spree_core 5.6.0 → 6.0.0.beta1

data/lib/spree/core/preferences/masking.rb

@@ -9,14 +9,36 @@ module Spree
     # characters of the original value — Stripe's "stored, here's the
     # last 4" pattern.
     module Masking
-      TOKEN = '••••'
+      TOKEN_CHARACTER = '•'.freeze
+      VISIBLE_CHARACTERS = 4
 
+      # Kept for the round-trip guard: any masked value starts with at least
+      # this run of dots, so `masked?` still recognizes what it sent.
+      TOKEN = TOKEN_CHARACTER * VISIBLE_CHARACTERS
+
+      # Upper bound on the dots, so a long key stays readable in a form
+      # field and the rendered length stops disclosing the exact size of
+      # anything longer than this.
+      MAX_MASK_LENGTH = 16
+
+      # Masks all but the last four characters, keeping one dot per hidden
+      # character so the field reads like the credential it stands for.
+      # Values of four characters or fewer are hidden entirely — showing
+      # "the last four" of a five-character secret would expose most of it.
+      #
       # @param value [Object] the preference value to mask
       # @return [String, nil] masked string, or nil if value is blank
       def self.mask(value)
         return nil if value.blank?
 
-        "#{TOKEN}#{value.to_s.last(4)}"
+        value = value.to_s
+        visible = value.length > VISIBLE_CHARACTERS ? value.last(VISIBLE_CHARACTERS) : ''
+        # Never fewer than VISIBLE_CHARACTERS dots: `masked?` recognizes a
+        # round-tripped value by that leading run, and a short secret must
+        # not produce a mask the guard fails to spot.
+        hidden = (value.length - visible.length).clamp(VISIBLE_CHARACTERS, MAX_MASK_LENGTH)
+
+        "#{TOKEN_CHARACTER * hidden}#{visible}"
       end
 
       # @param value [Object] a value previously returned by `mask`

data/lib/spree/core/preferences/preferable.rb

@@ -67,6 +67,36 @@ module Spree::Preferences::Preferable
     send(self.class.preference_deprecated_getter_method(name))
   end
 
+  # Whether this preference is written by Spree rather than supplied by the
+  # operator — a webhook secret a provider issues, say. Kept out of the
+  # schema, so nothing offers it as a field to fill in.
+  def preference_internal(name)
+    has_preference! name
+    getter = self.class.preference_internal_getter_method(name)
+    # A preference declared before this option existed has no such reader.
+    # Treated as not internal rather than raising, so one old declaration
+    # cannot take a whole class's preference schema down with it.
+    return false unless respond_to?(getter)
+
+    send(getter)
+  end
+
+  # The fixed set this preference's value must come from, when it has one.
+  # Carried into the schema so an admin form renders a picker rather than a
+  # text box the operator can only get wrong.
+  #
+  # @return [Array, nil]
+  def preference_choices(name)
+    has_preference! name
+    getter = self.class.preference_choices_getter_method(name)
+    # A preference declared before this option existed has no such reader.
+    # Treated as unconstrained rather than raising, so one old declaration
+    # cannot take a whole class's preference schema down with it.
+    return unless respond_to?(getter)
+
+    send(getter)
+  end
+
   def has_preference!(name)
     raise NoMethodError, "#{name} preference not defined" unless has_preference? name
   end
@@ -76,8 +106,12 @@ module Spree::Preferences::Preferable
   end
 
   def defined_preferences
-    methods.grep(/\Apreferred_.*=\Z/).map do |pref_method|
-      pref_method.to_s.gsub(/\Apreferred_|=\Z/, '').to_sym
+    # Only real `preference`-macro definitions carry a `_default` getter —
+    # the name grep alone would also catch `preferred_*` association writers
+    # (e.g. Order#preferred_stock_location=).
+    methods.grep(/\Apreferred_.*=\Z/).filter_map do |pref_method|
+      name = pref_method.to_s.gsub(/\Apreferred_|=\Z/, '').to_sym
+      name if respond_to?(self.class.preference_default_getter_method(name))
     end
   end
 
@@ -123,7 +157,13 @@ module Spree::Preferences::Preferable
   def convert_preference_value(value, type, nullable: false)
     case type
     when :string, :text
-      value.to_s
+      # A nullable string keeps "unset" (nil / empty string) as nil so it can
+      # fall back to another value, instead of collapsing it to "".
+      if nullable && (value.nil? || (value.respond_to?(:empty?) && value.empty?))
+        nil
+      else
+        value.to_s
+      end
     when :password
       value.to_s
     when :decimal
@@ -180,6 +220,22 @@ module Spree::Preferences::Preferable
       else
         value.to_time
       end
+    # Kept as the `yyyy-MM-dd` string it arrived as rather than coerced to a
+    # Time. Preferences are YAML-serialized, and what a date *means* depends on
+    # the store's timezone, which this method has no access to: coercing here
+    # would freeze the value against the server's zone and move the operator's
+    # deadline by hours. The reader owns that (see
+    # `Spree::SellerRequirements::AcceptTerms#effective_from`); the type exists
+    # so the admin form knows to render a date picker.
+    when :date
+      return nil if value.blank?
+
+      case value
+      when Date, Time, DateTime, ActiveSupport::TimeWithZone
+        value.strftime('%Y-%m-%d')
+      else
+        value.to_s
+      end
     else
       value
     end

data/lib/spree/core/preferences/preferable_class_methods.rb

@@ -1,18 +1,37 @@
 module Spree::Preferences
   module PreferableClassMethods
+    # Declaration order, so an admin form can present preferences the way
+    # their author grouped them — credentials before the optional settings
+    # that depend on them. `defined_preferences` reads Ruby's own `methods`,
+    # whose order is an implementation detail, so it cannot answer this.
+    def declared_preference_order
+      @declared_preference_order ||= begin
+        inherited = superclass.respond_to?(:declared_preference_order) ? superclass.declared_preference_order : []
+        inherited.dup
+      end
+    end
+
     def preference(name, type, *args)
+      declared_preference_order << name.to_sym unless declared_preference_order.include?(name.to_sym)
       options = args.extract_options!
-      options.assert_valid_keys(:default, :deprecated, :nullable, :parse_on_set)
+      options.assert_valid_keys(:default, :deprecated, :in, :internal, :nullable, :parse_on_set)
       default = options[:default]
       default = -> { options[:default] } unless default.is_a?(Proc)
       deprecated = options[:deprecated]
+      internal = options[:internal]
+      # The fixed set a value must come from. Turns a text box into a picker
+      # in every admin form, and is what the inclusion validation would have
+      # told the operator only after a failed save.
+      choices = options[:in]
       nullable = options[:nullable]
       parse_on_set = options[:parse_on_set]
 
       # cache_key will be nil for new objects, then if we check if there
       # is a pending preference before going to default
       define_method preference_getter_method(name) do
-        preferences.fetch(name) do
+        # Rows persisted before the model gained preferences can load with a
+        # NULL column — treat that as "no stored preferences".
+        (preferences || {}).fetch(name) do
           default.call
         end
       end
@@ -26,6 +45,7 @@ module Spree::Preferences
           value = parse_on_set.arity.abs > 1 ? parse_on_set.call(value, self) : parse_on_set.call(value)
         end
         value = convert_preference_value(value, type, nullable: nullable)
+        self.preferences = {} if preferences.nil?
         preferences[name] = value
 
         Spree::Deprecation.warn("`#{name}` is deprecated. #{deprecated}") if deprecated
@@ -46,6 +66,17 @@ module Spree::Preferences
         deprecated
       end
 
+      # Whether this preference is the system's to write rather than the
+      # operator's to supply — a value a provider hands back to us, not one
+      # anybody could know in advance.
+      define_method preference_internal_getter_method(name) do
+        internal
+      end
+
+      define_method preference_choices_getter_method(name) do
+        choices.respond_to?(:call) ? choices.call : choices
+      end
+
       define_method prefers_query_method(name) do
         preferences.fetch(name).to_b
       end
@@ -95,6 +126,14 @@ module Spree::Preferences
       "preferred_#{name}_deprecated".to_sym
     end
 
+    def preference_internal_getter_method(name)
+      "preferred_#{name}_internal".to_sym
+    end
+
+    def preference_choices_getter_method(name)
+      "preferred_#{name}_choices".to_sym
+    end
+
     def preference_type_getter_method(name)
       "preferred_#{name}_type".to_sym
     end

data/lib/spree/core/preferences/runtime_configuration.rb

@@ -2,15 +2,11 @@ module Spree
   module Preferences
     class RuntimeConfiguration
       def initialize
-        self.class.defaults.each do |key, value|
-          self[key] = value
-        end
+        load_defaults
       end
 
       def reset
-        self.class.defaults.each do |key, value|
-          self[key] = value
-        end
+        load_defaults
       end
 
       def configure
@@ -18,6 +14,7 @@ module Spree
       end
 
       def get(preference)
+        warn_if_deprecated(preference)
         send(preference)
       end
 
@@ -26,19 +23,76 @@ module Spree
       def set(*args)
         options = args.extract_options!
         options.each do |name, value|
+          warn_if_deprecated(name)
           send("#{name}=", value)
         end
 
-        send("#{args[0]}=", args[1]) if args.size == 2
+        if args.size == 2
+          warn_if_deprecated(args[0])
+          send("#{args[0]}=", args[1])
+        end
       end
 
       alias []= set
 
+      private
+
+      # Seeding defaults writes every preference, including the deprecated
+      # ones, so it goes straight to the accessor — warning on boot would fire
+      # for settings the application never touches.
+      #
+      # Env-backed settings are seeded with nil rather than their coded
+      # default: the reader treats a set value as an explicit choice, so
+      # writing the default here would shadow the environment. Their default
+      # applies in the reader instead.
+      def load_defaults
+        self.class.defaults.each do |key, value|
+          send("#{key}=", self.class.env_vars.key?(key) ? nil : value)
+        end
+      end
+
+      def warn_if_deprecated(preference)
+        message = self.class.deprecations[preference.to_sym]
+        return if message.blank?
+
+        Spree::Deprecation.warn(
+          message.is_a?(String) ? "Spree::Config[:#{preference}] is deprecated. #{message}" : "Spree::Config[:#{preference}] is deprecated."
+        )
+      end
+
       class << self
-        def preference(name, _type, default: nil, deprecated: false)
+        # Application-level settings (as opposed to store preferences, which
+        # belong on Spree::Store). Passing +env+ lets an operator configure the
+        # setting from the deployment environment instead of Ruby — the
+        # supported path for anything infrastructural, since editing an
+        # initializer means a code change and a deploy.
+        #
+        # Precedence is explicit value → env var → coded default, so a value
+        # set in an initializer or at runtime always wins over the
+        # environment; the env var only fills an unset preference.
+        #
+        # @param env [String, nil] environment variable backing this setting
+        def preference(name, _type, default: nil, deprecated: false, env: nil)
           defaults[name] = default
           deprecations[name] = deprecated
-          attr_accessor name
+          env_vars[name] = env if env
+
+          attr_writer name
+
+          if env
+            # The ivar symbol is built once here — interpolating it inside
+            # the reader would allocate a String on every read of an
+            # env-backed setting, some of which sit on the request path.
+            ivar = :"@#{name}"
+            define_method(name) do
+              value = instance_variable_get(ivar)
+              return value unless value.nil?
+
+              ENV[env].presence || default
+            end
+          else
+            attr_reader name
+          end
         end
 
         def defaults
@@ -48,6 +102,11 @@ module Spree
         def deprecations
           @deprecations ||= {}
         end
+
+        # @return [Hash{Symbol => String}] preferences backed by an env var
+        def env_vars
+          @env_vars ||= {}
+        end
       end
     end
   end

data/lib/spree/core/previews/admin_user_preview.rb

@@ -11,12 +11,4 @@ class Spree::AdminUserPreview < ActionMailer::Preview
       Spree::PreviewData.store(locale)
     )
   end
-
-  def confirmation_email
-    Spree::AdminUserMailer.confirmation_email(
-      Spree::PreviewData.admin_user,
-      'preview-token',
-      Spree::PreviewData.store(locale)
-    )
-  end
 end

data/lib/spree/core/previews/invitation_preview.rb

@@ -38,7 +38,7 @@ class Spree::InvitationPreview < ActionMailer::Preview
       resource: store,
       inviter: admin,
       invitee: accepted ? admin : nil,
-      role: Spree::Role.first || Spree::Role.new(name: 'admin'),
+      role: Spree::Role.for_resource(store).first || Spree::Role.new(name: 'admin', resource: store),
       token: 'preview-token',
       status: accepted ? 'accepted' : 'pending',
       expires_at: 7.days.from_now

data/lib/spree/core/previews/preview_data.rb

@@ -25,8 +25,8 @@ module Spree
     # A customer for previews of customer-facing account emails. Falls back to
     # an unsaved instance when the database has no users.
     def customer
-      Spree.user_class.first ||
-        Spree.user_class.new(email: 'customer@example.com').tap do |user|
+      Spree.customer_class.first ||
+        Spree.customer_class.new(email: 'customer@example.com').tap do |user|
           user.first_name = 'Alex' if user.respond_to?(:first_name=)
         end
     end

data/lib/spree/core/previews/seller_user_preview.rb

@@ -0,0 +1,14 @@
+require_relative 'preview_data'
+
+# Preview Spree seller panel auth emails at /rails/mailers/spree/seller_user
+class Spree::SellerUserPreview < ActionMailer::Preview
+  include Spree::PreviewData::LocaleParam
+
+  def password_reset_email
+    Spree::SellerUserMailer.password_reset_email(
+      Spree::PreviewData.admin_user,
+      'preview-token',
+      Spree::PreviewData.store(locale)
+    )
+  end
+end

data/lib/spree/core/pricing/context.rb

@@ -1,30 +1,41 @@
 module Spree
   module Pricing
     class Context
-      attr_reader :variant, :currency, :store, :zone, :market, :channel, :user, :quantity, :date, :order
+      attr_reader :variant, :currency, :store, :country, :market, :channel, :user, :quantity, :date, :order, :company
 
       # Initializes the context
       # @param variant [Spree::Variant]
       # @param currency [String]
       # @param store [Spree::Store]
-      # @param zone [Spree::Zone]
+      # @param country [Spree::Country] where the buyer is taxed
       # @param market [Spree::Market]
       # @param channel [Spree::Channel]
       # @param user [Spree::User]
       # @param quantity [Integer]
       # @param date [Time]
       # @param order [Spree::Order]
-      def initialize(variant: nil, currency:, store: nil, zone: nil, market: nil, channel: nil, user: nil, quantity: nil, date: nil, order: nil)
+      # @param company [Spree::Company] the purchase node — catalog-attached
+      #   price lists resolve through it, nearest node first
+      def initialize(variant: nil, currency:, store: nil, country: nil, market: nil, channel: nil, user: nil, quantity: nil, date: nil, order: nil, company: nil)
         @variant = variant
         @currency = currency
         @store = store || Spree::Current.store
-        @zone = zone || Spree::Current.zone
+        @country = country || Spree::Current.tax_country
         @market = market || Spree::Current.market
         @channel = channel || Spree::Current.channel
         @user = user
         @quantity = quantity
         @date = date || Time.current
         @order = order
+        @company = company
+      end
+
+      # The destination as a code. Rules compare against this rather than the
+      # country row, so eligibility keeps working once Spree::Country is gone.
+      #
+      # @return [String, nil]
+      def country_code
+        country&.iso
       end
 
       # Returns a new context from a variant and currency
@@ -35,16 +46,23 @@ module Spree
         new(variant: variant, currency: currency)
       end
 
+      # The owner's own market, not Spree::Current's: a cart carries the market it
+      # was placed on, and pricing a line from the request context instead makes
+      # the same cart price differently between two requests depending on whether
+      # the client sent a country hint. Catalogue requests have no owner and keep
+      # the Spree::Current fallback.
       def self.from_order(variant, order, quantity: nil)
         new(
           variant: variant,
           currency: order.currency,
           store: order.store,
-          zone: order.tax_zone || Spree::Zone.default_tax,
+          country: order.tax_country,
+          market: order.market,
           channel: order.channel,
-          user: order.user,
+          user: order.customer,
           quantity: quantity || order.line_items.find_by(variant: variant)&.quantity,
-          order: order
+          order: order,
+          company: order.resolved_company
         )
       end
 
@@ -57,10 +75,12 @@ module Spree
           variant.id,
           currency,
           store&.id,
-          zone&.id,
+          # Countries are reference data with no id; the ISO code is the identity.
+          country&.iso,
           market&.id,
           channel&.id,
           user&.id,
+          company&.id,
           quantity,
           date&.to_i
         ].compact.join('/')

data/lib/spree/core/pricing/price_resolution.rb

@@ -0,0 +1,150 @@
+module Spree
+  module Pricing
+    # Picks the engine that answers a price, and stands between it and the rest
+    # of Spree.
+    #
+    # This sits on the catalog read path — the Store API serializers price every
+    # row of every listing — so three things happen here rather than in each
+    # provider:
+    #
+    # * a provider that declines the context (+handles?+) never gets asked, so
+    #   anonymous browsing stays on the local catalog even when a contract
+    #   pricing system is connected;
+    # * an answer is cached for providers that declare a +cache_ttl+, keyed by
+    #   the context;
+    # * a provider that raises is handled per the store's failure policy —
+    #   +strict+ re-raises as {ProviderUnavailable} so the caller decides,
+    #   +fallback+ quietly uses Spree's own price.
+    class PriceResolution
+      # Raised when the configured provider could not answer and the store's
+      # policy is to refuse rather than substitute a catalog price. Callers in
+      # a checkout flow turn this into a retryable failure; the catalog read
+      # path treats it as "no price".
+      class ProviderUnavailable < StandardError
+        attr_reader :provider_key
+
+        def initialize(message = nil, provider_key: nil)
+          @provider_key = provider_key
+          super(message)
+        end
+      end
+
+      # @param context [Spree::Pricing::Context]
+      # @return [Spree::Price, nil]
+      def self.call(context)
+        new(context).resolve
+      end
+
+      attr_reader :context
+
+      def initialize(context)
+        @context = context
+      end
+
+      # @return [Spree::Price, nil]
+      def resolve
+        return internal_price unless external_provider?
+
+        provider_price
+      rescue StandardError => e
+        handle_failure(e)
+      end
+
+      private
+
+      def store
+        context.store
+      end
+
+      def provider
+        @provider ||= store&.pricing_provider_instance || Spree::PricingProvider::Internal.new
+      end
+
+      # Internal is not "an external system that happens to be local": skipping
+      # the cache and the rescue for it keeps the default path exactly as it
+      # was before providers existed.
+      def external_provider?
+        !provider.is_a?(Spree::PricingProvider::Internal) && provider.handles?(context)
+      end
+
+      def provider_price
+        ttl = provider.cache_ttl
+        return stamp(provider.price_for(context)) if ttl.blank?
+
+        cached = Rails.cache.fetch(provider_cache_key(store_id: store&.id), expires_in: ttl) do
+          price = provider.price_for(context)
+          price&.attributes
+        end
+
+        return if cached.blank?
+
+        stamp(build_price(cached))
+      end
+
+      # An internal answer carries no source: NULL on the line item means
+      # "Spree's own catalog", where price_list_id already says which list.
+      def internal_price
+        Spree::PricingProvider::Internal.new.price_for(context)
+      end
+
+      # A cached price is rebuilt from attributes rather than stored as an
+      # object: a marshalled Active Record instance carries the schema it was
+      # dumped under, and comes back broken after a migration.
+      def build_price(attributes)
+        Spree::Price.new(attributes.except('id')).tap do |price|
+          price.variant ||= context.variant
+        end
+      end
+
+      # An external price must never be saved into the catalog — readonly! is
+      # what turns "someone called save" from silent corruption into an error.
+      # It also carries which provider answered, so the line item can record
+      # that rather than whatever the store happens to be configured for.
+      def stamp(price)
+        return if price.blank?
+
+        # The context always knows the variant, and the tax-inclusive
+        # restatement reads it — a provider that builds a Price without one
+        # would otherwise fail deep in that call with an obscure NoMethodError
+        # rather than anywhere near the provider that omitted it.
+        price.variant ||= context.variant
+        price.readonly!
+        price.price_source = provider.class.key
+        price
+      end
+
+      # The store id is passed in rather than read here so the key visibly
+      # carries it — core's cache-key audit reads the call site, and a reader
+      # should not have to follow Pricing::Context to satisfy themselves that
+      # two stores cannot share an entry.
+      #
+      # Deliberately not Context#cache_key: that includes the context's date
+      # to the second, which would make every entry unique and the TTL
+      # meaningless. Staleness is bounded by the provider's cache_ttl instead.
+      def provider_cache_key(store_id:)
+        [
+          'spree', 'pricing_provider', provider.class.key, store_id,
+          context.variant&.id, context.currency, context.country_code,
+          context.market&.id, context.channel&.id, context.user&.id, context.quantity
+        ].join('/')
+      end
+
+      # Strict refuses to *charge* an unconfirmed price — it must not take the
+      # catalog down. A checkout context carries the order and gets the
+      # exception, so the workflow can fail the step; a catalog read (no
+      # order) gets nil, which the serializers already render as "no price".
+      def handle_failure(error)
+        policy = store&.pricing_failure_policy
+        Spree::ProviderFailurePolicy.report_fallback(
+          kind: 'pricing', provider: provider.class.key, store: store, error: error,
+          policy: policy || Spree::ProviderFailurePolicy::DEFAULT_PRICING_POLICY
+        )
+
+        return internal_price unless policy == 'strict'
+        return nil if context.order.blank?
+
+        raise ProviderUnavailable.new(error.message, provider_key: provider.class.key)
+      end
+    end
+  end
+end