solidus_core 2.9.6 → 2.11.0

data/lib/solidus/migrations/promotions_with_code_handlers.rb

@@ -3,7 +3,7 @@
 module Solidus
   module Migrations
     module PromotionWithCodeHandlers
-      class PromotionCode < ActiveRecord::Base
+      class PromotionCode < Spree::Base
         self.table_name = "spree_promotion_codes"
       end
 

data/lib/spree/app_configuration.rb

@@ -24,12 +24,20 @@ require 'spree/core/environment'
 
 module Spree
   class AppConfiguration < Preferences::Configuration
-    # Alphabetized to more easily lookup particular preferences
+    # Preferences (alphabetized to more easily lookup particular preferences)
+
+    # @!attribute [rw] address_requires_phone
+    #   @return [Boolean] should phone number be required (default: +true+)
+    preference :address_requires_phone, :boolean, default: true
 
     # @!attribute [rw] address_requires_state
     #   @return [Boolean] should state/state_name be required (default: +true+)
     preference :address_requires_state, :boolean, default: true
 
+    # @!attribute [rw] legacy
+    #   @return [Boolean] use the legacy address' state validation logic (default: +true+)
+    preference :use_legacy_address_state_validator, :boolean, default: true
+
     # @!attribute [rw] admin_interface_logo
     #   @return [String] URL of logo used in admin (default: +'logo/solidus.svg'+)
     preference :admin_interface_logo, :string, default: 'logo/solidus.svg'
@@ -42,6 +50,12 @@ module Spree
     #   @return [Integer] Number of variants to display in admin (default: +20+)
     preference :admin_variants_per_page, :integer, default: 20
 
+    # @!attribute [rw] admin_vat_country_iso
+    #   Set this if you want to enter prices in the backend including value added tax.
+    #   @return [String, nil] Two-letter ISO code of that {Spree::Country} for which
+    #      prices are entered in the backend (default: nil)
+    preference :admin_vat_country_iso, :string, default: nil
+
     # @!attribute [rw] allow_checkout_on_gateway_error
     #   @return [Boolean] Allow checkout to complete after a failed payment (default: +false+)
     preference :allow_checkout_on_gateway_error, :boolean, default: false
@@ -50,6 +64,10 @@ module Spree
     #   @return [Boolean] When false, customers must create an account to complete an order (default: +true+)
     preference :allow_guest_checkout, :boolean, default: true
 
+    # @!attribute [rw] guest_token_cookie_options
+    #   @return [Hash] Add additional guest_token cookie options here (ie. domain or path)
+    preference :guest_token_cookie_options, :hash, default: {}
+
     # @!attribute [rw] allow_return_item_amount_editing
     #   @return [Boolean] Determines whether an admin is allowed to change a return item's pre-calculated amount (default: +false+)
     preference :allow_return_item_amount_editing, :boolean, default: false
@@ -78,6 +96,21 @@ module Spree
     #   @return [Boolean] Automatically capture the credit card (as opposed to just authorize and capture later) (default: +false+)
     preference :auto_capture_exchanges, :boolean, default: false
 
+    # @!attribute [rw] automatic_default_address
+    #   The default value of true preserves existing backwards compatible feature of
+    #   treating the most recently used address in checkout as the user's default address.
+    #   Setting to false means that the user should manage their own default via some
+    #   custom UI that uses AddressBookController.
+    #   @return [Boolean] Whether use of an address in checkout marks it as user's default
+    preference :automatic_default_address, :boolean, default: true
+
+    # @!attribute [rw] billing_address_required
+    #   Controls whether billing address is required or not in the checkout process
+    #   by default, can be overridden at order level.
+    #   (default: +false+)
+    #   @return [Boolean]
+    preference :billing_address_required, :boolean, default: false
+
     # @!attribute [rw] binary_inventory_cache
     #   Only invalidate product caches when they change from in stock to out of
     #   stock. By default, caches are invalidated on any change of inventory
@@ -88,20 +121,9 @@ module Spree
     #   @return [Boolean]
     preference :binary_inventory_cache, :boolean, default: false
 
-    # @!attribute [rw] completable_order_created_cutoff
-    #   @return [Integer] the number of days to look back for created orders which get returned to the user as last completed
-    preference :completable_order_created_cutoff_days, :integer, default: nil
-
-    # @!attribute [rw] completable_order_created_cutoff
-    #   @return [Integer] the number of days to look back for updated orders which get returned to the user as last completed
-    preference :completable_order_updated_cutoff_days, :integer, default: nil
-
-    # @!attribute [rw] inventory_cache_threshold
-    #   Only invalidate product caches when the count on hand for a stock item
-    #   falls below or rises about the inventory_cache_threshold.  When undefined, the
-    #   product caches will be invalidated anytime the count on hand is changed.
-    #   @return [Integer]
-    preference :inventory_cache_threshold, :integer
+    # @!attribute [rw] can_restrict_stock_management
+    #   @return [Boolean] Indicates if stock management can be restricted by location
+    preference :can_restrict_stock_management, :boolean, default: false
 
     # @!attribute [rw] checkout_zone
     #   @return [String] Name of a {Spree::Zone}, which limits available countries to those included in that zone. (default: +nil+)
@@ -111,11 +133,27 @@ module Spree
     #   @return [Boolean] Request company field for billing and shipping addresses. (default: +false+)
     preference :company, :boolean, default: false
 
+    # @!attribute [rw] completable_order_created_cutoff
+    #   @return [Integer] the number of days to look back for created orders which get returned to the user as last completed
+    preference :completable_order_created_cutoff_days, :integer, default: nil
+
+    # @!attribute [rw] completable_order_created_cutoff
+    #   @return [Integer] the number of days to look back for updated orders which get returned to the user as last completed
+    preference :completable_order_updated_cutoff_days, :integer, default: nil
+
+    # @!attribute [rw] credit_to_new_allocation
+    #   @return [Boolean] Creates a new allocation anytime {Spree::StoreCredit#credit} is called
+    preference :credit_to_new_allocation, :boolean, default: false
+
     # @!attribute [rw] currency
     #   Currency to use by default when not defined on the site (default: +"USD"+)
     #   @return [String] ISO 4217 Three letter currency code
     preference :currency, :string, default: "USD"
 
+    # @!attribute [rw] customer_returns_per_page
+    #   @return [Integer] Customer returns to show per-page in the admin (default: +15+)
+    preference :customer_returns_per_page, :integer, default: 15
+
     # @!attribute [rw] default_country_id
     #   @deprecated Use the default country ISO preference instead
     #   @return [Integer,nil] id of {Spree::Country} to be selected by default in dropdowns (default: nil)
@@ -126,17 +164,22 @@ module Spree
     #   @return [String] Two-letter ISO code of a {Spree::Country} to assumed as the country of an unidentified customer (default: "US")
     preference :default_country_iso, :string, default: 'US'
 
-    # @!attribute [rw] admin_vat_country_iso
-    #   Set this if you want to enter prices in the backend including value added tax.
-    #   @return [String, nil] Two-letter ISO code of that {Spree::Country} for which
-    #      prices are entered in the backend (default: nil)
-    preference :admin_vat_country_iso, :string, default: nil
+    # @!attribute [rw] use_custom_cancancan_actions
+    #   @return [Boolean] Allow to use legacy Solidus custom CanCanCan action aliases (default: +true+)
+    preference :use_custom_cancancan_actions, :boolean, default: true
 
     # @!attribute [rw] generate_api_key_for_all_roles
     #   @return [Boolean] Allow generating api key automatically for user
     #   at role_user creation for all roles. (default: +false+)
     preference :generate_api_key_for_all_roles, :boolean, default: false
 
+    # @!attribute [rw] inventory_cache_threshold
+    #   Only invalidate product caches when the count on hand for a stock item
+    #   falls below or rises about the inventory_cache_threshold.  When undefined, the
+    #   product caches will be invalidated anytime the count on hand is changed.
+    #   @return [Integer]
+    preference :inventory_cache_threshold, :integer
+
     # @!attribute [rw] layout
     #   @return [String] template to use for layout on the frontend (default: +"spree/layouts/spree_application"+)
     preference :layout, :string, default: 'spree/layouts/spree_application'
@@ -145,6 +188,14 @@ module Spree
     #   @return [String] URL of logo used on frontend (default: +'logo/solidus.svg'+)
     preference :logo, :string, default: 'logo/solidus.svg'
 
+    # @!attribute [rw] mails_from
+    #   @return [String] Email address used as +From:+ field in transactional emails.
+    preference :mails_from, :string, default: 'spree@example.com'
+
+    # @!attribute [rw] max_level_in_taxons_menu
+    #   @return [Integer] maximum nesting level in taxons menu (default: +1+)
+    preference :max_level_in_taxons_menu, :integer, default: 1
+
     # @!attribute [rw] order_bill_address_used
     #   @return [Boolean] Use the order's bill address, as opposed to storing
     #   bill addresses on payment sources. (default: +true+)
@@ -154,10 +205,6 @@ module Spree
     #   @return [Integer] the number of days to look back for fully-shipped/cancelled orders in order to charge for them
     preference :order_capturing_time_window, :integer, default: 14
 
-    # @!attribute [rw] max_level_in_taxons_menu
-    #   @return [Integer] maximum nesting level in taxons menu (default: +1+)
-    preference :max_level_in_taxons_menu, :integer, default: 1
-
     # @!attribute [rw] order_mutex_max_age
     #   @return [Integer] Max age of {Spree::OrderMutex} in seconds (default: 2 minutes)
     preference :order_mutex_max_age, :integer, default: 120
@@ -178,9 +225,22 @@ module Spree
     #   @return [Integer] Promotions to show per-page in the admin (default: +15+)
     preference :promotions_per_page, :integer, default: 15
 
-    # @!attribute [rw] customer_returns_per_page
-    #   @return [Integer] Customer returns to show per-page in the admin (default: +15+)
-    preference :customer_returns_per_page, :integer, default: 15
+    # @!attribute [rw] disable_actionless_promotion_validation
+    #   @return [Boolean] Promotions should have actions associated before being considered active (default: +true+)
+    preference :consider_actionless_promotion_active, :boolean, default: true
+
+    # @!attribute [rw] raise_with_invalid_currency
+    #   Whether to raise an exception if trying to set a line item currency
+    #   different from the order currency. When false a validation error
+    #   is added to the instance instead.
+    #   @return [Boolean] (default: +true+)
+    preference :raise_with_invalid_currency, :boolean, default: true
+
+    # @!attribute [rw] redirect_back_on_unauthorized
+    #   Whether to try to redirect users back when they try to access
+    #   unauthorized routes, before redirect them to /unauthorized.
+    #   @return [Boolean] (default: +false+)
+    preference :redirect_back_on_unauthorized, :boolean, default: false
 
     # @!attribute [rw] require_master_price
     #   @return [Boolean] Require a price on the master variant of a product (default: +true+)
@@ -200,6 +260,22 @@ module Spree
     #   (default: +['admin']+)
     preference :roles_for_auto_api_key, :array, default: ['admin']
 
+    # @!attribute [rw] countries_that_use_nested_subregions
+    #   @return [Array] An array of countries that use nested subregions, instead
+    #   of the default subregions that come with Carmen. Will be used on store creation
+    #   to ensure the correct states are generated, and when running the states
+    #   regenerate rake task.
+    #   (default: +['IT']+)
+    preference :countries_that_use_nested_subregions, :array, default: ['IT']
+
+    # @!attribute [rw] run_order_validations_on_order_updater
+    #   @return [Boolean] Whether to run validation when updating an order with the OrderUpdater
+    preference :run_order_validations_on_order_updater, :boolean, default: false
+
+    # @!attribute [rw] send_core_emails
+    #   @return [Boolean] Whether to send transactional emails (default: true)
+    preference :send_core_emails, :boolean, default: true
+
     # @!attribute [rw] shipping_instructions
     #   @return [Boolean] Request instructions/info for shipping (default: +false+)
     preference :shipping_instructions, :boolean, default: false
@@ -231,33 +307,23 @@ module Spree
     #   @return [] Track on_hand values for variants / products. (default: true)
     preference :track_inventory_levels, :boolean, default: true
 
-    # Default mail headers settings
-
-    # @!attribute [rw] send_core_emails
-    #   @return [Boolean] Whether to send transactional emails (default: true)
-    preference :send_core_emails, :boolean, default: true
+    # @!attribute [rw] use_combined_first_and_last_name_in_address
+    #   @return [Boolean] Use Spree::Address combined first and last name in HTML views and
+    #   API responses. (default: +false+)
+    preference :use_combined_first_and_last_name_in_address, :boolean, default: false
 
-    # @!attribute [rw] mails_from
-    #   @return [String] Email address used as +From:+ field in transactional emails.
-    preference :mails_from, :string, default: 'spree@example.com'
-
-    # Store credits configurations
-
-    # @!attribute [rw] credit_to_new_allocation
-    #   @return [Boolean] Creates a new allocation anytime {Spree::StoreCredit#credit} is called
-    preference :credit_to_new_allocation, :boolean, default: false
+    # @!attribute [rw] use_legacy_order_state_machine
+    #   @return [Boolean] Uses the legacy order state machine from Spree::Order::Checkout
+    #   (default: +false+)
+    preference :use_legacy_order_state_machine, :boolean, default: true
 
-    # @!attribute [rw] automatic_default_address
-    #   The default value of true preserves existing backwards compatible feature of
-    #   treating the most recently used address in checkout as the user's default address.
-    #   Setting to false means that the user should manage their own default via some
-    #   custom UI that uses AddressBookController.
-    #   @return [Boolean] Whether use of an address in checkout marks it as user's default
-    preference :automatic_default_address, :boolean, default: true
+    # The legacy_store_credit_category_name allows to control whether the legacy
+    # way of fetching the category should be used.
+    #
+    # @param [Boolean] enable/disable the legacy way of fetching the store category name
+    preference :use_legacy_store_credit_reimbursement_category_name, :boolean, default: true
 
-    # @!attribute [rw] can_restrict_stock_management
-    #   @return [Boolean] Indicates if stock management can be restricted by location
-    preference :can_restrict_stock_management, :boolean, default: false
+    # Other configurations
 
     # Allows restricting what currencies will be available.
     #
@@ -292,6 +358,14 @@ module Spree
 
     class_name_attribute :variant_search_class, default: 'Spree::Core::Search::Variant'
 
+    # Allows implementing custom vat prices generation
+    # @!attribute [rw] variant_vat_prices_generator_class
+    # @see Spree::Variant::VatPriceGenerator
+    # @return [Class] an object that conforms to the API of
+    #   the standard variant vat prices generator class
+    #   Spree::Variant::VatPriceGenerator.
+    class_name_attribute :variant_vat_prices_generator_class, default: 'Spree::Variant::VatPriceGenerator'
+
     # promotion_chooser_class allows extensions to provide their own PromotionChooser
     class_name_attribute :promotion_chooser_class, default: 'Spree::PromotionChooser'
 
@@ -306,7 +380,6 @@ module Spree
     # @!attribute [rw] shipping_rate_tax_calculator_class
     # @return [Class] a class with the same public interfaces as
     #   Spree::TaxCalculator::ShippingRate
-    # @api experimental
     class_name_attribute :shipping_rate_tax_calculator_class, default: 'Spree::TaxCalculator::ShippingRate'
 
     # Allows providing your own Mailer for order mailer.
@@ -384,7 +457,6 @@ module Spree
     # @!attribute [rw] tax_adjuster_class
     # @return [Class] a class with the same public interfaces as
     #   Spree::Tax::OrderAdjuster
-    # @api experimental
     class_name_attribute :tax_adjuster_class, default: 'Spree::Tax::OrderAdjuster'
 
     # Allows providing your own class for calculating taxes on an order.
@@ -392,7 +464,6 @@ module Spree
     # @!attribute [rw] tax_calculator_class
     # @return [Class] a class with the same public interfaces as
     #   Spree::TaxCalculator::Default
-    # @api experimental
     class_name_attribute :tax_calculator_class, default: 'Spree::TaxCalculator::Default'
 
     # Allows providing your own class for choosing which store to use.
@@ -454,6 +525,10 @@ module Spree
       @order_number_generator ||= Spree::Order::NumberGenerator.new
     end
 
+    def state_machines
+      @state_machines ||= Spree::Core::StateMachines.new
+    end
+
     def static_model_preferences
       @static_model_preferences ||= Spree::Preferences::StaticModelPreferences.new
     end
@@ -473,6 +548,12 @@ module Spree
       @events_configuration ||= Spree::Event::Configuration.new
     end
 
+    def user_last_url_storer_rules
+      @user_last_url_storer_rules ||= ::Spree::Core::ClassConstantizer::Set.new.tap do |set|
+        set << 'Spree::UserLastUrlStorer::Rules::AuthenticationRule'
+      end
+    end
+
     def environment
       @environment ||= Spree::Core::Environment.new(self).tap do |env|
         env.calculators.promotion_actions_create_adjustments = %w[

data/lib/spree/awesome_nested_set_override.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module AwesomeNestedSetOvveride
+  # Add :polimorphic key option only when used to make it work with Rails 6.1+,
+  # required since rails/rails@2c008d9
+  # This can be removed when upgrading to an awesome_nested_set version
+  # compliant with Rails 6.1+, already addressed in
+  # collectiveidea/awesome_nested_set#421
+  module RelateParent
+    def acts_as_nested_set_relate_parent!
+      # Disable Rubocop to keep original code for diffs
+      # rubocop:disable
+      options = {
+        :class_name => self.base_class.to_s,
+        :foreign_key => parent_column_name,
+        :primary_key => primary_column_name,
+        :counter_cache => acts_as_nested_set_options[:counter_cache],
+        :inverse_of => (:children unless acts_as_nested_set_options[:polymorphic]),
+        :touch => acts_as_nested_set_options[:touch]
+      }
+      options[:polymorphic] = true if acts_as_nested_set_options[:polymorphic]
+      options[:optional] = true if ActiveRecord::VERSION::MAJOR >= 5
+      belongs_to :parent, options
+      # rubocop:enable
+    end
+
+    CollectiveIdea::Acts::NestedSet.prepend self
+  end
+
+  # Skip breaking model reload before update depth. Already addressed in
+  # collectiveidea/awesome_nested_set#413
+  # This can be removed when a new version of awesome_nested_set is released.
+  module Model
+    def set_depth!
+      return unless has_depth_column?
+
+      in_tenacious_transaction do
+        update_depth(level)
+      end
+    end
+
+    CollectiveIdea::Acts::NestedSet::Model.prepend self
+  end
+end

data/lib/spree/core.rb

@@ -78,6 +78,7 @@ require 'spree/core/product_duplicator'
 require 'spree/core/current_store'
 require 'spree/core/controller_helpers/auth'
 require 'spree/core/controller_helpers/common'
+require 'spree/core/controller_helpers/current_host'
 require 'spree/core/controller_helpers/order'
 require 'spree/core/controller_helpers/payment_parameters'
 require 'spree/core/controller_helpers/pricing'
@@ -85,6 +86,7 @@ require 'spree/core/controller_helpers/search'
 require 'spree/core/controller_helpers/store'
 require 'spree/core/controller_helpers/strong_parameters'
 require 'spree/core/role_configuration'
+require 'spree/core/state_machines'
 require 'spree/core/stock_configuration'
 require 'spree/core/validators/email'
 require 'spree/permission_sets'
@@ -92,3 +94,7 @@ require 'spree/permission_sets'
 require 'spree/preferences/store'
 require 'spree/preferences/static_model_preferences'
 require 'spree/preferences/scoped_store'
+
+if Rails.gem_version >= Gem::Version.new('6.1.0.alpha')
+  require 'spree/awesome_nested_set_override'
+end

data/lib/spree/core/controller_helpers/auth.rb

@@ -11,7 +11,7 @@ module Spree
         # @!attribute [rw] unauthorized_redirect
         #   @!scope class
         #   Extension point for overriding behaviour of access denied errors.
-        #   Default behaviour is to redirect to "/unauthorized" with a flash
+        #   Default behaviour is to redirect back or to "/unauthorized" with a flash
         #   message.
         #   @return [Proc] action to take when access denied error is raised.
 
@@ -22,7 +22,20 @@ module Spree
           class_attribute :unauthorized_redirect
           self.unauthorized_redirect = -> do
             flash[:error] = I18n.t('spree.authorization_failure')
-            redirect_to "/unauthorized"
+            if Spree::Config.redirect_back_on_unauthorized
+              redirect_back(fallback_location: "/unauthorized")
+            else
+              Spree::Deprecation.warn <<-WARN.strip_heredoc, caller
+                Having Spree::Config.redirect_back_on_unauthorized set
+                to `false` is deprecated and will not be supported in Solidus 3.0.
+
+                Please change this configuration to `true` and be sure that your
+                application does not break trying to redirect back when there is
+                an unauthorized access.
+              WARN
+
+              redirect_to "/unauthorized"
+            end
           end
 
           rescue_from CanCan::AccessDenied do
@@ -42,27 +55,15 @@ module Spree
 
         def set_guest_token
           unless cookies.signed[:guest_token].present?
-            cookies.permanent.signed[:guest_token] = {
+            cookies.permanent.signed[:guest_token] = Spree::Config[:guest_token_cookie_options].merge(
               value: SecureRandom.urlsafe_base64(nil, false),
               httponly: true
-            }
+            )
           end
         end
 
         def store_location
-          # disallow return to login, logout, signup pages
-          authentication_routes = [:spree_signup_path, :spree_login_path, :spree_logout_path]
-          disallowed_urls = []
-          authentication_routes.each do |route|
-            if respond_to?(route)
-              disallowed_urls << send(route)
-            end
-          end
-
-          disallowed_urls.map!{ |url| url[/\/\w+$/] }
-          unless disallowed_urls.include?(request.fullpath)
-            session['spree_user_return_to'] = request.fullpath.gsub('//', '/')
-          end
+          Spree::UserLastUrlStorer.new(self).store_location
         end
 
         # proxy method to *possible* spree_current_user method