spree_cm_commissioner 2.13.2 → 2.13.3.pre.pre2

data/app/serializers/spree/v2/storefront/line_item_serializer_decorator.rb

@@ -2,20 +2,26 @@ module Spree
   module V2
     module Storefront
       module LineItemSerializerDecorator
-        def self.prepended(base)
+        def self.prepended(base) # rubocop:disable Metrics/MethodLength
           base.attributes :from_date, :to_date, :need_confirmation, :product_type, :event_status, :amount, :display_amount,
                           :checkin_date, :checkout_date,
                           :number, :qr_data,
                           :kyc, :kyc_fields, :remaining_total_guests, :number_of_guests,
                           :completion_steps, :available_social_contact_platforms, :allow_anonymous_booking, :discontinue_on,
                           :high_demand, :jwt_token,
-                          :direction, :trip_id, :boarding_trip_stop_id, :drop_off_trip_stop_id
+                          :direction, :trip_id, :boarding_trip_stop_id, :drop_off_trip_stop_id,
+                          :service_fee_total, :display_service_fee_total
 
           base.attribute :required_self_check_in_location, &:required_self_check_in_location?
           base.attribute :allowed_self_check_in, &:allowed_self_check_in?
           base.attribute :allowed_upload_later, &:allowed_upload_later?
           base.attribute :delivery_required, &:delivery_required?
           base.attribute :sufficient_stock, &:sufficient_stock?
+          base.attribute :open_dated, &:open_dated?
+          base.attribute :redeemed, &:redeemed?
+          base.attribute :can_redeem, &:can_redeem?
+          base.attribute :expired, &:expired?
+          base.attribute :open_dated_route_label, &:open_dated_route_label
 
           base.attribute :pickup_map_place do |line_item|
             line_item.pickup_map_place&.to_h

data/app/serializers/spree/v2/tenant/cart_serializer.rb

@@ -13,7 +13,8 @@ module Spree
                    :promo_total, :display_promo_total, :item_count, :special_instructions, :display_total,
                    :pre_tax_item_amount, :display_pre_tax_item_amount, :pre_tax_total, :display_pre_tax_total,
                    :shipment_state, :payment_state, :public_metadata,
-                   :phone_number, :intel_phone_number, :country_code, :request_state, :channel
+                   :phone_number, :intel_phone_number, :country_code, :request_state, :channel,
+                   :service_fee_total, :display_service_fee_total
 
         belongs_to :user, serializer: Spree::V2::Tenant::UserSerializer
         belongs_to :billing_address,

data/app/serializers/spree/v2/tenant/line_item_serializer.rb

@@ -11,13 +11,19 @@ module Spree
                    :display_amount, :number, :qr_data, :kyc, :kyc_fields, :remaining_total_guests, :number_of_guests,
                    :completion_steps, :available_social_contact_platforms, :allow_anonymous_booking,
                    :discontinue_on, :high_demand, :jwt_token, :pre_tax_amount, :display_pre_tax_amount, :public_metadata,
-                   :direction, :trip_id, :boarding_trip_stop_id, :drop_off_trip_stop_id, :passenger_count, :remark
+                   :direction, :trip_id, :boarding_trip_stop_id, :drop_off_trip_stop_id, :passenger_count, :remark,
+                   :service_fee_total, :display_service_fee_total
 
         attribute :required_self_check_in_location, &:required_self_check_in_location?
         attribute :allowed_self_check_in, &:allowed_self_check_in?
         attribute :allowed_upload_later, &:allowed_upload_later?
         attribute :delivery_required, &:delivery_required?
         attribute :sufficient_stock, &:sufficient_stock?
+        attribute :open_dated, &:open_dated?
+        attribute :redeemed, &:redeemed?
+        attribute :can_redeem, &:can_redeem?
+        attribute :expired, &:expired?
+        attribute :open_dated_route_label, &:open_dated_route_label
 
         attribute :pickup_map_place do |line_item|
           line_item.pickup_map_place&.to_h

data/app/serializers/spree_cm_commissioner/v2/operator/guest_serializer.rb

@@ -6,7 +6,8 @@ module SpreeCmCommissioner
 
         attributes :first_name, :last_name, :dob, :gender, :kyc_fields, :other_occupation, :created_at, :updated_at,
                    :qr_data, :social_contact_platform, :social_contact, :available_social_contact_platforms, :event_id, :seat_number,
-                   :age, :emergency_contact, :other_organization, :expectation, :upload_later, :address, :formatted_bib_number, :phone_number
+                   :age, :emergency_contact, :other_organization, :expectation, :upload_later, :address, :formatted_bib_number, :phone_number,
+                   :state
 
         attribute :allowed_checkout, &:allowed_checkout?
         attribute :require_kyc_field, &:require_kyc_field?

data/app/serializers/spree_cm_commissioner/v2/storefront/cart_serializer_decorator.rb

@@ -9,7 +9,8 @@ module SpreeCmCommissioner
 
           base.attributes :phone_number, :intel_phone_number, :country_code, :request_state,
                           :term_accepted_at,
-                          :channel, :hold_expires_at
+                          :channel, :hold_expires_at,
+                          :service_fee_total, :display_service_fee_total
 
           base.attribute :has_incomplete_guest_info, &:has_incomplete_guest_info?
           base.attribute :required_payway_payout, &:required_payway_payout?

data/app/serializers/spree_cm_commissioner/v2/storefront/cross_app_handoff_token_serializer.rb

@@ -0,0 +1,9 @@
+module SpreeCmCommissioner
+  module V2
+    module Storefront
+      class CrossAppHandoffTokenSerializer < BaseSerializer
+        attribute :token, :expires_at
+      end
+    end
+  end
+end

data/app/serializers/spree_cm_commissioner/v2/storefront/item_availability_sync_serializer.rb

@@ -0,0 +1,10 @@
+module SpreeCmCommissioner
+  module V2
+    module Storefront
+      class ItemAvailabilitySyncSerializer < BaseSerializer
+        set_type :item_availability_sync
+        attributes :last_sync_at
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/api_caches/invalidate.rb

@@ -148,7 +148,7 @@ module SpreeCmCommissioner
         SpreeCmCommissioner::InvalidateCacheRequestJob.perform_later(patterns: patterns)
       end
 
-      # {:general, :ticket, :tour, :accommodation, :things_to_do, :football}
+      # Every key of BIT_SEGMENT (general, ticket, ..., ferry).
       def homepage_segment
         SpreeCmCommissioner::HomepageSectionBitwise::BIT_SEGMENT.keys
       end

data/app/services/spree_cm_commissioner/audit_logger.rb

@@ -0,0 +1,59 @@
+require_dependency 'spree_cm_commissioner'
+
+module SpreeCmCommissioner
+  # AuditLogger is a safe write-through service for API audit events.
+  #
+  # Usage:
+  #   AuditLogger.log!(
+  #     event_type:     'bookmebus.order.hold.request',
+  #     success:        true,
+  #     metadata:       { request: { method: 'POST', endpoint: '/api/v2/trip_reservations', body: {} } },
+  #     actor:          integration,
+  #     auditable:      order,
+  #     user:           current_user,
+  #     correlation_id: 'uuid',
+  #     attempt:        0,
+  #     retention_days: 90
+  #   )
+  #
+  # This service NEVER raises — any failure is swallowed and logged so it
+  # cannot disrupt the main application flow.
+  class AuditLogger
+    class << self
+      def log!( # rubocop:disable Metrics/ParameterLists
+        event_type:,
+        success: true,
+        metadata: {},
+        auditable: nil,
+        user: nil,
+        correlation_id: nil,
+        attempt: 0,
+        retention_days: nil
+      )
+        retention_until = (retention_days || 90).days.from_now.to_date
+
+        SpreeCmCommissioner::AuditEventJob.perform_later(
+          event_type: event_type,
+          success: success,
+          metadata: metadata,
+          auditable: auditable,
+          user: user,
+          correlation_id: correlation_id,
+          attempt: attempt,
+          retention_until: retention_until
+        )
+      rescue StandardError => e
+        CmAppLogger.error(
+          label: 'AuditLogger failed to persist audit event',
+          data: {
+            event_type: event_type,
+            error_class: e.class.name,
+            error_message: e.message,
+            backtrace: e.backtrace&.first(5)
+          }
+        )
+        nil
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/checkout/advance_to_payment.rb

@@ -0,0 +1,27 @@
+module SpreeCmCommissioner
+  module Checkout
+    # Same as Spree::Checkout::Advance, but stops at `payment` instead of running on to `confirm`.
+    # Lets a client reach the payment step in one call instead of stepping through `next` state by
+    # state -- useful wherever the checkout doesn't need per-state client input in between (e.g. a
+    # top-up order, or a booking flow where guest info is already assigned so there's nothing for
+    # the client to fill in at the address/delivery states).
+    # Fails with the order's error message when it can't get there.
+    class AdvanceToPayment
+      prepend Spree::ServiceModule::Base
+
+      def call(order:)
+        Spree::Dependencies.checkout_next_service.constantize.call(order: order) until cannot_make_transition?(order)
+
+        return success(order) if order.payment?
+
+        failure(order, order.errors.full_messages.to_sentence.presence)
+      end
+
+      private
+
+      def cannot_make_transition?(order)
+        order.payment? || order.confirm? || order.complete? || order.errors.present?
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/cross_app_handoff_tokens/decode.rb

@@ -0,0 +1,42 @@
+# Verifies a token minted by Encode and resolves the user it was signed for. Two-step decode:
+# peek at `sub` without verifying (the signing key is per-user, so the user must be looked up
+# before the signature can be checked), then verify with that user's own secure_token.
+#
+# Also checks the token's `ver` against the user's current cross_app_handoff_version (see
+# Encode) — a mismatch means either a newer token has since been minted (this one is stale) or
+# this exact token was already consumed once (single-use). The check and the bump that follows a
+# match happen inside the same row lock, so two concurrent replays of the same token can't both
+# pass the check before either bumps it.
+module SpreeCmCommissioner
+  module CrossAppHandoffTokens
+    class Decode
+      prepend Spree::ServiceModule::Base
+
+      def call(token:, purpose:)
+        unverified_payload = JWT.decode(token, nil, false).first
+        user = Spree.user_class.find_by(id: unverified_payload['sub'])
+        return failure(nil, 'invalid_token') if user.nil?
+
+        payload = JWT.decode(token, user.secure_token, true, algorithm: Encode::ALGORITHM).first
+        return failure(nil, 'invalid_purpose') unless payload['purpose'] == purpose.to_s
+        return failure(nil, 'invalid_token') unless consume_if_current_version!(user, payload['ver'])
+
+        success(user: user, payload: payload)
+      rescue JWT::DecodeError
+        failure(nil, 'invalid_token')
+      end
+
+      private
+
+      def consume_if_current_version!(user, token_version)
+        user.with_lock do
+          next false unless token_version == user.cross_app_handoff_version
+
+          user.cross_app_handoff_version += 1
+          user.save!
+          true
+        end
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/cross_app_handoff_tokens/encode.rb

@@ -0,0 +1,47 @@
+# Mints a stateless, signed handoff token used to carry an authenticated user's identity into
+# another app/session without a second login — modeled on Users::QrData (signed with the user's
+# own secure_token, so it self-revokes if that column is regenerated) and LoadTest::LoginToken
+# (short-lived JWT verified by signature + expiry alone, no DB row to look up or clean up).
+#
+# `purpose` is locked into the signed payload so a token minted for one hand-off can't be replayed
+# for a different one, even before it expires — `operator_sign_in` (customer app → operator app)
+# and `organizer_web_session` (operator app → organizer web dashboard) exist today. See Decode for
+# the counterpart.
+#
+# `ver` (User#cross_app_handoff_version, a plain public_metadata counter — same shape as
+# Users::QrData's qr_data_version, no migration needed) is bumped here on every mint, so minting a
+# new token immediately invalidates any earlier, not-yet-consumed one for this user. Decode bumps
+# it again on successful consumption, so the token just used can't be replayed either.
+module SpreeCmCommissioner
+  module CrossAppHandoffTokens
+    class Encode
+      prepend Spree::ServiceModule::Base
+
+      TTL = 1.minute
+      ALGORITHM = 'HS256'.freeze
+
+      PURPOSES = %w[operator_sign_in organizer_web_session].freeze
+
+      def call(user:, purpose:)
+        return failure(nil, "invalid purpose: #{purpose}") unless PURPOSES.include?(purpose.to_s)
+
+        bump_version!(user)
+
+        expires_at = TTL.from_now
+        payload = { sub: user.id, purpose: purpose.to_s, ver: user.cross_app_handoff_version, exp: expires_at.to_i }
+
+        success(token: JWT.encode(payload, user.secure_token, ALGORITHM), expires_at: expires_at)
+      end
+
+      private
+
+      def bump_version!(user)
+        user.with_lock do
+          user.cross_app_handoff_version ||= 0
+          user.cross_app_handoff_version += 1
+          user.save!
+        end
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/currency_converter/create.rb

@@ -0,0 +1,27 @@
+module SpreeCmCommissioner
+  module CurrencyConverter
+    # Converts amounts between two currencies using vendor-specific exchange rates
+    class Create
+      attr_reader :vendor, :from_currency, :to_currency, :converted_amount
+
+      def initialize(vendor:, from_currency: 'USD', to_currency: 'USD')
+        @vendor = vendor
+        @from_currency = from_currency.upcase
+        @to_currency = to_currency.upcase
+        @converted_amount = nil
+      end
+
+      # Converts the given amount from one currency to another
+      def call(amount)
+        return amount if from_currency == to_currency || amount.zero?
+
+        rate = vendor.exchange_rate(from_currency, to_currency)
+        raise MissingCurrencyRateError, "No conversion rate from #{from_currency} to #{to_currency} for vendor #{vendor.name}" if rate.nil?
+
+        @converted_amount = (amount * rate).round(2)
+      end
+    end
+
+    class MissingCurrencyRateError < StandardError; end
+  end
+end

data/app/services/spree_cm_commissioner/currency_rates/manage.rb

@@ -0,0 +1,99 @@
+module SpreeCmCommissioner
+  module CurrencyRates
+    # Manages currency rate creation and updates for vendors.
+    # Handles rate deduplication using floating-point tolerance and maintains
+    # a history of rate changes by marking old rates as inactive.
+    #
+    # Example:
+    #   response = Manage.new(
+    #     vendor_id: 1,
+    #     from_currency: 'USD',
+    #     to_currency: 'KHR',
+    #     rate: 4100.50
+    #   ).call
+    #
+    #   if response.success?
+    #     puts response.currency_rate.rate  # => 4100.50
+    #   else
+    #     puts response.error  # => "Rate must be greater than 0"
+    #   end
+    class Manage
+      Response = Struct.new(:success?, :error, :currency_rate, keyword_init: true)
+
+      attr_reader :options, :vendor_id, :from_currency, :to_currency, :rate
+
+      def initialize(options = {})
+        @options = options
+        @vendor_id = options[:vendor_id]
+        @from_currency = options[:from_currency]
+        @to_currency = options[:to_currency]
+        @rate = options[:rate]
+      end
+
+      def call
+        return failure_response('Vendor ID is required') if vendor_id.blank?
+        return failure_response('From currency is required') if from_currency.blank?
+        return failure_response('To currency is required') if to_currency.blank?
+        return failure_response('Rate is required') if rate.blank?
+        return failure_response('Rate must be greater than 0') if rate.to_f <= 0
+
+        existing = existing_rates.first
+
+        # Deduplication: If a rate already exists with the same value (within floating-point tolerance),
+        # return the existing rate without creating a new one.
+        # This prevents duplicate entries when the same rate is submitted multiple times.
+        #
+        # Example:
+        #   Existing rate: 4100.0
+        #   New rate:      4100.00001  (difference: 0.00001, which is < 0.0001 tolerance)
+        #   Result:        Returns existing rate, no new record created
+        #
+        # The tolerance of 0.0001 accounts for floating-point precision issues
+        # and minor rounding differences in currency calculations.
+        return success_response(existing) if existing && (existing.rate - rate.to_f).abs < 0.0001
+
+        ActiveRecord::Base.transaction do
+          override_existing_rates!
+          new_rate = create_new_rate
+          success_response(new_rate)
+        end
+      rescue ActiveRecord::RecordInvalid => e
+        failure_response(e.message)
+      end
+
+      private
+
+      def override_existing_rates!
+        existing_rates.each do |rate|
+          rate.update!(status: 'inactive', override_at: Time.current)
+        end
+      end
+
+      def existing_rates
+        vendor.currency_rates.by_pair(from_currency, to_currency).where(override_at: nil)
+      end
+
+      def vendor
+        @vendor ||= Spree::Vendor.find(vendor_id)
+      end
+
+      def create_new_rate
+        SpreeCmCommissioner::CurrencyRate.create!(
+          vendor_id: vendor_id,
+          from_currency: from_currency.upcase,
+          to_currency: to_currency.upcase,
+          rate: rate,
+          status: 'active'
+        )
+      end
+
+      def success_response(currency_rate)
+        Response.new(success?: true, error: nil, currency_rate: currency_rate)
+      end
+
+      def failure_response(message)
+        Response.new(success?: false, error: message, currency_rate: nil)
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/draft_orders/create.rb

@@ -90,6 +90,7 @@ module SpreeCmCommissioner
           order.update_with_updater!
           order.line_items.reload
           order.create_tax_charge!
+          order.create_service_fee_charge!
 
           order.update_with_updater!
 

data/app/services/spree_cm_commissioner/google_maps_geocoder.rb

@@ -0,0 +1,41 @@
+module SpreeCmCommissioner
+  class GoogleMapsGeocoder
+    class GeocodingError < StandardError; end
+    class ConfigurationError < StandardError; end
+
+    def initialize(api_key: nil)
+      @api_key = api_key || ENV.fetch('GOOGLE_MAP_KEY', nil)
+    end
+
+    def fetch_location_data(location_name, country_name)
+      raise ConfigurationError, 'Google Maps API key not configured' if @api_key.blank?
+
+      query = "#{location_name}, #{country_name}"
+      url = "#{GOOGLE_MAP_API_URL}/place/textsearch/json"
+      params = { query: query, key: @api_key }
+
+      response = Faraday.get(url, params)
+
+      begin
+        data = JSON.parse(response.body)
+      rescue JSON::ParserError => e
+        raise GeocodingError, "Failed to parse Google Maps API response: #{e.message}"
+      end
+
+      unless data['status'] == 'OK' && data['results'].present?
+        error_msg = "Geocoding failed for '#{query}': #{data['status']}"
+        error_msg += " - #{data['error_message']}" if data['error_message'].present?
+        raise GeocodingError, error_msg
+      end
+
+      result = data['results'].first
+      location = result['geometry']['location']
+
+      {
+        lat: location['lat'],
+        lon: location['lng'],
+        reference: result['reference']
+      }
+    end
+  end
+end

data/app/services/spree_cm_commissioner/integrations/base/sync_manager.rb

@@ -1,8 +1,7 @@
 module SpreeCmCommissioner::Integrations::Base
   class SyncManager
-    def initialize(integration:, client:)
+    def initialize(integration:)
       @integration = integration
-      @client = client
       @sync_session = nil
     end
 

data/app/services/spree_cm_commissioner/integrations/base/sync_result.rb

@@ -174,6 +174,17 @@ module SpreeCmCommissioner::Integrations::Base
       @error.nil?
     end
 
+    # Access metrics
+    # @return [Hash] The metrics hash
+    attr_reader :metrics
+
+    # Access API calls
+    # @return [Hash] The API calls hash
+    attr_reader :api_calls
+
+    # Timestamp of the last synced item (set by SyncItemAvailability)
+    attr_accessor :last_synced_at
+
     # Serialize to hash for JSONB persistence
     # @return [Hash] Serialized representation
     def to_h