spree_core 6.0.0.beta4 → 6.0.0.rc2

data/app/models/spree/tax_provider/internal.rb

@@ -30,40 +30,43 @@ module Spree
         sweep_internal_duty_tax_lines(owner) if full_estimate
         return if items.empty?
 
-        rates = Spree::TaxRate.for_store(owner.store).for_jurisdiction(owner.tax_country&.iso, owner.tax_address&.state_code).to_a
+        rates = rates_for(owner)
 
         items.group_by(&:class).each do |klass, group|
           # Replace-all set semantics per estimate: stale lines die with the
           # address/items change that triggered the re-estimate.
-          Spree::TaxLine.where(tax_line_foreign_key(klass) => group.map(&:id)).delete_all
+          Spree::TaxLine.where(Spree::TaxLine.adjustable_key_for(klass) => group.map(&:id)).delete_all
         end
 
+        items.each { |item| tax_item(owner, item, rates, exemptions) }
+      end
+
+      # Gives back each credited unit's share of the TaxLines the sale actually
+      # charged (see Spree::TaxProvider::RecordedShare). TaxRate rows are not
+      # versioned, so this engine can never recompute at a past date —
+      # +tax_date+ is accepted and ignored, and the rows are the only record
+      # of what the customer paid.
+      def estimate_refund(order, items, amounts: nil, tax_date: nil)
+        Spree::TaxProvider::RecordedShare.new(order: order, items: items, amounts: amounts).call
+      end
+
+      # Taxed like any line of the order, under the replacement's own category
+      # and at the order's tax address. +tax_date+ is ignored for the reason
+      # given on #estimate.
+      #
+      # An exemption is read as it applied to the line being replaced: a
+      # certificate's per-line carve-out names that line, and the exchange line
+      # replacing it would otherwise match no carve-out and come out exempt.
+      def estimate_replacement(order, items, tax_date: nil, tax_identifier: nil, exemptions: [])
+        return if items.empty?
+
+        Spree::TaxLine.charges.where(exchange_line_item_id: items.map(&:id)).delete_all
+
+        rates = rates_for(order)
         items.each do |item|
-          relevant_rates = rates.select { |rate| rate.tax_category_id == tax_category_id_for(item, owner) }
-
-          # A matched rate always produces a row, zero-amount ones included:
-          # a zero rate is a treatment ("this is zero-rated"), which reporting
-          # and e-invoicing both need to see. No matched rate means no opinion,
-          # and writes nothing.
-          taxed = relevant_rates.map do |rate|
-            jurisdiction = jurisdiction_for(rate, owner)
-            [rate, jurisdiction, exemption_for(item, exemptions, jurisdiction)]
-          end
+          next unless item.credited_quantity.to_i.positive?
 
-          # An exempt item has no tax to back out of its price, so its whole
-          # basis is pre-tax.
-          exempt_rates = taxed.select { |_rate, _jurisdiction, exemption| exemption }.map(&:first)
-          store_pre_tax_amount(item, relevant_rates - exempt_rates)
-
-          taxed.each do |rate, jurisdiction, exemption|
-            if exemption
-              write_tax_line(owner, item, rate, 0, 'customer_exempt', jurisdiction,
-                             data: exemption_data(exemption, item))
-            else
-              write_tax_line(owner, item, rate, compute_tax(rate, item, relevant_rates),
-                             reason_for(rate), jurisdiction)
-            end
-          end
+          tax_item(order, item, rates, exemptions, exemption_subject: item.line_item || item)
         end
       end
 
@@ -107,12 +110,35 @@ module Spree
         owner.tax_lines.where(fee_id: duty_fee_ids, provider_id: 'internal').delete_all
       end
 
-      def tax_line_foreign_key(klass)
-        case klass.name
-        when 'Spree::LineItem' then :line_item_id
-        when 'Spree::Fulfillment' then :fulfillment_id
-        when 'Spree::Fee' then :fee_id
-        else raise ArgumentError, "#{klass} is not taxable"
+      def rates_for(owner)
+        Spree::TaxRate.for_store(owner.store).for_jurisdiction(owner.tax_country&.iso, owner.tax_address&.state_code).to_a
+      end
+
+      def tax_item(owner, item, rates, exemptions, exemption_subject: item)
+        relevant_rates = rates.select { |rate| rate.tax_category_id == tax_category_id_for(item, owner) }
+
+        # A matched rate always produces a row, zero-amount ones included:
+        # a zero rate is a treatment ("this is zero-rated"), which reporting
+        # and e-invoicing both need to see. No matched rate means no opinion,
+        # and writes nothing.
+        taxed = relevant_rates.map do |rate|
+          jurisdiction = jurisdiction_for(rate, owner)
+          [rate, jurisdiction, exemption_for(exemption_subject, exemptions, jurisdiction)]
+        end
+
+        # An exempt item has no tax to back out of its price, so its whole
+        # basis is pre-tax.
+        exempt_rates = taxed.select { |_rate, _jurisdiction, exemption| exemption }.map(&:first)
+        store_pre_tax_amount(item, relevant_rates - exempt_rates)
+
+        taxed.each do |rate, jurisdiction, exemption|
+          if exemption
+            write_tax_line(owner, item, rate, 0, 'customer_exempt', jurisdiction,
+                           data: exemption_data(exemption, exemption_subject))
+          else
+            write_tax_line(owner, item, rate, compute_tax(rate, item, relevant_rates, owner.currency),
+                           reason_for(rate), jurisdiction)
+          end
         end
       end
 
@@ -143,16 +169,19 @@ module Spree
         item.respond_to?(:taxable_basis) ? item.taxable_basis : item.amount
       end
 
-      def compute_tax(rate, item, relevant_rates)
+      # Rounded per line, half up, to the order's currency — the internal
+      # provider's choice; other providers round as their jurisdictions require.
+      def compute_tax(rate, item, relevant_rates, currency)
         basis = taxable_basis(item)
 
-        if rate.included_in_price
-          included_sum = relevant_rates.select(&:included_in_price).sum(&:amount)
-          included_sum = rate.amount if included_sum.zero?
-          (basis / (1 + included_sum) * rate.amount).round(2)
-        else
-          (basis * rate.amount).round(2)
-        end
+        tax = if rate.included_in_price
+                included_sum = relevant_rates.select(&:included_in_price).sum(&:amount)
+                included_sum = rate.amount if included_sum.zero?
+                basis / (1 + included_sum) * rate.amount
+              else
+                basis * rate.amount
+              end
+        Spree::Money::Rounding.to_currency(tax, currency)
       end
 
       # Pre-tax amounts are stored so refund and reporting code can weigh
@@ -209,7 +238,7 @@ module Spree
         owner_key = owner.is_a?(Spree::Order) ? :order : :cart
         Spree::TaxLine.create!(
           {
-            tax_line_foreign_key(item.class) => item.id,
+            Spree::TaxLine.adjustable_key_for(item.class) => item.id,
             owner_key => owner,
             tax_rate: rate,
             amount: amount,

data/app/models/spree/tax_provider/recorded_share.rb

@@ -0,0 +1,114 @@
+module Spree
+  module TaxProvider
+    # The tax a return, claim or exchange line gives back, read off what the
+    # sale actually charged: each credited unit's part of every TaxLine on the
+    # original line, row by row.
+    #
+    # Read from the rows rather than recomputed from TaxRate configuration,
+    # because the customer is owed back what they paid. Rates are not
+    # versioned, so a rate edited since the sale would otherwise refund a
+    # figure nobody was charged.
+    #
+    # Internal's answer to +estimate_refund+. Public so any other provider can
+    # answer with it too, rather than quoting the credit itself.
+    class RecordedShare
+      # @param order [Spree::Order]
+      # @param items [Array<Spree::ReturnLineItem, Spree::ClaimLineItem, Spree::ExchangeLineItem>]
+      # @param amounts [Hash{Object => BigDecimal}, nil] see Base#estimate_refund
+      def initialize(order:, items:, amounts: nil)
+        @order = order
+        @items = Array(items)
+        @amounts = amounts
+      end
+
+      # Replaces each item's credit rows.
+      #
+      # @return [void]
+      def call
+        items.each do |item|
+          key = Spree::TaxLine.adjustable_key_for(item.class)
+          Spree::TaxLine.credits.where(key => item.id).delete_all
+          credit(item, key)
+        end
+      end
+
+      private
+
+      attr_reader :order, :items, :amounts
+
+      def credit(item, key)
+        share = share_of_line(item)
+        return if share.zero?
+
+        sources = item.line_item.tax_lines.order(:id).to_a
+        sources.zip(shares_for(sources, share)).each do |source, cents|
+          write(item, key, source, cents)
+        end
+      end
+
+      # The part of the original line this item gives back: its credited units,
+      # and of those only the share of their worth the customer is refunded.
+      def share_of_line(item)
+        quantity = item.line_item&.quantity.to_i
+        units = item.credited_quantity.to_i
+        return 0 if quantity.zero? || units.zero?
+
+        Rational(units, quantity) * refunded_fraction(item)
+      end
+
+      def refunded_fraction(item)
+        return 1 if amounts.nil?
+
+        worth = item.credited_worth.to_d
+        return 0 unless worth.positive?
+
+        [Rational(amounts.fetch(item, 0).to_d) / Rational(worth), 1].min
+      end
+
+      # The rows' total share rounded once, then divided by largest remainder,
+      # so the credit lands on the cent and each rate keeps its part of it. A
+      # row is never credited past what earlier credits left of it, or three
+      # single-unit returns of one line could give back a cent more than it
+      # charged.
+      def shares_for(sources, share)
+        weights = sources.map { |source| to_minor_units(source.amount) }
+        return Array.new(sources.size, 0) if weights.sum.zero?
+
+        target = (Rational(weights.sum) * share).round(half: :up)
+        allotted = Spree::Adjusters::LargestRemainder.largest_remainder_shares(target, weights)
+
+        sources.zip(allotted).map { |source, cents| [cents, remaining_cents(source)].min }
+      end
+
+      def remaining_cents(source)
+        credited = Spree::TaxLine.credits.where(original_tax_line_id: source.id).sum(:amount)
+        [to_minor_units(source.amount) - to_minor_units(credited), 0].max
+      end
+
+      # Zero-amount rows are copied too: a zero-rated or exempt sale is a
+      # treatment the credit note has to repeat.
+      def write(item, key, source, cents)
+        Spree::TaxLine.create!(
+          key => item.id,
+          order: order,
+          credit: true,
+          original_tax_line: source,
+          tax_rate_id: source.tax_rate_id,
+          amount: Spree::Money::Rounding.from_minor_units(cents, order.currency),
+          rate: source.rate,
+          label: source.label,
+          included: source.included,
+          provider_id: source.provider_id,
+          taxability_reason: source.taxability_reason,
+          country_code: source.country_code,
+          state_code: source.state_code,
+          data: source.data
+        )
+      end
+
+      def to_minor_units(amount)
+        Spree::Money::Rounding.to_minor_units(amount, order.currency)
+      end
+    end
+  end
+end

data/app/models/spree/tax_rate.rb

@@ -15,6 +15,10 @@ module Spree
     include Spree::HasCustomFields
     include Spree::Metadata
     include Spree::SingleStoreResource
+    include Spree::CanonicalDecimals
+
+    # A fraction (0.07125), held to the column's five decimals.
+    canonical_decimals :amount, places: 5
 
     with_options inverse_of: :tax_rates do
       belongs_to :tax_category,
@@ -56,17 +60,36 @@ module Spree
           ->(category) { where(tax_category_id: category.try(:id)) }
     scope :included_in_price, -> { where(included_in_price: true) }
 
-    self.whitelisted_ransackable_attributes = %w[amount country_code state_code tax_category_id included_in_price name]
+    self.whitelisted_ransackable_attributes = %w[amount rate country_code state_code tax_category_id included_in_price name]
+    ransack_alias :rate, :amount
+    search_by :name
 
-    # Virtual attribute for percentage display in admin forms
-    def amount_percentage
-      return nil if amount.nil?
+    # The rate as a fraction (0.23); the column is +amount+.
+    alias_attribute :rate, :amount
+
+    # The rate as a percentage (23), what a merchant types.
+    #
+    # @return [BigDecimal, nil]
+    def rate_percent
+      amount && amount * 100
+    end
+
+    # @param value [String, Numeric, nil]
+    def rate_percent=(value)
+      parsed = Spree::Money::Rounding.parse_decimal(value)
+      self.amount = parsed && parsed / 100
+    end
 
-      (amount * 100).round(2)
+    # @deprecated Use {#rate_percent}; removed in 6.1.
+    def amount_percentage
+      Spree::Deprecation.warn('Spree::TaxRate#amount_percentage is deprecated and will be removed in Spree 6.1. Use #rate_percent instead.')
+      rate_percent
     end
 
+    # @deprecated Use {#rate_percent=}; removed in 6.1.
     def amount_percentage=(value)
-      self.amount = value.present? ? (value.to_f / 100) : nil
+      Spree::Deprecation.warn('Spree::TaxRate#amount_percentage= is deprecated and will be removed in Spree 6.1. Use #rate_percent= instead.')
+      self.rate_percent = value
     end
 
     # The included-in-price rate to back out of a gross price.
@@ -100,8 +123,7 @@ module Spree
     #
     # @return [String]
     def adjustment_label
-      Spree.t included_in_price? ? :including_tax : :excluding_tax,
-              scope: 'adjustment_labels.tax_rates',
+      I18n.t "spree.adjustment_labels.tax_rates.#{included_in_price? ? :including_tax : :excluding_tax}",
               name: name.presence || tax_category.name,
               amount: amount_for_label
     end

data/app/models/spree/taxon.rb

@@ -10,7 +10,7 @@ module Spree
   # prefix (ctg), and model_name are all Spree::Category. Only the constant differs,
   # so is_a?, STI, polymorphic *_type strings, and class_name: references keep
   # resolving to Spree::Category. The warning below fires through Spree's deprecator
-  # when this file loads (at boot under eager load, on first reference otherwise).
+  # when this file loads (on first reference; it is kept out of eager loading).
   Taxon = Category
 
   Spree::Deprecation.warn('Spree::Taxon is deprecated and will be removed in Spree 6.1. Use Spree::Category instead.')

data/app/models/spree/taxonomy.rb

@@ -12,7 +12,6 @@ module Spree
 
     has_many :taxons, class_name: 'Spree::Category', inverse_of: :taxonomy
     has_one :root, -> { where parent_id: nil }, class_name: 'Spree::Category', dependent: :destroy
-    belongs_to :store, class_name: 'Spree::Store'
 
     default_scope { order("#{table_name}.position, #{table_name}.created_at") }
   end

data/app/models/spree/update_status.rb

@@ -0,0 +1,25 @@
+module Spree
+  # What {Spree::UpdateCheck} last learned about newer releases. Never
+  # persisted.
+  class UpdateStatus
+    include ActiveModel::Model
+    include ActiveModel::Attributes
+
+    attribute :current_version, :string
+    attribute :enabled, :boolean, default: true
+    # Nil until the first check has finished.
+    attribute :checked_at, :datetime
+    # Newer releases, newest first: hashes with +version+, +url+ and +published_at+.
+    attribute :releases, default: -> { [] }
+
+    # @return [Hash, nil]
+    def latest_release
+      releases.first
+    end
+
+    # @return [Boolean]
+    def update_available?
+      latest_release.present?
+    end
+  end
+end

data/app/models/spree/variant.rb

@@ -8,6 +8,7 @@ module Spree
     include Spree::MemoizedData
     include Spree::HasCustomFields
     include Spree::Metadata
+    include Spree::CanonicalDecimals
     include Spree::HasExternalReferences
     include Spree::Searchable
     include Spree::StorePreferences
@@ -231,6 +232,10 @@ module Spree
 
     scope :not_deleted, -> { where("#{Spree::Variant.quoted_table_name}.deleted_at IS NULL") }
 
+    # The variants of a product relation, as a subquery. Unordered, because a
+    # listing's sort would otherwise land inside the IN.
+    scope :for_products, ->(products) { where(product_id: products.reorder(nil).select(Spree::Product.arel_table[:id])) }
+
     # Variants the shop sells in this currency. Base prices only: a price
     # list's rows are what one audience pays under an agreement, and a ladder
     # holds several rows for one variant, so a contract-only variant is not
@@ -285,17 +290,9 @@ module Spree
       relation.where(conditions.reduce(:or)).distinct
     end
 
-    # Backward compatibility alias — remove in Spree 6.0
-    scope :multi_search, ->(*args) { search(*args) }
-
-    # FIXME: cost price should be represented with DisplayMoney class
-    LOCALIZED_NUMBERS = %w(cost_price weight depth width height)
-
-    LOCALIZED_NUMBERS.each do |m|
-      define_method("#{m}=") do |argument|
-        self[m] = Spree::LocalizedNumber.parse(argument) if argument.present?
-      end
-    end
+    # A blank value leaves these as they were rather than clearing them.
+    canonical_decimals :cost_price, places: Spree::Money::Rounding::UNIT_PRICE_DECIMALS, ignore_blank: true
+    canonical_decimals :weight, :depth, :width, :height, places: nil, ignore_blank: true
 
     accepts_nested_attributes_for(
       :stock_levels,
@@ -330,6 +327,7 @@ module Spree
                                                  carton_package_type_id carton_weight cartons_per_pallet]
     self.whitelisted_ransackable_scopes = %i(product_name_or_sku_cont search_by_product_name_or_sku search
                                              available_at_stock_location)
+    self.ransackable_scope_types = { 'available_at_stock_location' => 'id' }
     self.private_ransackable_attributes = { store: %w[cost_price cost_currency deleted_at] }
 
     def self.product_name_or_sku_cont(query)
@@ -665,7 +663,7 @@ module Spree
     def price_in(currency)
       currency = currency&.upcase
 
-      price = if prices.loaded? && prices.any?
+      price = if read_association_in_memory?(:prices) && prices.any?
                 prices.detect { |p| p.currency == currency && p.price_list_id.nil? }
               else
                 prices.base_prices.find_by(currency: currency)

data/app/models/spree/variant_media.rb

@@ -35,7 +35,7 @@ module Spree
       return if asset.product&.id == variant.product_id
 
       errors.add(:asset, :variant_product_mismatch,
-                 message: Spree.t('errors.messages.variant_product_mismatch'))
+                 message: I18n.t('spree.errors.messages.variant_product_mismatch'))
     end
 
     def refresh_variant_thumbnail

data/app/models/spree/webhook_delivery.rb

@@ -25,6 +25,7 @@ module Spree
 
     # Ransack configuration
     self.whitelisted_ransackable_attributes = %w[event_name response_code execution_time success delivered_at created_at]
+    search_by :event_name
 
     # Event subjects whose permission is not found by class name alone.
     PAYLOAD_SUBJECT_CLASSES = {

data/app/models/spree/webhook_endpoint.rb

@@ -13,7 +13,6 @@ module Spree
 
     encrypts :secret_key, deterministic: true if Rails.configuration.active_record.encryption.include?(:primary_key)
 
-    belongs_to :store, class_name: 'Spree::Store'
     has_many :webhook_deliveries, class_name: 'Spree::WebhookDelivery', dependent: :destroy_async
 
     validates :url, presence: true
@@ -31,11 +30,45 @@ module Spree
     before_save :clear_disabled_state_when_reactivated
 
     self.whitelisted_ransackable_attributes = %w[name url active]
+    search_by :url
 
     scope :active, -> { where(active: true) }
     scope :inactive, -> { where(active: false) }
     scope :enabled, -> { active.where(disabled_at: nil) }
 
+    # Whether +url+ targets a host the operator trusts despite it resolving to
+    # a private address — e.g. a storefront Service in the same Kubernetes
+    # cluster. Set via +Spree::Api::Config.webhooks_allowed_internal_hosts+
+    # (SPREE_WEBHOOKS_ALLOWED_INTERNAL_HOSTS): an entry matches that exact
+    # host, or with a leading dot (".svc.cluster.local") any host under it.
+    # Matching is case-insensitive. Operator config only, so a store admin
+    # can never point a webhook at an internal address.
+    #
+    # @param url [String]
+    # @return [Boolean]
+    def self.allowed_internal_host?(url)
+      host = URI.parse(url.to_s).hostname&.downcase
+      return false if host.blank?
+
+      allowed_internal_hosts.any? do |entry|
+        entry.start_with?('.') ? host.end_with?(entry) : host == entry
+      end
+    rescue URI::InvalidURIError
+      false
+    end
+
+    # Spree::Api::Config only exists when spree_api is loaded; without it no
+    # webhook is ever delivered, so there is nothing to allow.
+    def self.allowed_internal_hosts
+      return [] unless defined?(Spree::Api::Config)
+
+      Array(Spree::Api::Config.webhooks_allowed_internal_hosts).filter_map do |entry|
+        entry = entry.to_s.strip.downcase
+        entry if entry.present? && entry != '.'
+      end
+    end
+    private_class_method :allowed_internal_hosts
+
     # Returns the plaintext `secret_key` only on the create response.
     #
     # `@reveal_secret_in_response` is set by the `after_create` callback above
@@ -50,18 +83,16 @@ module Spree
     # Number of consecutive failed deliveries before auto-disabling
     AUTO_DISABLE_THRESHOLD = 15
 
-    # Events whose payload carries a live customer credential (a password
-    # reset token). Receiving one is as good as holding the customer's account,
-    # so they reach only an endpoint that names them — never through `*` or a
-    # pattern — and the API asks for customer write access to point one at them.
-    CREDENTIAL_EVENTS = %w[customer.password_reset_requested].freeze
-
-    # Check if this endpoint is subscribed to a specific event
+    # Check if this endpoint is subscribed to a specific event.
+    #
+    # Events whose payload carries a live credential (a password reset token)
+    # reach only an endpoint that names them — never through `*` or a pattern —
+    # since receiving one is as good as holding the account.
     #
     # @param event_name [String] the event name to check
     # @return [Boolean]
     def subscribed_to?(event_name)
-      return subscriptions.to_a.include?(event_name) if CREDENTIAL_EVENTS.include?(event_name)
+      return subscriptions.to_a.include?(event_name) if Spree::Events.catalog.credential?(event_name)
       return true if subscriptions.blank? || subscriptions.include?('*')
 
       subscriptions.any? do |subscription|
@@ -74,11 +105,11 @@ module Spree
       end
     end
 
-    # Whether this endpoint receives customer credentials.
+    # The credential-carrying events this endpoint names.
     #
-    # @return [Boolean]
-    def receives_credentials?
-      (subscriptions.to_a & CREDENTIAL_EVENTS).any?
+    # @return [Array<Spree::Events::Catalog::Entry>]
+    def credential_subscriptions
+      Spree::Events.catalog.credential_events(subscriptions.to_a)
     end
 
     # Returns all events this endpoint is subscribed to
@@ -168,6 +199,8 @@ module Spree
     end
 
     def url_must_not_resolve_to_private_ip
+      return if self.class.allowed_internal_host?(url)
+
       uri = URI.parse(url)
       blacklist = SsrfFilter::IPV4_BLACKLIST + SsrfFilter::IPV6_BLACKLIST
       addresses = Resolv.getaddresses(uri.host)

data/app/models/spree/wishlist.rb

@@ -6,15 +6,10 @@ module Spree
 
     publishes_lifecycle_events
 
-    if Rails::VERSION::STRING >= '7.1.0'
-      has_secure_token on: :save
-    else
-      has_secure_token
-    end
+    has_secure_token on: :save
 
     belongs_to :customer, class_name: "::#{Spree.customer_class}", touch: true
     include Spree::DeprecatedCustomerAlias
-    belongs_to :store, class_name: 'Spree::Store'
 
     has_many :wishlist_items, class_name: 'Spree::WishlistItem', dependent: :destroy
     has_many :wished_items, class_name: 'Spree::WishlistItem', inverse_of: :wishlist, deprecated: true

data/app/models/spree/wishlist_item/custom_events.rb

@@ -11,6 +11,12 @@ module Spree
       LEGACY_EVENT_PREFIX = 'wished_item'
       LEGACY_EVENT_SUFFIXES = %w[created updated deleted].freeze
 
+      def self.included(base)
+        LEGACY_EVENT_SUFFIXES.each do |suffix|
+          base.publishes_event("#{LEGACY_EVENT_PREFIX}.#{suffix}", deprecated_alias_of: "#{base.event_prefix}.#{suffix}")
+        end
+      end
+
       # Wraps publishing rather than the three callbacks that call it, so the
       # decisions Publishable makes — whether events are enabled at all,
       # whether a touch-only update is worth announcing — are made once and the

data/app/presenters/spree/csv/customer_presenter.rb

@@ -35,7 +35,7 @@ module Spree
           customer.first_name,
           customer.last_name,
           customer.email,
-          customer.accepts_email_marketing ? Spree.t(:say_yes) : Spree.t(:say_no),
+          customer.accepts_email_marketing ? I18n.t('spree.say_yes') : I18n.t('spree.say_no'),
           customer.address&.company,
           customer.address&.address1,
           customer.address&.address2,

data/app/presenters/spree/csv/newsletter_subscriber_presenter.rb

@@ -25,7 +25,7 @@ module Spree
           newsletter_subscriber.email,
           newsletter_subscriber.customer&.full_name,
           newsletter_subscriber.customer_id,
-          newsletter_subscriber.verified? ? Spree.t(:say_yes) : Spree.t(:say_no),
+          newsletter_subscriber.verified? ? I18n.t('spree.say_yes') : I18n.t('spree.say_no'),
           newsletter_subscriber.verified_at,
           newsletter_subscriber.created_at,
           newsletter_subscriber.updated_at

data/app/presenters/spree/csv/order_line_item_presenter.rb

@@ -96,16 +96,16 @@ module Spree
           index.zero? ? order.email : nil,
           index.zero? ? order.status : nil,
           index.zero? ? order.currency : nil,
-          index.zero? ? order.item_total.to_f : nil,
-          index.zero? ? order.shipment_total.to_f : nil,
-          index.zero? ? order.tax_total.to_f : nil,
+          index.zero? ? money(order.item_total) : nil,
+          index.zero? ? money(order.delivery_total) : nil,
+          index.zero? ? money(order.tax_total) : nil,
           index.zero? ? order.included_tax_total.positive? : nil,
           index.zero? ? (order.discount_total.negative? || line_item.discount_total.negative?) : nil,
           index.zero? ? order.has_free_shipping? : nil,
-          index.zero? ? order.discount_total.abs : nil,
+          index.zero? ? money(order.discount_total.abs) : nil,
           index.zero? ? order.promo_code : nil,
-          index.zero? ? order.payments.store_credits.sum(:amount).abs : nil,
-          index.zero? ? order.total.to_f : nil,
+          index.zero? ? money(order.payments.store_credits.sum(:amount).abs) : nil,
+          index.zero? ? money(order.total) : nil,
           index.zero? ? order.delivery_method&.name : nil,
           index.zero? ? order.total_weight.to_f : nil,
           index.zero? ? order.payments.valid&.first&.display_source_name : nil,
@@ -160,6 +160,10 @@ module Spree
 
       private
 
+      def money(amount)
+        Spree::Money::Rounding.format(amount, order.currency)
+      end
+
       # Drops the cells whose headers were omitted, matching each value to its
       # header by position so the row and the header list stay aligned.
       def reject_omitted(csv)

data/app/presenters/spree/csv/price_list_price_presenter.rb

@@ -26,15 +26,10 @@ module Spree
 
       private
 
-      # The currency's own precision, a dot for the decimal mark and nothing
-      # else — "18.00", never "$18.00", "18.0" or "18,00". Fixed rather than
-      # localized because the file is read back by the import under the
-      # store's locale, not the exporting admin's, and a comma written here
-      # would re-import as a hundred times the price.
+      # A plain decimal ("18.00", never "$18.00" or "18,00"): the import reads
+      # the file back and accepts nothing else.
       def amount_string(amount)
-        return nil if amount.nil?
-
-        format("%.#{Spree::Money::Rounding.precision(price.currency)}f", amount)
+        Spree::Money::Rounding.format(amount, price.currency, unit_price: true)
       end
     end
   end