spree_cm_commissioner 2.13.2 → 2.13.3.pre.pre2

data/app/controllers/spree/api/v2/storefront/transit/item_availabilities_controller.rb

@@ -0,0 +1,66 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module Transit
+          class ItemAvailabilitiesController < ::Spree::Api::V2::ResourceController
+            include SpreeCmCommissioner::Integrations::InventorySyncCachable
+
+            def create
+              sync_result = sync_item_availability!
+
+              unless sync_result.success?
+                error_message = sync_result.to_h.dig(:error, :message) || 'Sync failed'
+                return render_error_payload(error_message, 422)
+              end
+
+              item_availability = SpreeCmCommissioner::ItemAvailabilitySync.new(
+                id: trip.id,
+                last_sync_at: sync_result.last_synced_at
+              )
+              render_serialized_payload { serialize_resource(item_availability) }
+            rescue ActiveRecord::RecordNotFound => e
+              render_error_payload(e.message, 404)
+            end
+
+            private
+
+            def trip
+              @trip ||= SpreeCmCommissioner::Trip.find(params[:trip_id])
+            end
+
+            def integration
+              @integration ||= trip.vendor&.integration
+            end
+
+            def sync_item_availability!
+              # Return success result if vendor has no integration
+              return SpreeCmCommissioner::Integrations::Base::SyncResult.new if integration.nil?
+
+              # Check cache first for successful results only
+              cached_result = Rails.cache.read(sync_cache_key)
+              return cached_result if cached_result
+
+              # Perform sync
+              result = integration.sync_item_availability!(trip_id: trip.id, on_date: params[:on_date])
+
+              # Only cache successful results to avoid sticky failures
+              Rails.cache.write(sync_cache_key, result, expires_in: sync_cache_ttl) if result.success?
+
+              result
+            end
+
+            def sync_cache_key
+              # Include trip.updated_at to auto-bust cache when trip is updated by background syncs
+              "item_availability_syncs:#{trip.id}:#{params[:on_date]}:#{trip.updated_at.to_i}"
+            end
+
+            def resource_serializer
+              SpreeCmCommissioner::V2::Storefront::ItemAvailabilitySyncSerializer
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/checkout_controller.rb

@@ -26,6 +26,17 @@ module Spree
             render_order(result)
           end
 
+          # Like `advance`, but stops at `payment` (see SpreeCmCommissioner::Checkout::AdvanceToPayment).
+          def advance_to_payment
+            return render_serialized_payload { serialized_current_order } if spree_current_order.complete?
+
+            spree_authorize! :update, spree_current_order, order_token
+
+            result = SpreeCmCommissioner::Checkout::AdvanceToPayment.call(order: spree_current_order)
+
+            render_order(result)
+          end
+
           def complete
             return render_serialized_payload { serialized_current_order } if spree_current_order.confirm? || spree_current_order.complete?
 

data/app/controllers/spree/api/v2/tenant/vendor_photos_controller.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class VendorPhotosController < BaseController
+          def index
+            collection = scope.page(params[:page]).per(params[:per_page])
+
+            render_serialized_payload do
+              serialize_collection(collection)
+            end
+          end
+
+          def scope
+            current_vendor.photos.includes(attachment_attachment: :blob)
+          end
+
+          def collection_serializer
+            Spree::V2::Tenant::AssetSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree_cm_commissioner/admin/orders_controller_decorator.rb

@@ -10,7 +10,7 @@ module SpreeCmCommissioner
           close_adjustments cart channel set_channel
           accept_all reject_all alert_request_to_vendor
           notifications fire_notification queue_webhooks_requests update_order_status
-          update_internal_note
+          update_internal_note line_items
         ]
 
         base.before_action :initialize_notification_methods, only: %i[
@@ -82,6 +82,14 @@ module SpreeCmCommissioner
 
       def notifications; end
 
+      # Rendered lazily into a turbo_frame from the orders index (see line_items.html.erb),
+      # since eager-loading every order's line items on the index would be wasteful.
+      def line_items
+        @line_items = @order.line_items.includes(:event, variant: :product)
+
+        render layout: false
+      end
+
       def update_internal_note
         internal_note = params.dig(:order, :internal_note).to_s.strip.presence
         @order.update_columns(internal_note: internal_note, updated_at: Time.current) # rubocop:disable Rails/SkipsModelValidations

data/app/controllers/spree_cm_commissioner/api/v2/storefront/checkout_controller_decorator.rb

@@ -5,6 +5,9 @@ module SpreeCmCommissioner
         module CheckoutControllerDecorator
           def self.prepended(base)
             base.include SpreeCmCommissioner::OrderConcern
+            base.include SpreeCmCommissioner::TurnstileProtectable
+
+            base.before_action -> { verify_turnstile! }, only: %i[create_payment]
             # Sets Current.load_test_bypass from the X-Request-Verify secret so
             # InventoryHolds::ValidateLimits can skip anti-abuse checks for trusted load tests.
             base.include SpreeCmCommissioner::LoadTestBypassable
@@ -20,6 +23,18 @@ module SpreeCmCommissioner
 
             super
           end
+
+          # Like `advance`, but stops at `payment` (see SpreeCmCommissioner::Checkout::AdvanceToPayment) so the
+          # client can attach a payment before confirming.
+          def advance_to_payment
+            return render_serialized_payload { serialized_current_order } if spree_current_order.complete?
+
+            spree_authorize! :update, spree_current_order, order_token
+
+            result = SpreeCmCommissioner::Checkout::AdvanceToPayment.call(order: spree_current_order)
+
+            render_order(result)
+          end
         end
       end
     end

data/app/factory/spree_cm_commissioner/order_telegram_message_factory.rb

@@ -200,10 +200,14 @@ module SpreeCmCommissioner
       grouped.map { |nationality_group, guests| customer_type_summary(nationality_group, guests) }.join(', ')
     end
 
-    # e.g. "Local (Adult x1, Child x1)". age_group is NOT NULL, so it is always present.
+    # e.g. "Local (Adult x1, Child x1)". `cm_saved_guests.age_group` is declared `null: false` in
+    # the migration, but a dev/staging DB whose column predates that migration (added via
+    # `add_column ... if_not_exists: true`, which silently skips the constraint if the column
+    # already exists) can still carry real NULL rows - group those under "Unknown" rather than
+    # crashing the whole order-completion Telegram notification on nil.humanize.
     def customer_type_summary(nationality_group, guests)
       age_breakdown = guests
-                      .group_by { |sg| sg.age_group.humanize }
+                      .group_by { |sg| sg.age_group&.humanize || 'Unknown' }
                       .map { |age_group, age_guests| "#{age_group} x#{age_guests.count}" }
                       .join(', ')
 

data/app/helpers/spree/admin/customer_notifications_helper.rb

@@ -0,0 +1,57 @@
+# Builds the audience description shown in the "Send to All" confirmation modal.
+# This help to clarify who will receive the notification based on the notification's taxons and vendor.
+# 1. No vendor and no taxons: sent to all BookMe+ users, excluding tenant users
+# 2. Has taxons: sent to users who bought a ticket for those specific events
+# 3. Has vendor, vendor has no tenant: sent to users who bought a ticket for any of the vendor's events
+# 4. Has vendor, vendor has a tenant: sent to all users in that tenant
+
+module Spree
+  module Admin
+    module CustomerNotificationsHelper
+      def send_all_description(notification)
+        if notification.taxons.any?
+          send_all_taxons_description(notification)
+        elsif notification.vendor.present?
+          send_all_vendor_description(notification.vendor)
+        else
+          content_tag(:p, 'This notification will be sent to all BookMe+ users, excluding tenant users.')
+        end
+      end
+
+      private
+
+      def send_all_taxons_description(notification)
+        content_tag(:div) do
+          concat('This notification will be sent to everyone who bought the ticket from these events:')
+          concat(
+            content_tag(:ul) do
+              safe_join(notification.taxons.map { |taxon| content_tag(:li, taxon_link(taxon)) })
+            end
+          )
+        end
+      end
+
+      def send_all_vendor_description(vendor)
+        content_tag(:p) do
+          if vendor.tenant.present?
+            safe_join(['This notification will be sent to all users in Tenant ', tenant_link(vendor.tenant), '.'])
+          else
+            safe_join(['This notification will be sent to everyone who bought a ticket for any event from vendor ', vendor_link(vendor), '.'])
+          end
+        end
+      end
+
+      def taxon_link(taxon)
+        link_to(taxon.name, edit_admin_taxonomy_taxon_path(taxon.taxonomy_id, taxon.id))
+      end
+
+      def vendor_link(vendor)
+        link_to(vendor.name, edit_admin_vendor_path(vendor.slug))
+      end
+
+      def tenant_link(tenant)
+        link_to(tenant.name, edit_admin_tenant_path(tenant.slug))
+      end
+    end
+  end
+end

data/app/helpers/spree_cm_commissioner/admin/homepage_segment_helper.rb

@@ -1,35 +1,57 @@
 module SpreeCmCommissioner
   module Admin
     module HomepageSegmentHelper
+      # Bootstrap has only eight badge colors, so later segments share one; the label tells them apart.
+      SEGMENT_BADGE_COLORS = {
+        general: 'primary',
+        ticket: 'secondary',
+        tour: 'info',
+        accommodation: 'warning',
+        things_to_do: 'success',
+        football: 'dark',
+        show: 'danger',
+        bus: 'light',
+        intercity_taxi: 'warning',
+        rails: 'secondary',
+        ferry: 'info'
+      }.freeze
+
       def badge_class_for_segment(segment_name)
-        case segment_name.to_sym
-        when :general
-          'badge badge-primary text-uppercase'
-        when :ticket
-          'badge badge-secondary text-uppercase'
-        when :tour
-          'badge badge-info text-uppercase'
-        when :accommodation
-          'badge badge-warning text-uppercase'
-        when :things_to_do
-          'badge badge-success text-uppercase'
-        when :football
-          'badge badge-dark text-uppercase'
-        when :show
-          'badge badge-danger text-uppercase'
-        else
-          'badge'
-        end
+        color = SEGMENT_BADGE_COLORS[segment_name.to_sym]
+        color ? "badge badge-#{color} text-uppercase" : 'badge'
+      end
+
+      def badge_class_for_mini_app(_mini_app_name)
+        'badge badge-info text-uppercase'
+      end
+
+      def mini_app_label(mini_app_name)
+        mini_app_name.to_s.titleize
+      end
+
+      # `none` is any value outside BIT_MINI_APP, which filter_by_mini_app reads as untagged.
+      def mini_app_filter_options
+        [['No mini app', 'none']] +
+          SpreeCmCommissioner::HomepageSectionBitwise::BIT_MINI_APP.keys.map { |name| [mini_app_label(name), name] }
       end
 
       def calculate_segment_value(params)
-        segment_params = params.slice(*SpreeCmCommissioner::HomepageSectionBitwise::BIT_SEGMENT.keys)
+        calculate_bitwise_value(params, SpreeCmCommissioner::HomepageSectionBitwise::BIT_SEGMENT)
+      end
+
+      def calculate_mini_app_value(params)
+        calculate_bitwise_value(params, SpreeCmCommissioner::HomepageSectionBitwise::BIT_MINI_APP)
+      end
+
+      private
 
-        return nil unless segment_params.values.any?
+      # Sums the checked boxes into one integer. Keyed by name, not position, so a checkbox the
+      # form omits cannot shift the rest onto the wrong bits. Returns 0, never nil: `value & bit`
+      # raises on NULL.
+      def calculate_bitwise_value(params, bit_map)
+        return 0 if params.blank?
 
-        segment_params.values.each_with_index.sum do |value, index|
-          value.to_i * (2**index)
-        end
+        bit_map.sum { |name, bit_value| ActiveModel::Type::Boolean.new.cast(params[name]) ? bit_value : 0 }
       end
     end
   end

data/app/interactors/spree_cm_commissioner/customer_notification_sender.rb

@@ -54,21 +54,30 @@ module SpreeCmCommissioner
         .where(cm_notifications: { id: nil })
     end
 
+    # Resolves the base user scope for the notification: by its taxons, by its vendor's own
+    # taxons (when the vendor has no tenant), or by tenant otherwise
     def end_users
-      users_scope = Spree.user_class
-                         .where(tenant_id: notification_tenant_id)
-
       if customer_notification.notification_taxons.exists?
         taxon_ids = customer_notification.notification_taxons.pluck(:taxon_id)
-        users_scope = SpreeCmCommissioner::UsersByEventFetcherQuery
-                      .new(taxon_ids)
-                      .call
-                      .end_users_push_notificable
-                      .where(tenant_id: notification_tenant_id)
+        users_by_taxon_ids(taxon_ids)
+      elsif notification_tenant_id.nil? && customer_notification.vendor.present?
+        taxon_ids = customer_notification.vendor.taxons.ids
+        users_by_taxon_ids(taxon_ids)
       else
-        users_scope = users_scope.end_users_push_notificable
+        Spree.user_class
+             .where(tenant_id: notification_tenant_id)
+             .end_users_push_notificable
       end
+    end
 
+    # Fetches push-notificable users who purchased under the given taxon(s), scoped to the
+    # notification's tenant when it has one
+    def users_by_taxon_ids(taxon_ids)
+      users_scope = SpreeCmCommissioner::UsersByEventFetcherQuery
+                    .new(event_id: taxon_ids)
+                    .call
+                    .end_users_push_notificable
+      users_scope = users_scope.where(tenant_id: notification_tenant_id) if notification_tenant_id.present?
       users_scope
     end
 

data/app/interactors/spree_cm_commissioner/user_cross_app_handoff_authenticator.rb

@@ -0,0 +1,17 @@
+# Resolves a user from a cross-app handoff JWT (see CrossAppHandoffTokens::Decode) instead of a
+# username/password pair. Routed here by UserAuthenticator when the grant_type=password request
+# carries a `handoff_token` param — used by the operator app to sign a user in after the customer
+# app minted the token on their behalf (purpose: operator_sign_in).
+module SpreeCmCommissioner
+  class UserCrossAppHandoffAuthenticator < BaseInteractor
+    delegate :handoff_token, to: :context
+
+    def call
+      result = SpreeCmCommissioner::CrossAppHandoffTokens::Decode.call(token: handoff_token, purpose: 'operator_sign_in')
+      context.fail!(message: I18n.t('authenticator.incorrect_login')) unless result.success?
+
+      context.user = result.value[:user]
+      reject_unauthenticatable_user!(context.user)
+    end
+  end
+end

data/app/jobs/spree_cm_commissioner/audit_event_job.rb

@@ -0,0 +1,29 @@
+module SpreeCmCommissioner
+  class AuditEventJob < ApplicationUniqueJob
+    def perform(options = {})
+      SpreeCmCommissioner::AuditEvent.create!(
+        event_type: options[:event_type],
+        success: options.fetch(:success, true),
+        auditable: options[:auditable],
+        user: options[:user],
+        correlation_id: options[:correlation_id],
+        attempt: options.fetch(:attempt, 0),
+        metadata: options.fetch(:metadata, {}),
+        retention_until: options[:retention_until]
+      )
+    rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotSaved => e
+      # Log validation errors but don't retry - these are data issues, not transient failures
+      CmAppLogger.log(
+        label: 'AuditEventJob validation failed - non-retryable',
+        data: {
+          event_type: options[:event_type],
+          error_class: e.class.name,
+          error_message: e.message,
+          validation_errors: e.record&.errors&.full_messages
+        }
+      )
+      # Return nil to indicate the job completed (but audit wasn't saved)
+      nil
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/audit_wrapper.rb

@@ -0,0 +1,139 @@
+module SpreeCmCommissioner
+  # AuditWrapper is a reusable mixin for classes that make external API calls.
+  #
+  # It wraps an API call in a three-event lifecycle:
+  #   1. <event_base>.request  – logged before the call
+  #   2. <event_base>.response – logged after a successful call (includes timing)
+  #   3. <event_base>.failed   – logged when the block raises, then re-raises
+  #
+  # Metadata follows this canonical shape:
+  #   {
+  #     request:  { method:, endpoint:, body:, params: },
+  #     response: { status:, body: },
+  #     timing:   { duration_ms: },
+  #     error:    nil | { message: }
+  #   }
+  #
+  # Usage:
+  #   include SpreeCmCommissioner::AuditWrapper
+  #
+  #   with_audit(
+  #     event_base: 'bookmebus.order.hold',
+  #     request:    { method: 'POST', endpoint: '/api/v2/trip_reservations', body: body },
+  #     auditable:  order,
+  #     user:       current_user
+  #   ) do
+  #     post("#{BASE_PATH}/trip_reservations", body)
+  #   end
+
+  module AuditWrapper
+    extend ActiveSupport::Concern
+
+    def with_audit(event_base:, request: {}, auditable: nil, user: nil, # rubocop:disable Metrics/ParameterLists
+                   attempt: 0, retention_days: nil
+    )
+      correlation_id = SecureRandom.uuid
+
+      shared = {
+        auditable: auditable,
+        user: user,
+        correlation_id: correlation_id,
+        attempt: attempt,
+        retention_days: retention_days
+      }
+
+      # 1. Log the outbound request
+      AuditLogger.log!(
+        **shared,
+        event_type: "#{event_base}.request",
+        success: true,
+        metadata: build_request_metadata(request)
+      )
+
+      started_at = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      result     = yield
+      duration   = elapsed_ms(started_at)
+
+      # 2. Log the successful response
+      AuditLogger.log!(
+        **shared,
+        event_type: "#{event_base}.response",
+        success: true,
+        metadata: build_response_metadata(request, result, duration)
+      )
+
+      result
+    rescue StandardError => e
+      duration = elapsed_ms(started_at || Process.clock_gettime(Process::CLOCK_MONOTONIC))
+
+      # 3. Log the failure event
+      AuditLogger.log!(
+        **shared,
+        event_type: "#{event_base}.failed",
+        success: false,
+        metadata: build_error_metadata(request, e, duration)
+      )
+
+      raise
+    end
+
+    private
+
+    def build_request_metadata(request)
+      {
+        request: normalize_request(request),
+        response: nil,
+        timing: nil,
+        error: nil
+      }
+    end
+
+    def build_response_metadata(request, result, duration_ms)
+      status, body = extract_response(result)
+
+      {
+        request: normalize_request(request),
+        response: { status: status, body: body },
+        timing: { duration_ms: duration_ms },
+        error: nil
+      }
+    end
+
+    def build_error_metadata(request, error, duration_ms)
+      {
+        request: normalize_request(request),
+        response: nil,
+        timing: { duration_ms: duration_ms },
+        error: { message: error.message }
+      }
+    end
+
+    def normalize_request(request)
+      {
+        method: request[:method],
+        endpoint: request[:endpoint],
+        body: request[:body],
+        params: request[:params]
+      }
+    end
+
+    # Try to extract status + body from common response objects.
+    # Falls back to inspecting the raw result.
+    def extract_response(result)
+      if result.respond_to?(:status) && result.respond_to?(:body)
+        [result.status, result.body]
+      elsif result.is_a?(Array)
+        # Handle arrays of resource objects
+        [nil, result.map(&:to_h)]
+      elsif result.respond_to?(:to_h)
+        [nil, result.to_h]
+      else
+        [nil, result.inspect]
+      end
+    end
+
+    def elapsed_ms(started_at)
+      ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started_at) * 1000).round(2)
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/homepage_section_bitwise.rb

@@ -2,6 +2,8 @@ module SpreeCmCommissioner
   module HomepageSectionBitwise
     extend ActiveSupport::Concern
 
+    # Append only: [SpreeCmCommissioner::HomepageBackground] maps these keys to an integer enum by
+    # index, so inserting one renumbers every stored background.
     BIT_SEGMENT = {
       general: 0b00001,
       ticket: 0b00010,
@@ -9,7 +11,25 @@ module SpreeCmCommissioner
       accommodation: 0b01000,
       things_to_do: 0b10000,
       football: 0b100000,
-      show: 0b1000000
+      show: 0b1000000,
+      bus: 0b10000000,
+      intercity_taxi: 0b100000000,
+      rails: 0b1000000000,
+      ferry: 0b10000000000
+    }.freeze
+
+    # Keys match the `mini_app` query param the app sends (ApiConstant.miniApp.paramValue).
+    BIT_MINI_APP = {
+      vattanac: 0b001,
+      acleda: 0b010,
+      wing: 0b100
+    }.freeze
+
+    # The feed each mini app's home requests, mirroring `isWing ? BusRoute : HomeRoute` in routes.dart.
+    MINI_APP_HOME_SEGMENT = {
+      vattanac: :general,
+      acleda: :general,
+      wing: :bus
     }.freeze
 
     BIT_SEGMENT.each do |segment, bit_value|
@@ -18,6 +38,12 @@ module SpreeCmCommissioner
       end
     end
 
+    BIT_MINI_APP.each do |mini_app, bit_value|
+      define_method "#{mini_app}?" do
+        mini_app_enabled?(bit_value)
+      end
+    end
+
     def segments
       BIT_SEGMENT.filter_map do |segment_value, bit_value|
         segment_value if segment_enabled?(bit_value)
@@ -27,5 +53,15 @@ module SpreeCmCommissioner
     def segment_enabled?(bit_value)
       segment & bit_value != 0
     end
+
+    def mini_apps
+      BIT_MINI_APP.filter_map do |mini_app_value, bit_value|
+        mini_app_value if mini_app_enabled?(bit_value)
+      end
+    end
+
+    def mini_app_enabled?(bit_value)
+      mini_app.to_i & bit_value != 0
+    end
   end
 end

data/app/models/concerns/spree_cm_commissioner/integrations/inventory_sync_cachable.rb

@@ -0,0 +1,9 @@
+module SpreeCmCommissioner
+  module Integrations
+    module InventorySyncCachable
+      def sync_cache_ttl
+        ENV.fetch('SYNC_CACHE_TTL', '300').to_i.seconds
+      end
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/line_item_open_dated_trippable.rb

@@ -66,11 +66,11 @@ module SpreeCmCommissioner
     end
 
     def redeemed?
-      redeemed_at.present?
+      open_dated? && redeemed_at.present?
     end
 
     def expired?
-      valid_until.present? && valid_until.to_date < Date.current
+      open_dated? && valid_until.present? && valid_until.to_date < Date.current
     end
 
     def can_redeem?

data/app/models/concerns/spree_cm_commissioner/order_state_machine.rb

@@ -9,6 +9,16 @@ module SpreeCmCommissioner
 
       state_machine.before_transition to: :address, do: :hold_order_holds
 
+      # Same transitions core calls create_tax_charge! from (gems/core/app/models/spree/order/checkout.rb,
+      # before_transition to: :payment / from: :address), so this fires twice per checkout, plus
+      # again for orders TransitOrder::Create/DraftOrders::Create already called it on at creation.
+      #
+      # Each run is a destroy_all plus one rule lookup per line item — cheap enough that recomputing
+      # on every step isn't worth guarding against, and it's what keeps the fee correct if a rule or
+      # line item changes between steps.
+      state_machine.before_transition to: :payment, do: :create_service_fee_charge!
+      state_machine.before_transition from: :address, do: :create_service_fee_charge!
+
       # Fails fast, before any of the other before_transition/around_transition work below runs
       # (external-system unstock, Redis unstock, notifications, ...), when the inventory hold has
       # already expired and been released rather than converted — see

data/app/models/concerns/spree_cm_commissioner/phone_number_sanitizer.rb

@@ -10,7 +10,11 @@ module SpreeCmCommissioner
     private
 
     def sanitize_phone_number
-      return if phone_number.blank?
+      if phone_number.blank?
+        self.intel_phone_number = nil
+        self.country_code = nil
+        return
+      end
 
       parser = PhoneNumberParser.call(
         phone_number: phone_number,