spree_core 5.4.0.beta6 → 5.4.0.beta8

data/app/services/spree/carts/update.rb

@@ -0,0 +1,115 @@
+module Spree
+  module Carts
+    class Update
+      prepend Spree::ServiceModule::Base
+
+      def call(cart:, params:)
+        @cart = cart
+        @params = params.to_h.deep_symbolize_keys
+
+        ApplicationRecord.transaction do
+          assign_cart_attributes
+          assign_address(:ship_address)
+          assign_address(:bill_address)
+
+          cart.save!
+
+          process_items
+        end
+
+        try_advance
+
+        success(cart)
+      rescue ActiveRecord::RecordNotFound
+        raise
+      rescue ActiveRecord::RecordInvalid => e
+        failure(cart, e.record.errors.full_messages.to_sentence)
+      rescue StandardError => e
+        failure(cart, e.message)
+      end
+
+      private
+
+      attr_reader :cart, :params
+
+      def assign_cart_attributes
+        cart.email = params[:email] if params[:email].present?
+        cart.special_instructions = params[:special_instructions] if params.key?(:special_instructions)
+        cart.currency = params[:currency].upcase if params[:currency].present?
+        cart.locale = params[:locale] if params[:locale].present?
+        cart.metadata = cart.metadata.merge(params[:metadata].to_h) if params[:metadata].present?
+      end
+
+      def assign_address(address_type)
+        address_id_param = params[:"#{address_type}_id"]
+        address_params = params[address_type]
+
+        if address_id_param.present?
+          address_id = resolve_address_id(address_id_param)
+          cart.public_send(:"#{address_type}_id=", address_id) if address_id
+          return
+        end
+
+        return unless address_params.is_a?(Hash)
+
+        if address_params[:id].present?
+          address_id = resolve_address_id(address_params[:id])
+          cart.public_send(:"#{address_type}_id=", address_id) if address_id
+        else
+          # Only revert to address state when shipping address changes.
+          # Billing address updates (e.g. during payment) should not
+          # destroy shipments and reset the checkout flow.
+          revert_to_address_state if address_type == :ship_address && cart.has_checkout_step?('address')
+          cart.public_send(:"#{address_type}_attributes=", address_params)
+        end
+      end
+
+      def process_items
+        return unless params[:items].is_a?(Array)
+
+        result = Spree::Carts::UpsertItems.call(
+          cart: cart,
+          items: params[:items]
+        )
+
+        raise StandardError, result.error.to_s if result.failure?
+      end
+
+      def resolve_address_id(prefixed_id)
+        return unless cart.user
+
+        decoded = Spree::Address.decode_prefixed_id(prefixed_id)
+        decoded ? cart.user.addresses.find_by(id: decoded)&.id : nil
+      end
+
+      def revert_to_address_state
+        return if ['cart', 'address'].include?(cart.state)
+
+        cart.state = 'address'
+      end
+
+      # Auto-advance as far as the checkout state machine allows.
+      # Loops cart.next until the cart can't progress further (e.g. missing
+      # payment) or reaches confirm/complete. Stops at the first step whose
+      # before_transition guard fails — the `requirements` array in the
+      # serialized response tells the frontend what's still missing.
+      # Failure is swallowed — the update itself already succeeded.
+      def try_advance
+        return if cart.complete? || cart.canceled?
+
+        loop do
+          break unless cart.next
+          break if cart.confirm? || cart.complete?
+        end
+      rescue StandardError => e
+        Rails.error.report(e, context: { order_id: cart.id, state: cart.state }, source: 'spree.checkout')
+      ensure
+        begin
+          cart.reload
+        rescue StandardError # rubocop:disable Lint/SuppressedException
+          # reload failure must not mask the original result
+        end
+      end
+    end
+  end
+end

data/app/services/spree/{cart → carts}/upsert_items.rb

@@ -1,21 +1,17 @@
 module Spree
-  module Cart
-    # Bulk upsert line items on an order.
+  module Carts
+    # Bulk upsert line items on a cart.
     #
-    # For each entry in +line_items+:
-    # - If a line item for the variant already exists → sets its quantity
-    # - If no line item exists → creates one with the given quantity
+    # For each entry in +items+:
+    # - If a line item for the variant already exists -> sets its quantity
+    # - If no line item exists -> creates one with the given quantity
     #
-    # After all items are processed the order is recalculated once.
-    #
-    # Price calculation and tax adjustments are handled by LineItem model callbacks
-    # (copy_price, update_adjustments, update_tax_charge), so we only need to
-    # save each item and run a single order recalculation at the end.
+    # After all items are processed the cart is recalculated once.
     #
     # @example
-    #   Spree::Cart::UpsertItems.call(
-    #     order: order,
-    #     line_items: [
+    #   Spree::Carts::UpsertItems.new.call(
+    #     cart: cart,
+    #     items: [
     #       { variant_id: "variant_k5nR8xLq", quantity: 2 },
     #       { variant_id: "variant_m3Rp9wXz", quantity: 1 }
     #     ]
@@ -24,39 +20,39 @@ module Spree
     class UpsertItems
       prepend Spree::ServiceModule::Base
 
-      def call(order:, line_items:)
-        line_items = Array(line_items)
-        return success(order) if line_items.empty?
+      def call(cart:, items:)
+        items = Array(items)
+        return success(cart) if items.empty?
 
-        store = order.store || Spree::Current.store
+        store = cart.store || Spree::Current.store
 
         ApplicationRecord.transaction do
-          line_items.each do |item_params|
+          items.each do |item_params|
             item_params = item_params.to_h.deep_symbolize_keys
             variant = resolve_variant(store, item_params[:variant_id])
             next unless variant
 
             quantity = (item_params[:quantity] || 1).to_i
 
-            return failure(variant, "#{variant.name} is not available in #{order.currency}") if variant.amount_in(order.currency).nil?
+            return failure(variant, "#{variant.name} is not available in #{cart.currency}") if variant.amount_in(cart.currency).nil?
 
-            line_item = Spree.line_item_by_variant_finder.new.execute(order: order, variant: variant)
+            line_item = Spree.line_item_by_variant_finder.new.execute(order: cart, variant: variant)
 
             if line_item
               line_item.quantity = quantity
               line_item.metadata = line_item.metadata.merge(item_params[:metadata].to_h) if item_params[:metadata].present?
             else
-              line_item = order.line_items.new(quantity: quantity, variant: variant, options: { currency: order.currency })
+              line_item = cart.items.new(quantity: quantity, variant: variant, options: { currency: cart.currency })
               line_item.metadata = item_params[:metadata].to_h if item_params[:metadata].present?
             end
 
             return failure(line_item) unless line_item.save
           end
 
-          order.update_with_updater!
+          cart.update_with_updater!
         end
 
-        success(order)
+        success(cart)
       end
 
       private

data/app/services/spree/payments/handle_webhook.rb

@@ -0,0 +1,58 @@
+module Spree
+  module Payments
+    class HandleWebhook
+      prepend Spree::ServiceModule::Base
+
+      # @param payment_method [Spree::PaymentMethod] the payment method that received the webhook
+      # @param action [Symbol] normalized action (:captured, :authorized, :failed, :canceled)
+      # @param payment_session [Spree::PaymentSession] the payment session associated with the webhook
+      # @param metadata [Hash] gateway-specific metadata (e.g. charge data, psp reference)
+      def call(payment_method:, action:, payment_session:, metadata: {})
+        return success(nil) if payment_session.nil?
+
+        order = payment_session.order
+
+        case action
+        when :captured, :authorized
+          handle_success(payment_session, order, metadata)
+        when :failed
+          payment_session.fail if payment_session.can_fail?
+          success(payment_session)
+        when :canceled
+          payment_session.cancel if payment_session.can_cancel?
+          success(payment_session)
+        else
+          failure(payment_session, "Unknown webhook action: #{action}")
+        end
+      end
+
+      private
+
+      def handle_success(payment_session, order, metadata)
+        order.with_lock do
+          # Ensure payment record exists
+          payment = payment_session.find_or_create_payment!(metadata)
+
+          # Mark payment as completed — the webhook confirms the gateway processed it
+          if payment.present? && !payment.completed?
+            payment.started_processing! if payment.checkout?
+            payment.complete! if payment.can_complete?
+          end
+
+          # Mark session as completed
+          payment_session.complete if payment_session.can_complete?
+
+          # Complete order if not already done
+          unless order.reload.completed?
+            Spree::Dependencies.carts_complete_service.constantize.call(cart: order)
+          end
+        end
+
+        success(payment_session)
+      rescue StandardError => e
+        Rails.error.report(e, context: { payment_session_id: payment_session.id, order_id: order.id }, source: 'spree.payments.webhook')
+        failure(payment_session, e.message)
+      end
+    end
+  end
+end

data/app/services/spree/seeds/all.rb

@@ -28,6 +28,7 @@ module Spree
           # add store resources
           PaymentMethods.call
           ApiKeys.call
+          AllowedOrigins.call
         end
       end
     end

data/app/services/spree/seeds/allowed_origins.rb

@@ -0,0 +1,14 @@
+module Spree
+  module Seeds
+    class AllowedOrigins
+      prepend Spree::ServiceModule::Base
+
+      def call
+        store = Spree::Store.default
+        return unless store&.persisted?
+
+        store.allowed_origins.find_or_create_by!(origin: 'http://localhost')
+      end
+    end
+  end
+end

data/app/views/spree/shared/_mailer_logo.html.erb

@@ -2,7 +2,7 @@
 <% height ||= 64 %>
 <% logo_css ||= '' %>
 
-<%= link_to current_store.url_or_custom_domain, id: 'site-logo', style: "text-decoration: none;" do %>
+<%= link_to current_store.storefront_url, id: 'site-logo', style: "text-decoration: none;" do %>
   <span style="display: none;"><%= current_store.name %></span>
   <% if logo.present? && logo.attached? && logo.variable? %>
     <% aspect_ratio = spree_asset_aspect_ratio(logo) %>

data/config/locales/en.yml

@@ -240,6 +240,10 @@ en:
       messages:
         blank: can't be blank
       models:
+        spree/allowed_origin:
+          attributes:
+            origin:
+              must_be_origin_only: must be an origin (scheme and host) without path, query, or fragment
         spree/calculator/tiered_flat_rate:
           attributes:
             base:
@@ -742,6 +746,8 @@ en:
     all_products: All products
     all_rights_reserved: All rights reserved
     all_time: All time
+    allowed_origin: Allowed Origin
+    allowed_origins: Allowed Origins
     already_have_account: Already have an account?
     alt_text: Alternative Text
     alternative_phone: Alternative Phone
@@ -837,6 +843,7 @@ en:
     card_type: Brand
     card_type_is: Card type is
     cart: Cart
+    cart_already_updated: The cart has already been updated.
     cart_line_item:
       discontinued: "%{li_name} was removed because it was discontinued"
       out_of_stock: "%{li_name} was removed because it was sold out"
@@ -864,6 +871,12 @@ en:
     charged: Charged
     checkout: Checkout
     checkout_message: Checkout message
+    checkout_requirements:
+      email_required: Email address is required
+      line_items_required: Add at least one item to your cart
+      payment_required: Add a payment method
+      ship_address_required: Shipping address is required
+      shipping_method_required: Select a shipping method for all shipments
     choose_a_customer: Choose a customer
     choose_a_taxon_to_sort_products_for: Choose a taxon to sort products for
     choose_currency: Choose Currency
@@ -969,6 +982,14 @@ en:
     customer_group_rule:
       choose_customer_groups: 'Select the customer group(s) to which this promotion should apply:'
     customer_groups: Customer Groups
+    customer_mailer:
+      password_reset_email:
+        action: Reset Password
+        expiry_notice: This password reset link will expire shortly. If you did not request this, no action is needed.
+        greeting: Hi %{name},
+        ignore_notice: If you did not request a password reset, you can safely ignore this email. Your password will not be changed.
+        instructions: We received a request to reset your password. Click the button below to choose a new password.
+        subject: Password Reset
     customer_removed_from_group: Customer removed from group
     customer_return: Customer Return
     customer_returns: Customer Returns
@@ -1097,6 +1118,7 @@ en:
         blank: can't be blank
         cannot_remove_icon: Cannot remove image
         could_not_create_taxon: Could not create taxon
+        must_be_origin_only: must be an origin (scheme and host) without path, query, or fragment
         no_shipping_methods_available: No shipping methods available for selected location, please change your address and try again.
         store_association_can_not_be_changed: The store association can not be changed
         store_is_already_set: Store is already set
@@ -1411,6 +1433,7 @@ en:
     new: New
     new_address: New address
     new_adjustment: New Adjustment
+    new_allowed_origin: New Allowed Origin
     new_api_key: New API Key
     new_balance: New balance
     new_billing_address: New Billing Address
@@ -1559,8 +1582,6 @@ en:
     order: Order
     order_adjustments: Order adjustments
     order_again: Order again
-    order_already_completed: Order already completed
-    order_already_updated: The order has already been updated.
     order_approved: Order approved
     order_canceled: Order canceled
     order_details: Order Details

data/db/migrate/20260315000000_create_spree_allowed_origins.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class CreateSpreeAllowedOrigins < ActiveRecord::Migration[7.2]
+  def change
+    create_table :spree_allowed_origins do |t|
+      t.references :store, null: false
+      t.string :origin, null: false
+      t.timestamps
+    end
+
+    add_index :spree_allowed_origins, [:store_id, :origin], unique: true,
+              name: 'index_spree_allowed_origins_on_store_id_and_origin'
+  end
+end

data/db/migrate/20260315100000_add_product_media_support.rb

@@ -0,0 +1,21 @@
+class AddProductMediaSupport < ActiveRecord::Migration[7.2]
+  def change
+    add_column :spree_assets, :media_type, :string
+    add_column :spree_assets, :focal_point_x, :decimal, precision: 5, scale: 4
+    add_column :spree_assets, :focal_point_y, :decimal, precision: 5, scale: 4
+    add_column :spree_assets, :external_video_url, :string
+
+    add_index :spree_assets, :media_type
+
+    rename_column :spree_variants, :image_count, :media_count
+    rename_column :spree_products, :total_image_count, :media_count
+    rename_column :spree_variants, :thumbnail_id, :primary_media_id
+    rename_column :spree_products, :thumbnail_id, :primary_media_id
+
+    reversible do |dir|
+      dir.up do
+        Spree::Asset.unscoped.where(media_type: nil).update_all(media_type: 'image')
+      end
+    end
+  end
+end

data/lib/spree/core/configuration.rb

@@ -107,6 +107,9 @@ module Spree
       preference :coupon_codes_web_limit, :integer, default: 500 # number of coupon codes to be generated in the web process, more than this will be generated in a background job
       preference :coupon_codes_total_limit, :integer, default: 5000 # the maximum number of coupon codes to be generated
 
+      # password reset
+      preference :customer_password_reset_expires_in, :integer, default: 15 # password reset token expiration time in minutes
+
       # gift cards
       preference :gift_card_batch_web_limit, :integer, default: 500 # number of gift card codes to be generated in the web process, more than this will be generated in a background job
       preference :gift_card_batch_limit, :integer, default: 50_000

data/lib/spree/core/dependencies.rb

@@ -16,7 +16,6 @@ module Spree
         cart_remove_item_service: 'Spree::Cart::RemoveItem',
         cart_remove_line_item_service: 'Spree::Cart::RemoveLineItem',
         cart_set_item_quantity_service: 'Spree::Cart::SetQuantity',
-        cart_upsert_items_service: 'Spree::Cart::UpsertItems',
         cart_estimate_shipping_rates_service: 'Spree::Cart::EstimateShippingRates',
         cart_empty_service: 'Spree::Cart::Empty',
         cart_destroy_service: 'Spree::Cart::Destroy',
@@ -24,6 +23,9 @@ module Spree
         cart_change_currency_service: 'Spree::Cart::ChangeCurrency',
         cart_remove_out_of_stock_items_service: 'Spree::Cart::RemoveOutOfStockItems',
 
+        # carts
+        carts_complete_service: 'Spree::Carts::Complete',
+
         # checkout
         checkout_next_service: 'Spree::Checkout::Next',
         checkout_advance_service: 'Spree::Checkout::Advance',
@@ -42,7 +44,6 @@ module Spree
         # order
         order_approve_service: 'Spree::Orders::Approve',
         order_cancel_service: 'Spree::Orders::Cancel',
-        order_update_service: 'Spree::Orders::Update',
         order_updater: 'Spree::OrderUpdater',
 
         # shipment
@@ -87,6 +88,7 @@ module Spree
         line_item_destroy_service: 'Spree::LineItems::Destroy',
 
         payment_create_service: 'Spree::Payments::Create',
+        payments_handle_webhook_service: 'Spree::Payments::HandleWebhook',
 
         # finders
         address_finder: 'Spree::Addresses::Find',

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.4.0.beta6'.freeze
+  VERSION = '5.4.0.beta8'.freeze
 
   def self.version
     VERSION

data/lib/spree/core.rb

@@ -109,6 +109,7 @@ module Spree
       addresses: :default,
       gift_cards: :default,
       webhooks: :default,
+      payment_webhooks: :default,
       api_keys: :default
     )
   end

data/lib/spree/permitted_attributes.rb

@@ -2,6 +2,7 @@ module Spree
   module PermittedAttributes
     ATTRIBUTES = [
       :address_attributes,
+      :allowed_origin_attributes,
       :api_key_attributes,
       :asset_attributes,
       :checkout_attributes,
@@ -87,9 +88,12 @@ module Spree
         state: [:name, :abbr] }
     ]
 
+    @@allowed_origin_attributes = [:origin]
+
     @@api_key_attributes = [:name, :key_type]
 
-    @@asset_attributes = [:type, :viewable_id, :viewable_type, :attachment, :alt, :position]
+    @@asset_attributes = [:type, :viewable_id, :viewable_type, :attachment, :alt, :position,
+                          :media_type, :focal_point_x, :focal_point_y, :external_video_url]
 
     @@checkout_attributes = [
       :coupon_code, :email, :shipping_method_id, :special_instructions, :use_billing, :use_shipping,

data/lib/spree/testing_support/factories/allowed_origin_factory.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :allowed_origin, class: Spree::AllowedOrigin do
+    store
+    sequence(:origin) { |n| "https://storefront#{n}.example.com" }
+  end
+end

data/lib/spree/testing_support/factories/asset_factory.rb

@@ -1,15 +1,12 @@
 FactoryBot.define do
   factory :asset, class: Spree::Asset do
-    viewable_type {}
-    viewable_id {}
-    attachment_width { 340 }
-    attachment_height { 280 }
-    attachment_file_size { 128 }
     position { 1 }
-    attachment_content_type { '.jpg' }
-    attachment_file_name { 'attachment.jpg' }
-    type {}
-    attachment_updated_at {}
     alt {}
+
+    after(:build) do |asset|
+      if asset.media_type == 'image' && !asset.attachment.attached?
+        asset.attachment.attach(io: File.new(Spree::Core::Engine.root + 'spec/fixtures' + 'thinking-cat.jpg'), filename: 'thinking-cat.jpg')
+      end
+    end
   end
 end

data/lib/spree/testing_support/factories/image_factory.rb

@@ -1,5 +1,7 @@
 FactoryBot.define do
-  factory :image, class: Spree::Image do
+  factory :image, class: Spree::Asset do
+    media_type { 'image' }
+
     before(:create) do |image|
       if image.class.method_defined?(:attachment)
         image.attachment.attach(io: File.new(Spree::Core::Engine.root + 'spec/fixtures' + 'thinking-cat.jpg'), filename: 'thinking-cat.jpg')

data/lib/spree/testing_support/factories/order_factory.rb

@@ -22,6 +22,9 @@ FactoryBot.define do
       end
     end
 
+    factory :cart, class: Spree::Order do
+    end
+
     factory :order_with_totals do
       after(:create) do |order, evaluator|
         create(:line_item, order: order, price: evaluator.line_items_price)

data/lib/tasks/images.rake

@@ -1,17 +1,17 @@
 namespace :spree do
-  namespace :images do
-    desc 'Backfill thumbnail_id for all variants and products'
-    task backfill_thumbnails: :environment do
-      puts 'Backfilling variant thumbnails...'
-      Spree::Variant.where(thumbnail_id: nil).where.not(image_count: 0).find_each do |variant|
-        first_image = variant.images.order(:position).first
-        variant.update_column(:thumbnail_id, first_image.id) if first_image
+  namespace :media do
+    desc 'Backfill primary_media_id for all variants and products'
+    task backfill_primary_media: :environment do
+      puts 'Backfilling variant primary_media...'
+      Spree::Variant.where(primary_media_id: nil).where.not(media_count: 0).find_each do |variant|
+        first_media = variant.gallery_media.first
+        variant.update_column(:primary_media_id, first_media.id) if first_media
       end
 
-      puts 'Backfilling product thumbnails...'
-      Spree::Product.where(thumbnail_id: nil).where.not(total_image_count: 0).find_each do |product|
-        first_image = product.variant_images.order(:position).first
-        product.update_column(:thumbnail_id, first_image.id) if first_image
+      puts 'Backfilling product primary_media...'
+      Spree::Product.where(primary_media_id: nil).where.not(media_count: 0).find_each do |product|
+        first_media = product.gallery_media.first
+        product.update_column(:primary_media_id, first_media.id) if first_media
       end
 
       puts 'Done!'

data/lib/tasks/products.rake

@@ -1,14 +1,16 @@
 namespace :spree do
   namespace :products do
-    desc 'Reset counter caches (variant_count, classification_count, total_image_count) on products'
+    desc 'Reset counter caches (variant_count, classification_count, media_count) on products'
     task reset_counter_caches: :environment do |_t, _args|
       puts 'Resetting product counter caches...'
 
       Spree::Product.find_each do |product|
+        total_media = product.media.count + product.variant_images.where.not(id: product.media.select(:id)).count
+
         product.update_columns(
           variant_count: product.variants.count,
           classification_count: product.classifications.count,
-          total_image_count: product.variant_images.count,
+          media_count: total_media,
           updated_at: Time.current
         )
         print '.'