spree_core 5.5.4 → 5.6.0.rc1

data/app/models/spree/translations/batch.rb

@@ -0,0 +1,104 @@
+module Spree
+  module Translations
+    # Atomically upserts translations across MANY records of (possibly)
+    # different translatable resource types in one operation — the domain
+    # behind +POST /api/v3/admin/translations/batch+.
+    #
+    # The input is a flat list of independent registry writes, each naming its
+    # own +resource_type+ + +resource_id+ (no nested parent-owns-children
+    # payload), so there's no per-model branching. Records are resolved within
+    # the current store, then upserted in a single transaction: any failure
+    # rolls back the whole batch and surfaces the offending entry's index via a
+    # typed {EntryError}.
+    #
+    # @example
+    #   Spree::Translations::Batch.new(entries).process! do |record|
+    #     authorize!(:update, record)
+    #   end
+    class Batch
+      include ActiveModel::Model
+
+      # Raised when the batch payload is empty (or not a list of entries).
+      class EmptyError < StandardError; end
+
+      # Raised when an entry can't be processed — unknown/non-translatable
+      # resource type, a record missing in the current store, or an invalid
+      # save. Carries the entry +index+ so the caller can map the error back to
+      # the offending row.
+      class EntryError < StandardError
+        attr_reader :index
+
+        def initialize(message, index)
+          @index = index
+          super(message)
+        end
+      end
+
+      # @return [Array<Spree.base_class>] records written by the last successful {#process!}
+      attr_reader :records
+
+      # @param entries [Array<Hash>] [{ resource_type:, resource_id:, values: { locale => { field => value } } }]
+      def initialize(entries)
+        @entries = Array(entries)
+        @records = []
+      end
+
+      # Distinct +write_<resource>+ scopes a caller needs to authorize this
+      # batch — one per resource type present. Lets the API layer gate an
+      # API-key request without re-deriving scope names.
+      # @return [Array<String>]
+      def required_scopes
+        @entries.map { |entry| "write_#{entry[:resource_type].to_s.pluralize}" }.uniq
+      end
+
+      # Upserts every entry in one transaction. Yields each resolved record
+      # before it is written so the caller can authorize it; a raised error in
+      # the block (or any entry failure) rolls back the whole batch.
+      #
+      # @yieldparam record [Spree.base_class] the resolved record, pre-write
+      # @raise [EmptyError] when there are no entries
+      # @raise [EntryError] when an entry can't be resolved or saved
+      # @return [Array<Spree.base_class>] the written records
+      def process!
+        raise EmptyError if @entries.empty?
+
+        @records = []
+        ActiveRecord::Base.transaction do
+          @entries.each_with_index do |entry, index|
+            record = resolve_record!(entry, index)
+            yield record if block_given?
+            upsert!(record, entry[:values], index)
+            @records << record
+          end
+        end
+        @records
+      end
+
+      private
+
+      def upsert!(record, values, index)
+        record.upsert_translations(values)
+      rescue ActiveRecord::RecordInvalid => e
+        raise EntryError.new(e.record.errors.full_messages.join(', '), index)
+      end
+
+      def resolve_record!(entry, index)
+        klass = resource_class(entry[:resource_type])
+        raise EntryError.new("Unknown translatable resource type: #{entry[:resource_type]}", index) if klass.nil?
+
+        relation = klass.respond_to?(:for_store) ? klass.for_store(Spree::Store.current) : klass
+        relation.find_by_prefix_id!(entry[:resource_id])
+      rescue ActiveRecord::RecordNotFound
+        raise EntryError.new("Resource not found: #{entry[:resource_id]}", index)
+      end
+
+      # Memoized per instance so a batch of N entries doesn't rebuild the
+      # registry map N times. A Batch is request-scoped, so dev-mode class
+      # reloads are still picked up on the next request.
+      def resource_class(token)
+        @resource_class_map ||= Hash.new { |h, t| h[t] = Spree::Translations.resource_class(t) }
+        @resource_class_map[token]
+      end
+    end
+  end
+end

data/app/models/spree/variant.rb

@@ -13,7 +13,7 @@ module Spree
 
     publishes_lifecycle_events
 
-    MEMOIZED_METHODS = %w(purchasable in_stock on_sale backorderable tax_category options_text compare_at_price)
+    MEMOIZED_METHODS = %w(in_stock on_sale backorderable tax_category options_text compare_at_price)
 
     DIMENSION_UNITS = %w[mm cm in ft]
     WEIGHT_UNITS = %w[g kg lb oz]
@@ -88,6 +88,8 @@ module Spree
     validates :dimensions_unit, inclusion: { in: DIMENSION_UNITS }, allow_blank: true
     validates :weight_unit, inclusion: { in: WEIGHT_UNITS }, allow_blank: true
 
+    validates :backorder_limit, numericality: { only_integer: true, greater_than_or_equal_to: 0, allow_nil: true }
+
     after_create :create_stock_items
     after_create :set_master_out_of_stock, unless: :is_master?
     after_commit :clear_line_items_cache, on: :update
@@ -238,6 +240,19 @@ module Spree
       !discontinued? && product.available?
     end
 
+    # Returns true if the variant is sold as a pre-order: the product is active
+    # and not deleted, the variant is flagged preorderable and not discontinued,
+    # and the "ships by" date is open-ended or still in the future.
+    # Pre-order relaxes only the publish-date embargo, not the rest of the
+    # availability rules. Like backorder, a pre-order can make the variant
+    # purchasable beyond on-hand stock; the oversell cap is +backorder_limit+
+    # (empty ⇒ unlimited), and it adds the ship-by promise.
+    # @return [Boolean] true if the variant is a pre-order
+    def preorder?
+      !discontinued? && preorderable? && product.active? && !product.deleted? &&
+        (preorder_ships_at.nil? || preorder_ships_at > Time.current)
+    end
+
     # Returns true if the variant is in stock or backorderable.
     # @return [Boolean] true if the variant is in stock or backorderable
     def in_stock_or_backorderable?
@@ -647,7 +662,19 @@ module Spree
     alias is_backorderable? backorderable?
 
     def purchasable?
-      @purchasable ||= in_stock? || backorderable?
+      in_stock? || oversellable_now?
+    end
+
+    # Whether the variant can currently be bought by overselling — via
+    # backorder or pre-order. Unlimited when +backorder_limit+ is nil (empty =
+    # no cap); with a limit, purchasable only while the oversell allowance
+    # remains.
+    #
+    # @return [Boolean]
+    def oversellable_now?
+      return false unless backorderable? || preorder?
+
+      backorder_limit.nil? || can_supply?(1)
     end
 
     # Shortcut method to determine if inventory tracking is enabled for this variant

data/app/models/spree/webhook_delivery.rb

@@ -7,11 +7,6 @@ module Spree
     belongs_to :webhook_endpoint, class_name: 'Spree::WebhookEndpoint'
     delegate :url, to: :webhook_endpoint
 
-    # Credentials stripped from the persisted payload. Never written to the
-    # database — held in memory on a single delivery instance, assigned by
-    # WebhookDeliveryJob when it runs. See {Spree::WebhookPayloadRedaction}.
-    attr_accessor :payload_secrets
-
     validates :event_name, presence: true
     validates :payload, presence: true
 
@@ -69,23 +64,6 @@ module Spree
       webhook_endpoint.check_auto_disable! unless is_success
     end
 
-    # Payload as it should be sent over the wire.
-    #
-    # Re-attaches any credentials withheld from the persisted column. Once this
-    # record has been reloaded from the database those secrets are gone for
-    # good, so a redelivery sends the redacted placeholder — single-use tokens
-    # are not replayable anyway.
-    #
-    # This is deliberate: keeping a recoverable copy would put the credential
-    # back at rest, which is what redaction exists to prevent. If a delivery is
-    # lost (worker crash between creation and delivery), the customer requests
-    # a new reset, which mints a fresh token.
-    #
-    # @return [Hash]
-    def deliverable_payload
-      Spree::WebhookPayloadRedaction.merge(payload, payload_secrets)
-    end
-
     # Create a new delivery with the same payload and queue it.
     # Used to retry failed deliveries manually.
     #

data/app/presenters/spree/data_feeds/google_presenter.rb

@@ -3,22 +3,6 @@ require 'nokogiri'
 module Spree
   module DataFeeds
     class GooglePresenter < BasePresenter
-      # Optional Google Merchant Center product attributes sourced from
-      # metafields. See https://support.google.com/merchants/answer/7052112
-      OPTIONAL_ATTRIBUTES = %w[
-        brand gtin mpn identifier_exists condition adult multipack is_bundle
-        age_group color gender material pattern size size_type size_system
-        product_length product_width product_height product_weight
-        google_product_category product_type sale_price sale_price_effective_date
-        cost_of_goods_sold unit_pricing_measure unit_pricing_base_measure
-        shipping shipping_label shipping_weight shipping_length shipping_width
-        shipping_height ships_from_country transit_time_label max_handling_time
-        min_handling_time tax tax_category energy_efficiency_class
-        min_energy_efficiency_class max_energy_efficiency_class
-        gtin_source expiration_date custom_label_0 custom_label_1 custom_label_2
-        custom_label_3 custom_label_4 mobile_link additional_image_link
-      ].freeze
-
       # @return [String] RSS XML feed for Google Merchant Center
       def call
         builder = Nokogiri::XML::Builder.new do |xml|
@@ -75,21 +59,10 @@ module Spree
 
       def build_optional_attributes(xml, product)
         product.public_metafields.each do |metafield|
-          key = metafield.metafield_definition.key.parameterize.underscore
-          next unless OPTIONAL_ATTRIBUTES.include?(key)
-
-          append_g_element(xml, key, metafield.value)
+          xml['g'].send(metafield.metafield_definition.key.parameterize.underscore, metafield.value)
         end
       end
 
-      def append_g_element(xml, name, value)
-        parent = xml.parent
-        node = Nokogiri::XML::Node.new(name, parent.document)
-        node.namespace = parent.namespace_scopes.find { |ns| ns.prefix == 'g' }
-        node.content = value
-        parent << node
-      end
-
       def format_title(product, variant)
         parts = [product.name]
         variant.option_values.each do |option_value|

data/app/presenters/spree/search_provider/product_presenter.rb

@@ -58,6 +58,9 @@ module Spree
           status: product.status,
           sku: product.sku,
           in_stock: product.in_stock?,
+          # True when the product has an active pre-order variant, so a
+          # scheduled (future-published) launch still surfaces in search.
+          preorder: product.preorder?,
           store_ids: Array(product.store_id).map(&:to_s),
           channel_ids: channel_ids_for_store,
           discontinue_on: product.discontinue_on&.to_i || 0,

data/app/services/spree/carts/complete.rb

@@ -10,6 +10,9 @@ module Spree
       def call(cart:)
         return success(cart) if cart.completed?
         return failure(cart, 'Order is canceled') if cart.canceled?
+        # Enforced here (not only in the controller) so every completion path —
+        # API, payment-session webhook — honors the channel's guest-checkout gate.
+        return failure(cart, Spree.t(:guest_checkout_not_allowed)) if cart.guest_checkout_disallowed?
 
         cart.with_lock do
           process_payments!(cart) if cart.payment_required?

data/app/services/spree/fulfillments/create.rb

@@ -0,0 +1,259 @@
+module Spree
+  module Fulfillments
+    # Manually creates a fulfillment (Spree::Shipment) on a completed order,
+    # bypassing order routing. Moves the requested quantities of each line
+    # item's not-yet-shipped inventory units out of their current shipments
+    # into the new fulfillment, mirroring externally-managed fulfillment
+    # (3PL, courier API, drop-shipping) back into Spree.
+    #
+    # Stock bookkeeping follows the split/transfer semantics: when the source
+    # and target stock locations differ, moved quantities are restocked at the
+    # source and unstocked at the target. Source shipments left empty are
+    # destroyed and their cost and selected delivery method carry over to the
+    # new fulfillment, unless the caller provides its own +cost+ /
+    # +delivery_method+.
+    #
+    # The resulting cost is frozen only for fulfillments registered with
+    # status: 'shipped' (rate refresh skips shipped shipments). Pending/ready
+    # fulfillments participate in the standard rate machinery — the order
+    # updater re-prices them from the delivery method calculators on the next
+    # recalculation, exactly like shipments created via split/transfer.
+    class Create
+      prepend Spree::ServiceModule::Base
+
+      # @param order [Spree::Order] completed order to fulfill
+      # @param stock_location [Spree::StockLocation] location the fulfillment ships from
+      # @param items [Array<Hash>, nil] `[{ line_item: Spree::LineItem, quantity: Integer }]`;
+      #   nil fulfills every not-yet-shipped unit on the order
+      # @param tracking [String, nil] carrier tracking number
+      # @param delivery_method [Spree::ShippingMethod, nil] carrier; stored as the selected rate.
+      #   Defaults to the delivery method of the drained source fulfillment(s)
+      # @param cost [String, Numeric, nil] explicit shipping cost (e.g. the 3PL's price).
+      #   Defaults to the summed cost of the drained source fulfillment(s), keeping the
+      #   order total unchanged; an explicit cost changes the order total and payment state.
+      #   Guaranteed to persist only with status: 'shipped' — pending fulfillments are
+      #   re-priced by the rate engine (see class docs)
+      # @param status [String, nil] pass 'shipped' to register an already-shipped fulfillment
+      # @param metadata [Hash, nil] metadata stored on the fulfillment
+      # @return [Spree::ServiceModule::Result] the created shipment on success
+      def call(order:, stock_location:, items: nil, tracking: nil, delivery_method: nil, cost: nil, status: nil, metadata: nil)
+        return failure(nil, Spree.t('fulfillments.errors.invalid_status')) unless status.nil? || status == 'shipped'
+
+        cost = parse_cost(cost)
+        return cost if cost.is_a?(Spree::ServiceModule::Result)
+
+        fulfillment = nil
+
+        # The order row is locked before reading fulfillable units so
+        # concurrent creations (e.g. duplicate carrier webhooks) validate and
+        # move units against a serialized snapshot. The API layer already
+        # serializes via with_order_lock; this covers direct service callers.
+        ActiveRecord::Base.transaction do
+          order.lock!
+
+          return failure(nil, Spree.t('fulfillments.errors.order_not_completed')) unless order.completed?
+          return failure(nil, Spree.t('fulfillments.errors.order_canceled')) if order.canceled?
+
+          units_by_line_item = fulfillable_units(order)
+
+          requested = normalize_items(order, items, units_by_line_item)
+          return requested if requested.is_a?(Spree::ServiceModule::Result)
+
+          fulfillment = order.shipments.new(
+            stock_location: stock_location,
+            address_id: order.ship_address_id,
+            tracking: tracking
+          )
+          fulfillment.metadata = metadata if metadata.present?
+          fulfillment.save!
+
+          source_shipments = move_units(order, fulfillment, requested, units_by_line_item)
+          inherited = destroy_drained_shipments(source_shipments, capture_delivery_method: delivery_method.nil?)
+          attach_cost_and_rate(fulfillment, delivery_method, cost, inherited)
+
+          if status == 'shipped'
+            mark_shipped(fulfillment)
+          else
+            fulfillment.update!(order)
+          end
+
+          order.reload.update_with_updater!
+        end
+
+        success(fulfillment.reload)
+      end
+
+      private
+
+      # Units that can still be moved into a manual fulfillment: on-hand or
+      # backordered units sitting in shipments that haven't shipped or been
+      # canceled (canceled shipments already restocked their stock). Loaded
+      # in one query, on-hand first so moved units stay shippable, grouped
+      # by line item for both validation and moving.
+      def fulfillable_units(order)
+        order.inventory_units.
+          on_hand_or_backordered.
+          joins(:shipment).
+          merge(Spree::Shipment.ready_or_pending).
+          preload(:shipment, :variant).
+          order(Arel.sql("CASE WHEN #{Spree::InventoryUnit.table_name}.state = 'on_hand' THEN 0 ELSE 1 END"), :id).
+          group_by(&:line_item_id)
+      end
+
+      def normalize_items(order, items, units_by_line_item)
+        available_for = ->(line_item) { units_by_line_item.fetch(line_item.id, []).sum(&:quantity) }
+
+        if items.nil?
+          derived = order.line_items.filter_map do |line_item|
+            quantity = available_for.call(line_item)
+            { line_item: line_item, quantity: quantity } if quantity.positive?
+          end
+          return failure(nil, Spree.t('fulfillments.errors.no_items_to_fulfill')) if derived.empty?
+
+          return derived
+        end
+
+        return failure(nil, Spree.t('fulfillments.errors.no_items_to_fulfill')) if items.empty?
+
+        # Merge duplicate line item entries, then validate quantities.
+        merged = items.group_by { |item| item[:line_item].id }.values.map do |grouped|
+          { line_item: grouped.first[:line_item], quantity: grouped.sum { |item| item[:quantity].to_i } }
+        end
+
+        merged.each do |item|
+          line_item = item[:line_item]
+          quantity = item[:quantity]
+
+          unless quantity.positive?
+            return failure(nil, Spree.t('fulfillments.errors.invalid_quantity', item: line_item.prefixed_id))
+          end
+
+          available = available_for.call(line_item)
+          if quantity > available
+            return failure(
+              nil,
+              Spree.t('fulfillments.errors.insufficient_quantity',
+                      item: line_item.prefixed_id, requested: quantity, available: available)
+            )
+          end
+        end
+
+        merged
+      end
+
+      # Moves the requested quantities into the fulfillment, on-hand units
+      # first so the new fulfillment is shippable whenever possible. Restocks
+      # the source location and unstocks the target for tracked variants when
+      # the locations differ, keeping stock levels truthful about where the
+      # goods actually leave from.
+      #
+      # @return [Array<Spree::Shipment>] the shipments units were taken from
+      def move_units(order, fulfillment, requested, units_by_line_item)
+        source_shipments = []
+        stock_moves = Hash.new(0)
+
+        requested.each do |item|
+          remaining = item[:quantity]
+
+          units_by_line_item.fetch(item[:line_item].id, []).each do |unit|
+            break if remaining.zero?
+
+            take = [unit.quantity, remaining].min
+            source_shipments << unit.shipment
+            stock_moves[[unit.shipment, unit.variant]] += take
+
+            target = fulfillment.inventory_units.find_or_initialize_by(
+              state: unit.state,
+              variant_id: unit.variant_id,
+              line_item_id: unit.line_item_id,
+              order_id: order.id
+            )
+            target.pending = unit.pending
+            # The quantity column has a database default of 1, so a fresh
+            # record must be set to the moved quantity, not incremented.
+            target.quantity = target.new_record? ? take : target.quantity + take
+            target.save!
+
+            if take == unit.quantity
+              unit.destroy!
+            else
+              unit.update!(quantity: unit.quantity - take)
+            end
+
+            remaining -= take
+          end
+        end
+
+        stock_moves.each do |(source_shipment, variant), quantity|
+          next unless variant.track_inventory?
+          next if source_shipment.stock_location_id == fulfillment.stock_location_id
+
+          source_shipment.stock_location.restock(variant, quantity, source_shipment)
+          fulfillment.stock_location.unstock(variant, quantity, fulfillment)
+        end
+
+        source_shipments.uniq
+      end
+
+      # Destroys fully drained source shipments, capturing what the new
+      # fulfillment inherits from them — the summed cost and the first
+      # selected delivery method, read before destroy since the rates are
+      # deleted along with the shipment. The delivery method lookup costs
+      # queries, so it is skipped when the caller provided its own.
+      #
+      # @return [Hash] `{ cost: BigDecimal, delivery_method: Spree::ShippingMethod or nil }`
+      def destroy_drained_shipments(source_shipments, capture_delivery_method:)
+        inherited = { cost: 0, delivery_method: nil }
+
+        source_shipments.each do |shipment|
+          next unless shipment.inventory_units.sum(:quantity).zero?
+
+          inherited[:cost] += shipment.cost
+          inherited[:delivery_method] ||= shipment.shipping_method if capture_delivery_method
+          shipment.destroy!
+        end
+
+        inherited
+      end
+
+      # The fulfillment inherits the cost and carrier of the shipments it
+      # replaced — keeping the order total (and thus payment state) unchanged —
+      # unless the caller provides its own. Frozen once shipped; see the class
+      # docs for pending-path re-pricing. The carrier rides along as a
+      # selected rate.
+      def attach_cost_and_rate(fulfillment, delivery_method, cost, inherited)
+        effective_cost = cost || inherited[:cost]
+        method = delivery_method || inherited[:delivery_method]
+
+        fulfillment.update_columns(cost: effective_cost) if effective_cost.positive?
+        fulfillment.add_shipping_method(method, true) if method
+      end
+
+      # Strict decimal parsing (same semantics as Shipment#cost=, which the
+      # update_columns freeze path bypasses) — the lenient LocalizedNumber
+      # would turn garbage into 0, and 0 is a legal cost here.
+      #
+      # @return [BigDecimal, Numeric, nil] nil when no cost was given (blank
+      #   counts as omitted); a failure Result for malformed or negative input
+      def parse_cost(cost)
+        return if cost.blank?
+
+        parsed = cost.is_a?(String) ? BigDecimal(cost.strip) : cost
+        return failure(nil, Spree.t('fulfillments.errors.invalid_cost')) if parsed.negative?
+
+        parsed
+      rescue ArgumentError
+        failure(nil, Spree.t('fulfillments.errors.invalid_cost'))
+      end
+
+      # Registers an externally-completed fulfillment: backorders are filled
+      # (the external location evidently had the goods) and the paid-order
+      # readiness gate is bypassed deliberately — the goods already left.
+      def mark_shipped(fulfillment)
+        fulfillment.inventory_units.backordered.each(&:fill_backorder!)
+        fulfillment.update_columns(state: 'ready') unless fulfillment.ready?
+        fulfillment.reload.ship!
+      end
+    end
+  end
+end

data/app/services/spree/locales/set_fallback_locale_for_store.rb

@@ -9,7 +9,13 @@ module Spree
           object[locale] = [store_default_locale]
         end
 
-        fallbacks_instance = I18n::Locale::Fallbacks.new(fallbacks)
+        # Pass the store default as the terminal default so EVERY locale —
+        # including regional variants not in `supported_locales_list` (e.g.
+        # `pt-BR` when only `pt` is configured) — ultimately falls back to it.
+        # The store default resolves to the populated DB column via Mobility's
+        # `column_fallback`, so translated reads never return nil for a locale
+        # that lacks a translation row.
+        fallbacks_instance = I18n::Locale::Fallbacks.new(store_default_locale, fallbacks)
 
         Mobility.store_based_fallbacks = fallbacks_instance
       end

data/app/services/spree/locales.rb

@@ -0,0 +1,52 @@
+module Spree
+  module Locales
+    # Canonical set of locale codes a merchant may translate **data** into
+    # (Mobility-backed content such as product names, descriptions, taxons,
+    # option values, etc.).
+    #
+    # This is deliberately **independent of the admin/storefront UI translation
+    # set** (`Spree.available_locales`, which reflects which `spree_i18n` UI
+    # bundles happen to be installed). In a headless setup the storefront ships
+    # its own UI translations, so the languages a merchant can store content in
+    # must not be constrained by which admin chrome translations exist.
+    #
+    # Codes follow BCP-47 casing (lowercase language, uppercase region —
+    # `pt-BR`, `zh-CN`) so the browser's `Intl.DisplayNames` resolves a clean
+    # localized label for each. The list is the full ISO 639-1 base-language set
+    # plus the regional variants that matter for commerce (British vs. US
+    # English, Brazilian vs. European Portuguese, Simplified vs. Traditional
+    # Chinese, etc.).
+    #
+    # The underlying translation tables accept any locale string, so this list
+    # governs only what the locale pickers offer — it is not a hard storage
+    # constraint.
+    ALL = %w[
+      aa ab ae af ak am an ar as av ay az
+      ba be bg bh bi bm bn bo br bs
+      ca ce ch co cr cs cu cv cy
+      da de de-AT de-CH dv dz
+      ee el en en-AU en-CA en-GB en-IN en-NZ eo es es-419 es-MX et eu
+      fa ff fi fj fo fr fr-CA fy
+      ga gd gl gn gu gv
+      ha he hi ho hr ht hu hy hz
+      ia id ie ig ii ik io is it iu
+      ja jv
+      ka kg ki kj kk kl km kn ko kr ks ku kv kw ky
+      la lb lg li ln lo lt lu lv
+      mg mh mi mk ml mn mr ms mt my
+      na nb nd ne ng nl nn no nr nv ny
+      oc oj om or os
+      pa pi pl ps pt pt-BR pt-PT
+      qu
+      rm rn ro ru rw
+      sa sc sd se sg si sk sl sm sn so sq sr ss st su sv sw
+      ta te tg th ti tk tl tn to tr ts tt tw ty
+      ug uk ur uz
+      ve vi vo
+      wa wo
+      xh
+      yi yo
+      za zh-CN zh-HK zh-TW zu
+    ].freeze
+  end
+end