spree_cm_commissioner 2.13.1 → 2.13.3.pre.pre1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 709925b9130644b3e39ef1bb01415692019bc72643176593877c42f1a710ff0f
-  data.tar.gz: a336bae1ac6555051a4d6c718d8cce7bb1fcbed67b8bea0a2accb5b96cb8ae1b
+  metadata.gz: 6debbf57a54a0a2fcbc3ba4ee4c3e07045c520377afbd0ad13d6f6fde2120654
+  data.tar.gz: 3c66791879a8187925ac7ecba67437a4e049bce327f7d19ff9f435d0acddd54e
 SHA512:
-  metadata.gz: '0769de948ff5436227d88a348a051a7992956deca52f0a165c4cfa885750b9d672c9192482070d922b52921ded1b080a08c004eb6d33206ae67638ee4eec3a61'
-  data.tar.gz: '09affaee452bf8a04579f43999a2beb71282b0d369109085fa59b63a8851d0c6fb80ad67b9ffc3930542ab6fe9e6b9c500c17b243380b5d33440225e30d8cc02'
+  metadata.gz: f5a7c7f1e396e46ae559484c92900a1180ede361e562b192a0b13abc922779f521fbc093a86d695b760abcc8609e0563785e5fadd285fb919670c0c8816bf5d9
+  data.tar.gz: 124912777c8bacddd0a1f067ab1e6faaa245af600da5343150f4862fd5c9cabdea60e54efddf64e636903a99cb2e0a7143c91647ff34e05a5c0d9d705ff8a5da

data/.env.example

@@ -87,3 +87,4 @@ PAYMENT_INCOMPLETE_NOTIFICATION_DELAY_IN_MINUTES=5  # Delay before notifying a c
 
 # See: app/jobs/spree_cm_commissioner/telegram_alerts/order_integrity_check_job.rb
 ORDER_INTEGRITY_TELEGRAM_ALERT_ENABLED="no"  # Set to yes to enable the order integrity Telegram alert job (off by default to avoid flooding Telegram rate limits during traffic spikes)
+

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.13.1)
+    spree_cm_commissioner (2.13.3.pre.pre1)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/operator/event_authorization.rb

@@ -0,0 +1,19 @@
+module SpreeCmCommissioner
+  module Operator
+    module EventAuthorization
+      extend ActiveSupport::Concern
+
+      private
+
+      # True only when the current user holds the organizer role AND owns the
+      # vendor that `taxon`'s event belongs to — the organizer role alone has no
+      # link to any specific event, so it must be paired with vendor ownership.
+      def organizer_for_event?(taxon)
+        return false if taxon.nil? || taxon.vendor_id.nil? || spree_current_user.nil?
+        return false unless spree_current_user.organizer?
+
+        spree_current_user.vendors.exists?(id: taxon.vendor_id)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -5,6 +5,8 @@ module Spree
 
       before_action :load_tenants, only: [:index]
 
+      helper_method :selected_tenant
+
       def model_class
         SpreeCmCommissioner::HomepageSection
       end
@@ -14,7 +16,13 @@ module Spree
       end
 
       def collection_url
-        admin_homepage_feed_homepage_section_index_url
+        admin_homepage_feed_homepage_section_index_url(tenant_id: params[:tenant_id].presence || @object&.tenant_id)
+      end
+
+      # A new section joins the storefront you were viewing. Reading it from the URL keeps
+      # `tenant_id` out of permitted_resource_params, so the form cannot reassign a storefront.
+      def build_resource
+        model_class.new(tenant_id: params[:tenant_id].presence)
       end
 
       def edit
@@ -41,25 +49,41 @@ module Spree
         @collection = super.order(position: :asc)
         @search = @collection.ransack(params[:q])
 
-        @collection = @search.result
-                             .where(tenant_id: params[:tenant_id].presence || nil)
-                             .page(params[:page])
-                             .per(params[:per_page])
+        # An unknown segment would compare against a nil bit and silently return nothing.
+        scoped = @search.result.where(tenant_id: selected_tenant&.id)
+        scoped = scoped.filter_by_segment(params[:segment]) if valid_segment?(params[:segment])
+        scoped = scoped.filter_by_mini_app(params[:mini_app]) if params[:mini_app].present?
+
+        @collection = scoped.page(params[:page]).per(params[:per_page])
       end
 
       # overrided
       def permitted_resource_params
-        segment_value = helpers.calculate_segment_value(params[:spree_cm_commissioner_homepage_section])
+        object_params = params[:spree_cm_commissioner_homepage_section]
+        segment_value = helpers.calculate_segment_value(object_params)
+        mini_app_value = helpers.calculate_mini_app_value(object_params)
 
         params
           .require(:spree_cm_commissioner_homepage_section)
-          .permit(:title, :description, :active, :tenant_id, :preview)
-          .merge(segment: segment_value)
+          .permit(:title, :description, :active, :preview)
+          .merge(segment: segment_value, mini_app: mini_app_value)
+      end
+
+      # The storefront being viewed; no tenant in the URL means BookMe+. Also gates the mini app
+      # column and form field, which apply to BookMe+ only.
+      def selected_tenant
+        return @selected_tenant if defined?(@selected_tenant)
+
+        @selected_tenant = params[:tenant_id].presence && SpreeCmCommissioner::Tenant.find_by(id: params[:tenant_id])
       end
 
       def load_tenants
         @tenants ||= SpreeCmCommissioner::Tenant.order(:name)
       end
+
+      def valid_segment?(segment)
+        segment.present? && SpreeCmCommissioner::HomepageSectionBitwise::BIT_SEGMENT.key?(segment.to_sym)
+      end
     end
   end
 end

data/app/controllers/spree/admin/integrations_controller.rb

@@ -12,7 +12,9 @@ module Spree
       def enqueue_polling
         sync_type = params[:sync_type].presence || :full
 
-        if @integration.active?
+        if !@integration.supports_polling?
+          flash[:error] = Spree.t('admin.integration_polling_not_supported')
+        elsif @integration.active?
           SpreeCmCommissioner::Integrations::PollingJob.perform_later(
             integration_id: @integration.id,
             sync_type: sync_type
@@ -47,6 +49,7 @@ module Spree
           :full_sync_interval_hours,
           :tenant_id,
           :vendor_id,
+          :oauth_application_id,
           public_metadata: {},
           private_metadata: {}
         )
@@ -62,6 +65,7 @@ module Spree
         @conflict_strategy_options ||= enum_to_options(SpreeCmCommissioner::Integration.conflict_strategies)
         @tenants ||= SpreeCmCommissioner::Tenant.select(:id, :name).order(:name)
         @vendors ||= Spree::Vendor.select(:id, :name).order(:name)
+        @oauth_applications ||= Spree::OauthApplication.select(:id, :name).order(:name)
       end
 
       def enum_to_options(enum_hash)
@@ -69,14 +73,10 @@ module Spree
       end
 
       def integration_type_options
-        files = Dir[SpreeCmCommissioner::Engine.root.join('app/models/spree_cm_commissioner/integrations/*.rb')]
+        types = SpreeCmCommissioner::Integration.types
+        return [[Spree.t(:type), 'SpreeCmCommissioner::Integration']] if types.blank?
 
-        return [[Spree.t(:type), 'SpreeCmCommissioner::Integration']] if files.blank?
-
-        files.map do |path|
-          class_name = "SpreeCmCommissioner::Integrations::#{File.basename(path, '.rb').camelize}"
-          [class_name, class_name]
-        end.sort_by(&:first)
+        types.map { |class_name| [class_name, class_name] }
       end
     end
   end

data/app/controllers/spree/admin/inventory_items_controller.rb

@@ -2,6 +2,7 @@ module Spree
   module Admin
     class InventoryItemsController < StockManagementsController
       before_action :load_parent
+      before_action :reject_external_inventory_edits, only: %i[bulk_update_prices bulk_update_stocks]
 
       # GET /products/:slug/inventory_items/prices?inventory_item_ids=1,2,3
       def prices
@@ -78,6 +79,17 @@ module Spree
 
         redirect_back fallback_location: admin_product_stock_managements_path(@product)
       end
+
+      private
+
+      # The partner owns these per-night stocks and prices; its next update would silently overwrite
+      # an edit made here.
+      def reject_external_inventory_edits
+        return unless @product.variants.includes(vendor: :integration).any?(&:inventory_external_wins?)
+
+        flash[:error] = Spree.t('admin.inventory_external_wins', name: @product.vendor.integration.name)
+        redirect_back fallback_location: admin_product_stock_managements_path(@product)
+      end
     end
   end
 end

data/app/controllers/spree/admin/notification_users_controller.rb

@@ -1,26 +1,58 @@
+# Looks up users targetable by a customer notification, for the "send test" user picker in the modal form.
+
 module Spree
   module Admin
     class NotificationUsersController < Spree::Admin::BaseController
+      RESULTS_LIMIT = 20
+
       def index
         notification = SpreeCmCommissioner::CustomerNotification.find(params[:customer_notification_id])
-        users_with_device_token = fetch_users_with_device_token(notification)
+        scope = fetch_users_with_device_token(notification)
+        users = search(scope, params[:q])
 
-        render json: users_with_device_token.as_json(only: %i[id], methods: %i[display_name])
+        render json: users.limit(RESULTS_LIMIT).as_json(only: %i[id], methods: %i[display_name])
       end
 
       private
 
+      # Filters scope by email or phone number matching query (case-insensitive)
+      def search(scope, query)
+        return scope.none if query.blank?
+
+        term = "%#{Spree::User.sanitize_sql_like(query)}%"
+        scope.where('spree_users.email ILIKE :term OR spree_users.phone_number ILIKE :term', term: term)
+      end
+
+      # Narrows the notification's target users down to those with a registered push device token
       def fetch_users_with_device_token(notification)
+        scope = users_scope_for(notification)
+
+        scope.where(id: registered_user_ids)
+      end
+
+      # User ids that have a device token registered for push notifications
+      def registered_user_ids
+        device_tokens = SpreeCmCommissioner::DeviceToken.where.not(registration_token: nil)
+        device_tokens.select(:user_id)
+      end
+
+      # Resolves the base user scope for a notification: by its taxons, by its vendor's own
+      # taxons (when the vendor has no tenant), or by tenant otherwise
+      def users_scope_for(notification)
+        tenant_id = notification.vendor&.tenant_id
+
         if notification.notification_taxons.present?
-          users = users(notification.notification_taxons.pluck(:taxon_id))
-          users.where(id: SpreeCmCommissioner::DeviceToken.where.not(registration_token: nil).select(:user_id))
+          users(notification.notification_taxons.pluck(:taxon_id))
+        elsif tenant_id.nil? && notification.vendor.present?
+          users(notification.vendor.taxons.ids)
         else
-          Spree::User.where(id: SpreeCmCommissioner::DeviceToken.where.not(registration_token: nil).select(:user_id))
+          Spree::User.where(tenant_id: tenant_id)
         end
       end
 
-      def users(taxon_id)
-        SpreeCmCommissioner::UsersByEventFetcherQuery.new(taxon_id).call
+      # Fetches users who purchased under the given events
+      def users(event_id)
+        SpreeCmCommissioner::UsersByEventFetcherQuery.new(event_id: event_id).call
       end
     end
   end

data/app/controllers/spree/admin/service_fee_rules_controller.rb

@@ -0,0 +1,83 @@
+module Spree
+  module Admin
+    class ServiceFeeRulesController < Spree::Admin::ResourceController
+      helper_method :selected_tenant
+
+      before_action :load_data
+
+      def index
+        @search = model_class.ransack(params[:q])
+        # Same 'chip button' status filter convention as
+        # admin/system/waiting_room_sessions#guests (see guests.html.erb) -- an unrecognized or
+        # missing param falls back to showing everything rather than silently hiding rows.
+        @status = %w[active inactive].include?(params[:status]) ? params[:status] : 'all'
+
+        scope = @search.result
+        scope = scope.where(active: true) if @status == 'active'
+        scope = scope.where(active: false) if @status == 'inactive'
+
+        # Same tenant-dropdown convention as admin/homepage_section#index. tenant_id only ever
+        # gets set on a ruleable-less row (see ServiceFeeRule's tenant_id absence validation), so
+        # picking a specific tenant narrows down to just that tenant's own default rule -- the
+        # default (no param, "BookMe+") view shows tenant_id: nil, i.e. everything except other
+        # tenants' own overrides: the true platform-wide default plus every product/event/vendor
+        # rule (their tenant is already implied by their ruleable, so they never set tenant_id).
+        scope = scope.where(tenant_id: selected_tenant&.id)
+
+        @service_fee_rules = scope.order(ruleable_type: :asc, ruleable_id: :asc, currency: :asc)
+                                  .page(params[:page])
+                                  .per(25)
+      end
+
+      # A new rule inherits the tenant you were browsing under (index's tenant dropdown). Reading
+      # it from the URL keeps `tenant_id` out of permitted_resource_params, so the form can't be
+      # used to reassign a rule to a different tenant after the fact -- same shape as
+      # HomepageSectionController#build_resource.
+      def build_resource
+        model_class.new(tenant_id: params[:tenant_id].presence)
+      end
+
+      private
+
+      def load_data
+        @calculators = model_class.available_calculator_types.sort_by(&:name)
+        @tenants ||= SpreeCmCommissioner::Tenant.order(:name)
+      end
+
+      def selected_tenant
+        return @selected_tenant if defined?(@selected_tenant)
+
+        @selected_tenant = params[:tenant_id].presence && SpreeCmCommissioner::Tenant.find_by(id: params[:tenant_id])
+      end
+
+      def model_class
+        SpreeCmCommissioner::ServiceFeeRule
+      end
+
+      def object_name
+        'spree_cm_commissioner_service_fee_rule'
+      end
+
+      def collection_url
+        admin_service_fee_rules_url
+      end
+
+      def location_after_save
+        edit_admin_service_fee_rule_path(@object)
+      end
+
+      # tenant_id is deliberately excluded here -- see build_resource. It's set once from the URL
+      # at creation time and never reassignable via the form afterwards.
+      def permitted_resource_params
+        params.require(:spree_cm_commissioner_service_fee_rule).permit(
+          :ruleable_type,
+          :ruleable_id,
+          :active,
+          :currency,
+          :calculator_type,
+          calculator_attributes: %i[id preferred_percent preferred_flat_amount]
+        )
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/stock_managements_controller.rb

@@ -99,11 +99,11 @@ module Spree
         @cached_inventory_items = ::SpreeCmCommissioner::RedisStock::CachedInventoryItemsBuilder.new(@product.inventory_items)
                                                                                                 .call
                                                                                                 .index_by(&:inventory_item_id)
-        @reserved_stocks = Spree::LineItem
-                           .affecting_inventory
-                           .where(variant_id: @variants.pluck(:id))
-                           .group('spree_line_items.variant_id')
-                           .sum(:quantity)
+        @purchased_quantities = Spree::LineItem
+                                .affecting_inventory
+                                .where(variant_id: @variants.pluck(:id))
+                                .group('spree_line_items.variant_id')
+                                .sum(:quantity)
       end
 
       def model_class

data/app/controllers/spree/api/switch_cm/base_controller.rb

@@ -0,0 +1,98 @@
+module Spree::Api::SwitchCm
+  # The Booking.com-compatible API channel managers (switch.cm) call under /api/switch_cm.
+  # It's built on ActionController::API rather than Spree's v2 base, whose rescue handlers
+  # answer in JSON:API: a Booking.com connector parses every answer, errors included, as its
+  # family's XML, which Ota::BaseController and Xml::BaseController render.
+  #
+  # One Doorkeeper app per channel manager, presented as a Bearer token from the token
+  # exchange or as HTTP Basic with the app's client id and secret. Booking.com accepted Basic
+  # until 31 Dec 2025, and an older connector may still send it.
+  class BaseController < ActionController::API
+    include ActionController::HttpAuthentication::Basic::ControllerMethods
+
+    before_action :authenticate_switch_cm!
+
+    rescue_from Nokogiri::XML::SyntaxError do
+      render_fault(:bad_request, 'Request body is not well-formed XML')
+    end
+
+    private
+
+    def authenticate_switch_cm!
+      @oauth_application = application_from_bearer || application_from_basic
+      return if @oauth_application.present? && switch_cm_integrations.exists?
+
+      render_fault(:unauthorized, 'Authorization Required')
+    end
+
+    def application_from_bearer
+      doorkeeper_token.application if doorkeeper_token&.accessible?
+    end
+
+    def application_from_basic
+      authenticate_with_http_basic do |client_id, client_secret|
+        application = Spree::OauthApplication.find_by(uid: client_id)
+        application if application&.secret_matches?(client_secret)
+      end
+    end
+
+    def switch_cm_integrations
+      SpreeCmCommissioner::Integrations::SwitchCm.readable.where(oauth_application_id: @oauth_application.id)
+    end
+
+    # nil unless the requested hotel is one of this channel manager's connected hotels.
+    def current_integration
+      return @current_integration if defined?(@current_integration)
+
+      accommodation_id = accommodation_id_from_request
+      @current_integration = accommodation_id.present? ? switch_cm_integrations.find_by(vendor_id: accommodation_id) : nil
+    end
+
+    def require_integration!
+      render_fault(:forbidden, 'Not authorized for this hotel') if current_integration.nil?
+    end
+
+    # Pushes need an active connection: a paused one is still being set up, and the hotel keeps
+    # selling on its own counts until it's activated.
+    def require_active_integration!
+      return render_fault(:forbidden, 'Not authorized for this hotel') if current_integration.nil?
+
+      render_fault(:forbidden, 'This hotel is not active on BookMe+ yet') unless current_integration.active?
+    end
+
+    # Pushes may leave out the hotel id (B.XML never sends one); Booking.com derives it from the
+    # rooms. A room of another channel manager's hotel resolves to a hotel this app can't access.
+    def vendor_id_of_room(room_id)
+      Spree::Variant.where(id: room_id.to_i).pick(:vendor_id) if room_id.present?
+    end
+
+    # Reservation pulls take a comma-separated list of hotel ids, or none for all of this
+    # channel manager's hotels. Unknown ids come back separately, for a warning each, as at
+    # Booking.com; a list with no known hotel at all is refused.
+    def requested_integrations(hotel_ids)
+      ids = hotel_ids.to_s.split(',').map(&:strip).compact_blank
+      scope = switch_cm_integrations.includes(:vendor).order(:vendor_id)
+      return [scope.to_a, []] if ids.empty?
+
+      integrations = scope.where(vendor_id: ids).to_a
+      [integrations, ids - integrations.map { |integration| integration.vendor_id.to_s }]
+    end
+
+    def accommodation_id_from_request
+      raise NotImplementedError, "#{self.class.name} must implement accommodation_id_from_request"
+    end
+
+    def render_fault(_status, _text, code: nil)
+      raise NotImplementedError, "#{self.class.name} must implement render_fault"
+    end
+
+    # Rails parses neither XML nor text/xml bodies into params, so both families read the raw body.
+    def request_document
+      @request_document ||= Nokogiri::XML(request.raw_post) { |config| config.strict.nonet }.tap(&:remove_namespaces!)
+    end
+
+    def ruid
+      request.request_id
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/ota/avail_notifs_controller.rb

@@ -0,0 +1,17 @@
+module Spree::Api::SwitchCm
+  module Ota
+    # POST /api/switch_cm/hotels/ota/OTA_HotelAvailNotif, served by PushesController#create.
+    class AvailNotifsController < PushesController
+      private
+
+      # override
+      def parser_class = SpreeCmCommissioner::Integrations::SwitchCm::Ota::AvailNotifParser
+
+      # override
+      def message_name = 'OTA_HotelAvailNotif'
+
+      # override
+      def response_root = 'OTA_HotelAvailNotifRS'
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/ota/base_controller.rb

@@ -0,0 +1,27 @@
+module Spree::Api::SwitchCm
+  module Ota
+    # Booking.com's OTA family (/hotels/ota/...): a failed request answers with its HTTP status
+    # and an RS document holding only <Errors>.
+    class BaseController < Spree::Api::SwitchCm::BaseController
+      # OTA EWT codes for the Error Type attribute.
+      ERROR_TYPES = { unauthorized: 4, forbidden: 6 }.freeze
+      PROCESSING_ERROR_TYPE = 12
+
+      private
+
+      def response_root
+        raise NotImplementedError, "#{self.class.name} must implement response_root"
+      end
+
+      # override
+      def render_fault(status, text, code: nil)
+        errors = [{ type: ERROR_TYPES.fetch(status, PROCESSING_ERROR_TYPE), code: code, text: text }]
+        render xml: SpreeCmCommissioner::Integrations::SwitchCm::Ota::ResponseBuilder.errors(response_root, errors, ruid: ruid), status: status
+      end
+
+      def render_success(warnings: [], &block)
+        render xml: SpreeCmCommissioner::Integrations::SwitchCm::Ota::ResponseBuilder.success(response_root, ruid: ruid, warnings: warnings, &block)
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/ota/product_notifs_controller.rb

@@ -0,0 +1,44 @@
+module Spree::Api::SwitchCm
+  module Ota
+    class ProductNotifsController < BaseController
+      before_action :require_integration!
+
+      # GET /api/switch_cm/hotels/ota/OTA_HotelProductNotif?HotelCode=
+      # The hotel's rooms and rates, which the channel manager maps to its own ("Refresh Room" in
+      # switch.cm). One HotelProduct per room and rate, like Booking.com's roomrates.
+      def show
+        rooms = SpreeCmCommissioner::Integrations::SwitchCm::RoomCatalog.new(current_integration.vendor).rooms
+
+        render_success do |xml|
+          xml.HotelProducts(HotelCode: current_integration.vendor_id) do
+            rooms.each do |room|
+              xml.HotelProduct do
+                xml.RoomTypes do
+                  xml.RoomType(
+                    RoomTypeCode: room.id,
+                    RoomTypeName: room.name,
+                    MaxOccupancy: room.max_persons,
+                    MaxChildOccupancy: room.max_children
+                  )
+                end
+                xml.RatePlans { xml.RatePlan(RatePlanCode: room.rate_id, RatePlanName: room.rate_name) }
+              end
+            end
+          end
+        end
+      end
+
+      private
+
+      # override
+      def response_root
+        'OTA_HotelProductNotifRS'
+      end
+
+      # override
+      def accommodation_id_from_request
+        params[:HotelCode]
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/ota/pushes_controller.rb

@@ -0,0 +1,46 @@
+module Spree::Api::SwitchCm
+  module Ota
+    # The two OTA push endpoints; subclasses name the parser.
+    class PushesController < BaseController
+      before_action :require_active_integration!
+
+      # POST /api/switch_cm/hotels/ota/OTA_HotelAvailNotif (AvailNotifsController): rooms to sell and open/close
+      # POST /api/switch_cm/hotels/ota/OTA_HotelRateAmountNotif (RateAmountNotifsController): per-night prices
+      # Validated and applied in the request (AcceptPush); the answer is the real outcome.
+      def create
+        result = SpreeCmCommissioner::Integrations::SwitchCm::AcceptPush.call(
+          integration: current_integration,
+          message: message_name,
+          updates: updates,
+          request_id: ruid
+        )
+
+        push_response = SpreeCmCommissioner::Integrations::SwitchCm::Ota::PushResponse.new(root: response_root, result: result.value, ruid: ruid)
+        render xml: push_response.to_xml, status: push_response.http_status
+      end
+
+      private
+
+      def parser_class
+        raise NotImplementedError, "#{self.class.name} must implement parser_class"
+      end
+
+      def message_name
+        raise NotImplementedError, "#{self.class.name} must implement message_name"
+      end
+
+      def parser
+        @parser ||= parser_class.new(request_document)
+      end
+
+      def updates
+        @updates ||= parser.updates
+      end
+
+      # override
+      def accommodation_id_from_request
+        parser.accommodation_id.presence || vendor_id_of_room(updates.first&.room_id)
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/ota/rate_amount_notifs_controller.rb

@@ -0,0 +1,17 @@
+module Spree::Api::SwitchCm
+  module Ota
+    # POST /api/switch_cm/hotels/ota/OTA_HotelRateAmountNotif, served by PushesController#create.
+    class RateAmountNotifsController < PushesController
+      private
+
+      # override
+      def parser_class = SpreeCmCommissioner::Integrations::SwitchCm::Ota::RateAmountNotifParser
+
+      # override
+      def message_name = 'OTA_HotelRateAmountNotif'
+
+      # override
+      def response_root = 'OTA_HotelRateAmountNotifRS'
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/ota/res_modify_notifs_controller.rb

@@ -0,0 +1,31 @@
+module Spree::Api::SwitchCm
+  module Ota
+    # GET and POST /api/switch_cm/hotels/ota/OTA_HotelResModifyNotif, served by
+    # ReservationStreamsController: cancelled reservations, and their acknowledgements.
+    # BookMe+ doesn't modify a reservation's rooms or dates, so this stream only carries
+    # cancellations, including those cancelled before their new-reservation acknowledgement.
+    class ResModifyNotifsController < ReservationStreamsController
+      private
+
+      # override
+      def feed_method = :cancelled_reservations
+
+      # override
+      def acknowledged_status = :cancelled
+
+      # override
+      def notification_root = 'OTA_HotelResModifyNotifRQ'
+
+      # override
+      def response_root = 'OTA_HotelResModifyNotifRS'
+
+      # override
+      def container = :HotelResModifies
+
+      # override
+      def present(presenter, xml)
+        presenter.build_modification(xml)
+      end
+    end
+  end
+end