spree_cm_commissioner 2.13.3 → 2.13.4

data/app/views/spree/admin/oauth_applications/_api_key_revoke_modal.html.erb

@@ -0,0 +1,54 @@
+<%# Outside the application's form — forms cannot nest. Revoking leaves the partner with nothing to
+    deploy in place of the old key, so it costs the application's name typed back. The controller
+    checks it again — a stale page walks straight past this. %>
+
+<div class="modal fade" id="mini-app-api-key-revoke-modal" tabindex="-1" role="dialog"
+     aria-labelledby="miniAppApiKeyRevokeModalLabel" aria-hidden="true">
+  <div class="modal-dialog" role="document">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title" id="miniAppApiKeyRevokeModalLabel">Revoke this API key?</h5>
+        <button type="button" class="close" data-dismiss="modal" aria-label="Close">
+          <span aria-hidden="true">&times;</span>
+        </button>
+      </div>
+
+      <%= form_with url: spree.admin_oauth_application_api_key_path(application), method: :delete, local: true do %>
+        <div class="modal-body">
+          <div class="alert alert-danger mb-3">
+            The mini app is left with no key at all — unlike Regenerate, nothing takes the old key's place.
+            <strong>Nothing the partner sends reaches us until a new key is generated and they deploy it.</strong>
+          </div>
+
+          <div class="form-group mb-0">
+            <label>Type the application name <code class="text-danger"><%= application.name %></code> to confirm</label>
+            <%= text_field_tag :api_key_confirm, nil, class: 'form-control', autocomplete: 'off',
+                               id: 'mini-app-api-key-revoke-confirm' %>
+          </div>
+        </div>
+
+        <div class="modal-footer">
+          <button type="button" class="btn btn-secondary" data-dismiss="modal">Cancel</button>
+          <%= submit_tag 'Revoke key', class: 'btn btn-danger', id: 'mini-app-api-key-revoke-submit' %>
+        </div>
+      <% end %>
+    </div>
+  </div>
+</div>
+
+<%# Left enabled in the markup so a script that never runs cannot strand an admin who needs to revoke
+    a leaked key; the controller is what actually refuses. %>
+<script>
+  (function () {
+    var input = document.getElementById('mini-app-api-key-revoke-confirm');
+    var submit = document.getElementById('mini-app-api-key-revoke-submit');
+    if (!input || !submit) return;
+
+    var expected = '<%= j application.name %>';
+
+    function sync() { submit.disabled = input.value.trim() !== expected; }
+
+    sync();
+    input.addEventListener('input', sync);
+  })();
+</script>

data/app/views/spree/admin/oauth_applications/_form.html.erb

@@ -0,0 +1,152 @@
+<%# Overrides spree_backend's single-column form to sit the mini app settings beside the
+    application's own. `admin_oauth_application_form_fields` has to stay in the left column or the
+    tenant deface override (_form/tenant_fields.html.erb.deface) lands away from its fields. %>
+
+<div data-hook="oauth_application" class="row">
+  <div class="col-12 col-md-6">
+    <div class="card mb-3">
+      <div class="card-header">
+        <h5 class="mb-0"><%= Spree.t(:settings) %></h5>
+      </div>
+
+      <div class="card-body">
+        <div data-hook="admin_oauth_application_form_fields">
+          <%= f.field_container :name, 'data-hook' => "oauth_application_name" do %>
+            <%= f.label :name, raw(Spree.t(:name) + required_span_tag) %>
+            <%= f.text_field :name, class: 'form-control', required: true %>
+            <%= f.error_message_on :name %>
+          <% end %>
+
+          <%= f.field_container :scopes, 'data-hook' => "oauth_application_scopes" do %>
+            <%= f.label :scopes, raw(Spree.t(:scopes) + required_span_tag) %>
+            <%= f.text_field :scopes, class: 'form-control' %>
+            <%= f.error_message_on :scopes %>
+            <small class="form-text text-muted">
+              Possible values:
+              <ul>
+                <li><strong>admin read</strong> - read only access</li>
+                <li><strong>admin write</strong> - read and write access</li>
+              </ul>
+            </small>
+          <% end %>
+
+          <div data-hook="additional_oauth_application_fields"></div>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <div class="col-12 col-md-6">
+    <%# Mirrors the payment method form's provider settings card. The provider names which mini app
+        this application stands for, and the fields below come from that mini app's own class under
+        SpreeCmCommissioner::MiniAppProvider — the stand-in for a gateway owning its preferences by
+        its own class. %>
+
+    <% mini_app = f.object.mini_app %>
+
+    <div data-hook="admin_oauth_application_mini_app" class="card mb-3">
+      <div class="card-header">
+        <h5 class="mb-0">Mini App</h5>
+      </div>
+
+      <div class="card-body">
+        <%= f.field_container :provider do %>
+          <%= f.label :provider, 'Provider' %>
+          <%= f.select :provider, SpreeCmCommissioner::MiniAppProvider::Base.providers.map(&:provider), { include_blank: 'None' }, { class: 'form-control' } %>
+          <%= f.error_message_on :provider %>
+        <% end %>
+
+        <div id="mini-app-settings" data-hook>
+          <% unless mini_app.nil? %>
+          <% if mini_app.preference_groups.empty? %>
+            <small class="form-text text-muted">
+              Nothing else to set here — this mini app's remaining settings come from the environment.
+            </small>
+          <% else %>
+            <%= f.fields_for :mini_app_attributes, mini_app do |pf| %>
+              <% headings = { credentials: 'Credentials',
+                              ip_rules: 'IP rules',
+                              rate_limits: 'Rate limits (per minute, 0 to turn off)' } %>
+              <%# Examples rather than a rule in the heading, so the format is in front of
+                  whoever is typing. preference_field_for cannot carry one. %>
+              <% placeholders = { allowed_ips: '203.0.113.0/24, 198.51.100.7', blocked_ips: '198.51.100.9' } %>
+
+              <%# humanize alone drops a trailing _id and lowercases every acronym. The
+                  trailing group keeps a plural's s lowercase: IPs, not IPS. %>
+              <% acronyms = /\b(id|ip|api)(s?)\b/i %>
+
+              <% mini_app.preference_groups.each do |group, names| %>
+                <h6 class="text-muted mt-4"><%= headings.fetch(group, group.to_s.humanize) %></h6>
+
+                <% names.each do |name| %>
+                  <div class="form-group" id="<%= "mini-app-preference-#{name}" %>">
+                    <%= pf.label "preferred_#{name}", name.to_s.humanize(keep_id_suffix: true).gsub(acronyms) { "#{Regexp.last_match(1).upcase}#{Regexp.last_match(2)}" } %>
+                    <% if placeholders[name] %>
+                      <%= pf.text_field "preferred_#{name}", class: 'form-control', placeholder: placeholders[name] %>
+                    <% else %>
+                      <%= preference_field_for(pf, "preferred_#{name}", type: mini_app.preference_type(name)) %>
+                    <% end %>
+                  </div>
+                <% end %>
+              <% end %>
+            <% end %>
+          <% end %>
+
+          <%# Last in the card, under everything the admin types here. The field carries no name, so
+              this form cannot submit the key however it is edited — Generate, Restore and Revoke each
+              post to an action of their own, from a dialog outside this form. %>
+          <% if mini_app.supports_api_key? %>
+            <% has_key = mini_app.api_key.present? %>
+
+            <h6 class="text-muted mt-4">API key</h6>
+
+            <%# `row` without `form-group`: the caption underneath belongs to the field and reads as
+                one block with it, which form-group's bottom margin pulls apart. %>
+            <div class="row align-items-center" id="mini-app-api-key">
+              <div class="col">
+                <%# A mask, never the key: it is on screen once, in the dialog that follows minting. The
+                    last four characters stay, so the stored key can be checked against the one the
+                    partner quotes back without putting it on the page. %>
+                <%= tag.input type: 'text', class: 'form-control', readonly: true,
+                              id: 'mini-app-api-key-value', value: mini_app.masked_api_key,
+                              placeholder: 'Not generated yet' %>
+              </div>
+
+              <% if f.object.persisted? %>
+                <div class="col-auto pl-0">
+                  <button type="button" class="btn <%= has_key ? 'btn-outline-danger' : 'btn-outline-primary' %>"
+                          data-toggle="modal" data-target="#mini-app-api-key-modal">
+                    <%= has_key ? 'Regenerate' : 'Generate' %>
+                  </button>
+
+                  <% if has_key %>
+                    <button type="button" class="btn btn-outline-danger"
+                            data-toggle="modal" data-target="#mini-app-api-key-revoke-modal">
+                      Revoke
+                    </button>
+                  <% end %>
+
+                  <button type="button" class="btn btn-outline-secondary" id="mini-app-api-key-restore-open"
+                          data-toggle="modal" data-target="#mini-app-api-key-restore-modal">
+                    Restore
+                  </button>
+                </div>
+              <% end %>
+            </div>
+
+            <% if f.object.persisted? && has_key %>
+              <small class="form-text text-muted mt-1 mb-0"><%= mini_app.api_key_provenance %></small>
+            <% end %>
+
+            <% unless f.object.persisted? %>
+              <small class="form-text text-muted mt-1 mb-0">Save the application first, then generate its key.</small>
+            <% end %>
+
+
+          <% end %>
+        <% end %>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>

data/app/views/spree/admin/oauth_applications/edit.html.erb

@@ -0,0 +1,36 @@
+<%# Overrides spree_backend's template only to render the API key dialogs down here: their forms
+    post to actions of their own and cannot nest inside the application's. %>
+
+<% content_for :page_title do %>
+  <%= link_to Spree.t('admin.oauth_applications.list'), spree.admin_oauth_applications_url %> /
+  <%= @oauth_application.name.capitalize %>
+<% end %>
+
+<%= render partial: 'spree/admin/shared/error_messages', locals: { target: @oauth_application } %>
+
+<%= form_for [:admin, @oauth_application] do |f| %>
+  <fieldset>
+    <%= render partial: 'form', locals: { f: f } %>
+    <%= render partial: 'spree/admin/shared/edit_resource_links' %>
+  </fieldset>
+<% end %>
+
+<% mini_app = @oauth_application.mini_app %>
+
+<% if mini_app&.supports_api_key? %>
+  <% if @minted_api_key.present? %>
+    <%= render partial: 'api_key_minted_modal', locals: { api_key: @minted_api_key } %>
+  <% end %>
+
+  <%= render partial: 'api_key_modal',
+             locals: { application: @oauth_application, mini_app: mini_app } %>
+
+  <%# Restorable even with no key in place: revoking is one of the things it undoes. The list of keys
+      is fetched when the dialog opens, so nothing here reads history. %>
+  <%= render partial: 'api_key_restore_modal', locals: { application: @oauth_application } %>
+
+  <% if mini_app.api_key.present? %>
+    <%= render partial: 'api_key_revoke_modal',
+               locals: { application: @oauth_application } %>
+  <% end %>
+<% end %>

data/app/views/spree/admin/shared/_ticket_transfer_details.html.erb

@@ -109,7 +109,7 @@
                   <% guest_label = @ticket_transfer.from_guest.display_name_with_bib.presence || "Guest ##{@ticket_transfer.from_guest.id}" %>
                   <% source_order = @ticket_transfer.from_guest.line_item&.order %>
                   <% if source_order %>
-                    <%= link_to guest_label, spree.edit_admin_order_path(source_order.number) %>
+                    <%= link_to guest_label, spree.admin_order_guests_path(source_order) %>
                   <% else %>
                     <%= guest_label %>
                   <% end %>
@@ -138,7 +138,13 @@
               <th scope="row">Guest</th>
               <td>
                 <% if @ticket_transfer.to_guest %>
-                  <%= @ticket_transfer.to_guest.display_name_with_bib.presence || "Guest ##{@ticket_transfer.to_guest.id}" %>
+                  <% to_guest_label = @ticket_transfer.to_guest.display_name_with_bib.presence || "Guest ##{@ticket_transfer.to_guest.id}" %>
+                  <% to_order = @ticket_transfer.to_guest.line_item&.order %>
+                  <% if to_order %>
+                    <%= link_to to_guest_label, spree.admin_order_guests_path(to_order) %>
+                  <% else %>
+                    <%= to_guest_label %>
+                  <% end %>
                 <% else %>
                   <span class="text-muted">None</span>
                 <% end %>

data/config/locales/en.yml

@@ -1194,3 +1194,15 @@ en:
   service_fee:
     rules:
       rule_already_exists_for_scope: "An active service fee rule already exists for %{scope_type} with currency %{currency}"
+  mini_apps:
+    api_key:
+      unsupported: "This application does not stand for a mini app that uses an API key."
+      stale: "API key left unchanged: it was replaced while this page was open."
+      confirmation_mismatched: "API key left unchanged: the confirmation did not match the application name."
+      saved: "API key saved. Nothing the partner sends reaches us until their calls carry exactly this value."
+      nothing_to_revoke: "There is no API key to revoke."
+      revoked: "API key revoked. The mini app has no way in until a new key is generated and the partner deploys it."
+      restored: "API key restored. The partner's existing key works again — nothing to deploy on their side."
+      not_restorable: "That key could not be read back. It may have been removed, or the encryption keys have changed since."
+    ip_rules:
+      invalid: "%{name} must be addresses or CIDR ranges"

data/config/routes.rb

@@ -374,6 +374,12 @@ Spree::Core::Engine.add_routes do
       resources :ticket_transfers, controller: 'order_ticket_transfers', only: %i[index show]
     end
 
+    resources :oauth_applications, only: [] do
+      resource :api_key, only: %i[create update destroy], controller: :oauth_application_api_keys do
+        get :history
+      end
+    end
+
     resources :user_events, except: %i[show edit update]
     resources :telegram_bots do
       member do
@@ -431,119 +437,6 @@ Spree::Core::Engine.add_routes do
     get '/resource_not_found', to: 'errors#resource_not_found'
   end
 
-  scope '(:locale)', locale: /#{I18n.available_locales.join('|')}/ do
-    namespace :billing do
-      resources :reports do
-        collection do
-          get :failed_orders
-          get :paid
-          get :balance_due
-          get :overdue
-          get :active_subscribers
-          get :export
-          put :print_all_invoices
-          get :export_orders
-        end
-      end
-      resources :vendors do
-        resource :payment_qrcodes, only: %i[destroy]
-      end
-      resources :customers do
-        post 're_create_order', to: 'customers#re_create_order'
-        post 'apply_promotion', to: 'customers#apply_promotion'
-        delete 'delete_promotion', to: 'customers#delete_promotion'
-        resources :orders
-        resources :subscriptions
-        resources :addresses
-        resources :store_credits
-      end
-      resources :roles
-      resources :users do
-        resource :account_deletions, only: [:destroy]
-      end
-      resources :products do
-        member do
-          get :stock
-        end
-        resources :variants do
-          collection do
-            post :update_positions
-          end
-        end
-        resources :refunds, only: %i[new create edit update]
-      end
-      resources :variants do
-        collection do
-          post :update_positions
-        end
-
-        resources :variants_including_master, only: [:update]
-      end
-      resources :orders do
-        resource :invoice, only: %i[show create], controller: :invoice do
-          collection do
-            put :print_invoice_date
-          end
-        end
-        resources :payments do
-          resources :refunds, only: %i[new create edit update]
-        end
-        resources :adjustments
-      end
-      resources :places
-      put '/switch_vendor', to: 'base#switch_vendor'
-      get '/forbidden', to: 'errors#forbidden', as: :forbidden
-      root to: redirect('/billing/reports')
-      resources :businesses
-      resources :option_types do
-        collection do
-          post :update_positions
-          post :update_values_positions
-        end
-      end
-    end
-  end
-
-  namespace :transit do
-    namespace :vectors do
-      resources :icons, only: [:index]
-      resources :amenity_values, only: %i[index update] do
-        collection do
-          post :update
-        end
-      end
-    end
-
-    resources :reservations
-    resources :locations
-    resources :branches
-    resources :stops
-    resources :routes do
-      resources :trips do
-        resources :trip_stops do
-          post :update_sequences, on: :collection
-        end
-      end
-    end
-    resources :places
-    resource :amenity, only: %i[new create edit update]
-    post '/amenity/update_positions'
-    post '/amenity/update_values_positions'
-    resources :vehicle_types do
-      resources :vehicle_seats
-    end
-    resources :vehicles do
-      resources :vehicle_photos do
-        collection do
-          post :update_positions
-        end
-      end
-    end
-    root to: redirect('/transit/reservations')
-    post '/vehicle_types/vehicle_seats/load_seat', to: 'vehicle_seats#load_seat'
-    post '/vehicle_types/layer', to: 'vehicle_types#layer'
-  end
-
   namespace :api, defaults: { format: 'json' } do
     namespace :v2 do
       namespace :platform do
@@ -819,8 +712,17 @@ Spree::Core::Engine.add_routes do
         resources :guests, only: %i[create update show] do
           resources :id_cards
         end
+
+        # deprecated: use the nested dynamic fields under products instead.
         resources :dynamic_field_options
         resources :dynamic_fields
+
+        resources :products, only: [] do
+          resources :dynamic_fields, only: :index do
+            resources :dynamic_field_options, only: :index
+          end
+        end
+
         resources :user_guests do
           resources :id_cards
         end

data/db/migrate/20260928070109_add_provider_and_api_key_to_spree_oauth_applications.rb

@@ -0,0 +1,11 @@
+class AddProviderAndApiKeyToSpreeOauthApplications < ActiveRecord::Migration[7.0]
+  def change
+    add_column :spree_oauth_applications, :provider, :string, if_not_exists: true
+    add_column :spree_oauth_applications, :api_key, :string, if_not_exists: true
+
+    add_index :spree_oauth_applications, :provider, unique: true, if_not_exists: true,
+                                                    where: "provider IS NOT NULL AND provider <> ''"
+    add_index :spree_oauth_applications, :api_key, unique: true, if_not_exists: true,
+                                                   where: 'api_key IS NOT NULL'
+  end
+end

data/lib/spree_cm_commissioner/test_helper/factories/vendor_factory.rb

@@ -1,13 +1,27 @@
+FactoryBot.define do
+  # Spree::Vendor validates name uniqueness. One shared counter keeps names unique across every
+  # vendor factory; FFaker::Company.name alone repeats, and "#{n}#{rand}" collides (1+"23" vs 12+"3").
+  sequence(:vendor_name) { |n| "#{FFaker::Company.name} #{n}" }
+end
+
+# spree_multi_vendor's :vendor factory (used directly by e.g. cm_vehicle_type) names vendors with a
+# bare FFaker::Company.name, which made specs creating several vendors fail at random.
+FactoryBot.modify do
+  factory :vendor do
+    name { generate(:vendor_name) }
+  end
+end
+
 FactoryBot.define do
   factory :cm_transit_vendor, parent: :vendor do
     from_email { FFaker::Internet.email } # required only when tenant exist.
-    sequence(:name) { |n| "#{FFaker::Company.name} #{n}#{Kernel.rand(9999)}" }
+    name { generate(:vendor_name) }
     state { :active }
     primary_product_type { :transit }
   end
 
   factory :cm_vendor, parent: :vendor do
-    sequence(:name) { |n| "#{FFaker::Company.name} #{n}#{Kernel.rand(9999)}" }
+    name { generate(:vendor_name) }
     from_email { FFaker::Internet.email } # required only when tenant exist.
     state { :active }
     default_state_id { Spree::State.first&.id }

data/lib/spree_cm_commissioner/version.rb

@@ -1,5 +1,5 @@
 module SpreeCmCommissioner
-  VERSION = '2.13.3'.freeze
+  VERSION = '2.13.4'.freeze
 
   module_function
 

data/lib/spree_cm_commissioner.rb

@@ -69,7 +69,7 @@ require 'byebug' if Rails.env.development? || Rails.env.test?
 module SpreeCmCommissioner
   class << self
     # Allows overriding the default Redis connection pools with custom ones
-    attr_writer :inventory_redis_pool, :voting_redis_pool
+    attr_writer :inventory_redis_pool, :voting_redis_pool, :redis_pool
 
     # Inventory Redis pool for inventory management
     def inventory_redis_pool
@@ -81,10 +81,17 @@ module SpreeCmCommissioner
       @voting_redis_pool ||= default_redis_pool
     end
 
+    # General-purpose pool for callers with no dedicated pool of their own,
+    # e.g. RateLimiter counters.
+    def redis_pool
+      @redis_pool ||= default_redis_pool
+    end
+
     # Resets all Redis pools, useful for testing or reinitialization
     def reset_redis_pools
       @inventory_redis_pool = nil
       @voting_redis_pool = nil
+      @redis_pool = nil
     end
 
     private