spree_core 6.0.0.beta4 → 6.0.0.rc2

data/lib/spree/core/emails/escaped_output.rb

@@ -0,0 +1,60 @@
+module Spree
+  module Core
+    module Emails
+      # HTML-escapes what a Liquid email template prints, unless the value was
+      # marked `| raw`. Applied where output is written rather than through
+      # Liquid's global filter, which `{% assign %}` also runs through — that
+      # would escape a value once when assigned and again when printed, and
+      # turn assigned numbers and lists into strings.
+      #
+      # Switched on by the `escape_output` register, which Liquid hands down to
+      # every partial, so any other Liquid the host app runs is untouched.
+      module EscapedOutput
+        def self.active?(context)
+          context.registers[:escape_output]
+        end
+
+        # `{{ value }}` and `{% echo value %}`. Variables are not tags, so this
+        # is the one place Liquid itself has to be extended.
+        module Variable
+          def render_to_output_buffer(context, output)
+            return super unless EscapedOutput.active?(context)
+
+            write_escaped(render(context), output)
+            output
+          end
+
+          private
+
+          def write_escaped(value, output)
+            case value
+            when nil then nil
+            when Array then value.each { |item| write_escaped(item, output) }
+            else output << ERB::Util.html_escape(Liquid::Utils.to_s(value))
+            end
+          end
+        end
+
+        # A captured block was escaped as it rendered, so it is kept as safe
+        # HTML rather than escaped a second time when printed.
+        class Capture < Liquid::Capture
+          def render(context)
+            output = super
+            EscapedOutput.active?(context) ? output.html_safe : output
+          end
+        end
+
+        # `{% cycle %}` writes its values straight to the output.
+        class Cycle < Liquid::Cycle
+          def render_to_output_buffer(context, output)
+            return super unless EscapedOutput.active?(context)
+
+            output << ERB::Util.html_escape(super(context, +''))
+          end
+        end
+      end
+    end
+  end
+end
+
+Liquid::Variable.prepend(Spree::Core::Emails::EscapedOutput::Variable)

data/lib/spree/core/engine.rb

@@ -19,6 +19,7 @@ module Spree
                                :payout_providers,
                                :password_validator,
                                :fulfillment_providers,
+                               :pickup_point_providers,
                                :tracking_carriers,
                                :stock_splitters,
                                :commission_rules,
@@ -37,19 +38,11 @@ module Spree
                                :taxon_rules,
                                :collection_rules,
                                :time_based_collection_rules,
-                               :themes,
-                               :theme_layout_sections,
-                               :pages,
-                               :page_sections,
-                               :page_blocks,
-                               :reports,
                                :translatable_resources,
                                :taggable_types,
                                :actor_classes,
                                :custom_fields,
                                :reporting,
-                               :analytics_events,
-                               :analytics_event_handlers,
                                :integrations,
                                :number_generators,
                                :subscribers,
@@ -60,16 +53,10 @@ module Spree
       PromoEnvironment = Struct.new(:rules, :actions)
       PricingEnvironment = Struct.new(:rules)
       OrderRoutingEnvironment = Struct.new(:strategies, :rules)
-      # Spree::Validators, not a Struct: the sets carry register/unregister so
-      # a host can drop a core rule (see Spree.validators.addresses).
-      SpreeValidators = Spree::Validators
       CustomFieldsEnvironment = Struct.new(:types, :enabled_resources)
       isolate_namespace Spree
       engine_name 'spree'
 
-      # Add app/subscribers to autoload paths
-      config.paths.add 'app/subscribers', eager_load: true
-
       # Register bundled ActionMailer previews so they show up at /rails/mailers
       # without the host app having to copy any files.
       initializer 'spree.mailer_previews' do |app|
@@ -79,14 +66,28 @@ module Spree
       end
 
       initializer 'spree.environment', before: :load_config_initializers do |app|
-        app.config.spree = Environment.new(SpreeCalculators.new, SpreeValidators.new, Spree::Core::Configuration.new, Spree::Core::Dependencies.new)
+        # Spree::Validators, not a Struct: the sets carry register/unregister so
+        # a host can drop a core rule (see Spree.validators.addresses).
+        app.config.spree = Environment.new(SpreeCalculators.new, Spree::Validators.new, Spree::Core::Configuration.new, Spree::Core::Dependencies.new)
+
+        # Registries are seeded before application initializers so extensions
+        # and host apps can append their own entries from initializer files.
+        # Core's defaults are concatenated in after_initialize below.
+        %i[subscribers actor_classes commission_rules delivery_method_rules seller_requirements
+           delivery_rate_providers tax_providers pricing_providers inventory_providers
+           payout_providers digital_asset_providers delivery_profile_types pickup_point_providers].each do |registry|
+          app.config.spree[registry] = []
+        end
+        app.config.spree.line_item_comparison_hooks = Set.new
+        app.config.spree.order_routing = OrderRoutingEnvironment.new([], [])
+        app.config.spree.custom_fields = CustomFieldsEnvironment.new([], [])
+        app.config.spree.promotions = PromoEnvironment.new([])
+        app.config.spree.pricing = PricingEnvironment.new([])
 
-        app.config.active_record.yaml_column_permitted_classes ||= []
-        app.config.active_record.yaml_column_permitted_classes.concat([Symbol, BigDecimal, ActiveSupport::HashWithIndifferentAccess, ActiveSupport::TimeWithZone, ActiveSupport::TimeZone, Time])
         Spree::Config = app.config.spree.preferences
-        Spree::RuntimeConfig = app.config.spree.preferences # for compatibility
         Spree::Dependencies = app.config.spree.dependencies
         Spree::Deprecation = ActiveSupport::Deprecation.new('6.0', 'Spree')
+        app.deprecators[:spree] = Spree::Deprecation
       end
 
       # Runs after initializers so an explicitly assigned preference — which
@@ -107,19 +108,32 @@ module Spree
         app.middleware.use ::I18n::Middleware
       end
 
-      initializer 'spree.register.subscribers', before: :load_config_initializers do |app|
-        # Initialize subscribers array early so engines can add subscribers via initializers
-        app.config.spree.subscribers = []
+      # Spree's translations cover only part of the English keys in most
+      # languages, so the rest fall back to English, the one complete language.
+      # `true` (Rails' generated production.rb) falls back to the app's default
+      # locale only, so English is added after it. An app that configured its
+      # own fallback chain, or turned fallbacks off, keeps its choice.
+      initializer 'spree.i18n.fallbacks', before: :load_config_initializers do |app|
+        fallbacks = app.config.i18n.fallbacks
+        if fallbacks == true
+          app.config.i18n.fallbacks = [app.config.i18n.default_locale || :en, :en].uniq
+        elsif fallbacks.is_a?(ActiveSupport::OrderedOptions) && fallbacks.empty?
+          app.config.i18n.fallbacks = [:en]
+        end
       end
 
-      # Seeded before application initializers so an extension registering an
-      # actor class has something to append to. The defaults are unioned in
-      # after initialization, where Spree.admin_user_class is finally known.
-      initializer 'spree.register.actor_classes', before: :load_config_initializers do |app|
-        app.config.spree.actor_classes = []
-      end
+      # Spree's gems ship translations for dozens of languages. An app that
+      # limits `config.i18n.available_locales` loads only those (and English),
+      # instead of parsing every file at boot and discarding the rest.
+      initializer 'spree.i18n.locale_files', before: :load_config_initializers do |app|
+        allowed = Array(app.config.i18n.available_locales).map(&:to_s)
+        next if allowed.empty?
 
-      initializer 'spree.register.calculators', before: :after_initialize do |app|
+        # A regional file (de-CH) holds only its differences from its base (de).
+        locales = allowed | allowed.map { |locale| locale.split('-').first } | ['en']
+        %w[Spree::Core::Engine Spree::Api::Engine Spree::Emails::Engine].filter_map(&:safe_constantize).each do |engine|
+          engine.config.paths['config/locales'].glob = "{#{locales.join(',')}}.yml"
+        end
       end
 
       # Seeded before application initializers so a host's
@@ -128,13 +142,6 @@ module Spree
         app.config.spree.number_generators = Spree::NumberGenerators::Registry.new
       end
 
-      initializer 'spree.register.stock_splitters', before: :load_config_initializers do |app|
-      end
-
-      initializer 'spree.register.line_item_comparison_hooks', before: :load_config_initializers do |app|
-        app.config.spree.line_item_comparison_hooks = Set.new
-      end
-
       # The one eligibility rule core ships: a per-market return window,
       # bypassed by staff. Registered before application initializers so a
       # store can unregister it in its own initializer.
@@ -143,78 +150,6 @@ module Spree
         Spree.hooks.register('exchanges.create.validate', 'Spree::Returns::EligibilityValidator')
       end
 
-      initializer 'spree.register.payment_methods', after: 'acts_as_list.insert_into_active_record' do |app|
-      end
-
-      initializer 'spree.register.adjustable_adjusters' do |app|
-      end
-
-      # Seed the order routing registries early so engines and apps can append
-      # their own strategies / rule kinds from initializer files. Core's defaults
-      # are concatenated in after_initialize below.
-      initializer 'spree.register.order_routing', before: :load_config_initializers do |app|
-        app.config.spree.order_routing = OrderRoutingEnvironment.new
-        app.config.spree.order_routing.strategies = []
-        app.config.spree.order_routing.rules = []
-      end
-
-      # Seeded early for the same reason as order routing: initializer files
-      # append custom rule kinds. Core defaults concatenate in after_initialize.
-      initializer 'spree.register.commission_rules', before: :load_config_initializers do |app|
-        app.config.spree.commission_rules = []
-      end
-
-      initializer 'spree.register.delivery_method_rules', before: :load_config_initializers do |app|
-        app.config.spree.delivery_method_rules = []
-      end
-
-      # Seeded early like the other kind registries: an initializer file adds
-      # a marketplace's own requirement kinds, core's concatenate after.
-      initializer 'spree.register.seller_requirements', before: :load_config_initializers do |app|
-        app.config.spree.seller_requirements = []
-      end
-
-      initializer 'spree.register.delivery_rate_providers', before: :load_config_initializers do |app|
-        app.config.spree.delivery_rate_providers = []
-      end
-
-      # Same reason again: a tax provider gem, or a host app, registers its
-      # engine from an initializer file. Core's Internal concatenates below.
-      initializer 'spree.register.tax_providers', before: :load_config_initializers do |app|
-        app.config.spree.tax_providers = []
-      end
-
-      # Same reason as the tax providers above: a connector gem registers its
-      # engine from an initializer file, and core's Internal concatenates below.
-      initializer 'spree.register.pricing_providers', before: :load_config_initializers do |app|
-        app.config.spree.pricing_providers = []
-      end
-
-      initializer 'spree.register.inventory_providers', before: :load_config_initializers do |app|
-        app.config.spree.inventory_providers = []
-      end
-
-      # How sellers get paid. A provider gem — the Stripe Connect one, or a
-      # marketplace's own — registers from an initializer file; core's
-      # record-only System concatenates below.
-      initializer 'spree.register.payout_providers', before: :load_config_initializers do |app|
-        app.config.spree.payout_providers = []
-      end
-
-      initializer 'spree.register.digital_asset_providers', before: :load_config_initializers do |app|
-        app.config.spree.digital_asset_providers = []
-      end
-
-      initializer 'spree.register.delivery_profile_types', before: :load_config_initializers do |app|
-        app.config.spree.delivery_profile_types = []
-      end
-
-      initializer 'spree.register.custom_fields' do |app|
-        app.config.spree.custom_fields = CustomFieldsEnvironment.new
-        app.config.spree.custom_fields.types = []
-        app.config.spree.custom_fields.enabled_resources = []
-      end
-
       # Seed the reporting vocabulary before app initializers so applications
       # and extensions can register their own metrics/dimensions in
       # config/initializers (see docs/plans/6.0-analytics-semantic-layer.md).
@@ -223,29 +158,13 @@ module Spree
         Spree::Reporting::DefaultVocabulary.install(app.config.spree.reporting)
       end
 
-      # We need to define promotions rules here so extensions and existing apps
-      # can add their custom classes on their initializer files
-      initializer 'spree.promo.environment' do |app|
-        app.config.spree.promotions = PromoEnvironment.new
-        app.config.spree.promotions.rules = []
-      end
-
-      initializer 'spree.promo.register.promotion.calculators' do |app|
-      end
-
-      # Pricing configuration for price lists and price rules
-      initializer 'spree.pricing.environment', after: 'spree.environment' do |app|
-        app.config.spree.pricing = PricingEnvironment.new
-        app.config.spree.pricing.rules = []
-      end
-
       # Country and subdivision names are translated by the countries gem, which
       # only loads the locales it is told about. This runs after initialization
       # because Spree.available_locales reads i18n configuration that is not
       # populated while initializers are still running.
       config.after_initialize do
         ISO3166.configure do |iso_config|
-          iso_config.locales = (Spree.available_locales.map { |locale| locale.to_s.downcase } << 'en').uniq
+          iso_config.locales = (Spree.configured_locales.map { |locale| locale.to_s.downcase } << 'en').uniq
         end
 
         Spree::IsoData.reset!
@@ -293,7 +212,6 @@ module Spree
           Spree::Collection
         ]
 
-
         # The fallback engine when a market names none (see docs/plans/6.0-tax-provider.md).
         # Assigned only if an initializer file has not already named one — an app
         # that picks its own default must keep it.
@@ -355,7 +273,6 @@ module Spree
           'deutsche_post' => { name: 'Deutsche Post DHL', url: 'https://www.dhl.de/de/privatkunden/pakete-empfangen/verfolgen.html?piececode=:tracking' }
         }
 
-
         # Quoting strategies selectable on a delivery method. Internal prices
         # through the method's calculator; carrier gems append theirs.
         Rails.application.config.spree.delivery_rate_providers.concat [
@@ -603,33 +520,6 @@ module Spree
           Spree.customer_class
         ]
 
-        Rails.application.config.spree.analytics_events = {
-          product_viewed: 'Product Viewed',
-          product_list_viewed: 'Product List Viewed',
-          product_searched: 'Product Searched',
-          product_added: 'Product Added',
-          product_removed: 'Product Removed',
-
-          product_added_to_wishlist: 'Product Added to Wishlist',
-          product_removed_from_wishlist: 'Product Removed from Wishlist',
-
-          subscribed_to_newsletter: 'Subscribed to Newsletter',
-          unsubscribed_from_newsletter: 'Unsubscribed from Newsletter',
-
-          payment_info_entered: 'Payment Info Entered',
-          coupon_entered: 'Coupon Entered',
-          coupon_removed: 'Coupon Removed',
-          coupon_applied: 'Coupon Applied',
-          coupon_denied: 'Coupon Denied',
-
-          checkout_started: 'Checkout Started',
-          checkout_email_entered: 'Checkout Email Entered',
-          checkout_step_viewed: 'Checkout Step Viewed',
-          checkout_step_completed: 'Checkout Step Completed',
-          order_completed: 'Order Completed',
-        }
-        Rails.application.config.spree.analytics_event_handlers = []
-
         Rails.application.config.spree.integrations = []
 
         Rails.application.config.spree.validators.addresses = [
@@ -648,6 +538,7 @@ module Spree
           Spree::SellerTransferSubscriber,
           Spree::SellerTransferReversalSubscriber,
           Spree::ExportSubscriber,
+          Spree::ImportEmailSubscriber,
           Spree::InvitationEmailSubscriber,
           Spree::SellerOnboardingSubscriber,
           Spree::AdminUserEmailSubscriber,
@@ -668,7 +559,23 @@ module Spree
         )
       end
 
-      initializer 'spree.promo.register.promotions.actions' do |app|
+      # Deprecated constant aliases warn when their file loads. Leaving them
+      # out of eager loading keeps every boot quiet; they still load, and
+      # warn, the first time something references the old name.
+      DEPRECATED_ALIAS_FILES = %w[
+        app/models/concerns/spree/user_methods.rb
+        app/models/spree/asset.rb
+        app/models/spree/classification.rb
+        app/models/spree/promotion/rules/taxon.rb
+        app/models/spree/promotion_rule_taxon.rb
+        app/models/spree/return_authorization_reason.rb
+        app/models/spree/taxon.rb
+        app/services/spree/checkout/add_store_credit.rb
+        app/services/spree/checkout/remove_store_credit.rb
+      ].freeze
+
+      initializer 'spree.deprecated_aliases.skip_eager_load' do
+        Rails.autoloaders.main.do_not_eager_load(*DEPRECATED_ALIAS_FILES.map { |path| root.join(path) })
       end
 
       # filter sensitive information during logging
@@ -684,6 +591,13 @@ module Spree
         ]
       end
 
+      # Records which store owns every uploaded file, and reports attaching a
+      # file to another store's record (docs/plans/6.0-uploads-and-file-ownership.md).
+      initializer 'spree.active_storage.store_ownership' do
+        ActiveSupport.on_load(:active_storage_blob) { include Spree::Uploads::BlobStoreOwnership }
+        ActiveSupport.on_load(:active_storage_attachment) { include Spree::Uploads::AttachmentStoreCheck }
+      end
+
       initializer 'spree.core.checking_migrations' do |app|
         app.config.after_initialize do
           Migrations.new(config, engine_name).check unless Rails.env.test? || Spree::Config.disable_migration_check
@@ -711,17 +625,10 @@ module Spree
       end
 
       config.to_prepare do
-        # Ensure spree locale paths are present before decorators
-        I18n.load_path.unshift(*(Dir.glob(
-          File.join(
-            File.dirname(__FILE__), '../../../config/locales', '*.{rb,yml}'
-          )
-        ) - I18n.load_path))
-
-        # Load application's model / class decorators
-        Dir.glob(File.join(File.dirname(__FILE__), '../../../app/**/*_decorator*.rb')) do |c|
-          Rails.configuration.cache_classes ? require(c) : load(c)
-        end
+        I18n.load_path.unshift(*(Spree::Core::Engine.config.paths['config/locales'].existent - I18n.load_path))
+
+        ActsAsTaggableOn::Tag.include(Spree::RansackableAttributes)
+        ActsAsTaggableOn::Tag.whitelisted_ransackable_attributes = %w[id name]
 
         # Reset and re-activate event subscribers on code reload
         # activate! will register all subscribers from Spree.subscribers

data/lib/spree/core/permissions/default_catalog.rb

@@ -194,6 +194,11 @@ module Spree
         catalog.register_scope(:webhooks, group: :settings, resources: -> {
           [Spree::WebhookEndpoint, Spree::WebhookDelivery]
         })
+        # Separate from settings: a template writes what every customer receives,
+        # links included, so managing store settings does not grant it.
+        catalog.register_scope(:email_templates, group: :settings, resources: -> {
+          [Spree::EmailTemplate, Spree::EmailTemplateDraft, Spree::EmailTemplateRevision]
+        })
         catalog.register_scope(:integrations, group: :settings, resources: -> { [Spree::Integration] })
 
         catalog.register_scope(:api_keys, group: :access, resources: -> { [Spree::ApiKey] })

data/lib/spree/core/preferences/invalid_preferences.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Preferences
+    # Raised when a `preferences` payload does not match the schema its type
+    # declares. Each failure names the value by a JSON pointer into the
+    # payload, so a client can show it next to the field it belongs to.
+    class InvalidPreferences < StandardError
+      # @return [Array<Hash{Symbol => String}>] `{ pointer:, message: }` per failure
+      attr_reader :failures
+
+      # @param failures [Array<Hash{Symbol => String}>] pointers relative to the preferences object
+      # @param prefix [String] where the preferences object sits in the request
+      def initialize(failures, prefix: '/preferences')
+        @failures = failures.map { |failure| failure.merge(pointer: "#{prefix}#{failure[:pointer]}") }
+        super(@failures.map { |failure| "#{failure[:pointer]}: #{failure[:message]}" }.join('; '))
+      end
+    end
+  end
+end

data/lib/spree/core/preferences/json_conversion.rb

@@ -0,0 +1,186 @@
+
+module Spree
+  module Preferences
+    # Converts preferences stored as YAML to JSON, for the 6.0 migration and the
+    # `spree:upgrade:preferences_json` safety net.
+    #
+    # Rows are read and written through the connection, never through models:
+    # a model would load the column through whichever coder the current code
+    # declares, which is the thing being converted. The only thing asked of a
+    # model class is which of its preferences are secrets, from its
+    # declarations alone.
+    class JsonConversion
+      PERMITTED_CLASSES = [
+        Symbol, BigDecimal, Date, Time,
+        ActiveSupport::TimeWithZone, ActiveSupport::TimeZone, ActiveSupport::HashWithIndifferentAccess
+      ].freeze
+
+      class UnreadableRowError < StandardError; end
+
+      # Whether a row's class keeps a tier ladder, which moves from a hash keyed
+      # by threshold to a list, because a JSON object key is always a string.
+      #
+      # @param model [Class, nil] the class the row's `type` names
+      # @return [Boolean]
+      def self.tiered_calculator?(model)
+        model.is_a?(Class) && model.include?(Spree::Calculator::Tiers)
+      end
+
+      # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter]
+      # @param log [#call, nil] receives a line for each row left as it was
+      def initialize(connection, log: nil)
+        @connection = connection
+        @log = log || ->(_message) {}
+        @models = Hash.new { |models, type| models[type] = type.presence&.safe_constantize }
+      end
+
+      # Resolves a row's `type`, once per type for the life of the conversion.
+      #
+      # @param type [String, nil]
+      # @return [Class, nil]
+      def model_for(type)
+        @models[type]
+      end
+
+      # @param table [String]
+      # @param id [Object] the row's primary key
+      # @param assignments [Hash{String => String}] column names and the values to write
+      def write(table, id, assignments)
+        arel_table = Arel::Table.new(table)
+        update = Arel::UpdateManager.new(arel_table).
+                 set(assignments.map { |column, value| [arel_table[column], value] }).
+                 where(arel_table[:id].eq(id))
+        connection.update(update)
+      end
+
+      # Tables with a `preferences` column that a model storing Spree
+      # preferences reads — Spree's, an extension's, or the application's own.
+      # A table another library owns is left alone.
+      #
+      # @return [Array<String>]
+      def preference_tables
+        Rails.application.eager_load! if defined?(Rails.application) && Rails.application
+        # An anonymous class (a spec's throwaway model) has no name to derive a
+        # table from, and asking raises, so it is skipped.
+        owned = ActiveRecord::Base.descendants.filter_map do |model|
+          next if model.name.nil? || model.abstract_class? || !model.include?(Spree::Preferences::Preferable)
+
+          model.table_name
+        end
+
+        connection.tables.select { |table| owned.include?(table) && connection.column_exists?(table, :preferences) }.sort
+      end
+
+      # Whether the table's `preferences` column is still `text` and needs a
+      # JSON column in its place.
+      #
+      # @param table [String]
+      # @return [Boolean]
+      def text_column?(table)
+        connection.columns(table).find { |column| column.name == 'preferences' }&.type == :text
+      end
+
+      # Replaces a `text` preferences column with a JSON one (`jsonb` where the
+      # adapter has it), converting every row on the way.
+      #
+      # @param table [String]
+      # @return [Integer] the number of rows written
+      def convert_text_table(table)
+        type = connection.native_database_types.key?(:jsonb) ? :jsonb : :json
+        # Left behind by an earlier run that stopped on an unreadable row, on a
+        # database that cannot roll back schema changes.
+        connection.add_column(table, :preferences_json, type) unless connection.column_exists?(table, :preferences_json)
+        converted = convert_table(table, target: 'preferences_json')
+        connection.remove_column(table, :preferences)
+        connection.rename_column(table, :preferences_json, :preferences)
+        converted
+      end
+
+      # Converts every row of `table` whose `source` column holds YAML (as text,
+      # or wrapped in a JSON string) and writes the JSON to `target`. Secrets
+      # move to `secret_preferences` when the table has that column, and tier
+      # ladders change shape.
+      #
+      # @param table [String]
+      # @param source [String] the column to read
+      # @param target [String] the column to write, the same one for an in-place conversion
+      # @return [Integer] the number of rows written
+      def convert_table(table, source: 'preferences', target: 'preferences')
+        typed = connection.column_exists?(table, :type)
+        secrets_column = connection.column_exists?(table, :secret_preferences)
+        rows = rows_with(table, source, ['id', source, ('type' if typed)].compact)
+
+        rows.count do |row|
+          preferences, already_json = read(row[source], table, row['id'])
+          type = row['type'] if typed
+          # A tiered calculator whose class was not loaded when the migration
+          # ran keeps its hash, so a JSON row is still reshaped when it has one.
+          reshaped = reshape_tiers(preferences, model_for(type))
+          next false if already_json && source == target && !reshaped
+
+          secrets = secrets_column ? extract_secrets(preferences, type, table, row['id']) : {}
+
+          assignments = { target => JSON.generate(preferences) }
+          assignments['secret_preferences'] = JSON.generate(secrets) if secrets.any?
+          write(table, row['id'], assignments)
+          true
+        end
+      end
+
+      private
+
+      attr_reader :connection, :log
+
+      # @return [Array(Hash, Boolean)] the preferences, and whether they were already JSON
+      def read(raw, table, id)
+        decoded = raw.is_a?(String) ? decode_json(raw) : raw
+        return [decoded.to_h, true] if decoded.is_a?(Hash)
+
+        yaml = decoded.is_a?(String) ? decoded : raw
+        value = parse_yaml(yaml, table, id) || {}
+        raise UnreadableRowError, "#{table} row #{id}: preferences are not a hash" unless value.is_a?(Hash)
+
+        [value.as_json, false]
+      end
+
+      def decode_json(raw)
+        JSON.parse(raw)
+      rescue JSON::ParserError
+        nil
+      end
+
+      def parse_yaml(text, table, id)
+        YAML.safe_load(text.to_s, permitted_classes: PERMITTED_CLASSES, aliases: true)
+      rescue Psych::Exception => e
+        raise UnreadableRowError, "#{table} row #{id}: #{e.message}. Fix or clear this row, then run the migration again."
+      end
+
+      def reshape_tiers(preferences, model)
+        tiers = preferences['tiers']
+        return unless tiers.is_a?(Hash) && self.class.tiered_calculator?(model)
+
+        preferences['tiers'] = tiers.map { |threshold, value| { 'threshold' => threshold.to_s, 'value' => value.to_s } }.
+                               sort_by { |tier| Spree::Calculator::Tiers.decimal(tier['threshold']) || 0 }
+      end
+
+      def extract_secrets(preferences, type, table, id)
+        model = model_for(type)
+        unless model.respond_to?(:secret_preference_names)
+          log.call("#{table} row #{id}: class #{type.inspect} is not loaded, so its secrets stay in preferences until it is")
+          return {}
+        end
+
+        names = model.secret_preference_names.map(&:to_s)
+        secrets = preferences.slice(*names)
+        names.each { |name| preferences.delete(name) }
+        secrets
+      end
+
+      # The given columns of every row whose `present` column is not NULL.
+      def rows_with(table, present, columns)
+        arel_table = Arel::Table.new(table)
+        connection.select_all(arel_table.project(*columns.map { |column| arel_table[column] }).where(arel_table[present].not_eq(nil)))
+      end
+    end
+  end
+end