spree_core 5.6.1 → 6.0.0.beta1

data/app/services/spree/checkout/update.rb

@@ -1,72 +0,0 @@
-module Spree
-  module Checkout
-    class Update
-      prepend Spree::ServiceModule::Base
-      include Spree::Addresses::Helper
-
-      def call(order:, params:, permitted_attributes:, request_env:)
-        # Validate address ownership to prevent IDOR attacks
-        address_ownership_error = validate_address_ownership(order, params)
-        return failure(order, address_ownership_error) if address_ownership_error
-
-        ship_changed = address_with_country_iso_present?(params, 'ship')
-        bill_changed = address_with_country_iso_present?(params, 'bill')
-        params[:order][:ship_address_attributes] = replace_country_iso_with_id(params[:order][:ship_address_attributes]) if ship_changed
-        params[:order][:bill_address_attributes] = replace_country_iso_with_id(params[:order][:bill_address_attributes]) if bill_changed
-
-        # for quick checkouts we cannot revert to previous states
-        # we already have the address and delivery steps completed
-        # however we need to update the shipping address with missing data
-        # as previously we didn't have access to first/last name and street
-        unless params[:do_not_change_state]
-          order.state = 'address' if (ship_changed || bill_changed || quick_checkout_cancelled?(params)) && order.has_checkout_step?('address')
-          order.state = 'delivery' if selected_shipping_rate_present?(params) && order.has_checkout_step?('delivery')
-        end
-
-        return success(order) if order.update_from_params(params, permitted_attributes, request_env)
-
-        failure(order)
-      end
-
-      private
-
-      def validate_address_ownership(order, params)
-        return nil unless params[:order]
-
-        %w[bill ship].each do |address_kind|
-          address_id = params[:order].dig("#{address_kind}_address_attributes".to_sym, :id)
-          next unless address_id
-
-          address = Spree::Address.find_by(id: address_id)
-          next unless address
-
-          # Allow if address has no user (guest address) or belongs to the order's user
-          next if address.user_id.nil?
-          next if order.user_id.present? && address.user_id == order.user_id
-
-          return Spree.t(:address_not_owned_by_user)
-        end
-
-        nil
-      end
-
-      def address_with_country_iso_present?(params, address_kind = 'ship')
-        return false unless params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_iso)
-        return false if params.dig(:order, "#{address_kind}_address_attributes".to_sym, :country_id)
-
-        true
-      end
-
-      def selected_shipping_rate_present?(params)
-        shipments_attributes = params.dig(:order, :shipments_attributes)
-        return false unless shipments_attributes
-
-        shipments_attributes.any? { |s| s.dig(:selected_shipping_rate_id) }
-      end
-
-      def quick_checkout_cancelled?(params)
-        params.dig(:order, :ship_address_id) == 'CLEAR'
-      end
-    end
-  end
-end

data/app/services/spree/credit_cards/destroy.rb

@@ -1,25 +0,0 @@
-module Spree
-  module CreditCards
-    # @deprecated Use card.destroy directly instead. Payment cleanup is now
-    #   handled by the before_destroy callback in Spree::PaymentSourceConcern.
-    #   This service will be removed in Spree 6.0.
-    class Destroy
-      prepend Spree::ServiceModule::Base
-
-      def call(card:)
-        Spree::Deprecation.warn(
-          "#{self.class.name} is deprecated and will be removed in Spree 6.0. " \
-          'Use card.destroy directly instead. Payment cleanup is now handled ' \
-          'automatically by the before_destroy callback in PaymentSourceConcern.',
-          caller_locations(2)
-        )
-
-        if card.destroy
-          success(card: card)
-        else
-          failure(card.errors.full_messages.to_sentence)
-        end
-      end
-    end
-  end
-end

data/app/services/spree/fulfillments/create.rb

@@ -1,259 +0,0 @@
-module Spree
-  module Fulfillments
-    # Manually creates a fulfillment (Spree::Shipment) on a completed order,
-    # bypassing order routing. Moves the requested quantities of each line
-    # item's not-yet-shipped inventory units out of their current shipments
-    # into the new fulfillment, mirroring externally-managed fulfillment
-    # (3PL, courier API, drop-shipping) back into Spree.
-    #
-    # Stock bookkeeping follows the split/transfer semantics: when the source
-    # and target stock locations differ, moved quantities are restocked at the
-    # source and unstocked at the target. Source shipments left empty are
-    # destroyed and their cost and selected delivery method carry over to the
-    # new fulfillment, unless the caller provides its own +cost+ /
-    # +delivery_method+.
-    #
-    # The resulting cost is frozen only for fulfillments registered with
-    # status: 'shipped' (rate refresh skips shipped shipments). Pending/ready
-    # fulfillments participate in the standard rate machinery — the order
-    # updater re-prices them from the delivery method calculators on the next
-    # recalculation, exactly like shipments created via split/transfer.
-    class Create
-      prepend Spree::ServiceModule::Base
-
-      # @param order [Spree::Order] completed order to fulfill
-      # @param stock_location [Spree::StockLocation] location the fulfillment ships from
-      # @param items [Array<Hash>, nil] `[{ line_item: Spree::LineItem, quantity: Integer }]`;
-      #   nil fulfills every not-yet-shipped unit on the order
-      # @param tracking [String, nil] carrier tracking number
-      # @param delivery_method [Spree::ShippingMethod, nil] carrier; stored as the selected rate.
-      #   Defaults to the delivery method of the drained source fulfillment(s)
-      # @param cost [String, Numeric, nil] explicit shipping cost (e.g. the 3PL's price).
-      #   Defaults to the summed cost of the drained source fulfillment(s), keeping the
-      #   order total unchanged; an explicit cost changes the order total and payment state.
-      #   Guaranteed to persist only with status: 'shipped' — pending fulfillments are
-      #   re-priced by the rate engine (see class docs)
-      # @param status [String, nil] pass 'shipped' to register an already-shipped fulfillment
-      # @param metadata [Hash, nil] metadata stored on the fulfillment
-      # @return [Spree::ServiceModule::Result] the created shipment on success
-      def call(order:, stock_location:, items: nil, tracking: nil, delivery_method: nil, cost: nil, status: nil, metadata: nil)
-        return failure(nil, Spree.t('fulfillments.errors.invalid_status')) unless status.nil? || status == 'shipped'
-
-        cost = parse_cost(cost)
-        return cost if cost.is_a?(Spree::ServiceModule::Result)
-
-        fulfillment = nil
-
-        # The order row is locked before reading fulfillable units so
-        # concurrent creations (e.g. duplicate carrier webhooks) validate and
-        # move units against a serialized snapshot. The API layer already
-        # serializes via with_order_lock; this covers direct service callers.
-        ActiveRecord::Base.transaction do
-          order.lock!
-
-          return failure(nil, Spree.t('fulfillments.errors.order_not_completed')) unless order.completed?
-          return failure(nil, Spree.t('fulfillments.errors.order_canceled')) if order.canceled?
-
-          units_by_line_item = fulfillable_units(order)
-
-          requested = normalize_items(order, items, units_by_line_item)
-          return requested if requested.is_a?(Spree::ServiceModule::Result)
-
-          fulfillment = order.shipments.new(
-            stock_location: stock_location,
-            address_id: order.ship_address_id,
-            tracking: tracking
-          )
-          fulfillment.metadata = metadata if metadata.present?
-          fulfillment.save!
-
-          source_shipments = move_units(order, fulfillment, requested, units_by_line_item)
-          inherited = destroy_drained_shipments(source_shipments, capture_delivery_method: delivery_method.nil?)
-          attach_cost_and_rate(fulfillment, delivery_method, cost, inherited)
-
-          if status == 'shipped'
-            mark_shipped(fulfillment)
-          else
-            fulfillment.update!(order)
-          end
-
-          order.reload.update_with_updater!
-        end
-
-        success(fulfillment.reload)
-      end
-
-      private
-
-      # Units that can still be moved into a manual fulfillment: on-hand or
-      # backordered units sitting in shipments that haven't shipped or been
-      # canceled (canceled shipments already restocked their stock). Loaded
-      # in one query, on-hand first so moved units stay shippable, grouped
-      # by line item for both validation and moving.
-      def fulfillable_units(order)
-        order.inventory_units.
-          on_hand_or_backordered.
-          joins(:shipment).
-          merge(Spree::Shipment.ready_or_pending).
-          preload(:shipment, :variant).
-          order(Arel.sql("CASE WHEN #{Spree::InventoryUnit.table_name}.state = 'on_hand' THEN 0 ELSE 1 END"), :id).
-          group_by(&:line_item_id)
-      end
-
-      def normalize_items(order, items, units_by_line_item)
-        available_for = ->(line_item) { units_by_line_item.fetch(line_item.id, []).sum(&:quantity) }
-
-        if items.nil?
-          derived = order.line_items.filter_map do |line_item|
-            quantity = available_for.call(line_item)
-            { line_item: line_item, quantity: quantity } if quantity.positive?
-          end
-          return failure(nil, Spree.t('fulfillments.errors.no_items_to_fulfill')) if derived.empty?
-
-          return derived
-        end
-
-        return failure(nil, Spree.t('fulfillments.errors.no_items_to_fulfill')) if items.empty?
-
-        # Merge duplicate line item entries, then validate quantities.
-        merged = items.group_by { |item| item[:line_item].id }.values.map do |grouped|
-          { line_item: grouped.first[:line_item], quantity: grouped.sum { |item| item[:quantity].to_i } }
-        end
-
-        merged.each do |item|
-          line_item = item[:line_item]
-          quantity = item[:quantity]
-
-          unless quantity.positive?
-            return failure(nil, Spree.t('fulfillments.errors.invalid_quantity', item: line_item.prefixed_id))
-          end
-
-          available = available_for.call(line_item)
-          if quantity > available
-            return failure(
-              nil,
-              Spree.t('fulfillments.errors.insufficient_quantity',
-                      item: line_item.prefixed_id, requested: quantity, available: available)
-            )
-          end
-        end
-
-        merged
-      end
-
-      # Moves the requested quantities into the fulfillment, on-hand units
-      # first so the new fulfillment is shippable whenever possible. Restocks
-      # the source location and unstocks the target for tracked variants when
-      # the locations differ, keeping stock levels truthful about where the
-      # goods actually leave from.
-      #
-      # @return [Array<Spree::Shipment>] the shipments units were taken from
-      def move_units(order, fulfillment, requested, units_by_line_item)
-        source_shipments = []
-        stock_moves = Hash.new(0)
-
-        requested.each do |item|
-          remaining = item[:quantity]
-
-          units_by_line_item.fetch(item[:line_item].id, []).each do |unit|
-            break if remaining.zero?
-
-            take = [unit.quantity, remaining].min
-            source_shipments << unit.shipment
-            stock_moves[[unit.shipment, unit.variant]] += take
-
-            target = fulfillment.inventory_units.find_or_initialize_by(
-              state: unit.state,
-              variant_id: unit.variant_id,
-              line_item_id: unit.line_item_id,
-              order_id: order.id
-            )
-            target.pending = unit.pending
-            # The quantity column has a database default of 1, so a fresh
-            # record must be set to the moved quantity, not incremented.
-            target.quantity = target.new_record? ? take : target.quantity + take
-            target.save!
-
-            if take == unit.quantity
-              unit.destroy!
-            else
-              unit.update!(quantity: unit.quantity - take)
-            end
-
-            remaining -= take
-          end
-        end
-
-        stock_moves.each do |(source_shipment, variant), quantity|
-          next unless variant.track_inventory?
-          next if source_shipment.stock_location_id == fulfillment.stock_location_id
-
-          source_shipment.stock_location.restock(variant, quantity, source_shipment)
-          fulfillment.stock_location.unstock(variant, quantity, fulfillment)
-        end
-
-        source_shipments.uniq
-      end
-
-      # Destroys fully drained source shipments, capturing what the new
-      # fulfillment inherits from them — the summed cost and the first
-      # selected delivery method, read before destroy since the rates are
-      # deleted along with the shipment. The delivery method lookup costs
-      # queries, so it is skipped when the caller provided its own.
-      #
-      # @return [Hash] `{ cost: BigDecimal, delivery_method: Spree::ShippingMethod or nil }`
-      def destroy_drained_shipments(source_shipments, capture_delivery_method:)
-        inherited = { cost: 0, delivery_method: nil }
-
-        source_shipments.each do |shipment|
-          next unless shipment.inventory_units.sum(:quantity).zero?
-
-          inherited[:cost] += shipment.cost
-          inherited[:delivery_method] ||= shipment.shipping_method if capture_delivery_method
-          shipment.destroy!
-        end
-
-        inherited
-      end
-
-      # The fulfillment inherits the cost and carrier of the shipments it
-      # replaced — keeping the order total (and thus payment state) unchanged —
-      # unless the caller provides its own. Frozen once shipped; see the class
-      # docs for pending-path re-pricing. The carrier rides along as a
-      # selected rate.
-      def attach_cost_and_rate(fulfillment, delivery_method, cost, inherited)
-        effective_cost = cost || inherited[:cost]
-        method = delivery_method || inherited[:delivery_method]
-
-        fulfillment.update_columns(cost: effective_cost) if effective_cost.positive?
-        fulfillment.add_shipping_method(method, true) if method
-      end
-
-      # Strict decimal parsing (same semantics as Shipment#cost=, which the
-      # update_columns freeze path bypasses) — the lenient LocalizedNumber
-      # would turn garbage into 0, and 0 is a legal cost here.
-      #
-      # @return [BigDecimal, Numeric, nil] nil when no cost was given (blank
-      #   counts as omitted); a failure Result for malformed or negative input
-      def parse_cost(cost)
-        return if cost.blank?
-
-        parsed = cost.is_a?(String) ? BigDecimal(cost.strip) : cost
-        return failure(nil, Spree.t('fulfillments.errors.invalid_cost')) if parsed.negative?
-
-        parsed
-      rescue ArgumentError
-        failure(nil, Spree.t('fulfillments.errors.invalid_cost'))
-      end
-
-      # Registers an externally-completed fulfillment: backorders are filled
-      # (the external location evidently had the goods) and the paid-order
-      # readiness gate is bypassed deliberately — the goods already left.
-      def mark_shipped(fulfillment)
-        fulfillment.inventory_units.backordered.each(&:fill_backorder!)
-        fulfillment.update_columns(state: 'ready') unless fulfillment.ready?
-        fulfillment.reload.ship!
-      end
-    end
-  end
-end

data/app/services/spree/gift_cards/apply.rb

@@ -1,78 +0,0 @@
-# frozen_string_literal: true
-
-# Applies a gift card to an order
-# under the hood it creates a store credit payment record and updates the gift card amount used
-# @param gift_card [Spree::GiftCard] the gift card to apply
-# @param order [Spree::Order] the order to apply the gift card to
-# @return [Spree::Order] the order with the gift card applied
-module Spree
-  module GiftCards
-    class Apply
-      prepend Spree::ServiceModule::Base
-
-      def call(gift_card:, order:)
-        # we shouldn't mix an order with a gift card and a store credit
-        return failure(:gift_card_using_store_credit_error) if order.using_store_credit?
-
-        # we shouldn't allow a gift card to be applied to an order with a different currency
-        return failure(:gift_card_mismatched_currency) if gift_card.currency != order.currency
-
-        # gift card requires logged user
-        if gift_card.user.present?
-          # user must be logged in
-          return failure(:gift_card_customer_not_logged_in) if order.user.blank?
-          # user must be the same as the gift card user
-          return failure(:gift_card_mismatched_customer) if gift_card.user != order.user
-        end
-
-        store = order.store
-
-        payment_method = ensure_store_credit_payment_method!(store)
-
-        order.with_lock do
-          gift_card.lock!
-          amount = [gift_card.amount_remaining, order.total].min
-
-          return failure(:gift_card_no_amount_remaining) unless amount.positive? || order.total.zero?
-
-          store_credit = gift_card.store_credits.create!(
-            store: store,
-            user: order.user,
-            amount: amount,
-            currency: order.currency,
-            originator: gift_card,
-            action_originator: gift_card
-          )
-          gift_card.amount_used += amount
-          gift_card.save!
-
-          order.update!(gift_card: gift_card)
-          order.payments.create!(
-            source: store_credit,
-            payment_method: payment_method,
-            amount: amount,
-            state: 'checkout',
-            response_code: store_credit.generate_authorization_code
-          )
-          order.update_with_updater!
-        end
-
-        success(order.reload)
-      end
-
-      private
-
-      def ensure_store_credit_payment_method!(store)
-        payment_method = store.payment_methods.find_or_initialize_by(
-          type: 'Spree::PaymentMethod::StoreCredit'
-        )
-        payment_method.name ||= Spree.t(:store_credit_name)
-        payment_method.active = true
-
-        payment_method.save! if payment_method.new_record?
-
-        payment_method
-      end
-    end
-  end
-end

data/app/services/spree/gift_cards/redeem.rb

@@ -1,17 +0,0 @@
-module Spree
-  module GiftCards
-    class Redeem
-      prepend Spree::ServiceModule::Base
-
-      def call(gift_card:)
-        if gift_card.amount_remaining.zero?
-          gift_card.redeem!
-        else
-          gift_card.partial_redeem!
-        end
-
-        success(gift_card)
-      end
-    end
-  end
-end

data/app/services/spree/gift_cards/remove.rb

@@ -1,39 +0,0 @@
-module Spree
-  module GiftCards
-    class Remove
-      prepend Spree::ServiceModule::Base
-
-      def call(order:)
-        return failure(:remove_gift_card_on_completed_order_error) if order.completed?
-        return success(true) if order.gift_card.nil?
-
-        gift_card = order.gift_card
-
-        return failure(:gift_card_not_found) if gift_card.nil?
-
-        order.with_lock do
-          payments = order.payments.checkout.store_credits.where(source: gift_card.store_credits)
-          payment_total = payments.sum(:amount)
-          payments.each(&:invalidate!)
-
-          gift_card.with_lock do
-            gift_card.amount_used -= payment_total
-            gift_card.save!
-          end
-
-          # we need to destroy the store credits here because they are not associated with the order
-          # and we need to remove them from the gift card
-          # TODO: rather than destroying the store credits, we should void them
-          payments.each do |payment|
-            payment.source.destroy!
-          end
-
-          order.update!(gift_card: nil)
-          order.update_with_updater!
-        end
-
-        success(true)
-      end
-    end
-  end
-end

data/app/services/spree/line_items/create.rb

@@ -1,20 +0,0 @@
-module Spree
-  module LineItems
-    class Create
-      prepend Spree::ServiceModule::Base
-      include Helper
-
-      def call(order:, line_item_attributes: {}, options: {})
-        line_item = order.line_items.new(line_item_attributes)
-
-        ActiveRecord::Base.transaction do
-          return failure(line_item) unless line_item.save
-
-          recalculate_service.call(order: order, line_item: line_item, options: options)
-        end
-
-        success(line_item)
-      end
-    end
-  end
-end

data/app/services/spree/line_items/destroy.rb

@@ -1,18 +0,0 @@
-module Spree
-  module LineItems
-    class Destroy
-      prepend Spree::ServiceModule::Base
-      include Helper
-
-      def call(line_item:, options: {})
-        order = line_item.order
-
-        ActiveRecord::Base.transaction do
-          order.line_items.destroy(line_item)
-          recalculate_service.call(order: order, line_item: line_item, options: options)
-        end
-        success(line_item)
-      end
-    end
-  end
-end

data/app/services/spree/line_items/helper.rb

@@ -1,11 +0,0 @@
-module Spree
-  module LineItems
-    module Helper
-      protected
-
-      def recalculate_service
-        Spree.cart_recalculate_service
-      end
-    end
-  end
-end

data/app/services/spree/line_items/update.rb

@@ -1,17 +0,0 @@
-module Spree
-  module LineItems
-    class Update
-      prepend Spree::ServiceModule::Base
-      include Helper
-
-      def call(line_item:, line_item_attributes: {}, options: {})
-        ActiveRecord::Base.transaction do
-          return failure(line_item) unless line_item.update(line_item_attributes)
-
-          recalculate_service.call(order: line_item.order, line_item: line_item, options: options)
-        end
-        success(line_item)
-      end
-    end
-  end
-end

data/app/services/spree/orders/build_shipments.rb

@@ -1,29 +0,0 @@
-module Spree
-  module Orders
-    # Shared shipment-building step for admin order Create / Update.
-    #
-    # Rebuilds shipments from scratch (Stock::Coordinator), then layers in
-    # tax, costs, and free-shipping promotions so totals reflect delivery
-    # before payment is requested. Without this, draft orders would expose
-    # delivery_total: 0.0 until completion is attempted — which is too late.
-    #
-    # No-op when the order has no shipping address, no line items, or does
-    # not require delivery (digital orders, etc.).
-    class BuildShipments
-      prepend Spree::ServiceModule::Base
-
-      def call(order:)
-        return success(order) unless order.ship_address_id.present?
-        return success(order) unless order.line_items.any?
-        return success(order) unless order.delivery_required?
-
-        order.create_proposed_shipments
-        order.create_shipment_tax_charge!
-        order.set_shipments_cost
-        order.apply_free_shipping_promotions
-
-        success(order)
-      end
-    end
-  end
-end

data/app/services/spree/orders/cancel.rb

@@ -1,54 +0,0 @@
-module Spree
-  module Orders
-    class Cancel
-      prepend Spree::ServiceModule::Base
-
-      DEFAULT_REASON = 'other'.freeze
-
-      # Cancels an order and records a Spree::OrderCancellation history record.
-      # Legacy `canceler:` and `canceled_at:` remain valid; new keywords are additive.
-      #
-      # @param order [Spree::Order]
-      # @param canceler [Object, nil] the user/admin who initiated the cancellation
-      # @param canceled_at [Time, nil] timestamp (defaults to Time.current)
-      # @param reason [String] one of Spree::OrderCancellation::REASONS
-      # @param note [String, nil] staff-facing note
-      # @param restock_items [Boolean] whether to return inventory
-      # @param refund_payments [Boolean] whether to refund captured payments
-      # @param refund_amount [BigDecimal, Numeric, nil] amount to refund;
-      #   when refund_payments is true and this is nil, defaults to order.payment_total
-      # @param notify_customer [Boolean] hint for subscribers
-      # @return [Spree::ServiceModule::Result]
-      def call(order:, canceler: nil, canceled_at: nil,
-               reason: DEFAULT_REASON, note: nil,
-               restock_items: false, refund_payments: false, refund_amount: nil,
-               notify_customer: false)
-        canceled_at ||= Time.current
-        refund_amount ||= order.payment_total if refund_payments
-
-        order.transaction do
-          order.cancellations.create!(
-            reason: reason,
-            note: note,
-            restock_items: restock_items,
-            refund_payments: refund_payments,
-            refund_amount: refund_amount,
-            notify_customer: notify_customer,
-            canceled_by: canceler,
-            created_at: canceled_at
-          )
-
-          changes = { canceled_at: canceled_at }
-          changes[:canceler_id] = canceler.id if canceler.present?
-          order.update_columns(changes)
-          order.cancel!
-        end
-
-        order.publish_event('order.canceled', order.event_payload.merge(notify_customer: notify_customer))
-        success(order.reload)
-      rescue ActiveRecord::RecordInvalid, StateMachines::InvalidTransition
-        failure(order)
-      end
-    end
-  end
-end