spree_core 5.4.2 → 5.5.0.rc1

data/app/services/spree/addresses/update.rb

@@ -11,8 +11,6 @@ module Spree
         default_billing = address_params.key?(:is_default_billing) ? address_params.delete(:is_default_billing) : opts.fetch(:default_billing, false)
         default_shipping = address_params.key?(:is_default_shipping) ? address_params.delete(:is_default_shipping) : opts.fetch(:default_shipping, false)
         address_changes_except = opts.fetch(:address_changes_except, [])
-        create_new_address_on_update = opts.fetch(:create_new_address_on_update, false)
-        Spree::Deprecation.warn('Spree::Addresses::Update create_new_address_on_update parameter is deprecated and will be removed in Spree 5.5.') if create_new_address_on_update
 
         prepare_address_params!(address, address_params)
         address.assign_attributes(address_params)
@@ -36,7 +34,7 @@ module Spree
 
         return success(address) unless address_changed
 
-        if address.editable? && !create_new_address_on_update
+        if address.editable?
           if address.update(address_params)
             if address.user.present?
               assign_to_user_as_default(
@@ -54,11 +52,11 @@ module Spree
             failure(address)
           end
         elsif new_address(address_params).valid?
-          address.destroy unless create_new_address_on_update
+          address.destroy
 
           if new_address.user.present?
-            default_billing = (!create_new_address_on_update && address.user_default_billing?) || default_billing
-            default_shipping = (!create_new_address_on_update && address.user_default_shipping?) || default_shipping
+            default_billing = address.user_default_billing? || default_billing
+            default_shipping = address.user_default_shipping? || default_shipping
 
             assign_to_user_as_default(
               user: new_address.user,
@@ -69,8 +67,8 @@ module Spree
           end
 
           if order.present?
-            order.ship_address = new_address if !create_new_address_on_update && order.ship_address_id == address.id
-            order.bill_address = new_address if !create_new_address_on_update && order.bill_address_id == address.id
+            order.ship_address = new_address if order.ship_address_id == address.id
+            order.bill_address = new_address if order.bill_address_id == address.id
             order.state = 'address'
             order.save
           end

data/app/services/spree/cart/add_item.rb

@@ -6,6 +6,7 @@ module Spree
       def call(order:, variant:, quantity: nil, metadata: {}, public_metadata: {}, private_metadata: {}, options: {})
         ApplicationRecord.transaction do
           run :add_to_line_item
+          run :handle_stock_reservations
           run Spree.cart_recalculate_service
         end
       end
@@ -48,6 +49,15 @@ module Spree
         ::Spree::TaxRate.adjust(order, [line_item]) if line_item_created
         success(order: order, line_item: line_item, line_item_created: line_item_created, options: options)
       end
+
+      def handle_stock_reservations(order:, line_item:, line_item_created:, options:)
+        if order.in_checkout?
+          result = Spree::StockReservations::Reserve.call(order: order)
+          return failure(line_item, result.error) if result.failure?
+        end
+
+        success(order: order, line_item: line_item, line_item_created: line_item_created, options: options)
+      end
     end
   end
 end

data/app/services/spree/cart/empty.rb

@@ -28,6 +28,8 @@ module Spree
           order.persist_totals
           order.restart_checkout_flow
 
+          Spree::StockReservations::Release.call(order: order)
+
           success(order)
         end
       end

data/app/services/spree/cart/remove_line_item.rb

@@ -7,11 +7,21 @@ module Spree
         options ||= {}
         ActiveRecord::Base.transaction do
           order.line_items.destroy(line_item)
+
+          # LineItem dependent: :destroy removes its own reservation row;
+          # remaining items may need a fresh reservation pass when in checkout.
+          if order.in_checkout? && order.line_items.any?
+            result = Spree::StockReservations::Reserve.call(order: order)
+            raise Spree::StockReservations::InsufficientStockError.new(nil, result.error.to_s) if result.failure?
+          end
+
           Spree.cart_recalculate_service.new.call(order: order,
                                                   line_item: line_item,
                                                   options: options)
         end
         success(line_item)
+      rescue Spree::StockReservations::InsufficientStockError => e
+        failure(line_item, e.message)
       end
     end
   end

data/app/services/spree/cart/remove_out_of_stock_items.rb

@@ -9,7 +9,7 @@ module Spree
 
         return success([order, @messages, @warnings]) if order.item_count.zero? || order.line_items.none?
 
-        line_items = order.line_items.includes(variant: [:product, :stock_items, :stock_locations, { stock_items: :stock_location }])
+        line_items = order.line_items.includes(variant: [:product, :stock_locations, { stock_items: [:stock_location, :active_stock_reservations] }])
 
         ActiveRecord::Base.transaction do
           line_items.each do |line_item|

data/app/services/spree/cart/set_quantity.rb

@@ -6,6 +6,7 @@ module Spree
       def call(order:, line_item:, quantity: nil)
         ActiveRecord::Base.transaction do
           run :change_item_quantity
+          run :handle_stock_reservations
           run Spree.cart_recalculate_service
         end
       end
@@ -17,6 +18,15 @@ module Spree
 
         success(order: order, line_item: line_item)
       end
+
+      def handle_stock_reservations(order:, line_item:)
+        if order.in_checkout?
+          result = Spree::StockReservations::Reserve.call(order: order)
+          return failure(line_item, result.error) if result.failure?
+        end
+
+        success(order: order, line_item: line_item)
+      end
     end
   end
 end

data/app/services/spree/carts/complete.rb

@@ -19,6 +19,7 @@ module Spree
           advance_to_complete!(cart)
 
           if cart.reload.complete?
+            Spree::StockReservations::Release.call(order: cart)
             success(cart)
           else
             failure(cart, cart.errors.full_messages.to_sentence.presence || 'Could not complete checkout')

data/app/services/spree/carts/create.rb

@@ -12,6 +12,7 @@ module Spree
         cart = store.carts.create!(
           user: @params.delete(:user),
           market: @params.delete(:market) || Spree::Current.market,
+          channel: @params.delete(:channel) || Spree::Current.channel,
           currency: @params.delete(:currency) || store.default_currency,
           locale: @params.delete(:locale) || Spree::Current.locale
         )

data/app/services/spree/carts/update.rb

@@ -6,6 +6,7 @@ module Spree
       def call(cart:, params:)
         @cart = cart
         @params = params.to_h.deep_symbolize_keys
+        was_in_cart = cart.cart?
 
         ApplicationRecord.transaction do
           assign_cart_attributes
@@ -16,10 +17,10 @@ module Spree
           cart.save!
 
           process_items
+          try_advance
+          sync_stock_reservations(was_in_cart: was_in_cart)
         end
 
-        try_advance
-
         success(cart)
       rescue ActiveRecord::RecordNotFound
         raise
@@ -110,6 +111,21 @@ module Spree
         cart.state = 'address'
       end
 
+      # Three-way dispatch on the cart→checkout transition:
+      # entering checkout → Reserve, mid-checkout mutation → Extend, reverting to cart → Release.
+      # A failed Reserve raises so the enclosing transaction rolls back and the
+      # outer rescue surfaces the error to the API caller.
+      def sync_stock_reservations(was_in_cart:)
+        if cart.cart?
+          Spree::StockReservations::Release.call(order: cart) unless was_in_cart
+        elsif was_in_cart
+          result = Spree::StockReservations::Reserve.call(order: cart)
+          raise Spree::StockReservations::InsufficientStockError.new(nil, result.error.to_s) if result.failure?
+        else
+          Spree::StockReservations::Extend.call(order: cart)
+        end
+      end
+
       # Auto-advance as far as the checkout state machine allows, but never
       # to complete. The complete transition must always be explicit via
       # the /carts/:id/complete endpoint — otherwise gift cards or store

data/app/services/spree/carts/upsert_items.rb

@@ -57,16 +57,16 @@ module Spree
 
       private
 
-      def resolve_variant(store, prefixed_id)
-        return nil if prefixed_id.blank?
+      def resolve_variant(store, variant_id)
+        return nil if variant_id.blank?
 
-        variant = store.variants.find_by_prefix_id(prefixed_id)
+        variant = store.variants.find_by_param(variant_id)
 
         raise ActiveRecord::RecordNotFound.new(
-          "Variant '#{prefixed_id}' not found in this store",
+          "Variant '#{variant_id}' not found in this store",
           'Spree::Variant',
-          'prefix_id',
-          prefixed_id
+          'id',
+          variant_id
         ) unless variant
 
         variant

data/app/services/spree/credit_cards/destroy.rb

@@ -11,7 +11,7 @@ module Spree
           "#{self.class.name} is deprecated and will be removed in Spree 6.0. " \
           'Use card.destroy directly instead. Payment cleanup is now handled ' \
           'automatically by the before_destroy callback in PaymentSourceConcern.',
-          caller
+          caller_locations(2)
         )
 
         if card.destroy

data/app/services/spree/imports/row_processors/customer.rb

@@ -34,7 +34,10 @@ module Spree
         end
 
         def assign_address(user)
-          address = user.bill_address || user.build_bill_address
+          # Save user first so the address can FK to it via user_id (has_many :addresses).
+          user.save! if user.new_record?
+
+          address = user.bill_address || user.addresses.build
           address.firstname = attributes['first_name'].presence || user.first_name
           address.lastname = attributes['last_name'].presence || user.last_name
           address.company = attributes['company'].strip if attributes['company'].present?

data/app/services/spree/imports/row_processors/product_variant.rb

@@ -66,9 +66,18 @@ module Spree
               product = existing_product if existing_product.present?
             end
 
-            product = assign_attributes_to_product(product)
-            product.save!
-            handle_metafields(product) if has_product_attributes?
+            # Store is touched when the import completes
+            Spree::Store.no_touching do
+              product = assign_attributes_to_product(product)
+              product.save!
+            end
+
+            handle_tags(product) if attributes['tags'].present?
+            if has_product_attributes?
+              handle_metafields(product)
+              handle_categories(product)
+            end
+
             product
           else
             # For non-master variants, only look up the product
@@ -89,27 +98,21 @@ module Spree
           if product.new_record?
             product.slug = attributes['slug']
             product.sku = attributes['sku'] if attributes['sku'].present? && options.empty?
+            product.store = store
           end
 
-          product.stores << store if product.stores.exclude?(store)
           product.name = attributes['name'] if attributes['name'].present?
           product.description = attributes['description'] if attributes['description'].present?
           product.meta_title = attributes['meta_title'] if attributes['meta_title'].present?
           product.meta_description = attributes['meta_description'] if attributes['meta_description'].present?
           product.meta_keywords = attributes['meta_keywords'] if attributes['meta_keywords'].present?
           product.status = to_spree_status(attributes['status']) if attributes['status'].present?
-          product.tag_list = attributes['tags'] if attributes['tags'].present?
 
           if options.empty?
             if attributes['shipping_category'].present?
               shipping_category = prepare_shipping_category
               product.shipping_category = shipping_category if shipping_category.present?
             end
-
-            taxons = prepare_taxons
-            # Full product rows (with name/status/description) clear taxons when categories are blank.
-            # Price-only rows (no product attributes) never touch taxons.
-            product.taxons = taxons if taxons.any? || has_product_attributes?
           end
 
           product
@@ -125,47 +128,73 @@ module Spree
           Spree::TaxCategory.find_by(name: tax_category_name)
         end
 
-        def prepare_taxons
-          taxon_pretty_names = [
-            attributes['category1'],
-            attributes['category2'],
-            attributes['category3']
-          ].compact_blank.map(&:strip).uniq
+        def prepare_option_value_variants
+          return [] if options.empty?
 
-          return [] if taxon_pretty_names.empty?
+          ActiveRecord::Base.no_touching do
+            options.map do |option|
+              option_type = find_or_create_option_type!(option[:option_name])
+              option_value = find_or_create_option_value!(option_type, option[:option_value])
 
-          taxons = taxon_pretty_names.map { |taxon_pretty_name| handle_taxon_line(taxon_pretty_name) }
-          taxons.compact
+              # ensure product option types include new option type
+              find_or_create_product_option_type!(option_type)
+
+              Spree::OptionValueVariant.new(option_value: option_value)
+            end
+          end
         end
 
-        def handle_taxon_line(taxon_pretty_name)
-          taxon_names = taxon_pretty_name.strip.split('->').map(&:strip).map(&:presence).compact
-          return if taxon_names.empty?
+        def options
+          @options ||= begin
+            options = []
 
-          taxonomy_name = taxon_names.shift
-          taxonomy = store.taxonomies.with_matching_name(taxonomy_name).first || store.taxonomies.create!(name: taxonomy_name)
+            OPTION_TYPES_COUNT.times.map do |index|
+              next if attributes["option#{index + 1}_name"].blank?
+              next if attributes["option#{index + 1}_value"].blank?
 
-          last_taxon = taxonomy.root
+              options << {
+                index: index + 1,
+                option_name: attributes["option#{index + 1}_name"],
+                option_value: attributes["option#{index + 1}_value"]
+              }
+            end
 
-          taxon_names.each do |taxon_name|
-            last_taxon = taxonomy.taxons.with_matching_name(taxon_name).where(parent: last_taxon).first || taxonomy.taxons.create!(name: taxon_name, parent: last_taxon)
+            options
           end
+        end
+
+        # Concurrent CSV imports can race when creating shared OptionTypes/OptionValues.
+        # Recover the losing worker by re-fetching the peer's row whether the conflict
+        # surfaces via the DB unique index (RecordNotUnique) or the AR uniqueness
+        # validator (RecordInvalid with a :taken error on the relevant attribute).
+        def find_or_create_option_type!(presentation)
+          Spree::OptionType.search_by_name(presentation).first || Spree::OptionType.create!(presentation: presentation)
+        rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid => e
+          raise unless uniqueness_conflict?(e, :name)
 
-          last_taxon
+          Spree::OptionType.search_by_name(presentation).first!
         end
 
-        def prepare_option_value_variants
-          return [] if options.empty?
+        def find_or_create_option_value!(option_type, presentation)
+          option_type.option_values.search_by_name(presentation).first || option_type.option_values.create!(presentation: presentation)
+        rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid => e
+          raise unless uniqueness_conflict?(e, :name)
 
-          options.map do |option|
-            option_type = Spree::OptionType.search_by_name(option[:option_name]).first || Spree::OptionType.create!(presentation: option[:option_name])
-            option_value = option_type.option_values.search_by_name(option[:option_value]).first || option_type.option_values.create!(presentation: option[:option_value])
+          option_type.option_values.search_by_name(presentation).first!
+        end
 
-            # ensure product option types include new option type
-            Spree::ProductOptionType.find_or_create_by!(product: product, option_type: option_type)
+        def find_or_create_product_option_type!(option_type)
+          Spree::ProductOptionType.find_or_create_by!(product: product, option_type: option_type)
+        rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid => e
+          raise unless uniqueness_conflict?(e, :product_id)
 
-            Spree::OptionValueVariant.new(option_value: option_value)
-          end
+          Spree::ProductOptionType.find_by!(product: product, option_type: option_type)
+        end
+
+        # RecordNotUnique is always a uniqueness conflict; RecordInvalid only when the
+        # given attribute has a :taken error (other validation failures must propagate).
+        def uniqueness_conflict?(error, attribute)
+          error.is_a?(ActiveRecord::RecordNotUnique) || error.record.errors.where(attribute, :taken).any?
         end
 
         def handle_images(variant)
@@ -177,27 +206,20 @@ module Spree
 
           return if image_urls.empty?
 
-          image_urls.each do |image_url|
-            Spree::Images::SaveFromUrlJob.perform_later(variant.id, 'Spree::Variant', image_url)
-          end
-        end
-
-        def options
-          @options ||= begin
-            options = []
+          # Always attach to the product so blobs aren't duplicated across
+          # variants. For non-master rows, pass the variant id so the job links
+          # the resulting product-level asset to that variant via VariantMedia.
+          link_variant_id = variant.is_master? ? nil : variant.id
 
-            OPTION_TYPES_COUNT.times.map do |index|
-              next if attributes["option#{index + 1}_name"].blank?
-              next if attributes["option#{index + 1}_value"].blank?
-
-              options << {
-                index: index + 1,
-                option_name: attributes["option#{index + 1}_name"],
-                option_value: attributes["option#{index + 1}_value"]
-              }
-            end
-
-            options
+          image_urls.each do |image_url|
+            Spree::Images::SaveFromUrlJob.perform_later(
+              product.id,
+              'Spree::Product',
+              image_url,
+              nil,
+              nil,
+              link_variant_id
+            )
           end
         end
 
@@ -251,6 +273,22 @@ module Spree
           product.update(metafields_attributes: nested_attrs) unless nested_attrs.empty?
         end
 
+        def handle_tags(product)
+          Spree::Imports::AssignTagsJob.perform_later(product.id, attributes['tags'])
+        end
+
+        def handle_categories(product)
+          Spree::Imports::CreateCategoriesJob.perform_later(product.id, store.id, prepare_taxon_pretty_names)
+        end
+
+        def prepare_taxon_pretty_names
+          [
+            attributes['category1'],
+            attributes['category2'],
+            attributes['category3']
+          ].compact_blank.map(&:strip).uniq
+        end
+
         def to_spree_status(status)
           case status.strip.downcase
           when 'active'

data/app/services/spree/newsletter/link_user.rb

@@ -0,0 +1,53 @@
+module Spree
+  module Newsletter
+    # Reconciles a Spree::NewsletterSubscriber with the customer who owns the email.
+    # Backfills the user link and propagates verified opt-in onto the user record so
+    # consent given before account creation isn't silently lost on registration.
+    #
+    # Best-effort: validation failures are logged but never re-raised. Callers are
+    # already past the point where rolling back makes sense (the user record exists,
+    # the subscription exists). This is reconciliation, not a precondition.
+    class LinkUser
+      def initialize(subscriber:, user:)
+        @subscriber = subscriber
+        @user = user
+      end
+
+      def call
+        return if subscriber.blank? || user.blank?
+        return if subscriber.user_id == user.id && !needs_marketing_propagation?
+
+        link_subscriber_to_user
+        propagate_marketing_consent if needs_marketing_propagation?
+
+        subscriber
+      end
+
+      private
+
+      attr_reader :subscriber, :user
+
+      def link_subscriber_to_user
+        return if subscriber.user_id == user.id
+
+        return if subscriber.update(user: user)
+
+        Rails.logger.warn(
+          "NewsletterSubscriber #{subscriber.id} link to user #{user.id} failed: #{subscriber.errors.full_messages.to_sentence}"
+        )
+      end
+
+      def needs_marketing_propagation?
+        subscriber.verified? && !user.accepts_email_marketing?
+      end
+
+      def propagate_marketing_consent
+        return if user.update(accepts_email_marketing: true)
+
+        Rails.logger.warn(
+          "User #{user.id} accepts_email_marketing update failed: #{user.errors.full_messages.to_sentence}"
+        )
+      end
+    end
+  end
+end

data/app/services/spree/newsletter/subscribe.rb

@@ -1,42 +1,64 @@
 module Spree
   module Newsletter
     class Subscribe
-      def initialize(email:, current_user: nil)
+      def initialize(email:, current_user: nil, current_store: nil, redirect_url: nil)
         @email = email
         @current_user = current_user
+        @current_store = current_store || Spree::Store.current
+        @redirect_url = redirect_url
       end
 
       def call
-        return existed_subscription if existed_subscription.present?
+        if existed_subscription.present?
+          Spree::Newsletter::LinkUser.new(subscriber: existed_subscription, user: known_user).call
+          return existed_subscription
+        end
 
         ActiveRecord::Base.transaction do
           upsert_subscriber
           return subscriber if subscriber.errors.any?
 
+          Spree::Newsletter::LinkUser.new(subscriber: subscriber, user: known_user).call
+
           if subscriber.email == current_user&.email
-            # no need to verified since user email is already verified
+            # User's email is already verified by login — skip the double opt-in.
             Spree::Newsletter::Verify.new(subscriber: subscriber).call
           end
         end
 
-        # publish event to trigger email delivery via subscriber
-        subscriber.publish_event('newsletter_subscriber.subscribed') unless subscriber.verified?
+        subscriber.publish_event('newsletter_subscriber.subscription_requested', subscription_requested_payload) unless subscriber.verified?
         subscriber
       end
 
       private
 
-      attr_reader :email, :current_user
+      attr_reader :email, :current_user, :current_store, :redirect_url
+
+      def subscription_requested_payload
+        payload = {
+          id: subscriber.prefixed_id,
+          email: subscriber.email,
+          verification_token: subscriber.verification_token,
+          store_id: current_store.prefixed_id,
+          customer_id: subscriber.user&.prefixed_id
+        }
+        payload[:redirect_url] = redirect_url if redirect_url.present?
+        payload
+      end
 
       def upsert_subscriber
-        @upsert_subscriber ||= Spree::NewsletterSubscriber.find_or_create_by(email: email) do |new_record|
-          new_record.user = Spree.user_class.find_by(email: new_record.email) || current_user
+        @upsert_subscriber ||= Spree::NewsletterSubscriber.find_or_create_by(email: email, store: current_store) do |new_record|
+          new_record.user = known_user
         end
       end
       alias_method :subscriber, :upsert_subscriber
 
       def existed_subscription
-        @existed_subscription ||= Spree::NewsletterSubscriber.verified.find_by(email: email)
+        @existed_subscription ||= Spree::NewsletterSubscriber.verified.find_by(email: email, store: current_store)
+      end
+
+      def known_user
+        @known_user ||= current_user || Spree.user_class.find_by(email: email)
       end
     end
   end

data/app/services/spree/orders/approve.rb

@@ -3,16 +3,37 @@ module Spree
     class Approve
       prepend Spree::ServiceModule::Base
 
-      def call(order:, approver: nil)
-        changes = { considered_risky: false, approved_at: Time.current }
-        if approver.present?
-          changes[:approver_id] = approver.id
+      # Approves an order and records a Spree::OrderApproval history record.
+      #
+      # The legacy keyword `approver:` remains valid; new keywords (`level:`, `note:`)
+      # are additive and stored on the approval record.
+      #
+      # @param order [Spree::Order]
+      # @param approver [Object, nil] the user/admin who approved
+      # @param level [String, nil] approval level (used by 6.0 multi-level B2B flow)
+      # @param note [String, nil] staff-facing note
+      # @return [Spree::ServiceModule::Result]
+      def call(order:, approver: nil, level: nil, note: nil)
+        decided_at = Time.current
+
+        order.transaction do
+          order.approvals.create!(
+            status: 'approved',
+            level: level,
+            note: note,
+            approver: approver,
+            decided_at: decided_at,
+            created_at: decided_at
+          )
+
+          changes = { considered_risky: false, approved_at: decided_at }
+          changes[:approver_id] = approver.id if approver.present?
+          order.update_columns(changes)
         end
-        order.update_columns(changes)
 
         order.publish_event('order.approved')
         success(order.reload)
-      rescue ActiveRecord::Rollback, ActiveRecord::RecordInvalid, StateMachines::InvalidTransition
+      rescue ActiveRecord::RecordInvalid, StateMachines::InvalidTransition
         failure(order)
       end
     end

data/app/services/spree/orders/build_shipments.rb

@@ -0,0 +1,29 @@
+module Spree
+  module Orders
+    # Shared shipment-building step for admin order Create / Update.
+    #
+    # Rebuilds shipments from scratch (Stock::Coordinator), then layers in
+    # tax, costs, and free-shipping promotions so totals reflect delivery
+    # before payment is requested. Without this, draft orders would expose
+    # delivery_total: 0.0 until completion is attempted — which is too late.
+    #
+    # No-op when the order has no shipping address, no line items, or does
+    # not require delivery (digital orders, etc.).
+    class BuildShipments
+      prepend Spree::ServiceModule::Base
+
+      def call(order:)
+        return success(order) unless order.ship_address_id.present?
+        return success(order) unless order.line_items.any?
+        return success(order) unless order.delivery_required?
+
+        order.create_proposed_shipments
+        order.create_shipment_tax_charge!
+        order.set_shipments_cost
+        order.apply_free_shipping_promotions
+
+        success(order)
+      end
+    end
+  end
+end