spree_core 5.6.1 → 6.0.0.beta1

data/app/models/concerns/spree/password_policy.rb

@@ -0,0 +1,37 @@
+module Spree
+  # Password policy for the default auth models (Customer, AdminUser).
+  #
+  # The policy itself lives in {Spree.password_validator} — by default
+  # {Spree::PasswordLengthValidator}. Swap that to replace it wholesale.
+  #
+  # Validation runs only while a password is actually being set, so raising the
+  # floor on an existing install invalidates no stored digest — short legacy
+  # passwords keep working until their owner next changes them.
+  module PasswordPolicy
+    extend ActiveSupport::Concern
+
+    included do
+      validates :password, confirmation: true, allow_blank: true
+
+      # Resolved per call rather than at include time so an integrator can swap
+      # the validator after the models have loaded, and so a development reload
+      # picks up changes to it.
+      validate :validate_password_policy, if: :password_policy_applicable?
+    end
+
+    private
+
+    # Only vet a password that is actually being set. +has_secure_password+ leaves
+    # the virtual +password+ populated in memory after a save, so testing it alone
+    # would re-validate an untouched record — and raising the floor on a live
+    # install would then break saves for every existing user whose password is
+    # shorter than the new minimum.
+    def password_policy_applicable?
+      password.present? && password_digest_changed?
+    end
+
+    def validate_password_policy
+      Spree.password_validator.new(attributes: [:password]).validate(self)
+    end
+  end
+end

data/app/models/concerns/spree/payment_session_transitions.rb

@@ -0,0 +1,93 @@
+module Spree
+  # Status transitions shared by PaymentSession and PaymentSetupSession —
+  # the replacement for their (identical) state machines.
+  #
+  # Transitions are non-raising, matching the machines' non-bang events: the
+  # webhook and synchronous completion paths race by design, and the loser
+  # must land as a no-op `false`, never an exception. Each transition
+  # publishes through the model's own publish_*_event method, exactly once —
+  # only the writer whose conditional update moved the row publishes.
+  #
+  # A transition writes status alone — unlike the machine's save, it never
+  # carries other dirty attributes along; a caller persists its own.
+  module PaymentSessionTransitions
+    extend ActiveSupport::Concern
+
+    included do
+      include Spree::HasStatus
+      has_status :pending, :processing, :completed, :failed, :canceled, :expired,
+                 default: :pending
+    end
+
+    # Guards preserved from the machine's transition graph.
+    def can_process?
+      pending?
+    end
+
+    %w[complete fail cancel expire].each do |transition|
+      define_method(:"can_#{transition}?") { pending? || processing? }
+    end
+
+    def process
+      return false unless transition_to('processing', from: %w[pending])
+
+      publish_processing_event
+      true
+    end
+
+    def complete
+      return false unless transition_to('completed', from: %w[pending processing])
+
+      publish_completed_event
+      true
+    end
+
+    def fail
+      return false unless transition_to('failed', from: %w[pending processing])
+
+      publish_failed_event
+      true
+    end
+
+    def cancel
+      return false unless transition_to('canceled', from: %w[pending processing])
+
+      publish_canceled_event
+      true
+    end
+
+    def expire
+      return false unless transition_to('expired', from: %w[pending processing])
+
+      publish_expired_event
+      true
+    end
+
+    private
+
+    # A compare-and-swap on the status column, like Payment's processing
+    # claim: the conditional update either moves the row or touches nothing,
+    # and the loser is the writer whose update matched no row. Deliberately
+    # not with_lock — its reload would wipe the session's association cache
+    # mid-flow. The write is the transition event's, published by the
+    # caller; the generic lifecycle updated event does not fire for status
+    # flips.
+    def transition_to(to, from:)
+      if new_record?
+        return false unless status.in?(from)
+
+        self.status = to
+        save!
+        return true
+      end
+
+      claimed = self.class.where(id: id, status: from)
+                          .update_all(status: to, updated_at: Time.current) == 1
+      return false unless claimed
+
+      self.status = to
+      clear_attribute_changes(['status'])
+      true
+    end
+  end
+end

data/app/models/concerns/spree/payment_source_concern.rb

@@ -54,7 +54,7 @@ module Spree
                                           .merge(Spree::Order.incomplete)
 
       incomplete_payments.checkout.each(&:invalidate!)
-      incomplete_payments.where.not(state: :checkout).each(&:void!)
+      incomplete_payments.where.not(status: :checkout).each(&:void!)
     end
   end
 end

data/app/models/concerns/spree/personal_data_matching.rb

@@ -0,0 +1,120 @@
+module Spree
+  # Finds the rows that belong to one person across the tables that record an
+  # email without owning a customer.
+  #
+  # Shared by the access export and the erasure workflow so the two cannot
+  # disagree about which rows are about this person — an address one of them
+  # reaches and the other does not is either data disclosed but not erased, or
+  # erased but never disclosed.
+  #
+  # Matching is case-insensitive because the models disagree: a customer's and
+  # an order's address keeps the casing it was typed in, while a newsletter
+  # address is stored downcased. Someone who checks out as `Ada@Example.com`
+  # and subscribes as `ada@example.com` is one person, and an exact comparison
+  # would leave the guest checkout behind — still holding their name, street
+  # and IP address — after they asked to be forgotten.
+  module PersonalDataMatching
+    extend ActiveSupport::Concern
+
+    private
+
+    # Rows of `model` owned by this customer, plus the ones left behind by a
+    # guest checkout: someone who ordered as a guest and registered afterwards
+    # has purchases carrying their address and IP with a null customer.
+    #
+    # @param model [Class] an ActiveRecord class with `customer_id` and `email`
+    # @param email [String] the address to match, before any redaction
+    # @param customer_id [String, Integer]
+    # @return [ActiveRecord::Relation]
+    def rows_about_person(model, email:, customer_id:)
+      model.where(customer_id: customer_id).
+        or(with_email(model, email).where(customer_id: nil))
+    end
+
+    # Every card this person used: saved to the account — including ones they
+    # removed, since cards are soft-deleted — plus the ones a guest checkout
+    # left behind, which carry no customer and are reachable only through the
+    # payment that spent them. A payment names exactly one of a cart, an order
+    # or a group, and keeps the cart one until completion repoints it.
+    #
+    # @param customer [Spree::Customer]
+    # @param email [String] the address to match, before any redaction
+    # @return [Array<Integer, String>]
+    def personal_card_ids(customer, email:)
+      cards = Spree::Payment.where(source_type: 'Spree::CreditCard')
+
+      from_payments = cards.where(order_id: purchases_about_person(Spree::Order, customer, email: email).select(:id)).
+                      or(cards.where(cart_id: purchases_about_person(Spree::Cart, customer, email: email).select(:id))).
+                      or(cards.where(order_group_id: purchases_about_person(Spree::OrderGroup, customer, email: email).select(:id))).
+                      pluck(:source_id)
+
+      (customer.credit_cards.with_deleted.ids + from_payments).compact.uniq
+    end
+
+    # Consent this person gave, whether the account recorded it or an order did
+    # before the account existed.
+    #
+    # @param customer [Spree::Customer]
+    # @param email [String]
+    # @return [ActiveRecord::Relation]
+    def personal_consent_records(customer, email:)
+      Spree::ConsentRecord.
+        where(owner_type: customer.class.base_class.to_s, owner_id: customer.id).
+        or(with_email_not_owned_by_others(Spree::ConsentRecord, email,
+                                          customer_type: customer.class.base_class.to_s,
+                                          customer_id: customer.id))
+    end
+
+    # Newsletter sign-ups. Unlike a purchase, a sign-up at this address is this
+    # person's whoever owns the row — the address IS the subscription, so there
+    # is no unowned-only narrowing here.
+    #
+    # @param customer [Spree::Customer]
+    # @param email [String]
+    # @return [ActiveRecord::Relation]
+    def personal_newsletter_subscribers(customer, email:)
+      Spree::NewsletterSubscriber.where(customer_id: customer.id).
+        or(with_email(Spree::NewsletterSubscriber, email))
+    end
+
+    # Named for the two callers that spell the email differently: the export
+    # reads the live address, the erasure the one captured before redaction.
+    #
+    # @param model [Class]
+    # @param customer [Spree::Customer]
+    # @param email [String]
+    # @return [ActiveRecord::Relation]
+    def purchases_about_person(model, customer, email:)
+      rows_about_person(model, email: email, customer_id: customer.id)
+    end
+
+    # Rows of `model` whose `email` is this address, whatever its casing.
+    #
+    # @param model [Class]
+    # @param email [String]
+    # @return [ActiveRecord::Relation]
+    def with_email(model, email)
+      model.where(model.arel_table[:email].lower.eq(email.to_s.downcase))
+    end
+
+    # Rows at this address that no *other* person already owns.
+    #
+    # Consent given before an account existed is owned by nothing, or by the
+    # order it was given during — both are this person's. A row owned by a
+    # different customer is theirs, however the address now reads: addresses
+    # get reused, and someone signing up at a colleague's old one must not
+    # inherit their consent history or be able to erase it.
+    #
+    # @param model [Class] an ActiveRecord class with a polymorphic `owner`
+    # @param email [String]
+    # @param customer_type [String] the owner type that denotes an account
+    # @param customer_id [String, Integer]
+    # @return [ActiveRecord::Relation]
+    def with_email_not_owned_by_others(model, email, customer_type:, customer_id:)
+      with_email(model, email).
+        where.not(owner_type: customer_type).
+        or(with_email(model, email).where(owner_type: customer_type, owner_id: customer_id)).
+        or(with_email(model, email).where(owner_type: nil))
+    end
+  end
+end

data/app/models/concerns/spree/preference_schema.rb

@@ -5,9 +5,28 @@ module Spree
   # Used by the admin API (`/payment_methods/types`, `/promotion_actions/types`,
   # `/promotion_rules/types`) so that admin UIs can render configuration forms
   # for any provider/action/rule subclass without hard-coding field lists.
+  #
+  # Also hosts the subclass registry (`registers_subclasses_via`) that
+  # `find_by_api_type` and `subclasses_with_preference_schema` resolve against.
+  # That is a lodger rather than a natural fit — the registry is its own
+  # concept, and `Spree::CalculatedAdjustments` resolves an equivalent one
+  # separately. Extract a `Spree::RegisteredSubclasses` concern when a family
+  # needs the registry without preferences.
   module PreferenceSchema
     extend ActiveSupport::Concern
 
+    # Raised when a class reaches registry resolution without declaring one.
+    # A StandardError so host apps' normal rescues catch it — NotImplementedError
+    # descends from ScriptError and slips past `rescue => e`.
+    class UndeclaredRegistryError < StandardError; end
+
+    included do
+      # Where this class's registered subclasses live, as a block evaluated on
+      # the class. `class_attribute` so STI subclasses inherit their parent's
+      # declaration.
+      class_attribute :subclass_registry, instance_accessor: false, default: nil
+    end
+
     delegate :preference_schema, :serialized_preference_schema, :password_preference_keys, to: :class
 
     # Wire-safe view of `preferences` with `:password`-typed values
@@ -23,7 +42,8 @@ module Spree
 
     class_methods do
       # Returns `[{ key:, type:, default: }]` for every preference declared
-      # on this class (and its ancestors). Skips deprecated preferences.
+      # on this class (and its ancestors). Skips deprecated and internal
+      # preferences.
       #
       # Memoized at class load — the schema is derived from the static
       # `preference :name, :type` declarations, so it can never change at
@@ -31,6 +51,11 @@ module Spree
       # serializers don't allocate `pref.to_s` per request.
       def preference_schema
         @preference_schema ||= compute_preference_schema
+
+        # An empty list to callers either way; only the memo tells the two
+        # apart, so a schema that could not be computed is retried rather than
+        # settled on.
+        @preference_schema || []
       end
 
       # Wire-safe variant of `preference_schema` with `:password`
@@ -43,8 +68,14 @@ module Spree
       # `Masking.serialize` to avoid `to_s` allocations per request, not
       # part of the documented `{ key, type, default }` wire shape.
       def serialized_preference_schema
-        @serialized_preference_schema ||= preference_schema.map do |field|
+        fields = preference_schema
+        # Nothing to memoize yet: the schema could not be computed, and
+        # settling on its empty stand-in would outlive the reason for it.
+        return fields if @preference_schema.nil?
+
+        @serialized_preference_schema ||= fields.map do |field|
           wire = { key: field[:key], type: field[:type], default: field[:default] }
+          wire[:choices] = field[:choices] if field[:choices].present?
           wire[:default] = nil if field[:type] == :password
           wire.freeze
         end.freeze
@@ -54,25 +85,58 @@ module Spree
       # so write-side guards (e.g. the masked-round-trip check) don't
       # walk the schema or fall back to a `rescue NoMethodError`.
       def password_preference_keys
-        @password_preference_keys ||= preference_schema
+        fields = preference_schema
+        return Set.new.freeze if @preference_schema.nil?
+
+        @password_preference_keys ||= fields
                                       .each_with_object(Set.new) { |field, set| set << field[:key] if field[:type] == :password }
                                       .freeze
       end
 
+      # Declared order first, so a form reads the way its author grouped the
+      # fields; anything the macro did not record (an association writer that
+      # looks like a preference) keeps its existing place at the end.
+      def ordered_preferences(instance)
+        defined = instance.defined_preferences
+        return defined unless respond_to?(:declared_preference_order)
+
+        declared = declared_preference_order & defined
+        declared + (defined - declared)
+      end
+
       def compute_preference_schema
-        instance = new
-        instance.defined_preferences.filter_map do |pref|
+        # Only instantiation is guarded. `new` touches the database to read
+        # the column list, so it fails whenever the schema is asked for before
+        # a connection exists — at boot, or in a rake task on an empty
+        # database. Describing the preferences themselves is pure Ruby, so an
+        # error there is a real bug: left inside the rescue it would return an
+        # empty schema and quietly strip every field from the admin form.
+        # Nil rather than an empty list, so `preference_schema`'s `||=` asks
+        # again next time. Memoizing the failure would leave a class describing
+        # no preferences for the life of the process because it was first asked
+        # before the database was up.
+        instance = begin
+          new
+        rescue StandardError
+          return nil
+        end
+
+        ordered_preferences(instance).filter_map do |pref|
           next if instance.preference_deprecated(pref)
+          # Written by Spree, not supplied by the operator — a value a
+          # provider hands back after we register something with it. Offering
+          # it as a field invites somebody to type over a secret that
+          # signature verification depends on.
+          next if instance.preference_internal(pref)
 
           {
             key: pref,
             key_string: pref.to_s.freeze,
             type: instance.preference_type(pref),
-            default: safe_preference_default(instance, pref)
-          }.freeze
+            default: safe_preference_default(instance, pref),
+            choices: instance.preference_choices(pref)
+          }.compact.freeze
         end
-      rescue StandardError
-        []
       end
 
       # Builds a `parse_on_set:` lambda for `preference :foo_ids, :array`
@@ -83,7 +147,7 @@ module Spree
       #
       # When `klass` is nil, prefixed-ID decoding is skipped — used for
       # ISO/string-keyed preferences where the value is the identifier
-      # (e.g. country `:country_isos`).
+      # (e.g. country `:country_codes`).
       #
       # When `scope:` is given, the existence check runs through the
       # scope relation derived from the owning record — prevents a
@@ -130,17 +194,41 @@ module Spree
       # for stable output. Uses `serialized_preference_schema` so
       # `:password` defaults are redacted — `/types` is an unauthenticated
       # discovery surface and must never leak gateway-shipped defaults.
+      #
+      # `label` and `description` are a fallback, not the admin UI's copy:
+      # they resolve in the request's locale, which is the store's rather
+      # than the admin's interface language. The dashboard renders `type`
+      # from its own locale files and reads these only for a type it has no
+      # translation for — an extension gem shipping no dashboard locales.
       def subclasses_with_preference_schema
         registered_subclasses.map do |klass|
-          {
+          entry = {
             type: klass.api_type,
             label: subclass_label(klass),
-            description: klass.respond_to?(:description) ? klass.description : nil,
+            # Families differ on which method carries the sentence: the rule
+            # base classes define `human_description`, the rest `description`.
+            # Asking for only one left promotion types with a null description
+            # and no fallback for a client without its own translation.
+            description: subclass_description(klass),
             preference_schema: klass.respond_to?(:serialized_preference_schema) ? klass.serialized_preference_schema : []
           }
+          # Only present when true, so families without the concept keep
+          # their wire shape byte-identical. Pickers stop offering a
+          # superseded kind; existing rows still render and match.
+          entry[:superseded] = true if klass.respond_to?(:superseded?) && klass.superseded?
+          entry
         end.sort_by { |entry| entry[:label] }
       end
 
+      # @return [String, nil] the class's own one-line description, from
+      #   whichever accessor its family defines
+      def subclass_description(klass)
+        return klass.human_description if klass.respond_to?(:human_description)
+        return klass.description if klass.respond_to?(:description)
+
+        nil
+      end
+
       # STI subclasses share the parent's `model_name`, so calling
       # `klass.model_name.human` would return "Payment Method" for every
       # entry. Subclasses can override by defining a class-level
@@ -166,17 +254,30 @@ module Spree
         outer.delete_prefix('Spree').presence&.titleize || leaf.titleize
       end
 
+      # Declares where this STI parent's subclass registry lives, powering
+      # `find_by_api_type` and `subclasses_with_preference_schema`. The block
+      # is evaluated on the class, so it can read config that changes at boot:
+      #
+      #   registers_subclasses_via { Spree.delivery_method_rules }
+      #
+      # @return [void]
+      def registers_subclasses_via(&block)
+        self.subclass_registry = block
+      end
+
       private
 
-      # Each STI parent (PaymentMethod, PromotionAction, PromotionRule)
-      # already exposes its registry — we just route to the right one.
-      # Override in the including class to add support for custom parents.
+      # Resolves the declared registry.
+      #
+      # Raises rather than returning an empty list: a missing declaration used
+      # to mean `find_by_api_type` silently returned nil, so typed rows were
+      # dropped from a payload with no error and admin pickers rendered empty.
       def registered_subclasses
-        return providers if respond_to?(:providers)
-        return Spree.promotions.actions if name == 'Spree::PromotionAction'
-        return Spree.promotions.rules if name == 'Spree::PromotionRule'
+        raise UndeclaredRegistryError,
+              "#{name} has no subclass registry. Declare one with " \
+              '`registers_subclasses_via { ... }` returning the registered subclasses.' if subclass_registry.nil?
 
-        []
+        instance_exec(&subclass_registry)
       end
 
       # Defaults can be Procs that hit the database (e.g. `Spree::Store.default`);

data/app/models/concerns/spree/prefixed_id.rb

@@ -114,7 +114,7 @@ module Spree
       end
 
       # Resolve an array of prefixed IDs for a has_many _ids setter.
-      # Infers the target class from the association name (e.g., taxon_ids → taxons → Spree::Taxon).
+      # Infers the target class from the association name (e.g., taxon_ids → taxons → Spree::Category).
       # Only resolves when a matching association exists.
       def resolve_prefixed_ids_for_attribute(attribute_name, values)
         association_name = attribute_name.sub(/_ids$/, '').pluralize
@@ -132,20 +132,42 @@ module Spree
         end
       end
 
+      # Builds the prefixed id for a raw primary key without loading the row —
+      # for serializing foreign keys (e.g. Order#cart_id) where fetching the
+      # associated record just to re-encode its id would be wasted I/O.
+      # @param id [Integer, String, nil]
+      # @return [String, nil]
+      def prefixed_id_for(id)
+        return nil if id.blank?
+
+        "#{_prefix_id_prefix}_#{Spree::PrefixedId::SQIDS.encode([id.to_i])}"
+      end
+
       def find_by_prefix_id!(prefixed_id)
-        decoded = Spree::PrefixedId.decode_prefixed_id(prefixed_id)
+        decoded = decode_own_prefixed_id(prefixed_id)
         raise ActiveRecord::RecordNotFound.new("Couldn't find #{name} with prefixed id=#{prefixed_id}", name) unless decoded
 
         find(decoded)
       end
 
       def find_by_prefix_id(prefixed_id)
-        decoded = Spree::PrefixedId.decode_prefixed_id(prefixed_id)
+        decoded = decode_own_prefixed_id(prefixed_id)
         return nil unless decoded
 
         find_by(id: decoded)
       end
 
+      # Rejects prefixed IDs from other models — an or_ ID must never
+      # resolve a cart just because the numeric payloads collide.
+      def decode_own_prefixed_id(prefixed_id)
+        if _prefix_id_prefix.present?
+          expected = "#{_prefix_id_prefix}_"
+          return nil unless prefixed_id.to_s.start_with?(expected)
+        end
+
+        Spree::PrefixedId.decode_prefixed_id(prefixed_id)
+      end
+
       def decode_prefixed_id(prefixed_id_string)
         Spree::PrefixedId.decode_prefixed_id(prefixed_id_string)
       end

data/app/models/concerns/spree/presentation_translatable.rb

@@ -1,39 +1,6 @@
 module Spree
-  # Shared by models whose single translatable field is the legacy
-  # +presentation+ column exposed publicly as +label+ (OptionType, OptionValue).
-  # Carries the Mobility setup, the translation-table normalizer, the
-  # locale-aware +label+/+label=+ bridge, and the +label → presentation+
-  # translation-matrix alias in one place so the two models don't restate it.
-  module PresentationTranslatable
-    extend ActiveSupport::Concern
-    include Spree::TranslatableResource
-
-    TRANSLATABLE_FIELDS = %i[presentation].freeze
-
-    included do
-      translates(*TRANSLATABLE_FIELDS, column_fallback: Spree.mobility_column_fallback)
-
-      self::Translation.class_eval do
-        normalizes :presentation, with: ->(value) { value&.to_s&.squish&.presence }
-      end
-    end
-
-    class_methods do
-      # The translation matrix uses +label+ (the public API name) for read/write
-      # symmetry; the +label+/+label=+ bridge below routes it to +presentation+.
-      def translatable_field_aliases
-        { label: :presentation }
-      end
-    end
-
-    # alias_attribute bypasses Mobility's locale-aware reader/writer, so these
-    # explicit delegations are required to keep +label+ translation-aware.
-    def label(*args, **kwargs)
-      presentation(*args, **kwargs)
-    end
-
-    def label=(value)
-      self.presentation = value
-    end
-  end
+  # Constant alias for the legacy Spree::PresentationTranslatable, renamed to
+  # Spree::LabelTranslatable in 6.0 along with the column it wrapped.
+  # Remove in 6.1.
+  PresentationTranslatable = LabelTranslatable
 end