StockLocation
       end
     end
   end

data/lib/spree/permission_sets/user_display.rb

@@ -4,9 +4,9 @@ module Spree
   module PermissionSets
     class UserDisplay < PermissionSets::Base
       def activate!
-        can [:display, :admin, :edit, :addresses, :orders, :items], Spree.user_class
-        can [:display, :admin], Spree::StoreCredit
-        can :display, Spree::Role
+        can [:read, :admin, :edit, :addresses, :orders, :items], Spree.user_class
+        can [:read, :admin], Spree::StoreCredit
+        can :read, Spree::Role
       end
     end
   end

data/lib/spree/permission_sets/user_management.rb

@@ -4,7 +4,7 @@ module Spree
   module PermissionSets
     class UserManagement < PermissionSets::Base
       def activate!
-        can [:admin, :display, :create, :update, :save_in_address_book, :remove_from_address_book, :addresses, :orders, :items], Spree.user_class
+        can [:admin, :read, :create, :update, :save_in_address_book, :remove_from_address_book, :addresses, :orders, :items], Spree.user_class
 
         # Note: This does not work with accessible_by.
         # See https://github.com/solidusio/solidus/pull/1263
@@ -15,9 +15,10 @@ module Spree
           user.spree_roles.none?
         end
 
-        cannot [:delete, :destroy], Spree.user_class
+        cannot :destroy, Spree.user_class
         can :manage, Spree::StoreCredit
-        can :display, Spree::Role
+        can :manage, :api_key
+        can :read, Spree::Role
       end
     end
   end

data/lib/spree/permitted_attributes.rb

@@ -39,7 +39,7 @@ module Spree
     mattr_reader(*ATTRIBUTES)
 
     @@address_attributes = [
-      :id, :firstname, :lastname, :first_name, :last_name,
+      :id, :name, :firstname, :lastname, :first_name, :last_name,
       :address1, :address2, :city, :country_id, :state_id,
       :zipcode, :phone, :state_name, :country_iso, :alternative_phone, :company,
       country: [:iso, :name, :iso3, :iso_name],
@@ -69,7 +69,7 @@ module Spree
     @@product_properties_attributes = [:property_name, :value, :position]
 
     @@product_attributes = [
-      :name, :description, :available_on, :permalink, :meta_description,
+      :name, :description, :available_on, :discontinue_on, :permalink, :meta_description,
       :meta_keywords, :price, :sku, :deleted_at,
       :option_values_hash, :weight, :height, :width, :depth,
       :shipping_category_id, :tax_category_id,
@@ -107,7 +107,8 @@ module Spree
 
     @@store_attributes = [:name, :url, :seo_title, :meta_keywords,
                           :meta_description, :default_currency,
-                          :mail_from_address, :cart_tax_country_iso]
+                          :mail_from_address, :cart_tax_country_iso,
+                          :bcc_email]
 
     @@taxonomy_attributes = [:name]
 
@@ -190,12 +191,12 @@ module Spree
 
     private
 
-    def inject_attributes_to_all_steps(attributes, method)
+    def inject_attributes_to_all_steps(attributes, method_name)
       attributes.each do |attribute|
-        PermittedAttributes.checkout_address_attributes.send(method, attribute)
-        PermittedAttributes.checkout_delivery_attributes.send(method, attribute)
-        PermittedAttributes.checkout_payment_attributes.send(method, attribute)
-        PermittedAttributes.checkout_confirm_attributes.send(method, attribute)
+        PermittedAttributes.checkout_address_attributes.send(method_name, attribute)
+        PermittedAttributes.checkout_delivery_attributes.send(method_name, attribute)
+        PermittedAttributes.checkout_payment_attributes.send(method_name, attribute)
+        PermittedAttributes.checkout_confirm_attributes.send(method_name, attribute)
       end
     end
   end

data/lib/spree/preferences/preferable.rb

@@ -141,11 +141,13 @@ module Spree
 
       private
 
-      def convert_preference_value(value, type)
+      def convert_preference_value(value, type, preference_encryptor = nil)
         return nil if value.nil?
         case type
         when :string, :text
           value.to_s
+        when :encrypted_string
+          preference_encryptor.encrypt(value.to_s)
         when :password
           value.to_s
         when :decimal
@@ -158,8 +160,7 @@ module Spree
           value.to_i
         when :boolean
           if !value ||
-             value == 0 ||
-             value =~ /\A(f|false|0)\Z/i ||
+             value.to_s =~ /\A(f|false|0|^)\Z/i ||
              (value.respond_to?(:empty?) && value.empty?)
             false
           else

data/lib/spree/preferences/preferable_class_methods.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'spree/encryptor'
+
 module Spree::Preferences
   module PreferableClassMethods
     DEFAULT_ADMIN_FORM_PREFERENCE_TYPES = %i(
@@ -9,6 +11,7 @@ module Spree::Preferences
       password
       string
       text
+      encrypted_string
     )
 
     def defined_preferences
@@ -16,7 +19,13 @@ module Spree::Preferences
     end
 
     def preference(name, type, options = {})
-      options.assert_valid_keys(:default)
+      options.assert_valid_keys(:default, :encryption_key)
+
+      if type == :encrypted_string
+        preference_encryptor = preference_encryptor(options)
+        options[:default] = preference_encryptor.encrypt(options[:default])
+      end
+
       default = options[:default]
       default = ->{ options[:default] } unless default.is_a?(Proc)
 
@@ -34,13 +43,15 @@ module Spree::Preferences
       # cache_key will be nil for new objects, then if we check if there
       # is a pending preference before going to default
       define_method preference_getter_method(name) do
-        preferences.fetch(name) do
+        value = preferences.fetch(name) do
           default.call
         end
+        value = preference_encryptor.decrypt(value) if preference_encryptor.present?
+        value
       end
 
       define_method preference_setter_method(name) do |value|
-        value = convert_preference_value(value, type)
+        value = convert_preference_value(value, type, preference_encryptor)
         preferences[name] = value
 
         # If this is an activerecord object, we need to inform
@@ -72,6 +83,14 @@ module Spree::Preferences
       "preferred_#{name}_type".to_sym
     end
 
+    def preference_encryptor(options)
+      key = options[:encryption_key] ||
+            ENV['SOLIDUS_PREFERENCES_MASTER_KEY'] ||
+            Rails.application.credentials.secret_key_base
+
+      Spree::Encryptor.new(key)
+    end
+
     # List of preference types allowed as form fields in the Solidus admin
     #
     # Overwrite this method in your class that includes +Spree::Preferable+

data/lib/spree/testing_support.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Spree
+  module TestingSupport
+    SEQUENCES = ["#{::Spree::Core::Engine.root}/lib/spree/testing_support/sequences.rb"]
+    FACTORIES = Dir["#{::Spree::Core::Engine.root}/lib/spree/testing_support/factories/**/*_factory.rb"]
+
+    def self.factory_bot_paths
+      @paths ||= (SEQUENCES + FACTORIES).sort.map { |path| path.sub(/.rb\z/, '') }
+    end
+
+    def self.deprecate_cherry_picking_factory_bot_files
+      # All good if the factory is being loaded by FactoryBot.
+      return if caller.find { |line| line.include? "/factory_bot/find_definitions.rb" }
+
+      Spree::Deprecation.warn(
+        "Please do not cherry-pick factories, this is not well supported by FactoryBot. " \
+        'Use `require "spree/testing_support/factories"` instead.', caller(2)
+      )
+    end
+
+    def self.load_all_factories
+      require 'factory_bot'
+      require 'factory_bot/version'
+
+      requirement = Gem::Requirement.new("~> 4.8")
+      version = Gem::Version.new(FactoryBot::VERSION)
+
+      unless requirement.satisfied_by? version
+        Spree::Deprecation.warn(
+          "Please be aware that the supported version of FactoryBot is #{requirement}, " \
+          "using version #{version} could lead to factory loading issues.", caller(2)
+        )
+      end
+
+      FactoryBot.definition_file_paths.concat(factory_bot_paths).uniq!
+      FactoryBot.reload
+    end
+  end
+end

data/lib/spree/testing_support/ability_helpers.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
 RSpec.shared_examples_for 'access granted' do
-  it 'should allow read' do
-    expect(ability).to be_able_to(:read, resource, token) if token
-    expect(ability).to be_able_to(:read, resource) unless token
+  it 'should allow show' do
+    expect(ability).to be_able_to(:show, resource, token) if token
+    expect(ability).to be_able_to(:show, resource) unless token
   end
 
   it 'should allow create' do
@@ -18,8 +18,8 @@ RSpec.shared_examples_for 'access granted' do
 end
 
 RSpec.shared_examples_for 'access denied' do
-  it 'should not allow read' do
-    expect(ability).to_not be_able_to(:read, resource)
+  it 'should not allow show' do
+    expect(ability).to_not be_able_to(:show, resource)
   end
 
   it 'should not allow create' do
@@ -61,8 +61,8 @@ RSpec.shared_examples_for 'create only' do
     expect(ability).to be_able_to(:create, resource)
   end
 
-  it 'should not allow read' do
-    expect(ability).to_not be_able_to(:read, resource)
+  it 'should not allow show' do
+    expect(ability).to_not be_able_to(:show, resource)
   end
 
   it 'should not allow update' do
@@ -93,8 +93,8 @@ RSpec.shared_examples_for 'update only' do
     expect(ability).to_not be_able_to(:create, resource)
   end
 
-  it 'should not allow read' do
-    expect(ability).to_not be_able_to(:read, resource)
+  it 'should not allow show' do
+    expect(ability).to_not be_able_to(:show, resource)
   end
 
   it 'should allow update' do