spree_core 5.6.1 → 6.0.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 102686daa285991fed8a91b768781fb7a3433411ffbc854cd2ef758c8c8687c7
-  data.tar.gz: 3c17b1e08025e190848c4699a5e6bbef00a66314b91054092d44c22971e3dbd2
+  metadata.gz: d404e43490b356a04bf850e09a644143d8f399c7f39c147301184fd11c2cfed5
+  data.tar.gz: 2b1a720b211b09a061c26b5bf1761510fdde20bf2d50ee9451fbab4a67939b0c
 SHA512:
-  metadata.gz: 24354241aa89fcd8129c48e6ffacb1325334a17d6bc65d7481e3a8c0a7816365f7a73d9fd853831bcbe20a4373697be39c8e49f666d41d52409bd78d170575c1
-  data.tar.gz: 7a11fb6dd5229cab6f45019d3ba94b2820c1a00a477ce13efdf9bf5e0af819cc40df37179caded829a169706de110bcf5cebdc8371dee704fe1d9cbaaf897750
+  metadata.gz: 62dd3e3663ddf4b540127ae6bd526027adc294004e05f6069bf9041f36f5542c7daead8f747937094ddd73d8e19da153ff6ae214cc0c98ca6d7b80a6a8d2b8e8
+  data.tar.gz: b8c49e3df74336ea44676d186c1b376979541c85610baf04b575f82d80886c2850ab4245d4274eb887535c4081e028631766a1b2fa31788c302116de4aca596e

data/LICENSE

@@ -0,0 +1,30 @@
+BSD 3-Clause License
+
+Copyright (c) 2024-present, Vendo Sp. z o.o., Vendo Connect Inc.
+Copyright (c) 2015-2024, Spark Solutions Sp. z o.o.
+Copyright (c) 2007-2015, Spree Commerce Inc.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

data/README.md

@@ -53,7 +53,7 @@ Spree uses an event-driven architecture for decoupling components:
 
 ```ruby
 # Publishing events
-order.publish_event('order.completed')
+order.publish_event('order.placed')
 
 # Subscribing to events
 module Spree
@@ -87,7 +87,7 @@ Configure Spree in an initializer:
 # config/initializers/spree.rb
 Spree.config do |config|
   config.currency = 'USD'
-  config.default_country_iso = 'US'
+  config.default_country_code = 'US'
 end
 ```
 
@@ -98,7 +98,6 @@ Spree Core includes testing support utilities:
 ```ruby
 # spec/rails_helper.rb
 require 'spree/testing_support/factories'
-require 'spree/testing_support/authorization_helpers'
 ```
 
 To run the test suite:

data/app/finders/spree/line_items/find_by_variant.rb

@@ -1,11 +1,13 @@
 module Spree
   module LineItems
     class FindByVariant
-      def execute(order:, variant:, options: {})
-        line_item = order.line_items.loaded? ? order.line_items.detect { |li| li.variant_id == variant.id } : order.line_items.find_by(variant_id: variant.id)
+      # @param owner [Spree::Cart, Spree::Order] the line-item owner
+      def execute(owner: nil, cart: nil, order: nil, variant:, options: {})
+        owner ||= cart || order
+        line_item = owner.line_items.loaded? ? owner.line_items.detect { |li| li.variant_id == variant.id } : owner.line_items.find_by(variant_id: variant.id)
 
         if line_item
-          Spree.cart_compare_line_items_service.call(order: order, line_item: line_item, options: options).value
+          Spree.cart_compare_line_items_service.call(order: owner, line_item: line_item, options: options).value
         end
 
         line_item

data/app/finders/spree/sellers/panel_url.rb

@@ -0,0 +1,47 @@
+module Spree
+  module Sellers
+    # Origin where the seller panel is hosted, for links that send a seller
+    # into it — today the invitation email.
+    #
+    # Resolution order, most authoritative first:
+    #
+    # 1. the `seller_panel_url` preference / SPREE_SELLER_PANEL_URL
+    # 2. the `/sellers` mount this app serves, when a bundle is configured
+    # 3. the dashboard origin, as a last resort — accepting there joins the
+    #    seller but issues an admin session, so they must sign in again once a
+    #    panel exists. Kept rather than raising: a marketplace that has not
+    #    deployed one yet still needs to invite people.
+    class PanelUrl
+      # @param store [Spree::Store, nil] store whose URL ends the fallback chain
+      # @return [String] origin without a trailing slash
+      def self.call(store: nil)
+        configured = Spree::Config[:seller_panel_url].presence
+        return configured.to_s.chomp('/') if configured
+
+        mounted_panel_url(store) || dashboard_fallback(store)
+      end
+
+      # The `/sellers` mount this app serves, when `spree_dashboard` is
+      # installed AND pointed at a seller-panel build. Without a bundle the
+      # route 404s, so linking there would be worse than the dashboard.
+      def self.mounted_panel_url(store)
+        return unless defined?(Spree::Dashboard) && Spree::Dashboard.seller_panel_dist_path.present?
+
+        host = Spree::Stores::DashboardUrl.app_host(store)
+        "#{host.chomp('/')}/sellers" if host.present?
+      end
+      private_class_method :mounted_panel_url
+
+      def self.dashboard_fallback(store)
+        Rails.logger.warn(
+          '[Spree] No seller panel is configured, so seller invitations point at the staff ' \
+          'dashboard. Accepting there joins the seller but issues an admin session, not a ' \
+          'seller one. Set SPREE_SELLER_PANEL_URL or serve a seller panel build at /sellers.'
+        )
+
+        Spree::Stores::DashboardUrl.call(store: store)
+      end
+      private_class_method :dashboard_fallback
+    end
+  end
+end

data/app/finders/spree/stores/dashboard_url.rb

@@ -0,0 +1,76 @@
+module Spree
+  module Stores
+    # Origin where the React dashboard is hosted, for every link that sends
+    # someone into it: invitation emails, the SSO callback, the first-run
+    # setup link.
+    #
+    # Resolution order, most authoritative first:
+    #
+    # 1. the `dashboard_url` preference / SPREE_DASHBOARD_URL — an explicit
+    #    answer always wins
+    # 2. the deprecated `admin_url` preference
+    # 3. the dashboard this app serves itself, when `spree_dashboard` is
+    #    installed and has a build to serve (`/dashboard` on the app's own
+    #    host) — a fact about this deployment, so it beats the guess below
+    # 4. the Vite dev server in development, for the monorepo/CLI workflow
+    #    where the dashboard runs as a separate process
+    # 5. the store's own URL
+    #
+    # Steps 3-5 keep links working on installs that never configured an
+    # origin; none is a substitute for setting SPREE_DASHBOARD_URL in
+    # production, where the app's own host is rarely where admins go.
+    class DashboardUrl
+      # @param store [Spree::Store, nil] store whose URL ends the fallback chain
+      # @return [String] origin without a trailing slash, e.g. +https://admin.shop.com+
+      def self.call(store: nil)
+        base = Spree::Config[:dashboard_url].presence ||
+               legacy_admin_url ||
+               mounted_dashboard_url(store) ||
+               (Rails.env.development? ? 'http://localhost:5173' : nil) ||
+               store&.formatted_url
+
+        base.to_s.chomp('/')
+      end
+
+      # Reads the deprecated `admin_url` without tripping its warning on every
+      # link — the warning belongs to whoever set it, and Spree::Config[] would
+      # emit one per call here.
+      # @return [String, nil]
+      def self.legacy_admin_url
+        Spree::Config.admin_url.presence
+      end
+      private_class_method :legacy_admin_url
+
+      # The `/dashboard` mount served by this app, when `spree_dashboard` is
+      # installed AND pointed at a build. Without a build the route 404s, so
+      # linking there would be worse than the dev-server guess.
+      # @return [String, nil]
+      def self.mounted_dashboard_url(store)
+        return unless defined?(Spree::Dashboard) && Spree::Dashboard.dist_path.present?
+
+        host = app_host(store)
+        return if host.blank?
+
+        "#{host.chomp('/')}/dashboard"
+      end
+      private_class_method :mounted_dashboard_url
+
+      # Where this Rails app answers. `default_url_options` is what mailers
+      # already rely on, so a deployment that gets email links right gets this
+      # right too; the store URL is the last resort.
+      #
+      # Public because the seller panel resolves its own `/sellers` mount
+      # against the same host — both are asking where this app serves.
+      # @return [String, nil]
+      def self.app_host(store)
+        options = Rails.application.routes.default_url_options
+        return store&.formatted_url if options[:host].blank?
+
+        protocol = options[:protocol].presence || 'http'
+        port = options[:port]
+        host = "#{protocol}://#{options[:host]}"
+        port.present? ? "#{host}:#{port}" : host
+      end
+    end
+  end
+end

data/app/helpers/spree/images_helper.rb

@@ -101,7 +101,7 @@ module Spree
     #       in URLs and JSON converts symbols to strings, causing digest mismatches.
     def spree_image_variant_options(options = {})
       format_opt = options[:format]&.to_s
-      saver_options = format_opt == "png" ? png_saver_options : Spree::Asset::WEBP_SAVER_OPTIONS
+      saver_options = format_opt == "png" ? png_saver_options : Spree::Media::WEBP_SAVER_OPTIONS
       format = format_opt || "webp"
 
       # Build hash in alphabetical order to match Active Storage's key ordering

data/app/jobs/spree/carts/reap_expired_job.rb

@@ -0,0 +1,43 @@
+module Spree
+  module Carts
+    # Tiered cart-expiry reaper: guest carts after
+    # +guest_cart_expiry_days+, customer carts after
+    # +customer_cart_expiry_days+, empty carts after
+    # +empty_cart_expiry_hours+ — measured on updated_at, batched. Carts
+    # with money attached (authorized/pending payment sessions or payment
+    # transactions) are never reaped.
+    class ReapExpiredJob < Spree::BaseJob
+      queue_as Spree.queues.default
+
+      def perform
+        reap(empty_scope.where(updated_at: ...Spree::Config[:empty_cart_expiry_hours].hours.ago))
+        reap(guest_scope.where(updated_at: ...Spree::Config[:guest_cart_expiry_days].days.ago))
+        reap(customer_scope.where(updated_at: ...Spree::Config[:customer_cart_expiry_days].days.ago))
+      end
+
+      private
+
+      def base_scope
+        Spree::Cart.incomplete.
+          where.not(id: Spree::PaymentSession.where(status: %w[pending processing]).select(:cart_id)).
+          where.not(id: Spree::Payment.where.not(state: Spree::Payment::INVALID_STATES).where.not(cart_id: nil).select(:cart_id))
+      end
+
+      def empty_scope
+        base_scope.where.missing(:line_items)
+      end
+
+      def guest_scope
+        base_scope.where(customer_id: nil)
+      end
+
+      def customer_scope
+        base_scope.where.not(customer_id: nil)
+      end
+
+      def reap(scope)
+        scope.in_batches(of: 200, &:destroy_all)
+      end
+    end
+  end
+end

data/app/jobs/spree/collections/regenerate_time_based_job.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Collections
+    # Re-evaluates automatic collections whose rules are time-relative (e.g. AvailableOn),
+    # which event-driven regeneration can't keep fresh. Scheduled by the host app
+    # (sidekiq-cron / solid_queue recurring), the same pattern as Spree::StockReservations::ExpireJob.
+    class RegenerateTimeBasedJob < ::Spree::BaseJob
+      queue_as Spree.queues.collections
+
+      def perform
+        types = Rails.application.config.spree.time_based_collection_rules.map(&:to_s)
+
+        Spree::Collection.automatic.
+          where(id: Spree::CollectionRule.where(type: types).select(:collection_id)).
+          find_each { |collection| Spree::Collections::RegenerateProducts.call(collection: collection) }
+      end
+    end
+  end
+end

data/app/jobs/spree/data_requests/process_job.rb

@@ -0,0 +1,42 @@
+module Spree
+  module DataRequests
+    # Builds the export (or runs the erasure) for a data subject request off
+    # the request cycle.
+    #
+    # A request that fails is recorded as `failed` with its message rather
+    # than left in `processing`, because a request stuck mid-flight would
+    # block the subject from asking again — the pending-request check is what
+    # rate-limits them. That is why the work is wrapped rather than left to
+    # raise: the base class's retries cover the transient database errors, and
+    # anything else has to leave the request in a state the subject can act on.
+    #
+    # Its own queue: an export reads a person's whole history and a statutory
+    # clock is running on it, so a shop with a long import backlog should be
+    # able to give these their own workers.
+    class ProcessJob < Spree::BaseJob
+      queue_as Spree.queues.data_requests
+
+      def perform(data_request_id)
+        data_request = Spree::DataRequest.find_by_prefix_id!(data_request_id)
+        result = Spree::DataRequests::Fulfill.call(data_request: data_request)
+
+        record_failure(data_request, result.error.to_s) if result.failure?
+      rescue StandardError => e
+        record_failure(data_request, e.message) if data_request
+        raise
+      end
+
+      private
+
+      def record_failure(data_request, message)
+        return if data_request.completed?
+
+        data_request.update_columns(
+          status: 'failed',
+          error_message: message.to_s.first(1000).presence,
+          updated_at: Time.current
+        )
+      end
+    end
+  end
+end

data/app/jobs/spree/events/subscriber_job.rb

@@ -10,7 +10,7 @@ module Spree
     # @example Direct usage (typically called by the adapter)
     #   Spree::Events::SubscriberJob.perform_later(
     #     'MySubscriber',
-    #     { name: 'order.completed', payload: {...}, ... }
+    #     { name: 'order.placed', payload: {...}, ... }
     #   )
     #
     class SubscriberJob < Spree::BaseJob

data/app/jobs/spree/images/migrate_product_media_job.rb

@@ -0,0 +1,80 @@
+module Spree
+  module Images
+    # Per-product worker for the 5.4 → 5.5 media migration. Idempotent.
+    class MigrateProductMediaJob < Spree::BaseJob
+      queue_as Spree.queues.images
+
+      def perform(product_id)
+        product = Spree::Product.includes(:variants).find_by(id: product_id)
+        return unless product
+
+        # One query for all variant-pinned assets on the product. Grouping by
+        # viewable_id avoids N queries per variant.
+        viewable_ids = product.variants.map(&:id)
+        return if viewable_ids.empty?
+
+        assets_by_variant = Spree::Media
+                              .where(viewable_type: 'Spree::Variant', viewable_id: viewable_ids)
+                              .pluck(:id, :viewable_id)
+                              .group_by(&:last)
+                              .transform_values { |rows| rows.map(&:first) }
+        return if assets_by_variant.empty?
+
+        touched_variants = []
+
+        product.variants.each do |variant|
+          asset_ids = assets_by_variant[variant.id]
+          next if asset_ids.blank?
+
+          move_assets_to_product(asset_ids, product)
+          # The default variant's assets stay product-level (no back-link). This
+          # only applies once default_variant_id is populated; during the one-time
+          # legacy migration it's still NULL (the backfill runs later in
+          # spree:remove_master_variant), so every migrated variant gets linked then.
+          link_assets_to_variant(asset_ids, variant.id) unless variant.id == product.default_variant_id
+          touched_variants << variant
+        end
+
+        # update_all + upsert_all skip callbacks, so refresh thumbnails by hand.
+        touched_variants.each(&:update_thumbnail!)
+        recalculate_counters(product)
+      end
+
+      private
+
+      def move_assets_to_product(asset_ids, product)
+        Spree::Media.where(id: asset_ids).update_all(
+          viewable_type: 'Spree::Product',
+          viewable_id: product.id,
+          updated_at: Time.current
+        )
+      end
+
+      def link_assets_to_variant(asset_ids, variant_id)
+        rows = asset_ids.map { |asset_id| { variant_id: variant_id, media_id: asset_id } }
+
+        # MySQL infers the conflict target from the unique index; only PG/SQLite
+        # need the explicit `unique_by:`.
+        opts = { on_duplicate: :skip }
+        if %w[PostgreSQL SQLite].include?(ActiveRecord::Base.connection.adapter_name)
+          opts[:unique_by] = :idx_variant_media_unique
+        end
+
+        Spree::VariantMedia.upsert_all(rows, **opts)
+      end
+
+      def recalculate_counters(product)
+        new_count = product.media.count
+        new_primary_id = product.media.order(:position).pick(:id)
+
+        return if product.media_count == new_count && product.primary_media_id == new_primary_id
+
+        product.update_columns(
+          media_count: new_count,
+          primary_media_id: new_primary_id,
+          updated_at: Time.current
+        )
+      end
+    end
+  end
+end

data/app/jobs/spree/images/save_from_url_job.rb

@@ -11,15 +11,34 @@ module Spree
       discard_on URI::InvalidURIError
       discard_on SsrfFilter::Error
 
+      # The system a bare external id is filed under when the caller names
+      # none. A DAM or PIM feeding media through this job should pass
+      # `{ system:, external_id: }` and name itself.
+      DEFAULT_EXTERNAL_SYSTEM = 'import'.freeze
+
+      # @param external_id [String, Hash, Array, nil] the identities the source
+      #   systems know this media by — a bare id, a `{ system:, external_id: }`
+      #   hash, or a list of them when several systems name the same asset.
+      #   Recorded as Spree::ExternalReferences on the media, and used to find
+      #   the row again on the next run so a feed never re-imports.
+      # @param position [Integer, nil] the media's position in the gallery
+      # @param link_variant_id [Integer, nil] links the product-level media to
+      #   this variant once saved
+      # @return [void]
       def perform(viewable_id, viewable_type, external_url, external_id = nil, position = nil, link_variant_id = nil)
         viewable = viewable_type.safe_constantize.find(viewable_id)
 
-        Spree::Image.ensure_metafield_definition_exists!(Spree::Image::EXTERNAL_URL_METAFIELD_KEY)
+        # The viewable's own store, not the current one: a job runs outside a
+        # request, where `Spree::Current.store` answers with the default store
+        # and would file every store's external-url definition on that one.
+        Spree::Media.ensure_custom_field_definition_exists!(
+          Spree::Media::EXTERNAL_URL_CUSTOM_FIELD_KEY, store: store_for(viewable)
+        )
 
         external_url = external_url.strip
-        external_id = external_id.to_s.downcase.strip if external_id.present?
+        references = external_references_from(external_id)
 
-        image = find_or_initialize_image(viewable, external_url, external_id)
+        image = find_or_initialize_image(viewable, external_url, references)
 
         image.set_default_values_for_import if image.new_record? && image.respond_to?(:set_default_values_for_import)
 
@@ -32,11 +51,13 @@ module Spree
         # still trigger save! if position has changed
         if image_already_saved?(image, external_url)
           image.save!
+          record_external_references(image, references)
           link_to_variant(image, link_variant_id)
           return
         end
 
-        download_and_attach_image(external_url, image, external_id)
+        download_and_attach_image(external_url, image)
+        record_external_references(image, references)
         link_to_variant(image, link_variant_id)
       rescue ActiveStorage::IntegrityError => e
         raise e unless Rails.env.test?
@@ -44,7 +65,15 @@ module Spree
 
       private
 
-      def download_and_attach_image(external_url, image, external_id)
+      # Mirrors how Spree::Media picks its own store: the viewable's, or its
+      # product's for a variant.
+      #
+      # @return [Spree::Store]
+      def store_for(viewable)
+        viewable.try(:store) || viewable.try(:product)&.store || Spree::Store.default
+      end
+
+      def download_and_attach_image(external_url, image)
         max_size = Spree::Config.max_image_download_size
 
         response = SsrfFilter.get(
@@ -78,7 +107,6 @@ module Spree
 
           image.attachment.attach(io: tempfile, filename: filename)
           image.external_url = external_url
-          image.external_id = external_id if external_id.present? && image.respond_to?(:external_id)
           image.save!
         ensure
           tempfile.close
@@ -90,8 +118,8 @@ module Spree
         image.persisted? && image.attachment.attached? && image.external_url.present? && external_url == image.external_url
       end
 
-      # `Product#images` delegates to the master variant (legacy alias) — use
-      # `Product#media` so 5.5 product-level uploads don't get re-pinned to master.
+      # `Product#images` delegates to the default variant — use `Product#media`
+      # so 5.5 product-level uploads don't get re-pinned to that variant.
       def viewable_assets(viewable)
         viewable.is_a?(Spree::Product) ? viewable.media : viewable.images
       end
@@ -101,12 +129,41 @@ module Spree
         scope.respond_to?(:with_deleted) ? scope.with_deleted : scope
       end
 
-      def find_or_initialize_image(viewable, external_url, external_id = nil)
-        if external_id.present? && viewable.respond_to?(:external_id)
-          image_scope(viewable).find_or_initialize_by(external_id: external_id)
-        else
-          image_scope(viewable).with_external_url(external_url).first || viewable_assets(viewable).new
+      # An identity from the source system wins over the URL: a DAM may move
+      # the file and keep the id, and matching on the URL would then import a
+      # second copy.
+      def find_or_initialize_image(viewable, external_url, references = [])
+        Array(references).each do |reference|
+          existing = image_scope(viewable).with_external_id(reference[:system], reference[:external_id]).take
+          return existing if existing.present?
         end
+
+        image_scope(viewable).with_external_url(external_url).first || viewable_assets(viewable).new
+      end
+
+      # Normalises the caller's external ids into the shared entry shape.
+      # This job's own additions over {Spree::ExternalReference.normalize_references}
+      # are the legacy bare-string form and a default system for entries that
+      # name none — everything else parses identically to the API.
+      def external_references_from(external_id)
+        return [] if external_id.blank?
+
+        entries = (external_id.is_a?(Array) ? external_id : [external_id]).map do |entry|
+          if entry.is_a?(Hash)
+            hash = entry.to_h.symbolize_keys
+            hash[:system].present? ? hash : hash.merge(system: DEFAULT_EXTERNAL_SYSTEM)
+          elsif entry.present?
+            { system: DEFAULT_EXTERNAL_SYSTEM, external_id: entry.to_s }
+          end
+        end
+
+        Spree::ExternalReference.normalize_references(entries.compact)
+      end
+
+      def record_external_references(image, references)
+        return unless image.persisted?
+
+        Array(references).each { |reference| image.set_external_id(reference[:system], reference[:external_id]) }
       end
 
       def link_to_variant(image, variant_id)

data/app/jobs/spree/imports/create_categories_job.rb

@@ -2,7 +2,7 @@ module Spree
   module Imports
     class CreateCategoriesJob < Spree::Imports::BaseJob
       # Concurrent imports can race on `with_matching_name(...).first || create!(...)`
-      # for the same taxonomy/taxon name and hit the unique index; a retry then finds
+      # for the same category name and hit the unique index; a retry then finds
       # the peer's committed row.
       retry_on ActiveRecord::RecordNotUnique, wait: :polynomially_longer, attempts: 5
 
@@ -11,28 +11,37 @@ module Spree
         store = Spree::Store.find(store_id)
 
         with_store_content_locale(store) do
-          taxons = taxon_pretty_names.filter_map { |taxon_pretty_name| find_or_create_taxon(store, taxon_pretty_name) }
-          product.taxons = taxons
+          categories = taxon_pretty_names.filter_map { |taxon_pretty_name| find_or_create_category(store, taxon_pretty_name) }
+          product.categories = categories
         end
       end
 
       private
 
-      def find_or_create_taxon(store, taxon_pretty_name)
-        taxon_names = taxon_pretty_name.strip.split('->').map(&:strip).map(&:presence).compact
-        return if taxon_names.empty?
+      # Walks a "Men -> Clothing -> Shirts" path, creating each missing level as a
+      # store-owned category. The first segment becomes a top-level category.
+      def find_or_create_category(store, taxon_pretty_name)
+        category_names = taxon_pretty_name.strip.split('->').map(&:strip).map(&:presence).compact
+        return if category_names.empty?
 
-        taxonomy_name = taxon_names.shift
-        taxonomy = store.taxonomies.with_matching_name(taxonomy_name).first || store.taxonomies.create!(name: taxonomy_name)
+        category_names.inject(nil) do |parent, category_name|
+          siblings = store.categories.where(parent: parent)
 
-        last_taxon = taxonomy.root
-
-        taxon_names.each do |taxon_name|
-          last_taxon = taxonomy.taxons.with_matching_name(taxon_name).where(parent: last_taxon).first ||
-                       taxonomy.taxons.create!(name: taxon_name, parent: last_taxon)
+          siblings.with_matching_name(category_name).first ||
+            find_by_permalink(siblings, parent, category_name) ||
+            store.categories.create!(name: category_name, parent: parent)
         end
+      end
+
+      # Uniqueness is on the permalink, and distinct names can normalize to the
+      # same slug ("Foo Bar" and "Foo-Bar" both become "foo-bar"). Matching on
+      # name alone would miss that row and then fail creating a duplicate.
+      def find_by_permalink(siblings, parent, category_name)
+        slug = category_name.to_s.to_url
+        return if slug.blank?
 
-        last_taxon
+        permalink = parent.present? ? "#{parent.permalink}/#{slug}" : slug
+        siblings.find_by(permalink: permalink)
       end
     end
   end