spree_core 5.6.1 → 6.0.0.beta1

data/app/models/concerns/spree/capture_method.rb

@@ -0,0 +1,33 @@
+module Spree
+  # When a customer's card is charged, as opposed to only authorized.
+  #
+  # A store sets the default and a payment method may override it, mirroring
+  # +Spree::Channel::Gating+: the method preference is nullable, so an unset
+  # value inherits the store's choice rather than meaning "checkout".
+  module CaptureMethod
+    extend ActiveSupport::Concern
+
+    # - +checkout+     charge as soon as the order is placed
+    # - +on_dispatch+  authorize at checkout, charge when goods are dispatched
+    # - +manual+       authorize at checkout, leave charging to staff
+    CAPTURE_METHODS = %w[checkout on_dispatch manual].freeze
+
+    # The value a store falls back to when nothing has been chosen.
+    DEFAULT_CAPTURE_METHOD = 'checkout'.freeze
+
+    # @return [Boolean] true when the money is taken as the order is placed.
+    def capture_at_checkout?
+      resolved_capture_method == 'checkout'
+    end
+
+    # @return [Boolean] true when dispatching goods is what triggers the charge.
+    def capture_on_dispatch?
+      resolved_capture_method == 'on_dispatch'
+    end
+
+    # @return [Boolean] true when only staff may take the money.
+    def capture_manually?
+      resolved_capture_method == 'manual'
+    end
+  end
+end

data/app/models/concerns/spree/custom_field_filterable.rb

@@ -0,0 +1,163 @@
+# frozen_string_literal: true
+
+module Spree
+  # Resolves `cf_*` custom-field predicates (e.g. +cf_custom_material_i_cont+)
+  # into scopes. Ransack has no such attributes, so callers split them out of a
+  # filter hash with {with_custom_field_filters} before handing the rest to
+  # Ransack. Lives on the model rather than in a SearchProvider so every
+  # consumer — the search providers, CSV export, any other Ransack entry
+  # point — resolves the same vocabulary.
+  module CustomFieldFilterable
+    extend ActiveSupport::Concern
+
+    # Arel comparison methods for numeric predicates.
+    NUMERIC_OPERATORS = {
+      'eq' => :eq,
+      'gt' => :gt,
+      'gteq' => :gteq,
+      'lt' => :lt,
+      'lteq' => :lteq
+    }.freeze
+
+    # Wraps a value in the LIKE pattern its predicate implies.
+    LIKE_PATTERNS = {
+      'cont' => ->(value) { "%#{value}%" },
+      'i_cont' => ->(value) { "%#{value}%" },
+      'start' => ->(value) { "#{value}%" },
+      'end' => ->(value) { "%#{value}" }
+    }.freeze
+
+    class_methods do
+      # Applies every `cf_*` predicate in +filters+ and returns the resulting
+      # scope alongside the filters Ransack should still handle. Predicates
+      # that don't apply (unknown key, wrong type, unparseable value) are
+      # dropped rather than raising, so a stale bookmarked filter degrades to
+      # "no filter" instead of a 500.
+      #
+      # @param filters [Hash]
+      # @param schema [Spree::SearchProvider::CustomFieldSchema] the store's
+      #   custom-field vocabulary; definitions are store-owned, so filtering
+      #   without one would read another store's schema.
+      # @return [Array(ActiveRecord::Relation, Hash)] scoped relation + remaining filters
+      def with_custom_field_filters(filters, schema:)
+        return [all, filters] if filters.blank?
+        # Skip the schema's DB query entirely for the common case of a filter
+        # hash with no custom-field predicates at all.
+        return [all, filters] unless filters.any? { |key, _| key.to_s.start_with?('cf_') }
+
+        scope = all
+
+        remaining = filters.reject do |key, value|
+          parsed = schema.parse_filter(key)
+          next false unless parsed
+
+          condition = custom_field_filter_condition(parsed[:definition], parsed[:predicate], value)
+          scope = scope.where(condition) if condition
+          true
+        end
+
+        [scope, remaining]
+      end
+
+      # One EXISTS / NOT EXISTS subquery per predicate — composes with other
+      # filters without duplicating rows the way a join would.
+      #
+      # @param definition [Spree::CustomFieldDefinition]
+      # @param predicate [String]
+      # @param value [Object]
+      # @return [Arel::Nodes::Node, nil] nil when the value is unusable
+      def custom_field_filter_condition(definition, predicate, value)
+        case predicate
+        when 'present'
+          custom_field_exists(definition)
+        when 'blank'
+          custom_field_exists(definition).not
+        else
+          value_condition = custom_field_value_condition(definition.field_type, predicate, value)
+          value_condition && custom_field_exists(definition, value_condition)
+        end
+      end
+
+      # Type-casts a custom_field value column so numeric fields compare
+      # numerically rather than lexicographically. Public because custom_field
+      # sorting in Spree::SearchProvider::Database applies the same cast to a
+      # differently-aliased join.
+      #
+      # @param column [Arel::Attributes::Attribute] value column
+      # @param field_type [String]
+      # @return [Arel::Nodes::Node] castable expression
+      def custom_field_value_expression(column, field_type)
+        return column unless field_type == 'number'
+
+        Arel::Nodes::NamedFunction.new('CAST', [column.as(custom_field_numeric_cast_type)])
+      end
+
+      private
+
+      # `CAST(... AS <type>)` target for numeric custom_field comparisons. SQLite
+      # has no DECIMAL affinity and PostgreSQL rejects MySQL's precision form,
+      # so the type is per-adapter.
+      def custom_field_numeric_cast_type
+        case connection.adapter_name
+        when /PostgreSQL/i then 'numeric'
+        when /Mysql|Trilogy/i then 'DECIMAL(30, 10)'
+        else 'REAL'
+        end
+      end
+
+      # `EXISTS (SELECT 1 FROM spree_custom_fields WHERE …)` correlated against
+      # this model's rows, optionally narrowed by a value condition.
+      def custom_field_exists(definition, value_condition = nil)
+        custom_fields = custom_field_filter_table
+        subquery = Arel::SelectManager.new(custom_fields).
+                   project(Arel.sql('1')).
+                   where(custom_fields[:resource_type].eq(name)).
+                   where(custom_fields[:resource_id].eq(arel_table[primary_key])).
+                   where(custom_fields[:custom_field_definition_id].eq(definition.id))
+
+        subquery = subquery.where(value_condition) if value_condition
+
+        # `.ast`, not the SelectManager — Exists adds its own parentheses, and
+        # a manager contributes a second set, yielding invalid `EXISTS ((…))`.
+        Arel::Nodes::Exists.new(subquery.ast)
+      end
+
+      # Aliased so the correlated subquery can't collide with an outer join on
+      # the same table (custom_field sorting joins it as `sort_cf`).
+      def custom_field_filter_table
+        @custom_field_filter_table ||= Spree::CustomField.arel_table.alias('filter_cf')
+      end
+
+      def custom_field_value_condition(field_type, predicate, value)
+        column = custom_field_filter_table[:value]
+
+        if field_type == 'number'
+          operator = NUMERIC_OPERATORS[predicate]
+          return nil unless operator
+
+          numeric = begin
+            BigDecimal(value.to_s)
+          rescue ArgumentError, TypeError
+            return nil
+          end
+
+          custom_field_value_expression(column, field_type).public_send(operator, numeric)
+        elsif (pattern = LIKE_PATTERNS[predicate])
+          escaped = sanitize_sql_like(value.to_s)
+          # LIKE is already case-insensitive under MySQL's default collation
+          # and for ASCII on SQLite, but not on PostgreSQL — lower both sides
+          # so `i_cont` behaves the same everywhere.
+          if predicate == 'i_cont'
+            column.lower.matches(pattern.call(escaped.downcase), nil, true)
+          else
+            column.matches(pattern.call(escaped), nil, true)
+          end
+        elsif predicate == 'eq'
+          column.eq(value.to_s)
+        elsif predicate == 'not_eq'
+          column.not_eq(value.to_s)
+        end
+      end
+    end
+  end
+end

data/app/models/concerns/spree/customer_methods.rb

@@ -0,0 +1,421 @@
+module Spree
+  module CustomerMethods
+    extend ActiveSupport::Concern
+
+    include Spree::PrefixedId
+    include Spree::HasCustomFields
+    include Spree::UserAddress
+    include Spree::UserPaymentSource
+    include Spree::UserReporting
+    include Spree::UserRoles
+    include Spree::RansackableAttributes
+    include Spree::Searchable
+    include Spree::Publishable
+    include Spree::SanitizableRichText
+
+    included do
+      has_prefix_id :cust  # Stripe: cus_
+
+      # Single consolidated metadata JSON column (docs/plans/decisions.md
+      # 2026-03-16 "Consolidate metadata") — no public/private split.
+      attribute :metadata, default: -> { {} }
+
+      # Enable lifecycle events for user models
+      publishes_lifecycle_events
+
+      # Password reset token (Rails 7.1+ signed token, no DB column needed)
+      # Token auto-invalidates when password changes (salt changes)
+      # Expiration is configurable via Spree::Config.customer_password_reset_expires_in (in minutes)
+      generates_token_for :password_reset, expires_in: Spree::Config.customer_password_reset_expires_in.minutes do
+        # `try` rather than `&.`: a model that lacks the method/column entirely
+        # must fall through rather than raise NameError. `password_salt` covers
+        # has_secure_password (which derives it from password_digest);
+        # `encrypted_password` covers a legacy bcrypt column on a custom model.
+        try(:password_salt)&.last(10) || try(:encrypted_password)&.last(10)
+      end
+
+      # we need to have this callback before any dependent: :destroy associations
+      # https://github.com/rails/rails/issues/3458
+      before_validation :clone_billing_address, if: :use_billing?
+      before_destroy :check_completed_orders
+
+      # GDPR Art. 7(1) puts the burden of demonstrating consent on the
+      # controller. The boolean says what is true now; the timestamp and
+      # source say when it became true and where the person agreed, which is
+      # what a supervisory authority asks for.
+      before_save :stamp_email_marketing_consent, if: :will_save_change_to_accepts_email_marketing?
+
+      after_save_commit :sync_newsletter_subscription_with_marketing_consent,
+                        if: :saved_change_to_accepts_email_marketing?
+
+      attr_accessor :use_billing
+
+      has_person_name
+      normalizes :email, :first_name, :last_name, with: ->(value) { value&.to_s&.squish&.presence }
+      acts_as_taggable_on :tags
+
+      def tags=(tags)
+        self.tag_list = tags
+      end
+
+      #
+      # Associations
+      #
+      has_many :promotion_rule_users, class_name: 'Spree::PromotionRuleUser', foreign_key: :customer_id, dependent: :destroy
+      has_many :promotion_rules, through: :promotion_rule_users, class_name: 'Spree::PromotionRule'
+      has_many :orders, foreign_key: :customer_id, class_name: 'Spree::Order'
+      has_many :carts, -> { incomplete }, foreign_key: :customer_id, class_name: 'Spree::Order'
+      has_many :completed_orders, -> { complete }, foreign_key: :customer_id, class_name: 'Spree::Order'
+      has_many :store_credits, class_name: 'Spree::StoreCredit', foreign_key: :customer_id, dependent: :destroy
+      # Everything the customer has bought and can download. Scoped to completed
+      # orders — a link on an abandoned cart was never paid for.
+      has_many :completed_order_line_items, through: :completed_orders, source: :line_items, class_name: 'Spree::LineItem'
+      has_many :digital_links, through: :completed_order_line_items, source: :digital_links, class_name: 'Spree::DigitalLink'
+      has_many :wishlists, class_name: 'Spree::Wishlist', foreign_key: :customer_id, dependent: :destroy
+      has_many :wishlist_items, through: :wishlists, source: :wishlist_items
+      has_many :gateway_customers, class_name: 'Spree::GatewayCustomer', foreign_key: :customer_id
+      has_many :gift_cards, class_name: 'Spree::GiftCard', foreign_key: :customer_id, dependent: :destroy
+      has_many :customer_group_users, class_name: 'Spree::CustomerGroupUser', as: :customer, dependent: :destroy
+      has_many :customer_groups, through: :customer_group_users, class_name: 'Spree::CustomerGroup'
+      has_many :identities, class_name: 'Spree::UserIdentity', as: :user, dependent: :destroy
+      # Destroying the account takes the privacy records with it. They exist to
+      # say what this person agreed to and what was done about their requests,
+      # which is nothing once the person is gone — and left behind they would
+      # keep an email, an address and a browser string that nothing reaches.
+      has_many :consent_records, class_name: 'Spree::ConsentRecord', as: :owner,
+                                 dependent: :destroy, inverse_of: :owner
+      has_many :data_requests, class_name: 'Spree::DataRequest', foreign_key: :customer_id,
+                               dependent: :destroy, inverse_of: :customer
+      # One per registration kind — a business can hold both an EU and a UK VAT number.
+      has_many :tax_identifiers, class_name: 'Spree::TaxIdentifier', as: :owner,
+                                 dependent: :destroy, inverse_of: :owner
+      has_many :company_memberships, class_name: 'Spree::CompanyMembership', foreign_key: :customer_id,
+                                     dependent: :destroy, inverse_of: :customer
+      has_many :companies, through: :company_memberships, class_name: 'Spree::Company'
+      belongs_to :ship_address, class_name: 'Spree::Address', optional: true
+      belongs_to :bill_address, class_name: 'Spree::Address', optional: true
+
+      # Replaces the customer's group membership. Accepts both prefixed IDs and
+      # raw integer IDs. Only groups belonging to the current store are
+      # assigned — ids from another store are dropped, preventing cross-store
+      # membership. Mirrors +Spree::Product#category_ids=+.
+      def customer_group_ids=(ids)
+        decoded_ids = Array(ids).filter_map do |id|
+          id.to_s.include?('_') ? Spree::CustomerGroup.decode_prefixed_id(id) : id
+        end
+        super(Spree::CustomerGroup.for_store(Spree::Current.store).where(id: decoded_ids).ids)
+      end
+
+      #
+      # Attachments
+      #
+      has_one_attached :avatar, service: Spree.public_storage_service_name
+
+      has_spree_rich_text :internal_note
+
+      #
+      # Attributes
+      #
+      attr_accessor :confirm_email, :terms_of_service
+
+      # Where a consent change came from, set alongside
+      # `accepts_email_marketing` by whatever is making the change. A caller
+      # that says nothing is recorded as an account-level edit, which is what
+      # a plain profile update is.
+      attr_writer :consent_source
+
+
+      # The company nodes this customer may act for within a store — their
+      # memberships on that store's trees, expanded by subtree. Customers are
+      # global while companies are store-scoped, so standing is always
+      # evaluated per store.
+      #
+      # @param store [Spree::Store]
+      # @return [ActiveRecord::Relation<Spree::Company>]
+      def company_standing(store:)
+        Spree::Company.subtree_of(companies.where(store_id: store.id))
+      end
+
+      # Whether this customer may act for the given node: a membership on the
+      # node or any of its ancestors. Always a subtree check, never an
+      # equality check on one node.
+      #
+      # @param company [Spree::Company]
+      # @return [Boolean]
+      def standing_for?(company)
+        return false if company.nil?
+
+        company_memberships.where(company_id: company.self_and_ancestors.map(&:id)).exists?
+      end
+
+      def self.find_by_password_reset_token(token)
+        find_by_token_for(:password_reset, token)
+      end
+
+      def self.find_by_password_reset_token!(token)
+        find_by_token_for!(:password_reset, token)
+      end
+
+      def self.search(query)
+        return none if query.blank?
+
+        # `search_condition` handles sanitization itself — it escapes LIKE
+        # wildcards for plain columns and compares encrypted columns by
+        # equality. Pass the raw query so it can branch correctly.
+        conditions = []
+        conditions << search_condition(self, :email, query)
+        conditions << search_condition(self, :first_name, query)
+        conditions << search_condition(self, :last_name, query)
+
+        full_name = NameOfPerson::PersonName.full(query.to_s.strip)
+
+        if full_name.first.present? && full_name.last.present?
+          conditions << search_condition(self, :first_name, full_name.first)
+          conditions << search_condition(self, :last_name, full_name.last)
+        end
+
+        where(conditions.reduce(:or))
+      end
+
+      # Backward compatibility alias — remove in Spree 6.0
+      def self.multi_search(query) = search(query)
+
+      self.whitelisted_ransackable_associations = %w[bill_address ship_address addresses tags spree_roles orders customer_groups]
+      self.whitelisted_ransackable_attributes = %w[id email first_name last_name phone accepts_email_marketing
+                                                    created_at updated_at last_sign_in_at]
+      self.whitelisted_ransackable_scopes = %w[search multi_search with_min_total_spent with_standing_for_company
+                                               anonymized]
+
+      # Two-state scope: see Spree::Base.ransack_flag? for why the cast is
+      # opted out of here and done inside the scope instead.
+      def self.ransackable_scopes_skip_sanitize_args
+        %i[anonymized]
+      end
+
+      # Whether an erasure has been carried out. A scope rather than a
+      # ransackable `anonymized_at`, because the question a merchant asks is
+      # "has this been erased", not "is this timestamp null" — and a filter
+      # control that offers two named states needs a predicate that takes one
+      # of them as its value.
+      # Defaulted because Ransack invokes a scope with no argument when the
+      # value it was given is simply `true`, and passes the value through only
+      # when it is something else — so both `anonymized: true` and
+      # `anonymized: 'false'` have to land here.
+      scope :anonymized, ->(*values) {
+        case Spree::Base.ransack_flag(*values)
+        when true then where.not(anonymized_at: nil)
+        when false then where(anonymized_at: nil)
+        else all
+        end
+      }
+
+      scope :with_min_total_spent, ->(amount) {
+        joins(:orders).where.not(spree_orders: { completed_at: nil }).
+          group("#{table_name}.id").
+          having('SUM(spree_orders.total) >= ?', amount.to_d)
+      }
+
+      # Customers with standing for a company: members of the node or of any
+      # ancestor (see #standing_for?). Accepts a record, an id, or an array.
+      scope :with_standing_for_company, ->(companies) {
+        scoped = Spree::Current.store&.companies || Spree::Company.none
+        nodes = Array.wrap(companies).filter_map do |company|
+          company.is_a?(Spree::Company) ? company : scoped.find_by_param(company)
+        end
+        next none if nodes.empty?
+
+        joins(:company_memberships).
+          where(Spree::CompanyMembership.table_name => { company_id: nodes.flat_map { |node| node.self_and_ancestors.map(&:id) }.uniq }).
+          distinct
+      }
+
+      # Precomputes orders_count, total_spent, and last_order_completed_at via a
+      # single aggregate join so list endpoints avoid 4 queries per user. The
+      # values land on the user as virtual attributes.
+      scope :with_order_aggregates, -> {
+        order_table = Spree::Order.table_name
+        select(
+          "#{table_name}.*, " \
+          "COALESCE(orders_agg.orders_count, 0) AS orders_count, " \
+          "COALESCE(orders_agg.total_spent, 0) AS total_spent, " \
+          "orders_agg.last_order_completed_at AS last_order_completed_at"
+        ).joins(
+          "LEFT JOIN (" \
+            "SELECT customer_id, COUNT(*) AS orders_count, SUM(total) AS total_spent, MAX(completed_at) AS last_order_completed_at " \
+            "FROM #{order_table} " \
+            "WHERE completed_at IS NOT NULL AND customer_id IS NOT NULL " \
+            "GROUP BY customer_id" \
+          ") orders_agg ON orders_agg.customer_id = #{table_name}.id"
+        )
+      }
+
+      def self.with_email(query)
+        where("#{table_name}.email LIKE ?", "%#{query}%")
+      end
+
+      def self.with_address(query, address = :ship_address)
+        left_outer_joins(address).
+          where("#{Spree::Address.table_name}.first_name like ?", "%#{query}%").
+          or(left_outer_joins(address).where("#{Spree::Address.table_name}.last_name like ?", "%#{query}%"))
+      end
+
+      def self.with_email_or_address(email, address)
+        left_outer_joins(:addresses).
+          where("#{Spree::Address.table_name}.first_name LIKE ? or #{Spree::Address.table_name}.last_name LIKE ? or #{table_name}.email LIKE ?",
+                "%#{address}%", "%#{address}%", "%#{email}%")
+      end
+
+      # We override this method because we cannot use for_store on users because it will return admin users
+      def self.for_store(store)
+        self
+      end
+    end
+
+    # Returns the last incomplete spree order for the current store
+    # @param [Spree::Store] store
+    # @param [Hash] options
+    # @option options [Array<Symbol>] :includes
+    # @return [Spree::Order]
+    def last_incomplete_spree_order(store, options = {})
+      orders.where(store: store).incomplete.not_canceled.
+        includes(options[:includes]).
+        order('created_at DESC').
+        first
+    end
+
+    # Returns the total available store credit for the current store per currency
+    # @param [Spree::Store] store
+    # @param [String] currency
+    # @return [Float]
+    def total_available_store_credit(currency = nil, store = nil)
+      store ||= Store.default
+      currency ||= store.default_currency
+
+      # When the association is already loaded (e.g. preloaded via the admin
+      # API's scope_includes), filter in memory to avoid an N+1 — but mirror
+      # the query branch exactly: non-gift-card credits, scoped to the store
+      # and currency. A gift card is identified by its originator_type.
+      if store_credits.loaded?
+        store_credits.
+          select { |sc| sc.originator_type != 'Spree::GiftCard' && sc.store_id.to_s == store.id.to_s && sc.currency == currency }.
+          sum(&:amount_remaining)
+      else
+        store_credits.without_gift_card.for_store(store).where(currency: currency).to_a.sum(&:amount_remaining)
+      end
+    end
+
+    # Returns the available store credits for the current store per currency
+    # @param [Spree::Store] store
+    # @return [Array<Spree::Money>]
+    def available_store_credits(store)
+      store ||= Store.default
+
+      store_credits.for_store(store).pluck(:currency).uniq.each_with_object([]) do |currency, arr|
+        arr << Spree::Money.new(total_available_store_credit(currency, store), currency: currency)
+      end
+    end
+
+    # Returns the default wishlist for the current store
+    # if no default wishlist exists, it creates one
+    # @param [Spree::Store] current_store
+    # @return [Spree::Wishlist]
+    def default_wishlist_for_store(current_store)
+      wishlists.find_by(is_default: true, store_id: current_store.id) || ActiveRecord::Base.connected_to(role: :writing) do
+        wishlists.create!(store: current_store, is_default: true, name: Spree.t(:default_wishlist_name))
+      end
+    end
+
+    # Returns true if the user can be deleted
+    # Customers can be deleted if they have no completed orders
+    # @return [Boolean]
+    def can_be_deleted?
+      orders.complete.none?
+    end
+
+    # Returns the CSV row representation of the user
+    # @return [Array<String>]
+    # @param store [Spree::Store, nil] the store the export runs for — it
+    #   decides which custom-field definitions the value columns are built
+    #   from. Customers are global, so unlike a store-owned record there is
+    #   nothing to fall back to but the current request's store.
+    def to_csv(store = nil)
+      Spree::CSV::CustomerPresenter.new(self, store || Spree::Current.store).call
+    end
+
+    # Returns the full name of the user
+    # @return [String]
+    def full_name
+      name&.full
+    end
+
+    def event_serializer_class
+      'Spree::Api::V3::CustomerSerializer'.safe_constantize
+    end
+
+    def event_prefix
+      if self.class == Spree.admin_user_class && Spree.admin_user_class != Spree.customer_class
+        'admin'
+      else
+        'user'
+      end
+    end
+
+    # @param store [Spree::Store] store to scope the lookup to; defaults to the current store
+    # @return [Spree::NewsletterSubscriber, nil] this user's newsletter subscriber for the given store
+    def newsletter_subscriber(store = Spree::Current.store)
+      return unless store
+
+      Spree::NewsletterSubscriber.for_store(store).find_by(customer_id: id)
+    end
+
+    # @deprecated Superseded by {Spree::Customers::Anonymize}, which erases
+    #   every column carrying personal data rather than three on this row —
+    #   the address book, the address snapshots on past orders, gateway
+    #   profiles, OAuth identities and live sessions all outlived this method.
+    #   Removed in Spree 6.1.
+    def scramble_email_and_names
+      Spree::Deprecation.warn('Spree::CustomerMethods#scramble_email_and_names is deprecated and will be removed in Spree 6.1. Use Spree::Customers::Anonymize instead.')
+
+      Spree.customer_anonymize_workflow.call(customer: self, store: Spree::Current.store).success?
+    end
+
+    # Whether this customer's personal data has been erased.
+    # @return [Boolean]
+    def anonymized?
+      anonymized_at.present?
+    end
+
+    private
+
+    def check_completed_orders
+      raise Spree::Core::DestroyWithOrdersError if !spree_admin? && orders.complete.present?
+    end
+
+    # One entry, both slots — which is what "ship to my billing address" means
+    # in an address book. Copying instead produced either an ownerless row the
+    # customer's own book could not see, or a second entry carrying the first
+    # one's label, which the per-book label index refuses.
+    def clone_billing_address
+      self.ship_address = bill_address if bill_address
+      true
+    end
+
+    def use_billing?
+      use_billing.in?([true, 'true', '1'])
+    end
+
+    def stamp_email_marketing_consent
+      self.email_marketing_consent_updated_at = Time.current
+      self.email_marketing_consent_source = @consent_source.presence || Spree::ConsentRecord::UNKNOWN
+    end
+
+    def sync_newsletter_subscription_with_marketing_consent
+      if accepts_email_marketing?
+        Spree::NewsletterSubscriber.subscribe(email: email, customer: self)
+      else
+        # Only remove the subscriber for the current store, mirroring the store-scoped subscribe path.
+        newsletter_subscriber&.destroy
+      end
+    end
+  end
+end

data/app/models/concerns/spree/deprecated_customer_alias.rb

@@ -0,0 +1,22 @@
+module Spree
+  # Deprecation shim for the 6.0 user_id -> customer_id / belongs_to :user -> :customer
+  # rename. Included by customer-facing models so `.user` / `.user_id` keep working
+  # for one release. Remove in Spree 6.1.
+  module DeprecatedCustomerAlias
+    extend ActiveSupport::Concern
+
+    included do
+      alias_attribute :user_id, :customer_id
+    end
+
+    def user
+      Spree::Deprecation.warn("#{self.class}#user is deprecated and will be removed in Spree 6.1. Use #customer instead.") if defined?(Spree::Deprecation)
+      customer
+    end
+
+    def user=(value)
+      Spree::Deprecation.warn("#{self.class}#user= is deprecated and will be removed in Spree 6.1. Use #customer= instead.") if defined?(Spree::Deprecation)
+      self.customer = value
+    end
+  end
+end