solidus_core 4.7.2 → 4.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d3d8242467851026fff5d6e6c31639174974d747193e9bef00a77acbd7c6e912
-  data.tar.gz: 7336f44aad6dc32d2d477acffe0de1af5acb1df5fa7bd399b3b754e3647269e3
+  metadata.gz: '01835b000500c6523be13d69e3b323203e5e5e5e8cdc0879c20b80aecbc4ab6e'
+  data.tar.gz: 81ad53d980d3d2c9fca7cce88e1b9fa0546114e6431d064ac53b46edfeb85e92
 SHA512:
-  metadata.gz: e0521407fa49fac2011d849d4fa08f03a165c32751ffdda07656dd985c3aa73a3ea0b90e4d7b6dfc7157a310fc371d3195b9e7e3f1d1b1b517d3c927370d01c8
-  data.tar.gz: 4619fdf8d485b61ba1610d4c579fd83f82e4f0710648719b07c4ec4e246915a6d2de458f351560c375b212c84a37db01d9b9463608f1f141e27e531e363a958f
+  metadata.gz: af199e02adbf3b4ee94bfb927bc2a6f7b5320737a65a7de7147700e3f5a4bec71147ae1b20881f27b71d522321833c9eaab60873bfb3cfe91eee48bcb40f9c53
+  data.tar.gz: 9ca9fbf1c2706cc69e11654026e6f64f2a623051c70dce63e57a9db46ba03542f98888371751e1c6fa19d2f731f35c839612f9423ca9d78ee968abf3cd93f0bf

data/LICENSE

@@ -1,6 +1,9 @@
 Copyright (c) 2007-2014, Spree Commerce, Inc. and other contributors
 All rights reserved.
 
+Copyright (c) 2015-2026, Solidus contributors
+All rights reserved.
+
 Redistribution and use in source and binary forms, with or without modification,
 are permitted provided that the following conditions are met:
 

data/app/helpers/spree/base_helper.rb

@@ -57,7 +57,7 @@ module Spree
       @body_class
     end
 
-    def logo(image_path = Spree::Config[:logo])
+    def logo(image_path = Spree::Config.logo)
       link_to image_tag(image_path), spree.root_path
     end
 
@@ -93,7 +93,7 @@ module Spree
         end
       end
 
-      content_tag(:nav, content_tag(:ol, raw(items.map(&:mb_chars).join), class: breadcrumb_class, itemscope: "", itemtype: "https://schema.org/BreadcrumbList"), id: "breadcrumbs", class: "sixteen columns")
+      content_tag(:nav, content_tag(:ol, safe_join(items), class: breadcrumb_class, itemscope: "", itemtype: "https://schema.org/BreadcrumbList"), id: "breadcrumbs", class: "sixteen columns")
     end
 
     def taxons_tree(root_taxon, current_taxon, max_level = 1)
@@ -110,7 +110,7 @@ module Spree
       end
     end
 
-    def available_countries(restrict_to_zone: Spree::Config[:checkout_zone])
+    def available_countries(restrict_to_zone: Spree::Config.checkout_zone)
       countries = Spree::Country.available(restrict_to_zone:)
 
       country_names = Carmen::Country.all.map do |country|

data/app/helpers/spree/core/controller_helpers/auth.rb

@@ -37,7 +37,7 @@ module Spree
 
         def set_guest_token
           if cookies.signed[:guest_token].blank?
-            cookies.permanent.signed[:guest_token] = Spree::Config[:guest_token_cookie_options].merge(
+            cookies.permanent.signed[:guest_token] = Spree::Config.guest_token_cookie_options.merge(
               value: SecureRandom.urlsafe_base64(nil, false),
               httponly: true
             )

data/app/helpers/spree/core/controller_helpers/common.rb

@@ -27,7 +27,7 @@ module Spree
         def title
           title_string = @title.presence || accurate_title
           if title_string.present?
-            if Spree::Config[:always_put_site_name_in_title]
+            if Spree::Config.always_put_site_name_in_title
               [title_string, default_title].join(" - ")
             else
               title_string
@@ -75,7 +75,7 @@ module Spree
         # Default layout is: +app/views/spree/layouts/spree_application+
         #
         def get_layout
-          Spree::Config[:layout]
+          Spree::Config.layout
         end
       end
     end

data/app/helpers/spree/core/controller_helpers/timezone.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Spree
+  module Core
+    module ControllerHelpers
+      module Timezone
+        extend ActiveSupport::Concern
+
+        included do
+          around_action :set_timezone
+        end
+
+        private
+
+        # Sets the timezone for the current request.
+        #
+        # Uses the most preferred timezone or falls back to the server default.
+        #
+        # It respects the server's configured timezone from +config/application.rb+.
+        #
+        def set_timezone(&action)
+          timezone = if timezone_change_needed?
+            resolved_timezone || Time.zone.name
+          else
+            session[:solidus_timezone]
+          end
+          session[:solidus_timezone] = timezone
+          Time.use_zone(timezone, &action)
+        end
+
+        # Checks if we need to change the timezone or not.
+        def timezone_change_needed?
+          params[:solidus_timezone].present? || session[:solidus_timezone].blank?
+        end
+
+        # Returns the first valid timezone from the priority chain, or nil.
+        #
+        # The priority order is:
+        #
+        #  * the passed parameter: +params[:solidus_timezone]+
+        #  * the user's timezone preference
+        #
+        def resolved_timezone
+          candidates = [params[:solidus_timezone], timezone_from_user].compact
+          candidates.detect { |tz| ActiveSupport::TimeZone[tz].present? }
+        end
+
+        # Try to get the timezone from user settings.
+        def timezone_from_user
+          spree_current_user.try(:timezone).presence
+        end
+      end
+    end
+  end
+end

data/app/helpers/spree/products_helper.rb

@@ -8,7 +8,7 @@ module Spree
     # @param variant [Spree::Variant] the variant
     # @return [Spree::Money] the price or price diff
     def variant_price(variant)
-      if Spree::Config[:show_variant_full_price]
+      if Spree::Config.show_variant_full_price
         variant_full_price(variant)
       else
         variant_price_diff(variant)
@@ -46,7 +46,7 @@ module Spree
     # @param product [Spree::Product] the product whose description you want to filter
     # @return [String] the generated HTML
     def product_description(product)
-      if Spree::Config[:show_raw_product_description]
+      if Spree::Config.show_raw_product_description
         raw(product.description)
       else
         sanitize(product.description.gsub(/(.*?)\r?\n\r?\n/m, '<p>\1</p>'))

data/app/jobs/spree/base_job.rb

@@ -2,7 +2,7 @@
 
 module Spree
   # Base class for all Solidus background jobs
-  class BaseJob < ActiveJob::Base # rubocop:disable Rails/ApplicationJob
+  class BaseJob < ActiveJob::Base
     # Automatically retry jobs that encountered a deadlock
     retry_on ActiveRecord::Deadlocked
 

data/app/mailers/spree/base_mailer.rb

@@ -10,13 +10,13 @@ module Spree
       store.bcc_email
     end
 
-    def money(amount, currency = Spree::Config[:currency])
+    def money(amount, currency = Spree::Config.currency)
       Spree::Money.new(amount, currency:).to_s
     end
     helper_method :money
 
     def mail(headers = {}, &block)
-      super if Spree::Config[:send_core_emails]
+      super if Spree::Config.send_core_emails
     end
   end
 end

data/app/models/spree/address.rb

@@ -118,7 +118,7 @@ module Spree
     # @return [true] whether or not the address requires a phone number to be
     #   present
     def require_phone?
-      Spree::Config[:address_requires_phone]
+      Spree::Config.address_requires_phone
     end
 
     # @todo Remove this from the public API if possible.

data/app/models/spree/adjustment.rb

@@ -65,7 +65,7 @@ module Spree
     end
 
     def currency
-      adjustable ? adjustable.currency : Spree::Config[:currency]
+      adjustable ? adjustable.currency : Spree::Config.currency
     end
 
     # @return [Boolean] true when this is a promotion adjustment (Promotion adjustments have a {PromotionAction} source)

data/app/models/spree/calculator/flat_rate.rb

@@ -5,13 +5,13 @@ require_dependency "spree/calculator"
 module Spree
   class Calculator::FlatRate < Calculator
     preference :amount, :decimal, default: 0
-    preference :currency, :string, default: -> { Spree::Config[:currency] }
+    preference :currency, :string, default: -> { Spree::Config.currency }
 
     def compute(object = nil)
       if object && preferred_currency.casecmp(object.currency).zero?
         preferred_amount
       else
-        0
+        Spree::ZERO
       end
     end
   end

data/app/models/spree/calculator/shipping/flat_rate.rb

@@ -7,7 +7,7 @@ module Spree
   module Calculator::Shipping
     class FlatRate < ShippingCalculator
       preference :amount, :decimal, default: 0
-      preference :currency, :string, default: -> { Spree::Config[:currency] }
+      preference :currency, :string, default: -> { Spree::Config.currency }
 
       def compute_package(_package)
         preferred_amount

data/app/models/spree/calculator/shipping/flexi_rate.rb

@@ -9,7 +9,7 @@ module Spree
       preference :first_item, :decimal, default: 0.0
       preference :additional_item, :decimal, default: 0.0
       preference :max_items, :integer, default: 0
-      preference :currency, :string, default: -> { Spree::Config[:currency] }
+      preference :currency, :string, default: -> { Spree::Config.currency }
 
       def compute_package(package)
         compute_from_quantity(package.contents.sum(&:quantity))

data/app/models/spree/calculator/shipping/per_item.rb

@@ -7,7 +7,7 @@ module Spree
   module Calculator::Shipping
     class PerItem < ShippingCalculator
       preference :amount, :decimal, default: 0
-      preference :currency, :string, default: -> { Spree::Config[:currency] }
+      preference :currency, :string, default: -> { Spree::Config.currency }
 
       def compute_package(package)
         compute_from_quantity(package.contents.sum(&:quantity))

data/app/models/spree/calculator/shipping/price_sack.rb

@@ -9,7 +9,7 @@ module Spree
       preference :minimal_amount, :decimal, default: 0
       preference :normal_amount, :decimal, default: 0
       preference :discount_amount, :decimal, default: 0
-      preference :currency, :string, default: -> { Spree::Config[:currency] }
+      preference :currency, :string, default: -> { Spree::Config.currency }
 
       def compute_package(package)
         compute_from_price(total(package.contents))

data/app/models/spree/calculator.rb

@@ -21,7 +21,7 @@ module Spree
     #                            Spree::ShippingRate)
     # @param ... [args, kwargs] Additional arguments passed to the specific compute method
     #
-    # @return [BigDecimal, Numeric] The computed amount
+    # @return [BigDecimal] The computed amount
     #
     # @raise [NotImplementedError] If the calculator doesn't implement the required compute method
     #

data/app/models/spree/country.rb

@@ -25,7 +25,7 @@ module Spree
       find_by!(iso: Spree::Config.default_country_iso)
     end
 
-    def self.available(restrict_to_zone: Spree::Config[:checkout_zone])
+    def self.available(restrict_to_zone: Spree::Config.checkout_zone)
       checkout_zone = Zone.find_by(name: restrict_to_zone)
 
       return checkout_zone.country_list if checkout_zone.try(:kind) == "country"

data/app/models/spree/customer_return.rb

@@ -15,6 +15,7 @@ module Spree
 
     validates :return_items, presence: true
     validate :return_items_belong_to_same_order
+    validate :return_items_have_returnable_inventory_units, on: :create
 
     accepts_nested_attributes_for :return_items
 
@@ -73,6 +74,12 @@ module Spree
       end
     end
 
+    def return_items_have_returnable_inventory_units
+      return if inventory_units.compact.all?(&:can_return?)
+
+      errors.add(:base, I18n.t("spree.return_items_must_have_shipped_inventory_units"))
+    end
+
     def inventory_units
       return_items.flat_map(&:inventory_unit)
     end

data/app/models/spree/exchange.rb

@@ -22,7 +22,10 @@ module Spree
 
     def perform!
       begin
-        shipments = Spree::Config.stock.coordinator_class.new(@order, @reimbursement_objects.map(&:build_exchange_inventory_unit)).shipments
+        shipments = Spree::Config.stock.coordinator_class.new(
+          @order,
+          inventory_units: @reimbursement_objects.map(&:build_exchange_inventory_unit)
+        ).shipments
       rescue Spree::Order::InsufficientStock
         raise UnableToCreateShipments.new("Could not generate shipments for all items. Out of stock?")
       end

data/app/models/spree/image/active_storage_attachment.rb

@@ -21,4 +21,19 @@ module Spree::Image::ActiveStorageAttachment
       end
     end
   end
+
+  # Returns the preload tree needed to resolve image.url(style) and image.alt
+  # without N+1 queries. Used by callers to nest preloads under image-bearing
+  # associations on parent records, e.g.
+  #   includes(variant_images: Spree::Image.attachment_preloads)
+  #
+  # We build this manually rather than delegating to with_attached_attachment
+  # because Rails' generated scope includes a preview_image_attachment branch
+  # that is only relevant for non-image files (PDFs, videos, etc.). Product
+  # images never have previews, so including that branch loads empty result
+  # sets from active_storage_attachments and active_storage_blobs on every
+  # request for no benefit.
+  def self.attachment_preloads = [
+    {attachment_attachment: {blob: {variant_records: {image_attachment: :blob}}}}
+  ]
 end

data/app/models/spree/image/paperclip_attachment.rb

@@ -22,6 +22,9 @@ module Spree::Image::PaperclipAttachment
     after_post_process :find_dimensions, if: :valid?
   end
 
+  # When using the Paperclip adapter, attachment preloads are a no-op.
+  def self.attachment_preloads = []
+
   def url(size)
     attachment.url(size)
   end

data/app/models/spree/image.rb

@@ -3,5 +3,9 @@
 module Spree
   class Image < Asset
     include ::Spree::Config.image_attachment_module
+
+    def self.attachment_preloads
+      Spree::Config.image_attachment_module.attachment_preloads
+    end
   end
 end

data/app/models/spree/log_entry.rb

@@ -11,8 +11,10 @@ module Spree
     CORE_PERMITTED_CLASSES = [
       ActiveMerchant::Billing::Response,
       ActiveSupport::TimeWithZone,
+      ActiveSupport::HashWithIndifferentAccess,
       Time,
-      ActiveSupport::TimeZone
+      ActiveSupport::TimeZone,
+      Symbol
     ].freeze
 
     class SerializationError < RuntimeError
@@ -65,38 +67,40 @@ module Spree
     belongs_to :source, polymorphic: true, optional: true
 
     def parsed_details
-      handle_psych_serialization_errors do
-        @details ||= YAML.safe_load(
-          details,
-          permitted_classes: self.class.permitted_classes,
-          aliases: Spree::Config.log_entry_allow_aliases
-        )
-      end
+      @details ||= deserialize_details
     end
 
     def parsed_details=(value)
-      handle_psych_serialization_errors do
-        self.details = YAML.safe_dump(
-          value,
-          permitted_classes: self.class.permitted_classes,
-          aliases: Spree::Config.log_entry_allow_aliases
-        )
-      end
+      self.details = YAML.dump(value)
     end
 
     def parsed_payment_response_details_with_fallback=(response)
       self.parsed_details = response
-    rescue SerializationError, YAML::Exception => e
-      # Fall back on wrapping the response and signaling the error to the end user.
-      self.parsed_details = ActiveMerchant::Billing::Response.new(
-        response.success?,
-        "[WARNING: An error occurred while trying to serialize the payment response] #{response.message}",
-        {"data" => response.inspect, "error" => e.message.to_s}
-      )
     end
 
     private
 
+    def deserialize_details
+      handle_psych_serialization_errors do
+        YAML.safe_load(
+          details,
+          permitted_classes: self.class.permitted_classes,
+          aliases: Spree::Config.log_entry_allow_aliases
+        )
+      end
+    rescue SerializationError, Psych::Exception => e
+      # The stored response could not be deserialized (a class that isn't
+      # permitted, a disabled alias, or malformed YAML). Keep the record readable
+      # by wrapping the raw details and surfacing the reason instead of raising,
+      # while reporting the error so it stays visible to developers.
+      Rails.error.report(e, handled: true, severity: :warning, context: {spree_log_entry_id: id})
+      ActiveMerchant::Billing::Response.new(
+        false,
+        "[WARNING: An error occurred while trying to deserialize the stored payment response] #{e.message}",
+        {"data" => details, "error" => e.message}
+      )
+    end
+
     def handle_psych_serialization_errors
       yield
     rescue Psych::DisallowedClass => e

data/app/models/spree/money.rb

@@ -11,7 +11,7 @@ module Spree
     class << self
       attr_accessor :default_formatting_rules
 
-      def parse(amount, currency = Spree::Config[:currency])
+      def parse(amount, currency = Spree::Config.currency)
         new(parse_to_money(amount, currency))
       end
 
@@ -36,7 +36,7 @@ module Spree
       if amount.is_a?(::Money)
         @money = amount
       else
-        currency = options[:currency] || Spree::Config[:currency]
+        currency = options[:currency] || Spree::Config.currency
 
         @money = Monetize.from_string(amount, currency)
       end

data/app/models/spree/order/payments.rb

@@ -47,7 +47,7 @@ module Spree
           payment.public_send(method_name)
         end
       rescue Core::GatewayError => error
-        result = !!Spree::Config[:allow_checkout_on_gateway_error]
+        result = !!Spree::Config.allow_checkout_on_gateway_error
         errors.add(:base, error.message) && (return result)
       end
     end

data/app/models/spree/order.rb

@@ -151,7 +151,8 @@ module Spree
     validates :email, presence: true, if: :email_required?
     validates :email, "spree/email" => true, :allow_blank => true
     validates :guest_token, presence: {allow_nil: true}
-    validates :number, presence: true, uniqueness: {allow_blank: true, case_sensitive: true}
+    validates :number, presence: true
+    validates :number, uniqueness: {allow_blank: true, case_sensitive: true}, if: :number_changed?
     validates :store_id, presence: true
 
     def self.find_by_param(value)
@@ -237,7 +238,7 @@ module Spree
     end
 
     def currency
-      self[:currency] || Spree::Config[:currency]
+      self[:currency] || Spree::Config.currency
     end
 
     def shipping_discount
@@ -271,7 +272,7 @@ module Spree
 
     # Returns the address for taxation based on configuration
     def tax_address
-      if Spree::Config[:tax_using_ship_address]
+      if Spree::Config.tax_using_ship_address
         ship_address
       else
         bill_address
@@ -307,6 +308,14 @@ module Spree
       inventory_units.reload.all?(&:returned?)
     end
 
+    # Since this method is called from within the order state machine, we cannot
+    # simply delegate this to :shipping. The state_machines gem uses the arity
+    # of the method to determine if it should pass in the transition as an
+    # argument. The arity of the method is masked when using delegates.
+    def create_proposed_shipments
+      shipping.create_proposed_shipments
+    end
+
     def contents
       @contents ||= Spree::Config.order_contents_class.new(self)
     end
@@ -501,21 +510,10 @@ module Spree
       Spree::Config.billing_address_required
     end
 
-    def create_proposed_shipments
-      if completed?
-        raise CannotRebuildShipments.new(I18n.t("spree.cannot_rebuild_shipments_order_completed"))
-      elsif shipments.any? { |shipment| !shipment.pending? }
-        raise CannotRebuildShipments.new(I18n.t("spree.cannot_rebuild_shipments_shipments_not_pending"))
-      else
-        shipments.destroy_all
-        shipments.push(*Spree::Config.stock.coordinator_class.new(self).shipments)
-      end
-    end
-
     def create_shipments_for_line_item(line_item)
-      units = Spree::Config.stock.inventory_unit_builder_class.new(self).missing_units_for_line_item(line_item)
+      inventory_units = Spree::Config.stock.inventory_unit_builder_class.new(self).missing_units_for_line_item(line_item)
 
-      Spree::Config.stock.coordinator_class.new(self, units).shipments.each do |shipment|
+      Spree::Config.stock.coordinator_class.new(self, inventory_units:).shipments.each do |shipment|
         shipments << shipment
       end
     end
@@ -879,7 +877,7 @@ module Spree
     end
 
     def set_currency
-      self.currency = Spree::Config[:currency] if self[:currency].nil?
+      self.currency = Spree::Config.currency if self[:currency].nil?
     end
 
     def create_token

data/app/models/spree/order_cancellations.rb

@@ -53,6 +53,7 @@ class Spree::OrderCancellations
         end
       end
 
+      @order.refresh_shipment_rates
       @order.recalculate
 
       short_ship_tax_notifier&.call(unit_cancels)

data/app/models/spree/order_mutex.rb

@@ -6,7 +6,7 @@ module Spree
 
     belongs_to :order, class_name: "Spree::Order", optional: true
 
-    scope :expired, -> { where(arel_table[:created_at].lteq(Spree::Config[:order_mutex_max_age].seconds.ago)) }
+    scope :expired, -> { where(arel_table[:created_at].lteq(Spree::Config.order_mutex_max_age.seconds.ago)) }
 
     class << self
       # Obtain a lock on an order, execute the supplied block and then release the lock.

data/app/models/spree/order_shipping.rb

@@ -8,6 +8,23 @@ class Spree::OrderShipping
     @order = order
   end
 
+  # A method that destroys the current shipments on an order, creates new
+  # shipments for the line items, and assigns them to the order.
+  #
+  # @return [Array<Spree::Shipment>] The created shipments
+  # @raise [Spree::Order::CannotRebuildShipments] raised if order is completed
+  #   or there are any non-pending shipments.
+  def create_proposed_shipments
+    if @order.completed?
+      raise Spree::Order::CannotRebuildShipments.new(I18n.t("spree.cannot_rebuild_shipments_order_completed"))
+    elsif @order.shipments.any? { |shipment| !shipment.pending? }
+      raise Spree::Order::CannotRebuildShipments.new(I18n.t("spree.cannot_rebuild_shipments_shipments_not_pending"))
+    else
+      @order.shipments.destroy_all
+      @order.shipments.push(*Spree::Config.stock.coordinator_class.new(@order).shipments)
+    end
+  end
+
   # A shortcut method that ships *all* inventory units in a shipment in a single
   # carton.  See also {#ship}.
   #

data/app/models/spree/order_updater.rb

@@ -148,7 +148,7 @@ module Spree
     end
 
     def recalculate_payment_total
-      order.payment_total = payments.completed.includes(:refunds).sum { |payment| payment.amount - payment.refunds.sum(:amount) }
+      order.payment_total = payments.completed.includes(:refunds).sum { |payment| payment.amount - payment.refunds.sum(&:amount) }
     end
     alias_method :update_payment_total, :recalculate_payment_total
     deprecate update_payment_total: :recalculate_payment_total, deprecator: Spree.deprecator

data/app/models/spree/payment_method/bogus_credit_card.rb

@@ -83,6 +83,10 @@ module Spree
       %w[capture void credit]
     end
 
+    def can_credit?(payment)
+      payment.completed? && payment.credit_allowed > 0
+    end
+
     private
 
     def generate_profile_id(success)

data/app/models/spree/payment_method/check.rb

@@ -6,16 +6,18 @@ module Spree
       %w[capture void credit]
     end
 
-    # Indicates whether its possible to capture the payment
     def can_capture?(payment)
       ["checkout", "pending"].include?(payment.state)
     end
 
-    # Indicates whether its possible to void the payment.
     def can_void?(payment)
       payment.state != "void"
     end
 
+    def can_credit?(payment)
+      payment.completed? && payment.credit_allowed > 0
+    end
+
     def capture(*)
       simulated_successful_billing_response
     end

data/app/models/spree/payment_method.rb

@@ -156,7 +156,7 @@ module Spree
     end
 
     def auto_capture?
-      auto_capture.nil? ? Spree::Config[:auto_capture] : auto_capture
+      auto_capture.nil? ? Spree::Config.auto_capture : auto_capture
     end
 
     # Check if given source is supported by this payment method

data/app/models/spree/price.rb

@@ -74,7 +74,7 @@ module Spree
     end
 
     def check_price
-      self.currency ||= Spree::Config[:currency]
+      self.currency ||= Spree::Config.currency
     end
 
     def pricing_options

data/app/models/spree/product.rb

@@ -124,7 +124,7 @@ module Spree
     validates :meta_keywords, length: {maximum: 255}
     validates :meta_title, length: {maximum: 255}
     validates :name, presence: true
-    validates :price, presence: true, if: proc { Spree::Config[:require_master_price] }
+    validates :price, presence: true, if: proc { Spree::Config.require_master_price }
     validates :slug, presence: true, uniqueness: {allow_blank: true, case_sensitive: true}
 
     attr_accessor :option_values_hash