spree_core 5.4.1 → 5.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3bed2ace5a7bcb6bc6b8c598cfb3ec19cb3dc0ea02854744543ae228ed9c636b
-  data.tar.gz: 81642ee18f7e01079090ec1c5d162dc25186aa5bd72ac2e799a5a3457ebd1a1a
+  metadata.gz: d8ff8a33cfaa4b9554bb3658995a2ed99d1715cb2365d3da012fce5dd2bbd518
+  data.tar.gz: fd19b449aa211be4cbec760db28e573064f9112d8c0922bf78517e51c0fc5002
 SHA512:
-  metadata.gz: 5a68e9d3b365c52c811c9a81fa7e2b3968de8f52ddfd7ef829ee47232c809b43715297b09d60f7a0d765b4c30fde3b9a0dfe181d4cff6bd50cb7ddd8c724f590
-  data.tar.gz: 122681c279ef487105deb809c4701c318c9cf7e767e3b4e7c86b630b59246f46093e921ea51fb15f82cb72a888f07ae962420b79fd0521c0440253337e50f940
+  metadata.gz: 5a392b8f08c1732f3b661a8758d37d63ac70e2aa7cf39d01dff5521c0e3267b1ee87ed190ea2cdddf914c7bf83462ebb6c7809736b5243610ab6d5e55c411300
+  data.tar.gz: 841e2707d2535a628a1cc2c743d594276a1cda0a969dd243ed8d82329f53f5d96bda3433517e40d0e261ef79159a7faae9cb57ebb1c5975b6bd2ea00f17d7641

data/app/jobs/spree/events/subscriber_job.rb

@@ -10,7 +10,7 @@ module Spree
     # @example Direct usage (typically called by the adapter)
     #   Spree::Events::SubscriberJob.perform_later(
     #     'MySubscriber',
-    #     { name: 'order.complete', payload: {...}, ... }
+    #     { name: 'order.completed', payload: {...}, ... }
     #   )
     #
     class SubscriberJob < Spree::BaseJob

data/app/jobs/spree/imports/process_group_job.rb

@@ -0,0 +1,45 @@
+module Spree
+  module Imports
+    class ProcessGroupJob < Spree::BaseJob
+      queue_as Spree.queues.imports
+
+      def perform(import_id, row_ids)
+        import = Spree::Import.find(import_id)
+        Spree::Current.store = import.store
+
+        mappings = import.mappings.mapped.to_a
+        schema_fields = import.schema_fields
+        large = import.large_import?
+        rows = import.rows.where(id: row_ids).order(:row_number)
+
+        if large
+          Spree::Events.disable do
+            rows.each { |row| row.bulk_process!(mappings: mappings, schema_fields: schema_fields) }
+          end
+        else
+          rows.each do |row|
+            row.process!(mappings: mappings, schema_fields: schema_fields)
+          end
+        end
+
+        check_import_completion(import, large)
+      end
+
+      private
+
+      def check_import_completion(import, large)
+        Spree::Import.where(id: import.id).update_all(
+          'completed_groups_count = COALESCE(completed_groups_count, 0) + 1'
+        )
+        import.reload
+
+        if import.completed_groups_count >= import.processing_groups_count
+          # Guard against concurrent workers both reaching this point
+          import.complete! if import.status == 'processing'
+        elsif large && (import.completed_groups_count % 10).zero?
+          import.publish_event('import.progress')
+        end
+      end
+    end
+  end
+end

data/app/jobs/spree/imports/process_rows_job.rb

@@ -3,16 +3,62 @@ module Spree
     class ProcessRowsJob < Spree::BaseJob
       queue_as Spree.queues.imports
 
+      BATCH_SIZE = 100
+
       def perform(import_id)
         import = Spree::Import.find(import_id)
+        dispatch_groups(import)
+      end
+
+      private
+
+      def dispatch_groups(import)
+        group_field = import.group_column
+        group_mapping = group_field && import.mappings.mapped.find_by(schema_field: group_field)
+        file_column = group_mapping&.file_column
 
-        # process all rows in sequential order
-        import.rows.pending_and_failed.find_each(batch_size: 100) do |row|
-          row.process!
+        if file_column
+          dispatch_grouped(import, file_column)
+        else
+          dispatch_batched(import)
         end
+      end
+
+      def dispatch_grouped(import, file_column)
+        groups = Hash.new { |h, k| h[k] = [] }
+
+        import.rows.pending_and_failed.order(:row_number).pluck(:id, :data).each do |id, data|
+          parsed = JSON.parse(data)
+          key = parsed[file_column].to_s.strip.downcase.presence || '__ungrouped__'
+          groups[key] << id
+        rescue JSON::ParserError
+          groups['__ungrouped__'] << id
+        end
+
+        # Set count before enqueuing so workers can't complete prematurely
+        import.update_columns(
+          processing_groups_count: groups.size,
+          completed_groups_count: 0,
+          updated_at: Time.current
+        )
+
+        groups.each_value { |row_ids| ProcessGroupJob.perform_later(import.id, row_ids) }
+      end
+
+      def dispatch_batched(import)
+        # Count first, then enqueue — prevents premature completion
+        row_id_batches = import.rows.pending_and_failed.order(:row_number)
+                              .pluck(:id)
+                              .each_slice(BATCH_SIZE)
+                              .to_a
+
+        import.update_columns(
+          processing_groups_count: row_id_batches.size,
+          completed_groups_count: 0,
+          updated_at: Time.current
+        )
 
-        # mark as complete
-        import.complete!
+        row_id_batches.each { |row_ids| ProcessGroupJob.perform_later(import.id, row_ids) }
       end
     end
   end

data/app/models/concerns/spree/payment_source_concern.rb

@@ -2,6 +2,10 @@ module Spree
   module PaymentSourceConcern
     extend ActiveSupport::Concern
 
+    included do
+      before_destroy :cleanup_payments_on_incomplete_orders
+    end
+
     # Available actions for the payment source.
     # @return [Array<String>]
     def actions
@@ -35,5 +39,22 @@ module Spree
     def has_payment_profile?
       gateway_customer_profile_id.present? || gateway_payment_profile_id.present?
     end
+
+    private
+
+    # Cleans up payments on incomplete orders before the source is destroyed.
+    # Invalidates checkout-state payments and voids non-checkout payments.
+    # Skips payments whose payment_method was already nullified (e.g. when
+    # the payment method itself is being destroyed).
+    def cleanup_payments_on_incomplete_orders
+      incomplete_payments = Spree::Payment.valid
+                                          .where(source: self)
+                                          .where.not(payment_method_id: nil)
+                                          .joins(:order)
+                                          .merge(Spree::Order.incomplete)
+
+      incomplete_payments.checkout.each(&:invalidate!)
+      incomplete_payments.where.not(state: :checkout).each(&:void!)
+    end
   end
 end

data/app/models/concerns/spree/publishable.rb

@@ -122,7 +122,7 @@ module Spree
 
     # Publish an event with this model's data
     #
-    # @param event_name [String] The event name (e.g., 'order.complete')
+    # @param event_name [String] The event name (e.g., 'order.completed')
     # @param payload [Hash, nil] Custom payload (defaults to event_payload)
     # @param metadata [Hash] Additional metadata
     # @return [Spree::Event] The published event

data/app/models/spree/address.rb

@@ -79,7 +79,7 @@ module Spree
       end
     end
 
-    delegate :name, :iso3, :iso, :iso_name, to: :country, prefix: true
+    delegate :name, :iso3, :iso, :iso_name, to: :country, prefix: true, allow_nil: true
     delegate :abbr, to: :state, prefix: true, allow_nil: true
 
     alias_attribute :postal_code, :zipcode

data/app/models/spree/asset.rb

@@ -153,31 +153,31 @@ module Spree
     end
 
     def increment_viewable_media_count
-      case viewable_type
-      when 'Spree::Variant'
+      case viewable
+      when Spree::Variant
         Spree::Variant.increment_counter(:media_count, viewable_id)
         Spree::Product.increment_counter(:media_count, viewable.product_id)
-      when 'Spree::Product'
+      when Spree::Product
         Spree::Product.increment_counter(:media_count, viewable_id)
       end
     end
 
     def decrement_viewable_media_count
-      case viewable_type
-      when 'Spree::Variant'
+      case viewable
+      when Spree::Variant
         Spree::Variant.decrement_counter(:media_count, viewable_id)
         Spree::Product.decrement_counter(:media_count, viewable.product_id)
-      when 'Spree::Product'
+      when Spree::Product
         Spree::Product.decrement_counter(:media_count, viewable_id)
       end
     end
 
     def update_viewable_thumbnail
-      case viewable_type
-      when 'Spree::Variant'
+      case viewable
+      when Spree::Variant
         viewable.update_thumbnail!
         viewable.product.update_thumbnail!
-      when 'Spree::Product'
+      when Spree::Product
         viewable.update_thumbnail!
       end
     end

data/app/models/spree/event.rb

@@ -6,20 +6,20 @@ module Spree
   # Events are immutable objects that carry information about something
   # that happened in the system. They contain:
   # - An id (UUID)
-  # - A name (e.g., 'order.complete', 'product.create')
+  # - A name (e.g., 'order.completed', 'product.created')
   # - A store_id (the store where the event originated)
   # - A payload (serialized data about the event)
   # - Metadata (contextual information like spree_version)
   #
   # @example Creating an event
   #   event = Spree::Event.new(
-  #     name: 'order.complete',
+  #     name: 'order.completed',
   #     payload: order.serializable_hash
   #   )
   #
   # @example Accessing event data
   #   event.id         # => "550e8400-e29b-41d4-a716-446655440000"
-  #   event.name       # => 'order.complete'
+  #   event.name       # => 'order.completed'
   #   event.store_id   # => 1
   #   event.payload    # => { 'id' => 1, 'number' => 'R123456' }
   #   event.created_at # => 2024-01-15 10:30:00 UTC
@@ -61,19 +61,19 @@ module Spree
     end
 
     # Returns the resource type from the event name
-    # @return [String] The resource type (e.g., 'order' from 'order.complete')
+    # @return [String] The resource type (e.g., 'order' from 'order.completed')
     def resource_type
       @resource_type ||= name.to_s.split('.').first
     end
 
     # Returns the action from the event name
-    # @return [String] The action (e.g., 'complete' from 'order.complete')
+    # @return [String] The action (e.g., 'completed' from 'order.completed')
     def action
       @action ||= name.to_s.split('.').drop(1).join('.')
     end
 
     # Checks if the event matches a pattern
-    # Supports wildcards: 'order.*' matches 'order.complete', 'order.cancel'
+    # Supports wildcards: 'order.*' matches 'order.completed', 'order.canceled'
     # @param pattern [String] The pattern to match against
     # @return [Boolean]
     def matches?(pattern)

data/app/models/spree/export.rb

@@ -83,10 +83,10 @@ module Spree
           batch.each do |record|
             if multi_line_csv?
               record.to_csv(store).each do |line|
-                csv << line
+                csv << Spree::CSV::FormulaSanitizer.row(line)
               end
             else
-              csv << record.to_csv(store)
+              csv << Spree::CSV::FormulaSanitizer.row(record.to_csv(store))
             end
           end
         end

data/app/models/spree/exports/product_translations.rb

@@ -30,7 +30,7 @@ module Spree
           records_to_export.includes(scope_includes).find_in_batches do |batch|
             batch.each do |product|
               product.to_translation_csv(store, locales).each do |line|
-                csv << line
+                csv << Spree::CSV::FormulaSanitizer.row(line)
               end
             end
           end

data/app/models/spree/gateway/bogus.rb

@@ -32,7 +32,7 @@ module Spree
     def authorize(_money, credit_card, _options = {})
       profile_id = credit_card.gateway_customer_profile_id
       if VALID_CCS.include?(credit_card.number) || (profile_id&.starts_with?('BGS-'))
-        Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: '12345', avs_result: { code: 'D' })
+        Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: generate_authorization, avs_result: { code: 'D' })
       else
         Spree::PaymentResponse.new(false, 'Bogus Gateway: Forced failure', { message: 'Bogus Gateway: Forced failure' }, test: true)
       end
@@ -41,18 +41,18 @@ module Spree
     def purchase(_money, credit_card, _options = {})
       profile_id = credit_card.gateway_customer_profile_id
       if VALID_CCS.include?(credit_card.number) || (profile_id&.starts_with?('BGS-'))
-        Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: '12345', avs_result: { code: 'M' })
+        Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: generate_authorization, avs_result: { code: 'M' })
       else
         Spree::PaymentResponse.new(false, 'Bogus Gateway: Forced failure', message: 'Bogus Gateway: Forced failure', test: true)
       end
     end
 
     def credit(_money, _credit_card, _response_code, _options = {})
-      Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: '12345')
+      Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: generate_authorization)
     end
 
     def capture(_money, authorization, _gateway_options)
-      if authorization == '12345'
+      if authorization&.start_with?('BGS-')
         Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true)
       else
         Spree::PaymentResponse.new(false, 'Bogus Gateway: Forced failure', error: 'Bogus Gateway: Forced failure', test: true)
@@ -60,11 +60,11 @@ module Spree
     end
 
     def void(_response_code, _credit_card, _options = {})
-      Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: 'void-12345')
+      Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: "void-#{generate_authorization}")
     end
 
     def cancel(_response_code, _payment = nil)
-      Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: '12345')
+      Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: generate_authorization)
     end
 
     def test?
@@ -120,9 +120,14 @@ module Spree
       true
     end
 
+    def payment_setup_session_class
+      PaymentSetupSessions::Bogus
+    end
+
     def create_payment_setup_session(customer:, external_data: {})
-      payment_setup_sessions.create(
+      payment_setup_session_class.create(
         customer: customer,
+        payment_method: self,
         status: 'pending',
         external_id: "bogus_seti_#{SecureRandom.hex(12)}",
         external_client_secret: "bogus_seti_secret_#{SecureRandom.hex(8)}",
@@ -150,6 +155,10 @@ module Spree
 
     private
 
+    def generate_authorization
+      "BGS-#{SecureRandom.hex(6)}"
+    end
+
     def generate_profile_id(success)
       record = true
       prefix = success ? 'BGS' : 'FAIL'

data/app/models/spree/import.rb

@@ -76,6 +76,21 @@ module Spree
     #
     preference :delimiter, :string, default: ','
 
+    # Returns true if the import has more rows than the large import threshold.
+    # Large imports skip per-row UI broadcasts and use bulk processing.
+    # @return [Boolean]
+    def large_import?
+      rows_count >= Spree::Config[:large_import_threshold]
+    end
+
+    # Returns the schema field name used to group rows for parallel processing.
+    # Rows sharing the same value in this field are processed together in one job.
+    # Returns nil for imports where rows are independent (default — batched in chunks).
+    # @return [String, nil]
+    def group_column
+      nil
+    end
+
     # Returns true if the import is in mapping state
     # @return [Boolean]
     def mapping?

data/app/models/spree/import_row.rb

@@ -77,9 +77,9 @@ module Spree
       data_json[mapping.file_column]
     end
 
-    def process!
+    def process!(mappings: nil, schema_fields: nil)
       start_processing!
-      self.item = import.row_processor_class.new(self).process!
+      self.item = import.row_processor_class.new(self, mappings: mappings, schema_fields: schema_fields).process!
       complete!
     rescue StandardError => e
       Rails.error.report(e, handled: true, context: { import_row_id: id }, source: 'spree.core')
@@ -87,6 +87,18 @@ module Spree
       fail!
     end
 
+    # Bulk processing mode for large imports.
+    # Uses update_columns to skip callbacks, validations, and event publishing.
+    def bulk_process!(mappings:, schema_fields:)
+      update_columns(status: 'processing', updated_at: Time.current)
+      processor = import.row_processor_class.new(self, mappings: mappings, schema_fields: schema_fields)
+      self.item = processor.process!
+      update_columns(status: 'completed', item_type: item.class.name, item_id: item.id, updated_at: Time.current)
+    rescue StandardError => e
+      Rails.error.report(e, handled: true, context: { import_row_id: id }, source: 'spree.core')
+      update_columns(status: 'failed', validation_errors: e.message, updated_at: Time.current)
+    end
+
     def publish_import_row_completed_event
       publish_event('import_row.completed')
     end

data/app/models/spree/imports/product_translations.rb

@@ -5,6 +5,10 @@ module Spree
         Spree::Imports::RowProcessors::ProductTranslation
       end
 
+      def group_column
+        'slug'
+      end
+
       def model_class
         Spree::Product
       end

data/app/models/spree/imports/products.rb

@@ -4,6 +4,11 @@ module Spree
       def row_processor_class
         Spree::Imports::RowProcessors::ProductVariant
       end
+
+      # Group by slug: product row + its variant rows must be processed together
+      def group_column
+        'slug'
+      end
     end
   end
 end

data/app/models/spree/line_item.rb

@@ -293,7 +293,7 @@ module Spree
     end
 
     def verify_order_inventory_before_destroy
-      Spree::OrderInventory.new(order, self).verify(target_shipment)
+      Spree::OrderInventory.new(order, self).verify(target_shipment, removing: true)
     end
 
     def update_adjustments

data/app/models/spree/market.rb

@@ -28,6 +28,7 @@ module Spree
     # Callbacks
     #
     before_save :ensure_single_default
+    before_destroy :ensure_can_be_deleted
 
     #
     # Scopes
@@ -80,12 +81,36 @@ module Spree
       @supported_locales_list ||= (supported_locales.to_s.split(',').map(&:strip) << default_locale).compact.uniq.sort
     end
 
+    # Returns true when the market is safe to delete. A market cannot be deleted
+    # if it is the default market or the only market in the store, since
+    # Spree::Current.currency would have no fallback.
+    #
+    # @return [Boolean]
+    def can_be_deleted?
+      !default? && !last_in_store?
+    end
+
     private
 
+    def last_in_store?
+      !self.class.where(store_id: store_id).where.not(id: id).exists?
+    end
+
     def ensure_single_default
       return unless default? && default_changed?
 
       self.class.where(store_id: store_id, default: true).where.not(id: id).update_all(default: false)
     end
+
+    def ensure_can_be_deleted
+      return if can_be_deleted?
+
+      if default?
+        errors.add(:base, :cannot_destroy_default_market)
+      else
+        errors.add(:base, :cannot_destroy_last_market)
+      end
+      throw(:abort)
+    end
   end
 end

data/app/models/spree/order_inventory.rb

@@ -17,13 +17,23 @@ module Spree
     # In case shipment is passed the stock location should only unstock or
     # restock items if the order is completed. That is so because stock items
     # are always unstocked when the order is completed through +shipment.finalize+
-    def verify(shipment = nil, is_updated: false)
+    def verify(shipment = nil, is_updated: false, removing: false)
       return unless order.completed? || shipment.present?
 
       units_count = inventory_units.reload.sum(&:quantity)
       line_item_changed = is_updated ? !line_item.saved_changes? : !line_item.changed?
 
-      if units_count < line_item.quantity
+      if removing
+        # When the line item is being destroyed, only remove existing inventory.
+        # Adding here would create units that the LineItem `dependent: :destroy`
+        # cascade can't see (set_up_inventory writes through shipment.inventory_units,
+        # leaving line_item.inventory_units stale), producing an orphaned unit.
+        #
+        # Bypass `remove` because it routes through `set_quantity_to_remove` which
+        # assumes a quantity-change scenario; here we want to drain everything tied
+        # to this line item regardless of `line_item.quantity`.
+        remove_all_units(units_count, shipment) if units_count.positive?
+      elsif units_count < line_item.quantity
         quantity = line_item.quantity - units_count
 
         shipment ||= determine_target_shipment
@@ -49,6 +59,18 @@ module Spree
       end
     end
 
+    def remove_all_units(quantity, target_shipment = nil)
+      if target_shipment.present?
+        remove_from_shipment(target_shipment, quantity)
+      else
+        order.shipments.each do |shipment|
+          break if quantity.zero?
+
+          quantity -= remove_from_shipment(shipment, quantity)
+        end
+      end
+    end
+
     def set_quantity_to_remove(units_count)
       if (units_count - line_item.quantity).zero?
         line_item.quantity

data/app/models/spree/payment.rb

@@ -42,6 +42,7 @@ module Spree
 
     validates :payment_method, presence: true
     validates :source, presence: true, if: :source_required?
+    validates :response_code, uniqueness: { scope: [:order_id, :payment_method_id] }, allow_nil: true
     validate :payment_method_available_for_order, on: :create
 
     before_validation :validate_source

data/app/models/spree/payment_session.rb

@@ -92,6 +92,11 @@ module Spree
         p.amount = amount
         p.skip_source_requirement = true
       end
+    rescue ActiveRecord::RecordNotUnique
+      order.payments.find_by!(
+        payment_method: payment_method,
+        response_code: external_id
+      )
     end
 
     private

data/app/models/spree/payment_setup_sessions/bogus.rb

@@ -0,0 +1,4 @@
+module Spree
+  class PaymentSetupSessions::Bogus < PaymentSetupSession
+  end
+end

data/app/models/spree/product.rb

@@ -249,16 +249,11 @@ module Spree
 
       products_to_auto_match_ids = store.products.not_deleted.not_archived.where(id: product_ids).ids
 
-      # for ActiveJob 7.1+
-      if ActiveJob.respond_to?(:perform_all_later)
-        auto_match_taxons_jobs = products_to_auto_match_ids.map do |product_id|
-          Spree::Products::AutoMatchTaxonsJob.new(product_id)
-        end
-
-        ActiveJob.perform_all_later(auto_match_taxons_jobs)
-      else
-        products_to_auto_match_ids.each { |product_id| Spree::Products::AutoMatchTaxonsJob.perform_later(product_id) }
+      auto_match_taxons_jobs = products_to_auto_match_ids.map do |product_id|
+        Spree::Products::AutoMatchTaxonsJob.new(product_id).tap { |job| job.scheduled_at = 30.seconds.from_now }
       end
+
+      ActiveJob.perform_all_later(auto_match_taxons_jobs)
     end
 
     # Can't use short form block syntax due to https://github.com/Netflix/fast_jsonapi/issues/259
@@ -582,7 +577,7 @@ module Spree
       store = stores.find_by(default: true) || stores.first
       return if store.nil? || store.taxons.automatic.none?
 
-      Spree::Products::AutoMatchTaxonsJob.perform_later(id)
+      Spree::Products::AutoMatchTaxonsJob.set(wait: 30.seconds).perform_later(id)
     end
 
     def to_csv(store = nil)

data/app/models/spree/search_provider/base.rb

@@ -13,7 +13,7 @@ module Spree
         @store = store
       end
 
-      # Search, filter, and return facets in one call.
+      # Search and paginate products. Does NOT compute filter facets — use #filters for that.
       #
       # @param scope [ActiveRecord::Relation] base scope (store-scoped, visibility-filtered, authorized)
       # @param query [String, nil] text search query
@@ -26,6 +26,18 @@ module Spree
         raise NotImplementedError
       end
 
+      # Compute filter facets, sort options, and total count for the given scope.
+      # Called by the dedicated filters endpoint — kept separate from search_and_filter
+      # to avoid expensive facet queries on every product listing.
+      #
+      # @param scope [ActiveRecord::Relation] base scope
+      # @param query [String, nil] text search query
+      # @param filters [Hash] structured filters
+      # @return [FiltersResult]
+      def filters(scope:, query: nil, filters: {})
+        raise NotImplementedError
+      end
+
       # Index a product — called after product save. No-op for database provider.
       #
       # @param product [Spree::Product] the product to index