spree_cm_commissioner 2.11.0 → 2.12.0.pre.pre2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 58bbc65915f1f69096fabf6a1778dd9d810ebdbf8e788c2b1597e3b2173f2204
-  data.tar.gz: c32858179db78672e07bc34c5f7395b59b228d5585e35647c3d5486cf0c0ea9c
+  metadata.gz: c7223999a2cd0d551f0694c7cd4103195db0ca0473b7ee577a17be13d6686f5f
+  data.tar.gz: bf3fa4a68bf67915a77bd37b2cc2fdaa7f05bece78be8101b76c786f9d8daad5
 SHA512:
-  metadata.gz: 6493ccc10ddcb0dfae06115f11168207bdee8f8d687367108ba59e41885e10a989f8adcb17a220019039ef3a5c224ab3fe4356c6f1e90ae9130e4a607347e015
-  data.tar.gz: 363d64fd5b2aa2f809163134dd050b85d46d529fe35a34994381c3bc7861acd4f57afab353fdd2772081e019a5f49eb78f4d9141ee9d7a44e06991b07170d764
+  metadata.gz: 7e4b196cc0f1426f4672f511546509ddcbf41981203f8affb32e26df9c2e2f0d08cefefb2530810405fa8d9cdf15f3a680e6ea78fcf0751b0efe7dba25e7ce8d
+  data.tar.gz: 9de8a0f14b88d42174f53d13cf3ac2cf0fd7cf5aea024a31f8e5c8a76aa86dc0dc40ac2f6d5774d7ecc35ca3a54868e4f48fb5084321bbb0c8066138a304669f

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.11.0)
+    spree_cm_commissioner (2.12.0.pre.pre2)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/assets/javascripts/spree_cm_commissioner/backend.js

@@ -12,3 +12,4 @@
 //= require spree_cm_commissioner/location_checkbox_manager
 //= require spree_cm_commissioner/trip_stop_selection
 //= require spree_cm_commissioner/tenant_payment_icon_fields
+//= require spree_cm_commissioner/copy_to_clipboard

data/app/assets/javascripts/spree_cm_commissioner/copy_to_clipboard.js

@@ -0,0 +1,49 @@
+// Copy-to-clipboard for any element carrying data-copy-value.
+//
+// Delegated from document rather than bound per button: the private sales index renders one of these
+// per row, and re-binding on every Turbo page load would stack duplicate listeners on the same nodes.
+//
+// The icon swap is the whole feedback mechanism — without it a click looks like nothing happened.
+document.addEventListener("click", function (event) {
+  const trigger = event.target.closest("[data-copy-value]");
+  if (!trigger) return;
+
+  event.preventDefault();
+  copyText(trigger.dataset.copyValue).then(function () {
+    confirmCopied(trigger);
+  });
+});
+
+// navigator.clipboard needs a secure context, which rules it out on plain-http staging boxes.
+// execCommand is deprecated but is the only thing that works there, so it stays as the fallback.
+function copyText(value) {
+  if (navigator.clipboard && window.isSecureContext) {
+    return navigator.clipboard.writeText(value);
+  }
+
+  const scratch = document.createElement("textarea");
+  scratch.value = value;
+  scratch.setAttribute("readonly", "");
+  scratch.style.position = "fixed";
+  scratch.style.opacity = "0";
+  document.body.appendChild(scratch);
+  scratch.select();
+  document.execCommand("copy");
+  document.body.removeChild(scratch);
+
+  return Promise.resolve();
+}
+
+function confirmCopied(trigger) {
+  const done = trigger.querySelector("[data-copy-done]");
+  const idle = trigger.querySelector("[data-copy-idle]");
+  if (!done || !idle) return;
+
+  idle.style.display = "none";
+  done.style.display = "inline";
+
+  setTimeout(function () {
+    idle.style.display = "inline";
+    done.style.display = "none";
+  }, 1500);
+}

data/app/controllers/spree/admin/inventory_locks_controller.rb

@@ -0,0 +1,134 @@
+module Spree
+  module Admin
+    # Withholds units of one product from public sale.
+    #
+    # Reached only from a private sale — there is no tab or sidebar entry. `create` is the POST target
+    # for the per-variant inputs on Spree::Admin::PrivateSalesController#edit, and `index` is the
+    # date-range screen that page links to for permanent-stock products, where one variant has an
+    # inventory item per date and a single input cannot express the range.
+    #
+    # All the accounting lives in InventoryItems::MoveToLocked — this controller resolves the
+    # product, calls it, and turns its named failures into flash messages.
+    #
+    class InventoryLocksController < Spree::Admin::ResourceController
+      skip_before_action :load_resource
+
+      before_action :load_parent
+
+      # GET /admin/products/:product_id/inventory_locks
+      def index
+        # Only active items can be locked — a past date cannot be sold, so withholding from it
+        # protects nothing (MoveToLocked refuses it outright).
+        # Paginated like every other admin index here: a permanent-stock product has one row per
+        # variant per date, so an unpaginated page is thousands of rows.
+        @inventory_items = @product.inventory_items.active
+                                   .includes(variant: { option_values: :option_type })
+                                   .order(:inventory_date)
+                                   .page(params[:page]).per(50)
+      end
+
+      # POST /admin/products/:product_id/inventory_locks
+      #
+      # One action for both directions: a positive quantity locks, a negative one releases. Applied
+      # across a date range for permanent-stock products, where each date is its own inventory item —
+      # "lock 5" means 5 per date, not 5 across the range.
+      def create
+        items = target_inventory_items
+        return redirect_with_error(:invalid_date_range) if items.nil?
+        return redirect_with_error(:no_inventory_item) if items.empty?
+
+        moved, failed = items.map { |item| move(item) }.partition(&:success?)
+        return redirect_with_error(failed.first.error.value) if moved.empty?
+
+        # Each date is moved independently and nothing can undo one that already went through —
+        # Redis has no rollback. So a mixed outcome says how many landed: a bare error would read as
+        # "nothing changed" while some dates are already locked.
+        if failed.empty?
+          flash[:success] = t('.moved', count: moved.size)
+        else
+          reason = error_sentence(failed.first.error.value)
+          flash[:error] = t('.partially_moved', count: moved.size, total: items.size, reason: reason)
+        end
+
+        redirect_back_to_caller
+      end
+
+      private
+
+      def load_parent
+        # Handled here rather than left to ResourceController's rescue_from: its handler redirects to
+        # collection_url, which for this controller resolves to a route that does not exist
+        # (model_class is InventoryItem, which has no admin resource route) — turning one 500 into
+        # another. An unknown or renamed slug belongs back at the product list.
+        @product = Spree::Product.find_by(slug: params[:product_id])
+        return if @product
+
+        flash[:error] = t('spree.admin.inventory_locks.create.product_not_found')
+        redirect_to spree.admin_products_path
+      end
+
+      def move(inventory_item)
+        SpreeCmCommissioner::InventoryItems::MoveToLocked.call(
+          inventory_item: inventory_item,
+          quantity: params[:quantity],
+          caller_source: "#{self.class.name}#create"
+        )
+      end
+
+      # A date range covers one inventory item per date; without one, ONLY the undated row.
+      #
+      # Never falls back to "every active date". Both callers can omit the range — the private sale's
+      # inline button always does — and a permanent-stock variant has a row per date for a year, so
+      # withholding across all of them because an operator left "To date" empty is unrecoverable:
+      # MoveToLocked's Redis half cannot be rolled back.
+      #
+      # Returns nil for a malformed range so #create can tell it apart from "found nothing".
+      def target_inventory_items
+        scope = @product.inventory_items.active.where(variant_id: params[:variant_id])
+        return scope.where(inventory_date: nil).to_a if params[:from_date].blank? || params[:to_date].blank?
+
+        dates = parsed_date_range
+        return nil if dates.nil?
+
+        scope.where(inventory_date: dates).to_a
+      end
+
+      # nil when either date is unparseable, or when the range runs backwards — both are operator
+      # error, and an empty result would report the misleading "no stock on sale" instead.
+      def parsed_date_range
+        from = params[:from_date].to_date
+        to = params[:to_date].to_date
+        return nil if from > to
+
+        from..to
+      # Date::Error subclasses ArgumentError, so this covers both.
+      rescue ArgumentError
+        nil
+      end
+
+      def redirect_with_error(reason)
+        flash[:error] = error_sentence(reason)
+        redirect_back_to_caller
+      end
+
+      # MoveToLocked's named failures carry their sentences; this controller's own reasons (a variant
+      # with no inventory item) are local. Falls back to the humanized symbol so a new failure name
+      # still reads as English rather than as a missing-translation string.
+      def error_sentence(reason)
+        service_message = t("spree_cm_commissioner.inventory_items.move_to_locked.#{reason}", default: reason.to_s.humanize)
+
+        t(".#{reason}", default: service_message)
+      end
+
+      # Posted from the private sale's edit page for undated stock, and from this screen for
+      # permanent-stock date ranges, so return to whichever asked.
+      def redirect_back_to_caller
+        redirect_back fallback_location: admin_product_inventory_locks_path(@product)
+      end
+
+      def model_class
+        SpreeCmCommissioner::InventoryItem
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/private_sales_controller.rb

@@ -0,0 +1,116 @@
+module Spree
+  module Admin
+    # Managing private sales: which products, sold to whom, until when — and, on edit, how much of
+    # each variant to withhold.
+    #
+    # New is deliberately thin: name, dates and three remote-search pickers, so opening it costs one
+    # query for roles and nothing else. Creating redirects straight to edit, which is where the
+    # allotment is actually set up now that the products are known.
+    #
+    class PrivateSalesController < Spree::Admin::ResourceController
+      # Also on update: ResourceController re-renders :edit when validation fails, and the stock
+      # partial reads these ivars — without this a rejected save is a 500 instead of a form.
+      before_action :load_stock_rows, only: %i[edit update]
+      before_action :load_assignable_roles, only: %i[new create edit update]
+
+      # GET /admin/private_sales
+      def index
+        # Off `collection`, which ResourceController already scoped with accessible_by(current_ability)
+        # — going through model_class directly would discard that.
+        @private_sales = collection.order(created_at: :desc).page(params[:page]).per(25)
+
+        load_audience_names
+      end
+
+      # PATCH /admin/private_sales/:id/revoke
+      #
+      # The point of storing the rule rather than signing it into the URL: one sale dies without
+      # touching the lock, so every other sale drawing on the same stock keeps working.
+      def revoke
+        # @private_sale is already loaded and authorized by ResourceController#load_resource.
+        @private_sale.revoked!
+
+        flash[:success] = t('.revoked')
+        redirect_to admin_private_sales_path
+      end
+
+      private
+
+      # Names for every product, user and role named by the sales ON THIS PAGE, in three queries.
+      # The ids live in jsonb rather than join tables, so there is no association for `includes` to
+      # preload — asking each row for its own would be 3 queries per row.
+      def load_audience_names
+        sales = @private_sales.to_a
+
+        @product_names = Spree::Product.where(id: sales.flat_map(&:product_ids)).pluck(:id, :name).to_h
+        @user_emails = Spree::User.where(id: sales.flat_map(&:user_ids)).pluck(:id, :email).to_h
+        @role_names = Spree::Role.where(id: sales.flat_map(&:role_ids))
+                                 .pluck(:id, :presentation, :name)
+                                 .to_h { |id, presentation, name| [id, presentation.presence || name] }
+      end
+
+      # Straight to edit rather than back to the list: a sale is not usable until stock is withheld
+      # for it, and edit is where that happens. Landing on the index would hide the next step.
+      # non_vendor: a private sale grants access across the store, and this repo's roles include
+      # per-vendor and per-event check-in roles whose `presentation` is only unique within a vendor —
+      # listing them all renders hundreds of indistinguishable duplicate options.
+      def load_assignable_roles
+        @assignable_roles = Spree::Role.non_vendor.order(:name)
+      end
+
+      def location_after_save
+        edit_admin_private_sale_path(@private_sale)
+      end
+
+      # Everything the edit page's per-variant lock controls need, in three queries regardless of how
+      # many products the sale names.
+      #
+      # Only UNDATED inventory items are loaded. A permanent-stock product has one row per date —
+      # hundreds per variant — which no inline control can express and which would make this page as
+      # slow as the table is large. Those link out to the product's own date-range screen instead.
+      def load_stock_rows
+        product_ids = @private_sale.product_ids
+        return @variants_by_product = {} if product_ids.empty?
+
+        @products_by_id = Spree::Product.where(id: product_ids).index_by(&:id)
+
+        # Master is excluded when a product has real variants — it carries no stock of its own there
+        # and would render as a blank row. A product with no variants sells through master, so it is
+        # the fallback. Same rule as Spree::Admin::StockManagementsController.
+        # option_values: :option_type, not just :option_values — sku_and_options_text walks the second
+        # hop, so preloading one level still fires a query per option value.
+        variants = Spree::Variant.where(product_id: product_ids)
+                                 .includes(option_values: :option_type)
+                                 .order(:id)
+        by_product = variants.group_by(&:product_id)
+
+        @variants_by_product = by_product.transform_values do |list|
+          list.reject(&:is_master?).presence || list
+        end
+
+        @inventory_item_by_variant = SpreeCmCommissioner::InventoryItem
+                                     .where(variant_id: @variants_by_product.values.flatten.map(&:id), inventory_date: nil)
+                                     .index_by(&:variant_id)
+      end
+
+      # override — the audience is posted as id arrays by the select2 pickers in _form.
+      def permitted_resource_params
+        params.require(:private_sale)
+              .permit(:name, :expires_at, product_ids: [], role_ids: [], user_ids: [])
+      end
+
+      # override — created_by is ours to set, never the form's.
+      def build_resource
+        model_class.new(created_by: try_spree_current_user)
+      end
+
+      def collection_url(options = {})
+        admin_private_sales_path(options)
+      end
+
+      def model_class
+        SpreeCmCommissioner::PrivateSale
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/operator/check_ins_controller.rb

@@ -10,10 +10,14 @@ module Spree
           CACHE_EXPIRES_IN = 1.minute
 
           def collection
-            @collection ||= SpreeCmCommissioner::CheckIn
-                            .where(checkinable_type: 'Spree::Taxon', checkinable_id: params[:taxon_id])
-                            .page(params[:page])
-                            .per(params[:per_page])
+            @collection ||= if restricted?
+                              SpreeCmCommissioner::CheckIn.none
+                            else
+                              SpreeCmCommissioner::CheckIn
+                                .where(checkinable_type: 'Spree::Taxon', checkinable_id: params[:taxon_id])
+                                .page(params[:page])
+                                .per(params[:per_page])
+                            end
           end
 
           # override
@@ -41,6 +45,20 @@ module Spree
 
           private
 
+          # Non-organizers may only see check-in history for an event they're assigned
+          # to, and only while it's ongoing — once it ends, it becomes organizer-owned
+          # history (admins assign themselves the organizer role explicitly if they
+          # need access). A missing/nonexistent taxon_id is restricted the same way.
+          def restricted?
+            return false if spree_current_user.organizer?
+
+            taxon = Spree::Taxon.find_by(id: params[:taxon_id])
+            return true if taxon.nil?
+            return true unless spree_current_user.events.exists?(id: taxon.id)
+
+            taxon.ended?
+          end
+
           def model_class
             SpreeCmCommissioner::CheckIn
           end

data/app/controllers/spree/api/v2/operator/dashboard_crew_events_controller.rb

@@ -7,7 +7,7 @@ module Spree
 
           def collection
             SpreeCmCommissioner::DashboardCrewEventQuery.new(
-              user_id: spree_current_user.id,
+              user: spree_current_user,
               section: params[:section] || 'incoming'
             ).events
           end

data/app/controllers/spree/api/v2/operator/event_charts_controller.rb

@@ -7,23 +7,31 @@ module Spree
           ADDITIONAL_FIELDS = %i[participation entry_type].freeze
 
           def index
-            kyc_fields = fetch_filtered_kyc_fields
-            types = ADDITIONAL_FIELDS + kyc_fields
-
-            resources = types.map do |type|
-              # Create unique ID by using chart_type as the identifier
-              SpreeCmCommissioner::EventChart.new(
-                id: type.to_s,
-                chart_type: type,
-                product_charts: nil
-              )
-            end
+            resources = if restricted?
+                          []
+                        else
+                          kyc_fields = fetch_filtered_kyc_fields
+                          types = ADDITIONAL_FIELDS + kyc_fields
+
+                          types.map do |type|
+                            # Create unique ID by using chart_type as the identifier
+                            SpreeCmCommissioner::EventChart.new(
+                              id: type.to_s,
+                              chart_type: type,
+                              product_charts: nil
+                            )
+                          end
+                        end
 
             render json: SpreeCmCommissioner::V2::Operator::PieChartEventAggregatorSerializer.new(resources).serializable_hash
           end
 
           def resource
-            @resource = event_chart_aggregator_queries.call
+            @resource = if restricted?
+                          SpreeCmCommissioner::EventChart.new(id: params[:id], chart_type: params[:id] || 'participation', product_charts: [])
+                        else
+                          event_chart_aggregator_queries.call
+                        end
           end
 
           def resource_serializer
@@ -32,6 +40,20 @@ module Spree
 
           private
 
+          # Non-organizers may only see chart data for an event they're assigned to,
+          # and only while it's ongoing — once it ends, it becomes organizer-owned
+          # history (admins assign themselves the organizer role explicitly if they
+          # need access). A missing/nonexistent taxon_id is restricted the same way.
+          def restricted?
+            return false if spree_current_user&.organizer?
+
+            taxon = Spree::Taxon.find_by(id: params[:taxon_id])
+            return true if taxon.nil?
+            return true unless spree_current_user&.events&.exists?(id: taxon.id)
+
+            taxon.ended?
+          end
+
           def event_chart_aggregator_queries
             SpreeCmCommissioner::EventChartQueries.new(
               taxon_id: params[:taxon_id],

data/app/controllers/spree/api/v2/resource_controller_decorator.rb

@@ -18,6 +18,13 @@ module Spree
           request.headers['X-Cm-App-Name']
         end
 
+        # Set by DefaultInterceptor (cm-market-app/packages/core) on every request, across every
+        # app (customer, operator, terminal) that shares it — the single source for device_id,
+        # replacing the old per-endpoint params[:device_id] (never actually sent by any client).
+        def device_id
+          request.headers['X-Cm-Device-Id']
+        end
+
         def required_schema_validation!
           return true if required_schema.nil?
 

data/app/controllers/spree/api/v2/storefront/draft_orders_controller.rb

@@ -10,13 +10,18 @@ module Spree
           # Endpoint: POST /api/v2/storefront/draft_orders
           # Params:
           # - line_items: Array of { variant_id:, quantity:, options: {}, public_metadata: {}, private_metadata: {} } (required)
+          # - st: private sale token granting this order the product's locked stock (optional).
           def create
             result = SpreeCmCommissioner::DraftOrders::Create.call(
               line_items: draft_order_line_items,
               user: spree_current_user,
               store: current_store,
               currency: current_currency,
-              options: { device_id: params[:device_id], last_ip_address: request.remote_ip }
+              options: {
+                device_id: device_id,
+                last_ip_address: request.remote_ip,
+                private_sale_token: params[:st]
+              }
             )
 
             if result.success?

data/app/controllers/spree/api/v2/storefront/private_sale_products_controller.rb

@@ -0,0 +1,34 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        # GET /api/v2/storefront/private_sale_products?st=<private sale token>
+        class PrivateSaleProductsController < ::Spree::Api::V2::Storefront::ProductsController
+          before_action :require_spree_current_user
+          before_action :authorize_private_sale_token!
+
+          private
+
+          attr_reader :private_sale
+
+          def authorize_private_sale_token!
+            result = SpreeCmCommissioner::PrivateSales::Authorize.call(
+              token: params[:st],
+              user: spree_current_user
+            )
+
+            return @private_sale = result.value if result.success?
+
+            render_error_payload(SpreeCmCommissioner::PrivateSales::Authorize.error_message(result.error.value), 403)
+          end
+
+          # override — the token names the products, so the client sends no ids. Returns them as a
+          # collection: one link is an agent's whole allotment across an event, not a single product.
+          def scope(**args)
+            super.where(id: private_sale.product_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/queue_draft_orders_controller.rb

@@ -0,0 +1,60 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class QueueDraftOrdersController < ::Spree::Api::V2::ResourceController
+          # Creating the order (once the job runs) acquires the inventory hold, so honor the
+          # load-test bypass here too, same as DraftOrdersController.
+          include SpreeCmCommissioner::LoadTestBypassable
+
+          # Accepts a draft order request without building it: writes a queued Firestore status
+          # document and schedules the real build (SpreeCmCommissioner::DraftOrders::Create) on a
+          # background job. The app watches the returned document for the eventual outcome
+          # instead of waiting on this request.
+          #
+          # Endpoint: POST /api/v2/storefront/queue_draft_orders
+          # Params: same as POST /api/v2/storefront/draft_orders — line_items: Array of
+          #   { variant_id:, quantity:, options: {}, public_metadata: {}, private_metadata: {} } (required)
+          #   st: private sale token granting this order the product's locked stock (optional).
+          def create
+            result = SpreeCmCommissioner::QueueDraftOrders::Enqueue.call(
+              create_type: 'generic',
+              creation_params: {
+                line_items: draft_order_line_items,
+                user: spree_current_user,
+                store: current_store,
+                currency: current_currency,
+                options: {
+                  device_id: device_id,
+                  last_ip_address: request.remote_ip,
+                  private_sale_token: params[:st]
+                }
+              },
+              locale: I18n.locale.to_s
+            )
+
+            if result.success?
+              render_serialized_payload { result.value }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          private
+
+          # .to_h.deep_symbolize_keys converts every level (including line_items and their nested
+          # options/metadata) from ActionController::Parameters into plain Ruby Hashes with symbol
+          # keys — required because this crosses an ActiveJob serialization boundary
+          # (QueueDraftOrders::ProcessJob), unlike DraftOrdersController's version of this method,
+          # which hands Parameters straight to DraftOrders::Create within the same request.
+          def draft_order_line_items
+            params.permit(line_items: [:variant_id, :quantity, { options: {}, public_metadata: {}, private_metadata: {} }])
+                  .to_h
+                  .deep_symbolize_keys
+                  .fetch(:line_items, [])
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/waiting_room_sessions_controller.rb

@@ -15,7 +15,10 @@ module Spree
               remote_ip: request.remote_ip,
               waiting_guest_firebase_doc_id: params[:waiting_guest_firebase_doc_id],
               page_path: params[:page_path],
-              device_attributes: permitted_device_attributes
+              device_attributes: permitted_device_attributes,
+              bypass_jwt: params[:bypass_jwt],
+              bypass_order_token: request.headers['X-Spree-Order-Token'],
+              user: spree_current_user
             )
 
             if context.success?

data/app/controllers/spree/api/v2/tenant/draft_orders_controller.rb

@@ -7,6 +7,7 @@ module Spree
           # Endpoint: POST /api/v2/tenant/draft_orders
           # Params:
           # - line_items: Array of { variant_id:, quantity:, options: {}, public_metadata: {}, private_metadata: {} } (required)
+          # - st: private sale token granting this order the product's locked stock (optional).
           def create
             result = SpreeCmCommissioner::DraftOrders::Create.call(
               line_items: draft_order_line_items,
@@ -14,7 +15,11 @@ module Spree
               store: current_store,
               currency: current_currency,
               tenant: @tenant,
-              options: { device_id: params[:device_id], last_ip_address: request.remote_ip }
+              options: {
+                device_id: params[:device_id],
+                last_ip_address: request.remote_ip,
+                private_sale_token: params[:st]
+              }
             )
 
             if result.success?

data/app/interactors/spree_cm_commissioner/payment_incomplete_notification_sender.rb

@@ -8,12 +8,23 @@ module SpreeCmCommissioner
       SpreeCmCommissioner::OrderGeneralNotification.with(
         notificable: order,
         title: title,
-        message: message(order)
+        message: message(order),
+        payload: payload(order)
       ).deliver_later(order.user)
     end
 
     private
 
+    # Overrides notification_type so the app can route this tap to the payment screen instead of
+    # the booking details every other OrderGeneralNotification lands on. The screen loads the cart
+    # by token, not by number, so the token has to ride along or the tap has nothing to open.
+    def payload(order)
+      {
+        notification_type: 'payment_incomplete_notification',
+        order_token: order.token
+      }
+    end
+
     def title
       I18n.t('notifications.spree_cm_commissioner.payment_incomplete_notification.title')
     end