spree_core 5.6.0.rc3 → 5.6.0.rc4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 45a9c3a76133036f89b3eabe73c9e53cd57dfd6417ee32211f88335424b9da94
-  data.tar.gz: f409d6453ba2a5a6fa9f66c3b26ffa8686c05723bcae99110cb7eede6d3fedb1
+  metadata.gz: 81bf3080a8d43c9bc6a6d76561c9fae751c9282a1e8b30dfb388ca6abe2511d7
+  data.tar.gz: 423cf415d52c180297db3e26b581ea4078cfcf0e7816fc3084d12034b3d74a87
 SHA512:
-  metadata.gz: 596464be183b137236eb76e984a2b8d84091ea95e22a553d7ffb3ab0a5bc3055d380d1283946517ad20e3a8bbd3617d9a246ebbe2157923943e64b054a014aaa
-  data.tar.gz: 58e3bb7aed929b0d17ac96510dee26475cdcfc645b49e491fa38625c958d5228ef81e5f9d703488dbe576167e2ef8c2078d993cce6a37feaad714f62c0b6b8c6
+  metadata.gz: 351598372ce3b7d938815929ac76d050a45679aad1a4734c07a5642f932b81e0e688e0903538e2446c30516545083d2c6d52963b82598650d6e998606aeb8341
+  data.tar.gz: 258324d4c6e23afbe5702782daf6e19811af60136b4f93bbd99d27824830ee7211426fde12f1330175132b4c82c281cfc6295ca0d7cd6f2cc400cce5e3f7e729

data/app/models/concerns/spree/webhook_payload_redaction.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module Spree
+  # Keeps single-use credentials out of the persisted webhook delivery log.
+  #
+  # Some events must carry a live credential to their subscriber — a storefront
+  # that owns its transactional emails needs the real password reset token to
+  # build the email. Delivering it over TLS to a merchant-configured endpoint is
+  # intended; keeping a readable copy in `spree_webhook_deliveries.payload` is
+  # not, because that column is queryable and is served back through the Admin
+  # API delivery log.
+  #
+  # Sensitive values are therefore replaced with {REDACTION_PLACEHOLDER} before
+  # the record is written, and re-attached in memory at send time so the
+  # outgoing request body is unchanged.
+  module WebhookPayloadRedaction
+    extend ActiveSupport::Concern
+
+    # Payload keys under `data` whose values are live credentials.
+    SENSITIVE_PAYLOAD_KEYS = %w[reset_token unsubscribe_token].freeze
+
+    REDACTION_PLACEHOLDER = '[REDACTED]'
+
+    # Splits a payload into the version safe to persist and the secrets held
+    # back from it.
+    #
+    # @param payload [Hash] the full event payload
+    # @return [Array(Hash, Hash)] redacted payload, and the extracted secrets
+    #   keyed as they appeared under `data`
+    def self.split(payload)
+      secrets = {}
+
+      redacted = transform_data_hashes(payload) do |data|
+        data.to_h do |key, value|
+          if SENSITIVE_PAYLOAD_KEYS.include?(key.to_s) && value.present?
+            secrets[secret_key_for(key)] = value
+            [key, REDACTION_PLACEHOLDER]
+          else
+            [key, value]
+          end
+        end
+      end
+
+      secrets.empty? ? [payload, {}] : [redacted, secrets]
+    end
+
+    # Re-attaches previously extracted secrets to a redacted payload.
+    #
+    # @param payload [Hash] the redacted payload
+    # @param secrets [Hash] secrets returned by {split}
+    # @return [Hash] the payload as it should go over the wire
+    def self.merge(payload, secrets)
+      return payload if secrets.blank?
+
+      transform_data_hashes(payload) do |data|
+        data.to_h do |key, value|
+          secret = secrets[secret_key_for(key)]
+          [key, secret.presence || value]
+        end
+      end
+    end
+
+    # Applies +block+ to every `data` hash on the payload.
+    #
+    # Both key forms are visited rather than only the first match: a payload
+    # carrying `:data` *and* `'data'` would otherwise leave one of them
+    # unredacted.
+    def self.transform_data_hashes(payload)
+      return payload unless payload.is_a?(Hash)
+
+      [:data, 'data'].reduce(payload) do |result, data_key|
+        data = result[data_key]
+        next result unless data.is_a?(Hash)
+
+        result.merge(data_key => yield(data))
+      end
+    end
+    private_class_method :transform_data_hashes
+
+    # Secrets are keyed by name alone. They cross an ActiveJob serialization
+    # boundary, which coerces symbol keys to strings, so the key form at split
+    # time cannot be relied on to still match at merge time.
+    def self.secret_key_for(key)
+      key.to_s
+    end
+    private_class_method :secret_key_for
+  end
+end

data/app/models/spree/api_key.rb

@@ -46,6 +46,11 @@ module Spree
     end
 
     belongs_to :store, class_name: 'Spree::Store'
+    # Optional single-channel binding for publishable keys. A bound key
+    # server-assigns the request's channel (see Api::V3::ChannelResolution),
+    # making channel identity unforgeable instead of client-asserted via the
+    # X-Spree-Channel header. See docs/plans/5.6-store-channel-context-and-key-binding.md.
+    belongs_to :channel, class_name: 'Spree::Channel', optional: true
     belongs_to :created_by, polymorphic: true, optional: true
     belongs_to :revoked_by, polymorphic: true, optional: true
 
@@ -64,6 +69,11 @@ module Spree
     # guard is at the model so every entry point (API, legacy admin, rake tasks)
     # is covered uniformly.
     validate :scopes_immutable, if: -> { secret? && persisted? && scopes_changed? }
+    validate :channel_binding_valid, if: -> { channel_id.present? }
+    # Like scopes, the binding is fixed for the life of the key — rebinding a
+    # live credential to a different channel would silently repoint every
+    # client holding it; mint a new key instead.
+    validate :channel_immutable, if: -> { persisted? && channel_id_changed? }
 
     before_validation :generate_token, on: :create
 
@@ -156,6 +166,18 @@ module Spree
       errors.add(:scopes, Spree.t(:api_key_scopes_immutable))
     end
 
+    def channel_binding_valid
+      if secret?
+        errors.add(:channel, Spree.t(:api_key_channel_publishable_only))
+      elsif channel && channel.store_id != store_id
+        errors.add(:channel, Spree.t(:api_key_channel_must_belong_to_store))
+      end
+    end
+
+    def channel_immutable
+      errors.add(:channel, Spree.t(:api_key_channel_immutable))
+    end
+
     # Generates the token on creation. For publishable keys, stores the raw token
     # in the +token+ column. For secret keys, computes an HMAC-SHA256 digest stored
     # in +token_digest+, saves the first 12 characters as +token_prefix+ for display,

data/app/models/spree/channel.rb

@@ -22,6 +22,7 @@ module Spree
     has_many :order_routing_rules, class_name: 'Spree::OrderRoutingRule', dependent: :destroy
     has_many :publications, class_name: 'Spree::ProductPublication', dependent: :destroy
     has_many :products, through: :publications, class_name: 'Spree::Product'
+    has_many :api_keys, class_name: 'Spree::ApiKey', dependent: :nullify
 
     attribute :active, :boolean, default: true
 
@@ -40,6 +41,10 @@ module Spree
     # arrives at a single default without relying on DB constraints.
     before_save :demote_other_defaults, if: -> { default? && will_save_change_to_default? }
     before_destroy :ensure_not_default
+    # prepend: the +dependent: :nullify+ on +api_keys+ registers its own
+    # before_destroy at association-declaration time; without prepend it would
+    # clear every binding before this guard could see them.
+    before_destroy :ensure_no_active_bound_api_keys, prepend: true
     after_create :ensure_default_order_routing_rules
 
     scope :active, -> { where(active: true) }
@@ -115,19 +120,32 @@ module Spree
 
     # @return [Boolean]
     def can_be_deleted?
-      !default?
+      !default? && !api_keys.active.exists?
     end
 
     private
 
     def ensure_not_default
-      return if can_be_deleted?
+      return unless default?
       return if destroyed_by_association.present?
 
       errors.add(:base, Spree.t('errors.messages.cannot_delete_default_channel'))
       throw :abort
     end
 
+    # Fail closed: deleting a channel must not silently convert its bound
+    # publishable keys into unbound (store-wide) credentials via the
+    # +dependent: :nullify+ above. Active keys block deletion — revoke or
+    # rebind them first; revoked keys are historical and nullify freely.
+    # Store-cascade deletes skip the guard (the keys die with the store).
+    def ensure_no_active_bound_api_keys
+      return unless api_keys.active.exists?
+      return if destroyed_by_association.present?
+
+      errors.add(:base, Spree.t('errors.messages.cannot_delete_channel_with_active_api_keys'))
+      throw :abort
+    end
+
     def backfill_code_from_name
       self.code = name
     end

data/app/models/spree/webhook_delivery.rb

@@ -7,6 +7,11 @@ module Spree
     belongs_to :webhook_endpoint, class_name: 'Spree::WebhookEndpoint'
     delegate :url, to: :webhook_endpoint
 
+    # Credentials stripped from the persisted payload. Never written to the
+    # database — held in memory on a single delivery instance, assigned by
+    # WebhookDeliveryJob when it runs. See {Spree::WebhookPayloadRedaction}.
+    attr_accessor :payload_secrets
+
     validates :event_name, presence: true
     validates :payload, presence: true
 
@@ -64,6 +69,23 @@ module Spree
       webhook_endpoint.check_auto_disable! unless is_success
     end
 
+    # Payload as it should be sent over the wire.
+    #
+    # Re-attaches any credentials withheld from the persisted column. Once this
+    # record has been reloaded from the database those secrets are gone for
+    # good, so a redelivery sends the redacted placeholder — single-use tokens
+    # are not replayable anyway.
+    #
+    # This is deliberate: keeping a recoverable copy would put the credential
+    # back at rest, which is what redaction exists to prevent. If a delivery is
+    # lost (worker crash between creation and delivery), the customer requests
+    # a new reset, which mints a fresh token.
+    #
+    # @return [Hash]
+    def deliverable_payload
+      Spree::WebhookPayloadRedaction.merge(payload, payload_secrets)
+    end
+
     # Create a new delivery with the same payload and queue it.
     # Used to retry failed deliveries manually.
     #

data/app/presenters/spree/data_feeds/google_presenter.rb

@@ -3,6 +3,22 @@ require 'nokogiri'
 module Spree
   module DataFeeds
     class GooglePresenter < BasePresenter
+      # Optional Google Merchant Center product attributes sourced from
+      # metafields. See https://support.google.com/merchants/answer/7052112
+      OPTIONAL_ATTRIBUTES = %w[
+        brand gtin mpn identifier_exists condition adult multipack is_bundle
+        age_group color gender material pattern size size_type size_system
+        product_length product_width product_height product_weight
+        google_product_category product_type sale_price sale_price_effective_date
+        cost_of_goods_sold unit_pricing_measure unit_pricing_base_measure
+        shipping shipping_label shipping_weight shipping_length shipping_width
+        shipping_height ships_from_country transit_time_label max_handling_time
+        min_handling_time tax tax_category energy_efficiency_class
+        min_energy_efficiency_class max_energy_efficiency_class
+        gtin_source expiration_date custom_label_0 custom_label_1 custom_label_2
+        custom_label_3 custom_label_4 mobile_link additional_image_link
+      ].freeze
+
       # @return [String] RSS XML feed for Google Merchant Center
       def call
         builder = Nokogiri::XML::Builder.new do |xml|
@@ -59,10 +75,21 @@ module Spree
 
       def build_optional_attributes(xml, product)
         product.public_metafields.each do |metafield|
-          xml['g'].send(metafield.metafield_definition.key.parameterize.underscore, metafield.value)
+          key = metafield.metafield_definition.key.parameterize.underscore
+          next unless OPTIONAL_ATTRIBUTES.include?(key)
+
+          append_g_element(xml, key, metafield.value)
         end
       end
 
+      def append_g_element(xml, name, value)
+        parent = xml.parent
+        node = Nokogiri::XML::Node.new(name, parent.document)
+        node.namespace = parent.namespace_scopes.find { |ns| ns.prefix == 'g' }
+        node.content = value
+        parent << node
+      end
+
       def format_title(product, variant)
         parts = [product.name]
         variant.option_values.each do |option_value|

data/app/services/spree/sample_data/loader.rb

@@ -39,6 +39,9 @@ module Spree
               puts 'Loading sample customers...'
               load_customers
 
+              puts 'Loading wholesale demo data...'
+              load_ruby_file('wholesale')
+
               puts 'Loading sample orders...'
               load_ruby_file('orders')
 
@@ -76,9 +79,13 @@ module Spree
         Spree::SampleData::ImportRunner.call(csv_path: csv_path, import_class: Spree::Imports::Products)
       end
 
+      # Publishes the catalog to both surfaces: the public default channel and
+      # the gated wholesale channel (catalog parity; wholesale differentiation
+      # comes from the price list in +wholesale.rb+ and the channel's gate).
       def publish_sample_products
         store = Spree::Store.default
         store.default_channel.add_products(store.product_ids)
+        store.channels.find_by(code: Spree::Seeds::Channels::WHOLESALE_CODE)&.add_products(store.product_ids)
       end
 
       def load_categories

data/app/services/spree/seeds/all.rb

@@ -23,11 +23,13 @@ module Spree
 
             # store & stock location
             Stores.call
+            Channels.call
             StockLocations.call
             AdminUser.call
 
             # add store resources
             PaymentMethods.call
+            CustomerGroups.call
             ApiKeys.call
             AllowedOrigins.call
           end

data/app/services/spree/seeds/api_keys.rb

@@ -4,11 +4,15 @@ module Spree
       prepend Spree::ServiceModule::Base
 
       def call
-        store = Spree::Store.default
-        return unless store&.persisted?
+        Spree::Store.find_each do |store|
+          unless store.api_keys.active.publishable.where(channel_id: nil).exists?
+            store.api_keys.create!(name: 'Default', key_type: 'publishable')
+          end
 
-        unless store.api_keys.active.publishable.exists?
-          store.api_keys.create!(name: 'Default', key_type: 'publishable')
+          wholesale = store.channels.find_by(code: Channels::WHOLESALE_CODE)
+          if wholesale && !store.api_keys.active.publishable.where(channel: wholesale).exists?
+            store.api_keys.create!(name: 'Storefront (Wholesale)', key_type: 'publishable', channel: wholesale)
+          end
         end
       end
     end

data/app/services/spree/seeds/channels.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Seeds
+    # Seeds the gated Wholesale channel every store ships with by default —
+    # the reference "blended DTC + B2B" setup: the default channel stays
+    # public while wholesale requires login and forbids guest checkout.
+    # See docs/plans/5.6-store-channel-context-and-key-binding.md.
+    class Channels
+      prepend Spree::ServiceModule::Base
+
+      WHOLESALE_CODE = 'wholesale'.freeze
+
+      def call
+        Spree::Store.find_each do |store|
+          store.ensure_default_channel
+
+          store.channels.find_or_create_by!(code: WHOLESALE_CODE) do |channel|
+            channel.name = 'Wholesale'
+            channel.preferred_storefront_access = 'login_required'
+            channel.preferred_guest_checkout = false
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/spree/seeds/customer_groups.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Seeds
+    # The Wholesale group is the B2B approval primitive until 6.1 Company
+    # accounts land: membership marks an approved wholesale buyer and is what
+    # wholesale price lists key off.
+    class CustomerGroups
+      prepend Spree::ServiceModule::Base
+
+      WHOLESALE_NAME = 'Wholesale'.freeze
+
+      def call
+        Spree::Store.find_each do |store|
+          store.customer_groups.find_or_create_by!(name: WHOLESALE_NAME)
+        end
+      end
+    end
+  end
+end

data/config/locales/en.yml

@@ -691,6 +691,9 @@ en:
     analytics: Analytics
     and: and
     api_key: API Key
+    api_key_channel_immutable: cannot be changed after the key is created; create a new key bound to the channel you need and revoke this one
+    api_key_channel_must_belong_to_store: must belong to the same store as the key
+    api_key_channel_publishable_only: can only be set on publishable keys
     api_key_no_current_key: No API key authenticated this request
     api_key_scopes_immutable: cannot be changed after the key is created; create a new key with the scopes you need and revoke this one
     api_keys: API Keys
@@ -913,6 +916,7 @@ en:
     error_user_does_not_have_any_store_credits: User does not have any Store Credits available
     errors:
       messages:
+        cannot_delete_channel_with_active_api_keys: Channel cannot be deleted while active API keys are bound to it. Revoke those keys first.
         cannot_delete_default_channel: Default channel cannot be deleted. Promote another channel to default first.
         channel_store_mismatch: must belong to the same store
         invalid_order_routing_rule: is not a registered order routing rule

data/db/migrate/20260719000001_add_channel_id_to_spree_api_keys.rb

@@ -0,0 +1,5 @@
+class AddChannelIdToSpreeApiKeys < ActiveRecord::Migration[7.2]
+  def change
+    add_reference :spree_api_keys, :channel, null: true, if_not_exists: true
+  end
+end

data/db/sample_data/channels.rb

@@ -7,6 +7,17 @@ store.channels.find_or_create_by!(code: 'pos') do |channel|
   channel.name = 'Point of Sale'
 end
 
-store.channels.find_or_create_by!(code: 'wholesale') do |channel|
+# Normally seeded by Spree::Seeds::Channels; created here too so installs
+# seeded before the gated-wholesale seed existed still get the channel, and
+# upgraded with the gated posture when it's missing.
+wholesale = store.channels.find_or_create_by!(code: 'wholesale') do |channel|
   channel.name = 'Wholesale'
+  channel.preferred_storefront_access = 'login_required'
+  channel.preferred_guest_checkout = false
+end
+
+if wholesale.preferred_storefront_access.blank?
+  wholesale.preferred_storefront_access = 'login_required'
+  wholesale.preferred_guest_checkout = false
+  wholesale.save!
 end

data/db/sample_data/wholesale.rb

@@ -0,0 +1,59 @@
+# Wholesale demo setup on top of the gated channel seeded by
+# Spree::Seeds::Channels: an approved demo buyer and a customer-group price
+# list, so a fresh install can walk the whole B2B portal story — sign in as
+# the buyer, see wholesale prices, check out on the wholesale channel.
+store = Spree::Store.default
+
+wholesale_group = store.customer_groups.find_or_create_by!(name: Spree::Seeds::CustomerGroups::WHOLESALE_NAME)
+
+buyer = Spree.user_class.find_by(email: 'wholesale@example.com')
+if buyer.nil?
+  buyer = Spree.user_class.new(
+    email: 'wholesale@example.com',
+    password: 'spree123',
+    password_confirmation: 'spree123',
+    first_name: 'Wanda',
+    last_name: 'Wholesale'
+  )
+  buyer.save!
+end
+wholesale_group.add_customers([buyer.id])
+
+price_list = store.price_lists.find_or_create_by!(name: 'Wholesale') do |list|
+  list.description = 'Wholesale pricing for approved B2B buyers (40% off retail)'
+end
+
+unless price_list.price_rules.any? { |rule| rule.is_a?(Spree::PriceRules::CustomerGroupRule) }
+  # price_list must be assigned before the preference — the customer-group-id
+  # normalizer resolves groups through rule.store (delegated to price_list).
+  rule = Spree::PriceRules::CustomerGroupRule.new(price_list: price_list)
+  rule.preferred_customer_group_ids = [wholesale_group.id]
+  rule.save!
+end
+
+if price_list.prices.none?
+  currency = store.default_currency
+  now = Time.current
+  rows = Spree::Variant.joins(:product)
+                       .where(spree_products: { store_id: store.id })
+                       .joins(:prices)
+                       .where(spree_prices: { currency: currency, price_list_id: nil })
+                       .pluck(:id, Spree::Price.arel_table[:amount])
+                       .to_h # one row per variant — last base price wins
+                       .filter_map do |variant_id, amount|
+    next if amount.blank?
+
+    {
+      variant_id: variant_id,
+      price_list_id: price_list.id,
+      amount: (amount * 0.6).round(2),
+      currency: currency,
+      created_at: now,
+      updated_at: now
+    }
+  end
+
+  Spree::Price.insert_all(rows) if rows.any?
+end
+
+price_list.activate if price_list.can_activate?

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.6.0.rc3'.freeze
+  VERSION = '5.6.0.rc4'.freeze
 
   def self.version
     VERSION

data/lib/spree/permitted_attributes.rb

@@ -91,7 +91,7 @@ module Spree
 
     @@allowed_origin_attributes = [:origin]
 
-    @@api_key_attributes = [:name, :key_type, { scopes: [] }]
+    @@api_key_attributes = [:name, :key_type, :channel_id, { scopes: [] }]
 
     @@asset_attributes = [:type, :viewable_id, :viewable_type, :attachment, :alt, :position, :url, :signed_id]
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.6.0.rc3
+  version: 5.6.0.rc4
 platform: ruby
 authors:
 - Sean Schofield
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-19 00:00:00.000000000 Z
+date: 2026-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: i18n-tasks
@@ -936,6 +936,7 @@ files:
 - app/models/concerns/spree/user_reporting.rb
 - app/models/concerns/spree/user_roles.rb
 - app/models/concerns/spree/vat_price_calculation.rb
+- app/models/concerns/spree/webhook_payload_redaction.rb
 - app/models/spree/ability.rb
 - app/models/spree/address.rb
 - app/models/spree/adjustable/adjuster/base.rb
@@ -1343,14 +1344,15 @@ files:
 - app/services/spree/prices/bulk_upsert.rb
 - app/services/spree/products/auto_match_taxons.rb
 - app/services/spree/products/duplicator.rb
-- app/services/spree/products/prepare_nested_attributes.rb
 - app/services/spree/sample_data/import_runner.rb
 - app/services/spree/sample_data/loader.rb
 - app/services/spree/seeds/admin_user.rb
 - app/services/spree/seeds/all.rb
 - app/services/spree/seeds/allowed_origins.rb
 - app/services/spree/seeds/api_keys.rb
+- app/services/spree/seeds/channels.rb
 - app/services/spree/seeds/countries.rb
+- app/services/spree/seeds/customer_groups.rb
 - app/services/spree/seeds/default_reimbursement_types.rb
 - app/services/spree/seeds/digital_delivery.rb
 - app/services/spree/seeds/payment_methods.rb
@@ -1601,6 +1603,7 @@ files:
 - db/migrate/20260707000001_add_fingerprint_to_spree_credit_cards.rb
 - db/migrate/20260710000001_add_import_id_status_index_to_spree_import_rows.rb
 - db/migrate/20260711000001_add_preferences_to_spree_exports.rb
+- db/migrate/20260719000001_add_channel_id_to_spree_api_keys.rb
 - db/sample_data/channels.rb
 - db/sample_data/customers.csv
 - db/sample_data/markets.rb
@@ -1612,6 +1615,7 @@ files:
 - db/sample_data/products.csv
 - db/sample_data/promotions.rb
 - db/sample_data/shipping_methods.rb
+- db/sample_data/wholesale.rb
 - db/seeds.rb
 - lib/friendly_id/history_decorator.rb
 - lib/friendly_id/paranoia.rb
@@ -1861,9 +1865,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc3
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.6.0.rc4
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc3
+  source_code_uri: https://github.com/spree/spree/tree/v5.6.0.rc4
 post_install_message:
 rdoc_options: []
 require_paths:

data/app/services/spree/products/prepare_nested_attributes.rb

@@ -1,265 +0,0 @@
-module Spree
-  module Products
-    # Prepares nested attributes for product updates, handling multi-store scenarios
-    # and permissions.
-    #
-    # This service ensures that when editing a product in one store, taxon associations
-    # from other stores are preserved. This prevents accidental data loss when a store
-    # admin updates product categories in their store without affecting other stores.
-    #
-    # Variant removal is opt-in: only variants explicitly listed in the
-    # `removed_variant_ids` param are marked for destruction (or collected for
-    # discontinuation when they have completed orders). Variants merely absent from
-    # `variants_attributes` are left untouched, so a partially rendered or broken
-    # form can never silently mass-delete variants.
-    #
-    # @example
-    #   service = Spree::Products::PrepareNestedAttributes.new(
-    #     product,
-    #     current_store,
-    #     params,
-    #     current_ability
-    #   )
-    #   prepared_params = service.call
-    #
-    class PrepareNestedAttributes
-      attr_reader :variants_to_discontinue
-
-      def initialize(product, store, params, ability)
-        @product = product
-        @store = store
-        @params = params
-        @ability = ability
-        @variants_to_discontinue = []
-      end
-
-      def call
-        extract_removed_variant_ids
-
-        if params[:variants_attributes]
-          params[:variants_attributes].each do |key, variant_params|
-            existing_variant = variant_params[:id].presence && @product.variants.find_by(id: variant_params[:id])
-            # a re-submitted variant always wins over a removal request
-            variants_to_remove.delete(variant_params[:id].to_s) if variant_params[:id].present?
-
-            variant_params.delete(:price) # remove legacy price param
-
-            if can_update_prices?
-              backfill_price_ids!(variant_params, existing_variant)
-
-              variant_params[:prices_attributes]&.each do |price_key, price_params|
-                variant_params[:prices_attributes][price_key]['_destroy'] = '1' if price_params[:amount].blank?
-              end
-            else
-              variant_params.delete(:prices_attributes)
-            end
-
-            variant_params[:option_value_variants_attributes] = update_option_value_variants(variant_params.delete(:options), existing_variant)
-
-            variant_params.delete(:stock_items_attributes) unless can_update_stock_items?
-
-            params[:variants_attributes].delete(key) if variant_params.blank?
-          end
-          params[:variants_attributes] = params[:variants_attributes].merge(removed_variants_attributes)
-
-          params[:product_option_types_attributes] = product_option_types_params.merge(removed_product_option_types_attributes)
-        elsif params[:master_attributes]
-          params[:master_attributes].delete(:stock_items_attributes) unless can_update_stock_items?
-
-          if can_update_prices?
-            # If the master price is nil then mark it for destruction
-            params.dig(:master_attributes, :prices_attributes)&.each do |price_key, price_params|
-              params[:master_attributes][:prices_attributes][price_key]['_destroy'] = '1' if price_params[:amount].blank?
-            end
-          else
-            params[:master_attributes].delete(:prices_attributes)
-          end
-        end
-
-        params.delete(:legacy_product_publications_attributes) unless can?(:manage, Spree::ProductPublication)
-
-        # ensure the product is owned by a store
-        params[:store_id] = store.id if params[:store_id].blank? && product.store_id.blank?
-
-        # The variants matrix was emptied: no variant rows re-submitted, removals sent instead.
-        # Option types are detached only when the removal list covers every variant, so a
-        # partial (possibly broken) submission never turns the product into a simple one.
-        # Variants kept alive by discontinuation still count as removed from the matrix,
-        # so the detachment can't hinge on any of them yielding a `_destroy` row.
-        if params[:variants_attributes].blank? && variants_to_remove.any? && can_remove_variants?
-          attributes = removed_variants_attributes
-
-          params[:option_type_ids] = [] if removing_all_variants? && !params.key?(:option_type_ids)
-
-          if attributes.any?
-            params[:variants_attributes] = attributes
-            params[:variants_attributes].permit!
-          end
-        end
-
-        params
-      end
-
-      private
-
-      attr_reader :product, :store, :params, :ability
-
-      delegate :can?, :cannot?, to: :ability
-
-      # Backfill IDs for prices_attributes entries that reference existing prices
-      # so that ActiveRecord updates them instead of inserting duplicates
-      def backfill_price_ids!(variant_params, existing_variant)
-        return unless existing_variant && variant_params[:prices_attributes]
-
-        variant_params[:prices_attributes].each do |_key, price_params|
-          next if price_params[:id].present?
-          next if price_params[:currency].blank?
-
-          existing_price = existing_variant.prices.base_prices.find_by(currency: price_params[:currency])
-          price_params[:id] = existing_price.id if existing_price
-        end
-      end
-
-      def product_option_types_params
-        @product_option_types_params ||= {}
-      end
-
-      def product_option_types_to_remove
-        @product_option_types_to_remove ||= product.product_option_type_ids
-      end
-
-      # Pulls `removed_variant_ids` out of the params so it never reaches Product#update.
-      # Must run before any `variants_to_remove` access.
-      def extract_removed_variant_ids
-        @removed_variant_ids = Array(params.delete(:removed_variant_ids)).map(&:to_s)
-      end
-
-      # Only variants the client explicitly asked to remove, and only ones that
-      # actually belong to this product.
-      def variants_to_remove
-        @variants_to_remove ||= (@removed_variant_ids || []).uniq & all_variant_ids
-      end
-
-      def all_variant_ids
-        @all_variant_ids ||= product.variant_ids.map(&:to_s)
-      end
-
-      def removing_all_variants?
-        (all_variant_ids - variants_to_remove).empty?
-      end
-
-      def can_update_prices?
-        @can_update_prices ||= product.new_record? || can?(:manage, Spree::Price.new(variant_id: product.default_variant.id))
-      end
-
-      def can_manage_option_types?
-        @can_manage_option_types ||= product.new_record? || can?(:manage_option_types, product)
-      end
-
-      def can_update_stock_items?
-        @can_update_stock_items ||= product.new_record? || can?(:manage, Spree::StockItem.new(variant_id: product.default_variant.id))
-      end
-
-      def can_remove_variants?
-        @can_remove_variants ||= product.persisted? && can?(:destroy, product.default_variant)
-      end
-
-      def removed_variants_attributes
-        return {} unless can_remove_variants?
-
-        populate_variants_to_discontinue
-
-        attributes = {}
-        last_index = params[:variants_attributes].presence&.keys&.map(&:to_i)&.max || -1
-        variant_ids_to_destroy.each_with_index do |variant_id, index|
-          attributes[(last_index + 1 + index).to_s] = { id: variant_id, _destroy: '1' }
-        end
-
-        attributes
-      end
-
-      def populate_variants_to_discontinue
-        ids = variants_to_remove.select { |vid| variant_ids_with_completed_orders.include?(vid) }
-        @variants_to_discontinue = product.variants.where(id: ids).to_a if ids.any?
-      end
-
-      def variant_ids_to_destroy
-        variants_to_remove - variant_ids_with_completed_orders
-      end
-
-      def variant_ids_with_completed_orders
-        @variant_ids_with_completed_orders ||=
-          product.variants
-                 .joins(:orders)
-                 .merge(Spree::Order.complete)
-                 .reorder(nil)
-                 .distinct
-                 .pluck(:id)
-                 .map(&:to_s)
-      end
-
-      def removed_product_option_types_attributes
-        return {} unless can_manage_option_types?
-
-        attributes = {}
-        last_index = product_option_types_params.keys.map(&:to_i).max
-        product_option_types_to_remove.each_with_index do |product_option_type_id, index|
-          attributes[(last_index + index + 1).to_s] = { id: product_option_type_id, _destroy: '1' }
-        end
-
-        attributes
-      end
-
-      def update_option_value_variants(option_value_params, existing_variant)
-        return {} unless option_value_params.present?
-        return {} unless can_manage_option_types?
-
-        option_value_variant_params = {}
-
-        option_value_params.each_with_index do |opt, index|
-          option_type = Spree::OptionType.find_by_param(opt[:id]) if opt.fetch(:id)
-          option_type ||= Spree::OptionType.where(name: opt[:name].parameterize).first_or_initialize do |o|
-            o.name = o.presentation = opt[:name]
-            o.position = opt[:position]
-            o.save!
-          end
-
-          option_value_identificator = if opt[:option_value_name].present?
-                                         opt[:option_value_name]
-                                       else
-                                         opt[:option_value_presentation]
-                                       end.parameterize.strip
-
-          option_value = option_type.option_values.where(name: option_value_identificator).first_or_initialize do |o|
-            o.presentation = opt[:option_value_presentation]
-            o.save!
-          end
-
-          existing_option_value_variant = existing_variant&.option_value_variants&.find { |ovv| ovv.option_value_id == option_value.id }
-
-          option_value_variant_params[index.to_s] = { id: existing_option_value_variant&.id, option_value_id: option_value.id }.compact_blank
-
-          next if product_option_types_params.find { |_i, v| v[:option_type_id] == option_type.id }
-
-          existing_product_option_type = @product.product_option_types.find { |pot| pot.option_type_id == option_type.id }
-
-          if existing_product_option_type
-            product_option_types_to_remove.delete(existing_product_option_type.id)
-            product_option_types_params[opt[:position]] = {
-              id: existing_product_option_type.id,
-              position: opt[:position],
-              option_type_id: option_type.id
-            }
-          else
-            product_option_types_params[opt[:position]] = {
-              option_type_id: option_type.id,
-              position: opt[:position]
-            }
-          end
-        end
-
-        option_value_variant_params
-      end
-    end
-  end
-end