spree_admin 5.4.2 → 5.5.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f9e9301b1be27a3349cfc4eaef27ca076dff3e8131a8a88fc926abba84b40a1
-  data.tar.gz: 49e0257fda4a3ffb5a6b8da0ea1623b2e3c323c07d2c47eafc986fd0b1485ce2
+  metadata.gz: 2f4bbbb1dd33ca70b641c0c4c687f4a8a36731ec816c3324930b44139d911bd6
+  data.tar.gz: d402abe10df4c9fe520db4f9b97fb17e33172238ff7e58b14f71b2754a9c09a5
 SHA512:
-  metadata.gz: e38c5fcb1d9c9205f67203ecfbc7dd0c862fc80bae7152d918f0ebec47af68f78f0ab7141d03219e4547c3ff1633bdc05355353ef74bdbc55a7e82f10ddba5b1
-  data.tar.gz: 46fa0bd908105098e55528c5691e38ea7d275bacd780f14f09f17062c81f15d8d91ddeb2fbd2bdaa3c18ef1dcabed2f60fea28242d763e1b4402ade26c6be53d
+  metadata.gz: 9931e85d7ade12bc71fd556f9014cb410ad03e205eedc6ba4c1bc03d3e5d38a32ddabd7a5b34114fe0cb1b58059d7b6ce36907c3515a866812609c9911989517
+  data.tar.gz: 8f9090d2f5d25c761f4f3ce74701fabd179b9947c21ce23ab64362ac67363ce77b63c624136a35bb02b2897d60fe72e716ac4e8539fdc032f5bc7c7cdbcab12c

data/app/controllers/spree/admin/assets_controller.rb

@@ -38,8 +38,14 @@ module Spree
 
       private
 
+      # Includes :variant_ids so the variant-assignment checkboxes mass-assign
+      # straight into Spree::Asset#variant_ids= — the model resolves prefixed
+      # ids and rejects cross-product variants.
       def permitted_resource_params
-        params.require(:asset).permit(Spree::PermittedAttributes.asset_attributes)
+        params.require(:asset).permit(
+          *Spree::PermittedAttributes.asset_attributes,
+          variant_ids: []
+        )
       end
 
       def create_turbo_stream_enabled?

data/app/controllers/spree/admin/bulk_operations_controller.rb

@@ -29,6 +29,10 @@ module Spree
         table = Spree.admin.tables.get(table_key)
         table.find_bulk_action(key.to_sym)
       end
+
+      def authorize_admin
+        params[:kind] == 'set_active' ? authorize!(:bulk_activate, Spree::Product) : super
+      end
     end
   end
 end

data/app/controllers/spree/admin/channels_controller.rb

@@ -0,0 +1,13 @@
+module Spree
+  module Admin
+    class ChannelsController < ResourceController
+      include Spree::Admin::SettingsConcern
+
+      private
+
+      def permitted_resource_params
+        params.require(:channel).permit(permitted_channel_attributes)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/invitations_controller.rb

@@ -63,8 +63,7 @@ module Spree
           redirect_to spree.new_admin_admin_user_path(token: @invitation.token), status: :see_other
         end
       rescue ActiveRecord::RecordNotFound
-        redirect_to spree.root_path, alert: Spree.t('invalid_or_expired_invitation')
-        nil
+        render :expired, status: :not_found
       end
 
       # PUT /admin/invitations/:id/accept

data/app/controllers/spree/admin/products_controller.rb

@@ -21,7 +21,7 @@ module Spree
       new_action.before :build_master_stock_items
       edit_action.before :build_master_prices
       edit_action.before :build_master_stock_items
-      create.after :assign_master_images
+      create.after :assign_session_uploaded_assets
       update.before :skip_updating_status
       update.before :update_status
       update.before :remove_empty_params
@@ -185,7 +185,7 @@ module Spree
           @product_variant_ids[variant.human_name] = variant.id.to_s
           @product_variant_prefix_ids[variant.human_name] = variant.to_param
 
-          image = variant.primary_media
+          image = variant.primary_media || @product.primary_media
           if image.present? && image.attached? && image.variable?
             @product_variant_images[variant.human_name] = helpers.spree_image_url(image, variant: :mini)
           end
@@ -287,15 +287,15 @@ module Spree
         {}
       end
 
-      def assign_master_images
-        return unless @product.master.persisted?
-
-        uploaded_assets = session_uploaded_assets('Spree::Variant')
+      def assign_session_uploaded_assets
+        uploaded_assets = session_uploaded_assets('Spree::Product')
 
         return if uploaded_assets.empty?
 
-        uploaded_assets.update_all(viewable_id: @product.master.id, viewable_type: 'Spree::Variant', updated_at: Time.current)
-        clear_session_for_uploaded_assets('Spree::Variant')
+        uploaded_assets.update_all(viewable_id: @product.id, viewable_type: 'Spree::Product', updated_at: Time.current)
+        @product.update_thumbnail!
+
+        clear_session_for_uploaded_assets('Spree::Product')
       end
 
       def check_slug_availability

data/app/controllers/spree/admin/resource_controller.rb

@@ -279,8 +279,7 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
 
     params[:q][:s] ||= collection_default_sort if collection_default_sort.present?
 
-    date_range_params = %i[created_at_gt created_at_lt updated_at_gt updated_at_lt]
-    date_range_params.each do |param|
+    %i[created_at_gt updated_at_gt].each do |param|
       if params[:q][param].present?
         params[:q][param] = begin
           params[:q][param].to_date&.in_time_zone(current_timezone)&.beginning_of_day
@@ -290,6 +289,16 @@ class Spree::Admin::ResourceController < Spree::Admin::BaseController
       end
     end
 
+    %i[created_at_lt updated_at_lt].each do |param|
+      if params[:q][param].present?
+        params[:q][param] = begin
+          params[:q][param].to_date&.in_time_zone(current_timezone)&.end_of_day
+        rescue StandardError
+          ''
+        end
+      end
+    end
+
     params[:q]
   end
 

data/app/controllers/spree/admin/states_controller.rb

@@ -0,0 +1,13 @@
+module Spree
+  module Admin
+    class StatesController < ResourceController
+      belongs_to 'spree/country', find_by: :id
+
+      def select_options
+        states = @country.states.accessible_by(current_ability).order(:name)
+
+        render json: states.to_tom_select_json
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/zones_controller.rb

@@ -23,7 +23,6 @@ module Spree
           current_store.default_country
         end
         @countries = Country.order(:name)
-        @states = @selected_country&.states&.order(:name) || Spree::State.none
         @zones = Zone.order(:name)
       end
 

data/app/helpers/spree/admin/assets_helper.rb

@@ -3,7 +3,11 @@ module Spree
     module AssetsHelper
       def media_form_assets(viewable, viewable_type)
         if viewable&.persisted?
-          viewable.images
+          # Product#images delegates to the master variant (legacy alias), so
+          # 5.5+ product-level uploads wouldn't show. gallery_media returns
+          # product-level media when present and falls back to legacy
+          # variant-pinned images during the transition.
+          viewable.respond_to?(:gallery_media) ? viewable.gallery_media : viewable.images
         elsif session_uploaded_assets(viewable_type).any?
           Spree::Asset.accessible_by(current_ability, :manage).where(id: session_uploaded_assets(viewable_type))
         else

data/app/helpers/spree/admin/base_helper.rb

@@ -36,14 +36,6 @@ module Spree
         @settings_area.present?
       end
 
-      def settings_active?
-        Spree::Deprecation.warn('settings_active? is deprecated and will be removed in Spree 5.5. Please use settings_area? instead')
-        @settings_active || %w[admin_users audits custom_domains exports invitations oauth_applications
-                               payment_methods refund_reasons reimbursement_types return_authorization_reasons roles
-                               shipping_categories shipping_methods stock_locations store_credit_categories
-                               stores tax_categories tax_rates webhooks webhooks_subscribers zones policies metafield_definitions].include?(controller_name) || settings_area?
-      end
-
       # @return [Array<String>] the available countries for checkout
       def available_countries_iso
         @available_countries_iso ||= current_store.countries_available_for_checkout.pluck(:iso)

data/app/helpers/spree/admin/channels_helper.rb

@@ -0,0 +1,14 @@
+module Spree
+  module Admin
+    module ChannelsHelper
+      # Registered +Spree::OrderRouting::Strategy::Base+ subclasses presented in
+      # the channel edit form, sourced from +Spree.order_routing.strategies+ so the
+      # picker can never drift from what the model accepts. A blank value clears the
+      # channel-level override and falls back to
+      # +Store#preferred_order_routing_strategy+.
+      def channel_order_routing_strategy_options
+        Spree.order_routing.strategies.map { |strategy| [strategy.display_name, strategy.to_s] }
+      end
+    end
+  end
+end

data/app/helpers/spree/admin/json_preview_helper.rb

@@ -69,6 +69,11 @@ module Spree
           return Spree.api.public_send(method_name)
         end
 
+        if namespace == 'Spree::Api::V3::Admin'
+          method_name = "admin_#{class_name.underscore}_serializer"
+          return Spree.api.public_send(method_name) if Spree.api.respond_to?(method_name)
+        end
+
         # Fall back to direct constant lookup
         serializer_class_name = "#{namespace}::#{class_name}Serializer"
         serializer_class_name.safe_constantize

data/app/helpers/spree/admin/orders_helper.rb

@@ -1,24 +1,6 @@
 module Spree
   module Admin
     module OrdersHelper
-      TaxLine = Struct.new(:label, :display_amount, :item, :for_shipment, keyword_init: true) do
-        def name
-          Spree::Deprecation.warn("TaxLine is deprecated and will be removed in Spree 5.5")
-          item_name = item.name
-          item_name += " #{Spree.t(:shipment).downcase}" if for_shipment
-
-          "#{label} (#{item_name})"
-        end
-      end
-
-      def order_summary_tax_lines_additional(order)
-        Spree::Deprecation.warn("order_summary_tax_lines_additional is deprecated and will be removed in Spree 5.5")
-        line_item_taxes = order.line_item_adjustments.tax.map { |tax_adjustment| map_to_tax_line(tax_adjustment) }
-        shipment_taxes = order.shipment_adjustments.tax.map { |tax_adjustment| map_to_tax_line(tax_adjustment, for_shipment: true) }
-
-        line_item_taxes + shipment_taxes
-      end
-
       def order_payment_state(order, options = {})
         return if order.payment_state.blank?
 
@@ -140,17 +122,6 @@ module Spree
           '' => 'Transaction failed because wrong CVV2 number was entered or no CVV2 number was entered'
         }
       end
-
-      private
-
-      def map_to_tax_line(tax_adjustment, for_shipment: false)
-        TaxLine.new(
-          label: tax_adjustment.label,
-          display_amount: tax_adjustment.display_amount,
-          item: tax_adjustment.adjustable,
-          for_shipment: for_shipment
-        )
-      end
     end
   end
 end

data/app/helpers/spree/admin/publishing_helper.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+module Spree
+  module Admin
+    # Helpers for the product Publishing card in the Rails admin. Mirrors the
+    # SPA's publishing card (see packages/dashboard/src/components/spree/products/publishing-card.tsx):
+    # per-channel status is gated by product status — Draft/Archived products
+    # render every publication as +not_available+ regardless of window.
+    module PublishingHelper
+      # @param product_status [String] the product's status (draft/active/archived)
+      # @param publication [Spree::ProductPublication]
+      # @return [Symbol] one of :live, :scheduled, :hidden, :not_available
+      def publication_schedule_status(product_status, publication)
+        return :not_available unless product_status == 'active'
+
+        now = Time.current
+        return :hidden if publication.unpublished_at && publication.unpublished_at <= now
+        return :scheduled if publication.published_at && publication.published_at > now
+
+        :live
+      end
+
+      # Renders a colored dot + status label for a publication row.
+      def publication_status_badge(product_status, publication)
+        status = publication_schedule_status(product_status, publication)
+        dot_class = case status
+                    when :live then 'bg-success'
+                    when :scheduled then 'bg-warning'
+                    else 'bg-secondary'
+                    end
+
+        label = Spree.t("admin.publishing.status_#{status}")
+
+        content_tag(:span, class: 'd-inline-flex align-items-center gap-1 text-muted small') do
+          content_tag(:span, '', class: "publication-dot rounded-circle #{dot_class}",
+                                 style: 'display:inline-block; width:0.5rem; height:0.5rem;') +
+            content_tag(:span, label)
+        end
+      end
+
+      # One-line summary of the publication window in the store's timezone.
+      def publication_caption(product_status, publication, store)
+        status = publication_schedule_status(product_status, publication)
+        tz = ActiveSupport::TimeZone[store.preferred_timezone] || Time.zone
+
+        case status
+        when :not_available
+          Spree.t('admin.publishing.caption_not_available',
+                  product_status: Spree.t("admin.products.status_options.#{product_status}", default: product_status.to_s.humanize))
+        when :hidden
+          Spree.t('admin.publishing.caption_unpublished',
+                  date: l(publication.unpublished_at.in_time_zone(tz), format: :short))
+        when :scheduled
+          if publication.unpublished_at
+            Spree.t('admin.publishing.caption_window',
+                    start: l(publication.published_at.in_time_zone(tz), format: :short),
+                    end:   l(publication.unpublished_at.in_time_zone(tz), format: :short))
+          else
+            Spree.t('admin.publishing.caption_scheduled',
+                    date: l(publication.published_at.in_time_zone(tz), format: :short))
+          end
+        else # :live
+          if publication.unpublished_at
+            Spree.t('admin.publishing.caption_hidden_after',
+                    date: l(publication.unpublished_at.in_time_zone(tz), format: :short))
+          else
+            Spree.t('admin.publishing.caption_live')
+          end
+        end
+      end
+    end
+  end
+end

data/app/helpers/spree/admin/turbo_helper.rb

@@ -1,24 +1,6 @@
 module Spree
   module Admin
     module TurboHelper
-      def turbo_close_modal(modal_id = nil)
-        Spree::Deprecation.warn('turbo_close_modal is deprecated and will be removed in Spree 5.5. Use turbo_close_dialog instead.')
-
-        modal_id ||= 'modal'
-
-        turbo_stream.replace :modal_scripts do
-          turbo_frame_tag :modal_scripts do
-            javascript_tag do
-              raw <<~JS
-                if (document.querySelector('##{modal_id}')) {
-                  window.$("##{modal_id}").modal('hide');
-                }
-              JS
-            end
-          end
-        end
-      end
-
       def turbo_close_dialog
         turbo_stream.replace 'main-dialog' do
           render 'spree/admin/shared/dialog'

data/app/helpers/spree/admin/webhook_endpoints_helper.rb

@@ -93,6 +93,7 @@ module Spree
       def custom_webhook_events
         %w[
           customer.password_reset_requested
+          newsletter_subscriber.subscription_requested
           order.completed
           order.paid
           order.canceled

data/app/javascript/spree/admin/application.js

@@ -68,6 +68,7 @@ import OrderBillingAddressController from 'spree/admin/controllers/order_billing
 import PageBuilderController from 'spree/admin/controllers/page_builder_controller'
 import PasswordToggle from 'spree/admin/controllers/password_toggle_controller'
 import ProductFormController from 'spree/admin/controllers/product_form_controller'
+import ProductPublishingController from 'spree/admin/controllers/product_publishing_controller'
 import QueryBuilderController from 'spree/admin/controllers/query_builder_controller'
 import RangeInputController from 'spree/admin/controllers/range_input_controller'
 import TableController from 'spree/admin/controllers/table_controller'
@@ -92,6 +93,7 @@ import TooltipController from 'spree/admin/controllers/tooltip_controller'
 import TurboSubmitButtonController from 'spree/admin/controllers/turbo_submit_button_controller'
 import UnitSystemController from 'spree/admin/controllers/unit_system_controller'
 import VariantsFormController from 'spree/admin/controllers/variants_form_controller'
+import ZoneStateSelectController from 'spree/admin/controllers/zone_state_select_controller'
 import BulkEditorController from 'spree/admin/controllers/bulk_editor_controller'
 import AddressAutocompleteController from 'spree/core/controllers/address_autocomplete_controller'
 import AddressFormController from 'spree/core/controllers/address_form_controller'
@@ -139,6 +141,7 @@ application.register('page-builder', PageBuilderController)
 application.register('password-toggle', PasswordToggle)
 application.register('password-visibility', PasswordVisibility)
 application.register('product-form', ProductFormController)
+application.register('product-publishing', ProductPublishingController)
 application.register('query-builder', QueryBuilderController)
 application.register('range-input', RangeInputController)
 application.register('table', TableController)
@@ -166,6 +169,7 @@ application.register('turbo-submit-button', TurboSubmitButtonController)
 application.register('textarea-autogrow', TextareaAutogrow)
 application.register('unit-system', UnitSystemController)
 application.register('variants-form', VariantsFormController)
+application.register('zone-state-select', ZoneStateSelectController)
 application.register('bulk-editor', BulkEditorController)
 
 LocalTime.start()

data/app/javascript/spree/admin/controllers/product_form_controller.js

@@ -4,10 +4,6 @@ export default class extends Controller {
   static targets = [
     'trackInventoryCheckbox',
     'quantityForm',
-    'availableOn',
-    'makeActiveAt',
-    'discontinueOn',
-    'status',
     'pricesForm'
   ]
 
@@ -26,28 +22,6 @@ export default class extends Controller {
     this.togglePricesFormVisibility()
   }
 
-  switchAvailabilityDatesFields(event) {
-    let status = event.target.value
-    if (status === 'draft') {
-      this.show(this.availableOnTarget)
-      this.show(this.makeActiveAtTarget)
-    } else if (status === 'active') {
-      this.show(this.availableOnTarget)
-      this.hide(this.makeActiveAtTarget)
-    } else {
-      this.hide(this.availableOnTarget)
-      this.hide(this.makeActiveAtTarget)
-    }
-  }
-
-  show(element) {
-    element.classList.remove('hidden', 'd-none')
-  }
-
-  hide(element) {
-    element.classList.add('hidden')
-  }
-
   toggleQuantityFormVisibility() {
     if (this.hasQuantityFormTarget) {
       if (!this.hasVariantsValue && this.trackInventoryCheckboxTarget.checked) {

data/app/javascript/spree/admin/controllers/product_publishing_controller.js

@@ -0,0 +1,11 @@
+import { Controller } from '@hotwired/stimulus'
+
+// Toggles the "Manage" channel-checkbox panel on the product Publishing card.
+// Pairs with spree/admin/app/views/spree/admin/products/form/_publishing.html.erb.
+export default class extends Controller {
+  static targets = ['manage']
+
+  toggleManage() {
+    this.manageTarget.classList.toggle('d-none')
+  }
+}

data/app/javascript/spree/admin/controllers/slug_form_controller.js

@@ -6,9 +6,26 @@ export default class extends Controller {
     'url',
   ]
 
+  connect() {
+    this.urlTouched = this.hasUrlTarget && this.urlTarget.value.length > 0
+    if (this.hasUrlTarget) {
+      this.urlTarget.addEventListener('input', () => { this.urlTouched = true })
+    }
+  }
+
   updateUrlFromName() {
+    if (this.urlTouched) return
     const name = this.nameTarget.value
-    const url = name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/(^-|-$)+/g, '')
+    // Mirrors ActiveSupport's +String#parameterize+: NFKD decompose, drop
+    // combining marks (accents), lowercase, hyphenate the rest. Keeps the
+    // legacy admin's auto-fill aligned with what +normalizes :code+ stores
+    // server-side — without NFKD, "Café" rendered "caf-" instead of "cafe".
+    const url = name
+      .normalize('NFKD')
+      .replace(/\p{M}/gu, '')
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, '-')
+      .replace(/(^-|-$)+/g, '')
     this.urlTarget.value = url
   }
 }

data/app/javascript/spree/admin/controllers/zone_state_select_controller.js

@@ -0,0 +1,31 @@
+import { Controller } from "@hotwired/stimulus"
+import { get } from '@rails/request.js'
+
+export default class extends Controller {
+  static values = {
+    url: String
+  }
+
+  static targets = ["statesSelect"]
+
+  async countryChanged(event) {
+    const countryId = event.target.value
+    const statesInput = this.statesSelectTarget.querySelector('select')
+    if (!statesInput || !statesInput.tomselect) return
+
+    const tomSelect = statesInput.tomselect
+    tomSelect.clear()
+    tomSelect.clearOptions()
+
+    if (!countryId) return
+
+    const url = this.urlValue.replace(':country_id', countryId)
+    const response = await get(url, { contentType: 'application/json' })
+
+    if (response.ok) {
+      const states = await response.json
+      states.forEach(state => tomSelect.addOption(state))
+      tomSelect.refreshOptions(false)
+    }
+  }
+}

data/app/presenters/spree/admin/order_summary_presenter.rb

@@ -13,6 +13,7 @@ module Spree
         [
           *metadata_rows,
           :separator,
+          channel_row,
           market_row,
           locale_row,
           currency_row,
@@ -73,6 +74,17 @@ module Spree
         rows
       end
 
+      def channel_row
+        return nil if order.channel.blank?
+
+        {
+          label: Spree.t(:channel),
+          value: order.channel.name,
+          id: 'channel',
+          link: Spree::Core::Engine.routes.url_helpers.edit_admin_channel_path(order.channel)
+        }
+      end
+
       def market_row
         return nil if order.market.blank?
 

data/app/views/spree/admin/api_keys/_form.html.erb

@@ -24,3 +24,21 @@
     <% end %>
   </div>
 </div>
+
+<div class="card mb-6" id="api-key-scopes" data-secret-only data-show-when-key-type="secret">
+  <div class="card-header">
+    <h5 class="card-title"><%= Spree.t('admin.api_keys.scopes', default: 'Scopes') %></h5>
+    <p class="text-sm text-gray-500 mt-1">
+      <%= Spree.t('admin.api_keys.scopes_description', default: 'Required for secret keys. Pick the narrowest set of scopes your integration needs.') %>
+    </p>
+  </div>
+  <div class="card-body">
+    <% Spree::ApiKey::SCOPES.each do |scope| %>
+      <div class="custom-control form-checkbox mb-1">
+        <%= f.check_box :scopes, { multiple: true, class: 'custom-control-input', id: "api_key_scopes_#{scope}" }, scope, nil %>
+        <%= f.label "scopes_#{scope}", scope, class: 'custom-control-label font-mono text-sm' %>
+      </div>
+    <% end %>
+    <%= f.hidden_field :scopes, value: '', multiple: true %>
+  </div>
+</div>

data/app/views/spree/admin/assets/edit.html.erb

@@ -1,17 +1,72 @@
-<%= turbo_frame_tag :dialog do %>
-  <%= dialog_header(Spree.t(:edit) + ' ' + Spree.t(:image)) %>
+<%= turbo_frame_tag :drawer do %>
   <%= form_with model: @asset, url: spree.admin_asset_path(@asset), method: :put, scope: :asset do |f| %>
-    <div class="dialog-body pb-0" data-turbo-permanent id="asset-<%= @asset.key.parameterize %>">
-      <%= f.spree_file_field :attachment, width: 200, height: 200, can_delete: false, label: Spree.t(:image) %>
+    <%= drawer_header(Spree.t(:edit) + ' ' + Spree.t(:image)) %>
+
+    <div class="drawer-body">
+      <% if @asset.attachment.attached? %>
+        <% blob_url_opts = { host: request.host_with_port, protocol: (request.ssl? ? 'https' : 'http') } %>
+        <% download_url = Rails.application.routes.url_helpers.rails_blob_url(@asset.attachment.blob, **blob_url_opts, disposition: 'attachment') %>
+        <% original_url = Rails.application.routes.url_helpers.rails_blob_url(@asset.attachment.blob, **blob_url_opts) %>
+        <div class="mb-4 rounded-lg border bg-light overflow-hidden">
+          <a href="<%= original_url %>"
+             target="_blank"
+             rel="noopener"
+             title="<%= Spree.t(:view_full_size) %>"
+             style="display: block; position: relative; cursor: zoom-in;">
+            <%= spree_image_tag(@asset.attachment, variant: :large, alt: @asset.alt, class: 'w-full max-h-96 object-contain') %>
+            <span style="position: absolute; top: 8px; right: 8px; display: inline-flex; align-items: center; justify-content: center; width: 32px; height: 32px; border-radius: 6px; background: rgba(255,255,255,0.95); color: #4b5563; box-shadow: 0 1px 2px rgba(0,0,0,0.1); pointer-events: none;">
+              <%= icon('zoom-in', class: 'mr-0') %>
+            </span>
+          </a>
+        </div>
+        <div class="flex gap-2 mb-4">
+          <%= link_to original_url, target: '_blank', rel: 'noopener', class: 'btn btn-light btn-sm' do %>
+            <%= icon('external-link', class: 'mr-1') %><%= Spree.t(:view_full_size) %>
+          <% end %>
+          <%= link_to download_url, target: '_blank', rel: 'noopener', class: 'btn btn-light btn-sm' do %>
+            <%= icon('download', class: 'mr-1') %><%= Spree.t(:download) %>
+          <% end %>
+        </div>
+      <% else %>
+        <%= f.spree_file_field :attachment, width: 200, height: 200, can_delete: false, label: Spree.t(:image) %>
+      <% end %>
+
+      <%= f.spree_text_area :alt, label: Spree.t(:alt_text), rows: 3 %>
+
+      <%# Variant assignment shows only for product-level assets — variant-pinned assets
+          already live on a single variant via the polymorphic viewable, so the
+          join-table UI doesn't apply. Empty submission (no boxes ticked) clears
+          all links thanks to the hidden field below. %>
+      <% if @asset.viewable_type == 'Spree::Product' && @asset.viewable.present? && @asset.viewable.variants.any? %>
+        <% product = @asset.viewable %>
+        <% linked_ids = @asset.variant_media.pluck(:variant_id).to_set %>
+        <div class="mt-4 pt-4 border-t">
+          <label class="form-label"><%= Spree.t(:assigned_variants) %></label>
+          <p class="text-muted small mb-2">
+            <%= Spree.t(:assigned_variants_help) %>
+          </p>
+          <%= hidden_field_tag 'asset[variant_ids][]', '' %>
+          <div class="flex flex-col gap-1">
+            <% product.variants.each do |variant| %>
+              <% chip_id = "asset_variant_#{variant.id}" %>
+              <div class="custom-control form-checkbox rounded-lg hover:bg-gray-100 p-2 transition-colors duration-100 ease-linear">
+                <%= check_box_tag('asset[variant_ids][]', variant.to_param, linked_ids.include?(variant.id), id: chip_id, class: 'custom-control-input') %>
+                <%= label_tag chip_id, class: 'custom-control-label' do %>
+                  <%= variant.descriptive_name.presence || variant.sku %>
+                <% end %>
+              </div>
+            <% end %>
+          </div>
+        </div>
+      <% end %>
     </div>
-    <div class="dialog-body" style="min-height: 200px">
-      <%= f.spree_text_area :alt, label: Spree.t(:alt_text), rows: 4 %>
-    </div>
-    <div class="dialog-footer">
+
+    <div class="drawer-footer gap-3">
       <%= turbo_save_button_tag %>
+      <%= drawer_discard_button %>
       <%= link_to Spree.t('actions.destroy'), object_url(@asset),
           data: { turbo_method: :delete, turbo_confirm: Spree.t(:are_you_sure_delete), turbo_frame: '_top' },
           class: 'btn btn-danger ml-auto' if can?(:destroy, @asset) %>
     </div>
   <% end %>
-<% end %>
+<% end %>