spree_core 6.0.0.rc2 → 6.0.0.rc4

data/lib/spree/core/controller_helpers/store.rb

@@ -37,19 +37,9 @@ module Spree
 
         # Return a Hash of things that influence the prices displayed in your shop.
         #
-        # By default, the only thing that influences prices is the country whose tax applies (to
-        # facilitate differing prices depending on VAT rate for digital products in Europe, see
-        # https://github.com/spree/spree/pull/6295 and https://github.com/spree/spree/pull/6662).
-        #
-        # If your prices depend on something else, overwrite this method and add
-        # more key/value pairs to the Hash it returns.
-        #
-        # Be careful though to also patch the following parts of Spree accordingly:
-        #
-        # * `Spree::VatPriceCalculation#gross_amount`
-        # * `Spree::LineItem#update_price`
-        # * `Spree::Stock::Estimator#taxation_options_for`
-        #
+        # By default that is the country whose tax applies. If your prices depend
+        # on something else, overwrite this method and add more key/value pairs
+        # to the Hash it returns.
         def current_price_options
           {
             country: current_tax_country

data/lib/spree/core/dependencies.rb

@@ -70,6 +70,11 @@ module Spree
         order_fee_create_service: 'Spree::Orders::Fees::Create',
         order_fee_update_service: 'Spree::Orders::Fees::Update',
         order_fee_destroy_service: 'Spree::Orders::Fees::Destroy',
+        # A workflow since 6.0: its `perform` signature is what the agent
+        # tools derive their schema from, which a service's opaque `params`
+        # hash could not provide. The `_service` key still resolves it, so a
+        # host app that overrode or called it keeps working.
+        order_create_workflow: 'Spree::Orders::Create',
         order_create_service: 'Spree::Orders::Create',
         order_create_from_cart_service: 'Spree::Orders::CreateFromCart',
         order_update_service: 'Spree::Orders::Update',
@@ -98,6 +103,10 @@ module Spree
 
         # inventory operations
         stock_level_correct_service: 'Spree::StockLevels::Correct',
+        # A workflow since 6.0: its signature is what the agent tool derives
+        # its schema from, which `Spree::ServiceModule` could not provide.
+        # The `_service` key still resolves it.
+        stock_level_bulk_upsert_workflow: 'Spree::StockLevels::BulkUpsert',
         stock_level_bulk_upsert_service: 'Spree::StockLevels::BulkUpsert',
         stock_level_recount_service: 'Spree::StockLevels::Recount',
         stock_transfer_create_workflow: 'Spree::StockTransfers::Create',

data/lib/spree/core/engine.rb

@@ -43,6 +43,8 @@ module Spree
                                :actor_classes,
                                :custom_fields,
                                :reporting,
+                               :admin_agent_tools,
+                               :store_agent_tools,
                                :integrations,
                                :number_generators,
                                :subscribers,
@@ -158,6 +160,20 @@ module Spree
         Spree::Reporting::DefaultVocabulary.install(app.config.spree.reporting)
       end
 
+      # Seed the agent-tool registry before app initializers so applications
+      # and extensions can register their own tools and expose their own
+      # workflows in config/initializers (see docs/plans/6.0-mcp-server.md).
+      # One registry per surface, the way the authentication strategies are
+      # split: a storefront agent and a back-office agent share the tool
+      # machinery but never the catalog, and a staff tool reaching a customer
+      # would be offering the back office to the public.
+      initializer 'spree.register.agent_tools', before: :load_config_initializers do |app|
+        app.config.spree.admin_agent_tools = Spree::AgentTools::Registry.new(audience: :admin)
+        app.config.spree.store_agent_tools = Spree::AgentTools::Registry.new(audience: :store)
+        Spree::AgentTools::DefaultCatalog.install(app.config.spree.admin_agent_tools)
+      end
+
+
       # Country and subdivision names are translated by the countries gem, which
       # only loads the locales it is told about. This runs after initialization
       # because Spree.available_locales reads i18n configuration that is not
@@ -587,7 +603,14 @@ module Spree
           :verification_value,
           :client_id,
           :client_secret,
-          :refresh_token
+          :refresh_token,
+          # The OAuth token exchange posts these. The code is single-use and
+          # spent the moment it is logged, but the verifier beside it is what
+          # PKCE relies on — logging both hands anyone who can read the log
+          # everything they need to race the exchange.
+          :code,
+          :code_verifier,
+          :code_challenge
         ]
       end
 
@@ -613,6 +636,13 @@ module Spree
         end
       end
 
+      # The same contexts, for the concerns extensions add to core models.
+      initializer 'spree.model_extensions.schedule_apply', after: :load_config_initializers do |app|
+        app.config.after_initialize do
+          Spree.model_extensions.apply
+        end
+      end
+
       # A hook registered against a key no workflow declares would never fire
       # and never say so. Checking after eager load turns that typo into a
       # boot failure. Skipped when eager loading is off (development,
@@ -630,6 +660,10 @@ module Spree
         ActsAsTaggableOn::Tag.include(Spree::RansackableAttributes)
         ActsAsTaggableOn::Tag.whitelisted_ransackable_attributes = %w[id name]
 
+        # Reloading makes new model classes, which have none of the
+        # extensions' concerns yet.
+        Spree.model_extensions.apply
+
         # Reset and re-activate event subscribers on code reload
         # activate! will register all subscribers from Spree.subscribers
         # Note: resolve_subscriber in register_subscribers! handles stale class references

data/lib/spree/core/model_extensions.rb

@@ -0,0 +1,111 @@
+module Spree
+  # Adds an extension's own methods, associations, scopes and validations to
+  # core models without a decorator.
+  #
+  # An extension writes an ordinary concern and registers it against the
+  # model by name. Spree includes it, so the model's own methods still win:
+  # an extension adds to a model, it never replaces what the model does.
+  # A concern that would shadow a method, attribute or association the model
+  # already has is refused at boot, naming both, where a decorator would
+  # overwrite it quietly.
+  #
+  # Registrations are kept as names and included again each time code is
+  # reloaded, so development reloading keeps them.
+  #
+  # @example
+  #   Spree.model_extensions.add('Spree::Product', 'MyExtension::ProductWarranty')
+  #   Spree.model_extensions.add(:customer, 'MyExtension::CustomerWarranties')
+  class ModelExtensions
+    class Conflict < StandardError; end
+
+    # The configured customer and admin user classes, which an extension cannot know by name.
+    USER_MODELS = { customer: -> { Spree.customer_class }, admin_user: -> { Spree.admin_user_class } }.freeze
+
+    def initialize
+      @extensions = Hash.new { |hash, key| hash[key] = [] }
+      @prepared = false
+    end
+
+    # @param model [String, Symbol] the model's class name, e.g. +'Spree::Product'+, or +:customer+ / +:admin_user+
+    # @param extension [String, Module] the concern to include
+    # @raise [ArgumentError] for a symbol other than +:customer+ and +:admin_user+
+    # @raise [Conflict] when the concern would shadow something the model already has
+    # @return [void]
+    def add(model, extension)
+      key = key_for(model)
+      name = extension.is_a?(Module) ? extension.name : extension.to_s
+      @extensions[key] |= [name]
+      apply_to(key, name) if @prepared
+    end
+
+    # @param model [String, Symbol]
+    # @return [Array<String>] the concerns registered for the model
+    def for(model)
+      @extensions.fetch(key_for(model), []).dup
+    end
+
+    # Includes every registered concern. Spree runs it each time code is
+    # loaded; a registration made after that is included straight away.
+    #
+    # @return [void]
+    def apply
+      @prepared = true
+      @extensions.each { |key, names| names.each { |name| apply_to(key, name) } }
+    end
+
+    private
+
+    def key_for(model)
+      return model.to_s unless model.is_a?(Symbol)
+      return model if USER_MODELS.key?(model)
+
+      raise ArgumentError, "#{model} is not a model: pass its class name, or :customer or :admin_user"
+    end
+
+    def resolve(key)
+      key.is_a?(Symbol) ? USER_MODELS.fetch(key).call : key.constantize
+    end
+
+    def apply_to(key, name)
+      model = resolve(key)
+      extension = name.constantize
+      return if model.include?(extension)
+
+      refuse_shadowed_methods!(model, extension)
+      existing = model.instance_methods
+      reflections = model.reflections.dup
+      model.include(extension)
+
+      # Associations are declared in the concern's +included+ block, so they
+      # are only known once it has run: one it declared or redeclared there
+      # must not take a name the model already answers to.
+      declared = model.reflections.reject { |name, reflection| reflections[name].equal?(reflection) }.keys
+      shadowed = declared.find { |name| reflections.key?(name) || existing.include?(name.to_sym) || attribute?(model, name) }
+      raise_conflict(model, extension, shadowed) if shadowed
+    end
+
+    def refuse_shadowed_methods!(model, extension)
+      methods = extension.instance_methods(false) + extension.private_instance_methods(false)
+      taken = methods.find { |method| model.method_defined?(method) || model.private_method_defined?(method) || attribute?(model, method) }
+      raise_conflict(model, extension, taken) if taken
+
+      return unless extension.const_defined?(:ClassMethods, false)
+
+      taken = extension::ClassMethods.instance_methods(false).find { |method| model.respond_to?(method, true) }
+      raise_conflict(model, extension, taken) if taken
+    end
+
+    # Attribute methods are generated on first use, so a column is checked by
+    # name. Without a database to read the columns from, as when assets are
+    # compiled, there are none to shadow.
+    def attribute?(model, method)
+      model.attribute_names.include?(method.to_s.delete_suffix('='))
+    rescue ActiveRecord::ActiveRecordError
+      false
+    end
+
+    def raise_conflict(model, extension, method)
+      raise Conflict, "#{extension.name} would replace #{model.name}##{method}, which the model already has"
+    end
+  end
+end

data/lib/spree/core/permissions/default_catalog.rb

@@ -167,7 +167,7 @@ module Spree
            Spree::StockLocation, Spree::DeliveryProfile,
            Spree::Market, Spree::TaxCategory, Spree::TaxRate, Spree::AllowedOrigin,
            Spree::RefundReason, Spree::ReturnReason, Spree::ClaimReason,
-           Spree::OrderCancellationReason, Spree::Channel,
+           Spree::OrderCancellationReason, Spree::TaxExemptionReason, Spree::Channel,
            Spree::OrderRoutingRule, Spree::CustomFieldDefinition, Spree::Policy]
         })
 
@@ -202,6 +202,11 @@ module Spree
         catalog.register_scope(:integrations, group: :settings, resources: -> { [Spree::Integration] })
 
         catalog.register_scope(:api_keys, group: :access, resources: -> { [Spree::ApiKey] })
+        # Connecting an AI agent hands a third party a standing credential to
+        # the store, so it is its own permission rather than part of settings
+        # — a merchandiser who may edit a delivery zone is not thereby someone
+        # who may connect Claude to the back office.
+        catalog.register_scope(:oauth_applications, group: :access, resources: -> { [Spree::OauthApplication] })
         catalog.register_scope(:staff, group: :access, resources: -> {
           [Spree.admin_user_class, Spree::Invitation, Spree::Role, Spree::RoleUser]
         })

data/lib/spree/core/pricing/price_resolution.rb

@@ -103,10 +103,10 @@ module Spree
       def stamp(price)
         return if price.blank?
 
-        # The context always knows the variant, and the tax-inclusive
-        # restatement reads it — a provider that builds a Price without one
-        # would otherwise fail deep in that call with an obscure NoMethodError
-        # rather than anywhere near the provider that omitted it.
+        # The context always knows the variant, and everything downstream
+        # reads it — a provider that builds a Price without one would otherwise
+        # fail far from the provider that omitted it, with an obscure
+        # NoMethodError.
         price.variant ||= context.variant
         price.readonly!
         price.price_source = provider.class.key

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '6.0.0.rc2'.freeze
+  VERSION = '6.0.0.rc4'.freeze
 
   def self.version
     VERSION

data/lib/spree/core.rb

@@ -15,6 +15,10 @@ require 'alba'
 require 'acts-as-taggable-on'
 require 'awesome_nested_set'
 require 'cancan'
+# The OAuth models include Doorkeeper's mixins, so the gem has to be loaded
+# before they are autoloaded — core owns the tables, api owns the server
+# configuration.
+require 'doorkeeper'
 require 'countries/global'
 require 'friendly_id'
 require 'json_schemer'
@@ -358,7 +362,6 @@ module Spree
   # @return [Class]
   singleton_class.delegate :password_validator, :password_validator=, to: :spree_config
 
-
   # Commission rule kinds selectable on a commission rate.
   #
   # @return [Array<Class>]
@@ -512,6 +515,15 @@ module Spree
   # @return [Spree::Reporting::Registry]
   singleton_class.delegate :reporting, :reporting=, to: :spree_config
 
+  # The agent-tool registry — what an MCP client or the dashboard assistant
+  # may do on a merchant's behalf. A contract like +Spree.integrations+ and
+  # +Spree.reporting+: an extension registers a tool without depending on
+  # either adapter. See docs/plans/6.0-mcp-server.md.
+  #
+  # @return [Spree::AgentTools::Registry]
+  singleton_class.delegate :admin_agent_tools, :admin_agent_tools=, to: :spree_config
+  singleton_class.delegate :store_agent_tools, :store_agent_tools=, to: :spree_config
+
   # The permission catalog — the grant vocabulary shared by staff roles and
   # secret API key scopes. Roles themselves are data (Spree::Role#permissions);
   # code only registers the vocabulary.
@@ -539,6 +551,16 @@ module Spree
     @ransack ||= RansackConfiguration.new
   end
 
+  # Concerns extensions add to core models, instead of decorating them.
+  #
+  # @example
+  #   Spree.model_extensions.add('Spree::Product', 'MyExtension::ProductWarranty')
+  #
+  # @return [Spree::ModelExtensions]
+  def self.model_extensions
+    @model_extensions ||= ModelExtensions.new
+  end
+
   class << self
     # Dynamic methods for core dependencies
     #
@@ -634,6 +656,8 @@ require 'spree/money'
 require 'spree/service_module'
 require 'spree/workflow'
 require 'spree/reporting'
+require 'spree/agent_tool'
+require 'spree/agent_tools'
 require 'spree/events'
 require 'spree/store_scope_guard'
 require 'spree/uploads'
@@ -655,8 +679,9 @@ require 'spree/core/preferences/invalid_preferences'
 require 'spree/core/preferences/json_conversion'
 
 require 'spree/core/permission_configuration'
+require 'spree/core/model_extensions'
 require 'spree/core/ransack_configuration'
 require 'spree/core/pricing/context'
 require 'spree/core/pricing/price_resolution'
-require 'spree/core/pricing/resolver'
 require 'spree/core/tax/provider_error'
+require 'spree/core/pricing/resolver'

data/lib/spree/service_module.rb

@@ -26,10 +26,21 @@ module Spree
     ResultError = Struct.new(:value) do
       def to_s
         return value.full_messages.join(', ') if value&.respond_to?(:full_messages)
+        # A failure carrying a code beside its message (`failure(cart, code:,
+        # message:)`) reads as the message, not as the hash it travels in.
+        return value[:message].to_s if value.is_a?(Hash) && value.key?(:message)
 
         value.to_s
       end
 
+      # The machine-readable reason a failure named, when it named one, so a
+      # caller can answer an outage differently from a refusal.
+      #
+      # @return [String, nil]
+      def code
+        value[:code]&.to_s if value.is_a?(Hash)
+      end
+
       def to_h
         return value.messages if value&.respond_to?(:messages)
 

data/lib/spree/testing_support/factories/tax_exemption_certificate_factory.rb

@@ -2,9 +2,21 @@ FactoryBot.define do
   factory :tax_exemption_certificate, class: Spree::TaxExemptionCertificate do
     company
     sequence(:certificate_number) { |n| "CERT-#{n}" }
-    reason_code { 'resale' }
     status { 'pending' }
 
+    transient do
+      reason_code { 'RESALE' }
+    end
+
+    # A certificate may only record a reason its store offers, so the reason
+    # is found or created in the company's store for whichever code a spec
+    # picks.
+    tax_exemption_reason do
+      company.store.tax_exemption_reasons.find_or_create_by!(code: reason_code.to_s.upcase) do |reason|
+        reason.name = reason_code.to_s.humanize
+      end
+    end
+
     trait :verified do
       status { 'verified' }
       verified_at { Time.current }

data/lib/spree/testing_support/factories/tax_exemption_reason_factory.rb

@@ -0,0 +1,8 @@
+FactoryBot.define do
+  factory :tax_exemption_reason, class: Spree::TaxExemptionReason do
+    store { Spree::Store.find_by(default: true) || association(:store) }
+    sequence(:name) { |n| "Tax Exemption Reason #{n}" }
+    sequence(:code) { |n| "REASON_#{n}" }
+    active { true }
+  end
+end

data/lib/spree/upgrades/5_6_to_6_0/manifest.yml

@@ -470,6 +470,28 @@ steps:
       once several stores hold tax configuration. The NOT NULL constraints land
       in 6.1. Idempotent.
 
+  - id: backfill_market_tax_inclusive
+    name: "Decide whether each market's prices include tax"
+    task: "spree:markets:backfill_tax_inclusive"
+    notes: |
+      In Spree 6 the market decides whether its prices include tax; tax rates
+      no longer carry an "included in price" flag. Each market takes the
+      convention its rates had: all included sets it to include tax, all added
+      on top sets it to add tax at checkout, and a market with no rates keeps
+      its setting. A market whose rates mixed the two is left unchanged and
+      named in the output, to be set by hand.
+
+      Prices are no longer adjusted for buyers abroad. A store that had a
+      default tax zone in 5.x and prices including tax now charges buyers
+      outside that zone the price as entered, with their own tax inside it.
+      Prices with tax added on top were never adjusted, and still have tax
+      added at checkout.
+
+      Run after migrate_tax_zones and backfill_tax_store_ids, which give each
+      rate its country and store; it stops if a rate still has no store.
+      Idempotent: each rate's old flag is read once and then cleared, so a
+      re-run leaves every market as it is.
+
   - id: backfill_order_coupon_codes
     name: "Backfill coupon codes on placed orders"
     task: "spree:backfill_order_coupon_codes"
@@ -683,6 +705,22 @@ steps:
       Idempotent — a store that already has a default package type is left
       alone, so a box edited since the upgrade is never overwritten.
 
+  - id: tax_exemption_reasons
+    name: "Give every store the default tax exemption reasons and link certificates to them"
+    task: "spree:upgrade:tax_exemption_reasons"
+    notes: |
+      Company tax exemption certificates point at one of the store's
+      exemption reasons, so a store without any cannot record a certificate.
+      Existing reason codes are saved in capitals, the way tax engines compare
+      them. Certificates recorded before reasons existed are linked to the
+      reason matching their old reason code; a code no reason holds gets a
+      reason of its own. Merchants using an external tax engine change each
+      reason's code to that engine's under Settings → Taxes → Exemption
+      reasons.
+
+      Idempotent — a reason the merchant already has under the same code or
+      name is left alone, and a certificate already linked is skipped.
+
   - id: migrate_external_receives_to_purchase_orders
     name: "Turn 5.x supplier receives into purchase orders, and give every transfer a store"
     task: "spree:upgrade:migrate_external_receives_to_purchase_orders"

data/lib/tasks/markets.rake

@@ -42,5 +42,52 @@ namespace :spree do
         puts "  Created market '#{market.name}' with #{countries.size} countries for store '#{store.name}' (#{store.code})"
       end
     end
+
+    desc "Set each market's tax_inclusive from whether its tax rates were included in the price"
+    task backfill_tax_inclusive: :environment do
+      # A rate with no store is one spree:backfill_tax_store_ids has not bound
+      # yet, and a market decided without it would be decided on part of its rates.
+      if Spree::TaxRate.with_deleted.where(store_id: nil).where.not(included_in_price: nil).exists?
+        abort '  Some tax rates have no store yet. Run spree:backfill_tax_store_ids first, then run this again.'
+      end
+
+      updated = 0
+      mixed = []
+
+      Spree::Store.find_each do |store|
+        # Each rate's old flag is read once and then cleared, so a re-run finds
+        # nothing to read and cannot undo a market the merchant changed since.
+        legacy_rates = Spree::TaxRate.with_deleted.where(store_id: store.id).where.not(included_in_price: nil)
+        next unless legacy_rates.exists?
+
+        ActiveRecord::Base.transaction do
+          store.markets.includes(:market_countries).find_each do |market|
+            # A rate with no country taxes every market's countries.
+            conventions = legacy_rates.where(deleted_at: nil, country_code: market.country_codes + [nil]).
+                          distinct.pluck(:included_in_price)
+            next if conventions.empty?
+
+            if conventions.size > 1
+              mixed << market
+              next
+            end
+            next if market.tax_inclusive == conventions.first
+
+            market.update_columns(tax_inclusive: conventions.first, updated_at: Time.current)
+            updated += 1
+          end
+
+          legacy_rates.update_all(included_in_price: nil)
+          store.touch
+        end
+      end
+
+      puts "  Set tax_inclusive on #{updated} market(s) from their tax rates."
+
+      mixed.each do |market|
+        puts "  ! Left '#{market.name}' (store #{market.store.code}) unchanged: some of its rates were included in " \
+             "the price and some added on top. Set whether its prices include tax in the dashboard."
+      end
+    end
   end
 end

data/lib/tasks/tax_exemption_reasons.rake

@@ -0,0 +1,48 @@
+namespace :spree do
+  namespace :upgrade do
+    desc <<~DESC
+      Gives every store the default tax exemption reasons, saves existing
+      reason codes in capitals, and links each existing certificate to the
+      reason matching its old reason code (Spree 6.0).
+
+      A code no reason holds gets a reason of its own, named after the code.
+      Idempotent: reasons the merchant already has are left alone, and a
+      certificate already linked is skipped.
+    DESC
+    task tax_exemption_reasons: :environment do
+      # Codes are stored in capitals since tax engines compare them that way;
+      # a lookup by code reads capitals too, so a lower-case row would never
+      # be found again. Runs before seeding so the seed finds these by code.
+      Spree::TaxExemptionReason.find_each do |reason|
+        code = Spree::TaxExemptionReason.normalize_value_for(:code, reason.code)
+        next if code == reason.code
+
+        if Spree::TaxExemptionReason.where(store_id: reason.store_id).where.not(id: reason.id).exists?(code: code)
+          puts "  Left tax exemption reason #{reason.prefixed_id} as #{reason.code}: #{code} is taken in its store"
+        else
+          reason.update_columns(code: code, updated_at: Time.current)
+        end
+      end
+
+      Spree::Store.find_each do |store|
+        Spree::Seeds::TaxExemptionReasons.call(store: store)
+      end
+
+      linked = 0
+
+      Spree::TaxExemptionCertificate.where(tax_exemption_reason_id: nil).where.not(reason_code: [nil, '']).
+        includes(company: :store).find_each do |certificate|
+        reasons = certificate.company.store.tax_exemption_reasons
+        code = Spree::TaxExemptionReason.normalize_value_for(:code, certificate.reason_code)
+        name = code.humanize
+        name = "#{name} (#{code})" if reasons.where.not(code: code).exists?(name: name)
+
+        reason = reasons.find_or_create_by!(code: code) { |new_reason| new_reason.name = name }
+        certificate.update_columns(tax_exemption_reason_id: reason.id, updated_at: Time.current)
+        linked += 1
+      end
+
+      puts "  Linked #{linked} tax exemption certificate(s) to their reason" if linked.positive?
+    end
+  end
+end