spree_core 6.0.0.rc2 → 6.0.0.rc4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b2f1ca5c6b7f00a17f11bd7c7f34eac185b07acfbc58ee5cb177b0ddc804f05
-  data.tar.gz: 521bffafb8eb7ea97c31c9e71206bb65ee5f46c453516a8365e9875b965780f7
+  metadata.gz: bc7dbcacac8f33d70f236f52c52070ee495d7d4e366797055c17d4b119eec6d4
+  data.tar.gz: 3a2e290f02c8d3c9f367c2b4d649d94f69e58449a3ca47179ea58480a3cb1375
 SHA512:
-  metadata.gz: 49c46ec423a04b65729afe6ed2f560f49927947f615551fdf35ff5b4edeab841e689a778321c1311310125237cde58007bd0ecd56b6554b0fec2756833da8fde
-  data.tar.gz: a8cc2d507005043e8e92e01398321e70d7af4cf687c4d9dd5bb46064c52743a42026eb5131aca5ed72735ae6389cd31423199041e13754a3a0d0a5edc3550c85
+  metadata.gz: ec7a1dc11ffe7aaa8b4cdd82e8e050f39d2d38fedb81c2b3a70901c3db5dbedd0b51bfad12164d2e28962b231ffff777c9ff22a884acc78e631e19a4741ab283
+  data.tar.gz: 4e7f9a59e472892e07722d15a598ca76dc1257c76c1cc969c77dcba8a73b7d78ceccfe88a61c9aa2fb084f633064256df3493bc2b91e79cecb86a9ca6a545259

data/app/mailers/spree/email_template_mailer.rb

@@ -11,11 +11,14 @@ module Spree
     # @param record_id [String, nil] the record to build sample data from
     # @param email_key [String, nil] for the layout or a partial, the email to show it in
     # @param branding [Hash] unsaved branding values
-    def test_email(store, recipient, key, locale: nil, subject: nil, body: nil, record_id: nil, email_key: nil, branding: {})
+    # @param mailer_logo_signed_id [String, nil] the signed id of an unsaved, uploaded email logo
+    # @param mailer_logo_cleared [Boolean] whether the email logo is sent as removed
+    def test_email(store, recipient, key, locale: nil, subject: nil, body: nil, record_id: nil, email_key: nil, branding: {},
+                   mailer_logo_signed_id: nil, mailer_logo_cleared: false)
       @current_store = store
       email = Spree::EmailTemplates::Preview.new(
         store: store, key: key, locale: locale, subject: subject, body: body, record_id: record_id, email_key: email_key,
-        branding: branding
+        branding: branding, mailer_logo_signed_id: mailer_logo_signed_id, mailer_logo_cleared: mailer_logo_cleared
       ).call
 
       mail(to: recipient, subject: I18n.t('spree.email_templates.test_email_subject', subject: email.subject)) do |format|

data/app/models/concerns/spree/has_external_references.rb

@@ -11,13 +11,14 @@ module Spree
       # Scope-friendly so controllers can chain it onto an already store-scoped
       # relation: `current_store.products.with_external_id('erp', 'MAT-100')`.
       # Scoping the lookup to the store is the caller's job, exactly as with any
-      # other id coming off a request.
+      # other id coming off a request. A subquery rather than a join, so a
+      # relation that also preloads `external_references` still loads every
+      # key, not only the matched one.
       scope :with_external_id, lambda { |system, external_id|
-        joins(:external_references).where(
-          spree_external_references: {
-            system: Spree::ExternalReference.normalize_system(system),
-            external_id: external_id.to_s.strip
-          }
+        where(
+          id: Spree::ExternalReference.for_system(system).
+            where(resource_type: polymorphic_name, external_id: external_id.to_s.strip).
+            select(:resource_id)
         )
       }
     end

data/app/models/concerns/spree/preference_schema/json_schema.rb

@@ -52,7 +52,14 @@ module Spree
         schema = value_schema(definition)
         choices = definition[:choices]
         choices = choices.call if choices.respond_to?(:call)
-        schema['enum'] = choices.map { |choice| choice.is_a?(Symbol) ? choice.to_s : choice } if choices.present?
+        if choices.present?
+          # `{ value => label }` names values that cannot label themselves — an
+          # endpoint URL is no i18n key, let alone something to show a merchant.
+          labels = choices.to_h { |value, label| [value.to_s, label.to_s] } if choices.is_a?(Hash)
+          values = choices.is_a?(Hash) ? choices.keys : Array(choices)
+          schema['enum'] = values.map { |choice| choice.is_a?(Symbol) ? choice.to_s : choice }
+          schema['x-spree-choice-labels'] = labels if labels
+        end
         default = definition[:dynamic_default] ? nil : wire_default(default, definition)
         unset_reads_null = default.nil? && !definition[:dynamic_default]
 

data/app/models/concerns/spree/purchase/taxation.rb

@@ -28,6 +28,15 @@ module Spree
         market&.tax_provider_instance || Spree.default_tax_provider.new
       end
 
+      # Whether this sale's prices include tax, which its market decides. With
+      # no market yet (an empty cart before currency resolution) the store's
+      # default market answers.
+      #
+      # @return [Boolean]
+      def tax_inclusive?
+        (market || store&.default_market)&.tax_inclusive? || false
+      end
+
       # The typed inputs every +estimate+ call carries. Assembled here rather
       # than at each call site so a single-item re-estimate reaches the provider
       # with the same buyer registration and exemption evidence as a full
@@ -39,7 +48,8 @@ module Spree
         {
           tax_date: Time.current,
           tax_identifier: resolved_tax_identifier,
-          exemptions: usable_exemptions
+          exemptions: usable_exemptions,
+          tax_inclusive: tax_inclusive?
         }
       end
 
@@ -100,15 +110,30 @@ module Spree
         pre_tax_item_amount + fulfillments.sum(:pre_tax_amount)
       end
 
-      private
-
       # The resolver is swappable, so what it returns is host code. An entry
       # whose per-line overrides cannot name their line is not a narrower claim
       # but a wider one — the provider would read it as the whole order being
       # exempt — so it is dropped rather than trusted. Charging tax is the safe
       # direction: under-exempting surfaces as a customer query, over-exempting
       # is tax the merchant owes and never collected.
+      #
+      # Public because a provider filing the sale needs the same evidence core
+      # hands it as an +estimate+ argument: an external engine commits its
+      # document after placement, and resolving again there could file an
+      # exemption the estimate never applied.
+      #
+      # A placed order answers from its frozen snapshot for that reason, the way
+      # +resolved_tax_identifier+ does. Resolving live months later is not the
+      # same evidence: a certificate lapses on its own date with nothing written
+      # to it, can be revoked, and goes with its company when that is deleted —
+      # so a credit for an exempt sale would be filed as a consumer refund and
+      # declare tax the sale never collected. Orders placed before the snapshot
+      # existed have none, and still resolve live.
+      #
+      # @return [Array]
       def usable_exemptions
+        return frozen_tax_exemptions if frozen_tax_exemptions?
+
         resolved = Array(Spree.tax_resolve_exemptions_service.new.call(order: self).value)
 
         resolved.select do |exemption|
@@ -127,6 +152,22 @@ module Spree
         end
       end
 
+      private
+
+      # Carts always resolve live — a buyer's certificates legitimately change
+      # while they shop, and the cart is priced again each time.
+      #
+      # Only nil is an absent snapshot. An empty one records that the sale found
+      # no claim, and reading that as absent would let a certificate added later
+      # explain a sale it was never part of.
+      def frozen_tax_exemptions?
+        is_a?(Spree::Order) && completed? && !applied_tax_exemptions.nil?
+      end
+
+      def frozen_tax_exemptions
+        Array(applied_tax_exemptions).map { |snapshot| Spree::TaxExemption.from_snapshot(snapshot) }
+      end
+
       # Read through the legal entity, never the node — a division holds no
       # registrations of its own.
       def company_tax_identifier

data/app/models/concerns/spree/translatable_resource.rb

@@ -12,6 +12,21 @@ module Spree
         const_get(:TRANSLATABLE_FIELDS)
       end
 
+      # The permission a caller needs in order to write this resource's
+      # translations.
+      #
+      # Declared rather than derived from the class name, because several
+      # resources are guarded by a permission that is not named after them:
+      # option types and values ride `write_products`, a policy rides
+      # `write_settings`. Deriving it produced names outside the permission
+      # catalog, which a credential could never hold and which the API
+      # therefore could not check at all.
+      #
+      # @return [String]
+      def translation_write_permission
+        "write_#{Spree::Base.polymorphic_api_type(name).pluralize}"
+      end
+
       # Maps a public API field name to the internal Mobility field, for a
       # model whose translatable column is named differently from the field the
       # API exposes. The public name is what the serializer and the translation
@@ -70,6 +85,40 @@ module Spree
       def arel_table_alias
         Arel::Table.new(translation_table_alias)
       end
+
+      # Sorts translated fields by the translation, or by the default-language
+      # value in the base column when the translation is missing or empty.
+      # Ransack sorts them by the translation alone, which leaves untranslated
+      # records unordered. On a DISTINCT relation the value is selected as
+      # well, because PostgreSQL rejects an ORDER BY the select list lacks.
+      #
+      # @return [ActiveRecord::Relation]
+      def with_translation_fallback_order
+        relation = all
+        return relation unless relation.order_values.any? { |node| translated_ordering?(node) }
+
+        relation = relation.select(arel_table[Arel.star]) if relation.distinct_value && relation.select_values.empty?
+        orders = relation.order_values.map do |node|
+          next node unless translated_ordering?(node)
+
+          value = Arel::Nodes::NamedFunction.new('COALESCE', [
+            Arel::Nodes::NamedFunction.new('NULLIF', [node.expr, Arel::Nodes.build_quoted('')]),
+            arel_table[node.expr.name]
+          ])
+          relation = relation.select(Arel::Nodes::As.new(value, Arel.sql('translated_sort'))) if relation.distinct_value
+          node.class.new(value)
+        end
+
+        relation.reorder(orders)
+      end
+
+      private
+
+      def translated_ordering?(node)
+        node.is_a?(Arel::Nodes::Ordering) &&
+          node.expr.is_a?(Mobility::Plugins::Arel::Attribute) &&
+          self <= node.expr.backend_class.model_class
+      end
     end
 
     def get_field_with_locale(locale, field_name, fallback: false)

data/app/models/spree/cart.rb

@@ -179,6 +179,7 @@ module Spree
 
       fulfillment_ids = fulfillments.map(&:id)
       DeliveryRate.where(fulfillment_id: fulfillment_ids).delete_all
+      Spree::ExternalReference.where(resource_type: Spree::Fulfillment.name, resource_id: fulfillment_ids).delete_all if fulfillment_ids.any?
       fulfillments.delete_all
       fulfillment_items.reset
       return fulfillments.reload unless can_propose_deliveries?

data/app/models/spree/delivery_rate.rb

@@ -41,7 +41,7 @@ module Spree
       return price if tax_rate.nil? || tax_amount.zero? || !tax_rate.show_rate_in_label
 
       I18n.t(
-        "spree.shipping_rates.display_price.#{tax_rate.included_in_price? ? :including_tax : :excluding_tax}",
+        "spree.shipping_rates.display_price.#{tax_inclusive? ? :including_tax : :excluding_tax}",
         price: price,
         tax_amount: display_tax_amount,
         tax_rate_name: tax_rate.name
@@ -79,7 +79,7 @@ module Spree
     def tax_amount
       @tax_amount ||= if tax_rate.nil?
                         BigDecimal(0)
-                      elsif tax_rate.included_in_price?
+                      elsif tax_inclusive?
                         Spree::Money::Rounding.to_currency(cost / (1 + tax_rate.amount) * tax_rate.amount, currency)
                       else
                         Spree::Money::Rounding.to_currency(cost * tax_rate.amount, currency)
@@ -90,14 +90,22 @@ module Spree
     #
     # @return [BigDecimal]
     def additional_tax_total
-      tax_rate&.included_in_price? ? BigDecimal(0) : tax_amount
+      tax_rate && tax_inclusive? ? BigDecimal(0) : tax_amount
     end
 
     # Returns the included tax total for the shipping rate
     #
     # @return [BigDecimal]
     def included_tax_total
-      tax_rate&.included_in_price? ? tax_amount : BigDecimal(0)
+      tax_rate && tax_inclusive? ? tax_amount : BigDecimal(0)
+    end
+
+    # Whether the cost already includes its tax, which the sale's market
+    # decides (Spree::Purchase::Taxation#tax_inclusive?).
+    #
+    # @return [Boolean]
+    def tax_inclusive?
+      fulfillment&.owner&.tax_inclusive? || false
     end
 
     alias tax_total tax_amount

data/app/models/spree/delivery_rate_provider/base.rb

@@ -6,7 +6,7 @@ module Spree
     # Stored as a string class name on DeliveryMethod and constantized at call
     # time; registered via Spree.delivery_rate_providers. The Estimator
     # dispatches here in place of calling the calculator directly, so
-    # filtering, VAT gross-up, tax resolution and sorting stay in one place
+    # filtering, markup, tax resolution and sorting stay in one place
     # for every provider.
     #
     # External providers resolve credentials through the delivery method's

data/app/models/spree/delivery_rate_provider/estimate.rb

@@ -2,10 +2,11 @@ module Spree
   module DeliveryRateProvider
     # A single quote returned by a delivery rate provider.
     #
-    # +cost+ is pre-tax and pre-VAT-gross-up: the Estimator applies
-    # +gross_amount+ and resolves the tax rate afterwards, exactly as it does
-    # for calculator output. Everything else is carrier metadata that flows
-    # onto the persisted DeliveryRate.
+    # +cost+ is the quoted price: the Estimator adds markup and resolves the
+    # tax rate afterwards, exactly as it does for calculator output, and the
+    # market decides whether that tax is inside the cost or added on top.
+    # Everything else is carrier metadata that flows onto the persisted
+    # DeliveryRate.
     class Estimate
       include ActiveModel::Model
       include ActiveModel::Attributes

data/app/models/spree/fulfillment.rb

@@ -5,6 +5,7 @@ module Spree
     include Spree::DerivedNumber
     derives_number infix: 'F'
     include Spree::HasCustomFields
+    include Spree::HasExternalReferences
     include Spree::Metadata
     include Spree::StorePreferences
     if defined?(Spree::Security::Shipments)

data/app/models/spree/gateway/bogus.rb

@@ -70,6 +70,13 @@ module Spree
       Spree::PaymentResponse.new(true, 'Bogus Gateway: Forced success', {}, test: true, authorization: generate_authorization)
     end
 
+    # A made-up address, so the dashboard link can be tried without a provider.
+    def gateway_dashboard_payment_url(payment)
+      return if payment.transaction_id.blank?
+
+      "https://dashboard.bogus.example/payments/#{payment.transaction_id}"
+    end
+
     def test?
       # Test mode is not really relevant with bogus gateway (no such thing as live server)
       true

data/app/models/spree/line_item.rb

@@ -3,6 +3,7 @@ module Spree
     has_prefix_id :li  # Spree-specific: line item
 
     include Spree::HasCustomFields
+    include Spree::HasExternalReferences
     include Spree::Metadata
 
     publishes_lifecycle_events
@@ -157,12 +158,6 @@ module Spree
 
     # Assigns the current price without saving — the caller is expected to.
     # {#recalculate_price} persists instead.
-    #
-    # Restatement for a tax-inclusive market happens inside
-    # {Spree::Carts::PriceItems}: an address-less cart still has a taxing
-    # country (its market's own), and without it a cross-border cart is taxed
-    # for the destination at a price quoted for home, leaving the merchant to
-    # absorb the difference.
     # persist: false — runs mid-build and from callers that save the record
     # themselves.
     def update_price
@@ -180,8 +175,8 @@ module Spree
       price_record = Spree::PricingProvider::Internal.new.price_for(context)
       return if price_record.blank?
 
-      # Through the same writer every resolved price goes through, so the
-      # tax-inclusive restatement inputs are stated once.
+      # Through the same writer every resolved price goes through, so a line
+      # built here is priced exactly like a resolved one.
       Spree::Carts::PriceItems.apply([[self, price_record]], persist: false)
     end
 

data/app/models/spree/oauth_access_grant.rb

@@ -0,0 +1,11 @@
+module Spree
+  class OauthAccessGrant < Spree.base_class
+    include ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant
+
+    self.table_name = 'spree_oauth_access_grants'
+
+    belongs_to :application,
+               class_name: 'Spree::OauthApplication',
+               optional: false
+  end
+end

data/app/models/spree/oauth_access_token.rb

@@ -0,0 +1,16 @@
+module Spree
+  # The credential a client sends. Its resource owner is a real user, so a
+  # call carries that person's own permissions resolved fresh on every
+  # request — narrowing a role or deleting the user takes effect immediately,
+  # without touching the token. This is what an API key cannot do: a key is a
+  # standing grant with nobody behind it.
+  class OauthAccessToken < Spree.base_class
+    include ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessToken
+
+    self.table_name = 'spree_oauth_access_tokens'
+
+    belongs_to :application,
+               class_name: 'Spree::OauthApplication',
+               optional: true
+  end
+end

data/app/models/spree/oauth_application.rb

@@ -0,0 +1,97 @@
+module Spree
+  # A registered OAuth client: an MCP client today, a marketplace app or a
+  # merchant-approved integration later. Clients are pre-registered rather
+  # than dynamically registered — RFC 7591 is deprecated, and the consumer
+  # clients worth supporting need no registration endpoint.
+  class OauthApplication < Spree.base_class
+    include ::Doorkeeper::Orm::ActiveRecord::Mixins::Application
+
+    self.table_name = 'spree_oauth_applications'
+
+    has_prefix_id :oauthapp
+
+    belongs_to :store, class_name: 'Spree::Store'
+
+    has_many :access_grants,
+             class_name: 'Spree::OauthAccessGrant',
+             foreign_key: :application_id,
+             dependent: :destroy
+    has_many :access_tokens,
+             class_name: 'Spree::OauthAccessToken',
+             foreign_key: :application_id,
+             dependent: :destroy
+
+    # Tokens that can still produce access.
+    #
+    # Not simply `not_expired`: an access token lasts hours while the refresh
+    # token beside it lasts far longer, so a client whose access has lapsed
+    # can mint another at will. Listing only unexpired access would hide a
+    # connection from the screen that exists to revoke it — the one place a
+    # merchant can actually stop it.
+    has_many :live_access_tokens,
+             -> { where(revoked_at: nil) },
+             class_name: 'Spree::OauthAccessToken',
+             foreign_key: :application_id,
+             inverse_of: :application,
+             dependent: nil
+
+    # Whether anything can still reach the store with this registration.
+    #
+    # The screen lists every registered client, so a row with no live token
+    # may be one nobody has connected yet or one whose access was revoked —
+    # and an empty permission list reads the same either way. A merchant
+    # pressing Revoke has to see that it worked.
+    #
+    # @return [Boolean]
+    def connected?
+      live_access_tokens.any?
+    end
+
+    # What this application may currently do, as permission keys.
+    #
+    # Read from the tokens rather than the registration: a client is
+    # registered once and granted per consent, so the registration's own
+    # `scopes` column stays empty.
+    #
+    # @return [Array<String>]
+    def live_token_scopes
+      live_access_tokens.flat_map { |token| token.scopes.to_a }.uniq.sort
+    end
+
+    # When this application last obtained a token that still works.
+    #
+    # Not the last call it made: a token is minted once and then used for
+    # hours, and nothing records a call. Reporting this as "last used" would
+    # let a merchant read an actively running agent as idle, which is the
+    # opposite of what the connected-apps screen is for.
+    #
+    # @return [ActiveSupport::TimeWithZone, nil]
+    def last_authorized_at
+      live_access_tokens.map(&:created_at).max
+    end
+
+    # Who approved this application's access, and when.
+    #
+    # Read from the oldest live token, because that is the consent still in
+    # force — a later token refreshes an existing grant rather than replacing
+    # who gave it. On the screen that decides whether to revoke, "Claude can
+    # read your orders" is only half the story without the person who allowed
+    # it.
+    #
+    # @return [Object, nil] a {Spree.admin_user_class} record
+    def authorized_by
+      oldest_live_token&.resource_owner
+    end
+
+    # @return [ActiveSupport::TimeWithZone, nil]
+    def authorized_at
+      oldest_live_token&.created_at
+    end
+
+    private
+
+    def oldest_live_token
+      live_access_tokens.min_by(&:created_at)
+    end
+  end
+end

data/app/models/spree/oauth_consent_request.rb

@@ -0,0 +1,23 @@
+module Spree
+  # What a client is asking a merchant to approve, as the consent screen
+  # needs it. Never persisted — approving it writes an
+  # {Spree::OauthAccessGrant} instead.
+  class OauthConsentRequest
+    include ActiveModel::Model
+    include ActiveModel::Attributes
+
+    attribute :client_name, :string
+    # Every permission the requested scopes imply, expanded, so the screen
+    # lists what is actually being handed over rather than the shorthand the
+    # client asked for.
+    attribute :scopes, default: -> { [] }
+    # Of those, the ones this person may hand over. A grant can only narrow
+    # the approver's own authority, so anything they do not hold is not
+    # offered.
+    attribute :grantable_scopes, default: -> { [] }
+    attribute :resource, :string
+    attribute :redirect_uri, :string
+
+    validates :client_name, :redirect_uri, presence: true
+  end
+end

data/app/models/spree/oauth_protected_resource.rb

@@ -0,0 +1,21 @@
+module Spree
+  # RFC 9728 metadata: which authorization server guards a protected surface
+  # and what it will accept. Never persisted — assembled per request, since
+  # the origin a client reached is the one it can use.
+  class OauthProtectedResource
+    include ActiveModel::Model
+    include ActiveModel::Attributes
+
+    attribute :resource, :string
+    attribute :authorization_servers, default: -> { [] }
+    # Exactly what the authorization server accepts. Advertising one scope
+    # more than it knows turns every connection into "the requested scope is
+    # invalid", because a client with no scope challenge asks for everything
+    # listed here.
+    attribute :scopes_supported, default: -> { [] }
+    attribute :bearer_methods_supported, default: -> { ['header'] }
+    attribute :resource_documentation, :string
+
+    validates :resource, presence: true
+  end
+end

data/app/models/spree/oauth_redirect.rb

@@ -0,0 +1,12 @@
+module Spree
+  # Where to send the browser once the merchant has decided, carrying either
+  # the authorization code or the refusal. Never persisted.
+  class OauthRedirect
+    include ActiveModel::Model
+    include ActiveModel::Attributes
+
+    attribute :redirect_uri, :string
+
+    validates :redirect_uri, presence: true
+  end
+end

data/app/models/spree/option_type.rb

@@ -12,6 +12,11 @@ module Spree
 
     TRANSLATABLE_FIELDS = Spree::LabelTranslatable::TRANSLATABLE_FIELDS
 
+    # Option types are managed under the catalog, so the products permission guards them — see Admin::OptionTypesController.
+    def self.translation_write_permission
+      'write_products'
+    end
+
     # Option values are translated alongside their type — the translations
     # endpoint nests their matrices so the editor fetches both in one read.
     def self.translatable_children

data/app/models/spree/option_value.rb

@@ -7,6 +7,11 @@ module Spree
     include Spree::Metadata
     include Spree::LabelTranslatable
 
+    # Values are written through their option type, so they ride the same permission.
+    def self.translation_write_permission
+      'write_products'
+    end
+
     TRANSLATABLE_FIELDS = Spree::LabelTranslatable::TRANSLATABLE_FIELDS
 
     #

data/app/models/spree/order.rb

@@ -51,9 +51,10 @@ module Spree
     include Spree::NumberIdentifier
 
     publishes_lifecycle_events
-    publishes_events :approved, :canceled, :delivered, :fulfilled, :paid, :placed, :shipped,
+    publishes_events :approved, :canceled, :delivered, :fulfilled, :paid, :placed,
                      :resend_confirmation_email, :resend_digital_links_email
     publishes_event :completed, deprecated_alias_of: 'order.placed'
+    publishes_event :shipped, deprecated_alias_of: 'order.fulfilled'
     include Spree::HasCustomFields
     include Spree::Metadata
     include Spree::HasExternalReferences
@@ -920,6 +921,9 @@ module Spree
 
       shipment_ids = fulfillments.map(&:id)
       DeliveryRate.where(fulfillment_id: shipment_ids).delete_all
+      # A connector's key for a fulfillment that is going away would otherwise
+      # outlive it and block the key from naming the rebuilt one.
+      Spree::ExternalReference.where(resource_type: Spree::Fulfillment.name, resource_id: shipment_ids).delete_all if shipment_ids.any?
 
       fulfillments.delete_all
 

data/app/models/spree/payment.rb

@@ -326,16 +326,28 @@ module Spree
       true
     end
 
+    # Matches +Payment.risky+: any result other than a match counts, whatever
+    # message the gateway sent with it.
     def is_cvv_risky?
       return false if cvv_response_code == 'M'
       return false if cvv_response_code.nil?
-      return false if cvv_response_message.present?
 
       true
     end
 
+    # The payment's page in the provider's dashboard. Only https links are
+    # returned, since staff open it from the admin and a gateway may build it
+    # from values the provider sent back.
+    #
+    # @return [String, nil]
     def gateway_dashboard_payment_url
-      payment_method.try(:gateway_dashboard_payment_url, self)
+      url = payment_method.try(:gateway_dashboard_payment_url, self)
+      return if url.blank?
+
+      uri = URI.parse(url)
+      url if uri.is_a?(URI::HTTPS) && uri.host.present?
+    rescue URI::InvalidURIError
+      nil
     end
 
     def captured_amount

data/app/models/spree/payment_capture_event.rb

@@ -4,6 +4,8 @@ module Spree
 
     belongs_to :payment, class_name: 'Spree::Payment'
 
+    delegate :currency, to: :payment
+
     def display_amount
       Spree::Money.new(amount, currency: payment.currency)
     end

data/app/models/spree/policy.rb

@@ -4,6 +4,12 @@ module Spree
 
     extend FriendlyId
     include Spree::TranslatableResource
+
+    # Policies are store settings — see Admin::PoliciesController.
+    def self.translation_write_permission
+      'write_settings'
+    end
+
     include Spree::SanitizableRichText
 
     UNIQUENESS_SCOPE = %i[owner_id owner_type].freeze