spree_core 5.0.3 → 5.1.0.beta

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61dc753fc9921cc827589519ccd19bdd4db91ff9ba052174e84e6681578b67a3
-  data.tar.gz: 9e992274856bc445de5a7b4041126721e992e1554aa0d677ff87c908a52c6cc9
+  metadata.gz: 7c1195535152943b227b48f47f34f8a53164727cff509e72ef64a720b4dfbf36
+  data.tar.gz: e88f4d0212bf72d2ef986faae3bd97a1793cffa2fa215a7d078f47044a1ad8f8
 SHA512:
-  metadata.gz: 6a6b74d64d7be259de034cfc831f6eaf9877f9f801a3312adda2af3983060948e8434e2ef4d7ad4b3fdbeac7ff366ae6d87a210b27f7172769abbda9243e46b5
-  data.tar.gz: f31e47f912ee551e853fe190e1acd34009d3c191cc9666797db4986fbecbb445062e6533de35489998dbdea569d85fd9bf0fd54ee3e27047c5c373e6c2a62ad6
+  metadata.gz: 702032f4dbd79afda63c303e4f2a957e982f6cac18f95dded6f241a920f6600b3ea5e08253780185b7e87ec4d676dd4fa7d6fa92c99e43e4cb79420afeef94ad
+  data.tar.gz: 72a2841b3265909bcc97404cc8c504216dc65033b251010ba96acc2e666ece5c30cba4902eed857ced89598c9b411659f424a376c61230d5d71771deda6660cb

data/app/finders/spree/products/find.rb

@@ -11,6 +11,7 @@ module Spree
         @currency         = params.dig(:filter, :currency) || params[:currency] || Spree::Store.default.default_currency
         @taxons           = taxon_ids(params.dig(:filter, :taxons))
         @concat_taxons    = taxon_ids(params.dig(:filter, :concat_taxons))
+        @taxonomies       = params.dig(:filter, :taxonomy_ids).to_h
         @name             = params.dig(:filter, :name)
         @slug             = params.dig(:filter, :slug)
         @options          = params.dig(:filter, :options).try(:to_unsafe_hash)
@@ -52,6 +53,7 @@ module Spree
         products = show_only_backorderable(products)
         products = show_only_purchasable(products)
         products = show_only_out_of_stock(products)
+        products = by_taxonomies(products)
         products = ordered(products)
         products = by_vendor_ids(products)
 
@@ -62,7 +64,7 @@ module Spree
 
       attr_reader :ids, :skus, :price, :currency, :taxons, :concat_taxons, :name, :options, :option_value_ids, :scope,
                   :sort_by, :deleted, :discontinued, :properties, :store, :in_stock, :backorderable, :purchasable, :tags,
-                  :query, :vendor_ids, :out_of_stock, :slug
+                  :query, :vendor_ids, :out_of_stock, :slug, :taxonomies
 
       def query?
         query.present?
@@ -169,6 +171,21 @@ module Spree
         products.where(id: product_ids)
       end
 
+      def by_taxonomies(products)
+        return products if taxonomies.none?
+
+        taxon_groups = taxonomies.values.map { |taxonomy| taxon_ids(taxonomy[:taxon_ids].join(',')) }.compact_blank
+
+        return products if taxon_groups.empty?
+
+        taxonomies_products = products.joins(:classifications).where(Classification.table_name => { taxon_id: taxon_groups.flatten.uniq })
+
+        # No need to filter if there is only one taxonomy
+        return taxonomies_products if taxonomies.size == 1
+
+        products.where(id: products_matching_all_taxonomies_ids(taxonomies_products.ids, taxon_groups))
+      end
+
       def by_name(products)
         return products unless name?
 
@@ -336,6 +353,16 @@ module Spree
       def order_by_best_selling(scope)
         scope.by_best_selling(:desc)
       end
+
+      def products_matching_all_taxonomies_ids(products_ids, taxon_groups)
+        classifications = Spree::Classification.grouped_taxon_ids_for_products(products_ids, taxon_groups.flatten)
+        classifications_hash = classifications.to_h.transform_values { |taxon_ids| taxon_ids.split(',') }
+
+        # Find products ids that match all taxonomies to tighten filter results
+        classifications_hash.filter_map do |product_id, product_taxon_ids|
+          product_id if taxon_groups.all? { |group| group.intersect?(product_taxon_ids) }
+        end
+      end
     end
   end
 end

data/app/finders/spree/taxons/find.rb

@@ -68,7 +68,7 @@ module Spree
         if Spree.use_translations?
           taxons.joins(:parent).
             join_translation_table(Taxon, 'parents_spree_taxons').
-            where(["#{Taxon.translation_table_alias}.permalink = ?", parent_permalink])
+            where(Taxon.translation_table_alias => { permalink: parent_permalink })
         else
           taxons.joins(:parent).where(parent: { permalink: parent_permalink })
         end

data/app/helpers/spree/integrations_helper.rb

@@ -0,0 +1,15 @@
+module Spree
+  module IntegrationsHelper
+    def store_integrations
+      @store_integrations ||= current_store.integrations.active.to_a
+    end
+
+    def store_integration(name)
+      store_integrations.find { |integration| integration.type.to_s.demodulize.underscore == name }
+    end
+
+    def grouped_available_store_integrations
+      Rails.application.config.spree.integrations.group_by(&:integration_group).sort_by { |group, _| group }
+    end
+  end
+end

data/app/javascript/spree/core/controllers/disable_submit_button_controller.js

@@ -0,0 +1,19 @@
+import { Controller } from "@hotwired/stimulus";
+
+export default class extends Controller {
+  static targets = ["button"]
+
+  connect() {
+    this.element.addEventListener('submit', this.toggleDisabledButton)
+  }
+
+  disconnect() {
+    this.element.removeEventListener('submit', this.toggleDisabledButton)
+  }
+
+  toggleDisabledButton = () => {
+    if (this.hasButtonTarget) {
+      this.buttonTarget.disabled = !this.buttonTarget.disabled
+    }
+  }
+}

data/app/mailers/spree/invitation_mailer.rb

@@ -0,0 +1,24 @@
+module Spree
+  class InvitationMailer < BaseMailer
+    # invitation email, sending email to the invited to let them know they have been invited to join a store/account/vendor
+    def invitation_email(invitation)
+      @invitation = invitation
+      mail(to: invitation.email,
+           from: from_address,
+           reply_to: reply_to_address,
+           subject: Spree.t('invitation_mailer.invitation_email.subject',
+                            resource_name: invitation.resource&.name))
+    end
+
+    # sending email to the inviter to let them know the invitee has accepted the invitation
+    def invitation_accepted(invitation)
+      @invitation = invitation
+      mail(to: invitation.inviter.email,
+           from: from_address,
+           reply_to: reply_to_address,
+           subject: Spree.t('invitation_mailer.invitation_accepted.subject',
+                            invitee_name: invitation.invitee&.name,
+                            resource_name: invitation.resource&.name))
+    end
+  end
+end

data/app/models/concerns/spree/integrations_concern.rb

@@ -0,0 +1,11 @@
+module Spree
+  module IntegrationsConcern
+    def store_integrations
+      @store_integrations ||= Spree::Store.current.integrations.active.to_a
+    end
+
+    def store_integration(name)
+      store_integrations.find { |integration| integration.type.to_s.demodulize.underscore == name }
+    end
+  end
+end

data/app/models/concerns/spree/product_scopes.rb

@@ -49,11 +49,11 @@ module Spree
       add_simple_scopes simple_scopes
 
       add_search_scope :ascend_by_master_price do
-        order("#{price_table_name}.amount ASC")
+        order(price_table_name => { amount: :asc })
       end
 
       add_search_scope :descend_by_master_price do
-        order("#{price_table_name}.amount DESC")
+        order(price_table_name => { amount: :desc })
       end
 
       add_search_scope :price_between do |low, high|
@@ -61,11 +61,11 @@ module Spree
       end
 
       add_search_scope :master_price_lte do |price|
-        where("#{price_table_name}.amount <= ?", price)
+        where(Price.table_name => { amount: ..price })
       end
 
       add_search_scope :master_price_gte do |price|
-        where("#{price_table_name}.amount >= ?", price)
+        where(Price.table_name => { amount: price.. })
       end
 
       add_search_scope :in_stock do
@@ -137,11 +137,11 @@ module Spree
           joins(:properties).
             join_translation_table(Property).
             join_translation_table(ProductProperty).
-            where("#{ProductProperty.translation_table_alias}.value = ?", value).
+            where(ProductProperty.translation_table_alias => { value: value }).
             where(property_conditions(property))
         else
           joins(:properties).
-            where("#{ProductProperty.table_name}.value = ?", value).
+            where(ProductProperty.table_name => { value: value }).
             where(property_conditions(property))
         end
       end

data/app/models/concerns/spree/translatable_resource.rb

@@ -20,6 +20,10 @@ module Spree
       def translation_table_alias
         "#{self::Translation.table_name}_#{Mobility.normalize_locale(Mobility.locale)}"
       end
+
+      def arel_table_alias
+        Arel::Table.new(translation_table_alias)
+      end
     end
   end
 end

data/app/models/concerns/spree/translatable_resource_scopes.rb

@@ -15,9 +15,23 @@ module Spree
                              end
         translatable_class_foreign_key = "#{translatable_class.table_name.singularize}_id"
 
-        joins("LEFT OUTER JOIN #{translatable_class::Translation.table_name} #{translatable_class.translation_table_alias}
-             ON #{translatable_class.translation_table_alias}.#{translatable_class_foreign_key} = #{join_on_table_name}.id
-             AND #{translatable_class.translation_table_alias}.locale = '#{Mobility.locale}'")
+        joins(
+          Arel::Nodes::OuterJoin.new(
+            Arel::Table.new(translatable_class::Translation.table_name).alias(translatable_class.translation_table_alias),
+            Arel::Nodes::On.new(
+              Arel::Nodes::And.new([
+                Arel::Nodes::Equality.new(
+                  Arel::Table.new(translatable_class.translation_table_alias)[translatable_class_foreign_key],
+                  Arel::Table.new(join_on_table_name)[:id]
+                ),
+                Arel::Nodes::Equality.new(
+                  Arel::Table.new(translatable_class.translation_table_alias)[:locale],
+                  Arel::Nodes::Quoted.new(Mobility.locale.to_s)
+                )
+              ])
+            )
+          )
+        )
       end
     end
   end

data/app/models/concerns/spree/unique_name.rb

@@ -3,6 +3,8 @@ module Spree
     extend ActiveSupport::Concern
 
     included do
+      auto_strip_attributes :name
+
       validates :name, presence: true,
                        uniqueness: { case_sensitive: false, allow_blank: true, scope: spree_base_uniqueness_scope }
     end

data/app/models/concerns/spree/user_management.rb

@@ -0,0 +1,33 @@
+module Spree
+  module UserManagement
+    extend ActiveSupport::Concern
+
+    included do
+      has_many :role_users, class_name: 'Spree::RoleUser', as: :resource, dependent: :destroy
+      has_many :users, through: :role_users, source: :user, source_type: Spree.admin_user_class.to_s
+      has_many :invitations, class_name: 'Spree::Invitation', as: :resource, dependent: :destroy
+    end
+
+    # Adds a user to the resource with the default user role
+    # If no role is provided, the default user role will be used
+    # If a role is provided, it will be used instead of the default user role
+    # @param user [Spree.admin_user_class] The user to add to the resource
+    # @param role [Spree::Role] The role to add the user to
+    def add_user(user, role = nil)
+      role = role || default_user_role
+      role_users.find_or_create_by!(user: user, role: role)
+    end
+
+    # Revokes a user's access to the resource
+    # @param user [Spree.admin_user_class] The user to remove from the resource
+    # @return [void]
+    def remove_user(user)
+      role_users.where(user: user).destroy_all
+    end
+
+    # this can be overridden in the base model to use a different user role, eg. 'vendor'
+    def default_user_role
+      Spree::Role.default_admin_role
+    end
+  end
+end

data/app/models/concerns/spree/user_methods.rb

@@ -84,6 +84,11 @@ module Spree
       end
     end
 
+    # Returns the last incomplete spree order for the current store
+    # @param [Spree::Store] store
+    # @param [Hash] options
+    # @option options [Array<Symbol>] :includes
+    # @return [Spree::Order]
     def last_incomplete_spree_order(store, options = {})
       orders.where(store: store).incomplete.not_canceled.
         includes(options[:includes]).
@@ -91,12 +96,19 @@ module Spree
         first
     end
 
+    # Returns the total available store credit for the current store per currency
+    # @param [Spree::Store] store
+    # @param [String] currency
+    # @return [Float]
     def total_available_store_credit(currency = nil, store = nil)
       store ||= Store.default
       currency ||= store.default_currency
       store_credits.for_store(store).where(currency: currency).reload.to_a.sum(&:amount_remaining)
     end
 
+    # Returns the available store credits for the current store per currency
+    # @param [Spree::Store] store
+    # @return [Array<Spree::Money>]
     def available_store_credits(store)
       store ||= Store.default
 
@@ -105,12 +117,18 @@ module Spree
       end
     end
 
+    # Returns the default wishlist for the current store
+    # if no default wishlist exists, it creates one
+    # @param [Spree::Store] current_store
+    # @return [Spree::Wishlist]
     def default_wishlist_for_store(current_store)
       wishlists.find_by(is_default: true, store_id: current_store.id) || ActiveRecord::Base.connected_to(role: :writing) do
         wishlists.create!(store: current_store, is_default: true, name: Spree.t(:default_wishlist_name))
       end
     end
 
+    # Returns true if the user can be deleted
+    # @return [Boolean]
     def can_be_deleted?
       orders.complete.none?
     end
@@ -140,6 +158,7 @@ module Spree
       use_billing.in?([true, 'true', '1'])
     end
 
+    # Scrambles the email and names of the user
     def scramble_email_and_names
       self.email = "#{SecureRandom.uuid}@example.net"
       self.first_name = 'Deleted'

data/app/models/concerns/spree/user_roles.rb

@@ -5,38 +5,64 @@ module Spree
     included do
       has_many :role_users, class_name: 'Spree::RoleUser', foreign_key: :user_id, as: :user, dependent: :destroy
       has_many :spree_roles, through: :role_users, class_name: 'Spree::Role', source: :role
+      has_many :stores, through: :role_users, source: :resource, source_type: 'Spree::Store'
+      has_many :invitations, class_name: 'Spree::Invitation', foreign_key: :invitee_id, dependent: :destroy
 
-      scope :spree_admin, -> { joins(:spree_roles).where(Spree::Role.table_name => { name: 'admin' }) }
+      scope :spree_admin, -> { joins(:spree_roles).where(Spree::Role.table_name => { name: Spree::Role::ADMIN_ROLE }) }
 
-      # has_spree_role? simply needs to return true or false whether a user has a role or not.
-      def has_spree_role?(role_name)
-        spree_roles.exists?(name: role_name)
-      end
-
-      def self.admin
-        Spree::Deprecation.warn('`User#admin` is deprecated and will be removed in Spree 5. Please use `User#spree_admin`')
+      # Adds a role to a resource
+      #
+      # @param role_name [String] The name of the role to add, eg. 'admin'
+      # @param resource [Spree::Base] The resource to add the role to
+      # @return [Spree::RoleUser] The role user created
+      def add_role(role_name, resource = nil)
+        resource ||= Spree::Store.current
+        role = Spree::Role.find_by(name: role_name)
+        return if role.nil?
 
-        spree_admin
+        role_users.find_or_create_by!(role: role, resource: resource)
       end
 
-      def self.admin_created?
-        Spree::Deprecation.warn('`User#admin_created?` is deprecated and will be removed in Spree 5. Please use `User#spree_admin_created?`')
+      # Removes a role from a resource
+      #
+      # @param role_name [String] The name of the role to remove, eg. 'admin'
+      # @param resource [Spree::Base] The resource to remove the role from
+      def remove_role(role_name, resource = nil)
+        resource ||= Spree::Store.current
+        role = Spree::Role.find_by(name: role_name)
+        return if role.nil?
 
-        spree_admin_created?
+        role_users.where(role: role, resource: resource).destroy_all
       end
 
-      def admin?
-        Spree::Deprecation.warn('`User#admin?` is deprecated and will be removed in Spree 5. Please use `User#spree_admin?`')
+      # has_spree_role? simply needs to return true or false whether a user has a role or not.
+      #
+      # @param role_name [String] The name of the role to check for
+      # @param resource [Spree::Base] The resource to get roles for
+      # @return [Boolean] Whether the user has the role for the resource
+      def has_spree_role?(role_name, resource = nil)
+        resource ||= Spree::Store.current
 
-        spree_admin?
+        role_users.where(resource: resource).joins(:role).where(Spree::Role.table_name => { name: role_name }).exists?
       end
 
       def self.spree_admin_created?
         spree_admin.exists?
       end
 
-      def spree_admin?
-        has_spree_role?('admin')
+      # Returns true if the user has the admin role for a given resource
+      #
+      # @param resource [Spree::Base] The resource to check the admin role for
+      # @return [Boolean] Whether the user has the admin role for the resource
+      def spree_admin?(resource = nil)
+        resource ||= Spree::Store.current
+        has_spree_role?(Spree::Role::ADMIN_ROLE, resource)
+      end
+
+      # Returns the user who invited the current user
+      # @return [Spree.admin_user_class]
+      def invited_by
+        invitations.first&.inviter
       end
     end
   end

data/app/models/spree/ability.rb

@@ -23,15 +23,16 @@ module Spree
       abilities.delete(ability)
     end
 
-    def initialize(user)
+    def initialize(user, options = {})
       alias_cancan_delete_action
 
       user ||= Spree.user_class.new
+      store ||= options[:store] || Spree::Current.store
 
-      if user.persisted? && user.try(:spree_admin?)
-        apply_admin_permissions(user)
+      if user.persisted? && user.is_a?(Spree.admin_user_class) && user.try(:spree_admin?, store)
+        apply_admin_permissions(user, options)
       else
-        apply_user_permissions(user)
+        apply_user_permissions(user, options)
       end
 
       # Include any abilities registered by extensions, etc.
@@ -56,7 +57,7 @@ module Spree
       alias_action :create, :update, :destroy, to: :modify
     end
 
-    def apply_admin_permissions(user)
+    def apply_admin_permissions(_user, _options)
       can :manage, :all
       cannot :cancel, Spree::Order
       can :cancel, Spree::Order, &:allow_cancel?
@@ -64,7 +65,7 @@ module Spree
       cannot [:edit, :update], Spree::ReimbursementType, mutable: false
     end
 
-    def apply_user_permissions(user)
+    def apply_user_permissions(user, _options)
       can :read, ::Spree::Country
       can :read, ::Spree::OptionType
       can :read, ::Spree::OptionValue
@@ -95,6 +96,7 @@ module Spree
       can [:create, :update, :destroy], ::Spree::WishedItem do |wished_item|
         wished_item.wishlist.user == user
       end
+      can :accept, Spree::Invitation, invitee_id: [user.id, nil], invitee_type: user.class.name, status: 'pending'
     end
 
     def protect_admin_role

data/app/models/spree/asset.rb

@@ -17,12 +17,7 @@ module Spree
 
     store_accessor :private_metadata, :session_uploaded_assets_uuid
     scope :with_session_uploaded_assets_uuid, lambda { |uuid|
-      case ActiveRecord::Base.connection.adapter_name
-      when 'PostgreSQL'
-        where("#{table_name}.private_metadata @> ?", { session_uploaded_assets_uuid: uuid }.to_json)
-      when 'Mysql2', 'SQLite'
-        where("JSON_EXTRACT(private_metadata, '$.session_uploaded_assets_uuid') = '#{uuid}'")
-      end
+      where(session_id: uuid)
     }
 
     def product

data/app/models/spree/base.rb

@@ -2,6 +2,7 @@ class Spree::Base < ApplicationRecord
   include Spree::Preferences::Preferable
   include Spree::RansackableAttributes
   include Spree::TranslatableResourceScopes
+  include Spree::IntegrationsConcern
 
   after_initialize do
     if has_attribute?(:preferences) && !preferences.nil?

data/app/models/spree/base_analytics_event_handler.rb

@@ -5,13 +5,16 @@ module Spree
     # @param opts [Hash] The options
     # @option opts [User] :user
     # @option opts [String] :session_id
+    # @option opts [Spree::Store] :store
     def initialize(opts = {})
       @user = opts[:user]
       @session = opts[:session]
       @request = opts[:request]
+      @store = opts[:store]
+      @visitor_id = opts[:visitor_id]
     end
 
-    attr_reader :user, :session, :request
+    attr_reader :user, :session, :request, :store, :visitor_id
 
     # Returns the client
     # @return [Object] The client object
@@ -42,7 +45,9 @@ module Spree
     def identity_hash
       {
         user_id: user&.id,
-        session_id: session&.id
+        # session.id is a custom class (not a string), which has overridden the `to_json` method, we have to convert it to a string first so it does not send garbage to the analytics service
+        session_id: session&.id&.to_s,
+        visitor_id: visitor_id
       }
     end
   end

data/app/models/spree/classification.rb

@@ -23,5 +23,18 @@ module Spree
         group("#{Spree::Classification.table_name}.id").
         reorder(completed_orders_count: order_direction, completed_orders_total: order_direction)
     }
+
+    scope :grouped_taxon_ids_for_products, lambda { |product_ids, taxon_groups|
+      where(product_id: product_ids, taxon_id: taxon_groups).
+        group(:product_id).
+        then do |query|
+        case ActiveRecord::Base.connection.adapter_name
+        when 'PostgreSQL'
+          query.pluck(:product_id, Arel.sql("STRING_AGG(taxon_id::text, ',')"))
+        when 'Mysql2', 'SQLite'
+          query.pluck(:product_id, Arel.sql('GROUP_CONCAT(taxon_id)'))
+        end
+      end
+    }
   end
 end

data/app/models/spree/custom_domain.rb

@@ -14,7 +14,7 @@ module Spree
     # Validations
     #
     validates :url, presence: true, uniqueness: true, format: {
-      with: %r{[a-z][a-z0-9-]*[a-z0-9]}i
+      with: %r{\A(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\z}i
     }, length: { in: 1..63 }
     validate :url_is_valid
 
@@ -26,6 +26,7 @@ module Spree
     after_validation :ensure_default, on: :create
 
     def url_is_valid
+      return if url.blank?
       parts = url.split('.')
 
       errors.add(:url, 'use domain or subdomain') if (parts[0] != 'www' && parts.size > 3) || (parts[0] == 'www' && parts.size > 4) || parts.size < 2

data/app/models/spree/export.rb

@@ -124,7 +124,7 @@ module Spree
     end
 
     def current_ability
-      @current_ability ||= Spree::Dependencies.ability_class.constantize.new(user)
+      @current_ability ||= Spree::Dependencies.ability_class.constantize.new(user, { store: store })
     end
 
     # eg. Spree::Exports::Products => products-store-my-store-code-20241030133348.csv

data/app/models/spree/integration.rb

@@ -0,0 +1,63 @@
+module Spree
+  class Integration < Spree.base_class
+    include Spree::SingleStoreResource
+
+    #
+    # Associations
+    #
+    belongs_to :store, class_name: 'Spree::Store', touch: true
+
+    #
+    # Validations
+    #
+    validates :type, presence: true
+    validates :store, presence: true, uniqueness: { scope: :type }
+
+    #
+    # Scopes
+    #
+    scope :active, -> { where(active: true) }
+
+    # This attribute is used to temporarily store connection-related error messages
+    # that can be displayed to users when testing or validating integration connections.
+    # It is not persisted to the database and is reset on each new connection attempt.
+    # @param message [String, nil] The error message to be stored
+    # @return [String, nil] The current error message
+    attr_accessor :connection_error_message
+
+    # Associates the integration to a group.
+    # The name here will be used as Spree.t key to display the group name.
+    # Leave blank to leave the integration ungrouped.
+    def self.integration_group
+      nil
+    end
+
+    def self.icon_path
+      nil
+    end
+
+    def self.integration_name
+      name.demodulize.titleize.strip
+    end
+
+    def self.integration_key
+      name.demodulize.underscore
+    end
+
+    def name
+      self.class.integration_name
+    end
+
+    def key
+      self.class.integration_key
+    end
+
+    # Checks if the integration can establish a connection.
+    # This is a base implementation that always returns true.
+    # Subclasses should override this method to implement their own connection validation logic.
+    # @return [Boolean] true if the integration can connect, false otherwise
+    def can_connect?
+      true
+    end
+  end
+end