solidus_core 4.1.6 → 4.5.1

data/app/models/spree/permission_sets/super_user.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Full permissions for store administration.
+    #
+    # This permission set is always added to users with the `:admin` role.
+    #
+    # It grants permission to perform any read or write action on any resource.
+    class SuperUser < PermissionSets::Base
+      class << self
+        def privilege
+          :other
+        end
+
+        def category
+          :super_user
+        end
+      end
+
+      def activate!
+        can :manage, :all
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/user_display.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Read-only permissions for users, roles and store credits.
+    #
+    # This permission set allows users to view all related information about
+    # users, roles and store credits, also from the admin panel.
+    class UserDisplay < PermissionSets::Base
+      class << self
+        def privilege
+          :display
+        end
+
+        def category
+          :user
+        end
+      end
+
+      def activate!
+        can [:read, :admin, :edit, :addresses, :orders, :items], Spree.user_class
+        can [:read, :admin], Spree::StoreCredit
+        can :read, Spree::Role
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/user_management.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Spree
+  module PermissionSets
+    # Full permissions for user management.
+    #
+    # This permission set grants full control over all user and
+    # related resources, including:
+    #
+    # - Users
+    # - Store credits
+    # - Roles
+    # - API keys
+    class UserManagement < PermissionSets::Base
+      class << self
+        def privilege
+          :management
+        end
+
+        def category
+          :user
+        end
+      end
+
+      def activate!
+        can [:admin, :read, :create, :update, :save_in_address_book, :remove_from_address_book, :addresses, :orders, :items], Spree.user_class
+
+        # NOTE: This does not work with accessible_by.
+        # See https://github.com/solidusio/solidus/pull/1263
+        can :update_email, Spree.user_class do |user|
+          user.spree_roles.none?
+        end
+        can :update_password, Spree.user_class do |user|
+          user.spree_roles.none?
+        end
+
+        cannot :destroy, Spree.user_class
+        can :manage, Spree::StoreCredit
+        can :manage, :api_key
+        can :read, Spree::Role
+      end
+    end
+  end
+end

data/app/models/spree/preference.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class Spree::Preference < Spree::Base
-  serialize :value
+  serialize :value, coder: YAML
 
   validates :key, presence: true, uniqueness: { allow_blank: true, case_sensitive: true }
 end

data/app/models/spree/product.rb

@@ -16,7 +16,6 @@ module Spree
       self.product_option_types = []
       self.product_properties = []
       self.classifications.destroy_all
-      self.product_promotion_rules = []
     end
 
     has_many :product_option_types, dependent: :destroy, inverse_of: :product
@@ -31,11 +30,9 @@ module Spree
     has_many :classifications, dependent: :delete_all, inverse_of: :product
     has_many :taxons, through: :classifications, before_remove: :remove_taxon
 
-    has_many :product_promotion_rules, dependent: :destroy
-    has_many :promotion_rules, through: :product_promotion_rules
-
     belongs_to :tax_category, class_name: 'Spree::TaxCategory', optional: true
     belongs_to :shipping_category, class_name: 'Spree::ShippingCategory', inverse_of: :products, optional: true
+    belongs_to :primary_taxon, class_name: 'Spree::Taxon', optional: true
 
     has_one :master,
       -> { where(is_master: true).with_discarded },
@@ -61,6 +58,8 @@ module Spree
     has_many :line_items, through: :variants_including_master
     has_many :orders, through: :line_items
 
+    has_many :option_values, -> { distinct }, through: :variants_including_master
+
     scope :sort_by_master_default_price_amount_asc, -> {
       with_default_price.order('spree_prices.amount ASC')
     }
@@ -86,6 +85,8 @@ module Spree
       :track_inventory,
       :weight,
       :width,
+      :gtin,
+      :condition
     ]
     MASTER_ATTRIBUTES.each do |attr|
       delegate :"#{attr}", :"#{attr}=", to: :find_or_build_master
@@ -131,7 +132,7 @@ module Spree
 
     alias :options :product_option_types
 
-    self.allowed_ransackable_associations = %w[stores variants_including_master master variants]
+    self.allowed_ransackable_associations = %w[stores variants_including_master master variants option_values]
     self.allowed_ransackable_attributes = %w[name slug]
     self.allowed_ransackable_scopes = %i[available with_discarded with_all_variant_sku_cont with_kept_variant_sku_cont]
 
@@ -252,7 +253,7 @@ module Spree
       ActiveRecord::Base.transaction do
         # Works around spree_i18n https://github.com/spree/spree/issues/301
         property = Spree::Property.create_with(presentation: property_name).find_or_create_by(name: property_name)
-        product_property = Spree::ProductProperty.where(product: self, property: property).first_or_initialize
+        product_property = Spree::ProductProperty.where(product: self, property:).first_or_initialize
         product_property.value = property_value
         product_property.save!
       end
@@ -260,8 +261,7 @@ module Spree
 
     # @return [Array] all advertised and not-rejected promotions
     def possible_promotions
-      promotion_ids = promotion_rules.map(&:promotion_id).uniq
-      Spree::Promotion.advertised.where(id: promotion_ids).reject(&:inactive?)
+      Spree::Config.promotions.advertiser_class.for_product(self)
     end
 
     # The number of on-hand stock items; Infinity if any variant does not track
@@ -294,6 +294,10 @@ module Spree
       @gallery ||= Spree::Config.product_gallery_class.new(self)
     end
 
+    def brand
+      Spree::Config.brand_selector_class.new(self).call
+    end
+
     private
 
     def any_variants_not_track_inventory?
@@ -366,7 +370,7 @@ module Spree
     end
 
     def remove_taxon(taxon)
-      removed_classifications = classifications.where(taxon: taxon)
+      removed_classifications = classifications.where(taxon:)
       removed_classifications.each(&:remove_from_list)
     end
   end

data/app/models/spree/refund.rb

@@ -2,6 +2,8 @@
 
 module Spree
   class Refund < Spree::Base
+    include Metadata
+
     belongs_to :payment, inverse_of: :refunds, optional: true
     belongs_to :reason, class_name: 'Spree::RefundReason', foreign_key: :refund_reason_id, optional: true
     belongs_to :reimbursement, inverse_of: :refunds, optional: true
@@ -21,7 +23,7 @@ module Spree
     delegate :currency, to: :payment
 
     def money
-      Spree::Money.new(amount, { currency: currency })
+      Spree::Money.new(amount, { currency: })
     end
     alias display_amount money
 

data/app/models/spree/refund_reason.rb

@@ -2,12 +2,17 @@
 
 module Spree
   class RefundReason < Spree::Base
-    include Spree::NamedType
+    scope :active, -> { where(active: true) }
+    default_scope -> { order(arel_table[:name].lower) }
+
+    validates :name, presence: true, uniqueness: { case_sensitive: false, allow_blank: true }
 
     RETURN_PROCESSING_REASON = 'Return processing'
 
     has_many :refunds
 
+    self.allowed_ransackable_attributes = %w[name code]
+
     def self.return_processing_reason
       find_by!(name: RETURN_PROCESSING_REASON, mutable: false)
     end

data/app/models/spree/reimbursement.rb

@@ -57,7 +57,7 @@ module Spree
       def build_from_customer_return(customer_return)
         order = customer_return.order
         order.reimbursements.build({
-          customer_return: customer_return,
+          customer_return:,
           return_items: customer_return.return_items.accepted.not_reimbursed
         })
       end
@@ -88,7 +88,7 @@ module Spree
       reload
       update!(total: calculated_total)
 
-      reimbursement_performer.perform(self, created_by: created_by)
+      reimbursement_performer.perform(self, created_by:)
 
       if unpaid_amount_within_tolerance?
         reimbursed!
@@ -108,7 +108,7 @@ module Spree
       reload
       update!(total: calculated_total)
 
-      reimbursement_performer.simulate(self, created_by: created_by)
+      reimbursement_performer.simulate(self, created_by:)
     end
 
     def return_items_requiring_exchange
@@ -131,7 +131,7 @@ module Spree
     def return_all(created_by:)
       return_items.each(&:accept!)
       save!
-      perform!(created_by: created_by)
+      perform!(created_by:)
     end
 
     # The returned category is used as the category

data/app/models/spree/reimbursement_performer.rb

@@ -12,12 +12,12 @@ module Spree
       # - #display_amount
       # so they can be displayed in the Admin UI appropriately.
       def simulate(reimbursement, created_by:)
-        execute(reimbursement, true, created_by: created_by)
+        execute(reimbursement, true, created_by:)
       end
 
       # Actually perform the reimbursement
       def perform(reimbursement, created_by:)
-        execute(reimbursement, false, created_by: created_by)
+        execute(reimbursement, false, created_by:)
       end
 
       private
@@ -26,7 +26,7 @@ module Spree
         reimbursement_type_hash = calculate_reimbursement_types(reimbursement)
 
         reimbursement_type_hash.flat_map do |reimbursement_type, return_items|
-          reimbursement_type.reimburse(reimbursement, return_items, simulate, created_by: created_by)
+          reimbursement_type.reimburse(reimbursement, return_items, simulate, created_by:)
         end
       end
 

data/app/models/spree/reimbursement_tax_calculator.rb

@@ -26,8 +26,8 @@ module Spree
         included_tax_total   = percent_of_tax * return_item.inventory_unit.included_tax_total
 
         return_item.update!({
-          additional_tax_total: additional_tax_total,
-          included_tax_total:   included_tax_total
+          additional_tax_total:,
+          included_tax_total:
         })
       end
     end

data/app/models/spree/reimbursement_type/credit.rb

@@ -7,7 +7,7 @@ module Spree
     class << self
       def reimburse(reimbursement, return_items, simulate, created_by:)
         unpaid_amount = return_items.sum(&:total).round(2, :down)
-        reimbursement_list, _unpaid_amount = create_credits(reimbursement, unpaid_amount, simulate, created_by: created_by)
+        reimbursement_list, _unpaid_amount = create_credits(reimbursement, unpaid_amount, simulate, created_by:)
         reimbursement_list
       end
     end

data/app/models/spree/reimbursement_type/reimbursement_helpers.rb

@@ -21,7 +21,7 @@ module Spree
     end
 
     def create_credits(reimbursement, unpaid_amount, simulate, reimbursement_list = [], created_by:)
-      credits = [create_credit(reimbursement, unpaid_amount, simulate, created_by: created_by)]
+      credits = [create_credit(reimbursement, unpaid_amount, simulate, created_by:)]
       unpaid_amount -= credits.sum(&:amount)
       reimbursement_list += credits
 
@@ -32,8 +32,8 @@ module Spree
 
     def create_refund(reimbursement, payment, amount, simulate)
       refund = reimbursement.refunds.build({
-        payment: payment,
-        amount: amount,
+        payment:,
+        amount:,
         reason: Spree::RefundReason.return_processing_reason
       })
 
@@ -50,8 +50,8 @@ module Spree
     # If you have multiple methods of crediting a customer, overwrite this method
     # Must return an array of objects the respond to #description, #display_amount
     def create_credit(reimbursement, unpaid_amount, simulate, created_by:)
-      creditable = create_creditable(reimbursement, unpaid_amount, created_by: created_by)
-      credit = reimbursement.credits.build(creditable: creditable, amount: unpaid_amount)
+      creditable = create_creditable(reimbursement, unpaid_amount, created_by:)
+      credit = reimbursement.credits.build(creditable:, amount: unpaid_amount)
       simulate ? credit.readonly! : credit.save!
       credit
     end
@@ -61,7 +61,7 @@ module Spree
         user: reimbursement.order.user,
         amount: unpaid_amount,
         category: reimbursement.store_credit_category,
-        created_by: created_by,
+        created_by:,
         memo: "Refund for uncreditable payments on order #{reimbursement.order.number}",
         currency: reimbursement.order.currency
       )

data/app/models/spree/reimbursement_type/store_credit.rb

@@ -25,7 +25,7 @@ class Spree::ReimbursementType::StoreCredit < Spree::ReimbursementType
           unpaid_amount,
           simulate,
           reimbursement_list,
-          created_by: created_by
+          created_by:
         )
       end
 

data/app/models/spree/reimbursement_type.rb

@@ -2,12 +2,17 @@
 
 module Spree
   class ReimbursementType < Spree::Base
-    include Spree::NamedType
+    scope :active, -> { where(active: true) }
+    default_scope -> { order(arel_table[:name].lower) }
+
+    validates :name, presence: true, uniqueness: { case_sensitive: false, allow_blank: true }
 
     ORIGINAL = 'original'
 
     has_many :return_items
 
+    self.allowed_ransackable_attributes = %w[name]
+
     # This method will reimburse the return items based on however it child implements it
     # By default it takes a reimbursement, the return items it needs to reimburse, and if
     # it is a simulation or a real reimbursement. This should return an array

data/app/models/spree/return_authorization.rb

@@ -4,6 +4,8 @@ module Spree
   # Models the return of Inventory Units to a Stock Location for an Order.
   #
   class ReturnAuthorization < Spree::Base
+    include Metadata
+
     belongs_to :order, class_name: 'Spree::Order', inverse_of: :return_authorizations, optional: true
 
     has_many :return_items, inverse_of: :return_authorization, dependent: :destroy

data/app/models/spree/return_item.rb

@@ -53,7 +53,7 @@ module Spree
     scope :not_expired, -> { where.not(reception_status: 'expired') }
     scope :received, -> { where(reception_status: 'received') }
     INTERMEDIATE_RECEPTION_STATUSES.each do |reception_status|
-      scope reception_status, -> { where(reception_status: reception_status) }
+      scope reception_status, -> { where(reception_status:) }
     end
     scope :pending, -> { where(acceptance_status: 'pending') }
     scope :accepted, -> { where(acceptance_status: 'accepted') }
@@ -67,7 +67,7 @@ module Spree
     scope :exchange_processed, -> { where.not(exchange_inventory_unit: nil) }
     scope :exchange_required, -> { exchange_requested.where(exchange_inventory_unit: nil) }
 
-    serialize :acceptance_status_errors
+    serialize :acceptance_status_errors, coder: YAML
 
     delegate :eligible_for_return?, :requires_manual_intervention?, to: :validator
     delegate :variant, to: :inventory_unit
@@ -93,8 +93,8 @@ module Spree
     # @return [Spree::ReturnItem] a valid return item for the given inventory
     #   unit if one exists, or a new one if one does not
     def self.from_inventory_unit(inventory_unit)
-      valid.find_by(inventory_unit: inventory_unit) ||
-        new(inventory_unit: inventory_unit).tap(&:set_default_amount)
+      valid.find_by(inventory_unit:) ||
+        new(inventory_unit:).tap(&:set_default_amount)
     end
 
     # @return [Boolean] true when an exchange has been requested on this return
@@ -130,7 +130,7 @@ module Spree
     # @return [ActiveRecord::Relation<Spree::Variant>] the variants eligible
     #   for exchange for this return item
     def eligible_exchange_variants(stock_locations = nil)
-      exchange_variant_engine.eligible_variants(variant, stock_locations: stock_locations)
+      exchange_variant_engine.eligible_variants(variant, stock_locations:)
     end
 
     # Builds the exchange inventory unit for this return item, only if an
@@ -248,20 +248,20 @@ module Spree
 
     def validate_no_other_completed_return_items
       other_return_item = Spree::ReturnItem.where({
-        inventory_unit_id: inventory_unit_id,
+        inventory_unit_id:,
         reception_status: COMPLETED_RECEPTION_STATUSES
-      }).where.not(id: id).first
+      }).where.not(id:).first
 
       if other_return_item && (new_record? || COMPLETED_RECEPTION_STATUSES.include?(reception_status.to_sym))
         errors.add(:inventory_unit, :other_completed_return_item_exists,
-          inventory_unit_id: inventory_unit_id,
+          inventory_unit_id:,
           return_item_id: other_return_item.id)
       end
     end
 
     def cancel_others
-      Spree::ReturnItem.where(inventory_unit_id: inventory_unit_id)
-                       .where.not(id: id)
+      Spree::ReturnItem.where(inventory_unit_id:)
+                       .where.not(id:)
                        .valid
                        .each(&:cancel!)
     end

data/app/models/spree/return_reason.rb

@@ -2,10 +2,15 @@
 
 module Spree
   class ReturnReason < Spree::Base
-    include Spree::NamedType
+    scope :active, -> { where(active: true) }
+    default_scope -> { order(arel_table[:name].lower) }
+
+    validates :name, presence: true, uniqueness: { case_sensitive: false, allow_blank: true }
 
     has_many :return_authorizations
 
+    self.allowed_ransackable_attributes = %w[name]
+
     def self.reasons_for_return_items(return_items)
       # Only allow an inactive reason if it's already associated to a return item
       active | return_items.map(&:return_reason).compact

data/app/models/spree/role.rb

@@ -4,8 +4,10 @@ module Spree
   class Role < Spree::Base
     has_many :role_users, class_name: "Spree::RoleUser", dependent: :destroy
     has_many :users, through: :role_users
+    has_many :role_permissions, dependent: :destroy
+    has_many :permission_sets, through: :role_permissions
 
-    validates_uniqueness_of :name, case_sensitive: true
+    validates :name, presence: true, uniqueness: { case_sensitive: true, allow_blank: true }
 
     def admin?
       name == "admin"

data/app/models/spree/role_permission.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Spree
+  class RolePermission < Spree::Base
+    belongs_to :role
+    belongs_to :permission_set
+  end
+end

data/app/models/spree/shipment.rb

@@ -4,6 +4,8 @@ module Spree
   # An order's planned shipments including tracking and cost.
   #
   class Shipment < Spree::Base
+    include Metadata
+
     belongs_to :order, class_name: 'Spree::Order', touch: true, inverse_of: :shipments, optional: true
     belongs_to :stock_location, class_name: 'Spree::StockLocation', optional: true
 
@@ -31,7 +33,7 @@ module Spree
     scope :ready,   -> { with_state('ready') }
     scope :shipped, -> { with_state('shipped') }
     scope :trackable, -> { where("tracking IS NOT NULL AND tracking != ''") }
-    scope :with_state, ->(*state) { where(state: state) }
+    scope :with_state, ->(*state) { where(state:) }
     # sort by most recent shipped_at, falling back to created_at. add "id desc" to make specs that involve this scope more deterministic.
     scope :reverse_chronological, -> {
       order(Arel.sql("coalesce(#{Spree::Shipment.table_name}.shipped_at, #{Spree::Shipment.table_name}.created_at) desc"), id: :desc)
@@ -92,7 +94,7 @@ module Spree
     # @return [BigDecimal] the amount of this item, taking into consideration
     #   all non-tax adjustments.
     def total_before_tax
-      amount + adjustments.select { |adjustment| !adjustment.tax? && adjustment.eligible? }.sum(&:amount)
+      amount + adjustments.reject(&:tax?).sum(&:amount)
     end
 
     # @return [BigDecimal] the amount of this shipment before VAT tax
@@ -175,7 +177,7 @@ module Spree
     end
 
     def manifest
-      @manifest ||= Spree::ShippingManifest.new(inventory_units: inventory_units).items
+      @manifest ||= Spree::ShippingManifest.new(inventory_units:).items
     end
 
     def selected_shipping_rate_id
@@ -217,7 +219,7 @@ module Spree
 
     def set_up_inventory(state, variant, _order, line_item)
       inventory_units.create(
-        state: state,
+        state:,
         variant_id: variant.id,
         line_item_id: line_item.id
       )
@@ -263,7 +265,7 @@ module Spree
         self.cost = selected_shipping_rate.cost
         if changed?
           update_columns(
-            cost: cost,
+            cost:,
             updated_at: Time.current
           )
         end
@@ -312,7 +314,7 @@ module Spree
     end
 
     def after_ship
-      order.shipping.ship_shipment(self, suppress_mailer: suppress_mailer)
+      order.shipping.ship_shipment(self, suppress_mailer:)
     end
 
     def can_get_rates?
@@ -339,7 +341,7 @@ module Spree
 
     def ensure_can_destroy
       if shipped? || canceled?
-        errors.add(:state, :cannot_destroy, state: state)
+        errors.add(:state, :cannot_destroy, state:)
         throw :abort
       end
     end

data/app/models/spree/shipping_category.rb

@@ -2,6 +2,8 @@
 
 module Spree
   class ShippingCategory < Spree::Base
+    self.allowed_ransackable_attributes = %w[name]
+
     validates :name, presence: true
     has_many :products, inverse_of: :shipping_category
     has_many :shipping_method_categories, inverse_of: :shipping_category

data/app/models/spree/shipping_rate.rb

@@ -18,8 +18,7 @@ module Spree
     delegate :name, :tax_category, :tax_category_id, to: :shipping_method
     delegate :code, to: :shipping_method, prefix: true
     alias_attribute :amount, :cost
-
-    alias_method :total_before_tax, :amount
+    alias_attribute :total_before_tax, :cost
 
     extend DisplayMoney
     money_methods :amount
@@ -32,7 +31,7 @@ module Spree
       tax_explanations = taxes.map(&:label).join(tax_label_separator)
 
       I18n.t 'spree.shipping_rate.display_price.display_price_with_explanations',
-             price: price,
+             price:,
              explanations: tax_explanations
     end
     alias_method :display_cost, :display_price

data/app/models/spree/{order_contents.rb → simple_order_contents.rb}

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Spree
-  class OrderContents
+  class SimpleOrderContents
     attr_accessor :order
 
     def initialize(order)
@@ -38,12 +38,7 @@ module Spree
       if order.update(params)
         unless order.completed?
           order.line_items = order.line_items.select { |li| li.quantity > 0 }
-          # Update totals, then check if the order is eligible for any cart promotions.
-          # If we do not update first, then the item total will be wrong and ItemTotal
-          # promotion rules would not be triggered.
-          reload_totals
           order.check_shipments_and_restart_checkout
-          PromotionHandler::Cart.new(order).activate
         end
         reload_totals
         true
@@ -71,10 +66,8 @@ module Spree
     private
 
     def after_add_or_remove(line_item, options = {})
-      reload_totals
       shipment = options[:shipment]
       shipment.present? ? shipment.update_amounts : order.check_shipments_and_restart_checkout
-      PromotionHandler::Cart.new(order, line_item).activate
       reload_totals
       line_item
     end
@@ -88,12 +81,15 @@ module Spree
 
       line_item ||= order.line_items.new(
         quantity: 0,
-        variant: variant,
-        adjustments: [],
+        variant:,
+        adjustments: []
       )
 
+      permitted_attributes = Spree::PermittedAttributes.line_item_attributes.dup
+      permitted_attributes << { admin_metadata: {} } if options[:admin_metadata].present?
+
       line_item.quantity += quantity.to_i
-      line_item.options = ActionController::Parameters.new(options).permit(PermittedAttributes.line_item_attributes).to_h
+      line_item.options = ActionController::Parameters.new(options).permit(permitted_attributes).to_h
 
       line_item.target_shipment = options[:shipment]
       line_item.save!
@@ -117,7 +113,7 @@ module Spree
     def grab_line_item_by_variant(variant, raise_error = false, options = {})
       line_item = order.find_line_item_by_variant(variant, options)
 
-      if !line_item.present? && raise_error
+      if line_item.blank? && raise_error
         raise ActiveRecord::RecordNotFound, "Line item not found for variant #{variant.sku}"
       end
 

data/app/models/spree/stock/estimator.rb

@@ -39,7 +39,7 @@ module Spree
           cost = shipping_method.calculator.compute(package)
           if cost
             rate = shipping_method.shipping_rates.new(
-              cost: cost,
+              cost:,
               shipment: package.shipment
             )
             tax_calculator.calculate(rate).each do |tax|