spree_core 6.0.0.rc1 → 6.0.0.rc2

data/app/models/spree/store.rb

@@ -41,11 +41,13 @@ module Spree
     #
     # Preferences
     #
+    UNIT_SYSTEMS = %w[metric imperial].freeze
+
     # general preferences
-    preference :admin_locale, :string
-    preference :timezone, :string, default: Time.zone.name
-    preference :weight_unit, :string, default: 'lb'
-    preference :unit_system, :string, default: 'imperial'
+    preference :admin_locale, :string, format: :locale
+    preference :timezone, :string, format: :timezone, default: Time.zone.name
+    preference :weight_unit, :string, default: 'lb', choices: -> { Spree::Variant::WEIGHT_UNITS }
+    preference :unit_system, :string, default: 'imperial', choices: -> { UNIT_SYSTEMS }
     # Anonymous identifier of this installation, kept on the default store
     # (see Spree.install_id). Written by Spree, never by the operator.
     preference :install_id, :string, internal: true, nullable: true
@@ -83,22 +85,22 @@ module Spree
     # How often sellers are settled, unless one carries its own schedule.
     # Monthly by default because it is the interval that needs least of an
     # operator paying by hand, which is what the built-in provider expects.
-    preference :default_payouts_schedule_interval, :string, default: 'monthly'
+    preference :default_payouts_schedule_interval, :string, default: 'monthly', choices: -> { Spree::Seller::PAYOUT_INTERVALS }
     validates :preferred_default_payouts_schedule_interval,
               inclusion: { in: Spree::Seller::PAYOUT_INTERVALS }, allow_blank: true
     # What a seller's balance must reach before a settlement is worth sending;
     # below it the balance carries to the next period. Zero pays whatever is
     # owed, which is right for a provider that moves money for free.
-    preference :default_minimum_payout_amount, :decimal, default: 0
+    preference :default_minimum_payout_amount, :money, default: 0
     # Checkout preferences
     # Store-level fallback for the channel-owned `guest_checkout` preference
     # (see Spree::Channel::Gating). Retained so existing accessors keep working.
     preference :guest_checkout, :boolean, default: true
     # Store-level fallback for the channel-owned `storefront_access` posture.
-    preference :storefront_access, :string, default: 'public'
+    preference :storefront_access, :string, default: 'public', choices: -> { Spree::Channel::Gating::STOREFRONT_ACCESS }
     # Canonical storefront origin used in customer-facing emails and links,
     # e.g. "https://myshop.com" — see #storefront_url for the fallback chain.
-    preference :storefront_url, :string
+    preference :storefront_url, :string, format: :url
     preference :special_instructions_enabled, :boolean, default: false
     # Advertises a confirm/review step for every checkout, even when no
     # payment method asks for one. Payment methods that require confirmation
@@ -108,7 +110,8 @@ module Spree
     # Store-wide default for when a customer is charged rather than only
     # authorized. A payment method's own capture_method wins when set.
     # See Spree::CaptureMethod.
-    preference :capture_method, :string, default: Spree::CaptureMethod::DEFAULT_CAPTURE_METHOD
+    preference :capture_method, :string, default: Spree::CaptureMethod::DEFAULT_CAPTURE_METHOD,
+                                       choices: -> { Spree::CaptureMethod::CAPTURE_METHODS }
     preference :stock_reservations_enabled, :boolean, default: true
     # Which address a sale's tax is computed against. Stores selling where tax
     # follows the destination keep this on; billing-address jurisdictions turn
@@ -120,9 +123,9 @@ module Spree
     preference :inventory_provider, :string, default: 'internal'
     # What happens when an external source cannot be reached.
     preference :pricing_provider_failure_policy, :string,
-               default: Spree::ProviderFailurePolicy::DEFAULT_PRICING_POLICY
+               default: Spree::ProviderFailurePolicy::DEFAULT_PRICING_POLICY, choices: -> { Spree::ProviderFailurePolicy::VALUES }
     preference :inventory_provider_failure_policy, :string,
-               default: Spree::ProviderFailurePolicy::DEFAULT_INVENTORY_POLICY
+               default: Spree::ProviderFailurePolicy::DEFAULT_INVENTORY_POLICY, choices: -> { Spree::ProviderFailurePolicy::VALUES }
     # Catalog preferences
     preference :track_inventory_levels, :boolean, default: true
     # On-hand quantity at or below which a tracked variant counts as running
@@ -163,11 +166,27 @@ module Spree
     # applies to every numbered document; prefix, suffix and starting value
     # are order-only — other document types keep their code-level prefixes.
     # Changes affect future numbers only; existing numbers are permanent.
-    preference :document_number_format, :string, default: 'sequential'
+    preference :document_number_format, :string, default: 'sequential', choices: -> { Spree::NumberGenerators::Registry::FORMATS.keys }
     preference :order_number_prefix, :string, default: 'R'
     preference :order_number_suffix, :string, default: ''
     preference :order_number_sequence_start, :integer, default: 1001
 
+    # The settings the API reads and writes under their plain names.
+    exposes_preferences :admin_locale, :timezone, :storefront_url, :weight_unit, :unit_system, :storefront_access, :guest_checkout,
+                        :always_include_confirm_step, :company_field_enabled, :address_requires_company,
+                        :address_requires_phone, :capture_method, :track_inventory_levels, :stock_reservations_enabled,
+                        :low_stock_threshold, :tax_using_ship_address, :track_price_history,
+                        :show_products_without_price, :disable_sku_validation, :order_routing_strategy,
+                        :pricing_provider, :inventory_provider, :pricing_provider_failure_policy,
+                        :inventory_provider_failure_policy, :payout_provider, :default_payouts_schedule_interval,
+                        :default_minimum_payout_amount, :auto_approve_sellers, :auto_approve_seller_products,
+                        :send_seller_transactional_emails, :default_commission_tax_rate, :document_number_format,
+                        :order_number_prefix, :order_number_suffix, :order_number_sequence_start,
+                        :limit_digital_download_count, :digital_asset_authorized_clicks,
+                        :limit_digital_download_days, :digital_asset_authorized_days,
+                        :send_consumer_transactional_emails, :email_accent_color, :email_background_color,
+                        :email_card_color, :email_text_color, :email_heading_color, :email_font
+
     #
     # Associations
     #
@@ -343,6 +362,10 @@ module Spree
     validates :preferred_default_commission_tax_rate,
               numericality: { greater_than_or_equal_to: 0, less_than_or_equal_to: 1 }
     validates :preferred_storefront_access, inclusion: { in: Spree::Channel::Gating::STOREFRONT_ACCESS }
+    # Blank falls back to the defaults where they are read, so a store saved
+    # with one before these checks existed stays savable.
+    validates :preferred_unit_system, inclusion: { in: UNIT_SYSTEMS }, allow_blank: true
+    validates :preferred_weight_unit, inclusion: { in: Spree::Variant::WEIGHT_UNITS }, allow_blank: true
     validates :preferred_document_number_format,
               inclusion: { in: Spree::NumberGenerators::Registry::FORMATS.keys }
     validates :preferred_order_number_sequence_start,
@@ -370,6 +393,7 @@ module Spree
     #
     has_one_attached :logo, service: Spree.public_storage_service_name
     has_one_attached :mailer_logo, service: Spree.public_storage_service_name
+    signed_id_attachments :logo, :mailer_logo
 
     # First-run setup credential (docs/plans/6.0-store-context-and-first-run-setup.md):
     # printed by the installer, only consulted by the setup endpoint while no
@@ -528,6 +552,7 @@ module Spree
     end
 
     # Returns the storefront origin URL for use in customer-facing emails and links.
+    # Replaces the plain `storefront_url` reader `exposes_preferences` defines.
     # Uses the `storefront_url` preference when set, then the oldest non-loopback
     # allowed origin (the `http://localhost` origin seeded on install must never
     # leak into customer emails), otherwise falls back to formatted_url.

data/app/models/spree/store_credit.rb

@@ -5,6 +5,9 @@ module Spree
     include Spree::SingleStoreResource
     include Spree::HasCustomFields
     include Spree::Metadata
+    include Spree::CanonicalDecimals
+
+    canonical_decimals :amount
 
     publishes_lifecycle_events
 
@@ -105,13 +108,11 @@ module Spree
     extend Spree::DisplayMoney
     money_methods :amount, :amount_used, :amount_remaining, :amount_authorized
 
-    def amount=(amount)
-      self[:amount] = Spree::LocalizedNumber.parse(amount)
-    end
-
     self.whitelisted_ransackable_attributes = %w[customer_id created_by_id amount currency memo]
+    search_by :memo
     self.whitelisted_ransackable_associations = %w[customer created_by]
     self.whitelisted_ransackable_scopes = %w[outstanding from_gift_card]
+    self.ransackable_scope_types = %w[outstanding from_gift_card].index_with('boolean')
     # Staff notes and who issued the credit are back-office data.
     self.private_ransackable_attributes = { store: %w[memo created_by_id] }
 

data/app/models/spree/supplier.rb

@@ -32,6 +32,7 @@ module Spree
     normalizes :name, :contact_name, :phone, with: ->(value) { value.strip }
 
     self.whitelisted_ransackable_attributes = %w[name contact_name email phone city country_code created_at]
+    search_by :name, :contact_name, :email
 
     # The postal address, built from this row's own columns the way
     # {Spree::StockLocation#address} does. Unsaved, and blank when nothing has

data/app/models/spree/tax_category.rb

@@ -16,6 +16,7 @@ module Spree
     before_save :set_default_category
 
     self.whitelisted_ransackable_attributes = %w[name is_default tax_code]
+    search_by :name
 
     # The category applied to taxable records that carry none of their own.
     #

data/app/models/spree/tax_exemption_certificate.rb

@@ -27,6 +27,7 @@ module Spree
     # Confidential, so the private service rather than the public one that
     # serves product images.
     has_one_attached :document, service: Spree.private_storage_service_name
+    signed_id_attachments :document
 
     validates :certificate_number, :reason_code, presence: true
     # Certificates exist only on legal-entity nodes — a division's purchases

data/app/models/spree/tax_provider/internal.rb

@@ -136,7 +136,7 @@ module Spree
             write_tax_line(owner, item, rate, 0, 'customer_exempt', jurisdiction,
                            data: exemption_data(exemption, exemption_subject))
           else
-            write_tax_line(owner, item, rate, compute_tax(rate, item, relevant_rates),
+            write_tax_line(owner, item, rate, compute_tax(rate, item, relevant_rates, owner.currency),
                            reason_for(rate), jurisdiction)
           end
         end
@@ -169,16 +169,19 @@ module Spree
         item.respond_to?(:taxable_basis) ? item.taxable_basis : item.amount
       end
 
-      def compute_tax(rate, item, relevant_rates)
+      # Rounded per line, half up, to the order's currency — the internal
+      # provider's choice; other providers round as their jurisdictions require.
+      def compute_tax(rate, item, relevant_rates, currency)
         basis = taxable_basis(item)
 
-        if rate.included_in_price
-          included_sum = relevant_rates.select(&:included_in_price).sum(&:amount)
-          included_sum = rate.amount if included_sum.zero?
-          (basis / (1 + included_sum) * rate.amount).round(2)
-        else
-          (basis * rate.amount).round(2)
-        end
+        tax = if rate.included_in_price
+                included_sum = relevant_rates.select(&:included_in_price).sum(&:amount)
+                included_sum = rate.amount if included_sum.zero?
+                basis / (1 + included_sum) * rate.amount
+              else
+                basis * rate.amount
+              end
+        Spree::Money::Rounding.to_currency(tax, currency)
       end
 
       # Pre-tax amounts are stored so refund and reporting code can weigh

data/app/models/spree/tax_rate.rb

@@ -15,6 +15,10 @@ module Spree
     include Spree::HasCustomFields
     include Spree::Metadata
     include Spree::SingleStoreResource
+    include Spree::CanonicalDecimals
+
+    # A fraction (0.07125), held to the column's five decimals.
+    canonical_decimals :amount, places: 5
 
     with_options inverse_of: :tax_rates do
       belongs_to :tax_category,
@@ -56,17 +60,36 @@ module Spree
           ->(category) { where(tax_category_id: category.try(:id)) }
     scope :included_in_price, -> { where(included_in_price: true) }
 
-    self.whitelisted_ransackable_attributes = %w[amount country_code state_code tax_category_id included_in_price name]
+    self.whitelisted_ransackable_attributes = %w[amount rate country_code state_code tax_category_id included_in_price name]
+    ransack_alias :rate, :amount
+    search_by :name
 
-    # Virtual attribute for percentage display in admin forms
-    def amount_percentage
-      return nil if amount.nil?
+    # The rate as a fraction (0.23); the column is +amount+.
+    alias_attribute :rate, :amount
+
+    # The rate as a percentage (23), what a merchant types.
+    #
+    # @return [BigDecimal, nil]
+    def rate_percent
+      amount && amount * 100
+    end
+
+    # @param value [String, Numeric, nil]
+    def rate_percent=(value)
+      parsed = Spree::Money::Rounding.parse_decimal(value)
+      self.amount = parsed && parsed / 100
+    end
 
-      (amount * 100).round(2)
+    # @deprecated Use {#rate_percent}; removed in 6.1.
+    def amount_percentage
+      Spree::Deprecation.warn('Spree::TaxRate#amount_percentage is deprecated and will be removed in Spree 6.1. Use #rate_percent instead.')
+      rate_percent
     end
 
+    # @deprecated Use {#rate_percent=}; removed in 6.1.
     def amount_percentage=(value)
-      self.amount = value.present? ? (value.to_f / 100) : nil
+      Spree::Deprecation.warn('Spree::TaxRate#amount_percentage= is deprecated and will be removed in Spree 6.1. Use #rate_percent= instead.')
+      self.rate_percent = value
     end
 
     # The included-in-price rate to back out of a gross price.

data/app/models/spree/taxon.rb

@@ -10,7 +10,7 @@ module Spree
   # prefix (ctg), and model_name are all Spree::Category. Only the constant differs,
   # so is_a?, STI, polymorphic *_type strings, and class_name: references keep
   # resolving to Spree::Category. The warning below fires through Spree's deprecator
-  # when this file loads (at boot under eager load, on first reference otherwise).
+  # when this file loads (on first reference; it is kept out of eager loading).
   Taxon = Category
 
   Spree::Deprecation.warn('Spree::Taxon is deprecated and will be removed in Spree 6.1. Use Spree::Category instead.')

data/app/models/spree/update_status.rb

@@ -0,0 +1,25 @@
+module Spree
+  # What {Spree::UpdateCheck} last learned about newer releases. Never
+  # persisted.
+  class UpdateStatus
+    include ActiveModel::Model
+    include ActiveModel::Attributes
+
+    attribute :current_version, :string
+    attribute :enabled, :boolean, default: true
+    # Nil until the first check has finished.
+    attribute :checked_at, :datetime
+    # Newer releases, newest first: hashes with +version+, +url+ and +published_at+.
+    attribute :releases, default: -> { [] }
+
+    # @return [Hash, nil]
+    def latest_release
+      releases.first
+    end
+
+    # @return [Boolean]
+    def update_available?
+      latest_release.present?
+    end
+  end
+end

data/app/models/spree/variant.rb

@@ -8,6 +8,7 @@ module Spree
     include Spree::MemoizedData
     include Spree::HasCustomFields
     include Spree::Metadata
+    include Spree::CanonicalDecimals
     include Spree::HasExternalReferences
     include Spree::Searchable
     include Spree::StorePreferences
@@ -289,14 +290,9 @@ module Spree
       relation.where(conditions.reduce(:or)).distinct
     end
 
-    # FIXME: cost price should be represented with DisplayMoney class
-    LOCALIZED_NUMBERS = %w(cost_price weight depth width height)
-
-    LOCALIZED_NUMBERS.each do |m|
-      define_method("#{m}=") do |argument|
-        self[m] = Spree::LocalizedNumber.parse(argument) if argument.present?
-      end
-    end
+    # A blank value leaves these as they were rather than clearing them.
+    canonical_decimals :cost_price, places: Spree::Money::Rounding::UNIT_PRICE_DECIMALS, ignore_blank: true
+    canonical_decimals :weight, :depth, :width, :height, places: nil, ignore_blank: true
 
     accepts_nested_attributes_for(
       :stock_levels,
@@ -331,6 +327,7 @@ module Spree
                                                  carton_package_type_id carton_weight cartons_per_pallet]
     self.whitelisted_ransackable_scopes = %i(product_name_or_sku_cont search_by_product_name_or_sku search
                                              available_at_stock_location)
+    self.ransackable_scope_types = { 'available_at_stock_location' => 'id' }
     self.private_ransackable_attributes = { store: %w[cost_price cost_currency deleted_at] }
 
     def self.product_name_or_sku_cont(query)
@@ -666,7 +663,7 @@ module Spree
     def price_in(currency)
       currency = currency&.upcase
 
-      price = if prices.loaded? && prices.any?
+      price = if read_association_in_memory?(:prices) && prices.any?
                 prices.detect { |p| p.currency == currency && p.price_list_id.nil? }
               else
                 prices.base_prices.find_by(currency: currency)

data/app/models/spree/webhook_delivery.rb

@@ -25,6 +25,7 @@ module Spree
 
     # Ransack configuration
     self.whitelisted_ransackable_attributes = %w[event_name response_code execution_time success delivered_at created_at]
+    search_by :event_name
 
     # Event subjects whose permission is not found by class name alone.
     PAYLOAD_SUBJECT_CLASSES = {

data/app/models/spree/webhook_endpoint.rb

@@ -30,11 +30,45 @@ module Spree
     before_save :clear_disabled_state_when_reactivated
 
     self.whitelisted_ransackable_attributes = %w[name url active]
+    search_by :url
 
     scope :active, -> { where(active: true) }
     scope :inactive, -> { where(active: false) }
     scope :enabled, -> { active.where(disabled_at: nil) }
 
+    # Whether +url+ targets a host the operator trusts despite it resolving to
+    # a private address — e.g. a storefront Service in the same Kubernetes
+    # cluster. Set via +Spree::Api::Config.webhooks_allowed_internal_hosts+
+    # (SPREE_WEBHOOKS_ALLOWED_INTERNAL_HOSTS): an entry matches that exact
+    # host, or with a leading dot (".svc.cluster.local") any host under it.
+    # Matching is case-insensitive. Operator config only, so a store admin
+    # can never point a webhook at an internal address.
+    #
+    # @param url [String]
+    # @return [Boolean]
+    def self.allowed_internal_host?(url)
+      host = URI.parse(url.to_s).hostname&.downcase
+      return false if host.blank?
+
+      allowed_internal_hosts.any? do |entry|
+        entry.start_with?('.') ? host.end_with?(entry) : host == entry
+      end
+    rescue URI::InvalidURIError
+      false
+    end
+
+    # Spree::Api::Config only exists when spree_api is loaded; without it no
+    # webhook is ever delivered, so there is nothing to allow.
+    def self.allowed_internal_hosts
+      return [] unless defined?(Spree::Api::Config)
+
+      Array(Spree::Api::Config.webhooks_allowed_internal_hosts).filter_map do |entry|
+        entry = entry.to_s.strip.downcase
+        entry if entry.present? && entry != '.'
+      end
+    end
+    private_class_method :allowed_internal_hosts
+
     # Returns the plaintext `secret_key` only on the create response.
     #
     # `@reveal_secret_in_response` is set by the `after_create` callback above
@@ -165,6 +199,8 @@ module Spree
     end
 
     def url_must_not_resolve_to_private_ip
+      return if self.class.allowed_internal_host?(url)
+
       uri = URI.parse(url)
       blacklist = SsrfFilter::IPV4_BLACKLIST + SsrfFilter::IPV6_BLACKLIST
       addresses = Resolv.getaddresses(uri.host)

data/app/presenters/spree/csv/order_line_item_presenter.rb

@@ -96,16 +96,16 @@ module Spree
           index.zero? ? order.email : nil,
           index.zero? ? order.status : nil,
           index.zero? ? order.currency : nil,
-          index.zero? ? order.item_total.to_f : nil,
-          index.zero? ? order.delivery_total.to_f : nil,
-          index.zero? ? order.tax_total.to_f : nil,
+          index.zero? ? money(order.item_total) : nil,
+          index.zero? ? money(order.delivery_total) : nil,
+          index.zero? ? money(order.tax_total) : nil,
           index.zero? ? order.included_tax_total.positive? : nil,
           index.zero? ? (order.discount_total.negative? || line_item.discount_total.negative?) : nil,
           index.zero? ? order.has_free_shipping? : nil,
-          index.zero? ? order.discount_total.abs : nil,
+          index.zero? ? money(order.discount_total.abs) : nil,
           index.zero? ? order.promo_code : nil,
-          index.zero? ? order.payments.store_credits.sum(:amount).abs : nil,
-          index.zero? ? order.total.to_f : nil,
+          index.zero? ? money(order.payments.store_credits.sum(:amount).abs) : nil,
+          index.zero? ? money(order.total) : nil,
           index.zero? ? order.delivery_method&.name : nil,
           index.zero? ? order.total_weight.to_f : nil,
           index.zero? ? order.payments.valid&.first&.display_source_name : nil,
@@ -160,6 +160,10 @@ module Spree
 
       private
 
+      def money(amount)
+        Spree::Money::Rounding.format(amount, order.currency)
+      end
+
       # Drops the cells whose headers were omitted, matching each value to its
       # header by position so the row and the header list stay aligned.
       def reject_omitted(csv)

data/app/presenters/spree/csv/price_list_price_presenter.rb

@@ -26,15 +26,10 @@ module Spree
 
       private
 
-      # The currency's own precision, a dot for the decimal mark and nothing
-      # else — "18.00", never "$18.00", "18.0" or "18,00". Fixed rather than
-      # localized because the file is read back by the import under the
-      # store's locale, not the exporting admin's, and a comma written here
-      # would re-import as a hundred times the price.
+      # A plain decimal ("18.00", never "$18.00" or "18,00"): the import reads
+      # the file back and accepts nothing else.
       def amount_string(amount)
-        return nil if amount.nil?
-
-        format("%.#{Spree::Money::Rounding.precision(price.currency)}f", amount)
+        Spree::Money::Rounding.format(amount, price.currency, unit_price: true)
       end
     end
   end

data/app/presenters/spree/csv/product_variant_presenter.rb

@@ -98,17 +98,17 @@ module Spree
           index.zero? ? product.meta_keywords : nil,
           index.zero? ? product.tag_list.to_s : nil,
           index.zero? ? product.label_list.to_s : nil,
-          variant.amount_in(currency).to_f,
-          variant.compare_at_amount_in(currency).to_f,
+          unit_price(variant.amount_in(currency) || 0),
+          unit_price(variant.compare_at_amount_in(currency) || 0),
           currency,
-          variant.width,
-          variant.height,
-          variant.depth,
+          decimal(variant.width),
+          decimal(variant.height),
+          decimal(variant.depth),
           # The stored columns, not the resolved readers: importing this file
           # into a store on another unit system must not silently write this
           # store's units onto every variant.
           variant[:dimensions_unit],
-          variant.weight,
+          decimal(variant.weight),
           variant[:weight_unit],
           publication_available_on&.strftime('%Y-%m-%d %H:%M:%S'),
           (variant.discontinue_on || publication_discontinue_on)&.strftime('%Y-%m-%d %H:%M:%S'),
@@ -151,6 +151,15 @@ module Spree
 
       private
 
+      def unit_price(amount)
+        Spree::Money::Rounding.format(amount, currency, unit_price: true)
+      end
+
+      # "1.5", never Ruby's "0.15e1", which the import refuses.
+      def decimal(value)
+        Spree::Money::Rounding.format_decimal(value)
+      end
+
       # Default-channel publication for the export's store. 5.5 transitional:
       # fall back to the legacy Product columns when the publication dates are
       # NULL (pre-backfill). 6.0 drops the Product-column fallback.
@@ -175,8 +184,8 @@ module Spree
         csv = Array.new(CSV_HEADERS.size)
         csv[CSV_HEADERS.index('sku')] = variant.sku
         csv[CSV_HEADERS.index('slug')] = product.slug
-        csv[CSV_HEADERS.index('price')] = variant.amount_in(currency)&.to_f
-        csv[CSV_HEADERS.index('compare_at_price')] = variant.compare_at_amount_in(currency)&.to_f
+        csv[CSV_HEADERS.index('price')] = unit_price(variant.amount_in(currency))
+        csv[CSV_HEADERS.index('compare_at_price')] = unit_price(variant.compare_at_amount_in(currency))
         csv[CSV_HEADERS.index('currency')] = currency
         csv
       end

data/app/presenters/spree/csv/purchase_order_item_presenter.rb

@@ -41,9 +41,7 @@ module Spree
       private
 
       def amount_string(amount, currency)
-        return nil if amount.nil?
-
-        format("%.#{Spree::Money::Rounding.precision(currency)}f", amount)
+        Spree::Money::Rounding.format(amount, currency, unit_price: true)
       end
     end
   end

data/app/services/spree/carts/update.rb

@@ -89,7 +89,7 @@ module Spree
         cart.use_shipping = params[:use_shipping] if params.key?(:use_shipping)
         assign_preferred_stock_location if params.key?(:preferred_stock_location_id)
         assign_company if params.key?(:company_id)
-        assign_po_document if params.key?(:po_document)
+        assign_po_document if params.key?(:po_document_signed_id)
       end
 
       # The buyer's purchase order as an ActiveStorage signed blob id — the
@@ -97,12 +97,12 @@ module Spree
       # value detaches, so a buyer can withdraw a document they attached in
       # error.
       #
-      # An abandoned direct upload leaves the blob row behind without its
+      # An abandoned presigned upload leaves the blob row behind without its
       # bytes, and the buyer's client may still send back the signed id it was
       # handed. ActiveStorage raises a message-less FileNotFoundError for that,
       # which would otherwise reach the storefront as a bare class name.
       def assign_po_document
-        value = params[:po_document]
+        value = params[:po_document_signed_id]
 
         if value.blank?
           cart.po_document.detach

data/app/services/spree/imports/row_processors/product_variant.rb

@@ -4,9 +4,13 @@ module Spree
       class ProductVariant < Base
         OPTION_TYPES_COUNT = 3
         CATEGORY_FIELDS = %w[category1 category2 category3].freeze
+        # Written as plain decimals ("16.50"): the models store text as sent,
+        # and "1,599.99" or "16,50" would otherwise be saved as 1 or 16.
+        DECIMAL_FIELDS = %w[price compare_at_price cost_price weight height width depth carton_weight].freeze
 
         def initialize(row, **)
           super
+          ensure_decimals!
           @store = row.store
           @seller = import.seller
           # Before the product is saved: rows are not wrapped in a transaction,
@@ -83,6 +87,14 @@ module Spree
 
         private
 
+        def ensure_decimals!
+          DECIMAL_FIELDS.each do |column|
+            Spree::Money::Rounding.parse_decimal(attributes[column])
+          rescue Spree::Money::InvalidFormat
+            raise ArgumentError, I18n.t('spree.import_invalid_number', column: column, value: attributes[column].to_s.strip)
+          end
+        end
+
         # A product-header (options-empty) row creates an option-less default
         # variant to hold product-level attributes. Once an option-bearing
         # variant exists, that placeholder is a leftover — remove it and

data/app/services/spree/locales.rb

@@ -16,15 +16,15 @@ module Spree
     # English, Brazilian vs. European Portuguese, Simplified vs. Traditional
     # Chinese, etc.).
     #
-    # The underlying translation tables accept any locale string, so this list
-    # governs only what the locale pickers offer — it is not a hard storage
-    # constraint.
+    # Markets and stores only accept codes from this list when their locales
+    # change, so an order's or cart's locale (which must be one its store
+    # supports) is one too, unless the store kept a value saved before that.
     ALL = %w[
       aa ab ae af ak am an ar as av ay az
       ba be bg bh bi bm bn bo br bs
       ca ce ch co cr cs cu cv cy
       da de de-AT de-CH dv dz
-      ee el en en-AU en-CA en-GB en-IN en-NZ eo es es-419 es-MX et eu
+      ee el en en-AU en-CA en-GB en-IN en-NZ en-US eo es es-419 es-CL es-EC es-MX et eu
       fa ff fi fj fo fr fr-CA fy
       ga gd gl gn gu gv
       ha he hi ho hr ht hu hy hz
@@ -38,7 +38,7 @@ module Spree
       pa pi pl ps pt pt-BR pt-PT
       qu
       rm rn ro ru rw
-      sa sc sd se sg si sk sl sm sn so sq sr ss st su sv sw
+      sa sc sd se sg si sk sl sl-SI sm sn so sq sr ss st su sv sw
       ta te tg th ti tk tl tn to tr ts tt tw ty
       ug uk ur uz
       ve vi vo
@@ -47,5 +47,39 @@ module Spree
       yi yo
       za zh-CN zh-HK zh-TW zu
     ].freeze
+
+    # The codes in a comma-separated list that are not listed, for a
+    # validation to name.
+    #
+    # @param codes [String, nil] e.g. "en,pt-BR"
+    # @return [Array<String>]
+    def self.unlisted(codes)
+      codes.to_s.split(',').map(&:strip).reject(&:empty?) - ALL
+    end
+
+    # A listed locale for a code from elsewhere (a host app's I18n config, a
+    # country's official language, a legacy column): the listed spelling of
+    # the code itself (`en_US` and `pt-br` give `en-US` and `pt-BR`),
+    # otherwise the listed one for its language (`en-IE` gives `en`, `zh`
+    # gives `zh-CN`), or nil when Spree knows neither.
+    #
+    # @param code [String, Symbol, nil]
+    # @return [String, nil]
+    def self.listed(code)
+      code = code.to_s.strip.tr('_', '-')
+      return if code.empty?
+
+      ALL.find { |listed| listed.casecmp?(code) } || for_language(code.split('-').first)
+    end
+
+    # The listed locale for an ISO 639-1 language: the language itself, or
+    # its first regional variant when only those are listed (`zh` gives
+    # `zh-CN`).
+    #
+    # @param language [String]
+    # @return [String, nil]
+    def self.for_language(language)
+      Spree.locale_for_language(language.to_s.downcase, ALL)
+    end
   end
 end