spree_cm_commissioner 2.12.8 → 2.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 742162ce28f156432f76f071c6538e682fecfa8008758acc698d283cb2a3742c
-  data.tar.gz: bfafd91f275bc28a16234e3153ee8d83aa5b5040be06acca7850770b2573fe01
+  metadata.gz: b168ef103cb6aec0e7865fc4a752cc2367d526180fd6855bf21f6fba1cc72412
+  data.tar.gz: 05a6401d8ea20de2661c421471a16e0e8e1ace6882178a4f3f1cef0e9825d9b4
 SHA512:
-  metadata.gz: f8c8857a35fe48099949496f9e69c0741ca32a18a05fbc05afafdc1cb5cd7feb3394b3b0158cbb27dea96f585e378f9a4a14c0d2fbac1b8cee6e54c8a51be443
-  data.tar.gz: d8e013c7a5172fabbfea21e83ac52d5231351ed380960e1308b458ad1e7b6cd960bb2ca7a6204b82448f3d494c17cb3eb3ebb9a5d704228b901c789dacef09f2
+  metadata.gz: 6cc975658385143deea2b8f1f8e7ac7b4d9ccfa2ce96054c1968a99fe4a6f3793a09585341bf389d2d9939f1097b4d9e867f62734a1d6aafaef0429628d2c875
+  data.tar.gz: 1baa1785ad8c59d5d3ae287518b19c4e680db6a796678096b31c9e18c7e5c1f856984e18ca19407e478e332a465ed4f0d86f0f3c269378e37e9567bb9e91e46b

data/.env.example

@@ -16,12 +16,21 @@ AWS_CF_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----
 CONTENT_HOST_URL=https://content.bookme.plus
 CONTENT_CACHE_MAX_AGE=7200
 
-WAITING_ROOM_SESSION_SIGNATURE="e6b2********************26e3"
 WAITING_ROOM_SESSION_EXPIRE_DURATION_IN_SECOND=
+WAITING_ROOM_SESSION_MAX_DURATION_IN_SECOND=600
+WAITING_ROOM_BYPASS_HEADROOM_MULTIPLIER=1.1
 WAITING_ROOM_MIN_SESSIONS_COUNT=5
 WAITING_ROOM_DISABLED=no
 WAITING_ROOM_POSITION_STAMP_LIMIT=1000
 WAITING_ROOM_FIRESTORE_BATCH_SIZE=500
+WAITING_ROOM_HEARTBEAT_TTL_SECONDS=180
+WAITING_ROOM_SWEEP_LIMIT=1000
+WAITING_ROOM_SIMULATION_TICK_KEY=
+
+# See: app/services/spree_cm_commissioner/waiting_room/admission/call_guests.rb
+WAITING_ROOM_MAX_CALLS_PER_RUN=200
+WAITING_ROOM_CALL_CHUNK_SIZE=50
+WAITING_ROOM_CALL_CLAIM_TTL_SECONDS=120
 
 # Vattanac Bank
 VATTANAC_AES_SECRET_KEY= ""

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.12.8)
+    spree_cm_commissioner (2.13.0)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/anonymous_booking_guard.rb

@@ -0,0 +1,22 @@
+module SpreeCmCommissioner
+  # Draft-order endpoints let a request through with no `spree_current_user` so guests can book —
+  # but only for products that opt into that via `Product#allow_anonymous_booking`. Include in any
+  # draft-order controller and call `ensure_anonymous_booking_allowed!(products)` before doing any
+  # writes, so a request for a login-required product fails fast with 401 (the app can then
+  # re-authenticate/open login and retry) instead of creating an order no signed-in account owns.
+  module AnonymousBookingGuard
+    extend ActiveSupport::Concern
+
+    private
+
+    # products: [Array<Spree::Product>] every distinct product referenced by this request.
+    # Vacuously passes on an empty/unresolved list — an invalid variant/trip id is the underlying
+    # create service's error to raise, not this guard's.
+    def ensure_anonymous_booking_allowed!(products)
+      return if spree_current_user.present?
+      return if products.all?(&:allow_anonymous_booking)
+
+      raise Doorkeeper::Errors::DoorkeeperError
+    end
+  end
+end

data/app/controllers/concerns/spree_cm_commissioner/waiting_room_authorization.rb

@@ -3,10 +3,6 @@ module SpreeCmCommissioner
     extend ActiveSupport::Concern
 
     included do
-      rescue_from JWT::ExpiredSignature, with: :handle_waiting_room_session_token_error
-      rescue_from JWT::VerificationError, with: :handle_waiting_room_session_token_error
-      rescue_from JWT::DecodeError, with: :handle_waiting_room_session_token_error
-
       before_action :ensure_waiting_room_session_token
     end
 
@@ -15,7 +11,9 @@ module SpreeCmCommissioner
       return if request_from_client?
       return unless required_waiting_room_session?
 
-      JWT.decode(params[:waiting_room_session_token], ENV.fetch('WAITING_ROOM_SESSION_SIGNATURE', nil), true, { algorithm: 'HS256' })
+      return if SpreeCmCommissioner::WaitingRoomSession.active.exists?(token: params[:waiting_room_session_token])
+
+      handle_waiting_room_session_token_error
     end
 
     def required_waiting_room_session?

data/app/controllers/spree/admin/orders/customer_details_controller_decorator.rb

@@ -2,11 +2,37 @@ module Spree
   module Admin
     module Orders
       module CustomerDetailsControllerDecorator
+        # Override
+        def edit
+          super
+          search_for_customer
+        end
+
+        # Persists the customer found by `search_for_customer` right away — no separate
+        # "Update" click, no manual Guest Checkout toggle. `associate_user!` only backfills
+        # bill/ship address when the order doesn't already have one (`||=`), so an order's
+        # existing addresses are left as-is; this is a user swap only.
+        def assign_customer
+          user = tenant_user_scope.find_by(id: params[:user_id])
+
+          if user.nil?
+            flash[:error] = Spree.t(:user_not_found)
+          elsif user.id == @order.user_id
+            flash[:notice] = Spree.t('admin.orders.customer_details.user_already_assigned', email: user.email)
+          else
+            @order.associate_user!(user)
+            flash[:success] = Spree.t('admin.orders.customer_details.user_assigned', email: user.email)
+          end
+
+          redirect_to spree.edit_admin_order_customer_path(@order)
+        end
+
         # Override
         def load_user
-          @user = Spree.user_class.find_by(id: order_params[:user_id]) ||
-            (Spree.user_class.find_by(email: order_params[:email]) if order_params[:email].present?) ||
-            (Spree.user_class.find_by(phone_number: order_params[:phone_number]) if order_params[:phone_number].present?)
+          scope = tenant_user_scope
+          @user = scope.find_by(id: order_params[:user_id]) ||
+            (scope.find_by(email: order_params[:email]) if order_params[:email].present?) ||
+            (scope.find_by(phone_number: order_params[:phone_number]) if order_params[:phone_number].present?)
 
           return if @user
 
@@ -21,6 +47,30 @@ module Spree
             ship_address_attributes: permitted_address_attributes
           )
         end
+
+        private
+
+        # Looks up a candidate to reassign this order to by whatever the admin typed —
+        # email, phone number, or login — the same lookup used for real user sign-in
+        # ([UserIdentity#find_user_by_login]), scoped to the order's own tenant so an
+        # admin can never attach a user from a different tenant. Only sets `@order.email`
+        # in memory (never saved here) — `assign_customer` is what actually persists it,
+        # once the admin confirms the match by clicking Assign.
+        def search_for_customer
+          @customer_search_query = params[:customer_search_query].presence
+          return if @customer_search_query.nil?
+
+          @customer_search_result = Spree.user_class.find_user_by_login(@customer_search_query, @order.tenant_id)
+          @order.email = @customer_search_result.email if @customer_search_result
+        end
+
+        # Same tenant boundary `find_user_by_login` uses — the actual save path (`update`)
+        # must enforce this itself rather than trust the search box above, since a
+        # crafted `order[user_id]`/`order[email]` could otherwise pull in a user from
+        # another tenant.
+        def tenant_user_scope
+          @order.tenant_id.present? ? Spree.user_class.by_tenant(@order.tenant_id) : Spree.user_class.by_non_tenant
+        end
       end
     end
   end

data/app/controllers/spree/admin/stock_managements_controller.rb

@@ -40,24 +40,32 @@ module Spree
         redirect_back fallback_location: admin_product_stock_managements_path(@product)
       end
 
-      # GET /products/:slug/stock_managements/calendar?year=&selected_variant_id=
+      # GET /products/:slug/stock_managements/calendar?year=&selected_option_value_ids[]=
       def calendar
         @year = params[:year].present? ? params[:year].to_i : Time.zone.today.year
 
         from_date = Date.new(@year, 1, 1).beginning_of_year
         to_date = Date.new(@year, 1, 1).end_of_year
 
-        @variants = @product.variants
-        @inventory_items = if params[:selected_variant_id].present?
-                             @product.inventory_items.includes(:variant, :prices).where(
-                               inventory_date: from_date..to_date,
-                               variant_id: params[:selected_variant_id]
-                             ).to_a
-                           else
-                             @product.inventory_items.includes(:variant, :prices).where(
-                               inventory_date: from_date..to_date
-                             ).to_a
-                           end
+        @variant_kind_option_types = Spree::Variants::OptionTypesFinder.new(variant_ids: @product.variants.ids)
+                                                                       .execute.select(&:variant?)
+        @selected_option_value_ids = Array(params[:selected_option_value_ids]).map(&:to_i)
+
+        inventory_items = @product.inventory_items.includes(:variant, :prices).where(
+          inventory_date: from_date..to_date
+        )
+
+        if @selected_option_value_ids.present?
+          variant_ids = SpreeCmCommissioner::Variants::FindByOptionValueIds.new(
+            product: @product, option_value_ids: @selected_option_value_ids
+          ).execute.ids
+          inventory_items = inventory_items.where(variant_id: variant_ids)
+          @matched_variants_count = variant_ids.size
+        else
+          @matched_variants_count = @product.variants.count
+        end
+
+        @inventory_items = inventory_items.to_a
 
         @cached_inventory_items = ::SpreeCmCommissioner::RedisStock::CachedInventoryItemsBuilder.new(@inventory_items)
                                                                                                 .call

data/app/controllers/spree/admin/system/waiting_room_controller.rb

@@ -35,7 +35,7 @@ module Spree
 
         def force_pull
           SpreeCmCommissioner::WaitingRoomLatestSystemMetadataPullerJob.perform_now
-          SpreeCmCommissioner::WaitingGuestsCallerJob.perform_now
+          SpreeCmCommissioner::WaitingRoom::AdvanceQueueJob.perform_now
 
           redirect_back fallback_location: admin_system_waiting_room_path
         end

data/app/controllers/spree/admin/system/waiting_room_sessions_controller.rb

@@ -13,7 +13,7 @@ module Spree
 
         # Kills only the sessions the admin checked (Gmail-style select + delete), instead of the
         # room's whole active set. Firebase's active_sessions/full reflect this only on the next
-        # WaitingGuestsCaller run (they're a once-a-minute mirror, not live).
+        # Admission::CallGuests run (they're a once-a-minute mirror, not live).
         def kill
           ids = Array(params[:ids])
           count = SpreeCmCommissioner::WaitingRoomSession.kill_by_ids!(ids)

data/app/controllers/spree/api/v2/platform/resource_controller_decorator.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Api
+    module V2
+      module Platform
+        # Single reusable entry point for tenant-scoping any Platform API resource: pass
+        # `?tenant_id=X` on the request and the collection is narrowed to that tenant, without each
+        # controller having to wire up its own filter/param handling.
+        #
+        # Tri-state on the param itself:
+        #   - absent: no scoping applied, collection flows through unrestricted (existing callers,
+        #     eg. the products/users pickers in checkouts and private sales, are unaffected).
+        #   - "0": scope to records with no tenant (tenant_id IS NULL) - most vendors today aren't
+        #     attached to a tenant, so this is the common case for tenant-scoped search.
+        #   - any other value: scope to that exact tenant_id.
+        #
+        # Default assumes the model owns a `tenant_id` column directly (true for Spree::User,
+        # Spree::Vendor, SpreeCmCommissioner::HomepageSection - see their `multi_tenant :tenant`
+        # declarations). A model related to tenant only indirectly should override
+        # `scope_by_tenant` in its own controller decorator.
+        module ResourceControllerDecorator
+          def scope
+            base_scope = super
+
+            # Keep the existing behavior when no tenant_id param is passed,
+            # so that existing controllers are unaffected.
+            return base_scope if params[:tenant_id].nil?
+
+            scope_by_tenant(base_scope, params[:tenant_id])
+          end
+
+          private
+
+          def scope_by_tenant(scope, tenant_id)
+            return scope unless scope.klass.column_names.include?('tenant_id')
+
+            if tenant_id.to_s == '0'
+              scope.where(tenant_id: nil)
+            else
+              scope.where(tenant_id: tenant_id)
+            end
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Platform::ResourceController.prepend(Spree::Api::V2::Platform::ResourceControllerDecorator)

data/app/controllers/spree/api/v2/storefront/draft_orders_controller.rb

@@ -5,6 +5,9 @@ module Spree
         class DraftOrdersController < ::Spree::Api::V2::ResourceController
           # Creating the order acquires the inventory hold, so honor the load-test bypass here too.
           include SpreeCmCommissioner::LoadTestBypassable
+          include SpreeCmCommissioner::AnonymousBookingGuard
+
+          before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
 
           # Creates a generic draft order from a locally-assembled cart in a single request.
           # Endpoint: POST /api/v2/storefront/draft_orders
@@ -46,6 +49,11 @@ module Spree
                   .fetch(:line_items, [])
           end
 
+          def draft_order_products
+            variant_ids = draft_order_line_items.pluck(:variant_id).compact
+            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+          end
+
           # override
           def resource_serializer
             Spree::Api::Dependencies.storefront_cart_serializer.constantize

data/app/controllers/spree/api/v2/storefront/intercity_taxi/draft_orders_controller.rb

@@ -6,8 +6,10 @@ module Spree
           class DraftOrdersController < ::Spree::Api::V2::ResourceController
             include Spree::Api::V2::Storefront::OrderConcern
             include SpreeCmCommissioner::OrderConcern
+            include SpreeCmCommissioner::AnonymousBookingGuard
 
             before_action :ensure_order, only: :update
+            before_action -> { ensure_anonymous_booking_allowed!(intercity_taxi_products) }, only: :create
 
             def create
               result = SpreeCmCommissioner::IntercityTaxiOrder::Create.call(
@@ -64,6 +66,11 @@ module Spree
 
             private
 
+            def intercity_taxi_products
+              trip = SpreeCmCommissioner::Trip.find_by(id: params[:trip_id])
+              trip ? [trip.product] : []
+            end
+
             def required_schema
               if action_name == 'create'
                 SpreeCmCommissioner::IntercityTaxiDraftOrderSchema

data/app/controllers/spree/api/v2/storefront/payment_methods_controller.rb

@@ -3,9 +3,10 @@ module Spree
     module V2
       module Storefront
         # Order & user independent catalog of the payment methods a vendor accepts.
-        # Takes vendor_id as a required query param. See
+        # Takes vendor_id as a required query param, and an optional payout param
+        # (caller passes Order#required_payway_payout? — see PaymentMethods::Find). See
         # Spree::Api::V2::Tenant::PaymentMethodsController for the caching caveat
-        # that comes with that, and for what this deliberately leaves out.
+        # that comes with vendor_id, and for what else this deliberately leaves out.
         class PaymentMethodsController < Spree::Api::V2::ResourceController
           # override
           def index
@@ -19,7 +20,8 @@ module Spree
             @collection ||= SpreeCmCommissioner::PaymentMethods::Find.new(
               vendor: vendor,
               store: current_store,
-              type: params[:type]
+              type: params[:type],
+              payout: payout?
             ).execute
           end
 
@@ -33,6 +35,10 @@ module Spree
           def vendor
             @vendor ||= ::Spree::Vendor.active.find(params[:vendor_id])
           end
+
+          def payout?
+            ActiveModel::Type::Boolean.new.cast(params[:payout])
+          end
         end
       end
     end

data/app/controllers/spree/api/v2/storefront/queue_draft_orders_controller.rb

@@ -6,6 +6,9 @@ module Spree
           # Sets Current.load_test_bypass from the X-Request-Verify secret. The hold is acquired later
           # in ProcessJob, so `create` passes this flag through options for the job to restore there.
           include SpreeCmCommissioner::LoadTestBypassable
+          include SpreeCmCommissioner::AnonymousBookingGuard
+
+          before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
 
           # Accepts a draft order request without building it: writes a queued Firestore status
           # document and schedules the real build (SpreeCmCommissioner::DraftOrders::Create) on a
@@ -55,6 +58,11 @@ module Spree
                   .deep_symbolize_keys
                   .fetch(:line_items, [])
           end
+
+          def draft_order_products
+            variant_ids = draft_order_line_items.pluck(:variant_id).compact
+            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+          end
         end
       end
     end

data/app/controllers/spree/api/v2/storefront/transit/draft_orders_controller.rb

@@ -4,6 +4,8 @@ module Spree
       module Storefront
         module Transit
           class DraftOrdersController < ::Spree::Api::V2::ResourceController
+            include SpreeCmCommissioner::AnonymousBookingGuard
+
             # Creates a draft transit order.
             # Endpoint: POST /api/v2/storefront/transit/draft_orders
             # Params:
@@ -15,6 +17,7 @@ module Spree
             def create
               @outbound_legs = params[:outbound_legs].is_a?(Array) && params[:outbound_legs].any? ? build_legs(:outbound, params[:outbound_legs]) : []
               @inbound_legs  = params[:inbound_legs].is_a?(Array) && params[:inbound_legs].any? ? build_legs(:inbound, params[:inbound_legs]) : []
+              ensure_anonymous_booking_allowed!(transit_leg_products)
 
               result = SpreeCmCommissioner::TransitOrder::Create.call(
                 outbound_date: params[:outbound_date]&.to_date,
@@ -36,6 +39,13 @@ module Spree
               SpreeCmCommissioner::Transit::LegsBuilderService.new(direction: direction, legs_params: legs_params).call
             end
 
+            private
+
+            def transit_leg_products
+              variant_ids = (@outbound_legs + @inbound_legs).flat_map(&:seat_selections).map(&:variant_id)
+              Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+            end
+
             # override
             def resource_serializer
               Spree::Api::Dependencies.storefront_cart_serializer.constantize

data/app/controllers/spree/api/v2/storefront/waiting_room_sessions_controller.rb

@@ -10,7 +10,7 @@ module Spree
           skip_before_action :ensure_waiting_room_session_token
 
           def create
-            context = SpreeCmCommissioner::WaitingRoomSessionCreator.call(
+            result = SpreeCmCommissioner::WaitingRoom::Sessions::Issue.call(
               tenant_id: nil,
               remote_ip: request.remote_ip,
               waiting_guest_firebase_doc_id: params[:waiting_guest_firebase_doc_id],
@@ -21,10 +21,10 @@ module Spree
               user: spree_current_user
             )
 
-            if context.success?
-              render_serialized_payload { serialize_resource(context.room_session) }
+            if result.success?
+              render_serialized_payload { serialize_resource(result.value[:room_session]) }
             else
-              render_error_payload(context.message)
+              render_error_payload(result.error)
             end
           end
 
@@ -35,7 +35,7 @@ module Spree
           private
 
           def permitted_device_attributes
-            params.permit(*SpreeCmCommissioner::WaitingRoomSessionCreator::PERMITTED_DEVICE_ATTRIBUTES)
+            params.permit(*SpreeCmCommissioner::WaitingRoom::Sessions::Issue::PERMITTED_DEVICE_ATTRIBUTES)
           end
         end
       end

data/app/controllers/spree/api/v2/tenant/draft_orders_controller.rb

@@ -3,6 +3,10 @@ module Spree
     module V2
       module Tenant
         class DraftOrdersController < BaseController
+          include SpreeCmCommissioner::AnonymousBookingGuard
+
+          before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
+
           # Creates a generic draft order from a locally-assembled cart in a single request.
           # Endpoint: POST /api/v2/tenant/draft_orders
           # Params:
@@ -44,6 +48,11 @@ module Spree
                   .fetch(:line_items, [])
           end
 
+          def draft_order_products
+            variant_ids = draft_order_line_items.pluck(:variant_id).compact
+            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+          end
+
           # override
           def resource_serializer
             Spree::V2::Tenant::CartSerializer

data/app/controllers/spree/api/v2/tenant/intercity_taxi/draft_orders_controller.rb

@@ -6,8 +6,10 @@ module Spree
           class DraftOrdersController < BaseController
             include Spree::Api::V2::Storefront::OrderConcern
             include SpreeCmCommissioner::OrderConcern
+            include SpreeCmCommissioner::AnonymousBookingGuard
 
             before_action :ensure_order, only: :update
+            before_action -> { ensure_anonymous_booking_allowed!(intercity_taxi_products) }, only: :create
 
             def create
               result = SpreeCmCommissioner::IntercityTaxiOrder::Create.call(
@@ -65,6 +67,11 @@ module Spree
 
             private
 
+            def intercity_taxi_products
+              trip = SpreeCmCommissioner::Trip.find_by(id: params[:trip_id])
+              trip ? [trip.product] : []
+            end
+
             def required_schema
               if action_name == 'create'
                 SpreeCmCommissioner::IntercityTaxiDraftOrderSchema

data/app/controllers/spree/api/v2/tenant/payment_methods_controller.rb

@@ -4,9 +4,11 @@ module Spree
       module Tenant
         # Order & user independent catalog of the payment methods a vendor accepts.
         #
-        # vendor_id is a required query param. A vendor id is globally unique and
-        # belongs to exactly one tenant, so it is what identifies tenant, vendor and
-        # store here — the tenant itself comes from the Doorkeeper token, not the URL.
+        # vendor_id is a required query param, and payout is an optional one (caller
+        # passes Order#required_payway_payout? — see PaymentMethods::Find). A vendor id
+        # is globally unique and belongs to exactly one tenant, so it is what identifies
+        # tenant, vendor and store here — the tenant itself comes from the Doorkeeper
+        # token, not the URL.
         #
         # IMPORTANT for caching (see SpreeCmCommissioner::ContentCachable): the CDN
         # must include vendor_id in its cache key. If query strings are stripped,
@@ -14,7 +16,7 @@ module Spree
         # are served. Moving to /vendors/:vendor_id/payment_methods would remove that
         # dependency — tracked as a follow-up.
         #
-        # For the per-order truth (store credit, early adopter, payout filtering)
+        # For the full per-order truth (store credit, early adopter filtering)
         # use CartPaymentMethodGroupsController instead.
         class PaymentMethodsController < BaseController
           # override
@@ -29,7 +31,8 @@ module Spree
             @collection ||= SpreeCmCommissioner::PaymentMethods::Find.new(
               vendor: vendor,
               store: current_store,
-              type: params[:type]
+              type: params[:type],
+              payout: payout?
             ).execute
           end
 
@@ -47,6 +50,10 @@ module Spree
               ::Spree::Vendor.active.find(params[:vendor_id])
             end
           end
+
+          def payout?
+            ActiveModel::Type::Boolean.new.cast(params[:payout])
+          end
         end
       end
     end

data/app/controllers/spree/api/v2/tenant/show_people_controller.rb

@@ -13,9 +13,7 @@ module Spree
           # override
           def scope
             scope = current_show.show_people
-                                .joins(:assignments)
-                                .distinct
-                                .includes(:assignments, :show_person_images)
+                                .includes(:show_person_images)
 
             role = params[:role].presence
             return scope if role.blank?

data/app/controllers/spree/api/v2/tenant/transit/draft_orders_controller.rb

@@ -4,6 +4,8 @@ module Spree
       module Tenant
         module Transit
           class DraftOrdersController < BaseController
+            include SpreeCmCommissioner::AnonymousBookingGuard
+
             # Creates a draft transit order for tenant.
             # Endpoint: POST /api/v2/tenant/transit/draft_orders
             # Params:
@@ -15,6 +17,7 @@ module Spree
             def create
               @outbound_legs = params[:outbound_legs].is_a?(Array) && params[:outbound_legs].any? ? build_legs(:outbound, params[:outbound_legs]) : []
               @inbound_legs  = params[:inbound_legs].is_a?(Array) && params[:inbound_legs].any? ? build_legs(:inbound, params[:inbound_legs]) : []
+              ensure_anonymous_booking_allowed!(transit_leg_products)
 
               result = SpreeCmCommissioner::TransitOrder::Create.call(
                 outbound_date: params[:outbound_date]&.to_date,
@@ -36,6 +39,13 @@ module Spree
               SpreeCmCommissioner::Transit::LegsBuilderService.new(direction: direction, legs_params: legs_params).call
             end
 
+            private
+
+            def transit_leg_products
+              variant_ids = (@outbound_legs + @inbound_legs).flat_map(&:seat_selections).map(&:variant_id)
+              Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+            end
+
             # override
             def resource_serializer
               Spree::V2::Tenant::TransitCartSerializer

data/app/controllers/spree/api/v2/tenant/waiting_room_sessions_controller.rb

@@ -6,7 +6,7 @@ module Spree
           skip_before_action :ensure_waiting_room_session_token
 
           def create
-            context = SpreeCmCommissioner::WaitingRoomSessionCreator.call(
+            result = SpreeCmCommissioner::WaitingRoom::Sessions::Issue.call(
               tenant_id: MultiTenant.current_tenant_id,
               remote_ip: request.remote_ip,
               waiting_guest_firebase_doc_id: params[:waiting_guest_firebase_doc_id],
@@ -14,10 +14,10 @@ module Spree
               device_attributes: permitted_device_attributes
             )
 
-            if context.success?
-              render_serialized_payload { serialize_resource(context.room_session) }
+            if result.success?
+              render_serialized_payload { serialize_resource(result.value[:room_session]) }
             else
-              render_error_payload(context.message)
+              render_error_payload(result.error)
             end
           end
 
@@ -28,7 +28,7 @@ module Spree
           private
 
           def permitted_device_attributes
-            params.permit(*SpreeCmCommissioner::WaitingRoomSessionCreator::PERMITTED_DEVICE_ATTRIBUTES)
+            params.permit(*SpreeCmCommissioner::WaitingRoom::Sessions::Issue::PERMITTED_DEVICE_ATTRIBUTES)
           end
         end
       end

data/app/controllers/spree_cm_commissioner/waiting_room_simulation_operations_controller.rb

@@ -0,0 +1,39 @@
+module SpreeCmCommissioner
+  # The one server-side endpoint the standalone waiting_room_simulation/ CLI needs — everything
+  # else it does directly against Firestore with its own service account (seeding, heartbeats,
+  # reading frontier/lobby state), and session mint/renew already has a real public endpoint
+  # (WaitingRoomSessionsController). This exists only because WaitingRoom::AdvanceQueue is a Ruby
+  # class that only exists inside this Rails app, with no equivalent reachable over Firestore.
+  #
+  # A machine client with no session, so CSRF protection doesn't apply here the way it does for a
+  # browser-originated request — authenticated instead by a shared secret
+  # (WAITING_ROOM_SIMULATION_TICK_KEY), same shape as LoadTestBypassable's X-Request-Verify check.
+  # Unset key => the endpoint 404s entirely, never a default-open state.
+  class WaitingRoomSimulationOperationsController < ApplicationController
+    skip_before_action :verify_authenticity_token
+    before_action :verify_key!
+
+    # AdvanceQueue always runs its full sweep+stamp+call sequence — there's only ever one thing
+    # this endpoint can ask for, so the response always echoes both results. The response returns
+    # before CallGuestsChunkJob finishes writing Firestore — a caller polling for
+    # allow_to_enter_room_at needs to wait a beat.
+    def create
+      advance_result = SpreeCmCommissioner::WaitingRoom::AdvanceQueue.call!.value
+
+      render json: {
+        stamp: { stamped: advance_result[:stamped] },
+        call: { called: true, called_count: advance_result[:called_count] }
+      }
+    end
+
+    private
+
+    def verify_key!
+      key = ENV.fetch('WAITING_ROOM_SIMULATION_TICK_KEY', nil)
+      return head(:not_found) if key.blank?
+
+      provided = request.headers.fetch('X-Waiting-Room-Simulation-Key', nil).to_s
+      head(:unauthorized) unless ActiveSupport::SecurityUtils.secure_compare(provided, key)
+    end
+  end
+end