spree_core 5.6.0 → 6.0.0.beta1

data/lib/generators/spree/dummy/templates/rails/test.rb

@@ -23,6 +23,11 @@ Dummy::Application.configure do
   # Disable request forgery protection in test environment
   config.action_controller.allow_forgery_protection    = false
 
+  # A `before_action ... only: [:gone_action]` naming an action that no longer
+  # exists makes Rails refuse every request to that controller. Enabled here so
+  # the suite sees it, as every real Spree app does.
+  config.action_controller.raise_on_missing_callback_actions = true
+
   # Tell Action Mailer not to deliver emails to the real world.
   # The :test delivery method accumulates sent emails in the
   # ActionMailer::Base.deliveries array.

data/lib/generators/spree/model/model_generator.rb

@@ -20,10 +20,10 @@ module Spree
                  default: false,
                  desc: 'Enable acts_as_paranoid soft-delete (adds deleted_at column + index)'
 
-    class_option :metafields,
+    class_option :custom_fields,
                  type: :boolean,
                  default: false,
-                 desc: 'Include Spree::Metafields and Spree::Metadata concerns'
+                 desc: 'Include Spree::HasCustomFields and Spree::Metadata concerns'
 
     desc 'Creates a new Spree model with prefixed IDs and Spree.base_class parent'
 
@@ -40,8 +40,8 @@ module Spree
         options[:paranoid]
       end
 
-      def metafields?
-        options[:metafields]
+      def custom_fields?
+        options[:custom_fields]
       end
 
       def class_path
@@ -52,7 +52,7 @@ module Spree
         "spree_#{super.delete_prefix('spree_')}"
       end
 
-      # Resolution: explicit class hint in attribute spec → Spree.user_class
+      # Resolution: explicit class hint in attribute spec → Spree.customer_class
       # for user-named columns → Spree.admin_user_class for admin-user-named
       # columns → Spree::<CamelCasedName> default. The Rails attribute parser
       # splits on `:` so explicit hints can only be unqualified names; users
@@ -63,7 +63,7 @@ module Spree
 
         case attribute.name
         when 'user', 'user_id'
-          '"::#{Spree.user_class}"'
+          '"::#{Spree.customer_class}"'
         when 'admin_user', 'admin_user_id', 'created_by', 'created_by_id',
              'approver', 'approver_id', 'canceler', 'canceler_id'
           '"::#{Spree.admin_user_class}"'

data/lib/generators/spree/model/templates/model.rb.tt

@@ -1,7 +1,7 @@
 module Spree
   class <%= class_name.demodulize %> < <%= parent_class_name %>
-<% if metafields? -%>
-    include Spree::Metafields
+<% if custom_fields? -%>
+    include Spree::HasCustomFields
     include Spree::Metadata
 
 <% end -%>
@@ -18,8 +18,12 @@ module Spree
     belongs_to :<%= attribute.name %>, class_name: <%= belongs_to_class_name_expr(attribute) %>
 <% end -%>
 <% end -%>
+<% if attributes.any?(&:rich_text?) -%>
+    include Spree::SanitizableRichText
+
 <% attributes.select(&:rich_text?).each do |attribute| -%>
-    has_rich_text :<%= attribute.name %>
+    has_spree_rich_text :<%= attribute.name %>
+<% end -%>
 <% end -%>
 <% attributes.select(&:attachment?).each do |attribute| -%>
     has_one_attached :<%= attribute.name %>

data/lib/spree/category_permalink_deduplicator.rb

@@ -0,0 +1,328 @@
+# frozen_string_literal: true
+
+module Spree
+  # Resolves duplicate category permalinks within a store.
+  #
+  # Before 6.0 a permalink only had to be unique within its taxonomy, so one store
+  # could legitimately hold two "catalog" roots under different taxonomies. In 6.0
+  # the permalink is the category's full path and is unique per store, so those
+  # rows have to be separated before the unique index can exist.
+  #
+  # Runs on raw SQL rather than through Spree::Category: it is called from a
+  # migration, where the model's callbacks, validations and default scopes may not
+  # match the schema on disk.
+  class CategoryPermalinkDeduplicator
+    # Spelled out per schema rather than interpolated from #effective_store_id:
+    # this query binds no values, so writing it as constants keeps it provably
+    # free of interpolated input (Brakeman flags the assembled form). The queries
+    # below interpolate the same fragments but bind their values via #sanitize.
+    DUPLICATE_GROUPS_WITH_TAXONOMY_SQL = <<~SQL.freeze
+      SELECT COALESCE(c.store_id, t.store_id) AS sid, c.permalink
+      FROM spree_categories c
+      LEFT JOIN spree_taxonomies t ON t.id = c.taxonomy_id
+      WHERE c.permalink IS NOT NULL AND COALESCE(c.store_id, t.store_id) IS NOT NULL
+      GROUP BY COALESCE(c.store_id, t.store_id), c.permalink
+      HAVING COUNT(*) > 1
+    SQL
+
+    TRANSLATION_GROUPS_WITH_TAXONOMY_SQL = <<~SQL.freeze
+      SELECT COALESCE(c.store_id, t.store_id) AS sid, tr.locale, tr.permalink
+      FROM spree_category_translations tr
+      INNER JOIN spree_categories c ON c.id = tr.spree_category_id
+      LEFT JOIN spree_taxonomies t ON t.id = c.taxonomy_id
+      WHERE tr.permalink IS NOT NULL AND COALESCE(c.store_id, t.store_id) IS NOT NULL
+      GROUP BY COALESCE(c.store_id, t.store_id), tr.locale, tr.permalink
+      HAVING COUNT(*) > 1
+    SQL
+
+    TRANSLATION_GROUPS_SQL = <<~SQL.freeze
+      SELECT c.store_id AS sid, tr.locale, tr.permalink
+      FROM spree_category_translations tr
+      INNER JOIN spree_categories c ON c.id = tr.spree_category_id
+      WHERE tr.permalink IS NOT NULL AND c.store_id IS NOT NULL
+      GROUP BY c.store_id, tr.locale, tr.permalink
+      HAVING COUNT(*) > 1
+    SQL
+
+    DUPLICATE_GROUPS_SQL = <<~SQL.freeze
+      SELECT c.store_id AS sid, c.permalink
+      FROM spree_categories c
+      WHERE c.permalink IS NOT NULL AND c.store_id IS NOT NULL
+      GROUP BY c.store_id, c.permalink
+      HAVING COUNT(*) > 1
+    SQL
+
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter]
+    def initialize(connection = ActiveRecord::Base.connection)
+      @connection = connection
+      @permalinks_by_store = {}
+    end
+
+    # Rewrites every duplicate permalink, keeping the lowest-id row in each group
+    # and re-prefixing each rewritten row's descendants so subtree paths stay
+    # consistent with their parents.
+    #
+    # @return [Integer] number of categories whose permalink changed
+    def call
+      return 0 unless connection.table_exists?('spree_categories')
+
+      renamed = 0
+
+      # Re-queried each round rather than snapshotted once: re-prefixing a
+      # subtree can move a descendant onto a path some other row already holds,
+      # and that collision has to be resolved too or the unique index cannot be
+      # created. Each round strictly reduces the duplicates, so this terminates.
+      while (groups = duplicate_groups).any?
+        # A cascade rewrites descendants directly, so the cached permalink sets
+        # are stale by the end of a round.
+        @permalinks_by_store.clear
+        moved = resolve_groups(groups)
+        break if moved.zero? # defensive: never spin if a group cannot be moved
+
+        renamed += moved
+      end
+
+      # Independent of the base pass: a store whose base permalinks are already
+      # unique can still hold colliding translated ones, and the storefront
+      # resolves categories through that table.
+      renamed + rewrite_translations
+    end
+
+    private
+
+    # @return [Integer] rows moved in this round
+    def resolve_groups(groups)
+      moved = 0
+
+      groups.each do |store_id, permalink|
+        ids = ids_for(store_id, permalink)
+        # The first row keeps the permalink; the rest have to move.
+        ids.drop(1).each do |id|
+          candidate = unique_permalink(permalink, id, store_id)
+          rewrite(id, permalink, candidate)
+          permalinks_for(store_id) << candidate
+          moved += 1
+        end
+      end
+
+      moved
+    end
+
+    private
+
+    attr_reader :connection
+
+    # Binds values as parameters rather than interpolating them, so no user- or
+    # data-derived string is ever spliced into SQL text.
+    def sanitize(sql, *binds)
+      ActiveRecord::Base.sanitize_sql_array([sql, *binds])
+    end
+
+    # Groups by the store a category belongs to *or is about to*: rows still
+    # awaiting the upgrade backfill have a NULL store_id but resolve one through
+    # their taxonomy, and they collide the moment that backfill assigns it. Both
+    # cases have to be resolved before the unique index sees them.
+    #
+    # @return [Array<Array(Integer, String)>] (store_id, permalink) pairs appearing more than once
+    # Shallowest paths first. A parent must be rewritten before its children, so
+    # the subtree re-prefix in #rewrite fixes them; otherwise a child rewritten
+    # first gets a suffix of its own and is then re-prefixed too, leaving paths
+    # like "catalog-shop-b/kids-shop-b". SQL returns groups in no defined order.
+    def duplicate_groups
+      rows = connection.select_rows(taxonomies_table? ? DUPLICATE_GROUPS_WITH_TAXONOMY_SQL : DUPLICATE_GROUPS_SQL)
+      rows.sort_by { |_store_id, permalink| permalink.to_s.count('/') }
+    end
+
+    def ids_for(store_id, permalink)
+      connection.select_values(sanitize(<<~SQL, store_id, permalink))
+        SELECT c.id FROM spree_categories c
+        #{taxonomy_join}
+        WHERE #{effective_store_id} = ? AND c.permalink = ?
+        ORDER BY c.id
+      SQL
+    end
+
+    def taxonomy_join
+      return '' unless taxonomies_table?
+
+      'LEFT JOIN spree_taxonomies t ON t.id = c.taxonomy_id'
+    end
+
+    def effective_store_id
+      taxonomies_table? ? 'COALESCE(c.store_id, t.store_id)' : 'c.store_id'
+    end
+
+    def taxonomies_table?
+      return @taxonomies_table unless @taxonomies_table.nil?
+
+      @taxonomies_table = connection.table_exists?('spree_taxonomies')
+    end
+
+    # Appends the owning taxonomy's name, falling back to a numeric suffix when
+    # that is absent or itself taken.
+    def unique_permalink(permalink, id, store_id)
+      candidate = [permalink, taxonomy_suffix(id)].compact.join('-')
+      return candidate unless taken?(candidate, store_id)
+
+      counter = 2
+      counter += 1 while taken?("#{candidate}-#{counter}", store_id)
+      "#{candidate}-#{counter}"
+    end
+
+    def taxonomy_suffix(id)
+      return nil unless taxonomies_table?
+
+      name = connection.select_value(sanitize(<<~SQL, id))
+        SELECT t.name FROM spree_taxonomies t
+        INNER JOIN spree_categories c ON c.taxonomy_id = t.id
+        WHERE c.id = ?
+      SQL
+
+      name.presence && name.to_s.parameterize.presence
+    end
+
+    def taken?(permalink, store_id)
+      permalinks_for(store_id).include?(permalink)
+    end
+
+    # Every permalink in the store, loaded once. COALESCE on store_id defeats the
+    # index, so testing candidates in memory beats a scan per candidate — and the
+    # numeric-suffix loop tries several per collision.
+    def permalinks_for(store_id)
+      @permalinks_by_store[store_id] ||= connection.select_values(sanitize(<<~SQL, store_id)).compact.to_set
+        SELECT c.permalink FROM spree_categories c
+        #{taxonomy_join}
+        WHERE #{effective_store_id} = ? AND c.permalink IS NOT NULL
+      SQL
+    end
+
+    # Moves the row and re-prefixes its subtree, so a child of "catalog" becomes a
+    # child of "catalog-shop-b" rather than keeping the old parent's path.
+    def rewrite(id, old_permalink, candidate)
+      connection.update(sanitize('UPDATE spree_categories SET permalink = ? WHERE id = ?', candidate, id))
+
+      descendants(id).each do |descendant_id, current|
+        next if current.blank? || !current.start_with?("#{old_permalink}/")
+
+        moved = current.sub("#{old_permalink}/", "#{candidate}/")
+        connection.update(sanitize('UPDATE spree_categories SET permalink = ? WHERE id = ?', moved, descendant_id))
+      end
+    end
+
+    # The storefront resolves a category by its *translated* permalink
+    # (`scope.i18n.find_by!(permalink:)`), and that table carries no uniqueness
+    # constraint — so a collision there survives the base-column pass and makes
+    # the lookup return whichever row it happens to reach first. Each locale is a
+    # separate namespace, so each is deduplicated on its own.
+    def rewrite_translations
+      return 0 unless connection.table_exists?('spree_category_translations')
+
+      renamed = 0
+
+      while (groups = translation_duplicate_groups).any?
+        moved = resolve_translation_groups(groups)
+        break if moved.zero?
+
+        renamed += moved
+      end
+
+      renamed
+    end
+
+    # @return [Integer] translation rows moved in this round
+    def resolve_translation_groups(groups)
+      renamed = 0
+
+      groups.each do |store_id, locale, permalink|
+        rows = translation_rows_for(store_id, locale, permalink)
+        taken = translation_permalinks_for(store_id, locale)
+
+        # The first row keeps the permalink; the rest have to move.
+        rows.drop(1).each do |translation_id, category_id|
+          counter = 2
+          counter += 1 while taken.include?("#{permalink}-#{counter}")
+          candidate = "#{permalink}-#{counter}"
+          taken << candidate
+
+          move_translation(translation_id, candidate)
+          # Children's translated paths are built from the parent's, so they have
+          # to follow it exactly as they do on the base column.
+          reprefix_descendant_translations(category_id, locale, permalink, candidate)
+          renamed += 1
+        end
+      end
+
+      renamed
+    end
+
+    def move_translation(translation_id, permalink)
+      connection.update(
+        sanitize('UPDATE spree_category_translations SET permalink = ? WHERE id = ?', permalink, translation_id)
+      )
+    end
+
+    def reprefix_descendant_translations(category_id, locale, old_permalink, new_permalink)
+      descendants(category_id).each do |descendant_id, _base_permalink|
+        row = connection.select_rows(sanitize(<<~SQL, descendant_id, locale)).first
+          SELECT id, permalink FROM spree_category_translations
+          WHERE spree_category_id = ? AND locale = ?
+        SQL
+        next if row.nil?
+
+        translation_id, current = row
+        next if current.blank? || !current.start_with?("#{old_permalink}/")
+
+        move_translation(translation_id, current.sub("#{old_permalink}/", "#{new_permalink}/"))
+      end
+    end
+
+    # Every (store, locale, permalink) appearing more than once, across all stores.
+    # Shallowest first, for the same reason as #duplicate_groups.
+    def translation_duplicate_groups
+      rows = connection.select_rows(taxonomies_table? ? TRANSLATION_GROUPS_WITH_TAXONOMY_SQL : TRANSLATION_GROUPS_SQL)
+      rows.sort_by { |_store_id, _locale, permalink| permalink.to_s.count('/') }
+    end
+
+    def translation_rows_for(store_id, locale, permalink)
+      connection.select_rows(sanitize(<<~SQL, store_id, locale, permalink))
+        SELECT tr.id, tr.spree_category_id
+        FROM spree_category_translations tr
+        INNER JOIN spree_categories c ON c.id = tr.spree_category_id
+        #{taxonomy_join}
+        WHERE #{effective_store_id} = ? AND tr.locale = ? AND tr.permalink = ?
+        ORDER BY tr.id
+      SQL
+    end
+
+    def translation_permalinks_for(store_id, locale)
+      connection.select_values(sanitize(<<~SQL, store_id, locale)).compact.to_set
+        SELECT tr.permalink
+        FROM spree_category_translations tr
+        INNER JOIN spree_categories c ON c.id = tr.spree_category_id
+        #{taxonomy_join}
+        WHERE #{effective_store_id} = ? AND tr.locale = ? AND tr.permalink IS NOT NULL
+      SQL
+    end
+
+    # Walks the parent chain rather than using lft/rgt, which may be stale on rows
+    # an installation has not rebuilt. One query per depth level, not per node.
+    #
+    # @return [Array<Array(Integer, String)>] (id, permalink) of every descendant
+    def descendants(id)
+      collected = []
+      frontier = [id]
+
+      until frontier.empty?
+        rows = connection.select_rows(
+          sanitize('SELECT id, permalink FROM spree_categories WHERE parent_id IN (?)', frontier)
+        )
+        break if rows.empty?
+
+        collected.concat(rows)
+        frontier = rows.map(&:first)
+      end
+
+      collected
+    end
+  end
+end

data/lib/spree/core/configuration.rb

@@ -23,33 +23,37 @@ module Spree
   module Core
     class Configuration < Preferences::RuntimeConfiguration
       # Alphabetized to more easily lookup particular preferences
-      preference :address_requires_state, :boolean, default: true, deprecated: true # should state/state_name be required
-      preference :address_requires_phone, :boolean, default: false # Determines whether we require phone in address
-      # Origin where the admin SPA is hosted (e.g. `https://admin.shop.com`).
-      # Used by admin mailers; falls back to `http://localhost:5173` in dev
-      # and the store's storefront URL otherwise. Set this in production.
-      preference :admin_url, :string, default: nil
-      preference :allow_checkout_on_gateway_error, :boolean, default: false
+      preference :address_requires_phone, :boolean, default: false, deprecated: 'Use the address_requires_phone preference in the Spree::Store model'
+      preference :admin_url, :string, default: nil, deprecated: 'Use dashboard_url (or the SPREE_DASHBOARD_URL environment variable) instead — both name the origin where the dashboard is hosted.'
+      # Origin where the React dashboard is hosted (e.g. `https://dashboard.shop.com`),
+      # used for every link that sends someone into the dashboard: invitation
+      # emails, the SSO callback, and the first-run setup link. Set
+      # SPREE_DASHBOARD_URL in the environment rather than editing an
+      # initializer — the setup link is printed by `db:seed`, before there is
+      # any way to configure a running app.
+      preference :dashboard_url, :string, default: nil, env: 'SPREE_DASHBOARD_URL'
+      # Origin where the seller panel is hosted (e.g. `https://sellers.shop.com`).
+      # Separate from `dashboard_url` because the two are different apps for
+      # different audiences: a seller invitation sent to the staff dashboard
+      # lands on a page that authenticates against the Admin API, which no
+      # seller may call. Unset on a marketplace that runs no panel, in which
+      # case seller invitations fall back to the dashboard origin.
+      preference :seller_panel_url, :string, default: nil, env: 'SPREE_SELLER_PANEL_URL'
+      preference :allow_checkout_on_gateway_error, :boolean, default: false, deprecated: 'Nothing reads this in Spree 6 — completion checks whether payments cover the total, so a failed gateway call never completes an order'
       preference :allow_empty_price_amount, :boolean, default: false
-      preference :allow_guest_checkout, :boolean, default: true, deprecated: true # this is only used in the rails frontend, and is not implemented in API
-      preference :alternative_shipping_phone, :boolean, default: false # Request extra phone for ship addr
+      preference :alternative_shipping_phone, :boolean, default: false, deprecated: 'Nothing reads this in Spree 6'
       preference :always_include_confirm_step, :boolean, default: false # Ensures confirmation step is always in checkout_progress bar, but does not force a confirm step if your payment methods do not support it.
-      preference :always_put_site_name_in_title, :boolean, deprecated: true
       preference :always_use_translations, :boolean, default: false
-      preference :auto_capture, :boolean, default: true # automatically capture the credit card (as opposed to just authorize and capture later)
-      preference :auto_capture_on_dispatch, :boolean, default: false # Captures payment for each shipment in Shipment#after_ship callback, and makes Shipment.ready when payment authorized.
-      preference :binary_inventory_cache, :boolean, default: false, deprecated: true # only invalidate product cache when a stock item changes whether it is in_stock
-      preference :checkout_zone, :string, default: nil, deprecated: true # replace with the name of a zone if you would like to limit the countries
+      preference :auto_capture, :boolean, default: true, deprecated: 'Set it on the store instead' # automatically capture the credit card (as opposed to just authorize and capture later)
+      preference :auto_capture_on_dispatch, :boolean, default: false, deprecated: 'Set it on the store instead' # Captures payment on dispatch rather than at checkout.
       preference :company, :boolean, default: false, deprecated: 'Use the company_field_enabled preference in the Spree::Store model' # Request company field for billing and shipping addr
-      preference :currency, :string, default: 'USD', deprecated: true
       preference :credit_to_new_allocation, :boolean, default: false
       preference :disable_migration_check, :boolean, default: false # when turned on disables the startup warning about missing engine migrations
-      preference :enable_legacy_default_price, :boolean, default: false # when enabled, keeps the legacy DefaultPrice concern active (has_one :default_price, variant.price= delegation, check_price validation). Disable (default) to use set_price exclusively.
-      preference :disable_sku_validation, :boolean, default: false # when turned off disables the built-in SKU uniqueness validation
-      preference :disable_store_presence_validation, :boolean, default: false # when turned off disables Store presence validation for Products and Payment Methods
+      preference :disable_sku_validation, :boolean, default: false, deprecated: 'Set it on the store instead' # when turned on disables the built-in SKU uniqueness validation
+      preference :disable_store_presence_validation, :boolean, default: false, deprecated: true # when turned off disables Store presence validation for Products and Payment Methods
       preference :events_log_enabled, :boolean, default: true # Log all Spree events to Rails logger
-      preference :expedited_exchanges, :boolean, default: false # NOTE this requires payment profiles to be supported on your gateway of choice as well as a delayed job handler to be configured with activejob. kicks off an exchange shipment upon return authorization save. charge customer if they do not return items within timely manner.
-      preference :expedited_exchanges_days_window, :integer, default: 14 # the amount of days the customer has to return their item after the expedited exchange is shipped in order to avoid being charged
+      preference :expedited_exchanges, :boolean, default: false, deprecated: 'Exchanges are their own record in Spree 6 — see Spree::Exchange and the Exchanges::Fulfill workflow'
+      preference :expedited_exchanges_days_window, :integer, default: 14, deprecated: 'Exchanges are their own record in Spree 6 — see Spree::Exchange and the Exchanges::Fulfill workflow'
       preference :geocode_addresses, :boolean, default: true
       preference :images_save_from_url_job_attempts, :integer, default: 5
       preference :max_image_download_size, :integer, default: 20_971_520 # 20 MB in bytes
@@ -83,35 +87,66 @@ module Spree
           og_image: [1200, 630]
         }
       end
-      preference :layout, :string, deprecated: 'Please use Spree::Frontend::Config[:layout] instead'
-      preference :logo, :string, deprecated: true
-      preference :mailer_logo, :string, deprecated: true
-      preference :max_level_in_taxons_menu, :integer, deprecated: true
-      preference :non_expiring_credit_types, :array, default: []
-      preference :products_per_page, :integer, default: 12
-      preference :require_master_price, :boolean, default: false
-      preference :restock_inventory, :boolean, default: true # Determines if a return item is restocked automatically once it has been received
-      preference :return_eligibility_number_of_days, :integer, default: 365
-      preference :reserve_stock_on, :string, default: 'checkout' # 'checkout' (default) or 'cart' — landing in 6.0 alongside Cart/Order split
-      preference :stock_reservations_enabled, :boolean, default: true # Hold stock during checkout to prevent overselling
-      preference :default_stock_reservation_ttl_minutes, :integer, default: 10 # Fallback TTL when a Store doesn't override
-      preference :send_core_emails, :boolean, default: true, deprecated: true # Default mail headers settings
-      preference :shipping_instructions, :boolean, deprecated: true
-      preference :show_only_complete_orders_by_default, :boolean, deprecated: true
-      preference :show_variant_full_price, :boolean, default: false # Displays variant full price or difference with product price. Default false to be compatible with older behavior
-      preference :show_products_without_price, :boolean, default: false
-      preference :show_raw_product_description, :boolean, deprecated: true
-      preference :tax_using_ship_address, :boolean, default: true
-      preference :title_site_name_separator, :string, deprecated: true
-      preference :track_inventory_levels, :boolean, default: true # Determines whether to track on_hand values for variants / products.
-      preference :track_price_history, :boolean, default: true # Records price changes for Omnibus Directive compliance. Disable for non-EU stores.
-      preference :price_history_retention_days, :integer, default: 30 # Days to retain price history records. Used by spree:price_history:prune rake task.
-      preference :use_user_locale, :boolean, default: true
+
+      # Bounding box for the rendition used by images embedded in rich text,
+      # as [width, height].
+      #
+      # Separate from product_image_variant_sizes because it is the one
+      # rendition that must not crop: those sizes are resize_to_fill, which
+      # squares off whatever it is given — right for a gallery grid, wrong for
+      # a diagram or a size chart inside a description, where the merchant
+      # chose the aspect ratio. This bounds the longest side instead and leaves
+      # the shape alone.
+      attr_writer :rich_text_image_size
+
+      def rich_text_image_size
+        @rich_text_image_size ||= [1200, 1200]
+      end
+
+      # Content types accepted for uploaded product videos (media_type 'video').
+      # Kept deliberately narrow — these three play natively in every current
+      # browser, so a merchant never uploads a file their shoppers can't watch.
+      attr_writer :video_content_types
+
+      def video_content_types
+        @video_content_types ||= %w[video/mp4 video/webm video/quicktime]
+      end
+
+      # Maximum size of an uploaded product video, in bytes.
+      preference :max_video_upload_size, :integer, default: 524_288_000 # 500 MB
+
+      # Maximum size of a document a seller uploads for an onboarding
+      # requirement, in bytes. Small on purpose: these are certificates and
+      # registrations, and an unbounded upload is a way to fill a disk.
+      preference :max_seller_document_upload_size, :integer, default: 20_971_520 # 20 MB
+      preference :non_expiring_credit_types, :array, default: [], deprecated: 'Nothing reads this in Spree 6 — store credits no longer carry a category, and expiry lives on Spree::GiftCard'
+      preference :products_per_page, :integer, default: 12, deprecated: 'Nothing reads this in Spree 6 — pass per_page to the API instead'
+      preference :restock_inventory, :boolean, default: true, deprecated: 'Restocking is decided per line item by Spree::ReturnLineItem#resellable'
+      preference :return_eligibility_number_of_days, :integer, default: 365, deprecated: 'Use the return_window_days preference on Spree::Market, or a returns.create.validate hook'
+      preference :reserve_stock_on, :string, default: 'checkout', deprecated: 'Nothing reads this in Spree 6 — see the stock_reservations_enabled preference on the store'
+      preference :stock_reservations_enabled, :boolean, default: true, deprecated: 'Set it on the store instead' # Hold stock during checkout to prevent overselling
+      preference :default_stock_reservation_ttl_minutes, :integer, default: 10, deprecated: 'Use the stock_reservation_ttl_minutes preference on the store'
+      # Cross-store leak tripwire for development and test (never active in
+      # production) — see Spree::StoreScopeGuard. 'log' warns about store-less
+      # queries on store-owned tables inside API requests; 'raise' turns them
+      # into failures (what this repo's API test suite runs); 'off' disables.
+      preference :store_scope_guard, :string, default: 'log', env: 'SPREE_STORE_SCOPE_GUARD'
+      # Tiered cart-expiry reaper (docs/plans/6.0-cart-order-split.md Decision 5)
+      preference :guest_cart_expiry_days, :integer, default: 30
+      preference :customer_cart_expiry_days, :integer, default: 90
+      preference :empty_cart_expiry_hours, :integer, default: 48
+      preference :show_variant_full_price, :boolean, default: false, deprecated: 'Nothing reads this in Spree 6 — a storefront decides how it renders prices'
+      preference :show_products_without_price, :boolean, default: false, deprecated: 'Set it on the store instead'
+      preference :tax_using_ship_address, :boolean, default: true, deprecated: 'Set it on the store instead'
+      preference :track_inventory_levels, :boolean, default: true, deprecated: 'Set it on the store instead' # Determines whether to track on_hand values for variants / products.
+      preference :track_price_history, :boolean, default: true, deprecated: 'Set it on the store instead' # Records price changes for Omnibus Directive compliance. Disable for non-EU stores.
+      preference :price_history_retention_days, :integer, default: 30, deprecated: 'Set it on the store instead' # Days to retain price history records. Used by spree:price_history:prune rake task.
+      preference :use_user_locale, :boolean, default: true, deprecated: true
 
       # Sets the path used for products, taxons and pages.
-      preference :storefront_products_path, :string, default: 'products'
-      preference :storefront_taxons_path, :string, default: 't'
-      preference :storefront_pages_path, :string, default: 'pages'
+      preference :storefront_products_path, :string, default: 'products', deprecated: 'Nothing reads this in Spree 6 — storefront routes are owned by the storefront'
+      preference :storefront_taxons_path, :string, default: 't', deprecated: 'Nothing reads this in Spree 6 — storefront routes are owned by the storefront'
+      preference :storefront_pages_path, :string, default: 'pages', deprecated: 'Nothing reads this in Spree 6 — storefront routes are owned by the storefront'
 
       # coupon codes
       preference :coupon_codes_web_limit, :integer, default: 500 # number of coupon codes to be generated in the web process, more than this will be generated in a background job
@@ -121,6 +156,20 @@ module Spree
       preference :admin_password_reset_expires_in, :integer, default: 15 # admin password reset token expiration time in minutes
       preference :customer_password_reset_expires_in, :integer, default: 15 # password reset token expiration time in minutes
 
+      # account lockout
+      preference :max_failed_login_attempts, :integer, default: 5 # failed login attempts before an account is locked
+      preference :lockout_duration, :integer, default: 1800 # lockout duration in seconds (30 minutes)
+
+      # password policy
+      # NIST 800-63B recommends a length floor with no composition rules (no forced
+      # symbols/digits, which push users toward predictable substitutions).
+      preference :minimum_password_length, :integer, default: 8
+      # bcrypt silently truncates past 72 bytes — without a cap a long passphrase and
+      # its 72-byte prefix are the same password. A correctness guard, not policy.
+      preference :maximum_password_length, :integer, default: ActiveModel::SecurePassword::MAX_PASSWORD_LENGTH_ALLOWED
+      # To replace the policy itself, assign Spree.password_validator — a class,
+      # not a preference.
+
       # gift cards
       preference :gift_card_batch_web_limit, :integer, default: 500 # number of gift card codes to be generated in the web process, more than this will be generated in a background job
       preference :gift_card_batch_limit, :integer, default: 50_000

data/lib/spree/core/controller_helpers/store.rb

@@ -37,8 +37,8 @@ module Spree
 
         # Return a Hash of things that influence the prices displayed in your shop.
         #
-        # By default, the only thing that influences prices that is the current order's +tax_zone+
-        # (to facilitate differing prices depending on VAT rate for digital products in Europe, see
+        # By default, the only thing that influences prices is the country whose tax applies (to
+        # facilitate differing prices depending on VAT rate for digital products in Europe, see
         # https://github.com/spree/spree/pull/6295 and https://github.com/spree/spree/pull/6662).
         #
         # If your prices depend on something else, overwrite this method and add
@@ -49,21 +49,20 @@ module Spree
         # * `Spree::VatPriceCalculation#gross_amount`
         # * `Spree::LineItem#update_price`
         # * `Spree::Stock::Estimator#taxation_options_for`
-        # * Subclass the `DefaultTax` calculator
         #
         def current_price_options
           {
-            tax_zone: current_tax_zone
+            country: current_tax_country
           }
         end
 
         private
 
-        def current_tax_zone
-          @current_tax_zone ||= begin
-            zone = @current_order&.tax_zone || Spree::Zone.default_tax
-            Spree::Current.zone = zone
-            zone
+        def current_tax_country
+          @current_tax_country ||= begin
+            country = @current_order&.tax_country || Spree::Current.tax_country
+            Spree::Current.tax_country = country
+            country
           end
         end