spree_core 6.0.0.beta1 → 6.0.0.beta3

data/app/models/spree/pricing_provider/internal.rb

@@ -45,7 +45,12 @@ module Spree
         # back to base.
         # @return [Spree::Price]
         def find_price_from_lists
-          (catalog_price_lists + applicable_price_lists).each do |price_list|
+          catalog_price_list_groups.each do |price_lists|
+            price = best_price_among(price_lists)
+            return price if price
+          end
+
+          applicable_price_lists.each do |price_list|
             price = find_price_for_list(price_list)
             return price if price
           end
@@ -53,12 +58,25 @@ module Spree
           nil
         end
 
-        # Price lists reached through the buyer's effective catalogs, in
-        # catalog resolution order — the company subtree, or failing that the
-        # customer's groups, or failing that the channel's default catalog.
-        # The same chain visibility uses, and its steps are alternatives: a
-        # company buyer is priced by their company's agreement and never
-        # also by their customer group's ({Spree::Catalog.for_context}).
+        # The cheapest price one node's lists give, nil when none prices this
+        # variant. Catalogs sharing a node rank equally, so taking the first to
+        # answer charged a company from whichever sorted first rather than the
+        # cheaper (docs/plans/6.0-b2b-companies-and-catalogs.md). Equal amounts
+        # keep list order, so the answer is stable.
+        #
+        # @param price_lists [Array<Spree::PriceList>]
+        # @return [Spree::Price, nil]
+        def best_price_among(price_lists)
+          price_lists.filter_map { |price_list| find_price_for_list(price_list) }.min_by(&:amount)
+        end
+
+        # Price lists reached through the buyer's effective catalogs, grouped
+        # by the node that assigns them and ordered nearest node first — the
+        # company subtree, or failing that the customer's groups, or failing
+        # that the channel's default catalog. The same chain visibility uses,
+        # and its steps are alternatives: a company buyer is priced by their
+        # company's agreement and never also by their customer group's
+        # ({Spree::Catalog.groups_for_context}).
         #
         # A catalog-attached list applies because the catalog applies: its
         # audience rules are not consulted, since the assignment already
@@ -68,10 +86,13 @@ module Spree
         # volume pricing is (docs/plans/6.0-price-list-automatic-pricing.md).
         # Status and dates gate the list as before.
         #
-        # @return [Array<Spree::PriceList>]
-        def catalog_price_lists
-          @catalog_price_lists ||= catalogs_for_context.filter_map(&:price_list).uniq.select do |price_list|
-            price_list.currently_active? && price_list.contextual_rules_applicable?(context)
+        # @return [Array<Array<Spree::PriceList>>]
+        def catalog_price_list_groups
+          @catalog_price_list_groups ||= catalog_groups_for_context.filter_map do |catalogs|
+            lists = catalogs.filter_map(&:price_list).select do |price_list|
+              price_list.currently_active? && price_list.contextual_rules_applicable?(context)
+            end
+            lists.presence
           end
         end
 
@@ -89,11 +110,12 @@ module Spree
         # Catalogs that apply to this buyer, through the one entry point
         # visibility and quantity terms also use — what a buyer is shown, what
         # they pay and how much they must take have to come from the same
-        # agreement. Reuses the request-scoped set for the current store, so a
+        # agreement. Grouped by assigning node, since that is where precedence
+        # lives. Reuses the request-scoped set for the current store, so a
         # listing does not re-resolve the same buyer per variant.
-        # @return [Array<Spree::Catalog>]
-        def catalogs_for_context
-          Spree::Catalog.for_buyer(
+        # @return [Array<Array<Spree::Catalog>>]
+        def catalog_groups_for_context
+          Spree::Catalog.groups_for_buyer(
             store: context.store, customer: context.user,
             company: context.company, channel: context.channel
           )

data/app/models/spree/product.rb

@@ -369,6 +369,10 @@ module Spree
     self.whitelisted_ransackable_attributes = %w[description name slug discontinue_on status available_on created_at updated_at seller_id]
     self.whitelisted_ransackable_associations = %w[categories collections store channels variants default_variant tags labels
                                                    product_type product_categories option_types seller]
+    # The storefront filters by tag, category and collection; every other hop
+    # (variants, prices, channels) reaches back-office data, and variants lead
+    # back to the product, which lets one filter chain joins without end.
+    self.storefront_ransackable_associations = %w[tags categories collections]
     self.whitelisted_ransackable_scopes = %w[not_discontinued search_by_name in_taxon in_category in_categories in_collection price_between
                                              price_lte price_gte
                                              search multi_search in_stock out_of_stock with_option_value_ids

data/app/models/spree/product_option_type.rb

@@ -7,5 +7,16 @@ module Spree
     acts_as_list scope: :product
 
     validates :product_id, uniqueness: { scope: :option_type_id }, allow_nil: true
+    validate :option_type_belongs_to_product_store
+
+    private
+
+    # Option types are store-owned, so a product may only use its own store's.
+    def option_type_belongs_to_product_store
+      return if product.nil? || option_type.nil?
+      return if option_type.store_id == product.store_id
+
+      errors.add(:option_type, :invalid)
+    end
   end
 end

data/app/models/spree/promotion/actions/create_line_items.rb

@@ -19,7 +19,33 @@ module Spree
 
         delegate :eligible?, to: :promotion
 
-        # Adds a line item to the Order if the promotion is eligible
+        # @return [Symbol]
+        def discount_scope
+          :line_item
+        end
+
+        # The gift is rarely the product the rules name ("buy a coffee maker,
+        # get a free tote"), so the rules decide whether the promotion applies
+        # and this action decides which lines it pays for.
+        #
+        # @param order [Spree::Order, Spree::Cart]
+        # @param line_item [Spree::LineItem]
+        # @return [Boolean]
+        def applies_to_line_item?(order, line_item)
+          gifted_item?(line_item) && qualifies_beyond_the_gift?(order)
+        end
+
+        # Covers the gifted units of the line at their own price, leaving any
+        # further units of the same variant the shopper bought themselves to be
+        # paid for.
+        #
+        # @param line_item [Spree::LineItem]
+        # @return [BigDecimal] never positive
+        def compute_amount(line_item)
+          line_item.price * gifted_quantity_of(line_item) * -1
+        end
+
+        # Tops the order up to the promised quantity and discounts it.
         #
         # This doesn't play right with Add to Cart events because at the moment
         # the item was added to cart the promo may not be eligible. However it
@@ -32,46 +58,26 @@ module Spree
         #   - Customer increases item quantity to 5 (order total goes to $50)
         #   - Now the order is eligible for the promo and the action should perform
         #
-        # Another complication is when the same line item created by the promo
-        # is also added to cart on a separate action.
-        #
-        # e.g.
-        #   - Promo adds 1 item A to cart if order total greater then $30
-        #   - Customer add 2 items B to cart, current order total is $40
-        #   - This action performs adding item A to cart since order is eligible
-        #   - Customer changes his mind and updates item B quantity to 1
-        #   - At this point order is no longer eligible and one might expect
-        #     that item A should be removed
-        #
-        # It doesn't remove items from the order here because there's no way
-        # it can know whether that item was added via this promo action or if
-        # it was manually populated somewhere else. In that case the item
-        # needs to be manually removed from the order by the customer
+        # A shopper who already has the gift variant is given theirs free rather
+        # than a duplicate, so the promotion still applies when it has nothing
+        # to add.
         def perform(options = {})
           order = options[:order]
           return unless eligible? order
+          return unless qualifies_beyond_the_gift?(order)
 
-          action_taken = false
-          promotion_action_line_items.each do |item|
-            current_quantity = order.quantity_of(item.variant)
-            next unless current_quantity < item.quantity && item_available?(item)
+          added = add_missing_line_items(order)
 
-            add_service = order.is_a?(Spree::Cart) ? Spree.cart_add_item_workflow : Spree.order_add_item_service
-            line_item = add_service.call(**{ (order.is_a?(Spree::Cart) ? :cart : :order) => order },
-                                                         variant: item.variant,
-                                                         quantity: item.quantity - current_quantity).value
-            action_taken = true if line_item.try(:valid?)
-          end
-          action_taken
+          apply_via_adjuster(options) || added
         end
 
         # Called by promotion handler when a promotion is removed
         # This will find any line item matching the ones defined in the PromotionAction
         # and remove the same quantity as was added by the PromotionAction.
-        # Should help to prevent some of cases listed above the #perform method
         def revert(options = {})
           order = options[:order]
           return if eligible?(order)
+          return unless order.promotions.include?(promotion)
 
           action_taken = false
           promotion_action_line_items.each do |item|
@@ -89,13 +95,69 @@ module Spree
         end
 
         # Checks that there's enough stock to add the line item to the order
-        def item_available?(item)
+        #
+        # @param item [Spree::PromotionActionLineItem]
+        # @param quantity [Integer] units wanted, defaulting to the whole gift
+        # @return [Boolean]
+        def item_available?(item, quantity = item.quantity)
           quantifier = Spree::Stock::Quantifier.new(item.variant)
-          quantifier.can_supply? item.quantity
+          quantifier.can_supply? quantity
         end
 
         private
 
+        # Whether this line holds a variant the promotion gives away.
+        def gifted_item?(line_item)
+          gifted_quantity_of(line_item).positive?
+        end
+
+        # A gift cannot be the thing that qualifies the order for the promotion
+        # giving it away: a rule naming the gift's own product would otherwise
+        # hand the item over to anyone who put it in their cart. The order has
+        # to hold a line the rules count with units this action is not already
+        # covering. A promotion with no rules qualifies on anything, so there is
+        # nothing for the gift to stand in for.
+        def qualifies_beyond_the_gift?(order)
+          return true if promotion.promotion_rules.empty?
+
+          order.line_items.any? do |line_item|
+            promotion.line_item_actionable?(order, line_item) &&
+              gifted_quantity_of(line_item) < line_item.quantity
+          end
+        end
+
+        # How many units of this line the promotion pays for — never more than
+        # the line holds, so a shopper buying three of a variant gifted once
+        # still pays for two. `quantity` is nullable and written by `upsert_all`,
+        # which skips validation, so a missing or negative one gifts nothing
+        # rather than raising or turning the discount into a surcharge.
+        #
+        # @param line_item [Spree::LineItem]
+        # @return [Integer]
+        def gifted_quantity_of(line_item)
+          gifted = promotion_action_line_items.detect { |item| item.variant_id == line_item.variant_id }
+          return 0 if gifted.nil?
+
+          [[line_item.quantity, gifted.quantity.to_i].min, 0].max
+        end
+
+        def add_missing_line_items(order)
+          added_results = promotion_action_line_items.map do |item|
+            missing = item.quantity.to_i - order.quantity_of(item.variant)
+            next false unless missing.positive? && item_available?(item, missing)
+
+            add_service = order.is_a?(Spree::Cart) ? Spree.cart_add_item_workflow : Spree.order_add_item_service
+            result = add_service.call(**{ (order.is_a?(Spree::Cart) ? :cart : :order) => order },
+                                      variant: item.variant,
+                                      quantity: missing)
+            result.success?
+          end
+
+          order.line_items.reload if added_results.any?
+
+          added_results.any?
+        end
+
         def promotion_variants_scope
           promotion.store.variants
         end

data/app/models/spree/promotion/rules/category.rb

@@ -21,18 +21,16 @@ module Spree
           'category'
         end
 
-        # Decode prefixed IDs before delegating to the generated setter (direct
-        # calls bypass PrefixedId's assign_attributes auto-resolver).
-        #
-        # Resolved through the promotion's own store, so an id belonging to
-        # another store raises rather than quietly linking — the promotion
-        # would otherwise discount against a catalog its store cannot see.
+        # Resolved through the promotion's own store, prefixed and raw ids
+        # alike, so an id belonging to another store raises rather than
+        # quietly linking — the promotion would otherwise discount against a
+        # catalog its store cannot see.
         def category_ids=(ids)
-          super(Array(ids).map do |id|
-            Spree::PrefixedId.prefixed_id?(id) ? promotion_categories_scope.find_by_param!(id).id : id
-          end)
+          super(ids_within_store(ids, promotion && promotion_categories_scope))
         end
 
+        validate :categories_belong_to_store
+
         #
         # Preferences
         #
@@ -140,6 +138,13 @@ module Spree
           promotion.store.categories
         end
 
+        def categories_belong_to_store
+          return if promotion.nil? || category_ids.empty?
+          return if (category_ids - promotion_categories_scope.where(id: category_ids).ids).empty?
+
+          errors.add(:categories, :invalid)
+        end
+
         # IDs of categories in rule including all their children
         def eligible_category_ids_including_children
           @eligible_category_ids_including_children ||= begin

data/app/models/spree/promotion/rules/product.rb

@@ -15,6 +15,15 @@ module Spree
 
         self.additional_permitted_attributes = [product_ids: []]
 
+        validate :products_belong_to_store
+
+        # Resolved through the promotion's own store, so another store's
+        # product raises rather than being linked and then served back with
+        # its admin data.
+        def product_ids=(ids)
+          super(ids_within_store(ids, promotion&.store&.products))
+        end
+
         #
         # Preferences
         #
@@ -86,11 +95,18 @@ module Spree
           ActiveSupport::Deprecation.warn(
             'Please use `product_ids=` instead.'
           )
-          self.product_ids = s
+          self.product_ids = s.to_s.split(',')
         end
 
         private
 
+        def products_belong_to_store
+          return if promotion.nil? || product_ids.empty?
+          return if (product_ids - promotion.store.products.where(id: product_ids).ids).empty?
+
+          errors.add(:products, :invalid)
+        end
+
         def add_products
           return if product_ids_to_add.nil?
 

data/app/models/spree/promotion.rb

@@ -317,7 +317,7 @@ module Spree
 
     def code_for_order(order)
       if multi_codes?
-        coupon_codes.find_by(order: order)&.code
+        coupon_codes.held_by(order).first&.code
       else
         code
       end

data/app/models/spree/promotion_action.rb

@@ -37,6 +37,17 @@ module Spree
       false
     end
 
+    # Whether this action's line-level discount may land on +line_item+.
+    # Promotion rules narrow it by default; an action that creates its own
+    # lines answers for itself.
+    #
+    # @param order [Spree::Order, Spree::Cart]
+    # @param line_item [Spree::LineItem]
+    # @return [Boolean]
+    def applies_to_line_item?(order, line_item)
+      promotion.line_item_actionable?(order, line_item)
+    end
+
     # Returns true if the promotion action is a free shipping action
     #
     # @return [Boolean]
@@ -53,7 +64,7 @@ module Spree
     def self.types_for_discount_scope(scope)
       case scope
       when :line_item
-        %w[Spree::Promotion::Actions::CreateItemAdjustments Spree::Promotion::Actions::CreateItemAdjustments]
+        %w[Spree::Promotion::Actions::CreateItemAdjustments Spree::Promotion::Actions::CreateLineItems]
       when :fulfillment
         %w[Spree::Promotion::Actions::FreeShipping Spree::Promotion::Actions::FreeShipping]
       when :order

data/app/models/spree/promotion_handler/coupon.rb

@@ -80,8 +80,7 @@ module Spree
           clear_persisted_coupon_code(coupon_code)
 
           if promotion.multi_codes?
-            coupon_code = promotion.coupon_codes.find_by(order: order)
-            coupon_code&.remove_from_order
+            promotion.coupon_codes.held_by(order).first&.remove_from_order
           else
             promotion.touch
           end
@@ -217,7 +216,10 @@ module Spree
         end
 
         if discount || created_line_items
-          handle_coupon_code(discount, coupon_code) if discount
+          if discount && !claim_coupon_code(discount, coupon_code)
+            release_coupon_code(order, coupon_code)
+            return set_error_code :coupon_code_used
+          end
 
           order.recalculate_totals!
           set_success_code :coupon_code_applied
@@ -236,8 +238,51 @@ module Spree
         end
       end
 
-      def handle_coupon_code(discount, coupon_code)
-        Spree::CouponCode.unused.find_by(promotion_id: discount.promotion_id, code: coupon_code)&.apply_order!(order)
+      # A single-use code is spent only when an order is placed with it, so a
+      # code sitting on another open cart is taken from it rather than
+      # refused: whoever presents it now gets the discount, and whoever places
+      # an order first keeps the code. A cart in the middle of checkout keeps
+      # it, and so does a draft order, since its totals are fixed and money
+      # may already be at the gateway.
+      #
+      # The holder is locked before the code, the same order checkout takes
+      # them in, so the two serialize instead of deadlocking.
+      #
+      # @return [Boolean] false when the code can no longer be claimed
+      def claim_coupon_code(discount, coupon_code)
+        record = Spree::CouponCode.find_by(promotion_id: discount.promotion_id, code: coupon_code)
+        return true if record.nil?
+
+        holder = record.holder
+        holder = nil if holder && same_record?(holder, order)
+
+        Spree::CouponCode.transaction do
+          holder&.lock!
+          record.lock!
+          next false if record.used? || !same_holder?(record.holder, holder) || !releasable?(holder)
+
+          release_coupon_code(holder, coupon_code) if holder
+          record.apply_order!(order)
+        end
+      end
+
+      # Gift cards are turned off so a holder paying with one keeps it.
+      def release_coupon_code(holder, coupon_code)
+        self.class.new(holder, enable_gift_cards: false).remove(coupon_code)
+      end
+
+      def releasable?(holder)
+        return true if holder.nil?
+
+        holder.is_a?(Spree::Cart) && holder.completed_at.nil? && !holder.completion_claimed?
+      end
+
+      def same_record?(holder, other)
+        holder.class == other.class && holder.id == other.id
+      end
+
+      def same_holder?(current, expected)
+        current.nil? || same_record?(current, expected || order)
       end
 
       # Whether the coupon handler should also handle gift card codes.

data/app/models/spree/promotion_rule.rb

@@ -55,6 +55,20 @@ module Spree
 
     private
 
+    # Resolves ids, prefixed or raw, through the promotion's store, so another
+    # store's record raises instead of being linked. A rule built before its
+    # promotion is known passes the ids through; its validation checks them.
+    #
+    # @param ids [Array<String, Integer>]
+    # @param scope [ActiveRecord::Relation, nil] the store's records
+    # @return [Array<Integer>]
+    def ids_within_store(ids, scope)
+      ids = Array(ids).reject(&:blank?)
+      return ids if scope.nil?
+
+      ids.map { |id| Spree::PrefixedId.prefixed_id?(id) ? scope.find_by_param!(id).id : scope.find(id).id }
+    end
+
     def eligibility_error_message(key, options = {})
       Spree.t(key, Hash[scope: [:eligibility_errors, :messages]].merge(options))
     end

data/app/models/spree/refund.rb

@@ -2,6 +2,7 @@ module Spree
   class Refund < Spree.base_class
     has_prefix_id :re  # Stripe: re_
 
+    include Spree::ActedBy
     include Spree::HasCustomFields
     include Spree::Metadata
     include Spree::InstrumentsGatewayCalls
@@ -18,7 +19,7 @@ module Spree
     # payment covers several and only one of them is being refunded.
     belongs_to :order, class_name: 'Spree::Order', optional: true, inverse_of: :refunds
     belongs_to :reason, class_name: 'Spree::RefundReason', foreign_key: :refund_reason_id
-    belongs_to :refunder, class_name: Spree.admin_user_class.to_s, optional: true
+    acted_by :refunder
     # What triggered this refund — a Spree::Return today, later an Exchange
     # or Claim; nil for a manual refund. Deliberately polymorphic: the set is
     # small and closed, and refunds are never bulk-queried in a hot path.

data/app/models/spree/return.rb

@@ -14,6 +14,7 @@ module Spree
     has_prefix_id :ret
 
     has_spree_number prefix: 'RET'
+    include Spree::ActedBy
     include Spree::NumberIdentifier
     include Spree::SingleStoreResource
     include Spree::HasStatus
@@ -31,7 +32,7 @@ module Spree
     belongs_to :reason, class_name: 'Spree::ReturnReason', optional: true, inverse_of: :returns
     # Staff only. Customer-initiated returns leave this nil — the requester
     # is always order.customer, so no second association is needed.
-    belongs_to :created_by, class_name: Spree.admin_user_class.to_s, optional: true
+    acted_by :created_by
 
     has_many :return_line_items, class_name: 'Spree::ReturnLineItem',
                                  dependent: :destroy, inverse_of: :return
@@ -110,21 +111,31 @@ module Spree
       end
     end
 
+    # Whether the warehouse has reported on this return.
+    #
+    # @return [Boolean]
+    def counted?
+      received? || refunded?
+    end
+
     # What the customer is owed for the items being returned.
     def refund_total
-      return_line_items.sum(&:pre_tax_amount)
+      return_line_items.sum(&:refund_amount)
     end
 
-    # What a refund from this return paid for, line by line. Counts what the
-    # warehouse received rather than what the customer announced, so it agrees
-    # with the amount {Spree::Returns::Refund} works out for itself.
+    # What a refund from this return paid for, line by line. Only ever what
+    # the warehouse counted: the seller's clawback is built from this, and a
+    # line nobody counted earned nothing back.
     #
     # @return [Hash{Integer => BigDecimal}] line item id => amount
     def refunded_line_amounts
+      return {} unless counted?
+
       return_line_items.each_with_object(Hash.new(0)) do |line, amounts|
-        next if line.quantity.to_i.zero? || line.received_quantity.to_i.zero?
+        amount = line.refund_amount
+        next if amount.zero?
 
-        amounts[line.line_item_id] += (line.pre_tax_amount / line.quantity) * line.received_quantity.to_i
+        amounts[line.line_item_id] += amount
       end
     end
 

data/app/models/spree/return_line_item.rb

@@ -19,6 +19,25 @@ module Spree
 
     delegate :order, :currency, to: :return
 
+    # What this line refunds. Once the warehouse has counted, only the units
+    # that arrived are paid for — a customer who announced three and sent two
+    # is owed two — and before the count there is nothing to go on but the
+    # announced quantity.
+    #
+    # Rounded to the currency, because this is the ceiling a refund is checked
+    # against as well as the figure the dialog offers: a third of $29.99 taken
+    # three times is not $29.99 until it is.
+    #
+    # @return [BigDecimal]
+    def refund_amount
+      return pre_tax_amount unless self.return.counted?
+      return 0.to_d if quantity.to_i.zero?
+
+      Spree::Money::Rounding.to_currency(
+        (pre_tax_amount / quantity) * received_quantity.to_i, currency
+      )
+    end
+
     def display_pre_tax_amount
       Spree::Money.new(pre_tax_amount, currency: currency)
     end

data/app/models/spree/search_provider/database.rb

@@ -7,6 +7,14 @@ module Spree
         'best_selling' => :by_best_selling
       }.freeze
 
+      # @param store [Spree::Store]
+      # @param audience [Symbol, nil] who filters: `:store` (shoppers) limits
+      #   filters to what the storefront may query; `nil` is the back office
+      def initialize(store, audience: :store)
+        super(store)
+        @audience = audience
+      end
+
       def search_and_filter(scope:, query: nil, filters: {}, sort: nil, page: 1, limit: 25)
         filters = filters.is_a?(Hash) ? filters.dup : {}
         option_value_ids = filters.delete('with_option_value_ids') || filters.delete(:with_option_value_ids)
@@ -72,7 +80,7 @@ module Spree
 
         ransack_filters = sanitize_filters(filters)
         if ransack_filters.present?
-          search = scope.ransack(ransack_filters)
+          search = scope.ransack(ransack_filters, auth_object: @audience)
           scope = search.result(distinct: true)
         end
 
@@ -127,7 +135,7 @@ module Spree
             end
           }.join(',')
 
-          scope.ransack(s: ransack_sort).result
+          scope.ransack({ s: ransack_sort }, auth_object: @audience).result
         end
       end
 

data/app/models/spree/seller_payout.rb

@@ -58,7 +58,9 @@ module Spree
     scope :owed, -> { where(status: %w[pending processing]) }
 
     self.whitelisted_ransackable_attributes = %w[amount currency status provider reference period_start period_end created_at seller_id]
-    self.whitelisted_ransackable_associations = %w[seller transfers]
+    # No `transfers`: they lead on to the order and its buyer, which a
+    # payouts-only caller may not read.
+    self.whitelisted_ransackable_associations = %w[seller]
 
     extend Spree::DisplayMoney
     money_methods :amount

data/app/models/spree/seller_transfer.rb

@@ -112,7 +112,9 @@ module Spree
     end
 
     self.whitelisted_ransackable_attributes = %w[amount currency kind status provider reference created_at seller_id order_id payout_id]
-    self.whitelisted_ransackable_associations = %w[seller order payout refund]
+    # No `order`: filtering through it reaches the buyer's email and address,
+    # which a payouts-only caller may not read. `order_id` covers the lookup.
+    self.whitelisted_ransackable_associations = %w[seller payout refund]
 
     extend Spree::DisplayMoney
     money_methods :amount