spree_cm_commissioner 2.13.7 → 2.14.0

data/app/controllers/spree/admin/stock_managements_controller.rb

@@ -5,7 +5,7 @@ module Spree
 
       before_action :load_parent
 
-      helper_method :inventory_item_message, :inventory_item_hold_message
+      helper SpreeCmCommissioner::Admin::InventoryItemsHelper
 
       def load_parent
         @product = Spree::Product.find_by(slug: params[:product_id])
@@ -40,58 +40,6 @@ module Spree
         redirect_back fallback_location: admin_product_stock_managements_path(@product)
       end
 
-      # GET /products/:slug/stock_managements/calendar?year=&selected_option_value_ids[]=
-      def calendar
-        @year = params[:year].present? ? params[:year].to_i : Time.zone.today.year
-
-        from_date = Date.new(@year, 1, 1).beginning_of_year
-        to_date = Date.new(@year, 1, 1).end_of_year
-
-        @variant_kind_option_types = Spree::Variants::OptionTypesFinder.new(variant_ids: @product.variants.ids)
-                                                                       .execute.select(&:variant?)
-        @selected_option_value_ids = Array(params[:selected_option_value_ids]).map(&:to_i)
-
-        inventory_items = @product.inventory_items.includes(:variant, :prices).where(
-          inventory_date: from_date..to_date
-        )
-
-        if @selected_option_value_ids.present?
-          variant_ids = SpreeCmCommissioner::Variants::FindByOptionValueIds.new(
-            product: @product, option_value_ids: @selected_option_value_ids
-          ).execute.ids
-          inventory_items = inventory_items.where(variant_id: variant_ids)
-          @matched_variants_count = variant_ids.size
-        else
-          @matched_variants_count = @product.variants.count
-        end
-
-        @inventory_items = inventory_items.to_a
-
-        @cached_inventory_items = ::SpreeCmCommissioner::RedisStock::CachedInventoryItemsBuilder.new(@inventory_items)
-                                                                                                .call
-                                                                                                .index_by(&:inventory_item_id)
-        @events = SpreeCmCommissioner::CalendarEvent.from_inventory_items(@inventory_items)
-      end
-
-      def inventory_item_message(inventory_item, cached_inventory_item)
-        synced = inventory_item.quantity_available == cached_inventory_item.quantity_available
-
-        if synced
-          "Synced: Quantity available matches in both DB and Redis (#{cached_inventory_item.quantity_available})."
-        else
-          "Out of sync: Redis shows #{cached_inventory_item.quantity_available} available, which doesn't match the database."
-        end
-      end
-
-      def inventory_item_hold_message(inventory_item, cached_inventory_item)
-        synced = inventory_item.quantity_on_hold == cached_inventory_item.quantity_on_hold
-        if synced
-          "Synced: Quantity on hold matches in both DB and Redis (#{cached_inventory_item.quantity_on_hold})."
-        else
-          "Out of sync: Redis shows #{cached_inventory_item.quantity_on_hold} on hold, which doesn't match the database."
-        end
-      end
-
       private
 
       def load_inventories

data/app/controllers/spree/api/switch_cm/base_controller.rb

@@ -0,0 +1,109 @@
+module Spree::Api::SwitchCm
+  # The Booking.com-compatible API channel managers (switch.cm) call under /api/cm.
+  # It's built on ActionController::API rather than Spree's v2 base, whose rescue handlers
+  # answer in JSON:API: a Booking.com connector parses every answer, errors included, as its
+  # family's XML, which Xml::BaseController renders.
+  #
+  # One Doorkeeper app per channel manager, presented as a Bearer token from the token
+  # exchange or as HTTP Basic with the app's client id and secret. Booking.com accepted Basic
+  # until 31 Dec 2025, and an older connector may still send it.
+  class BaseController < ActionController::API
+    include ActionController::HttpAuthentication::Basic::ControllerMethods
+
+    # Bodies are parsed whole and pushes applied in the request, so both are capped; the cap on
+    # updates is AcceptPush's.
+    MAX_BODY_BYTES = 1.megabyte
+
+    before_action :authenticate_switch_cm!
+    before_action :reject_oversized_body!
+
+    rescue_from Nokogiri::XML::SyntaxError do
+      render_fault(:bad_request, 'Request body is not well-formed XML')
+    end
+
+    private
+
+    def authenticate_switch_cm!
+      @oauth_application = application_from_bearer || application_from_basic
+      return if @oauth_application.present? && switch_cm_integrations.exists?
+
+      render_fault(:unauthorized, 'Authorization Required')
+    end
+
+    def reject_oversized_body!
+      return if request.raw_post.bytesize <= MAX_BODY_BYTES
+
+      render_fault(:payload_too_large, "Request body must not exceed #{MAX_BODY_BYTES / 1.megabyte} MB")
+    end
+
+    def application_from_bearer
+      doorkeeper_token.application if doorkeeper_token&.accessible?
+    end
+
+    def application_from_basic
+      authenticate_with_http_basic do |client_id, client_secret|
+        application = Spree::OauthApplication.find_by(uid: client_id)
+        application if application&.secret_matches?(client_secret)
+      end
+    end
+
+    def switch_cm_integrations
+      SpreeCmCommissioner::Integrations::SwitchCm.readable.where(oauth_application_id: @oauth_application.id)
+    end
+
+    # nil unless the requested hotel is one of this channel manager's connected hotels.
+    def current_integration
+      return @current_integration if defined?(@current_integration)
+
+      accommodation_id = accommodation_id_from_request
+      @current_integration = accommodation_id.present? ? switch_cm_integrations.find_by(vendor_id: accommodation_id) : nil
+    end
+
+    def require_integration!
+      render_fault(:forbidden, 'Not authorized for this hotel') if current_integration.nil?
+    end
+
+    # Pushes need an active connection: a paused one is still being set up, and the hotel keeps
+    # selling on its own counts until it's activated.
+    def require_active_integration!
+      return render_fault(:forbidden, 'Not authorized for this hotel') if current_integration.nil?
+
+      render_fault(:forbidden, 'This hotel is not active on BookMe+ yet') unless current_integration.active?
+    end
+
+    # Pushes may leave out the hotel id (B.XML never sends one); Booking.com derives it from the
+    # rooms. A room of another channel manager's hotel resolves to a hotel this app can't access.
+    def vendor_id_of_room(room_id)
+      Spree::Variant.where(id: room_id.to_i).pick(:vendor_id) if room_id.present?
+    end
+
+    # Reservation pulls take a comma-separated list of hotel ids, or none for all of this
+    # channel manager's hotels. Unknown ids come back separately, for a warning each, as at
+    # Booking.com; a list with no known hotel at all is refused.
+    def requested_integrations(hotel_ids)
+      ids = hotel_ids.to_s.split(',').map(&:strip).compact_blank
+      scope = switch_cm_integrations.includes(:vendor).order(:vendor_id)
+      return [scope.to_a, []] if ids.empty?
+
+      integrations = scope.where(vendor_id: ids).to_a
+      [integrations, ids - integrations.map { |integration| integration.vendor_id.to_s }]
+    end
+
+    def accommodation_id_from_request
+      raise NotImplementedError, "#{self.class.name} must implement accommodation_id_from_request"
+    end
+
+    def render_fault(_status, _text, code: nil)
+      raise NotImplementedError, "#{self.class.name} must implement render_fault"
+    end
+
+    # Rails parses neither XML nor text/xml bodies into params, so both families read the raw body.
+    def request_document
+      @request_document ||= Nokogiri::XML(request.raw_post) { |config| config.strict.nonet }.tap(&:remove_namespaces!)
+    end
+
+    def ruid
+      request.request_id
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/tokens_controller.rb

@@ -0,0 +1,68 @@
+module Spree::Api::SwitchCm
+  class TokensController < BaseController
+    # Booking.com's tokens also last an hour; connectors refresh on that schedule.
+    TOKEN_LIFETIME = 1.hour
+
+    skip_before_action :authenticate_switch_cm!
+
+    # POST /api/cm/token-based-authentication/exchange
+    # Client id and secret in (JSON or XML), { jwt, ruid } out, then `Authorization: Bearer` on every
+    # other call. The value is a Doorkeeper access token rather than a signed JWT, so a connector
+    # that only forwards it works but one that decodes it won't.
+    def create
+      client_id, client_secret = credentials
+      return render_fault(:bad_request, 'client_id and client_secret are required') if client_id.blank? || client_secret.blank?
+
+      @oauth_application = Spree::OauthApplication.find_by(uid: client_id)
+      unless @oauth_application&.secret_matches?(client_secret) && switch_cm_integrations.exists?
+        return render_fault(:unauthorized, 'Invalid client credentials')
+      end
+
+      render_token(issue_token.plaintext_token)
+    end
+
+    private
+
+    def issue_token
+      Spree::OauthAccessToken.create_for(
+        application: @oauth_application,
+        resource_owner: nil,
+        scopes: '',
+        expires_in: TOKEN_LIFETIME.to_i,
+        use_refresh_token: false
+      )
+    end
+
+    def credentials
+      return [params[:client_id], params[:client_secret]] unless xml_request?
+
+      %w[client_id client_secret].map { |name| request_document.at_xpath("/request/#{name}")&.text&.strip }
+    end
+
+    def xml_request?
+      request.content_mime_type&.symbol == :xml
+    end
+
+    def render_token(token)
+      return render json: { jwt: token, ruid: ruid } unless xml_request?
+
+      document = SpreeCmCommissioner::Integrations::SwitchCm::Xml::ResponseBuilder.build('response', ruid: ruid) do |xml|
+        xml.jwt token
+        xml.ruid ruid
+      end
+      render xml: document
+    end
+
+    # override
+    def render_fault(status, text, code: nil)
+      code ||= Rack::Utils.status_code(status)
+
+      if xml_request?
+        render xml: SpreeCmCommissioner::Integrations::SwitchCm::Xml::ResponseBuilder.fault('response', code: code, text: text, ruid: ruid),
+               status: status
+      else
+        render json: { errors: [{ code: code, message: text }], ruid: ruid }, status: status
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/availabilities_controller.rb

@@ -0,0 +1,39 @@
+module Spree::Api::SwitchCm
+  module Xml
+    class AvailabilitiesController < BaseController
+      before_action :require_active_integration!
+
+      # POST /api/cm/hotels/xml/availability
+      # Rooms to sell, prices and closed in one message, validated and applied in the request
+      # (Inventory::AcceptPush); the answer is the real outcome.
+      def create
+        result = SpreeCmCommissioner::Integrations::SwitchCm::Inventory::AcceptPush.call(
+          integration: current_integration,
+          message: 'availability',
+          updates: parser.updates,
+          request_id: ruid
+        )
+
+        push_response = SpreeCmCommissioner::Integrations::SwitchCm::Xml::PushResponse.new(result: result.value, ruid: ruid)
+        render xml: push_response.to_xml, status: push_response.http_status
+      end
+
+      private
+
+      # override
+      def response_root
+        'availability'
+      end
+
+      def parser
+        @parser ||= SpreeCmCommissioner::Integrations::SwitchCm::Xml::AvailabilityParser.new(request_document)
+      end
+
+      # B.XML pushes carry no hotel id; the rooms name it.
+      # override
+      def accommodation_id_from_request
+        vendor_id_of_room(parser.first_room_id)
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/base_controller.rb

@@ -0,0 +1,37 @@
+module Spree::Api::SwitchCm
+  module Xml
+    # Booking.com's B.XML family (/hotels/xml/...): a request that fails as a whole answers with
+    # a <fault code string/> under the call's root element. Requests carry their parameters
+    # in a <request> body.
+    class BaseController < Spree::Api::SwitchCm::BaseController
+      private
+
+      def response_root
+        raise NotImplementedError, "#{self.class.name} must implement response_root"
+      end
+
+      # override
+      def render_fault(status, text, code: nil)
+        code ||= Rack::Utils.status_code(status)
+        render xml: SpreeCmCommissioner::Integrations::SwitchCm::Xml::ResponseBuilder.fault(response_root, code: code, text: text, ruid: ruid),
+               status: status
+      end
+
+      def render_document(&block)
+        render xml: SpreeCmCommissioner::Integrations::SwitchCm::Xml::ResponseBuilder.build(response_root, ruid: ruid, &block)
+      end
+
+      # override
+      def accommodation_id_from_request
+        request_value('hotel_id')
+      end
+
+      # A parameter from the <request> body, falling back to the query string.
+      def request_value(name)
+        return params[name] if request.raw_post.blank?
+
+        request_document.at_xpath("/request/#{name}")&.text&.strip.presence || params[name]
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/reservation_summaries_controller.rb

@@ -0,0 +1,28 @@
+module Spree::Api::SwitchCm
+  module Xml
+    class ReservationSummariesController < BaseController
+      before_action :require_integration!
+
+      # POST /api/cm/hotels/xml/reservationssummary with <request><hotel_id/></request>
+      # The hotel's confirmed stays checking out from tomorrow on, however long ago they were
+      # booked. The channel manager imports these while setting the hotel up, so they count against
+      # its availability before its first push. Read-only: nothing is marked seen.
+      def create
+        reservations = SpreeCmCommissioner::Integrations::SwitchCm::Reservations::Feed.new([current_integration]).summary
+
+        render_document do |xml|
+          reservations.each do |reservation|
+            SpreeCmCommissioner::Integrations::SwitchCm::Xml::ReservationSerializer.new(reservation, summary: true).build(xml)
+          end
+        end
+      end
+
+      private
+
+      # override
+      def response_root
+        'reservations'
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/reservations_controller.rb

@@ -0,0 +1,57 @@
+module Spree::Api::SwitchCm
+  module Xml
+    class ReservationsController < BaseController
+      # POST /api/cm/hotels/xml/reservations with <request><hotel_id/><last_change/><limit/><id/></request>
+      # New, modified and cancelled reservations in one stream. B.XML has no acknowledgement, so returning a
+      # reservation is what marks it seen; `last_change` re-reads recent ones regardless.
+      def create
+        integrations, = requested_integrations(request_value('hotel_id') || request_value('hotel_ids'))
+        return render_fault(:forbidden, 'Not authorized for these hotels') if integrations.empty?
+
+        reservations = SpreeCmCommissioner::Integrations::SwitchCm::Reservations::Feed.new(integrations).changed_reservations(
+          id: request_value('id'),
+          last_change: SpreeCmCommissioner::Integrations::SwitchCm::Reservations::Feed.parse_last_change(request_value('last_change')),
+          limit: request_value('limit')
+        )
+
+        document = SpreeCmCommissioner::Integrations::SwitchCm::Xml::ResponseBuilder.build(response_root, ruid: ruid) do |xml|
+          reservations.each { |reservation| SpreeCmCommissioner::Integrations::SwitchCm::Xml::ReservationSerializer.new(reservation).build(xml) }
+        end
+
+        # Marked only once the document is built. One that fails to mark is simply returned
+        # again next time, which is harmless: its status is the same.
+        failed = mark_seen(reservations)
+        log_mark_seen_failures(failed) if failed.any?
+
+        render xml: document
+      end
+
+      private
+
+      # override
+      def response_root
+        'reservations'
+      end
+
+      def mark_seen(reservations)
+        reservations.each_with_object([]) do |reservation, failed|
+          SpreeCmCommissioner::Integrations::SwitchCm::Reservations::MarkSeen.call(
+            integration: reservation.integration, order: reservation.order, status: reservation.status,
+            modified_at: reservation.modified_at
+          )
+        rescue StandardError => e
+          failed << {
+            order_id: reservation.id,
+            integration_id: reservation.integration.id,
+            error_class: e.class.name,
+            error_message: e.message
+          }
+        end
+      end
+
+      def log_mark_seen_failures(failed)
+        CmAppLogger.error(label: "#{self.class.name}#mark_seen failed", data: { ruid: ruid, failed: failed })
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/room_rate_availabilities_controller.rb

@@ -0,0 +1,56 @@
+module Spree::Api::SwitchCm
+  module Xml
+    class RoomRateAvailabilitiesController < BaseController
+      DAYS_RANGE = (1..31)
+
+      before_action :require_integration!
+
+      # POST /api/cm/hotels/xml/roomrateavailability with <request><hotel_id/><start_date/><number_of_days/><room_id/></request>
+      # What we hold per room and night, so the channel manager can check its pushes landed.
+      # number_of_days is 1-31, 31 by default, as at Booking.com.
+      def create
+        start_date = parse_date(request_value('start_date')) || Time.zone.today
+        days = (request_value('number_of_days').presence || DAYS_RANGE.max).to_i
+        return render_fault(:bad_request, "number_of_days must be between #{DAYS_RANGE.min} and #{DAYS_RANGE.max}") unless DAYS_RANGE.cover?(days)
+
+        rows = SpreeCmCommissioner::Integrations::SwitchCm::Inventory::AvailabilitySnapshot.new(
+          integration: current_integration,
+          dates: (start_date...(start_date + days)).to_a,
+          room_id: request_value('room_id')
+        ).rows
+
+        render_document { |xml| rows.each { |row| build_row(xml, row) } }
+      end
+
+      private
+
+      # override
+      def response_root
+        'result'
+      end
+
+      def build_row(xml, row)
+        xml.roomrate(
+          {
+            date: row.date.iso8601,
+            room_id: row.room_id,
+            rate_id: row.rate_id,
+            rooms_to_sell: row.rooms_to_sell,
+            booked: row.booked,
+            cancelled: row.cancelled,
+            closed: row.closed ? 1 : 0,
+            price: row.price && format('%.2f', row.price),
+            currency: row.currency,
+            pushed_at: row.pushed_at&.utc&.iso8601
+          }.compact
+        )
+      end
+
+      def parse_date(value)
+        Date.iso8601(value) if value.present?
+      rescue Date::Error
+        nil
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/room_rates_controller.rb

@@ -0,0 +1,45 @@
+module Spree::Api::SwitchCm
+  module Xml
+    class RoomRatesController < BaseController
+      before_action :require_integration!
+
+      # POST /api/cm/hotels/xml/roomrates with <request><hotel_id/></request>
+      # The hotel's rooms, each with its rates, which the channel manager maps to its own
+      # ("Refresh Room" in switch.cm). A derived rate plan is a child rate of the room's base rate.
+      def create
+        vendor = current_integration.vendor
+        rooms = SpreeCmCommissioner::Integrations::SwitchCm::RoomCatalog.new(vendor).rooms
+
+        render_document do |xml|
+          rooms.each do |room|
+            xml.room(id: room.id, hotel_id: vendor.id, hotel_name: vendor.name, room_name: room.name, max_children: room.max_children) do
+              xml.rates { room.rates.each { |rate| build_rate(xml, room, rate) } }
+            end
+          end
+        end
+      end
+
+      private
+
+      def build_rate(xml, room, rate)
+        attributes = { id: rate.id, rate_name: rate.name, max_persons: room.max_persons, is_child_rate: rate.child? ? 1 : 0, readonly: 0 }
+        return xml.rate(attributes) unless rate.child?
+
+        # Restrictions other than closing aren't stored, so the child rate follows only its parent's price and closings.
+        xml.rate(attributes) do
+          xml.rate_relation(
+            {
+              parent_rate_id: rate.parent_id, percentage: rate.percentage&.to_f, additional: rate.additional&.to_f,
+              follows_price: 1, follows_closed: 3, follows_restrictions: 0
+            }.compact
+          )
+        end
+      end
+
+      # override
+      def response_root
+        'rooms'
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/operator/guests_controller.rb

@@ -12,7 +12,7 @@ module Spree
           end
 
           def collection
-            SpreeCmCommissioner::GuestSearcherQuery.new(params).call
+            SpreeCmCommissioner::GuestSearcherQuery.new(params).call.merge(SpreeCmCommissioner::Guest.with_dynamic_fields_and_options)
           end
 
           # override

data/app/controllers/spree/api/v2/storefront/accommodations/variants_controller.rb

@@ -7,13 +7,39 @@ module Spree
 
           # override
           def collection
-            @collection ||= SpreeCmCommissioner::Accommodations::FindVariant.new(
+            # Load in batches what every room's JSON reads, instead of per room: the storefront variant's base price
+            # (Variant#price_in), relationships and stock ids, and the rate plans and terms its rates are built from.
+            @collection ||= finder.execute.includes(
+              :product, :images, :option_values, :stock_items, :stock_locations, :default_price,
+              active_rate_plans: { option_values: :option_type }
+            )
+          end
+
+          def finder
+            @finder ||= SpreeCmCommissioner::Accommodations::FindVariant.new(
               from_date: params[:from_date]&.to_date,
               to_date: params[:to_date]&.to_date,
-              vendor_id: params[:accommodation_id],
+              vendor_id: Spree::Vendor.by_vendor_id!(params[:accommodation_id]).id,
               number_of_adults: params[:adult].to_i,
               number_of_kids: params[:children].to_i
-            ).execute
+            )
+          end
+
+          # override: price every room's rates from one batch of prices, instead of a query per room. Runs only
+          # when the response isn't cached, and the batch loads only when a room's JSON isn't cached either.
+          def serialize_collection(collection)
+            Spree::Variant.preload_stay_prices(
+              collection,
+              dates: finder.dates,
+              currency: current_currency
+            )
+
+            super
+          end
+
+          # override: rates are priced for the nights searched.
+          def serializer_params
+            super.merge(dates: finder.dates)
           end
 
           # override
@@ -23,12 +49,12 @@ module Spree
 
           # override
           def resource_serializer
-            Spree::V2::Storefront::VariantSerializer
+            SpreeCmCommissioner::V2::Storefront::AccommodationVariantSerializer
           end
 
           # override
           def collection_serializer
-            Spree::V2::Storefront::VariantSerializer
+            SpreeCmCommissioner::V2::Storefront::AccommodationVariantSerializer
           end
 
           # override

data/app/controllers/spree/api/v2/storefront/inventory_items_controller.rb

@@ -21,9 +21,9 @@ module Spree
             return @collection if defined?(@collection)
 
             scope = if include_reserved_blocks?
-                      SpreeCmCommissioner::InventoryItem.includes(:prices, :reserved_blocks)
+                      SpreeCmCommissioner::InventoryItem.includes(:variant_prices, :reserved_blocks)
                     else
-                      SpreeCmCommissioner::InventoryItem.includes(:prices)
+                      SpreeCmCommissioner::InventoryItem.includes(:variant_prices)
                     end
 
             @collection = scope.where(variant_id: params[:variant_ids], inventory_date: params[:inventory_dates])

data/app/controllers/spree/api/v2/tenant/intercity_taxi/draft_orders_controller.rb

@@ -31,7 +31,6 @@ module Spree
               result = SpreeCmCommissioner::IntercityTaxiOrder::Update.call(
                 order: spree_current_order,
                 remark: params[:remark],
-                passenger_count: params[:passenger_count],
                 pickup_map_place_attributes: params[:pickup_map_place_attributes]&.permit(
                   :place_name,
                   :lat,

data/app/factory/spree_cm_commissioner/order_telegram_message_factory.rb

@@ -165,7 +165,7 @@ module SpreeCmCommissioner
       text << bold('🚗 Trip Details')
       text << "Route: #{route_text}" if route_text.present?
       text << "Vehicle: #{vehicle_text}" if vehicle_text.present?
-      text << "Passengers: #{line_item.passenger_count || line_item.quantity}"
+      text << "Passengers: #{line_item.number_of_guests}"
       text << "Departure: #{departure_text}" if departure_text.present?
       text << seat_labels_text(line_item) if seat_labels_text(line_item).present?
 

data/app/finders/spree_cm_commissioner/accommodations/find.rb

@@ -13,11 +13,8 @@ module SpreeCmCommissioner
       def execute
         scope
           .where(default_state_id: state_id)
-          .where('spree_variants.track_inventory = FALSE OR cm_inventory_items.inventory_date BETWEEN ? AND ?', from_date, to_date)
-          .where('spree_variants.track_inventory = FALSE OR cm_inventory_items.quantity_available > 0')
-          .where('COALESCE(CAST(spree_variants.public_metadata->\'cm_options\'->>\'number-of-adults\' AS INTEGER), 0) +
-                  COALESCE(CAST(spree_variants.public_metadata->\'cm_options\'->>\'number-of-kids\' AS INTEGER), 0) >= ?', number_of_guests
-          )
+          .merge(bookable_variants)
+          .merge(Spree::Variant.with_guest_capacity(number_of_guests))
           .distinct
       end
 
@@ -26,12 +23,17 @@ module SpreeCmCommissioner
       def scope
         Spree::Vendor
           .joins(products: :variants)
-          .joins('LEFT OUTER JOIN cm_inventory_items ON cm_inventory_items.variant_id = spree_variants.id')
           .where(primary_product_type: :accommodation, state: :active)
       end
 
-      def stay_dates
-        from_date..to_date
+      def dates
+        @dates ||= SpreeCmCommissioner::BookingDates.nights(check_in: from_date, check_out: to_date)
+      end
+
+      # Same rule as the rooms endpoint: a hotel is listed only if one of its rooms is bookable every night
+      # with a rate open, so a listed hotel always has a room to show. Rooms that don't track inventory always count.
+      def bookable_variants
+        Spree::Variant.where(track_inventory: false).or(Spree::Variant.bookable_on_every_date(dates)).with_open_rate_on_every_date(dates)
       end
     end
   end