spree_core 6.0.0.rc3 → 6.0.0.rc5

data/app/{services → workflows}/spree/stock_levels/bulk_upsert.rb

@@ -12,18 +12,22 @@ module Spree
     # A feed states absolute levels (+count_on_hand+), which is what an
     # external system knows. The movement records the delta between what Spree
     # held and what the feed says.
-    class BulkUpsert
-      prepend Spree::ServiceModule::Base
+    class BulkUpsert < Spree::Workflow
 
       # What the stock history shows against a movement this service wrote.
       FEED_REASON = 'inventory_feed'.freeze
 
-      # @param rows [Array<Hash>] each with +variant_id+, +stock_location_id+,
-      #   and either +count_on_hand+ (absolute) or +adjustment+ (relative);
-      #   +backorderable+ optional
+      # @param store [Spree::Store] whose shelves these are. Ids are resolved
+      #   through it, so a row naming another store's variant is not found
+      #   rather than written.
+      # @param rows [Array<Hash>] one per shelf: +variant_id+ and
+      #   +stock_location_id+ naming it (prefixed ids, or raw), then either
+      #   +count_on_hand+ (the figure it should end at) or +adjustment+ (a
+      #   signed change); +backorderable+ optional
       # @return [Spree::ServiceModule::Result] +{ stock_level_count: N }+
-      def call(rows:)
-        rows = Array(rows).map { |row| row.with_indifferent_access }
+      def perform(store:, rows:)
+        @store = store
+        rows = resolve(Array(rows).map { |row| row.with_indifferent_access })
         keyed = rows.select { |row| row[:variant_id].present? && row[:stock_location_id].present? }
         return success(stock_level_count: 0) if keyed.empty?
 
@@ -41,6 +45,44 @@ module Spree
 
       private
 
+      # Names become this store's own ids, or nothing.
+      #
+      # Resolved here rather than by the caller, because a row reaching
+      # `find_or_initialize_by` unscoped writes to whichever shelf the id
+      # happens to name — including another merchant's. One caller decoding
+      # ids correctly does not make the workflow safe for the next one.
+      def resolve(rows)
+        variants = scoped_ids(store_variants, Spree::Variant, rows.map { |row| row[:variant_id] })
+        locations = scoped_ids(store_stock_locations, Spree::StockLocation,
+                               rows.map { |row| row[:stock_location_id] })
+
+        rows.map do |row|
+          row.merge(
+            variant_id: variants[row[:variant_id]],
+            stock_location_id: locations[row[:stock_location_id]]
+          ).compact
+        end
+      end
+
+      # Accepts a prefixed id or a raw one: the Admin API speaks prefixed,
+      # while the importer and seeds hold records they already loaded.
+      def scoped_ids(scope, model, values)
+        decoded = values.compact.uniq.index_with do |value|
+          model.decode_own_prefixed_id(value) || value
+        end
+        found = scope.where(id: decoded.values.compact).pluck(:id).map(&:to_s).to_set
+
+        decoded.transform_values { |id| id if id && found.include?(id.to_s) }
+      end
+
+      def store_variants
+        @store.variants
+      end
+
+      def store_stock_locations
+        @store.stock_locations
+      end
+
       def apply_row(row)
         stock_level = Spree::StockLevel.find_or_initialize_by(
           variant_id: row[:variant_id], stock_location_id: row[:stock_location_id]

data/app/workflows/spree/variants/create.rb

@@ -1,9 +1,12 @@
 module Spree
   module Variants
-    # Creates a variant on a product. The single gate for variant creation —
-    # the standalone variants endpoint and the nested payload on a product
-    # write both run through it, so a :validate handler sees every variant a
-    # catalog gains.
+    # Adds one variant to a product that already exists. A product being
+    # created carries its variants in the same write instead, which is one
+    # request and reconciles the list rather than adding to it.
+    #
+    # The single gate for variant creation — the standalone variants endpoint
+    # and the nested payload on a product write both run through it, so a
+    # :validate handler sees every variant a catalog gains.
     #
     # The product is a parameter rather than something read off the payload
     # because everything nested needs it: an option value attaches an option

data/config/locales/en.yml

@@ -429,6 +429,12 @@ en:
           attributes:
             company:
               must_be_legal_entity: must be a legal entity, not a division
+            tax_exemption_reason:
+              not_offered: is not a tax exemption reason this store offers
+        spree/tax_exemption_reason:
+          attributes:
+            base:
+              in_use: is recorded on tax exemption certificates and cannot be deleted
         spree/tax_identifier:
           attributes:
             company:
@@ -613,8 +619,10 @@ en:
     messages:
       already_confirmed: was already confirmed
       forbidden_reporting_member: references data you are not allowed to read
+      fragment_present: cannot contain a fragment
       invalid_document_number_affix: 'can only contain uppercase letters, digits, dashes and #'
       invalid_system_key: can only contain lowercase letters, digits and underscores
+      invalid_uri: must be a valid URL
       locked_after_first_number: cannot change once numbering has started
       not_a_number: is not a number
       not_found: not found
@@ -622,7 +630,10 @@ en:
       not_saved:
         one: '1 error prohibited this %{resource} from being saved:'
         other: "%{count} errors prohibited this %{resource} from being saved:"
+      relative_uri: must be an absolute URL
+      secured_uri: must start with https, because authorization codes are delivered to it
       seeded_report_read_only: is a built-in report and cannot be changed — save a copy instead
+      unspecified_scheme: must include a scheme, such as https
   number:
     currency:
       format:
@@ -688,6 +699,7 @@ en:
       pricing_unavailable: Prices could not be confirmed. Please try again.
       quantity_must_be_positive: Quantity must be at least 1. Use DELETE to remove the item.
       quantity_rule_violated: "%{li_name} cannot be ordered in that quantity. Try %{quantities}."
+      tax_unavailable: Tax could not be calculated. Please try again.
     catalogs:
       no_price_list_to_import: This catalog has no price list to import products from.
       product_not_in_store: One of those products belongs to another store.
@@ -753,6 +765,7 @@ en:
     created_at: Created at
     credit_card: Credit Card
     currency: Currency
+    currency_does_not_match_market: must be %{currency}, the currency of the chosen market
     currency_not_supported_by_store: is not supported by this store
     custom_field_definitions: Custom Field Definitions
     custom_fields: Custom Fields
@@ -761,7 +774,9 @@ en:
       anonymize_failed: The erasure could not be completed and nothing was changed
     customers: Customers
     data_request_errors:
+      address_changed: The account's email address changed after this request was made
       already_anonymized: This customer's personal data has already been erased
+      confirmation_invalid: This confirmation link has expired or is no longer valid
       download_unavailable: This download link has expired or is no longer valid
       not_pending: This request has already been processed
     default: Default
@@ -1004,6 +1019,7 @@ en:
     line_items: Line items
     link: Link
     locale: Locale
+    locale_not_supported_by_market: is not offered by the chosen market
     locale_not_supported_by_store: is not supported by this store
     locales_not_listed: 'includes locales Spree does not support: %{codes}'
     manual: Manual
@@ -1785,6 +1801,8 @@ en:
       gb_vat: UK VAT
       us_ein: US EIN
     tax_provider_unavailable: The tax service could not work out the tax to give back. Try again in a few minutes.
+    tax_providers:
+      internal: Spree tax rates
     terms_of_service: Terms of Service
     there_are_no_items_for_this_order: There are no items for this order
     tiered_flat_rate: Tiered Flat Rate

data/db/migrate/20250902143122_fix_policies_store_association.rb

@@ -2,10 +2,12 @@ class FixPoliciesStoreAssociation < ActiveRecord::Migration[7.2]
   def change
     add_reference :spree_policies, :owner, polymorphic: true, index: true
 
-    Spree::Policy.reset_column_information
-    Spree::Policy.all.each do |policy|
-      policy.update(owner_id: policy.store_id, owner_type: 'Spree::Store')
-    end
+    policies = Arel::Table.new(:spree_policies)
+    connection.update(
+      Arel::UpdateManager.new.table(policies).set(
+        [[policies[:owner_id], policies[:store_id]], [policies[:owner_type], 'Spree::Store']]
+      )
+    )
 
     remove_index :spree_policies, [:store_id, :slug], unique: true, if_exists: true
     remove_index :spree_policies, [:store_id, :position], if_exists: true

data/db/migrate/20260515000001_add_store_id_to_spree_newsletter_subscribers.rb

@@ -5,8 +5,17 @@ class AddStoreIdToSpreeNewsletterSubscribers < ActiveRecord::Migration[7.2]
     # For spree_multi_tenant we need handle the backfill and indices there
     return if defined?(SpreeMultiTenant)
 
-    default_store = Spree::Store.default
-    Spree::NewsletterSubscriber.update_all(store_id: default_store.id) if default_store&.persisted?
+    # Read without the models: Spree::Store expects its columns (preferences,
+    # metadata) in the format later migrations convert them to, so loading a
+    # store here crashes on a database upgraded from an earlier release.
+    stores = Arel::Table.new(:spree_stores)
+    default_store_id = connection.select_value(
+      stores.project(stores[:id]).where(stores[:deleted_at].eq(nil).and(stores[:default].eq(true))).take(1)
+    )
+    if default_store_id.present?
+      subscribers = Arel::Table.new(:spree_newsletter_subscribers)
+      connection.update(Arel::UpdateManager.new.table(subscribers).set([[subscribers[:store_id], default_store_id]]))
+    end
 
     change_column_null :spree_newsletter_subscribers, :store_id, false
 

data/db/migrate/20260904100001_add_applied_tax_exemptions_to_spree_orders.rb

@@ -0,0 +1,16 @@
+class AddAppliedTaxExemptionsToSpreeOrders < ActiveRecord::Migration[8.1]
+  # The exemption claims a placed order was priced with, frozen at completion
+  # beside its tax registration. Certificates lapse on their own date with
+  # nothing written to them, can be revoked, and are destroyed with their
+  # company — so resolving them again when a provider files or credits the sale
+  # is not the evidence the sale was priced with.
+  def change
+    change_table :spree_orders, bulk: true do |t|
+      if t.respond_to?(:jsonb)
+        t.jsonb :applied_tax_exemptions
+      else
+        t.json :applied_tax_exemptions
+      end
+    end
+  end
+end

data/db/migrate/20260914230000_add_store_to_spree_option_types.rb

@@ -5,8 +5,18 @@ class AddStoreToSpreeOptionTypes < ActiveRecord::Migration[8.1]
     # Existing option types were installation-wide, so they belong to the
     # store that has been using them. Left nullable: a fresh install has no
     # store yet, and the association enforces presence from the model side.
-    default_store = Spree::Store.where(default: true).first || Spree::Store.first
-    Spree::OptionType.update_all(store_id: default_store.id) if default_store
+    # Read without the models: Spree::Store expects its columns (preferences,
+    # metadata) in the format later migrations convert them to, so loading a
+    # store here crashes on a database upgraded from an earlier release.
+    stores = Arel::Table.new(:spree_stores)
+    default_store_id = connection.select_value(
+      stores.project(stores[:id]).where(stores[:deleted_at].eq(nil))
+            .order(stores[:default].desc, stores[:id].asc).take(1)
+    )
+    if default_store_id.present?
+      option_types = Arel::Table.new(:spree_option_types)
+      connection.update(Arel::UpdateManager.new.table(option_types).set([[option_types[:store_id], default_store_id]]))
+    end
 
     # Names are unique within a store now, so two stores may each define `size`.
     remove_index :spree_option_types, :name, unique: true, if_exists: true

data/db/migrate/20261005120000_create_spree_oauth_tables.rb

@@ -0,0 +1,67 @@
+# OAuth 2.1 authorization server tables. Separate from any OAuth Spree
+# carried before 5.4: those served password and client-credentials grants for
+# the legacy API, and nothing migrates forward.
+class CreateSpreeOauthTables < ActiveRecord::Migration[8.1]
+  def change
+    create_table :spree_oauth_applications do |t|
+      t.string :name, null: false
+      t.string :uid, null: false
+      # Null for a public client, which is every MCP client: they run in a
+      # browser or on a vendor's server and cannot hold a secret, which is
+      # why PKCE is mandatory rather than optional here.
+      t.string :secret
+      t.text :redirect_uri
+      t.string :scopes, null: false, default: ''
+      t.boolean :confidential, null: false, default: false
+      t.references :store, null: false, index: true
+      t.timestamps
+    end
+
+    add_index :spree_oauth_applications, :uid, unique: true
+
+    create_table :spree_oauth_access_grants do |t|
+      t.references :resource_owner, polymorphic: true, null: false, index: true
+      t.references :application, null: false, index: true
+      t.string :token, null: false
+      t.integer :expires_in, null: false
+      t.text :redirect_uri
+      t.string :scopes, null: false, default: ''
+      t.datetime :revoked_at
+      t.string :code_challenge
+      t.string :code_challenge_method
+      # RFC 8707: what the grant was requested for, carried to the token so
+      # the audience can be checked on every call. The column name is
+      # Doorkeeper's — its `resource_indicators_supported?` detects the
+      # feature by this column's presence.
+      t.text :resource
+      t.timestamps
+    end
+
+    add_index :spree_oauth_access_grants, :token, unique: true
+
+    create_table :spree_oauth_access_tokens do |t|
+      t.references :resource_owner, polymorphic: true, index: true
+      t.references :application, index: true
+      # Text rather than string: tokens are hashed, and a hash outgrows 255
+      # characters under some configurations.
+      t.text :token, null: false
+      t.text :refresh_token
+      t.integer :expires_in
+      t.datetime :revoked_at
+      t.string :scopes
+      t.string :previous_refresh_token, null: false, default: ''
+      t.text :resource
+      t.timestamps
+    end
+
+    # Hashed tokens are long, so both lookup indexes cover a prefix on MySQL,
+    # where an index over a full-length text column is rejected outright.
+    if connection.adapter_name.match?(/mysql/i)
+      add_index :spree_oauth_access_tokens, :token, unique: true, length: 255
+      add_index :spree_oauth_access_tokens, :refresh_token, unique: true, length: 255
+    else
+      add_index :spree_oauth_access_tokens, :token, unique: true
+      add_index :spree_oauth_access_tokens, :refresh_token, unique: true
+    end
+  end
+end

data/db/migrate/20261016000001_remove_default_from_spree_tax_rates_included_in_price.rb

@@ -0,0 +1,9 @@
+# Whether tax sits inside a price is the market's setting now, and the column is
+# read once by `spree:markets:backfill_tax_inclusive`. New rates leave it empty,
+# so that step, which every later upgrade runs again, never mistakes one for a
+# rate whose tax was added on top. The column is dropped in 6.1.
+class RemoveDefaultFromSpreeTaxRatesIncludedInPrice < ActiveRecord::Migration[8.1]
+  def change
+    change_column_default :spree_tax_rates, :included_in_price, from: false, to: nil
+  end
+end

data/db/migrate/20261016100001_create_spree_tax_exemption_reasons.rb

@@ -0,0 +1,21 @@
+class CreateSpreeTaxExemptionReasons < ActiveRecord::Migration[8.1]
+  def change
+    create_table :spree_tax_exemption_reasons do |t|
+      t.references :store, null: false, index: false
+      t.string :name, null: false
+      t.string :code, null: false
+      t.boolean :active, null: false, default: true
+      if t.respond_to?(:jsonb)
+        t.jsonb :metadata
+      else
+        t.json :metadata
+      end
+      t.timestamps
+    end
+
+    add_index :spree_tax_exemption_reasons, [:store_id, :name], unique: true,
+              name: 'idx_tax_exemption_reasons_on_store_and_name'
+    add_index :spree_tax_exemption_reasons, [:store_id, :code], unique: true,
+              name: 'idx_tax_exemption_reasons_on_store_and_code'
+  end
+end

data/db/migrate/20261017100001_add_tax_exemption_reason_to_spree_tax_exemption_certificates.rb

@@ -0,0 +1,9 @@
+class AddTaxExemptionReasonToSpreeTaxExemptionCertificates < ActiveRecord::Migration[8.1]
+  def change
+    # Nullable, and reason_code kept: certificates recorded before reasons
+    # existed are linked by `spree:upgrade:tax_exemption_reasons`, which reads
+    # their reason_code.
+    add_reference :spree_tax_exemption_certificates, :tax_exemption_reason
+    change_column_null :spree_tax_exemption_certificates, :reason_code, true
+  end
+end

data/db/sample_data/orders.rb

@@ -98,7 +98,7 @@ if tax_rate
     ).first_or_create! do |tax_line|
       tax_line.amount = 0
       tax_line.rate = tax_rate.amount
-      tax_line.included = tax_rate.included_in_price
+      tax_line.included = order.tax_inclusive?
       tax_line.provider_id = 'internal'
     end
   end

data/lib/spree/agent_tool.rb

@@ -0,0 +1,188 @@
+module Spree
+  # One entry in the agent-tool registry ({Spree.admin_agent_tools}).
+  #
+  # A tool is a plain Spree object: a name, a description the model reads, a
+  # JSON parameter schema, the permission key that gates it, whether it
+  # mutates the store, and an executor. Nothing here knows which client is
+  # asking — the MCP server and the dashboard assistant are both adapters
+  # over this one registry, so a tool registered once is offered by both.
+  #
+  # Subclasses implement {#call} and declare their metadata with the class-level
+  # DSL:
+  #
+  #   class Spree::AgentTools::SearchResources < Spree::AgentTool
+  #     tool_name 'search_resources'
+  #     description 'Search store records.'
+  #     permission 'read_products'
+  #     param :resource, description: 'What to search', required: true
+  #
+  #     def call(resource:)
+  #       # ...
+  #     end
+  #   end
+class AgentTool
+    # Declarations live in class attributes rather than plain class-level
+    # instance variables so a subclass inherits them. Subclassing a tool to
+    # tweak it is the documented extension path, and with bare ivars the
+    # subclass would come back `mutating? == false` — writing to the store
+    # immediately, with no approval card, no permission gate and no argument
+    # validation. Inheritance here is a safety property, not a convenience.
+    class_attribute :declared_tool_name, instance_accessor: false
+    class_attribute :declared_description, instance_accessor: false
+    class_attribute :declared_permission, instance_accessor: false
+    class_attribute :declared_mutating, instance_accessor: false, default: false
+    class_attribute :declared_audience, instance_accessor: false, default: :admin
+    class_attribute :declared_params, instance_accessor: false, default: {}.freeze
+
+    class << self
+      # @return [String] the name the model calls this tool by
+      def tool_name(value = nil)
+        self.declared_tool_name = value if value
+        declared_tool_name
+      end
+
+      # @return [String] what the tool does, read by the model when choosing
+      def description(value = nil)
+        self.declared_description = value if value
+        declared_description
+      end
+
+      # RBAC permission key required to use this tool. A user without it never
+      # sees the tool in the list handed to the model.
+      #
+      # @return [String]
+      def permission(value = nil)
+        self.declared_permission = value if value
+        declared_permission
+      end
+
+      # Which surface this tool belongs to: `:admin` for the back office,
+      # `:store` for the storefront.
+      #
+      # Declared on the tool rather than inferred from the registry it was
+      # pushed into, so filing one in the wrong place is refused at
+      # registration. It matters most for the tools that carry no permission
+      # of their own — they are gated per resource, and a blank permission
+      # reads as "anyone may see this".
+      #
+      # @param value [Symbol, nil]
+      # @return [Symbol]
+      def audience(value = nil)
+        self.declared_audience = value.to_sym if value
+        declared_audience
+      end
+
+      # Declares that this tool changes store data, so the turn halts for
+      # human approval instead of executing.
+      #
+      # @return [void]
+      def mutating!
+        self.declared_mutating = true
+      end
+
+      # @return [Boolean]
+      def mutating?
+        declared_mutating == true
+      end
+
+      # @param name [Symbol]
+      # @param type [Symbol] JSON schema type
+      # @param description [String]
+      # @param required [Boolean]
+      # @param items [Symbol] what an array holds — a JSON Schema array without
+      #   it is ambiguous, and a client that validates arguments against the
+      #   schema rejects the call before the tool ever runs
+      # @return [void]
+      def param(name, type: :string, description: nil, required: false, items: nil)
+        # Reassigned rather than mutated, so declaring a param on a subclass
+        # does not reach back and change the parent's list.
+        self.declared_params = declared_params.merge(
+          name => { type: type, description: description, required: required, items: items }
+        ).freeze
+      end
+
+      # @return [Hash{Symbol => Hash}]
+      def params
+        declared_params
+      end
+    end
+
+    # @return [Spree::AgentTools::Context] who is asking, and where
+    attr_reader :context
+
+    # @param context [Spree::AgentTools::Context]
+    def initialize(context)
+      @context = context
+    end
+
+    delegate :tool_name, :description, :permission, :mutating?, :params, to: :class
+
+    # Runs the tool. Subclasses implement this with keyword arguments matching
+    # their declared params.
+    #
+    # @return [Hash] the result handed back to the model
+    def call(**)
+      raise NotImplementedError, 'Agent tools must implement #call'
+    end
+
+    # One line saying what approving this call would do. It is the entire
+    # approval card — the merchant decides on this sentence and nothing else,
+    # so every mutating tool should override it with something that reads
+    # like an instruction ("Set Blue Shirt to draft"), naming the record
+    # rather than its id.
+    #
+    # The fallback spells the arguments out rather than dumping JSON, so a
+    # tool that forgets to override is merely terse instead of unreadable.
+    #
+    # @param arguments [Hash]
+    # @return [String]
+    def summary(arguments)
+      described = arguments.map { |key, value| "#{key.to_s.humanize.downcase} #{value}" }.join(', ')
+
+      [tool_name.humanize, described.presence].compact.join(': ')
+    end
+
+    # Whether the asking user may use this tool at all.
+    #
+    # @return [Boolean]
+    def permitted?
+      context.permitted?(permission)
+    end
+
+    # A resource the map does not hold, answered with the ones it does.
+    #
+    # Every tool that takes a resource key refuses the same way: naming what is
+    # available is what lets the model correct itself in one step instead of
+    # guessing again, and a caller only ever sees resources its own credential
+    # may read.
+    #
+    # @param key [String]
+    # @return [Hash]
+    def unknown_resource(key)
+      {
+        error: "Unknown resource #{key.to_s.inspect}. Call describe_resource for the list.",
+        available: Spree::AgentTools::ResourceMap.available_for(context).map(&:key)
+      }
+    end
+
+    protected
+
+    # Refuses unless this admin may take `action` on `record`.
+    #
+    # Holding `write_products` says an admin may edit products; it does not
+    # say they may edit *this* one. A host app can narrow that with a
+    # record-level rule, and the Admin API honours it — so any tool that
+    # changes a record must ask here first. Returns an error the model reads
+    # rather than raising, so the assistant explains itself instead of the
+    # turn dying.
+    #
+    # @param action [Symbol]
+    # @param record [Object]
+    # @return [Hash, nil] an error result to return, or nil when allowed
+    def unauthorized(action, record)
+      return if context.can?(action, record)
+
+      { error: "You do not have permission to #{action} this #{record.class.name.demodulize.underscore.humanize.downcase}." }
+    end
+  end
+end