spree_core 6.0.0.rc1 → 6.0.0.rc2

data/app/workflows/spree/purchase_orders/create.rb

@@ -19,9 +19,10 @@ module Spree
       # @param expected_at [Date, nil]
       # @param reference [String, nil] the supplier's own order number
       # @param notes [String, nil]
+      # @param metadata [Hash, nil]
       # @param created_by [Object, nil]
       def perform(store:, supplier:, destination_location:, items: [], currency: nil,
-                  expected_at: nil, cancel_by: nil, reference: nil, notes: nil, created_by: nil)
+                  expected_at: nil, cancel_by: nil, reference: nil, notes: nil, metadata: nil, created_by: nil)
         super
 
         step :build_purchase_order
@@ -50,6 +51,7 @@ module Spree
           created_by: created_by,
           status: Spree::PurchaseOrder.default_status
         )
+        @purchase_order.metadata = metadata if metadata
 
         Array(items).each do |item|
           @purchase_order.items.build(

data/app/workflows/spree/shipping_labels/record.rb

@@ -13,7 +13,7 @@ module Spree
       attr_reader :shipping_label
 
       # @param owner [Spree::Fulfillment, Spree::Return]
-      # @param file [ActionDispatch::Http::UploadedFile, String] the file, or a signed blob id from a direct upload
+      # @param file [ActionDispatch::Http::UploadedFile, String] the file, or a signed id from POST /files
       # @param tracking_number [String] the number printed on the label
       # @param carrier [String, nil] free text; detected from the number when omitted
       # @param service [String, nil]
@@ -69,7 +69,7 @@ module Spree
         failure(@shipping_label) unless @shipping_label.save
       end
 
-      # A direct-upload blob carries the type the client declared, which the
+      # An uploaded blob carries the type the client declared, which the
       # attachment validator re-decides from the bytes; either way the
       # extension is the merchant-visible answer, so it wins when it names a
       # format Spree knows.

data/app/workflows/spree/stock_transfers/create.rb

@@ -16,9 +16,10 @@ module Spree
       #   may legitimately open empty and gain lines as the merchant packs
       # @param reference [String, nil] the merchant's own label for the trip
       # @param notes [String, nil]
+      # @param metadata [Hash, nil]
       # @param created_by [Object, nil]
       def perform(store:, source_location:, destination_location:, items: [],
-                  reference: nil, notes: nil, created_by: nil)
+                  reference: nil, notes: nil, metadata: nil, created_by: nil)
         super
 
         step :build_transfer
@@ -46,6 +47,7 @@ module Spree
           created_by: created_by,
           status: Spree::StockTransfer.default_status
         )
+        @stock_transfer.metadata = metadata if metadata
 
         Array(items).each do |item|
           @stock_transfer.items.build(variant: item[:variant], quantity_shipped: item[:quantity_shipped])

data/config/currency_exponents.json

@@ -0,0 +1,180 @@
+{
+  "AED": 2,
+  "AFN": 2,
+  "ALL": 2,
+  "AMD": 2,
+  "ANG": 2,
+  "AOA": 2,
+  "ARS": 2,
+  "AUD": 2,
+  "AWG": 2,
+  "AZN": 2,
+  "BAM": 2,
+  "BBD": 2,
+  "BDT": 2,
+  "BGN": 2,
+  "BHD": 3,
+  "BIF": 0,
+  "BMD": 2,
+  "BND": 2,
+  "BOB": 2,
+  "BRL": 2,
+  "BSD": 2,
+  "BTN": 2,
+  "BWP": 2,
+  "BYN": 2,
+  "BYR": 0,
+  "BZD": 2,
+  "CAD": 2,
+  "CDF": 2,
+  "CHF": 2,
+  "CLF": 4,
+  "CLP": 0,
+  "CNY": 2,
+  "COP": 2,
+  "CRC": 2,
+  "CUC": 2,
+  "CUP": 2,
+  "CVE": 2,
+  "CZK": 2,
+  "DJF": 0,
+  "DKK": 2,
+  "DOP": 2,
+  "DZD": 2,
+  "EEK": 2,
+  "EGP": 2,
+  "ERN": 2,
+  "ETB": 2,
+  "EUR": 2,
+  "FJD": 2,
+  "FKP": 2,
+  "GBP": 2,
+  "GEL": 2,
+  "GHS": 2,
+  "GIP": 2,
+  "GMD": 2,
+  "GNF": 0,
+  "GTQ": 2,
+  "GYD": 2,
+  "HKD": 2,
+  "HNL": 2,
+  "HRK": 2,
+  "HTG": 2,
+  "HUF": 2,
+  "IDR": 2,
+  "ILS": 2,
+  "INR": 2,
+  "IQD": 3,
+  "IRR": 2,
+  "ISK": 0,
+  "JMD": 2,
+  "JOD": 3,
+  "JPY": 0,
+  "KES": 2,
+  "KGS": 2,
+  "KHR": 2,
+  "KMF": 0,
+  "KPW": 2,
+  "KRW": 0,
+  "KWD": 3,
+  "KYD": 2,
+  "KZT": 2,
+  "LAK": 2,
+  "LBP": 2,
+  "LKR": 2,
+  "LRD": 2,
+  "LSL": 2,
+  "LTL": 2,
+  "LVL": 2,
+  "LYD": 3,
+  "MAD": 2,
+  "MDL": 2,
+  "MGA": 2,
+  "MKD": 2,
+  "MMK": 2,
+  "MNT": 2,
+  "MOP": 2,
+  "MRO": 2,
+  "MRU": 2,
+  "MTL": 2,
+  "MUR": 2,
+  "MVR": 2,
+  "MWK": 2,
+  "MXN": 2,
+  "MYR": 2,
+  "MZN": 2,
+  "NAD": 2,
+  "NGN": 2,
+  "NIO": 2,
+  "NOK": 2,
+  "NPR": 2,
+  "NZD": 2,
+  "OMR": 3,
+  "PAB": 2,
+  "PEN": 2,
+  "PGK": 2,
+  "PHP": 2,
+  "PKR": 2,
+  "PLN": 2,
+  "PYG": 0,
+  "QAR": 2,
+  "RON": 2,
+  "RSD": 2,
+  "RUB": 2,
+  "RWF": 0,
+  "SAR": 2,
+  "SBD": 2,
+  "SCR": 2,
+  "SDG": 2,
+  "SEK": 2,
+  "SGD": 2,
+  "SHP": 2,
+  "SKK": 2,
+  "SLE": 2,
+  "SLL": 2,
+  "SOS": 2,
+  "SRD": 2,
+  "SSP": 2,
+  "STD": 2,
+  "STN": 2,
+  "SVC": 2,
+  "SYP": 2,
+  "SZL": 2,
+  "THB": 2,
+  "TJS": 2,
+  "TMM": 2,
+  "TMT": 2,
+  "TND": 3,
+  "TOP": 2,
+  "TRY": 2,
+  "TTD": 2,
+  "TWD": 2,
+  "TZS": 2,
+  "UAH": 2,
+  "UGX": 0,
+  "USD": 2,
+  "UYI": 0,
+  "UYU": 2,
+  "UYW": 4,
+  "UZS": 2,
+  "VED": 2,
+  "VEF": 2,
+  "VES": 2,
+  "VND": 0,
+  "VUV": 0,
+  "WST": 2,
+  "XAF": 0,
+  "XCD": 2,
+  "XCG": 2,
+  "XOF": 0,
+  "XPF": 0,
+  "YER": 2,
+  "ZAR": 2,
+  "ZMK": 2,
+  "ZMW": 2,
+  "ZWD": 2,
+  "ZWG": 2,
+  "ZWL": 2,
+  "ZWN": 2,
+  "ZWR": 2
+}

data/config/locales/content_locales.rb

@@ -0,0 +1,9 @@
+# A store's content locales are the codes Spree::Locales::ALL lists,
+# independent of the languages anything has translation files for. An API
+# request sets I18n.locale (and so Mobility's) to its content locale, and both
+# refuse a locale I18n does not know, so this registers every listed code:
+# content can be stored and read in, say, Yoruba, while messages in it fall
+# back along the i18n fallback chain. The backend ignores a locale with no
+# keys at all, hence the one marker key. An app that limits
+# `config.i18n.available_locales` keeps its own list.
+Spree::Locales::ALL.to_h { |code| [code.to_sym, { spree_content_locale: true }] }

data/config/locales/en.yml

@@ -251,6 +251,7 @@ en:
         must_belong_to_same_store: must belong to the same store
         not_registered: is not a registered provider
         spree_content_type_not_allowed: is not a file type we accept
+        too_many_decimals: has more than %{count} decimal places
       models:
         spree/allowed_origin:
           attributes:
@@ -381,6 +382,7 @@ en:
             base:
               duplicate_quantity: each quantity break must have its own quantity
               invalid_quantity: each quantity break must start at a whole number of units
+              malformed_price: a price must be a number like 16.50
               negative_price: a price cannot be below zero
               nothing_to_apply_to: has no rules, no catalog and no products, so it would apply to nothing. Add one before activating.
               price_rises_with_quantity: a quantity break cannot cost more than the price a buyer pays below it
@@ -873,6 +875,7 @@ en:
         invalid_status: Invalid status
         invalid_storefront_access: is not a valid storefront access level
         items_not_a_list: items must be a list of objects
+        money_preference_too_many_decimals: has more than %{count} decimal places for %{currency}
         must_be_greater_than_min_amount: must be greater than or equal to the minimum
         no_pickup_point_provider: this delivery method has no pickup point provider configured
         not_cancellable: cannot be canceled once its goods have been dispatched
@@ -894,6 +897,7 @@ en:
         stock_level_immutable: cannot be changed after the hold is taken — release the hold and take it again
         store_association_can_not_be_changed: The store association can not be changed
         store_is_already_set: Store is already set
+        unknown_calculator_type: "%{type} is not a calculator offered here"
         unknown_custom_field_type: 'is not a known custom field type (expected one of: %{types})'
         unknown_scopes: 'contains unknown scopes: %{scopes}'
         unregistered_actor: is not a registered actor class
@@ -956,6 +960,7 @@ en:
     image: Image
     import: Import
     import_has_no_failed_rows: This import has no failed rows to retry.
+    import_invalid_number: "%{column} must be a number like 16.50, got %{value}."
     import_mailer:
       greeting: Hi %{user_name},
       import_done:
@@ -1000,6 +1005,7 @@ en:
     link: Link
     locale: Locale
     locale_not_supported_by_store: is not supported by this store
+    locales_not_listed: 'includes locales Spree does not support: %{codes}'
     manual: Manual
     market: Market
     me_no_current_user: No admin user authenticated this request
@@ -1138,8 +1144,7 @@ en:
     phone: Phone
     pickup:
       store_pickup: Store Pickup
-    po_document_invalid: A purchase order document must be a PDF, image or Word file of %{size} or less.
-    po_document_invalid_signed_id: The purchase order document reference is not valid.
+    po_document_invalid: A purchase order document must be a PDF, image, Word document, spreadsheet or CSV file of %{size} or less.
     po_document_missing: This order has no attached purchase order document.
     po_document_too_large: is larger than %{size}.
     po_document_upload_incomplete: The purchase order document was not uploaded completely. Please try attaching it again.
@@ -1672,6 +1677,7 @@ en:
       errors:
         already_purchased: This parcel already has an active shipping label
         file_fetch_failed: The label file could not be fetched from the carrier (HTTP %{status})
+        file_renamed: Send the uploaded label's signed id as file_signed_id
         file_required: An uploaded label needs a file
         no_file_url: The carrier did not provide a file for this label
         not_refund_requested: Only a label awaiting the carrier's refund decision can be confirmed refunded
@@ -1791,6 +1797,8 @@ en:
     type: Type
     unable_to_connect_to_gateway: Unable to connect to gateway.
     updated_at: Updated at
+    upload_reference_invalid: A signed reference in this request is invalid or has expired. For a file, upload it again.
+    upload_wrong_visibility: must be uploaded with %{visibility} visibility
     url: URL
     user: User
     validation:

data/db/migrate/20261009000001_change_money_columns_to_decimal_19_4.rb

@@ -0,0 +1,116 @@
+# Widens every money column to decimal(19,4): room for a dinar's third decimal,
+# sub-cent unit prices and very large amounts. Every stored value fits exactly,
+# so no value changes. A column already at (19,4) is skipped, so an install
+# that widened its largest tables online ahead of the upgrade runs this as a
+# no-op for those (see the 5.6 to 6.0 upgrade guide).
+class ChangeMoneyColumnsToDecimal194 < ActiveRecord::Migration[8.1]
+  COLUMNS = {
+    spree_adjustments: %i[amount],
+    spree_carts: %i[additional_tax_total adjustment_total delivery_total discount_total fee_total included_tax_total
+                    item_total non_taxable_adjustment_total payment_total taxable_adjustment_total total],
+    spree_catalog_order_minimums: %i[amount],
+    spree_claim_line_items: %i[additional_tax_total included_tax_total refund_amount],
+    spree_commission_lines: %i[amount tax_amount total],
+    spree_commission_rate_values: %i[amount max_amount min_amount],
+    spree_delivery_method_services: %i[markup_flat],
+    spree_delivery_methods: %i[markup_flat],
+    spree_delivery_rates: %i[cost],
+    spree_discounts: %i[amount value],
+    spree_exchange_line_items: %i[new_additional_tax_total new_included_tax_total original_additional_tax_total
+                                  original_included_tax_total],
+    spree_fees: %i[amount],
+    spree_fulfillments: %i[additional_tax_total adjustment_total cost discount_total included_tax_total
+                           non_taxable_adjustment_total pre_tax_amount taxable_adjustment_total],
+    spree_gift_card_batches: %i[amount],
+    spree_gift_cards: %i[amount amount_authorized amount_used],
+    spree_line_items: %i[additional_tax_total adjustment_total cost_price discount_total included_tax_total
+                         non_taxable_adjustment_total pre_tax_amount price taxable_adjustment_total],
+    spree_orders: %i[additional_tax_total adjustment_total commission_amount_total commission_tax_total commission_total
+                     delivery_total discount_total fee_total included_tax_total item_total non_taxable_adjustment_total
+                     payment_total taxable_adjustment_total total],
+    spree_payment_capture_events: %i[amount],
+    spree_payment_sessions: %i[amount],
+    spree_payment_splits: %i[authorized_amount captured_amount claimed_amount refunded_amount],
+    spree_payments: %i[amount],
+    spree_price_histories: %i[amount compare_at_amount],
+    spree_prices: %i[amount compare_at_amount],
+    spree_products: %i[revenue],
+    spree_products_stores: %i[revenue],
+    spree_purchase_order_items: %i[unit_cost],
+    spree_refunds: %i[amount tax_amount],
+    spree_reimbursement_credits: %i[amount],
+    spree_reimbursements: %i[total],
+    spree_return_items: %i[additional_tax_total included_tax_total pre_tax_amount],
+    spree_return_line_items: %i[additional_tax_total included_tax_total pre_tax_amount],
+    spree_seller_payouts: %i[amount],
+    spree_seller_transfers: %i[amount settled_amount],
+    spree_sellers: %i[minimum_payout_amount],
+    spree_shipping_labels: %i[cost],
+    spree_stock_movements: %i[unit_cost],
+    spree_store_credit_events: %i[amount user_total_amount],
+    spree_store_credits: %i[amount amount_authorized amount_used],
+    spree_tax_lines: %i[amount],
+    spree_variants: %i[cost_price]
+  }.freeze
+
+  # What `down` restores: decimal(10,2) unless listed.
+  ORIGINAL = {
+    'spree_delivery_rates.cost' => [8, 2],
+    'spree_store_credit_events.amount' => [8, 2],
+    'spree_store_credit_events.user_total_amount' => [8, 2],
+    'spree_store_credits.amount' => [8, 2],
+    'spree_store_credits.amount_authorized' => [8, 2],
+    'spree_store_credits.amount_used' => [8, 2],
+    'spree_fulfillments.pre_tax_amount' => [12, 4],
+    'spree_line_items.pre_tax_amount' => [12, 4],
+    'spree_return_items.additional_tax_total' => [12, 4],
+    'spree_return_items.included_tax_total' => [12, 4],
+    'spree_return_items.pre_tax_amount' => [12, 4],
+    'spree_products.revenue' => [16, 4]
+  }.freeze
+
+  def up
+    deliberately_rewriting { COLUMNS.each_key { |table| retype(table) { [19, 4] } } }
+  end
+
+  def down
+    deliberately_rewriting do
+      COLUMNS.each_key { |table| retype(table) { |column| ORIGINAL.fetch("#{table}.#{column}", [10, 2]) } }
+    end
+  end
+
+  private
+
+  # The rewrite is the point of this migration and the upgrade guide documents
+  # it, so an app running strong_migrations is not stopped by it.
+  def deliberately_rewriting(&block)
+    respond_to?(:safety_assured) ? safety_assured(&block) : yield
+  end
+
+  # One ALTER TABLE per table, so each is rewritten once rather than once per
+  # column. PostgreSQL keeps NOT NULL and the default through a type change,
+  # and Rails' MySQL adapter carries them over itself; passing them would add a
+  # SET NOT NULL that scans every row. SQLite rebuilds the table from the new
+  # definition, so it is told both.
+  def retype(table)
+    return unless table_exists?(table)
+
+    existing = connection.columns(table).index_by(&:name)
+    changes = COLUMNS[table].filter_map do |name|
+      column = existing[name.to_s]
+      next if column.nil?
+
+      precision, scale = yield(name)
+      [column, precision, scale] unless column.precision == precision && column.scale == scale
+    end
+    return if changes.empty?
+
+    change_table(table, bulk: true) do |definition|
+      changes.each do |column, precision, scale|
+        options = { precision: precision, scale: scale }
+        options.merge!(null: column.null, default: column.default) if connection.adapter_name.match?(/sqlite/i)
+        definition.change column.name, :decimal, **options
+      end
+    end
+  end
+end

data/db/migrate/20261010000001_add_store_id_to_active_storage_blobs.rb

@@ -0,0 +1,12 @@
+# Records which store owns every uploaded file, so a file from one store cannot
+# be attached in another and storage can be measured and cleaned up per store.
+# Active Storage ignores columns it does not define. Existing rows are filled
+# in by `spree:uploads:assign_stores` in the 6.0 upgrade.
+class AddStoreIdToActiveStorageBlobs < ActiveRecord::Migration[8.1]
+  def change
+    return unless table_exists?(:active_storage_blobs)
+    return if column_exists?(:active_storage_blobs, :store_id)
+
+    add_reference :active_storage_blobs, :store, null: true, index: true
+  end
+end

data/lib/generators/spree/dummy/templates/rails/test.rb

@@ -42,9 +42,28 @@ Dummy::Application.configure do
   # Print deprecation notices to the stderr
   config.active_support.deprecation = :stderr
 
-  # Spree's own code must not call the deprecated Spree.t.
+  # Spree's own code and specs must not call these deprecated APIs. A spec
+  # covering one on purpose stubs Spree::Deprecation.warn or silences it.
   config.active_support.disallowed_deprecation = :raise
-  config.active_support.disallowed_deprecation_warnings = [/Spree\.t is deprecated/]
+  config.active_support.disallowed_deprecation_warnings = [
+    /Spree\.t is deprecated/,
+    /Spree::Product#(master|variants_including_master) is deprecated/,
+    /Spree::(Order|Cart)#(shipment_total|promo_total|item_count|shipping_discount) is deprecated/,
+    /Spree::Order#finalize! is deprecated/,
+    /Spree::Payment#state=? is deprecated/,
+    /Spree::Payment#(process|authorize|purchase|capture|void_transaction)! is deprecated/,
+    /Spree::(Category|Product)#classifications is deprecated/,
+    /Spree::Product#taxons=? is deprecated/,
+    /Spree::Promotion::Rules::Category#taxon/,
+    /Spree::Fulfillment#(add_)?shipping_method is deprecated/,
+    /Spree::Stock::Package#shipping_methods is deprecated/,
+    /Calling Spree::(Carts::AddItem|StockReservations::(Reserve|Extend)) with order: is deprecated/,
+    /Spree::Config\[:admin_url\] is deprecated/,
+    /private_metadata=? is deprecated/,
+    /Spree::Pricing::Resolver is deprecated/,
+    /Spree::Invitation#accept! is deprecated/,
+    /`preference :\w+, in:` is deprecated/
+  ]
 
   config.active_job.queue_adapter = :test
 

data/lib/spree/core/configuration.rb

@@ -119,6 +119,19 @@ module Spree
       # requirement, in bytes. Small on purpose: these are certificates and
       # registrations, and an unbounded upload is a way to fill a disk.
       preference :max_seller_document_upload_size, :integer, default: 20_971_520, env: 'SPREE_MAX_SELLER_DOCUMENT_UPLOAD_SIZE' # 20 MB
+
+      # Largest file the Admin and Seller APIs accept for upload straight to
+      # storage, in bytes. Digital products (courses, archives) can be large.
+      preference :max_upload_size, :integer, default: 5_368_709_120, env: 'SPREE_MAX_UPLOAD_SIZE' # 5 GB
+
+      # Largest file accepted as bytes in the upload request itself, in bytes.
+      # Lower, because those bytes pass through the application.
+      preference :max_multipart_upload_size, :integer, default: 10_485_760, env: 'SPREE_MAX_MULTIPART_UPLOAD_SIZE' # 10 MB
+
+      # Days an uploaded file that was never attached to anything is kept
+      # before the daily purge deletes it. Longer than an upload reference
+      # stays valid (one day), so nothing a client can still attach is lost.
+      preference :unattached_upload_retention_days, :integer, default: 2, env: 'SPREE_UNATTACHED_UPLOAD_RETENTION_DAYS'
       preference :non_expiring_credit_types, :array, default: [], deprecated: 'Nothing reads this in Spree 6 — store credits no longer carry a category, and expiry lives on Spree::GiftCard'
       preference :products_per_page, :integer, default: 12, deprecated: 'Nothing reads this in Spree 6 — pass per_page to the API instead'
       preference :restock_inventory, :boolean, default: true, deprecated: 'Restocking is decided per line item by Spree::ReturnLineItem#resellable'
@@ -137,10 +150,15 @@ module Spree
       preference :empty_cart_expiry_hours, :integer, default: 48, env: 'SPREE_EMPTY_CART_EXPIRY_HOURS'
       preference :show_variant_full_price, :boolean, default: false, deprecated: 'Nothing reads this in Spree 6 — a storefront decides how it renders prices'
       preference :show_products_without_price, :boolean, default: false, deprecated: 'Set it on the store instead'
+      # The daily update check also reports usage (see Spree::UpdateCheck).
+      # SPREE_TELEMETRY_DISABLED or DO_NOT_TRACK turns it off as well.
+      preference :telemetry_enabled, :boolean, default: true
       preference :tax_using_ship_address, :boolean, default: true, deprecated: 'Set it on the store instead'
       preference :track_inventory_levels, :boolean, default: true, deprecated: 'Set it on the store instead' # Determines whether to track on_hand values for variants / products.
       preference :track_price_history, :boolean, default: true, deprecated: 'Set it on the store instead' # Records price changes for Omnibus Directive compliance. Disable for non-EU stores.
       preference :price_history_retention_days, :integer, default: 30, deprecated: 'Set it on the store instead' # Days to retain price history records. Used by spree:price_history:prune rake task.
+      # SPREE_UPDATE_CHECK_DISABLED turns it off as well.
+      preference :update_check_enabled, :boolean, default: true
       preference :use_user_locale, :boolean, default: true, deprecated: true
 
       # Sets the path used for products, taxons and pages.

data/lib/spree/core/engine.rb

@@ -559,6 +559,25 @@ module Spree
         )
       end
 
+      # Deprecated constant aliases warn when their file loads. Leaving them
+      # out of eager loading keeps every boot quiet; they still load, and
+      # warn, the first time something references the old name.
+      DEPRECATED_ALIAS_FILES = %w[
+        app/models/concerns/spree/user_methods.rb
+        app/models/spree/asset.rb
+        app/models/spree/classification.rb
+        app/models/spree/promotion/rules/taxon.rb
+        app/models/spree/promotion_rule_taxon.rb
+        app/models/spree/return_authorization_reason.rb
+        app/models/spree/taxon.rb
+        app/services/spree/checkout/add_store_credit.rb
+        app/services/spree/checkout/remove_store_credit.rb
+      ].freeze
+
+      initializer 'spree.deprecated_aliases.skip_eager_load' do
+        Rails.autoloaders.main.do_not_eager_load(*DEPRECATED_ALIAS_FILES.map { |path| root.join(path) })
+      end
+
       # filter sensitive information during logging
       initializer 'spree.params.filter' do |app|
         app.config.filter_parameters += [
@@ -572,6 +591,13 @@ module Spree
         ]
       end
 
+      # Records which store owns every uploaded file, and reports attaching a
+      # file to another store's record (docs/plans/6.0-uploads-and-file-ownership.md).
+      initializer 'spree.active_storage.store_ownership' do
+        ActiveSupport.on_load(:active_storage_blob) { include Spree::Uploads::BlobStoreOwnership }
+        ActiveSupport.on_load(:active_storage_attachment) { include Spree::Uploads::AttachmentStoreCheck }
+      end
+
       initializer 'spree.core.checking_migrations' do |app|
         app.config.after_initialize do
           Migrations.new(config, engine_name).check unless Rails.env.test? || Spree::Config.disable_migration_check

data/lib/spree/core/preferences/invalid_preferences.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Preferences
+    # Raised when a `preferences` payload does not match the schema its type
+    # declares. Each failure names the value by a JSON pointer into the
+    # payload, so a client can show it next to the field it belongs to.
+    class InvalidPreferences < StandardError
+      # @return [Array<Hash{Symbol => String}>] `{ pointer:, message: }` per failure
+      attr_reader :failures
+
+      # @param failures [Array<Hash{Symbol => String}>] pointers relative to the preferences object
+      # @param prefix [String] where the preferences object sits in the request
+      def initialize(failures, prefix: '/preferences')
+        @failures = failures.map { |failure| failure.merge(pointer: "#{prefix}#{failure[:pointer]}") }
+        super(@failures.map { |failure| "#{failure[:pointer]}: #{failure[:message]}" }.join('; '))
+      end
+    end
+  end
+end

data/lib/spree/core/preferences/json_conversion.rb

@@ -60,8 +60,12 @@ module Spree
       # @return [Array<String>]
       def preference_tables
         Rails.application.eager_load! if defined?(Rails.application) && Rails.application
+        # An anonymous class (a spec's throwaway model) has no name to derive a
+        # table from, and asking raises, so it is skipped.
         owned = ActiveRecord::Base.descendants.filter_map do |model|
-          model.table_name if !model.abstract_class? && model.include?(Spree::Preferences::Preferable) && model.table_name
+          next if model.name.nil? || model.abstract_class? || !model.include?(Spree::Preferences::Preferable)
+
+          model.table_name
         end
 
         connection.tables.select { |table| owned.include?(table) && connection.column_exists?(table, :preferences) }.sort

data/lib/spree/core/preferences/masking.rb

@@ -47,6 +47,25 @@ module Spree
         value.is_a?(String) && value.start_with?(TOKEN)
       end
 
+      # Money is written to at least the decimals of the currency the record
+      # names (a calculator's `currency` preference), keeping up to four like
+      # a unit price, so a per-item amount below a cent survives a round trip.
+      # A money preference with no currency of its own, such as an order-total
+      # rule that applies to any currency, keeps its exact decimal.
+      def self.wire_value(preferable, key, type, value)
+        case type
+        when :password then mask(value)
+        when :money
+          # Stored as the JSON text of a decimal.
+          amount = value.is_a?(String) ? BigDecimal(value, exception: false) : value
+          return value unless amount.is_a?(Numeric)
+
+          currency = preferable.money_preference_currency(key)
+          currency.present? ? Spree::Money::Rounding.format(amount, currency, unit_price: true) : Spree::Money::Rounding.format_decimal(amount)
+        else value
+        end
+      end
+
       # Serializes a Preferable's `preferences` hash for the wire,
       # masking `:password` values. Keys are stringified to match the
       # wire shape expected by JSON clients — schema entries built by
@@ -59,14 +78,45 @@ module Spree
       def self.serialize(preferable)
         return {} if preferable.nil?
 
+        definitions = preferable.class.preference_definitions
         preferable.preference_schema.each_with_object({}) do |field, hash|
           # The stored value only, never the default — an unset secret must not
           # reveal what it would fall back to — read through the record,
           # because a secret lives in its own column.
           value = preferable.stored_preference(field[:key]) { nil }
-          hash[field[:key_string] || field[:key].to_s] = field[:type] == :password ? mask(value) : value
+          definition = definitions.fetch(field[:key])
+          hash[field[:key_string] || field[:key].to_s] =
+            if definition[:of] == :id
+              prefixed_ids(value, definition)
+            elsif %i[password money].include?(field[:type])
+              wire_value(preferable, field[:key], field[:type], value)
+            elsif definition[:keys] == :currency && definition[:values] == :money
+              money_by_currency(preferable.wire_preference_value(value, definition))
+            else
+              preferable.wire_preference_value(value, definition)
+            end
         end
       end
+
+      # Amounts keyed by currency (`{ "EUR" => "12.5" }`), each written with
+      # the decimals of its own currency, as every money value is.
+      def self.money_by_currency(value)
+        return value unless value.is_a?(Hash)
+
+        value.to_h do |currency, amount|
+          decimal = BigDecimal(amount.to_s, exception: false)
+          [currency, decimal ? Spree::Money::Rounding.format(decimal, currency, unit_price: true) : amount]
+        end
+      end
+
+      # Ids are stored as raw primary keys and leave as prefixed ids, the form
+      # every write accepts.
+      def self.prefixed_ids(value, definition)
+        return value unless value.is_a?(Array)
+
+        model = Spree::Preferences::Preferable.preference_model(definition)
+        value.map { |id| Spree::PrefixedId.prefixed_id?(id.to_s) ? id : model.prefixed_id_for(id) }
+      end
     end
   end
 end