spree_core 6.0.0.beta1 → 6.0.0.beta3

data/app/workflows/spree/claims/resolve.rb

@@ -130,17 +130,13 @@ module Spree
       end
 
       def issue_store_credit
-        @refunds = [
-          Spree::StoreCredit.create!(
-            store: claim.store,
-            customer: claim.order.customer,
-            amount: @amount_to_refund,
-            currency: claim.currency,
-            created_by: resolver,
-            originator: claim,
-            memo: "Claim #{claim.number}"
-          )
-        ]
+        @refunds = issue_refund_store_credit(
+          order: claim.order,
+          amount: @amount_to_refund,
+          record: claim,
+          memo: "Claim #{claim.number}",
+          refunder: resolver
+        )
       end
 
       def refund_at_gateway

data/app/workflows/spree/exchanges/create.rb

@@ -3,6 +3,8 @@ module Spree
     # Opens an exchange request: items coming back, and what should go out
     # in their place.
     class Create < Spree::Workflow
+      include Spree::Returns::ReturnableQuantity
+
       hooks :validate, :after_create
 
       attr_reader :exchange
@@ -55,9 +57,18 @@ module Spree
 
           { fulfillment_item: fulfillment_item, new_variant: new_variant, quantity: quantity }
         end
+
+        # The credit an exchange pays out is priced on these quantities, so
+        # they can never exceed what was shipped and not yet sent back.
+        ensure_returnable_quantities(@normalized_items, action: 'exchanged')
       end
 
       def build_exchange
+        # Again under the order's row lock, so two requests racing for the same
+        # units cannot both pass the check above.
+        Spree::Order.lock.find(order.id)
+        ensure_returnable_quantities(@normalized_items, action: 'exchanged')
+
         @exchange = order.exchanges.new(
           store: order.store,
           stock_location: stock_location || default_stock_location,

data/app/workflows/spree/exchanges/fulfill.rb

@@ -51,11 +51,23 @@ module Spree
       # Negative price difference means the replacements cost less than what
       # came back, so the customer is owed the difference.
       def credit_due?
-        exchange.price_difference.to_d.negative?
+        settled_difference.negative?
       end
 
       def credit_amount
-        exchange.price_difference.to_d.abs
+        settled_difference.abs
+      end
+
+      # The difference on the units that actually came back — the same units
+      # the replacements are shipped for. Priced on the requested quantity, an
+      # exchange that asked for more than arrived would pay credit for goods
+      # nobody returned.
+      def settled_difference
+        @settled_difference ||= exchange.exchange_line_items.sum(0.to_d) do |line|
+          next 0.to_d if line.quantity.to_i.zero?
+
+          line.price_difference.to_d / line.quantity.to_i * line.received_quantity.to_i
+        end
       end
 
       def ensure_fulfillable
@@ -112,17 +124,13 @@ module Spree
       end
 
       def issue_store_credit
-        @refunds = [
-          Spree::StoreCredit.create!(
-            store: exchange.store,
-            customer: exchange.order.customer,
-            amount: credit_amount,
-            currency: exchange.currency,
-            created_by: refunder,
-            originator: exchange,
-            memo: "Exchange #{exchange.number}"
-          )
-        ]
+        @refunds = issue_refund_store_credit(
+          order: exchange.order,
+          amount: credit_amount,
+          record: exchange,
+          memo: "Exchange #{exchange.number}",
+          refunder: refunder
+        )
       end
 
       def refund_at_gateway

data/app/workflows/spree/orders/cancel.rb

@@ -11,7 +11,8 @@ module Spree
       hooks :before_cancel, :after_cancel
 
       # @param order [Spree::Order]
-      # @param canceler [Object, nil] the user/admin who initiated the cancellation
+      # @param canceler [Object, nil] who initiated it — an admin user or an
+      #   API key (see Spree.actor_classes)
       # @param canceled_at [Time, nil] timestamp (defaults to Time.current)
       # @param reason [Spree::OrderCancellationReason, nil] the merchant's own
       #   vocabulary; must belong to the order's store
@@ -102,7 +103,7 @@ module Spree
 
       def mark_canceled
         changes = { status: 'canceled', canceled_at: @decided_at, cancel_reason_id: reason&.id, cancel_note: note }
-        changes[:canceler_id] = canceler.id if canceler.present?
+        changes.merge!(Spree::ActedBy.columns_for(:canceler, canceler)) if canceler.present?
         order.update_columns(changes)
       end
 

data/app/workflows/spree/orders/complete.rb

@@ -7,6 +7,9 @@ module Spree
     # may still need to process payments). Idempotent: an already-placed
     # order halts successfully, so interrupted completions replay safely.
     class Complete < Spree::Workflow
+      # Set only when the order divided between sellers.
+      attr_reader :order_group
+
       # @param order [Spree::Order]
       # @param payment_pending [Boolean] when true the order places without
       #   processing payments (B2B / invoice-later). With no payment rows the
@@ -15,17 +18,29 @@ module Spree
       #   rollup work's call (docs/plans/6.0-b2b-wholesale-shipping.md phase 7)
       # @param notify_customer [Boolean, nil] admin drafts pass false to
       #   complete silently; nil (checkout) leaves customer notification on
+      # @return [Spree::ServiceModule::Result] value is the order, or the
+      #   Spree::OrderGroup when it divided between sellers
       def perform(order:, payment_pending: false, notify_customer: nil)
         super
 
         order.notify_customer = notify_customer unless notify_customer.nil?
 
-        halt!(order) if order.completed?
+        # Replaying finishes what an interrupted division started — a sibling
+        # left in draft is an order nobody will ever ship — and answers with
+        # what the first run produced, rather than reporting one seller's order
+        # where it first reported the whole purchase.
+        if order.completed?
+          @order_group = order.order_group
+          step :complete_sibling_orders
+          halt!(order_group || order)
+        end
+
         step :ensure_not_canceled
 
         order.with_lock do
           unless order.reload.placed?
             step :process_payments unless payment_pending || !order.payment_required?
+            step :split_by_seller
             step :finalize_fulfillments
             step :place_order
             step :use_coupon_codes
@@ -39,8 +54,9 @@ module Spree
         step :release_stock_reservations
         step :update_statuses
         step :publish_order_placed
+        step :complete_sibling_orders
 
-        success(order)
+        success(order_group || order)
       end
 
       private
@@ -56,6 +72,56 @@ module Spree
         failure(order, Spree.t(:payment_processing_failed)) unless payment_covered?
       end
 
+      # Files the sale under whoever made it, dividing the order into one per
+      # seller when it holds several sellers' goods.
+      #
+      # Here because this is the one home both entry points share. Commission
+      # is charged from the line item's seller while the ledger credits the
+      # order's, so an order that skipped this — as one raised from the admin
+      # used to — is charged for and credited to nobody.
+      #
+      # Runs after payment so the money is settled once against the whole
+      # basket, and before placement so each seller's order is placed in its
+      # own right.
+      def split_by_seller
+        # A sibling arrives already divided.
+        return if order.order_group_id.present?
+
+        partitions = Spree::Carts::PartitionBySeller.call(purchase: order).value
+        return if partitions.empty?
+        return stamp_seller(partitions.first.seller_id) if partitions.one?
+
+        # The cart travels with it: the group becomes what that cart completed
+        # into, and the row carrying its id is the replay anchor.
+        result = Spree::Carts::SplitBySeller.call(order: order, partitions: partitions, cart: order.cart)
+        failure(order, result.error) if result.failure?
+
+        # The division adopts this very order as the group's first child and
+        # reloads it, so it stays the row this workflow locked and the object
+        # carrying the caller's notify_customer, which a freshly loaded one
+        # would not.
+        @order_group = result.value
+        # No child order is the purchase, this one included, so the customer is
+        # confirmed from the group instead and every child places silently.
+        @notify_customer_of_purchase = order.notify_customer
+        order.notify_customer = false
+        step :allocate_payment_splits
+      end
+
+      # Nothing to divide, but the sale still belongs to whoever made it: an
+      # order entirely from one seller is that seller's, and the column is what
+      # their own order list reads.
+      def stamp_seller(seller_id)
+        return if order.seller_id == seller_id
+
+        order.update_columns(seller_id: seller_id, updated_at: Time.current)
+      end
+
+      def allocate_payment_splits
+        result = Spree::OrderGroups::AllocatePayments.call(group: order_group)
+        failure(order, result.error) if result.failure?
+      end
+
       # Typed adjustment rows are frozen once completed — the totals
       # recalculation only re-sums them, never regenerates (see
       # Spree::Carts::RecalculateTotals) — so no per-row locking is needed.
@@ -160,6 +226,37 @@ module Spree
         order.publish_event('order.completed', payload, { deprecated_alias_of: 'order.placed' })
       end
 
+      # Places the orders the division produced beside this one.
+      #
+      # They place without processing payments, because the money was taken
+      # against the whole basket before the division and the group now holds
+      # it, and silently, as every child of a division does. Only the ones
+      # still in draft, so a replay finishes an interrupted division instead of
+      # re-placing what already went out.
+      def complete_sibling_orders
+        return if order_group.nil?
+
+        pending = order_group.orders.where.not(id: order.id).where(status: 'draft').order(:id)
+        pending.each { |sibling| place_sibling(sibling) }
+
+        # The division loaded these children before placing them, and the rows
+        # just placed are not those objects — anything reading the group now
+        # would see drafts that no longer exist.
+        order_group.orders.reset
+
+        return unless order_group.orders.all?(&:placed?)
+
+        order_group.publish_event(
+          'order_group.completed',
+          order_group.event_payload.merge(notify_customer: @notify_customer_of_purchase)
+        )
+      end
+
+      def place_sibling(sibling)
+        result = Spree.order_complete_workflow.call(order: sibling, payment_pending: true, notify_customer: false)
+        failure(order, result.error) if result.failure?
+      end
+
       def payment_covered?
         order.payments.reset
         order.payments.valid.where(status: %w[pending processing completed]).sum(:amount) >= order.amount_due_at_checkout

data/app/workflows/spree/price_lists/update.rb

@@ -65,6 +65,12 @@ module Spree
             price_list.errors.add(:base, :negative_price)
           elsif refusal[:invalid_quantities].present?
             price_list.errors.add(:base, :invalid_quantity)
+          elsif refusal[:quantities_on_base_prices].present?
+            price_list.errors.add(:base, :quantity_on_base_price)
+          elsif refusal[:duplicate_quantities].present?
+            price_list.errors.add(:base, :duplicate_quantity)
+          elsif refusal[:rising_ladders].present?
+            price_list.errors.add(:base, :price_rises_with_quantity)
           else
             price_list.errors.add(:base, :too_many_breaks, count: Spree::Price::MAXIMUM_BREAKS_PER_VARIANT)
           end
@@ -80,7 +86,18 @@ module Spree
         touch_variants(variant_ids)
       end
 
+      # Rows are written with upsert_all, which checks nothing, so a variant
+      # outside the list's store is dropped here rather than trusted to every
+      # caller to filter first.
       def price_rows
+        rows = raw_price_rows
+        store_variant_ids = price_list.store.variants.where(id: rows.map { |row| row[:variant_id] }).
+                            pluck(:id).map(&:to_s).to_set
+
+        rows.select { |row| store_variant_ids.include?(row[:variant_id].to_s) }
+      end
+
+      def raw_price_rows
         Array(@prices).filter_map do |raw|
           row = raw.respond_to?(:to_unsafe_h) ? raw.to_unsafe_h.with_indifferent_access : raw.with_indifferent_access
 

data/app/workflows/spree/refunds/create.rb

@@ -19,7 +19,7 @@ module Spree
       #   creditable balance
       # @param reason [Spree::RefundReason, nil] defaults to the store's
       #   return-processing reason
-      # @param refunder [Object, nil] the admin issuing the refund
+      # @param refunder [Object, nil] who is issuing it (see Spree.actor_classes)
       # @param originator [Object, nil] what triggered the refund — a
       #   Spree::Return, Exchange or Claim; nil for a manual refund
       # @param order [Spree::Order, nil] which order is being put right.

data/app/workflows/spree/refunds/order_payments.rb

@@ -2,7 +2,8 @@
 
 module Spree
   module Refunds
-    # Gives a post-sale workflow one way to put money back on an order.
+    # Gives a post-sale workflow its two ways to put money back on an order:
+    # back to what paid for it, or as store credit.
     #
     # Returns, claims and exchanges all owe the customer money for the same
     # reason — goods that are going back, or were never right — and all three
@@ -22,6 +23,57 @@ module Spree
 
       private
 
+      # Puts `amount` back as store credit.
+      #
+      # Credit is its own ledger and writes no {Spree::Refund} row, so the
+      # credit names the order it settles — without that the order could not
+      # tell it had given anything back, and its payment status stayed `paid`
+      # on money the customer had already been made whole for.
+      #
+      # @param order [Spree::Order] the order being put right
+      # @param amount [BigDecimal] how much to give back
+      # @param record [Spree::Return, Spree::Claim, Spree::Exchange] what asked
+      #   for it; it originates the credit
+      # @param memo [String] what the customer reads on the credit
+      # @param refunder [Object, nil] whoever is issuing it
+      # @return [Array<Spree::StoreCredit>] the one credit written, shaped like
+      #   {#refund_order_payments} so both branches answer the same way
+      def issue_refund_store_credit(order:, amount:, record:, memo:, refunder: nil)
+        failure(record, :refund_exceeds_paid) if amount.to_d > refundable_balance(order)
+
+        [
+          Spree::StoreCredit.create!(
+            store: record.store,
+            customer: order.customer,
+            refunded_order: order,
+            amount: amount,
+            currency: record.currency,
+            created_by: refunder,
+            originator: record,
+            memo: memo
+          )
+        ]
+      end
+
+      # What the order can still give back, as store credit or to its
+      # payments: what its payments can still refund, less credit already
+      # issued against it. Credit writes no refund row, so without the second
+      # half every return, claim and exchange on one order could each hand back
+      # the full amount paid, and a refund to the card could follow a credit.
+      #
+      # The order row is locked first, so two settlements racing on one order
+      # cannot both read the same headroom.
+      #
+      # @param order [Spree::Order]
+      # @param shares [Hash{Spree::Payment => BigDecimal}, nil] already read
+      # @return [BigDecimal]
+      def refundable_balance(order, shares = nil)
+        Spree::Order.lock.find(order.id)
+
+        (shares || refundable_shares(order)).values.sum(0.to_d) -
+          Spree::StoreCredit.where(refunded_order: order).sum(:amount).to_d
+      end
+
       # Puts `amount` back on `order`, oldest payment first, until it is
       # covered.
       #
@@ -44,6 +96,8 @@ module Spree
         remaining = amount.to_d
         refunds = []
         shares = refundable_shares(order)
+        # With no payment to draw on the caller reports that instead.
+        failure(record, :refund_exceeds_paid) if shares.any? && remaining > refundable_balance(order, shares)
         # Resolved once rather than per payment — but only once there is
         # something to refund, since it is a find_or_create_by and a run that
         # refunds nothing should leave no reason row behind.

data/app/workflows/spree/returns/approve.rb

@@ -13,7 +13,7 @@ module Spree
       hooks :validate, :after_approve
 
       # @param return_record [Spree::Return]
-      # @param approver [Object, nil] the admin approving it
+      # @param approver [Object, nil] who is approving it (see Spree.actor_classes)
       def perform(return_record:, approver: nil)
         super
 

data/app/workflows/spree/returns/create.rb

@@ -7,6 +7,8 @@ module Spree
     # regional consumer rights. That policy is the most-customized rule in
     # commerce and deliberately does not live in core.
     class Create < Spree::Workflow
+      include Spree::Returns::ReturnableQuantity
+
       hooks :validate, :after_create
 
       # The created return — hook handlers read it (nil while :validate runs).
@@ -18,8 +20,8 @@ module Spree
       #   back to; defaults to the location that shipped them
       # @param reason [Spree::ReturnReason, nil]
       # @param memo [String, nil] customer- or staff-supplied note
-      # @param created_by [Object, nil] the admin opening it; nil for
-      #   customer self-service
+      # @param created_by [Object, nil] who is opening it (see
+      #   Spree.actor_classes); nil for customer self-service
       def perform(order:, items:, stock_location: nil, reason: nil, memo: nil, created_by: nil)
         super
 
@@ -48,7 +50,7 @@ module Spree
       end
 
       # Quantities are validated against what is actually still returnable —
-      # units already returned on an earlier request must not come back twice.
+      # units already returned or exchanged must not come back twice.
       def normalize_items
         @normalized_items = items.map do |item|
           fulfillment_item = item[:fulfillment_item]
@@ -57,26 +59,18 @@ module Spree
           failure(order, :invalid_quantity) unless quantity.positive?
           failure(order, :item_not_on_order) unless fulfillment_item&.order_id == order.id
 
-          available = returnable_quantity_for(fulfillment_item)
-          if quantity > available
-            failure(order, "Only #{available} of #{fulfillment_item.variant.name} can be returned")
-          end
-
           { fulfillment_item: fulfillment_item, quantity: quantity }
         end
-      end
 
-      def returnable_quantity_for(fulfillment_item)
-        already_requested = Spree::ReturnLineItem.
-          joins(:return).
-          where(fulfillment_item_id: fulfillment_item.id).
-          where.not(spree_returns: { status: 'canceled' }).
-          sum(:quantity)
-
-        fulfillment_item.quantity.to_i - already_requested
+        ensure_returnable_quantities(@normalized_items, action: 'returned')
       end
 
       def build_return
+        # Again under the order's row lock, so two requests racing for the same
+        # units cannot both pass the check above.
+        Spree::Order.lock.find(order.id)
+        ensure_returnable_quantities(@normalized_items, action: 'returned')
+
         @return_record = order.returns.new(
           store: order.store,
           stock_location: stock_location || default_stock_location,

data/app/workflows/spree/returns/refund.rb

@@ -19,7 +19,7 @@ module Spree
       # @param amount [BigDecimal, Numeric, nil] defaults to what the return
       #   is still owed
       # @param refund_method [String] 'original_payment' or 'store_credit'
-      # @param refunder [Object, nil] the admin issuing it
+      # @param refunder [Object, nil] who is issuing it (see Spree.actor_classes)
       def perform(return_record:, amount: nil, refund_method: 'original_payment', refunder: nil)
         super
 
@@ -52,15 +52,14 @@ module Spree
       # original supply date rather than today's — the rate that applied then is
       # the rate to credit back.
       #
-      # Only lines that actually arrived are credited, matching what
-      # +received_total+ refunds: a customer who announced three items and sent
-      # two must not have tax credited on the third.
+      # Only lines that actually arrived are credited: a customer who announced
+      # three items and sent two must not have tax credited on the third.
       #
       # The refunded amount goes with them, because it can be less than those
       # lines are worth — a restocking fee, or an agreed part-refund. Without it
       # a provider would credit the tax on goods whose value the merchant kept.
       def refund_tax
-        received = return_record.return_line_items.select { |line| line.received_quantity.to_i.positive? }
+        received = return_record.return_line_items.select { |line| line.refund_amount.positive? }
         return if received.empty?
 
         order = return_record.order
@@ -83,34 +82,26 @@ module Spree
         failure(return_record, :not_received) unless return_record.received?
       end
 
-      # Only what actually came back is refundable — a customer who sent two
-      # of three items gets two items' worth.
+      # Only what actually came back is refundable — a customer who sent two of
+      # three items gets two items' worth. One figure serves as both the
+      # default and the ceiling, so a caller naming an amount cannot ask for
+      # more than a caller who names none would get.
       def resolve_amount
-        @amount_to_refund = (amount || received_total).to_d
+        refundable = return_record.refundable_total.to_d
+        @amount_to_refund = amount ? amount.to_d : refundable
 
         failure(return_record, :nothing_to_refund) unless @amount_to_refund.positive?
-        failure(return_record, :refund_exceeds_balance) if @amount_to_refund > return_record.refundable_total.to_d
-      end
-
-      def received_total
-        return_record.return_line_items.sum do |line|
-          next 0 if line.quantity.to_i.zero?
-
-          (line.pre_tax_amount / line.quantity) * line.received_quantity.to_i
-        end
+        failure(return_record, :refund_exceeds_balance) if @amount_to_refund > refundable
       end
 
       def issue_store_credit
-        credit = Spree::StoreCredit.create!(
-          store: return_record.store,
-          customer: return_record.order.customer,
+        @refunds = issue_refund_store_credit(
+          order: return_record.order,
           amount: @amount_to_refund,
-          currency: return_record.currency,
-          created_by: refunder,
-          originator: return_record,
-          memo: "Return #{return_record.number}"
+          record: return_record,
+          memo: "Return #{return_record.number}",
+          refunder: refunder
         )
-        @refunds = [credit]
       end
 
       # Each refund row commits, then Refund#perform! credits it at the

data/app/workflows/spree/returns/returnable_quantity.rb

@@ -0,0 +1,53 @@
+module Spree
+  module Returns
+    # How many units of a shipped item can still go back.
+    #
+    # A return and an exchange both take the same units off the customer, so
+    # each counts the other: without that, the units a customer returned could
+    # be exchanged again, and the credit for the exchange paid out a second
+    # time. Units named twice in one request count twice too.
+    module ReturnableQuantity
+      extend ActiveSupport::Concern
+
+      private
+
+      # @param fulfillment_item [Spree::FulfillmentItem]
+      # @param requested [Hash{Integer => Integer}] units already asked for in
+      #   this request, keyed by fulfillment item id
+      # @return [Integer]
+      def returnable_quantity_for(fulfillment_item, requested: {})
+        returned = Spree::ReturnLineItem.
+                   joins(:return).
+                   where(fulfillment_item_id: fulfillment_item.id).
+                   where.not(Spree::Return.table_name => { status: 'canceled' }).
+                   sum(:quantity)
+        exchanged = Spree::ExchangeLineItem.
+                    joins(:exchange).
+                    where(fulfillment_item_id: fulfillment_item.id).
+                    where.not(Spree::Exchange.table_name => { status: 'canceled' }).
+                    sum(:quantity)
+
+        fulfillment_item.quantity.to_i - returned - exchanged - requested.fetch(fulfillment_item.id, 0)
+      end
+
+      # Checks each item's quantity against what is still returnable and
+      # fails with the item's name when it is not.
+      #
+      # @param items [Array<Hash>] `[{ fulfillment_item:, quantity: }]`
+      # @param action [String] 'returned' or 'exchanged', for the message
+      def ensure_returnable_quantities(items, action:)
+        requested = Hash.new(0)
+
+        items.each do |item|
+          fulfillment_item = item[:fulfillment_item]
+          available = returnable_quantity_for(fulfillment_item, requested: requested)
+          if item[:quantity] > available
+            failure(order, "Only #{[available, 0].max} of #{fulfillment_item.variant.name} can be #{action}")
+          end
+
+          requested[fulfillment_item.id] += item[:quantity]
+        end
+      end
+    end
+  end
+end

data/app/workflows/spree/sellers/invite.rb

@@ -48,7 +48,7 @@ module Spree
       # role naming somewhere else comes back as a 422 rather than access
       # granted elsewhere.
       def send_invitation
-        @invitation = seller.invitations.new(email: email, role: role, inviter: inviter)
+        @invitation = seller.invitations.new(email: email, role: role || seller.default_user_role, inviter: inviter)
 
         failure(@invitation, @invitation.errors) unless @invitation.save
       end