spree_core 6.0.0.beta3 → 6.0.0.rc1

data/db/migrate/20260925000001_add_replacement_to_spree_fulfillment_items.rb

@@ -0,0 +1,5 @@
+class AddReplacementToSpreeFulfillmentItems < ActiveRecord::Migration[8.1]
+  def change
+    add_column :spree_fulfillment_items, :replacement, :boolean, default: false, null: false
+  end
+end

data/db/migrate/20261001000001_add_post_sale_tax.rb

@@ -0,0 +1,30 @@
+class AddPostSaleTax < ActiveRecord::Migration[8.1]
+  def change
+    change_table :spree_tax_lines, bulk: true do |t|
+      t.references :return_line_item, index: true
+      t.references :claim_line_item, index: true
+      t.references :exchange_line_item, index: true
+      t.references :original_tax_line, index: true
+      t.boolean :credit, default: false, null: false
+    end
+
+    change_table :spree_return_line_items, bulk: true do |t|
+      t.decimal :included_tax_total, precision: 10, scale: 2, default: 0, null: false
+      t.decimal :additional_tax_total, precision: 10, scale: 2, default: 0, null: false
+    end
+
+    change_table :spree_claim_line_items, bulk: true do |t|
+      t.decimal :included_tax_total, precision: 10, scale: 2, default: 0, null: false
+      t.decimal :additional_tax_total, precision: 10, scale: 2, default: 0, null: false
+    end
+
+    change_table :spree_exchange_line_items, bulk: true do |t|
+      t.decimal :original_included_tax_total, precision: 10, scale: 2, default: 0, null: false
+      t.decimal :original_additional_tax_total, precision: 10, scale: 2, default: 0, null: false
+      t.decimal :new_included_tax_total, precision: 10, scale: 2, default: 0, null: false
+      t.decimal :new_additional_tax_total, precision: 10, scale: 2, default: 0, null: false
+    end
+
+    add_column :spree_refunds, :tax_amount, :decimal, precision: 10, scale: 2, default: 0, null: false
+  end
+end

data/db/migrate/20261001000001_convert_preferences_to_json.rb

@@ -0,0 +1,166 @@
+class ConvertPreferencesToJson < ActiveRecord::Migration[8.1]
+  # The tables whose classes declare `:password` preferences. Their secrets move
+  # to an encrypted `secret_preferences` column (see Spree::SecretPreferences).
+  SECRET_TABLES = %i[spree_payment_methods spree_integrations].freeze
+
+  # Records which tables had their `text` column replaced, so `down` restores
+  # `text` only there — a table whose column was already JSON (delivery method
+  # rules, commission rules) keeps it. Dropped on the way back down.
+  CONVERTED_TABLES_REGISTRY = :spree_converted_preference_tables
+
+  # The conversion lives here rather than in the upgrade rake task because the
+  # manifest runs AFTER db:migrate — a task scheduled there would find the YAML
+  # column already replaced. Secrets are moved in plain text, so this needs no
+  # encryption keys; they stay readable and `spree:upgrade:encrypt_secret_preferences`
+  # encrypts them.
+  def up
+    SECRET_TABLES.each do |table|
+      next unless table_exists?(table)
+
+      add_column table, :secret_preferences, :text unless column_exists?(table, :secret_preferences)
+    end
+
+    create_table CONVERTED_TABLES_REGISTRY, if_not_exists: true do |t|
+      t.string :table_name, null: false
+    end
+
+    conversion.preference_tables.each do |table|
+      if conversion.text_column?(table)
+        conversion.convert_text_table(table)
+        execute(Arel::InsertManager.new.tap do |insert|
+          registry = Arel::Table.new(CONVERTED_TABLES_REGISTRY)
+          insert.into(registry).insert([[registry[:table_name], table]])
+        end.to_sql)
+      else
+        conversion.convert_table(table)
+      end
+    end
+
+    drop_table :spree_preferences, if_exists: true
+  end
+
+  # Restores YAML: a `text` column where `up` replaced one, and a YAML document
+  # inside a JSON string where the column was already JSON, as before the
+  # upgrade. Secrets go back into `preferences` — decrypted, so rolling back an
+  # encrypted secret needs the encryption keys — tiers become a hash keyed by
+  # threshold again, and decimals return as BigDecimal for every row whose class
+  # can be resolved; anything else comes back as the string JSON held.
+  def down
+    restore = Restore.new(connection, conversion)
+    create_table :spree_preferences, if_not_exists: true do |t|
+      t.text :value
+      t.string :key
+      t.timestamps
+      t.index :key, unique: true
+    end
+
+    converted = converted_tables
+    conversion.preference_tables.each do |table|
+      if converted.include?(table)
+        add_column table, :preferences_yaml, :text
+        restore.table(table, target: 'preferences_yaml')
+        remove_column table, :preferences
+        rename_column table, :preferences_yaml, :preferences
+      else
+        restore.table(table, target: 'preferences', inside_json: true)
+      end
+    end
+
+    drop_table CONVERTED_TABLES_REGISTRY, if_exists: true
+
+    SECRET_TABLES.each do |table|
+      remove_column table, :secret_preferences if table_exists?(table) && column_exists?(table, :secret_preferences)
+    end
+  end
+
+  private
+
+  def converted_tables
+    return [] unless table_exists?(CONVERTED_TABLES_REGISTRY)
+
+    registry = Arel::Table.new(CONVERTED_TABLES_REGISTRY)
+    connection.select_values(registry.project(registry[:table_name]))
+  end
+
+  def conversion
+    @conversion ||= Spree::Preferences::JsonConversion.new(connection, log: ->(message) { say(message, true) })
+  end
+
+  class Restore
+    def initialize(connection, conversion)
+      @connection = connection
+      @conversion = conversion
+    end
+
+    def table(table, target:, inside_json: false)
+      typed = connection.column_exists?(table, :type)
+      secrets = connection.column_exists?(table, :secret_preferences)
+      columns = ['id', 'preferences', ('type' if typed), ('secret_preferences' if secrets)].compact
+
+      arel_table = Arel::Table.new(table)
+      connection.select_all(arel_table.project(*columns.map { |column| arel_table[column] })).each do |row|
+        next if row['preferences'].nil? && row['secret_preferences'].nil?
+
+        preferences = decode(row['preferences']) || {}
+        preferences.merge!(decode(decrypt(row['secret_preferences'])) || {}) if secrets
+        model = typed ? conversion.model_for(row['type']) : nil
+        restore_tiers(preferences, model)
+        restore_typed_values(preferences, model)
+
+        yaml = YAML.dump(preferences.transform_keys(&:to_sym))
+        conversion.write(table, row['id'], target => inside_json ? JSON.generate(yaml) : yaml)
+      end
+    end
+
+    private
+
+    attr_reader :connection, :conversion
+
+    def decode(raw)
+      raw.is_a?(String) ? JSON.parse(raw) : raw
+    end
+
+    # A value written before encryption was enabled is plain JSON and comes
+    # back as it is. An encrypted one that cannot be decrypted stops the
+    # rollback: writing its ciphertext into `preferences` would replace a
+    # gateway's keys with garbage.
+    def decrypt(raw)
+      return raw if raw.nil? || !encrypted?(raw)
+
+      unless ActiveRecord::Encryption.config.has_primary_key?
+        raise ActiveRecord::IrreversibleMigration, 'Encrypted secret_preferences cannot be rolled back without the Active Record encryption keys. Configure them and run the rollback again.'
+      end
+
+      ActiveRecord::Encryption.encryptor.decrypt(raw)
+    rescue ActiveRecord::Encryption::Errors::Decryption
+      raise ActiveRecord::IrreversibleMigration, 'An encrypted secret_preferences value could not be decrypted with the configured keys. Restore the keys it was encrypted with and run the rollback again.'
+    end
+
+    def encrypted?(raw)
+      parsed = JSON.parse(raw)
+      parsed.is_a?(Hash) && parsed.key?('p') && parsed.key?('h')
+    rescue JSON::ParserError
+      false
+    end
+
+    def restore_tiers(preferences, model)
+      tiers = preferences['tiers']
+      return unless tiers.is_a?(Array) && Spree::Preferences::JsonConversion.tiered_calculator?(model)
+
+      # A value that is not a number is kept as written, so two such tiers
+      # cannot collapse into one nil key.
+      preferences['tiers'] = tiers.to_h do |tier|
+        [Spree::Calculator::Tiers.decimal(tier['threshold']) || tier['threshold'],
+         Spree::Calculator::Tiers.decimal(tier['value']) || tier['value']]
+      end
+    end
+
+    def restore_typed_values(preferences, model)
+      return unless model.respond_to?(:declared_preference_types)
+
+      model.declared_preference_types.each do |name, type|
+        preferences[name.to_s] = Spree::Preferences::Preferable.restore_value(preferences[name.to_s], type) if preferences.key?(name.to_s)
+      end
+    end
+  end
+end

data/db/migrate/20261001000001_create_spree_email_templates.rb

@@ -0,0 +1,52 @@
+class CreateSpreeEmailTemplates < ActiveRecord::Migration[8.1]
+  def change
+    create_table :spree_email_templates do |t|
+      t.references :store, null: false, index: false
+      t.string :key, null: false
+      t.string :locale, null: false
+      t.string :status, null: false
+      t.text :subject
+      t.text :body, null: false
+      t.text :base_subject
+      t.text :base_body, null: false
+      t.datetime :published_at, null: false
+      t.references :published_by, polymorphic: true, index: true
+      t.datetime :reverted_at
+      t.references :reverted_by, polymorphic: true, index: true
+
+      t.timestamps
+    end
+
+    add_index :spree_email_templates, [:store_id, :key, :locale], unique: true,
+                                                                  name: 'index_spree_email_templates_on_store_key_locale'
+    add_index :spree_email_templates, :status
+
+    create_table :spree_email_template_drafts do |t|
+      t.references :store, null: false, index: false
+      t.string :key, null: false
+      t.string :locale, null: false
+      t.text :subject
+      t.text :body, null: false
+      t.text :base_subject
+      t.text :base_body, null: false
+      t.integer :lock_version, null: false, default: 0
+      t.references :updated_by, polymorphic: true, index: true
+
+      t.timestamps
+    end
+
+    add_index :spree_email_template_drafts, [:store_id, :key, :locale], unique: true,
+                                                                        name: 'index_spree_email_template_drafts_on_store_key_locale'
+
+    create_table :spree_email_template_revisions do |t|
+      t.references :email_template, null: false, index: false
+      t.text :subject
+      t.text :body, null: false
+      t.references :published_by, polymorphic: true, index: true
+      t.datetime :created_at, null: false
+    end
+
+    add_index :spree_email_template_revisions, [:email_template_id, :created_at],
+              name: 'index_spree_email_template_revisions_on_template_and_created'
+  end
+end

data/lib/generators/spree/dummy/dummy_generator.rb

@@ -63,7 +63,6 @@ module Spree
 
       puts "Rails app generator args: #{args.inspect}"
       Rails::Generators.invoke('app', args)
-      inject_yaml_permitted_classes
     end
 
     def test_dummy_config
@@ -96,14 +95,6 @@ module Spree
 
     protected
 
-    def inject_yaml_permitted_classes
-      inside dummy_path do
-        inject_into_file 'config/application.rb', %Q[
-    config.active_record.yaml_column_permitted_classes = [Symbol, BigDecimal, ActiveSupport::HashWithIndifferentAccess, ActiveSupport::TimeWithZone, ActiveSupport::TimeZone, Time]
-        ], after: /config\.load_defaults.*$/, verbose: true
-      end
-    end
-
     def dummy_path
       ENV['DUMMY_PATH'] || 'spec/dummy'
     end

data/lib/generators/spree/dummy/templates/rails/test.rb

@@ -28,6 +28,9 @@ Dummy::Application.configure do
   # the suite sees it, as every real Spree app does.
   config.action_controller.raise_on_missing_callback_actions = true
 
+  # Fail a spec that looks up a translation key that does not exist.
+  config.i18n.raise_on_missing_translations = true
+
   # Tell Action Mailer not to deliver emails to the real world.
   # The :test delivery method accumulates sent emails in the
   # ActionMailer::Base.deliveries array.
@@ -39,6 +42,10 @@ Dummy::Application.configure do
   # Print deprecation notices to the stderr
   config.active_support.deprecation = :stderr
 
+  # Spree's own code must not call the deprecated Spree.t.
+  config.active_support.disallowed_deprecation = :raise
+  config.active_support.disallowed_deprecation_warnings = [/Spree\.t is deprecated/]
+
   config.active_job.queue_adapter = :test
 
   config.cache_store = :null_store

data/lib/spree/checkout/default_requirements.rb

@@ -29,19 +29,19 @@ module Spree
 
       def advisory_requirements
         [].tap do |r|
-          r << req('cart', 'line_items', Spree.t('checkout_requirements.line_items_required')) unless @cart.line_items.any?
-          r << req('address', 'email', Spree.t('checkout_requirements.email_required')) unless @cart.email.present?
-          r << req('address', 'ship_address', Spree.t('checkout_requirements.ship_address_required')) if @cart.shipping_address_required? && @cart.ship_address.blank?
-          r << req('delivery', 'delivery_method', Spree.t('checkout_requirements.delivery_method_required')) if delivery_step_required? && !delivery_method_selected?
-          r << req('payment', 'payment', Spree.t('checkout_requirements.payment_required')) if payment_required? && !payment_satisfied?
-          r << req('address', 'po_number', Spree.t('checkout_requirements.po_number_required')) if po_number_missing?
+          r << req('cart', 'line_items', I18n.t('spree.checkout_requirements.line_items_required')) unless @cart.line_items.any?
+          r << req('address', 'email', I18n.t('spree.checkout_requirements.email_required')) unless @cart.email.present?
+          r << req('address', 'ship_address', I18n.t('spree.checkout_requirements.ship_address_required')) if @cart.shipping_address_required? && @cart.ship_address.blank?
+          r << req('delivery', 'delivery_method', I18n.t('spree.checkout_requirements.delivery_method_required')) if delivery_step_required? && !delivery_method_selected?
+          r << req('payment', 'payment', I18n.t('spree.checkout_requirements.payment_required')) if payment_required? && !payment_satisfied?
+          r << req('address', 'po_number', I18n.t('spree.checkout_requirements.po_number_required')) if po_number_missing?
           r << order_minimum_requirement if below_order_minimum?
         end
       end
 
       def completion_requirements
-        errors = stock_errors + quantity_rule_errors
-        errors << req('address', 'email', Spree.t(:guest_checkout_not_allowed), code: 'guest_checkout_not_allowed') if @cart.guest_checkout_disallowed?
+        errors = stock_errors + quantity_rule_errors + assortment_errors
+        errors << req('address', 'email', I18n.t('spree.guest_checkout_not_allowed'), code: 'guest_checkout_not_allowed') if @cart.guest_checkout_disallowed?
         errors
       end
 
@@ -55,6 +55,22 @@ module Spree
         end
       end
 
+      # Re-checked at completion because a line can outlive the add that
+      # admitted it: a guest cart claimed after sign-in, a cart moved to
+      # another company, an assortment edited since. An order arriving here is
+      # staff's draft, which may sell outside the buyer's catalogs. A
+      # discontinued line already has its own requirement.
+      def assortment_errors
+        return [] unless @cart.is_a?(Spree::Cart)
+
+        line_items = completion_line_items.reject { |line_item| discontinued?(line_item) }
+        orderable_ids = @cart.orderable_variants.where(id: line_items.map(&:variant_id)).pluck(:id).to_set
+
+        line_items.reject { |line_item| orderable_ids.include?(line_item.variant_id) }.map do |line_item|
+          req('cart', 'line_items', I18n.t('spree.cart_line_item.not_orderable', li_name: line_item.name), code: 'not_orderable')
+        end
+      end
+
       # Advisory rather than completion-only: a buyer has to be able to build
       # the order below the threshold and read how far off they are while
       # they can still add to it. Completion refuses it because the advisory
@@ -68,7 +84,7 @@ module Spree
         shortfall = Spree::Money.new(@cart.order_minimum_shortfall, currency: minimum.currency)
 
         req('cart', 'order_minimum',
-            Spree.t('checkout_requirements.order_minimum_not_met',
+            I18n.t('spree.checkout_requirements.order_minimum_not_met',
                     minimum: minimum.display_amount.to_s, shortfall: shortfall.to_s),
             code: 'order_minimum_not_met')
       end
@@ -77,15 +93,23 @@ module Spree
       # while an individual variant hit its discontinue_on date after it
       # entered the cart.
       def stock_errors
-        @cart.line_items.includes(variant: :product).filter_map do |line_item|
-          if line_item.variant.nil? || line_item.variant.discontinued? || line_item.variant.product.discontinued?
-            req('cart', 'line_items', Spree.t('cart_line_item.discontinued', li_name: line_item.name), code: 'discontinued')
+        completion_line_items.filter_map do |line_item|
+          if discontinued?(line_item)
+            req('cart', 'line_items', I18n.t('spree.cart_line_item.discontinued', li_name: line_item.name), code: 'discontinued')
           elsif !line_item.sufficient_stock?
-            req('cart', 'line_items', Spree.t('cart_line_item.out_of_stock', li_name: line_item.name), code: 'out_of_stock')
+            req('cart', 'line_items', I18n.t('spree.cart_line_item.out_of_stock', li_name: line_item.name), code: 'out_of_stock')
           end
         end
       end
 
+      def discontinued?(line_item)
+        line_item.variant.nil? || line_item.variant.discontinued? || line_item.variant.product.discontinued?
+      end
+
+      def completion_line_items
+        @completion_line_items ||= @cart.line_items.includes(variant: :product).to_a
+      end
+
       def delivery_step_required?
         @cart.delivery_step_required?
       end

data/lib/spree/core/configuration.rb

@@ -60,7 +60,7 @@ module Spree
 
       # Preprocessed product image variant sizes at 2x retina resolution.
       # These variants are generated on upload to reduce runtime processing.
-      # When using spree_image_tag, pass variant option instead of width and height.
+      # Pass the variant to spree_image_url instead of a width and height.
       #
       # Default sizes:
       #   mini (128x128)     - admin thumbnails, checkout line items

data/lib/spree/core/controller_helpers/store.rb

@@ -26,7 +26,7 @@ module Spree
 
           if object.has_attribute?(:store_id)
             if object.store.present? && object.store != current_store
-              raise Spree.t('errors.messages.store_is_already_set')
+              raise I18n.t('spree.errors.messages.store_is_already_set')
             else
               object.store = current_store
             end

data/lib/spree/core/dependencies.rb

@@ -37,7 +37,6 @@ module Spree
         order_update_item_service: 'Spree::Orders::UpdateItem',
         order_remove_line_item_service: 'Spree::Orders::RemoveLineItem',
         order_remove_item_service: 'Spree::Orders::RemoveItem',
-        cart_empty_service: 'Spree::Carts::Empty',
         cart_destroy_service: 'Spree::Carts::Destroy',
         cart_associate_service: 'Spree::Carts::Associate',
         cart_remove_out_of_stock_items_service: 'Spree::Carts::RemoveOutOfStockItems',
@@ -83,7 +82,6 @@ module Spree
         fulfillment_fulfill_workflow: 'Spree::Fulfillments::Fulfill',
         fulfillment_cancel_workflow: 'Spree::Fulfillments::Cancel',
         fulfillment_mark_delivered_workflow: 'Spree::Fulfillments::MarkDelivered',
-        fulfillment_purchase_label_workflow: 'Spree::Fulfillments::PurchaseLabel',
 
         # shipping labels + deliveries
         shipping_label_purchase_workflow: 'Spree::ShippingLabels::Purchase',
@@ -97,7 +95,6 @@ module Spree
         fulfillment_stand_down_service: 'Spree::Fulfillments::StandDownProvider',
         fulfillment_recalculate_delivery_service: 'Spree::Fulfillments::RecalculateDelivery',
         delivery_destroy_service: 'Spree::Deliveries::Destroy',
-        return_purchase_label_workflow: 'Spree::Returns::PurchaseLabel',
 
         # inventory operations
         stock_level_correct_service: 'Spree::StockLevels::Correct',
@@ -242,7 +239,6 @@ module Spree
         # payment is arranged (deposits, net terms).
         purchase_amount_due_at_checkout_service: 'Spree::Purchases::AmountDueAtCheckout',
 
-        payment_create_service: 'Spree::Payments::Create',
         payment_process_workflow: 'Spree::Payments::Process',
         payment_capture_workflow: 'Spree::Payments::Capture',
         payment_void_workflow: 'Spree::Payments::Void',
@@ -253,6 +249,11 @@ module Spree
         seller_payout_complete_workflow: 'Spree::SellerPayouts::Complete',
         payments_handle_webhook_workflow: 'Spree::Payments::HandleWebhook',
         payment_session_complete_workflow: 'Spree::PaymentSessions::Complete',
+        email_template_save_draft_workflow: 'Spree::EmailTemplates::SaveDraft',
+        email_template_publish_workflow: 'Spree::EmailTemplates::Publish',
+        email_template_revert_workflow: 'Spree::EmailTemplates::Revert',
+        email_template_discard_draft_workflow: 'Spree::EmailTemplates::DiscardDraft',
+        email_template_restore_revision_workflow: 'Spree::EmailTemplates::RestoreRevision',
 
         # finders
         current_store_finder: 'Spree::Stores::FindDefault',

data/lib/spree/core/emails/escaped_output.rb

@@ -0,0 +1,60 @@
+module Spree
+  module Core
+    module Emails
+      # HTML-escapes what a Liquid email template prints, unless the value was
+      # marked `| raw`. Applied where output is written rather than through
+      # Liquid's global filter, which `{% assign %}` also runs through — that
+      # would escape a value once when assigned and again when printed, and
+      # turn assigned numbers and lists into strings.
+      #
+      # Switched on by the `escape_output` register, which Liquid hands down to
+      # every partial, so any other Liquid the host app runs is untouched.
+      module EscapedOutput
+        def self.active?(context)
+          context.registers[:escape_output]
+        end
+
+        # `{{ value }}` and `{% echo value %}`. Variables are not tags, so this
+        # is the one place Liquid itself has to be extended.
+        module Variable
+          def render_to_output_buffer(context, output)
+            return super unless EscapedOutput.active?(context)
+
+            write_escaped(render(context), output)
+            output
+          end
+
+          private
+
+          def write_escaped(value, output)
+            case value
+            when nil then nil
+            when Array then value.each { |item| write_escaped(item, output) }
+            else output << ERB::Util.html_escape(Liquid::Utils.to_s(value))
+            end
+          end
+        end
+
+        # A captured block was escaped as it rendered, so it is kept as safe
+        # HTML rather than escaped a second time when printed.
+        class Capture < Liquid::Capture
+          def render(context)
+            output = super
+            EscapedOutput.active?(context) ? output.html_safe : output
+          end
+        end
+
+        # `{% cycle %}` writes its values straight to the output.
+        class Cycle < Liquid::Cycle
+          def render_to_output_buffer(context, output)
+            return super unless EscapedOutput.active?(context)
+
+            output << ERB::Util.html_escape(super(context, +''))
+          end
+        end
+      end
+    end
+  end
+end
+
+Liquid::Variable.prepend(Spree::Core::Emails::EscapedOutput::Variable)