spree_core 5.2.0 → 5.2.2

data/app/models/spree/permission_sets/default_customer.rb

@@ -0,0 +1,66 @@
+# Permission set for default storefront customers (both authenticated and guests).
+#
+# This permission set provides the standard permissions needed for browsing
+# the store and making purchases.
+#
+# @example
+#   Spree.permissions.assign(:default, Spree::PermissionSets::DefaultCustomer)
+#
+module Spree
+  module PermissionSets
+    class DefaultCustomer < Base
+      def activate!
+        # Read-only access to catalog
+        can :read, Spree::Country
+        can :read, Spree::OptionType
+        can :read, Spree::OptionValue
+        can :read, Spree::Product
+        can :read, Spree::ProductProperty
+        can :read, Spree::Property
+        can :read, Spree::State
+        can :read, Spree::Store
+        can :read, Spree::Taxon
+        can :read, Spree::Taxonomy
+        can :read, Spree::Variant
+        can :read, Spree::Zone
+
+        # Content pages
+        can :read, Spree::Policy
+        can :read, Spree::Page
+        can :read, Spree::Post
+        can :read, Spree::PostCategory
+
+        # Order management for the user's own orders
+        can :create, Spree::Order
+        can :show, Spree::Order do |order, token|
+          order.user == user || order.token && token == order.token
+        end
+        can :update, Spree::Order do |order, token|
+          !order.completed? && (order.user == user || order.token && token == order.token)
+        end
+
+        # User account management - available to all users (including guests for their own record)
+        can :create, Spree.user_class
+        can [:show, :update, :destroy], Spree.user_class, id: user.id
+
+        # Address management
+        can :manage, Spree::Address, user_id: user.id
+
+        # Credit card management
+        can [:read, :destroy], Spree::CreditCard, user_id: user.id
+
+        # Wishlist management
+        can :manage, Spree::Wishlist, user_id: user.id
+        can :show, Spree::Wishlist do |wishlist|
+          wishlist.user == user || wishlist.is_private == false
+        end
+        can [:create, :update, :destroy], Spree::WishedItem do |wished_item|
+          wished_item.wishlist.user == user
+        end
+
+        # Invitation acceptance
+        can :accept, Spree::Invitation, invitee_id: [user.id, nil], invitee_type: user.class.name, status: 'pending'
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/order_display.rb

@@ -0,0 +1,27 @@
+# Permission set for viewing orders and related resources.
+#
+# This permission set provides read-only access to orders and associated
+# models like payments, shipments, and refunds.
+#
+# @example
+#   Spree.permissions.assign(:customer_service, Spree::PermissionSets::OrderDisplay)
+#
+module Spree
+  module PermissionSets
+    class OrderDisplay < Base
+      def activate!
+        can [:read, :admin, :index], Spree::Order
+        can [:read, :admin], Spree::Payment
+        can [:read, :admin], Spree::Shipment
+        can [:read, :admin], Spree::Adjustment
+        can [:read, :admin], Spree::LineItem
+        can [:read, :admin], Spree::ReturnAuthorization
+        can [:read, :admin], Spree::CustomerReturn
+        can [:read, :admin], Spree::Reimbursement
+        can [:read, :admin], Spree::Refund
+        can [:read, :admin], Spree::StoreCredit
+        can [:read, :admin], Spree::GiftCard
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/order_management.rb

@@ -0,0 +1,33 @@
+# Permission set for full order management.
+#
+# This permission set provides complete access to manage orders,
+# including creating, updating, and processing payments and shipments.
+#
+# @example
+#   Spree.permissions.assign(:order_manager, Spree::PermissionSets::OrderManagement)
+#
+module Spree
+  module PermissionSets
+    class OrderManagement < Base
+      def activate!
+        can :manage, Spree::Order
+        can :manage, Spree::Payment
+        can :manage, Spree::Shipment
+        can :manage, Spree::Adjustment
+        can :manage, Spree::LineItem
+        can :manage, Spree::ReturnAuthorization
+        can :manage, Spree::CustomerReturn
+        can :manage, Spree::Reimbursement
+        can :manage, Spree::Refund
+        can :manage, Spree::StoreCredit
+        can :manage, Spree::GiftCard
+
+        # Order-specific restrictions
+        cannot :cancel, Spree::Order
+        can :cancel, Spree::Order, &:allow_cancel?
+        cannot :destroy, Spree::Order
+        can :destroy, Spree::Order, &:can_be_deleted?
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/product_display.rb

@@ -0,0 +1,27 @@
+# Permission set for viewing products and catalog information.
+#
+# This permission set provides read-only access to products, variants,
+# and related catalog models.
+#
+# @example
+#   Spree.permissions.assign(:content_editor, Spree::PermissionSets::ProductDisplay)
+#
+module Spree
+  module PermissionSets
+    class ProductDisplay < Base
+      def activate!
+        can [:read, :admin, :index], Spree::Product
+        can [:read, :admin], Spree::Variant
+        can [:read, :admin], Spree::OptionType
+        can [:read, :admin], Spree::OptionValue
+        can [:read, :admin], Spree::Property
+        can [:read, :admin], Spree::ProductProperty
+        can [:read, :admin], Spree::Metafield
+        can [:read, :admin], Spree::Taxon
+        can [:read, :admin], Spree::Taxonomy
+        can [:read, :admin], Spree::Classification
+        can [:read, :admin], Spree::Price
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/product_management.rb

@@ -0,0 +1,27 @@
+# Permission set for full product and catalog management.
+#
+# This permission set provides complete access to manage products, variants,
+# and related catalog models like taxonomies and properties.
+#
+# @example
+#   Spree.permissions.assign(:merchandiser, Spree::PermissionSets::ProductManagement)
+#
+module Spree
+  module PermissionSets
+    class ProductManagement < Base
+      def activate!
+        can :manage, Spree::Product
+        can :manage, Spree::Variant
+        can :manage, Spree::OptionType
+        can :manage, Spree::OptionValue
+        can :manage, Spree::Property
+        can :manage, Spree::ProductProperty
+        can :manage, Spree::Taxon
+        can :manage, Spree::Taxonomy
+        can :manage, Spree::Classification
+        can :manage, Spree::Price
+        can :manage, Spree::Asset
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/promotion_management.rb

@@ -0,0 +1,22 @@
+# Permission set for managing promotions and discounts.
+#
+# This permission set provides access to create and manage promotions,
+# coupon codes, and promotion rules.
+#
+# @example
+#   Spree.permissions.assign(:marketing, Spree::PermissionSets::PromotionManagement)
+#
+module Spree
+  module PermissionSets
+    class PromotionManagement < Base
+      def activate!
+        can :manage, Spree::Promotion
+        can :manage, Spree::PromotionRule
+        can :manage, Spree::PromotionAction
+        can :manage, Spree::PromotionCategory
+        can :manage, Spree::CouponCode
+        can [:read, :admin], Spree::Metafield
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/role_management.rb

@@ -0,0 +1,21 @@
+# Permission set for managing roles and permissions.
+#
+# This permission set provides access to manage roles and user assignments.
+# Note: The admin role cannot be modified.
+#
+# @example
+#   Spree.permissions.assign(:admin, Spree::PermissionSets::RoleManagement)
+#
+module Spree
+  module PermissionSets
+    class RoleManagement < Base
+      def activate!
+        can :manage, Spree::Role
+        can :manage, Spree::RoleUser
+
+        # Protect the admin role from modification
+        cannot [:update, :destroy], Spree::Role, name: ['admin']
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/stock_display.rb

@@ -0,0 +1,19 @@
+# Permission set for viewing stock and inventory information.
+#
+# This permission set provides read-only access to stock items,
+# locations, and movements.
+#
+# @example
+#   Spree.permissions.assign(:warehouse_viewer, Spree::PermissionSets::StockDisplay)
+#
+module Spree
+  module PermissionSets
+    class StockDisplay < Base
+      def activate!
+        can [:read, :admin, :index], Spree::StockItem
+        can [:read, :admin], Spree::StockLocation
+        can [:read, :admin], Spree::StockMovement
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/stock_management.rb

@@ -0,0 +1,19 @@
+# Permission set for full stock and inventory management.
+#
+# This permission set provides complete access to manage stock items,
+# locations, and movements.
+#
+# @example
+#   Spree.permissions.assign(:warehouse_manager, Spree::PermissionSets::StockManagement)
+#
+module Spree
+  module PermissionSets
+    class StockManagement < Base
+      def activate!
+        can :manage, Spree::StockItem
+        can :manage, Spree::StockLocation
+        can :manage, Spree::StockMovement
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/super_user.rb

@@ -0,0 +1,28 @@
+# Permission set granting full administrative access.
+#
+# This permission set provides unrestricted access to all resources,
+# with some safety restrictions for critical operations.
+#
+# @example
+#   Spree.permissions.assign(:admin, Spree::PermissionSets::SuperUser)
+#
+module Spree
+  module PermissionSets
+    class SuperUser < Base
+      def activate!
+        can :manage, :all
+
+        # Safety restrictions
+        cannot :cancel, Spree::Order
+        can :cancel, Spree::Order, &:allow_cancel?
+        cannot :destroy, Spree::Order
+        can :destroy, Spree::Order, &:can_be_deleted?
+        cannot [:edit, :update], Spree::RefundReason, mutable: false
+        cannot [:edit, :update], Spree::ReimbursementType, mutable: false
+
+        # Protect the admin role from modification
+        cannot [:update, :destroy], Spree::Role, name: ['admin']
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/user_display.rb

@@ -0,0 +1,19 @@
+# Permission set for viewing users and related information.
+#
+# This permission set provides read-only access to user accounts,
+# addresses, and credit cards.
+#
+# @example
+#   Spree.permissions.assign(:support_staff, Spree::PermissionSets::UserDisplay)
+#
+module Spree
+  module PermissionSets
+    class UserDisplay < Base
+      def activate!
+        can [:read, :admin, :index], Spree.user_class
+        can [:read, :admin], Spree::Address
+        can [:read, :admin], Spree::CreditCard
+      end
+    end
+  end
+end

data/app/models/spree/permission_sets/user_management.rb

@@ -0,0 +1,20 @@
+# Permission set for full user management.
+#
+# This permission set provides complete access to manage user accounts,
+# addresses, and credit cards.
+#
+# @example
+#   Spree.permissions.assign(:customer_service, Spree::PermissionSets::UserManagement)
+#
+module Spree
+  module PermissionSets
+    class UserManagement < Base
+      def activate!
+        can :manage, Spree.user_class
+        can :manage, Spree::Address
+        can :manage, Spree::CreditCard
+        can [:read, :admin], Spree::Metafield
+      end
+    end
+  end
+end

data/app/models/spree/promotion/actions/create_line_items.rb

@@ -47,9 +47,9 @@ module Spree
             current_quantity = order.quantity_of(item.variant)
             next unless current_quantity < item.quantity && item_available?(item)
 
-            line_item = Spree::Dependencies.cart_add_item_service.constantize.call(order: order,
-                                                                                   variant: item.variant,
-                                                                                   quantity: item.quantity - current_quantity).value
+            line_item = Spree.cart_add_item_service.call(order: order,
+                                                         variant: item.variant,
+                                                         quantity: item.quantity - current_quantity).value
             action_taken = true if line_item.try(:valid?)
           end
           action_taken
@@ -68,9 +68,9 @@ module Spree
             line_item = order.find_line_item_by_variant(item.variant)
             next unless line_item.present?
 
-            Spree::Dependencies.cart_remove_item_service.constantize.call(order: order,
-                                                                          variant: item.variant,
-                                                                          quantity: (item.quantity || 1))
+            Spree.cart_remove_item_service.call(order: order,
+                                                variant: item.variant,
+                                                quantity: (item.quantity || 1))
             action_taken = true
           end
 

data/app/models/spree/promotion_handler/coupon.rb

@@ -133,7 +133,7 @@ module Spree
           line_item = order.find_line_item_by_variant(item.variant)
           next if line_item.blank?
 
-          Spree::Dependencies.cart_remove_item_service.constantize.call(order: order, variant: item.variant, quantity: item.quantity)
+          Spree.cart_remove_item_service.call(order: order, variant: item.variant, quantity: item.quantity)
         end
       end
 

data/app/models/spree/shipping_method.rb

@@ -77,7 +77,7 @@ module Spree
 
     # your shipping method subclasses can override this method to provide a custom tracking number service
     def tracking_number_service(tracking)
-      @tracking_number_service ||= Spree::Dependencies.tracking_number_service.constantize.new(tracking)
+      @tracking_number_service ||= Spree.tracking_number_service.new(tracking)
     end
 
     def self.calculators

data/app/models/spree/store.rb

@@ -210,7 +210,7 @@ module Spree
 
     def self.current(url = nil)
       if url.present?
-        Spree::Dependencies.current_store_finder.constantize.new(url: url).execute
+        Spree.current_store_finder.new(url: url).execute
       else
         Spree::Current.store
       end

data/app/models/spree/themes/default.rb

@@ -85,10 +85,13 @@ module Spree
       preference :border_shadow_blur, :integer, default: 5
 
       # PRODUCT IMAGES
-      preference :product_listing_image_height, :integer, default: 300
-      preference :product_listing_image_width, :integer, default: 300
-      preference :product_listing_image_height_mobile, :integer, default: 190
-      preference :product_listing_image_width_mobile, :integer, default: 190
+      # These defaults match preprocessed variant sizes for optimal performance:
+      # Desktop (360x360) → large variant (720x720 at 2x)
+      # Mobile (200x200) → medium variant (400x400 at 2x)
+      preference :product_listing_image_height, :integer, default: 360
+      preference :product_listing_image_width, :integer, default: 360
+      preference :product_listing_image_height_mobile, :integer, default: 200
+      preference :product_listing_image_width_mobile, :integer, default: 200
     end
   end
 end

data/app/presenters/spree/csv/product_variant_presenter.rb

@@ -135,10 +135,7 @@ module Spree
       private
 
       def image_url_options
-        {
-          width: 1000,
-          height: 1000
-        }
+        { variant: :xlarge }
       end
     end
   end

data/app/services/spree/cart/add_item.rb

@@ -6,7 +6,7 @@ module Spree
       def call(order:, variant:, quantity: nil, public_metadata: {}, private_metadata: {}, options: {})
         ApplicationRecord.transaction do
           run :add_to_line_item
-          run Spree::Dependencies.cart_recalculate_service.constantize
+          run Spree.cart_recalculate_service
         end
       end
 
@@ -18,7 +18,7 @@ module Spree
 
         return failure(variant, "#{variant.name} is not available in #{order.currency}") if variant.amount_in(order.currency).nil?
 
-        line_item = Spree::Dependencies.line_item_by_variant_finder.constantize.new.execute(order: order, variant: variant, options: options)
+        line_item = Spree.line_item_by_variant_finder.new.execute(order: order, variant: variant, options: options)
 
         line_item_created = line_item.nil?
         if line_item.nil?

data/app/services/spree/cart/remove_item.rb

@@ -9,9 +9,9 @@ module Spree
 
         ActiveRecord::Base.transaction do
           line_item = remove_from_line_item(order: order, variant: variant, quantity: quantity, options: options)
-          Spree::Dependencies.cart_recalculate_service.constantize.call(line_item: line_item,
-                                                                        order: order,
-                                                                        options: options)
+          Spree.cart_recalculate_service.call(line_item: line_item,
+                                              order: order,
+                                              options: options)
           success(line_item)
         end
       end
@@ -19,7 +19,7 @@ module Spree
       private
 
       def remove_from_line_item(order:, variant:, quantity:, options:)
-        line_item = Spree::Dependencies.line_item_by_variant_finder.constantize.new.execute(order: order, variant: variant, options: options)
+        line_item = Spree.line_item_by_variant_finder.new.execute(order: order, variant: variant, options: options)
 
         raise ActiveRecord::RecordNotFound if line_item.nil?
 

data/app/services/spree/cart/remove_line_item.rb

@@ -7,9 +7,9 @@ module Spree
         options ||= {}
         ActiveRecord::Base.transaction do
           order.line_items.destroy(line_item)
-          Spree::Dependencies.cart_recalculate_service.constantize.new.call(order: order,
-                                                                            line_item: line_item,
-                                                                            options: options)
+          Spree.cart_recalculate_service.new.call(order: order,
+                                                  line_item: line_item,
+                                                  options: options)
         end
         success(line_item)
       end

data/app/services/spree/cart/remove_out_of_stock_items.rb

@@ -49,7 +49,7 @@ module Spree
       end
 
       def cart_remove_line_item_service
-        Spree::Dependencies.cart_remove_line_item_service.constantize
+        Spree.cart_remove_line_item_service
       end
     end
   end

data/app/services/spree/cart/set_quantity.rb

@@ -6,7 +6,7 @@ module Spree
       def call(order:, line_item:, quantity: nil)
         ActiveRecord::Base.transaction do
           run :change_item_quantity
-          run Spree::Dependencies.cart_recalculate_service.constantize
+          run Spree.cart_recalculate_service
         end
       end
 

data/app/services/spree/checkout/advance.rb

@@ -15,7 +15,7 @@ module Spree
         transitions_count = 0
 
         until cannot_make_transition?(order, state)
-          next_result = Spree::Dependencies.checkout_next_service.constantize.call(order: order)
+          next_result = Spree.checkout_next_service.call(order: order)
           return failure(order, order.errors) if next_result.failure? && (transitions_count.zero? || state.present?)
 
           transitions_count +=1

data/app/services/spree/checkout/complete.rb

@@ -4,7 +4,7 @@ module Spree
       prepend Spree::ServiceModule::Base
 
       def call(order:)
-        Spree::Dependencies.checkout_next_service.constantize.call(order: order) until cannot_make_transition?(order)
+        Spree.checkout_next_service.call(order: order) until cannot_make_transition?(order)
 
         if order.reload.complete?
           success(order)

data/app/services/spree/data_feeds/google/rss.rb

@@ -87,19 +87,19 @@ module Spree
         end
 
         def optional_attributes
-          Spree::Dependencies.data_feeds_google_optional_attributes_service.constantize.new
+          Spree.data_feeds_google_optional_attributes_service.new
         end
 
         def required_attributes
-          Spree::Dependencies.data_feeds_google_required_attributes_service.constantize.new
+          Spree.data_feeds_google_required_attributes_service.new
         end
 
         def optional_sub_attributes
-          Spree::Dependencies.data_feeds_google_optional_sub_attributes_service.constantize.new
+          Spree.data_feeds_google_optional_sub_attributes_service.new
         end
 
         def products_list
-          Spree::Dependencies.data_feeds_google_products_list.constantize.new
+          Spree.data_feeds_google_products_list.new
         end
       end
     end

data/app/services/spree/line_items/helper.rb

@@ -4,7 +4,7 @@ module Spree
       protected
 
       def recalculate_service
-        Spree::Dependencies.cart_recalculate_service.constantize
+        Spree.cart_recalculate_service
       end
     end
   end

data/app/services/spree/shipments/helper.rb

@@ -12,11 +12,11 @@ module Spree
       end
 
       def add_item_service
-        Spree::Dependencies.cart_add_item_service.constantize
+        Spree.cart_add_item_service
       end
 
       def remove_item_service
-        Spree::Dependencies.cart_remove_item_service.constantize
+        Spree.cart_remove_item_service
       end
     end
   end

data/config/locales/en.yml

@@ -624,6 +624,7 @@ en:
     add_new_style: Add New Style
     add_one: Add One
     add_option_value: Add Option Value
+    add_page_block: Add Block
     add_product: Add Product
     add_product_properties: Add Product Properties
     add_products: Add Products

data/lib/friendly_id/history_decorator.rb

@@ -0,0 +1,26 @@
+module FriendlyId
+  module HistoryDecorator
+    private
+
+    # This a patch to friendly_id history module.
+    # Originally, it removes and re-creates a slug record if it already exists. The issue is that we use `acts_as_paranoid`
+    # for slugs so it sets the `deleted_at` timestamp instead of deleting the record. We need to delete the record instead.
+    def create_slug
+      return unless friendly_id
+      return if history_is_up_to_date?
+      # Allow reversion back to a previously used slug
+      relation = slugs.where(slug: friendly_id)
+      if friendly_id_config.uses?(:scoped)
+        relation = relation.where(scope: serialized_scope)
+      end
+      # Use `delete_all` instead of `destroy_all` to avoid the unique index error.
+      relation.delete_all unless relation.empty?
+      slugs.create! do |record|
+        record.slug = friendly_id
+        record.scope = serialized_scope if friendly_id_config.uses?(:scoped)
+      end
+    end
+  end
+end
+
+FriendlyId::History.prepend(FriendlyId::HistoryDecorator)

data/lib/generators/spree/install/templates/config/initializers/spree.rb

@@ -95,6 +95,31 @@ Rails.application.config.after_initialize do
 
   # Admin partials
   # Spree.admin.partials.product_form << 'spree/admin/products/custom_section'
+
+  # Role-based permissions
+  # Configure which permission sets are assigned to each role
+  # More on permission sets: https://spreecommerce.org/docs/developer/customization/permissions
+  Spree.permissions.assign(:default, [Spree::PermissionSets::DefaultCustomer])
+  Spree.permissions.assign(:admin, [Spree::PermissionSets::SuperUser])
+
+  # Example: Create a custom role with specific permissions
+  # Spree.permissions.assign(:customer_service, [
+  #   Spree::PermissionSets::DashboardDisplay,
+  #   Spree::PermissionSets::OrderManagement,
+  #   Spree::PermissionSets::UserDisplay
+  # ])
+  #
+  # Available permission sets:
+  # - Spree::PermissionSets::SuperUser (full admin access)
+  # - Spree::PermissionSets::DefaultCustomer (storefront access)
+  # - Spree::PermissionSets::DashboardDisplay (view admin dashboard)
+  # - Spree::PermissionSets::OrderDisplay / OrderManagement
+  # - Spree::PermissionSets::ProductDisplay / ProductManagement
+  # - Spree::PermissionSets::UserDisplay / UserManagement
+  # - Spree::PermissionSets::StockDisplay / StockManagement
+  # - Spree::PermissionSets::PromotionManagement
+  # - Spree::PermissionSets::ConfigurationManagement
+  # - Spree::PermissionSets::RoleManagement
 end
 
 Spree.user_class = <%= (options[:user_class].blank? ? 'Spree::LegacyUser' : options[:user_class]).inspect %>