spree_core 6.0.0.rc3 → 6.0.0.rc5

data/app/models/spree/oauth_access_grant.rb

@@ -0,0 +1,11 @@
+module Spree
+  class OauthAccessGrant < Spree.base_class
+    include ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant
+
+    self.table_name = 'spree_oauth_access_grants'
+
+    belongs_to :application,
+               class_name: 'Spree::OauthApplication',
+               optional: false
+  end
+end

data/app/models/spree/oauth_access_token.rb

@@ -0,0 +1,16 @@
+module Spree
+  # The credential a client sends. Its resource owner is a real user, so a
+  # call carries that person's own permissions resolved fresh on every
+  # request — narrowing a role or deleting the user takes effect immediately,
+  # without touching the token. This is what an API key cannot do: a key is a
+  # standing grant with nobody behind it.
+  class OauthAccessToken < Spree.base_class
+    include ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessToken
+
+    self.table_name = 'spree_oauth_access_tokens'
+
+    belongs_to :application,
+               class_name: 'Spree::OauthApplication',
+               optional: true
+  end
+end

data/app/models/spree/oauth_application.rb

@@ -0,0 +1,97 @@
+module Spree
+  # A registered OAuth client: an MCP client today, a marketplace app or a
+  # merchant-approved integration later. Clients are pre-registered rather
+  # than dynamically registered — RFC 7591 is deprecated, and the consumer
+  # clients worth supporting need no registration endpoint.
+  class OauthApplication < Spree.base_class
+    include ::Doorkeeper::Orm::ActiveRecord::Mixins::Application
+
+    self.table_name = 'spree_oauth_applications'
+
+    has_prefix_id :oauthapp
+
+    belongs_to :store, class_name: 'Spree::Store'
+
+    has_many :access_grants,
+             class_name: 'Spree::OauthAccessGrant',
+             foreign_key: :application_id,
+             dependent: :destroy
+    has_many :access_tokens,
+             class_name: 'Spree::OauthAccessToken',
+             foreign_key: :application_id,
+             dependent: :destroy
+
+    # Tokens that can still produce access.
+    #
+    # Not simply `not_expired`: an access token lasts hours while the refresh
+    # token beside it lasts far longer, so a client whose access has lapsed
+    # can mint another at will. Listing only unexpired access would hide a
+    # connection from the screen that exists to revoke it — the one place a
+    # merchant can actually stop it.
+    has_many :live_access_tokens,
+             -> { where(revoked_at: nil) },
+             class_name: 'Spree::OauthAccessToken',
+             foreign_key: :application_id,
+             inverse_of: :application,
+             dependent: nil
+
+    # Whether anything can still reach the store with this registration.
+    #
+    # The screen lists every registered client, so a row with no live token
+    # may be one nobody has connected yet or one whose access was revoked —
+    # and an empty permission list reads the same either way. A merchant
+    # pressing Revoke has to see that it worked.
+    #
+    # @return [Boolean]
+    def connected?
+      live_access_tokens.any?
+    end
+
+    # What this application may currently do, as permission keys.
+    #
+    # Read from the tokens rather than the registration: a client is
+    # registered once and granted per consent, so the registration's own
+    # `scopes` column stays empty.
+    #
+    # @return [Array<String>]
+    def live_token_scopes
+      live_access_tokens.flat_map { |token| token.scopes.to_a }.uniq.sort
+    end
+
+    # When this application last obtained a token that still works.
+    #
+    # Not the last call it made: a token is minted once and then used for
+    # hours, and nothing records a call. Reporting this as "last used" would
+    # let a merchant read an actively running agent as idle, which is the
+    # opposite of what the connected-apps screen is for.
+    #
+    # @return [ActiveSupport::TimeWithZone, nil]
+    def last_authorized_at
+      live_access_tokens.map(&:created_at).max
+    end
+
+    # Who approved this application's access, and when.
+    #
+    # Read from the oldest live token, because that is the consent still in
+    # force — a later token refreshes an existing grant rather than replacing
+    # who gave it. On the screen that decides whether to revoke, "Claude can
+    # read your orders" is only half the story without the person who allowed
+    # it.
+    #
+    # @return [Object, nil] a {Spree.admin_user_class} record
+    def authorized_by
+      oldest_live_token&.resource_owner
+    end
+
+    # @return [ActiveSupport::TimeWithZone, nil]
+    def authorized_at
+      oldest_live_token&.created_at
+    end
+
+    private
+
+    def oldest_live_token
+      live_access_tokens.min_by(&:created_at)
+    end
+  end
+end

data/app/models/spree/oauth_consent_request.rb

@@ -0,0 +1,23 @@
+module Spree
+  # What a client is asking a merchant to approve, as the consent screen
+  # needs it. Never persisted — approving it writes an
+  # {Spree::OauthAccessGrant} instead.
+  class OauthConsentRequest
+    include ActiveModel::Model
+    include ActiveModel::Attributes
+
+    attribute :client_name, :string
+    # Every permission the requested scopes imply, expanded, so the screen
+    # lists what is actually being handed over rather than the shorthand the
+    # client asked for.
+    attribute :scopes, default: -> { [] }
+    # Of those, the ones this person may hand over. A grant can only narrow
+    # the approver's own authority, so anything they do not hold is not
+    # offered.
+    attribute :grantable_scopes, default: -> { [] }
+    attribute :resource, :string
+    attribute :redirect_uri, :string
+
+    validates :client_name, :redirect_uri, presence: true
+  end
+end

data/app/models/spree/oauth_protected_resource.rb

@@ -0,0 +1,21 @@
+module Spree
+  # RFC 9728 metadata: which authorization server guards a protected surface
+  # and what it will accept. Never persisted — assembled per request, since
+  # the origin a client reached is the one it can use.
+  class OauthProtectedResource
+    include ActiveModel::Model
+    include ActiveModel::Attributes
+
+    attribute :resource, :string
+    attribute :authorization_servers, default: -> { [] }
+    # Exactly what the authorization server accepts. Advertising one scope
+    # more than it knows turns every connection into "the requested scope is
+    # invalid", because a client with no scope challenge asks for everything
+    # listed here.
+    attribute :scopes_supported, default: -> { [] }
+    attribute :bearer_methods_supported, default: -> { ['header'] }
+    attribute :resource_documentation, :string
+
+    validates :resource, presence: true
+  end
+end

data/app/models/spree/oauth_redirect.rb

@@ -0,0 +1,12 @@
+module Spree
+  # Where to send the browser once the merchant has decided, carrying either
+  # the authorization code or the refusal. Never persisted.
+  class OauthRedirect
+    include ActiveModel::Model
+    include ActiveModel::Attributes
+
+    attribute :redirect_uri, :string
+
+    validates :redirect_uri, presence: true
+  end
+end

data/app/models/spree/option_type.rb

@@ -12,6 +12,11 @@ module Spree
 
     TRANSLATABLE_FIELDS = Spree::LabelTranslatable::TRANSLATABLE_FIELDS
 
+    # Option types are managed under the catalog, so the products permission guards them — see Admin::OptionTypesController.
+    def self.translation_write_permission
+      'write_products'
+    end
+
     # Option values are translated alongside their type — the translations
     # endpoint nests their matrices so the editor fetches both in one read.
     def self.translatable_children

data/app/models/spree/option_value.rb

@@ -7,6 +7,11 @@ module Spree
     include Spree::Metadata
     include Spree::LabelTranslatable
 
+    # Values are written through their option type, so they ride the same permission.
+    def self.translation_write_permission
+      'write_products'
+    end
+
     TRANSLATABLE_FIELDS = Spree::LabelTranslatable::TRANSLATABLE_FIELDS
 
     #

data/app/models/spree/order.rb

@@ -51,9 +51,10 @@ module Spree
     include Spree::NumberIdentifier
 
     publishes_lifecycle_events
-    publishes_events :approved, :canceled, :delivered, :fulfilled, :paid, :placed, :shipped,
+    publishes_events :approved, :canceled, :delivered, :fulfilled, :paid, :placed,
                      :resend_confirmation_email, :resend_digital_links_email
     publishes_event :completed, deprecated_alias_of: 'order.placed'
+    publishes_event :shipped, deprecated_alias_of: 'order.fulfilled'
     include Spree::HasCustomFields
     include Spree::Metadata
     include Spree::HasExternalReferences
@@ -151,7 +152,7 @@ module Spree
     self.whitelisted_ransackable_attributes = %w[
       completed_at email number status payment_status payment_state fulfillment_status shipment_state delivery_total
       total item_total total_quantity considered_risky channel_id currency coupon_code customer_id seller_id
-      order_group_id po_number
+      order_group_id po_number market_id locale
     ]
     self.whitelisted_ransackable_scopes = %w[complete incomplete refunded partially_refunded search]
     self.ransackable_scope_types = %w[complete incomplete refunded partially_refunded].index_with('boolean')
@@ -920,6 +921,9 @@ module Spree
 
       shipment_ids = fulfillments.map(&:id)
       DeliveryRate.where(fulfillment_id: shipment_ids).delete_all
+      # A connector's key for a fulfillment that is going away would otherwise
+      # outlive it and block the key from naming the rebuilt one.
+      Spree::ExternalReference.where(resource_type: Spree::Fulfillment.name, resource_id: shipment_ids).delete_all if shipment_ids.any?
 
       fulfillments.delete_all
 

data/app/models/spree/payment.rb

@@ -326,16 +326,28 @@ module Spree
       true
     end
 
+    # Matches +Payment.risky+: any result other than a match counts, whatever
+    # message the gateway sent with it.
     def is_cvv_risky?
       return false if cvv_response_code == 'M'
       return false if cvv_response_code.nil?
-      return false if cvv_response_message.present?
 
       true
     end
 
+    # The payment's page in the provider's dashboard. Only https links are
+    # returned, since staff open it from the admin and a gateway may build it
+    # from values the provider sent back.
+    #
+    # @return [String, nil]
     def gateway_dashboard_payment_url
-      payment_method.try(:gateway_dashboard_payment_url, self)
+      url = payment_method.try(:gateway_dashboard_payment_url, self)
+      return if url.blank?
+
+      uri = URI.parse(url)
+      url if uri.is_a?(URI::HTTPS) && uri.host.present?
+    rescue URI::InvalidURIError
+      nil
     end
 
     def captured_amount

data/app/models/spree/payment_capture_event.rb

@@ -4,6 +4,8 @@ module Spree
 
     belongs_to :payment, class_name: 'Spree::Payment'
 
+    delegate :currency, to: :payment
+
     def display_amount
       Spree::Money.new(amount, currency: payment.currency)
     end

data/app/models/spree/policy.rb

@@ -4,6 +4,12 @@ module Spree
 
     extend FriendlyId
     include Spree::TranslatableResource
+
+    # Policies are store settings — see Admin::PoliciesController.
+    def self.translation_write_permission
+      'write_settings'
+    end
+
     include Spree::SanitizableRichText
 
     UNIQUENESS_SCOPE = %i[owner_id owner_type].freeze

data/app/models/spree/price.rb

@@ -9,7 +9,6 @@ module Spree
 
     has_prefix_id :price
 
-    include Spree::VatPriceCalculation
     include Spree::StorePreferences
     include Spree::CanonicalDecimals
 
@@ -135,44 +134,28 @@ module Spree
     alias_attribute :price, :amount
     alias_attribute :compare_at_price, :compare_at_amount
 
-    # Whether this figure is the merchant's answer for the buyer's geography
-    # already. A price list narrowed by market or country states its prices for
-    # that geography, so they are charged exactly as entered — restating one would
-    # net it out with the *home* rate and destroy the price point the merchant
-    # chose. Lists narrowed by anything else (a quantity, a group) were not set
-    # for a country, so their prices restate like any other.
-    #
-    # @return [Boolean]
-    def final_for_destination?
-      rules = price_list&.price_rules.to_a
-      return false unless rules.any?(&:geographic?)
-
-      # Under 'any' the list can win on a non-geographic rule alone, so a
-      # geographic rule being present does not mean this buyer's geography is why
-      # the price applied. Under 'all' every rule matched, so it does.
-      price_list.match_policy == 'all' || rules.all?(&:geographic?)
-    end
-
-    def price_including_vat_for(price_options)
-      return price if final_for_destination?
-
-      options = price_options.merge(tax_category: variant.tax_category)
-      gross_amount(price, options)
+    # @deprecated Prices are charged as entered for every buyer since 6.0. Use {#price}; removed in 6.1.
+    def price_including_vat_for(_price_options = {})
+      Spree::Deprecation.warn('Spree::Price#price_including_vat_for is deprecated and will be removed in Spree 6.1. Prices are charged as entered; use #price instead.')
+      price
     end
 
-    def compare_at_price_including_vat_for(price_options)
-      return compare_at_price if final_for_destination?
-
-      options = price_options.merge(tax_category: variant.tax_category)
-      gross_amount(compare_at_price, options)
+    # @deprecated Use {#compare_at_price}; removed in 6.1.
+    def compare_at_price_including_vat_for(_price_options = {})
+      Spree::Deprecation.warn('Spree::Price#compare_at_price_including_vat_for is deprecated and will be removed in Spree 6.1. Prices are charged as entered; use #compare_at_price instead.')
+      compare_at_price
     end
 
-    def display_price_including_vat_for(price_options)
-      Spree::Money.new(price_including_vat_for(price_options), currency: currency)
+    # @deprecated Use {#display_price}; removed in 6.1.
+    def display_price_including_vat_for(_price_options = {})
+      Spree::Deprecation.warn('Spree::Price#display_price_including_vat_for is deprecated and will be removed in Spree 6.1. Prices are charged as entered; use #display_price instead.')
+      display_price
     end
 
-    def display_compare_at_price_including_vat_for(price_options)
-      Spree::Money.new(compare_at_price_including_vat_for(price_options), currency: currency)
+    # @deprecated Use {#display_compare_at_price}; removed in 6.1.
+    def display_compare_at_price_including_vat_for(_price_options = {})
+      Spree::Deprecation.warn('Spree::Price#display_compare_at_price_including_vat_for is deprecated and will be removed in Spree 6.1. Prices are charged as entered; use #display_compare_at_price instead.')
+      display_compare_at_price
     end
 
     # returns the name of the price in a format of variant name and currency

data/app/models/spree/price_rule.rb

@@ -16,18 +16,6 @@ module Spree
       raise NotImplementedError, "#{self.class.name} must implement #applicable?"
     end
 
-    # Whether this rule narrows its price list by geography. A list carrying one
-    # states the price for that geography outright, so its prices are charged as
-    # entered and never restated for the buyer's VAT rate
-    # (Spree::VatPriceCalculation). A rule that narrows by anything else — a
-    # quantity, a group, a channel — leaves its prices open to restatement, since
-    # they were not set for a country.
-    #
-    # @return [Boolean]
-    def geographic?
-      false
-    end
-
     # Whether this rule narrows by something about the purchase rather than
     # about the buyer. A catalog-owned price list has already been matched on
     # audience by the time the resolver holds it — the catalog assignment is
@@ -45,10 +33,9 @@ module Spree
       false
     end
 
-    # Instance-side reader, so rules are classified the same way
-    # `geographic?` classifies them (`rules.any?(&:geographic?)`). A kind
-    # whose answer depends on how it is configured overrides this, exactly
-    # as MarketRule does for `geographic?`.
+    # Instance-side reader, so rules can be classified per row
+    # (`price_rules.select(&:contextual?)`). A kind whose answer depends on how it is
+    # configured overrides this.
     #
     # @return [Boolean]
     def contextual?

data/app/models/spree/price_rules/market_rule.rb

@@ -23,12 +23,6 @@ module Spree
         preferred_market_ids.map(&:to_s).include?(context.market.id.to_s)
       end
 
-      # An empty market list matches every buyer (see #applicable?), so it names
-      # no geography — and that is the state a freshly created rule row is in.
-      def geographic?
-        preferred_market_ids.present?
-      end
-
       def self.description
         'Apply pricing based on the market'
       end

data/app/models/spree/pricing_provider/base.rb

@@ -6,7 +6,7 @@ module Spree
     # A provider returns a {Spree::Price}: {Internal} returns the persisted
     # catalog row, an external provider an **unsaved, readonly** instance. The
     # Active Record shape is deliberately the contract, so everything
-    # downstream — tax-inclusive restatement, +discounted?+, the serializers —
+    # downstream — the line item, +discounted?+, the serializers —
     # keeps working without knowing where the number came from. +readonly!+ is
     # what stops an external answer being written back into the catalog.
     #

data/app/models/spree/product.rb

@@ -887,7 +887,7 @@ module Spree
         next unless variant.should_track_inventory?
         next if variant.sku.blank? && variant != default_variant
 
-        variant.stock_levels.each do |stock_level|
+        variant.stock_levels.sort_by(&:id).each do |stock_level|
           location = stock_level.stock_location
           next if location.nil? || location == default_stock_location
           next unless location.store_id == store.id && location_owner_ids.include?(location.seller_id)

data/app/models/spree/purchase_order_item.rb

@@ -11,7 +11,7 @@ module Spree
     belongs_to :purchase_order, class_name: 'Spree::PurchaseOrder', inverse_of: :items, touch: true
 
     validates :quantity_ordered, numericality: { greater_than: 0, only_integer: true }
-    validates :unit_cost, numericality: { greater_than_or_equal_to: 0 }
+    validates :unit_cost, presence: true, numericality: { greater_than_or_equal_to: 0, allow_nil: true }
     validates :variant_id, uniqueness: { scope: :purchase_order_id }
 
     delegate :currency, to: :purchase_order, allow_nil: true

data/app/models/spree/return.rb

@@ -19,6 +19,7 @@ module Spree
     include Spree::SingleStoreResource
     include Spree::HasStatus
     include Spree::HasCustomFields
+    include Spree::HasExternalReferences
     include Spree::Metadata
     include Spree::PostSale::Taxation
 

data/app/models/spree/sales_context.rb

@@ -0,0 +1,162 @@
+module Spree
+  # Who buys, on which channel, in which market: what a buyer can be sold, and
+  # at what price, depends on all of these together. A market fixes the
+  # currency and the languages a sale may use.
+  class SalesContext
+    include ActiveModel::Model
+    include ActiveModel::Attributes
+
+    attribute :store
+    attribute :market
+    attribute :channel
+    attribute :customer
+    attribute :company
+    attribute :country
+    attribute :currency, :string
+    attribute :locale, :string
+    # A placed sale keeps the company it was stamped with, even none, so only
+    # a sale still being put together looks up the customer's company.
+    attribute :resolve_company, :boolean, default: true
+
+    validate :currency_sold_in_a_market
+    validate :currency_matches_market
+    validate :locale_supported_by_market
+
+    # @param order [Spree::Order]
+    # @return [Spree::SalesContext]
+    def self.from_order(order)
+      new(
+        store: order.store, market: order.market, channel: order.channel, customer: order.customer,
+        company: order.resolved_company, resolve_company: false, country: order.tax_country,
+        currency: order.currency, locale: order.locale
+      )
+    end
+
+    # The market chosen for the sale, else one selling the requested currency,
+    # else the store's default.
+    #
+    # @return [Spree::Market, nil]
+    def market
+      chosen = super
+      return chosen if chosen
+      return @resolved_market if defined?(@resolved_market)
+
+      @resolved_market = resolve_market
+    end
+
+    def channel
+      super || store&.default_channel
+    end
+
+    # @return [String] the requested currency, else the market's, else the store's
+    def currency
+      requested_currency || market&.currency || store&.default_currency
+    end
+
+    # @return [String, nil] the requested language, else the market's default
+    def locale
+      super.presence || market&.default_locale
+    end
+
+    # The company chosen for the sale, else the one the customer stands in
+    # alone — the same answer pricing and catalog visibility reach.
+    #
+    # @return [Spree::Company, nil]
+    def company
+      chosen = super
+      return chosen if chosen || !resolve_company
+      return @standing_company if defined?(@standing_company)
+
+      @standing_company =
+        if customer.is_a?(Spree.customer_class) && store
+          Spree::Company.sole_standing_for(store: store, customer: customer)
+        end
+    end
+
+    # Variants the buyer may order on the channel: published there and inside
+    # their catalogs.
+    #
+    # @return [ActiveRecord::Relation<Spree::Variant>]
+    def orderable_variants
+      @orderable_variants ||= Spree::Variant.for_products(
+        Spree.products_for_context_service.call(
+          store: store, channel: channel, customer: customer, company: company,
+          base: store.products.not_discontinued_on(channel)
+        ).value
+      )
+    end
+
+    # Orderable variants the buyer can be quoted in the sale's currency: a base
+    # price, or a price from a list that applies to them, so a product sold to
+    # a buyer only under their agreement is offered to that buyer alone.
+    #
+    # @return [ActiveRecord::Relation<Spree::Variant>]
+    def sellable_variants
+      prices = Spree::Price.where(variant_id: orderable_variants.select(:id), currency: currency)
+                           .where.not(amount: nil)
+                           .where(price_list_id: [nil, *applicable_price_list_ids])
+
+      orderable_variants.where(id: prices.select(:variant_id))
+    end
+
+    # @return [Spree::Pricing::Context] the context prices are resolved in
+    def pricing_context
+      @pricing_context ||= Spree::Pricing::Context.new(
+        currency: currency, store: store, country: country, market: market,
+        channel: channel, user: customer, company: company
+      )
+    end
+
+    private
+
+    def requested_currency
+      attributes['currency'].presence&.upcase
+    end
+
+    def resolve_market
+      return unless store
+
+      candidates = [(Spree::Current.market if Spree::Current.store == store), store.default_market].compact
+      return candidates.first unless requested_currency
+
+      candidates.find { |candidate| candidate.currency == requested_currency } ||
+        store.markets.find_by(currency: requested_currency)
+    end
+
+    # Catalog price lists the buyer's catalogs carry, and standalone lists
+    # whose rules match the sale, judged the way the internal pricing provider
+    # judges them.
+    def applicable_price_list_ids
+      @applicable_price_list_ids ||= begin
+        catalogs = Spree::Catalog.groups_for_buyer(store: store, customer: customer, company: company, channel: channel)
+        catalog_lists = catalogs.flatten.filter_map(&:price_list).select do |list|
+          list.currently_active? && list.contextual_rules_applicable?(pricing_context)
+        end
+        standalone_lists = Spree::PriceList.for_context(pricing_context).select { |list| list.applicable?(pricing_context) }
+
+        (catalog_lists + standalone_lists).map(&:id).uniq
+      end
+    end
+
+    def currency_sold_in_a_market
+      return if requested_currency.nil? || market || store.nil? || !store.markets.exists?
+
+      errors.add(:currency, :currency_not_supported_by_store, message: I18n.t('spree.currency_not_supported_by_store'))
+    end
+
+    def currency_matches_market
+      return if market.nil? || currency == market.currency
+
+      errors.add(
+        :currency, :currency_does_not_match_market,
+        message: I18n.t('spree.currency_does_not_match_market', currency: market.currency)
+      )
+    end
+
+    def locale_supported_by_market
+      return if market.nil? || locale.blank? || market.supported_locales_list.include?(locale)
+
+      errors.add(:locale, :locale_not_supported_by_market, message: I18n.t('spree.locale_not_supported_by_market'))
+    end
+  end
+end

data/app/models/spree/search_provider/database.rb

@@ -135,7 +135,7 @@ module Spree
             end
           }.join(',')
 
-          scope.ransack({ s: ransack_sort }, auth_object: @audience).result
+          scope.ransack({ s: ransack_sort }, auth_object: @audience).result.with_translation_fallback_order
         end
       end