spree_core 5.6.1 → 6.0.0.beta1

data/app/services/spree/carts/update.rb

@@ -6,24 +6,46 @@ module Spree
       def call(cart:, params:)
         @cart = cart
         @params = params.to_h.deep_symbolize_keys
-        was_in_cart = cart.cart?
+        was_in_checkout = cart.in_checkout?
 
         ApplicationRecord.transaction do
           assign_cart_attributes
           clear_shipping_address_if_outside_market
           assign_address(:shipping_address)
           assign_address(:billing_address)
+          assign_default_addresses
 
           cart.save!
 
           process_items
           try_advance
-          sync_stock_reservations(was_in_cart: was_in_cart)
+          sync_stock_reservations(was_in_checkout: was_in_checkout)
         end
 
         success(cart)
       rescue ActiveRecord::RecordNotFound
         raise
+      rescue Spree::Pricing::PriceResolution::ProviderUnavailable => e
+        # A strict store could not confirm a price. The transaction has rolled
+        # back, so the address change is not committed either — better than
+        # saving a destination whose prices nobody stood behind.
+        #
+        # The in-memory cart still holds the rolled-back attributes, though, so
+        # a caller that renders the object it passed in would show the customer
+        # an address the database never accepted. Reload it to match what was
+        # actually kept, carrying the transient warnings across as try_advance
+        # does.
+        Rails.error.report(e, context: { order_id: cart.id }, source: 'spree.checkout')
+
+        warnings = cart.warnings
+        begin
+          cart.reload
+        rescue StandardError # rubocop:disable Lint/SuppressedException
+          # a reload failure must not mask the pricing failure being reported
+        end
+        cart.warnings |= warnings if warnings.present?
+
+        failure(cart, Spree.t('cart_line_item.pricing_unavailable'))
       rescue ActiveRecord::RecordInvalid => e
         failure(cart, e.record.errors.full_messages.to_sentence)
       rescue StandardError => e
@@ -34,57 +56,145 @@ module Spree
 
       attr_reader :cart, :params
 
+      # Pickup intent counts as a destination change: proposals priced for
+      # shipping (or for another counter) are stale once the customer picks
+      # or clears a pickup location.
+      def destination_changed?
+        cart.saved_change_to_ship_address_id? ||
+          cart.saved_change_to_market_id? ||
+          cart.saved_change_to_preferred_stock_location_id?
+      end
+
       def assign_cart_attributes
         cart.email = params[:email] if params[:email].present?
         cart.customer_note = params[:customer_note] if params.key?(:customer_note)
+        cart.po_number = params[:po_number] if params.key?(:po_number)
 
         assign_market if params[:market_id].present?
         cart.currency = params[:currency].upcase if params[:currency].present?
         cart.locale = params[:locale] if params[:locale].present?
         cart.metadata = cart.metadata.merge(params[:metadata].to_h) if params[:metadata].present?
         cart.use_shipping = params[:use_shipping] if params.key?(:use_shipping)
+        assign_preferred_stock_location if params.key?(:preferred_stock_location_id)
+        assign_company if params.key?(:company_id)
+        assign_po_document if params.key?(:po_document)
       end
 
-      def assign_address(address_type)
-        address_id_param = params[:"#{address_type}_id"]
-        address_params = params[address_type]
+      # The buyer's purchase order as an ActiveStorage signed blob id — the
+      # bytes are normally already in storage by the time this runs. A blank
+      # value detaches, so a buyer can withdraw a document they attached in
+      # error.
+      #
+      # An abandoned direct upload leaves the blob row behind without its
+      # bytes, and the buyer's client may still send back the signed id it was
+      # handed. ActiveStorage raises a message-less FileNotFoundError for that,
+      # which would otherwise reach the storefront as a bare class name.
+      def assign_po_document
+        value = params[:po_document]
 
-        if address_id_param.present?
-          address_id = resolve_address_id(address_id_param)
-          cart.public_send(:"#{address_type}_id=", address_id) if address_id
+        if value.blank?
+          cart.po_document.detach
+        else
+          cart.po_document.attach(value)
+        end
+      rescue ActiveStorage::FileNotFoundError
+        cart.errors.add(:po_document, :po_document_upload_incomplete, message: Spree.t(:po_document_upload_incomplete))
+        raise ActiveRecord::RecordInvalid, cart
+      end
+
+      # Which company node the purchase is for. Resolved through the cart's
+      # store so a foreign node 404s; the model validates that the cart's
+      # customer has standing over it.
+      def assign_company
+        value = params[:company_id]
+
+        if value.blank?
+          cart.company_id = nil
+          return
+        end
+
+        cart.company_id = cart.store.companies.find_by_prefix_id!(value).id
+      end
+
+      # Storefront pickup selection: resolves the public prefixed ID (or raw
+      # ID) against the store's pickup-enabled locations, intersected with
+      # the channel's served set — a counter the channel cannot fulfill from
+      # 404s exactly like a non-pickup one. Enforced here at the API boundary,
+      # mirroring Orders::Create.
+      def assign_preferred_stock_location
+        value = params[:preferred_stock_location_id]
+
+        if value.blank?
+          cart.preferred_stock_location_id = nil
           return
         end
 
+        eligible = cart.store.stock_locations.pickup_enabled
+        eligible = eligible.merge(cart.channel.served_stock_locations) if cart.channel
+        cart.preferred_stock_location_id = eligible.find_by_param!(value).id
+      end
+
+      def assign_address(address_type)
+        address_id_param = params[:"#{address_type}_id"]
+        return resolve_and_assign(address_type, address_id_param) if address_id_param.present?
+
+        address_params = params[address_type]
         return unless address_params.is_a?(Hash)
 
         if address_params[:id].present?
-          address_id = resolve_address_id(address_params[:id])
-          cart.public_send(:"#{address_type}_id=", address_id) if address_id
+          resolve_and_assign(address_type, address_params[:id])
         else
-          # Only revert to address state when shipping address changes.
-          # Billing address updates (e.g. during payment) should not
-          # destroy shipments and reset the checkout flow.
-          revert_to_address_state if address_type == :shipping_address && cart.has_checkout_step?('address')
-          cart.public_send(:"#{address_type}_attributes=", address_params)
+          with_address_recalc_tracking(address_type) do
+            cart.public_send(:"#{address_type}_attributes=", address_params)
+          end
         end
       end
 
+      def resolve_and_assign(address_type, prefixed_id)
+        address_id = resolve_address_id(prefixed_id)
+        assign_address_id(address_type, address_id) if address_id
+      end
+
+      def assign_address_id(address_type, address_id)
+        return if cart.public_send(:"#{address_type}_id") == address_id
+
+        with_address_recalc_tracking(address_type) do
+          cart.public_send(:"#{address_type}_id=", address_id)
+        end
+      end
+
+      def with_address_recalc_tracking(address_type)
+        tax_address_was = cart.tax_address
+        yield
+
+        # Shipping changes always affect delivery proposals; billing changes only
+        # matter when they shift which address computes tax.
+        @address_invalidated = true if address_type == :shipping_address || cart.tax_address != tax_address_was
+      end
+
       def process_items
         return unless params[:items].is_a?(Array)
 
-        result = Spree::Carts::UpsertItems.call(
-          cart: cart,
-          items: params[:items]
-        )
+        result = Spree.cart_upsert_items_workflow.call(cart: cart, items: params[:items])
 
         raise StandardError, result.error.to_s if result.failure?
       end
 
+      # Legacy `before_transition to: :address` parity: once a signed-in
+      # customer is in checkout, blank address slots fill from their saved
+      # defaults (assign_default_addresses! guards each slot itself).
+      def assign_default_addresses
+        return unless cart.customer
+        return unless cart.email.present? || cart.ship_address_id.present?
+
+        cart.assign_default_addresses!
+      end
+
       def resolve_address_id(prefixed_id)
-        return unless cart.user
+        return unless cart.customer
 
         decoded = Spree::Address.decode_prefixed_id(prefixed_id)
-        decoded ? cart.user.addresses.find_by(id: decoded)&.id : nil
+        decoded ? cart.customer.addresses.find_by(id: decoded)&.id : nil
       end
 
       def assign_market
@@ -97,52 +207,48 @@ module Spree
       # is not part of the new market. The market dictates which countries
       # are available for checkout.
       def clear_shipping_address_if_outside_market
-        return unless cart.market_id_changed? && cart.ship_address&.country
+        return unless cart.market_id_changed? && cart.ship_address&.country_code.present?
 
-        unless cart.market.country_ids.include?(cart.ship_address.country_id)
+        unless cart.market.country_codes.include?(cart.ship_address.country_code)
           cart.ship_address = nil
-          revert_to_address_state if cart.has_checkout_step?('address')
+          @address_invalidated = true
         end
       end
 
-      def revert_to_address_state
-        return if ['cart', 'address'].include?(cart.state)
-
-        cart.state = 'address'
-      end
-
       # Three-way dispatch on the cart→checkout transition:
       # entering checkout → Reserve, mid-checkout mutation → Extend, reverting to cart → Release.
       # A failed Reserve raises so the enclosing transaction rolls back and the
       # outer rescue surfaces the error to the API caller.
-      def sync_stock_reservations(was_in_cart:)
-        if cart.cart?
-          Spree::StockReservations::Release.call(order: cart) unless was_in_cart
-        elsif was_in_cart
-          result = Spree::StockReservations::Reserve.call(order: cart)
-          raise Spree::StockReservations::InsufficientStockError.new(nil, result.error.to_s) if result.failure?
+      def sync_stock_reservations(was_in_checkout:)
+        if !cart.in_checkout?
+          Spree::StockReservations::Release.call(cart: cart) if was_in_checkout
+        elsif was_in_checkout
+          Spree::StockReservations::Extend.call(cart: cart)
         else
-          Spree::StockReservations::Extend.call(order: cart)
+          result = Spree::StockReservations::Reserve.call(cart: cart)
+          raise Spree::StockReservations::InsufficientStockError.new(nil, result.error.to_s) if result.failure?
         end
       end
 
-      # Auto-advance as far as the checkout state machine allows, but never
-      # to complete. The complete transition must always be explicit via
-      # the /carts/:id/complete endpoint — otherwise gift cards or store
-      # credits that fully cover the order total would auto-complete the
-      # cart during address/delivery updates.
+      # Recalculation-on-write: address/market changes re-price, re-tax and
+      # rebuild delivery proposals; completion stays explicit via the
+      # /carts/:id/complete endpoint (a fully-covered cart must never
+      # auto-complete during address updates).
       def try_advance
-        return if cart.complete? || cart.canceled?
-
-        steps = cart.checkout_steps
-        loop do
-          current_index = steps.index(cart.state).to_i
-          next_step = steps[current_index + 1]
-          break if next_step.nil? || next_step == 'complete'
-          break unless cart.next
+        return if cart.complete?
+
+        if @address_invalidated || destination_changed?
+          cart.recalculate_for_address_change!
+        else
+          cart.recalculate_totals!
         end
+      rescue Spree::Pricing::PriceResolution::ProviderUnavailable
+        # Deliberately not swallowed like the rest: a strict store refusing to
+        # price must roll the whole update back, so `call` sees it and the
+        # address change does not commit around unconfirmed prices.
+        raise
       rescue StandardError => e
-        Rails.error.report(e, context: { order_id: cart.id, state: cart.state }, source: 'spree.checkout')
+        Rails.error.report(e, context: { order_id: cart.id }, source: 'spree.checkout')
       ensure
         # A halted transition records warnings on the cart, which reload would drop, so carry them across the reload.
         warnings = cart.warnings

data/app/services/spree/catalogs/resolve_prices.rb

@@ -0,0 +1,192 @@
+module Spree
+  module Catalogs
+    # Answers "what does a buyer on this agreement pay for this product, and
+    # where does that number come from" — the reading behind the catalog's
+    # products-with-prices view (docs/plans/6.0-catalog-agreement-rework.md).
+    #
+    # Three sources, in the order the pricing resolver itself consults them:
+    # an explicit row on the catalog's owned list, that list's percentage
+    # adjustment applied to the base price, or the variant's own base price
+    # when the catalog prices at base or the list says nothing about this
+    # variant. A catalog whose assortment holds a product its list never
+    # prices reads as `base` — which is the divergence the view exists to
+    # make visible.
+    #
+    # No buyer is involved: an owned list applies because the catalog
+    # applies, so the agreement alone decides the number. Contextual rules on
+    # the list (a volume threshold) are deliberately not consulted — they ask
+    # about the purchase, which a merchant reading an agreement is not making.
+    #
+    # Nor is the catalog's own `active` flag. This answers "what will this
+    # agreement charge", not "what is anyone paying right now": a catalog is
+    # born inactive and is priced before it goes live, so reporting base
+    # prices while it is a draft would show every row undiscounted beside a
+    # pricing card promising a percentage — exactly when checking the
+    # agreement matters most. What an active catalog charges a real buyer is
+    # `PricingProvider::Internal`'s question, and its specs pin the two
+    # together.
+    #
+    # Built once per page of products and reused, so a fifty-row listing is
+    # two queries rather than a hundred.
+    #
+    # Built from a catalog, the list read is the catalog's own and only while
+    # it is in effect — a draft or expired list leaves the agreement at base.
+    # Built from a price list directly, that list is read as it stands: the
+    # caller is the list's own editor, where a merchant pricing a draft has
+    # to see the rows they are typing (docs/plans/6.0-volume-pricing.md).
+    class ResolvePrices
+      # @param catalog [Spree::Catalog, nil] the agreement to read, through its list
+      # @param price_list [Spree::PriceList, nil] a list to read as-is; one of the two
+      # @param currency [String] the currency to read prices in
+      def initialize(currency:, catalog: nil, price_list: nil)
+        raise ArgumentError, 'pass a catalog or a price list' if catalog.nil? && price_list.nil?
+
+        @catalog = catalog
+        @price_list = price_list unless price_list.nil?
+        @currency = currency.to_s.upcase
+      end
+
+      # Loads the price rows every given variant needs, so callers resolving a
+      # page of products pay for two queries rather than one per row.
+      #
+      # @param variants [Array<Spree::Variant>]
+      # @return [void]
+      def preload(variants)
+        ids = Array(variants).map(&:id)
+        return if ids.empty?
+
+        # Accumulated rather than replaced: a caller may preload in batches,
+        # and overwriting would send every variant from an earlier batch back
+        # to a query of its own.
+        #
+        # An empty result still counts as loaded for that variant — a product
+        # nothing prices must not fall through to a query per row.
+        @rows = (@rows || {}).merge(ids.index_with { [] }).merge(price_rows_for(ids))
+      end
+
+      # The price this agreement gives for a variant.
+      #
+      # @param variant [Spree::Variant, nil]
+      # @return [Spree::CatalogPrice, nil] nil when nothing prices the variant
+      #   in this currency at all, or when there is no variant to price — a
+      #   product whose only variant was soft-deleted still has to render as a
+      #   row rather than taking the whole listing down with it
+      def call(variant)
+        return if variant.nil?
+
+        rows = rows_for(variant)
+        base = rows.detect { |row| row.price_list_id.nil? }
+
+        if price_list
+          list_rows = rows.select { |row| row.price_list_id == price_list.id }
+          break_count = list_rows.count { |row| row.min_quantity.to_i > 1 }
+          # The bottom rung only — this reading makes no purchase, so a deeper
+          # rung read as the single-unit price would name an amount the
+          # resolver does not charge at that quantity. A ladder starting above
+          # one unit therefore reads as base here, which is what a buyer of
+          # one actually pays.
+          explicit = list_rows.detect { |row| row.min_quantity.to_i == 1 }
+          return build(explicit, 'explicit', tiers: break_tiers(list_rows), variant: variant) if explicit
+
+          # Derived by the list itself, so the amount a merchant reads here is
+          # the one the pricing resolver charges — one formula, not two. A
+          # variant with a ladder is priced by the ladder alone, so the list's
+          # percentage is not reported for it either.
+          derived = price_list.automatic_pricing? && break_count.zero? ? price_list.derived_price_from(base, 1) : nil
+          return build(derived, 'automatic', tiers: band_tiers(base), variant: variant) if derived
+
+          # A list that prices this variant only from a quantity up charges
+          # the base price for a single unit, and says so — with the tiers
+          # counted, so the reading is "base now, less from a case up" rather
+          # than a bare base price that hides the agreement.
+          tiers_above = break_count.positive? ? break_tiers(list_rows) : band_tiers(base)
+          return build(base, 'base', tiers: tiers_above, variant: variant) if base && tiers_above.any?
+        end
+
+        base && build(base, 'base', variant: variant)
+      end
+
+      private
+
+      attr_reader :catalog, :currency
+
+      def price_list
+        return @price_list if defined?(@price_list)
+
+        # Only a list currently in effect prices anything; a draft or expired
+        # one leaves the agreement at base, which is what a buyer would pay.
+        list = catalog.price_list
+        @price_list = list&.currently_active? ? list : nil
+      end
+
+      # Preloaded rows when this variant was in the batch, a query when it
+      # was not: a caller who preloads a page and then asks about a variant
+      # outside it must get the real answer, not silence.
+      def rows_for(variant)
+        preloaded = @rows&.[](variant.id)
+        return preloaded if preloaded
+
+        price_rows_for([variant.id])[variant.id] || []
+      end
+
+      # Base rows always, the owned list's rows when there is one. `compact`
+      # would leave an empty list for a catalog pricing at base, and
+      # `price_list_id: []` matches nothing at all.
+      def price_rows_for(variant_ids)
+        list_ids = [nil, price_list&.id].uniq
+
+        Spree::Price.
+          where(variant_id: variant_ids, currency: currency).
+          where(price_list_id: list_ids).
+          where.not(amount: nil).
+          group_by(&:variant_id)
+      end
+
+      # The variant's own rungs above its ordinary price, as the agreement
+      # reads them: each carries the amount it is charged at.
+      #
+      # @param list_rows [Array<Spree::Price>]
+      # @return [Array<Spree::CatalogPriceTier>]
+      def break_tiers(list_rows)
+        list_rows.
+          select { |row| row.min_quantity.to_i > 1 }.
+          sort_by { |row| row.min_quantity.to_i }.
+          map do |row|
+            Spree::CatalogPriceTier.new(
+              min_quantity: row.min_quantity, amount: row.amount, currency: currency
+            )
+          end
+      end
+
+      # The list's percentage bands, resolved against the base price — so the
+      # reading is an amount a buyer pays rather than a percentage a merchant
+      # has to apply in their head.
+      #
+      # Loaded rather than counted: this is asked once per product row, and
+      # `.size` on an unloaded association issues a COUNT every time without
+      # ever populating it.
+      #
+      # @param base [Spree::Price, nil]
+      # @return [Array<Spree::CatalogPriceTier>]
+      def band_tiers(base)
+        return [] if price_list.nil? || base.nil?
+
+        price_list.price_adjustment_tiers.to_a.sort_by(&:min_quantity).filter_map do |band|
+          derived = price_list.derived_price_from(base, band.min_quantity)
+          next if derived.nil?
+
+          Spree::CatalogPriceTier.new(
+            min_quantity: band.min_quantity, amount: derived.amount, currency: currency
+          )
+        end
+      end
+
+      def build(price, source, tiers: [], variant: nil)
+        Spree::CatalogPrice.new(
+          amount: price.amount, currency: price.currency, source: source,
+          break_count: tiers.size, tiers: tiers, variant: variant
+        )
+      end
+    end
+  end
+end

data/app/services/spree/catalogs/resolve_quantity_rules.rb

@@ -0,0 +1,115 @@
+module Spree
+  module Catalogs
+    # Answers "how may this buyer order this variant" by walking their
+    # catalogs nearest-agreement-first.
+    #
+    # Resolution is **per field**, not all-or-nothing: the first catalog that
+    # states a minimum wins the minimum, the first that states a multiple wins
+    # the multiple, and an agreement silent on a field passes it through to
+    # the next rather than waiving it — a nearer catalog with no stated
+    # minimum must not silently drop the one behind it. Within a single
+    # catalog the variant override row beats that catalog's own default
+    # columns. Nothing anywhere leaves the variant's own base rules.
+    #
+    # The catalogs walked are whatever {Spree::Catalog.for_buyer} resolved,
+    # and that chain is exclusive by tier: a buyer with company catalogs never
+    # also carries their customer group's or the channel's default. So a
+    # channel-wide term is the floor for buyers who resolve NO company or
+    # group catalog, not a fallback beneath one — a company agreement that
+    # states nothing about a field lands on the variant's base rule, not on
+    # the channel default.
+    #
+    # Built once per cart or request and reused: resolving a fifty-line cart
+    # must not be fifty passes over the same catalogs.
+    class ResolveQuantityRules
+      # @param catalogs [Array<Spree::Catalog>] nearest agreement first
+      def initialize(catalogs)
+        @catalogs = Array(catalogs)
+      end
+
+      # Builds a resolver for a purchase's buyer, reusing the request's
+      # already-resolved catalog set where the purchase belongs to the store
+      # being served.
+      #
+      # @param purchase [Spree::Cart, Spree::Order]
+      # @return [Spree::Catalogs::ResolveQuantityRules]
+      def self.for_purchase(purchase)
+        new(catalogs_for(purchase))
+      end
+
+      # @param variant [Spree::Variant]
+      # @return [Spree::QuantityRule] the buyer's effective rules
+      def call(variant)
+        return variant.quantity_rule if catalogs.empty?
+
+        minimum = nil
+        multiple = nil
+
+        catalogs.each do |catalog|
+          override = override_for(catalog, variant)
+
+          minimum ||= override&.minimum_order_quantity || catalog.minimum_order_quantity
+          multiple ||= override&.order_multiple || catalog.order_multiple
+
+          break if minimum && multiple
+        end
+
+        Spree::QuantityRule.new(
+          minimum_order_quantity: minimum || variant.minimum_order_quantity,
+          order_multiple: multiple || variant.order_multiple
+        )
+      end
+
+      # The order minimum in effect for a currency: the first catalog with a
+      # row for it. Catalogs saying nothing about this currency pass through,
+      # so an agreement priced only in EUR does not waive a USD threshold set
+      # by another catalog in the same tier.
+      #
+      # @param currency [String]
+      # @return [Spree::CatalogOrderMinimum, nil]
+      def order_minimum(currency)
+        return nil if currency.blank? || catalogs.empty?
+
+        code = currency.to_s.upcase
+        catalogs.each do |catalog|
+          row = minimums_for(catalog)[code]
+          return row if row
+        end
+        nil
+      end
+
+      # Through the one entry point every catalog-reading surface uses, so a
+      # cart's terms come from the same agreement its prices did.
+      def self.catalogs_for(purchase)
+        Spree::Catalog.for_buyer(
+          store: purchase.store,
+          customer: purchase.try(:customer),
+          company: purchase.try(:resolved_company),
+          channel: purchase.try(:channel)
+        )
+      end
+      private_class_method :catalogs_for
+
+      private
+
+      attr_reader :catalogs
+
+      # One indexed row read per (catalog, variant), memoized: an agreement
+      # may state terms for thousands of SKUs, so loading the whole table to
+      # answer about one variant would put that on the add-to-cart path. The
+      # composite unique index makes the keyed read cheap.
+      def override_for(catalog, variant)
+        @overrides ||= {}
+        key = [catalog.id, variant.id]
+        return @overrides[key] if @overrides.key?(key)
+
+        @overrides[key] = catalog.quantity_rules.find_by(variant_id: variant.id)
+      end
+
+      def minimums_for(catalog)
+        @minimums ||= {}
+        @minimums[catalog.id] ||= catalog.order_minimums.index_by { |row| row.currency.to_s.upcase }
+      end
+    end
+  end
+end

data/app/services/spree/catalogs/set_assignments.rb

@@ -0,0 +1,59 @@
+module Spree
+  module Catalogs
+    # Replaces a catalog's audience with the given set.
+    #
+    # An audience absent from the payload is withdrawn, so the whole set
+    # arrives in one request — the agreement editor stages every change
+    # behind the catalog's Save, and applying half of them would show the
+    # agreement to people the merchant never confirmed.
+    class SetAssignments
+      prepend Spree::ServiceModule::Base
+
+      # @param catalog [Spree::Catalog]
+      # @param assignables [Array<Spree::CustomerGroup, Spree::Company>] the
+      #   audiences this catalog should be shown to, resolved by the caller
+      #   through the store so another tenant's record cannot reach here
+      # @return [Spree::ServiceModule::Result] value is the catalog
+      def call(catalog:, assignables:)
+        keys = Array(assignables).map { |record| [record.class.base_class.name, record.id] }
+        invalid = nil
+
+        ApplicationRecord.transaction do
+          withdraw(catalog, keys)
+
+          keys.zip(Array(assignables)).each do |(type, id), record|
+            next if catalog.catalog_assignments.exists?(assignable_type: type, assignable_id: id)
+
+            assignment = catalog.catalog_assignments.new(assignable: record)
+            next if assignment.save
+
+            # A plain service's `failure` returns rather than raising, so one
+            # bad row has to take the transaction down itself — otherwise the
+            # rest of the set commits and the caller is told it all worked.
+            invalid = assignment
+            raise ActiveRecord::Rollback
+          end
+        end
+
+        return failure(invalid) if invalid
+
+        success(catalog.reload)
+      end
+
+      private
+
+      # Rows the payload no longer names. Deleted per row rather than in one
+      # NOT IN clause, because the pair is polymorphic and an id means
+      # nothing without its type.
+      def withdraw(catalog, keys)
+        kept = keys.to_set
+
+        catalog.catalog_assignments.find_each do |assignment|
+          next if kept.include?([assignment.assignable_type, assignment.assignable_id])
+
+          assignment.destroy!
+        end
+      end
+    end
+  end
+end