solidus_core 4.7.1 → 4.8.0

data/app/models/spree/payment_create.rb

@@ -8,6 +8,10 @@ module Spree
     #   * :payment_method_id Id of payment method used for this payment
     #   * :source_attributes Attributes used to build the source of this payment. Usually a {CreditCard}
     #     * :wallet_payment_source_id (Integer): The id of a {WalletPaymentSource} to use
+    #     * :gateway_customer_profile_id, :gateway_payment_profile_id (String): Gateway
+    #       identifiers for a new {CreditCard}, e.g. a one-time token. Raises
+    #       ActiveRecord::RecordNotFound if either already belongs to a {CreditCard}
+    #       owned by a different user.
     # @param request_env [Hash] rack env of user creating the payment
     # @param payment [Payment] Internal use only. Instead of making a new payment, change the attributes for an existing one.
     def initialize(order, attributes, payment: nil, request_env: {})
@@ -44,6 +48,7 @@ module Spree
     def build_source
       payment_method = payment.payment_method
       if source_attributes.present? && payment_method.try(:payment_source_class)
+        ensure_gateway_profile_ownership!(payment_method.payment_source_class)
         payment.source = payment_method.payment_source_class.new(source_attributes)
         payment.source.payment_method_id = payment_method.id
         if order && payment.source.respond_to?(:user=)
@@ -52,6 +57,24 @@ module Spree
       end
     end
 
+    # Gateway profile ids may only be submitted for a new source when they are
+    # unknown to the store (e.g. a one-time token) or already belong to the
+    # order's user. Raises if either id is stored on a {CreditCard} owned by a
+    # different user, so customers cannot pay with another customer's stored
+    # gateway credential.
+    def ensure_gateway_profile_ownership!(source_class)
+      return unless source_class <= Spree::CreditCard
+
+      %i[gateway_customer_profile_id gateway_payment_profile_id].each do |attribute|
+        value = source_attributes[attribute]
+        next if value.blank?
+
+        foreign_cards = Spree::CreditCard.where(attribute => value).where.not(user_id: nil)
+        foreign_cards = foreign_cards.where.not(user_id: order.user_id) if order&.user_id
+        raise ActiveRecord::RecordNotFound if foreign_cards.exists?
+      end
+    end
+
     def build_from_wallet_payment_source
       wallet_payment_source_id = source_attributes.fetch(:wallet_payment_source_id)
       raise(ActiveRecord::RecordNotFound) if order.user.nil?

data/app/models/spree/payment_method/bogus_credit_card.rb

@@ -83,6 +83,10 @@ module Spree
       %w[capture void credit]
     end
 
+    def can_credit?(payment)
+      payment.completed? && payment.credit_allowed > 0
+    end
+
     private
 
     def generate_profile_id(success)

data/app/models/spree/payment_method/check.rb

@@ -6,16 +6,18 @@ module Spree
       %w[capture void credit]
     end
 
-    # Indicates whether its possible to capture the payment
     def can_capture?(payment)
       ["checkout", "pending"].include?(payment.state)
     end
 
-    # Indicates whether its possible to void the payment.
     def can_void?(payment)
       payment.state != "void"
     end
 
+    def can_credit?(payment)
+      payment.completed? && payment.credit_allowed > 0
+    end
+
     def capture(*)
       simulated_successful_billing_response
     end

data/app/models/spree/payment_method.rb

@@ -156,7 +156,7 @@ module Spree
     end
 
     def auto_capture?
-      auto_capture.nil? ? Spree::Config[:auto_capture] : auto_capture
+      auto_capture.nil? ? Spree::Config.auto_capture : auto_capture
     end
 
     # Check if given source is supported by this payment method

data/app/models/spree/price.rb

@@ -74,7 +74,7 @@ module Spree
     end
 
     def check_price
-      self.currency ||= Spree::Config[:currency]
+      self.currency ||= Spree::Config.currency
     end
 
     def pricing_options

data/app/models/spree/product.rb

@@ -124,7 +124,7 @@ module Spree
     validates :meta_keywords, length: {maximum: 255}
     validates :meta_title, length: {maximum: 255}
     validates :name, presence: true
-    validates :price, presence: true, if: proc { Spree::Config[:require_master_price] }
+    validates :price, presence: true, if: proc { Spree::Config.require_master_price }
     validates :slug, presence: true, uniqueness: {allow_blank: true, case_sensitive: true}
 
     attr_accessor :option_values_hash
@@ -355,14 +355,17 @@ module Spree
       run_callbacks(:touch)
     end
 
-    # Iterate through this product's taxons and taxonomies and touch their timestamps in a batch
+    # Iterate through this product's taxons and taxonomies and touch their timestamps
     def touch_taxons
-      taxons_to_touch = taxons.flat_map(&:self_and_ancestors).uniq
-      unless taxons_to_touch.empty?
-        Spree::Taxon.where(id: taxons_to_touch.map(&:id)).update_all(updated_at: Time.current)
+      taxons_to_touch = taxons.flat_map(&:self_and_ancestors).uniq.sort_by(&:id)
+      return if taxons_to_touch.empty?
 
-        taxonomy_ids_to_touch = taxons_to_touch.flat_map(&:taxonomy_id).uniq
-        Spree::Taxonomy.where(id: taxonomy_ids_to_touch).update_all(updated_at: Time.current)
+      time = Time.current
+      taxons_to_touch.each { |taxon| taxon.update_column(:updated_at, time) }
+
+      taxonomy_ids_to_touch = taxons_to_touch.map(&:taxonomy_id).uniq
+      Spree::Taxonomy.where(id: taxonomy_ids_to_touch).order(:id).each do |taxonomy|
+        taxonomy.touch(time:)
       end
     end
 

data/app/models/spree/product_option_type.rb

@@ -5,5 +5,7 @@ module Spree
     belongs_to :product, class_name: "Spree::Product", inverse_of: :product_option_types, touch: true
     belongs_to :option_type, class_name: "Spree::OptionType", inverse_of: :product_option_types
     acts_as_list scope: :product
+
+    delegate :name, :presentation, :option_values, to: :option_type
   end
 end

data/app/models/spree/refund.rb

@@ -15,6 +15,7 @@ module Spree
     validates :amount, presence: true, numericality: {greater_than: 0}
 
     validate :amount_is_less_than_or_equal_to_allowed_amount, on: :create
+    validate :payment_is_in_refundable_state, on: :create
 
     attr_reader :perform_response
 
@@ -91,6 +92,22 @@ module Spree
       end
     end
 
+    def payment_is_in_refundable_state
+      return if payment.nil? || Spree::Config.refundable_payment_states.include?(payment.state)
+
+      if Spree::Config.require_refundable_payment_state
+        errors.add(:payment, :not_refundable)
+      else
+        Spree.deprecator.warn(
+          "Creating a refund for a payment in the '#{payment.state}' state is deprecated " \
+          "and will become a validation error in Solidus 5.0. Refunds should only be created " \
+          "for payments in one of these states: #{Spree::Config.refundable_payment_states.join(", ")}. " \
+          "Set `Spree::Config.require_refundable_payment_state = true` to adopt the new " \
+          "behavior early."
+        )
+      end
+    end
+
     def update_order
       payment.order.recalculate
     end

data/app/models/spree/return_item/eligibility_validator/time_since_purchase.rb

@@ -5,7 +5,7 @@ module Spree
     module EligibilityValidator
       class TimeSincePurchase < Spree::ReturnItem::EligibilityValidator::BaseValidator
         def eligible_for_return?
-          if (@return_item.inventory_unit.order.completed_at + Spree::Config[:return_eligibility_number_of_days].days) > Time.current
+          if (@return_item.inventory_unit.order.completed_at + Spree::Config.return_eligibility_number_of_days.days) > Time.current
             true
           else
             add_error(:number_of_days, I18n.t("spree.return_item_time_period_ineligible"))

data/app/models/spree/return_item.rb

@@ -41,6 +41,7 @@ module Spree
 
     validate :eligible_exchange_variant
     validate :belongs_to_same_customer_order
+    validate :belongs_to_return_authorization_order, if: -> { inventory_unit_id_changed? || return_authorization_id_changed? }
     validate :validate_acceptance_status_for_reimbursement
     validate :validate_no_other_completed_return_items
 
@@ -179,7 +180,7 @@ module Spree
     end
 
     def currency
-      return_authorization.try(:currency) || Spree::Config[:currency]
+      return_authorization.try(:currency) || Spree::Config.currency
     end
 
     private
@@ -226,6 +227,14 @@ module Spree
       end
     end
 
+    def belongs_to_return_authorization_order
+      return unless return_authorization && inventory_unit
+
+      if return_authorization.order_id != inventory_unit.order_id
+        errors.add(:base, I18n.t("spree.return_items_cannot_be_associated_with_multiple_orders"))
+      end
+    end
+
     def eligible_exchange_variant
       return unless exchange_variant && exchange_variant_id_changed?
       unless eligible_exchange_variants.include?(exchange_variant)

data/app/models/spree/shipment.rb

@@ -55,7 +55,7 @@ module Spree
     def can_transition_from_pending_to_ready?
       order.can_ship? &&
         inventory_units.all? { |iu| iu.shipped? || iu.allow_ship? || iu.canceled? } &&
-        (order.paid? || !Spree::Config[:require_payment_to_ship])
+        (order.paid? || !Spree::Config.require_payment_to_ship)
     end
 
     def can_transition_from_canceled_to_ready?
@@ -83,7 +83,7 @@ module Spree
     end
 
     def currency
-      order ? order.currency : Spree::Config[:currency]
+      order ? order.currency : Spree::Config.currency
     end
 
     # @return [BigDecimal] the amount of this shipment, taking into
@@ -229,6 +229,8 @@ module Spree
       self.state =
         if shipped?
           "shipped"
+        elsif inventory_units.none?
+          "pending"
         elsif order.canceled? || inventory_units.all?(&:canceled?)
           "canceled"
         elsif !order.can_ship?
@@ -267,7 +269,7 @@ module Spree
     def to_package
       package = Stock::Package.new(stock_location)
       package.shipment = self
-      inventory_units.includes(variant: :product).joins(:variant).group_by(&:state).each do |state, state_inventory_units|
+      inventory_units.not_canceled.includes(variant: :product).joins(:variant).group_by(&:state).each do |state, state_inventory_units|
         package.add_multiple state_inventory_units, state.to_sym
       end
       package

data/app/models/spree/stock/inventory_unit_builder.rb

@@ -8,6 +8,7 @@ module Spree
       end
 
       def units
+        ActiveRecord::Associations::Preloader.new(records: @order.line_items, associations: {variant: :product}).call
         @order.line_items.flat_map do |line_item|
           build_units(line_item, line_item.quantity)
         end

data/app/models/spree/stock/simple_coordinator.rb

@@ -12,7 +12,7 @@ module Spree
     #   * Combine allocated and on hand inventory into a single shipment per-location
     #
     # Allocation logic can be changed using a custom class (as
-    # configured in Spree::Config::stock_allocator_class )
+    # configured in Spree::Config.stock.allocator_class)
     #
     # After allocation, splitters are run on each Package (as configured in
     # Spree::Config.environment.stock_splitters)
@@ -27,7 +27,14 @@ module Spree
         :filtered_stock_locations, :inventory_units_by_variant, :desired,
         :availability, :allocator, :packages
 
-      def initialize(order, inventory_units = nil)
+      def initialize(order, inventory_units_deprecated = nil, inventory_units: nil)
+        if inventory_units_deprecated
+          Spree.deprecator.warn "Using the `inventory_units` positional " \
+            "argument is deprecated in favor of using the keyword argument. "
+
+          inventory_units ||= inventory_units_deprecated
+        end
+
         @order = order
         @inventory_units =
           inventory_units || Spree::Config.stock.inventory_unit_builder_class.new(order).units

data/app/models/spree/store.rb

@@ -17,6 +17,8 @@ module Spree
 
     has_many :orders, class_name: "Spree::Order"
 
+    belongs_to :address, class_name: "Spree::Address", optional: true, validate: true
+
     validates :code, presence: true, uniqueness: {allow_blank: true, case_sensitive: true}
     validates :name, presence: true
     validates :url, presence: true
@@ -25,7 +27,7 @@ module Spree
     self.allowed_ransackable_attributes = %w[name url code]
 
     before_save :ensure_default_exists_and_is_unique
-    before_destroy :validate_not_default
+    before_destroy :validate_not_default, prepend: true
 
     enum :reverse_charge_status, {
       disabled: 0,
@@ -51,6 +53,10 @@ module Spree
       end
     end
 
+    def address_attributes=(attributes)
+      self.address = Spree::Address.immutable_merge(address, attributes)
+    end
+
     def self.default
       where(default: true).first || new
     end
@@ -73,6 +79,7 @@ module Spree
     def validate_not_default
       if default
         errors.add(:base, :cannot_destroy_default_store)
+        throw :abort
       end
     end
   end

data/app/models/spree/store_credit.rb

@@ -209,7 +209,7 @@ class Spree::StoreCredit < Spree::PaymentSource
   def create_credit_record(amount, action_attributes = {})
     # Setting credit_to_new_allocation to true will create a new allocation anytime #credit is called
     # If it is not set, it will update the store credit's amount in place
-    credit = if Spree::Config[:credit_to_new_allocation]
+    credit = if Spree::Config.credit_to_new_allocation
       Spree::StoreCredit.new(create_credit_record_params(amount))
     else
       self.amount_used = amount_used - amount

data/app/models/spree/tax_calculator/default.rb

@@ -23,6 +23,8 @@ module Spree
       #
       # @return [Spree::Tax::OrderTax] the calculated taxes for the order
       def calculate
+        ActiveRecord::Associations::Preloader.new(records: order.line_items, associations: {variant: :product}).call
+
         Spree::Tax::OrderTax.new(
           order_id: order.id,
           order_taxes: order_rates,

data/app/models/spree/taxon.rb

@@ -140,8 +140,11 @@ module Spree
     private
 
     def touch_ancestors_and_taxonomy
-      # Touches all ancestors at once to avoid recursive taxonomy touch, and reduce queries.
-      self.class.default_scoped.where(id: ancestors.pluck(:id)).update_all(updated_at: Time.current)
+      # Touches ancestors directly rather than through #touch to avoid a recursive taxonomy touch.
+      time = Time.current
+      self.class.default_scoped.where(id: ancestors.pluck(:id)).order(:id).each do |ancestor|
+        ancestor.update_column(:updated_at, time)
+      end
       # Have taxonomy touch happen in #touch_ancestors_and_taxonomy rather than association option in order for imports to override.
       taxonomy.try!(:touch)
     end

data/app/models/spree/variant/pricing_options.rb

@@ -54,7 +54,7 @@ module Spree
       # @return [Spree::Variant::PricingOptions] pricing options for pricing a line item
       def self.from_context(context)
         new(
-          currency: context.current_store.try!(:default_currency).presence || Spree::Config[:currency],
+          currency: context.current_store.try!(:default_currency).presence || Spree::Config.currency,
           country_iso: context.current_store.try!(:cart_tax_country_iso).presence
         )
       end

data/app/models/spree/variant/vat_price_generator.rb

@@ -25,6 +25,7 @@ module Spree
       def run
         # Early return if there is no VAT rates in the current store.
         return if !variant.tax_category || variant_vat_rates.empty?
+        return if variant.default_price&.amount.nil?
 
         country_isos_requiring_price.each do |country_iso|
           # Don't re-create the default price

data/app/models/spree/variant.rb

@@ -400,17 +400,17 @@ module Spree
 
     # Ensures a new variant takes the product master price when price is not supplied
     def set_price
-      self.price = product.master.price if price.nil? && Spree::Config[:require_master_price] && !is_master?
+      self.price = product.master.price if price.nil? && Spree::Config.require_master_price && !is_master?
     end
 
     def check_price
-      if price.nil? && Spree::Config[:require_master_price] && is_master?
+      if price.nil? && Spree::Config.require_master_price && is_master?
         errors.add :price, "Must supply price for variant or master.price for product."
       end
     end
 
     def set_cost_currency
-      self.cost_currency = Spree::Config[:currency] if cost_currency.blank?
+      self.cost_currency = Spree::Config.currency if cost_currency.blank?
     end
 
     def create_stock_items

data/config/locales/en.yml

@@ -158,6 +158,9 @@ en:
         display_on: Display
         name: Name
         preference_source: Preference Source
+        preferred_server: Server
+        preferred_test_mode: Test Mode
+        store_ids: Stores
         type: Type
       spree/price:
         amount: Price
@@ -191,6 +194,7 @@ en:
         sku: Master SKU
         slug: Slug
         tax_category: Tax Category
+        taxon_ids: Categories
         weight: Weight
         width: Width
       spree/product_property:
@@ -395,12 +399,15 @@ en:
         tax_code: Tax Code
       spree/tax_rate:
         amount: Rate
+        calculator_type: Calculator
         expires_at: Expiration Date
         included_in_price: Included in Price
+        level: Tax Rate Level
         name: Name
         show_rate_in_label: Show Rate in Label
         starts_at: Start Date
         tax_categories: Tax Categories
+        tax_category_ids: Tax Categories
       spree/taxon:
         description: Description
         icon: Icon
@@ -408,6 +415,7 @@ en:
         meta_keywords: Meta Keywords
         meta_title: Meta Title
         name: Name
+        parent_id: Parent Category
         permalink: Permalink
         position: Position
       spree/taxonomy:
@@ -495,6 +503,8 @@ en:
           attributes:
             amount:
               greater_than_allowed: is greater than the allowed amount.
+            payment:
+              not_refundable: cannot be refunded in its current state.
         spree/reimbursement:
           attributes:
             base:
@@ -1130,6 +1140,7 @@ en:
     choose_currency: Choose Currency
     choose_dashboard_locale: Choose Dashboard Locale
     choose_dashboard_theme: Choose Dashboard Theme
+    choose_dashboard_timezone: Choose Dashboard Timezone
     choose_location: Choose Location
     choose_reason: Choose Reason
     city: City
@@ -1942,6 +1953,7 @@ en:
     payment_could_not_be_created: Payment could not be created.
     payment_identifier: Payment Identifier
     payment_information: Payment Information
+    payment_is_not_refundable: This payment cannot be refunded in its current state.
     payment_method: Payment Method
     payment_method_not_supported: That payment method is unsupported. Please choose another one.
     payment_method_settings_warning: If you are changing the payment method type, you must save first before you can edit the payment method settings
@@ -2093,6 +2105,7 @@ en:
     return_items: Return Items
     return_items_cannot_be_associated_with_multiple_orders: Return items cannot be associated with multiple orders.
     return_items_cannot_be_created_for_inventory_units_that_are_already_awaiting_exchange: Return items cannot be created for inventory units that are already awaiting exchange.
+    return_items_must_have_shipped_inventory_units: Return items can only be created for shipped inventory units.
     return_number: Return Number
     return_quantity: Return Quantity
     return_reasons: Return Reasons

data/db/default/spree/states.rb

@@ -13,7 +13,7 @@ ActiveRecord::Base.transaction do
     carmen_country = Carmen::Country.coded(country.iso)
     next unless carmen_country.subregions?
 
-    if Spree::Config[:countries_that_use_nested_subregions].include? country.iso
+    if Spree::Config.countries_that_use_nested_subregions.include? country.iso
       create_states(carmen_country.subregions.flat_map(&:subregions), country)
     else
       create_states(carmen_country.subregions, country)

data/db/migrate/20260924120000_add_address_to_spree_stores.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddAddressToSpreeStores < ActiveRecord::Migration[7.0]
+  def change
+    change_table :spree_stores do |t|
+      t.references :address, type: :integer, foreign_key: {to_table: :spree_addresses}
+    end
+  end
+end

data/lib/generators/solidus/install/app_templates/authentication/existing.rb

@@ -4,9 +4,7 @@ begin
   user_class.classify.constantize
 rescue NameError
   say_status :error, "Can't find an existing user class named #{user_class.classify}, plese set up one before using this authentication option.", :red
-  # rubocop:disable Rails/Exit
   abort
-  # rubocop:enable Rails/Exit
 end
 
 generate "spree:custom_user #{user_class.shellescape}"

data/lib/generators/solidus/install/app_templates/frontend/starter.rb

@@ -1 +1,19 @@
-apply "https://github.com/solidusio/solidus_starter_frontend/raw/v4.7/template.rb"
+# frozen_string_literal: true
+
+template =
+  ENV["SOLIDUS_STOREFRONT_TEMPLATE"] ||
+  begin
+    version = Spree.solidus_version if defined?(Spree) && Spree.respond_to?(:solidus_version)
+    gem_version = version ? Gem::Version.new(version) : nil
+
+    ref =
+      if gem_version && !gem_version.prerelease?
+        "v#{gem_version.segments[0, 2].join(".")}"
+      else
+        "main"
+      end
+
+    "https://github.com/solidusio/solidus/raw/#{ref}/storefront/template.rb"
+  end
+
+apply template

data/lib/generators/solidus/install/app_templates/payment_method/paypal.rb

@@ -1,5 +1,6 @@
 unless Bundler.locked_gems.dependencies["solidus_paypal_commerce_platform"]
-  bundle_command "add solidus_paypal_commerce_platform --version='~> 1.0'"
+  # The released gem uses the old enum syntax and breaks on recent Ruby/Rails, so install from GitHub.
+  bundle_command "add solidus_paypal_commerce_platform --github solidusio/solidus_paypal_commerce_platform"
 end
 
 generate "solidus_paypal_commerce_platform:install --migrate=#{options[:migrate]}"

data/lib/generators/solidus/install/install_generator.rb

@@ -126,7 +126,7 @@ module Solidus
     def install_file_attachment
       if options[:active_storage]
         say_status :assets, "Active Storage", :green
-        rake "active_storage:install"
+        rake "active_storage:install", abort_on_failure: true
       else
         say_status :assets, "Paperclip", :green
         gsub_file "config/initializers/spree.rb", "::ActiveStorageAttachment", "::PaperclipAttachment"
@@ -158,19 +158,19 @@ module Solidus
 
     def install_migrations
       say_status :copying, "migrations"
-      rake "railties:install:migrations"
+      rake "railties:install:migrations", abort_on_failure: true
     end
 
     def create_database
       say_status :creating, "database"
-      rake "db:create"
+      rake "db:create", abort_on_failure: true
     end
 
     def run_migrations
       if @run_migrations
         say_status :running, "migrations"
 
-        rake "db:migrate"
+        rake "db:migrate", abort_on_failure: true
       else
         say_status :skipping, "migrations (don't forget to run rake db:migrate)"
       end
@@ -178,8 +178,8 @@ module Solidus
 
     def install_subcomponents
       apply_template_for :authentication, @selected_authentication
-      apply_template_for :frontend, @selected_frontend
       apply_template_for :payment_method, @selected_payment_method
+      apply_template_for :frontend, @selected_frontend
     end
 
     def install_solidus_admin
@@ -200,7 +200,7 @@ module Solidus
         rake_options << "ADMIN_EMAIL=#{options[:admin_email]}" if options[:admin_email]
         rake_options << "ADMIN_PASSWORD=#{options[:admin_password]}" if options[:admin_password]
 
-        rake("db:seed #{rake_options.join(" ")}")
+        rake("db:seed #{rake_options.join(" ")}", abort_on_failure: true)
       else
         say_status :skipping, "seed data (you can always run rake db:seed)"
       end
@@ -209,7 +209,7 @@ module Solidus
     def load_sample_data
       if @load_sample_data
         say_status :loading, "sample data"
-        rake "spree_sample:load"
+        rake "spree_sample:load", abort_on_failure: true
       else
         say_status :skipping, "sample data (you can always run rake spree_sample:load)"
       end