spree_cm_commissioner 2.13.5 → 2.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9473bef71175dc42b69c1959ac56827e1ca0ef2b6c13205ed2c83793e678a21f
-  data.tar.gz: 314a9fbe0dbc6fe925f435b3eaeef9d737689f81fb7d95e631bbcf10a2e3e8bf
+  metadata.gz: ba98474e53d7bb369512ec096ad8459a8baae5d2d77985462e99d48cd4d68820
+  data.tar.gz: 9588226b0da09b905292b7518b656ee4261d03ca1e6e55beb526a96ee3365e87
 SHA512:
-  metadata.gz: fa509b4c09684a80915bca9927228aa41de193821593d00f84da4cd1bb2f2b0d5034146d9c52e4dec654ad57092ac87273771be63841b66546cb1a1b63e0077d
-  data.tar.gz: f04d83d04ce10ebb051931a0bde85c690e279ac08d18e90b3be9e2f14721992c9e04096ef1eab051e1dde8b81ba6ea6aef356ca77422ac27ecb05aebf7f2e5c8
+  metadata.gz: f09ce118715100ba4d56d0b3c828c946277d632329c1b84e0517f1b513ec4cf64d055bceb6696983324b46f4df428ad0626f959dc961f1e73bdf22c4fac79b51
+  data.tar.gz: 72ca04d1fe1ab0f6741269127a90b9f005c7569b55b7e41e619fa3bce15564131414dacf36d619a4d44020a57e8e298581d42f0a06b7933a682343058a266e39

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.13.5)
+    spree_cm_commissioner (2.14.0)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/assets/javascripts/spree_cm_commissioner/backend.js

@@ -1,7 +1,6 @@
 //= require map/map-control-button
 //= require map/map-picker
 //= require spree_cm_commissioner/routes
-//= require spree_cm_commissioner/calendar
 //= require spree_cm_commissioner/annual_calendar_form
 //= require spree_cm_commissioner/tenant_payment_icon_fields
 //= require spree_cm_commissioner/copy_to_clipboard

data/app/assets/stylesheets/spree_cm_commissioner/backend/calendar.scss

@@ -22,37 +22,6 @@ $day-background: theme-color("light");
     @include hover {
       background-color: darken($day-background, 5%);
     }
-
-    .c-date-container {
-      display: flex;
-      flex-flow: column;
-      height: 100%;
-
-      .c-date {
-        padding: 6px;
-        cursor: pointer;
-      }
-
-      .c-events-container {
-        flex-grow: 1;
-        display: flex;
-        align-items: flex-end;
-      }
-
-      .c-events {
-        display: flex;
-        align-items: flex-end;
-
-        .c-event {
-          width: 8px;
-          height: 8px;
-          border-radius: 4px;
-          background-color: theme-color("primary");
-          margin-right: 4px;
-          cursor: pointer;
-        }
-      }
-    }
   }
 
   .wday-0 {
@@ -103,14 +72,6 @@ $day-background: theme-color("light");
   // }
 }
 
-.c-month-calendar {
-  .simple-calendar {
-    table {
-      @extend .table-responsive-md;
-    }
-  }
-}
-
 .c-annual-calendar {
   @extend .row;
 

data/app/controllers/concerns/spree/admin/rates_availability_cells.rb

@@ -0,0 +1,16 @@
+module Spree
+  module Admin
+    # The `cells` the Rates & Availability grid posts for its selection, shaped by the script's raCellData:
+    # { type: 'stock' | 'price', variant_id:, rate_plan_id: ('' for the variant's own prices), date: ('' for Base) }.
+    # They travel in a JSON body, as a selection across months can be thousands.
+    module RatesAvailabilityCells
+      extend ActiveSupport::Concern
+
+      private
+
+      def selected_cells
+        @selected_cells ||= params.permit(cells: %i[type variant_id rate_plan_id date]).fetch(:cells, []).map { |cell| cell.to_h.symbolize_keys }
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree/api/v2/product_list_includes_decorator.rb

@@ -18,6 +18,7 @@ module Spree
             stock_items: :stock_location
           }
           base_includes[:product_option_types] = :option_type
+          base_includes[:variant_kind_product_option_types] = :option_type
           base_includes[:product_promotion_rules] = {
             promotion_rule: {
               promotion: []

data/app/controllers/spree/admin/base_controller_decorator.rb

@@ -1,6 +1,10 @@
 module Spree
   module Admin
     module BaseControllerDecorator
+      def self.prepended(base)
+        base.before_action :set_prepaid_current_actor
+      end
+
       # even db in read only mode, authorizor still need to run Warden callbacks which will write to db
       # this include update tracked fields such as sign_in_count, last_sign_in_at, etc.
       def authorize!(*args)
@@ -40,6 +44,16 @@ module Spree
 
         redirect_back fallback_location: admin_root_path
       end
+
+      private
+
+      # See SpreeCmCommissioner::Current#actor -- lets StoreCreditEventDecorator's after_create
+      # mirror attribute an admin-triggered authorize/capture/void/credit event (refunds, voids)
+      # to whoever is signed in, without threading current_user through Spree core's own
+      # Payment/Refund/StoreCredit call chain.
+      def set_prepaid_current_actor
+        SpreeCmCommissioner::Current.actor = try_spree_current_user
+      end
     end
   end
 end

data/app/controllers/spree/admin/customer_notifications_controller.rb

@@ -2,7 +2,22 @@ module Spree
   module Admin
     class CustomerNotificationsController < Spree::Admin::ResourceController
       def index
-        @notifications = SpreeCmCommissioner::CustomerNotification.all
+        @search = model_class.ransack(params[:q])
+        @search.sorts = 'created_at desc' if @search.sorts.empty?
+        @notifications = @search.result.page(params[:page]).per(params[:per_page] || 25)
+      end
+
+      # POST /admin/customer_notifications/:id/clone
+      def clone
+        result = SpreeCmCommissioner::CustomerNotifications::Clone.call(customer_notification: @object)
+
+        if result.success?
+          flash[:success] = Spree.t(:customer_notification_cloned)
+          redirect_to edit_admin_customer_notification_url(result.value)
+        else
+          flash[:error] = Spree.t(:customer_notification_not_cloned, error: result.error.to_s)
+          redirect_to admin_customer_notifications_url
+        end
       end
 
       def model_class

data/app/controllers/spree/admin/guests_controller.rb

@@ -43,7 +43,8 @@ module Spree
 
       def edit
         @kyc_fields = @object.line_item.kyc_fields
-        @check_in = @object.check_in
+        @check_ins = @object.check_ins.includes(:check_in_session, :check_in_by)
+        @eligible_check_in_sessions = @object.eligible_check_in_sessions.order(:position)
       end
 
       def check_in

data/app/controllers/spree/admin/integrations_controller.rb

@@ -35,6 +35,17 @@ module Spree
         admin_integrations_url(options)
       end
 
+      # Builds the chosen subclass rather than the base Integration: `create` only assigns `type`
+      # afterwards, which changes the column but not the object's class, so the subclass's
+      # callbacks and attribute defaults would never run. `create` posts the type in the form;
+      # `new` gets it as ?type= when one is picked. With no type yet, or one that isn't an
+      # integration, it stays the base class (never constantized).
+      # override
+      def build_resource
+        type = params.dig(:spree_cm_commissioner_integration, :type).presence || params[:type]
+        SpreeCmCommissioner::Integration.types.include?(type) ? type.constantize.new : model_class.new
+      end
+
       private
 
       def permitted_resource_params
@@ -47,6 +58,7 @@ module Spree
           :full_sync_interval_hours,
           :tenant_id,
           :vendor_id,
+          :oauth_application_id,
           public_metadata: {},
           private_metadata: {}
         )
@@ -62,6 +74,7 @@ module Spree
         @conflict_strategy_options ||= enum_to_options(SpreeCmCommissioner::Integration.conflict_strategies)
         @tenants ||= SpreeCmCommissioner::Tenant.select(:id, :name).order(:name)
         @vendors ||= Spree::Vendor.select(:id, :name).order(:name)
+        @oauth_applications ||= Spree::OauthApplication.select(:id, :name).order(:name)
       end
 
       def enum_to_options(enum_hash)
@@ -69,14 +82,10 @@ module Spree
       end
 
       def integration_type_options
-        files = Dir[SpreeCmCommissioner::Engine.root.join('app/models/spree_cm_commissioner/integrations/*.rb')]
-
-        return [[Spree.t(:type), 'SpreeCmCommissioner::Integration']] if files.blank?
+        types = SpreeCmCommissioner::Integration.types
+        return [[Spree.t(:type), 'SpreeCmCommissioner::Integration']] if types.blank?
 
-        files.map do |path|
-          class_name = "SpreeCmCommissioner::Integrations::#{File.basename(path, '.rb').camelize}"
-          [class_name, class_name]
-        end.sort_by(&:first)
+        types.map { |class_name| [class_name, class_name] }
       end
     end
   end

data/app/controllers/spree/admin/inventory_items_controller.rb

@@ -1,73 +1,25 @@
 module Spree
   module Admin
     class InventoryItemsController < StockManagementsController
-      before_action :load_parent
-
-      # GET /products/:slug/inventory_items/prices?inventory_item_ids=1,2,3
-      def prices
-        inventory_item_ids = params[:inventory_item_ids]
-        @inventory_items = @product.inventory_items.where(id: inventory_item_ids)
-      end
-
-      # GET /products/:slug/inventory_items/stocks?inventory_item_ids=1,2,3
-      def stocks
-        inventory_item_ids = params[:inventory_item_ids]
-        @inventory_items = @product.inventory_items.where(id: inventory_item_ids)
-      end
-
-      # PATCH /products/:slug/inventory_items/bulk_update_prices
-      def bulk_update_prices # rubocop:disable Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
-        inventory_item_ids = params[:inventory_item_ids]
-        inventory_items = @product.inventory_items.where(id: inventory_item_ids)
-
-        inventory_items.each do |inventory_item|
-          params[:prices]&.values&.each do |price_params|
-            next if price_params[:price].empty?
+      include RatesAvailabilityCells
 
-            price = inventory_item.prices.find_or_initialize_by(currency: price_params[:currency])
-            price.price = price_params[:price]
-            price.compare_at_price = price_params[:compare_at_price].empty? ? nil : price_params[:compare_at_price]
-            price.variant_id = inventory_item.variant_id
-            price.save! if (price.new_record? && price.price) || (!price.new_record? && price.changed?)
-          end
-        end
-
-        flash[:success] = "Successfully updated prices for #{inventory_items.count} items"
-        redirect_back fallback_location: admin_product_stock_managements_path(@product)
-      end
+      DETAILS_PER_PAGE = 50
 
-      # PATCH /products/:slug/inventory_items/bulk_update_stocks
-      def bulk_update_stocks
-        inventory_item_ids = params[:inventory_item_ids]
-        inventory_items = @product.inventory_items.where(id: inventory_item_ids)
-        target_quantity = params[:quantity].to_i
-
-        if target_quantity.negative?
-          flash[:error] = "Target quantity (#{target_quantity}) must not be negative"
-          return redirect_back(fallback_location: admin_product_stock_managements_path(@product))
-        end
-
-        inventory_items.each do |inventory_item|
-          # Calculate the difference between target and current quantity
-          quantity_change = target_quantity - inventory_item.quantity_available
-
-          # Use adjust_quantity! to update max_capacity, quantity_available, and sync to Redis
-          inventory_item.adjust_quantity!(quantity_change)
-        end
+      before_action :load_parent
 
-        flash[:success] = "Successfully updated stocks for #{inventory_items.count} items"
-        redirect_back fallback_location: admin_product_stock_managements_path(@product)
-      end
+      helper SpreeCmCommissioner::Admin::RatesAvailabilitiesHelper
 
-      # PATCH /products/:slug/inventory_items/bulk_update_closed
+      # POST /products/:slug/inventory_items/details, JSON: { cells: [...], page: }
       #
-      # Ids travel in the form body, not the query string: a range across a year can be hundreds of ids.
-      def bulk_update_closed
-        closed = ActiveModel::Type::Boolean.new.cast(params[:closed])
-        count = @product.inventory_items.where(id: params[:inventory_item_ids]).update_all(closed: closed, updated_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
-
-        flash[:success] = "#{closed ? 'Closed' : 'Reopened'} #{count} inventory items for sale"
-        redirect_back fallback_location: admin_product_stock_managements_path(@product)
+      # The Rates & Availability grid's stock details modal: the counts of each selected variant and date, as stock
+      # managements shows them. POST, as cells travel in the body.
+      def details
+        inventory_items = selected_inventory_items.page(params[:page]).per(DETAILS_PER_PAGE)
+        cached = SpreeCmCommissioner::RedisStock::CachedInventoryItemsBuilder.new(inventory_items.to_a).call.index_by(&:inventory_item_id)
+
+        render partial: 'details', formats: [:html], locals: {
+          inventory_items: inventory_items, cached_inventory_items: cached, cells: selected_cells
+        }
       end
 
       # PATCH /products/:slug/inventory_items/bulk_reset?inventory_item_ids=1,2,3
@@ -89,6 +41,25 @@ module Spree
 
         redirect_back fallback_location: admin_product_stock_managements_path(@product)
       end
+
+      private
+
+      # Price cells count too: each names a variant and a date. A dated product's Base has no inventory item.
+      def selected_inventory_items
+        pairs = selected_cells.map { |cell| [cell[:variant_id].to_i, cell[:date].presence] }.uniq
+        return SpreeCmCommissioner::InventoryItem.none if pairs.empty?
+
+        # Joined to the exact pairs: variant and date lists alone would also match every other variant on those dates.
+        values = pairs.map { |variant_id, date| ActiveRecord::Base.sanitize_sql_array(['(?, ?::date)', variant_id, date]) }.join(', ')
+        selected = "JOIN (VALUES #{values}) AS selected(variant_id, inventory_date) ON selected.variant_id = cm_inventory_items.variant_id " \
+                   'AND selected.inventory_date IS NOT DISTINCT FROM cm_inventory_items.inventory_date'
+        SpreeCmCommissioner::InventoryItem
+          .where(variant_id: @product.variants_including_master.select(:id))
+          .joins(selected)
+          .joins(:variant)
+          .order('spree_variants.position, cm_inventory_items.variant_id, cm_inventory_items.inventory_date')
+          .preload(variant: [:product, { option_values: :option_type }])
+      end
     end
   end
 end

data/app/controllers/spree/admin/prepaid_transactions_controller.rb

@@ -0,0 +1,69 @@
+module Spree
+  module Admin
+    # Two read-only views over the prepaid ledger:
+    # - #index: platform-wide filterable browse (GET /admin/store_credit/transactions).
+    # - #show: a single ledger row's full detail (GET /admin/store_credit/transactions/:id),
+    #   reached from both #index's row links and the per-user store_credits Transactions tab.
+    #   Not nested under a user/store_credit -- PrepaidTransaction has a global id, and one
+    #   detail page reached from two different listings is simpler than two near-identical ones.
+    #   Currency, balance, admin, and reason/freeze metadata live here rather than cluttering
+    #   either listing table.
+    class PrepaidTransactionsController < Spree::Admin::BaseController
+      TRANSACTIONS_PER_PAGE = 25
+
+      before_action :load_transaction, only: :show
+
+      # GET /admin/store_credit/transactions -- the admin/store_credit dashboard's own
+      # platform-wide ledger browse (see Spree::Admin::StoreCreditAdminController's other tabs and
+      # store_credit_admin/_tabs.html.erb), but its own route/controller rather than a #show?
+      # tab=transactions query param, so filters/pagination live in a real URL.
+      def index
+        @current_tab = 'transactions'
+        @tenants = SpreeCmCommissioner::Tenant.order(:name)
+        @current_tenant_id = params[:tenant_id].presence&.to_i
+        @store = Spree::Store.default
+        build_transactions_search
+      end
+
+      def show; end
+
+      private
+
+      def load_transaction
+        @transaction = SpreeCmCommissioner::PrepaidTransaction.find(params[:id])
+        @user = @transaction.user
+        @store_credit = @transaction.store_credit
+        @reversed = SpreeCmCommissioner::PrepaidTransaction
+                    .exists?(user: @user, transaction_type: 'reverse_top_up', idempotency_key: "admin_reverse:#{@transaction.id}")
+        @return_to = safe_return_to
+      end
+
+      # So the back link on the detail page returns to the exact filtered/paginated Transactions
+      # tab state the admin came from, not a bare reset to page 1 -- only same-admin-namespace
+      # paths are honored, since this is attacker-controllable input (an admin could be tricked
+      # into following a crafted link) and open-redirecting out of /admin would be a phishing vector.
+      def safe_return_to
+        candidate = params[:return_to]
+        candidate if candidate.present? && candidate.start_with?('/admin/')
+      end
+
+      # Individual ledger row search/browse -- scoped to whichever tenant the dashboard's own
+      # tenant selector has picked (tenant_id: nil => platform-issued, same convention as
+      # StoreCreditOverviewQuery), further filtered via Ransack (q[user_email_cont],
+      # q[currency_eq], q[transaction_type_eq], q[created_at_gteq]/[created_at_lteq], ...).
+      def build_transactions_search
+        params[:q] = {} if params[:q].blank?
+        @transactions_search = SpreeCmCommissioner::PrepaidTransaction.where(tenant_id: @current_tenant_id).ransack(params[:q])
+        @transactions = @transactions_search.result
+                                            .includes(:user, :order, :tenant, :admin, :store_credit)
+                                            .order(created_at: :desc)
+                                            .page(params[:page])
+                                            .per(TRANSACTIONS_PER_PAGE)
+      end
+
+      def model_class
+        SpreeCmCommissioner::PrepaidTransaction
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/private_sales_controller.rb

@@ -14,6 +14,7 @@ module Spree
       # partial reads these ivars — without this a rejected save is a 500 instead of a form.
       before_action :load_stock_rows, only: %i[edit update]
       before_action :load_assignable_roles, only: %i[new create edit update]
+      before_action :load_offline_product_ids, only: %i[new create edit update]
 
       # GET /admin/private_sales
       def index
@@ -45,6 +46,11 @@ module Spree
         @assignable_roles = Spree::Role.non_vendor.order(:name)
       end
 
+      # The product search only returns `name`, so the form labels offline products from this list.
+      def load_offline_product_ids
+        @offline_product_ids = Spree::Product.where(offline: true).pluck(:id)
+      end
+
       def location_after_save
         edit_admin_private_sale_path(@private_sale)
       end

data/app/controllers/spree/admin/product_commissions_controller.rb

@@ -42,7 +42,8 @@ module Spree
 
       def commission_for(product)
         commission_rate = product.commission_rate || product.vendor&.commission_rate || 0
-        product.price * commission_rate / 100
+        # A product can have no price in the store currency yet (e.g. a freshly created ticket).
+        (product.price || 0) * commission_rate / 100
       end
 
       # override

data/app/controllers/spree/admin/product_option_types_controller.rb

@@ -0,0 +1,88 @@
+module Spree
+  module Admin
+    class ProductOptionTypesController < Spree::Admin::ResourceController
+      belongs_to 'spree/product', find_by: :slug
+
+      before_action :load_available_option_types, only: :index
+      before_action :ensure_not_used_by_variants, only: :destroy
+
+      # override: the base version finds ids across every product; scope them to this one.
+      def update_positions
+        ApplicationRecord.transaction do
+          params[:positions].each do |id, index|
+            parent.product_option_types.find(id).set_list_position(index)
+          end
+        end
+
+        head :ok
+      end
+
+      # One Save for the whole table instead of a submit per row. Only this product's rows are looked up,
+      # so ids belonging to another product are ignored.
+      def update_all
+        rows = parent.product_option_types.where(id: bulk_params.keys).index_by { |row| row.id.to_s }
+
+        ApplicationRecord.transaction do
+          bulk_params.each { |id, attributes| rows[id]&.update!(attributes) }
+        end
+
+        flash[:success] = I18n.t('spree.admin.product_option_types.saved')
+        redirect_to collection_url
+      rescue ActiveRecord::RecordInvalid => e
+        flash[:error] = e.record.errors.full_messages.to_sentence
+        redirect_to collection_url
+      end
+
+      private
+
+      # override
+      def collection_actions
+        super + [:update_all]
+      end
+
+      # { "<product_option_type id>" => { hidden:, presentation: } }
+      def bulk_params
+        @bulk_params ||= params.fetch(:product_option_types, {}).to_unsafe_h.to_h do |id, attributes|
+          [id.to_s, ActionController::Parameters.new(attributes).permit(:hidden, :presentation)]
+        end
+      end
+
+      # override
+      def collection
+        parent.product_option_types.includes(:option_type).order(:position)
+      end
+
+      # override
+      def model_class
+        Spree::ProductOptionType
+      end
+
+      # override: only create goes through the resource params; display settings are saved by #update_all.
+      def permitted_resource_params
+        params.require(:product_option_type).permit(:option_type_id)
+      end
+
+      def load_available_option_types
+        @available_option_types = Spree::OptionType.where(kind: %i[variant product])
+                                                   .where.not(id: parent.option_type_ids)
+                                                   .order(:presentation)
+      end
+
+      # Removing an option type that variants still carry values for would leave those values orphaned
+      # from the product's option types, the same rule the dashboard's variant options page enforces.
+      def ensure_not_used_by_variants
+        used = parent.variants_including_master.joins(:option_values)
+                     .exists?(spree_option_values: { option_type_id: @object.option_type_id })
+        return unless used
+
+        flash[:error] = I18n.t('spree.admin.product_option_types.still_used_by_variants', name: @object.display_presentation)
+
+        # link_to_delete removes over AJAX and only drops the row when the JS response carries a success flash.
+        respond_to do |format|
+          format.html { redirect_to collection_url }
+          format.js { render_js_for_destroy }
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/rate_plans_controller.rb

@@ -0,0 +1,125 @@
+module Spree
+  module Admin
+    # A product's rate plans: the record (name, kind, adjustment, terms), not its prices, which the Rates &
+    # Availability grid edits. Forms open in a modal on that grid, so a save answers with no content and the
+    # grid reloads its rows, while an invalid form comes back as HTML to show in place.
+    class RatePlansController < Spree::Admin::BaseController
+      before_action :load_product
+      before_action :load_rate_plan, only: %i[edit update destroy]
+
+      helper SpreeCmCommissioner::Admin::RatesAvailabilitiesHelper
+      helper_method :rate_plan_option_types, :currencies
+
+      def new
+        variant = variants.find(params[:variant_id])
+        @rate_plan = variant.rate_plans.new(kind: :derived, adjustment_type: :percent)
+        render_form
+      end
+
+      def edit
+        render_form
+      end
+
+      # Also creates it on each variant in `also_variant_ids`, with the same terms.
+      def create
+        variant = variants.find(params[:variant_id])
+        also_variants = variants.where(id: params[:also_variant_ids]).where.not(id: variant.id)
+        @rate_plan = variant.rate_plans.new
+        rate_plans = [@rate_plan] + also_variants.map { |also_variant| also_variant.rate_plans.new }
+
+        save(rate_plans, rate_plan_params.merge(kind: params.dig(:rate_plan, :kind)))
+      end
+
+      # Kind stays as created: an independent rate plan has its own price rows, a derived one only date overrides.
+      def update
+        save([@rate_plan], rate_plan_params.merge(status: params.dig(:rate_plan, :status)).compact)
+      end
+
+      # Only a rate plan never sold: line items keep theirs (`restrict_with_error`), so a sold one is archived.
+      def destroy
+        if @rate_plan.destroy
+          head :no_content
+        else
+          render json: { error: @rate_plan.errors.full_messages.to_sentence }, status: :unprocessable_entity
+        end
+      end
+
+      # A dialog listing one variant's rate plans, archived too, as positions run across all of them.
+      def edit_order
+        @variant = variants.find(params[:variant_id])
+        render_order_form
+      end
+
+      # Saves the whole order at once, so a misclick in the dialog costs nothing until Save. `rate_plan_ids` must be
+      # exactly the variant's rate plans, or a plan added or deleted meanwhile would end up out of place.
+      def update_order
+        @variant = variants.find(params[:variant_id])
+        ids = Array(params[:rate_plan_ids]).map(&:to_i)
+        rate_plans = @variant.rate_plans.index_by(&:id)
+
+        return render_order_form(error: t('rates_availabilities.reorder_form.changed'), status: :conflict) unless ids.sort == rate_plans.keys.sort
+
+        # update_columns: acts_as_list would shift the others on every single save.
+        SpreeCmCommissioner::RatePlan.transaction do
+          ids.each.with_index(1) do |id, position|
+            rate_plans[id].update_columns(position: position, updated_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
+          end
+        end
+
+        head :no_content
+      end
+
+      private
+
+      def rate_plan_option_types
+        @rate_plan_option_types ||= Spree::OptionType.where(kind: :rate_plan).includes(:option_values).order(:position)
+      end
+
+      def currencies
+        supported_currencies_for_all_stores.map(&:iso_code)
+      end
+
+      def save(rate_plans, attributes)
+        result = SpreeCmCommissioner::RatePlans::Save.call(
+          rate_plans: rate_plans,
+          attributes: attributes,
+          option_value_ids: Array(params.dig(:rate_plan, :option_value_ids)),
+          starting_prices: params.fetch(:starting_prices, {}).permit(*currencies).to_h
+        )
+
+        return head :no_content if result.success?
+
+        render_form(error: result.error.to_s, status: :unprocessable_entity)
+      end
+
+      def render_form(error: nil, status: :ok)
+        render partial: 'form', locals: { rate_plan: @rate_plan, error: error }, status: status
+      end
+
+      def render_order_form(error: nil, status: :ok)
+        rate_plans = @variant.rate_plans.includes(option_values: :option_type)
+        render partial: 'order_form', locals: { variant: @variant, rate_plans: rate_plans, error: error }, status: status
+      end
+
+      def rate_plan_params
+        params.require(:rate_plan).permit(:name, :adjustment_type, :adjustment_value, :currency)
+      end
+
+      def load_product
+        @product = Spree::Product.find_by!(slug: params[:product_id])
+      end
+
+      def load_rate_plan
+        @rate_plan = SpreeCmCommissioner::RatePlan.where(variant_id: variants.select(:id)).find(params[:id])
+      end
+
+      def variants
+        Spree::Variant.where(product_id: @product.id)
+      end
+
+      def model_class
+        SpreeCmCommissioner::RatePlan
+      end
+    end
+  end
+end