spree_core 5.4.2 → 5.5.0.rc1

data/app/models/spree/store_credit.rb

@@ -189,14 +189,6 @@ module Spree
       "#{id}-SC-#{Time.now.utc.strftime('%Y%m%d%H%M%S%6N')}"
     end
 
-    class << self
-      def default_created_by
-        Spree::Deprecation.warn('StoreCredit#default_created_by is deprecated and will be removed in Spree 5.5. Please use store.users.first instead.')
-
-        Spree::Store.current.users.first
-      end
-    end
-
     private
 
     def create_credit_record(amount, action_attributes = {})

data/app/models/spree/store_product.rb

@@ -1,29 +1,17 @@
 module Spree
+  # Thin AR wrapper over the legacy +spree_products_stores+ join table.
+  # Pre-5.5 core used this table to attach products to stores; 5.5+ moved
+  # that responsibility onto +Spree::Product#store_id+ + +ProductPublication+.
+  #
+  # The model exists only to power the 5.4 → 5.5 backfill rake task
+  # (+spree:upgrade:populate_publications+). Host apps upgrading from 5.4
+  # still have the table; after the backfill runs, +spree_multi_store+ (for
+  # multi-store catalogs) keeps the table around, and single-store
+  # installations may drop it.
   class StoreProduct < Spree.base_class
-    has_prefix_id :sp
-
     self.table_name = 'spree_products_stores'
 
-    belongs_to :store, class_name: 'Spree::Store', touch: true
-    belongs_to :product, class_name: 'Spree::Product', touch: true
-
-    validates :store, :product, presence: true
-    validates :store_id, uniqueness: { scope: :product_id }
-
-    def refresh_metrics!
-      return if product.nil?
-
-      completed_order_ids = product.completed_orders.where(store_id: store_id).select(:id)
-      variant_ids = product.variants_including_master.ids
-
-      line_items = Spree::LineItem.joins(:order)
-        .where(spree_orders: { id: completed_order_ids })
-        .where(variant_id: variant_ids)
-
-      update!(
-        units_sold_count: line_items.sum(:quantity),
-        revenue: line_items.sum(:pre_tax_amount)
-      )
-    end
+    belongs_to :product, class_name: 'Spree::Product'
+    belongs_to :store, class_name: 'Spree::Store'
   end
 end

data/app/models/spree/subscriber.rb

@@ -9,7 +9,7 @@ module Spree
   #
   # @example Basic subscriber
   #   class OrderCompletedNotifier < Spree::Subscriber
-  #     subscribes_to 'order.complete'
+  #     subscribes_to 'order.completed'
   #
   #     def call(event)
   #       order_id = event.payload['id']
@@ -19,7 +19,7 @@ module Spree
   #
   # @example Multi-event subscriber
   #   class OrderAuditLogger < Spree::Subscriber
-  #     subscribes_to 'order.complete', 'order.cancel', 'order.resume'
+  #     subscribes_to 'order.completed', 'order.canceled', 'order.resumed'
   #
   #     def call(event)
   #       AuditLog.create!(
@@ -41,11 +41,11 @@ module Spree
   #
   # @example Subscriber with method routing
   #   class PaymentSubscriber < Spree::Subscriber
-  #     subscribes_to 'payment.complete', 'payment.void', 'payment.refund'
+  #     subscribes_to 'payment.completed', 'payment.voided', 'refund.created'
   #
-  #     on 'payment.complete', :handle_complete
-  #     on 'payment.void', :handle_void
-  #     on 'payment.refund', :handle_refund
+  #     on 'payment.completed', :handle_complete
+  #     on 'payment.voided', :handle_void
+  #     on 'refund.created', :handle_refund
   #
   #     private
   #
@@ -64,7 +64,7 @@ module Spree
   #
   # @example Synchronous subscriber (runs immediately, not via ActiveJob)
   #   class CriticalOrderHandler < Spree::Subscriber
-  #     subscribes_to 'order.complete', async: false
+  #     subscribes_to 'order.completed', async: false
   #
   #     def call(event)
   #       # This runs synchronously
@@ -81,10 +81,10 @@ module Spree
       # @return [void]
       #
       # @example
-      #   subscribes_to 'order.complete'
-      #   subscribes_to 'order.complete', 'order.cancel'
+      #   subscribes_to 'order.completed'
+      #   subscribes_to 'order.completed', 'order.canceled'
       #   subscribes_to 'order.*'
-      #   subscribes_to 'order.complete', async: false
+      #   subscribes_to 'order.completed', async: false
       #
       def subscribes_to(*patterns, **options)
         @subscription_patterns ||= []
@@ -102,8 +102,8 @@ module Spree
       # @return [void]
       #
       # @example
-      #   on 'payment.complete', :handle_complete
-      #   on 'payment.void', :handle_void
+      #   on 'payment.completed', :handle_complete
+      #   on 'payment.voided', :handle_void
       #
       def on(pattern, method_name)
         @event_handlers ||= {}

data/app/models/spree/taxon.rb

@@ -340,11 +340,6 @@ module Spree
       end
     end
 
-    def active_products
-      Spree::Deprecation.warn('active_products is deprecated and will be removed in Spree 5.5. Please use taxon.products.active instead.')
-      products.active
-    end
-
     def regenerate_pretty_name_and_permalink
       Mobility.with_locale(nil) do
         update_columns(pretty_name: generate_pretty_name, permalink: generate_slug, updated_at: Time.current)

data/app/models/spree/user_identity.rb

@@ -9,8 +9,7 @@ module Spree
 
     validates :provider, inclusion: {
       in: ->(_record) {
-        config = Rails.application.config.spree
-        (config.store_authentication_strategies.keys + config.admin_authentication_strategies.keys).uniq.map(&:to_s)
+        (Spree.store_authentication_strategies.keys + Spree.admin_authentication_strategies.keys).uniq.map(&:to_s)
       }
     }
 

data/app/models/spree/variant.rb

@@ -8,6 +8,7 @@ module Spree
     include Spree::MemoizedData
     include Spree::Metafields
     include Spree::Metadata
+    include Spree::Searchable
     include Spree::Variant::Webhooks
 
     publishes_lifecycle_events
@@ -36,31 +37,43 @@ module Spree
     with_options inverse_of: :variant do
       has_many :inventory_units
       has_many :line_items
-      has_many :stock_items, dependent: :destroy
+      has_many :stock_items, dependent: :destroy, autosave: true
     end
 
     has_many :orders, through: :line_items
     with_options through: :stock_items do
       has_many :stock_locations
       has_many :stock_movements
+      has_many :stock_reservations
     end
 
     has_many :option_value_variants, class_name: 'Spree::OptionValueVariant'
     has_many :option_values, through: :option_value_variants, dependent: :destroy, class_name: 'Spree::OptionValue'
 
     has_many :images, -> { order(:position) }, as: :viewable, dependent: :destroy, class_name: 'Spree::Asset'
+
+    has_many :variant_media, class_name: 'Spree::VariantMedia', dependent: :destroy
+    # Order through the asset's product-level position so a variant's gallery
+    # follows whatever ordering the merchant set on the product. There's no
+    # per-variant reordering — link/unlink only.
+    has_many :associated_media,
+             -> { order(Spree::Asset.arel_table[:position].asc) },
+             through: :variant_media, source: :asset, class_name: 'Spree::Asset'
+
     belongs_to :primary_media, class_name: 'Spree::Asset', optional: true, foreign_key: :primary_media_id
 
     has_many :prices,
              class_name: 'Spree::Price',
              dependent: :destroy,
-             inverse_of: :variant
+             inverse_of: :variant,
+             autosave: true
 
     has_many :wished_items, dependent: :destroy
 
     has_many :digitals
 
     before_validation :set_cost_currency
+    before_validation :apply_pending_options, if: :pending_options?
 
     validate :check_price, if: -> { Spree::Config.enable_legacy_default_price }
 
@@ -128,11 +141,29 @@ module Spree
 
     scope :with_digital_assets, -> { joins(:digitals) }
 
-    scope :search, ->(query) {
-      next none if query.blank? || query.length < 3
+    # Free-text variant search: SKU, parent product name, and any
+    # option-value presentation (e.g. "Red", "XL"). The 3-char floor
+    # keeps single-letter queries from triggering a full scan.
+    def self.search(query)
+      return none if query.blank? || query.length < 3
 
-      product_name_or_sku_cont(query)
-    }
+      conditions = [
+        search_condition(self, :sku, query),
+        search_condition(Spree::OptionValue, :presentation, query),
+      ]
+
+      if Spree.use_translations?
+        translation_table = Product::Translation.arel_table.alias(Product.translation_table_alias)
+        sanitized = sanitize_query_for_search(query)
+        conditions << translation_table[:name].lower.matches("%#{sanitized}%", '\\')
+      else
+        conditions << search_condition(Spree::Product, :name, query)
+      end
+
+      relation = joins(:product).left_joins(:option_values)
+      relation = relation.join_translation_table(Product) if Spree.use_translations?
+      relation.where(conditions.reduce(:or)).distinct
+    end
 
     # Backward compatibility alias — remove in Spree 6.0
     scope :multi_search, ->(*args) { search(*args) }
@@ -166,8 +197,8 @@ module Spree
 
     self.whitelisted_ransackable_associations = %w[option_values product tax_category prices default_price]
     self.whitelisted_ransackable_attributes = %w[weight depth width height sku discontinue_on is_master cost_price cost_currency track_inventory
-                                                 deleted_at]
-    self.whitelisted_ransackable_scopes = %i(product_name_or_sku_cont search_by_product_name_or_sku)
+                                                 deleted_at product_id]
+    self.whitelisted_ransackable_scopes = %i(product_name_or_sku_cont search_by_product_name_or_sku search)
 
     def self.product_name_or_sku_cont(query)
       sanitized_query = ActiveRecord::Base.sanitize_sql_like(query.to_s.downcase.strip)
@@ -260,16 +291,21 @@ module Spree
     end
 
     # Returns the variant's media gallery.
-    # Currently returns direct images. In 6.0 will use variant_media join table.
+    # Prefers product-level media linked via variant_media (5.5+) — these reuse
+    # a single blob across variants. Falls back to direct variant images for
+    # legacy uploads.
     # @return [ActiveRecord::Relation]
     def gallery_media
+      return associated_media if has_associated_media?
+
       images
     end
 
-    # Returns true if the variant has media.
-    # Uses loaded association when available, otherwise falls back to counter cache.
+    # Returns true if the variant has media (linked product-level or direct images).
+    # Uses loaded associations when available, otherwise falls back to counter cache.
     # @return [Boolean]
     def has_media?
+      return true if has_associated_media?
       return images.any? if images.loaded?
 
       media_count.positive?
@@ -277,6 +313,13 @@ module Spree
 
     alias has_images? has_media?
 
+    # @return [Boolean] true if any product-level media is linked to this variant
+    def has_associated_media?
+      return variant_media.any? if variant_media.loaded?
+
+      variant_media.exists?
+    end
+
     # @deprecated Use #primary_media instead.
     def default_image
       Spree::Deprecation.warn('Spree::Variant#default_image is deprecated and will be removed in Spree 6.0. Please use Spree::Variant#primary_media instead.')
@@ -285,8 +328,10 @@ module Spree
 
     # Updates primary_media_id to the first media item by position.
     # Called when media is added, removed, or reordered.
+    # Uses gallery_media so product-level assets linked via VariantMedia are
+    # considered alongside legacy variant-pinned images.
     def update_thumbnail!
-      first_media = images.order(:position).first
+      first_media = gallery_media.first
       update_column(:primary_media_id, first_media&.id)
     end
 
@@ -330,6 +375,11 @@ module Spree
     # @param options [Array<Hash>] the options to set
     # @return [void]
     def options=(options = {})
+      if product.nil?
+        @pending_options = options
+        return
+      end
+
       options.each do |option|
         next if option[:name].blank? || option[:value].blank?
 
@@ -438,6 +488,51 @@ module Spree
       price_in(currency).try(:compare_at_amount)
     end
 
+    # Syncs base prices from an array of hashes.
+    # Upserts prices for listed currencies, removes base prices for unlisted currencies.
+    # On new records, builds prices in memory (saved when variant is saved).
+    # On persisted records, saves prices immediately and removes unlisted currencies.
+    # An empty array clears every base price — distinguished from `nil` (no
+    # change requested), which falls through to the default ActiveRecord setter.
+    # @param prices_params [Array<Hash>, nil] array of { currency:, amount:, compare_at_amount: }
+    # @return [void]
+    def prices=(prices_params)
+      return super if prices_params.nil? || prices_params.first.is_a?(Spree::Price)
+
+      currencies_in_payload = []
+
+      prices_params.each do |price_data|
+        price_data = price_data.to_h.with_indifferent_access
+        currencies_in_payload << price_data[:currency]
+        set_price(price_data[:currency], price_data[:amount], price_data[:compare_at_amount])
+      end
+
+      # Remove base prices for currencies not in the payload (including the
+      # `prices_params == []` case, which clears every base price).
+      prices.base_prices.where.not(currency: currencies_in_payload).destroy_all if persisted?
+    end
+
+    # Syncs stock items from an array of hashes.
+    # Upserts stock for listed locations, soft-deletes stock items for unlisted locations.
+    # On new records, defers to after_create callback.
+    # @param stock_items_params [Array<Hash>] array of { stock_location_id:, count_on_hand:, backorderable: }
+    # @return [void]
+    def stock_items=(stock_items_params)
+      return super if stock_items_params.blank? || stock_items_params.first.is_a?(Spree::StockItem)
+
+      location_ids_in_payload = []
+
+      stock_items_params.each do |stock_data|
+        stock_data = stock_data.to_h.with_indifferent_access
+        location = Spree::StockLocation.find_by_param(stock_data[:stock_location_id])
+        location_ids_in_payload << location.id
+        set_stock(stock_data[:count_on_hand], stock_data[:backorderable], location)
+      end
+
+      # Soft-delete stock items for locations not in the payload
+      stock_items.where.not(stock_location_id: location_ids_in_payload).destroy_all if persisted?
+    end
+
     # Sets the base price (global price, not for a price list) for the given currency.
     # @param currency [String] the currency to set the price for
     # @param amount [BigDecimal] the amount to set
@@ -465,16 +560,18 @@ module Spree
       Spree::Pricing::Resolver.new(context).resolve
     end
 
-    # Sets the stock for the variant
+    # Sets the stock for the variant at a given location.
+    # Mirrors set_price: find-or-initialize, set attrs, save only if persisted.
     # @param count_on_hand [Integer] the count on hand
     # @param backorderable [Boolean] the backorderable flag
-    # @param stock_location [Spree::StockLocation] the stock location to set the stock for
+    # @param stock_location [Spree::StockLocation] the stock location (defaults to store default)
     # @return [void]
-    def set_stock(count_on_hand, backorderable = nil)
-      stock_item = stock_items.find_or_initialize_by(stock_location: default_stock_location)
+    def set_stock(count_on_hand, backorderable = nil, stock_location = nil)
+      stock_location ||= default_stock_location
+      stock_item = stock_items.find_or_initialize_by(stock_location: stock_location)
       stock_item.count_on_hand = count_on_hand
       stock_item.backorderable = backorderable if backorderable.present?
-      stock_item.save!
+      stock_item.save! if persisted?
     end
 
     def default_stock_location
@@ -532,7 +629,7 @@ module Spree
       @on_sale ||= price_in(currency)&.discounted?
     end
 
-    delegate :total_on_hand, :can_supply?, to: :quantifier
+    delegate :total_on_hand, :available_stock, :reserved_quantity, :can_supply?, to: :quantifier
 
     alias is_backorderable? backorderable?
 
@@ -585,6 +682,23 @@ module Spree
 
     private
 
+    def pending_options?
+      @pending_options.present?
+    end
+
+    def apply_pending_options
+      return unless @pending_options
+
+      options_to_apply = @pending_options
+      @pending_options = nil
+
+      options_to_apply.each do |option|
+        next if option[:name].blank? || option[:value].blank?
+
+        set_option_value(option[:name], option[:value], option[:position])
+      end
+    end
+
     def ensure_not_in_complete_orders
       if orders.complete.any?
         errors.add(:base, :cannot_destroy_if_attached_to_line_items)

data/app/models/spree/variant_media.rb

@@ -0,0 +1,46 @@
+module Spree
+  # FK column is `media_id` (not `asset_id`) to match the 6.0 rename
+  # Spree::Asset → Spree::Media. The `:asset` association name follows the
+  # current parent class; in 6.0 it renames to `:media` without a column change.
+  class VariantMedia < Spree.base_class
+    self.table_name = 'spree_variant_media'
+
+    belongs_to :variant, class_name: 'Spree::Variant', touch: true
+    belongs_to :asset, class_name: 'Spree::Asset', foreign_key: :media_id, inverse_of: :variant_media
+
+    validates :variant, :asset, presence: true
+    validates :media_id, uniqueness: { scope: :variant_id }
+    validate :asset_belongs_to_variant_product
+
+    after_commit :refresh_variant_thumbnail, on: %i[create destroy]
+
+    # Resolves an array of variant identifiers (prefixed ids or raw ids) to the
+    # numeric ids of variants that belong to `product`. Anything else — bad
+    # prefix, foreign product, garbage — is dropped. This is the security
+    # boundary used by Spree::Asset#variant_ids=, so callers (forms, API params)
+    # can't link assets to variants from another product.
+    def self.resolve_variant_ids(product, variant_ids)
+      ids = Array(variant_ids).reject(&:blank?)
+      return [] if ids.empty?
+
+      product.variants.filter_map do |variant|
+        token = variant.id.to_s
+        prefixed = variant.prefixed_id
+        variant.id if ids.any? { |id| id.to_s == token || id == prefixed }
+      end
+    end
+
+    private
+
+    def asset_belongs_to_variant_product
+      return if asset.blank? || variant.blank?
+      return if asset.product&.id == variant.product_id
+
+      errors.add(:asset, 'must belong to the same product as the variant')
+    end
+
+    def refresh_variant_thumbnail
+      variant&.update_thumbnail!
+    end
+  end
+end

data/app/models/spree/webhook_delivery.rb

@@ -19,7 +19,7 @@ module Spree
     scope :for_event, ->(event_name) { where(event_name: event_name) }
 
     # Ransack configuration
-    self.whitelisted_ransackable_attributes = %w[event_name response_code execution_time success delivered_at]
+    self.whitelisted_ransackable_attributes = %w[event_name response_code execution_time success delivered_at created_at]
 
     # Check if the delivery was successful
     #

data/app/models/spree/webhook_endpoint.rb

@@ -22,6 +22,12 @@ module Spree
     validate :url_must_not_resolve_to_private_ip, if: -> { !Rails.env.development? && url.present? && url_changed? }
 
     before_create :generate_secret_key
+    after_create  { @reveal_secret_in_response = true }
+    # Re-enabling via a direct `update(active: true)` (e.g., the dashboard's
+    # edit form) must also clear the auto-disable bookkeeping so the endpoint
+    # rejoins the `enabled` scope. `#enable!` handles this too, but we can't
+    # rely on every call site using it.
+    before_save :clear_disabled_state_when_reactivated
 
     self.whitelisted_ransackable_attributes = %w[name url active]
 
@@ -29,6 +35,17 @@ module Spree
     scope :inactive, -> { where(active: false) }
     scope :enabled, -> { active.where(disabled_at: nil) }
 
+    # Returns the plaintext `secret_key` only on the create response.
+    #
+    # `@reveal_secret_in_response` is set by the `after_create` callback above
+    # — a per-instance flag, not derived from `previous_changes`, so a reload
+    # or any subsequent save can't accidentally re-expose the secret.
+    #
+    # @return [String, nil]
+    def secret_key_for_response
+      @reveal_secret_in_response ? secret_key : nil
+    end
+
     # Number of consecutive failed deliveries before auto-disabling
     AUTO_DISABLE_THRESHOLD = 15
 
@@ -128,6 +145,13 @@ module Spree
       self.secret_key ||= SecureRandom.hex(32)
     end
 
+    def clear_disabled_state_when_reactivated
+      return unless will_save_change_to_active? && active
+
+      self.disabled_at = nil
+      self.disabled_reason = nil
+    end
+
     def url_must_not_resolve_to_private_ip
       uri = URI.parse(url)
       blacklist = SsrfFilter::IPV4_BLACKLIST + SsrfFilter::IPV6_BLACKLIST

data/app/models/spree/wished_item.rb

@@ -16,19 +16,6 @@ module Spree
     validates :variant, uniqueness: { scope: [:wishlist] }
     validates :quantity, numericality: { only_integer: true, greater_than: 0 }
 
-    # This is a workaround to allow the variant_id to be set with a prefixed ID
-    # in the API.
-    #
-    # @param id [String] the prefixed ID of the variant
-    def variant_id=(id)
-      if id.to_s.include?('_')
-        decoded = Spree::Variant.decode_prefixed_id(id)
-        super(decoded)
-      else
-        super(id)
-      end
-    end
-
     def price(currency)
       variant.amount_in(currency[:currency])
     end

data/app/presenters/spree/csv/formula_sanitizer.rb

@@ -0,0 +1,28 @@
+module Spree
+  module CSV
+    # Neutralizes CSV formula injection (CWE-1236 / OWASP "CSV Injection")
+    # by prefixing cells that would otherwise be evaluated as a formula
+    # when the exported file is opened in Excel, Google Sheets, LibreOffice,
+    # or Numbers.
+    #
+    # The leading apostrophe is the OWASP-recommended marker — spreadsheets
+    # render the cell as plain text without displaying the apostrophe.
+    module FormulaSanitizer
+      TRIGGERS = ["=", "+", "-", "@", "\t", "\r", "\n"].freeze
+
+      module_function
+
+      def cell(value)
+        return value unless value.is_a?(String)
+        return value if value.empty?
+        return value unless TRIGGERS.include?(value[0])
+
+        "'#{value}"
+      end
+
+      def row(values)
+        values.map { |v| cell(v) }
+      end
+    end
+  end
+end

data/app/presenters/spree/csv/product_variant_presenter.rb

@@ -53,7 +53,7 @@ module Spree
         @index = index
         @properties = properties
         @taxons = taxons
-        @store = store || product.stores.first
+        @store = store || product.store
         @currency = currency || @store.default_currency
         @price_only = @currency != @store.default_currency
         @metafields = metafields
@@ -100,8 +100,8 @@ module Spree
           variant.dimensions_unit,
           variant.weight,
           variant.weight_unit,
-          variant.available_on&.strftime('%Y-%m-%d %H:%M:%S'),
-          (variant.discontinue_on || product.discontinue_on)&.strftime('%Y-%m-%d %H:%M:%S'),
+          publication_available_on&.strftime('%Y-%m-%d %H:%M:%S'),
+          (variant.discontinue_on || publication_discontinue_on)&.strftime('%Y-%m-%d %H:%M:%S'),
           variant.track_inventory?,
           total_on_hand == BigDecimal::INFINITY ? '∞' : total_on_hand,
           variant.backorderable?,
@@ -137,6 +137,26 @@ module Spree
 
       private
 
+      # Default-channel publication for the export's store. 5.5 transitional:
+      # fall back to the legacy Product columns when the publication dates are
+      # NULL (pre-backfill). 6.0 drops the Product-column fallback.
+      def default_publication
+        return @default_publication if defined?(@default_publication)
+
+        channel_id = store&.default_channel&.id
+        @default_publication = channel_id && product.product_publications.find do |p|
+          p.store_id == store.id && p.channel_id == channel_id
+        end
+      end
+
+      def publication_available_on
+        default_publication&.published_at || product.available_on
+      end
+
+      def publication_discontinue_on
+        default_publication&.unpublished_at || product.discontinue_on
+      end
+
       def price_only_row
         csv = Array.new(CSV_HEADERS.size)
         csv[CSV_HEADERS.index('sku')] = variant.sku

data/app/presenters/spree/search_provider/product_presenter.rb

@@ -58,7 +58,8 @@ module Spree
           status: product.status,
           sku: product.sku,
           in_stock: product.in_stock?,
-          store_ids: product.store_ids.map(&:to_s),
+          store_ids: Array(product.store_id).map(&:to_s),
+          channel_ids: channel_ids_for_store,
           discontinue_on: product.discontinue_on&.to_i || 0,
           category_ids: category_ids_with_ancestors,
           category_names: product.taxons.map { |t| translated(t, :name, fallback_locale) },
@@ -67,7 +68,7 @@ module Spree
           option_value_ids: variant_option_value_ids,
           option_values: variant_option_values_data.map { |ov| translated(ov, :presentation, fallback_locale) }.uniq,
           tags: product.tag_list || [],
-          units_sold_count: product.store_products.find { |sp| sp.store_id == store.id }&.units_sold_count || 0,
+          units_sold_count: product.units_sold_count || 0,
           available_on: product.available_on&.iso8601,
           created_at: product.created_at&.iso8601,
           updated_at: product.updated_at&.iso8601
@@ -107,8 +108,14 @@ module Spree
         @compare_at_cache[currency]
       end
 
-      # Include ancestor category IDs so filtering by a parent category
-      # matches products classified under its descendants.
+      def channel_ids_for_store
+        @channel_ids_for_store ||= product.product_publications
+                                          .joins(:channel)
+                                          .where(spree_channels: { store_id: store.id })
+                                          .pluck(:channel_id)
+                                          .map(&:to_s)
+      end
+
       def category_ids_with_ancestors
         @category_ids_with_ancestors ||= product.taxons.flat_map { |t|
           t.self_and_ancestors.map(&:prefixed_id)

data/app/presenters/spree/variant_presenter.rb

@@ -16,10 +16,11 @@ module Spree
 
     def call
       @variants.map do |variant|
+        price = variant.price_in(current_currency)
         {
-          display_price: display_price(variant),
-          price: variant.price_in(current_currency),
-          display_compare_at_price: display_compare_at_price(variant),
+          display_price: price.display_price_including_vat_for(current_price_options).to_html,
+          price: price,
+          display_compare_at_price: price.display_compare_at_price_including_vat_for(current_price_options).to_html,
           should_display_compare_at_price: should_display_compare_at_price?(variant),
           is_product_available_in_currency: @is_product_available_in_currency,
           backorderable: backorderable?(variant),