spree_core 6.0.0.rc4 → 6.0.0.rc5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bc7dbcacac8f33d70f236f52c52070ee495d7d4e366797055c17d4b119eec6d4
-  data.tar.gz: 3a2e290f02c8d3c9f367c2b4d649d94f69e58449a3ca47179ea58480a3cb1375
+  metadata.gz: 9e7960e9257c5de15c7d9e69d8916c669c5ab082fccd02e17c5ee9c9d9d378c8
+  data.tar.gz: 3c160cd58beb2d3fc3c99bead42bc0d3f365952ae7c2b2c103d92004303f7d13
 SHA512:
-  metadata.gz: ec7a1dc11ffe7aaa8b4cdd82e8e050f39d2d38fedb81c2b3a70901c3db5dbedd0b51bfad12164d2e28962b231ffff777c9ff22a884acc78e631e19a4741ab283
-  data.tar.gz: 4e7f9a59e472892e07722d15a598ca76dc1257c76c1cc969c77dcba8a73b7d78ceccfe88a61c9aa2fb084f633064256df3493bc2b91e79cecb86a9ca6a545259
+  metadata.gz: b396fb4c3d553e372dab904f57cb794015b4c2670028fea33c775fc343ac844db1d0d2733a9c47cfb2450898408ad4696ba312114719f7b3d1ad55716149f674
+  data.tar.gz: 89e9eb2e33742ec34f5c89e5e732544a868e4241ba5886cfa357e0ca43929107d895024ff6e936952c3648cf51ac379e7839ac2d211dc2515697d2ff52d8e7a7

data/app/models/concerns/spree/purchase/addresses.rb

@@ -3,8 +3,8 @@ module Spree
     # The full address surface shared by Spree::Cart and Spree::Order:
     # the bill/ship associations and their public aliases, default filling
     # from the customer's saved addresses, address-row deduplication on
-    # write, ownership-guarded address_id assignment, promotion of checkout
-    # addresses to the customer's defaults, and the ship→bill cloning
+    # write, ownership-guarded address_id assignment and deletion, promotion
+    # of checkout addresses to the customer's defaults, and the ship→bill cloning
     # predicate. The shipping address is canonical: use_shipping copies it
     # onto the billing address; the reverse use_billing direction is a
     # deprecated 6.1-removal bridge. Clone callbacks are wired per model.
@@ -12,8 +12,13 @@ module Spree
       extend ActiveSupport::Concern
 
       included do
-        belongs_to :bill_address, class_name: 'Spree::Address', optional: true, dependent: :destroy
-        belongs_to :ship_address, class_name: 'Spree::Address', optional: true, dependent: :destroy
+        belongs_to :bill_address, class_name: 'Spree::Address', optional: true
+        belongs_to :ship_address, class_name: 'Spree::Address', optional: true
+
+        # Stands in for `dependent: :destroy`, which would take any attached
+        # row down with the purchase. See {#owns_address?} for why only some
+        # of them may go.
+        after_destroy :destroy_own_addresses
 
         # The writers these generate are shadowed by the hand-written ones
         # below, which deduplicate address rows. The declarations still earn
@@ -40,9 +45,12 @@ module Spree
         before_validation :clone_shipping_address, if: :use_shipping?
       end
 
+      # Whether both addresses are present and match. With neither present
+      # there is nothing to call the same.
+      #
       # @return [Boolean]
       def shipping_eq_billing_address?
-        bill_address == ship_address
+        ship_address.present? && bill_address == ship_address
       end
 
       # Whether checkout must collect a customer shipping address. Selected
@@ -90,6 +98,68 @@ module Spree
         use_shipping.in?([true, 'true', '1'])
       end
 
+      # The address behind an id a client may select, or nil when the id names
+      # one this purchase has no business shipping to. Takes a prefixed id or a
+      # raw primary key, so the services that resolve a client-supplied id and
+      # the writers below share one rule rather than each inventing their own.
+      #
+      # Two books qualify. The buyer's own is the ordinary case. The company's
+      # is the B2B one: a purchase for a node ships to that node's sites, and
+      # to its ancestors' — the same self-and-ancestors chain the node's
+      # default address is prefilled from, so a division can pick the
+      # headquarters address it already inherits.
+      #
+      # @param id [Integer, String, nil]
+      # @return [Spree::Address, nil]
+      def selectable_address(id)
+        address = ::Spree::Address.not_deleted.find_by_param(id) || ::Spree::Address.not_deleted.find_by(id: id)
+        return if address.nil?
+
+        return address if customer_id.present? && address.customer_owned? && address.owner_id == customer_id
+
+        company = readable_company
+        return if company.nil? || address.owner_type != 'Spree::Company'
+
+        company.self_and_ancestors.any? { |node| node.id == address.owner_id } ? address : nil
+      end
+
+      # Everything a checkout address picker may offer for this purchase: the
+      # buyer's own book plus the book of the company it names, that node's
+      # own entries and the ones it inherits, limited to the countries the
+      # purchase's market sells to. A subset of what {#selectable_address}
+      # accepts, so a picker built from it never offers an address the
+      # checkout cannot deliver to.
+      #
+      # @return [ActiveRecord::Relation<Spree::Address>]
+      def selectable_addresses
+        books = []
+        books << ::Spree::Address.not_deleted.where(owner_type: ::Spree.customer_class.to_s, owner_id: customer_id) if customer_id.present?
+        books << readable_company&.address_book
+
+        addresses = books.compact.reduce { |left, right| left.or(right) } || ::Spree::Address.none
+        return addresses if market.nil?
+
+        addresses.where(country_code: market.market_countries.select(:country_code))
+      end
+
+      # Whether an attached address row is this purchase's own to delete.
+      #
+      # Only the ownerless rows are: the one a guest typed in, and the
+      # snapshot completion copies onto the order. Everything else is an entry
+      # in somebody's address book — the buyer's, a company node's, a seller's
+      # — which the purchase is merely pointing at. A cart may name a company
+      # site every other member ships from, so taking an attached row down
+      # with the cart would let one member empty the shared book.
+      #
+      # A business snapshot keeps its +owner_type+ to stay addressed to a
+      # company rather than to a person, so ownership is the id, not the type.
+      #
+      # @param address [Spree::Address, nil]
+      # @return [Boolean]
+      def owns_address?(address)
+        address.present? && address.owner_id.blank?
+      end
+
       # Fills any blank bill/ship address from the customer's valid saved
       # defaults. The ship address is skipped when no physical delivery is
       # required, so shipping-address validations never fire on digital-only
@@ -174,6 +244,26 @@ module Spree
 
       private
 
+      # The company whose book this purchase may read: only the one the
+      # client named, never one inferred from a sole membership. A cart asks
+      # again rather than trusting the column, which nothing clears when a
+      # membership is revoked; an order's authority is staff or a completed
+      # cart, so it keeps what it was given.
+      #
+      # @return [Spree::Company, nil]
+      def readable_company
+        return company if company.nil? || !is_a?(Spree::Cart)
+
+        company if customer&.standing_for?(company)
+      end
+
+      # Both slots often hold the same row, so destroy it once.
+      def destroy_own_addresses
+        [bill_address, ship_address].compact.uniq.each do |address|
+          address.destroy if owns_address?(address)
+        end
+      end
+
       def items_require_shipping_address?
         # Answered by the profile kind, resolved once per profile.
         profile_requires_address = Hash.new do |cache, profile|
@@ -187,33 +277,6 @@ module Spree
         end
       end
 
-      # The address behind an id a client may select, or nil when the id names
-      # one this purchase has no business shipping to.
-      #
-      # Two books qualify. The buyer's own is the ordinary case. The company's
-      # is the B2B one: a purchase for a node ships to that node's sites, and
-      # to its ancestors' — the same self-and-ancestors chain the node's
-      # default address is prefilled from, so a division can pick the
-      # headquarters address it already inherits.
-      #
-      # Standing is not re-checked here: a cart cannot name a company its
-      # customer lacks standing over, so reaching this point already means the
-      # buyer may act for the node.
-      #
-      # @param id [Integer, String, nil]
-      # @return [Spree::Address, nil]
-      def selectable_address(id)
-        address = ::Spree::Address.find_by(id: id)
-        return nil if address.nil?
-
-        return address if customer_id.present? && address.customer_owned? && address.owner_id == customer_id
-
-        company = resolved_company
-        return nil if company.nil? || address.owner_type != 'Spree::Company'
-
-        company.self_and_ancestors.any? { |node| node.id == address.owner_id } ? address : nil
-      end
-
       # Reuse never reaches past what the buyer already owns: a signed-in buyer
       # may name any entry of their own address book, and a guest — who keeps
       # no book — may only edit the row already in the slot being written.

data/app/models/concerns/spree/webhook_payload_redaction.rb

@@ -32,6 +32,7 @@ module Spree
       reset_token
       unsubscribe_token
       verification_token
+      confirmation_token
       download_url
       external_client_secret
       client_secret

data/app/models/spree/ability.rb

@@ -167,6 +167,9 @@ module Spree
 
     # Reference data every staff member can read regardless of keys — address
     # forms need countries/states, and the dashboard shell reads the store.
+    # The back office also reads the store's markets and channels: its
+    # currencies and languages come from the markets, and list filters offer
+    # both.
     #
     # The store grant is unrestricted only for the store's own back office.
     # Another panel reads the one store it operates under and no other, so a
@@ -180,6 +183,11 @@ module Spree
       else
         can :read, Spree::Store, id: @store.id
       end
+
+      return unless store_resource?
+
+      can :read, Spree::Market, store_id: @resource.id
+      can :read, Spree::Channel, store_id: @resource.id
     end
 
   end

data/app/models/spree/address.rb

@@ -343,6 +343,12 @@ module Spree
     def snapshot
       dup.tap do |copy|
         copy.owner = nil
+
+        if business_owned?
+          copy.company = company.presence || owner&.name
+          copy.owner_type = owner_type
+        end
+
         copy.label = nil
         copy.deleted_at = nil
       end

data/app/models/spree/cart.rb

@@ -284,12 +284,9 @@ module Spree
     #
     # @return [ActiveRecord::Relation<Spree::Variant>]
     def orderable_variants
-      products = Spree.products_for_context_service.call(
-        store: store, channel: channel, customer: customer, company: resolved_company,
-        base: store.products.not_discontinued_on(channel)
-      ).value
-
-      Spree::Variant.for_products(products)
+      Spree::SalesContext.new(
+        store: store, channel: channel, customer: customer, company: resolved_company, resolve_company: false
+      ).orderable_variants
     end
 
     # Removes out-of-stock/discontinued items and populates warnings

data/app/models/spree/company.rb

@@ -245,7 +245,7 @@ module Spree
     #
     # @return [ActiveRecord::Relation]
     def address_book
-      Spree::Address.where(owner_type: 'Spree::Company', owner_id: self_and_ancestors.map(&:id))
+      Spree::Address.not_deleted.where(owner_type: 'Spree::Company', owner_id: self_and_ancestors.map(&:id))
     end
 
     private

data/app/models/spree/data_request.rb

@@ -20,9 +20,12 @@ module Spree
 
     publishes_lifecycle_events
     publishes_event :completed
+    publishes_event :confirmation_requested,
+                    serializer: 'Spree::Api::V3::DataRequestConfirmationRequestedEventSerializer',
+                    credential: 'write_customers'
 
     include Spree::HasStatus
-    has_status :pending, :processing, :completed, :failed, default: :pending
+    has_status :awaiting_confirmation, :pending, :processing, :completed, :failed, :lapsed, default: :pending
 
     ACCESS = 'access'.freeze
     ERASURE = 'erasure'.freeze
@@ -33,11 +36,23 @@ module Spree
     # about them is not left lying around.
     DEFAULT_EXPIRY = 7.days
 
+    # How long a request a customer raised waits for confirmation from its
+    # email address before it lapses.
+    CONFIRMATION_WINDOW = 24.hours
+
     # Addresses the finished export. Plaintext like the digital-link token:
     # the URL is the credential, it is only ever sent to the address that
     # asked, and it stops working when the request expires.
     has_secure_token :download_token
 
+    # Proves that whoever confirms reads mail at the address the request
+    # names. Bound to
+    # the download token, so an erasure, which clears it, voids every link
+    # already sent.
+    generates_token_for :confirmation do
+      download_token
+    end
+
     belongs_to :customer, class_name: Spree.customer_class.to_s
     # Null when the subject asked for it themselves; set when staff acted on a
     # request that arrived by email.
@@ -52,6 +67,8 @@ module Spree
     scope :access, -> { where(kind: ACCESS) }
     scope :erasure, -> { where(kind: ERASURE) }
     scope :in_progress, -> { with_status(:pending, :processing) }
+    scope :confirmable, -> { awaiting_confirmation.where(requested_at: CONFIRMATION_WINDOW.ago..) }
+    scope :past_confirmation_window, -> { awaiting_confirmation.where(requested_at: ...CONFIRMATION_WINDOW.ago) }
     scope :recent_first, -> { order(requested_at: :desc) }
 
     self.whitelisted_ransackable_attributes = %w[number kind status email requested_at completed_at]
@@ -89,6 +106,22 @@ module Spree
       expires_at.present? && expires_at.past?
     end
 
+    # Whether the request is still waiting for confirmation, within the window
+    # to receive it, and still names the account's address.
+    # @return [Boolean]
+    def confirmable?
+      awaiting_confirmation? && requested_at > CONFIRMATION_WINDOW.ago && addressed_to_customer?
+    end
+
+    # Whether the request names the address the account has now. The work
+    # matches guest rows by the account's address when it runs, so a request
+    # for an address the account has since left would reach rows it never
+    # named.
+    # @return [Boolean]
+    def addressed_to_customer?
+      customer.present? && email.to_s.casecmp?(customer.email.to_s)
+    end
+
     private
 
     def set_defaults

data/app/models/spree/order.rb

@@ -152,7 +152,7 @@ module Spree
     self.whitelisted_ransackable_attributes = %w[
       completed_at email number status payment_status payment_state fulfillment_status shipment_state delivery_total
       total item_total total_quantity considered_risky channel_id currency coupon_code customer_id seller_id
-      order_group_id po_number
+      order_group_id po_number market_id locale
     ]
     self.whitelisted_ransackable_scopes = %w[complete incomplete refunded partially_refunded search]
     self.ransackable_scope_types = %w[complete incomplete refunded partially_refunded].index_with('boolean')

data/app/models/spree/sales_context.rb

@@ -0,0 +1,162 @@
+module Spree
+  # Who buys, on which channel, in which market: what a buyer can be sold, and
+  # at what price, depends on all of these together. A market fixes the
+  # currency and the languages a sale may use.
+  class SalesContext
+    include ActiveModel::Model
+    include ActiveModel::Attributes
+
+    attribute :store
+    attribute :market
+    attribute :channel
+    attribute :customer
+    attribute :company
+    attribute :country
+    attribute :currency, :string
+    attribute :locale, :string
+    # A placed sale keeps the company it was stamped with, even none, so only
+    # a sale still being put together looks up the customer's company.
+    attribute :resolve_company, :boolean, default: true
+
+    validate :currency_sold_in_a_market
+    validate :currency_matches_market
+    validate :locale_supported_by_market
+
+    # @param order [Spree::Order]
+    # @return [Spree::SalesContext]
+    def self.from_order(order)
+      new(
+        store: order.store, market: order.market, channel: order.channel, customer: order.customer,
+        company: order.resolved_company, resolve_company: false, country: order.tax_country,
+        currency: order.currency, locale: order.locale
+      )
+    end
+
+    # The market chosen for the sale, else one selling the requested currency,
+    # else the store's default.
+    #
+    # @return [Spree::Market, nil]
+    def market
+      chosen = super
+      return chosen if chosen
+      return @resolved_market if defined?(@resolved_market)
+
+      @resolved_market = resolve_market
+    end
+
+    def channel
+      super || store&.default_channel
+    end
+
+    # @return [String] the requested currency, else the market's, else the store's
+    def currency
+      requested_currency || market&.currency || store&.default_currency
+    end
+
+    # @return [String, nil] the requested language, else the market's default
+    def locale
+      super.presence || market&.default_locale
+    end
+
+    # The company chosen for the sale, else the one the customer stands in
+    # alone — the same answer pricing and catalog visibility reach.
+    #
+    # @return [Spree::Company, nil]
+    def company
+      chosen = super
+      return chosen if chosen || !resolve_company
+      return @standing_company if defined?(@standing_company)
+
+      @standing_company =
+        if customer.is_a?(Spree.customer_class) && store
+          Spree::Company.sole_standing_for(store: store, customer: customer)
+        end
+    end
+
+    # Variants the buyer may order on the channel: published there and inside
+    # their catalogs.
+    #
+    # @return [ActiveRecord::Relation<Spree::Variant>]
+    def orderable_variants
+      @orderable_variants ||= Spree::Variant.for_products(
+        Spree.products_for_context_service.call(
+          store: store, channel: channel, customer: customer, company: company,
+          base: store.products.not_discontinued_on(channel)
+        ).value
+      )
+    end
+
+    # Orderable variants the buyer can be quoted in the sale's currency: a base
+    # price, or a price from a list that applies to them, so a product sold to
+    # a buyer only under their agreement is offered to that buyer alone.
+    #
+    # @return [ActiveRecord::Relation<Spree::Variant>]
+    def sellable_variants
+      prices = Spree::Price.where(variant_id: orderable_variants.select(:id), currency: currency)
+                           .where.not(amount: nil)
+                           .where(price_list_id: [nil, *applicable_price_list_ids])
+
+      orderable_variants.where(id: prices.select(:variant_id))
+    end
+
+    # @return [Spree::Pricing::Context] the context prices are resolved in
+    def pricing_context
+      @pricing_context ||= Spree::Pricing::Context.new(
+        currency: currency, store: store, country: country, market: market,
+        channel: channel, user: customer, company: company
+      )
+    end
+
+    private
+
+    def requested_currency
+      attributes['currency'].presence&.upcase
+    end
+
+    def resolve_market
+      return unless store
+
+      candidates = [(Spree::Current.market if Spree::Current.store == store), store.default_market].compact
+      return candidates.first unless requested_currency
+
+      candidates.find { |candidate| candidate.currency == requested_currency } ||
+        store.markets.find_by(currency: requested_currency)
+    end
+
+    # Catalog price lists the buyer's catalogs carry, and standalone lists
+    # whose rules match the sale, judged the way the internal pricing provider
+    # judges them.
+    def applicable_price_list_ids
+      @applicable_price_list_ids ||= begin
+        catalogs = Spree::Catalog.groups_for_buyer(store: store, customer: customer, company: company, channel: channel)
+        catalog_lists = catalogs.flatten.filter_map(&:price_list).select do |list|
+          list.currently_active? && list.contextual_rules_applicable?(pricing_context)
+        end
+        standalone_lists = Spree::PriceList.for_context(pricing_context).select { |list| list.applicable?(pricing_context) }
+
+        (catalog_lists + standalone_lists).map(&:id).uniq
+      end
+    end
+
+    def currency_sold_in_a_market
+      return if requested_currency.nil? || market || store.nil? || !store.markets.exists?
+
+      errors.add(:currency, :currency_not_supported_by_store, message: I18n.t('spree.currency_not_supported_by_store'))
+    end
+
+    def currency_matches_market
+      return if market.nil? || currency == market.currency
+
+      errors.add(
+        :currency, :currency_does_not_match_market,
+        message: I18n.t('spree.currency_does_not_match_market', currency: market.currency)
+      )
+    end
+
+    def locale_supported_by_market
+      return if market.nil? || locale.blank? || market.supported_locales_list.include?(locale)
+
+      errors.add(:locale, :locale_not_supported_by_market, message: I18n.t('spree.locale_not_supported_by_market'))
+    end
+  end
+end

data/app/models/spree/tax_line.rb

@@ -22,10 +22,11 @@ module Spree
     # core doesn't know about registers its reason here. The bar for a new
     # value: it distinguishes a treatment that reporting or invoicing has to
     # tell apart, not merely a different amount.
-    class_attribute :taxability_reasons,
-                    default: %w[standard_rated reduced_rated zero_rated reverse_charge
-                                intra_community_supply export customer_exempt product_exempt
-                                not_collecting not_subject_to_tax]
+    BUILT_IN_TAXABILITY_REASONS = %w[standard_rated reduced_rated zero_rated reverse_charge
+                                     intra_community_supply export customer_exempt product_exempt
+                                     not_collecting not_subject_to_tax].freeze
+
+    class_attribute :taxability_reasons, default: BUILT_IN_TAXABILITY_REASONS.dup
 
     # Provider payloads (jurisdiction breakdowns, external ids) read nil-safe.
     attribute :data, default: -> { {} }

data/app/services/spree/carts/destroy.rb

@@ -52,9 +52,14 @@ module Spree
         success(cart: cart)
       end
 
+      # Lets go of everything the cart was only borrowing, so the cascade that
+      # follows reaches nothing but the cart's own rows. An entry in somebody's
+      # address book stays in it, and a row a fulfillment or a completed order
+      # still points at is detached rather than soft-deleted out from under
+      # them.
       def clear_addresses(cart:)
-        cart.ship_address = nil unless cart.ship_address&.can_be_deleted?
-        cart.bill_address = nil unless cart.bill_address&.can_be_deleted?
+        cart.ship_address = nil unless cart.owns_address?(cart.ship_address) && cart.ship_address.can_be_deleted?
+        cart.bill_address = nil unless cart.owns_address?(cart.bill_address) && cart.bill_address.can_be_deleted?
 
         success(cart: cart)
       end

data/app/services/spree/carts/update.rb

@@ -206,10 +206,7 @@ module Spree
       end
 
       def resolve_address_id(prefixed_id)
-        return unless cart.customer
-
-        decoded = Spree::Address.decode_prefixed_id(prefixed_id)
-        decoded ? cart.customer.addresses.find_by(id: decoded)&.id : nil
+        cart.selectable_address(prefixed_id)&.id
       end
 
       def assign_market

data/app/services/spree/data_requests/confirm.rb

@@ -0,0 +1,37 @@
+module Spree
+  module DataRequests
+    # Confirms a request the customer raised, from the link emailed to the
+    # address it names, and queues the work.
+    #
+    # Confirming again is answered with the request as it stands, so a second
+    # click on the same link changes nothing.
+    class Confirm
+      prepend Spree::ServiceModule::Base
+
+      # @param data_request [Spree::DataRequest]
+      # @return [Spree::ServiceModule::Result] the confirmed request
+      def call(data_request:)
+        newly_confirmed = false
+
+        data_request.with_lock do
+          newly_confirmed = data_request.confirmable?
+
+          if newly_confirmed
+            data_request.update!(status: 'pending')
+          elsif data_request.awaiting_confirmation?
+            data_request.update!(status: 'lapsed')
+          end
+        end
+
+        if data_request.lapsed?
+          data_request.errors.add(:base, I18n.t('spree.data_request_errors.confirmation_invalid'))
+          return failure(data_request)
+        end
+
+        Spree::DataRequests::ProcessJob.perform_later(data_request.prefixed_id) if newly_confirmed
+
+        success(data_request)
+      end
+    end
+  end
+end

data/app/services/spree/data_requests/create.rb

@@ -7,9 +7,15 @@ module Spree
     # whole history, and a customer holding the button down should not be able
     # to queue a hundred of them. It is also the honest answer — the request
     # they already made is still being worked on.
+    #
+    # A request the customer raised themselves waits for confirmation from its
+    # email address instead of being queued, because it reaches guest orders
+    # placed at that address. Asking again while it waits sends the email again.
     class Create
       prepend Spree::ServiceModule::Base
 
+      CONFIRMATION_EVENT = 'data_request.confirmation_requested'.freeze
+
       # @param store [Spree::Store]
       # @param customer [Spree::Customer]
       # @param kind [String] Spree::DataRequest::ACCESS or ERASURE
@@ -19,8 +25,12 @@ module Spree
       #   caller fulfils the request itself — the admin export renders the file
       #   inline for a waiting staffer, and queueing would additionally email
       #   the customer a copy of something they did not ask for
+      # @param confirm_by_email [Boolean] hold the request until it is
+      #   confirmed from its email address; true for the customer's own requests
+      # @param redirect_url [String, nil] the storefront page the confirmation
+      #   link opens, already checked against the store's allowed origins
       # @return [Spree::ServiceModule::Result]
-      def call(store:, customer:, kind:, requested_by: nil, process: true)
+      def call(store:, customer:, kind:, requested_by: nil, process: true, confirm_by_email: false, redirect_url: nil)
         # Nothing useful is left to answer with: an export would return the
         # tombstone and email a link to an address that no longer receives,
         # and a second erasure has nothing to erase.
@@ -38,7 +48,9 @@ module Spree
         # of the same person's whole history; taking the lock closes it without
         # a partial unique index, which MySQL does not support.
         customer.with_lock do
-          existing = in_flight_request(store: store, customer: customer, kind: kind)
+          lapse_unconfirmed_requests(store: store, customer: customer, kind: kind, staff_request: !confirm_by_email)
+          existing = in_flight_request(store: store, customer: customer, kind: kind,
+                                       include_unconfirmed: confirm_by_email)
 
           unless existing
             data_request = Spree::DataRequest.new(
@@ -46,20 +58,27 @@ module Spree
               customer: customer,
               kind: kind.to_s,
               email: customer.email,
-              requested_by: requested_by
+              requested_by: requested_by,
+              status: confirm_by_email ? 'awaiting_confirmation' : 'pending'
             )
             data_request.save
           end
         end
 
-        return success(existing) if existing
-        return failure(data_request) unless data_request.persisted?
+        return failure(data_request) if data_request && !data_request.persisted?
 
-        # Enqueued after the lock is released: the job may start immediately,
-        # and it should not contend for the row this flow still holds.
-        Spree::DataRequests::ProcessJob.perform_later(data_request.prefixed_id) if process
+        request = existing || data_request
 
-        success(data_request)
+        # Both happen after the lock is released: the job may start at once and
+        # should not contend for the row this flow holds, and the email must
+        # not go out before the row is committed.
+        if request.awaiting_confirmation?
+          request_confirmation(request, redirect_url: redirect_url)
+        elsif data_request && process
+          Spree::DataRequests::ProcessJob.perform_later(data_request.prefixed_id)
+        end
+
+        success(request)
       end
 
       private
@@ -67,10 +86,39 @@ module Spree
       # Only the person's own requests. A staff member exporting from the admin
       # opens their own row and answers it inline, and handing that back here
       # would close the customer's request with a file they can never download.
-      def in_flight_request(store:, customer:, kind:)
-        Spree::DataRequest.where(store_id: store.id, customer_id: customer.id, kind: kind.to_s,
-                                 requested_by_id: nil).
-          in_progress.recent_first.first
+      # A request still waiting for confirmation is returned only to the
+      # customer: staff have checked who they are dealing with, so theirs
+      # proceeds on its own row (see lapse_unconfirmed_requests).
+      def in_flight_request(store:, customer:, kind:, include_unconfirmed:)
+        requests = Spree::DataRequest.where(store_id: store.id, customer_id: customer.id, kind: kind.to_s,
+                                            requested_by_id: nil)
+        open_requests = include_unconfirmed ? requests.in_progress.or(requests.confirmable) : requests.in_progress
+
+        open_requests.recent_first.first
+      end
+
+      # Lapses what can no longer be confirmed: requests past the window, and
+      # requests naming an address the account has since moved away from, so
+      # asking again emails the current address. A staff request of the same
+      # kind replaces the customer's unconfirmed one, which would otherwise
+      # run the same work a second time once confirmed.
+      def lapse_unconfirmed_requests(store:, customer:, kind:, staff_request:)
+        unconfirmed = Spree::DataRequest.where(store_id: store.id, customer_id: customer.id).awaiting_confirmation
+        stale = unconfirmed.past_confirmation_window.or(unconfirmed.where.not(email: customer.email))
+        stale = stale.or(unconfirmed.where(kind: kind.to_s)) if staff_request
+
+        stale.find_each { |data_request| data_request.update!(status: 'lapsed') }
+      end
+
+      # The token travels in a credential event, which reaches only webhook
+      # endpoints that name it and keeps the token out of the delivery log.
+      def request_confirmation(data_request, redirect_url:)
+        payload = data_request.event_payload_for(
+          CONFIRMATION_EVENT,
+          confirmation_token: data_request.generate_token_for(:confirmation),
+          redirect_url: redirect_url.presence
+        )
+        data_request.publish_event(CONFIRMATION_EVENT, payload)
       end
     end
   end

data/app/workflows/spree/customers/anonymize.rb

@@ -212,9 +212,15 @@ module Spree
         # redacting that would overwrite the shared address for every other
         # member and every other order. Only rows this person owns, or rows
         # nobody owns, are this erasure's to rewrite.
+        #
+        # Ownership is the id alone, never the type. A snapshot taken from a
+        # company site keeps its owner_type so the copy stays addressed to a
+        # business rather than to a person, so matching on the type too would
+        # skip exactly those copies — and an erasure that quietly covers less
+        # than it did raises nothing.
         snapshots = Spree::Address.where(id: address_ids)
         mine = snapshots.where(owner_type: customer.class.base_class.to_s, owner_id: customer.id)
-        unowned = snapshots.where(owner_type: nil, owner_id: nil)
+        unowned = snapshots.where(owner_id: nil)
 
         mine.or(unowned).find_each do |address|
           redact_address(address, deleted: false)
@@ -407,7 +413,9 @@ module Spree
         end
 
         # The token goes too, so a link already emailed stops resolving rather
-        # than waiting out its expiry.
+        # than waiting out its expiry. Confirmation links are bound to it, so
+        # a request still waiting for one can never be confirmed.
+        requests.awaiting_confirmation.update_all(status: 'lapsed', updated_at: Time.current)
         requests.update_all(
           email: customer.email,
           download_token: nil,
@@ -458,22 +466,35 @@ module Spree
 
       # @param address [Spree::Address]
       # @param deleted [Boolean] whether to soft-delete it as well
+      # What the person left on an address, rewritten; the address itself kept
+      # readable enough to answer a tax enquiry.
+      #
+      # A snapshot copied from a company site is the narrower case. The dock
+      # and the trading name on it are the business's, not this person's, and
+      # erasing them would take the merchant's record of a lawful sale with
+      # them — so only the contact details go. A business address is allowed
+      # to name nobody, which is why those fields are emptied rather than
+      # stamped: writing "Redacted" where a company never named anyone would
+      # invent a person who was not there.
       def redact_address(address, deleted:)
-        attributes = {
-          first_name: REDACTED_NAME,
-          last_name: REDACTED_NAME,
-          address1: REDACTED_NAME,
-          address2: nil,
-          phone: nil,
-          alternative_phone: nil,
-          company: nil,
-          label: nil,
-          latitude: nil,
-          longitude: nil,
-          postal_code: truncated_postal_code(address.postal_code),
-          metadata: {},
-          updated_at: Time.current
-        }
+        attributes =
+          if address.business_owned?
+            { first_name: nil, last_name: nil }
+          else
+            {
+              first_name: REDACTED_NAME,
+              last_name: REDACTED_NAME,
+              address1: REDACTED_NAME,
+              address2: nil,
+              company: nil,
+              label: nil,
+              latitude: nil,
+              longitude: nil,
+              postal_code: truncated_postal_code(address.postal_code)
+            }
+          end
+
+        attributes.merge!(phone: nil, alternative_phone: nil, metadata: {}, updated_at: Time.current)
         attributes[:deleted_at] = Time.current if deleted && address.deleted_at.nil?
 
         address.update_columns(attributes)

data/app/workflows/spree/data_requests/fulfill.rb

@@ -36,6 +36,7 @@ module Spree
         super
 
         step :ensure_pending
+        step :ensure_addressed_to_customer
         step :mark_processing
 
         run_hooks :before_fulfill
@@ -56,6 +57,15 @@ module Spree
         failure(data_request, I18n.t('spree.data_request_errors.not_pending'))
       end
 
+      # An account already erased has a replaced address by design, and
+      # erase_customer counts that as done.
+      def ensure_addressed_to_customer
+        customer = data_request.customer
+        return if customer.nil? || customer.anonymized? || data_request.addressed_to_customer?
+
+        failure(data_request, I18n.t('spree.data_request_errors.address_changed'))
+      end
+
       def mark_processing
         data_request.update!(status: 'processing')
       end
@@ -78,21 +88,25 @@ module Spree
         # anonymizer starts after the check and finishes its attachment scan
         # before this attaches, stranding a full personal-data file it will
         # never see.
+        #
+        # The address is checked again under the same lock, so it cannot change
+        # between the check and the export reading it.
         return attach_export unless customer
 
-        refused = false
+        refusal = nil
 
         customer.with_lock do
-          if customer.reload.anonymized?
-            refused = true
+          customer.reload
+          if customer.anonymized?
+            refusal = 'spree.data_request_errors.already_anonymized'
+          elsif !data_request.addressed_to_customer?
+            refusal = 'spree.data_request_errors.address_changed'
           else
             attach_export
           end
         end
 
-        return unless refused
-
-        failure(data_request, I18n.t('spree.data_request_errors.already_anonymized'))
+        failure(data_request, I18n.t(refusal)) if refusal
       end
 
       def attach_export

data/app/workflows/spree/orders/create.rb

@@ -28,6 +28,14 @@ module Spree
 
         return failure(:store_is_required) if store.nil?
 
+        @sales_context = Spree::SalesContext.new(
+          store: store,
+          market: (resolve_market if @params[:market_id].present?),
+          currency: @params[:currency],
+          locale: @params[:locale]
+        )
+        return refuse_sales_context unless @sales_context.valid?
+
         order = nil
         ApplicationRecord.transaction do
           order = build_order
@@ -60,8 +68,9 @@ module Spree
           customer: @customer,
           created_by: @created_by,
           email: @params[:email] || @customer&.email,
-          currency: @params[:currency].presence&.upcase || @store.default_currency,
-          locale: @params[:locale] || Spree::Current.locale,
+          market: @sales_context.market,
+          currency: @sales_context.currency,
+          locale: @sales_context.locale || Spree::Current.locale,
           customer_note: @params[:customer_note],
           po_number: @params[:po_number],
           internal_note: @params[:internal_note],
@@ -74,7 +83,6 @@ module Spree
         # signed id, so it assigns like any other attribute.
         attrs[:po_document_signed_id] = @params[:po_document_signed_id] if @params[:po_document_signed_id].present?
 
-        attrs[:market] = resolve_market if @params[:market_id].present?
         attrs[:channel] = resolve_channel if @params[:channel_id].present?
         attrs[:company] = resolve_company if @params[:company_id].present?
         attrs[:preferred_stock_location] = resolve_preferred_stock_location if @params[:preferred_stock_location_id].present?
@@ -83,6 +91,12 @@ module Spree
         @store.orders.new(attrs)
       end
 
+      def refuse_sales_context
+        order = @store.orders.new
+        order.errors.merge!(@sales_context.errors)
+        failure(order, order.errors.full_messages.to_sentence)
+      end
+
       def resolve_market
         @store.markets.find_by_param!(@params[:market_id])
       end
@@ -100,34 +114,44 @@ module Spree
       end
 
       def assign_addresses(order)
-        if @params[:use_customer_default_address] && @customer
-          @customer.association(:bill_address).load_target
-          @customer.association(:ship_address).load_target
-          order.bill_address = @customer.bill_address&.snapshot
-          order.ship_address = @customer.ship_address&.snapshot
-        end
+        assign_default_addresses(order) if @params[:use_customer_default_address]
 
         assign_address(order, :ship_address, @params[:shipping_address_id], @params[:shipping_address])
         assign_address(order, :bill_address, @params[:billing_address_id], @params[:billing_address])
+        order.use_shipping = @params[:use_shipping]
+      end
+
+      def assign_default_addresses(order)
+        company = order.company
+
+        if company.present?
+          order.bill_address = company.default_billing_address&.snapshot
+          order.ship_address = company.default_shipping_address&.snapshot
+          return
+        end
+
+        return if @customer.nil?
+
+        @customer.association(:bill_address).load_target
+        @customer.association(:ship_address).load_target
+        order.bill_address = @customer.bill_address&.snapshot
+        order.ship_address = @customer.ship_address&.snapshot
       end
 
       def assign_address(order, association, address_id, address_attrs)
         if address_id.present?
-          address = resolve_user_address(address_id)
+          address = order.selectable_address(address_id)
           order.public_send(:"#{association}_id=", address.id) if address
         elsif address_attrs.present?
           order.public_send(:"#{association}_attributes=", address_attrs)
         end
       end
 
-      def resolve_user_address(address_id)
-        return unless @customer
-
-        @customer.addresses.find_by_param(address_id)
-      end
-
       def add_items(order)
-        result = Spree::Orders::UpsertItems.call(order: order, items: @params[:items])
+        result = Spree::Orders::UpsertItems.call(
+          order: order, items: @params[:items],
+          orderable_variants: Spree::SalesContext.from_order(order).orderable_variants
+        )
         return if result.success?
 
         propagate_step_failure!(order, result, fallback: 'Failed to add items to order')

data/config/locales/en.yml

@@ -765,6 +765,7 @@ en:
     created_at: Created at
     credit_card: Credit Card
     currency: Currency
+    currency_does_not_match_market: must be %{currency}, the currency of the chosen market
     currency_not_supported_by_store: is not supported by this store
     custom_field_definitions: Custom Field Definitions
     custom_fields: Custom Fields
@@ -773,7 +774,9 @@ en:
       anonymize_failed: The erasure could not be completed and nothing was changed
     customers: Customers
     data_request_errors:
+      address_changed: The account's email address changed after this request was made
       already_anonymized: This customer's personal data has already been erased
+      confirmation_invalid: This confirmation link has expired or is no longer valid
       download_unavailable: This download link has expired or is no longer valid
       not_pending: This request has already been processed
     default: Default
@@ -1016,6 +1019,7 @@ en:
     line_items: Line items
     link: Link
     locale: Locale
+    locale_not_supported_by_market: is not offered by the chosen market
     locale_not_supported_by_store: is not supported by this store
     locales_not_listed: 'includes locales Spree does not support: %{codes}'
     manual: Manual

data/lib/spree/core/engine.rb

@@ -506,6 +506,7 @@ module Spree
           Spree::Address,
           Spree::Claim,
           Spree::Collection,
+          Spree::Company,
           Spree::CreditCard,
           Spree::Exchange,
           Spree::GiftCard,
@@ -521,6 +522,7 @@ module Spree
           Spree::Product,
           Spree::ProductType,
           Spree::Promotion,
+          Spree::PurchaseOrder,
           Spree::Refund,
           Spree::Return,
           Spree::Fulfillment,

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '6.0.0.rc4'.freeze
+  VERSION = '6.0.0.rc5'.freeze
 
   def self.version
     VERSION

data/lib/spree/testing_support/factories/data_request_factory.rb

@@ -9,6 +9,10 @@ FactoryBot.define do
       kind { Spree::DataRequest::ERASURE }
     end
 
+    trait :awaiting_confirmation do
+      status { 'awaiting_confirmation' }
+    end
+
     trait :completed do
       status { 'completed' }
       completed_at { Time.current }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 6.0.0.rc4
+  version: 6.0.0.rc5
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-19 00:00:00.000000000 Z
+date: 2026-10-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -1193,6 +1193,7 @@ files:
 - app/models/spree/rich_text_sanitizer.rb
 - app/models/spree/role.rb
 - app/models/spree/role_user.rb
+- app/models/spree/sales_context.rb
 - app/models/spree/saved_report.rb
 - app/models/spree/search_provider.rb
 - app/models/spree/search_provider/base.rb
@@ -1358,6 +1359,7 @@ files:
 - app/services/spree/coupon_codes/bulk_generate.rb
 - app/services/spree/coupon_codes/coupon_codes_handler.rb
 - app/services/spree/customers/data_export.rb
+- app/services/spree/data_requests/confirm.rb
 - app/services/spree/data_requests/create.rb
 - app/services/spree/deliveries/create.rb
 - app/services/spree/deliveries/destroy.rb
@@ -2369,9 +2371,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.0.rc4
+  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.0.rc5
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v6.0.0.rc4
+  source_code_uri: https://github.com/spree/spree/tree/v6.0.0.rc5
 post_install_message:
 rdoc_options: []
 require_paths: