spree-shipstation 5.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 30a88f9939731dc679980577dc0b23a91fdbda25c4019063b3f4728dfb2fe5a9
+  data.tar.gz: d410ae3a207dd0051ab938c3890c60c515b403723ac43392ede48ab872352ca1
+SHA512:
+  metadata.gz: f1d456fbe2b2e4a682b7cc2b62e1c07faad779b449bd8f2da72e5a2ce67b9f133b8cb23a214bb62dfd2ba4d1429a6b1b6fc8839597feb3e445a31fd419de5869
+  data.tar.gz: ce40b12b11650ef36d848a709a4a0bd513c654a9ca6da8659728e178dd82cdba573504dbaf7ce981ef67509b986d0a11f47157f21280894dec8c90f2fae56769

data/.github/stale.yml

@@ -0,0 +1,17 @@
+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 60
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: 7
+# Issues with these labels will never be considered stale
+exemptLabels:
+  - pinned
+  - security
+# Label to use when marking an issue as stale
+staleLabel: wontfix
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had
+  recent activity. It will be closed if no further activity occurs. Thank you
+  for your contributions.
+# Comment to post when closing a stale issue. Set to `false` to disable
+closeComment: false

data/.github/workflows/lint.yml

@@ -0,0 +1,24 @@
+---
+name: Standard Rb
+on:
+  pull_request:
+    branches:
+    - '*'
+  push:
+    branches:
+    - main
+jobs:
+  standard:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby: ['3.4']
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Ruby ${{ matrix.ruby }}
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby }}
+        bundler-cache: true
+    - name: Run Standard Rb
+      run: bundle exec standardrb --format progress

data/.github/workflows/security.yml

@@ -0,0 +1,41 @@
+---
+name: Security
+on:
+  pull_request:
+    branches:
+    - '*'
+  push:
+    branches:
+    - main
+jobs:
+  brakeman:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby: ['3.4']
+    steps:
+    - uses: actions/checkout@v6
+    - name: Set up Ruby ${{ matrix.ruby }}
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby }}
+        bundler-cache: true
+    - name: Run Brakeman
+      # --force scans the engine even though it is not a full Rails app;
+      # --exit-on-warn fails the build when any security warning is found.
+      run: bundle exec brakeman --force --no-pager --quiet --exit-on-warn
+
+  bundler-audit:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby: ['3.4']
+    steps:
+    - uses: actions/checkout@v6
+    - name: Set up Ruby ${{ matrix.ruby }}
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby }}
+        bundler-cache: true
+    - name: Run bundler-audit
+      run: bundle exec bundle-audit check --update

data/.github/workflows/test.yml

@@ -0,0 +1,32 @@
+---
+name: CI
+on:
+  pull_request:
+    branches:
+    - '*'
+  push:
+    branches:
+    - main
+jobs:
+  sqlite:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ['3.4']
+        gemfile: [spree_5_2, spree_5_3, spree_5_4]
+    env:
+      BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/${{ matrix.gemfile }}.gemfile
+      BUNDLE_PATH_RELATIVE_TO_CWD: true
+      RAILS_ENV: test
+    steps:
+    - uses: actions/checkout@v6
+    - name: Set up Ruby ${{ matrix.ruby }}
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby }}
+        bundler-cache: false
+    - name: Bundle Install
+      run: bundle install
+    - name: Run Tests
+      run: bundle exec rake

data/.gitignore

@@ -0,0 +1,23 @@
+\#*
+*~
+.#*
+.DS_Store
+.idea
+.localeapp/locales
+.project
+.vscode
+coverage
+default
+Gemfile.lock
+tmp
+nbproject
+pkg
+*.sw?
+spec/dummy
+.rvmrc
+.sass-cache
+public/spree
+.ruby-version
+.ruby-gemset
+gemfiles/*.gemfile.lock
+*.gem

data/.rspec

@@ -0,0 +1,3 @@
+--color
+-r spec_helper
+-f documentation

data/.standard.yml

@@ -0,0 +1,3 @@
+---
+ignore:
+- 'spec/dummy/**/*'

data/Appraisals

@@ -0,0 +1,20 @@
+appraise "spree-5-2" do
+  spree = "~> 5.2.0"
+
+  gem "spree", spree
+  gem "spree_admin", spree
+end
+
+appraise "spree-5-3" do
+  spree = "~> 5.3.0"
+
+  gem "spree", spree
+  gem "spree_admin", spree
+end
+
+appraise "spree-5-4" do
+  spree = "~> 5.4.0"
+
+  gem "spree", spree
+  gem "spree_admin", spree
+end

data/CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## 5.0.0
+
+First public release on RubyGems, as `spree-shipstation`.
+
+This gem was developed under the working name `spree_shipstation` but was never
+published under it — that name is held on RubyGems by an unrelated, abandoned
+2014 project. Releasing as `spree-shipstation` also lets the gem name, the require
+path, and the Ruby namespace agree with each other, per the RubyGems convention
+that a dash denotes a gem living under another gem's namespace.
+
+**Versioning:** the major version tracks Spree's major version — `spree-shipstation`
+5.x supports Spree 5.x. This release therefore starts at 5.0.0 rather than 1.0.0,
+and continues the repository's existing tag lineage (which reached `v3.0.0` before
+the rename).
+
+If you tracked this repository from git before 5.0.0, note:
+
+- **Gem name** is `spree-shipstation`. `gem "spree-shipstation"` is all a host app
+  needs — `Bundler.require` resolves through a shim at `lib/spree-shipstation.rb`.
+- **Require path** is now `spree/shipstation` (was `spree_shipstation`).
+- **Ruby namespace** is now `Spree::Shipstation` (was `SpreeShipstation`). This
+  affects `Spree::Shipstation::ShipmentNotice`, the error hierarchy
+  (`Spree::Shipstation::Error` and subclasses), `Spree::Shipstation::ExportHelper`,
+  and `Spree::Shipstation::Export::{OrderPresenter,ItemPresenter,Weight}`.
+- **Test factories** are loaded with `require "spree/shipstation/factories"`.
+- **Unchanged:** the `Spree::Integrations::Shipstation` integration model,
+  `Spree::ShipstationController`, both `/shipstation` routes, the admin form
+  partial, and all i18n keys. Existing installations need no data or config
+  changes.
+
+### Features
+
+- XML export endpoint (`GET /shipstation`) for ShipStation to poll ready shipments,
+  paginated at 50 per page and validated against ShipStation's XML schema.
+- Shipnotify webhook (`POST /shipstation`) that applies tracking numbers and ships
+  shipments, capturing pending payments first when `auto_capture_on_dispatch` is on.
+- HTTP Basic Auth against per-store credentials, compared in constant time.
+- Registers with Spree's integration framework; no migrations or generators to run.
+- Tested against Spree 5.2, 5.3, and 5.4.

data/CLAUDE.md

@@ -0,0 +1,95 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Overview
+
+`spree-shipstation` is a Spree e-commerce extension (gem) that integrates Spree stores with [ShipStation](https://www.shipstation.com). It exposes an XML endpoint that ShipStation polls for shipments, and a webhook endpoint that ShipStation POSTs to when a label is created (updating the Spree shipment with a tracking number and marking it shipped).
+
+This gem targets **Spree 5.x** and uses the `spree_extension` framework for integration registration.
+
+### Naming
+
+Three related but distinct names — do not "fix" one to match another:
+
+| | Value | Why |
+|---|---|---|
+| Gem name | `spree-shipstation` | Dash denotes a gem under another gem's namespace |
+| Require path | `spree/shipstation` | `lib/spree-shipstation.rb` is a shim so Bundler's auto-require of the gem *name* still works |
+| Ruby namespace | `Spree::Shipstation` | Matches the require path |
+| `engine_name` | `spree_shipstation` | Generates route helper prefixes, so it **must** be a valid Ruby identifier — a dash is illegal here |
+| Asset manifest | `app/assets/config/spree_shipstation_manifest.js` | Referenced by name in the engine's `assets` initializer |
+
+`ENV["LIB_NAME"]` in the `Rakefile` must be the **require path** (`spree/shipstation`), not the gem name: Spree's `common:test_app` does a literal `require ENV['LIB_NAME']` and templates the same string into the generated `spec/dummy/config/application.rb`. Setting it to the gem name makes dummy-app generation fail with a `LoadError` that surfaces as the entire suite erroring.
+
+## Commands
+
+### Run all tests
+```shell
+bundle exec rake
+```
+The default Rake task automatically generates a dummy Rails app under `spec/dummy/` if it doesn't exist, then runs the full spec suite.
+
+### Generate the test dummy app (first time or after reset)
+```shell
+bundle exec rake test_app
+```
+
+### Run a single spec file
+```shell
+bundle exec rspec spec/controllers/spree/shipstation_controller_spec.rb
+```
+
+### Lint (StandardRB)
+```shell
+bundle exec standardrb
+```
+
+### Auto-fix lint issues
+```shell
+bundle exec standardrb --fix
+```
+
+## Architecture
+
+### Integration Registration
+
+The extension registers itself with Spree's integration framework via `config/initializers/spree.rb`, which appends `Spree::Integrations::Shipstation` to `spree.integrations`. The integration model (`app/models/spree/integrations/shipstation.rb`) extends `Spree::Integration` and stores credentials as Spree preferences (`preferred_username`, `preferred_password`) with validations.
+
+### Request Flow
+
+**Export (GET `/shipstation`)** — ShipStation polls this endpoint to fetch shipments ready to process:
+1. `Spree::ShipstationController#export` authenticates via HTTP Basic Auth using credentials stored on the active store integration.
+2. Queries `current_store.shipments.exportable` — a scope added by `Spree::ShipmentDecorator` that filters for `state: "ready"` on complete orders.
+3. Filters by `start_date`/`end_date` params (matching either shipment or order `updated_at`). If both params are absent or invalid, all exportable shipments are returned with no date filter.
+4. Renders `app/views/spree/shipstation/export.xml.builder` using the `builder` gem. XML structure is validated against `spec/fixtures/shipstation_xml_schema.xsd` in tests.
+5. Results are paginated at 50 per page.
+
+**Shipnotify (POST `/shipstation`)** — ShipStation calls this when a label is created:
+1. `Spree::ShipstationController#shipnotify` passes `order_number` and `tracking_number` params to `Spree::Shipstation::ShipmentNotice.from_payload`.
+2. `ShipmentNotice#apply` looks up the `Spree::Shipment` by number on `current_store` and, inside a transaction: captures pending payments if `Spree::Config.auto_capture_on_dispatch` is on, sets the tracking number, saves, then calls `ship!` unless already shipped.
+3. Errors from `Spree::Shipstation::Error` subclasses return HTTP 400; successes return HTTP 200. The webhook is written to be safe for ShipStation to retry.
+
+> **Note on naming:** ShipStation's webhook param is called `order_number` but its value is actually the *shipment* number — it mirrors the `<OrderNumber>` field from the export XML, which is set to `shipment.number`.
+
+### Key Files
+
+| File | Purpose |
+|------|---------|
+| `app/controllers/spree/shipstation_controller.rb` | Both endpoints; auth (constant-time `secure_compare`) + integration guard |
+| `app/models/spree/integrations/shipstation.rb` | Integration model with credential preferences and validations |
+| `app/models/spree/shipment_decorator.rb` | Adds `:exportable` and `:between` scopes to `Spree::Shipment` |
+| `lib/spree/shipstation/shipment_notice.rb` | Plain Ruby object that applies a ship notification |
+| `lib/spree/shipstation/errors.rb` | Custom error hierarchy (`ShipmentNotFoundError`, `PaymentError`, `MissingTrackingNumberError`) |
+| `lib/spree/shipstation/engine.rb` | Engine; note `activate` globs `../../../app` — three levels up from `lib/spree/shipstation/` |
+| `lib/spree-shipstation.rb` | Bundler auto-require shim; only does `require "spree/shipstation"` |
+| `app/helpers/spree/shipstation/export_helper.rb` | Helper methods for building address XML nodes |
+| `app/views/spree/shipstation/export.xml.builder` | XML template for ShipStation export |
+| `app/views/spree/admin/integrations/forms/_shipstation.html.erb` | Admin UI partial for configuring credentials |
+
+### Testing Helpers
+
+- `spec/support/auth_helper.rb` — provides `stub_basic_auth(username, password)` for controller specs.
+- `spec/support/xsd.rb` — provides the `pass_validation(xsd_path)` RSpec matcher for XML schema validation.
+- `spec/support/shipment_helper.rb` — shipment-related test helpers.
+- `lib/spree/shipstation/testing_support/factories/shipstation_integration.rb` — FactoryBot factory for `Spree::Integrations::Shipstation`, loaded via `require "spree/shipstation/factories"` in `spec/spec_helper.rb`.

data/Gemfile

@@ -0,0 +1,14 @@
+source "https://rubygems.org"
+
+gem "appraisal"
+gem "benchmark"
+gem "brakeman", require: false
+gem "bundler-audit", require: false
+gem "propshaft"
+gem "rails-controller-testing"
+gem "rspec-xsd"
+gem "spree_dev_tools"
+gem "standard"
+gem "sqlite3"
+
+gemspec

data/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2021-2026 Matthew Kennedy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,120 @@
+# spree-shipstation
+
+![CI](https://github.com/aypex-io/spree-shipstation/workflows/CI/badge.svg)
+![Standard Rb](https://github.com/aypex-io/spree-shipstation/workflows/Standard%20Rb/badge.svg)
+
+The spree-shipstation integration connects your Spree stores with [ShipStation](https://www.shipstation.com), allowing ShipStation to pull shipments from your store, and when a shipment is sent, update the order with a tracking number and mark it as shipped.
+
+
+## Installation
+
+1. Add this extension to your Gemfile with this line:
+
+    ```ruby
+    gem "spree-shipstation"
+    ```
+
+2. Install the gem using Bundler
+
+    ```shell
+    bundle install
+    ```
+
+The extension registers itself with Spree's integration framework automatically — there are no migrations or generators to run.
+
+### Step 1: Configuring Spree
+
+Visit the **Integrations** section of your Spree store and configure the ShipStation integration by creating a unique username and password.
+
+### Step 2: Configuring ShipStation
+
+Create a new ShipStation store by visiting: **Settings** -> **Selling Channels** -> **Stores** -> **Add Store**, then selecting the **Custom Store** option.
+
+Enter the following details:
+
+- **Username**: The username you created in Step 1.
+- **Password**: The password you created in Step 1.
+- **URL to custom page**: `https://your-store-domain.com/shipstation.xml`.
+
+There are five shipment states for an order (= shipment) in ShipStation. These states do not
+necessarily align with Spree, but you can configure ShipStation to create a mapping for your
+specific needs. Here's the default mapping:
+
+ShipStation description | ShipStation status | Spree status
+------------------------|--------------------|---------------
+Awaiting Payment        | `unpaid`           | `pending`
+Awaiting Shipment       | `paid`             | `ready`
+Shipped                 | `shipped`          | `shipped`
+Cancelled               | `cancelled`        | `cancelled`
+On-Hold                 | `on-hold`          | `pending`
+
+## Configuration
+
+### Payment capture on dispatch
+
+The integration respects Spree's `auto_capture_on_dispatch` setting. When enabled in your Spree store, pending payments are captured automatically before a shipment is marked as shipped. If a payment capture fails, an error is returned to ShipStation (HTTP 400), preventing the shipment from being marked as shipped until the issue is resolved.
+
+Payment capture happens **synchronously** within the shipnotify webhook request (inside a database transaction) so that a shipment is never marked as shipped against an uncaptured payment. ShipStation automatically retries failed webhook deliveries, and the operation is designed to be safe to repeat: a shipment that is already `shipped` is not shipped again, and only still-pending payments are captured. If your payment gateway is slow, be aware that the capture round-trip occurs in the request cycle.
+
+### Pagination
+
+The export endpoint returns up to **50 shipments per page**. ShipStation handles pagination automatically using the `page` query parameter.
+
+## Security considerations
+
+- **Serve the endpoints over HTTPS.** Both `/shipstation` endpoints authenticate with HTTP Basic Auth, which transmits the configured username and password (base64-encoded) on every request. Always terminate these requests over TLS in production so the credentials are not exposed in transit. Credentials are compared in constant time to avoid timing attacks.
+- **Consider rate limiting.** The gem does not throttle authentication attempts. If you want brute-force protection, add it at the application or edge layer (for example, [`rack-attack`](https://github.com/rack/rack-attack)). The enforced credential length (10–30 character username, 20–60 character complex password) already makes guessing impractical.
+- **Response codes.** When no active ShipStation integration is configured, the endpoints respond with `404` before authentication is checked; a configured-but-unauthenticated request responds with `401`. This is intentional, but be aware it reveals whether the integration is configured.
+
+## Performance
+
+The export query eager-loads its association graph to avoid N+1 queries. The `exportable` scope filters shipments by `state` and orders them by `updated_at`, joining and filtering orders by their `updated_at`. The gem ships no migrations of its own; on large stores, ensure the relevant Spree core columns (`spree_shipments.state`, `spree_shipments.updated_at`, `spree_orders.updated_at`) are adequately indexed in your application's database.
+
+## Usage
+
+There's nothing you need to do. Once properly configured, the integration just works!
+
+### Compatibility
+
+This extension works with the following Spree versions:
+- 5.x
+
+
+### Testing
+
+First bundle your dependencies:
+
+```shell
+bundle
+```
+
+To run the tests use:
+
+```shell
+bundle exec rake
+```
+
+### Code Formatting
+
+To check your code formatting with [Standard Rb](https://github.com/testdouble/standard) run:
+
+```shell
+bundle exec standardrb
+```
+
+To fix basic code formatting issues run:
+
+```shell
+bundle exec standardrb --fix
+```
+
+## Releasing
+
+```bash
+bundle exec gem bump -p -t
+bundle exec gem release
+```
+
+## License
+
+Copyright (c) 2021-2026 Matthew Kennedy, released under the MIT License.

data/Rakefile

@@ -0,0 +1,69 @@
+require "bundler"
+Bundler::GemHelper.install_tasks
+
+require "rspec/core/rake_task"
+require "spree/testing_support/extension_rake"
+
+RSpec::Core::RakeTask.new
+
+task :default do
+  if Dir["spec/dummy"].empty?
+    Rake::Task[:test_app].invoke
+    Dir.chdir("../../")
+  end
+  Rake::Task["dummy:verify_schema"].invoke
+  Rake::Task[:spec].invoke
+end
+
+desc "Generates a dummy app for testing"
+task :test_app do
+  # Must be the require path, not the gem name: Spree's common:test_app does a
+  # literal `require ENV['LIB_NAME']` and templates the same string into the
+  # generated spec/dummy/config/application.rb.
+  ENV["LIB_NAME"] = "spree/shipstation"
+  Rake::Task["extension:test_app"].execute(
+    install_admin: true
+  )
+end
+
+namespace :dummy do
+  # Spree's test_app task runs `db:migrate` in the generator's own process with
+  # output redirected to /dev/null and its exit status ignored. On the heavier
+  # Spree 5.3+/5.4 setup path (admin install + Tailwind/asset build) that step
+  # can be interrupted mid schema-dump, leaving a TRUNCATED db/schema.rb. Rails
+  # then loads that broken dump on the next migrate and fails, so the dummy
+  # database ends up empty and the whole suite errors with
+  # "Could not find table 'spree_*'".
+  #
+  # Make setup deterministic: discard any (possibly corrupt) schema dump and
+  # rebuild the database from the migration files, in a fresh process and
+  # visibly. Fail fast with the real error if migration genuinely fails.
+  desc "Ensure the dummy app database schema is fully migrated"
+  task :verify_schema do
+    dummy_path = File.expand_path("spec/dummy", __dir__)
+    next unless File.directory?(dummy_path)
+
+    # Keep using the gem's bundle after the chdir below.
+    ENV["BUNDLE_GEMFILE"] = File.expand_path(ENV["BUNDLE_GEMFILE"], __dir__) if ENV["BUNDLE_GEMFILE"]
+    ENV["RAILS_ENV"] = "test"
+
+    Dir.chdir(dummy_path) do
+      puts "Rebuilding dummy app database schema..."
+
+      # Remove a potentially-truncated schema dump so the migration files (the
+      # source of truth) are used to build the schema from scratch.
+      schema = File.join(dummy_path, "db", "schema.rb")
+      File.delete(schema) if File.exist?(schema)
+
+      # Separate invocations on purpose: chaining db:create and db:migrate in a
+      # single `rails` call can leave migrate reading a stale schema state.
+      system("bundle exec rails db:drop db:create")
+      migrated = system("bundle exec rails db:migrate")
+
+      unless migrated
+        abort "Dummy app database setup failed; aborting before running specs. " \
+          "See the migration output above for the underlying error."
+      end
+    end
+  end
+end

data/app/assets/config/spree_shipstation_manifest.js

@@ -0,0 +1 @@
+//= link_tree ../images

data/app/controllers/spree/shipstation_controller.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Spree
+  class ShipstationController < Spree::BaseController
+    include Spree::IntegrationsHelper
+    include Pagy::Method
+
+    protect_from_forgery with: :null_session, only: :shipnotify
+
+    before_action :ensure_active_integration
+    before_action :authenticate_shipstation
+
+    def export
+      @pagy, @shipments = pagy(
+        current_store.shipments
+          .exportable
+          .between(date_param(:start_date), date_param(:end_date)),
+        page: params[:page],
+        items: 50
+      )
+
+      respond_to do |format|
+        format.xml { render layout: false }
+      end
+    end
+
+    def shipnotify
+      Shipstation::ShipmentNotice.from_payload(params.permit(:order_number, :tracking_number).to_h, store: current_store).apply
+      head :ok
+    rescue Shipstation::Error => e
+      Rails.logger.error("ShipStation Notification Error: #{e.message}")
+      render plain: e.message, status: :bad_request
+    end
+
+    private
+
+    def ensure_active_integration
+      head :not_found unless store_integration("shipstation")&.active?
+    end
+
+    def date_param(name)
+      return if params[name].blank?
+
+      Time.strptime("#{params[name]} UTC", "%m/%d/%Y %H:%M %Z")
+    rescue ArgumentError
+      nil
+    end
+
+    def authenticate_shipstation
+      authenticate_or_request_with_http_basic do |username, password|
+        integration = store_integration("shipstation")
+        ActiveSupport::SecurityUtils.secure_compare(username.to_s, integration.preferred_username.to_s) &&
+          ActiveSupport::SecurityUtils.secure_compare(password.to_s, integration.preferred_password.to_s)
+      end
+    end
+  end
+end

data/app/helpers/spree/shipstation/export_helper.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "builder"
+
+module Spree
+  module Shipstation
+    module ExportHelper
+      DATE_FORMAT = "%m/%d/%Y %H:%M"
+
+      def self.bill_address(xml, address)
+        render_address(xml, address, "BillTo", include_street: false)
+      end
+
+      def self.ship_address(xml, address)
+        render_address(xml, address, "ShipTo", include_street: true)
+      end
+
+      class << self
+        private
+
+        def render_address(xml, address, tag_name, include_street:)
+          return unless address
+
+          xml.tag!(tag_name) do
+            xml.Name name_from(address)
+            xml.Company address.company
+
+            if include_street
+              xml.Address1 address.address1
+              xml.Address2 address.address2
+              xml.City address.city
+              xml.State state_from(address)
+              xml.PostalCode address.zipcode
+              xml.Country address.country&.iso
+            end
+
+            xml.Phone address.phone
+          end
+        end
+
+        def name_from(address)
+          return address.name if address.respond_to?(:name)
+
+          address.try(:full_name)
+        end
+
+        def state_from(address)
+          address.state&.abbr || address.state_name
+        end
+      end
+    end
+  end
+end