spree_core 6.0.0.rc4 → 6.0.0.rc6

data/app/models/spree/webhook_endpoint.rb

@@ -20,6 +20,10 @@ module Spree
     validates :url, format: { with: URI::DEFAULT_PARSER.make_regexp(%w[http https]), message: :invalid_url }
     validates :active, inclusion: { in: [true, false] }
     validate :url_must_not_resolve_to_private_ip, if: -> { !Rails.env.development? && url.present? && url_changed? }
+    validate :subscriptions_must_be_event_patterns, if: :will_save_change_to_subscriptions?
+
+    attribute :subscriptions, default: -> { [] }
+    normalizes :subscriptions, apply_to_nil: true, with: ->(value) { Array(value).map { |entry| entry.to_s.strip }.reject(&:empty?).uniq }
 
     before_create :generate_secret_key
     after_create  { @reveal_secret_in_response = true }
@@ -83,6 +87,23 @@ module Spree
     # Number of consecutive failed deliveries before auto-disabling
     AUTO_DISABLE_THRESHOLD = 15
 
+    MAX_SUBSCRIPTIONS = 200
+    MAX_SUBSCRIPTION_LENGTH = 100
+    SUBSCRIPTION_SEGMENT = /\A[a-zA-Z0-9_-]+\z/
+
+    # Whether +value+ is a shape `subscriptions` accepts: `*`, an event name,
+    # or a name with `*` in place of whole segments (`order.*`, `*.created`).
+    # Anything else — regexp syntax above all — is refused before it is
+    # stored, so the matcher only ever sees names and segment wildcards.
+    #
+    # @param value [Object]
+    # @return [Boolean]
+    def self.event_pattern?(value)
+      return false unless value.is_a?(String) && value.length.between?(1, MAX_SUBSCRIPTION_LENGTH)
+
+      value.split('.', -1).all? { |segment| segment == '*' || segment.match?(SUBSCRIPTION_SEGMENT) }
+    end
+
     # Check if this endpoint is subscribed to a specific event.
     #
     # Events whose payload carries a live credential (a password reset token)
@@ -93,16 +114,9 @@ module Spree
     # @return [Boolean]
     def subscribed_to?(event_name)
       return subscriptions.to_a.include?(event_name) if Spree::Events.catalog.credential?(event_name)
-      return true if subscriptions.blank? || subscriptions.include?('*')
-
-      subscriptions.any? do |subscription|
-        if subscription.include?('*')
-          pattern = Regexp.escape(subscription).gsub('\*', '.*')
-          event_name.match?(Regexp.new("^#{pattern}$"))
-        else
-          subscription == event_name
-        end
-      end
+      return true if subscriptions.blank?
+
+      subscriptions.any? { |subscription| Spree::Event.matches?(event_name, subscription) }
     end
 
     # The credential-carrying events this endpoint names.
@@ -191,6 +205,16 @@ module Spree
       self.secret_key ||= SecureRandom.hex(32)
     end
 
+    def subscriptions_must_be_event_patterns
+      entries = subscriptions.to_a
+      errors.add(:subscriptions, :too_many, count: MAX_SUBSCRIPTIONS) if entries.size > MAX_SUBSCRIPTIONS
+
+      rejected = entries.reject { |entry| self.class.event_pattern?(entry) }
+      return if rejected.empty?
+
+      errors.add(:subscriptions, :invalid_pattern, entries: rejected.first(5).map { |entry| entry.truncate(40) }.join(', '))
+    end
+
     def clear_disabled_state_when_reactivated
       return unless will_save_change_to_active? && active
 
@@ -203,12 +227,22 @@ module Spree
 
       uri = URI.parse(url)
       blacklist = SsrfFilter::IPV4_BLACKLIST + SsrfFilter::IPV6_BLACKLIST
-      addresses = Resolv.getaddresses(uri.host)
+      addresses = host_addresses(uri.host)
       if addresses.any? { |addr| blacklist.any? { |range| range.include?(IPAddr.new(addr)) } }
         errors.add(:url, :internal_address_not_allowed)
       end
     rescue URI::InvalidURIError, Resolv::ResolvError, IPAddr::InvalidAddressError, ArgumentError
       # URI format validation handles invalid URLs; DNS failures are not SSRF
     end
+
+    # A literal address first — including the forms a resolver answers
+    # nothing for, such as a bracketed IPv6 address, `127.1`, or a decimal or
+    # hex IPv4 — then DNS for a hostname.
+    def host_addresses(host)
+      literal = host.to_s.delete_prefix('[').delete_suffix(']')
+      Socket.getaddrinfo(literal, nil, nil, Socket::SOCK_STREAM, nil, Socket::AI_NUMERICHOST).map { |entry| entry[3] }.uniq
+    rescue SocketError
+      Resolv.getaddresses(host)
+    end
   end
 end

data/app/services/spree/carts/destroy.rb

@@ -52,9 +52,14 @@ module Spree
         success(cart: cart)
       end
 
+      # Lets go of everything the cart was only borrowing, so the cascade that
+      # follows reaches nothing but the cart's own rows. An entry in somebody's
+      # address book stays in it, and a row a fulfillment or a completed order
+      # still points at is detached rather than soft-deleted out from under
+      # them.
       def clear_addresses(cart:)
-        cart.ship_address = nil unless cart.ship_address&.can_be_deleted?
-        cart.bill_address = nil unless cart.bill_address&.can_be_deleted?
+        cart.ship_address = nil unless cart.owns_address?(cart.ship_address) && cart.ship_address.can_be_deleted?
+        cart.bill_address = nil unless cart.owns_address?(cart.bill_address) && cart.bill_address.can_be_deleted?
 
         success(cart: cart)
       end

data/app/services/spree/carts/price_items.rb

@@ -31,6 +31,9 @@ module Spree
         items = items.reject(&:manual_price?)
         return success([]) if items.empty?
 
+        # One read of every line's prices rather than one per variant.
+        ActiveRecord::Associations::Preloader.new(records: items.filter_map(&:variant).uniq, associations: :prices).call
+
         resolutions = items.filter_map do |line_item|
           price = resolve_price(line_item, cart)
           next if price.blank?

data/app/services/spree/carts/split_by_seller.rb

@@ -270,8 +270,10 @@ module Spree
       # describe what they held before the split, and the new one holds nothing
       # at all.
       def restate_freight_summaries(*fulfillments)
+        selected_rates = Spree::DeliveryRate.where(fulfillment_id: fulfillments.map(&:id), selected: true).order(:cost).to_a
+
         fulfillments.each do |fulfillment|
-          rate = fulfillment.reload.selected_delivery_rate
+          rate = selected_rates.find { |selected_rate| selected_rate.fulfillment_id == fulfillment.id }
           next if rate.nil?
 
           metadata = rate.metadata

data/app/services/spree/carts/update.rb

@@ -206,10 +206,7 @@ module Spree
       end
 
       def resolve_address_id(prefixed_id)
-        return unless cart.customer
-
-        decoded = Spree::Address.decode_prefixed_id(prefixed_id)
-        decoded ? cart.customer.addresses.find_by(id: decoded)&.id : nil
+        cart.selectable_address(prefixed_id)&.id
       end
 
       def assign_market

data/app/services/spree/catalogs/set_product_terms.rb

@@ -50,7 +50,8 @@ module Spree
       def apply(catalog, product, values)
         minimum = normalize(values[:minimum_order_quantity])
         multiple = normalize(values[:order_multiple])
-        variant_ids = product.variants.ids
+        variants = product.variants.to_a
+        variant_ids = variants.map(&:id)
 
         # Both blank is a deletion: the product falls back to the catalog's
         # own default, which is what an empty pair means on the row.
@@ -59,8 +60,12 @@ module Spree
           return nil
         end
 
-        variant_ids.each do |variant_id|
-          rule = catalog.quantity_rules.find_or_initialize_by(variant_id: variant_id)
+        existing_rules = catalog.quantity_rules.where(variant_id: variant_ids).index_by(&:variant_id)
+
+        variants.each do |variant|
+          rule = existing_rules[variant.id] || catalog.quantity_rules.build
+          # The loaded variant, so the store check reads its product in memory.
+          rule.variant = variant
           rule.assign_attributes(minimum_order_quantity: minimum, order_multiple: multiple)
           return rule unless rule.save
         end

data/app/services/spree/collections/add_products.rb

@@ -22,7 +22,7 @@ module Spree
       def group_class = Spree::Collection
 
       def refresh_group_counters(collection_ids)
-        collection_ids.each { |id| Spree::Collection.reset_counters(id, :product_collections) }
+        Spree::Collection.reset_counters_in_bulk(collection_ids, :product_collections)
       end
     end
   end

data/app/services/spree/collections/regenerate_products.rb

@@ -44,9 +44,7 @@ module Spree
 
         # counter caches — bulk insert/delete bypass the ProductCollection counter_cache callbacks
         Spree::Collection.reset_counters(collection.id, :product_collections)
-        all_product_ids = (previous_products_ids + product_ids_to_insert).uniq
-        existing_product_ids = Spree::Product.where(id: all_product_ids).pluck(:id)
-        existing_product_ids.each { |id| Spree::Product.reset_counters(id, :product_collections) }
+        Spree::Product.reset_counters_in_bulk(previous_products_ids + product_ids_to_insert, :product_collections)
 
         success(collection)
       end

data/app/services/spree/collections/remove_products.rb

@@ -22,7 +22,7 @@ module Spree
       def group_class = Spree::Collection
 
       def refresh_group_counters(collection_ids)
-        collection_ids.each { |id| Spree::Collection.reset_counters(id, :product_collections) }
+        Spree::Collection.reset_counters_in_bulk(collection_ids, :product_collections)
       end
     end
   end

data/app/services/spree/data_requests/confirm.rb

@@ -0,0 +1,37 @@
+module Spree
+  module DataRequests
+    # Confirms a request the customer raised, from the link emailed to the
+    # address it names, and queues the work.
+    #
+    # Confirming again is answered with the request as it stands, so a second
+    # click on the same link changes nothing.
+    class Confirm
+      prepend Spree::ServiceModule::Base
+
+      # @param data_request [Spree::DataRequest]
+      # @return [Spree::ServiceModule::Result] the confirmed request
+      def call(data_request:)
+        newly_confirmed = false
+
+        data_request.with_lock do
+          newly_confirmed = data_request.confirmable?
+
+          if newly_confirmed
+            data_request.update!(status: 'pending')
+          elsif data_request.awaiting_confirmation?
+            data_request.update!(status: 'lapsed')
+          end
+        end
+
+        if data_request.lapsed?
+          data_request.errors.add(:base, I18n.t('spree.data_request_errors.confirmation_invalid'))
+          return failure(data_request)
+        end
+
+        Spree::DataRequests::ProcessJob.perform_later(data_request.prefixed_id) if newly_confirmed
+
+        success(data_request)
+      end
+    end
+  end
+end

data/app/services/spree/data_requests/create.rb

@@ -7,9 +7,15 @@ module Spree
     # whole history, and a customer holding the button down should not be able
     # to queue a hundred of them. It is also the honest answer — the request
     # they already made is still being worked on.
+    #
+    # A request the customer raised themselves waits for confirmation from its
+    # email address instead of being queued, because it reaches guest orders
+    # placed at that address. Asking again while it waits sends the email again.
     class Create
       prepend Spree::ServiceModule::Base
 
+      CONFIRMATION_EVENT = 'data_request.confirmation_requested'.freeze
+
       # @param store [Spree::Store]
       # @param customer [Spree::Customer]
       # @param kind [String] Spree::DataRequest::ACCESS or ERASURE
@@ -19,8 +25,12 @@ module Spree
       #   caller fulfils the request itself — the admin export renders the file
       #   inline for a waiting staffer, and queueing would additionally email
       #   the customer a copy of something they did not ask for
+      # @param confirm_by_email [Boolean] hold the request until it is
+      #   confirmed from its email address; true for the customer's own requests
+      # @param redirect_url [String, nil] the storefront page the confirmation
+      #   link opens, already checked against the store's allowed origins
       # @return [Spree::ServiceModule::Result]
-      def call(store:, customer:, kind:, requested_by: nil, process: true)
+      def call(store:, customer:, kind:, requested_by: nil, process: true, confirm_by_email: false, redirect_url: nil)
         # Nothing useful is left to answer with: an export would return the
         # tombstone and email a link to an address that no longer receives,
         # and a second erasure has nothing to erase.
@@ -38,7 +48,9 @@ module Spree
         # of the same person's whole history; taking the lock closes it without
         # a partial unique index, which MySQL does not support.
         customer.with_lock do
-          existing = in_flight_request(store: store, customer: customer, kind: kind)
+          lapse_unconfirmed_requests(store: store, customer: customer, kind: kind, staff_request: !confirm_by_email)
+          existing = in_flight_request(store: store, customer: customer, kind: kind,
+                                       include_unconfirmed: confirm_by_email)
 
           unless existing
             data_request = Spree::DataRequest.new(
@@ -46,20 +58,27 @@ module Spree
               customer: customer,
               kind: kind.to_s,
               email: customer.email,
-              requested_by: requested_by
+              requested_by: requested_by,
+              status: confirm_by_email ? 'awaiting_confirmation' : 'pending'
             )
             data_request.save
           end
         end
 
-        return success(existing) if existing
-        return failure(data_request) unless data_request.persisted?
+        return failure(data_request) if data_request && !data_request.persisted?
 
-        # Enqueued after the lock is released: the job may start immediately,
-        # and it should not contend for the row this flow still holds.
-        Spree::DataRequests::ProcessJob.perform_later(data_request.prefixed_id) if process
+        request = existing || data_request
 
-        success(data_request)
+        # Both happen after the lock is released: the job may start at once and
+        # should not contend for the row this flow holds, and the email must
+        # not go out before the row is committed.
+        if request.awaiting_confirmation?
+          request_confirmation(request, redirect_url: redirect_url)
+        elsif data_request && process
+          Spree::DataRequests::ProcessJob.perform_later(data_request.prefixed_id)
+        end
+
+        success(request)
       end
 
       private
@@ -67,10 +86,39 @@ module Spree
       # Only the person's own requests. A staff member exporting from the admin
       # opens their own row and answers it inline, and handing that back here
       # would close the customer's request with a file they can never download.
-      def in_flight_request(store:, customer:, kind:)
-        Spree::DataRequest.where(store_id: store.id, customer_id: customer.id, kind: kind.to_s,
-                                 requested_by_id: nil).
-          in_progress.recent_first.first
+      # A request still waiting for confirmation is returned only to the
+      # customer: staff have checked who they are dealing with, so theirs
+      # proceeds on its own row (see lapse_unconfirmed_requests).
+      def in_flight_request(store:, customer:, kind:, include_unconfirmed:)
+        requests = Spree::DataRequest.where(store_id: store.id, customer_id: customer.id, kind: kind.to_s,
+                                            requested_by_id: nil)
+        open_requests = include_unconfirmed ? requests.in_progress.or(requests.confirmable) : requests.in_progress
+
+        open_requests.recent_first.first
+      end
+
+      # Lapses what can no longer be confirmed: requests past the window, and
+      # requests naming an address the account has since moved away from, so
+      # asking again emails the current address. A staff request of the same
+      # kind replaces the customer's unconfirmed one, which would otherwise
+      # run the same work a second time once confirmed.
+      def lapse_unconfirmed_requests(store:, customer:, kind:, staff_request:)
+        unconfirmed = Spree::DataRequest.where(store_id: store.id, customer_id: customer.id).awaiting_confirmation
+        stale = unconfirmed.past_confirmation_window.or(unconfirmed.where.not(email: customer.email))
+        stale = stale.or(unconfirmed.where(kind: kind.to_s)) if staff_request
+
+        stale.find_each { |data_request| data_request.update!(status: 'lapsed') }
+      end
+
+      # The token travels in a credential event, which reaches only webhook
+      # endpoints that name it and keeps the token out of the delivery log.
+      def request_confirmation(data_request, redirect_url:)
+        payload = data_request.event_payload_for(
+          CONFIRMATION_EVENT,
+          confirmation_token: data_request.generate_token_for(:confirmation),
+          redirect_url: redirect_url.presence
+        )
+        data_request.publish_event(CONFIRMATION_EVENT, payload)
       end
     end
   end

data/app/services/spree/newsletter/subscribe.rb

@@ -54,8 +54,16 @@ module Spree
         @existed_subscription ||= Spree::NewsletterSubscriber.verified.find_by(email: email, store: current_store)
       end
 
+      # The account the subscription belongs to: the signed-in customer only
+      # when the address is theirs. Linking it to whoever is signed in would
+      # hand them another person's subscription — and with it the right to
+      # cancel it.
       def known_user
-        @known_user ||= current_user || Spree.customer_class.find_by(email: email)
+        @known_user ||= if current_user&.email.to_s.casecmp?(email.to_s)
+                          current_user
+                        else
+                          Spree.customer_class.find_by(email: email)
+                        end
       end
     end
   end

data/app/services/spree/order_groups/allocate_payments.rb

@@ -82,14 +82,16 @@ module Spree
         )
         captured = payment.completed?
 
+        allocated_order_ids = Spree::PaymentSplit.where(payment_id: payment.id, order_id: orders.map(&:id)).pluck(:order_id).to_set
+
         orders.each_with_index do |order, index|
-          split = Spree::PaymentSplit.find_or_initialize_by(payment_id: payment.id, order_id: order.id)
-          next if split.persisted?
+          next if allocated_order_ids.include?(order.id)
 
           share = Spree::Money::Rounding.from_minor_units(shares[index], currency)
-          # So re-summing its payment total on save reuses this instance rather
-          # than loading a second copy of the row per share.
-          split.order = order
+          # The payment and order are handed over rather than looked up, so
+          # validating and re-summing each share reuses these instances
+          # instead of loading a copy per share.
+          split = Spree::PaymentSplit.new(payment: payment, order: order)
           split.currency = payment.currency
           split.authorized_amount = share
           split.captured_amount = captured ? share : 0

data/app/services/spree/orders/update.rb

@@ -14,6 +14,7 @@ module Spree
 
         items_param = @params.delete(:items)
         address_params = extract_address_params
+        scope_store_references
 
         # requires_new: the rescue below sits outside the block, so joining a
         # caller's open transaction (the API's order lock) would let it commit
@@ -63,6 +64,24 @@ module Spree
         end.compact_blank
       end
 
+      # Named by id in the payload and read through the order's own store, as
+      # Orders::Create does: the model only checks that the record exists, so
+      # another store's market, channel or warehouse would otherwise be
+      # accepted.
+      STORE_REFERENCES = {
+        market_id: :markets,
+        channel_id: :channels,
+        preferred_stock_location_id: :stock_locations
+      }.freeze
+
+      def scope_store_references
+        STORE_REFERENCES.each do |key, association|
+          next if @params[key].blank?
+
+          @params[key] = @order.store.public_send(association).find_by_param!(@params[key]).id
+        end
+      end
+
       def assign_addresses(address_params)
         address_params.each do |association, attributes|
           @order.public_send(:"#{association}_attributes=", attributes)

data/app/services/spree/product_memberships.rb

@@ -7,9 +7,15 @@ module Spree
     private
 
     def add_memberships(groups, products)
-      rows = groups.pluck(:id).flat_map do |group_id|
-        position = membership_class.where(group_key => group_id).count
-        products.pluck(:id).map do |product_id|
+      group_ids = groups.pluck(:id)
+      product_ids = products.pluck(:id)
+      # Every group's current size in one grouped count, rather than a probe
+      # per group for the position to append at.
+      sizes = membership_class.where(group_key => group_ids).group(group_key).count
+
+      rows = group_ids.flat_map do |group_id|
+        position = sizes.fetch(group_id, 0)
+        product_ids.map do |product_id|
           {
             group_key => group_id, product_id: product_id, position: (position += 1),
             created_at: Time.current, updated_at: Time.current
@@ -18,7 +24,7 @@ module Spree
       end
       membership_class.insert_all(rows)
 
-      refresh_after_membership_change(groups.pluck(:id), products)
+      refresh_after_membership_change(group_ids, products)
     end
 
     # Removes the products, then re-packs the remaining positions from 1.
@@ -28,8 +34,12 @@ module Spree
       ApplicationRecord.transaction do
         membership_class.where(group_key => group_ids, product_id: products.pluck(:id)).delete_all
 
+        # What survived the delete, for every group in one read.
+        remaining = membership_class.where(group_key => group_ids).order(:position).pluck(group_key, :product_id).
+                    group_by(&:first).transform_values { |pairs| pairs.map(&:last) }
+
         rows = group_ids.flat_map do |group_id|
-          membership_class.where(group_key => group_id).order(:position).pluck(:product_id).map.with_index(1) do |product_id, position|
+          remaining.fetch(group_id, []).map.with_index(1) do |product_id, position|
             {
               group_key => group_id, product_id: product_id, position: position,
               created_at: Time.current, updated_at: Time.current
@@ -46,7 +56,7 @@ module Spree
     # search index are refreshed here.
     def refresh_after_membership_change(group_ids, products)
       product_ids = products.pluck(:id)
-      product_ids.each { |id| Spree::Product.reset_counters(id, membership_class.model_name.element.pluralize.to_sym) }
+      Spree::Product.reset_counters_in_bulk(product_ids, membership_class.model_name.element.pluralize.to_sym)
       refresh_group_counters(group_ids)
 
       Spree::Product.where(id: product_ids).touch_all

data/app/services/spree/products/duplicator.rb

@@ -42,7 +42,7 @@ module Spree
 
       def duplicate_variant(variant, include_images)
         new_variant = variant.dup
-        new_variant.sku = sku_generator(new_variant.sku)
+        new_variant.sku = sku_generator(variant)
         new_variant.deleted_at = nil
         new_variant.option_values = variant.option_values.map { |option_value| option_value }
         new_variant.prices = duplicate_prices(variant.prices)
@@ -82,10 +82,18 @@ module Spree
         new_image
       end
 
-      def sku_generator(sku)
-        return '' if sku.blank?
+      def sku_generator(variant)
+        return '' if variant.sku.blank?
 
-        "COPY OF #{Variant.unscoped.where('sku like ?', "%#{sku}").order(:created_at).last.sku}"
+        store_product_ids = Product.with_deleted.where(store_id: variant.store_id).select(:id)
+        # Matched the way the SKU uniqueness check compares, without regard
+        # to case, and within the same seller scope it reads, so the name taken
+        # from the latest match is one this seller may use.
+        sku_pattern = Variant.arel_table[:sku].matches("%#{Variant.sanitize_sql_like(variant.sku)}", '\\', false)
+        latest_match = Variant.with_deleted.for_seller(variant.resolved_seller_id).
+                       where(product_id: store_product_ids).where(sku_pattern).order(:created_at, :id).last
+
+        "COPY OF #{(latest_match || variant).sku}"
       end
 
       def duplicate_error_message(new_product)

data/app/services/spree/search_provider/custom_field_schema.rb

@@ -15,13 +15,16 @@ module Spree
       ORDERED_FILTER_PREDICATES = (TEXT_FILTER_PREDICATES | NUMBER_FILTER_PREDICATES).
                                   sort_by { |predicate| -predicate.length }.freeze
 
-      attr_reader :store
+      attr_reader :store, :audience
 
       # @param store [Spree::Store] the store whose custom-field schema this
       #   describes — definitions are store-owned, so two stores have their own
       #   filter vocabularies.
-      def initialize(store)
+      # @param audience [Symbol, nil] who filters: `:store` (shoppers) sees only
+      #   storefront-visible definitions; `nil` is the back office
+      def initialize(store, audience: nil)
         @store = store
+        @audience = audience
       end
 
       # @return [Hash{String => Spree::CustomFieldDefinition}]
@@ -134,8 +137,13 @@ module Spree
 
       private
 
+      # A definition hidden from the storefront stays out of its filter and
+      # sort vocabulary too: the serializer withholds the value, and a sort or
+      # a range filter on it would hand that value back one comparison at a
+      # time.
       def product_definitions
         scope = store.custom_field_definitions.for_resource_type('Spree::Product')
+        scope = scope.storefront_visible if audience == :store
         scope.where(searchable: true).or(scope.where(sortable: true))
       end
 

data/app/services/spree/stock_levels/correct.rb

@@ -32,6 +32,11 @@ module Spree
         return failure(stock_level, I18n.t('spree.stock_level.errors.count_on_hand_not_an_integer')) if count_on_hand.present? && target.nil?
         return failure(stock_level, I18n.t('spree.stock_level.errors.adjustment_not_an_integer')) if adjustment.present? && delta.nil?
 
+        # Read before locking, which reloads the level and with it drops the
+        # variant and location a bulk caller loaded for every row at once.
+        stock_location = stock_level.stock_location
+        variant = stock_level.variant
+
         # Locked around the read: the delta is worked out from the count this
         # caller first saw, so two admins correcting the same level at once
         # would otherwise each measure against a shelf the other had already
@@ -42,12 +47,14 @@ module Spree
 
           # Through the location's own mover rather than building a movement
           # by hand: it types the row as an adjustment and records the reason,
-          # so a correction reads like every other change in the history.
-          stock_level.stock_location.adjust(stock_level.variant, move,
-                                            reason: Spree::StockMovement.adjustment_reason_text(reason))
+          # so a correction reads like every other change in the history. The
+          # movement writes through this locked instance, which leaves it
+          # current without another reload.
+          stock_location.adjust(variant, move, reason: Spree::StockMovement.adjustment_reason_text(reason),
+                                               stock_level: stock_level)
         end
 
-        success(stock_level.reload)
+        success(stock_level)
       end
 
       private

data/app/services/spree/stock_reservations/reserve.rb

@@ -69,7 +69,7 @@ module Spree
       private
 
       def build_targets(cart)
-        cart.line_items.includes(variant: { stock_levels: :stock_location }).filter_map do |line_item|
+        cart.line_items.includes(variant: [:product, { stock_levels: :stock_location }]).filter_map do |line_item|
           variant = line_item.variant
           next unless variant&.should_track_inventory?
 

data/app/services/spree/stores/provision_defaults.rb

@@ -31,13 +31,17 @@ module Spree
         @currency = resolve_currency(currency, country)
         @locale = resolve_locale(locale, country)
 
-        ApplicationRecord.transaction do
-          update_default_market
-          provision_stock_location
-          provision_delivery_zones
-          provision_package_type
-          provision_pickup
-          restate_seeded_calculators
+        # Defaults are bookkeeping, not merchant actions — webhooks and
+        # subscribers should not hear about each zone and method created here.
+        Spree::Events.disable do
+          ApplicationRecord.transaction do
+            update_default_market
+            provision_stock_location
+            provision_delivery_zones
+            provision_package_type
+            provision_pickup
+            restate_seeded_calculators
+          end
         end
 
         store.reload