spree_core 5.3.6 → 5.4.0.beta

data/app/models/spree/variant.rb

@@ -1,5 +1,7 @@
 module Spree
   class Variant < Spree.base_class
+    has_prefix_id :variant
+
     acts_as_paranoid
     acts_as_list scope: :product
 
@@ -47,6 +49,7 @@ module Spree
     has_many :option_values, through: :option_value_variants, dependent: :destroy, class_name: 'Spree::OptionValue'
 
     has_many :images, -> { order(:position) }, as: :viewable, dependent: :destroy, class_name: 'Spree::Image'
+    belongs_to :thumbnail, class_name: 'Spree::Image', optional: true
 
     has_many :prices,
              class_name: 'Spree::Price',
@@ -275,7 +278,7 @@ module Spree
     # Returns the descriptive name of the variant.
     # @return [String] the descriptive name of the variant
     def descriptive_name
-      is_master? ? "#{name} - Master" : "#{name} - #{options_text}"
+      is_master? ? name + ' - Master' : name + ' - ' + options_text
     end
 
     # use deleted? rather than checking the attribute directly. this
@@ -295,10 +298,17 @@ module Spree
       image_count.positive?
     end
 
-    # Returns default Image for Variant, falling back to product's default image.
+    # Returns default Image for Variant.
     # @return [Spree::Image, nil]
     def default_image
-      @default_image ||= has_images? ? images.first : product.default_image
+      thumbnail
+    end
+
+    # Updates the thumbnail_id to the first image by position.
+    # Called when images are added, removed, or reordered.
+    def update_thumbnail!
+      first_image = images.order(:position).first
+      update_column(:thumbnail_id, first_image&.id)
     end
 
     # Returns first Image for Variant.

data/app/models/spree/webhook_delivery.rb

@@ -2,6 +2,8 @@
 
 module Spree
   class WebhookDelivery < Spree.base_class
+    has_prefix_id :whd
+
     belongs_to :webhook_endpoint, class_name: 'Spree::WebhookEndpoint'
     delegate :url, to: :webhook_endpoint
 

data/app/models/spree/webhook_endpoint.rb

@@ -1,23 +1,19 @@
 # frozen_string_literal: true
 
-require 'ssrf_filter'
-require 'resolv'
-
 module Spree
   class WebhookEndpoint < Spree.base_class
+    has_prefix_id :whe  # Stripe: we_
+
     acts_as_paranoid
 
     include Spree::SingleStoreResource
 
-    encrypts :secret_key, deterministic: true if Rails.configuration.active_record.encryption.include?(:primary_key)
-
     belongs_to :store, class_name: 'Spree::Store'
     has_many :webhook_deliveries, class_name: 'Spree::WebhookDelivery', dependent: :destroy_async
 
     validates :store, :url, presence: true
     validates :url, format: { with: URI::DEFAULT_PARSER.make_regexp(%w[http https]), message: :invalid_url }
     validates :active, inclusion: { in: [true, false] }
-    validate :url_must_not_resolve_to_private_ip, if: -> { url.present? && url_changed? }
 
     before_create :generate_secret_key
 
@@ -55,16 +51,5 @@ module Spree
     def generate_secret_key
       self.secret_key ||= SecureRandom.hex(32)
     end
-
-    def url_must_not_resolve_to_private_ip
-      uri = URI.parse(url)
-      blacklist = SsrfFilter::IPV4_BLACKLIST + SsrfFilter::IPV6_BLACKLIST
-      addresses = Resolv.getaddresses(uri.host)
-      if addresses.any? { |addr| blacklist.any? { |range| range.include?(IPAddr.new(addr)) } }
-        errors.add(:url, :internal_address_not_allowed)
-      end
-    rescue URI::InvalidURIError, Resolv::ResolvError, IPAddr::InvalidAddressError, ArgumentError
-      # URI format validation handles invalid URLs; DNS failures are not SSRF
-    end
   end
 end

data/app/models/spree/wished_item.rb

@@ -1,5 +1,7 @@
 module Spree
   class WishedItem < Spree.base_class
+    has_prefix_id :wi  # Spree-specific: wished item
+
     extend DisplayMoney
     money_methods :total, :price
 
@@ -14,6 +16,19 @@ module Spree
     validates :variant, uniqueness: { scope: [:wishlist] }
     validates :quantity, numericality: { only_integer: true, greater_than: 0 }
 
+    # This is a workaround to allow the variant_id to be set with a prefixed ID
+    # in the API.
+    #
+    # @param id [String] the prefixed ID of the variant
+    def variant_id=(id)
+      if id.to_s.include?('_')
+        decoded = Spree::Variant.decode_prefixed_id(id)
+        super(decoded)
+      else
+        super(id)
+      end
+    end
+
     def price(currency)
       variant.amount_in(currency[:currency])
     end

data/app/models/spree/wishlist.rb

@@ -1,5 +1,7 @@
 module Spree
   class Wishlist < Spree.base_class
+    has_prefix_id :wl  # Spree-specific: wishlist
+
     include Spree::SingleStoreResource
 
     publishes_lifecycle_events
@@ -24,10 +26,6 @@ module Spree
       wished_items.exists?(variant_id: variant_id)
     end
 
-    def to_param
-      token
-    end
-
     # returns the number of wished items in the wishlist
     #
     # @return [Integer]
@@ -42,10 +40,6 @@ module Spree
       @variant_ids ||= wished_items.pluck(:variant_id)
     end
 
-    def self.get_by_param(param)
-      find_by(token: param)
-    end
-
     private
 
     def ensure_default_exists_and_is_unique

data/app/models/spree/zone.rb

@@ -1,5 +1,7 @@
 module Spree
   class Zone < Spree.base_class
+    has_prefix_id :zone
+
     include Spree::UniqueName
 
     with_options dependent: :destroy, inverse_of: :zone do
@@ -18,7 +20,6 @@ module Spree
 
     after_save :remove_defunct_members
     after_save :remove_previous_default, if: %i[default_tax? saved_change_to_default_tax?]
-    before_destroy :nullify_checkout_zone
 
     alias members zone_members
     accepts_nested_attributes_for :zone_members, allow_destroy: true, reject_if: proc { |a| a['zoneable_id'].blank? }
@@ -198,10 +199,5 @@ module Spree
       end
     end
 
-    def nullify_checkout_zone
-      if id == Spree::Store.current.checkout_zone_id
-        Spree::Store.current.update(checkout_zone_id: nil)
-      end
-    end
   end
 end

data/app/presenters/spree/filters/price_presenter.rb

@@ -2,6 +2,7 @@ module Spree
   module Filters
     class PricePresenter
       def initialize(amount:, currency:)
+        Spree::Deprecation.warn('Spree::Filters::PricePresenter is deprecated and will be removed in Spree 5.5.')
         @amount = amount.to_i
         @currency = currency
       end

data/app/presenters/spree/filters/price_range_presenter.rb

@@ -11,6 +11,7 @@ module Spree
       end
 
       def initialize(min_price:, max_price:)
+        Spree::Deprecation.warn('Spree::Filters::PriceRangePresenter is deprecated and will be removed in Spree 5.5.')
         @min_price = min_price
         @max_price = max_price
       end

data/app/presenters/spree/filters/quantified_price_range_presenter.rb

@@ -7,6 +7,7 @@ module Spree
       ].freeze
 
       def initialize(price:, quantifier:)
+        Spree::Deprecation.warn('Spree::Filters::QuantifiedPriceRangePresenter is deprecated and will be removed in Spree 5.5.')
         if ALLOWED_QUANTIFIERS.exclude?(quantifier.to_sym)
           raise ArgumentError, "quantifier must be one of: #{ALLOWED_QUANTIFIERS.join(', ')}"
         end

data/app/presenters/spree/product_summary_presenter.rb

@@ -3,6 +3,7 @@ module Spree
     include Rails.application.routes.url_helpers
 
     def initialize(product)
+      Spree::Deprecation.warn('Spree::ProductSummaryPresenter is deprecated and will be removed in Spree 5.5.')
       @product = product
     end
 

data/app/services/spree/addresses/helper.rb

@@ -21,13 +21,32 @@ module Spree
       end
 
       def fill_state_id(params)
-        state_name = params[:state_name]
-        return params unless state_name.present?
+        # Always extract state_abbr - it's not a model attribute
+        state_abbr = params.delete(:state_abbr)
 
         country ||= Spree::Country.find(params[:country_id]) if params[:country_id].present?
         return params unless country
 
-        params[:state_id] = country.states.find_by(name: state_name)&.id
+        # Support state_abbr (state abbreviation code, e.g., "CA", "NY")
+        if state_abbr.present?
+          params[:state_id] = country.states.find_by(abbr: state_abbr)&.id
+          return params
+        end
+
+        # Support state_name - try to find matching state
+        if params[:state_name].present?
+          state = country.states.find_by(name: params[:state_name])
+          if state
+            # Found a matching state, use state_id
+            params[:state_id] = state.id
+            params.delete(:state_name)
+          elsif country.states_required?
+            # States required but not found - clear state_name so validation fails
+            params.delete(:state_name)
+          end
+          # If states not required and no match found, keep state_name as-is
+        end
+
         params
       end
 

data/app/services/spree/cart/associate.rb

@@ -3,13 +3,26 @@ module Spree
     class Associate
       prepend Spree::ServiceModule::Base
 
-      def call(guest_order:, user:)
-        if guest_order.user.nil?
-          guest_order.associate_user!(user)
-          success(guest_order)
-        else
-          failure(guest_order, 'Already assigned to a user')
+      def call(guest_order:, user:, override_email: true, guest_only: false)
+        return failure(guest_order, 'Already assigned to a user') if guest_only && guest_order.user.present? && guest_order.user != user
+
+        guest_order.user           = user
+        guest_order.email          = user.email if override_email
+        guest_order.bill_address ||= user.bill_address
+        guest_order.ship_address ||= user.ship_address
+
+        changes = guest_order.slice(*Spree::Order::ASSOCIATED_USER_ATTRIBUTES)
+
+        # immediately persist the changes we just made, but don't use save
+        # since we might have an invalid address associated
+        ActiveRecord::Base.connected_to(role: :writing) do
+          Spree::Order.unscoped.where(id: guest_order.id).update_all(changes)
         end
+
+        # Manually publish update event since update_all bypasses callbacks
+        guest_order.publish_event('order.updated') if changes.present?
+
+        success(guest_order)
       end
     end
   end

data/app/services/spree/checkout/select_shipping_method.rb

@@ -1,9 +1,18 @@
 module Spree
   module Checkout
+    # @deprecated This service is deprecated and will be removed in Spree 6.0.
+    #   Order totals are now automatically updated via a callback on ShippingRate
+    #   when selected_shipping_rate_id is set on a Shipment.
     class SelectShippingMethod
       prepend Spree::ServiceModule::Base
 
       def call(order:, params:)
+        Spree::Deprecation.warn(
+          "#{self.class.name} is deprecated and will be removed in Spree 6.0. " \
+          "Order totals are now automatically updated via ShippingRate callback when " \
+          "selected_shipping_rate_id is set on a Shipment.",
+          caller_locations(2)
+        )
         if params[:shipment_id].present?
           shipment = order.shipments.valid.find_by(id: params[:shipment_id])
           return failure(:shipment_not_found) if shipment.nil?
@@ -26,6 +35,9 @@ module Spree
           end
         end
 
+        # Note: selected_shipping_rate_id= now automatically updates order totals,
+        # but we still need update_with_updater! here because Checkout::Advance
+        # expects the full updater to run (including state updates) when this service succeeds.
         order.update_with_updater!
 
         success(order)
@@ -41,8 +53,8 @@ module Spree
           )
         end
 
+        # selected_shipping_rate_id= now automatically calls update_amounts and updates order totals
         shipment.selected_shipping_rate_id = selected_shipping_rate.id
-        shipment.update_amounts
 
         success(shipment)
       end

data/app/services/spree/classifications/reposition.rb

@@ -1,9 +1,14 @@
 module Spree
   module Classifications
+    # @deprecated This service is deprecated and will be removed in Spree 5.5.
     class Reposition
       prepend Spree::ServiceModule::Base
 
       def call(classification:, position:)
+        Spree::Deprecation.warn(
+          "#{self.class.name} is deprecated and will be removed in Spree 5.5.",
+          caller_locations(2)
+        )
         if position.is_a?(String) && !position.match(/^\d+$/)
           return failure(nil, I18n.t('errors.messages.not_a_number'))
         end

data/app/services/spree/data_feeds/google/required_attributes.rb

@@ -41,10 +41,15 @@ module Spree
         end
 
         def get_image_link(variant, product)
-          image = variant.thumbnail || product.thumbnail
-          return if image.nil?
+          # try getting image from variant
+          img = variant.images.first&.plp_url
 
-          Rails.application.routes.url_helpers.cdn_image_url(image.attachment.variant(:xlarge))
+          # if no image specified for variant try getting product image
+          if img.nil?
+            img = product.images.first&.plp_url
+          end
+
+          img
         end
 
         def format_price(variant)

data/app/services/spree/gift_cards/apply.rb

@@ -25,16 +25,15 @@ module Spree
           return failure(:gift_card_mismatched_customer) if gift_card.user != order.user
         end
 
+        amount = [gift_card.amount_remaining, order.total].min
         store = order.store
 
+        return failure(:gift_card_no_amount_remaining) unless amount.positive? || order.total.zero?
+
         payment_method = ensure_store_credit_payment_method!(store)
 
+        gift_card.lock!
         order.with_lock do
-          gift_card.lock!
-          amount = [gift_card.amount_remaining, order.total].min
-
-          return failure(:gift_card_no_amount_remaining) unless amount.positive? || order.total.zero?
-
           store_credit = gift_card.store_credits.create!(
             store: store,
             user: order.user,

data/app/services/spree/imports/row_processors/customer.rb

@@ -0,0 +1,70 @@
+module Spree
+  module Imports
+    module RowProcessors
+      class Customer < Base
+        def process!
+          user = find_or_initialize_user
+          assign_user_attributes(user)
+          assign_address(user) if address_fields_present?
+          user.save!
+          user
+        end
+
+        private
+
+        def find_or_initialize_user
+          email = attributes['email'].to_s.strip.downcase
+          raise ArgumentError, 'Email is required' if email.blank?
+
+          Spree.user_class.find_or_initialize_by(email: email)
+        end
+
+        def assign_user_attributes(user)
+          user.first_name = attributes['first_name'].strip if attributes['first_name'].present?
+          user.last_name = attributes['last_name'].strip if attributes['last_name'].present?
+          user.phone = attributes['phone'].strip if attributes['phone'].present?
+          user.accepts_email_marketing = to_boolean(attributes['accepts_email_marketing']) if attributes['accepts_email_marketing'].present?
+          user.tag_list = attributes['tags'] if attributes['tags'].present?
+
+          if user.new_record?
+            password = SecureRandom.hex(16)
+            user.password = password
+            user.password_confirmation = password
+          end
+        end
+
+        def assign_address(user)
+          address = user.bill_address || user.build_bill_address
+          address.firstname = attributes['first_name'].presence || user.first_name
+          address.lastname = attributes['last_name'].presence || user.last_name
+          address.company = attributes['company'].strip if attributes['company'].present?
+          address.address1 = attributes['address1'].strip if attributes['address1'].present?
+          address.address2 = attributes['address2'].strip if attributes['address2'].present?
+          address.city = attributes['city'].strip if attributes['city'].present?
+          address.zipcode = attributes['zip'].strip if attributes['zip'].present?
+          address.phone = attributes['phone'].presence || user.phone
+
+          if attributes['country_code'].present?
+            address.country = Spree::Country.find_by(iso: attributes['country_code'].strip.upcase)
+          end
+
+          if attributes['province_code'].present? && address.country
+            address.state = address.country.states.find_by(abbr: attributes['province_code'].strip)
+          end
+
+          address.save!
+          user.bill_address = address
+          user.ship_address ||= address
+        end
+
+        def address_fields_present?
+          %w[address1 city country_code].any? { |f| attributes[f].present? }
+        end
+
+        def to_boolean(value)
+          value.to_s.strip.downcase.in?(%w[true yes 1 y])
+        end
+      end
+    end
+  end
+end

data/app/services/spree/orders/approve.rb

@@ -4,11 +4,13 @@ module Spree
       prepend Spree::ServiceModule::Base
 
       def call(order:, approver: nil)
+        changes = { considered_risky: false, approved_at: Time.current }
         if approver.present?
-          order.approved_by(approver)
-        else
-          order.approve!
+          changes[:approver_id] = approver.id
         end
+        order.update_columns(changes)
+
+        order.publish_event('order.approved')
         success(order.reload)
       rescue ActiveRecord::Rollback, ActiveRecord::RecordInvalid, StateMachines::InvalidTransition
         failure(order)

data/app/services/spree/orders/cancel.rb

@@ -3,12 +3,17 @@ module Spree
     class Cancel
       prepend Spree::ServiceModule::Base
 
-      def call(order:, canceler: nil)
-        if canceler.present?
-          order.canceled_by(canceler)
-        else
+      def call(order:, canceler: nil, canceled_at: nil)
+        canceled_at ||= Time.current
+
+        order.transaction do
+          changes = { canceled_at: canceled_at }
+          changes[:canceler_id] = canceler.id if canceler.present?
+          order.update_columns(changes)
           order.cancel!
         end
+
+        order.publish_event('order.canceled')
         success(order.reload)
       rescue ActiveRecord::Rollback, ActiveRecord::RecordInvalid, StateMachines::InvalidTransition
         failure(order)

data/app/services/spree/products/prepare_nested_attributes.rb

@@ -184,7 +184,7 @@ module Spree
         option_value_variant_params = {}
 
         option_value_params.each_with_index do |opt, index|
-          option_type = Spree::OptionType.find_by(id: opt[:id]) if opt.fetch(:id)
+          option_type = Spree::OptionType.find_by_param(opt[:id]) if opt.fetch(:id)
           option_type ||= Spree::OptionType.where(name: opt[:name].parameterize).first_or_initialize do |o|
             o.name = o.presentation = opt[:name]
             o.position = opt[:position]

data/app/services/spree/sample_data/import_runner.rb

@@ -0,0 +1,54 @@
+require 'csv'
+
+module Spree
+  module SampleData
+    class ImportRunner
+      prepend Spree::ServiceModule::Base
+
+      def call(csv_path:, import_class:)
+        store = Spree::Store.default
+        admin = Spree.admin_user_class.first
+
+        raise 'No admin user found. Please run seeds first.' unless admin
+
+        import = import_class.new(
+          owner: store,
+          user: admin
+        )
+        import.number = import.generate_permalink(import_class)
+        import.attachment.attach(
+          io: File.open(csv_path),
+          filename: File.basename(csv_path),
+          content_type: 'text/csv'
+        )
+        import.save!(validate: false)
+        import.update_columns(status: 'processing')
+        import.create_mappings
+
+        row_number = 0
+        failed = 0
+
+        ::CSV.foreach(csv_path, headers: true) do |csv_row|
+          row_number += 1
+          import_row = import.rows.create!(
+            row_number: row_number,
+            data: csv_row.to_h.to_json,
+            status: 'pending'
+          )
+
+          begin
+            import_row.process!
+          rescue StandardError => e
+            failed += 1
+            puts "\n  Warning: Row #{row_number} failed: #{e.message}"
+          end
+
+          print '.' if (row_number % 10).zero?
+        end
+
+        import.update!(status: 'completed')
+        puts "\n  Processed #{row_number} rows (#{failed} failed)"
+      end
+    end
+  end
+end

data/app/services/spree/sample_data/loader.rb

@@ -0,0 +1,78 @@
+module Spree
+  module SampleData
+    class Loader
+      prepend Spree::ServiceModule::Base
+
+      def call
+        Spree::Events.disable do
+          without_geocoding do
+            ensure_seeds_loaded
+
+            puts 'Loading sample configuration data...'
+            load_configuration_data
+
+            puts 'Loading sample metafield definitions...'
+            load_ruby_file('metafield_definitions')
+
+            puts 'Loading sample products...'
+            load_products
+
+            puts 'Loading sample customers...'
+            load_customers
+
+            puts 'Loading sample orders...'
+            load_ruby_file('orders')
+
+            puts 'Loading sample posts...'
+            load_ruby_file('posts')
+
+            puts 'Sample data loaded successfully!'
+          end
+        end
+      end
+
+      private
+
+      def ensure_seeds_loaded
+        us = Spree::Country.find_by(iso: 'US')
+        return if us&.states&.any? && Spree::Store.default&.persisted?
+
+        puts 'Running seeds first...'
+        Spree::Seeds::All.call
+      end
+
+      def sample_data_path
+        @sample_data_path ||= Spree::Core::Engine.root.join('db', 'sample_data')
+      end
+
+      def load_configuration_data
+        load_ruby_file('shipping_methods')
+        load_ruby_file('payment_methods')
+        load_ruby_file('promotions')
+      end
+
+      def load_products
+        csv_path = sample_data_path.join('products.csv')
+        Spree::SampleData::ImportRunner.call(csv_path: csv_path, import_class: Spree::Imports::Products)
+      end
+
+      def load_customers
+        csv_path = sample_data_path.join('customers.csv')
+        Spree::SampleData::ImportRunner.call(csv_path: csv_path, import_class: Spree::Imports::Customers)
+      end
+
+      def load_ruby_file(name)
+        file = sample_data_path.join("#{name}.rb")
+        load file.to_s if file.exist?
+      end
+
+      def without_geocoding
+        previous = Spree::Config[:geocode_addresses]
+        Spree::Config[:geocode_addresses] = false
+        yield
+      ensure
+        Spree::Config[:geocode_addresses] = previous
+      end
+    end
+  end
+end

data/app/services/spree/seeds/admin_user.rb

@@ -14,9 +14,8 @@ module Spree
           )
           user.save!
 
-          Spree::Store.all.each do |store|
-            store.add_user(user)
-          end
+          store = Spree::Store.default
+          store&.add_user(user) if store&.persisted?
         end
       end
     end

data/app/services/spree/seeds/all.rb

@@ -27,6 +27,7 @@ module Spree
 
           # add store resources
           PaymentMethods.call
+          ApiKeys.call
         end
       end
     end