Spree has just added SSL support using the excellent ssl_requirement plugin written by DHH. Now the credit card payment and order summary pages are served up using HTTPS.

You will need an SSL certificate for your production site (obviously) along with a proper virtual host setup for the 443 port. Don’t forget to use the following to ensure that Mongrel is able to tell which requests are already over HTTPS:

RequestHeader set X_FORWARDED_PROTO 'https'

The default behavior of the ssl_requirement plugin is to not require SSL for any of the pages when running in development mode. If you don’t want to use SSL in production mode, just comment out the ssl_required lines in your controllers. You might also want to check out this interesting blog post by Mike Subelsky for more information on working with SSL in Rails.

Special thanks to Ricardo Shiota Yasuda (shadow11) for providing and testing the patch.

Spree now includes a complete shipping framework that allow you to configure shipping for your exact needs. Shipping is implemented through a combination of zones and calculators. The core shipping extension in Spree adds several columns to the variant table to assist in shipping. Each product variant has a weight, height, width and depth field. There is an assumption of an implicit common unit of measurment for each of these fields.

The core shipping extension also adds a shipping_category field to the Product model. Products can be assigned to zero or one shipping category. The shipping_category field is entirely optional. Shipping calculators can be designed to take advantage of this category information or ignore it entirely.

Each of the shipping methods relies on a calculator to determine the actual shipping costs. Calculators contain a calculate_shipping method to which you pass an Order object. The order contains an Address which is the shipping address as well as LineItems which contain references to the Variants and their quantities.

It is our experience that most applications require very specific logic for their shipping needs. Most open source platforms fall into the trap of trying to integrate a shipping solution that attempts to meet everyone’s needs. Spree takes a different approach. Spree comes with a simple flat rate shipping option as well as the ability to turn off shipping all together (just remove the shipping extension.) It is expected that you will either develop your own shipping extension or use an existing third party extension. Spree puts an emphasis on making it easier to customize the piece that always ends up needing to be customized anyways.

Please see the shipping chapter of the user’s guide for more details. Also, be sure to checkout the extensions listing for more information on all of the shipping and other Spree extensions.

The new openid extension for Spree is now available. The business logic included in this extension provides sensible defaults for various user authentication/creation scenarios. Feel free to fork and modify to taste.

The authorizaiton requests make user of the OpenID Simple Registration Extension 1.0 when possible. So if the OpenID provider supports this specification, then requested user information (by default only email) will be returned as sreg parameters.

User Authentication

Authentication refers to the login screen where the user is asked to supply their email and password (or OpenID.) If the user provides an openid url then they will be taken to the standard login screen for that user’s provider. Upon successful authentication, the url will be checked against existing users in the Spree database. The user is authorized if a record is found with a matching url. (See also auto creation for other scenarios.)

User Creation

If the user successfully authenticates via OpenID but there is no user with a corresponding URL, then Spree will attempt to create a new account automatically. If there is an sreq parameter for email, we first check to see if there is a user with a corresponding email.

If there is a matching email, the user will be presented with a screen and given the opportunity to associate this openid url with their account. In order to do so, the user must enter their original password in order to prevent malicious attempts to hijack another user’s account.

If no matching email is found then Spree will ask the user to “complete” the account creation process by supplying a valid email.

Installation

script/extension install git://github.com/schof/spree-open-id.git

The edge version of Spree now requires Rails 2.1.2. We just upgraded to the latest version of resource_controller which seemed to have resolved issues people were experiencing when attempting to use the earlier Rails 2.1.1 release with Spree.

Since Spree uses SEO friendly permalinks, we need to make a few minor changes to the resource_controller plugin. Those changes are being tracked in a github fork which you may be intersted in using if you require further modifications to resource_controller.

Spree comes with all sorts of default configurations that you will likely want to customize. Many of these values can be changed now through admin screens (those that can’t be changed will be able to shortly once those screens are written.) Once a preference is changed from its default, the value is stored in the database.

It is possible to use a migration to setup these preferences so that you can set the preferences of your site automatically. This is handy when migrating a new series of configurations from a tested development environment to production. You no longer have to remember to manually change these settings, just run the migrations like normal.

For example, the default country in Spree is United States. If you wanted the default country to be Ireland you could add the following to your site extension:

class AddCustomConfigurations < ActiveRecord::Migration
  def self.up
    Spree::Config.set(:default_country_id => 96)
  end

  def self.down
  end
end