spree_core 5.6.1 → 6.0.0.beta2

data/lib/tasks/package_types.rake

@@ -0,0 +1,62 @@
+namespace :spree do
+  namespace :upgrade do
+    desc <<~DESC
+      Turns each store's default package preferences into a default
+      Spree::PackageType row (Spree 6.0).
+
+      The box a store ships in used to be four loose preferences on the store
+      (default_package_weight/length/width/height). It is now a row in the
+      store's packaging vocabulary, alongside the cartons, pallets and
+      containers wholesale orders leave on, so the same geometry can be named,
+      reused and referenced by a product.
+
+      Stores that never configured a box — the preferences still at their
+      seeded zeros — get nothing, exactly as before: quoting falls back to
+      content weight with no tare and no dimensions.
+
+      Idempotent. A store that already has a default package type is skipped,
+      so this never overwrites a box the merchant has since edited.
+    DESC
+    task package_types: :environment do
+      created = 0
+      skipped = 0
+
+      Spree::Store.find_each do |store|
+        if store.default_package_type.present?
+          skipped += 1
+          next
+        end
+
+        # Read the raw preferences hash: the four keys no longer have
+        # declarations on Spree::Store, so there are no readers to call.
+        # Indifferent access because how the YAML column keyed them depends on
+        # what wrote it, and a symbol-only read would silently answer zero and
+        # discard a merchant's configured box.
+        preferences = (store.preferences || {}).with_indifferent_access
+        weight, length, width, height = %i[
+          default_package_weight default_package_length default_package_width default_package_height
+        ].map { |key| preferences[key].to_f }
+
+        if [weight, length, width, height].all?(&:zero?)
+          skipped += 1
+          next
+        end
+
+        store.package_types.create!(
+          name: Spree.t('package_types.default_name'),
+          kind: 'box',
+          default: true,
+          weight: weight.positive? ? weight : nil,
+          length: length.positive? ? length : nil,
+          width: width.positive? ? width : nil,
+          height: height.positive? ? height : nil,
+          dimensions_unit: store.metric_unit_system? ? 'cm' : 'in',
+          weight_unit: store.preferred_weight_unit
+        )
+        created += 1
+      end
+
+      puts "  Created #{created} default package type(s); skipped #{skipped} store(s)."
+    end
+  end
+end

data/lib/tasks/price_history.rake

@@ -23,14 +23,57 @@ namespace :spree do
       puts "Seeded #{count} price history records"
     end
 
-    desc 'Prune price history older than retention period'
+    # Retention is per store, because whether a shop records price history at
+    # all is (`track_price_history`). Pruning globally on one number would
+    # delete an EU store's Omnibus evidence on the schedule of its non-EU
+    # sibling.
+    desc 'Prune price history older than each store\'s retention period'
     task prune: :environment do
-      retention_days = Spree::Config[:price_history_retention_days] || 30
-      deleted = Spree::PriceHistory
-                .where('recorded_at < ?', retention_days.days.ago)
-                .delete_all
+      total = 0
 
-      puts "Pruned #{deleted} price history records older than #{retention_days} days"
+      Spree::Store.find_each do |store|
+        retention_days = store.preferred_price_history_retention_days
+        next if retention_days.blank?
+
+        # `with_deleted` on both: a soft-deleted variant or product still has
+        # price history, and a scope that skips it would match no store at all
+        # — leaving those rows to accumulate past the retention window the
+        # task exists to enforce.
+        variant_ids = Spree::Variant.with_deleted.
+                      joins(:product).merge(Spree::Product.with_deleted).
+                      where(spree_products: { store_id: store.id }).
+                      select(:id)
+
+        deleted = Spree::PriceHistory.
+                  where(variant_id: variant_ids).
+                  where(recorded_at: ...retention_days.days.ago).
+                  delete_all
+
+        total += deleted
+        puts "Store #{store.name}: pruned #{deleted} price history records older than #{retention_days} days"
+      end
+
+      # Rows whose variant or product was hard-deleted belong to no store's
+      # query and would otherwise outlive every retention window there is.
+      # Swept on the longest window in play, so no store loses evidence it is
+      # still required to be able to show.
+      longest = Spree::Store.all.filter_map { |store| store.preferred_price_history_retention_days }.max
+
+      if longest
+        owned = Spree::Variant.with_deleted.
+                joins(:product).merge(Spree::Product.with_deleted).
+                select(:id)
+
+        orphaned = Spree::PriceHistory.
+                   where.not(variant_id: owned).
+                   where(recorded_at: ...longest.days.ago).
+                   delete_all
+
+        total += orphaned
+        puts "Pruned #{orphaned} price history records with no surviving variant"
+      end
+
+      puts "Pruned #{total} price history records"
     end
   end
 end

data/lib/tasks/products.rake

@@ -1,6 +1,25 @@
 namespace :spree do
+  namespace :product_types do
+    desc 'Backfill store ownership on product types and clean orphaned joins'
+    task backfill: :environment do
+      default_store = Spree::Store.default
+      abort 'No default store found' unless default_store&.persisted?
+
+      count = Spree::ProductType.where(store_id: nil).update_all(store_id: default_store.id)
+      puts "product types assigned to #{default_store.code}: #{count}"
+
+      orphans = Spree::OptionTypeProductType.where.missing(:product_type)
+      puts "orphaned option-type joins removed: #{orphans.delete_all}"
+
+      Spree::ProductType.find_each do |product_type|
+        Spree::ProductType.reset_counters(product_type.id, :products)
+      end
+      puts 'product counters reset.'
+    end
+  end
+
   namespace :products do
-    desc 'Reset counter caches (variant_count, classification_count, media_count) on products'
+    desc 'Reset counter caches (variant_count, categories_count, media_count) on products'
     task reset_counter_caches: :environment do |_t, _args|
       puts 'Resetting product counter caches...'
 
@@ -9,7 +28,7 @@ namespace :spree do
 
         product.update_columns(
           variant_count: product.variants.count,
-          classification_count: product.classifications.count,
+          categories_count: product.product_categories.count,
           media_count: total_media,
           updated_at: Time.current
         )

data/lib/tasks/remove_master_variant.rake

@@ -0,0 +1,58 @@
+namespace :spree do
+  desc <<~DESC
+    Migrates products off the master variant. Idempotent (products that already
+    have a default_variant_id are skipped) and loud about deletions.
+
+    For each product:
+      * With real variants: point default_variant_id at the first variant by
+        position, then delete the now-empty master — unless it still carries
+        line items, in which case keep it as a discontinued regular variant
+        (is_master=false) so historical orders stay intact without exposing it
+        as a sellable variant.
+      * Simple (no-variant) products: convert the master into a regular variant
+        (is_master=false) and point default_variant_id at it.
+      * Recompute variant_count to the real variant count.
+
+    Prerequisite: run +spree:media:migrate_master_images_to_product_media+ first
+    so no master-pinned media is lost when ghost masters are deleted.
+  DESC
+  task remove_master_variant: :environment do
+    migrated = converted = deleted = kept = 0
+
+    # with_deleted: Product/Variant are paranoid, so soft-deleted rows would
+    # otherwise be skipped and keep a NULL default_variant_id.
+    Spree::Product.with_deleted.where(default_variant_id: nil).find_each do |product|
+      master = Spree::Variant.where(product_id: product.id, is_master: true).first
+      first_variant = Spree::Variant.where(product_id: product.id, is_master: false).order(:position).first
+
+      if first_variant
+        product.update_column(:default_variant_id, first_variant.id)
+
+        if master && master.line_items.exists?
+          # Keep for order history, but discontinue so the demoted master isn't
+          # exposed as a live, sellable variant.
+          master.update_columns(is_master: false, discontinue_on: master.discontinue_on || Time.current)
+          kept += 1
+        elsif master
+          Rails.logger.info("[remove_master_variant] deleting master variant #{master.id} of product #{product.id}")
+          master.really_destroy!
+          deleted += 1
+        end
+      elsif master
+        master.update_column(:is_master, false)
+        product.update_column(:default_variant_id, master.id)
+        converted += 1
+      else
+        next
+      end
+
+      variant_count = Spree::Variant.where(product_id: product.id, deleted_at: nil).count
+      product.update_column(:variant_count, variant_count)
+
+      migrated += 1
+    end
+
+    puts "  Migrated #{migrated} product(s): converted #{converted} simple master(s), " \
+         "deleted #{deleted} ghost master(s), kept #{kept} discontinued master(s) with order history."
+  end
+end

data/lib/tasks/rich_text.rake

@@ -0,0 +1,44 @@
+namespace :spree do
+  desc <<~DESC
+    Sanitizes rich text HTML already stored in the database through
+    +Spree::RichTextSanitizer+ — +spree_products.description+ and its
+    per-locale translations.
+
+    Run through +spree:upgrade+ (or on its own) after upgrading to Spree 5.6.2+,
+    ideally after reviewing the allowlist (+Spree::RichTextSanitizer.allowed_tags+
+    / +allowed_attributes+) and re-permitting anything your content relies on,
+    e.g. +iframe+ for embedded videos.
+
+    Idempotent — rows whose sanitized output already matches what is stored are
+    left untouched, and writes go through +update_all+ so callbacks, timestamps
+    and webhooks don't churn. Each write is conditional on the row still holding
+    the value that was sanitized, so concurrent edits are never clobbered.
+  DESC
+  task sanitize_rich_text: :environment do
+    # Writes only when the row still holds the value we sanitized, so an edit
+    # landing between the read and the write is never clobbered by this batch.
+    sanitize = lambda do |record|
+      original = record.description
+      sanitized = Spree::RichTextSanitizer.sanitize(original)
+      next false if sanitized == original
+
+      updated = record.class.unscoped.
+                where(id: record.id, description: original).
+                update_all(description: sanitized)
+
+      updated.positive?
+    end
+
+    products = 0
+    Spree::Product.with_deleted.where.not(description: [nil, '']).find_each do |product|
+      products += 1 if sanitize.call(product)
+    end
+    puts "  Spree::Product: sanitized #{products} description(s)."
+
+    translations = 0
+    Spree::Product::Translation.where.not(description: [nil, '']).find_each do |translation|
+      translations += 1 if sanitize.call(translation)
+    end
+    puts "  Spree::Product::Translation: sanitized #{translations} description(s)."
+  end
+end

data/lib/tasks/seller_sample_data.rake

@@ -0,0 +1,142 @@
+namespace :spree do
+  namespace :sellers do
+    desc 'Create a sample seller with an owner, a pending invitation and a fund ledger, for trying the seller panel (development/test only)'
+    task sample_data: :environment do
+      # Refused outside development and test on purpose. This task writes a
+      # known password, and `find_or_initialize_by(email:)` can land on a real
+      # account — resetting a live user's credentials from a sample-data task
+      # is not a mistake worth leaving available.
+      unless Rails.env.development? || Rails.env.test?
+        abort "spree:sellers:sample_data is for development and test only (RAILS_ENV=#{Rails.env})."
+      end
+
+      store = Spree::Store.default || Spree::Store.first
+      abort 'No store found — run db:seed first.' if store.nil?
+
+      email = ENV.fetch('SELLER_EMAIL', 'seller@example.com')
+      password = ENV.fetch('SELLER_PASSWORD', 'spree123')
+
+      seller_name = ENV.fetch('SELLER_NAME', 'Bright Sparks')
+      seller = Spree::Seller.find_by(name: seller_name, store: store)
+
+      # Through the workflow, so the sample seller gets the stock location a
+      # real one does — without it their returns have nowhere to go and the
+      # checklist can never be finished.
+      if seller.nil?
+        result = Spree.seller_create_workflow.call(
+          store: store, attributes: { name: seller_name, status: 'approved' }
+        )
+        abort "Could not create the sample seller: #{result.value.errors.full_messages.to_sentence}" unless result.success?
+
+        seller = result.value
+      end
+
+      owner = Spree.admin_user_class.find_by(email: email)
+
+      # An existing account keeps its own password. Re-running the task then
+      # tells you to use the credentials you already have, rather than silently
+      # changing them underneath you.
+      if owner
+        puts "Reusing existing user #{email} — password unchanged."
+      else
+        owner = Spree.admin_user_class.create!(
+          email: email, password: password, first_name: 'Ada', last_name: 'Lovelace'
+        )
+      end
+
+      seller.add_user(owner)
+
+      # One outstanding offer, so the panel's pending-invitations card has
+      # something to show without having to send an email first.
+      invitee = ENV.fetch('SELLER_INVITEE', 'pending@example.com')
+      unless seller.invitations.pending.exists?(email: invitee)
+        seller.invitations.create!(email: invitee, role: seller.default_user_role, inviter: owner)
+      end
+
+      # A checklist to work through, so the panel's onboarding page and its
+      # nav counter have something to show. Skipped when the marketplace
+      # already defines its own.
+      if store.seller_requirements.none?
+        Spree::SellerRequirements::AcceptTerms.create!(store: store, position: 1, active: true, required: true)
+        Spree::SellerRequirements::BillingAddress.create!(store: store, position: 2, active: true, required: true)
+        Spree::SellerRequirements::ReturnsAddress.create!(store: store, position: 3, active: true, required: true)
+        Spree::SellerRequirements::Attestation.create!(
+          store: store, position: 4, active: true, required: true,
+          name: 'Confirm you can ship within two working days'
+        )
+        Spree::SellerRequirements::OperatorReview.create!(
+          store: store, position: 5, active: true, required: false,
+          name: 'Marketplace background check'
+        )
+      end
+
+      # A fund ledger to read: a settled payout with the sales it covered, one
+      # still owed, and a sale not yet swept into either. Written directly
+      # rather than through fulfilment and the payout sweep — reaching those
+      # would mean placing and shipping real orders, which is a different
+      # task's job, and the screens under test read these rows either way.
+      provider = Spree::PayoutProvider::System.provider_key
+      currency = store.default_currency
+
+      if seller.seller_transfers.none?
+        # Each earning hangs off an order, because that is what a seller
+        # clicks through to from their ledger.
+        sample_orders = 5.times.map do |index|
+          Spree::Order.create!(
+            store: store, seller: seller, currency: currency,
+            email: "sample-buyer-#{index + 1}@example.com",
+            status: 'placed', completed_at: (index + 1).weeks.ago,
+            total: 100 + (index * 25), item_total: 100 + (index * 25)
+          )
+        end
+
+        settled = seller.seller_payouts.create!(
+          store: store, amount: 0, currency: currency, provider: provider, status: 'completed',
+          reference: 'BACS-SAMPLE-001',
+          period_start: 6.weeks.ago, period_end: 4.weeks.ago
+        )
+        owed = seller.seller_payouts.create!(
+          store: store, amount: 0, currency: currency, provider: provider, status: 'pending',
+          period_start: 3.weeks.ago, period_end: 1.week.ago
+        )
+
+        # Two settled, two owed, one still unswept — so the balance is a real
+        # subtraction rather than a single number, and the payouts queue has
+        # both a completed row and one to mark paid.
+        [[settled, 0], [settled, 1], [owed, 2], [owed, 3], [nil, 4]].each do |payout, index|
+          order = sample_orders[index]
+          seller.seller_transfers.create!(
+            store: store, order: order, payout: payout,
+            amount: order.total * 0.85, currency: currency,
+            kind: 'earning', provider: provider, status: 'completed',
+            created_at: order.completed_at
+          )
+        end
+
+        # A refund on the newest settled sale, so the reversal row and the
+        # negative amount both appear on the earnings screens.
+        original = seller.seller_transfers.earnings.order(:created_at).last
+        seller.seller_transfers.create!(
+          store: store, order: original.order, reversed_from: original,
+          amount: -(original.amount * 0.5), currency: currency,
+          kind: 'refund_reversal', provider: provider, status: 'completed'
+        )
+
+        # Each settlement is worth exactly what it claimed.
+        [settled, owed].each { |payout| payout.update!(amount: payout.transfers.sum(:amount)) }
+      end
+
+      progress = Spree::Sellers::Requirements.new(seller.reload).progress
+      balances = seller.balances
+
+      puts "Seller:   #{seller.name} (#{seller.prefixed_id}, #{seller.status})"
+      puts "Checklist: #{progress[:done]}/#{progress[:total]} done"
+      puts "Sign in:  #{email}"
+      puts "Pending:  #{seller.invitations.pending.pluck(:email).join(', ')}"
+      puts "Ledger:   #{seller.seller_transfers.count} earning(s), #{seller.seller_payouts.count} payout(s)"
+      balances.each do |balance|
+        puts "Balance:  #{balance.display_balance} owed (#{balance.display_earned} earned, #{balance.display_paid} paid)"
+      end
+    end
+  end
+end

data/lib/tasks/setup.rake

@@ -0,0 +1,18 @@
+namespace :spree do
+  namespace :setup do
+    desc 'Print the one-time first-run setup URL (only while no admin user exists); ROTATE=1 issues a fresh token first'
+    task token: :environment do
+      if Spree.admin_user_class.blank? || Spree.admin_user_class.count.positive?
+        abort 'An admin account already exists — first-run setup is closed. Use invitations to add more admins.'
+      end
+
+      store = Spree::Store.default
+      abort 'No store yet — run `bin/rails db:seed` first.' if store.nil?
+
+      store.regenerate_setup_token if store.setup_token.blank? || ENV['ROTATE'] == '1'
+
+      puts 'Open this link (with your app running) to create the first admin account:'
+      puts "  #{store.setup_url}"
+    end
+  end
+end

data/lib/tasks/single_store_associations.rake

@@ -60,6 +60,17 @@ namespace :spree do
         puts "  #{shared[:promotions]} promotion(s) and #{shared[:payment_methods]} payment method(s) " \
              "were shared across stores — only the owner store keeps them unless spree_multi_store is installed."
       end
+
+      # Positions were numbered across the whole table before acts_as_list
+      # was scoped per store; renumber each store's list so reordering
+      # behaves on upgraded data (a sparse, non-1-based list confuses
+      # acts_as_list's move operations). Idempotent: renumbering an already
+      # per-store list reproduces it.
+      Spree::Store.ids.each do |store_id|
+        Spree::PaymentMethod.with_deleted.where(store_id: store_id).order(:position, :id).each.with_index(1) do |payment_method, index|
+          payment_method.update_column(:position, index) unless payment_method.position == index
+        end
+      end
     end
   end
 end

data/lib/tasks/stock.rake

@@ -0,0 +1,15 @@
+namespace :spree do
+  namespace :stock do
+    desc 'Recompute reserved and incoming counters on every stock level from their sources'
+    task recount_levels: :environment do
+      corrected = Spree.stock_level_recount_service.call.value
+
+      corrected.each do |row|
+        level = row[:stock_level]
+        puts "  #{level.prefixed_id} (variant #{level.variant_id} @ location #{level.stock_location_id}): " \
+             "reserved #{row[:reserved].join(' → ')}, incoming #{row[:incoming].join(' → ')}"
+      end
+      puts "  Corrected #{corrected.size} stock level(s)."
+    end
+  end
+end

data/lib/tasks/store_binding_migration.rake

@@ -0,0 +1,33 @@
+namespace :spree do
+  desc <<~DESC
+    Assigns the default store to delivery methods and stock locations that
+    predate their store binding (Spree 6.0). Idempotent — rows that already
+    carry a store_id are skipped. Every unassigned record goes to the
+    default store; additional stores manage their own records afterwards.
+  DESC
+  task backfill_delivery_and_stock_store_ids: :environment do
+    store = Spree::Store.default
+    abort 'No default store found — create a store first.' if store.nil?
+
+    methods = Spree::DeliveryMethod.where(store_id: nil).update_all(store_id: store.id)
+    locations = Spree::StockLocation.with_deleted.where(store_id: nil).update_all(store_id: store.id)
+
+    puts "  Assigned #{methods} delivery methods and #{locations} stock locations to store #{store.name} (#{store.id})."
+  end
+
+  desc <<~DESC
+    Assigns the default store to tax rates and tax categories that predate
+    their store binding (Spree 6.0). Idempotent — rows that already carry a
+    store_id are skipped. Soft-deleted rows are bound too, so restoring one
+    later still yields a valid record.
+  DESC
+  task backfill_tax_store_ids: :environment do
+    store = Spree::Store.default
+    abort 'No default store found — create a store first.' if store.nil?
+
+    categories = Spree::TaxCategory.with_deleted.where(store_id: nil).update_all(store_id: store.id)
+    rates = Spree::TaxRate.with_deleted.where(store_id: nil).update_all(store_id: store.id)
+
+    puts "  Assigned #{categories} tax categories and #{rates} tax rates to store #{store.name} (#{store.id})."
+  end
+end

data/lib/tasks/store_settings.rake

@@ -0,0 +1,105 @@
+namespace :spree do
+  namespace :store_settings do
+    # Settings that moved from Spree::Config onto Spree::Store, mapped to the
+    # default they carried as globals and — where the two differ — the name the
+    # store preference goes by. A global still at its default says nothing about
+    # intent and is never copied.
+    MOVED_SETTINGS = {
+      address_requires_phone: { default: false },
+      always_include_confirm_step: { default: false },
+      company: { default: false, store_preference: :company_field_enabled },
+      default_stock_reservation_ttl_minutes: { default: 10, store_preference: :stock_reservation_ttl_minutes },
+      disable_sku_validation: { default: false },
+      show_products_without_price: { default: false },
+      stock_reservations_enabled: { default: true },
+      tax_using_ship_address: { default: true },
+      price_history_retention_days: { default: 30 },
+      track_inventory_levels: { default: true },
+      track_price_history: { default: true }
+    }.freeze
+
+    # The two capture booleans became one Store#preferred_capture_method
+    # string, so they are derived together rather than copied name-for-name.
+    # Capturing at checkout wins when both were on, matching the old code:
+    # money already taken at checkout left the dispatch capture with nothing
+    # to do.
+    #
+    # @return [String] the capture method the globals describe.
+    CAPTURE_METHOD_FROM_CONFIG = lambda do
+      next 'checkout' if Spree::Config.auto_capture
+      next 'on_dispatch' if Spree::Config.auto_capture_on_dispatch
+
+      # auto_capture off with no dispatch capture means staff took charge of it.
+      'manual'
+    end
+
+    # Marks a store the backfill has already visited. Preferences seed their
+    # declared defaults on create, so a stored value that equals the default is
+    # indistinguishable from one a merchant deliberately set back to it — there
+    # is no "explicitly set" flag to read. Without this marker, a merchant who
+    # turns a copied setting off would have it turned back on by the next run.
+    BACKFILL_MARKER = 'store_settings_backfilled_from_config'.freeze
+
+    desc <<~DESC
+      Copies commerce settings that moved from Spree::Config onto every store
+      (Spree 6.0).
+
+      Spree 6.0 reads these from the store, with no fallback to the global, so
+      an install that changed one in an initializer needs this step to keep its
+      behavior. Globals left at their default are skipped.
+
+      Idempotent: each store is copied to at most once and stores already
+      carrying a non-default value are left alone, so a merchant's own change
+      is never overwritten. Remove the settings from your initializer
+      afterwards — the globals are deprecated and are deleted in 6.1.
+    DESC
+    task backfill_from_config: :environment do
+      changed = MOVED_SETTINGS.reject do |name, config|
+        Spree::Config.send(name) == config[:default]
+      end
+
+      capture_method = CAPTURE_METHOD_FROM_CONFIG.call
+      capture_method = nil if capture_method == Spree::CaptureMethod::DEFAULT_CAPTURE_METHOD
+
+      if changed.empty? && capture_method.nil?
+        puts '  No moved settings differ from their defaults — nothing to copy.'
+        next
+      end
+
+      Spree::Store.find_each do |store|
+        metadata = store.metadata || {}
+
+        if metadata[BACKFILL_MARKER]
+          puts "  #{store.name} (#{store.id}): already backfilled — skipped."
+          next
+        end
+
+        changed.each do |name, config|
+          preference = config[:store_preference] || name
+
+          if store.get_preference(preference) != store.preference_default(preference)
+            puts "  #{store.name} (#{store.id}): #{preference} already customized — skipped."
+            next
+          end
+
+          value = Spree::Config.send(name)
+          store.set_preference(preference, value)
+
+          puts "  #{store.name} (#{store.id}): #{preference} = #{value}"
+        end
+
+        if capture_method
+          if store.get_preference(:capture_method) != store.preference_default(:capture_method)
+            puts "  #{store.name} (#{store.id}): capture_method already customized — skipped."
+          else
+            store.set_preference(:capture_method, capture_method)
+            puts "  #{store.name} (#{store.id}): capture_method = #{capture_method}"
+          end
+        end
+
+        store.metadata = metadata.merge(BACKFILL_MARKER => true)
+        store.save!
+      end
+    end
+  end
+end