spree_core 6.0.1 → 6.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2407d5fb2d24d9dd893a8c9dae11cfd8aba5a4b1d621a82938a2cb7009581936
-  data.tar.gz: f3384773e3442f383e979f60d58b7b06672a72065cd8d117a114ef49827fda5e
+  metadata.gz: 95b9df74c721a763fd81c0ca389f4bf996400ed8e1a262ca031228387157be16
+  data.tar.gz: ff8cd8cc1294aaa4eea49a2fbcd0c6319b15ed59d77988af865d48ae56782bf2
 SHA512:
-  metadata.gz: ebc83d9db9ebc13afea53ae0b184789f32a81121dcd9608461d93fb7e2e62b020cef774e69de3404fc0d23adb62df13f770281eacd6fd4671e5c0f5328ecae5b
-  data.tar.gz: 99ecc2439e9a73c1f805898c35e48079cd573b947110951c1a8349b26934e7ea8023b55a53cfdf1b3af94a5013290c52e5a097e4e5dff61d1249af8ca3327fb7
+  metadata.gz: 94d512c61c6b2e6aa3c8672c883ea406af8efb8c509fe7ba0f0a49d58c02aa767d23a9ff82e8532965e32217130aeff39074c78d5b8d0896de6f8dac9e7e19e7
+  data.tar.gz: cb944067256bc44223bca95b0c00bcf17f242745c2885ea063d7549592ebdbb013c0138359fb60326b662ae4b4ed583fdba553fc2f42378fa3952049b69d7af2

data/README.md

@@ -110,6 +110,6 @@ bundle exec rspec
 
 ## Documentation
 
-- [Official Documentation](https://docs.spreecommerce.org)
+- [Official Documentation](https://spreecommerce.org/docs)
 - [API Reference](https://api.spreecommerce.org)
-- [Guides](https://docs.spreecommerce.org/developer)
+- [Guides](https://spreecommerce.org/docs/developer)

data/app/models/concerns/spree/admin_user_methods.rb

@@ -2,6 +2,8 @@ module Spree
   module AdminUserMethods
     extend ActiveSupport::Concern
 
+    STATUSES = %w[active locked deactivated].freeze
+
     include Spree::Actor
     include Spree::PrefixedId
     include Spree::SignedIdAttachments
@@ -43,6 +45,8 @@ module Spree
 
       # Associations
       has_many :identities, class_name: 'Spree::UserIdentity', as: :user, dependent: :destroy
+      # Signed-in sessions, on the admin and the seller API alike.
+      has_many :refresh_tokens, class_name: 'Spree::RefreshToken', as: :user, dependent: :delete_all
       # The order operations became polymorphic in 6.0, so these read through
       # the association rather than a bare foreign key: matching on the id
       # alone would hand this user the rows an API key with the same numeric
@@ -84,6 +88,25 @@ module Spree
       Spree::Store.current.users.where.not(id: id).exists?
     end
 
+    # Whether the account can sign in. Duck-typed: a custom admin user class
+    # may lack deactivation or lockout.
+    # @return [String] +active+, +locked+ or +deactivated+
+    def status
+      if try(:deactivated?)
+        'deactivated'
+      elsif try(:locked?)
+        'locked'
+      else
+        'active'
+      end
+    end
+
+    # Sessions that can still be refreshed, most recently used first.
+    # @return [ActiveRecord::Relation<Spree::RefreshToken>]
+    def active_sessions
+      refresh_tokens.active.order(created_at: :desc)
+    end
+
     # Returns the full name of the user
     # @return [String]
     def full_name

data/app/models/concerns/spree/user_roles.rb

@@ -57,10 +57,15 @@ module Spree
         has_spree_role?(Spree::Role::ADMIN_ROLE, resource)
       end
 
-      # Returns the user who invited the current user
-      # @return [Spree.admin_user_class]
-      def invited_by
-        invitations.first&.inviter
+      # Who sent the invitation this user accepted to get a role on +resource+.
+      # Nil for a user given a role without one, such as the store owner.
+      #
+      # @param resource [Spree::Base] the store or seller; defaults to the current store
+      # @return [Object, nil] an actor (see Spree.actor_classes)
+      def invited_by(resource = nil)
+        resource ||= Spree::Store.current
+
+        invitations.accepted.where(resource: resource).order(:created_at).first&.inviter
       end
 
       # Whether this user belongs to any marketplace seller. The seller login

data/app/models/spree/order.rb

@@ -337,8 +337,10 @@ module Spree
     scope :reverse_chronological, -> { order(Arel.sql('spree_orders.completed_at IS NULL'), completed_at: :desc, created_at: :desc) }
 
     def self.search(query)
+      # Ransack passes `true` when the scope is called as a bare flag (`q[search]=1`)
+      return none unless query.is_a?(String) && query.present?
+
       sanitized_query = sanitize_query_for_search(query)
-      return none if query.blank?
 
       query_pattern = "%#{sanitized_query}%"
 

data/app/models/spree/order_promotion.rb

@@ -8,7 +8,7 @@ module Spree
     belongs_to :cart, class_name: 'Spree::Cart', optional: true, inverse_of: :order_promotions
     belongs_to :promotion, class_name: 'Spree::Promotion'
 
-    delegate :name, :description, :code, to: :promotion
+    delegate :name, :description, :code, to: :promotion, allow_nil: true
     delegate :currency, to: :owner
 
     validates :order, uniqueness: { scope: :promotion }, allow_nil: true
@@ -35,6 +35,8 @@ module Spree
     end
 
     def amount
+      return BigDecimal(0) if promotion.nil?
+
       owner.discounts.promotion.where(promotion_action_id: promotion.actions.ids).sum(:amount)
     end
 

data/app/models/spree/payment.rb

@@ -27,6 +27,11 @@ module Spree
     INVALID_STATES      = INVALID_STATUSES
     deprecate_constant :INVALID_STATES
 
+    # Statuses a payment can be voided / captured from, before the payment
+    # method is consulted. Extend them to support gateways with other flows.
+    VOIDABLE_STATUSES   = %w[pending processing completed checkout].freeze
+    CAPTURABLE_STATUSES = %w[checkout pending].freeze
+
     with_options inverse_of: :payments do
       belongs_to :order, class_name: 'Spree::Order', touch: true, optional: true
       belongs_to :cart, class_name: 'Spree::Cart', optional: true
@@ -219,8 +224,18 @@ module Spree
       status.in?(%w[checkout processing])
     end
 
+    # Whether the payment is in a status that can be voided and its payment
+    # method agrees. A gateway that cannot void a capture returns false from
+    # +can_void?(payment)+ for completed payments.
     def can_void?
-      status.in?(%w[pending processing completed checkout])
+      status.in?(VOIDABLE_STATUSES) &&
+        (!payment_method.respond_to?(:can_void?) || payment_method.can_void?(self))
+    end
+
+    # Whether the payment can be captured from the back office.
+    def can_capture?
+      status.in?(CAPTURABLE_STATUSES) &&
+        (!payment_method.respond_to?(:can_capture?) || payment_method.can_capture?(self))
     end
 
     # @deprecated read +status+ — removed in 6.1

data/app/models/spree/payment_method/store_credit.rb

@@ -18,8 +18,10 @@ module Spree
       ['checkout', 'pending'].include?(payment.status)
     end
 
+    # Mirrors Spree::StoreCredit#can_void?: a checkout payment can still be
+    # voided while its order is incomplete.
     def can_void?(payment)
-      payment.pending?
+      payment.pending? || (payment.checkout? && !payment.order&.completed?)
     end
 
     def authorize(money, store_credit, gateway_options = {})

data/app/models/spree/payment_method.rb

@@ -197,7 +197,7 @@ module Spree
     def webhook_url
       return nil unless store
 
-      "#{store.url_or_custom_domain}/api/v3/webhooks/payments/#{prefixed_id}"
+      "#{store.formatted_url_or_custom_domain}/api/v3/webhooks/payments/#{prefixed_id}"
     end
 
     class WebhookSignatureError < StandardError; end
@@ -309,6 +309,19 @@ module Spree
       raise ::NotImplementedError, 'You must implement cancel method for this payment method.'
     end
 
+    # Whether the payment can be voided in its current state. Gateways that
+    # cannot void a captured payment override this.
+    # @param _payment [Spree::Payment]
+    def can_void?(_payment)
+      true
+    end
+
+    # Whether the payment can be captured in its current state.
+    # @param _payment [Spree::Payment]
+    def can_capture?(_payment)
+      true
+    end
+
     def store_credit?
       self.class == Spree::PaymentMethod::StoreCredit
     end

data/app/models/spree/payment_source.rb

@@ -17,7 +17,9 @@ module Spree
     #
     # Validations
     #
-    validates_uniqueness_of :gateway_payment_profile_id, scope: :type
+    # A gateway profile id is only unique within the gateway account that issued it, so the same
+    # buyer needs a separate source under each payment method they pay through.
+    validates_uniqueness_of :gateway_payment_profile_id, scope: %i[type payment_method_id]
 
     #
     # Delegations

data/app/models/spree/promotion/actions/create_item_adjustments.rb

@@ -22,7 +22,7 @@ module Spree
         # clamped against its line's remaining discounted base, so the order net
         # can never go below zero.
         def compute_amount(line_item)
-          return 0 unless promotion.line_item_actionable?(line_item.order, line_item)
+          return 0 unless promotion.line_item_actionable?(line_item.owner, line_item)
 
           [line_item.amount, compute(line_item)].min * -1
         end

data/app/models/spree/promotion.rb

@@ -51,7 +51,8 @@ module Spree
     before_validation :set_starts_at_to_current_time, if: -> { starts_at.blank? }
     after_commit :generate_coupon_codes, if: -> { multi_codes? }, on: [:create, :update]
     after_commit :remove_coupons, on: :update
-    before_destroy :not_used?
+    before_destroy :detach_from_open_carts, prepend: true
+    before_destroy :not_used?, prepend: true
 
     #
     # Validations
@@ -376,6 +377,14 @@ module Spree
       flush_pending_typed_association(:promotion_actions)
     end
 
+    # Runs before the promotion's actions are destroyed, since the carts'
+    # discounts are tied back to the promotion through them.
+    def detach_from_open_carts
+      Spree::Cart.where(id: order_promotions.where.not(cart_id: nil).select(:cart_id)).find_each do |cart|
+        Spree::Promotions::DetachFromOwner.call(owner: cart, promotion: self, clear_coupon_code: true)
+      end
+    end
+
     def not_used?
       return true if orders.empty?
 

data/app/models/spree/promotion_handler/cart.rb

@@ -16,14 +16,20 @@ module Spree
       attr_reader :line_item, :order, :store
       attr_accessor :error, :success
 
-      def initialize(order, line_item = nil)
+      # @param order [Spree::Cart, Spree::Order]
+      # @param line_item [Spree::LineItem, nil]
+      # @param excluded_promotion_ids [Array<String, Integer>] promotions to leave alone, e.g. one that is being removed
+      def initialize(order, line_item = nil, excluded_promotion_ids: [])
         @order = order
         @line_item = line_item
         @store = order.store
+        @excluded_promotion_ids = Array(excluded_promotion_ids).map(&:to_s)
       end
 
       def activate
         promotions.each do |promotion|
+          next if @excluded_promotion_ids.include?(promotion.id.to_s)
+
           if (line_item && promotion.eligible?(line_item)) || promotion.eligible?(order)
             promotion.activate(line_item: line_item, order: order)
           else

data/app/models/spree/promotion_handler/coupon.rb

@@ -166,35 +166,7 @@ module Spree
       end
 
       def detach_promotion(promotion)
-        # Order promotion has to be destroyed before line item removing
-        order.promotions.delete(promotion)
-
-        if promotion.multi_codes?
-          promotion.coupon_codes.held_by(order).first&.remove_from_order
-        else
-          promotion.touch
-        end
-
-        remove_promotion_adjustments(promotion)
-        remove_promotion_line_items(promotion)
-        order.recalculate_totals!
-      end
-
-      def remove_promotion_adjustments(promotion)
-        order.discounts.where(promotion_action_id: promotion.actions.pluck(:id)).destroy_all
-      end
-
-      def remove_promotion_line_items(promotion)
-        create_line_item_actions_ids = promotion.actions.
-          where(type: %w[Spree::Promotion::Actions::CreateLineItems Spree::Promotion::Actions::CreateLineItems]).pluck(:id)
-
-        Spree::PromotionActionLineItem.where(promotion_action: create_line_item_actions_ids).find_each do |item|
-          line_item = order.find_line_item_by_variant(item.variant)
-          next if line_item.blank?
-
-          remove_service = order.is_a?(Spree::Cart) ? Spree.cart_remove_item_service : Spree.order_remove_item_service
-          remove_service.call(**{ (order.is_a?(Spree::Cart) ? :cart : :order) => order }, variant: item.variant, quantity: item.quantity)
-        end
+        Spree::Promotions::DetachFromOwner.call(owner: order, promotion: promotion)
       end
 
       def handle_present_promotion

data/app/models/spree/refresh_token.rb

@@ -6,12 +6,19 @@ module Spree
 
     has_secure_token :token
 
+    # Personal data. Rows written before encryption was enabled stay readable
+    # and are encrypted when the token next rotates.
+    encrypts :ip_address, support_unencrypted_data: true if ActiveRecord::Encryption.config.has_primary_key?
+
     validates :user, :expires_at, presence: true
     # On create only: rows minted before the column exists keep their NULL and
     # stay loadable (they are simply unredeemable), while nothing new is born
     # without the surface it belongs to.
     validates :audience, presence: true, on: :create
 
+    # Starting a session and refreshing one both create a row.
+    after_create :record_user_activity
+
     scope :active, -> { where('expires_at > ?', Time.current) }
     scope :expired, -> { where('expires_at <= ?', Time.current) }
 
@@ -23,6 +30,12 @@ module Spree
       expires_at <= Time.current
     end
 
+    # Each refresh replaces the row, so its creation is the session's last use.
+    # @return [ActiveSupport::TimeWithZone]
+    def last_active_at
+      created_at
+    end
+
     # Rotate: destroy this token and create a new one.
     # Returns the new token.
     def rotate!(request_env: {})
@@ -74,5 +87,18 @@ module Spree
     rescue StandardError
       30.days
     end
+
+    private
+
+    # Outlives the session itself, which signing out deletes. Skips callbacks
+    # and +updated_at+: activity is not an edit to the account, and an older
+    # session committing last never moves it back. Users without the column
+    # (customers, custom admin classes) are left alone.
+    def record_user_activity
+      return unless user.has_attribute?(:last_active_at)
+
+      stale = user.class.where(id: user.id).where('last_active_at IS NULL OR last_active_at < ?', created_at)
+      stale.update_all(last_active_at: created_at)
+    end
   end
 end

data/app/models/spree/variant.rb

@@ -71,7 +71,7 @@ module Spree
       has_many :stock_reservations
     end
 
-    has_many :option_value_variants, class_name: 'Spree::OptionValueVariant'
+    has_many :option_value_variants, class_name: 'Spree::OptionValueVariant', dependent: :destroy
     has_many :option_values, through: :option_value_variants, dependent: :destroy, class_name: 'Spree::OptionValue'
 
     has_many :images, -> { order(:position) }, as: :viewable, dependent: :destroy, class_name: 'Spree::Media'

data/app/services/spree/promotions/detach_from_owner.rb

@@ -0,0 +1,72 @@
+module Spree
+  module Promotions
+    # Removes a promotion from a cart or an order the way a shopper removing the
+    # code does: the order promotion, held coupon code, discounts and items
+    # the promotion added are removed, then totals are recalculated.
+    #
+    # @example Removing a promotion from a cart
+    #   Spree::Promotions::DetachFromOwner.call(owner: cart, promotion: promotion)
+    class DetachFromOwner
+      prepend Spree::ServiceModule::Base
+
+      # Action types whose line items are removed along with the promotion.
+      CREATE_LINE_ITEMS_ACTION_TYPES = %w[Spree::Promotion::Actions::CreateLineItems].freeze
+
+      # @param owner [Spree::Cart, Spree::Order] the cart or order holding the promotion
+      # @param promotion [Spree::Promotion] the promotion to remove
+      # @param clear_coupon_code [Boolean] also clear the code the shopper entered on the
+      #   owner, so recalculating does not apply the promotion again. Leave it off when the
+      #   shopper should be told the code was lost.
+      # @return [Spree::ServiceModule::Result] success, holding the owner; a failure when the
+      #   owner is already completed, since placed orders are never changed this way
+      def call(owner:, promotion:, clear_coupon_code: false)
+        return failure(owner, 'Cannot remove a promotion from a completed order') if owner.completed?
+
+        held_code = promotion.coupon_codes.held_by(owner).first if promotion.multi_codes?
+        clear_entered_coupon_code(owner, held_code&.code || promotion.code) if clear_coupon_code
+
+        # The order promotion has to go before line items are removed
+        owner.promotions.delete(promotion)
+
+        if held_code
+          held_code.remove_from_order
+        else
+          promotion.touch
+        end
+
+        owner.discounts.where(promotion_action_id: promotion.actions.ids).destroy_all
+        remove_promotion_line_items(owner, promotion)
+        owner.recalculate_totals!
+
+        success(owner)
+      end
+
+      private
+
+      # Carts keep the entered code, and recalculation would apply it again.
+      # Callers that let the shopper be told the code went keep it.
+      def clear_entered_coupon_code(owner, code)
+        return if code.blank? || !owner.has_attribute?(:coupon_code)
+        return unless owner.read_attribute(:coupon_code).to_s.casecmp?(code)
+
+        owner.update_column(:coupon_code, nil)
+      end
+
+      # Removes the line items a promotion's create-line-items actions added.
+      def remove_promotion_line_items(owner, promotion)
+        action_ids = promotion.actions.where(type: CREATE_LINE_ITEMS_ACTION_TYPES).ids
+        remove_service = owner.is_a?(Spree::Cart) ? Spree.cart_remove_item_service : Spree.order_remove_item_service
+        owner_key = owner.is_a?(Spree::Cart) ? :cart : :order
+
+        Spree::PromotionActionLineItem.where(promotion_action: action_ids).find_each do |item|
+          next if owner.find_line_item_by_variant(item.variant).blank?
+
+          # The promotion is still active here, so recalculating would add its items back;
+          # other promotions are still re-evaluated.
+          options = owner.is_a?(Spree::Cart) ? { excluded_promotion_ids: [promotion.id] } : {}
+          remove_service.call(owner_key => owner, variant: item.variant, quantity: item.quantity, options: options)
+        end
+      end
+    end
+  end
+end

data/app/services/spree/stock_reservations/reserve.rb

@@ -33,8 +33,12 @@ module Spree
 
           this_order_used = Hash.new(0)
 
-          reservations = targets.map do |line_item, stock_level, quantity|
-            stock_level = locked_stock_levels.fetch(stock_level.id)
+          reservations = targets.filter_map do |line_item, stock_level, quantity|
+            # A shelf deleted since the allocation was read (a variant being
+            # discontinued removes its stock) has nothing left to hold.
+            stock_level = locked_stock_levels[stock_level.id]
+            next if stock_level.nil?
+
             available = stock_level.available_count - held.fetch(stock_level.id, 0) - this_order_used[stock_level.id]
 
             raise_insufficient_stock(line_item, available) if available < quantity

data/app/workflows/spree/carts/recalculate.rb

@@ -9,6 +9,8 @@ module Spree
 
       # @param cart [Spree::Cart, Spree::Order] draft orders ride the same pipeline
       # @param line_item [Spree::LineItem, nil] the item whose change triggered this
+      # @param options [Hash] +excluded_promotion_ids:+ lists promotions to leave out of activation,
+      #   for callers that are removing a promotion's effects
       def perform(cart: nil, order: nil, line_item: nil, line_item_created: false, options: {})
         if order
           Spree::Deprecation.warn('Calling Spree::Carts::Recalculate with order: is deprecated and will be removed in Spree 6.1. Pass cart: instead.')
@@ -47,7 +49,9 @@ module Spree
       def activate_promotions
         @promotion_context = run_hooks :set_promotion_context
 
-        ::Spree::PromotionHandler::Cart.new(cart, line_item).activate
+        ::Spree::PromotionHandler::Cart.new(
+          cart, line_item, excluded_promotion_ids: options[:excluded_promotion_ids] || []
+        ).activate
       end
     end
   end

data/db/migrate/20260809150001_promote_shipping_categories_to_delivery_profiles.rb

@@ -52,6 +52,7 @@ class PromoteShippingCategoriesToDeliveryProfiles < ActiveRecord::Migration[8.1]
     remove_column :spree_product_types, :fulfillment_types
 
     backfill_store_defaults
+    copy_first_zone_onto_methods
 
     drop_table :spree_delivery_method_zones
   end
@@ -141,13 +142,21 @@ class PromoteShippingCategoriesToDeliveryProfiles < ActiveRecord::Migration[8.1]
       # never carried a category, so they all belong to the default profile.
       MigrationProduct.where(store_id: store.id, delivery_profile_id: nil).update_all(delivery_profile_id: profile.id)
 
-      MigrationMethod.where(store_id: store.id).find_each do |method|
-        zone_ids = MigrationMethodZone.where(delivery_method_id: method.id).order(:id).pluck(:delivery_zone_id)
-        if zone_ids.size > 1
-          say "Delivery method #{method.id} was linked to #{zone_ids.size} zones; keeping the first — recreate the method for the other zones if both were intended."
-        end
-        method.update_columns(delivery_profile_id: profile.id, delivery_origin_group_id: origin_group.id, delivery_zone_id: zone_ids.first)
+      MigrationMethod.where(store_id: store.id).update_all(delivery_profile_id: profile.id, delivery_origin_group_id: origin_group.id)
+    end
+  end
+
+  # Runs for every method, including 5.x rows whose store_id is still nil: the
+  # link table is dropped right after, so this is the last chance to keep it.
+  def copy_first_zone_onto_methods
+    zone_ids_by_method = MigrationMethodZone.order(:id).pluck(:delivery_method_id, :delivery_zone_id).
+      group_by(&:first).transform_values { |pairs| pairs.map(&:last) }
+
+    zone_ids_by_method.each do |method_id, zone_ids|
+      if zone_ids.size > 1
+        say "Delivery method #{method_id} was linked to #{zone_ids.size} zones; keeping the first — recreate the method for the other zones if both were intended."
       end
+      MigrationMethod.where(id: method_id).update_all(delivery_zone_id: zone_ids.first)
     end
   end
 end

data/db/migrate/20261030100001_scope_payment_sources_profile_id_uniqueness_to_payment_method.rb

@@ -0,0 +1,38 @@
+class ScopePaymentSourcesProfileIdUniquenessToPaymentMethod < ActiveRecord::Migration[8.1]
+  LEGACY_INDEX_NAME = 'index_payment_sources_on_type_and_gateway_payment_profile_id'.freeze
+  INDEX_NAME = 'index_payment_sources_on_type_profile_id_and_payment_method'.freeze
+
+  def up
+    remove_index :spree_payment_sources, name: LEGACY_INDEX_NAME
+    add_index :spree_payment_sources, [:type, :gateway_payment_profile_id, :payment_method_id],
+              unique: true, name: INDEX_NAME
+  end
+
+  # The legacy index cannot come back once a buyer holds the same gateway profile under two
+  # payment methods, which is what `up` exists to allow. Checked before anything is dropped so a
+  # refusal leaves both indexes intact on MySQL, which has no transactional DDL.
+  def down
+    if cross_payment_method_duplicates?
+      raise ActiveRecord::IrreversibleMigration,
+            'Payment sources share a gateway_payment_profile_id across payment methods, which ' \
+            'the globally unique index cannot represent. Reconcile those rows before rolling back.'
+    end
+
+    remove_index :spree_payment_sources, name: INDEX_NAME
+    add_index :spree_payment_sources, [:type, :gateway_payment_profile_id],
+              unique: true, name: LEGACY_INDEX_NAME
+  end
+
+  private
+
+  # NULLs are distinct in a unique index, so only fully populated pairs could ever have collided.
+  def cross_payment_method_duplicates?
+    connection.select_value(<<~SQL).present?
+      SELECT 1 FROM spree_payment_sources
+      WHERE type IS NOT NULL AND gateway_payment_profile_id IS NOT NULL
+      GROUP BY type, gateway_payment_profile_id
+      HAVING COUNT(*) > 1
+      LIMIT 1
+    SQL
+  end
+end

data/db/migrate/20261031000001_add_last_active_at_to_spree_admin_users.rb

@@ -0,0 +1,7 @@
+# Written whenever a session starts or refreshes (see Spree::RefreshToken), so
+# it outlives the sessions themselves, which signing out deletes.
+class AddLastActiveAtToSpreeAdminUsers < ActiveRecord::Migration[8.1]
+  def change
+    add_column :spree_admin_users, :last_active_at, :datetime
+  end
+end

data/db/migrate/20261031100001_delete_orphaned_spree_option_value_variants.rb

@@ -0,0 +1,10 @@
+class DeleteOrphanedSpreeOptionValueVariants < ActiveRecord::Migration[8.1]
+  # Replacing a variant's option_value_variants used to nullify the old join rows instead of
+  # deleting them. Rows with no variant belong to nothing and block new variants from reusing
+  # their option values through the uniqueness validation scoped to a NULL variant_id.
+  def up
+    execute 'DELETE FROM spree_option_value_variants WHERE variant_id IS NULL'
+  end
+
+  def down; end
+end

data/lib/generators/spree/dummy/dummy_generator.rb

@@ -40,7 +40,6 @@ module Spree
       args << '--skip-git'
       args << '--skip-keeps'
       args << '--skip-rc'
-      args << '--skip-spring'
       args << '--skip-test'
       args << '--skip-bootsnap'
       args << '--skip-docker'

data/lib/generators/spree/dummy/templates/rails/database.yml

@@ -1,6 +1,3 @@
-<% if agent_number = ENV['TC_AGENT_NUMBER']
-database_prefix = agent_number + '_'
-end %>
 <% if options[:lib_name]
   lib_name = options[:lib_name].gsub('/', '_')
 end %>
@@ -37,13 +34,13 @@ mysql: &mysql
 
 development:
   <<: *mysql
-  database: <%= database_prefix %><%= lib_name %>_spree_development
+  database: <%= lib_name %>_spree_development
 test:
   <<: *mysql
-  database: <%= database_prefix %><%= lib_name %>_spree_test<%%= ENV['TEST_ENV_NUMBER'] %>
+  database: <%= lib_name %>_spree_test<%%= ENV['TEST_ENV_NUMBER'] %>
 production:
   <<: *mysql
-  database: <%= database_prefix %><%= lib_name %>_spree_production
+  database: <%= lib_name %>_spree_production
 <% when 'postgres' %>
 postgres: &postgres
   adapter: postgresql
@@ -61,13 +58,13 @@ postgres: &postgres
 
 development:
   <<: *postgres
-  database: <%= database_prefix %><%= lib_name %>_spree_development
+  database: <%= lib_name %>_spree_development
 test:
   <<: *postgres
-  database: <%= database_prefix %><%= lib_name %>_spree_test<%%= ENV['TEST_ENV_NUMBER'] %>
+  database: <%= lib_name %>_spree_test<%%= ENV['TEST_ENV_NUMBER'] %>
 production:
   <<: *postgres
-  database: <%= database_prefix %><%= lib_name %>_spree_production
+  database: <%= lib_name %>_spree_production
 <% else %>
 development:
   adapter: sqlite3

data/lib/generators/spree/dummy/templates/rails/test.rb

@@ -1,11 +1,11 @@
-Dummy::Application.configure do
+Rails.application.configure do
   # Settings specified here will take precedence over those in config/application.rb
 
   # The test environment is used exclusively to run your application's
   # test suite. You never need to work with it otherwise. Remember that
   # your test database is "scratch space" for the test suite and is wiped
   # and recreated between test runs. Don't rely on the data there!
-  config.cache_classes = true
+  config.enable_reloading = false
 
   # Configure static asset server for tests with Cache-Control for performance
   config.public_file_server.enabled = true
@@ -17,8 +17,9 @@ Dummy::Application.configure do
 
   config.eager_load = false
 
-  # Raise exceptions instead of rendering exception templates
-  config.action_dispatch.show_exceptions = false
+  # Raise unexpected exceptions; render the ones Rails maps to a status, such
+  # as a 404 for an unknown route, the way production does.
+  config.action_dispatch.show_exceptions = :rescuable
 
   # Disable request forgery protection in test environment
   config.action_controller.allow_forgery_protection    = false
@@ -138,7 +139,10 @@ Dummy::Application.configure do
       %r{/spree/orders/complete\.rb:\d+:in '[^']*#place_sibling'},
       # Each requested line is priced, stock-checked, saved and taxed as it
       # is written.
-      %r{/spree/carts/upsert_items\.rb:\d+:in '[^']*#apply_item'}
+      %r{/spree/carts/upsert_items\.rb:\d+:in '[^']*#apply_item'},
+      # An import writes each row on its own, inside the request when the
+      # import is set to run inline.
+      %r{/spree/import_row\.rb:\d+:in '[^']*#process!'}
     ]
 
     # A purchase's billing and shipping addresses, and a transfer's two

data/lib/generators/spree/dummy_model/templates/migration.rb.tt

@@ -1,4 +1,4 @@
-class CreateSpreeDummyModels < ActiveRecord::Migration[5.1]
+class CreateSpreeDummyModels < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
   def change
     create_table :spree_dummy_models do |t|
       t.string :name

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '6.0.1'.freeze
+  VERSION = '6.0.2'.freeze
 
   def self.version
     VERSION

data/lib/spree/core.rb

@@ -39,8 +39,6 @@ require 'ransack'
 require 'active_storage_validations'
 require 'wannabe_bool'
 require 'geocoder'
-
-require 'safely_block'
 require 'ar_lazy_preload'
 require 'sqids'
 
@@ -125,7 +123,6 @@ module Spree
       collections: :default,
       stock_location_stock_levels: :default,
       coupon_codes: :default,
-      themes: :default,
       addresses: :default,
       gift_cards: :default,
       webhooks: :default,

data/lib/spree/testing_support/common_rake.rb

@@ -3,11 +3,12 @@ require 'generators/spree/dummy_model/dummy_model_generator'
 
 desc 'Generates a dummy app for testing'
 namespace :common do
+  # :authentication is ignored (test apps use the gem-owned auth models); it stays
+  # so extensions passing positional arguments keep working.
   task :test_app, [:authentication, :user_class, :admin_user_class] do |_t, args|
     # Support both Rake::TaskArguments (via invoke) and Hash (via execute)
     # When using execute with a Hash, args IS the hash directly
     defaults = {
-      authentication: 'dummy',
       user_class: 'Spree::Customer',
       admin_user_class: 'Spree::AdminUser',
     }
@@ -45,7 +46,7 @@ namespace :common do
       File.exist?(File.expand_path('../../../../spree.gemspec', __dir__))
     bundle_exec = use_root_gemfile ? "bundle exec --gemfile=#{root_gemfile}" : 'bundle exec'
     puts 'Running Spree install generator...'
-    system("#{bundle_exec} rails g spree:install --force --auto-accept --migrate=false --seed=false --sample=false --user_class=#{args[:user_class]} --admin_user_class=#{args[:admin_user_class]} --authentication=#{args[:authentication]}")
+    system("#{bundle_exec} rails g spree:install --force --auto-accept --migrate=false --seed=false --sample=false --user_class=#{args[:user_class]} --admin_user_class=#{args[:admin_user_class]}")
 
     unless ENV['NO_MIGRATE']
       puts 'Setting up dummy database...'

data/lib/spree/testing_support/lifecycle_events.rb

@@ -23,9 +23,7 @@ shared_examples_for 'lifecycle events' do |factory: nil, event_prefix: nil|
 
         # update_attribute, not update!: Spree::Fulfillment#update! shadows the
         # Active Record method with the legacy state-recalculation API.
-        Timecop.travel(1.minute.from_now) do
-          record.update_attribute(:updated_at, Time.current)
-        end
+        record.update_attribute(:updated_at, 1.minute.from_now)
       end
 
       it 'does not publish updated event on a bare touch' do

data/lib/spree/upgrades/5_6_to_6_0/manifest.yml

@@ -212,7 +212,8 @@ steps:
     task: "spree:migrate_shipping_to_delivery"
     notes: |
       Rewrites stored 'Spree::Shipment' class-name strings (state changes,
-      stock movements, legacy adjustments), renames the terminal fulfillment
+      stock movements, legacy adjustments) and the calculators' 'Spree::ShippingMethod'
+      calculable type (so delivery methods find their calculator), renames the terminal fulfillment
       status 'shipped' -> 'fulfilled', backfills the fulfillment provider on
       delivery methods (DigitalDelivery calculators become the Digital
       provider) and copies the provider-derived type onto existing

data/lib/tasks/delivery_migration.rake

@@ -29,6 +29,11 @@ namespace :spree do
       say.call "spree_adjustments.adjustable_type: #{count} rows Spree::Shipment → Spree::Fulfillment"
     end
 
+    # Calculators are polymorphic on the renamed shipping method; without this
+    # DeliveryMethod#calculator finds nothing.
+    count = Spree::Calculator.where(calculable_type: 'Spree::ShippingMethod').in_batches(of: batch_size).update_all(calculable_type: 'Spree::DeliveryMethod')
+    say.call "spree_calculators.calculable_type: #{count} rows Spree::ShippingMethod → Spree::DeliveryMethod"
+
     # The name column distinguishes the machine ('shipment' rows become
     # 'fulfillment'); the recorded states keep their history except the
     # renamed terminal value.
@@ -171,6 +176,11 @@ namespace :spree do
       end
     end
 
+    # 5.x methods have no store until backfill_delivery_and_stock_store_ids
+    # runs (later in the upgrade), and a DeliveryZone requires one. Resolve
+    # them to the default store, exactly as that backfill will.
+    default_store_id = Spree::Store.default&.id
+
     legacy_zones.find_each do |zone|
       if Spree::DeliveryZone.exists?(id: zone.id) && !migrated.value?(zone.id)
         puts "SKIP zone #{zone.id} (#{zone.name}): a DeliveryZone with the same id already exists — resolve manually"
@@ -178,7 +188,7 @@ namespace :spree do
       end
 
       methods_by_home = Spree::DeliveryMethod.unscoped.where(delivery_zone_id: zone.id).
-        group_by { |method| [method.store_id, method.delivery_profile_id] }
+        group_by { |method| [method.store_id || default_store_id, method.delivery_profile_id] }
 
       methods_by_home.each do |(store_id, profile_id), methods|
         profile_id ||= Spree::DeliveryProfile.where(store_id: store_id, default: true).pick(:id)
@@ -208,6 +218,12 @@ namespace :spree do
       puts "SKIP unreferenced shipping zone #{zone.id} (#{zone.name}) — no delivery method uses it"
     end
 
+    zoneless = Spree::DeliveryMethod.unscoped.where(delivery_zone_id: nil).pluck(:id, :name)
+    if zoneless.any?
+      puts "WARNING: #{zoneless.size} delivery methods have no delivery zone and return no rates at checkout. Assign a zone to each in the admin:"
+      zoneless.each { |id, name| puts "  - ##{id} #{name}" }
+    end
+
     puts 'migrate_zones_to_delivery_zones done. Tax-scoped zones stay on Spree::Zone for the tax provider migration.'
   end
 end

data/lib/tasks/remove_orphan_order_promotions.rake

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+# Deleting a promotion used to leave OrderPromotion rows on open carts pointing
+# at a promotion that no longer exists, which broke loading those carts.
+namespace :spree do
+  desc 'Remove order promotions whose promotion no longer exists and recalculate the affected carts'
+  task remove_orphan_order_promotions: :environment do
+    orphans = Spree::OrderPromotion.where.not(promotion_id: Spree::Promotion.unscoped.select(:id))
+    removed = 0
+
+    orphans.find_each do |order_promotion|
+      owner = order_promotion.owner
+      order_promotion.destroy
+      owner&.recalculate_totals! if owner.is_a?(Spree::Cart)
+      removed += 1
+    end
+
+    puts "remove_orphan_order_promotions done. removed: #{removed}"
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 6.0.1
+  version: 6.0.2
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-29 00:00:00.000000000 Z
+date: 2026-11-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -66,14 +66,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: acts-as-taggable-on
   requirement: !ruby/object:Gem::Requirement
@@ -108,20 +108,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.3.1
-- !ruby/object:Gem::Dependency
-  name: benchmark
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: cancancan
   requirement: !ruby/object:Gem::Requirement
@@ -198,26 +184,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: highline
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '2'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '4'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '2'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '4'
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
@@ -442,20 +408,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.5'
-- !ruby/object:Gem::Dependency
-  name: rexml
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: stringex
   requirement: !ruby/object:Gem::Requirement
@@ -608,26 +560,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: safely_block
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.4'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.4'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: phonelib
   requirement: !ruby/object:Gem::Requirement
@@ -1436,6 +1368,7 @@ files:
 - app/services/spree/products/duplicator.rb
 - app/services/spree/products/for_context.rb
 - app/services/spree/products/select_buy_box.rb
+- app/services/spree/promotions/detach_from_owner.rb
 - app/services/spree/purchases/amount_due_at_checkout.rb
 - app/services/spree/returns/eligibility_validator.rb
 - app/services/spree/sample_data/helper.rb
@@ -2029,6 +1962,9 @@ files:
 - db/migrate/20261022000001_store_credit_actor_polymorphic.rb
 - db/migrate/20261023100001_add_deactivated_at_to_spree_admin_users.rb
 - db/migrate/20261029100001_add_lockout_columns_to_spree_admin_users.rb
+- db/migrate/20261030100001_scope_payment_sources_profile_id_uniqueness_to_payment_method.rb
+- db/migrate/20261031000001_add_last_active_at_to_spree_admin_users.rb
+- db/migrate/20261031100001_delete_orphaned_spree_option_value_variants.rb
 - db/sample_data/channels.rb
 - db/sample_data/collections.rb
 - db/sample_data/custom_field_definitions.rb
@@ -2058,9 +1994,6 @@ files:
 - lib/generators/spree/api_resource/templates/store_controller.rb.tt
 - lib/generators/spree/api_resource/templates/store_controller_spec.rb.tt
 - lib/generators/spree/api_resource/templates/store_serializer.rb.tt
-- lib/generators/spree/authentication/dummy/dummy_generator.rb
-- lib/generators/spree/authentication/dummy/templates/authentication_helpers.rb.tt
-- lib/generators/spree/authentication/dummy/templates/create_spree_admin_users.rb.tt
 - lib/generators/spree/controller_decorator/controller_decorator_generator.rb
 - lib/generators/spree/controller_decorator/templates/controller_decorator.rb.tt
 - lib/generators/spree/dummy/dummy_generator.rb
@@ -2363,6 +2296,7 @@ files:
 - lib/tasks/products.rake
 - lib/tasks/publications.rake
 - lib/tasks/remove_master_variant.rake
+- lib/tasks/remove_orphan_order_promotions.rake
 - lib/tasks/rich_text.rake
 - lib/tasks/sample_data.rake
 - lib/tasks/search.rake
@@ -2400,9 +2334,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.1
-  documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v6.0.1
+  changelog_uri: https://github.com/spree/spree/releases/tag/v6.0.2
+  documentation_uri: https://spreecommerce.org/docs/
+  source_code_uri: https://github.com/spree/spree/tree/v6.0.2
 post_install_message:
 rdoc_options: []
 require_paths:

data/lib/generators/spree/authentication/dummy/dummy_generator.rb

@@ -1,54 +0,0 @@
-require 'rails/generators'
-
-module Spree
-  module Authentication
-    class DummyGenerator < Rails::Generators::Base
-      desc 'Set up a Spree installation with dummy authentication for testing. Creates a separate spree_admin_users table.'
-
-      def self.source_paths
-        paths = superclass.source_paths
-        paths << File.expand_path('templates', __dir__)
-        paths.flatten
-      end
-
-      def create_authentication_helpers
-        template 'authentication_helpers.rb.tt', 'lib/spree/authentication_helpers.rb'
-      end
-
-      def configure_authentication_helpers
-        file_action = File.exist?('config/initializers/spree.rb') ? :append_file : :create_file
-        send(file_action, 'config/initializers/spree.rb') do
-          <<~RUBY
-
-            Rails.application.config.to_prepare do
-              require_dependency 'spree/authentication_helpers'
-            end
-          RUBY
-        end
-      end
-
-      def create_admin_users_migration
-        # Use a fixed early timestamp (20210913) to ensure this migration runs BEFORE
-        # any Spree core migrations that reference spree_admin_users table.
-        # The earliest such migration is 20250122113708_add_first_and_last_name_to_spree_admin_class.rb
-        # We use a timestamp before the main Spree migration (20210914000000_spree_four_three.rb)
-        migration_file = File.join('db', 'migrate', '20210913000000_create_spree_admin_users.rb')
-
-        # Skip if migration already exists
-        return if File.exist?(migration_file) || migration_exists?('create_spree_admin_users')
-
-        template 'create_spree_admin_users.rb.tt', migration_file
-      end
-
-      private
-
-      def migration_exists?(name)
-        Dir.glob(File.join('db', 'migrate', "*_#{name}.rb")).any?
-      end
-
-      def migration_version
-        "[#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}]"
-      end
-    end
-  end
-end

data/lib/generators/spree/authentication/dummy/templates/authentication_helpers.rb.tt

@@ -1,52 +0,0 @@
-# Dummy authentication helpers for testing purposes.
-# These provide stub implementations that don't require actual routes.
-module Spree
-  module AuthenticationHelpers
-    def self.included(receiver)
-      receiver.helper_method(
-        :spree_current_user,
-        :spree_login_path,
-        :spree_signup_path,
-        :spree_logout_path,
-        :spree_forgot_password_path,
-        :spree_edit_password_path,
-        :spree_admin_login_path,
-        :spree_admin_logout_path
-      )
-    end
-
-    def spree_current_user
-      @spree_current_user
-    end
-
-    def spree_login_path(_opts = {})
-      '/login'
-    end
-
-    def spree_signup_path(_opts = {})
-      '/signup'
-    end
-
-    def spree_logout_path(_opts = {})
-      '/logout'
-    end
-
-    def spree_forgot_password_path(_opts = {})
-      '/forgot_password'
-    end
-
-    def spree_edit_password_path(_opts = {})
-      '/edit_password'
-    end
-
-    def spree_admin_login_path(_opts = {})
-      '/admin/login'
-    end
-
-    def spree_admin_logout_path(_opts = {})
-      '/admin/logout'
-    end
-  end
-end
-
-ApplicationController.include Spree::AuthenticationHelpers if defined?(ApplicationController)

data/lib/generators/spree/authentication/dummy/templates/create_spree_admin_users.rb.tt

@@ -1,33 +0,0 @@
-class CreateSpreeAdminUsers < ActiveRecord::Migration<%= migration_version %>
-  def change
-    create_table :spree_admin_users do |t|
-      t.string :encrypted_password, limit: 128
-      t.string :password_digest
-      t.string :email
-      t.string :remember_token
-      t.string :persistence_token
-      t.string :reset_password_token
-      t.string :perishable_token
-      t.integer :sign_in_count, default: 0, null: false
-      t.integer :failed_attempts, default: 0, null: false
-      t.datetime :last_request_at
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string :current_sign_in_ip
-      t.string :last_sign_in_ip
-      t.string :login
-      t.string :authentication_token
-      t.string :unlock_token
-      t.datetime :locked_at
-      t.datetime :remember_created_at
-      t.datetime :reset_password_sent_at
-      t.string :first_name
-      t.string :last_name
-      t.string :selected_locale
-
-      t.timestamps
-    end
-
-    add_index :spree_admin_users, :email, unique: true
-  end
-end