spree_core 5.1.9 → 5.2.0.rc1

data/app/services/spree/checkout/update.rb

@@ -5,10 +5,6 @@ module Spree
       include Spree::Addresses::Helper
 
       def call(order:, params:, permitted_attributes:, request_env:)
-        # Validate address ownership to prevent IDOR attacks
-        address_ownership_error = validate_address_ownership(order, params)
-        return failure(order, address_ownership_error) if address_ownership_error
-
         ship_changed = address_with_country_iso_present?(params, 'ship')
         bill_changed = address_with_country_iso_present?(params, 'bill')
         params[:order][:ship_address_attributes] = replace_country_iso_with_id(params[:order][:ship_address_attributes]) if ship_changed
@@ -30,26 +26,6 @@ module Spree
 
       private
 
-      def validate_address_ownership(order, params)
-        return nil unless params[:order]
-
-        %w[bill ship].each do |address_kind|
-          address_id = params[:order].dig("#{address_kind}_address_attributes".to_sym, :id)
-          next unless address_id
-
-          address = Spree::Address.find_by(id: address_id)
-          next unless address
-
-          # Allow if address has no user (guest address) or belongs to the order's user
-          next if address.user_id.nil?
-          next if order.user_id.present? && address.user_id == order.user_id
-
-          return Spree.t(:address_not_owned_by_user)
-        end
-
-        nil
-      end
-
       def address_with_country_iso_present?(params, address_kind = 'ship')
         return false unless params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_iso)
         return false if params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_id)

data/app/services/spree/imports/row_processors/base.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Imports
+    module RowProcessors
+      class Base
+        def initialize(row)
+          @row = row
+          @import = row.import
+          @attributes = row.to_schema_hash
+        end
+
+        attr_reader :row, :import, :attributes
+
+        def process!
+          raise NotImplementedError, 'Subclasses must implement the process! method'
+        end
+      end
+    end
+  end
+end

data/app/services/spree/imports/row_processors/product_variant.rb

@@ -0,0 +1,228 @@
+module Spree
+  module Imports
+    module RowProcessors
+      class ProductVariant < Base
+        OPTION_TYPES_COUNT = 3
+
+        def initialize(row)
+          super
+          @store = row.store
+          @product = ensure_product_exists
+        end
+
+        attr_reader :product, :store
+
+        def process!
+          variant_scope = options.empty? ? product.variants_including_master : product.variants
+
+          variant = if attributes['sku'].present?
+                      variant_scope.where(
+                        Spree::Variant.arel_table[:sku].lower.eq(attributes['sku'].strip.downcase)
+                      ).first || product.variants.new
+                    elsif options.empty?
+                      product.master
+                    else
+                      product.variants.new
+                    end
+
+          variant.sku = attributes['sku'] if attributes['sku'].present?
+          variant.cost_price = attributes['cost_price'] if attributes['cost_price'].present?
+          variant.weight = attributes['weight'] if attributes['weight'].present?
+          variant.height = attributes['height'] if attributes['height'].present?
+          variant.width = attributes['width'] if attributes['width'].present?
+          variant.depth = attributes['depth'] if attributes['depth'].present?
+          variant.track_inventory = attributes['track_inventory'] if attributes['track_inventory'].present?
+          variant.option_value_variants = prepare_option_value_variants
+          variant.save!
+
+          if attributes['price'].present?
+            currency = (attributes['currency'].presence || store.default_currency).to_s.strip.upcase
+            variant.set_price(currency, attributes['price'], attributes['compare_at_price'])
+          end
+
+          if attributes['inventory_count'].present?
+            variant.set_stock(attributes['inventory_count'].to_i, attributes['inventory_backorderable']&.to_b, store.default_stock_location)
+          end
+
+          handle_images(variant)
+
+          variant
+        end
+
+        private
+
+        def ensure_product_exists
+          product = Spree::Product.new
+          if attributes['slug'].present?
+            existing_product = product_scope.find_by(slug: attributes['slug'].strip.downcase)
+            product = existing_product if existing_product.present?
+          end
+
+          product = assign_attributes_to_product(product)
+          product.save!
+          handle_metafields(product)
+          product
+        end
+
+        def product_scope
+          Spree::Product.accessible_by(import.current_ability, :manage)
+        end
+
+        def assign_attributes_to_product(product)
+          # setting SKU for master variant so it will be picked up in process! and won't try to create a non-master variant
+          if product.new_record?
+            product.slug = attributes['slug']
+            product.sku = attributes['sku'] if attributes['sku'].present? && options.empty?
+          end
+
+          product.stores << store if product.stores.exclude?(store)
+          product.name = attributes['name'] if attributes['name'].present?
+          product.description = attributes['description'] if attributes['description'].present?
+          product.meta_title = attributes['meta_title'] if attributes['meta_title'].present?
+          product.meta_description = attributes['meta_description'] if attributes['meta_description'].present?
+          product.meta_keywords = attributes['meta_keywords'] if attributes['meta_keywords'].present?
+          product.status = to_spree_status(attributes['status']) if attributes['status'].present?
+          product.tag_list = attributes['tags'] if attributes['tags'].present?
+
+          product.taxons = prepare_taxons if options.empty?
+          product
+        end
+
+        def prepare_taxons
+          taxon_pretty_names = [
+            attributes['category1'],
+            attributes['category2'],
+            attributes['category3']
+          ].compact_blank.map(&:strip).uniq
+
+          return [] if taxon_pretty_names.empty?
+
+          taxons = taxon_pretty_names.map { |taxon_pretty_name| handle_taxon_line(taxon_pretty_name) }
+          taxons.compact
+        end
+
+        def handle_taxon_line(taxon_pretty_name)
+          taxon_names = taxon_pretty_name.strip.split('->').map(&:strip).map(&:presence).compact
+          return if taxon_names.empty?
+
+          taxonomy_name = taxon_names.shift
+          taxonomy = store.taxonomies.with_matching_name(taxonomy_name).first || store.taxonomies.create!(name: taxonomy_name)
+
+          last_taxon = taxonomy.root
+
+          taxon_names.each do |taxon_name|
+            last_taxon = taxonomy.taxons.with_matching_name(taxon_name).where(parent: last_taxon).first || taxonomy.taxons.create!(name: taxon_name, parent: last_taxon)
+          end
+
+          last_taxon
+        end
+
+        def prepare_option_value_variants
+          return [] if options.empty?
+
+          options.map do |option|
+            option_type = Spree::OptionType.search_by_name(option[:option_name]).first || Spree::OptionType.create!(presentation: option[:option_name])
+            option_value = option_type.option_values.search_by_name(option[:option_value]).first || option_type.option_values.create!(presentation: option[:option_value])
+
+            # ensure product option types include new option type
+            Spree::ProductOptionType.find_or_create_by!(product: product, option_type: option_type)
+
+            Spree::OptionValueVariant.new(option_value: option_value)
+          end
+        end
+
+        def handle_images(variant)
+          image_urls = [
+            attributes['image1_src'],
+            attributes['image2_src'],
+            attributes['image3_src'],
+          ].compact.map(&:strip).compact_blank.uniq
+
+          return if image_urls.empty?
+
+          image_urls.each do |image_url|
+            Spree::Images::SaveFromUrlJob.perform_later(variant.id, 'Spree::Variant', image_url)
+          end
+        end
+
+        def options
+          @options ||= begin
+            options = []
+
+            OPTION_TYPES_COUNT.times.map do |index|
+              next if attributes["option#{index + 1}_name"].blank?
+              next if attributes["option#{index + 1}_value"].blank?
+
+              options << {
+                index: index + 1,
+                option_name: attributes["option#{index + 1}_name"],
+                option_value: attributes["option#{index + 1}_value"]
+              }
+            end
+
+            options
+          end
+        end
+
+        def handle_metafields(product)
+          return unless product.class.included_modules.include?(Spree::Metafields)
+
+          metafield_attributes = attributes.select { |key, _value| key.to_s.start_with?('metafield.') }
+          return if metafield_attributes.empty?
+
+          # Build nested attributes for metafields
+          nested_attrs = []
+
+          metafield_attributes.each do |attribute_key, value|
+            # Extract namespace.key from "metafield.namespace.key"
+            full_key = attribute_key.to_s.sub(/^metafield\./, '')
+            namespace, key = product.extract_namespace_and_key(full_key)
+
+            # Find or initialize metafield definition
+            metafield_definition = Spree::MetafieldDefinition.find_by(
+              namespace: namespace,
+              key: key,
+              resource_type: product.class.name
+            )
+
+            next unless metafield_definition
+
+            # Find existing metafield if product is persisted
+            existing_metafield = product.persisted? ? product.metafields.find_by(metafield_definition: metafield_definition) : nil
+
+            # Skip blank values for new metafields
+            next if value.blank? && existing_metafield.nil?
+
+            # For existing metafields with blank values, we'll mark them for destruction
+            # For new metafields, we skip them (handled above)
+            # For existing or new metafields with values, we create/update them
+            metafield_attrs = {
+              metafield_definition_id: metafield_definition.id,
+              value: value.to_s.strip,
+              type: metafield_definition.metafield_type
+            }
+
+            metafield_attrs[:id] = existing_metafield.id if existing_metafield
+
+            nested_attrs << metafield_attrs
+          end
+
+          product.update(metafields_attributes: nested_attrs) unless nested_attrs.empty?
+        end
+
+        def to_spree_status(status)
+          case status.strip.downcase
+          when 'active'
+            'active'
+          when 'draft'
+            'draft'
+          when 'archived'
+            'archived'
+          else
+            'draft'
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/spree/line_items/destroy.rb

@@ -8,7 +8,7 @@ module Spree
         order = line_item.order
 
         ActiveRecord::Base.transaction do
-          line_item.destroy!
+          order.line_items.destroy(line_item)
           recalculate_service.call(order: order, line_item: line_item, options: options)
         end
         success(line_item)

data/app/services/spree/newsletter/subscribe.rb

@@ -0,0 +1,43 @@
+module Spree
+  module Newsletter
+    class Subscribe
+      def initialize(email:, current_user: nil)
+        @email = email
+        @current_user = current_user
+      end
+
+      def call
+        return existed_subscription if existed_subscription.present?
+
+        ActiveRecord::Base.transaction do
+          upsert_subscriber
+          return subscriber if subscriber.errors.any?
+
+          if subscriber.email == current_user&.email
+            # no need to verified since user email is already verified
+            Spree::Newsletter::Verify.new(subscriber: subscriber).call
+          end
+        end
+
+        # deliver confirmation email after the transaction is completed
+        subscriber.deliver_newsletter_email_verification unless subscriber.verified?
+        subscriber
+      end
+
+      private
+
+      attr_reader :email, :current_user
+
+      def upsert_subscriber
+        @upsert_subscriber ||= Spree::NewsletterSubscriber.find_or_create_by(email: email) do |new_record|
+          new_record.user = Spree.user_class.find_by(email: new_record.email) || current_user
+        end
+      end
+      alias_method :subscriber, :upsert_subscriber
+
+      def existed_subscription
+        @existed_subscription ||= Spree::NewsletterSubscriber.verified.find_by(email: email)
+      end
+    end
+  end
+end

data/app/services/spree/newsletter/verify.rb

@@ -0,0 +1,30 @@
+module Spree
+  module Newsletter
+    class Verify
+      def initialize(subscriber:)
+        @subscriber = subscriber
+      end
+
+      def call
+        verify_subscriber
+        set_user_email_marketing_to_true
+
+        subscriber
+      end
+
+      private
+
+      attr_reader :subscriber
+
+      def verify_subscriber
+        subscriber.update!(verified_at: Time.current, verification_token: nil)
+      end
+
+      def set_user_email_marketing_to_true
+        return if subscriber.user.blank?
+
+        subscriber.user.update!(accepts_email_marketing: true)
+      end
+    end
+  end
+end

data/app/sorters/spree/posts/sort.rb

@@ -0,0 +1,40 @@
+module Spree
+  module Posts
+    class Sort < ::Spree::BaseSorter
+      def initialize(scope, params = {}, allowed_sort_attributes = [])
+        super(scope, params, allowed_sort_attributes)
+      end
+
+      def call
+        posts = by_param_attributes(scope)
+        posts = select_translatable_fields(posts) if Spree.use_translations?
+
+        posts.distinct
+      end
+
+      private
+
+      attr_reader :sort, :scope, :allowed_sort_attributes
+
+      # Add translatable fields to SELECT statement to avoid InvalidColumnReference error (workaround for Mobility issue #596)
+      def select_translatable_fields(scope)
+        translatable_fields = translatable_sortable_fields
+        return scope if translatable_fields.empty?
+
+        scope.i18n.select("#{Post.table_name}.*").select(*translatable_fields)
+      end
+
+      def translatable_sortable_fields
+        fields = []
+        Post.translatable_fields.each do |field|
+          fields << field if sort_by?(field.to_s)
+        end
+        fields
+      end
+
+      def sort_by?(field)
+        sort.detect { |s| s[0] == field }
+      end
+    end
+  end
+end

data/app/views/spree/shared/_payment.html.erb

@@ -22,7 +22,7 @@
         <p class="mb-1"><%= Spree.t(:gift_card) %>: <strong><%= source.originator.code.upcase %></strong></p>
         <%= @order.display_gift_card_total %>
       </div>
-    <% elsif payment_method_icon_tag(payment.payment_method.payment_icon_name).present? %>
+    <% elsif payment.payment_method.present? && payment_method_icon_tag(payment.payment_method.payment_icon_name).present? %>
       <div class="d-flex flex align-items-center items-center">
         <div><%= payment_method_icon_tag(payment.payment_method.payment_icon_name) %></div>
         <div class="ml-3"><%= Spree.t(:store_credit_name) %></div>
@@ -33,7 +33,7 @@
       <%= payment_method_icon_tag source.class.to_s.demodulize.downcase, height: 30 %>
     </div>
     <div>
-      <% if payment.payment_method.respond_to?(:source_partial_name) %>
+      <% if payment.payment_method.present? && payment.payment_method.respond_to?(:source_partial_name) %>
         <%= render partial: "spree/payment_sources/#{payment.payment_method.source_partial_name}", locals: { payment: payment, source: source } %>
       <% elsif source.respond_to?(:name) %>
         <%= source.name %>
@@ -41,7 +41,7 @@
         <%= source.class.to_s.demodulize.downcase %>
       <% end %>
     </div>
-  <% else %>
+  <% elsif payment.payment_method.present? %>
     <div class="flex-shrink-0">
       <%= payment_method_icon_tag payment.payment_method.payment_icon_name %>
     </div>

data/config/locales/en.yml

@@ -53,6 +53,13 @@ en:
       spree/gift_card:
         amount_used: Amount used
         expires_at: Expires at
+      spree/import:
+        preferred_delimiter: Delimiter
+      spree/import_mapping:
+        file_column: File Column
+        schema_field: Schema Field
+      spree/import_row:
+        row_number: Number
       spree/inventory_unit:
         state: State
       spree/invitation:
@@ -60,6 +67,8 @@ en:
       spree/line_item:
         price: Price
         quantity: Quantity
+      spree/metafield_definition:
+        namespace: Namespace
       spree/option_type:
         filterable: Filterable
         name: Name
@@ -101,6 +110,9 @@ en:
         number: Number
       spree/payment_method:
         name: Name
+      spree/policy:
+        body: Body
+        owner: Policy for
       spree/product:
         available_on: Available On
         cost_currency: Cost Currency
@@ -165,6 +177,9 @@ en:
         preferred_limit_digital_download_days: Limit digital links download days
         seo_robots: SEO Robots
         seo_title: SEO Title
+        storefront_custom_code_body_end: Custom Code before closing body tag
+        storefront_custom_code_body_start: Custom Code after opening body tag
+        storefront_custom_code_head: Custom Code in page head
         url: Site URL
       spree/store_credit:
         amount_used: Amount used
@@ -241,6 +256,12 @@ en:
             attachment:
               attachment_must_be_present: must be present
               not_allowed_content_type: has not allowed content type
+        spree/import:
+          attributes:
+            attachment:
+              content_type: has not allowed content type
+            type:
+              inclusion: is not included in the list of allowed types
         spree/legacy_user:
           attributes:
             bill_address_id:
@@ -642,7 +663,6 @@ en:
       successfully_updated: Updated successfully
       unsuccessfully_saved: There was an error while trying to save your address.
       unsuccessfully_updated: There was an update while trying to update your address.
-    address_not_owned_by_user: The specified address does not belong to this user.
     address_settings: Address settings
     addresses: Addresses
     adjustable: Adjustable
@@ -678,6 +698,9 @@ en:
     analytics: Analytics
     and: and
     api_keys: API keys
+    apis:
+      platform: Platform API
+      storefront: Storefront API
     apply: Apply
     apply_only_on_full_priced_items: Apply only on full priced items
     apply_store_credit: Apply Store Credit
@@ -729,6 +752,7 @@ en:
     body_tag_end: Body tag end
     body_tag_start: Body tag start
     both: Both
+    brand: Brand
     breadcrumbs: Breadcrumbs
     calculated_reimbursements: Calculated Reimbursements
     calculator: Calculator
@@ -822,6 +846,7 @@ en:
     continue_selling_when_out_of_stock: Continue selling when out of stock
     continue_shopping: Continue shopping
     continue_without_logging_in: Continue without logging in
+    copied: Copied!
     copy: Copy
     copy_id: Copy ID
     copy_link: Copy link
@@ -872,7 +897,6 @@ en:
     credits: Credits
     currencies: Currencies
     currency: Currency
-    currency_and_country_help: This determines which vendors you can connect with and what customers see on your store.
     currency_settings: Currency Settings
     current: Current
     current_password: Current password
@@ -901,6 +925,7 @@ en:
     default_billing_address: Default billing address
     default_country: Default Country
     default_country_cannot_be_deleted: Default country cannot be deleted
+    default_country_help: Country that will be used for the default shipping and billing addresses on Checkout
     default_currency: Default currency
     default_locale: Default locale
     default_post_categories:
@@ -1062,6 +1087,7 @@ en:
     field: Field
     filename: Filename
     fill_in_customer_info: Please fill in customer info
+    filled: Filled
     filter: Filter
     filter_results: Filter Results
     filterable: Filterable
@@ -1144,6 +1170,7 @@ en:
     images: Images
     implement_eligible_for_return: 'Must implement #eligible_for_return? for your EligibilityValidator.'
     implement_requires_manual_intervention: 'Must implement #requires_manual_intervention? for your EligibilityValidator.'
+    import: Import
     import_payment_methods_from: Import payment methods from
     import_products_from: Import products from
     in_stock: In Stock
@@ -1166,6 +1193,8 @@ en:
     intercept_email_address: Intercept Email Address
     intercept_email_instructions: Override email recipient and replace with this address.
     internal_name: Internal Name
+    internal_server_error: Internal Server Error
+    internal_server_error_message: The server encountered an internal error and was unable to complete your request.
     internationalization: Internationalization
     invalid_credit_card: Invalid credit card.
     invalid_exchange_variant: Invalid exchange variant.
@@ -1210,6 +1239,7 @@ en:
     items_reimbursed: Items reimbursed
     items_to_be_reimbursed: Items to be reimbursed
     join_slack: Join Slack
+    key: Key
     kind: Kind
     language: Language
     last_name: Last Name
@@ -1265,6 +1295,8 @@ en:
     meta_keywords: Meta Keywords
     meta_title: Meta Title
     metadata: Metadata
+    metafield_definitions: Metafield Definitions
+    metafields: Metafields
     min: Min
     minimal_amount: Minimal Amount
     minimum_password_length:
@@ -1302,7 +1334,7 @@ en:
     new_gift_card: New Gift Card
     new_image: New Image
     new_line_item: Add line item
-    new_market: New market
+    new_metafield_definition: New Metafield Definition
     new_nested_taxon: New nested taxon
     new_option_type: New Option Type
     new_order: New Order
@@ -1312,6 +1344,7 @@ en:
     new_password: New password
     new_payment: New Payment
     new_payment_method: New Payment Method
+    new_policy: New Policy
     new_post: New Post
     new_post_category: New Post Category
     new_product: New Product
@@ -1344,6 +1377,17 @@ en:
     new_user: New User
     new_variant: New Variant
     new_zone: New Zone
+    newsletter_mailer:
+      email_confirmation:
+        dear_customer: Hey,
+        ignore_disclaimer: If you didn't request this, please ignore this email.
+        instructions: Please click the button below to verify your email address.
+        message_copy_link: 'If the button doesn''t work please copy and paste the following link to your browser:'
+        store_team: "%{store_name} Team"
+        subject: Verify your email address
+        thanks: Thank you
+        verify_email_address_link: Verify email address
+    newsletter_subscribers: Newsletter Subscribers
     newsletters: Newsletters
     next: Next
     no_actions_added: No actions added
@@ -1496,6 +1540,7 @@ en:
         buy_buttons:
           display_name: Add To Cart
     page_not_found: Sorry! Page you are looking can’t be found.
+    page_not_found_message: This page just doesn't exist.
     page_sections:
       announcement_bar:
         default_text: Welcome to my Store!
@@ -1780,6 +1825,7 @@ en:
     resellable: Resellable
     resend: Resend
     reset_password: Reset my password
+    resource: Resource
     response_code: Response Code
     restore_defaults: Restore defaults
     resume: resume
@@ -1814,6 +1860,7 @@ en:
     rma_value: RMA Value
     role_id: Role ID
     roles: Roles
+    row: Row
     rules: Rules
     safe: Safe
     sale: Sale
@@ -1870,6 +1917,8 @@ en:
     seo_title: SEO Title
     server: Server
     server_error: The server returned an error
+    service_unavailable: Service Unavailable
+    service_unavailable_message: The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.
     settings: Settings
     ship: Ship
     ship_address: Ship Address
@@ -2206,6 +2255,8 @@ en:
       metric: metric
       metric_system: Metric system
     unlock: Unlock
+    unprocessable_entity: Unprocessable Entity
+    unprocessable_entity_message: Your request could not be processed. Please check the form for errors and try again.
     unrecognized_card_type: Unrecognized card type
     unshippable_items: Unshippable Items
     update: Update
@@ -2247,6 +2298,8 @@ en:
     variants_count: Variants count
     vendor: Vendor
     vendors: Vendors
+    verified: Verified
+    verified_at: Verified at
     version: Version
     view: View
     view_all: View all