spree_core 5.5.3 → 5.6.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2edebb88f8cab59b634a4bbbae5a24b15feab2d7673ecd521d70a1265b4e7bd0
-  data.tar.gz: 1fa56dfbe5ebd747212b1608490c5414246cfad12e721f49d040c97f8299ef33
+  metadata.gz: c8058b9d81b22cf12abe2193023f52faa57b5d757b99e0359e4592415b00a434
+  data.tar.gz: 13d6653cb85ab1364290621d668ed291aecbff9442ce205803595fe316ed4ea7
 SHA512:
-  metadata.gz: 20f0b006c40c37d8e8cbf25d97b99a73e9f3ce72d6a4903f6238aec8cad435f45c1f6517cfb54356732f7c0f69910e1013f45b7a344bc29506c888521661f46a
-  data.tar.gz: c72003a7f9002a1443ef60fa19f70fe6aa4e4acf9f466012101889bd964c7aaf806d9f136fe158453c751d4f11dee74f4c42b9c9e1d39ec82b3994a5293337ee
+  metadata.gz: ecbab7dc49344e7c228237344ff01b7addacb6309e0e70cc6a42510823265cfd97827c2a00fb9c990a90b6ace535529b2d60e11c0b45bce745d3185a8422851a
+  data.tar.gz: a2657923c327254ee18b0b222aff4b6b7c3075b26d4c9ff001f66d3b2ad5b35f7daf6d36b5d16161cfaf62613707722ae8dcf55549c2a5c811c3333638240bab

data/app/helpers/spree/base_helper.rb

@@ -8,7 +8,7 @@ module Spree
       countries = current_store.countries_available_for_checkout
 
       countries.collect do |country|
-        country.name = Spree.t(country.iso, scope: 'country_names', default: country.name)
+        country.name = localized_country_name(country)
         country
       end.sort_by { |c| c.name.parameterize }
     end
@@ -17,7 +17,7 @@ module Spree
       countries = Spree::Country.all
 
       countries.collect do |country|
-        country.name = Spree.t(country.iso, scope: 'country_names', default: country.name)
+        country.name = localized_country_name(country)
         country
       end.sort_by { |c| c.name.parameterize }
     end
@@ -112,6 +112,16 @@ module Spree
       inline_svg "payment_icons/#{payment_method}.svg", opts
     end
 
+    # @param country [Spree::Country]
+    # @return [String]
+    def localized_country_name(country)
+      Spree.t(
+        country.iso,
+        scope: 'country_names',
+        default: country.localized_name
+      )
+    end
+
     private
 
     I18N_PLURAL_MANY_COUNT = 2.1

data/app/helpers/spree/currency_helper.rb

@@ -36,10 +36,7 @@ module Spree
     # @param currency [String] the currency ISO code
     # @return [Array] the currency presentation and ISO code
     def currency_presentation(currency)
-      currency_money = currency_money(currency)
-      label = "#{currency_money.name} (#{currency_money.iso_code})"
-
-      [label, currency]
+      [Spree::Currency.new(code: currency).label, currency]
     end
 
     def currency_money(currency = current_currency)

data/app/helpers/spree/locale_helper.rb

@@ -4,10 +4,27 @@ module Spree
       supported_locales_for_all_stores.map { |locale| locale_presentation(locale) }
     end
 
+    # Locales the admin UI is translated into, as [name, code] pairs for a
+    # select. Self-contained (reads Spree.available_locales directly) so it
+    # works outside the storefront/admin controller stack — e.g. the pre-auth
+    # login screen, which has no current store.
+    def admin_locales_options
+      Spree.available_locales.map { |locale| locale_presentation(locale) }
+    end
+
     def available_locales_options
       available_locales.map { |locale| locale_presentation(locale) }
     end
 
+    # Locales a merchant may translate **content** into, as [name, code] pairs
+    # for a select. Backed by `Spree::Locales::ALL` (the canonical translation
+    # locale set) rather than the installed UI-translation bundles, so a
+    # market/store can adopt any supported locale instead of only ones already
+    # in use.
+    def translation_locales_options
+      Spree::Locales::ALL.map { |locale| locale_presentation(locale) }
+    end
+
     def supported_locales_options
       return if current_store.nil?
 
@@ -15,19 +32,7 @@ module Spree
     end
 
     def locale_presentation(locale)
-      if I18n.exists?('spree.i18n.this_file_language', locale: locale, fallback: false)
-        [locale_full_name(locale), locale.to_s]
-      elsif defined?(SpreeI18n::Locale) && (language_name = SpreeI18n::Locale.local_language_name(locale))
-        ["#{language_name} (#{locale})", locale.to_s]
-      elsif locale.to_s == 'en'
-        ['English (US)', 'en']
-      else
-        [locale, locale.to_s]
-      end
-    end
-
-    def locale_full_name(locale)
-      Spree.t('i18n.this_file_language', locale: locale)
+      [Spree::Locale.new(code: locale).label, locale.to_s]
     end
 
     def should_render_locale_dropdown?

data/app/helpers/spree/localized_names_helper.rb

@@ -0,0 +1,25 @@
+module Spree
+  module LocalizedNamesHelper
+    # @param code [String, Symbol]
+    # @return [String]
+    def locale_display_label(code)
+      return if code.blank?
+
+      content_tag(
+        :span,
+        Spree::Locale.new(code: code).label,
+        data: {
+          controller: 'display-name',
+          display_name_type_value: 'language',
+          display_name_code_value: code
+        }
+      )
+    end
+
+    # @param countries [Enumerable<Spree::Country>]
+    # @return [Array<Array>]
+    def country_select_options(countries)
+      countries.map { |country| [country.option_label, country.id] }
+    end
+  end
+end

data/app/mailers/spree/admin_user_mailer.rb

@@ -0,0 +1,71 @@
+module Spree
+  # Auth emails for admin users. Reached two ways: the legacy Rails admin's
+  # Devise flow (via Spree::AdminUserMethods::DeviseNotifications) and the Admin
+  # API's `admin_user.password_reset_requested` event (dashboard SPA).
+  class AdminUserMailer < BaseMailer
+    def password_reset_email(admin_user, token, store, redirect_url: nil)
+      @user = admin_user
+      @current_store = store
+      @reset_url = password_reset_url(token, store, redirect_url)
+
+      with_store_locale(store, preferred_locale(admin_user, store)) do
+        mail(
+          to: admin_user.email,
+          subject: "#{store.name} #{Spree.t('admin_user_mailer.password_reset_email.subject')}",
+          store_url: store.formatted_url
+        )
+      end
+    end
+
+    def confirmation_email(admin_user, token, store)
+      @user = admin_user
+      @current_store = store
+      @confirmation_url = confirmation_url(token, store)
+
+      with_store_locale(store, preferred_locale(admin_user, store)) do
+        mail(
+          to: admin_user.email,
+          subject: "#{store.name} #{Spree.t('admin_user_mailer.confirmation_email.subject')}",
+          store_url: store.formatted_url
+        )
+      end
+    end
+
+    private
+
+    # Locale chain for admin auth emails:
+    # the admin's own dashboard language (persisted by the profile/language
+    # switcher via `PATCH /api/v3/admin/me`) → the store's configured admin
+    # locale → nil, which lets with_store_locale fall back to the store's
+    # default (storefront) locale. Blank or unavailable values fall through.
+    def preferred_locale(admin_user, store)
+      [admin_user.try(:selected_locale), store&.preferred_admin_locale]
+        .find { |locale| available_locale?(locale) }
+    end
+
+    def available_locale?(locale)
+      locale.present? && I18n.available_locales.map(&:to_s).include?(locale.to_s)
+    end
+
+    # The dashboard SPA passes a validated redirect URL (token appended as a
+    # query param); the legacy Devise flow links to its own edit-password route
+    # when the host app installed it.
+    def password_reset_url(token, store, redirect_url)
+      return append_token(redirect_url, token) if redirect_url.present?
+
+      if spree.respond_to?(:edit_admin_user_password_url)
+        spree.edit_admin_user_password_url(reset_password_token: token, host: store.formatted_url)
+      else
+        append_token(store.formatted_url, token)
+      end
+    end
+
+    def confirmation_url(token, store)
+      if spree.respond_to?(:admin_user_confirmation_url)
+        spree.admin_user_confirmation_url(confirmation_token: token, host: store.formatted_url)
+      else
+        append_token(store.formatted_url, token)
+      end
+    end
+  end
+end

data/app/mailers/spree/base_mailer.rb

@@ -2,18 +2,46 @@ module Spree
   class BaseMailer < ActionMailer::Base
     helper Spree::ImagesHelper
 
+    default from: -> { from_address }, reply_to: -> { reply_to_address }
+
     def current_store
       @current_store ||= @order&.store.presence || Spree::Store.current || Spree::Store.default
     end
 
     helper_method :current_store
 
+    # Render an email in the given locale, with the store's translation fallbacks
+    # active, and restore both afterwards. Controllers set these fallbacks per
+    # request via `set_fallback_locale`, but mailers run in background jobs where
+    # that never happens — so without this, translatable attributes (store name,
+    # product names, taxon names, …) return nil under a non-default locale and
+    # leave e.g. the footer blank. Setting the fallbacks here mirrors a request,
+    # so reads fall back to the store's default-locale value.
+    #
+    # @param store [Spree::Store]
+    # @param locale [String, Symbol, nil] defaults to the store's default locale
+    def with_store_locale(store, locale = nil, &block)
+      locale = locale.presence || store&.default_locale
+      return yield if locale.blank?
+
+      previous_fallbacks = Mobility.store_based_fallbacks
+      previously_active = @_store_locale_active
+      @_store_locale_active = true
+      begin
+        Spree::Locales::SetFallbackLocaleForStore.new.call(store: store) if store
+        I18n.with_locale(locale, &block)
+      ensure
+        @_store_locale_active = previously_active
+        Mobility.store_based_fallbacks = previous_fallbacks
+      end
+    end
+
     def from_address
       current_store.mail_from_address
     end
 
     def reply_to_address
-      current_store.mail_from_address
+      current_store.customer_support_email.presence || current_store.mail_from_address
     end
 
     def money(amount, currency = nil)
@@ -29,8 +57,50 @@ module Spree
 
     def mail(headers = {}, &block)
       ensure_default_action_mailer_url_host(headers[:store_url])
-      set_email_locale
-      super if Spree::Config[:send_core_emails]
+      return unless Spree::Config[:send_core_emails]
+
+      if @_store_locale_active
+        super
+      else
+        # Subclasses that call `mail` without wrapping their action in
+        # `with_store_locale` (e.g. Devise mailers, extensions) still get the
+        # store default locale, as `mail` applied before Spree 5.6.
+        with_store_locale(current_store) { super }
+      end
+    end
+
+    # @deprecated Each mailer action now wraps its body in {#with_store_locale},
+    #   which also activates the store's translation fallbacks and restores the
+    #   previous locale afterwards. This method mutates `I18n.locale` for the rest
+    #   of the thread without restoring it. Will be removed in Spree 6.0.
+    def set_email_locale
+      Spree::Deprecation.warn(
+        'Spree::BaseMailer#set_email_locale is deprecated and will be removed in Spree 6.0. ' \
+        'Wrap the mailer action body in `with_store_locale(store, locale) { ... }` instead.'
+      )
+      locale = @order&.locale.presence || @order&.store&.default_locale || current_store&.default_locale
+      I18n.locale = locale if locale.present?
+    end
+
+    protected
+
+    # The "<store> <subject> #<number>" subject line shared by customer-facing
+    # order emails, with the optional [RESEND] prefix.
+    def order_email_subject(store, subject, number, resend: false)
+      "#{resend ? "[#{Spree.t(:resend).upcase}] " : ''}#{store.name} #{subject} ##{number}"
+    end
+
+    # URI-based merge preserves existing query params and fragments so the token
+    # doesn't get swallowed by a `#section` or clobber an existing `?source=`.
+    def append_token(url, token)
+      uri = URI.parse(url.to_s)
+      params = URI.decode_www_form(uri.query || '')
+      params << ['token', token.to_s]
+      uri.query = URI.encode_www_form(params)
+      uri.to_s
+    rescue URI::InvalidURIError
+      separator = url.include?('?') ? '&' : '?'
+      "#{url}#{separator}token=#{CGI.escape(token.to_s)}"
     end
 
     private
@@ -46,13 +116,5 @@ module Spree
       ActionMailer::Base.default_url_options ||= {}
       ActionMailer::Base.default_url_options[:host] = host_url
     end
-
-    # Sets the I18n locale for the email.
-    # Prefers the order's locale (the language the customer used),
-    # falls back to the store's default locale.
-    def set_email_locale
-      locale = @order&.locale.presence || @order&.store&.default_locale || current_store&.default_locale
-      I18n.locale = locale if locale.present?
-    end
   end
 end

data/app/mailers/spree/export_mailer.rb

@@ -3,13 +3,13 @@ module Spree
     def export_done(export)
       @export = export
 
-      mail(
-        to: @export.user.email,
-        subject: Spree.t('export_mailer.export_done.subject', export_number: @export.number).to_s,
-        from: from_address,
-        reply_to: reply_to_address,
-        store_url: current_store.url
-      )
+      with_store_locale(@export.store) do
+        mail(
+          to: @export.user.email,
+          subject: Spree.t('export_mailer.export_done.subject', export_number: @export.number).to_s,
+          store_url: current_store.url
+        )
+      end
     end
 
     def current_store

data/app/mailers/spree/import_mailer.rb

@@ -0,0 +1,19 @@
+module Spree
+  class ImportMailer < Spree::BaseMailer
+    def import_done(import)
+      @import = import
+
+      with_store_locale(@import.store) do
+        mail(
+          to: @import.user.email,
+          subject: Spree.t('import_mailer.import_done.subject', import_number: @import.number).to_s,
+          store_url: current_store.url
+        )
+      end
+    end
+
+    def current_store
+      @current_store ||= @import.store
+    end
+  end
+end

data/app/mailers/spree/invitation_mailer.rb

@@ -3,22 +3,27 @@ module Spree
     # invitation email, sending email to the invited to let them know they have been invited to join a store/account/vendor
     def invitation_email(invitation)
       @invitation = invitation
-      mail(to: invitation.email,
-           from: from_address,
-           reply_to: reply_to_address,
-           subject: Spree.t('invitation_mailer.invitation_email.subject',
-                            resource_name: invitation.resource&.name))
+      # The shared header/footer and from/reply-to addresses read
+      # current_store — without this, background delivery falls back to the
+      # default store's branding on multi-store installs.
+      @current_store = invitation.store
+      with_store_locale(invitation.store) do
+        mail(to: invitation.email,
+             subject: Spree.t('invitation_mailer.invitation_email.subject',
+                              resource_name: invitation.resource&.name))
+      end
     end
 
     # sending email to the inviter to let them know the invitee has accepted the invitation
     def invitation_accepted(invitation)
       @invitation = invitation
-      mail(to: invitation.inviter.email,
-           from: from_address,
-           reply_to: reply_to_address,
-           subject: Spree.t('invitation_mailer.invitation_accepted.subject',
-                            invitee_name: invitation.invitee&.name,
-                            resource_name: invitation.resource&.name))
+      @current_store = invitation.store
+      with_store_locale(invitation.store) do
+        mail(to: invitation.inviter.email,
+             subject: Spree.t('invitation_mailer.invitation_accepted.subject',
+                              invitee_name: invitation.invitee&.name,
+                              resource_name: invitation.resource&.name))
+      end
     end
   end
 end

data/app/mailers/spree/report_mailer.rb

@@ -3,12 +3,12 @@ module Spree
     def report_done(report)
       @report = report
 
-      mail(
-        to: @report.user.email,
-        subject: Spree.t('report_mailer.report_done.subject', report_name: @report.human_name).to_s,
-        from: from_address,
-        reply_to: reply_to_address
-      )
+      with_store_locale(@report.store) do
+        mail(
+          to: @report.user.email,
+          subject: Spree.t('report_mailer.report_done.subject', report_name: @report.human_name).to_s
+        )
+      end
     end
 
     private

data/app/mailers/spree/webhook_mailer.rb

@@ -6,12 +6,13 @@ module Spree
       @endpoint = webhook_endpoint
       @current_store = webhook_endpoint.store
 
-      mail(
-        to: @current_store.new_order_notifications_email.presence || @current_store.mail_from_address,
-        from: from_address,
-        subject: Spree.t('webhook_mailer.endpoint_disabled.subject', endpoint_name: @endpoint.name || @endpoint.url),
-        store_url: @current_store.formatted_url
-      )
+      with_store_locale(webhook_endpoint.store) do
+        mail(
+          to: @current_store.new_order_notifications_email.presence || @current_store.mail_from_address,
+          subject: Spree.t('webhook_mailer.endpoint_disabled.subject', endpoint_name: @endpoint.name || @endpoint.url),
+          store_url: @current_store.formatted_url
+        )
+      end
     end
   end
 end

data/app/models/concerns/spree/admin_user_methods.rb

@@ -7,12 +7,34 @@ module Spree
     include Spree::RansackableAttributes
 
     included do
+      # Wins over Devise's implementation regardless of module include order, so
+      # host apps that add `devise ...` after this concern still send admin auth
+      # emails through Spree's mailer.
+      prepend Spree::AdminUserMethods::DeviseNotifications
+
       has_prefix_id :admin
 
       has_person_name
 
       normalizes :email, :first_name, :last_name, with: ->(value) { value&.to_s&.squish&.presence }
 
+      # Token auto-invalidates when password changes (salt changes)
+      # Expiration is configurable via Spree::Config.admin_password_reset_expires_in (in minutes)
+      generates_token_for :password_reset, expires_in: Spree::Config.admin_password_reset_expires_in.minutes do
+        # `try` rather than `&.`: models without a password_salt method or
+        # column at all (modern Devise) must fall through to encrypted_password
+        # — a bare call would raise NameError before the fallback.
+        try(:password_salt)&.last(10) || encrypted_password&.last(10)
+      end
+
+      def self.find_by_password_reset_token(token)
+        find_by_token_for(:password_reset, token)
+      end
+
+      def self.find_by_password_reset_token!(token)
+        find_by_token_for!(:password_reset, token)
+      end
+
       # Associations
       has_many :identities, class_name: 'Spree::UserIdentity', as: :user, dependent: :destroy
       has_many :canceled_orders, class_name: 'Spree::Order', foreign_key: :canceler_id
@@ -33,6 +55,8 @@ module Spree
       # Attachments
       has_one_attached :avatar, service: Spree.public_storage_service_name
 
+      validates :avatar, content_type: Rails.application.config.active_storage.web_image_content_types
+
       #
       # Attributes
       #
@@ -78,5 +102,25 @@ module Spree
       reports.destroy_all
       exports.destroy_all
     end
+
+    # Routes Devise's auth notifications through Spree's own mailer so admin
+    # password reset and account confirmation emails carry the store design and
+    # locale instead of Devise's built-in templates. Other notification kinds
+    # (e.g. unlock instructions) fall through to Devise.
+    module DeviseNotifications
+      def send_devise_notification(notification, *args)
+        token = args.first
+        store = Spree::Current.store || Spree::Store.default
+
+        case notification
+        when :reset_password_instructions
+          Spree::AdminUserMailer.password_reset_email(self, token, store).deliver_later
+        when :confirmation_instructions
+          Spree::AdminUserMailer.confirmation_email(self, token, store).deliver_later
+        else
+          super
+        end
+      end
+    end
   end
 end

data/app/models/concerns/spree/legacy_multi_store_support.rb

@@ -0,0 +1,48 @@
+module Spree
+  # Backwards-compatible shim for resources migrated from a many-to-many store
+  # relationship to a single-store +belongs_to :store+ FK (Spree::Product in 5.5,
+  # Spree::Promotion and Spree::PaymentMethod in 5.6). Maps the historic
+  # +stores+/+store_ids+ accessors onto the singular +store+/+store_id+, warning
+  # on use. The +spree_multi_store+ extension defines +SpreeMultiStore+ to
+  # suppress the include and restore the real +has_many :stores+ association.
+  module LegacyMultiStoreSupport
+    extend ActiveSupport::Concern
+
+    included do
+      # Legacy accessors for the many-to-many store relationship. These are deprecated
+      # and will be removed in Spree 6.0 once the models finish migrating to single-store ownership.
+      # @return [ActiveRecord::Relation<Spree::Store>] the single store wrapped in a relation, or an empty relation if no store is set
+      def stores
+        Spree::Deprecation.warn(
+          "#{self.class.base_class}#stores is deprecated. Please use #{self.class.base_class}#store instead. " \
+          'If you want to continue using multiple stores please install spree_multi_store gem'
+        )
+        store ? Spree::Store.where(id: store.id) : Spree::Store.none
+      end
+
+      def store_ids
+        Spree::Deprecation.warn(
+          "#{self.class.base_class}#store_ids is deprecated. Please use #{self.class.base_class}#store_id instead. " \
+          'If you want to continue using multiple stores please install spree_multi_store gem'
+        )
+        store_id ? [store_id] : []
+      end
+
+      def stores=(stores)
+        Spree::Deprecation.warn(
+          "#{self.class.base_class}#stores= is deprecated. Please use #{self.class.base_class}#store= instead. " \
+          'If you want to continue using multiple stores please install spree_multi_store gem'
+        )
+        self.store = Array(stores).compact.first
+      end
+
+      def store_ids=(store_ids)
+        Spree::Deprecation.warn(
+          "#{self.class.base_class}#store_ids= is deprecated. Please use #{self.class.base_class}#store_id= instead. " \
+          'If you want to continue using multiple stores please install spree_multi_store gem'
+        )
+        self.store_id = Array(store_ids).compact_blank.first
+      end
+    end
+  end
+end

data/app/models/concerns/spree/presentation_translatable.rb

@@ -0,0 +1,39 @@
+module Spree
+  # Shared by models whose single translatable field is the legacy
+  # +presentation+ column exposed publicly as +label+ (OptionType, OptionValue).
+  # Carries the Mobility setup, the translation-table normalizer, the
+  # locale-aware +label+/+label=+ bridge, and the +label → presentation+
+  # translation-matrix alias in one place so the two models don't restate it.
+  module PresentationTranslatable
+    extend ActiveSupport::Concern
+    include Spree::TranslatableResource
+
+    TRANSLATABLE_FIELDS = %i[presentation].freeze
+
+    included do
+      translates(*TRANSLATABLE_FIELDS, column_fallback: Spree.mobility_column_fallback)
+
+      self::Translation.class_eval do
+        normalizes :presentation, with: ->(value) { value&.to_s&.squish&.presence }
+      end
+    end
+
+    class_methods do
+      # The translation matrix uses +label+ (the public API name) for read/write
+      # symmetry; the +label+/+label=+ bridge below routes it to +presentation+.
+      def translatable_field_aliases
+        { label: :presentation }
+      end
+    end
+
+    # alias_attribute bypasses Mobility's locale-aware reader/writer, so these
+    # explicit delegations are required to keep +label+ translation-aware.
+    def label(*args, **kwargs)
+      presentation(*args, **kwargs)
+    end
+
+    def label=(value)
+      self.presentation = value
+    end
+  end
+end

data/app/models/concerns/spree/product_scopes.rb

@@ -308,7 +308,11 @@ module Spree
       #   +.available+ without args returned future-dated products too.
       # @param currency [String, nil] currency to require a price in; nil
       #   falls back to the default store's default currency.
-      def self.available(available_on = nil, currency = nil)
+      # @param include_preorderable [Boolean] when true (storefront), products
+      #   scheduled to publish later are still included if they have an active
+      #   pre-order variant, so a "coming soon" launch can be pre-ordered before
+      #   its publish date. Channel context only.
+      def self.available(available_on = nil, currency = nil, include_preorderable: false)
         cutoff = available_on
         cutoff = cutoff.beginning_of_minute if cutoff.respond_to?(:beginning_of_minute)
 
@@ -316,8 +320,22 @@ module Spree
 
         if cutoff
           scope = if (channel = Spree::Current.channel)
-                    scope.for_channel(channel)
-                         .where(Spree::ProductPublication.table_name => { published_at: [nil, ..cutoff] })
+                    pub = Spree::ProductPublication.table_name
+                    channel_scope = scope.for_channel(channel)
+                    if include_preorderable
+                      variants = Spree::Variant.quoted_table_name
+                      products = Product.quoted_table_name
+                      channel_scope.where(
+                        "#{pub}.published_at IS NULL OR #{pub}.published_at <= :cutoff OR " \
+                        "EXISTS (SELECT 1 FROM #{variants} WHERE #{variants}.product_id = #{products}.id " \
+                        "AND #{variants}.deleted_at IS NULL AND #{variants}.preorderable = :preorderable " \
+                        "AND (#{variants}.discontinue_on IS NULL OR #{variants}.discontinue_on > :cutoff) " \
+                        "AND (#{variants}.preorder_ships_at IS NULL OR #{variants}.preorder_ships_at > :cutoff))",
+                        cutoff: cutoff, preorderable: true
+                      )
+                    else
+                      channel_scope.where(pub => { published_at: [nil, ..cutoff] })
+                    end
                   else
                     scope.where(Product.table_name => { available_on: ..cutoff })
                   end

data/app/models/concerns/spree/single_store_resource.rb

@@ -3,6 +3,7 @@ module Spree
     extend ActiveSupport::Concern
 
     included do
+      before_validation :ensure_store, unless: :store_id?
       validate :ensure_store_association_is_not_changed
 
       scope :for_store, ->(store) { where(store_id: store.id) }
@@ -10,6 +11,10 @@ module Spree
 
     protected
 
+    def ensure_store
+      self.store ||= Spree::Current.store
+    end
+
     def ensure_store_association_is_not_changed
       if store_id_changed? && persisted?
         errors.add(:store, Spree.t('errors.messages.store_association_can_not_be_changed'))