dscf-marketplace 0.13.1 → 0.13.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b091f4c61797a9d242e5549085a344206dc178204ce22804531f6b26ef7d01c
-  data.tar.gz: 82cc79832782e83f5be62faf463b9a1e38057b4a1afd1636e2c612008b82b811
+  metadata.gz: 475043853266506246b2775c97fc0fb8a4c361fb7e415ae36b0c30c0a36f6a34
+  data.tar.gz: 5e5045ee415293974c10856a416907a1aeb9434a9e51fed26aecf72ed4ef1339
 SHA512:
-  metadata.gz: 330173378807cfd261103aebcbbaedaf8e14488f03b0ddc50e594abaa7e0500fe146f397a2886e2bef7e6d86d9c7aa6c0f7efe182350bd2867d1469f9cf4e0e1
-  data.tar.gz: 98896fcf395bbeda0d3ad13757a7c925455190ce8d68dba0b7a8f8d266b8ec3b28278d5aee7fe6405b94e7736738a0c9114faa852fffa7c21ed5fef3e1884e2e
+  metadata.gz: 19eb9d280c9b18f8cf07c1532acff967a2bee651bc930f2c24a5142686999308b176d1622ebdbe9be233662fac3ed99bb4f55f2e50b4e3f4ac3bd29bc2e516ff
+  data.tar.gz: a907e0a7fa9aba5f8c14b3eaabc4b47224278bfdc32d758300c20744d12747a546aa846a219386f49e1cc6855fd96adebab43274f6835181fb016bcfbb5e0841

data/app/controllers/dscf/marketplace/orders_controller.rb

@@ -9,7 +9,7 @@ module Dscf
 
         return create_direct_listing_order if direct_listing_request?
 
-        obj = @clazz.new(model_params)
+        obj = @clazz.new(model_params.except(:retailer_id))
         if obj.save
           obj = @clazz.includes(eager_loaded_associations).find(obj.id) if eager_loaded_associations.present?
           includes = default_serializer_includes[:create] || []
@@ -45,6 +45,8 @@ module Dscf
       def confirm
         @obj = find_record
         authorize @obj, :confirm?
+        return render_error("orders.errors.otp_confirmation_required", status: :unprocessable_entity) if @obj.agent_assisted? && !@obj.otp_verified?
+
         if @obj.confirm!
           render_success("orders.success.confirmed", data: @obj)
         else
@@ -52,6 +54,46 @@ module Dscf
         end
       end
 
+      # The agent enters the OTP the retailer received to confirm an
+      # agent-assisted order. This does not touch `status` — it only
+      # unblocks `validate`/`confirm` (see the guards there), keeping the
+      # OTP gate independent of the existing fulfillment state machine.
+      def confirm_agent_order
+        @obj = find_record
+        authorize @obj, :confirm_agent_order?
+        return render_error(errors: "Order was not placed by an agent", status: :unprocessable_entity) unless @obj.agent_assisted?
+
+        otp = @obj.otp_verifications.order(created_at: :desc).first
+        return render_error(errors: "No OTP has been sent for this order", status: :unprocessable_entity) unless otp
+
+        case otp.verify(params[:otp_code])
+        when :verified
+          create_notification_for_order(@obj, :agent_order_confirmed)
+          notify_agent_order_confirmed(@obj)
+          render_success(data: @obj, serializer_options: { include: default_serializer_includes[:show] || [] })
+        when :expired
+          render_error(errors: "OTP has expired, request a new one", status: :unprocessable_entity)
+        when :max_attempts_exceeded
+          render_error(errors: "Too many incorrect attempts, request a new OTP", status: :unprocessable_entity)
+        else
+          render_error(errors: "Incorrect OTP", status: :unprocessable_entity)
+        end
+      end
+
+      def resend_agent_order_otp
+        @obj = find_record
+        authorize @obj, :confirm_agent_order?
+        return render_error(errors: "Order was not placed by an agent", status: :unprocessable_entity) unless @obj.agent_assisted?
+
+        phone = @obj.otp_verifications.order(created_at: :desc).first&.phone ||
+          Dscf::Marketplace::Retailer.find_by(user_id: @obj.ordered_by_id)&.phone
+        return render_error(errors: "No retailer phone number on file for this order", status: :unprocessable_entity) if phone.blank?
+
+        otp = Dscf::Marketplace::OtpVerification.generate_for(@obj, phone: phone)
+        create_notification_for_order(@obj, :agent_order_placed, otp_code: otp.code)
+        render_success(data: @obj, serializer_options: { include: default_serializer_includes[:show] || [] })
+      end
+
       def cancel
         @obj = find_record
         authorize @obj, :cancel?
@@ -107,6 +149,7 @@ module Dscf
       def validate
         obj = find_record
         authorize obj, :validate?
+        return render_error(errors: "Order awaits retailer OTP confirmation", status: :unprocessable_entity) if obj.agent_assisted? && !obj.otp_verified?
 
         Dscf::Marketplace::OrderValidationService.validate(obj)
         create_notification_for_order(obj, :validation_completed)
@@ -283,7 +326,7 @@ module Dscf
       end
 
 
-      def create_notification_for_order(order, action, reason: nil)
+      def create_notification_for_order(order, action, reason: nil, otp_code: nil)
         recipient = order.ordered_by || order.user
         return unless recipient
 
@@ -298,12 +341,16 @@ module Dscf
         when :adjustment_rejected then "Adjustment rejected on order ##{order.id}"
         when :retailer_confirmed then "Retailer confirmed order ##{order.id}"
         when :retailer_rejected then "Retailer cancelled order ##{order.id}"
+        when :agent_order_placed then "Your agent placed order ##{order.id}"
+        when :agent_order_confirmed then "Order ##{order.id} confirmed"
         else "Order ##{order.id} update"
         end
 
         body = case action
         when :supplier_rejected, :retailer_rejected, :supplier_adjusted, :adjustment_rejected
           "Reason: #{reason}" if reason
+        when :agent_order_placed
+          "Your agent placed an order on your behalf. Your confirmation code is #{otp_code}. Share it only with your agent to confirm the order."
         else "Status: #{order.status}"
         end
 
@@ -317,6 +364,22 @@ module Dscf
         Dscf::Core::NotificationService.deliver(notification)
       end
 
+      # After the retailer's OTP confirms an agent-assisted order, both the
+      # agent and the aggregator (the business the order was placed with)
+      # get notified, in addition to the retailer's own notification above.
+      def notify_agent_order_confirmed(order)
+        [ order.agent&.user, order.ordered_to&.user ].compact.each do |recipient|
+          notification = Dscf::Core::Notification.create!(
+            notifiable: order,
+            recipient: recipient,
+            notification_type: :general,
+            title: "Order ##{order.id} confirmed",
+            body: "The retailer confirmed order ##{order.id} via OTP."
+          )
+          Dscf::Core::NotificationService.deliver(notification)
+        end
+      end
+
       private
 
       # Builds one or more direct-listing orders from a cart of one or more
@@ -327,6 +390,9 @@ module Dscf
       # transaction (a multi-vendor cart either checks out completely or not
       # at all — mirrors how the single-item path already behaved).
       def create_direct_listing_order
+        agent_order_retailer = resolve_agent_assisted_retailer!
+        return if performed? # resolve_agent_assisted_retailer! already rendered an error
+
         resolved_items = resolve_direct_listing_items
         return if performed? # resolve_direct_listing_items already rendered an error
 
@@ -337,6 +403,8 @@ module Dscf
           end
         end
 
+        orders.each { |order| send_agent_order_otp(order, agent_order_retailer) } if agent_order_retailer
+
         orders = orders.map { |o| @clazz.includes(eager_loaded_associations).find(o.id) } if eager_loaded_associations.present?
         includes = default_serializer_includes[:create] || []
         options = {include: includes} if includes.present?
@@ -354,6 +422,34 @@ module Dscf
         render_error(error: e.message)
       end
 
+      # When an agent places this order, ordered_by/user must be the
+      # retailer being ordered for — not whatever the client happens to send
+      # as ordered_by_id/user_id — so we resolve it server-side from
+      # retailer_id and overwrite those params. Returns the Retailer (used
+      # afterward for the OTP phone number), or nil for non-agent orders.
+      def resolve_agent_assisted_retailer!
+        return nil if model_params[:agent_id].blank?
+
+        retailer = Dscf::Marketplace::Retailer.find_by(id: model_params[:retailer_id])
+        if retailer.blank?
+          render_error(errors: "Retailer not found", status: :unprocessable_entity)
+          return nil
+        end
+        if retailer.user_id.blank?
+          render_error(errors: "Retailer has no linked user account to order on behalf of", status: :unprocessable_entity)
+          return nil
+        end
+
+        @model_params[:ordered_by_id] = retailer.user_id
+        @model_params[:user_id] = retailer.user_id
+        retailer
+      end
+
+      def send_agent_order_otp(order, retailer)
+        otp = Dscf::Marketplace::OtpVerification.generate_for(order, phone: retailer.phone)
+        create_notification_for_order(order, :agent_order_placed, otp_code: otp.code)
+      end
+
       # Resolves each cart line to its Listing or AggregatorListing + quantity +
       # the business it's ordered to. Falls back to the legacy top-level
       # listing_id/listing_type params when a line doesn't carry its own
@@ -413,7 +509,7 @@ module Dscf
           raise ActiveRecord::RecordInvalid.new(source)
         end
 
-        order = @clazz.new(model_params.except(:order_items_attributes, :listing_id, :listing_type))
+        order = @clazz.new(model_params.except(:order_items_attributes, :listing_id, :listing_type, :retailer_id))
         order.order_type = :direct_listing
         order.status = :pending
         order.ordered_to = items.first[:ordered_to]
@@ -473,6 +569,7 @@ module Dscf
         @model_params ||= params.require(:order).permit(
           :quotation_id, :listing_id, :user_id, :ordered_by_id, :ordered_to_id, :delivery_order_id, :dropoff_address_id,
           :order_type, :status, :fulfillment_type, :payment_method, :received_bank_name, :transaction_reference, :listing_type,
+          :agent_id, :retailer_id,
           order_items_attributes: [ :id, :quotation_item_id, :listing_id, :listing_type, :product_id, :unit_id, :quantity, :unit_price, :status, :_destroy ]
         )
         @model_params[:payment_method] = normalize_payment_method(@model_params[:payment_method]) if @model_params.key?(:payment_method)

data/app/models/dscf/marketplace/order.rb

@@ -23,8 +23,10 @@ module Dscf::Marketplace
     belongs_to :ordered_to, class_name: "Dscf::Core::Business"
     belongs_to :delivery_order, optional: true
     belongs_to :dropoff_address, class_name: "Dscf::Core::Address", optional: true
+    belongs_to :agent, class_name: "Dscf::Marketplace::Agent", optional: true
     has_many :order_items, dependent: :destroy, autosave: true
     has_one :order_invoice, class_name: "Dscf::Marketplace::OrderInvoice", dependent: :destroy
+    has_many :otp_verifications, as: :verifiable, class_name: "Dscf::Marketplace::OtpVerification", dependent: :destroy
     accepts_nested_attributes_for :order_items, allow_destroy: true
 
     validates :order_type, presence: true
@@ -46,7 +48,7 @@ module Dscf::Marketplace
 
     # Ransack configuration for secure filtering
     def self.ransackable_attributes(_auth_object = nil)
-      %w[id quotation_id listing_id user_id ordered_by_id ordered_to_id delivery_order_id dropoff_address_id order_type status fulfillment_type payment_method received_bank_name transaction_reference total_amount created_at updated_at]
+      %w[id quotation_id listing_id user_id ordered_by_id ordered_to_id delivery_order_id dropoff_address_id agent_id order_type status fulfillment_type payment_method received_bank_name transaction_reference total_amount created_at updated_at]
     end
 
     def self.ransackable_associations(_auth_object = nil)
@@ -225,6 +227,19 @@ module Dscf::Marketplace
       end
     end
 
+    # An agent-assisted order (agent_id present) must have its OTP verified
+    # by the retailer before it can enter the normal validate/confirm
+    # pipeline — this gate is intentionally orthogonal to `status`, which
+    # already has an unrelated `waiting_retailer_confirmation` meaning (the
+    # retailer signing off on supplier-proposed adjustments mid-fulfillment).
+    def agent_assisted?
+      agent_id.present?
+    end
+
+    def otp_verified?
+      otp_verifications.verified.exists?
+    end
+
   private
 
     def auto_assign_dropoff_address

data/app/models/dscf/marketplace/otp_verification.rb

@@ -0,0 +1,44 @@
+module Dscf::Marketplace
+  class OtpVerification < ApplicationRecord
+    self.table_name = "dscf_marketplace_otp_verifications"
+
+    # Placeholder until a real SMS/OTP provider is wired up (see
+    # Dscf::Core::NotificationService::Adapters::SmsStub) — every OTP is the
+    # same known code so the flow can be exercised end-to-end without a real
+    # phone. Swapping in random generation later only touches generate_for.
+    DEFAULT_CODE = "123456"
+    TTL = 10.minutes
+    MAX_ATTEMPTS = 5
+
+    belongs_to :verifiable, polymorphic: true
+
+    enum :status, {pending: 0, verified: 1, expired: 2, failed: 3}, default: :pending
+
+    validates :phone, :code, presence: true
+
+    def self.generate_for(verifiable, phone:)
+      verifiable.otp_verifications.pending.update_all(status: statuses[:expired])
+      create!(verifiable: verifiable, phone: phone, code: DEFAULT_CODE, expires_at: TTL.from_now)
+    end
+
+    def verify(code)
+      return :verified if verified?
+      return :expired if past_expiry?
+      return :max_attempts_exceeded if failed? || attempts >= MAX_ATTEMPTS
+
+      increment!(:attempts)
+
+      if code.to_s == self.code
+        update!(status: :verified, verified_at: Time.current)
+        :verified
+      else
+        update!(status: :failed) if attempts >= MAX_ATTEMPTS
+        :invalid
+      end
+    end
+
+    def past_expiry?
+      pending? && expires_at < Time.current
+    end
+  end
+end

data/app/policies/dscf/marketplace/order_policy.rb

@@ -9,6 +9,10 @@ module Dscf
         user.has_permission?("orders.confirm")
       end
 
+      def confirm_agent_order?
+        user.has_permission?("orders.confirm")
+      end
+
       def cancel?
         user.has_permission?("orders.cancel")
       end

data/app/serializers/dscf/marketplace/order_item_serializer.rb

@@ -19,6 +19,10 @@ module Dscf
       end
 
       def source_name
+        # object.source (a polymorphic belongs_to) constantizes source_type
+        # internally and raises on anything that isn't a real class name —
+        # guard against legacy/bad data instead of 500ing the whole response.
+        return nil if object.source_type.present? && object.source_type.safe_constantize.nil?
         return nil unless object.source
         case object.source_type
         when 'Dscf::Marketplace::AggregatorListing'

data/app/serializers/dscf/marketplace/order_serializer.rb

@@ -1,7 +1,7 @@
 module Dscf
   module Marketplace
     class OrderSerializer < ActiveModel::Serializer
-      attributes :id, :quotation_id, :listing_id, :user_id, :ordered_by_id, :ordered_to_id, :delivery_order_id, :dropoff_address_id,
+      attributes :id, :quotation_id, :listing_id, :user_id, :ordered_by_id, :ordered_to_id, :delivery_order_id, :dropoff_address_id, :agent_id,
         :order_type, :status, :workflow_status, :has_validation_issues, :fulfillment_type, :payment_method, :received_bank_name, :transaction_reference, :total_amount,
         :buyer_name, :buyer_phone, :buyer_email, :seller_name, :seller_phone, :seller_email,
         :created_at, :updated_at
@@ -13,6 +13,7 @@ module Dscf
       belongs_to :ordered_to
       belongs_to :delivery_order
       belongs_to :dropoff_address
+      belongs_to :agent
       has_many :order_items
 
       # Retailer's registered display name (users have no name field of their

data/app/services/dscf/marketplace/order_splitting_service.rb

@@ -8,8 +8,19 @@ module Dscf
       # - Other supplier
 
       def self.assign_source(order_item, source_type:, source_id:)
-        order_item.source_type = source_type
-        order_item.source_id = source_id
+        # "self" is the frontend SourcePicker's sentinel for "the aggregator
+        # fulfils it directly" — it is not a real polymorphic class name, so
+        # storing it literally corrupts the source association (any later
+        # read of order_item.source tries "self".constantize and crashes).
+        # A self-fulfilled line has no external source at all: clear it,
+        # matching the frontend's own isAggregatorManaged check (!source_type).
+        if source_type.to_s == "self"
+          order_item.source_type = nil
+          order_item.source_id = nil
+        else
+          order_item.source_type = source_type
+          order_item.source_id = source_id
+        end
         order_item.save!
         order_item
       end

data/config/routes.rb

@@ -137,6 +137,8 @@ Dscf::Marketplace::Engine.routes.draw do
       post "reject_adjustment"
       post "reopen_item"
       post "retailer_confirm"
+      post "confirm_agent_order"
+      post "resend_agent_order_otp"
     end
     collection do
       get "my_orders"

data/db/migrate/20260704000001_add_agent_id_to_dscf_marketplace_orders.rb

@@ -0,0 +1,8 @@
+class AddAgentIdToDscfMarketplaceOrders < ActiveRecord::Migration[8.0]
+  def change
+    add_reference :dscf_marketplace_orders, :agent,
+                  foreign_key: { to_table: :dscf_marketplace_agents },
+                  index: { name: "agent_on_dm_orders_indx" },
+                  null: true
+  end
+end

data/db/migrate/20260704000002_create_dscf_marketplace_otp_verifications.rb

@@ -0,0 +1,19 @@
+class CreateDscfMarketplaceOtpVerifications < ActiveRecord::Migration[8.0]
+  def change
+    create_table :dscf_marketplace_otp_verifications do |t|
+      t.references :verifiable, polymorphic: true, null: false, index: false
+      t.string :phone, null: false
+      t.string :code, null: false
+      t.integer :status, default: 0, null: false
+      t.integer :attempts, default: 0, null: false
+      t.datetime :expires_at, null: false
+      t.datetime :verified_at
+
+      t.timestamps
+    end
+
+    add_index :dscf_marketplace_otp_verifications, %i[verifiable_type verifiable_id],
+      name: "verifiable_on_dm_otp_verifications_indx"
+    add_index :dscf_marketplace_otp_verifications, :status
+  end
+end

data/lib/dscf/marketplace/version.rb

@@ -1,5 +1,5 @@
 module Dscf
   module Marketplace
-    VERSION = "0.13.1".freeze
+    VERSION = "0.13.3".freeze
   end
 end

data/spec/factories/dscf/marketplace/otp_verifications.rb

@@ -0,0 +1,8 @@
+FactoryBot.define do
+  factory :dscf_marketplace_otp_verification, class: "Dscf::Marketplace::OtpVerification" do
+    phone { Faker::PhoneNumber.phone_number }
+    code { Dscf::Marketplace::OtpVerification::DEFAULT_CODE }
+    expires_at { Dscf::Marketplace::OtpVerification::TTL.from_now }
+    association :verifiable, factory: :dscf_marketplace_order
+  end
+end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: dscf-marketplace
 version: !ruby/object:Gem::Version
-  version: 0.13.1
+  version: 0.13.3
 platform: ruby
 authors:
 - Asrat
 bindir: bin
 cert_chain: []
-date: 2026-07-03 00:00:00.000000000 Z
+date: 2026-07-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -459,6 +459,7 @@ files:
 - app/models/dscf/marketplace/order.rb
 - app/models/dscf/marketplace/order_invoice.rb
 - app/models/dscf/marketplace/order_item.rb
+- app/models/dscf/marketplace/otp_verification.rb
 - app/models/dscf/marketplace/product.rb
 - app/models/dscf/marketplace/product_inclusion_request.rb
 - app/models/dscf/marketplace/quotation.rb
@@ -594,6 +595,8 @@ files:
 - db/migrate/20260622000001_add_validation_and_source_fields_to_dscf_marketplace_order_items.rb
 - db/migrate/20260702000001_unify_aggregator_listing_source.rb
 - db/migrate/20260703000001_add_supplier_adjustment_to_dscf_marketplace_order_items.rb
+- db/migrate/20260704000001_add_agent_id_to_dscf_marketplace_orders.rb
+- db/migrate/20260704000002_create_dscf_marketplace_otp_verifications.rb
 - db/seeds.rb
 - lib/dscf/marketplace.rb
 - lib/dscf/marketplace/engine.rb
@@ -617,6 +620,7 @@ files:
 - spec/factories/dscf/marketplace/order_invoices.rb
 - spec/factories/dscf/marketplace/order_items.rb
 - spec/factories/dscf/marketplace/orders.rb
+- spec/factories/dscf/marketplace/otp_verifications.rb
 - spec/factories/dscf/marketplace/product_inclusion_requests.rb
 - spec/factories/dscf/marketplace/products.rb
 - spec/factories/dscf/marketplace/quotation_items.rb