spree_core 6.0.0.beta1 → 6.0.0.beta3

data/app/models/spree/stock_receipt.rb

@@ -9,6 +9,7 @@ module Spree
   class StockReceipt < Spree.base_class
     has_prefix_id :sr
 
+    include Spree::ActedBy
     include Spree::SingleStoreResource
     has_spree_number prefix: 'SR'
     include Spree::NumberIdentifier
@@ -17,7 +18,7 @@ module Spree
     publishes_lifecycle_events
 
     belongs_to :receivable, polymorphic: true, inverse_of: :stock_receipts
-    belongs_to :received_by, class_name: Spree.admin_user_class.to_s, optional: true
+    acted_by :received_by
 
     has_many :items, class_name: 'Spree::StockReceiptItem', inverse_of: :stock_receipt,
                      dependent: :destroy
@@ -29,8 +30,12 @@ module Spree
 
     normalizes :reference, with: ->(value) { value.strip.presence }
 
+    # `received_by_type` sits beside its id because ids are per-table: filtering
+    # on the id alone would match the admin user and the API key that happen to
+    # share that number.
     self.whitelisted_ransackable_attributes = %w[number reference received_at receivable_type
-                                                 receivable_id received_by_id created_at]
+                                                 receivable_id received_by_id received_by_type
+                                                 created_at]
 
     # @return [Integer] units this delivery put on the shelf
     def quantity_accepted_total

data/app/models/spree/store.rb

@@ -95,6 +95,10 @@ module Spree
     # e.g. "https://myshop.com" — see #storefront_url for the fallback chain.
     preference :storefront_url, :string
     preference :special_instructions_enabled, :boolean, default: false
+    # Advertises a confirm/review step for every checkout, even when no
+    # payment method asks for one. Payment methods that require confirmation
+    # get it regardless of this setting.
+    preference :always_include_confirm_step, :boolean, default: false
     preference :stock_reservation_ttl_minutes, :integer, default: 10
     # Store-wide default for when a customer is charged rather than only
     # authorized. A payment method's own capture_method wins when set.

data/app/models/spree/store_credit.rb

@@ -25,6 +25,8 @@ module Spree
     include Spree::DeprecatedCustomerAlias
     belongs_to :created_by, class_name: Spree.admin_user_class.to_s, foreign_key: 'created_by_id', optional: true
     belongs_to :originator, polymorphic: true, optional: true
+    belongs_to :refunded_order, class_name: 'Spree::Order', optional: true,
+                                inverse_of: :store_credit_refunds
 
     has_many :store_credit_events, class_name: 'Spree::StoreCreditEvent'
     has_many :payments, as: :source, class_name: 'Spree::Payment'
@@ -111,6 +113,8 @@ module Spree
     self.whitelisted_ransackable_attributes = %w[customer_id created_by_id amount currency memo]
     self.whitelisted_ransackable_associations = %w[customer created_by]
     self.whitelisted_ransackable_scopes = %w[outstanding from_gift_card]
+    # Staff notes and who issued the credit are back-office data.
+    self.private_ransackable_attributes = { store: %w[memo created_by_id] }
 
     # Two-state scopes: see Spree::Base.ransack_flag? for why the cast is
     # opted out of here and done inside each scope instead.

data/app/models/spree/translations/batch.rb

@@ -38,8 +38,10 @@ module Spree
       attr_reader :records
 
       # @param entries [Array<Hash>] [{ resource_type:, resource_id:, values: { locale => { field => value } } }]
-      def initialize(entries)
+      # @param store [Spree::Store] the store every record must belong to
+      def initialize(entries, store: Spree::Store.current)
         @entries = Array(entries)
+        @store = store
         @records = []
       end
 
@@ -86,7 +88,7 @@ module Spree
         klass = resource_class(entry[:resource_type])
         raise EntryError.new("Unknown translatable resource type: #{entry[:resource_type]}", index) if klass.nil?
 
-        relation = klass.respond_to?(:for_store) ? klass.for_store(Spree::Store.current) : klass
+        relation = klass.respond_to?(:translatable_scope) ? klass.translatable_scope(@store) : klass.for_store(@store)
         relation.find_by_prefix_id!(entry[:resource_id])
       rescue ActiveRecord::RecordNotFound
         raise EntryError.new("Resource not found: #{entry[:resource_id]}", index)

data/app/models/spree/user_identity.rb

@@ -9,15 +9,19 @@ module Spree
 
     validates :provider, inclusion: {
       in: lambda { |_record|
-        (Spree.store_authentication_strategies.keys + Spree.admin_authentication_strategies.keys).uniq.map(&:to_s)
+        (
+          Spree.store_authentication_strategies.keys +
+          Spree.admin_authentication_strategies.keys +
+          Spree.seller_authentication_strategies.keys
+        ).uniq.map(&:to_s)
       }
     }
 
-    # Store provider-specific data
-    # info: JSON field with provider-specific data (name, avatar, etc)
-    # access_token: encrypted OAuth access token
-    # refresh_token: encrypted OAuth refresh token
-    # expires_at: token expiration timestamp
+    # Keys may come from config or from encrypted credentials. Rows written before
+    # encryption was enabled stay readable and are encrypted on their next write.
+    if ActiveRecord::Encryption.config.has_primary_key?
+      encrypts :access_token, :refresh_token, support_unencrypted_data: true
+    end
 
     # Find or create user from OAuth data
     def self.find_or_create_from_oauth(provider:, uid:, info:, tokens: {}, user_class: nil)

data/app/models/spree/variant.rb

@@ -330,6 +330,7 @@ module Spree
                                                  carton_package_type_id carton_weight cartons_per_pallet]
     self.whitelisted_ransackable_scopes = %i(product_name_or_sku_cont search_by_product_name_or_sku search
                                              available_at_stock_location)
+    self.private_ransackable_attributes = { store: %w[cost_price cost_currency deleted_at] }
 
     def self.product_name_or_sku_cont(query)
       sanitized_query = ActiveRecord::Base.sanitize_sql_like(query.to_s.downcase.strip)
@@ -604,8 +605,11 @@ module Spree
     # @param opt_type_position [Integer] the position of the option type
     # @return [void]
     def set_option_value(opt_name, opt_value, opt_type_position = nil)
-      option_type = Spree::OptionType.where(name: opt_name.parameterize).first_or_initialize do |o|
+      # The product's own store: option types are store-owned, and matching one
+      # by name elsewhere would attach and extend another store's type.
+      option_type = Spree::OptionType.for_store(product.store).where(name: opt_name.parameterize).first_or_initialize do |o|
         o.name = o.label = opt_name
+        o.store = product.store
         o.save!
       end
 
@@ -1190,10 +1194,11 @@ module Spree
     end
 
     # Only the product's own store's locations — a new variant must not grow
-    # stock items in every other store's warehouses.
+    # stock items in every other store's warehouses — and of those, a seller's
+    # location only stocks what that seller sells.
     def create_stock_levels
       locations = product&.store ? product.store.stock_locations : StockLocation.all
-      locations.where(propagate_all_variants: true).each do |stock_location|
+      locations.where(propagate_all_variants: true, seller_id: [nil, resolved_seller_id].uniq).each do |stock_location|
         stock_location.propagate_variant(self)
       end
     end

data/app/models/spree/webhook_delivery.rb

@@ -26,6 +26,34 @@ module Spree
     # Ransack configuration
     self.whitelisted_ransackable_attributes = %w[event_name response_code execution_time success delivered_at created_at]
 
+    # Event subjects whose permission is not found by class name alone.
+    PAYLOAD_SUBJECT_CLASSES = {
+      'cart' => 'Spree::Order',
+      'customer' => -> { Spree.customer_class },
+      'newsletter_subscriber' => -> { Spree.customer_class }
+    }.freeze
+
+    # Event subjects whose payload holds no record of anyone's data.
+    PUBLIC_PAYLOAD_SUBJECTS = %w[webhook].freeze
+
+    # The catalog key a caller needs to read this delivery's payload. The
+    # payload is the full record the event is about — an order's addresses, a
+    # customer's email — so reading the log is no wider than reading the
+    # record. A subject no permission scope covers falls back to customer
+    # access, since an unknown payload may hold personal data.
+    #
+    # @return [String, nil] nil when anyone who can read the log may see it
+    def payload_permission_key
+      subject = event_name.to_s.split('.').first.to_s
+      return if PUBLIC_PAYLOAD_SUBJECTS.include?(subject)
+
+      source = PAYLOAD_SUBJECT_CLASSES[subject]
+      klass = source.respond_to?(:call) ? source.call : (source || "Spree::#{subject.camelize}").to_s.safe_constantize
+      scope = Spree.permissions.scope_for_resource(klass)
+
+      scope ? "read_#{scope.name}" : 'read_customers'
+    end
+
     # Check if the delivery was successful
     #
     # @return [Boolean]

data/app/models/spree/webhook_endpoint.rb

@@ -50,11 +50,18 @@ module Spree
     # Number of consecutive failed deliveries before auto-disabling
     AUTO_DISABLE_THRESHOLD = 15
 
+    # Events whose payload carries a live customer credential (a password
+    # reset token). Receiving one is as good as holding the customer's account,
+    # so they reach only an endpoint that names them — never through `*` or a
+    # pattern — and the API asks for customer write access to point one at them.
+    CREDENTIAL_EVENTS = %w[customer.password_reset_requested].freeze
+
     # Check if this endpoint is subscribed to a specific event
     #
     # @param event_name [String] the event name to check
     # @return [Boolean]
     def subscribed_to?(event_name)
+      return subscriptions.to_a.include?(event_name) if CREDENTIAL_EVENTS.include?(event_name)
       return true if subscriptions.blank? || subscriptions.include?('*')
 
       subscriptions.any? do |subscription|
@@ -67,6 +74,13 @@ module Spree
       end
     end
 
+    # Whether this endpoint receives customer credentials.
+    #
+    # @return [Boolean]
+    def receives_credentials?
+      (subscriptions.to_a & CREDENTIAL_EVENTS).any?
+    end
+
     # Returns all events this endpoint is subscribed to
     #
     # @return [Array<String>]

data/app/presenters/spree/csv/order_line_item_presenter.rb

@@ -130,7 +130,7 @@ module Spree
           index.zero? ? order.bill_address&.company : nil,
           index.zero? ? order.bill_address&.city : nil,
           index.zero? ? order.bill_address&.postal_code : nil,
-          index.zero? ? order.bill_address&.state_name : nil,
+          index.zero? ? order.bill_address&.state_text : nil,
           index.zero? ? order.bill_address&.country&.name : nil,
           index.zero? ? order.bill_address&.phone : nil,
           index.zero? ? order.ship_address&.full_name : nil,
@@ -139,7 +139,7 @@ module Spree
           index.zero? ? order.ship_address&.company : nil,
           index.zero? ? order.ship_address&.city : nil,
           index.zero? ? order.ship_address&.postal_code : nil,
-          index.zero? ? order.ship_address&.state_name : nil,
+          index.zero? ? order.ship_address&.state_text : nil,
           index.zero? ? order.ship_address&.country&.name : nil,
           index.zero? ? order.ship_address&.phone : nil,
           index.zero? ? format_date(order.completed_at) : nil,

data/app/services/spree/carts/split_by_seller.rb

@@ -29,20 +29,26 @@ module Spree
       # blocklist would carry every future column onto siblings by default.
       # Adding a column here is a decision that it describes the checkout
       # rather than one seller's part of it.
+      #
+      # +metadata+ is here because at this point it holds what the checkout
+      # recorded about the purchase (copied from the cart), so every child gets
+      # the same hash — and so does the group. Once split, each order's
+      # metadata is its own: edits never propagate between siblings.
       CARRIED_TO_SIBLING = %w[
         email currency locale market_id channel_id company_id
         customer_id token accept_marketing preferred_stock_location_id
-        customer_note last_ip_address po_number
+        customer_note last_ip_address po_number metadata
       ].freeze
 
-      # @param cart [Spree::Cart]
       # @param order [Spree::Order] the paid draft order, adopted as the
       #   group's first child rather than replaced — it is the record the
       #   payment was taken against
       # @param partitions [Array<Spree::Carts::SellerPartition>] ordered, first
       #   party first
+      # @param cart [Spree::Cart, nil] nil for an order raised from the admin,
+      #   which never had one
       # @return [Spree::ServiceModule::Result] value is the Spree::OrderGroup
-      def call(cart:, order:, partitions:)
+      def call(order:, partitions:, cart: nil)
         group = nil
         # Every apportionment here divides money in this one currency.
         @currency = order.currency
@@ -76,20 +82,24 @@ module Spree
       # keeps the reference they saw at checkout, and the children number off
       # it: R1001-1, R1001-2. The cart_id moves up too — the group is what that
       # cart completed into, and it becomes the replay anchor.
+      #
+      # The facts come off the order rather than the cart because the order
+      # carries every one of them and an admin-raised order has no cart; the
+      # cart is only linked, as the replay anchor, when there is one.
       def build_group(cart, order)
         order.update_columns(cart_id: nil)
 
-        group = cart.store.order_groups.create!(
+        order.store.order_groups.create!(
           cart: cart,
-          customer: cart.customer,
+          customer: order.customer,
           number: order.number,
-          currency: cart.currency,
-          email: cart.email,
-          token: cart.token,
-          ship_address: cart.ship_address&.snapshot,
-          bill_address: cart.bill_address&.snapshot
+          currency: order.currency,
+          email: order.email,
+          token: order.token,
+          metadata: order.metadata.to_h.deep_dup,
+          ship_address: order.ship_address&.snapshot,
+          bill_address: order.bill_address&.snapshot
         )
-        group
       end
 
       # Files the paid order under the group as its first child. Its own
@@ -109,7 +119,7 @@ module Spree
       # settled during completion.
       def hand_off(source_order, group, partition, index)
         sibling = source_order.store.orders.create!(
-          source_order.attributes.slice(*CARRIED_TO_SIBLING).merge(
+          source_order.attributes.slice(*CARRIED_TO_SIBLING).deep_dup.merge(
             'order_group_id' => group.id,
             'seller_id' => partition.seller_id,
             'number' => "#{group.number}-#{index}",

data/app/services/spree/companies/add_member.rb

@@ -18,11 +18,17 @@ module Spree
       #   (memberships have no metadata column; a direct-membership payload is
       #   applied by the caller through the `company_membership.form_fields`
       #   contract, not stored here)
+      # @param require_acceptance [Boolean] always invite, even an existing
+      #   customer — for callers who cannot vouch that the email is the
+      #   person they mean (a storefront member typing an address). The
+      #   emailed token is what proves the invitee owns the address and
+      #   agrees to join; a direct membership would hand the company to
+      #   whoever happens to hold that email.
       # @return [Spree::ServiceModule::Result] value is the created
       #   Spree::CompanyMembership or Spree::CompanyInvitation
-      def call(company:, email:, inviter: nil, metadata: nil)
+      def call(company:, email:, inviter: nil, metadata: nil, require_acceptance: false)
         normalized_email = email.to_s.strip.downcase
-        customer = Spree.customer_class.find_by(email: normalized_email)
+        customer = Spree.customer_class.find_by(email: normalized_email) unless require_acceptance
 
         record =
           if customer

data/app/services/spree/imports/row_processors/price_list_price.rb

@@ -154,6 +154,12 @@ module Spree
             Spree.t(:price_list_import_too_many_breaks, count: Spree::Price::MAXIMUM_BREAKS_PER_VARIANT)
           elsif value[:invalid_quantities].present?
             Spree.t(:price_list_import_invalid_quantity, value: attributes['min_quantity'])
+          elsif (rising = value[:rising_ladders].presence)
+            # Named rung and floor, like the sibling branches: a file is written
+            # one rung per row, so the merchant needs to know which one and what
+            # it had to beat.
+            Spree.t(:price_list_import_price_rises_with_quantity,
+                    quantity: rising.first[:min_quantity], floor: rising.first[:floor])
           else
             result.error.to_s.presence || Spree.t(:price_list_import_failed)
           end

data/app/services/spree/imports/row_processors/product_translation.rb

@@ -37,7 +37,7 @@ module Spree
         private
 
         def product_scope
-          Spree::Product.accessible_by(import.current_ability, :manage)
+          store.products.accessible_by(import.current_ability, :manage)
         end
       end
     end

data/app/services/spree/imports/row_processors/product_variant.rb

@@ -125,15 +125,17 @@ module Spree
 
         # Which products this import may resolve an existing row onto.
         #
-        # A seller's import reaches only that seller's own products. The
-        # ability cannot answer this: it grants capability, never tenancy —
-        # a seller holding `write_products` gets `can :manage, Spree::Product`,
-        # the whole class (see Spree::Ability). On the API that is safe because
-        # the controller scope-fetches through `current_seller`; a background
-        # row processor has no controller, so the narrowing has to happen here
-        # or a CSV naming another seller's slug would edit their product.
+        # The import's own store's products, and for a seller's import only
+        # that seller's. The ability cannot answer either: it grants
+        # capability, never tenancy — a seller holding `write_products` gets
+        # `can :manage, Spree::Product`, the whole class (see Spree::Ability),
+        # and an admin of two stores reaches both. On the API that is safe because
+        # the controller scope-fetches through `current_store` and
+        # `current_seller`; a background row processor has no controller, so
+        # the narrowing has to happen here or a CSV naming another store's or
+        # seller's slug would edit their product.
         def product_scope
-          scope = Spree::Product.accessible_by(import.current_ability, :manage)
+          scope = store.products.accessible_by(import.current_ability, :manage)
           seller.present? ? scope.where(seller_id: seller.id) : scope
         end
 
@@ -237,7 +239,7 @@ module Spree
         def prepare_tax_category
           tax_category_name = attributes['tax_category'].strip
           cached_lookup(:tax_category, tax_category_name) do
-            Spree::TaxCategory.find_by(name: tax_category_name)
+            store.tax_categories.find_by(name: tax_category_name)
           end
         end
 
@@ -302,15 +304,19 @@ module Spree
         def find_or_create_option_type!(label)
           cached_lookup(:option_type, label) do
             begin
-              Spree::OptionType.search_by_name(label).first || Spree::OptionType.create!(label: label)
+              store_option_types.search_by_name(label).first || store_option_types.create!(label: label)
             rescue ActiveRecord::RecordNotUnique, ActiveRecord::RecordInvalid => e
               raise unless uniqueness_conflict?(e, :name)
 
-              Spree::OptionType.search_by_name(label).first!
+              store_option_types.search_by_name(label).first!
             end
           end
         end
 
+        def store_option_types
+          Spree::OptionType.for_store(store)
+        end
+
         def find_or_create_option_value!(option_type, label)
           cached_lookup(:option_value, option_type.id, label) do
             begin

data/app/services/spree/order_groups/allocate_payments.rb

@@ -87,6 +87,9 @@ module Spree
           next if split.persisted?
 
           share = Spree::Money::Rounding.from_minor_units(shares[index], currency)
+          # So re-summing its payment total on save reuses this instance rather
+          # than loading a second copy of the row per share.
+          split.order = order
           split.currency = payment.currency
           split.authorized_amount = share
           split.captured_amount = captured ? share : 0

data/app/services/spree/orders/approve.rb

@@ -6,7 +6,8 @@ module Spree
       # Approves an order: clears the risk flag and records who approved it and when.
       #
       # @param order [Spree::Order]
-      # @param approver [Object, nil] the user/admin who approved
+      # @param approver [Object, nil] who approved it — an admin user or an
+      #   API key (see Spree.actor_classes)
       # @param level [String, nil] deprecated and ignored — removed in Spree 6.1
       # @param note [String, nil] deprecated and ignored — removed in Spree 6.1
       # @return [Spree::ServiceModule::Result]
@@ -16,7 +17,7 @@ module Spree
         end
 
         changes = { considered_risky: false, approved_at: Time.current }
-        changes[:approver_id] = approver.id if approver.present?
+        changes.merge!(Spree::ActedBy.columns_for(:approver, approver)) if approver.present?
         order.update_columns(changes)
 
         order.publish_event('order.approved')

data/app/services/spree/orders/build_fulfillments.rb

@@ -9,10 +9,16 @@ module Spree
     #
     # No-op when the order has no shipping address, no line items, or does
     # not require delivery (digital orders, etc.).
+    #
+    # Also a no-op once the order is placed. Its fulfillments hold the stock
+    # promised at placement, and an edit adjusts them in place through
+    # Spree::OrderInventory. Rebuilding would delete them and leave that
+    # promise on rows nothing can cancel or ship, so the stock stays held.
     class BuildFulfillments
       prepend Spree::ServiceModule::Base
 
       def call(order:)
+        return success(order) if order.completed?
         return success(order) unless order.ship_address_id.present?
         return success(order) unless order.line_items.any?
         return success(order) unless order.delivery_step_required?

data/app/services/spree/orders/update_statuses.rb

@@ -60,14 +60,20 @@ module Spree
       # shipped and been captured while another has not, no proportion of the
       # group's totals can describe either.
       #
+      # Refunded spans both ledgers. A refund paid as store credit writes no
+      # {Spree::Refund} row, and counting only those rows left an order that
+      # had given every penny back still reading `paid`.
+      #
       # @return [Array(BigDecimal, BigDecimal, BigDecimal)] captured,
       #   authorized and refunded, in that order
       def money_for(order)
+        credited = order.store_credit_refunds.sum(:amount)
+
         unless order.order_group_id.present?
           return [
             order.payments.valid.completed.sum(:amount),
             order.payments.valid.pending.sum(:amount),
-            order.refunds.sum(:amount)
+            order.refunds.sum(:amount) + credited
           ]
         end
 
@@ -76,7 +82,7 @@ module Spree
 
         # Authorized means still to draw: what the shares allow, less what has
         # already been taken against them.
-        [captured, splits.sum(&:authorized_amount) - captured, splits.sum(&:refunded_amount)]
+        [captured, splits.sum(&:authorized_amount) - captured, splits.sum(&:refunded_amount) + credited]
       end
 
       # Rolls the fulfillments up into one word for filtering and display.