spree_core 5.6.0 → 6.0.0.beta1

data/app/subscribers/spree/order_placed_subscriber.rb

@@ -0,0 +1,58 @@
+module Spree
+  # Completion side effects decoupled from Order#finalize! — each guards
+  # its own idempotency. Runs synchronously on order.placed.
+  class OrderPlacedSubscriber < Spree::Subscriber
+    subscribes_to 'order.placed', async: false
+
+    def handle(event)
+      order = Spree::Order.find_by_prefix_id(event.payload['id'])
+      return unless order
+
+      record_marketing_consent(order)
+      subscribe_to_newsletter(order)
+      create_user_record(order)
+      order.consider_risk
+    end
+
+    private
+
+    # An opt-in taken at checkout is consent, and GDPR Art. 7(1) asks the
+    # controller to be able to demonstrate it. Recorded against the order
+    # rather than the customer because guest checkout produces consent with no
+    # account behind it — and the order is what the shop can point at.
+    #
+    # Only an opt-in is recorded: an unticked box is the absence of consent,
+    # not its refusal, and storing it as a decision would misrepresent what
+    # the buyer did.
+    def record_marketing_consent(order)
+      return unless order.accept_marketing?
+      # Each side effect here guards its own idempotency: the event can be
+      # replayed, and one tick of one box must stay one agreement.
+      return if Spree::ConsentRecord.exists?(
+        owner: order, purpose: Spree::ConsentRecord::EMAIL_MARKETING
+      )
+
+      Spree::ConsentRecord.record!(
+        store: order.store,
+        owner: order,
+        purpose: Spree::ConsentRecord::EMAIL_MARKETING,
+        source: Spree::ConsentRecord::CHECKOUT,
+        email: order.email,
+        ip_address: order.last_ip_address
+      )
+    end
+
+    def subscribe_to_newsletter(order)
+      return unless order.accept_marketing?
+
+      Spree::NewsletterSubscriber.subscribe(email: order.email, customer: order.customer, store: order.store)
+    end
+
+    def create_user_record(order)
+      return if order.customer.present?
+      return unless order.signup_for_an_account?
+
+      Spree.customer_create_workflow.call(store: order.store, order: order)
+    end
+  end
+end

data/app/subscribers/spree/order_status_subscriber.rb

@@ -0,0 +1,82 @@
+module Spree
+  # The trigger side of derive-then-persist statuses: any payment, refund,
+  # fulfillment or return change recomputes the owning order's
+  # payment_status / fulfillment_status through the single writer
+  # (Spree::Orders::UpdateStatuses). Synchronous so API responses right
+  # after a capture/void/fulfill already carry the fresh status. Cart-owned
+  # records are skipped — carts have no status columns.
+  #
+  # Money-moving payment events additionally re-sum payment_total through
+  # the totals workflow, which is the only writer of that column. A payment
+  # save used to do both itself in an after_save callback; the callback and
+  # these events overlapped, so one capture recomputed the order four
+  # times.
+  class OrderStatusSubscriber < Spree::Subscriber
+    subscribes_to 'payment.created', 'payment.updated', 'payment.deleted',
+                  'payment.completed', 'payment.captured', 'payment.voided',
+                  'refund.created', 'refund.updated',
+                  'fulfillment.created', 'fulfillment.updated', 'fulfillment.deleted',
+                  'return.received', 'return.refunded', 'return.canceled',
+                  async: false
+
+    # Events whose payload changes what the customer has actually paid, so
+    # payment_total has to be re-summed before statuses derive from it.
+    MONEY_EVENTS = %w[
+      payment.created payment.updated payment.deleted payment.completed
+      payment.voided refund.created refund.updated
+      return.refunded
+    ].freeze
+
+    # payment.captured always accompanies payment.completed for the same
+    # settlement — the order changed once, so it is answered once. The
+    # remaining overlap (payment.updated is the settling save's own
+    # after_commit) is left alone deliberately: the payload cannot tell an
+    # accompanying update from a genuine later edit of a completed payment,
+    # and skipping the wrong one would leave the order stale. Two cheap
+    # recomputations beat a missed one.
+    #
+    # Keyed on the event, never on the order: two payments settling in one
+    # request (mixed tender) are two real settlements and must both count.
+    SETTLEMENT_COMPANIONS = %w[payment.captured].freeze
+
+    def handle(event)
+      return if event.name.in?(SETTLEMENT_COMPANIONS)
+
+      owner = owner_for(event)
+      return if owner.nil?
+
+      # Only the payment side is re-summed, before statuses derive from it
+      # (payment_status reads payment_total). Deliberately not the full
+      # totals workflow: a payment settling must not re-derive item and
+      # delivery money, which is the totals workflow's business and would
+      # overwrite figures the caller set.
+      owner.refresh_payment_total! if event.name.in?(MONEY_EVENTS) && owner.respond_to?(:refresh_payment_total!)
+
+      # Carts carry payment_total but no status columns — money still has to
+      # be right while checkout is in flight, statuses only exist on orders.
+      owner.update_statuses! if owner.is_a?(Spree::Order)
+    end
+
+    private
+
+    def owner_for(event)
+      resource_class = {
+        'payment' => Spree::Payment,
+        'refund' => Spree::Refund,
+        'fulfillment' => Spree::Fulfillment,
+        'return' => Spree::Return
+      }[event.resource_type]
+      return if resource_class.nil?
+
+      record = resource_class.find_by_prefix_id(event.payload['id'])
+      # None of these models are paranoid, so a .deleted event arrives with
+      # its row already gone and a payload carrying no owner — nothing can
+      # lead back to the order. The models whose deletion changes order
+      # money recalculate from their own after_destroy instead.
+      return if record.nil?
+
+      record.try(:owner) || record.try(:order) ||
+        record.try(:payment)&.try(:owner)
+    end
+  end
+end

data/app/subscribers/spree/payment_split_subscriber.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Spree
+  # Keeps a split checkout's per-order shares in step with the money.
+  #
+  # Two things move a share after it is written. A refund puts one seller's
+  # order right, and must touch only that order's share: the customer's money
+  # comes back out of the one charge either way, but what each seller owes and
+  # is owed does not move because a sibling refunded. And a payment completing
+  # captures the whole basket at once — an authorisation settled after
+  # placement — which every child shares in proportionally.
+  #
+  # Synchronous, like the commission subscriber, because a share is what an
+  # order's payment status is derived from: an order that still read as
+  # unpaid until a job ran would be showing the wrong thing to the merchant
+  # and to the seller.
+  class PaymentSplitSubscriber < Spree::Subscriber
+    subscribes_to 'refund.created', 'payment.completed', async: false
+
+    on 'refund.created', :handle_refund
+    on 'payment.completed', :handle_capture
+
+    def handle_refund(event)
+      refund = Spree::Refund.find_by_prefix_id(event.payload['id'])
+      return unless refund
+
+      order = refund.order
+      return if order.nil? || !order.grouped?
+
+      split = order.payment_split_for(refund.payment)
+      return if split.nil?
+
+      # Recomputed from the refunds rather than incremented, so a replayed
+      # event cannot count the same money twice — and read and written under
+      # the row's lock, so two refunds landing together cannot each total the
+      # rows before the other's has committed.
+      split.with_lock do
+        refunded = Spree::Refund.where(payment_id: refund.payment_id, order_id: order.id).sum(:amount)
+        split.update!(refunded_amount: refunded)
+      end
+
+      # Deliberately re-derived here even though OrderStatusSubscriber also
+      # answers refund.created: subscriber order is not guaranteed, and a
+      # status derived before this share was written would describe the refund
+      # as not having happened.
+      Spree::Orders::UpdateStatuses.call(order: order)
+    end
+
+    # The whole payment settled, so every share it covers is captured in full.
+    # A share already carrying a larger captured figure is left alone — a
+    # dispatch captured it first, and that is the more specific record.
+    def handle_capture(event)
+      payment = Spree::Payment.find_by_prefix_id(event.payload['id'])
+      return if payment.nil? || !payment.grouped?
+
+      payment.payment_splits.includes(:order).each do |split|
+        # Read and written under the row's lock, so a dispatch capturing the
+        # same share at the same moment cannot be overwritten by the figure
+        # this one read before it.
+        settled = split.with_lock do
+          next false if split.captured_amount >= split.authorized_amount
+
+          split.update!(captured_amount: split.authorized_amount)
+          true
+        end
+
+        Spree::Orders::UpdateStatuses.call(order: split.order) if settled && split.order
+      end
+    end
+  end
+end

data/app/subscribers/spree/product_metrics_subscriber.rb

@@ -4,9 +4,9 @@ module Spree
   # Handles order completion events to update product metrics
   # (+units_sold_count+, +revenue+).
   class ProductMetricsSubscriber < Spree::Subscriber
-    subscribes_to 'order.completed'
+    subscribes_to 'order.placed'
 
-    on 'order.completed', :refresh_product_metrics
+    on 'order.placed', :refresh_product_metrics
 
     def refresh_product_metrics(event)
       order_id = event.payload['id']

data/app/subscribers/spree/seller_onboarding_subscriber.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Spree
+  # Opens onboarding when someone accepts an invitation to run a seller.
+  #
+  # Acceptance is the moment a seller becomes a business with a person behind
+  # it, and it happens on the shared invitation path rather than anywhere
+  # marketplace-specific — so the seller's own lifecycle picks it up from the
+  # event rather than the invitation flow having to know about sellers.
+  class SellerOnboardingSubscriber < Spree::Subscriber
+    # Synchronous: the person who just accepted is being sent straight into
+    # the seller panel, and it has to find them `onboarding` on arrival — a
+    # job that runs a moment later would show them a checklist they cannot
+    # yet submit. The transition itself is one row update, so there is no
+    # queue worth of work to defer.
+    subscribes_to 'invitation.accepted', async: false
+
+    on 'invitation.accepted', :start_seller_onboarding
+
+    private
+
+    def start_seller_onboarding(event)
+      invitation = Spree::Invitation.find_by_prefix_id(event.payload['id'])
+      return if invitation.nil?
+
+      seller = invitation.resource
+      return unless seller.is_a?(Spree::Seller)
+
+      Spree::Sellers::StartOnboarding.call(seller: seller)
+    end
+  end
+end

data/app/subscribers/spree/seller_transfer_reversal_subscriber.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Spree
+  # Takes back part of a seller's earning when their order is refunded.
+  #
+  # Hangs off `refund.created` rather than off returns, exchanges or claims
+  # individually: every one of those funnels its money movement through a
+  # refund, so one listener covers all three.
+  #
+  # A refund on an order that never shipped reverses nothing, because nothing
+  # was credited — the workflow answers that case by doing nothing rather than
+  # by failing.
+  class SellerTransferReversalSubscriber < Spree::Subscriber
+    subscribes_to 'refund.created'
+
+    def handle(event)
+      refund = Spree::Refund.find_by_prefix_id(event.payload['id'])
+      return unless refund
+
+      order = refund.order
+      return if order.nil? || order.seller_id.blank?
+
+      Spree.seller_transfer_reverse_workflow.call(order: order, amount: refund.amount, refund: refund)
+    end
+  end
+end

data/app/subscribers/spree/seller_transfer_subscriber.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Spree
+  # Credits a seller once their order's goods have all gone out.
+  #
+  # Subscribes to `order.fulfilled` only, never the legacy `order.shipped` it
+  # is dual-emitted alongside — both would fire this. The workflow is
+  # idempotent regardless, but crediting twice and relying on a unique index to
+  # refuse it is not a design, it is a rescue.
+  #
+  # Asynchronous, unlike the commission subscriber: a provider that moves money
+  # makes a network call, and a fulfillment must not wait on a bank. What the
+  # seller earned is already determined by the time this runs — the order is
+  # fulfilled and its commission is written — so nothing is lost by deferring.
+  class SellerTransferSubscriber < Spree::Subscriber
+    subscribes_to 'order.fulfilled'
+
+    def handle(event)
+      order = Spree::Order.find_by_prefix_id(event.payload['id'])
+      return unless order
+      return if order.seller_id.blank?
+
+      Spree.seller_transfer_create_workflow.call(order: order)
+    end
+  end
+end

data/app/subscribers/spree/seller_user_email_subscriber.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Spree
+  class SellerUserEmailSubscriber < Spree::Subscriber
+    subscribes_to 'seller_user.password_reset_requested'
+
+    def handle(event)
+      user = Spree.admin_user_class.find_by(email: event.payload['email'])
+      return unless user
+
+      SellerUserMailer.password_reset_email(
+        user,
+        event.payload['reset_token'],
+        find_store(event),
+        redirect_url: event.payload['redirect_url']
+      ).deliver_later
+    end
+
+    private
+
+    def find_store(event)
+      Spree::Store.find_by_prefix_id(event.payload['store_id']) ||
+        Spree::Current.store ||
+        Spree::Store.default
+    end
+  end
+end

data/app/subscribers/spree/tax_identifier_validation_subscriber.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Spree
+  # Asks the registry whether a buyer's tax number is real, whenever that number
+  # changes.
+  #
+  # Runs synchronously: the row has to read +pending+ in the same request that
+  # wrote it, so the buyer sees "we're checking this" rather than a blank verdict
+  # that fills in later. The check itself is the background job.
+  class TaxIdentifierValidationSubscriber < Spree::Subscriber
+    subscribes_to 'tax_identifier.number_changed', async: false
+
+    def call(event)
+      identifier = Spree::TaxIdentifier.find_by_prefix_id(event.payload['id'])
+      return if identifier.nil?
+
+      # Nothing to ask when no validator is registered for this kind — a stock
+      # install registers none — and an order's snapshot is never re-checked.
+      return unless identifier.validatable?
+
+      # The row is already marked pending by the write that published this;
+      # queueing the registry call is all that is left.
+      Spree::TaxIdentifiers::ValidateJob.perform_later(identifier.id)
+    end
+  end
+end

data/app/validators/spree/addresses/phone_validator.rb

@@ -8,10 +8,10 @@ module Spree
   module Addresses
     class PhoneValidator < ActiveModel::Validator
       def validate(address)
-        return if !address.require_phone? || address.phone.blank? || address.country.blank? || address.country_iso.blank?
+        return if !address.require_phone? || address.phone.blank? || address.country.blank? || address.country_code.blank?
 
         phone = Phonelib.parse(address.phone)
-        unless phone.valid_for_country?(address.country_iso)
+        unless phone.valid_for_country?(address.country_code)
           address.errors.add(:phone, :invalid)
         end
       end

data/app/validators/spree/attachment_content_type_validator.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+module Spree
+  # Checks an Active Storage attachment against an allowlist of content types,
+  # deciding what a file is from its bytes rather than from the header the
+  # uploader sent.
+  #
+  # This is the low-trust upload path: buyers attach purchase orders and
+  # sellers attach registration documents, and an operator opens both on their
+  # own machine. Without reading the bytes a shell script or an HTML page named
+  # `po.pdf` passes, so the declared content type is discarded outright and the
+  # filename is used only as described below.
+  #
+  # Reached through `validates_with` rather than a `validates` option, because
+  # Rails resolves that shorthand against the model's own ancestry and would
+  # not find a constant living in this namespace.
+  #
+  #   validates_with Spree::AttachmentContentTypeValidator,
+  #                  attributes: [:po_document], in: CONTENT_TYPES
+  #   validates_with Spree::AttachmentContentTypeValidator,
+  #                  attributes: [:file], in: ->(record) { record.accepted }
+  #
+  # Marcel does the reading, which is deliberate: it ships with Active Storage
+  # and identifies every type these allowlists carry without the Unix `file`
+  # command, a binary absent from most slim container images and whose absence
+  # otherwise surfaces to a buyer mid-checkout.
+  #
+  # @see Spree::Purchase::PurchaseOrder
+  # @see Spree::SellerRequirementSubmission
+  class AttachmentContentTypeValidator < ActiveModel::EachValidator
+    # Office files are containers — a zip for the modern formats, an OLE
+    # compound file for the older ones — and which office format a given
+    # container holds is recorded in a part that can sit anywhere inside it.
+    # Magic bytes alone therefore identify some of them only as the container,
+    # however much of the file is read. For those types, and only those, the
+    # extension breaks the tie.
+    #
+    # This is narrower than it looks. The container itself is still proven from
+    # the bytes, so no script, document or executable can borrow the name: the
+    # slack is that a plain zip renamed `.docx` is accepted as one. That is the
+    # same answer a merchant's own machine gives when they double-click it.
+    #
+    # A container whose own marker happens to fall within the bytes read is
+    # identified outright and never reaches the tie-break at all.
+    CONTAINER_CONTENT_TYPES = %w[application/zip application/x-ole-storage].freeze
+
+    # A misspelled or forgotten option would otherwise leave this validator
+    # silently accepting everything, on the one path whose whole purpose is
+    # refusing hostile files. An allowlist that resolves to empty at runtime is
+    # still allowed — a submission whose requirement names no types accepts any.
+    def check_validity!
+      return if options.key?(:in) || options.key?(:with)
+
+      raise ArgumentError, 'You must pass either :in or :with to the validator'
+    end
+
+    def validate_each(record, attribute, _value)
+      attachment = record.public_send(attribute)
+      return unless attachment.attached?
+
+      permitted = permitted_content_types(record)
+      return if permitted.empty?
+
+      pending = pending_attachables(record, attribute)
+
+      blobs_for(attachment).each_with_index do |blob, index|
+        validate_blob(record, attribute, blob, permitted, pending[index])
+      end
+    end
+
+    private
+
+    def permitted_content_types(record)
+      value = options[:in] || options[:with]
+      value = value.call(record) if value.respond_to?(:call)
+
+      Array.wrap(value).map(&:to_s)
+    end
+
+    # Serves both `has_one_attached` and `has_many_attached` without asking the
+    # proxy to behave like an array, which the single-attachment one does not.
+    def blobs_for(attachment)
+      attachment.respond_to?(:blobs) ? attachment.blobs : [attachment.blob]
+    end
+
+    # Where the bytes live depends on how the file arrived. A direct upload — the
+    # storefront and dashboard path — has already stored them and sends back a
+    # signed id. An attachment handed raw IO, as seeds and imports do, has not
+    # been uploaded yet: Active Storage holds it until the record saves, so it is
+    # read from the pending attachable instead. Reading storage in that case
+    # would find nothing and reject a file that is perfectly good.
+    def pending_attachables(record, attribute)
+      change = record.attachment_changes[attribute.to_s]
+      return [] if change.nil?
+
+      change.respond_to?(:attachables) ? Array(change.attachables) : [change.attachable]
+    end
+
+    def validate_blob(record, attribute, blob, permitted, attachable)
+      return if blob.nil?
+
+      return if permitted_bytes?(blob, attachable, permitted)
+
+      record.errors.add(attribute, :spree_content_type_not_allowed)
+    end
+
+    def permitted_bytes?(blob, attachable, permitted)
+      head = leading_bytes(blob, attachable)
+
+      # Bytes that could not be read at all are somebody else's problem to
+      # report — see {#leading_bytes} — and are not evidence of a bad file type.
+      return true if head.nil?
+      return false if head.empty?
+
+      # No declared type is passed: Marcel falls back to it for bytes it cannot
+      # read, which would hand the decision back to whoever uploaded the file.
+      detected = Marcel::MimeType.for(StringIO.new(head))
+      return true if permitted.include?(detected)
+      return false unless CONTAINER_CONTENT_TYPES.include?(detected)
+
+      permitted.include?(office_type_from_extension(blob))
+    end
+
+    # Asks the extension alone, rather than re-reading the bytes with a filename
+    # attached. Marcel would only let the name win where it records the office
+    # type as a descendant of the container, which it does for the zip-based
+    # formats but not the OLE-based ones — so going through it would quietly
+    # reject every legacy Word document whose internal marker sits beyond the
+    # bytes we read.
+    #
+    # @return [String, nil]
+    def office_type_from_extension(blob)
+      filename = blob.filename.to_s
+      return if File.extname(filename).blank?
+
+      Marcel::MimeType.for(name: filename)
+    end
+
+    # Only the leading bytes are read: that is all a magic-number match needs,
+    # and it keeps a 10 MB purchase order from being pulled into memory to
+    # identify its first few bytes.
+    #
+    # @return [String, nil] the bytes, or nil when there are none to read
+    def leading_bytes(blob, attachable)
+      pending = pending_bytes(attachable)
+      return pending if pending
+
+      blob.service.download_chunk(blob.key, 0...MAGIC_BYTES_LENGTH)
+    rescue ActiveStorage::FileNotFoundError
+      # An abandoned direct upload leaves the blob row without its bytes. Saying
+      # the type is wrong would misdescribe that, so this stays quiet and lets
+      # the callers report the upload itself as incomplete.
+      nil
+    end
+
+    # @return [String, nil] the head of a file not yet uploaded, leaving the
+    #   caller's IO rewound so the upload itself still sees the whole thing
+    def pending_bytes(attachable)
+      case attachable
+      when Pathname then attachable.open('rb') { |file| file.read(MAGIC_BYTES_LENGTH) }
+      when Hash then read_head(attachable[:io])
+      else read_head(attachable)
+      end
+    end
+
+    # An uploaded file and a plain IO are both read in place and rewound: the
+    # upload still has to send the whole file afterwards.
+    def read_head(io)
+      io = io.open if io.is_a?(ActionDispatch::Http::UploadedFile)
+      return unless io.respond_to?(:read) && io.respond_to?(:rewind)
+
+      begin
+        io.rewind
+        io.read(MAGIC_BYTES_LENGTH)
+      ensure
+        io.rewind
+      end
+    end
+
+    MAGIC_BYTES_LENGTH = 4.kilobytes
+    private_constant :MAGIC_BYTES_LENGTH
+  end
+end

data/app/validators/spree/password_length_validator.rb

@@ -0,0 +1,23 @@
+module Spree
+  # Default password policy: a length floor with no composition rules, following
+  # NIST 800-63B (forced symbols and digits push people toward predictable
+  # substitutions). Bounds are configurable via
+  # +Spree::Config[:minimum_password_length]+ and +[:maximum_password_length]+.
+  #
+  # Replace the whole policy with {Spree.password_validator=}.
+  class PasswordLengthValidator < ActiveModel::Validator
+    def validate(record)
+      password = record.password
+      return if password.blank?
+
+      minimum = Spree::Config[:minimum_password_length]
+      maximum = Spree::Config[:maximum_password_length]
+
+      if password.length < minimum
+        record.errors.add(:password, :too_short, count: minimum)
+      elsif password.length > maximum
+        record.errors.add(:password, :too_long, count: maximum)
+      end
+    end
+  end
+end

data/app/views/spree/seller_user_mailer/password_reset_email.html.erb

@@ -0,0 +1,8 @@
+<%= render layout: 'spree/shared/mailer_hero' do %>
+  <h1><%= Spree.t('seller_user_mailer.password_reset_email.action') %></h1>
+  <p class="greeting"><%= Spree.t('seller_user_mailer.password_reset_email.greeting', name: @user.first_name.presence || @user.email) %></p>
+  <p><%= Spree.t('seller_user_mailer.password_reset_email.instructions', store_name: @current_store.name) %></p>
+  <%= render 'spree/shared/mailer_button', url: @reset_url, label: Spree.t('seller_user_mailer.password_reset_email.action') %>
+  <p class="sub"><%= Spree.t('seller_user_mailer.password_reset_email.expiry_notice') %></p>
+  <p class="sub"><%= Spree.t('seller_user_mailer.password_reset_email.ignore_notice') %></p>
+<% end %>

data/app/views/spree/shared/_purchased_items_styles.html.erb

@@ -24,6 +24,13 @@
       border-radius: 12px;
     }
 
+    .item .item_thumb_placeholder {
+      width: 80px;
+      height: 80px;
+      background-color: #E4E4E4;
+      border-radius: 12px;
+    }
+
     .item .item_info {
       padding: 8px 16px 8px 8px;
     }