spree_core 5.2.0 → 5.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ae177c6a311a310cbcb6d6faf5b879afc52177f9f6bf4c7063edb5ece85fc755
-  data.tar.gz: 54794ac79f785c9965c7a1f69fe0c88470fdf751cb789cab9db047b6d9ddbaa4
+  metadata.gz: 40e658898150457b9405d6d68e58d78c1b31b23518e2ffdb6829d3bfb0d68a90
+  data.tar.gz: e36b7e5d2e39426e2ea9cb4078625f72c36ed58e626959b277174f7f033bdd1f
 SHA512:
-  metadata.gz: a0f404ec813d9fc4eaabcab6cac7a461aae2671d43a55c5b59b3e53c10fbb442acf6fa01171690999f576f93e90ab77a26f767881f77dbe6f14dd73ec5619689
-  data.tar.gz: d4bacd845e8c842ab4ee8e394feb1006a4289c85ca7569e017eee6053fe29492dfc30466e413793b1af07b00a2f2575487d8746cf9a9ecdf959292b4cc0e6763
+  metadata.gz: f01a4d3e5245986e4a851dc51fb18103405cf2fab2669a43d504c922a5e7284739a23f6cd17da01276a6ab9a71b4c9589667a4bd7e3373d2c83a9508ea9b87e4
+  data.tar.gz: 1be2f451d4c370d7c72eee740dfce1536308d61ad7f16c114a7db2eb2462401150ca874b56cda455645abccdc65e9bc97e5810ef82dac16a263ed64ea584c7f7

data/app/finders/spree/line_items/find_by_variant.rb

@@ -5,7 +5,7 @@ module Spree
         line_item = order.line_items.loaded? ? order.line_items.detect { |li| li.variant_id == variant.id } : order.line_items.find_by(variant_id: variant.id)
 
         if line_item
-          Spree::Dependencies.cart_compare_line_items_service.constantize.call(order: order, line_item: line_item, options: options).value
+          Spree.cart_compare_line_items_service.call(order: order, line_item: line_item, options: options).value
         end
 
         line_item

data/app/helpers/spree/images_helper.rb

@@ -7,10 +7,17 @@ module Spree
     # @param options [Hash] options for the image tag
     # @option options [Integer] :width the width of the image
     # @option options [Integer] :height the height of the image
+    # @option options [Symbol] :variant use a preprocessed named variant (e.g., :mini, :small, :medium, :large, :xlarge)
     def spree_image_tag(image, options = {})
+      url_options = if options[:variant].present?
+                      { variant: options[:variant] }
+                    else
+                      { width: options[:width], height: options[:height], format: options[:format] }
+                    end
+
       image_tag(
-        spree_image_url(image, { width: options[:width], height: options[:height], format: options[:format] }),
-        options
+        spree_image_url(image, url_options),
+        options.except(:variant, :format)
       )
     end
 
@@ -19,9 +26,17 @@ module Spree
       return unless image.variable?
       return if image.respond_to?(:attached?) && !image.attached?
       url_helpers = respond_to?(:main_app) ? main_app : Rails.application.routes.url_helpers
+
+      # Use preprocessed named variant if specified (e.g., :mini, :small, :medium, :large, :xlarge)
+      if options[:variant].present?
+        return url_helpers.cdn_image_url(image.variant(options[:variant]))
+      end
+
+      # Dynamic variant generation for width/height options
       width = options[:width]
       height = options[:height]
 
+      # Double dimensions for retina displays
       width *= 2 if width.present?
       height *= 2 if height.present?
 
@@ -74,27 +89,28 @@ module Spree
     # @param options [Hash] options for the image variant
     # @option options [Integer] :width the width of the image
     # @option options [Integer] :height the height of the image
+    #
+    # @note The key order matters for variation digest matching with preprocessed variants.
+    #       Active Storage reorders keys alphabetically, so use: format, resize_to_fill/limit, saver
+    # @note Use string values (not symbols) for format because variation keys are JSON-encoded
+    #       in URLs and JSON converts symbols to strings, causing digest mismatches.
     def spree_image_variant_options(options = {})
-      {
-        saver: options[:format] == :png ? png_variant_options : webp_variant_options,
-        format: options[:format] || :webp
-      }.merge(options.except(:format))
+      format_opt = options[:format]&.to_s
+      saver_options = format_opt == "png" ? png_saver_options : Spree::Asset::WEBP_SAVER_OPTIONS
+      format = format_opt || "webp"
+
+      # Build hash in alphabetical order to match Active Storage's key ordering
+      result = {}
+      result[:format] = format
+      result[:resize_to_fill] = options[:resize_to_fill] if options[:resize_to_fill]
+      result[:resize_to_limit] = options[:resize_to_limit] if options[:resize_to_limit]
+      result[:saver] = saver_options
+      result
     end
 
     private
 
-    def webp_variant_options
-      {
-        strip: true,
-        quality: 75,
-        lossless: false,
-        alpha_q: 85,
-        reduction_effort: 6,
-        smart_subsample: true
-      }
-    end
-
-    def png_variant_options
+    def png_saver_options
       {
         strip: true,
         compression_level: 8,

data/app/helpers/spree/mail_helper.rb

@@ -5,7 +5,7 @@ module Spree
 
     def variant_image_url(variant)
       image = variant.default_image
-      image.present? && image.attached? ? spree_image_url(image, width: 100, height: 100, format: :png) : image_url('noimage/small.png')
+      image.present? && image.attached? ? spree_image_url(image, variant: :mini) : image_url('noimage/small.png')
     end
 
     def name_for(order)

data/app/jobs/spree/imports/create_rows_job.rb

@@ -31,7 +31,7 @@ module Spree
 
         upsert_options = {}
         if %w[PostgreSQL SQLite].include?(ActiveRecord::Base.connection.adapter_name)
-          upsert_options[:unique_by] = %i[import_id row_number]
+          upsert_options[:unique_by] = :index_spree_import_rows_on_import_id_and_row_number
         end
         # NOTE: Ensure a DB-level unique index on [:import_id, :row_number] for all adapters.
 

data/app/jobs/spree/variants/remove_line_item_job.rb

@@ -4,7 +4,7 @@ module Spree
       queue_as Spree.queues.variants
 
       def perform(line_item:)
-        Spree::Dependencies.cart_remove_line_item_service.constantize.call(order: line_item.order, line_item: line_item)
+        Spree.cart_remove_line_item_service.call(order: line_item.order, line_item: line_item)
       end
     end
   end

data/app/models/spree/ability.rb

@@ -1,6 +1,15 @@
 # Implementation class for Cancan gem. Instead of overriding this class, consider adding new permissions
 # using the special +register_ability+ method which allows extensions to add their own abilities.
 #
+# The preferred way to add permissions is now through permission sets. See Spree::PermissionSets::Base
+# for more details on creating custom permission sets.
+#
+# @example Configuring role permissions
+#   Spree.permissions.assign(:customer_service, [
+#     Spree::PermissionSets::OrderDisplay,
+#     Spree::PermissionSets::UserManagement
+#   ])
+#
 # See https://github.com/CanCanCommunity/cancancan for more details.
 require 'cancan'
 
@@ -11,6 +20,12 @@ module Spree
     class_attribute :abilities
     self.abilities = Set.new
 
+    # @return [Object] the current user
+    attr_reader :user
+
+    # @return [Spree::Store, nil] the current store
+    attr_reader :store
+
     # Allows us to go beyond the standard cancan initialize method which makes it difficult for engines to
     # modify the default +Ability+ of an application.  The +ability+ argument must be a class that includes
     # the +CanCan::Ability+ module.  The registered ability should behave properly as a stand-alone class
@@ -26,22 +41,16 @@ module Spree
     def initialize(user, options = {})
       alias_cancan_delete_action
 
-      user ||= Spree.user_class.new
-      store ||= options[:store] || Spree::Current.store
+      @user = user || Spree.user_class.new
+      @store = options[:store] || Spree::Current.store
 
-      if user.persisted? && user.is_a?(Spree.admin_user_class) && user.try(:spree_admin?, store)
-        apply_admin_permissions(user, options)
-      else
-        apply_user_permissions(user, options)
-      end
+      apply_permissions_from_sets
 
       # Include any abilities registered by extensions, etc.
       # this is legacy behaviour and should be removed in Spree 5.0
       Ability.abilities.merge(abilities_to_register).each do |clazz|
-        merge clazz.new(user)
+        merge clazz.new(@user)
       end
-
-      protect_admin_role
     end
 
     protected
@@ -57,6 +66,62 @@ module Spree
       alias_action :create, :update, :destroy, to: :modify
     end
 
+    # Applies permissions based on the user's roles and the configured permission sets.
+    def apply_permissions_from_sets
+      role_names = determine_role_names
+      permission_sets = Spree.permissions.permission_sets_for_roles(role_names)
+
+      # If no permission sets are configured for the user's roles, use legacy behavior
+      if permission_sets.empty?
+        apply_legacy_permissions
+      else
+        activate_permission_sets(permission_sets)
+      end
+    end
+
+    # Determines the role names for the current user.
+    #
+    # @return [Array<Symbol>] the role names
+    def determine_role_names
+      return [:default] unless @user.persisted?
+
+      # First, try to get roles from the spree_roles association
+      if @user.respond_to?(:spree_roles)
+        role_names = @user.spree_roles.pluck(:name).map(&:to_sym)
+        return role_names if role_names.any?
+      end
+
+      # Fall back to checking spree_admin? for backward compatibility
+      # This supports cases where roles are mocked or admin status is determined differently
+      if @user.try(:spree_admin?, @store)
+        [:admin]
+      else
+        [:default]
+      end
+    end
+
+    # Activates the given permission sets.
+    #
+    # @param permission_sets [Array<Class>] the permission set classes to activate
+    def activate_permission_sets(permission_sets)
+      permission_sets.each do |permission_set_class|
+        permission_set = permission_set_class.new(self)
+        permission_set.activate!
+      end
+    end
+
+    # Legacy permission application for backward compatibility.
+    # This is used when no permission sets are configured for the user's roles.
+    def apply_legacy_permissions
+      if @user.persisted? && @user.is_a?(Spree.admin_user_class) && @user.try(:spree_admin?, @store)
+        apply_admin_permissions(@user, { store: @store })
+      else
+        apply_user_permissions(@user, { store: @store })
+      end
+
+      protect_admin_role
+    end
+
     def apply_admin_permissions(_user, _options)
       can :manage, :all
       cannot :cancel, Spree::Order

data/app/models/spree/asset.rb

@@ -12,9 +12,33 @@ module Spree
     belongs_to :viewable, polymorphic: true, touch: true
     acts_as_list scope: [:viewable_id, :viewable_type]
 
-    delegate :key, :attached?, :variant, :variable?, :blob, :filename, to: :attachment
+    delegate :key, :attached?, :variant, :variable?, :blob, :filename, :variation, to: :attachment
 
-    has_one_attached :attachment, service: Spree.public_storage_service_name
+    WEBP_SAVER_OPTIONS = {
+      strip: true,
+      quality: 75,
+      lossless: false,
+      alpha_q: 85,
+      reduction_effort: 6,
+      smart_subsample: true
+    }.freeze
+
+    has_one_attached :attachment, service: Spree.public_storage_service_name do |attachable|
+      # Note: Key order matters for variation digest matching.
+      # Active Storage reorders keys alphabetically when calling variant(:name),
+      # so we must define them in alphabetical order: format, resize_to_fill, saver
+      #
+      # IMPORTANT: Use string values (not symbols) for format because the variation key
+      # is JSON-encoded in URLs. JSON converts symbols to strings, so "webp" != :webp
+      # after round-tripping, which causes digest mismatches.
+      Spree::Config.product_image_variant_sizes.each do |name, (width, height)|
+        attachable.variant name,
+                           format: "webp",
+                           resize_to_fill: [width, height],
+                           saver: WEBP_SAVER_OPTIONS,
+                           preprocessed: true
+      end
+    end
 
     default_scope { includes(attachment_attachment: :blob) }
 

data/app/models/spree/export.rb

@@ -157,7 +157,7 @@ module Spree
     end
 
     def current_ability
-      @current_ability ||= Spree::Dependencies.ability_class.constantize.new(user, { store: store })
+      @current_ability ||= Spree.ability_class.new(user, { store: store })
     end
 
     # eg. Spree::Exports::Products => products-store-my-store-code-20241030133348.csv

data/app/models/spree/image/configuration/active_storage.rb

@@ -7,25 +7,16 @@ module Spree
         included do
           validates :attachment, attached: true, content_type: Rails.application.config.active_storage.web_image_content_types
 
+          # Returns image styles derived from Spree::Config.product_image_variant_sizes
+          # Format: { variant_name: 'WxH>' } for API compatibility
           def self.styles
-            @styles ||= {
-              mini: '48x48>',
-              small: '100x100>',
-              product: '240x240>',
-              pdp_thumbnail: '160x200>',
-              plp_and_carousel: '448x600>',
-              plp_and_carousel_xs: '254x340>',
-              plp_and_carousel_sm: '350x468>',
-              plp_and_carousel_md: '222x297>',
-              plp_and_carousel_lg: '278x371>',
-              large: '600x600>',
-              plp: '278x371>',
-              zoomed: '650x870>'
-            }
+            @styles ||= Spree::Config.product_image_variant_sizes.transform_values do |dimensions|
+              "#{dimensions[0]}x#{dimensions[1]}>"
+            end
           end
 
           def default_style
-            :product
+            :small
           end
         end
       end

data/app/models/spree/image.rb

@@ -51,7 +51,8 @@ module Spree
     end
 
     def plp_url
-      generate_url(size: self.class.styles[:plp_and_carousel])
+      Spree::Deprecation.warn "Image#plp_url is deprecated. Use variant(:large) instead."
+      generate_url(size: self.class.styles[:large])
     end
 
     private

data/app/models/spree/import.rb

@@ -217,7 +217,7 @@ module Spree
     # Returns the current ability for the import
     # @return [Spree::Ability]
     def current_ability
-      @current_ability ||= Spree::Dependencies.ability_class.constantize.new(user, { store: store })
+      @current_ability ||= Spree.ability_class.new(user, { store: store })
     end
 
     class << self

data/app/models/spree/order/gift_card.rb

@@ -25,13 +25,13 @@ module Spree
       # @param gift_card [Spree::GiftCard] the gift card to apply
       # @return [Spree::Order] the order with the gift card applied
       def apply_gift_card(gift_card)
-        Spree::Dependencies.gift_card_apply_service.constantize.call(gift_card: gift_card, order: self)
+        Spree.gift_card_apply_service.call(gift_card: gift_card, order: self)
       end
 
       # Removes a gift card from the order
       # @return [Spree::Order] the order with the gift card removed
       def remove_gift_card
-        Spree::Dependencies.gift_card_remove_service.constantize.call(order: self)
+        Spree.gift_card_remove_service.call(order: self)
       end
 
       def recalculate_gift_card
@@ -44,7 +44,7 @@ module Spree
       def redeem_gift_card
         return unless gift_card.present?
 
-        Spree::Dependencies.gift_card_redeem_service.constantize.call(gift_card: gift_card)
+        Spree.gift_card_redeem_service.call(gift_card: gift_card)
       end
     end
   end

data/app/models/spree/order/store_credit.rb

@@ -2,11 +2,11 @@ module Spree
   class Order < Spree.base_class
     module StoreCredit
       def add_store_credit_payments(amount = nil)
-        Spree::Dependencies.checkout_add_store_credit_service.constantize.call(order: self, amount: amount)
+        Spree.checkout_add_store_credit_service.call(order: self, amount: amount)
       end
 
       def remove_store_credit_payments
-        Spree::Dependencies.checkout_remove_store_credit_service.constantize.call(order: self)
+        Spree.checkout_remove_store_credit_service.call(order: self)
       end
 
       def covered_by_store_credit?

data/app/models/spree/order.rb

@@ -349,7 +349,7 @@ module Spree
     end
 
     def updater
-      @updater ||= Spree::Dependencies.order_updater.constantize.new(self)
+      @updater ||= Spree.order_updater.new(self)
     end
 
     def update_with_updater!
@@ -407,7 +407,7 @@ module Spree
     def find_line_item_by_variant(variant, options = {})
       line_items.detect do |line_item|
         line_item.variant_id == variant.id &&
-          Spree::Dependencies.cart_compare_line_items_service.constantize.new.call(order: self, line_item: line_item, options: options).value
+          Spree.cart_compare_line_items_service.new.call(order: self, line_item: line_item, options: options).value
       end
     end
 
@@ -578,7 +578,7 @@ module Spree
     def empty!
       raise Spree.t(:cannot_empty_completed_order) if completed?
 
-      result = Spree::Dependencies.cart_empty_service.constantize.call(order: self)
+      result = Spree.cart_empty_service.call(order: self)
       result.value
     end
 
@@ -957,7 +957,7 @@ module Spree
       if gift_card.present?
         recalculate_gift_card
       elsif using_store_credit?
-        Spree::Dependencies.checkout_add_store_credit_service.constantize.call(order: self)
+        Spree.checkout_add_store_credit_service.call(order: self)
       end
     end
   end

data/app/models/spree/order_contents.rb

@@ -7,17 +7,17 @@ module Spree
     end
 
     def add(variant, quantity = 1, options = {})
-      Spree::Dependencies.cart_add_item_service.constantize.call(order: order,
-                                                                 variant: variant,
-                                                                 quantity: quantity,
-                                                                 options: options).value
+      Spree.cart_add_item_service.call(order: order,
+                                       variant: variant,
+                                       quantity: quantity,
+                                       options: options).value
     end
 
     def remove(variant, quantity = 1, options = {})
-      Spree::Dependencies.cart_remove_item_service.constantize.call(order: order,
-                                                                    variant: variant,
-                                                                    quantity: quantity,
-                                                                    options: options).value
+      Spree.cart_remove_item_service.call(order: order,
+                                          variant: variant,
+                                          quantity: quantity,
+                                          options: options).value
     end
 
     def remove_line_item(line_item, options = {})
@@ -25,7 +25,7 @@ module Spree
     end
 
     def update_cart(params)
-      Spree::Dependencies.cart_update_service.constantize.call(order: order, params: params).value
+      Spree.cart_update_service.call(order: order, params: params).value
     end
   end
 end

data/app/models/spree/order_merger.rb

@@ -35,9 +35,9 @@ module Spree
     def find_matching_line_item(other_order_line_item)
       order.line_items.detect do |my_li|
         my_li.variant == other_order_line_item.variant &&
-          Spree::Dependencies.cart_compare_line_items_service.constantize.new.call(order: order,
-                                                                                   line_item: my_li,
-                                                                                   options: other_order_line_item.serializable_hash).value
+          Spree.cart_compare_line_items_service.new.call(order: order,
+                                                         line_item: my_li,
+                                                         options: other_order_line_item.serializable_hash).value
       end
     end
 

data/app/models/spree/page_sections/featured_taxon.rb

@@ -61,8 +61,7 @@ module Spree
             sort_by: 'default'
           }
 
-          products_finder = Spree::Dependencies.products_finder.constantize
-          products_finder.new(scope: store.products, params: finder_params).execute.limit(preferred_max_products_to_show)
+          Spree.products_finder.new(scope: store.products, params: finder_params).execute.limit(preferred_max_products_to_show)
         end
       end
 

data/app/models/spree/permission_sets/base.rb

@@ -0,0 +1,81 @@
+# Base class for all permission sets.
+#
+# Permission sets are reusable groups of permissions that can be assigned to roles.
+# They provide a clean abstraction over CanCanCan abilities, making it easier to
+# manage permissions in a modular way.
+#
+# @example Creating a custom permission set
+#   class Spree::PermissionSets::InventoryManagement < Spree::PermissionSets::Base
+#     def activate!
+#       can :manage, Spree::StockItem
+#       can :manage, Spree::StockLocation
+#       can :manage, Spree::StockMovement
+#     end
+#   end
+#
+# @example Assigning the permission set to a role
+#   Spree.permissions.assign(:warehouse_manager, Spree::PermissionSets::InventoryManagement)
+#
+module Spree
+  module PermissionSets
+    class Base
+      # @return [CanCan::Ability] the ability instance to add permissions to
+      attr_reader :ability
+
+      # @param ability [CanCan::Ability] the ability instance to add permissions to
+      def initialize(ability)
+        @ability = ability
+      end
+
+      # Activates this permission set by adding its permissions to the ability.
+      # Override this method in subclasses to define the permissions.
+      #
+      # @abstract
+      # @return [void]
+      def activate!
+        raise NotImplementedError, "#{self.class} must implement #activate!"
+      end
+
+      protected
+
+      # Delegates the `can` method to the ability instance.
+      #
+      # @param args [Array] arguments to pass to CanCan::Ability#can
+      # @param block [Proc] optional block for conditional permissions
+      def can(*args, &block)
+        ability.can(*args, &block)
+      end
+
+      # Delegates the `cannot` method to the ability instance.
+      #
+      # @param args [Array] arguments to pass to CanCan::Ability#cannot
+      # @param block [Proc] optional block for conditional permissions
+      def cannot(*args, &block)
+        ability.cannot(*args, &block)
+      end
+
+      # Delegates the `can?` method to the ability instance.
+      #
+      # @param args [Array] arguments to pass to CanCan::Ability#can?
+      # @return [Boolean]
+      def can?(*args)
+        ability.can?(*args)
+      end
+
+      # Returns the user from the ability instance.
+      # This method assumes the ability has a user accessor.
+      #
+      # @return [Object] the current user
+      def user
+        ability.user
+      end
+
+      # Returns the store from the ability instance options.
+      #
+      # @return [Spree::Store, nil] the current store
+      def store
+        ability.store
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/configuration_management.rb

@@ -0,0 +1,47 @@
+# Permission set for managing store configuration and settings.
+#
+# This permission set provides access to manage store settings,
+# payment methods, shipping methods, and other configuration.
+#
+# @example
+#   Spree.permissions.assign(:store_admin, Spree::PermissionSets::ConfigurationManagement)
+#
+module Spree
+  module PermissionSets
+    class ConfigurationManagement < Base
+      def activate!
+        # Store settings
+        can :manage, Spree::Store
+
+        # Payment configuration
+        can :manage, Spree::PaymentMethod
+        can :manage, Spree::Gateway
+
+        # Shipping configuration
+        can :manage, Spree::ShippingMethod
+        can :manage, Spree::ShippingCategory
+        can :manage, Spree::Zone
+        can :manage, Spree::ZoneMember
+
+        # Tax configuration
+        can :manage, Spree::TaxCategory
+        can :manage, Spree::TaxRate
+
+        # General configuration
+        can :manage, Spree::RefundReason
+        can :manage, Spree::ReimbursementType
+        can :manage, Spree::ReturnReason
+
+        # Restrictions on immutable types
+        cannot [:edit, :update], Spree::RefundReason, mutable: false
+        cannot [:edit, :update], Spree::ReimbursementType, mutable: false
+
+        # Metafield configuration
+        can :manage, Spree::MetafieldDefinition
+
+        # Policies
+        can :manage, Spree::Policy
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/dashboard_display.rb

@@ -0,0 +1,17 @@
+# Permission set for viewing the admin dashboard.
+#
+# This permission set provides access to view the admin dashboard
+# and basic admin navigation.
+#
+# @example
+#   Spree.permissions.assign(:viewer, Spree::PermissionSets::DashboardDisplay)
+#
+module Spree
+  module PermissionSets
+    class DashboardDisplay < Base
+      def activate!
+        can [:admin, :index, :show], :dashboard
+      end
+    end
+  end
+end