spree_core 5.4.0.beta4 → 5.4.0.beta6

data/app/models/spree/taxon.rb

@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 require 'stringex'
 
 module Spree
   class Taxon < Spree.base_class
-    has_prefix_id :txn  # Spree-specific: taxon
+    has_prefix_id :ctg
 
     RULES_MATCH_POLICIES = %w[all any].freeze
     SORT_ORDERS = [
@@ -54,9 +56,9 @@ module Spree
     #
     # Validations
     #
-    validates :name, presence: true, uniqueness: { scope: [:parent_id, :taxonomy_id], case_sensitive: false }
+    validates :name, presence: true, uniqueness: { scope: %i[parent_id taxonomy_id], case_sensitive: false }
     validates :taxonomy, presence: true
-    validates :permalink, uniqueness: { case_sensitive: false, scope: [:parent_id, :taxonomy_id] }
+    validates :permalink, uniqueness: { case_sensitive: false, scope: %i[parent_id taxonomy_id] }
     validates :hide_from_nav, inclusion: { in: [true, false] }
     validate :check_for_root, on: :create
     validate :parent_belongs_to_same_taxonomy
@@ -88,9 +90,9 @@ module Spree
     scope :for_stores, ->(stores) { joins(:taxonomy).where(spree_taxonomies: { store_id: stores.ids }) }
     scope :for_taxonomy, lambda { |taxonomy_name|
       if Spree.use_translations?
-        joins(:taxonomy).
-          join_translation_table(Taxonomy).
-          where(
+        joins(:taxonomy)
+          .join_translation_table(Taxonomy)
+          .where(
             Taxonomy.arel_table_alias[:name].lower.matches(taxonomy_name.downcase.strip)
           )
       else
@@ -110,7 +112,7 @@ module Spree
       end
     end
 
-    scope :with_matching_name, ->(name_to_match) do
+    scope :with_matching_name, lambda { |name_to_match|
       value = name_to_match.to_s.strip.downcase
 
       if Spree.use_translations?
@@ -118,13 +120,14 @@ module Spree
       else
         where(arel_table[:name].lower.eq(value))
       end
-    end
+    }
 
     #
     #  Ransack
     #
-    self.whitelisted_ransackable_associations = %w[taxonomy]
-    self.whitelisted_ransackable_attributes = %w[name permalink automatic]
+    self.whitelisted_ransackable_associations = %w[taxonomy parent]
+    self.whitelisted_ransackable_attributes = %w[name permalink automatic depth is_root children_count
+                                                 classification_count hide_from_nav parent_id]
 
     #
     # Translations
@@ -142,7 +145,9 @@ module Spree
     validates :sort_order, inclusion: { in: SORT_ORDERS }, presence: true
 
     has_many :taxon_rules, class_name: 'Spree::TaxonRule', dependent: :destroy
-    accepts_nested_attributes_for :taxon_rules, allow_destroy: true, reject_if: proc { |attributes| attributes['value'].blank? }
+    accepts_nested_attributes_for :taxon_rules, allow_destroy: true, reject_if: proc { |attributes|
+      attributes['value'].blank?
+    }
     alias rules taxon_rules
 
     scope :manual, -> { where.not(automatic: true) }
@@ -160,14 +165,14 @@ module Spree
     end
 
     def active_products_with_descendants
-      @active_products_with_descendants ||= store.products.
-                                            joins(:classifications).
-                                            active.
-                                            where(
-                                              Spree::Classification.table_name => {
-                                                taxon_id: descendants.ids + [id]
-                                              }
-                                            )
+      @active_products_with_descendants ||= store.products
+                                                 .joins(:classifications)
+                                                 .active
+                                                 .where(
+                                                   Spree::Classification.table_name => {
+                                                     taxon_id: descendants.ids + [id]
+                                                   }
+                                                 )
     end
 
     def products_matching_rules(opts = {})
@@ -209,10 +214,10 @@ module Spree
     # so we can later use them for product filtering and so on
     # if we want to fire the service once during object lifecycle - pass only_once: true
     def regenerate_taxon_products(only_once: false)
-      if marked_for_regenerate_taxon_products?
-        Spree::Taxons::RegenerateProducts.call(taxon: self)
-        self.marked_for_regenerate_taxon_products = false if !frozen? && only_once
-      end
+      return unless marked_for_regenerate_taxon_products?
+
+      Spree::Taxons::RegenerateProducts.call(taxon: self)
+      self.marked_for_regenerate_taxon_products = false if !frozen? && only_once
     end
 
     def slug
@@ -283,7 +288,8 @@ module Spree
       end
 
       def generate_permalink_including_parent
-        [parent_permalink_with_fallback, (permalink.blank? ? name_with_fallback.to_url : permalink.split('/').last.to_url)].join('/')
+        [parent_permalink_with_fallback,
+         (permalink.blank? ? name_with_fallback.to_url : permalink.split('/').last.to_url)].join('/')
       end
 
       def generate_pretty_name_including_parent
@@ -384,11 +390,10 @@ module Spree
     end
 
     def sync_taxonomy_name
-      if saved_changes.key?(:name) && root?
-        return if taxonomy.name.to_s == name.to_s
+      return unless saved_changes.key?(:name) && root?
+      return if taxonomy.name.to_s == name.to_s
 
-        taxonomy.update(name: name)
-      end
+      taxonomy.update(name: name)
     end
 
     def touch_ancestors_and_taxonomy
@@ -399,15 +404,15 @@ module Spree
     end
 
     def check_for_root
-      if taxonomy.try(:root).present? && parent_id.nil?
-        errors.add(:root_conflict, 'this taxonomy already has a root taxon')
-      end
+      return unless taxonomy.try(:root).present? && parent_id.nil?
+
+      errors.add(:root_conflict, 'this taxonomy already has a root taxon')
     end
 
     def parent_belongs_to_same_taxonomy
-      if parent.present? && parent.taxonomy_id != taxonomy_id
-        errors.add(:parent, 'must belong to the same taxonomy')
-      end
+      return unless parent.present? && parent.taxonomy_id != taxonomy_id
+
+      errors.add(:parent, 'must belong to the same taxonomy')
     end
 
     def copy_taxonomy_from_parent

data/app/models/spree/webhook_endpoint.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require 'ssrf_filter'
+require 'resolv'
+
 module Spree
   class WebhookEndpoint < Spree.base_class
     has_prefix_id :whe  # Stripe: we_
@@ -8,12 +11,15 @@ module Spree
 
     include Spree::SingleStoreResource
 
+    encrypts :secret_key, deterministic: true if Rails.configuration.active_record.encryption.include?(:primary_key)
+
     belongs_to :store, class_name: 'Spree::Store'
     has_many :webhook_deliveries, class_name: 'Spree::WebhookDelivery', dependent: :destroy_async
 
     validates :store, :url, presence: true
     validates :url, format: { with: URI::DEFAULT_PARSER.make_regexp(%w[http https]), message: :invalid_url }
     validates :active, inclusion: { in: [true, false] }
+    validate :url_must_not_resolve_to_private_ip, if: -> { url.present? && url_changed? }
 
     before_create :generate_secret_key
 
@@ -51,5 +57,16 @@ module Spree
     def generate_secret_key
       self.secret_key ||= SecureRandom.hex(32)
     end
+
+    def url_must_not_resolve_to_private_ip
+      uri = URI.parse(url)
+      blacklist = SsrfFilter::IPV4_BLACKLIST + SsrfFilter::IPV6_BLACKLIST
+      addresses = Resolv.getaddresses(uri.host)
+      if addresses.any? { |addr| blacklist.any? { |range| range.include?(IPAddr.new(addr)) } }
+        errors.add(:url, :internal_address_not_allowed)
+      end
+    rescue URI::InvalidURIError, Resolv::ResolvError, IPAddr::InvalidAddressError, ArgumentError
+      # URI format validation handles invalid URLs; DNS failures are not SSRF
+    end
   end
 end

data/app/services/spree/cart/create.rb

@@ -10,9 +10,11 @@ module Spree
       # @param public_metadata [Hash] public metadata for the order
       # @param private_metadata [Hash] private metadata for the order
       # @param order_params [Hash] additional order attributes
+      # @param line_items [Array<Hash>] line items to add, each with :variant_id (prefixed) and :quantity
       # @return [Spree::ServiceModule::Result]
-      def call(user:, store:, currency:, locale: nil, metadata: {}, public_metadata: {}, private_metadata: {}, order_params: {})
+      def call(user:, store:, currency:, locale: nil, metadata: {}, public_metadata: {}, private_metadata: {}, order_params: {}, line_items: [])
         order_params ||= {}
+        line_items ||= []
 
         # we cannot create an order without store
         return failure(:store_is_required) if store.nil?
@@ -28,8 +30,22 @@ module Spree
           private_metadata: resolved_metadata.to_h
         }
 
-        order = store.orders.create!(default_params.merge(order_params))
+        order = nil
+
+        ApplicationRecord.transaction do
+          order = store.orders.create!(default_params.merge(order_params))
+
+          if line_items.present?
+            result = Spree.cart_upsert_items_service.call(order: order, line_items: line_items)
+            raise StandardError, result.error.to_s if result.failure?
+          end
+        end
+
         success(order)
+      rescue ActiveRecord::RecordNotFound
+        raise
+      rescue StandardError => e
+        failure(order, e.message)
       end
     end
   end

data/app/services/spree/cart/upsert_items.rb

@@ -0,0 +1,80 @@
+module Spree
+  module Cart
+    # Bulk upsert line items on an order.
+    #
+    # For each entry in +line_items+:
+    # - If a line item for the variant already exists → sets its quantity
+    # - If no line item exists → creates one with the given quantity
+    #
+    # After all items are processed the order is recalculated once.
+    #
+    # Price calculation and tax adjustments are handled by LineItem model callbacks
+    # (copy_price, update_adjustments, update_tax_charge), so we only need to
+    # save each item and run a single order recalculation at the end.
+    #
+    # @example
+    #   Spree::Cart::UpsertItems.call(
+    #     order: order,
+    #     line_items: [
+    #       { variant_id: "variant_k5nR8xLq", quantity: 2 },
+    #       { variant_id: "variant_m3Rp9wXz", quantity: 1 }
+    #     ]
+    #   )
+    #
+    class UpsertItems
+      prepend Spree::ServiceModule::Base
+
+      def call(order:, line_items:)
+        line_items = Array(line_items)
+        return success(order) if line_items.empty?
+
+        store = order.store || Spree::Current.store
+
+        ApplicationRecord.transaction do
+          line_items.each do |item_params|
+            item_params = item_params.to_h.deep_symbolize_keys
+            variant = resolve_variant(store, item_params[:variant_id])
+            next unless variant
+
+            quantity = (item_params[:quantity] || 1).to_i
+
+            return failure(variant, "#{variant.name} is not available in #{order.currency}") if variant.amount_in(order.currency).nil?
+
+            line_item = Spree.line_item_by_variant_finder.new.execute(order: order, variant: variant)
+
+            if line_item
+              line_item.quantity = quantity
+              line_item.metadata = line_item.metadata.merge(item_params[:metadata].to_h) if item_params[:metadata].present?
+            else
+              line_item = order.line_items.new(quantity: quantity, variant: variant, options: { currency: order.currency })
+              line_item.metadata = item_params[:metadata].to_h if item_params[:metadata].present?
+            end
+
+            return failure(line_item) unless line_item.save
+          end
+
+          order.update_with_updater!
+        end
+
+        success(order)
+      end
+
+      private
+
+      def resolve_variant(store, prefixed_id)
+        return nil if prefixed_id.blank?
+
+        variant = store.variants.find_by_prefix_id(prefixed_id)
+
+        raise ActiveRecord::RecordNotFound.new(
+          "Variant '#{prefixed_id}' not found in this store",
+          'Spree::Variant',
+          'prefix_id',
+          prefixed_id
+        ) unless variant
+
+        variant
+      end
+    end
+  end
+end

data/app/services/spree/gift_cards/apply.rb

@@ -25,15 +25,16 @@ module Spree
           return failure(:gift_card_mismatched_customer) if gift_card.user != order.user
         end
 
-        amount = [gift_card.amount_remaining, order.total].min
         store = order.store
 
-        return failure(:gift_card_no_amount_remaining) unless amount.positive? || order.total.zero?
-
         payment_method = ensure_store_credit_payment_method!(store)
 
-        gift_card.lock!
         order.with_lock do
+          gift_card.lock!
+          amount = [gift_card.amount_remaining, order.total].min
+
+          return failure(:gift_card_no_amount_remaining) unless amount.positive? || order.total.zero?
+
           store_credit = gift_card.store_credits.create!(
             store: store,
             user: order.user,

data/app/services/spree/orders/update.rb

@@ -0,0 +1,121 @@
+module Spree
+  module Orders
+    # Core order update service with modern conventions:
+    # - Flat parameter structure (no wrapping in "order" key)
+    # - snake_case field names without "_attributes" suffix
+    # - Automatic state management based on what's being updated
+    # - Support for line_items with prefixed variant IDs
+    #
+    # @example Update order with line items
+    #   Spree::Orders::Update.call(
+    #     order: order,
+    #     params: {
+    #       email: "customer@example.com",
+    #       line_items: [
+    #         { variant_id: "variant_123", quantity: 2 },
+    #         { variant_id: "variant_456", quantity: 1 }
+    #       ],
+    #       ship_address: {
+    #         firstname: "John",
+    #         lastname: "Doe",
+    #         address1: "123 Main St",
+    #         city: "New York",
+    #         zipcode: "10001",
+    #         country_iso: "US",
+    #         state_abbr: "NY"
+    #       }
+    #     }
+    #   )
+    #
+    class Update
+      prepend Spree::ServiceModule::Base
+
+      def call(order:, params:)
+        @order = order
+        @params = params.to_h.deep_symbolize_keys
+
+        ApplicationRecord.transaction do
+          assign_order_attributes
+          assign_address(:ship_address)
+          assign_address(:bill_address)
+
+          order.save!
+
+          process_line_items
+        end
+
+        success(order.reload)
+      rescue ActiveRecord::RecordNotFound
+        raise
+      rescue ActiveRecord::RecordInvalid => e
+        failure(order, e.record.errors.full_messages.to_sentence)
+      rescue StandardError => e
+        failure(order, e.message)
+      end
+
+      private
+
+      attr_reader :order, :params
+
+      def assign_order_attributes
+        order.email = params[:email] if params[:email].present?
+        order.special_instructions = params[:special_instructions] if params.key?(:special_instructions)
+        order.currency = params[:currency].upcase if params[:currency].present?
+        order.locale = params[:locale] if params[:locale].present?
+        order.metadata = order.metadata.merge(params[:metadata].to_h) if params[:metadata].present?
+      end
+
+      def assign_address(address_type)
+        address_id_param = params[:"#{address_type}_id"]
+        address_params = params[address_type]
+
+        # Priority 1: Direct address ID reference (ship_address_id / bill_address_id)
+        if address_id_param.present?
+          address_id = resolve_address_id(address_id_param)
+          order.public_send(:"#{address_type}_id=", address_id) if address_id
+          return
+        end
+
+        # Priority 2: Nested address params (ship_address / bill_address)
+        return unless address_params.is_a?(Hash)
+
+        if address_params[:id].present?
+          # Using existing address by ID within nested params
+          address_id = resolve_address_id(address_params[:id])
+          order.public_send(:"#{address_type}_id=", address_id) if address_id
+        else
+          # Creating/updating address with provided attributes
+          revert_to_address_state if order.has_checkout_step?('address')
+          order.public_send(:"#{address_type}_attributes=", address_params)
+        end
+      end
+
+      def process_line_items
+        return unless params[:line_items].is_a?(Array)
+
+        result = Spree.cart_upsert_items_service.call(
+          order: order,
+          line_items: params[:line_items]
+        )
+
+        raise StandardError, result.error.to_s if result.failure?
+      end
+
+      # Translate prefixed ID to internal id
+      def resolve_address_id(prefixed_id)
+        return unless order.user
+
+        decoded = Spree::Address.decode_prefixed_id(prefixed_id)
+        decoded ? order.user.addresses.find_by(id: decoded)&.id : nil
+      end
+
+      # Revert order state to 'address' when address changes
+      # This ensures shipments are recreated when transitioning back to delivery
+      def revert_to_address_state
+        return if ['cart', 'address'].include?(order.state)
+
+        order.state = 'address'
+      end
+    end
+  end
+end

data/app/services/spree/products/prepare_nested_attributes.rb

@@ -17,11 +17,14 @@ module Spree
     #   prepared_params = service.call
     #
     class PrepareNestedAttributes
+      attr_reader :variants_to_discontinue
+
       def initialize(product, store, params, ability)
         @product = product
         @store = store
         @params = params
         @ability = ability
+        @variants_to_discontinue = []
       end
 
       def call
@@ -75,7 +78,8 @@ module Spree
           params[:option_type_ids] = []
           params[:variants_attributes] = {}
 
-          variants_to_remove.each_with_index do |variant_id, index|
+          populate_variants_to_discontinue
+          variant_ids_to_destroy.each_with_index do |variant_id, index|
             params[:variants_attributes][index.to_s] = { id: variant_id, _destroy: '1' }
           end
 
@@ -122,15 +126,37 @@ module Spree
       def removed_variants_attributes
         return {} unless can_remove_variants?
 
+        populate_variants_to_discontinue
+
         attributes = {}
         last_index = params[:variants_attributes].keys.map(&:to_i).max
-        variants_to_remove.each_with_index do |variant_id, index|
-          attributes[(index + last_index + 1).to_s] = { id: variant_id, _destroy: '1' }
+        variant_ids_to_destroy.each_with_index do |variant_id, index|
+          attributes[(last_index + 1 + index).to_s] = { id: variant_id, _destroy: '1' }
         end
 
         attributes
       end
 
+      def populate_variants_to_discontinue
+        ids = variants_to_remove.select { |vid| variant_ids_with_completed_orders.include?(vid) }
+        @variants_to_discontinue = product.variants.where(id: ids).to_a if ids.any?
+      end
+
+      def variant_ids_to_destroy
+        variants_to_remove - variant_ids_with_completed_orders
+      end
+
+      def variant_ids_with_completed_orders
+        @variant_ids_with_completed_orders ||=
+          product.variants
+                 .joins(:orders)
+                 .merge(Spree::Order.complete)
+                 .reorder(nil)
+                 .distinct
+                 .pluck(:id)
+                 .map(&:to_s)
+      end
+
       def removed_product_option_types_attributes
         return {} unless can_manage_option_types?
 

data/config/locales/en.yml

@@ -363,6 +363,10 @@ en:
               cannot_destroy_if_attached_to_line_items: Cannot delete Variants that are added to placed Orders. In such cases, please discontinue them.
               must_supply_price_for_variant_or_master: Must supply price for variant or master price for product.
               no_master_variant_found_to_infer_price: No master variant found to infer price
+        spree/webhook_endpoint:
+          attributes:
+            url:
+              internal_address_not_allowed: must not point to an internal or private network address
         spree/wished_item:
           attributes:
             variant:
@@ -1231,6 +1235,7 @@ en:
       this_file_language: English (US)
       translations: Translations
     icon: Icon
+    idempotency_key_reused: This Idempotency-Key has already been used with different request parameters.
     image: Image
     image_alt_text: Add Alt text to your image
     images: Images

data/lib/spree/core/configuration.rb

@@ -47,6 +47,7 @@ module Spree
       preference :expedited_exchanges_days_window, :integer, default: 14 # the amount of days the customer has to return their item after the expedited exchange is shipped in order to avoid being charged
       preference :geocode_addresses, :boolean, default: true
       preference :images_save_from_url_job_attempts, :integer, default: 5
+      preference :max_image_download_size, :integer, default: 20_971_520 # 20 MB in bytes
 
       # Preprocessed product image variant sizes at 2x retina resolution.
       # These variants are generated on upload to reduce runtime processing.

data/lib/spree/core/controller_helpers/strong_parameters.rb

@@ -39,7 +39,7 @@ module Spree
         end
 
         def permitted_store_attributes
-          permitted_attributes.store_attributes + Spree::Store::SUPPORTED_SOCIAL_NETWORKS.map { |social| "store_#{social}" }
+          permitted_attributes.store_attributes
         end
       end
     end

data/lib/spree/core/dependencies.rb

@@ -16,6 +16,7 @@ module Spree
         cart_remove_item_service: 'Spree::Cart::RemoveItem',
         cart_remove_line_item_service: 'Spree::Cart::RemoveLineItem',
         cart_set_item_quantity_service: 'Spree::Cart::SetQuantity',
+        cart_upsert_items_service: 'Spree::Cart::UpsertItems',
         cart_estimate_shipping_rates_service: 'Spree::Cart::EstimateShippingRates',
         cart_empty_service: 'Spree::Cart::Empty',
         cart_destroy_service: 'Spree::Cart::Destroy',
@@ -41,6 +42,7 @@ module Spree
         # order
         order_approve_service: 'Spree::Orders::Approve',
         order_cancel_service: 'Spree::Orders::Cancel',
+        order_update_service: 'Spree::Orders::Update',
         order_updater: 'Spree::OrderUpdater',
 
         # shipment

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.4.0.beta4'.freeze
+  VERSION = '5.4.0.beta6'.freeze
 
   def self.version
     VERSION

data/lib/spree/permitted_attributes.rb

@@ -266,15 +266,13 @@ module Spree
                           :meta_description, :default_currency, :default_country_iso, :mail_from_address,
                           :customer_support_email, :description, :address, :contact_phone,
                           :supported_locales, :default_locale, :supported_currencies,
-                          :new_order_notifications_email, :seo_robots,
+                          :new_order_notifications_email,
                           :preferred_admin_locale, :preferred_timezone, :preferred_weight_unit, :preferred_unit_system,
                           :preferred_digital_asset_authorized_clicks, :preferred_digital_asset_authorized_days,
                           :preferred_limit_digital_download_count, :preferred_limit_digital_download_days,
                           :preferred_digital_asset_link_expire_time,
-                          :logo, :mailer_logo, :social_logo, :favicon_image,
-                          :checkout_message, :preferred_guest_checkout,
-                          :customer_terms_of_service, :customer_privacy_policy,
-                          :customer_returns_policy, :customer_shipping_policy]
+                          :logo, :mailer_logo,
+                          :preferred_guest_checkout]
 
     @@store_credit_attributes = %i[amount currency category_id memo]
 

data/lib/spree/testing_support/factories/store_factory.rb

@@ -14,14 +14,5 @@ FactoryBot.define do
     instagram              { 'spreecommerce' }
     meta_description       { 'Sample store description.' }
 
-    trait :with_favicon do
-      after(:build) do |store|
-        store.favicon_image.attach(
-          io: File.open(Spree::Core::Engine.root.join('spec', 'fixtures', 'thinking-cat.jpg')),
-          filename: 'thinking-cat.jpg',
-          content_type: 'image/jpeg'
-        )
-      end
-    end
   end
 end

data/lib/tasks/core.rake

@@ -8,34 +8,6 @@ namespace :db do
     end
   end
 
-  desc 'Migrate policies to store policies'
-  task migrate_policies: :environment do |_t, _args|
-    # Helper to consistently derive policy name
-    derive_policy_name = lambda do |name_str|
-      name_str.to_s.gsub(/customer_/, '').gsub(/_policy$/, '')
-    end
-
-    # Check if migration has already been run
-    if Spree::Policy.any?
-      puts "Policies already exist. Skipping migration to prevent duplicates."
-      exit
-    end
-
-    Spree::Store.all.each do |store|
-      %w[customer_terms_of_service customer_privacy_policy customer_returns_policy customer_shipping_policy].each do |policy_slug|
-        policy = store.send(policy_slug)
-        next unless policy.present?
-
-        store.policies.create(
-          name: Spree.t(derive_policy_name.call(policy_slug)),
-          body: policy.body
-        )
-
-        puts "Migrated #{policy_slug} to store #{store.id}"
-      end
-    end
-  end
-
 end
 
 namespace :core do