Launch of the S3 Store Development Process

[fthobe]

Introduction into S3-Store

A project to render Solidus EU compliant and fully functional as a standalone web shop.

Introduction

The S3 Project was born out of the necessity to have a variable web store. During our research process several solutions were discarded in favour of a fork of Solidus / Spree, below a summary of our findings:

• Solutions like Shopify or BigCommerce proved to be very strong in the handling of a basic cart but quickly reached limits on more complex operations. While BigCommerce was very strong and feature complete on B2B issues such as price lists and B2B features, it proved to be hard to handle regarding tax compliance and multi store operations. Shopify, while excelling extremely on frontend customisation proved to be too limited in payment methods and checkout customisations.
• Options like WooCommerce or Prestashop came with a massive and old codebase despite requiering many features to be integrated via extensions, that were frequently unstable;
• Magento basically ceased active development after being acquisitioned by Adobe as most of the product and major future developments are paywalled now;
• While Spree (written in rails) seemed to be the most feature complete, the change of license and dependency on only one rather small company seemed to be more feature complete than Solidus, we were worried about continuity and security audits.

As written in the first paragraph we decided to go with Solidus.

Capabilities and Limitations of Solidus

Features

Solidus historically derives from Spree and was hard forked in mid 2010s.

Solidus inherited many logics that made it immedietly attractive for us such as:

1. A solid multi store environment,
2. A very flexible but stable cart,
3. Many extensions outlining or blueprinting features that we needed for marketing or integrations.

A very robust and variable implementation of Categories called Taxonomies are present and Solidus comes with a very variable tax logic and pricing logic that has proven over the past few months to be very easy to adjust.

It has to be said that the entire system is very US centric in sense that functionalities work very well on the American market but need adjustments for the European market.

Limitations of Solidus

Tax Model

The entire tax model works in Europe for a Direct to Consumer webshop. There are significant features lacking though for a B2B shop:

• Reverse Charge mechanisms (completed)
• Price Lists for businesses (WIP)
• Net (no vat / sales tax) and gross (including VAT / sales tax) prices deriving from the same base price (WIP)

Hereby it's important to notice that significant progress has been made and that the logic for taxes was robust enough to easily integrate the features. Pricelists and groups will probably be released in the first half of April 2025 allowing to proceed with net and gross pricing.

Localisation

Solidus comes with basic translation models for the interface derived from i18. There's no support for more sophisticated content strategies though inside the core. When we started the work most of the extensions where broken, we have brought them into a working state by now.

• Multi Language Support for Products and Taxons (completed by bugfixing extension)
• CMS
  • Basic functionality with Blog and Pages
  • Integration with Multilanguage
• Multi Content Support (same merchant multiple shops with same products) (WIP)

Marketing Integrations

• Structured Data & Google
  • Google Analytics
  • Structured Data
    • Implementation on Backend
    • Implementation on Frontend (partial)
• Newsletter
• Alerts
  • Back in Stock (3rd party open source extension)
  • Abandoned Cart

GDPR

Solidus lacks core functionalities regarding GDPR.
Following features need to be implemented:

• Cookie Consent
• Profiling Consent
• Communication Consent
• Consent Registry
• Deletable Addresses *

* Addresses are currently not deletable which is violation of GDPR. While not problematic in the US, this is a challenging situation in Europe.

Security

Solidus has a very solid user system derived from Devise, there are some issues attached to it though:

There's no separation of Admin and user accounts making features like user impersonation complex and Devise is not maintained anymore beyond security updates. The current configuration does not allow an effective way to reach PCI compliance as features are missing:

• Password Complexity
• MFA

Some of those features can be achieved via alternative ways, we have fixed:

• Social Auth (partially solved)
  • Google
  • Github
  • Microsoft
  • X / Twitter

They all allow MFA, allowing effectively MFA by enforcement of social auth.

Desired Outcome

The outcome is to model and implement all features above and integrate them into the core of the S3_Store with the goal of having a fully functional system.