spree_square 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de9d79909bb37dc35374d1b512f5e015f2e29f37b6aafe9948ee9cc5eb870c2a
-  data.tar.gz: aa8065c6c9c5fd613f97f1fcf5ba827bb5a4f6083dfd1259ed723b0214fe40ef
+  metadata.gz: 25d852608d74d0163f8216bfe8daaa44b0d0cff76612deb563aaee475fbf6fc7
+  data.tar.gz: d5d1b302b8713ef27a7b89a58490225b2903a3e6f263ba23efc6822983facb90
 SHA512:
-  metadata.gz: 6eab08d920ac2cee2dd52da0d728294733393b4b7c2f48ebe3c4f38f7a1b5f9f8e469569125d7843b58e38f6ea097aba71937da4f88a854fc1ec7a2c043b75a5
-  data.tar.gz: f56a193327ddf7ed32f34cfd31e1a47ca2f5a3d91506797d9278bcb0acfdb7f3fa5e1cb1a3889aa63a1baa1877cd151e6b15249cfb959a88b287003d141db21f
+  metadata.gz: c16da8f9c347d08bc694092c3babb2bda2a96c483d1972ce83b24f578893715357f8d2fa36f6a476969b9589abab4b635e5ba73776e373a8e50073c7a3db6c20
+  data.tar.gz: 8c6681d1a46fefe6fce793f03d6f6a3a668618f3e958691dd27fbb8b8f25dae061ffebdb38daccbc57d1174d700342e9124307e7dc66916a8c55d837295c3e63

data/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project are documented here.
 
+## 0.2.1
+
+Fixes a real bug in `v0.2.0`, found running it against production traffic (not caught by specs —
+sandbox/local dev has no registered webhook to race against): the concurrency fix for the composite
+tax category race (see `v0.2.0`'s own changelog entry) was itself Postgres-only
+(`pg_advisory_xact_lock`), breaking outright on the gem's own SQLite/MySQL-tested dummy app, and
+production actually hit the race it was meant to prevent — this rake task's own `CatalogImporter.call`
+ran concurrently with a real `catalog.version.updated` webhook Square's own `update_item_taxes` call
+fired back mid-run, leaving 44 products correctly on one "Sales Tax" category and 1 stray product on a
+duplicate with its own duplicate rate (same 8% amount either way — no wrong tax charged, but a real
+data duplication). Replaced with `SpreeSquare::TaxCombination`, a real unique index raced via
+`create_or_find_by!` — portable across every adapter this gem supports. `v0.2.0` is yanked; upgrade
+directly to this version.
+
 ## 0.2.0
 
 - **Sales tax, sourced from Square's own catalog tax config.** Square's Catalog API has no concept

data/app/models/spree_square/tax_combination.rb

@@ -0,0 +1,31 @@
+module SpreeSquare
+  # One row per distinct combination of Square tax ids an item carries at
+  # once, keyed by `signature` (sorted, comma-joined SpreeSquare::TaxMapping
+  # ids) — the race-safe find-or-create key `create_or_find_by!` needs. See
+  # CatalogObjectMapper#composite_tax_category for why this exists: without
+  # a real unique index to race against, two concurrent imports resolving
+  # the same combination for the first time could each create their own
+  # Spree::TaxCategory.
+  class TaxCombination < Spree.base_class
+    self.table_name = 'spree_square_tax_combinations'
+
+    belongs_to :tax_category, class_name: 'Spree::TaxCategory'
+
+    # Deliberately NO `uniqueness: true` here — that's a validation-layer
+    # SELECT-then-INSERT check with exactly the same race this table exists
+    # to close. `create_or_find_by!` (see CatalogObjectMapper#
+    # composite_tax_category) depends on the real DB-level unique index
+    # (the migration's `add_index ... unique: true`) raising
+    # ActiveRecord::RecordNotUnique on the losing INSERT, which is the one
+    # thing it explicitly rescues — a uniqueness validation raises
+    # RecordInvalid instead, which it does not, and defeats the whole
+    # point (confirmed live: adding this validation back made the second,
+    # non-racing call in this file's own idempotency spec raise instead of
+    # transparently finding the row).
+    validates :signature, presence: true
+
+    def self.signature_for(tax_mapping_ids)
+      tax_mapping_ids.sort.join(',')
+    end
+  end
+end

data/app/services/spree_square/catalog_object_mapper.rb

@@ -313,33 +313,47 @@ module SpreeSquare
       # will resolve it correctly once the tax itself is known.
       return non_taxable_category if tax_mappings.empty?
 
-      existing_category_id = matching_composite_category_id(tax_mappings)
-      return Spree::TaxCategory.find(existing_category_id) if existing_category_id
-
-      create_composite_tax_category!(tax_mappings)
+      category = composite_tax_category(tax_mappings)
+      ensure_tax_rates!(category, tax_mappings)
+      category
     end
 
-    def matching_composite_category_id(tax_mappings)
-      target_ids = tax_mappings.map(&:id)
-      candidates = SpreeSquare::TaxCategoryMapping.where(tax_mapping_id: target_ids)
-                                                    .group(:tax_category_id)
-                                                    .having('COUNT(*) = ?', target_ids.size)
-                                                    .pluck(:tax_category_id)
-
-      # The HAVING above only proves the candidate contains at least
-      # `target_ids.size` of OUR mappings — it doesn't rule out the
-      # candidate having MORE members than that (a superset, e.g. a
-      # 3-tax category when the item only carries 2 of those taxes).
-      # Confirm an exact match before reusing it.
-      candidates.find do |tax_category_id|
-        SpreeSquare::TaxCategoryMapping.where(tax_category_id: tax_category_id).count == target_ids.size
+    # A real bug found running this against production: the same catalog
+    # import can run concurrently more than once (this rake task's own
+    # `CatalogImporter.call` racing a real `catalog.version.updated`
+    # webhook that Square's own `update_item_taxes` call fires back mid-run
+    # — sandbox/local dev, with no registered webhook, never exercises
+    # this). Two processes each finding "no matching category yet" and
+    # independently creating one left two "Sales Tax" categories with
+    # duplicate rates. `SpreeSquare::TaxCombination#signature` is a real
+    # unique index — `create_or_find_by!` races against it exactly the way
+    # Rails intends (portable across Postgres/MySQL/SQLite, unlike a
+    # database-specific advisory lock): the losing side's block-created
+    # Spree::TaxCategory rolls back with it (create_or_find_by! wraps the
+    # attempt in its own transaction) and it transparently re-finds what
+    # the winner created instead.
+    def composite_tax_category(tax_mappings)
+      signature = SpreeSquare::TaxCombination.signature_for(tax_mappings.map(&:id))
+
+      # `create_or_find_by!`'s block runs while *building* the record, before
+      # the create attempt that its own race-safety depends on — so it can
+      # run more than once even with no real race at all (confirmed live: a
+      # second, non-concurrent call in the same process re-runs this block
+      # and only then discovers the TaxCombination already exists). The
+      # block itself must therefore be safe to run repeatedly — plain
+      # `Spree::TaxCategory.create!` isn't, since core validates `name`
+      # uniqueness and a second run raises `RecordInvalid` before this
+      # method's own race-safety ever gets a chance to matter.
+      combination = SpreeSquare::TaxCombination.create_or_find_by!(signature: signature) do |c|
+        name = tax_mappings.map(&:name).join(' + ').presence || 'Square Tax'
+        c.tax_category = Spree::TaxCategory.find_by(name: name) || Spree::TaxCategory.create!(name: name)
       end
+
+      combination.tax_category
     end
 
-    def create_composite_tax_category!(tax_mappings)
+    def ensure_tax_rates!(category, tax_mappings)
       zone = tax_zone!
-      name = tax_mappings.map(&:name).join(' + ').presence || 'Square Tax'
-      category = Spree::TaxCategory.find_by(name: name) || Spree::TaxCategory.create!(name: name)
 
       tax_mappings.each do |tm|
         next if SpreeSquare::TaxCategoryMapping.exists?(tax_category_id: category.id, tax_mapping_id: tm.id)
@@ -353,9 +367,14 @@ module SpreeSquare
           calculator_type: 'Spree::Calculator::DefaultTax'
         )
         SpreeSquare::TaxCategoryMapping.create!(tax_category: category, tax_mapping: tm, tax_rate: rate)
+      rescue ActiveRecord::RecordNotUnique
+        # A concurrent import created this exact (category, tax) row first
+        # (same class of race `composite_tax_category` guards against, just
+        # a narrower window) — the orphaned rate this attempt already
+        # created never got a join row and is safe to drop; the other
+        # side's row is what matters.
+        rate&.destroy
       end
-
-      category
     end
 
     def non_taxable_category

data/db/migrate/20260820190001_create_spree_square_tax_combinations.rb

@@ -0,0 +1,22 @@
+class CreateSpreeSquareTaxCombinations < ActiveRecord::Migration[8.1]
+  def change
+    # Resolves the race `create_composite_tax_category!` used to have: two
+    # concurrent imports (this rake task's own CatalogImporter.call racing a
+    # real catalog.version.updated webhook Square fires back mid-run —
+    # confirmed live against production, never exercised by sandbox/local
+    # dev with no registered webhook) each finding "no matching category
+    # yet" and independently creating one. `signature` is a unique,
+    # deterministic key for one exact combination of Square tax ids
+    # (sorted, joined) — `create_or_find_by!` against it is a portable
+    # (Postgres/MySQL/SQLite) race-safe find-or-create, unlike a
+    # Postgres-only advisory lock.
+    create_table :spree_square_tax_combinations do |t|
+      t.string :signature, null: false
+      t.references :tax_category, null: false, foreign_key: { to_table: :spree_tax_categories }
+
+      t.timestamps
+    end
+
+    add_index :spree_square_tax_combinations, :signature, unique: true
+  end
+end

data/lib/spree_square/version.rb

@@ -1,5 +1,5 @@
 module SpreeSquare
-  VERSION = '0.2.0'.freeze
+  VERSION = '0.2.1'.freeze
 
   def gem_version
     Gem::Version.new(VERSION)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_square
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Amit Solanki
@@ -143,6 +143,7 @@ files:
 - app/models/spree_square/order_mapping.rb
 - app/models/spree_square/product_modifier_list.rb
 - app/models/spree_square/tax_category_mapping.rb
+- app/models/spree_square/tax_combination.rb
 - app/models/spree_square/tax_mapping.rb
 - app/models/spree_square/taxon_mapping.rb
 - app/models/spree_square/webhook_event.rb
@@ -187,6 +188,7 @@ files:
 - db/migrate/20260810180001_create_spree_square_credentials.rb
 - db/migrate/20260820180001_create_spree_square_tax_mappings.rb
 - db/migrate/20260820180002_create_spree_square_tax_category_mappings.rb
+- db/migrate/20260820190001_create_spree_square_tax_combinations.rb
 - lib/generators/spree_square/install/install_generator.rb
 - lib/spree_square.rb
 - lib/spree_square/configuration.rb