spree_core 6.0.0.beta3 → 6.0.0.rc1

data/app/services/spree/collections/remove_products.rb

@@ -2,6 +2,7 @@ module Spree
   module Collections
     class RemoveProducts
       prepend Spree::ServiceModule::Base
+      include Spree::ProductMemberships
 
       # Removes the given products from the given collections and re-packs positions.
       #
@@ -11,54 +12,17 @@ module Spree
       def call(collections:, products:)
         return if collections.blank? || products.blank?
 
-        collection_ids = collections.pluck(:id)
-        product_ids = products.pluck(:id)
-
-        ApplicationRecord.transaction do
-          collection_ids.each do |collection_id|
-            Spree::ProductCollection.where(collection_id: collection_id, product_id: product_ids).delete_all
-          end
-
-          product_collections_params = collection_ids.flat_map do |collection_id|
-            position = 0
-            existing_product_ids = Spree::ProductCollection.where(collection_id: collection_id).pluck(:product_id)
-
-            existing_product_ids.map do |product_id|
-              {
-                collection_id: collection_id,
-                product_id: product_id,
-                position: (position += 1),
-                created_at: Time.current,
-                updated_at: Time.current
-              }
-            end
-          end
-
-          if product_collections_params.any?
-            opts = {}
-            # Column list rather than the index name — the composite unique index is named
-            # index_product_collections_on_collection_and_product (shortened to fit the
-            # identifier limit), so match by columns to stay name-independent.
-            opts[:unique_by] = %i[collection_id product_id] unless mysql_adapter?
-
-            Spree::ProductCollection.upsert_all(product_collections_params, **opts)
-          end
-        end
-
-        collection_ids.each { |id| Spree::Collection.reset_counters(id, :product_collections) }
-        product_ids.each { |id| Spree::Product.reset_counters(id, :product_collections) }
-
-        Spree::Product.where(id: product_ids).touch_all
-        products.each(&:enqueue_search_index)
-        Spree::Collection.where(id: collection_ids).touch_all
-
+        remove_memberships(collections, products)
         success(true)
       end
 
       private
 
-      def mysql_adapter?
-        Spree.mysql?
+      def membership_class = Spree::ProductCollection
+      def group_class = Spree::Collection
+
+      def refresh_group_counters(collection_ids)
+        collection_ids.each { |id| Spree::Collection.reset_counters(id, :product_collections) }
       end
     end
   end

data/app/services/spree/coupon_codes/bulk_generate.rb

@@ -4,13 +4,15 @@ module Spree
       prepend Spree::ServiceModule::Base
 
       def call(promotion:, quantity: 10)
-        coupon_codes = []
-
         Spree::CouponCode.transaction do
-          quantity.times do
-            coupon_codes << coupon_attributes(promotion).merge(code: create_code(promotion.code_prefix))
-          end
-          Spree::CouponCode.insert_all coupon_codes
+          Spree::CouponCode.insert_all(
+            Array.new(quantity) do
+              {
+                promotion_id: promotion.id, code: create_code(promotion.code_prefix),
+                created_at: Time.current, updated_at: Time.current
+              }
+            end
+          )
         end
 
         success(promotion.reload.coupon_codes)
@@ -24,14 +26,6 @@ module Spree
           break code unless Spree::CouponCode.exists?(code: code)
         end
       end
-
-      def coupon_attributes(promotion)
-        {
-          promotion_id: promotion.id,
-          created_at: Time.current,
-          updated_at: Time.current
-        }
-      end
     end
   end
 end

data/app/services/spree/data_requests/create.rb

@@ -26,7 +26,7 @@ module Spree
         # and a second erasure has nothing to erase.
         if customer.anonymized?
           data_request = Spree::DataRequest.new(customer: customer)
-          data_request.errors.add(:base, Spree.t('data_request_errors.already_anonymized'))
+          data_request.errors.add(:base, I18n.t('spree.data_request_errors.already_anonymized'))
           return failure(data_request)
         end
 

data/app/services/spree/deliveries/destroy.rb

@@ -15,12 +15,12 @@ module Spree
       # @return [Spree::ServiceModule::Result]
       def call(delivery:)
         if delivery.shipping_label_id.present?
-          delivery.errors.add(:base, :has_label, message: Spree.t('deliveries.errors.has_label'))
+          delivery.errors.add(:base, :has_label, message: I18n.t('spree.deliveries.errors.has_label'))
           return failure(delivery)
         end
 
         if delivery.delivered?
-          delivery.errors.add(:base, :delivered, message: Spree.t('deliveries.errors.delivered'))
+          delivery.errors.add(:base, :delivered, message: I18n.t('spree.deliveries.errors.delivered'))
           return failure(delivery)
         end
 

data/app/services/spree/email_templates/check.rb

@@ -0,0 +1,58 @@
+module Spree
+  module EmailTemplates
+    # Renders a draft the way customers would receive it, with sample data
+    # and strict variables, and reports what stops it from rendering. A
+    # draft of the layout or a shared partial is checked inside every
+    # editable email, since all of them use it, and in every language the
+    # store has published its own version of an email in.
+    #
+    # An email the store has no record for cannot be rendered with data; its
+    # draft is still checked for Liquid syntax errors.
+    class Check
+      # @param store [Spree::Store]
+      # @param draft [Spree::EmailTemplateDraft]
+      def initialize(store:, draft:)
+        @store = store
+        @draft = draft
+      end
+
+      # @return [Array<Hash>] one `{ email:, message:, line: }` per problem; empty when the draft renders
+      def call
+        locales.flat_map { |locale| email_keys.filter_map { |email_key| problem_in(email_key, locale) } }.uniq
+      end
+
+      private
+
+      def email_keys
+        definition = @draft.definition
+        definition.email? ? [definition.key] : Spree.editable_email_templates.emails.map(&:key)
+      end
+
+      def locales
+        return [@draft.locale] if @draft.definition.email? || @draft.locale != Spree::EmailTemplate::ANY_LOCALE
+
+        [@draft.locale, *@store.email_templates.published.where.not(locale: Spree::EmailTemplate::ANY_LOCALE).distinct.pluck(:locale)]
+      end
+
+      def problem_in(email_key, locale)
+        Preview.new(store: @store, key: @draft.key, locale: locale, subject: @draft.subject, body: @draft.body,
+                    email_key: email_key, strict: true).call
+        nil
+      rescue Spree::EmailTemplates::NoSampleRecord
+        syntax_problem(email_key)&.merge(locale: locale)
+      rescue Liquid::Error => e
+        { email: email_key, locale: locale, message: e.message, line: e.line_number }
+      rescue MRML::Error => e
+        { email: email_key, locale: locale, message: e.message, line: nil }
+      end
+
+      def syntax_problem(email_key)
+        Liquid::Template.parse(@draft.body, environment: Spree::Emails::Renderer.environment, line_numbers: true)
+        Liquid::Template.parse(@draft.subject.to_s, environment: Spree::Emails::Renderer.environment)
+        nil
+      rescue Liquid::Error => e
+        { email: email_key, message: e.message, line: e.line_number }
+      end
+    end
+  end
+end

data/app/services/spree/email_templates/no_sample_record.rb

@@ -0,0 +1,7 @@
+module Spree
+  module EmailTemplates
+    # The store has no record to build an email's sample data from, so it
+    # cannot be previewed with data yet.
+    class NoSampleRecord < StandardError; end
+  end
+end

data/app/services/spree/email_templates/preview.rb

@@ -0,0 +1,99 @@
+module Spree
+  module EmailTemplates
+    # Renders an editable email template with sample data, through the same
+    # renderer customers' emails go through. An unsaved subject and body take
+    # the place of the store's published version; everything else the email
+    # uses comes from the store's published templates and the files.
+    #
+    # The layout and shared partials are previewed inside an email that uses
+    # them, the first editable email unless another is named.
+    class Preview
+      # @return [Hash] the variables the email was rendered with, once {#call} has run
+      attr_reader :variables
+
+      # @return [Spree::Emails::RenderedEmail, nil] the rendered email, once {#call} has run
+      attr_reader :rendered
+
+      # @param store [Spree::Store]
+      # @param key [String] the editable template being previewed
+      # @param locale [String] a language code, or "any"
+      # @param subject [String, nil] an unsaved subject; nil keeps the current one
+      # @param body [String, nil] an unsaved body; nil keeps the current one
+      # @param record_id [String, nil] the prefixed id of the record to build sample data from
+      # @param email_key [String, nil] for the layout or a partial, the email to show it in
+      # @param strict [Boolean] whether an unknown variable raises
+      # @param branding [Hash] unsaved branding values (see Spree::Emails::Branding)
+      def initialize(store:, key:, locale: Spree::EmailTemplate::ANY_LOCALE, subject: nil, body: nil,
+                     record_id: nil, email_key: nil, strict: false, branding: {})
+        @store = store
+        @key = key
+        @locale = locale.presence || Spree::EmailTemplate::ANY_LOCALE
+        @subject = subject
+        @body = body
+        @record_id = record_id
+        @email_key = email_key
+        @strict = strict
+        @branding = branding
+      end
+
+      # @return [Spree::Emails::RenderedEmail]
+      # @raise [Spree::EmailTemplates::NoSampleRecord] when the store has no record to build the sample from
+      def call
+        sample = email.sample_class.new(store: @store, record_id: @record_id)
+
+        in_locale do
+          renderer = Spree::Emails::Renderer.new(resolver: resolver, store: @store, currency: sample.currency, strict: @strict,
+                                                 branding: @branding)
+          sample_variables = sample.variables
+          @variables = renderer.variables(sample_variables)
+          @rendered = renderer.render(resolver.find(email.key), sample_variables)
+        end
+      end
+
+      # @return [Spree::Emails::EditableTemplates::Definition] the email the preview renders
+      def email
+        @email ||= if definition.email?
+                     definition
+                   else
+                     emails = Spree.editable_email_templates.emails
+                     emails.find { |candidate| candidate.key == @email_key } || emails.first
+                   end
+      end
+
+      private
+
+      def definition
+        Spree.editable_email_templates[@key] || raise(ArgumentError, "#{@key} is not an editable email template")
+      end
+
+      def resolver
+        @resolver ||= Spree::Emails::TemplateResolver.for_mailers(store: @store, locale: language, drafts: drafts)
+      end
+
+      # An unsaved subject or body sent alone is previewed with the other half
+      # customers currently get.
+      def drafts
+        return {} if @subject.nil? && @body.nil?
+
+        current = Spree::Emails::TemplateResolver.for_mailers(store: @store, locale: language).find(@key)
+        subject = @subject.nil? ? current&.subject : @subject
+        body = @body.nil? ? current&.body : @body
+        { @key => Spree::Emails::Template.new(key: @key, subject: subject, body: body) }
+      end
+
+      def language
+        @locale == Spree::EmailTemplate::ANY_LOCALE ? @store.default_locale : @locale
+      end
+
+      # Mirrors how mailers render: the email's language with the store's
+      # translation fallbacks, restored afterwards.
+      def in_locale(&block)
+        previous_fallbacks = Mobility.store_based_fallbacks
+        Spree::Locales::SetFallbackLocaleForStore.new.call(store: @store)
+        I18n.with_locale(language.presence || I18n.default_locale, &block)
+      ensure
+        Mobility.store_based_fallbacks = previous_fallbacks
+      end
+    end
+  end
+end

data/app/services/spree/emails/file_system.rb

@@ -0,0 +1,23 @@
+module Spree
+  module Emails
+    # Loads the partials templates pull in with `{% render 'spree/shared/line_item' %}`
+    # from `spree/shared/_line_item.liquid`, following Rails' partial naming.
+    class FileSystem
+      # @param resolver [Spree::Emails::TemplateResolver]
+      def initialize(resolver)
+        @resolver = resolver
+      end
+
+      # @param name [String]
+      # @return [String] the partial's source
+      def read_template_file(name)
+        partial = @resolver.find_partial(name.to_s)
+        raise Liquid::FileSystemError, "No such email partial: #{name}" unless partial
+
+        partial.body
+      rescue Spree::Emails::TemplateResolver::InvalidKey
+        raise Liquid::FileSystemError, 'Invalid email partial name'
+      end
+    end
+  end
+end

data/app/services/spree/emails/filters.rb

@@ -0,0 +1,84 @@
+module Spree
+  module Emails
+    # The filters email templates can use, in addition to Liquid's standard
+    # set. Names follow common Liquid conventions where the meaning is the same,
+    # is the Liquid most developers and agents already know.
+    module Filters
+      # @example {{ line_item.price | money }}
+      # @param amount [String, Numeric, nil]
+      # @param currency [String, nil] defaults to the email's currency
+      # @return [String]
+      def money(amount, currency = nil)
+        return '' if amount.blank?
+
+        Spree::Money.new(amount, currency: currency.presence || @context.registers[:currency]).to_s
+      end
+
+      # @example {{ order.total | money_with_currency }} # => "$10.00 USD"
+      # @return [String]
+      def money_with_currency(amount, currency = nil)
+        return '' if amount.blank?
+
+        Spree::Money.new(amount, currency: currency.presence || @context.registers[:currency], with_currency: true).to_s
+      end
+
+      # Formats a date in the store's time zone, never the server's. Takes a
+      # named format from the locale's `date.formats` (`long`, `short`,
+      # `default`), or a strftime pattern. A date with no time of day, such as
+      # "2026-12-31", is shown as that day in every zone.
+      #
+      # @example {{ order.completed_at | date: 'long' }}
+      # @example {{ 'now' | date: '%Y' }}
+      # @return [String]
+      def date(input, format = 'default')
+        value = parse_time(input)
+        return input.to_s if value.nil?
+
+        value = value.in_time_zone(time_zone) unless value.instance_of?(Date)
+        format = format.to_s
+
+        return value.strftime(format) if format.include?('%')
+
+        format = 'default' unless I18n.exists?("date.formats.#{format}")
+        I18n.l(value.to_date, format: format.to_sym)
+      end
+
+      # Translates one of Spree's own keys, with interpolation.
+      #
+      # @example {{ 'order_mailer.confirm_email.dear_customer' | t: name: order.customer_name }}
+      # @return [String]
+      def t(key, options = {})
+        interpolations = options.to_h.except('scope', 'default', :scope, :default).transform_keys(&:to_sym)
+
+        I18n.t(key.to_s, **interpolations, scope: :spree).to_s
+      end
+
+      # Marks a value as trusted HTML, so it is output without escaping. Only
+      # for HTML that was sanitized when it was written.
+      #
+      # @example {{ product.description_html | raw }}
+      # @return [ActiveSupport::SafeBuffer]
+      def raw(input)
+        input.to_s.html_safe
+      end
+
+      private
+
+      def parse_time(input)
+        case input
+        when Time, DateTime, ActiveSupport::TimeWithZone then input
+        when Date then input
+        when 'now', 'today' then Time.current
+        when /\A\d{4}-\d{2}-\d{2}\z/ then Date.iso8601(input)
+        when String then Time.iso8601(input)
+        end
+      rescue ArgumentError
+        nil
+      end
+
+      def time_zone
+        Time.find_zone(@context.registers[:store]&.preferred_timezone) || Time.zone
+      end
+    end
+  end
+end

data/app/services/spree/emails/liquid_context.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Emails
+    # `{% render %}` gives each partial a fresh, isolated context, and Liquid
+    # does not carry strict mode into it.
+    #
+    # Inside a partial an argument the caller left out reads as empty, so
+    # partials can take optional arguments; a misspelled field on an object
+    # still raises under strict variables.
+    class LiquidContext < Liquid::Context
+      attr_accessor :optional_arguments
+
+      def new_isolated_subcontext
+        super.tap do |subcontext|
+          subcontext.strict_variables = strict_variables
+          subcontext.strict_filters = strict_filters
+          subcontext.optional_arguments = true
+        end
+      end
+
+      def find_variable(key, raise_on_not_found: true)
+        super(key, raise_on_not_found: raise_on_not_found && !optional_arguments)
+      end
+
+      # Filters that can only rearrange escaped text, never decode it into
+      # markup. `url_decode` and the like are left out on purpose: turning
+      # "%3Cb%3E" back into "<b>" must not produce trusted HTML.
+      MARKUP_PRESERVING_FILTERS = %w[
+        strip lstrip rstrip strip_newlines upcase downcase capitalize
+        append prepend replace replace_first replace_last remove remove_first remove_last
+        truncate truncatewords
+      ].freeze
+
+      # Captured text is already-escaped HTML. A filter from the list above
+      # keeps it that way: plain string arguments are escaped going in, and the
+      # result stays marked safe, so `{{ greeting | upcase }}` is not escaped a
+      # second time when printed. Any other filter's result is escaped again.
+      def invoke(method, *args)
+        input = args.first
+        return super unless registers[:escape_output] && input.is_a?(ActiveSupport::SafeBuffer)
+        return super(method, input.to_str, *args.drop(1)) unless MARKUP_PRESERVING_FILTERS.include?(method.to_s)
+
+        escaped = args.drop(1).map { |arg| arg.is_a?(String) ? ERB::Util.html_escape(arg) : arg }
+        result = super(method, input, *escaped)
+        result.is_a?(String) ? result.html_safe : result
+      end
+    end
+  end
+end

data/app/services/spree/emails/rendered_email.rb

@@ -0,0 +1,14 @@
+module Spree
+  module Emails
+    # The finished parts of one email, ready for Action Mailer.
+    class RenderedEmail
+      attr_reader :subject, :html, :text
+
+      def initialize(subject:, html:, text:)
+        @subject = subject
+        @html = html
+        @text = text
+      end
+    end
+  end
+end

data/app/services/spree/emails/renderer.rb

@@ -0,0 +1,125 @@
+module Spree
+  module Emails
+    # Renders an email template into its subject, HTML and plain-text parts.
+    #
+    # Liquid fills in the data first, into the template and then the layout
+    # wrapping it; MJML then compiles the result into email-safe HTML. Every
+    # output is HTML-escaped unless a template marks it `| raw`, and a runaway
+    # template fails its one email rather than stalling the job queue.
+    class Renderer
+      LAYOUT = 'layouts/spree/base_mailer'.freeze
+
+      RESOURCE_LIMITS = {
+        render_length_limit: 2_000_000,
+        render_score_limit: 200_000,
+        assign_score_limit: 50_000
+      }.freeze
+
+      class << self
+        # The Liquid environment every email renders in: strict parsing and
+        # Spree's filters, isolated from any other Liquid the host app runs.
+        #
+        # @return [Liquid::Environment]
+        def environment
+          @environment ||= Liquid::Environment.build(error_mode: :strict) do |environment|
+            environment.register_filter(Spree::Emails::Filters)
+            # `include` takes a variable as the partial name, which would echo
+            # data back in its error message; `render` only takes a fixed name.
+            environment.tags.delete('include')
+            environment.register_tag('capture', Spree::Core::Emails::EscapedOutput::Capture)
+            environment.register_tag('cycle', Spree::Core::Emails::EscapedOutput::Cycle)
+          end
+        end
+      end
+
+      # @param resolver [Spree::Emails::TemplateResolver]
+      # @param store [Spree::Store]
+      # @param currency [String, nil] what `money` formats in, defaults to the store's
+      # @param strict [Boolean] whether an unknown variable raises; defaults to
+      #   true in development and test, false in production
+      # @param branding [Hash] unsaved branding values over the store's, for previews
+      def initialize(resolver:, store:, currency: nil, strict: Rails.env.local?, branding: {})
+        @resolver = resolver
+        @store = store
+        @branding = branding
+        @currency = currency.presence || store.default_currency
+        @strict = strict
+      end
+
+      # @param template [Spree::Emails::Template] a Liquid template
+      # @param assigns [Hash] the template's variables
+      # @return [Spree::Emails::RenderedEmail]
+      def render(template, assigns = {})
+        assigns = variables(assigns)
+        subject = subject_for(template, assigns)
+        body = render_liquid(template.body, assigns)
+        html = render_layout(body, assigns.merge('subject' => subject))
+
+        Spree::Emails::RenderedEmail.new(subject: subject, html: html, text: render_text(template, assigns, html))
+      end
+
+      # Wraps HTML a mailer rendered some other way — its own ERB views — in
+      # the email layout, so it carries the store's logo, header and footer.
+      #
+      # @param html [String] the email's body, trusted as rendered
+      # @param subject [String, nil]
+      # @return [String] the finished email HTML
+      def wrap(html, subject: nil)
+        body = %(<mj-section><mj-column><mj-text align="left">#{html}</mj-text></mj-column></mj-section>)
+
+        render_layout(body, variables('subject' => subject.to_s))
+      end
+
+      # Everything a template receives: the given variables plus `store` and
+      # `locale`, with string keys.
+      #
+      # @param assigns [Hash]
+      # @return [Hash]
+      def variables(assigns = {})
+        base_assigns.merge(assigns.deep_stringify_keys)
+      end
+
+      private
+
+      def render_layout(body, assigns)
+        layout = @resolver.find(LAYOUT) || raise(ArgumentError, "Missing email layout #{LAYOUT}.liquid")
+
+        MRML.to_html(render_liquid(layout.body, assigns.merge('content_for_layout' => body.html_safe)))
+      end
+
+      # The subject is plain text for a mail header, so it is not HTML-escaped.
+      def subject_for(template, assigns)
+        render_liquid(template.subject.to_s, assigns, escape: false).squish
+      end
+
+      def render_text(template, assigns, html)
+        text_template = @resolver.find_text(template.key)
+        return Spree::Emails::TextConverter.call(html) unless text_template
+
+        render_liquid(text_template.body, assigns, escape: false)
+      end
+
+      def render_liquid(source, assigns, escape: true)
+        context = Spree::Emails::LiquidContext.build(
+          environment: self.class.environment,
+          environments: [assigns],
+          registers: { store: @store, currency: @currency, escape_output: escape,
+                       file_system: Spree::Emails::FileSystem.new(@resolver) },
+          resource_limits: Liquid::ResourceLimits.new(RESOURCE_LIMITS),
+          rethrow_errors: true
+        )
+        context.strict_variables = @strict
+        context.strict_filters = true
+
+        Liquid::Template.parse(source, environment: self.class.environment, line_numbers: true).render!(context)
+      end
+
+      def base_assigns
+        @base_assigns ||= {
+          'store' => JSON.parse(Spree::Emails::StoreSerializer.new(@store, params: { branding: @branding }).serialize),
+          'locale' => I18n.locale.to_s
+        }
+      end
+    end
+  end
+end

data/app/services/spree/emails/template.rb

@@ -0,0 +1,51 @@
+module Spree
+  module Emails
+    # One Liquid email template: a file on disk, with optional front matter
+    # holding its subject, or a store's saved version with the subject in its
+    # own field.
+    class Template
+      FRONT_MATTER = /\A---\s*\n(.*?)\n---\s*(?:\n|\z)/m
+
+      attr_reader :key, :path
+
+      # @param key [String] the template key, e.g. "spree/order_mailer/confirm_email"
+      # @param path [String, nil] the file on disk
+      # @param subject [String, nil] the subject, for a template not read from a file
+      # @param body [String, nil] the body, for a template not read from a file
+      def initialize(key:, path: nil, subject: nil, body: nil)
+        @key = key
+        @path = path
+        @subject = subject
+        @body = body
+      end
+
+      # @return [Boolean] whether this is a store's saved template or a draft, rather than a file
+      def stored?
+        path.nil?
+      end
+
+      # @return [String, nil] the subject line as Liquid
+      def subject
+        stored? ? @subject : front_matter['subject']
+      end
+
+      # @return [String] the template without its front matter
+      def body
+        stored? ? @body.to_s : source.sub(FRONT_MATTER, '')
+      end
+
+      private
+
+      def source
+        @source ||= File.read(path)
+      end
+
+      def front_matter
+        @front_matter ||= begin
+          match = source.match(FRONT_MATTER)
+          match ? YAML.safe_load(match[1]).to_h : {}
+        end
+      end
+    end
+  end
+end

data/app/services/spree/emails/template_data.rb

@@ -0,0 +1,23 @@
+module Spree
+  module Emails
+    # Turns a record into the JSON an email template reads: the serializer's
+    # output, the same data a renderer outside Ruby would receive. Shared by
+    # mailers and by the sample data the template editor previews with.
+    # Download links and other bearer tokens stay out of it.
+    module TemplateData
+      # @param object [Object, nil] the record
+      # @param serializer [Class] an email serializer
+      # @param store [Spree::Store]
+      # @param currency [String, nil] defaults to the store's
+      # @param params [Hash] serializer params over the defaults
+      # @return [Hash, nil]
+      def self.call(object, serializer, store:, currency: nil, **params)
+        return if object.nil?
+
+        params = { store: store, currency: currency || store.default_currency, locale: I18n.locale.to_s,
+                   storefront_url: store.storefront_url.to_s.chomp('/'), hide_credentials: true }.merge(params)
+        JSON.parse(serializer.new(object, params: params).serialize)
+      end
+    end
+  end
+end