spree_core 6.0.0.rc5 → 6.0.0.rc7

data/app/workflows/spree/carts/complete.rb

@@ -422,10 +422,21 @@ module Spree
       # provider a question whose answer is discarded — and for an external
       # engine that is a billable remote call per line item, inside the
       # completion lock.
+      #
+      # Each copy is handed the cart line's variant, loaded once for every
+      # line, so validating the copies reads its product, stock and tax
+      # category for all of them at once rather than per line.
       def copy_line_items!(cart, order)
-        cart.line_items.reload.index_with do |cart_line_item|
+        cart_line_items = cart.line_items.reload.to_a
+        ActiveRecord::Associations::Preloader.new(
+          records: cart_line_items,
+          associations: { variant: [{ product: %i[store product_publications tax_category] }, { stock_levels: %i[stock_location active_stock_reservations] }] }
+        ).call
+
+        cart_line_items.index_with do |cart_line_item|
           attributes = cart_line_item.attributes.except('id', 'cart_id', 'created_at', 'updated_at')
           line_item = order.line_items.new(attributes.merge('order_id' => order.id))
+          line_item.variant = cart_line_item.variant if cart_line_item.variant
           line_item.skip_tax_estimation = true
           line_item.save!
           line_item
@@ -434,9 +445,12 @@ module Spree
 
       # @return [Hash{Integer => Integer}] cart fulfillment id → order fulfillment id
       def copy_fulfillments!(cart, order, line_item_map)
-        line_item_id_map = line_item_map.transform_keys(&:id).transform_values(&:id)
+        line_items_by_cart_line_item_id = line_item_map.transform_keys(&:id)
+
+        cart_fulfillments = cart.fulfillments.reload.to_a
+        ActiveRecord::Associations::Preloader.new(records: cart_fulfillments, associations: %i[selected_delivery_rate fulfillment_items]).call
 
-        cart.fulfillments.reload.each_with_object({}) do |cart_fulfillment, map|
+        cart_fulfillments.each_with_object({}) do |cart_fulfillment, map|
           attributes = cart_fulfillment.attributes.except('id', 'cart_id', 'number', 'tracking', 'created_at', 'updated_at')
           fulfillment = order.fulfillments.create!(attributes.merge('order_id' => order.id, 'address_id' => order.ship_address_id))
 
@@ -447,13 +461,15 @@ module Spree
 
           cart_fulfillment.fulfillment_items.each do |item|
             item_attributes = item.attributes.except('id', 'created_at', 'updated_at')
-            fulfillment.fulfillment_items.create!(
-              item_attributes.merge(
-                'fulfillment_id' => fulfillment.id,
-                'order_id' => order.id,
-                'line_item_id' => line_item_id_map.fetch(item.line_item_id)
-              )
+            line_item = line_items_by_cart_line_item_id.fetch(item.line_item_id)
+            fulfillment_item = fulfillment.fulfillment_items.new(
+              item_attributes.merge('fulfillment_id' => fulfillment.id, 'order_id' => order.id)
             )
+            # Objects rather than ids, so validating the copy does not look
+            # each of them up again.
+            fulfillment_item.line_item = line_item
+            fulfillment_item.variant = line_item.variant if line_item.variant_id == item.variant_id
+            fulfillment_item.save!
           end
 
           map[cart_fulfillment.id] = fulfillment.id

data/app/workflows/spree/carts/upsert_items.rb

@@ -90,9 +90,10 @@ module Spree
       # applied.
       def resolve_items
         store = cart.store || Spree::Current.store
+        requested_items = Array(items).map { |item_params| item_params.to_h.deep_symbolize_keys }
+        prefetch_added_variants(store, requested_items)
 
-        @resolved_items = Array(items).filter_map do |item_params|
-          item_params = item_params.to_h.deep_symbolize_keys
+        @resolved_items = requested_items.filter_map do |item_params|
           quantity = (item_params[:quantity] || 1).to_i
           variant = resolve_variant(store, item_params[:variant_id], removing: quantity <= 0)
           next if variant.nil?
@@ -357,18 +358,44 @@ module Spree
           cart.line_items.detect { |line_item| line_item.variant_id.to_s == variant_id.to_s }&.variant ||
             Spree::Variant.with_deleted.find_by_param(variant_id)
         else
-          variant = store.variants.find_by_param(variant_id)
+          variant = @added_variants[variant_param_id(variant_id)]
           # +orderable_variants+ narrows what a request may add. A line already
           # in the cart is a quantity edit and resolves as before — checkout
           # judges it — so one stale line cannot fail a whole cart's update.
           if variant && orderable_variants && cart.line_items.none? { |line_item| line_item.variant_id == variant.id }
-            variant = orderable_variants.find_by(id: variant.id)
+            variant = nil unless @orderable_added_variant_ids.include?(variant.id)
           end
 
           variant || raise(ActiveRecord::RecordNotFound.new("Variant '#{variant_id}' not found in this store", 'Spree::Variant', 'id', variant_id))
         end
       end
 
+      # Every variant the batch adds, looked up through the store in one
+      # query rather than one per item, and which of them the buyer may order.
+      def prefetch_added_variants(store, requested_items)
+        ids = requested_items.filter_map do |item_params|
+          variant_param_id(item_params[:variant_id]) if (item_params[:quantity] || 1).to_i.positive?
+        end
+
+        @added_variants = ids.empty? ? {} : store.variants.where(id: ids.uniq).preload_associations_lazily.index_by(&:id)
+        Spree::Stock::Quantifier.preload(@added_variants.values)
+        @orderable_added_variant_ids = if orderable_variants && @added_variants.any?
+                                         orderable_variants.where(id: @added_variants.keys).pluck(:id).to_set
+                                       else
+                                         Set.new
+                                       end
+      end
+
+      # The id a variant param names: a prefixed id, or a bare integer id
+      # kept for backwards compatibility.
+      #
+      # @return [Integer, nil]
+      def variant_param_id(param)
+        return nil if param.blank?
+
+        Spree::Variant.decode_prefixed_id(param) || (param.to_s.to_i if param.to_s.match?(/\A\d+\z/))
+      end
+
       def warn(index, item, code, message)
         warnings << Spree::Carts::ItemWarning.new(item_index: index, variant: item.variant, code: code, message: message)
       end

data/app/workflows/spree/customers/anonymize.rb

@@ -318,7 +318,7 @@ module Spree
         }
 
         owner_ids.each do |owner_type, ids|
-          Spree::ShippingLabel.where(owner_type: owner_type, owner_id: ids).find_each do |label|
+          Spree::ShippingLabel.where(owner_type: owner_type, owner_id: ids).with_attached_file.find_each do |label|
             purge_after_commit(label.file)
           end
         end
@@ -408,7 +408,7 @@ module Spree
         # complete copy of everything being erased, sitting behind a link that
         # stays live for days. Rewriting the row's email would leave the
         # payload itself untouched and still fetchable.
-        requests.each do |data_request|
+        requests.with_attached_export_file.each do |data_request|
           purge_after_commit(data_request.export_file)
         end
 

data/app/workflows/spree/digital_assets/create.rb

@@ -0,0 +1,56 @@
+module Spree
+  module DigitalAssets
+    # Adds a downloadable file (or a provider-backed deliverable) to a product.
+    #
+    # The single gate for new assets: the operator's and the seller's nested
+    # endpoints and the `digital_assets` list on a product write all run
+    # through it, so a :validate handler sees every file a catalog gains.
+    # A host that scans uploads registers on `digital_assets.create.validate`
+    # for a quick check, or on `after_create` to queue a slower one; the bytes
+    # are already in storage when either fires.
+    #
+    # Passing `seller:` applies the marketplace's rules for a seller's file —
+    # whether sellers may upload at all, which content types, and whether an
+    # approved listing goes back to review. The operator's own writes pass none.
+    class Create < Spree::Workflow
+      include Spree::DigitalAssets::Writing
+
+      hooks :validate, :after_create
+
+      # The unsaved record a :validate handler reads.
+      attr_reader :digital_asset
+
+      # @param product [Spree::Product]
+      # @param attributes [Hash] `signed_id`, `variant_id`, the download limits
+      #   and, for the operator, the provider fields
+      # @param seller [Spree::Seller, nil] the seller this file is written for
+      # @param submitted_by [Spree.admin_user_class, nil] who made the change,
+      #   named on the review it may reopen
+      # @return [Spree::ServiceModule::Result] value is the digital asset
+      def perform(product:, attributes: {}, seller: nil, submitted_by: nil)
+        super
+
+        step :build_digital_asset
+        step :resolve_upload
+        step :enforce_seller_rules
+        run_hooks :validate
+
+        ApplicationRecord.transaction do
+          step :attach_upload
+          step :save_digital_asset
+          step :reopen_review
+          run_hooks :after_create
+        end
+
+        success(digital_asset)
+      end
+
+      private
+
+      def build_digital_asset
+        @digital_asset = Spree::DigitalAsset.new
+        assign_attributes
+      end
+    end
+  end
+end

data/app/workflows/spree/digital_assets/update.rb

@@ -0,0 +1,44 @@
+module Spree
+  module DigitalAssets
+    # Changes a digital asset: its download limits, the variant it hangs off,
+    # or the file itself. Replacing the file keeps every already-issued link
+    # working, since links resolve through the asset rather than the blob.
+    #
+    # Handlers reading `digital_asset.changes` in :validate see the pending
+    # edit; `blob` is the replacement file, when the payload carries one.
+    class Update < Spree::Workflow
+      include Spree::DigitalAssets::Writing
+
+      hooks :validate, :after_update
+
+      # @param digital_asset [Spree::DigitalAsset]
+      # @param attributes [Hash] see Spree::DigitalAssets::Create
+      # @param seller [Spree::Seller, nil] the seller this change is written for
+      # @param submitted_by [Spree.admin_user_class, nil] who made the change
+      # @return [Spree::ServiceModule::Result] value is the digital asset
+      def perform(digital_asset:, attributes: {}, seller: nil, submitted_by: nil)
+        super
+
+        step :assign_attributes
+        step :resolve_upload
+        step :enforce_seller_rules
+        run_hooks :validate
+
+        ApplicationRecord.transaction do
+          step :attach_upload
+          step :save_digital_asset
+          step :reopen_review
+          run_hooks :after_update
+        end
+
+        success(digital_asset)
+      end
+
+      private
+
+      def product
+        digital_asset.product
+      end
+    end
+  end
+end

data/app/workflows/spree/digital_assets/writing.rb

@@ -0,0 +1,108 @@
+module Spree
+  module DigitalAssets
+    # The steps a file write shares between Create and Update: the upload the
+    # payload names, the marketplace's rules for a seller's file, and sending
+    # an approved listing back to review once what it delivers has changed.
+    module Writing
+      extend ActiveSupport::Concern
+
+      # Why a product reopened review: recorded on the submission row so the
+      # operator's queue says what changed.
+      REVIEW_REASON = 'digital_asset_changed'.freeze
+
+      included do
+        # The uploaded file the payload names, resolved before it is attached.
+        attr_reader :blob
+      end
+
+      private
+
+      def assign_attributes
+        attrs = attributes.to_h.with_indifferent_access
+        @signed_id = attrs.delete(:signed_id)
+        variant_id = attrs.delete(:variant_id)
+
+        digital_asset.assign_attributes(attrs)
+        # Through the product's own variants, so an asset reached through one
+        # product can never point at another product's variant.
+        digital_asset.variant = product.variants.find_by_param!(variant_id) if variant_id.present?
+        digital_asset.variant ||= product.default_variant
+      end
+
+      def resolve_upload
+        return if @signed_id.blank?
+
+        @blob = ActiveStorage::Blob.find_signed(@signed_id)
+        return refuse(:digital_assets_upload_not_found) if blob.nil?
+
+        # Attaching never moves a blob between storage services, so a file
+        # uploaded to the public bucket would stay publicly readable while
+        # looking attached.
+        unless blob.service_name.to_s == Spree.private_storage_service_name.to_s
+          return refuse(:digital_assets_attachment_must_be_private)
+        end
+
+        # A provider-backed asset delivers through its provider, so a file on
+        # it would show in the panel but never reach a buyer. An unregistered
+        # provider is left to the model's validation rather than asked.
+        return unless Spree.digital_asset_providers.include?(digital_asset.provider_class)
+
+        refuse(:digital_assets_provider_takes_no_file) unless digital_asset.provider_class.requires_attachment?
+      end
+
+      # What the marketplace lets a seller attach. The operator's own writes
+      # are not subject to these: the operator is who the rules protect.
+      def enforce_seller_rules
+        return if seller.nil?
+
+        refuse(:digital_assets_sellers_disabled) unless store.preferred_seller_digital_assets_enabled
+        return if blob.nil?
+
+        # Identifying reads the file's own signature where it has one, so a
+        # renamed executable cannot pass as a PDF; a format with no signature
+        # (plain text) keeps the type the client declared.
+        blob.identify_without_saving
+        return if content_type_accepted?(blob.content_type)
+
+        refuse(:digital_assets_content_type_not_accepted, content_type: blob.content_type)
+      end
+
+      # An entry names one type (`audio/mpeg`) or a whole family (`audio/*`).
+      def content_type_accepted?(content_type)
+        family = "#{content_type.to_s.split('/').first}/*"
+        store.preferred_seller_digital_asset_content_types.any? { |accepted| accepted.casecmp?(content_type.to_s) || accepted == family }
+      end
+
+      def attach_upload
+        digital_asset.attachment.attach(blob) if blob
+      end
+
+      def save_digital_asset
+        failure(digital_asset) unless digital_asset.save
+      end
+
+      # A seller changing what an approved listing delivers reopens its review.
+      # The operator's own change does not: they are the reviewer.
+      def reopen_review
+        return if seller.nil? || blob.nil? || !product.active?
+        return unless store.preferred_review_seller_digital_asset_changes
+        return if store.preferred_auto_approve_seller_products
+
+        result = Spree.product_propose_workflow.call(product: product, submitted_by: submitted_by, reason: REVIEW_REASON)
+        return if result.success?
+
+        digital_asset.errors.add(:base, result.error.to_s)
+        failure(digital_asset)
+      end
+
+      def store
+        product.store
+      end
+
+      def refuse(key, **options)
+        digital_asset.errors.add(:base, I18n.t("spree.#{key}", **options))
+        failure(digital_asset)
+      end
+    end
+  end
+end

data/app/workflows/spree/imports/start_mapping.rb

@@ -33,8 +33,10 @@ module Spree
       # TODO: seed from the previous import of the same type, so a merchant
       # doesn't map the same columns twice.
       def build_mappings
+        existing = import.mappings.index_by(&:schema_field)
+
         import.schema_fields.each do |schema_field|
-          mapping = import.mappings.find_or_create_by!(schema_field: schema_field[:name])
+          mapping = existing[schema_field[:name]] || import.mappings.build(schema_field: schema_field[:name])
           mapping.try_to_auto_assign_file_column(import.csv_headers)
           mapping.save!
         end

data/app/workflows/spree/orders/complete.rb

@@ -140,11 +140,16 @@ module Spree
       end
 
       def allocate_fulfillment_stock(fulfillment)
-        fulfillment.manifest.each do |item|
-          next unless item.variant.track_inventory?
-          next unless item.quantity.positive?
+        items = fulfillment.manifest.select { |item| item.variant.track_inventory? && item.quantity.positive? }
+        return if items.empty?
 
-          fulfillment.stock_location.allocate(item.variant, item.quantity, fulfillment)
+        stock_location = fulfillment.stock_location
+        # Lowest id first, as StockLocation#stock_level reads.
+        stock_levels = stock_location.stock_levels.where(variant_id: items.map { |item| item.variant.id }).order(:id).
+                       group_by(&:variant_id).transform_values(&:first)
+
+        items.each do |item|
+          stock_location.allocate(item.variant, item.quantity, fulfillment, stock_level: stock_levels[item.variant.id])
         end
       end
 
@@ -240,7 +245,9 @@ module Spree
       # wildcard subscribers dedupe on the metadata marker.
       def publish_order_placed
         metadata = { notify_customer: order.notify_customer }
-        payload = order.event_payload
+        # The payload renders every line and parcel, read back through a lazily
+        # preloading query so each association loads once rather than per row.
+        payload = Spree::Order.where(id: order.id).preload_associations_lazily.take!.event_payload
         order.publish_event('order.placed', payload, metadata)
         order.publish_event('order.completed', payload, metadata.merge(deprecated_alias_of: 'order.placed'))
       end

data/app/workflows/spree/payments/capture.rb

@@ -23,6 +23,7 @@ module Spree
         @amount = capture_amount(amount)
 
         step :ensure_capturable
+        step :ensure_within_payment_amount
         # Veto point — fraud holds, manual review. Before any money moves.
         run_hooks :validate
         run_hooks :before_capture
@@ -69,6 +70,17 @@ module Spree
         failure(payment, :payment_not_capturable)
       end
 
+      # A capture takes some or all of what was authorized, never more: a
+      # gateway may let a larger figure through, and the books would then
+      # carry a capture the authorization never covered. Nor nothing, or less
+      # than nothing — every caller gets the same rule, not only the API.
+      def ensure_within_payment_amount
+        failure(payment, :capture_amount_not_positive) unless @amount.positive?
+        return if @amount <= payment.amount
+
+        failure(payment, :capture_exceeds_payment_amount)
+      end
+
       def claim
         halt!(payment) unless payment.started_processing!
       rescue Spree::Core::GatewayError => error

data/app/workflows/spree/products/nested_attributes.rb

@@ -195,6 +195,10 @@ module Spree
       # accumulate copies. Omitting an entry leaves it alone; removal is the
       # nested digital_assets DELETE endpoint's job.
       #
+      # Delegates to the digital asset workflows, so a file written as part of
+      # a product payload passes the same gate — and the same :validate
+      # handlers — as one written through the digital assets endpoint.
+      #
       # @param product [Spree::Product]
       # @param digital_assets_params [Array<Hash>, nil]
       # @return [void]
@@ -203,38 +207,18 @@ module Spree
 
         digital_assets_params.each do |raw|
           attrs = (raw.respond_to?(:to_h) ? raw.to_h : raw).with_indifferent_access
-
           asset_id = attrs.delete(:id)
-          signed_id = attrs.delete(:signed_id)
-          variant_id = attrs.delete(:variant_id)
-
-          # An id patches an existing asset; without one this is a new asset on
-          # the named variant (or the default). A patch for an asset that is
-          # gone is skipped rather than recreated.
-          if asset_id.present?
-            asset = product.digital_assets.find_by_param(asset_id) || next
-          else
-            target = variant_id.present? ? product.variants.find_by_param!(variant_id) : product.default_variant
-            next unless target
 
-            asset = target.digital_assets.build
-          end
-
-          asset.assign_attributes(attrs)
-
-          if signed_id.present?
-            # Attaching never moves a blob between storage services, so a file
-            # uploaded to the public bucket would stay publicly readable. Refuse
-            # it rather than attaching it wrongly.
-            blob = ActiveStorage::Blob.find_signed(signed_id)
-            unless blob && blob.service_name.to_s == Spree.private_storage_service_name.to_s
-              asset.errors.add(:attachment, :digital_assets_attachment_must_be_private, message: I18n.t('spree.digital_assets_attachment_must_be_private'))
-              raise ActiveRecord::RecordInvalid.new(asset)
+          result =
+            if asset_id.present?
+              # A patch for an asset that is gone is skipped rather than recreated.
+              asset = product.digital_assets.find_by_param(asset_id) || next
+              Spree.digital_asset_update_workflow.call(digital_asset: asset, attributes: attrs)
+            else
+              Spree.digital_asset_create_workflow.call(product: product, attributes: attrs)
             end
 
-            asset.attachment.attach(signed_id)
-          end
-          asset.save!
+          raise ActiveRecord::RecordInvalid, result.value if result.failure?
         end
       end
     end

data/app/workflows/spree/products/propose.rb

@@ -13,16 +13,20 @@ module Spree
 
       # @param product [Spree::Product]
       # @param submitted_by [Spree.admin_user_class, nil] who asked
+      # @param reason [String, nil] why a listing already on sale goes back to
+      #   review — what changed on it. Recorded on the submission row. Without
+      #   one, only a draft or a rejected product can be submitted.
       # @return [Spree::ServiceModule::Result] value is the product
-      def perform(product:, submitted_by: nil)
+      def perform(product:, submitted_by: nil, reason: nil)
         super
 
         # Only a listing that is being worked on can be submitted. Guarding
         # `active?` alone let an archived product through — and with
         # auto-approval on, a withdrawn listing went straight back on sale
         # without anybody reviewing it. Re-submitting one already in review
-        # is equally meaningless.
-        unless product.draft? || product.rejected?
+        # is equally meaningless. An active listing reopens review only when
+        # the caller says what changed, which no seller-facing action does.
+        unless product.draft? || product.rejected? || (reason.present? && product.active?)
           reject!(:cannot_propose, message: I18n.t('activerecord.errors.models.spree/product.attributes.base.cannot_propose'))
         end
 
@@ -51,7 +55,8 @@ module Spree
       # one: the trail is how many times this was asked for, and rewriting
       # the last answer would erase that.
       def open_submission
-        product.submissions.create!(status: 'pending', submitted_by: submitted_by)
+        product.submissions.create!(status: 'pending', submitted_by: submitted_by,
+                                    metadata: reason.present? ? { 'reason' => reason } : {})
       end
 
       def auto_approve?

data/app/workflows/spree/stock_levels/bulk_upsert.rb

@@ -35,9 +35,10 @@ module Spree
         # means the later line, not the sum of both.
         deduped = keyed.reverse.uniq { |row| [row[:variant_id].to_s, row[:stock_location_id].to_s] }.reverse
 
+        existing = existing_stock_levels(deduped)
         count = 0
         Spree::StockLevel.transaction do
-          deduped.each { |row| count += 1 if apply_row(row) }
+          deduped.each { |row| count += 1 if apply_row(row, existing) }
         end
 
         success(stock_level_count: count)
@@ -52,27 +53,41 @@ module Spree
       # happens to name — including another merchant's. One caller decoding
       # ids correctly does not make the workflow safe for the next one.
       def resolve(rows)
-        variants = scoped_ids(store_variants, Spree::Variant, rows.map { |row| row[:variant_id] })
-        locations = scoped_ids(store_stock_locations, Spree::StockLocation,
-                               rows.map { |row| row[:stock_location_id] })
+        @variants = scoped_records(store_variants, Spree::Variant, rows.map { |row| row[:variant_id] })
+        @stock_locations = scoped_records(store_stock_locations, Spree::StockLocation,
+                                          rows.map { |row| row[:stock_location_id] })
+        @variants_by_id = @variants.values.index_by(&:id)
+        @stock_locations_by_id = @stock_locations.values.index_by(&:id)
 
         rows.map do |row|
           row.merge(
-            variant_id: variants[row[:variant_id]],
-            stock_location_id: locations[row[:stock_location_id]]
+            variant_id: @variants[row[:variant_id]]&.id,
+            stock_location_id: @stock_locations[row[:stock_location_id]]&.id
           ).compact
         end
       end
 
       # Accepts a prefixed id or a raw one: the Admin API speaks prefixed,
       # while the importer and seeds hold records they already loaded.
-      def scoped_ids(scope, model, values)
+      #
+      # @return [Hash{Object => ActiveRecord::Base}] each value as given => this store's record
+      def scoped_records(scope, model, values)
         decoded = values.compact.uniq.index_with do |value|
           model.decode_own_prefixed_id(value) || value
         end
-        found = scope.where(id: decoded.values.compact).pluck(:id).map(&:to_s).to_set
+        found = scope.where(id: decoded.values.compact).index_by { |record| record.id.to_s }
+
+        decoded.transform_values { |id| found[id.to_s] if id }.compact
+      end
 
-        decoded.transform_values { |id| id if id && found.include?(id.to_s) }
+      # Every shelf the feed names, in one query rather than one per row.
+      # Lowest id wins, as an unordered lookup per pair would return.
+      def existing_stock_levels(rows)
+        Spree::StockLevel.
+          where(variant_id: rows.map { |row| row[:variant_id] }.uniq,
+                stock_location_id: rows.map { |row| row[:stock_location_id] }.uniq).
+          order(id: :desc).
+          index_by { |stock_level| [stock_level.variant_id.to_s, stock_level.stock_location_id.to_s] }
       end
 
       def store_variants
@@ -83,10 +98,10 @@ module Spree
         @store.stock_locations
       end
 
-      def apply_row(row)
-        stock_level = Spree::StockLevel.find_or_initialize_by(
-          variant_id: row[:variant_id], stock_location_id: row[:stock_location_id]
-        )
+      def apply_row(row, existing)
+        stock_level = existing[[row[:variant_id].to_s, row[:stock_location_id].to_s]] || Spree::StockLevel.new
+        stock_level.variant = @variants_by_id.fetch(row[:variant_id])
+        stock_level.stock_location = @stock_locations_by_id.fetch(row[:stock_location_id])
         stock_level.backorderable = row[:backorderable] if row.key?(:backorderable)
         stock_level.save! if stock_level.new_record? || stock_level.changed?
 

data/app/workflows/spree/variants/nested_attributes.rb

@@ -48,6 +48,8 @@ module Spree
         return if prices_params.nil?
 
         currencies = []
+        # Loaded once so each currency's write finds its row in memory.
+        variant.prices.load if variant.persisted?
 
         Array(prices_params).each do |raw|
           price = raw.to_h.with_indifferent_access
@@ -59,7 +61,8 @@ module Spree
 
         return unless variant.persisted?
 
-        variant.prices.base_prices.where.not(currency: currencies).destroy_all
+        stale = variant.prices.select { |price| price.persisted? && price.price_list_id.nil? && currencies.exclude?(price.currency) }
+        variant.prices.destroy(*stale) if stale.any?
       end
 
       # @param variant [Spree::Variant]
@@ -68,22 +71,44 @@ module Spree
       def apply_stock_levels(variant, stock_levels_params)
         return if stock_levels_params.blank?
 
-        Array(stock_levels_params).each do |raw|
-          row = raw.to_h.with_indifferent_access
-          next if row[:stock_location_id].blank?
+        rows = Array(stock_levels_params).map { |raw| raw.to_h.with_indifferent_access }
+        rows.reject! { |row| row[:stock_location_id].blank? }
+        return if rows.empty?
 
-          # Scoped through the product's own store: Spree::StockLocation
-          # lookup is global, so an id belonging to another store would
-          # otherwise put this variant's stock in that store's warehouse.
-          location = stock_location_for(variant, row[:stock_location_id])
+        locations = stock_locations_by_param(variant, rows.map { |row| row[:stock_location_id] })
+        # Loaded once so each row's write finds its level in memory.
+        variant.stock_levels.load if variant.persisted?
+
+        rows.each do |row|
+          location = locations[row[:stock_location_id].to_s]
           next if location.nil?
 
           variant.set_stock(row[:count_on_hand], row[:backorderable], location)
         end
+
+        # A count change locks and reloads its level, so the locations the
+        # response's stock figures read are loaded for every level afterwards.
+        ActiveRecord::Associations::Preloader.new(records: variant.stock_levels.to_a, associations: :stock_location).call
       end
 
-      def stock_location_for(variant, param)
-        variant.product&.store&.stock_locations&.find_by_param(param)
+      # Resolves every stock location the payload names in one read. Scoped
+      # through the product's own store: Spree::StockLocation lookup is
+      # global, so an id belonging to another store would otherwise put this
+      # variant's stock in that store's warehouse. A store keeps few
+      # locations, so loading them beats a lookup per row.
+      #
+      # @return [Hash{String => Spree::StockLocation}] keyed by both the
+      #   prefixed id and the raw id, which is what the payload may carry
+      def stock_locations_by_param(variant, params)
+        scope = variant.product&.store&.stock_locations
+        return {} if scope.nil? || params.empty?
+
+        wanted = params.map(&:to_s).uniq
+        scope.each_with_object({}) do |location, memo|
+          [location.prefixed_id.to_s, location.id.to_s].each do |key|
+            memo[key] = location if wanted.include?(key)
+          end
+        end
       end
     end
   end