spree_cm_commissioner 2.13.3 → 2.13.4

data/app/services/spree_cm_commissioner/rate_limiter.rb

@@ -0,0 +1,62 @@
+module SpreeCmCommissioner
+  # Fixed-window counter in Redis: "at most `limit` hits on `key` per `window`".
+  #
+  # Owns the atomic increment and the fail-open policy so callers can't get either
+  # wrong. A non-positive `limit` disables the check without touching Redis, the
+  # same "0 = disabled" convention FraudCheck's thresholds use.
+  class RateLimiter
+    # KEYS[1] - counter key, ARGV[1] - window in seconds.
+    #
+    # INCR and EXPIRE issued as two commands race: two callers can both observe
+    # the first write and each re-apply EXPIRE, sliding the window forward so the
+    # counter never resets. Lua runs them as a single atomic unit in Redis.
+    INCREMENT_SCRIPT = <<~LUA.freeze
+      local count = redis.call('INCR', KEYS[1])
+      if count == 1 then
+        redis.call('EXPIRE', KEYS[1], ARGV[1])
+      end
+      return count
+    LUA
+
+    def self.call(key:, limit:, window:)
+      new(key: key, limit: limit, window: window).call
+    end
+
+    def initialize(key:, limit:, window:)
+      @key = key
+      @limit = limit.to_i
+      @window = window.to_i
+    end
+
+    def call
+      return within_limit unless enabled?
+
+      count = SpreeCmCommissioner.redis_pool.with do |redis|
+        redis.eval(INCREMENT_SCRIPT, keys: [key], argv: [window])
+      end
+
+      Result.new(count: count, limit: limit, exceeded: count > limit)
+    rescue Redis::BaseError, ConnectionPool::TimeoutError => e
+      # Fail open: a Redis outage must not lock users out of whatever the caller
+      # protects. Log it so the blind spot is visible in monitoring — while this
+      # is firing, the limit is not being enforced at all.
+      CmAppLogger.error(
+        label: 'RateLimiter Redis error — failing open',
+        data: { key: key, error_class: e.class.name, error_message: e.message }
+      )
+      within_limit
+    end
+
+    private
+
+    attr_reader :key, :limit, :window
+
+    def enabled?
+      limit.positive? && window.positive?
+    end
+
+    def within_limit
+      Result.new(count: 0, limit: limit, exceeded: false)
+    end
+  end
+end

data/app/services/spree_cm_commissioner/seeds/user_usernames.rb

@@ -19,7 +19,9 @@ module SpreeCmCommissioner
           begin
             new_login = SpreeCmCommissioner::Users::Username::Generate.call(user: user)
 
-            if user.update_column(:login, new_login) # rubocop:disable Rails/SkipsModelValidations
+            # normalized_login must be written too: Username::Generate checks collisions against it,
+            # so a stale value lets later users in this run reuse a login just assigned.
+            if user.update_columns(login: new_login, normalized_login: new_login.downcase) # rubocop:disable Rails/SkipsModelValidations
               updated_count += 1
 
               # Log progress every 100 users to avoid log spam

data/app/services/spree_cm_commissioner/ticket_transfers/eligibility_checker.rb

@@ -21,7 +21,7 @@ module SpreeCmCommissioner
           return failure(nil, error)
         end
 
-        if (error = check_price_range(from_guest, rule, price, transfer_type)) # rubocop:disable Lint/AssignmentInCondition
+        if (error = check_price_range(rule, price, transfer_type)) # rubocop:disable Lint/AssignmentInCondition
           return failure(nil, error)
         end
 
@@ -75,17 +75,16 @@ module SpreeCmCommissioner
         I18n.t('ticket_transfer.event_cutoff_reached', hours: rule.event_cutoff_hours)
       end
 
-      # Check 4 — price range. Enforces min/max price set on the rule.
-      # If `rule.min_price` is nil, falls back to the variant price.
+      # Check 4 — price range. Enforces min/max price set on the rule, and only those: a rule that
+      # names no minimum sets no floor, rather than inheriting what the ticket originally sold for.
       # Skips for gift and manual_payment transfers (no platform pricing).
-      def check_price_range(from_guest, rule, price, transfer_type)
+      def check_price_range(rule, price, transfer_type)
         return nil unless SpreeCmCommissioner::TicketTransfer.new(transfer_type: transfer_type).purchase?
         return nil if price.blank?
 
         price_decimal = price.to_d
-        variant_price = from_guest.variant&.price
+        min_allowed = rule.min_price
 
-        min_allowed = rule.min_price.presence || variant_price
         return I18n.t('ticket_transfer.price_below_minimum', minimum: min_allowed) if min_allowed.present? && price_decimal < min_allowed.to_d
 
         if rule.max_price.present? && price_decimal > rule.max_price.to_d

data/app/services/spree_cm_commissioner/ticket_transfers/preview_rule.rb

@@ -12,21 +12,19 @@ module SpreeCmCommissioner
 
         success(
           currency: currency,
-          rule: rule_summary(fee_result.value[:rule], from_guest)
+          rule: rule_summary(fee_result.value[:rule])
         )
       end
 
       private
 
-      def rule_summary(rule, from_guest)
+      def rule_summary(rule)
         return nil if rule.nil?
 
-        variant_price = from_guest.variant&.price
-
         {
           fee_percentage: rule.fee_percentage,
           fee_flat_amount: rule.fee_flat_amount,
-          min_price: rule.min_price.presence || variant_price,
+          min_price: rule.min_price,
           max_price: rule.max_price,
           cooldown_hours: rule.cooldown_hours,
           max_transfers_per_ticket: rule.max_transfers_per_ticket,

data/app/services/spree_cm_commissioner/user_authenticator.rb

@@ -9,6 +9,8 @@ module SpreeCmCommissioner
     # :fb_access_token
     # :telegram_init_data, :tg_bot
     # :session_id
+    # :session_key (ACLEDA Mini App JWT, self-identifying, minted by Vpago::AcledaMiniApp::Session::Create)
+    # :wing_session_key (Wing Mini App JWT, self-identifying, minted by Vpago::WingMiniApp::Session::Create)
 
     def self.call!(params)
       context = auth_context(params)
@@ -31,7 +33,7 @@ module SpreeCmCommissioner
       user
     end
 
-    def self.auth_context(params)
+    def self.auth_context(params) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength
       oauth_application = find_oauth_application(params)
       tenant_id = oauth_application&.tenant_id
 
@@ -62,6 +64,12 @@ module SpreeCmCommissioner
       when 'vattanac_bank_web_app_auth'
         options = { session_id: params[:session_id] }
         SpreeCmCommissioner::UserVattanacBankWebAppAuthenticator.call(options)
+      when 'acleda_bank_web_app_auth'
+        options = { session_key: params[:session_key] }
+        SpreeCmCommissioner::UserAcledaBankWebAppAuthenticator.call(options)
+      when 'wing_bank_web_app_auth'
+        options = { session_key: params[:wing_session_key] }
+        SpreeCmCommissioner::UserWingBankWebAppAuthenticator.call(options)
       end
     end
 
@@ -76,7 +84,9 @@ module SpreeCmCommissioner
       'social_auth' => -> (params) { params.key?(:id_token) },
       'facebook_auth' => -> (params) { params.key?(:fb_access_token) },
       'telegram_web_app_auth' => -> (params) { params.key?(:telegram_init_data) && params.key?(:tg_bot) },
-      'vattanac_bank_web_app_auth' => -> (params) { params.key?(:session_id) }
+      'vattanac_bank_web_app_auth' => -> (params) { params.key?(:session_id) },
+      'acleda_bank_web_app_auth' => -> (params) { params.key?(:session_key) },
+      'wing_bank_web_app_auth' => -> (params) { params.key?(:wing_session_key) }
     }.freeze
 
     def self.flow_type(params)

data/app/services/spree_cm_commissioner/wing_mini_app/config.rb

@@ -0,0 +1,44 @@
+module SpreeCmCommissioner
+  module WingMiniApp
+    # Partner credentials for the Wing Web JS Bridge SDK, read from Wing's own mini app row
+    # (MiniAppProvider::WingBank) so they can be rotated from the admin, and so clearing one
+    # revokes the mini app instead of falling through to another source.
+    #
+    # Both halves of the integration read here — login, and Spree::Gateway::WingMiniApp for
+    # doPayment and webhook signing. Wing issues one pair, so they must come from one place:
+    # two sources would let the halves act as different partners, a mismatch that only shows
+    # up at the webhook, once the customer has already paid.
+    class Config
+      PROVIDER = 'wing_bank'.freeze
+
+      # The lowest getProfile data level whose hash formula includes `phone`, which is
+      # how a Wing customer is matched to an existing BookMe+ account.
+      ACCEPTED_LEVELS_FLOOR = %w[level_1a level_1b level_2 level_3].freeze
+
+      # Wing sends no api key — its WebView is opened by the partner, so the customer's
+      # browser arrives. Nil until someone configures the row.
+      def self.mini_app
+        Spree::OauthApplication.keyless_mini_app_for(PROVIDER)
+      end
+
+      def self.app_id
+        mini_app&.preferred_app_id.presence
+      end
+
+      def self.secret_api_key
+        mini_app&.preferred_secret_api_key.presence
+      end
+
+      # Blank (default) accepts level_1a or above. Set to pin verification to exactly
+      # one level (level_0..level_3, level_1a, level_1b), including a weaker one if
+      # Wing insists.
+      def self.data_level
+        mini_app&.preferred_data_level.presence
+      end
+
+      def self.accepted_levels
+        data_level.present? ? [data_level] : ACCEPTED_LEVELS_FLOOR
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/wing_mini_app/find_or_create_user.rb

@@ -0,0 +1,89 @@
+module SpreeCmCommissioner
+  module WingMiniApp
+    # Finds or creates the BookMe+ customer for a verified Wing getProfile response.
+    #
+    # Unlike ACLEDA (server-to-server, phone only), Wing hands us a stable per-user
+    # `id`, so that — not phone — is what the wing_bank identity is keyed on, the
+    # same way the google/facebook/telegram identities key on the provider's own
+    # account id rather than a mutable field. Phone is still how a *new* Wing login
+    # gets matched to an existing BookMe+ account.
+    class FindOrCreateUser
+      prepend Spree::ServiceModule::Base
+
+      # `gate` is optional: without one nothing is configured to cap new accounts, which is
+      # how this behaved before mini apps had a row to configure.
+      def call(profile:, gate: nil)
+        @profile = profile.with_indifferent_access
+        @gate = gate
+
+        return failure(nil, 'id is required') if profile['id'].blank?
+        return failure({ status: :too_many_requests }, 'too many requests') if new_user_throttled?
+
+        user = find_or_create
+        return failure(user, 'user creation failed') if user.nil? || !user.persisted?
+
+        success(user: user)
+      end
+
+      private
+
+      attr_reader :profile, :gate
+
+      # Only asked where this call would mint an account — the damage a leaked key does.
+      # Returning customers never spend that quota.
+      def new_user_throttled?
+        return false if gate.nil?
+        return false if wing_identity.persisted? || find_existing_user.present?
+
+        gate.new_user_exceeded?(phone: intel_phone)
+      end
+
+      def find_or_create
+        identity = wing_identity
+
+        # Returning customer: the Wing identity already points at a user.
+        return identity.user if identity.persisted?
+
+        # New to Wing: reuse a customer matched by phone, otherwise build one, then
+        # tag them with the wing_bank identity so the lookup above hits next time.
+        user = find_existing_user || build_user
+        identity.name = profile['fullName'].presence
+        user.user_identity_providers << identity
+        user.save
+
+        user
+      end
+
+      # Memoized: #new_user_throttled? asks the same questions, and this row is the one
+      # that gets tagged onto the user.
+      def wing_identity
+        @wing_identity ||= SpreeCmCommissioner::UserIdentityProvider.wing_bank.find_or_initialize_by(sub: profile['id'])
+      end
+
+      def find_existing_user
+        return @find_existing_user if defined?(@find_existing_user)
+        return @find_existing_user = nil if intel_phone.blank?
+
+        @find_existing_user = Spree::User.by_non_tenant.find_by(intel_phone_number: intel_phone)
+      end
+
+      def build_user
+        Spree::User.new(
+          first_name: profile['firstName'].presence,
+          last_name: profile['lastName'].presence,
+          phone_number: profile['phone'].presence,
+          intel_phone_number: intel_phone,
+          password: SecureRandom.base64(16),
+          confirmed_at: Time.zone.now
+        )
+      end
+
+      def intel_phone
+        return @intel_phone if defined?(@intel_phone)
+        return @intel_phone = nil if profile['phone'].blank?
+
+        @intel_phone = SpreeCmCommissioner::PhoneNumberParser.call(phone_number: profile['phone']).intel_phone_number
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/wing_mini_app/profile_verifier.rb

@@ -0,0 +1,65 @@
+module SpreeCmCommissioner
+  module WingMiniApp
+    # Verifies the `secret_key` a Wing getProfile response carries (Wing Web JS
+    # Bridge SDK spec, Native API #1).
+    #
+    # Each data level has its own exact hash formula, and they are NOT simply "the
+    # response fields that came back non-blank" — `sex` is a case in point: Wing's
+    # spec returns it in the response starting at level_1a, but it only enters the
+    # *hash formula* one tier later, at level_1b. So which fields are present in the
+    # payload cannot be used to infer which formula to check; every level's formula
+    # has to be tried explicitly against LEVEL_FIELDS, which is transcribed directly
+    # from the spec rather than derived.
+    class ProfileVerifier
+      prepend Spree::ServiceModule::Base
+
+      # Field order per data level, transcribed from the spec's plainText formulas.
+      # Order matters. Every level's field list is a prefix of the next level's.
+      LEVEL_FIELDS = {
+        'level_0' => %w[id appId],
+        'level_1' => %w[id appId fullName],
+        'level_1a' => %w[id appId fullName phone],
+        'level_1b' => %w[id appId fullName phone sex age nationality],
+        'level_2' => %w[id appId fullName phone sex age nationality occupation],
+        'level_3' => %w[id appId fullName phone sex age nationality occupation dobFull nidNumber nidType]
+      }.freeze
+
+      def call(profile:)
+        @profile = profile.with_indifferent_access
+
+        return failure(nil, 'appId does not match configured partner') unless app_id_matches?
+        return failure(nil, 'secret_key is missing or invalid') unless matched_level
+        return failure(nil, "data level #{matched_level} is below the accepted floor") unless level_accepted?
+
+        success(profile: profile, level: matched_level)
+      end
+
+      private
+
+      attr_reader :profile
+
+      def app_id_matches?
+        profile['appId'].present? && profile['appId'] == Config.app_id
+      end
+
+      # The one level (if any) whose exact formula produces the received secret_key.
+      # Cryptographically, at most one level can match unless there's a SHA-256
+      # collision, since every formula is salted with the same secret_api_key.
+      def matched_level
+        return @matched_level if defined?(@matched_level)
+
+        received = profile['secret_key']
+        @matched_level = received.present? && LEVEL_FIELDS.keys.find { |level| hash_for(level) == received.to_s.upcase }
+      end
+
+      def hash_for(level)
+        plaintext = LEVEL_FIELDS.fetch(level).map { |field| profile[field].to_s }.join + Config.secret_api_key.to_s
+        Digest::SHA256.hexdigest(plaintext.upcase).upcase
+      end
+
+      def level_accepted?
+        Config.accepted_levels.include?(matched_level)
+      end
+    end
+  end
+end

data/app/views/spree/admin/guests/_table.html.erb

@@ -114,6 +114,10 @@
 
                 <td class="text-left"><%= guest_state_badge(guest) %></td>
                 <td class="text-right">
+                  <% buyer_order = guest.transferred_to_order %>
+                  <% if buyer_order.present? %>
+                    <%= link_to_with_icon 'box-arrow-up-right.svg', 'View order', spree.edit_admin_order_path(buyer_order.number), no_text: true, class: 'btn btn-light btn-sm' %>
+                  <% end %>
                   <%= link_to_edit guest, url: edit_admin_order_guest_path(@order, guest), no_text: true %>
                   <% if guest&.id_card&.front_image.present? || guest&.id_card&.back_image.present? %>
                     <%= link_to_with_icon 'images.svg', 'Edit Id Card Images', edit_admin_order_guest_id_card_path(order_id: @order, guest_id: guest.id, id: guest.id_card.id), no_text: true, class: 'mx-2' %>

data/app/views/spree/admin/oauth_applications/_api_key_minted_modal.html.erb

@@ -0,0 +1,71 @@
+<%# Rendered already open, with a backdrop of its own and its own close handler, so it needs nothing
+    from Bootstrap's JS to appear. The other dialogs here are opened by a data-toggle button and can
+    afford to wait for the plugin; this one carries the only copy of a freshly minted key, and a dialog
+    that fails to open would lose it. Bootstrap's CSS still does the styling. %>
+
+<div class="modal show" id="mini-app-api-key-minted-modal" tabindex="-1" role="dialog"
+     aria-labelledby="miniAppApiKeyMintedModalLabel" aria-modal="true" style="display: block;">
+  <div class="modal-dialog" role="document">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title" id="miniAppApiKeyMintedModalLabel">Copy this API key</h5>
+        <button type="button" class="close" aria-label="Close" data-minted-key-close>
+          <span aria-hidden="true">&times;</span>
+        </button>
+      </div>
+
+      <div class="modal-body">
+        <div class="alert alert-warning">
+          Send it to the partner now — <strong>closing this dialog is the last you see of it</strong>.
+        </div>
+
+        <div class="input-group">
+          <%= tag.input type: 'text', class: 'form-control', readonly: true,
+                        value: api_key, id: 'mini-app-api-key-minted-value' %>
+          <div class="input-group-append">
+            <button type="button" class="btn btn-primary" id="mini-app-api-key-copy">Copy</button>
+          </div>
+        </div>
+      </div>
+
+      <div class="modal-footer">
+        <button type="button" class="btn btn-secondary" data-minted-key-close>Done</button>
+      </div>
+    </div>
+  </div>
+</div>
+
+<div class="modal-backdrop show" id="mini-app-api-key-minted-backdrop"></div>
+
+<script>
+  (function () {
+    var modal = document.getElementById('mini-app-api-key-minted-modal');
+    var backdrop = document.getElementById('mini-app-api-key-minted-backdrop');
+    var field = document.getElementById('mini-app-api-key-minted-value');
+    var button = document.getElementById('mini-app-api-key-copy');
+
+    if (field && button) {
+      button.addEventListener('click', function () {
+        field.select();
+
+        // navigator.clipboard is absent outside a secure context. select() has still put the key on
+        // screen selected, so it can be copied by hand rather than lost.
+        if (navigator.clipboard) navigator.clipboard.writeText(field.value);
+
+        button.textContent = 'Copied';
+      });
+    }
+
+    // Our own close rather than data-dismiss: the dialog was never handed to Bootstrap, so Bootstrap
+    // has no state to hide. Removing both nodes is the whole of it.
+    function close() {
+      if (modal) modal.remove();
+      if (backdrop) backdrop.remove();
+    }
+
+    Array.prototype.forEach.call(
+      document.querySelectorAll('[data-minted-key-close]'),
+      function (el) { el.addEventListener('click', close); }
+    );
+  })();
+</script>

data/app/views/spree/admin/oauth_applications/_api_key_modal.html.erb

@@ -0,0 +1,68 @@
+<%# Outside the application's form — forms cannot nest. Replacing a key cuts the mini app off
+    until they deploy the new one, so only that asks for the name typed back; a first key has
+    nothing to lose. The controller checks it again — a stale page walks straight past this. %>
+
+<% replacing_key = mini_app.api_key.present? %>
+
+<div class="modal fade" id="mini-app-api-key-modal" tabindex="-1" role="dialog" aria-labelledby="miniAppApiKeyModalLabel" aria-hidden="true">
+  <div class="modal-dialog" role="document">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title" id="miniAppApiKeyModalLabel">
+          <%= replacing_key ? 'Regenerate this API key?' : 'Generate an API key?' %>
+        </h5>
+        <button type="button" class="close" data-dismiss="modal" aria-label="Close">
+          <span aria-hidden="true">&times;</span>
+        </button>
+      </div>
+
+      <%= form_with url: spree.admin_oauth_application_api_key_path(application), method: :post, local: true do %>
+        <div class="modal-body">
+          <% if replacing_key %>
+            <div class="alert alert-warning mb-3">
+              The current key stops working the moment this is done.
+              <strong>The partner cannot reach us again until they deploy the new one.</strong>
+            </div>
+
+            <div class="form-group mb-0">
+              <label>Type the application name <code class="text-danger"><%= application.name %></code> to confirm</label>
+              <%= text_field_tag :api_key_confirm, nil, class: 'form-control', autocomplete: 'off', id: 'mini-app-api-key-confirm' %>
+            </div>
+          <% else %>
+            <div class="alert alert-info mb-0">
+              This key names the application on its server-to-server calls.
+              <strong>Send it to the partner</strong> — they have to include it on every request,
+              and nothing they send reaches us until they do.
+            </div>
+          <% end %>
+        </div>
+
+        <div class="modal-footer">
+          <button type="button" class="btn btn-secondary" data-dismiss="modal">Cancel</button>
+          <%= submit_tag replacing_key ? 'Regenerate key' : 'Generate key',
+                         class: "btn #{replacing_key ? 'btn-danger' : 'btn-primary'}",
+                         id: 'mini-app-api-key-generate' %>
+        </div>
+      <% end %>
+    </div>
+  </div>
+</div>
+
+<% if replacing_key %>
+  <%# Left enabled in the markup so a script that never runs cannot strand an admin who needs to
+      rotate a leaked key; the controller is what actually refuses. %>
+  <script>
+    (function () {
+      var input = document.getElementById('mini-app-api-key-confirm');
+      var submit = document.getElementById('mini-app-api-key-generate');
+      if (!input || !submit) return;
+
+      var expected = '<%= j application.name %>';
+
+      function sync() { submit.disabled = input.value.trim() !== expected; }
+
+      sync();
+      input.addEventListener('input', sync);
+    })();
+  </script>
+<% end %>

data/app/views/spree/admin/oauth_applications/_api_key_restore_list.html.erb

@@ -0,0 +1,40 @@
+<%# Fetched when the dialog is opened, not rendered with the page: reading history costs a scan of the
+    application's versions, and this way the keys are never in the markup of a page nobody asked. %>
+
+<% if entries.empty? %>
+  <div class="alert alert-info mb-0">
+    This application has held no other key — there is nothing to restore.
+  </div>
+<% else %>
+  <p class="text-muted mb-3">
+    Pick the key the partner is still using — their calls start working again with no deploy on
+    their side.
+  </p>
+
+  <div class="list-group mb-3">
+    <% entries.each do |entry| %>
+      <label class="list-group-item list-group-item-action d-flex align-items-start mb-0">
+        <%= radio_button_tag :version_id, entry.version_id, false, class: 'mt-1 mr-3' %>
+
+        <span class="text-break">
+          <code class="text-body"><%= entry.key %></code>
+          <% if entry.revoked %>
+            <span class="badge badge-danger ml-1" title="Cleared rather than replaced — usually a leak">revoked</span>
+          <% end %>
+
+          <small class="d-block text-muted">
+            <%= entry.source.to_s.titleize.presence || 'Unknown' %>
+            <%= entry.created_at&.strftime('%d %b %Y %H:%M') %>
+            <%= "· #{entry.created_by}" if entry.created_by.present? %>
+          </small>
+        </span>
+      </label>
+    <% end %>
+  </div>
+
+  <div class="form-group mb-0">
+    <label>Type the application name <code class="text-danger"><%= application.name %></code> to confirm</label>
+    <%= text_field_tag :api_key_confirm, nil, class: 'form-control', autocomplete: 'off',
+                       id: 'mini-app-api-key-restore-confirm' %>
+  </div>
+<% end %>

data/app/views/spree/admin/oauth_applications/_api_key_restore_modal.html.erb

@@ -0,0 +1,72 @@
+<%# The form submits a version id, never a key — the plaintext is read out of history in the controller,
+    so nothing weak or foreign can be typed into the column. The body arrives from #history the first
+    time the dialog is opened. %>
+
+<div class="modal fade" id="mini-app-api-key-restore-modal" tabindex="-1" role="dialog"
+     aria-labelledby="miniAppApiKeyRestoreModalLabel" aria-hidden="true">
+  <div class="modal-dialog modal-lg" role="document">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title" id="miniAppApiKeyRestoreModalLabel">Restore a previous API key</h5>
+        <button type="button" class="close" data-dismiss="modal" aria-label="Close">
+          <span aria-hidden="true">&times;</span>
+        </button>
+      </div>
+
+      <%= form_with url: spree.admin_oauth_application_api_key_path(application), method: :patch, local: true do %>
+        <div class="modal-body" id="mini-app-api-key-restore-body">
+          <p class="text-muted mb-0">Loading previous keys…</p>
+        </div>
+
+        <div class="modal-footer">
+          <button type="button" class="btn btn-secondary" data-dismiss="modal">Cancel</button>
+          <%= submit_tag 'Restore key', class: 'btn btn-primary', id: 'mini-app-api-key-restore-submit',
+                                        disabled: true %>
+        </div>
+      <% end %>
+    </div>
+  </div>
+</div>
+
+<script>
+  (function () {
+    var modal = document.getElementById('mini-app-api-key-restore-modal');
+    var opener = document.getElementById('mini-app-api-key-restore-open');
+    var body = document.getElementById('mini-app-api-key-restore-body');
+    var submit = document.getElementById('mini-app-api-key-restore-submit');
+    if (!modal || !opener || !body || !submit) return;
+
+    var url = '<%= j spree.history_admin_oauth_application_api_key_path(application) %>';
+    var expected = '<%= j application.name %>';
+    var requested = false;
+
+    // Delegated, because the radios and the confirmation field do not exist until the body arrives.
+    function sync() {
+      var chosen = modal.querySelector('input[name="version_id"]:checked');
+      var typed = modal.querySelector('#mini-app-api-key-restore-confirm');
+
+      submit.disabled = !chosen || !typed || typed.value.trim() !== expected;
+    }
+
+    function load() {
+      if (requested) return;
+      requested = true;
+
+      fetch(url, { credentials: 'same-origin', headers: { 'Accept': 'text/html' } })
+        .then(function (response) {
+          if (!response.ok) throw new Error(response.status);
+          return response.text();
+        })
+        .then(function (html) { body.innerHTML = html; sync(); })
+        .catch(function () {
+          // Left retryable: the next click asks again rather than stranding an admin mid-incident.
+          requested = false;
+          body.innerHTML = '<div class="alert alert-danger mb-0">Could not load previous keys. Close this and try again.</div>';
+        });
+    }
+
+    opener.addEventListener('click', load);
+    modal.addEventListener('change', sync);
+    modal.addEventListener('input', sync);
+  })();
+</script>