spree_cm_commissioner 2.13.3.pre.pre3 → 2.13.4.pre.pre1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c2ffd7af989f00931883cac1fc7aa3ff4173458f57a42abd9294ecba2687c2bb
-  data.tar.gz: d2ee7a2a5d558f018075eded5ef178d294a61afc6e53b5d77018c3ef3a239c04
+  metadata.gz: 046dd1ce98770679145a8be935a9effb826b78c3e5ca63a1fa192f63da587687
+  data.tar.gz: 5fcbc34dea16ab68471e12f627cdb8eef28c3fe93d92d071b0dee39e032fad6a
 SHA512:
-  metadata.gz: db45749501e065ded53bef1baa37ebbbca96badd6384ac47505f72ed08dd45c0040e6ea22f50dfa4454ea32a3059d63aa7f9ce3e80fe4b97f99d3dca06e1f1ea
-  data.tar.gz: fc0b52d82222015696750733ecc702ef57e425256ca4e460644f21fe48369251e01e41adee33848e9d78be225e3342d845db8c4df93e973c70a9a360c21e72cb
+  metadata.gz: e312bbb74e20d80b384b980ef0e1c13926946ffd6f1a7c9cdeec0a6ce32f68e254e9b033a4e256d18db5856b9bdba1ce33a93465b8feaf8d987f88af611202d9
+  data.tar.gz: 1a80c7bc586ccd24e77370692626d3da1d3c4418e04da0ec95e156f8c52f91121e17796265ef1aba2ac18579d70e734356609b1ff77e4ecf6b9871e4a04e5259

data/.env.example

@@ -50,7 +50,6 @@ DISTANCE_SIGNING_KEY=hei********************VY
 # Cache durations (in seconds) for different content types
 # See: app/controllers/concerns/spree_cm_commissioner/content_cachable.rb
 CACHE_AUTO_INVALIDATION_DISABLED="" # Set to yes to disable CDN cache invalidation entirely (kill switch)
-CACHE_CDN_MAX_AGE=86400 # CDN/server-side cache duration for all responses
 CACHE_STATIC_MAX_AGE=86400 # Static content (countries, provinces, seat layouts, CMS pages) - 1 day
 CACHE_SEMI_STATIC_MAX_AGE=3600 # Semi-static content (menus, homepage backgrounds, routes) - 1 hour
 CACHE_MODERATE_MAX_AGE=1800 # Moderate freshness (products, events, vendors) - 30 minutes
@@ -87,4 +86,3 @@ PAYMENT_INCOMPLETE_NOTIFICATION_DELAY_IN_MINUTES=5  # Delay before notifying a c
 
 # See: app/jobs/spree_cm_commissioner/telegram_alerts/order_integrity_check_job.rb
 ORDER_INTEGRITY_TELEGRAM_ALERT_ENABLED="no"  # Set to yes to enable the order integrity Telegram alert job (off by default to avoid flooding Telegram rate limits during traffic spikes)
-

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.13.3.pre.pre3)
+    spree_cm_commissioner (2.13.4.pre.pre1)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -24,7 +24,7 @@ module SpreeCmCommissioner
       MenusController
       HomepageBackgroundController
       HomepageDataController
-      PopularRoutesController
+      PopularRoutePlacesController
       RoutePlacesController
       ShowsController
       EpisodesController
@@ -46,7 +46,6 @@ module SpreeCmCommissioner
       AccommodationsController
       VendorsController
       VendorPhotosController
-      DynamicFieldsController
     ].freeze
 
     # Priority 4: High Freshness (5 minutes)
@@ -54,12 +53,9 @@ module SpreeCmCommissioner
       TripsController
       TripSearchController
       VotingContestantsController
+      DynamicFieldsController
     ].freeze
 
-    def shared_max_age
-      ENV.fetch('CACHE_CDN_MAX_AGE', 1.day.to_i).to_i
-    end
-
     # Override This Method based on your UseCase
     # Or let it auto-detect based on controller name
     def client_max_age
@@ -78,12 +74,18 @@ module SpreeCmCommissioner
       end
     end
 
+    # Defaults to the client TTL so a tier's max-age bounds CDN staleness too: most endpoints
+    # (e.g. trips, trip search) have no invalidation on change, and an unlisted controller
+    # (max-age 0) must not be CDN-cached at all.
+    def shared_max_age
+      client_max_age
+    end
+
     def set_cache_control_for_cdn
       return if response.committed?
       return if response.status != 200
 
-      # max-age: browser/client cache, s-maxage: CDN/server cache
-      # Allow client caching for mobile apps while keeping CDN cache longer
+      # max-age: browser/client cache, s-maxage: CDN cache
       response.headers['Cache-Control'] = "public, max-age=#{client_max_age}, s-maxage=#{shared_max_age}"
 
       # Expires: Absolute timestamp when cache becomes stale (HTTP/1.0 fallback)

data/app/controllers/spree/admin/integrations_controller.rb

@@ -47,7 +47,6 @@ module Spree
           :full_sync_interval_hours,
           :tenant_id,
           :vendor_id,
-          :oauth_application_id,
           public_metadata: {},
           private_metadata: {}
         )
@@ -63,7 +62,6 @@ module Spree
         @conflict_strategy_options ||= enum_to_options(SpreeCmCommissioner::Integration.conflict_strategies)
         @tenants ||= SpreeCmCommissioner::Tenant.select(:id, :name).order(:name)
         @vendors ||= Spree::Vendor.select(:id, :name).order(:name)
-        @oauth_applications ||= Spree::OauthApplication.select(:id, :name).order(:name)
       end
 
       def enum_to_options(enum_hash)
@@ -71,10 +69,14 @@ module Spree
       end
 
       def integration_type_options
-        types = SpreeCmCommissioner::Integration.types
-        return [[Spree.t(:type), 'SpreeCmCommissioner::Integration']] if types.blank?
+        files = Dir[SpreeCmCommissioner::Engine.root.join('app/models/spree_cm_commissioner/integrations/*.rb')]
 
-        types.map { |class_name| [class_name, class_name] }
+        return [[Spree.t(:type), 'SpreeCmCommissioner::Integration']] if files.blank?
+
+        files.map do |path|
+          class_name = "SpreeCmCommissioner::Integrations::#{File.basename(path, '.rb').camelize}"
+          [class_name, class_name]
+        end.sort_by(&:first)
       end
     end
   end

data/app/controllers/spree/admin/inventory_items_controller.rb

@@ -2,7 +2,6 @@ module Spree
   module Admin
     class InventoryItemsController < StockManagementsController
       before_action :load_parent
-      before_action :reject_external_inventory_edits, only: %i[bulk_update_prices bulk_update_stocks]
 
       # GET /products/:slug/inventory_items/prices?inventory_item_ids=1,2,3
       def prices
@@ -79,17 +78,6 @@ module Spree
 
         redirect_back fallback_location: admin_product_stock_managements_path(@product)
       end
-
-      private
-
-      # The partner owns these per-night stocks and prices; its next update would silently overwrite
-      # an edit made here.
-      def reject_external_inventory_edits
-        return unless @product.variants.includes(vendor: :integration).any?(&:inventory_external_wins?)
-
-        flash[:error] = Spree.t('admin.inventory_external_wins', name: @product.vendor.integration.name)
-        redirect_back fallback_location: admin_product_stock_managements_path(@product)
-      end
     end
   end
 end

data/app/controllers/spree/admin/oauth_application_api_keys_controller.rb

@@ -0,0 +1,118 @@
+module Spree
+  module Admin
+    # A mini app's API key as its own resource: POST mints one, PATCH restores a previous one, DELETE
+    # revokes it. Each asks for nothing else, so no ordinary save of the application can reach the key.
+    class OauthApplicationApiKeysController < Spree::Admin::BaseController
+      before_action :load_oauth_application
+
+      # A minted key is one the admin has no other copy of, so it is handed to the page this redirects
+      # to and shown there once. Stashed only if the save went through — a key that never reached the
+      # row is not one to hand out.
+      def create
+        minted = change_api_key(:saved) { save_api_key(nil) }
+
+        session[:minted_api_key] = @oauth_application.mini_app.api_key if minted
+      end
+
+      # Puts back a key this application used to hold, named by the version that recorded it. The value
+      # never travels through the request — the admin picks one and the plaintext is read out of history
+      # here, so no key can be typed in and nothing weak can get in.
+      def update
+        key = api_key_history.key_for(params[:version_id])
+
+        if key.blank?
+          flash[:error] = I18n.t('mini_apps.api_key.not_restorable')
+          return redirect_to_application
+        end
+
+        change_api_key(:restored) { save_api_key(key, source: 'restored') }
+      end
+
+      # Leaves the mini app with no key at all, rather than handing the partner a working one they never
+      # asked for — what a leak calls for. #create puts one back.
+      def destroy
+        mini_app = @oauth_application.mini_app
+
+        # Said plainly rather than reporting a revoke that removed nothing.
+        if mini_app&.supports_api_key? && mini_app.api_key.blank?
+          flash[:error] = I18n.t('mini_apps.api_key.nothing_to_revoke')
+          return redirect_to_application
+        end
+
+        change_api_key(:revoked) do
+          mini_app.revoke_api_key!
+          @oauth_application.save
+        end
+      end
+
+      # The dialog's contents, fetched when it is opened. Reading history costs a scan of the
+      # application's versions, which is not worth doing on every render of the edit page.
+      def history
+        render partial: 'spree/admin/oauth_applications/api_key_restore_list',
+               locals: { application: @oauth_application, entries: api_key_history.entries },
+               layout: false
+      end
+
+      private
+
+      # Authorized as an edit of the application, not as create/destroy of a key. Spelled out because
+      # #model_class only tells BaseController the class, never this row.
+      def load_oauth_application
+        @oauth_application = Spree::OauthApplication.find(params[:oauth_application_id])
+
+        authorize! :update, @oauth_application
+      end
+
+      def model_class
+        Spree::OauthApplication
+      end
+
+      # The gate every key change passes. Replacing, restoring or clearing a live key changes what the
+      # partner has to send, so it costs the application's name typed back — checked here because a
+      # hand-made request walks past the dialog. A mini app with no key yet is asked for nothing.
+      #
+      # Returns whether this request changed the key. A `flash[:success]` check would also see the
+      # previous request's flash, and #create would reveal a key it never minted.
+      def change_api_key(success)
+        mini_app = @oauth_application.mini_app
+        changed = false
+
+        if mini_app.nil? || !mini_app.supports_api_key?
+          flash[:error] = I18n.t('mini_apps.api_key.unsupported')
+        elsif confirmation_mismatched?(mini_app)
+          flash[:error] = I18n.t('mini_apps.api_key.confirmation_mismatched')
+        elsif yield
+          flash[:success] = I18n.t("mini_apps.api_key.#{success}")
+          changed = true
+        else
+          # The key's own validations still apply — a restored one another application has since taken
+          # lands here.
+          flash[:error] = @oauth_application.errors.full_messages.to_sentence
+        end
+
+        redirect_to_application
+
+        changed
+      end
+
+      def save_api_key(value, source: nil)
+        @oauth_application.mini_app.replace_api_key!(value, actor: try_spree_current_user, source: source)
+        @oauth_application.save
+      end
+
+      def api_key_history
+        SpreeCmCommissioner::MiniAppProvider::ApiKeyHistory.new(@oauth_application)
+      end
+
+      def confirmation_mismatched?(mini_app)
+        return false if mini_app.api_key.blank?
+
+        params[:api_key_confirm].to_s.strip != @oauth_application.name
+      end
+
+      def redirect_to_application
+        redirect_to spree.edit_admin_oauth_application_path(@oauth_application)
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/oauth_applications_controller.rb

@@ -5,8 +5,18 @@ module Spree
       # Edit forms allow users to modify scopes without forced default
       before_action :set_default_scopes, only: [:new]
 
+      # Declared after ResourceController's own callbacks so @object is loaded by the time it runs.
+      before_action :take_minted_api_key, only: [:edit]
+
       private
 
+      # Written by OauthApplicationApiKeysController#create and read here, because this is the page that
+      # shows it. The session rather than the flash, because the admin layout renders whichever flash
+      # entry happens to be first. Deleted as it is read, so it is on screen for exactly one render.
+      def take_minted_api_key
+        @minted_api_key = session.delete(:minted_api_key)
+      end
+
       def create_turbo_stream_enabled?
         true
       end

data/app/controllers/spree/api/v2/storefront/dynamic_field_options_controller.rb

@@ -3,6 +3,8 @@ module Spree
     module V2
       module Storefront
         class DynamicFieldOptionsController < ::Spree::Api::V2::ResourceController
+          before_action :ensure_dynamic_field_enabled_for_product, if: -> { params[:product_id].present? }
+
           # override
           def collection
             return @collection if defined?(@collection)
@@ -17,6 +19,16 @@ module Spree
             @collection
           end
 
+          private
+
+          # Only the product-scoped route checks this; the legacy flat route serves any field by id.
+          def ensure_dynamic_field_enabled_for_product
+            SpreeCmCommissioner::ProductDynamicField.find_by!(
+              product_id: params[:product_id],
+              dynamic_field_id: params[:dynamic_field_id]
+            )
+          end
+
           # override
           def collection_serializer
             SpreeCmCommissioner::V2::Storefront::DynamicFieldOptionSerializer

data/app/controllers/spree/api/v2/storefront/trip_search_controller.rb

@@ -25,11 +25,6 @@ module Spree
 
           private
 
-          # override from ContentCacheable
-          def max_age
-            CACHE_EXPIRES_IN.to_i
-          end
-
           # override
           def collection_cache_key
             cache_key_parts = [

data/app/controllers/spree/api/v2/tenant/trip_search_controller.rb

@@ -25,11 +25,6 @@ module Spree
 
           private
 
-          # override from ContentCacheable
-          def max_age
-            CACHE_EXPIRES_IN.to_i
-          end
-
           # override
           def collection_cache_key
             cache_key_parts = [

data/app/controllers/spree_cm_commissioner/api/v2/storefront/checkout_controller_decorator.rb

@@ -5,9 +5,6 @@ module SpreeCmCommissioner
         module CheckoutControllerDecorator
           def self.prepended(base)
             base.include SpreeCmCommissioner::OrderConcern
-            base.include SpreeCmCommissioner::TurnstileProtectable
-
-            base.before_action -> { verify_turnstile! }, only: %i[create_payment]
             # Sets Current.load_test_bypass from the X-Request-Verify secret so
             # InventoryHolds::ValidateLimits can skip anti-abuse checks for trusted load tests.
             base.include SpreeCmCommissioner::LoadTestBypassable

data/app/factory/spree_cm_commissioner/order_telegram_message_factory.rb

@@ -200,14 +200,10 @@ module SpreeCmCommissioner
       grouped.map { |nationality_group, guests| customer_type_summary(nationality_group, guests) }.join(', ')
     end
 
-    # e.g. "Local (Adult x1, Child x1)". `cm_saved_guests.age_group` is declared `null: false` in
-    # the migration, but a dev/staging DB whose column predates that migration (added via
-    # `add_column ... if_not_exists: true`, which silently skips the constraint if the column
-    # already exists) can still carry real NULL rows - group those under "Unknown" rather than
-    # crashing the whole order-completion Telegram notification on nil.humanize.
+    # e.g. "Local (Adult x1, Child x1)". age_group is NOT NULL, so it is always present.
     def customer_type_summary(nationality_group, guests)
       age_breakdown = guests
-                      .group_by { |sg| sg.age_group&.humanize || 'Unknown' }
+                      .group_by { |sg| sg.age_group.humanize }
                       .map { |age_group, age_guests| "#{age_group} x#{age_guests.count}" }
                       .join(', ')
 

data/app/interactors/spree_cm_commissioner/user_acleda_bank_web_app_authenticator.rb

@@ -0,0 +1,38 @@
+module SpreeCmCommissioner
+  # Authenticates an ACLEDA Mini App session_key (a JWT minted by
+  # Vpago::AcledaMiniApp::Session::Create, signed with the user's secure_token).
+  #
+  # Unlike the Vattanac authenticator, this enforces the JWT signature: a token
+  # must be signed with the user's secure_token or it is rejected.
+  class UserAcledaBankWebAppAuthenticator < BaseInteractor
+    delegate :session_key, to: :context
+
+    def call
+      return context.fail!(message: 'Invalid token') unless payload
+      return context.fail!(message: 'User not found') unless user
+      return context.fail!(message: 'Invalid token signature') unless valid_signature?
+
+      context.user = user
+    rescue JWT::DecodeError => e
+      context.fail!(message: "Decode error: #{e.message}")
+    end
+
+    private
+
+    # Unverified decode, only to read user_id. The signature is enforced
+    # separately in #valid_signature?.
+    def payload
+      @payload ||= SpreeCmCommissioner::UserSessionJwtToken.decode(session_key)
+    end
+
+    def user
+      @user ||= Spree::User.find_by(id: payload['user_id']) if payload
+    end
+
+    # UserSessionJwtToken.decode returns nil when the signature does not verify
+    # against the user's secure_token, so a forged/tampered token fails here.
+    def valid_signature?
+      SpreeCmCommissioner::UserSessionJwtToken.decode(session_key, user.secure_token).present?
+    end
+  end
+end

data/app/interactors/spree_cm_commissioner/user_wing_bank_web_app_authenticator.rb

@@ -0,0 +1,39 @@
+module SpreeCmCommissioner
+  # Authenticates a Wing Mini App session_key (a JWT minted by
+  # Vpago::WingMiniApp::Session::Create, signed with the user's secure_token).
+  #
+  # Same shape as UserAcledaBankWebAppAuthenticator: the JWT signature is enforced
+  # here — a token must be signed with the user's secure_token or it is rejected.
+  class UserWingBankWebAppAuthenticator < BaseInteractor
+    delegate :session_key, to: :context
+
+    def call
+      return context.fail!(message: 'Invalid token') unless payload
+      return context.fail!(message: 'User not found') unless user
+      return context.fail!(message: 'Invalid token signature') unless valid_signature?
+
+      context.user = user
+      reject_unauthenticatable_user!(context.user)
+    rescue JWT::DecodeError => e
+      context.fail!(message: "Decode error: #{e.message}")
+    end
+
+    private
+
+    # Unverified decode, only to read user_id. The signature is enforced
+    # separately in #valid_signature?.
+    def payload
+      @payload ||= SpreeCmCommissioner::UserSessionJwtToken.decode(session_key)
+    end
+
+    def user
+      @user ||= Spree::User.find_by(id: payload['user_id']) if payload
+    end
+
+    # UserSessionJwtToken.decode returns nil when the signature does not verify
+    # against the user's secure_token, so a forged/tampered token fails here.
+    def valid_signature?
+      SpreeCmCommissioner::UserSessionJwtToken.decode(session_key, user.secure_token).present?
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/line_item_bundleable.rb

@@ -0,0 +1,38 @@
+module SpreeCmCommissioner
+  # Groups add-on line items (sold via a ProductRelation) under the line item they were bought with.
+  #
+  # Grouping is display-only: each child keeps its own price, quantity and adjustments, since
+  # promotions, tax, service fees, payouts, refunds and open-dated redemption all work per line item.
+  # `relation_type` is a snapshot of the ProductRelation type at purchase, so later edits to the
+  # relation don't change what the order sold.
+  module LineItemBundleable
+    extend ActiveSupport::Concern
+
+    included do
+      belongs_to :parent, class_name: 'Spree::LineItem', optional: true, inverse_of: :children
+      has_many :children, class_name: 'Spree::LineItem', foreign_key: :parent_id, inverse_of: :parent, dependent: :destroy
+
+      enum relation_type: SpreeCmCommissioner::ProductRelationType::PRODUCT_RELATION_TYPES.each_with_index.to_h { |type, index| [type, index] },
+           _prefix: :relation
+
+      scope :top_level, -> { where(parent_id: nil) }
+
+      money_methods :bundle_amount
+
+      validates :relation_type, presence: true, if: -> { parent_id.present? || parent.present? }
+      validates :relation_type, absence: true, if: -> { parent_id.blank? && parent.blank? }
+      validate :ensure_valid_parent, if: -> { parent.present? }
+    end
+
+    def bundle_amount
+      amount + children.sum(&:amount)
+    end
+
+    private
+
+    def ensure_valid_parent
+      errors.add(:parent, :invalid) if parent.parent_id.present? || parent == self
+      errors.add(:parent, :invalid) if parent.order_id.present? && order_id.present? && parent.order_id != order_id
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/oauth_application/mini_app.rb

@@ -0,0 +1,72 @@
+module SpreeCmCommissioner
+  module OauthApplication
+    # Lets a Spree::OauthApplication stand for a mini app — the storefront a partner embeds in its
+    # own banking app. `provider` names which one; its settings live on a MiniAppProvider class.
+    module MiniApp
+      extend ActiveSupport::Concern
+
+      included do
+        # Deterministic so `find_by` and the unique index keep working: calls are looked up by key.
+        encrypts :api_key, deterministic: true
+
+        # '' encrypts to a non-empty ciphertext, which the partial index cannot tell from a real key.
+        before_validation { self.api_key = nil if api_key.blank? }
+
+        # Unique: a keyless call is traced back by provider alone.
+        validates :provider,
+                  inclusion: { in: -> (_application) { MiniAppProvider::Base.providers.map(&:provider) } },
+                  uniqueness: true,
+                  allow_blank: true
+
+        # `is`, not a minimum: a short or padded key saves fine, then fails every call the partner makes.
+        validates :api_key, uniqueness: true, allow_blank: true
+        validates :api_key, length: { is: MiniAppProvider::Base::API_KEY_LENGTH },
+                            format: { without: /\s/, message: 'cannot contain spaces' }, # rubocop:disable Rails/I18nLocaleTexts
+                            allow_blank: true
+
+        # Rules that do not parse stop matching silently and lock the mini app out.
+        validate do
+          mini_app&.invalid_ip_rules&.each do |name|
+            errors.add(:base, I18n.t('mini_apps.ip_rules.invalid', name: name.to_s.humanize))
+          end
+        end
+      end
+
+      class_methods do
+        # Authenticated lookup. The provider must match the row the key found, or one mini app's key
+        # would open another's flow. `api_key:` has no default: a missing header fails loudly here
+        # instead of falling through to #keyless_mini_app_for, where nothing is checked.
+        def mini_app_for(provider, api_key:)
+          return nil if api_key.blank?
+
+          application = find_by(api_key: api_key)
+          return nil unless application && application.provider.to_s == provider.to_s
+
+          mini_app = application.mini_app
+
+          mini_app if mini_app&.supports_api_key?
+        end
+
+        # For mini apps with no key to send — the partner only opens a WebView, so the customer's
+        # browser arrives, not the partner's server. Refuses any provider that does have a key, so
+        # nothing reaches a key-using mini app without it.
+        def keyless_mini_app_for(provider)
+          mini_app = find_by(provider: provider.to_s)&.mini_app
+
+          mini_app unless mini_app.nil? || mini_app.supports_api_key?
+        end
+      end
+
+      def mini_app
+        @mini_app ||= MiniAppProvider::Base.for(self)
+      end
+
+      # Preferences belonging to other mini apps are ignored rather than written to `settings`.
+      def mini_app_attributes=(attributes)
+        attributes.each do |name, value|
+          mini_app.public_send("#{name}=", value) if mini_app.respond_to?("#{name}=")
+        end
+      end
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/vehicle_kind.rb

@@ -2,7 +2,7 @@ module SpreeCmCommissioner
   module VehicleKind
     extend ActiveSupport::Concern
 
-    VEHICLE_KINDS = %i[suv sedan minivan van sleeping_bus luxury_van air_bus bus ferry boat train].freeze
+    VEHICLE_KINDS = %i[suv sedan minivan van sleeping_bus luxury_van air_bus bus ferry train].freeze
 
     included do
       enum kind: VEHICLE_KINDS if table_exists? && column_names.include?('kind')

data/app/models/spree_cm_commissioner/dynamic_field.rb

@@ -4,7 +4,7 @@ module SpreeCmCommissioner
 
     belongs_to :vendor, class_name: 'Spree::Vendor', optional: false
 
-    has_many :dynamic_field_options, class_name: 'SpreeCmCommissioner::DynamicFieldOption', dependent: :destroy
+    has_many :dynamic_field_options, -> { order(:position) }, class_name: 'SpreeCmCommissioner::DynamicFieldOption', dependent: :destroy
     has_many :guest_dynamic_fields, class_name: 'SpreeCmCommissioner::GuestDynamicField', dependent: :destroy
     has_many :product_dynamic_fields, class_name: 'SpreeCmCommissioner::ProductDynamicField', dependent: :destroy
 
@@ -19,6 +19,7 @@ module SpreeCmCommissioner
     validate :validate_data_fill_stage_phase
 
     after_commit :enqueue_data_fill_stage_maintenance_for_products, on: %i[update], if: :saved_change_to_data_fill_stage?
+    after_commit :enqueue_cache_invalidation_for_products, on: %i[update]
 
     scope :with_dynamic_field_options, -> { includes(dynamic_field_options: :dynamic_field) }
 
@@ -57,6 +58,16 @@ module SpreeCmCommissioner
       end
     end
 
+    # Destroy isn't handled here: by after_commit the join rows are gone, and each
+    # ProductDynamicField destroyed with this field enqueues its own product.
+    def enqueue_cache_invalidation_for_products
+      product_dynamic_fields.distinct.pluck(:product_id).each do |product_id|
+        SpreeCmCommissioner::MaintenanceTasks::CacheInvalidation
+          .pending
+          .create_or_find_by(maintainable_type: 'Spree::Product', maintainable_id: product_id)
+      end
+    end
+
     def validate_data_fill_stage_phase
       return if data_fill_stage.blank?
 

data/app/models/spree_cm_commissioner/dynamic_field_option.rb

@@ -11,8 +11,19 @@ module SpreeCmCommissioner
     validates :status, presence: true
     validate :parent_field_must_be_selection_type
 
+    after_commit :enqueue_cache_invalidation_for_products
+
     private
 
+    # Options are embedded in the storefront dynamic_fields response of every product using the parent field.
+    def enqueue_cache_invalidation_for_products
+      SpreeCmCommissioner::ProductDynamicField.where(dynamic_field_id: dynamic_field_id).distinct.pluck(:product_id).each do |product_id|
+        SpreeCmCommissioner::MaintenanceTasks::CacheInvalidation
+          .pending
+          .create_or_find_by(maintainable_type: 'Spree::Product', maintainable_id: product_id)
+      end
+    end
+
     def parent_field_must_be_selection_type
       return unless dynamic_field
 

data/app/models/spree_cm_commissioner/guest.rb

@@ -311,6 +311,14 @@ module SpreeCmCommissioner
       Array(public_metadata['eligible_check_in_session_ids']).map(&:to_i)
     end
 
+    # The buyer's order that took over this ticket. Nil until a transfer out of this guest completes,
+    # which is also when the guest is marked transferred.
+    def transferred_to_order
+      return nil unless transferred?
+
+      ticket_transfers.completed.order(:completed_at).last&.order
+    end
+
     # Set by TicketTransfers::TransferGuest when this guest was created to receive a transferred ticket
     def from_transfer?
       ActiveModel::Type::Boolean.new.cast(public_metadata['from_transfer']) || false