spree_core 5.5.4 → 5.6.0.rc1

data/app/services/spree/products/prepare_nested_attributes.rb

@@ -7,6 +7,12 @@ module Spree
     # from other stores are preserved. This prevents accidental data loss when a store
     # admin updates product categories in their store without affecting other stores.
     #
+    # Variant removal is opt-in: only variants explicitly listed in the
+    # `removed_variant_ids` param are marked for destruction (or collected for
+    # discontinuation when they have completed orders). Variants merely absent from
+    # `variants_attributes` are left untouched, so a partially rendered or broken
+    # form can never silently mass-delete variants.
+    #
     # @example
     #   service = Spree::Products::PrepareNestedAttributes.new(
     #     product,
@@ -28,10 +34,13 @@ module Spree
       end
 
       def call
+        extract_removed_variant_ids
+
         if params[:variants_attributes]
           params[:variants_attributes].each do |key, variant_params|
             existing_variant = variant_params[:id].presence && @product.variants.find_by(id: variant_params[:id])
-            variants_to_remove.delete(variant_params[:id]) if variant_params[:id].present?
+            # a re-submitted variant always wins over a removal request
+            variants_to_remove.delete(variant_params[:id].to_s) if variant_params[:id].present?
 
             variant_params.delete(:price) # remove legacy price param
 
@@ -72,17 +81,20 @@ module Spree
         # ensure the product is owned by a store
         params[:store_id] = store.id if params[:store_id].blank? && product.store_id.blank?
 
-        # Add empty list for option_type_ids and mark variants as removed if there are no variants and options
-        if params[:variants_attributes].blank? && variants_to_remove.any? && !params.key?(:option_type_ids)
-          params[:option_type_ids] = []
-          params[:variants_attributes] = {}
+        # The variants matrix was emptied: no variant rows re-submitted, removals sent instead.
+        # Option types are detached only when the removal list covers every variant, so a
+        # partial (possibly broken) submission never turns the product into a simple one.
+        # Variants kept alive by discontinuation still count as removed from the matrix,
+        # so the detachment can't hinge on any of them yielding a `_destroy` row.
+        if params[:variants_attributes].blank? && variants_to_remove.any? && can_remove_variants?
+          attributes = removed_variants_attributes
 
-          populate_variants_to_discontinue
-          variant_ids_to_destroy.each_with_index do |variant_id, index|
-            params[:variants_attributes][index.to_s] = { id: variant_id, _destroy: '1' }
-          end
+          params[:option_type_ids] = [] if removing_all_variants? && !params.key?(:option_type_ids)
 
-          params[:variants_attributes].permit!
+          if attributes.any?
+            params[:variants_attributes] = attributes
+            params[:variants_attributes].permit!
+          end
         end
 
         params
@@ -116,8 +128,24 @@ module Spree
         @product_option_types_to_remove ||= product.product_option_type_ids
       end
 
+      # Pulls `removed_variant_ids` out of the params so it never reaches Product#update.
+      # Must run before any `variants_to_remove` access.
+      def extract_removed_variant_ids
+        @removed_variant_ids = Array(params.delete(:removed_variant_ids)).map(&:to_s)
+      end
+
+      # Only variants the client explicitly asked to remove, and only ones that
+      # actually belong to this product.
       def variants_to_remove
-        @variants_to_remove ||= product.variant_ids.map(&:to_s)
+        @variants_to_remove ||= (@removed_variant_ids || []).uniq & all_variant_ids
+      end
+
+      def all_variant_ids
+        @all_variant_ids ||= product.variant_ids.map(&:to_s)
+      end
+
+      def removing_all_variants?
+        (all_variant_ids - variants_to_remove).empty?
       end
 
       def can_update_prices?
@@ -142,7 +170,7 @@ module Spree
         populate_variants_to_discontinue
 
         attributes = {}
-        last_index = params[:variants_attributes].keys.map(&:to_i).max
+        last_index = params[:variants_attributes].presence&.keys&.map(&:to_i)&.max || -1
         variant_ids_to_destroy.each_with_index do |variant_id, index|
           attributes[(last_index + 1 + index).to_s] = { id: variant_id, _destroy: '1' }
         end

data/app/services/spree/shipments/update.rb

@@ -8,7 +8,7 @@ module Spree
         ActiveRecord::Base.transaction do
           return failure(shipment) unless shipment.update(shipment_attributes)
 
-          if shipment_attributes.key?(:selected_shipping_rate_id)
+          if shipment_attributes.key?(:selected_shipping_rate_id) || shipment_attributes.key?(:selected_delivery_rate_id)
             order = shipment.order
 
             # Changing the selected Shipping Rate won't update the cost (for now)

data/app/services/spree/stock_reservations/reserve.rb

@@ -65,7 +65,10 @@ module Spree
           next unless variant&.should_track_inventory?
 
           stock_item = select_stock_item(variant)
-          next if stock_item.nil? || stock_item.backorderable?
+          # Backorderable and pre-order variants oversell past count_on_hand,
+          # so a reservation capped at on-hand stock would wrongly reject them;
+          # their cap is enforced by Stock::Quantifier#can_supply? instead.
+          next if stock_item.nil? || stock_item.backorderable? || variant.preorder?
 
           [line_item, stock_item]
         end

data/app/services/spree/taxons/add_products.rb

@@ -33,6 +33,9 @@ module Spree
         product_ids = products.pluck(:id)
         taxon_ids.each { |id| Spree::Taxon.reset_counters(id, :classifications) }
         product_ids.each { |id| Spree::Product.reset_counters(id, :classifications) }
+        # Recompute the descendant-inclusive products_count for the taxons and
+        # their ancestors (bulk insert skips Classification callbacks).
+        Spree::Taxon.recalculate_products_count(taxon_ids)
 
         # clear cache & index products
         Spree::Product.where(id: product_ids).touch_all

data/app/services/spree/taxons/remove_products.rb

@@ -48,6 +48,9 @@ module Spree
         # update counter caches
         taxon_ids.each { |id| Spree::Taxon.reset_counters(id, :classifications) }
         product_ids.each { |id| Spree::Product.reset_counters(id, :classifications) }
+        # Recompute the descendant-inclusive products_count for the taxons and
+        # their ancestors (delete_all skips Classification callbacks).
+        Spree::Taxon.recalculate_products_count(taxon_ids)
 
         # clear cache & index products
         Spree::Product.where(id: product_ids).touch_all

data/app/subscribers/spree/admin_user_email_subscriber.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Spree
+  class AdminUserEmailSubscriber < Spree::Subscriber
+    subscribes_to 'admin_user.password_reset_requested'
+
+    def handle(event)
+      user = Spree.admin_user_class.find_by(email: event.payload['email'])
+      return unless user
+
+      store = find_store(event)
+
+      AdminUserMailer.password_reset_email(
+        user,
+        event.payload['reset_token'],
+        store,
+        redirect_url: event.payload['redirect_url']
+      ).deliver_later
+    end
+
+    private
+
+    def find_store(event)
+      Spree::Store.find_by_prefix_id(event.payload['store_id']) ||
+        Spree::Current.store ||
+        Spree::Store.default
+    end
+  end
+end

data/app/subscribers/spree/import_email_subscriber.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Spree
+  # Emails the import's owner when processing finishes — including after a
+  # failed-rows retry pass, which publishes `import.completed` again.
+  # App-created imports (API key without an admin creator) have no recipient
+  # and send nothing.
+  #
+  # We use async: false because this subscriber only enqueues the mail job.
+  class ImportEmailSubscriber < Spree::Subscriber
+    subscribes_to 'import.completed', async: false
+
+    on 'import.completed', :send_import_done_email
+
+    def send_import_done_email(event)
+      import_id = event.payload['id']
+      return unless import_id
+
+      import = Spree::Import.find_by_prefix_id(import_id)
+      return unless import
+      return if import.user&.email.blank?
+
+      Spree::ImportMailer.import_done(import).deliver_later
+    end
+  end
+end

data/app/views/layouts/spree/base_mailer.html.erb

@@ -1,46 +1,43 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html>
+<html lang="<%= I18n.locale %>">
   <head>
     <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
     <meta name="x-apple-disable-message-reformatting"/>
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
+    <meta name="color-scheme" content="light"/>
+    <meta name="supported-color-schemes" content="light"/>
 
     <%= render partial: 'spree/shared/base_mailer_stylesheets' %>
+    <%# Per-email styles — templates add their own via `content_for :head` %>
+    <%= yield :head %>
   </head>
-  <body>
-    <table class="email-wrapper" width="100%" cellpadding="0" cellspacing="0" role="presentation">
+  <body class="email-bg" style="margin: 0; padding: 0; -webkit-text-size-adjust: none;" bgcolor="#FFFFFF">
+    <table class="email-wrapper" width="100%" cellpadding="0" cellspacing="0" role="presentation" bgcolor="#FFFFFF">
       <tr>
         <td align="center">
           <table class="email-content" width="100%" cellpadding="0" cellspacing="0" role="presentation">
-            <%= render partial: 'spree/shared/base_mailer_header' %>
             <!-- Email Body -->
             <tr>
-              <td class="email-body" width="570" cellpadding="0" cellspacing="0">
-                <table class="email-body_inner" align="center" width="570" cellpadding="0" cellspacing="0" role="presentation">
-                  <!-- Body content -->
-                  <tbody>
+              <td class="email-card" bgcolor="#F6F6F6">
+                <%= render partial: 'spree/shared/base_mailer_header' %>
+                <table width="100%" cellpadding="0" cellspacing="0" role="presentation">
                   <tr>
-                    <td class="content-cell">
-                      <div class="f-fallback">
-                        <%= yield %>
-                      </div>
+                    <td class="content-cell f-fallback" align="left">
+                      <%= yield %>
                     </td>
                   </tr>
-                  </tbody>
                 </table>
               </td>
             </tr>
+            <!-- Email Footer -->
             <tr>
-              <td>
+              <td class="email-footer" align="center">
                 <%= render partial: 'spree/shared/base_mailer_footer' %>
               </td>
             </tr>
           </table>
         </td>
       </tr>
-      <tr>
-        <td height="60px">&nbsp;</td>
-      </tr>
     </table>
   </body>
 </html>

data/app/views/spree/admin_user_mailer/confirmation_email.html.erb

@@ -0,0 +1,7 @@
+<%= render layout: 'spree/shared/mailer_hero' do %>
+  <h1><%= Spree.t('admin_user_mailer.confirmation_email.action') %></h1>
+  <p class="greeting"><%= Spree.t('admin_user_mailer.confirmation_email.greeting', name: @user.first_name.presence || @user.email) %></p>
+  <p><%= Spree.t('admin_user_mailer.confirmation_email.instructions', store_name: @current_store.name) %></p>
+  <%= render 'spree/shared/mailer_button', url: @confirmation_url, label: Spree.t('admin_user_mailer.confirmation_email.action') %>
+  <p class="sub"><%= Spree.t('admin_user_mailer.confirmation_email.ignore_notice') %></p>
+<% end %>

data/app/views/spree/admin_user_mailer/password_reset_email.html.erb

@@ -0,0 +1,8 @@
+<%= render layout: 'spree/shared/mailer_hero' do %>
+  <h1><%= Spree.t('admin_user_mailer.password_reset_email.action') %></h1>
+  <p class="greeting"><%= Spree.t('admin_user_mailer.password_reset_email.greeting', name: @user.first_name.presence || @user.email) %></p>
+  <p><%= Spree.t('admin_user_mailer.password_reset_email.instructions', store_name: @current_store.name) %></p>
+  <%= render 'spree/shared/mailer_button', url: @reset_url, label: Spree.t('admin_user_mailer.password_reset_email.action') %>
+  <p class="sub"><%= Spree.t('admin_user_mailer.password_reset_email.expiry_notice') %></p>
+  <p class="sub"><%= Spree.t('admin_user_mailer.password_reset_email.ignore_notice') %></p>
+<% end %>

data/app/views/spree/export_mailer/export_done.html.erb

@@ -1,15 +1,7 @@
-<h1>
-  <%= Spree.t('export_mailer.greeting', user_name: @export.user&.first_name) %>
-</h1>
-<p>
-  <%= Spree.t('export_mailer.export_done.message') %>
-</p>
-<% if spree.respond_to?(:admin_export_url) %>
-  <p>
-    <%= link_to @export.attachment.filename, spree.admin_export_url(@export, host: @current_store.formatted_url) %>
-  </p>
+<%= render layout: 'spree/shared/mailer_hero' do %>
+  <h1><%= Spree.t('export_mailer.greeting', user_name: @export.user&.first_name) %></h1>
+  <p><%= Spree.t('export_mailer.export_done.message') %></p>
+  <% if @export.results_url.present? %>
+    <%= render 'spree/shared/mailer_button', url: @export.results_url, label: @export.attachment.filename %>
+  <% end %>
 <% end %>
-<p>
-  <%= Spree.t('export_mailer.thanks') %><br />
-  <%= "#{current_store.name}" %>
-</p>

data/app/views/spree/import_mailer/import_done.html.erb

@@ -0,0 +1,12 @@
+<%= render layout: 'spree/shared/mailer_hero' do %>
+  <h1><%= Spree.t('import_mailer.greeting', user_name: @import.user&.first_name) %></h1>
+  <p><%= Spree.t('import_mailer.import_done.message', completed_count: @import.rows_status_counts['completed'] || 0) %></p>
+  <% failed_count = @import.rows_status_counts['failed'] || 0 %>
+  <% if failed_count > 0 %>
+    <p><strong><%= Spree.t('import_mailer.import_done.failed_message', failed_count: failed_count) %></strong></p>
+  <% end %>
+  <% results_url = @import.results_page_url %>
+  <% if results_url.present? %>
+    <%= render 'spree/shared/mailer_button', url: results_url, label: Spree.t('import_mailer.import_done.view_results') %>
+  <% end %>
+<% end %>

data/app/views/spree/invitation_mailer/invitation_accepted.html.erb

@@ -1,12 +1,4 @@
-<h1>
-  <%= Spree.t('invitation_mailer.greeting', user_name: @invitation.inviter.first_name) %>
-</h1>
-<p>
-  <%= Spree.t('invitation_mailer.invitation_accepted.body', invitee_name: @invitation.invitee&.name, resource_name: @invitation.resource.name) %>
-</p>
-
-<p>
-  <%= Spree.t('invitation_mailer.thanks') %><br />
-  <%= current_store.name %>
-</p>
-
+<%= render layout: 'spree/shared/mailer_hero' do %>
+  <h1><%= Spree.t('invitation_mailer.greeting', user_name: @invitation.inviter.first_name) %></h1>
+  <p><%= Spree.t('invitation_mailer.invitation_accepted.body', invitee_name: @invitation.invitee&.name, resource_name: @invitation.resource.name) %></p>
+<% end %>

data/app/views/spree/invitation_mailer/invitation_email.html.erb

@@ -1,25 +1,12 @@
-<h1>
-  <%= Spree.t('invitation_mailer.greeting', user_name: @invitation.invitee&.first_name || @invitation.email) %>
-</h1>
-<p>
-  <%= Spree.t('invitation_mailer.invitation_email.body', inviter_name: @invitation.inviter.name, resource_name: @invitation.resource.name) %>
-</p>
-<p>
-  <%= Spree.t('invitation_mailer.invitation_email.link_description') %>
-</p>
-
-<% if spree.respond_to?(:admin_invitation_url) %>
-  <p>
-    <%= link_to Spree.t(:accept), spree.admin_invitation_url(@invitation, token: @invitation.token, host: @invitation.store.formatted_url) %>
-  </p>
-<% else %>
-  <p>
-    <%= link_to Spree.t(:accept), main_app.admin_invitation_acceptance_url(@invitation) %>
-  </p>
+<%= render layout: 'spree/shared/mailer_hero' do %>
+  <h1><%= Spree.t('invitation_mailer.invitation_email.subject', resource_name: @invitation.resource.name) %></h1>
+  <p class="greeting"><%= Spree.t('invitation_mailer.greeting', user_name: @invitation.invitee&.first_name || @invitation.email) %></p>
+  <p><%= Spree.t('invitation_mailer.invitation_email.body', inviter_name: @invitation.inviter.name, resource_name: @invitation.resource.name) %></p>
+  <p><%= Spree.t('invitation_mailer.invitation_email.link_description') %></p>
+  <% accept_url = if spree.respond_to?(:admin_invitation_url)
+                    spree.admin_invitation_url(@invitation, token: @invitation.token, host: @invitation.store.formatted_url)
+                  else
+                    main_app.admin_invitation_acceptance_url(@invitation)
+                  end %>
+  <%= render 'spree/shared/mailer_button', url: accept_url, label: Spree.t(:accept) %>
 <% end %>
-
-<p>
-  <%= Spree.t('invitation_mailer.thanks') %><br />
-  <%= current_store.name %>
-</p>
-

data/app/views/spree/report_mailer/report_done.html.erb

@@ -1,15 +1,7 @@
-<h1>
-  <%= Spree.t('report_mailer.greeting', user_name: @report.user&.first_name) %>
-</h1>
-<p>
-  <%= Spree.t('report_mailer.report_done.message') %>
-</p>
-<% if spree.respond_to?(:admin_report_url) %>
-  <p>
-    <%= link_to @report.attachment.filename, spree.admin_report_url(@report, host: @current_store.formatted_url) %>
-  </p>
+<%= render layout: 'spree/shared/mailer_hero' do %>
+  <h1><%= Spree.t('report_mailer.greeting', user_name: @report.user&.first_name) %></h1>
+  <p><%= Spree.t('report_mailer.report_done.message') %></p>
+  <% if spree.respond_to?(:admin_report_url) %>
+    <%= render 'spree/shared/mailer_button', url: spree.admin_report_url(@report, host: @current_store.formatted_url), label: @report.attachment.filename %>
+  <% end %>
 <% end %>
-<p>
-  <%= Spree.t('report_mailer.thanks') %><br />
-  <%= "#{current_store.name}" %>
-</p>

data/app/views/spree/shared/_base_mailer_footer.html.erb

@@ -1,12 +1,19 @@
-<!-- You can override this template to design your own footer.
-<table class="email-footer" align="center" width="570" cellpadding="0" cellspacing="0" role="presentation">
+<!-- You can override this template to design your own footer. -->
+<table width="100%" cellpadding="0" cellspacing="0" role="presentation">
   <tr>
-    <td class="content-cell" align="center">
-      <p class="f-fallback sub align-center">
-        <a href="#">Terms</a> | <a href="#">Privacy</a> |
-        <a href="#">Unsubscribe</a>
-      </p>
+    <td align="center">
+      <div class="footer_content f-fallback">
+        <p class="footer_brand">
+          <%= link_to current_store.name, current_store.storefront_url %>
+        </p>
+        <% if current_store.address.present? %>
+          <p class="footer_meta"><%= current_store.address %></p>
+        <% end %>
+        <% if current_store.customer_support_email.present? %>
+          <p class="footer_meta"><%= mail_to current_store.customer_support_email %></p>
+        <% end %>
+        <p class="footer_note">&copy; <%= Time.current.year %> <%= current_store.name %></p>
+      </div>
     </td>
   </tr>
 </table>
--->

data/app/views/spree/shared/_base_mailer_header.html.erb

@@ -1,6 +1,8 @@
 <!-- You can override this template to design your own header. -->
-<tr>
-  <td class="email-masthead">
-    <%= render 'spree/shared/mailer_logo', logo: current_store.mailer_logo.attached? ? current_store.mailer_logo : current_store.logo %>
-  </td>
-</tr>
+<table width="100%" cellpadding="0" cellspacing="0" role="presentation">
+  <tr>
+    <td class="email-masthead" align="center">
+      <%= render 'spree/shared/mailer_logo', logo: current_store.mailer_logo.attached? ? current_store.mailer_logo : current_store.logo, height: 32 %>
+    </td>
+  </tr>
+</table>