spree_cm_commissioner 2.13.7 → 2.14.1

data/app/controllers/spree/admin/rates_availabilities_controller.rb

@@ -0,0 +1,142 @@
+module Spree
+  module Admin
+    # Stock, prices and sale status of a product's variants and their rate plans, per date.
+    # StockManagementsController keeps per-variant setup: stock locations, track inventory, purchases, resets.
+    class RatesAvailabilitiesController < Spree::Admin::BaseController
+      include RatesAvailabilityCells
+
+      MIN_DAYS_AHEAD = 14
+      MAX_BLOCK_DAYS = 62
+      VARIANTS_PER_PAGE = 25
+      BOOKINGS_PER_PAGE = 25
+
+      before_action :load_product
+      before_action :load_grid, only: %i[index dates]
+
+      helper SpreeCmCommissioner::Admin::RatesAvailabilitiesHelper
+      helper_method :filter_params
+
+      # GET /products/:product_id/rates_availabilities?from=&currency=&option_value_ids[]=&archived=&page=
+      def index
+        @option_types = Spree::Variants::OptionTypesFinder.new(variant_ids: @product.variants.ids).execute.select(&:variant?)
+        @currencies = supported_currencies_for_all_stores.map(&:iso_code)
+        # A channel manager sets these variants' stock, prices and closings, so BulkUpdate skips them; the page says why.
+        @managing_integration = @product.vendor&.integration if @grid.variants.any?(&:inventory_external_wins?)
+      end
+
+      # GET /products/:product_id/rates_availabilities/dates?from=&to=&<index filters>
+      #
+      # The page adds this block next to the dates it already shows, so a range across months doesn't need a reload.
+      # It asks for whole months, so a month never spans two blocks.
+      def dates
+        render partial: 'block', locals: { grid: @grid }
+      end
+
+      # PATCH /products/:product_id/rates_availabilities/bulk_update, JSON: { bulk_action:, cells: [...], values: {...} }
+      #
+      # Answers with the counts, and the page then reloads its loaded dates.
+      def bulk_update
+        result = SpreeCmCommissioner::RatesAvailabilities::BulkUpdate.call(
+          product: @product,
+          store: current_store,
+          action: params[:bulk_action].to_s,
+          cells: selected_cells,
+          values: params.fetch(:values, {}).permit(:amount, :compare_at_amount, :quantity, :currency),
+          user: try_spree_current_user
+        )
+
+        if result.success?
+          render json: result.value
+        else
+          render json: { error: result.error.to_s }, status: :unprocessable_entity
+        end
+      end
+
+      # POST /products/:product_id/rates_availabilities/bookings, JSON: { cells: [...], filter:, q:, page: }
+      #
+      # The bookings modal for the selected cells. POST, as cells travel in the body.
+      def bookings
+        finder = SpreeCmCommissioner::RatesAvailabilities::FindBookings.new(
+          product: @product,
+          cells: selected_cells,
+          filter: params[:filter].to_s,
+          query: params[:q]
+        )
+
+        line_items = finder.execute.page(params[:page]).per(BOOKINGS_PER_PAGE)
+        render partial: 'bookings', formats: [:html], locals: {
+          finder: finder,
+          line_items: line_items,
+          cells: selected_cells,
+          held_order_ids: finder.held_order_ids_among(line_items)
+        }
+      end
+
+      private
+
+      def filter_params
+        params.permit(:currency, :archived, option_value_ids: []).to_h
+      end
+
+      def load_product
+        @product = Spree::Product.find_by!(slug: params[:product_id])
+      end
+
+      def load_grid
+        @include_archived = params[:archived] == '1'
+        @variants = variants.page(params[:page]).per(VARIANTS_PER_PAGE)
+        @currency = (params[:currency].presence || current_currency).upcase
+        @from = parse_date(params[:from]) || Time.zone.today
+
+        dates = @product.permanent_stock? ? date_window.to_a : []
+
+        @grid = SpreeCmCommissioner::RatesAvailabilityGrid.new(
+          variants: @variants.to_a,
+          dates: dates,
+          currency: @currency,
+          include_archived: @include_archived
+        )
+      end
+
+      def variants
+        rate_plans = @include_archived ? :rate_plans : :active_rate_plans
+        scope = @product.variants.exists? ? @product.variants : Spree::Variant.where(id: @product.master.id)
+        scope = scope.where(id: matching_variant_ids) if option_value_ids.present?
+        scope.includes(:stock_items, { rate_plans => { option_values: :option_type } }, { vendor: :integration }, option_values: :option_type)
+             .order(:position, :id)
+      end
+
+      def option_value_ids
+        @option_value_ids ||= Array(params[:option_value_ids]).compact_blank.map(&:to_i)
+      end
+
+      def matching_variant_ids
+        SpreeCmCommissioner::Variants::FindByOptionValueIds.new(product: @product, option_value_ids: option_value_ids).execute.ids
+      end
+
+      # The first window is `from`'s month, plus the next one when fewer than MIN_DAYS_AHEAD days are left, so a
+      # late `from` still shows weeks ahead. Whole months, so the blocks added next to it are whole months too.
+      # Kept to about a month: every day is a column on every row, and a dated product can have many variants.
+      # The page scrolls to `from`.
+      def date_window
+        to = parse_date(params[:to])
+        return @from..[to, @from + (MAX_BLOCK_DAYS - 1)].min if to
+
+        last = @from.end_of_month
+        last = @from.next_month.end_of_month if (last - @from).to_i + 1 < MIN_DAYS_AHEAD
+        @from.beginning_of_month..last
+      end
+
+      def parse_date(value)
+        Date.parse(value.to_s) if value.present?
+      rescue Date::Error
+        nil
+      end
+
+      # Same permission as the stock calendar this replaces.
+      def model_class
+        Spree::StockItem
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/stock_managements_controller.rb

@@ -5,7 +5,7 @@ module Spree
 
       before_action :load_parent
 
-      helper_method :inventory_item_message, :inventory_item_hold_message
+      helper SpreeCmCommissioner::Admin::InventoryItemsHelper
 
       def load_parent
         @product = Spree::Product.find_by(slug: params[:product_id])
@@ -40,58 +40,6 @@ module Spree
         redirect_back fallback_location: admin_product_stock_managements_path(@product)
       end
 
-      # GET /products/:slug/stock_managements/calendar?year=&selected_option_value_ids[]=
-      def calendar
-        @year = params[:year].present? ? params[:year].to_i : Time.zone.today.year
-
-        from_date = Date.new(@year, 1, 1).beginning_of_year
-        to_date = Date.new(@year, 1, 1).end_of_year
-
-        @variant_kind_option_types = Spree::Variants::OptionTypesFinder.new(variant_ids: @product.variants.ids)
-                                                                       .execute.select(&:variant?)
-        @selected_option_value_ids = Array(params[:selected_option_value_ids]).map(&:to_i)
-
-        inventory_items = @product.inventory_items.includes(:variant, :prices).where(
-          inventory_date: from_date..to_date
-        )
-
-        if @selected_option_value_ids.present?
-          variant_ids = SpreeCmCommissioner::Variants::FindByOptionValueIds.new(
-            product: @product, option_value_ids: @selected_option_value_ids
-          ).execute.ids
-          inventory_items = inventory_items.where(variant_id: variant_ids)
-          @matched_variants_count = variant_ids.size
-        else
-          @matched_variants_count = @product.variants.count
-        end
-
-        @inventory_items = inventory_items.to_a
-
-        @cached_inventory_items = ::SpreeCmCommissioner::RedisStock::CachedInventoryItemsBuilder.new(@inventory_items)
-                                                                                                .call
-                                                                                                .index_by(&:inventory_item_id)
-        @events = SpreeCmCommissioner::CalendarEvent.from_inventory_items(@inventory_items)
-      end
-
-      def inventory_item_message(inventory_item, cached_inventory_item)
-        synced = inventory_item.quantity_available == cached_inventory_item.quantity_available
-
-        if synced
-          "Synced: Quantity available matches in both DB and Redis (#{cached_inventory_item.quantity_available})."
-        else
-          "Out of sync: Redis shows #{cached_inventory_item.quantity_available} available, which doesn't match the database."
-        end
-      end
-
-      def inventory_item_hold_message(inventory_item, cached_inventory_item)
-        synced = inventory_item.quantity_on_hold == cached_inventory_item.quantity_on_hold
-        if synced
-          "Synced: Quantity on hold matches in both DB and Redis (#{cached_inventory_item.quantity_on_hold})."
-        else
-          "Out of sync: Redis shows #{cached_inventory_item.quantity_on_hold} on hold, which doesn't match the database."
-        end
-      end
-
       private
 
       def load_inventories

data/app/controllers/spree/api/switch_cm/base_controller.rb

@@ -0,0 +1,109 @@
+module Spree::Api::SwitchCm
+  # The Booking.com-compatible API channel managers (switch.cm) call under /api/cm.
+  # It's built on ActionController::API rather than Spree's v2 base, whose rescue handlers
+  # answer in JSON:API: a Booking.com connector parses every answer, errors included, as its
+  # family's XML, which Xml::BaseController renders.
+  #
+  # One Doorkeeper app per channel manager, presented as a Bearer token from the token
+  # exchange or as HTTP Basic with the app's client id and secret. Booking.com accepted Basic
+  # until 31 Dec 2025, and an older connector may still send it.
+  class BaseController < ActionController::API
+    include ActionController::HttpAuthentication::Basic::ControllerMethods
+
+    # Bodies are parsed whole and pushes applied in the request, so both are capped; the cap on
+    # updates is AcceptPush's.
+    MAX_BODY_BYTES = 1.megabyte
+
+    before_action :authenticate_switch_cm!
+    before_action :reject_oversized_body!
+
+    rescue_from Nokogiri::XML::SyntaxError do
+      render_fault(:bad_request, 'Request body is not well-formed XML')
+    end
+
+    private
+
+    def authenticate_switch_cm!
+      @oauth_application = application_from_bearer || application_from_basic
+      return if @oauth_application.present? && switch_cm_integrations.exists?
+
+      render_fault(:unauthorized, 'Authorization Required')
+    end
+
+    def reject_oversized_body!
+      return if request.raw_post.bytesize <= MAX_BODY_BYTES
+
+      render_fault(:payload_too_large, "Request body must not exceed #{MAX_BODY_BYTES / 1.megabyte} MB")
+    end
+
+    def application_from_bearer
+      doorkeeper_token.application if doorkeeper_token&.accessible?
+    end
+
+    def application_from_basic
+      authenticate_with_http_basic do |client_id, client_secret|
+        application = Spree::OauthApplication.find_by(uid: client_id)
+        application if application&.secret_matches?(client_secret)
+      end
+    end
+
+    def switch_cm_integrations
+      SpreeCmCommissioner::Integrations::SwitchCm.readable.where(oauth_application_id: @oauth_application.id)
+    end
+
+    # nil unless the requested hotel is one of this channel manager's connected hotels.
+    def current_integration
+      return @current_integration if defined?(@current_integration)
+
+      accommodation_id = accommodation_id_from_request
+      @current_integration = accommodation_id.present? ? switch_cm_integrations.find_by(vendor_id: accommodation_id) : nil
+    end
+
+    def require_integration!
+      render_fault(:forbidden, 'Not authorized for this hotel') if current_integration.nil?
+    end
+
+    # Pushes need an active connection: a paused one is still being set up, and the hotel keeps
+    # selling on its own counts until it's activated.
+    def require_active_integration!
+      return render_fault(:forbidden, 'Not authorized for this hotel') if current_integration.nil?
+
+      render_fault(:forbidden, 'This hotel is not active on BookMe+ yet') unless current_integration.active?
+    end
+
+    # Pushes may leave out the hotel id (B.XML never sends one); Booking.com derives it from the
+    # rooms. A room of another channel manager's hotel resolves to a hotel this app can't access.
+    def vendor_id_of_room(room_id)
+      Spree::Variant.where(id: room_id.to_i).pick(:vendor_id) if room_id.present?
+    end
+
+    # Reservation pulls take a comma-separated list of hotel ids, or none for all of this
+    # channel manager's hotels. Unknown ids come back separately, for a warning each, as at
+    # Booking.com; a list with no known hotel at all is refused.
+    def requested_integrations(hotel_ids)
+      ids = hotel_ids.to_s.split(',').map(&:strip).compact_blank
+      scope = switch_cm_integrations.includes(:vendor).order(:vendor_id)
+      return [scope.to_a, []] if ids.empty?
+
+      integrations = scope.where(vendor_id: ids).to_a
+      [integrations, ids - integrations.map { |integration| integration.vendor_id.to_s }]
+    end
+
+    def accommodation_id_from_request
+      raise NotImplementedError, "#{self.class.name} must implement accommodation_id_from_request"
+    end
+
+    def render_fault(_status, _text, code: nil)
+      raise NotImplementedError, "#{self.class.name} must implement render_fault"
+    end
+
+    # Rails parses neither XML nor text/xml bodies into params, so both families read the raw body.
+    def request_document
+      @request_document ||= Nokogiri::XML(request.raw_post) { |config| config.strict.nonet }.tap(&:remove_namespaces!)
+    end
+
+    def ruid
+      request.request_id
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/tokens_controller.rb

@@ -0,0 +1,68 @@
+module Spree::Api::SwitchCm
+  class TokensController < BaseController
+    # Booking.com's tokens also last an hour; connectors refresh on that schedule.
+    TOKEN_LIFETIME = 1.hour
+
+    skip_before_action :authenticate_switch_cm!
+
+    # POST /api/cm/token-based-authentication/exchange
+    # Client id and secret in (JSON or XML), { jwt, ruid } out, then `Authorization: Bearer` on every
+    # other call. The value is a Doorkeeper access token rather than a signed JWT, so a connector
+    # that only forwards it works but one that decodes it won't.
+    def create
+      client_id, client_secret = credentials
+      return render_fault(:bad_request, 'client_id and client_secret are required') if client_id.blank? || client_secret.blank?
+
+      @oauth_application = Spree::OauthApplication.find_by(uid: client_id)
+      unless @oauth_application&.secret_matches?(client_secret) && switch_cm_integrations.exists?
+        return render_fault(:unauthorized, 'Invalid client credentials')
+      end
+
+      render_token(issue_token.plaintext_token)
+    end
+
+    private
+
+    def issue_token
+      Spree::OauthAccessToken.create_for(
+        application: @oauth_application,
+        resource_owner: nil,
+        scopes: '',
+        expires_in: TOKEN_LIFETIME.to_i,
+        use_refresh_token: false
+      )
+    end
+
+    def credentials
+      return [params[:client_id], params[:client_secret]] unless xml_request?
+
+      %w[client_id client_secret].map { |name| request_document.at_xpath("/request/#{name}")&.text&.strip }
+    end
+
+    def xml_request?
+      request.content_mime_type&.symbol == :xml
+    end
+
+    def render_token(token)
+      return render json: { jwt: token, ruid: ruid } unless xml_request?
+
+      document = SpreeCmCommissioner::Integrations::SwitchCm::Xml::ResponseBuilder.build('response', ruid: ruid) do |xml|
+        xml.jwt token
+        xml.ruid ruid
+      end
+      render xml: document
+    end
+
+    # override
+    def render_fault(status, text, code: nil)
+      code ||= Rack::Utils.status_code(status)
+
+      if xml_request?
+        render xml: SpreeCmCommissioner::Integrations::SwitchCm::Xml::ResponseBuilder.fault('response', code: code, text: text, ruid: ruid),
+               status: status
+      else
+        render json: { errors: [{ code: code, message: text }], ruid: ruid }, status: status
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/availabilities_controller.rb

@@ -0,0 +1,39 @@
+module Spree::Api::SwitchCm
+  module Xml
+    class AvailabilitiesController < BaseController
+      before_action :require_active_integration!
+
+      # POST /api/cm/hotels/xml/availability
+      # Rooms to sell, prices and closed in one message, validated and applied in the request
+      # (Inventory::AcceptPush); the answer is the real outcome.
+      def create
+        result = SpreeCmCommissioner::Integrations::SwitchCm::Inventory::AcceptPush.call(
+          integration: current_integration,
+          message: 'availability',
+          updates: parser.updates,
+          request_id: ruid
+        )
+
+        push_response = SpreeCmCommissioner::Integrations::SwitchCm::Xml::PushResponse.new(result: result.value, ruid: ruid)
+        render xml: push_response.to_xml, status: push_response.http_status
+      end
+
+      private
+
+      # override
+      def response_root
+        'availability'
+      end
+
+      def parser
+        @parser ||= SpreeCmCommissioner::Integrations::SwitchCm::Xml::AvailabilityParser.new(request_document)
+      end
+
+      # B.XML pushes carry no hotel id; the rooms name it.
+      # override
+      def accommodation_id_from_request
+        vendor_id_of_room(parser.first_room_id)
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/base_controller.rb

@@ -0,0 +1,37 @@
+module Spree::Api::SwitchCm
+  module Xml
+    # Booking.com's B.XML family (/hotels/xml/...): a request that fails as a whole answers with
+    # a <fault code string/> under the call's root element. Requests carry their parameters
+    # in a <request> body.
+    class BaseController < Spree::Api::SwitchCm::BaseController
+      private
+
+      def response_root
+        raise NotImplementedError, "#{self.class.name} must implement response_root"
+      end
+
+      # override
+      def render_fault(status, text, code: nil)
+        code ||= Rack::Utils.status_code(status)
+        render xml: SpreeCmCommissioner::Integrations::SwitchCm::Xml::ResponseBuilder.fault(response_root, code: code, text: text, ruid: ruid),
+               status: status
+      end
+
+      def render_document(&block)
+        render xml: SpreeCmCommissioner::Integrations::SwitchCm::Xml::ResponseBuilder.build(response_root, ruid: ruid, &block)
+      end
+
+      # override
+      def accommodation_id_from_request
+        request_value('hotel_id')
+      end
+
+      # A parameter from the <request> body, falling back to the query string.
+      def request_value(name)
+        return params[name] if request.raw_post.blank?
+
+        request_document.at_xpath("/request/#{name}")&.text&.strip.presence || params[name]
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/reservation_summaries_controller.rb

@@ -0,0 +1,28 @@
+module Spree::Api::SwitchCm
+  module Xml
+    class ReservationSummariesController < BaseController
+      before_action :require_integration!
+
+      # POST /api/cm/hotels/xml/reservationssummary with <request><hotel_id/></request>
+      # The hotel's confirmed stays checking out from tomorrow on, however long ago they were
+      # booked. The channel manager imports these while setting the hotel up, so they count against
+      # its availability before its first push. Read-only: nothing is marked seen.
+      def create
+        reservations = SpreeCmCommissioner::Integrations::SwitchCm::Reservations::Feed.new([current_integration]).summary
+
+        render_document do |xml|
+          reservations.each do |reservation|
+            SpreeCmCommissioner::Integrations::SwitchCm::Xml::ReservationSerializer.new(reservation, summary: true).build(xml)
+          end
+        end
+      end
+
+      private
+
+      # override
+      def response_root
+        'reservations'
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/reservations_controller.rb

@@ -0,0 +1,57 @@
+module Spree::Api::SwitchCm
+  module Xml
+    class ReservationsController < BaseController
+      # POST /api/cm/hotels/xml/reservations with <request><hotel_id/><last_change/><limit/><id/></request>
+      # New, modified and cancelled reservations in one stream. B.XML has no acknowledgement, so returning a
+      # reservation is what marks it seen; `last_change` re-reads recent ones regardless.
+      def create
+        integrations, = requested_integrations(request_value('hotel_id') || request_value('hotel_ids'))
+        return render_fault(:forbidden, 'Not authorized for these hotels') if integrations.empty?
+
+        reservations = SpreeCmCommissioner::Integrations::SwitchCm::Reservations::Feed.new(integrations).changed_reservations(
+          id: request_value('id'),
+          last_change: SpreeCmCommissioner::Integrations::SwitchCm::Reservations::Feed.parse_last_change(request_value('last_change')),
+          limit: request_value('limit')
+        )
+
+        document = SpreeCmCommissioner::Integrations::SwitchCm::Xml::ResponseBuilder.build(response_root, ruid: ruid) do |xml|
+          reservations.each { |reservation| SpreeCmCommissioner::Integrations::SwitchCm::Xml::ReservationSerializer.new(reservation).build(xml) }
+        end
+
+        # Marked only once the document is built. One that fails to mark is simply returned
+        # again next time, which is harmless: its status is the same.
+        failed = mark_seen(reservations)
+        log_mark_seen_failures(failed) if failed.any?
+
+        render xml: document
+      end
+
+      private
+
+      # override
+      def response_root
+        'reservations'
+      end
+
+      def mark_seen(reservations)
+        reservations.each_with_object([]) do |reservation, failed|
+          SpreeCmCommissioner::Integrations::SwitchCm::Reservations::MarkSeen.call(
+            integration: reservation.integration, order: reservation.order, status: reservation.status,
+            modified_at: reservation.modified_at
+          )
+        rescue StandardError => e
+          failed << {
+            order_id: reservation.id,
+            integration_id: reservation.integration.id,
+            error_class: e.class.name,
+            error_message: e.message
+          }
+        end
+      end
+
+      def log_mark_seen_failures(failed)
+        CmAppLogger.error(label: "#{self.class.name}#mark_seen failed", data: { ruid: ruid, failed: failed })
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/room_rate_availabilities_controller.rb

@@ -0,0 +1,56 @@
+module Spree::Api::SwitchCm
+  module Xml
+    class RoomRateAvailabilitiesController < BaseController
+      DAYS_RANGE = (1..31)
+
+      before_action :require_integration!
+
+      # POST /api/cm/hotels/xml/roomrateavailability with <request><hotel_id/><start_date/><number_of_days/><room_id/></request>
+      # What we hold per room and night, so the channel manager can check its pushes landed.
+      # number_of_days is 1-31, 31 by default, as at Booking.com.
+      def create
+        start_date = parse_date(request_value('start_date')) || Time.zone.today
+        days = (request_value('number_of_days').presence || DAYS_RANGE.max).to_i
+        return render_fault(:bad_request, "number_of_days must be between #{DAYS_RANGE.min} and #{DAYS_RANGE.max}") unless DAYS_RANGE.cover?(days)
+
+        rows = SpreeCmCommissioner::Integrations::SwitchCm::Inventory::AvailabilitySnapshot.new(
+          integration: current_integration,
+          dates: (start_date...(start_date + days)).to_a,
+          room_id: request_value('room_id')
+        ).rows
+
+        render_document { |xml| rows.each { |row| build_row(xml, row) } }
+      end
+
+      private
+
+      # override
+      def response_root
+        'result'
+      end
+
+      def build_row(xml, row)
+        xml.roomrate(
+          {
+            date: row.date.iso8601,
+            room_id: row.room_id,
+            rate_id: row.rate_id,
+            rooms_to_sell: row.rooms_to_sell,
+            booked: row.booked,
+            cancelled: row.cancelled,
+            closed: row.closed ? 1 : 0,
+            price: row.price && format('%.2f', row.price),
+            currency: row.currency,
+            pushed_at: row.pushed_at&.utc&.iso8601
+          }.compact
+        )
+      end
+
+      def parse_date(value)
+        Date.iso8601(value) if value.present?
+      rescue Date::Error
+        nil
+      end
+    end
+  end
+end

data/app/controllers/spree/api/switch_cm/xml/room_rates_controller.rb

@@ -0,0 +1,45 @@
+module Spree::Api::SwitchCm
+  module Xml
+    class RoomRatesController < BaseController
+      before_action :require_integration!
+
+      # POST /api/cm/hotels/xml/roomrates with <request><hotel_id/></request>
+      # The hotel's rooms, each with its rates, which the channel manager maps to its own
+      # ("Refresh Room" in switch.cm). A derived rate plan is a child rate of the room's base rate.
+      def create
+        vendor = current_integration.vendor
+        rooms = SpreeCmCommissioner::Integrations::SwitchCm::RoomCatalog.new(vendor).rooms
+
+        render_document do |xml|
+          rooms.each do |room|
+            xml.room(id: room.id, hotel_id: vendor.id, hotel_name: vendor.name, room_name: room.name, max_children: room.max_children) do
+              xml.rates { room.rates.each { |rate| build_rate(xml, room, rate) } }
+            end
+          end
+        end
+      end
+
+      private
+
+      def build_rate(xml, room, rate)
+        attributes = { id: rate.id, rate_name: rate.name, max_persons: room.max_persons, is_child_rate: rate.child? ? 1 : 0, readonly: 0 }
+        return xml.rate(attributes) unless rate.child?
+
+        # Restrictions other than closing aren't stored, so the child rate follows only its parent's price and closings.
+        xml.rate(attributes) do
+          xml.rate_relation(
+            {
+              parent_rate_id: rate.parent_id, percentage: rate.percentage&.to_f, additional: rate.additional&.to_f,
+              follows_price: 1, follows_closed: 3, follows_restrictions: 0
+            }.compact
+          )
+        end
+      end
+
+      # override
+      def response_root
+        'rooms'
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/operator/guests_controller.rb

@@ -12,7 +12,7 @@ module Spree
           end
 
           def collection
-            SpreeCmCommissioner::GuestSearcherQuery.new(params).call
+            SpreeCmCommissioner::GuestSearcherQuery.new(params).call.merge(SpreeCmCommissioner::Guest.with_dynamic_fields_and_options)
           end
 
           # override

data/app/controllers/spree/api/v2/platform/homepage_section_relatable_options_controller.rb

@@ -7,6 +7,7 @@ module Spree
             return Spree::Vendor if params['model_class'] == 'Spree::Vendor'
             return Spree::Product if params['model_class'] == 'Spree::Product'
             return Spree::Taxon if params['model_class'] == 'Spree::Taxon'
+            return Spree.user_class if params['model_class'] == 'Spree::User'
 
             nil
           end