spree_cm_commissioner 2.14.10 → 2.14.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de45fdbe1a6ac4c18da7e6b8fbd3eb6f4fe7241bb10e23c0d4c23973a91b7170
-  data.tar.gz: 54156df2cef71cff39256c04a949869559c0e477f6c1ba413d8b0ef91761d616
+  metadata.gz: 404c51ec35ca9f40be93a12f9d7c9af99621231ec51b47b4300e34570e0ee2c6
+  data.tar.gz: 4cc03fe1be1e9dbae9b4e7eca107e1b882b34fb2d0bb0ff6372c6d55f24935a2
 SHA512:
-  metadata.gz: '0383b1bb4e0459522cc0004b2a841a5697e18b9b28ff62469a8e1ce5501f91e7fb3fb8899689c2174d997484231b71883408069aca5f53ed0af400bb8e091cd6'
-  data.tar.gz: 5adeb841a23fb3d28a74e0972d34c478a0a80e26ba5ab114bb4d837aac2dadaf98fa9e696aff506fa4ed0de1acaa48af64067e8db8cd34803aa2518e0661945d
+  metadata.gz: 2d8d4d96eeb4e6b3e659cdc3660cb0213fb3da8b39ea09f680b8eb116e028c2205ebabf74cab3fcc6b1146725f25d7035d212b22215522b7b8950bd84b9ab88d
+  data.tar.gz: fab1f613701eec7c9ce563bf668781a8356d9cabd088cc3f55cf59a70eb527d8cb29fd6b5658272f871831ba17641a1c0914b63c971f9d0e5dd920311d37649d

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.14.10)
+    spree_cm_commissioner (2.14.11)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/services/spree_cm_commissioner/checkout/strip_uncollected_guest_fields.rb

@@ -0,0 +1,57 @@
+# A guest only stores what its line item collects (kyc_fields + dynamic fields), whatever a client
+# submits. Clients may send every guest with prefilled values — the app seeds guest #1 with the
+# buyer's contact info even for products that collect nothing — which would make guest #1 read as
+# the buyer while the others stay blank. Unenabled attributes are dropped rather than rejected so a
+# client that over-sends still checks out.
+module SpreeCmCommissioner
+  module Checkout
+    class StripUncollectedGuestFields
+      ALWAYS_ALLOWED = %w[id guest_dynamic_fields_attributes].freeze
+
+      # Not in KYC_FIELD_ATTRIBUTES; each only means something alongside the field it pairs with.
+      PAIRED_ATTRIBUTES = {
+        guest_phone_number: %w[country_code],
+        guest_id_card: %w[upload_later]
+      }.freeze
+
+      def self.call(order:, params:)
+        new.call(order: order, params: params)
+      end
+
+      def call(order:, params:)
+        line_items_params = params[:order]&.[](:line_items_attributes)
+        return if line_items_params.blank?
+
+        each_entry(line_items_params) do |line_item_params|
+          guests_params = line_item_params[:guests_attributes]
+          next if guests_params.blank?
+
+          line_item = order.line_items.find { |item| item.id.to_s == line_item_params[:id].to_s }
+          next if line_item.nil?
+
+          allowed = allowed_attributes(line_item)
+          each_entry(guests_params) do |guest_params|
+            rejected = guest_params.keys.reject { |key| allowed.include?(key.to_s) }
+            rejected.each { |key| guest_params.delete(key) }
+          end
+        end
+      end
+
+      private
+
+      def allowed_attributes(line_item)
+        kyc_fields = line_item.kyc.nil? ? [] : line_item.kyc_fields
+
+        ALWAYS_ALLOWED + kyc_fields.flat_map do |field|
+          Array(SpreeCmCommissioner::KycBitwise::KYC_FIELD_ATTRIBUTES[field]).map(&:to_s) + PAIRED_ATTRIBUTES.fetch(field, [])
+        end
+      end
+
+      # Nested attributes arrive either as an array or as an index-keyed hash ({ '0' => {...} }).
+      def each_entry(collection)
+        entries = collection.is_a?(Array) ? collection : collection.values
+        entries.each { |entry| yield(entry) if entry.respond_to?(:delete) && entry.respond_to?(:keys) }
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/checkout/update_decorator.rb

@@ -5,6 +5,7 @@ module SpreeCmCommissioner
       # 1. Validate line items are in stock before updating address
       # 2. Skip automatic state transitions (lines 17-18 commented out)
       #    State changes are handled by the advance action, not update
+      # 3. Drop guest attributes the line item doesn't collect (see StripUncollectedGuestFields)
       def call(order:, params:, permitted_attributes:, request_env:)
         return failure(order) unless order.ensure_line_items_are_in_stock
 
@@ -17,6 +18,8 @@ module SpreeCmCommissioner
         # order.state = 'address' if (ship_changed || bill_changed) && order.has_checkout_step?('address')
         # order.state = 'delivery' if selected_shipping_rate_present?(params) && order.has_checkout_step?('delivery')
 
+        SpreeCmCommissioner::Checkout::StripUncollectedGuestFields.call(order: order, params: params)
+
         if order.update_from_params(params, permitted_attributes, request_env)
           # Recalculate pricing models after order/guest updates to ensure adjustments reflect current rules
           SpreeCmCommissioner::PricingModels::Activate.call(order: order)

data/lib/spree_cm_commissioner/version.rb

@@ -1,5 +1,5 @@
 module SpreeCmCommissioner
-  VERSION = '2.14.10'.freeze
+  VERSION = '2.14.11'.freeze
 
   module_function
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_cm_commissioner
 version: !ruby/object:Gem::Version
-  version: 2.14.10
+  version: 2.14.11
 platform: ruby
 authors:
 - You
@@ -2347,6 +2347,7 @@ files:
 - app/services/spree_cm_commissioner/checkout/advance_to_payment.rb
 - app/services/spree_cm_commissioner/checkout/complete_decorator.rb
 - app/services/spree_cm_commissioner/checkout/remove_store_credit_decorator.rb
+- app/services/spree_cm_commissioner/checkout/strip_uncollected_guest_fields.rb
 - app/services/spree_cm_commissioner/checkout/update_decorator.rb
 - app/services/spree_cm_commissioner/completion_steps/mark_line_item_as_completed.rb
 - app/services/spree_cm_commissioner/completion_steps/regenerate_for_line_items.rb