spree_core 5.4.3 → 5.5.0.rc1

data/app/models/spree/stock_reservation.rb

@@ -0,0 +1,38 @@
+module Spree
+  class StockReservation < Spree.base_class
+    has_prefix_id :res
+
+    publishes_lifecycle_events
+
+    belongs_to :stock_item, class_name: 'Spree::StockItem', inverse_of: :stock_reservations
+    belongs_to :line_item, class_name: 'Spree::LineItem', inverse_of: :stock_reservations
+    belongs_to :order, class_name: 'Spree::Order', inverse_of: :stock_reservations
+
+    validates :stock_item, :line_item, :order, :quantity, :expires_at, presence: true
+    validates :quantity, numericality: { greater_than: 0, only_integer: true }, presence: true
+    validates :line_item_id, uniqueness: { scope: :stock_item_id }, presence: true
+
+    scope :active, -> { where('spree_stock_reservations.expires_at > ?', Time.current) }
+    scope :expired, -> { where('spree_stock_reservations.expires_at <= ?', Time.current) }
+    scope :for_order, ->(order) { where(order_id: order.id) }
+    scope :for_store, ->(store) {
+      joins(:order).where(spree_orders: { store_id: store.id })
+    }
+
+    self.whitelisted_ransackable_attributes = %w[stock_item_id line_item_id order_id quantity expires_at]
+    self.whitelisted_ransackable_associations = %w[stock_item line_item order]
+
+    def active?
+      expires_at > Time.current
+    end
+
+    # Resolves the reservation TTL: per-Store preference if set, otherwise
+    # the global Spree::Config[:default_stock_reservation_ttl_minutes]. Falls
+    # back to 10 minutes if both are unset (e.g. early-boot / fixture state).
+    def self.ttl_for(order)
+      minutes = order&.store&.preferred_stock_reservation_ttl_minutes
+      minutes = Spree::Config[:default_stock_reservation_ttl_minutes] if minutes.blank?
+      minutes.to_i.then { |m| m > 0 ? m : 10 }.minutes
+    end
+  end
+end

data/app/models/spree/stock_reservations/insufficient_stock_error.rb

@@ -0,0 +1,12 @@
+module Spree
+  module StockReservations
+    class InsufficientStockError < StandardError
+      attr_reader :line_item
+
+      def initialize(line_item, message)
+        @line_item = line_item
+        super(message)
+      end
+    end
+  end
+end

data/app/models/spree/store.rb

@@ -12,8 +12,10 @@ module Spree
     include Spree::Metadata
     include Spree::Stores::Setup
     include Spree::Stores::Markets
+    include Spree::Stores::Channels
     include Spree::Security::Stores if defined?(Spree::Security::Stores)
     include Spree::UserManagement
+    include Spree::OrderRouting::HasStrategyPreference
 
     #
     # Magic methods
@@ -46,6 +48,7 @@ module Spree
     # Checkout preferences
     preference :guest_checkout, :boolean, default: true
     preference :special_instructions_enabled, :boolean, default: false
+    preference :stock_reservation_ttl_minutes, :integer, default: 10
     # Address preferences
     preference :company_field_enabled, :boolean, default: false
     # digital assets preferences
@@ -54,6 +57,9 @@ module Spree
     preference :digital_asset_authorized_clicks, :integer, default: 5
     preference :digital_asset_authorized_days, :integer, default: 7
     preference :digital_asset_link_expire_time, :integer, default: 300
+    # Class name of the Spree::OrderRouting::Strategy::Base subclass that
+    # decides which StockLocation fulfills which items.
+    preference :order_routing_strategy, :string, default: 'Spree::OrderRouting::Strategy::Rules'
 
     #
     # Associations
@@ -71,10 +77,11 @@ module Spree
     has_many :store_payment_methods, class_name: 'Spree::StorePaymentMethod'
     has_many :payment_methods, through: :store_payment_methods, class_name: 'Spree::PaymentMethod'
 
-    has_many :store_products, class_name: 'Spree::StoreProduct'
-    has_many :products, through: :store_products, class_name: 'Spree::Product'
+    has_many :products, class_name: 'Spree::Product', dependent: :nullify
+    has_many :product_publications, through: :channels, source: :publications, class_name: 'Spree::ProductPublication'
     has_many :variants, through: :products, class_name: 'Spree::Variant', source: :variants_including_master
     has_many :stock_items, through: :variants, class_name: 'Spree::StockItem'
+    has_many :prices, through: :variants, class_name: 'Spree::Price'
     has_many :inventory_units, through: :variants, class_name: 'Spree::InventoryUnit'
     has_many :option_value_variants, through: :variants, class_name: 'Spree::OptionValueVariant'
     has_many :customer_returns, class_name: 'Spree::CustomerReturn', inverse_of: :store
@@ -108,6 +115,9 @@ module Spree
     has_many :webhook_endpoints, class_name: 'Spree::WebhookEndpoint', dependent: :destroy, inverse_of: :store
     has_many :webhook_deliveries, through: :webhook_endpoints, class_name: 'Spree::WebhookDelivery'
 
+    has_many :channels, class_name: 'Spree::Channel', dependent: :destroy
+    has_many :order_routing_rules, through: :channels, class_name: 'Spree::OrderRoutingRule'
+
     has_many :customer_groups, class_name: 'Spree::CustomerGroup', dependent: :destroy, inverse_of: :store
 
     has_many :api_keys, class_name: 'Spree::ApiKey', dependent: :destroy
@@ -121,6 +131,7 @@ module Spree
     end
     validates :preferred_digital_asset_authorized_clicks, numericality: { only_integer: true, greater_than: 0 }
     validates :preferred_digital_asset_authorized_days, numericality: { only_integer: true, greater_than: 0 }
+    validates :preferred_stock_reservation_ttl_minutes, numericality: { only_integer: true, greater_than: 0 }
     validates :mail_from_address, email: { allow_blank: false }
     # FIXME: we should remove this condition in v5
     if !ENV['SPREE_DISABLE_DB_CONNECTION'] &&
@@ -141,7 +152,6 @@ module Spree
     # Callbacks
     before_validation :set_default_code, on: :create
     before_save :ensure_default_exists_and_is_unique
-    after_create :ensure_default_market
     after_create :create_default_policies
 
     #
@@ -165,7 +175,7 @@ module Spree
       else
         Spree::Deprecation.warn(
           'Spree::Store.default returning a new unpersisted store when no default store exists is deprecated ' \
-          'and will be removed in Spree 5.5. Please ensure a default store is created before calling Store.default.'
+          'and will be removed in Spree 6.0. Please ensure a default store is created before calling Store.default.'
         )
         new(default: true)
       end
@@ -175,6 +185,10 @@ module Spree
       Spree::Store.default&.supported_locales_list || []
     end
 
+    def default_channel
+      channels.find_by(code: Spree::Channel::DEFAULT_CODE) || channels.active.first
+    end
+
     # @deprecated Use Markets instead. Will be removed in Spree 5.5.
     def checkout_zone
       Spree::Deprecation.warn('Store#checkout_zone is deprecated and will be removed in Spree 5.5. Use Markets instead.')
@@ -366,25 +380,6 @@ module Spree
 
     private
 
-    def ensure_default_market
-      return if markets.exists?
-
-      country = @default_country_for_market
-      return if country.blank?
-
-      iso_country = ISO3166::Country[country.iso]
-
-      Spree::Events.disable do
-        markets.create!(
-          name: country.name,
-          currency: iso_country&.currency_code || read_attribute(:default_currency) || 'USD',
-          default_locale: iso_country&.languages_official&.first || read_attribute(:default_locale) || 'en',
-          default: true,
-          countries: [country]
-        )
-      end
-    end
-
     def create_default_policies
       Spree::Events.disable do
         [
@@ -401,55 +396,6 @@ module Spree
       end
     end
 
-    def ensure_default_taxonomies_are_created
-      Spree::Deprecation.warn('Store#ensure_default_taxonomies_are_created is deprecated and will be removed in Spree 5.5. Please remove it from your codebase')
-
-      Spree::Events.disable do
-        [
-          translate_with_store_locale_fallback('spree.taxonomy_categories_name'),
-          translate_with_store_locale_fallback('spree.taxonomy_brands_name'),
-          translate_with_store_locale_fallback('spree.taxonomy_collections_name')
-        ].each do |taxonomy_name|
-          # Manual exists?/create to work around Mobility bug with find_or_create_by
-          next if taxonomies.with_matching_name(taxonomy_name).exists?
-
-          taxonomies.create(name: taxonomy_name)
-        end
-      end
-    end
-
-    def ensure_default_automatic_taxons
-      Spree::Deprecation.warn('Store#ensure_default_automatic_taxons is deprecated and will be removed in Spree 5.5. Please remove it from your codebase')
-
-      Spree::Events.disable do
-        # Use Mobility-safe lookup for taxonomy
-        collections_taxonomy = taxonomies.with_matching_name(translate_with_store_locale_fallback('spree.taxonomy_collections_name')).first
-        return unless collections_taxonomy.present?
-
-        automatic_taxons_config = [
-          { name: translate_with_store_locale_fallback('spree.automatic_taxon_names.on_sale'),
-            rule_type: 'Spree::TaxonRules::Sale', rule_value: 'true' },
-          { name: translate_with_store_locale_fallback('spree.automatic_taxon_names.new_arrivals'), rule_type: 'Spree::TaxonRules::AvailableOn', rule_value: 30 }
-        ]
-
-        automatic_taxons_config.map do |config|
-          # Manual exists?/create to work around Mobility bug with first_or_create
-          taxon_scope = collections_taxonomy.taxons.automatic.with_matching_name(config[:name])
-
-          if taxon_scope.exists?
-            taxon_scope.first
-          else
-            collections_taxonomy.taxons.create!(
-              name: config[:name],
-              automatic: true,
-              parent: collections_taxonomy.root,
-              taxon_rules: [TaxonRule.new(type: config[:rule_type], value: config[:rule_value])]
-            )
-          end
-        end
-      end
-    end
-
     # Translates a key using the store's default locale with fallback to :en
     def translate_with_store_locale_fallback(key)
       locale = default_locale.presence&.to_sym || :en

data/app/models/spree/store_credit.rb

@@ -189,14 +189,6 @@ module Spree
       "#{id}-SC-#{Time.now.utc.strftime('%Y%m%d%H%M%S%6N')}"
     end
 
-    class << self
-      def default_created_by
-        Spree::Deprecation.warn('StoreCredit#default_created_by is deprecated and will be removed in Spree 5.5. Please use store.users.first instead.')
-
-        Spree::Store.current.users.first
-      end
-    end
-
     private
 
     def create_credit_record(amount, action_attributes = {})

data/app/models/spree/store_product.rb

@@ -1,29 +1,17 @@
 module Spree
+  # Thin AR wrapper over the legacy +spree_products_stores+ join table.
+  # Pre-5.5 core used this table to attach products to stores; 5.5+ moved
+  # that responsibility onto +Spree::Product#store_id+ + +ProductPublication+.
+  #
+  # The model exists only to power the 5.4 → 5.5 backfill rake task
+  # (+spree:upgrade:populate_publications+). Host apps upgrading from 5.4
+  # still have the table; after the backfill runs, +spree_multi_store+ (for
+  # multi-store catalogs) keeps the table around, and single-store
+  # installations may drop it.
   class StoreProduct < Spree.base_class
-    has_prefix_id :sp
-
     self.table_name = 'spree_products_stores'
 
-    belongs_to :store, class_name: 'Spree::Store', touch: true
-    belongs_to :product, class_name: 'Spree::Product', touch: true
-
-    validates :store, :product, presence: true
-    validates :store_id, uniqueness: { scope: :product_id }
-
-    def refresh_metrics!
-      return if product.nil?
-
-      completed_order_ids = product.completed_orders.where(store_id: store_id).select(:id)
-      variant_ids = product.variants_including_master.ids
-
-      line_items = Spree::LineItem.joins(:order)
-        .where(spree_orders: { id: completed_order_ids })
-        .where(variant_id: variant_ids)
-
-      update!(
-        units_sold_count: line_items.sum(:quantity),
-        revenue: line_items.sum(:pre_tax_amount)
-      )
-    end
+    belongs_to :product, class_name: 'Spree::Product'
+    belongs_to :store, class_name: 'Spree::Store'
   end
 end

data/app/models/spree/taxon.rb

@@ -340,11 +340,6 @@ module Spree
       end
     end
 
-    def active_products
-      Spree::Deprecation.warn('active_products is deprecated and will be removed in Spree 5.5. Please use taxon.products.active instead.')
-      products.active
-    end
-
     def regenerate_pretty_name_and_permalink
       Mobility.with_locale(nil) do
         update_columns(pretty_name: generate_pretty_name, permalink: generate_slug, updated_at: Time.current)

data/app/models/spree/user_identity.rb

@@ -9,8 +9,7 @@ module Spree
 
     validates :provider, inclusion: {
       in: ->(_record) {
-        config = Rails.application.config.spree
-        (config.store_authentication_strategies.keys + config.admin_authentication_strategies.keys).uniq.map(&:to_s)
+        (Spree.store_authentication_strategies.keys + Spree.admin_authentication_strategies.keys).uniq.map(&:to_s)
       }
     }
 

data/app/models/spree/variant.rb

@@ -8,6 +8,7 @@ module Spree
     include Spree::MemoizedData
     include Spree::Metafields
     include Spree::Metadata
+    include Spree::Searchable
     include Spree::Variant::Webhooks
 
     publishes_lifecycle_events
@@ -36,31 +37,43 @@ module Spree
     with_options inverse_of: :variant do
       has_many :inventory_units
       has_many :line_items
-      has_many :stock_items, dependent: :destroy
+      has_many :stock_items, dependent: :destroy, autosave: true
     end
 
     has_many :orders, through: :line_items
     with_options through: :stock_items do
       has_many :stock_locations
       has_many :stock_movements
+      has_many :stock_reservations
     end
 
     has_many :option_value_variants, class_name: 'Spree::OptionValueVariant'
     has_many :option_values, through: :option_value_variants, dependent: :destroy, class_name: 'Spree::OptionValue'
 
     has_many :images, -> { order(:position) }, as: :viewable, dependent: :destroy, class_name: 'Spree::Asset'
+
+    has_many :variant_media, class_name: 'Spree::VariantMedia', dependent: :destroy
+    # Order through the asset's product-level position so a variant's gallery
+    # follows whatever ordering the merchant set on the product. There's no
+    # per-variant reordering — link/unlink only.
+    has_many :associated_media,
+             -> { order(Spree::Asset.arel_table[:position].asc) },
+             through: :variant_media, source: :asset, class_name: 'Spree::Asset'
+
     belongs_to :primary_media, class_name: 'Spree::Asset', optional: true, foreign_key: :primary_media_id
 
     has_many :prices,
              class_name: 'Spree::Price',
              dependent: :destroy,
-             inverse_of: :variant
+             inverse_of: :variant,
+             autosave: true
 
     has_many :wished_items, dependent: :destroy
 
     has_many :digitals
 
     before_validation :set_cost_currency
+    before_validation :apply_pending_options, if: :pending_options?
 
     validate :check_price, if: -> { Spree::Config.enable_legacy_default_price }
 
@@ -128,11 +141,29 @@ module Spree
 
     scope :with_digital_assets, -> { joins(:digitals) }
 
-    scope :search, ->(query) {
-      next none if query.blank? || query.length < 3
+    # Free-text variant search: SKU, parent product name, and any
+    # option-value presentation (e.g. "Red", "XL"). The 3-char floor
+    # keeps single-letter queries from triggering a full scan.
+    def self.search(query)
+      return none if query.blank? || query.length < 3
 
-      product_name_or_sku_cont(query)
-    }
+      conditions = [
+        search_condition(self, :sku, query),
+        search_condition(Spree::OptionValue, :presentation, query),
+      ]
+
+      if Spree.use_translations?
+        translation_table = Product::Translation.arel_table.alias(Product.translation_table_alias)
+        sanitized = sanitize_query_for_search(query)
+        conditions << translation_table[:name].lower.matches("%#{sanitized}%", '\\')
+      else
+        conditions << search_condition(Spree::Product, :name, query)
+      end
+
+      relation = joins(:product).left_joins(:option_values)
+      relation = relation.join_translation_table(Product) if Spree.use_translations?
+      relation.where(conditions.reduce(:or)).distinct
+    end
 
     # Backward compatibility alias — remove in Spree 6.0
     scope :multi_search, ->(*args) { search(*args) }
@@ -166,8 +197,8 @@ module Spree
 
     self.whitelisted_ransackable_associations = %w[option_values product tax_category prices default_price]
     self.whitelisted_ransackable_attributes = %w[weight depth width height sku discontinue_on is_master cost_price cost_currency track_inventory
-                                                 deleted_at]
-    self.whitelisted_ransackable_scopes = %i(product_name_or_sku_cont search_by_product_name_or_sku)
+                                                 deleted_at product_id]
+    self.whitelisted_ransackable_scopes = %i(product_name_or_sku_cont search_by_product_name_or_sku search)
 
     def self.product_name_or_sku_cont(query)
       sanitized_query = ActiveRecord::Base.sanitize_sql_like(query.to_s.downcase.strip)
@@ -260,16 +291,21 @@ module Spree
     end
 
     # Returns the variant's media gallery.
-    # Currently returns direct images. In 6.0 will use variant_media join table.
+    # Prefers product-level media linked via variant_media (5.5+) — these reuse
+    # a single blob across variants. Falls back to direct variant images for
+    # legacy uploads.
     # @return [ActiveRecord::Relation]
     def gallery_media
+      return associated_media if has_associated_media?
+
       images
     end
 
-    # Returns true if the variant has media.
-    # Uses loaded association when available, otherwise falls back to counter cache.
+    # Returns true if the variant has media (linked product-level or direct images).
+    # Uses loaded associations when available, otherwise falls back to counter cache.
     # @return [Boolean]
     def has_media?
+      return true if has_associated_media?
       return images.any? if images.loaded?
 
       media_count.positive?
@@ -277,6 +313,13 @@ module Spree
 
     alias has_images? has_media?
 
+    # @return [Boolean] true if any product-level media is linked to this variant
+    def has_associated_media?
+      return variant_media.any? if variant_media.loaded?
+
+      variant_media.exists?
+    end
+
     # @deprecated Use #primary_media instead.
     def default_image
       Spree::Deprecation.warn('Spree::Variant#default_image is deprecated and will be removed in Spree 6.0. Please use Spree::Variant#primary_media instead.')
@@ -285,8 +328,10 @@ module Spree
 
     # Updates primary_media_id to the first media item by position.
     # Called when media is added, removed, or reordered.
+    # Uses gallery_media so product-level assets linked via VariantMedia are
+    # considered alongside legacy variant-pinned images.
     def update_thumbnail!
-      first_media = images.order(:position).first
+      first_media = gallery_media.first
       update_column(:primary_media_id, first_media&.id)
     end
 
@@ -330,6 +375,11 @@ module Spree
     # @param options [Array<Hash>] the options to set
     # @return [void]
     def options=(options = {})
+      if product.nil?
+        @pending_options = options
+        return
+      end
+
       options.each do |option|
         next if option[:name].blank? || option[:value].blank?
 
@@ -438,6 +488,51 @@ module Spree
       price_in(currency).try(:compare_at_amount)
     end
 
+    # Syncs base prices from an array of hashes.
+    # Upserts prices for listed currencies, removes base prices for unlisted currencies.
+    # On new records, builds prices in memory (saved when variant is saved).
+    # On persisted records, saves prices immediately and removes unlisted currencies.
+    # An empty array clears every base price — distinguished from `nil` (no
+    # change requested), which falls through to the default ActiveRecord setter.
+    # @param prices_params [Array<Hash>, nil] array of { currency:, amount:, compare_at_amount: }
+    # @return [void]
+    def prices=(prices_params)
+      return super if prices_params.nil? || prices_params.first.is_a?(Spree::Price)
+
+      currencies_in_payload = []
+
+      prices_params.each do |price_data|
+        price_data = price_data.to_h.with_indifferent_access
+        currencies_in_payload << price_data[:currency]
+        set_price(price_data[:currency], price_data[:amount], price_data[:compare_at_amount])
+      end
+
+      # Remove base prices for currencies not in the payload (including the
+      # `prices_params == []` case, which clears every base price).
+      prices.base_prices.where.not(currency: currencies_in_payload).destroy_all if persisted?
+    end
+
+    # Syncs stock items from an array of hashes.
+    # Upserts stock for listed locations, soft-deletes stock items for unlisted locations.
+    # On new records, defers to after_create callback.
+    # @param stock_items_params [Array<Hash>] array of { stock_location_id:, count_on_hand:, backorderable: }
+    # @return [void]
+    def stock_items=(stock_items_params)
+      return super if stock_items_params.blank? || stock_items_params.first.is_a?(Spree::StockItem)
+
+      location_ids_in_payload = []
+
+      stock_items_params.each do |stock_data|
+        stock_data = stock_data.to_h.with_indifferent_access
+        location = Spree::StockLocation.find_by_param(stock_data[:stock_location_id])
+        location_ids_in_payload << location.id
+        set_stock(stock_data[:count_on_hand], stock_data[:backorderable], location)
+      end
+
+      # Soft-delete stock items for locations not in the payload
+      stock_items.where.not(stock_location_id: location_ids_in_payload).destroy_all if persisted?
+    end
+
     # Sets the base price (global price, not for a price list) for the given currency.
     # @param currency [String] the currency to set the price for
     # @param amount [BigDecimal] the amount to set
@@ -465,16 +560,18 @@ module Spree
       Spree::Pricing::Resolver.new(context).resolve
     end
 
-    # Sets the stock for the variant
+    # Sets the stock for the variant at a given location.
+    # Mirrors set_price: find-or-initialize, set attrs, save only if persisted.
     # @param count_on_hand [Integer] the count on hand
     # @param backorderable [Boolean] the backorderable flag
-    # @param stock_location [Spree::StockLocation] the stock location to set the stock for
+    # @param stock_location [Spree::StockLocation] the stock location (defaults to store default)
     # @return [void]
-    def set_stock(count_on_hand, backorderable = nil)
-      stock_item = stock_items.find_or_initialize_by(stock_location: default_stock_location)
+    def set_stock(count_on_hand, backorderable = nil, stock_location = nil)
+      stock_location ||= default_stock_location
+      stock_item = stock_items.find_or_initialize_by(stock_location: stock_location)
       stock_item.count_on_hand = count_on_hand
       stock_item.backorderable = backorderable if backorderable.present?
-      stock_item.save!
+      stock_item.save! if persisted?
     end
 
     def default_stock_location
@@ -532,7 +629,7 @@ module Spree
       @on_sale ||= price_in(currency)&.discounted?
     end
 
-    delegate :total_on_hand, :can_supply?, to: :quantifier
+    delegate :total_on_hand, :available_stock, :reserved_quantity, :can_supply?, to: :quantifier
 
     alias is_backorderable? backorderable?
 
@@ -585,6 +682,23 @@ module Spree
 
     private
 
+    def pending_options?
+      @pending_options.present?
+    end
+
+    def apply_pending_options
+      return unless @pending_options
+
+      options_to_apply = @pending_options
+      @pending_options = nil
+
+      options_to_apply.each do |option|
+        next if option[:name].blank? || option[:value].blank?
+
+        set_option_value(option[:name], option[:value], option[:position])
+      end
+    end
+
     def ensure_not_in_complete_orders
       if orders.complete.any?
         errors.add(:base, :cannot_destroy_if_attached_to_line_items)

data/app/models/spree/variant_media.rb

@@ -0,0 +1,46 @@
+module Spree
+  # FK column is `media_id` (not `asset_id`) to match the 6.0 rename
+  # Spree::Asset → Spree::Media. The `:asset` association name follows the
+  # current parent class; in 6.0 it renames to `:media` without a column change.
+  class VariantMedia < Spree.base_class
+    self.table_name = 'spree_variant_media'
+
+    belongs_to :variant, class_name: 'Spree::Variant', touch: true
+    belongs_to :asset, class_name: 'Spree::Asset', foreign_key: :media_id, inverse_of: :variant_media
+
+    validates :variant, :asset, presence: true
+    validates :media_id, uniqueness: { scope: :variant_id }
+    validate :asset_belongs_to_variant_product
+
+    after_commit :refresh_variant_thumbnail, on: %i[create destroy]
+
+    # Resolves an array of variant identifiers (prefixed ids or raw ids) to the
+    # numeric ids of variants that belong to `product`. Anything else — bad
+    # prefix, foreign product, garbage — is dropped. This is the security
+    # boundary used by Spree::Asset#variant_ids=, so callers (forms, API params)
+    # can't link assets to variants from another product.
+    def self.resolve_variant_ids(product, variant_ids)
+      ids = Array(variant_ids).reject(&:blank?)
+      return [] if ids.empty?
+
+      product.variants.filter_map do |variant|
+        token = variant.id.to_s
+        prefixed = variant.prefixed_id
+        variant.id if ids.any? { |id| id.to_s == token || id == prefixed }
+      end
+    end
+
+    private
+
+    def asset_belongs_to_variant_product
+      return if asset.blank? || variant.blank?
+      return if asset.product&.id == variant.product_id
+
+      errors.add(:asset, 'must belong to the same product as the variant')
+    end
+
+    def refresh_variant_thumbnail
+      variant&.update_thumbnail!
+    end
+  end
+end

data/app/models/spree/webhook_delivery.rb

@@ -19,7 +19,7 @@ module Spree
     scope :for_event, ->(event_name) { where(event_name: event_name) }
 
     # Ransack configuration
-    self.whitelisted_ransackable_attributes = %w[event_name response_code execution_time success delivered_at]
+    self.whitelisted_ransackable_attributes = %w[event_name response_code execution_time success delivered_at created_at]
 
     # Check if the delivery was successful
     #

data/app/models/spree/webhook_endpoint.rb

@@ -22,6 +22,12 @@ module Spree
     validate :url_must_not_resolve_to_private_ip, if: -> { !Rails.env.development? && url.present? && url_changed? }
 
     before_create :generate_secret_key
+    after_create  { @reveal_secret_in_response = true }
+    # Re-enabling via a direct `update(active: true)` (e.g., the dashboard's
+    # edit form) must also clear the auto-disable bookkeeping so the endpoint
+    # rejoins the `enabled` scope. `#enable!` handles this too, but we can't
+    # rely on every call site using it.
+    before_save :clear_disabled_state_when_reactivated
 
     self.whitelisted_ransackable_attributes = %w[name url active]
 
@@ -29,6 +35,17 @@ module Spree
     scope :inactive, -> { where(active: false) }
     scope :enabled, -> { active.where(disabled_at: nil) }
 
+    # Returns the plaintext `secret_key` only on the create response.
+    #
+    # `@reveal_secret_in_response` is set by the `after_create` callback above
+    # — a per-instance flag, not derived from `previous_changes`, so a reload
+    # or any subsequent save can't accidentally re-expose the secret.
+    #
+    # @return [String, nil]
+    def secret_key_for_response
+      @reveal_secret_in_response ? secret_key : nil
+    end
+
     # Number of consecutive failed deliveries before auto-disabling
     AUTO_DISABLE_THRESHOLD = 15
 
@@ -128,6 +145,13 @@ module Spree
       self.secret_key ||= SecureRandom.hex(32)
     end
 
+    def clear_disabled_state_when_reactivated
+      return unless will_save_change_to_active? && active
+
+      self.disabled_at = nil
+      self.disabled_reason = nil
+    end
+
     def url_must_not_resolve_to_private_ip
       uri = URI.parse(url)
       blacklist = SsrfFilter::IPV4_BLACKLIST + SsrfFilter::IPV6_BLACKLIST