spree_core 6.0.0.rc3 → 6.0.0.rc5

data/app/tools/spree/agent_tools/upload_file.rb

@@ -0,0 +1,104 @@
+module Spree
+  module AgentTools
+    # Stores a file the merchant provided, through the Admin API's own upload
+    # endpoint, and answers with the id every other write accepts.
+    #
+    # The dashboard uploads in two steps: ask for a storage target, then PUT
+    # the bytes to it. An agent has no second request to make, so this sends
+    # the bytes with the request — the multipart shape `POST /files` already
+    # accepts — and the endpoint owns the type allowlist, the size cap and
+    # which store the file belongs to.
+    #
+    # Storing a file is not yet using it: the id is attached by whichever
+    # tool the merchant asked for next, under that tool's own permission.
+    class UploadFile < Spree::AgentTool
+      tool_name 'upload_file'
+      description 'Store a file the merchant provided — a CSV to import, an image for a ' \
+                  'product, a document to attach — and return the id other tools accept. ' \
+                  'Send text as text; use encoding "base64" only for images, PDFs and other ' \
+                  'binary files. Storing a file does nothing on its own.'
+      # The endpoint's own floor, which is the gate the dashboard's uploader
+      # passes; whatever uses the file checks its own permission after.
+      permission 'write_products'
+      mutating!
+
+      param :filename, description: 'The file name, with its extension', required: true
+      param :content, description: 'The file contents — text as text, binary base64 encoded',
+                      required: true
+      param :encoding, description: '"base64" for a binary file; omit for text'
+      param :content_type, description: "The file's media type, e.g. text/csv or application/pdf"
+
+      # A private upload accepts any type, which is right for the dashboard —
+      # a merchant picking a file has already decided. A model repeating a
+      # filename back has decided nothing, so an agent is held to the kinds
+      # it has a reason to send.
+      PERMITTED_CONTENT_TYPES = %w[
+        text/csv
+        text/plain
+        application/pdf
+        image/jpeg
+        image/png
+        image/webp
+        image/gif
+        application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+      ].freeze
+
+      def call(filename:, content:, encoding: nil, content_type: nil)
+        bytes, error = decode(content, encoding)
+        return { error: error } if error
+
+        # Read from the bytes, not from what the caller named it: Marcel
+        # places the content first, so a renamed script is not a CSV.
+        kind = Marcel::MimeType.for(StringIO.new(bytes), name: filename,
+                                                         declared_type: content_type.presence)
+        unless PERMITTED_CONTENT_TYPES.include?(kind)
+          return { error: "Files of type #{kind.inspect} are not accepted here.",
+                   supported_content_types: PERMITTED_CONTENT_TYPES }
+        end
+
+        response = ApiDispatch.new(context).call(
+          method: :post,
+          path: '/api/v3/admin/files',
+          body: {
+            'filename' => filename,
+            'content_type' => kind,
+            # Agent uploads are private: a purchase order or a customer list
+            # is not something to put behind a public URL, and a private
+            # upload is the one that accepts a document at all.
+            'visibility' => 'private',
+            'file' => StringIO.new(bytes)
+          }.compact
+        )
+        return { error: response.error_message } unless response.success?
+
+        data = response.data.to_h
+
+        {
+          ok: true,
+          file_id: data['signed_id'],
+          filename: data['filename'],
+          content_type: data['content_type'],
+          byte_size: data['byte_size']
+        }
+      end
+
+      def summary(arguments)
+        "Store the file #{arguments[:filename]}"
+      end
+
+      private
+
+      # Text arrives as text. Base64 is a third larger and a model has to
+      # emit every byte of it, so it is asked for only where the bytes are
+      # not text at all.
+      def decode(content, encoding)
+        raw = content.to_s
+        return [raw, nil] unless encoding.to_s == 'base64'
+
+        [Base64.strict_decode64(raw.gsub(/\s+/, '')), nil]
+      rescue ArgumentError
+        [nil, 'content is not valid base64. Send text as text, without the encoding parameter.']
+      end
+    end
+  end
+end

data/app/workflows/spree/carts/complete.rb

@@ -77,6 +77,19 @@ module Spree
       def complete_draft_order
         result = Spree.order_complete_workflow.call(order: cart, payment_pending: payment_pending)
         failure(result.value, result.error) if result.failure?
+
+        # A draft leaves before FINALIZE, so the document that phase files is
+        # filed here — otherwise it charged tax that never reached the return.
+        # A draft holding several sellers' goods divides like a checkout, and
+        # each of its orders is a sale of its own to file.
+        if result.value.is_a?(Spree::OrderGroup)
+          @order_group = result.value
+          @order = order_group.orders.order(:id).first
+        else
+          @order = result.value
+        end
+        external_step :commit_tax
+
         halt!(result.value)
       end
 
@@ -141,6 +154,26 @@ module Spree
       def recalculate_in_lock
         Spree::Carts::PriceItems.apply(@confirmed_prices) if @confirmed_prices.present?
         cart.recalculate_totals!
+      rescue Spree::Tax::ProviderError => error
+        # The engine that decides this sale's tax did not produce any.
+        # Completing anyway would place an order whose tax nobody computed, so
+        # the sale is refused — as a failure the caller can render, not as an
+        # exception that reads like a broken checkout.
+        Rails.error.report(error, context: { order_id: cart.id }, source: 'spree.checkout')
+
+        if error.is_a?(Spree::Tax::CalculationRefused)
+          # The engine said no to this request. Its message names the problem —
+          # the postcode, the missing company code — and asking the customer to
+          # retry would be asking them to repeat something that cannot work.
+          failure(cart, code: 'tax_calculation_refused', message: error.message.to_s)
+        else
+          # It could not be asked. Retrying may work, and the reason belongs in
+          # the error tracker rather than the response: the raw message names
+          # the endpoint and the transport, which tells a shopper nothing and
+          # tells everyone else too much.
+          failure(cart, code: 'tax_provider_unavailable',
+                        message: I18n.t('spree.cart_line_item.tax_unavailable'))
+        end
       end
 
       def verify_expected_total
@@ -253,9 +286,10 @@ module Spree
 
           line_item_map = copy_line_items!(cart, order)
           fulfillment_map = copy_fulfillments!(cart, order, line_item_map)
-          copy_typed_lines!(cart, order, line_item_map, fulfillment_map)
+          fee_map = copy_typed_lines!(cart, order, line_item_map, fulfillment_map)
           copy_promotions!(cart, order)
           copy_tax_identifier!(cart, order)
+          copy_tax_exemptions!(cart, order, line_item_map, fulfillment_map, fee_map)
           copy_po_document!(cart, order)
           repoint_money_records!(cart, order)
 
@@ -290,6 +324,71 @@ module Spree
         order.create_tax_identifier!(attributes.merge('source' => source_of(resolved)))
       end
 
+      # Freezes the exemption evidence the sale was priced with, beside the
+      # registration and for the same reason. A certificate lapses on its own
+      # date with nothing written to it, can be revoked, and is destroyed with
+      # its company — so a provider re-resolving at commit or refund time would
+      # file a credit for an exempt sale as a consumer refund and declare tax
+      # that was never collected. Read from the cart, which is what was priced.
+      #
+      # An empty list is still written: "found no claim" and "placed before this
+      # existed" are different facts, and the reader tells them apart.
+      def copy_tax_exemptions!(cart, order, line_item_map, fulfillment_map, fee_map)
+        translation = exemption_item_ids(line_item_map, fulfillment_map, fee_map)
+        claims = cart.usable_exemptions.map { |claim| reown_claim(claim, translation) }
+
+        order.update_column(:applied_tax_exemptions, claims)
+      end
+
+      # An override names its line by prefixed id, and completion mints new ones.
+      # Left as the cart's it matches nothing — which widens the claim rather
+      # than narrowing it, exempting every line instead of carving one out.
+      def reown_claim(claim, translation)
+        snapshot = claim.to_snapshot
+        overrides = Array(snapshot['item_overrides'])
+        return snapshot if overrides.empty?
+
+        snapshot.merge(
+          'item_overrides' => overrides.map do |override|
+            reowned = translation[override['item_id'].to_s]
+            next override.merge('item_id' => reowned) if reowned
+
+            # It narrowed nothing while the cart was priced either, so it is
+            # left alone and reported rather than dropped.
+            report_unmatched_override(override)
+            override
+          end
+        )
+      end
+
+      # Cart prefixed id → order prefixed id, encoded from the ids the copy maps
+      # already carry rather than by reloading the records.
+      def exemption_item_ids(line_item_map, fulfillment_map, fee_map)
+        translation = {}
+
+        line_item_map.each do |cart_line_item, order_line_item|
+          translation[cart_line_item.prefixed_id] = order_line_item.prefixed_id
+        end
+        { Spree::Fulfillment => fulfillment_map, Spree::Fee => fee_map }.each do |klass, ids|
+          ids.each do |cart_id, order_id|
+            translation[klass.prefixed_id_for(cart_id)] = klass.prefixed_id_for(order_id)
+          end
+        end
+
+        translation
+      end
+
+      def report_unmatched_override(override)
+        Rails.error.report(
+          Spree::Tax::UnusableExemptionError.new(
+            "A tax exemption override named #{override['item_id'].inspect}, which is not part of this sale"
+          ),
+          handled: true,
+          context: { item_id: override['item_id'] },
+          source: 'spree.core'
+        )
+      end
+
       # The buyer's purchase order follows the number onto the order. The same
       # blob is attached to both records rather than uploaded twice — the cart
       # keeps its copy so a completion that rolls back leaves the buyer's
@@ -366,6 +465,9 @@ module Spree
       # Fees before tax lines, because a fee is something tax is charged on: a
       # tax line copied first would reach the order still naming the cart's
       # fee, and that row is then destroyed with it.
+      #
+      # @return [Hash{Integer => Integer}] cart fee id → order fee id, which an
+      #   exemption override may name
       def copy_typed_lines!(cart, order, line_item_map, fulfillment_map)
         line_item_id_map = line_item_map.transform_keys(&:id).transform_values(&:id)
         fee_map = {}
@@ -392,6 +494,8 @@ module Spree
             fee_map[row.id] = copy.id if klass == Spree::Fee
           end
         end
+
+        fee_map
       end
 
       def copy_promotions!(cart, order)
@@ -458,7 +562,16 @@ module Spree
       # separate sale with its own tax, and an unfiled sibling is a hole in the
       # merchant's return that only surfaces at filing time.
       def commit_tax
-        placed_orders.each { |placed| placed.tax_provider.commit(placed) }
+        placed_orders.each do |placed|
+          placed.tax_provider.commit(placed)
+        rescue Spree::Tax::ProviderError => error
+          # Deliberately not a failure. The order is placed and paid; refusing
+          # now would leave the customer charged for a sale the platform denies
+          # having taken. Filing is idempotent and replayable, so the document
+          # can follow — an unfiled sale is a reporting gap to chase, not a
+          # reason to break the checkout that produced it.
+          Rails.error.report(error, context: { order_id: placed.id }, source: 'spree.checkout')
+        end
       end
 
       # What this checkout produced: the children of a split, or the one order

data/app/workflows/spree/catalogs/set_price_list.rb

@@ -90,8 +90,8 @@ module Spree
       # settled by its assignments. Rules are reconciled by replacement, so
       # the audience rules the caller never mentioned are merged back in;
       # without this, editing a catalog's name through the inline payload
-      # would destroy a market rule and silently change how its prices are
-      # restated for VAT.
+      # would destroy a market rule and silently change which buyers its
+      # prices apply to.
       def merged_rules(rows)
         existing = catalog.price_list&.price_rules&.to_a || []
         untouched = existing.reject(&:contextual?)

data/app/workflows/spree/customers/anonymize.rb

@@ -212,9 +212,15 @@ module Spree
         # redacting that would overwrite the shared address for every other
         # member and every other order. Only rows this person owns, or rows
         # nobody owns, are this erasure's to rewrite.
+        #
+        # Ownership is the id alone, never the type. A snapshot taken from a
+        # company site keeps its owner_type so the copy stays addressed to a
+        # business rather than to a person, so matching on the type too would
+        # skip exactly those copies — and an erasure that quietly covers less
+        # than it did raises nothing.
         snapshots = Spree::Address.where(id: address_ids)
         mine = snapshots.where(owner_type: customer.class.base_class.to_s, owner_id: customer.id)
-        unowned = snapshots.where(owner_type: nil, owner_id: nil)
+        unowned = snapshots.where(owner_id: nil)
 
         mine.or(unowned).find_each do |address|
           redact_address(address, deleted: false)
@@ -407,7 +413,9 @@ module Spree
         end
 
         # The token goes too, so a link already emailed stops resolving rather
-        # than waiting out its expiry.
+        # than waiting out its expiry. Confirmation links are bound to it, so
+        # a request still waiting for one can never be confirmed.
+        requests.awaiting_confirmation.update_all(status: 'lapsed', updated_at: Time.current)
         requests.update_all(
           email: customer.email,
           download_token: nil,
@@ -458,22 +466,35 @@ module Spree
 
       # @param address [Spree::Address]
       # @param deleted [Boolean] whether to soft-delete it as well
+      # What the person left on an address, rewritten; the address itself kept
+      # readable enough to answer a tax enquiry.
+      #
+      # A snapshot copied from a company site is the narrower case. The dock
+      # and the trading name on it are the business's, not this person's, and
+      # erasing them would take the merchant's record of a lawful sale with
+      # them — so only the contact details go. A business address is allowed
+      # to name nobody, which is why those fields are emptied rather than
+      # stamped: writing "Redacted" where a company never named anyone would
+      # invent a person who was not there.
       def redact_address(address, deleted:)
-        attributes = {
-          first_name: REDACTED_NAME,
-          last_name: REDACTED_NAME,
-          address1: REDACTED_NAME,
-          address2: nil,
-          phone: nil,
-          alternative_phone: nil,
-          company: nil,
-          label: nil,
-          latitude: nil,
-          longitude: nil,
-          postal_code: truncated_postal_code(address.postal_code),
-          metadata: {},
-          updated_at: Time.current
-        }
+        attributes =
+          if address.business_owned?
+            { first_name: nil, last_name: nil }
+          else
+            {
+              first_name: REDACTED_NAME,
+              last_name: REDACTED_NAME,
+              address1: REDACTED_NAME,
+              address2: nil,
+              company: nil,
+              label: nil,
+              latitude: nil,
+              longitude: nil,
+              postal_code: truncated_postal_code(address.postal_code)
+            }
+          end
+
+        attributes.merge!(phone: nil, alternative_phone: nil, metadata: {}, updated_at: Time.current)
         attributes[:deleted_at] = Time.current if deleted && address.deleted_at.nil?
 
         address.update_columns(attributes)

data/app/workflows/spree/data_requests/fulfill.rb

@@ -36,6 +36,7 @@ module Spree
         super
 
         step :ensure_pending
+        step :ensure_addressed_to_customer
         step :mark_processing
 
         run_hooks :before_fulfill
@@ -56,6 +57,15 @@ module Spree
         failure(data_request, I18n.t('spree.data_request_errors.not_pending'))
       end
 
+      # An account already erased has a replaced address by design, and
+      # erase_customer counts that as done.
+      def ensure_addressed_to_customer
+        customer = data_request.customer
+        return if customer.nil? || customer.anonymized? || data_request.addressed_to_customer?
+
+        failure(data_request, I18n.t('spree.data_request_errors.address_changed'))
+      end
+
       def mark_processing
         data_request.update!(status: 'processing')
       end
@@ -78,21 +88,25 @@ module Spree
         # anonymizer starts after the check and finishes its attachment scan
         # before this attaches, stranding a full personal-data file it will
         # never see.
+        #
+        # The address is checked again under the same lock, so it cannot change
+        # between the check and the export reading it.
         return attach_export unless customer
 
-        refused = false
+        refusal = nil
 
         customer.with_lock do
-          if customer.reload.anonymized?
-            refused = true
+          customer.reload
+          if customer.anonymized?
+            refusal = 'spree.data_request_errors.already_anonymized'
+          elsif !data_request.addressed_to_customer?
+            refusal = 'spree.data_request_errors.address_changed'
           else
             attach_export
           end
         end
 
-        return unless refused
-
-        failure(data_request, I18n.t('spree.data_request_errors.already_anonymized'))
+        failure(data_request, I18n.t(refusal)) if refusal
       end
 
       def attach_export

data/app/workflows/spree/orders/cancel.rb

@@ -253,8 +253,16 @@ module Spree
 
       # Reverses the filed tax document. The canceled sale must stop appearing
       # in the merchant's tax liability.
+      #
+      # Reported rather than raised, as `Carts::Complete` treats its filing. The
+      # cancellation and its payments are already settled by now, and the steps
+      # after this one update statuses and announce `order.canceled` — so
+      # raising abandoned a cancelled order half-recorded. Void is idempotent, so
+      # a standing document can follow.
       def void_tax
         order.tax_provider.void(order)
+      rescue Spree::Tax::ProviderError => error
+        Rails.error.report(error, context: { order_id: order.id }, source: 'spree.orders.cancel')
       end
     end
   end

data/app/workflows/spree/orders/complete.rb

@@ -43,6 +43,7 @@ module Spree
             step :split_by_seller
             step :finalize_fulfillments
             step :place_order
+            step :freeze_tax_exemptions
             step :use_coupon_codes
             step :redeem_gift_card
             step :fulfill_auto_fulfillments
@@ -151,6 +152,13 @@ module Spree
         order.update!(status: 'placed', completed_at: Time.current)
       end
 
+      # Pins what the sale was priced with, as `Carts::Complete` does for a cart.
+      # A draft is its own source, so nothing needs translating — and it is the
+      # path company certificates take, which left it resolving live at credit.
+      def freeze_tax_exemptions
+        order.update_column(:applied_tax_exemptions, order.usable_exemptions.map(&:to_snapshot))
+      end
+
       def use_coupon_codes
         Spree::CouponCodes::CouponCodesHandler.new(order: order).use_all_codes
       end

data/app/{services → workflows}/spree/orders/create.rb

@@ -8,18 +8,18 @@ module Spree
     # Standalone from Spree::Carts::Create (storefront). Admin-created orders
     # are first-class Spree::Order records (status: 'draft') in 5.x and remain
     # so in 6.0 — Spree::Cart in 6.0 is storefront-only.
-    class Create
-      prepend Spree::ServiceModule::Base
-
+    class Create < Spree::Workflow
       attr_reader :discount_application_errors
 
-      # @param store [Spree::Store]
-      # @param customer [Object, nil] resolved customer (Spree.customer_class instance)
-      # @param created_by [Object, nil] the staff member creating the draft
-      #   (Spree.admin_user_class instance); nil for machine callers (secret keys)
-      # @param params [Hash] order params (see admin API docs)
+      # @param store [Spree::Store] the store the order belongs to
+      # @param customer [Object, nil] who is ordering, when they are an
+      #   existing customer; the order keeps `email` either way
+      # @param created_by [Object, nil] who is placing it — a staff member, or
+      #   the credential acting for one
+      # @param params [Hash] the order's own attributes, plus `items`,
+      #   addresses and a coupon code
       # @return [Spree::ServiceModule::Result]
-      def call(store:, customer: nil, created_by: nil, params: {})
+      def perform(store:, customer: nil, created_by: nil, params: {})
         @store = store
         @customer = customer
         @created_by = created_by
@@ -28,6 +28,14 @@ module Spree
 
         return failure(:store_is_required) if store.nil?
 
+        @sales_context = Spree::SalesContext.new(
+          store: store,
+          market: (resolve_market if @params[:market_id].present?),
+          currency: @params[:currency],
+          locale: @params[:locale]
+        )
+        return refuse_sales_context unless @sales_context.valid?
+
         order = nil
         ApplicationRecord.transaction do
           order = build_order
@@ -60,8 +68,9 @@ module Spree
           customer: @customer,
           created_by: @created_by,
           email: @params[:email] || @customer&.email,
-          currency: @params[:currency].presence&.upcase || @store.default_currency,
-          locale: @params[:locale] || Spree::Current.locale,
+          market: @sales_context.market,
+          currency: @sales_context.currency,
+          locale: @sales_context.locale || Spree::Current.locale,
           customer_note: @params[:customer_note],
           po_number: @params[:po_number],
           internal_note: @params[:internal_note],
@@ -74,7 +83,6 @@ module Spree
         # signed id, so it assigns like any other attribute.
         attrs[:po_document_signed_id] = @params[:po_document_signed_id] if @params[:po_document_signed_id].present?
 
-        attrs[:market] = resolve_market if @params[:market_id].present?
         attrs[:channel] = resolve_channel if @params[:channel_id].present?
         attrs[:company] = resolve_company if @params[:company_id].present?
         attrs[:preferred_stock_location] = resolve_preferred_stock_location if @params[:preferred_stock_location_id].present?
@@ -83,6 +91,12 @@ module Spree
         @store.orders.new(attrs)
       end
 
+      def refuse_sales_context
+        order = @store.orders.new
+        order.errors.merge!(@sales_context.errors)
+        failure(order, order.errors.full_messages.to_sentence)
+      end
+
       def resolve_market
         @store.markets.find_by_param!(@params[:market_id])
       end
@@ -100,34 +114,44 @@ module Spree
       end
 
       def assign_addresses(order)
-        if @params[:use_customer_default_address] && @customer
-          @customer.association(:bill_address).load_target
-          @customer.association(:ship_address).load_target
-          order.bill_address = @customer.bill_address&.snapshot
-          order.ship_address = @customer.ship_address&.snapshot
-        end
+        assign_default_addresses(order) if @params[:use_customer_default_address]
 
         assign_address(order, :ship_address, @params[:shipping_address_id], @params[:shipping_address])
         assign_address(order, :bill_address, @params[:billing_address_id], @params[:billing_address])
+        order.use_shipping = @params[:use_shipping]
+      end
+
+      def assign_default_addresses(order)
+        company = order.company
+
+        if company.present?
+          order.bill_address = company.default_billing_address&.snapshot
+          order.ship_address = company.default_shipping_address&.snapshot
+          return
+        end
+
+        return if @customer.nil?
+
+        @customer.association(:bill_address).load_target
+        @customer.association(:ship_address).load_target
+        order.bill_address = @customer.bill_address&.snapshot
+        order.ship_address = @customer.ship_address&.snapshot
       end
 
       def assign_address(order, association, address_id, address_attrs)
         if address_id.present?
-          address = resolve_user_address(address_id)
+          address = order.selectable_address(address_id)
           order.public_send(:"#{association}_id=", address.id) if address
         elsif address_attrs.present?
           order.public_send(:"#{association}_attributes=", address_attrs)
         end
       end
 
-      def resolve_user_address(address_id)
-        return unless @customer
-
-        @customer.addresses.find_by_param(address_id)
-      end
-
       def add_items(order)
-        result = Spree::Orders::UpsertItems.call(order: order, items: @params[:items])
+        result = Spree::Orders::UpsertItems.call(
+          order: order, items: @params[:items],
+          orderable_variants: Spree::SalesContext.from_order(order).orderable_variants
+        )
         return if result.success?
 
         propagate_step_failure!(order, result, fallback: 'Failed to add items to order')

data/app/workflows/spree/purchase_orders/create.rb

@@ -17,6 +17,9 @@ module Spree
       # @param currency [String, nil] defaults to the store's; set it for a
       #   foreign-currency order
       # @param expected_at [Date, nil]
+      # @param cancel_by [Date, nil] the date past which the merchant no longer
+      #   wants the goods, so an order still open after it reads as overdue to
+      #   cancel rather than merely late
       # @param reference [String, nil] the supplier's own order number
       # @param notes [String, nil]
       # @param metadata [Hash, nil]

data/app/workflows/spree/returns/refund.rb

@@ -65,6 +65,10 @@ module Spree
       # The refunded amount goes with them, because it can be less than those
       # lines are worth — a restocking fee, or an agreed part-refund. Without it
       # a provider would credit the tax on goods whose value the merchant kept.
+      # Reported rather than raised, as filing and voiding are: the money has
+      # moved and the return is marked refunded by now, and `return.refunded`
+      # follows — so raising failed a refund that had gone through, and lost the
+      # event with it.
       def refund_tax
         received = return_record.return_line_items.select { |line| line.refund_amount.positive? }
         return if received.empty?