spree_core 5.4.0.beta6 → 5.4.0.beta8

data/app/models/spree/image.rb

@@ -1,82 +1,6 @@
+# Backward compatibility — all logic now lives in Spree::Asset.
+# This class will be removed in Spree 6.0.
 module Spree
   class Image < Asset
-    include Spree::Image::Configuration::ActiveStorage # legacy to be removed in Spree 6
-    include Rails.application.routes.url_helpers
-    include Spree::ImageMethods # legacy, will be removed in Spree 6
-
-    validates :attachment, attached: true, content_type: Rails.application.config.active_storage.web_image_content_types
-
-    after_commit :touch_product_variants, if: :should_touch_product_variants?, on: :update
-    after_commit :update_variant_thumbnail, on: [:create, :destroy]
-    after_commit :update_variant_thumbnail_on_reorder, on: :update, if: :saved_change_to_position?
-    after_commit :update_variant_thumbnail_on_viewable_change, on: :update, if: :saved_change_to_viewable_id?
-
-    after_create :increment_viewable_image_count
-    after_destroy :decrement_viewable_image_count
-
-    # In Rails 5.x class constants are being undefined/redefined during the code reloading process
-    # in a rails development environment, after which the actual ruby objects stored in those class constants
-    # are no longer equal (subclass == self) what causes error ActiveRecord::SubclassNotFound
-    # Invalid single-table inheritance type: Spree::Image is not a subclass of Spree::Image.
-    # The line below prevents the error.
-    self.inheritance_column = nil
-
-    # @deprecated
-    def styles
-      Spree::Deprecation.warn("Image#styles is deprecated and will be removed in Spree 6.0. Please use active storage variants with cdn_image_url")
-
-      self.class.styles.map do |_, size|
-        width, height = size.chop.split('x').map(&:to_i)
-
-        {
-          url: generate_url(size: size),
-          size: size,
-          width: width,
-          height: height
-        }
-      end
-    end
-
-    private
-
-    def touch_product_variants
-      viewable.product.variants.touch_all
-    end
-
-    def should_touch_product_variants?
-      viewable.is_a?(Spree::Variant) &&
-        viewable.is_master? &&
-        viewable.product.has_variants? &&
-        saved_change_to_position?
-    end
-
-    def increment_viewable_image_count
-      return unless viewable.is_a?(Spree::Variant)
-
-      Spree::Variant.increment_counter(:image_count, viewable_id)
-      Spree::Product.increment_counter(:total_image_count, viewable.product_id)
-    end
-
-    def decrement_viewable_image_count
-      return unless viewable.is_a?(Spree::Variant)
-
-      Spree::Variant.decrement_counter(:image_count, viewable_id)
-      Spree::Product.decrement_counter(:total_image_count, viewable.product_id)
-    end
-
-    def update_variant_thumbnail
-      return unless viewable.is_a?(Spree::Variant)
-
-      viewable.update_thumbnail!
-      viewable.product.update_thumbnail!
-    end
-
-    def update_variant_thumbnail_on_reorder
-      update_variant_thumbnail
-    end
-
-    def update_variant_thumbnail_on_viewable_change
-      update_variant_thumbnail
-    end
   end
 end

data/app/models/spree/legacy_user.rb

@@ -12,6 +12,7 @@ module Spree
     attr_accessor :password, :password_confirmation
 
     validates :email, presence: true, uniqueness: { case_sensitive: false }
+    validates :password, confirmation: true, if: :password
 
     before_save :encrypt_password, if: :password
 

data/app/models/spree/line_item.rb

@@ -55,10 +55,10 @@ module Spree
     delegate :name, :description, :brand, :category, to: :product
 
     # Returns the thumbnail image for this line item
-    # Prefers variant thumbnail, falls back to product thumbnail
-    # @return [Spree::Image, nil]
+    # Prefers variant primary media, falls back to product primary media
+    # @return [Spree::Asset, nil]
     def thumbnail
-      variant.thumbnail || product.thumbnail
+      variant.primary_media || product.primary_media
     end
     delegate :tax_zone, to: :order
     delegate :digital?, :can_supply?, to: :variant

data/app/models/spree/order/checkout.rb

@@ -227,6 +227,24 @@ module Spree
             self.checkout_steps.index(step).to_i
           end
 
+          # Customer-facing checkout step derived from the internal state machine state.
+          # Maps +'cart'+ to +'address'+ since cart is not a user-facing checkout step.
+          #
+          # @return [String] current checkout step name (e.g. +"address"+, +"delivery"+, +"payment"+)
+          def current_checkout_step
+            state == 'cart' ? 'address' : state
+          end
+
+          # Checkout steps that have already been completed, i.e. all steps before
+          # {#current_checkout_step}. Does not include +'complete'+.
+          #
+          # @return [Array<String>] completed step names in order
+          def completed_checkout_steps
+            steps = checkout_steps.reject { |s| s == 'complete' }
+            idx = steps.index(current_checkout_step) || 0
+            steps.first(idx)
+          end
+
           def can_go_to_state?(state)
             return false unless has_checkout_step?(self.state) && has_checkout_step?(state)
 

data/app/models/spree/order.rb

@@ -139,6 +139,7 @@ module Spree
              inverse_of: :order
 
     has_many :order_promotions, class_name: 'Spree::OrderPromotion'
+    has_many :cart_promotions, class_name: 'Spree::CartPromotion', foreign_key: :order_id
     has_many :promotions, through: :order_promotions, class_name: 'Spree::Promotion'
 
     has_many :shipments, class_name: 'Spree::Shipment', dependent: :destroy, inverse_of: :order do
@@ -148,6 +149,8 @@ module Spree
     end
     has_many :shipment_adjustments, through: :shipments, source: :adjustments
 
+    alias items line_items
+
     accepts_nested_attributes_for :line_items
     accepts_nested_attributes_for :bill_address
     accepts_nested_attributes_for :ship_address

data/app/models/spree/order_promotion.rb

@@ -1,5 +1,7 @@
 module Spree
   class OrderPromotion < Spree.base_class
+    has_prefix_id :oprom
+
     belongs_to :order, class_name: 'Spree::Order'
     belongs_to :promotion, class_name: 'Spree::Promotion'
 

data/app/models/spree/payment_method.rb

@@ -71,10 +71,44 @@ module Spree
 
     # Completes a payment session via the provider.
     # Override in gateway subclasses to implement provider-specific session completion.
+    #
+    # Responsibilities:
+    # - Verify payment status with the provider
+    # - Create/update the Spree::Payment record
+    # - Patch order data from provider (e.g. wallet billing address)
+    # - Transition payment session to completed/failed
+    #
+    # Must NOT complete the order — that is handled by Carts::Complete
+    # (called by the frontend or by the webhook handler).
     def complete_payment_session(payment_session:, params: {})
       raise ::NotImplementedError, 'You must implement complete_payment_session method for this gateway.'
     end
 
+    # Parses an incoming webhook payload from the payment provider.
+    # Override in gateway subclasses to implement provider-specific webhook parsing.
+    #
+    # @param raw_body [String] the raw request body
+    # @param headers [Hash] the request headers
+    # @return [Hash, nil] normalized result or nil for unsupported events
+    #   { action: :captured/:authorized/:failed/:canceled,
+    #     payment_session: <Spree::PaymentSession>,
+    #     metadata: {} }
+    # @raise [Spree::PaymentMethod::WebhookSignatureError] if signature is invalid
+    def parse_webhook_event(raw_body, headers)
+      raise ::NotImplementedError, 'You must implement parse_webhook_event method for this gateway.'
+    end
+
+    # Returns the webhook URL for this payment method.
+    # @return [String, nil]
+    def webhook_url
+      store = stores.first
+      return nil unless store
+
+      "#{store.url_or_custom_domain}/api/v3/webhooks/payments/#{prefixed_id}"
+    end
+
+    class WebhookSignatureError < StandardError; end
+
     # Whether this payment method supports setup sessions (saving payment methods for future use).
     # Override in gateway subclasses that support tokenization without a payment.
     def setup_session_supported?

data/app/models/spree/payment_session.rb

@@ -76,6 +76,24 @@ module Spree
       expires_at.present? && expires_at <= Time.current
     end
 
+    # Creates or finds the Spree::Payment record for this session.
+    # Gateway subclasses can override this in their PaymentSession subclass
+    # to handle gateway-specific source creation (credit cards, wallets, etc).
+    #
+    # @param metadata [Hash] gateway-specific metadata
+    # @return [Spree::Payment] the payment record
+    def find_or_create_payment!(metadata = {})
+      return payment if payment.present?
+
+      order.payments.find_or_create_by!(
+        payment_method: payment_method,
+        response_code: external_id,
+      ) do |p|
+        p.amount = amount
+        p.skip_source_requirement = true
+      end
+    end
+
     private
 
     def publish_processing_event

data/app/models/spree/product.rb

@@ -114,10 +114,12 @@ module Spree
     has_many :orders, through: :line_items
     has_many :completed_orders, -> { reorder(nil).distinct.complete }, through: :line_items, source: :order
 
+    has_many :media, -> { order(:position) }, as: :viewable, dependent: :destroy, class_name: 'Spree::Asset'
+
     has_many :variant_images, -> { order(:position) }, source: :images, through: :variants_including_master
     has_many :variant_images_without_master, -> { order(:position) }, source: :images, through: :variants
 
-    belongs_to :thumbnail, class_name: 'Spree::Image', optional: true
+    belongs_to :primary_media, class_name: 'Spree::Asset', optional: true, foreign_key: :primary_media_id
 
     has_many :option_value_variants, class_name: 'Spree::OptionValueVariant', through: :variants
     has_many :option_values, class_name: 'Spree::OptionValue', through: :variants
@@ -335,17 +337,26 @@ module Spree
       @default_variant_id ||= default_variant.id
     end
 
-    # Returns true if any variant (including master) has images.
-    # Uses loaded association when available, otherwise falls back to counter cache.
+    # Returns the product's media gallery.
+    # Uses product-level media if present, otherwise falls back to variant images.
+    # @return [ActiveRecord::Relation]
+    def gallery_media
+      return media if association(:media).loaded? ? media.any? : media.exists?
+
+      variant_images
+    end
+
+    # Returns true if the product has any media (product-level or variant-level).
+    # Uses counter cache for performance.
     # @return [Boolean]
-    def has_variant_images?
+    def has_media?
       return variant_images.any? if association(:variant_images).loaded?
 
-      total_image_count.positive?
+      media_count.positive?
     end
 
-    # Alias for has_variant_images? for consistency with Variant#has_images?
-    alias has_images? has_variant_images?
+    alias has_images? has_media?
+    alias has_variant_images? has_media?
 
     # Returns the variant that should be used for displaying images.
     # Priority: master > default_variant > first variant with images
@@ -354,47 +365,47 @@ module Spree
       @variant_for_images ||= find_variant_for_images
     end
 
-    # Returns default Image for Product.
-    # Uses cached thumbnail_id which is updated when images are added/removed/reordered.
-    # @return [Spree::Image, nil]
+    # @deprecated Use #primary_media instead.
     def default_image
-      thumbnail
+      Spree::Deprecation.warn('Spree::Product#default_image is deprecated and will be removed in Spree 6.0. Please use Spree::Product#primary_media instead.')
+      primary_media
     end
 
-    # Backward compatibility for Spree 5.2 and earlier.
-    # @deprecated Use Spree::Product#default_image instead.
+    # @deprecated Use #primary_media instead.
     def featured_image
-      Spree::Deprecation.warn('Spree::Product#featured_image is deprecated and will be removed in Spree 5.5. Please use Spree::Product#default_image instead.')
+      Spree::Deprecation.warn('Spree::Product#featured_image is deprecated and will be removed in Spree 6.0. Please use Spree::Product#primary_media instead.')
+      primary_media
+    end
 
-      default_image
+    # @deprecated Use #primary_media instead.
+    def primary_image
+      Spree::Deprecation.warn('Spree::Product#primary_image is deprecated and will be removed in Spree 6.0. Please use Spree::Product#primary_media instead.')
+      primary_media
     end
 
-    # Returns secondary Image for Product (for hover effects).
-    # @return [Spree::Image, nil]
+    # Returns secondary media for Product (for hover effects).
+    # @return [Spree::Asset, nil]
     def secondary_image
       variant_for_images&.secondary_image
     end
 
-    # Alias for default_image for consistency.
-    alias primary_image default_image
-
-    # Returns the image count from the variant used for displaying images.
-    # @return [Integer]
+    # @deprecated Use media_count instead
     def image_count
-      variant_for_images&.image_count || 0
+      media_count
     end
 
-    # Updates the thumbnail_id to the first image from variant_images.
-    # Called when images are added, removed, or reordered on any variant.
+    # Updates primary_media_id to the first media item.
+    # Checks product-level media first, then falls back to variant images.
+    # Called when media is added, removed, or reordered.
     def update_thumbnail!
-      first_image = variant_images.order(:position).first
-      update_column(:thumbnail_id, first_image&.id)
+      first_media = media.order(:position).first || variant_images.order(:position).first
+      update_column(:primary_media_id, first_media&.id)
     end
 
-    # Finds first variant with images using preloaded data when available.
+    # Finds first variant with media using preloaded data when available.
     # @return [Spree::Variant, nil]
     def find_variant_with_images
-      return variants.find(&:has_images?) if variants.loaded?
+      return variants.find(&:has_media?) if variants.loaded?
 
       variants.joins(:images).first
     end
@@ -630,12 +641,12 @@ module Spree
 
     private
 
-    # Determines which variant should be used for displaying images.
-    # Priority: master > default_variant > first variant with images
+    # Determines which variant should be used for displaying media.
+    # Priority: master > default_variant > first variant with media
     def find_variant_for_images
-      return master if master.has_images?
-      return default_variant if has_variants? && default_variant.has_images?
-      return find_variant_with_images if has_variant_images?
+      return master if master.has_media?
+      return default_variant if has_variants? && default_variant.has_media?
+      return find_variant_with_images if has_media?
 
       nil
     end

data/app/models/spree/shipment.rb

@@ -354,6 +354,7 @@ module Spree
       return if order.completed?
 
       update_amounts
+      reload # reload to pick up cost set by update_columns in update_amounts
       order.set_shipments_cost
     end
 

data/app/models/spree/store.rb

@@ -58,6 +58,7 @@ module Spree
     #
     # Associations
     #
+    has_many :carts, -> { incomplete }, class_name: 'Spree::Order', inverse_of: :store
     has_many :checkouts, -> { incomplete }, class_name: 'Spree::Order', inverse_of: :store
     has_many :orders, class_name: 'Spree::Order'
     has_many :line_items, through: :orders, class_name: 'Spree::LineItem'
@@ -108,6 +109,7 @@ module Spree
     has_many :customer_groups, class_name: 'Spree::CustomerGroup', dependent: :destroy, inverse_of: :store
 
     has_many :api_keys, class_name: 'Spree::ApiKey', dependent: :destroy
+    has_many :allowed_origins, class_name: 'Spree::AllowedOrigin', dependent: :destroy
 
     #
     # Validations
@@ -251,6 +253,36 @@ module Spree
       formatted_url
     end
 
+    # Returns the storefront origin URL for use in customer-facing emails and links.
+    # Uses the first allowed origin if configured, otherwise falls back to formatted_url.
+    #
+    # @return [String] e.g. "https://myshop.com"
+    def storefront_url
+      allowed_origins.order(:created_at).pick(:origin) || formatted_url
+    end
+
+    # Returns true if the given URL's origin matches one of the store's allowed origins.
+    # Comparison is port-less: only scheme + host are matched, so storing
+    # `http://localhost` will match `http://localhost:3000`, `http://localhost:4000`, etc.
+    #
+    # @param url [String] the full URL to check
+    # @return [Boolean]
+    def allowed_origin?(url)
+      return false if url.blank?
+
+      uri = URI.parse(url)
+      request_origin = "#{uri.scheme}://#{uri.host}"
+
+      allowed_origins.pluck(:origin).any? do |stored|
+        stored_uri = URI.parse(stored)
+        "#{stored_uri.scheme}://#{stored_uri.host}" == request_origin
+      rescue URI::InvalidURIError
+        false
+      end
+    rescue URI::InvalidURIError
+      false
+    end
+
     # Returns the states available for checkout for the store
     # @param country [Spree::Country] the country to get the states for
     # @return [Array<Spree::State>]

data/app/models/spree/variant.rb

@@ -48,8 +48,8 @@ module Spree
     has_many :option_value_variants, class_name: 'Spree::OptionValueVariant'
     has_many :option_values, through: :option_value_variants, dependent: :destroy, class_name: 'Spree::OptionValue'
 
-    has_many :images, -> { order(:position) }, as: :viewable, dependent: :destroy, class_name: 'Spree::Image'
-    belongs_to :thumbnail, class_name: 'Spree::Image', optional: true
+    has_many :images, -> { order(:position) }, as: :viewable, dependent: :destroy, class_name: 'Spree::Asset'
+    belongs_to :primary_media, class_name: 'Spree::Asset', optional: true, foreign_key: :primary_media_id
 
     has_many :prices,
              class_name: 'Spree::Price',
@@ -279,26 +279,35 @@ module Spree
       is_master? ? name + ' - Master' : name + ' - ' + options_text
     end
 
-    # Returns true if the variant has images.
+    # Returns the variant's media gallery.
+    # Currently returns direct images. In 6.0 will use variant_media join table.
+    # @return [ActiveRecord::Relation]
+    def gallery_media
+      images
+    end
+
+    # Returns true if the variant has media.
     # Uses loaded association when available, otherwise falls back to counter cache.
     # @return [Boolean]
-    def has_images?
+    def has_media?
       return images.any? if images.loaded?
 
-      image_count.positive?
+      media_count.positive?
     end
 
-    # Returns default Image for Variant.
-    # @return [Spree::Image, nil]
+    alias has_images? has_media?
+
+    # @deprecated Use #primary_media instead.
     def default_image
-      thumbnail
+      Spree::Deprecation.warn('Spree::Variant#default_image is deprecated and will be removed in Spree 6.0. Please use Spree::Variant#primary_media instead.')
+      primary_media
     end
 
-    # Updates the thumbnail_id to the first image by position.
-    # Called when images are added, removed, or reordered.
+    # Updates primary_media_id to the first media item by position.
+    # Called when media is added, removed, or reordered.
     def update_thumbnail!
-      first_image = images.order(:position).first
-      update_column(:thumbnail_id, first_image&.id)
+      first_media = images.order(:position).first
+      update_column(:primary_media_id, first_media&.id)
     end
 
     # Returns first Image for Variant.

data/app/services/spree/cart/create.rb

@@ -3,49 +3,22 @@ module Spree
     class Create
       prepend Spree::ServiceModule::Base
 
-      # @param user [Spree.user_class, nil] the user to associate with the cart
-      # @param store [Spree::Store] the store for the cart
-      # @param currency [String, nil] ISO currency code, defaults to store's default currency
-      # @param locale [String, nil] locale for the cart (e.g. 'en', 'fr'), defaults to Spree::Current.locale
-      # @param public_metadata [Hash] public metadata for the order
-      # @param private_metadata [Hash] private metadata for the order
-      # @param order_params [Hash] additional order attributes
-      # @param line_items [Array<Hash>] line items to add, each with :variant_id (prefixed) and :quantity
-      # @return [Spree::ServiceModule::Result]
-      def call(user:, store:, currency:, locale: nil, metadata: {}, public_metadata: {}, private_metadata: {}, order_params: {}, line_items: [])
+      def call(user:, store:, currency:, public_metadata: {}, private_metadata: {}, order_params: {})
         order_params ||= {}
-        line_items ||= []
 
         # we cannot create an order without store
         return failure(:store_is_required) if store.nil?
 
-        resolved_metadata = metadata.presence || private_metadata
-
         default_params = {
           user: user,
           currency: currency || store.default_currency,
-          locale: locale || Spree::Current.locale,
           token: Spree::GenerateToken.new.call(Spree::Order),
           public_metadata: public_metadata.to_h,
-          private_metadata: resolved_metadata.to_h
+          private_metadata: private_metadata.to_h
         }
 
-        order = nil
-
-        ApplicationRecord.transaction do
-          order = store.orders.create!(default_params.merge(order_params))
-
-          if line_items.present?
-            result = Spree.cart_upsert_items_service.call(order: order, line_items: line_items)
-            raise StandardError, result.error.to_s if result.failure?
-          end
-        end
-
+        order = store.orders.create!(default_params.merge(order_params))
         success(order)
-      rescue ActiveRecord::RecordNotFound
-        raise
-      rescue StandardError => e
-        failure(order, e.message)
       end
     end
   end

data/app/services/spree/carts/complete.rb

@@ -0,0 +1,46 @@
+# In Spree 6 this servoice will complete the Spree::Cart, and create a Spree::Order
+# created based on the contents of the cart.
+module Spree
+  module Carts
+    class Complete
+      prepend Spree::ServiceModule::Base
+
+      # Completes the cart and creates a Spree::Order based on its contents.
+      # @return [Spree::Order]
+      def call(cart:)
+        return success(cart) if cart.completed?
+        return failure(cart, 'Order is canceled') if cart.canceled?
+
+        cart.with_lock do
+          process_payments!(cart) if cart.payment_required?
+
+          return failure(cart, cart.errors.full_messages.to_sentence) if cart.errors.any?
+
+          advance_to_complete!(cart)
+
+          if cart.reload.complete?
+            success(cart)
+          else
+            failure(cart, cart.errors.full_messages.to_sentence.presence || 'Could not complete checkout')
+          end
+        end
+      end
+
+      private
+
+      def process_payments!(cart)
+        # If payments were already processed by the payment session
+        # (e.g. Stripe charged the card during complete_payment_session),
+        # skip re-processing. Only process unprocessed (checkout state) payments.
+        return if cart.payment_total >= cart.total
+        return if cart.payments.valid.any?(&:completed?) && cart.unprocessed_payments.empty?
+
+        cart.process_payments!
+      end
+
+      def advance_to_complete!(cart)
+        cart.next until cart.complete? || cart.errors.present?
+      end
+    end
+  end
+end

data/app/services/spree/carts/create.rb

@@ -0,0 +1,32 @@
+module Spree
+  module Carts
+    class Create
+      prepend Spree::ServiceModule::Base
+
+      def call(params: {})
+        @params = params.to_h.deep_symbolize_keys
+
+        store = @params.delete(:store)
+        return failure(:store_is_required) if store.nil?
+
+        cart = store.carts.create!(
+          user: @params.delete(:user),
+          currency: @params.delete(:currency) || store.default_currency,
+          locale: @params.delete(:locale) || Spree::Current.locale
+        )
+
+        # Delegate all attribute/address/item processing to Carts::Update
+        if @params.present?
+          result = Spree::Carts::Update.call(cart: cart, params: @params)
+          return result if result.failure?
+        end
+
+        success(cart.reload)
+      rescue ActiveRecord::RecordNotFound
+        raise
+      rescue StandardError => e
+        failure(nil, e.message)
+      end
+    end
+  end
+end