spree_cm_commissioner 2.14.11 → 2.15.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 404c51ec35ca9f40be93a12f9d7c9af99621231ec51b47b4300e34570e0ee2c6
-  data.tar.gz: 4cc03fe1be1e9dbae9b4e7eca107e1b882b34fb2d0bb0ff6372c6d55f24935a2
+  metadata.gz: 7cd929df06e0243dc4cf2b0b4ffc57d3346ced9f9d0cb5bdd3142d6adc153a88
+  data.tar.gz: 29a71dceac61e9e6497137c525ff9e76ace8ca1a179f0dc6eab157fd83a30a4d
 SHA512:
-  metadata.gz: 2d8d4d96eeb4e6b3e659cdc3660cb0213fb3da8b39ea09f680b8eb116e028c2205ebabf74cab3fcc6b1146725f25d7035d212b22215522b7b8950bd84b9ab88d
-  data.tar.gz: fab1f613701eec7c9ce563bf668781a8356d9cabd088cc3f55cf59a70eb527d8cb29fd6b5658272f871831ba17641a1c0914b63c971f9d0e5dd920311d37649d
+  metadata.gz: 2bd7890db6844d7057a5e89f8e2cd0285e387772aaccba0ba2806aee4b7f78de3cea566402fb5a97279613bae6be342bbef2b55e2d185c82d8d85fec59401520
+  data.tar.gz: 682f9b46dae492ff3f0bdb9f558dccc3185ec4b9a6a0770e4fca4146ecd496e90577b97c049a9a171f7ab6ac76486fc14d4cdefe6bf7098ec96de9b8c09c170b

data/.env.example

@@ -49,8 +49,6 @@ DISTANCE_SIGNING_KEY=hei********************VY
 
 # CDN cache durations (s-maxage, in seconds) for listed public APIs; client max-age is always 0, unlisted APIs are never CDN-cached
 # See: app/controllers/concerns/spree_cm_commissioner/content_cachable.rb
-CACHE_AUTO_INVALIDATION_DISABLED="" # Set to yes to stop automatic CDN cache invalidation on save (kill switch); a clear-cache click still sends one
-CACHE_SERIALIZER_DISABLED="" # Set to yes to turn off Spree's serializer record cache everywhere
 CACHE_STATIC_MAX_AGE=86400 # Static content (CMS pages) - 1 day
 CACHE_REALTIME_MAX_AGE=300 # Everything else listed (homepage, menus, products, events, vendors, trips, seat layouts, countries, provinces, guest card classes) - 5 minutes
 
@@ -95,3 +93,4 @@ ORDER_INTEGRITY_TELEGRAM_ALERT_ENABLED="no"  # Set to yes to enable the order in
 PRE_INVENTORY_DAYS_TRANSIT=180  # How many days ahead inventory items are pre-generated for transit variants
 PRE_INVENTORY_DAYS_ACCOMMODATION=365  # How many days ahead inventory items are pre-generated for accommodation variants
 PRE_INVENTORY_DAYS_SERVICE=180  # How many days ahead inventory items are pre-generated for service variants
+PAYMENT_BASE_URL=http://localhost:4000

data/.tool-versions

@@ -1 +1 @@
-ruby 3.2.0
+ruby 3.2.11

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.14.11)
+    spree_cm_commissioner (2.15.1)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront
@@ -886,7 +886,7 @@ GEM
       spree_backend (>= 4.3.0.rc1)
       spree_emails (>= 4.3.0.rc1)
       spree_extension
-    spree_vpago (2.3.4)
+    spree_vpago (2.4.6)
       faraday
       google-cloud-firestore
       spree_api (>= 4.5)

data/app/controllers/concerns/spree_cm_commissioner/operator/event_authorization.rb

@@ -3,6 +3,8 @@ module SpreeCmCommissioner
     module EventAuthorization
       extend ActiveSupport::Concern
 
+      OPERATOR_CHART_TYPE = 'entry_type'.freeze
+
       private
 
       # True only when the current user holds the organizer role AND owns the
@@ -14,6 +16,27 @@ module SpreeCmCommissioner
 
         spree_current_user.vendors.exists?(id: taxon.vendor_id)
       end
+
+      # Whether the current user may load `chart_type` for `taxon`. A user holding the operator role —
+      # even if also an organizer — sees only the entry type chart, and only while the event allows
+      # operators the total ticket number or the event overview (allow_total_ticket_order_for_operator,
+      # allow_event_overview_for_operator); the participation chart exposes the event's overall
+      # show / no-show totals, so it is never shown to them. Everyone else: the event's vendor
+      # organizer sees every chart, and a user assigned to the event sees only the entry type chart.
+      def chart_type_allowed?(taxon, chart_type)
+        return false if taxon.nil? || spree_current_user.nil?
+        return operator_chart_allowed?(taxon, chart_type) if spree_current_user.operator?
+        return true if organizer_for_event?(taxon)
+        return false unless spree_current_user.events.exists?(id: taxon.id)
+
+        chart_type.to_s == OPERATOR_CHART_TYPE
+      end
+
+      def operator_chart_allowed?(taxon, chart_type)
+        (taxon.allow_total_ticket_order_for_operator || taxon.allow_event_overview_for_operator) &&
+          chart_type.to_s == OPERATOR_CHART_TYPE &&
+          spree_current_user.events.exists?(id: taxon.id)
+      end
     end
   end
 end

data/app/controllers/concerns/spree_cm_commissioner/waiting_room_authorization.rb

@@ -53,7 +53,18 @@ module SpreeCmCommissioner
     end
 
     def active_waiting_room_session?
-      SpreeCmCommissioner::WaitingRoomSession.active.exists?(token: params[:waiting_room_session_token])
+      current_waiting_room_session.present?
+    end
+
+    # The active session behind this request's token, memoized so the guard and the draft order it
+    # admits share one lookup. Draft-order actions store its id on the order for analytics even when
+    # the guard didn't run (non-enforced product, private sale, waiting room disabled): the app sends
+    # the token on every request while its session is live, and only an active one is ever linked.
+    def current_waiting_room_session
+      return @current_waiting_room_session if defined?(@current_waiting_room_session)
+
+      token = params[:waiting_room_session_token]
+      @current_waiting_room_session = token.present? ? SpreeCmCommissioner::WaitingRoomSession.active.find_by(token: token) : nil
     end
 
     # Verified, not just present: a made-up `st` must not skip the queue, so a token that fails

data/app/controllers/spree/admin/system/waiting_room_sessions_controller.rb

@@ -33,6 +33,7 @@ module Spree
           @doc_id = params[:doc_id].presence
           @per_page = guests_per_page
           @in_queue_only = guests_in_queue_only?
+          @newest_first = guests_newest_first?
         end
 
         # GET .../waiting_room_sessions/guests_status -- the poll target, mirroring
@@ -43,6 +44,7 @@ module Spree
           date = params[:date].presence || Time.zone.today.strftime('%Y-%m-%d')
           doc_id = params[:doc_id].presence
           in_queue_only = guests_in_queue_only?
+          newest_first = guests_newest_first?
           error = nil
 
           guests =
@@ -56,17 +58,17 @@ module Spree
             else
               # Cached for the same span as the client's poll interval so N concurrently open admin
               # tabs (each polling every 10s) collapse into one Firestore read per date per 10s,
-              # instead of one per open tab. Keyed by filter too -- "in queue" and "all" are
-              # different Firestore queries, not a client-side slice of the same result.
+              # instead of one per open tab. Keyed by filter and order too -- "in queue"/"all" and
+              # oldest/newest are different Firestore queries, not a client-side slice of one result.
               #
               # A failed fetch (e.g. a missing Firestore composite index for in_queue_only's
               # where+order combination) is never cached: caching `[]` would make the next 10s
               # poll -- and the one after that -- believe the queue is empty instead of retrying.
-              cache_key = "admin/waiting_room_guests/#{date}/#{in_queue_only}"
+              cache_key = "admin/waiting_room_guests/#{date}/#{in_queue_only}/#{newest_first}"
               docs = Rails.cache.read(cache_key)
 
               if docs.nil?
-                result = SpreeCmCommissioner::WaitingRoom::Guests::List.call(date: date, in_queue_only: in_queue_only)
+                result = SpreeCmCommissioner::WaitingRoom::Guests::List.call(date: date, in_queue_only: in_queue_only, newest_first: newest_first)
                 if result.success?
                   docs = result.value[:guests]
                   Rails.cache.write(cache_key, docs, expires_in: 10.seconds)
@@ -122,6 +124,12 @@ module Spree
           params[:status] != 'all'
         end
 
+        # Defaults to oldest-first (queue order). ?order=newest is for spotting who joined last,
+        # which oldest-first buries on the final page -- or past MAX_DOCS, doesn't load at all.
+        def guests_newest_first?
+          params[:order] == 'newest'
+        end
+
         # Same 10s window as the guest list itself: this is one extra doc read per render, and the
         # "people ahead" figure it feeds only changes as often as Positions::Stamp ticks (10s),
         # so caching it any shorter would just be re-fetching a value that hasn't moved.

data/app/controllers/spree/api/v2/operator/check_ins_controller.rb

@@ -50,10 +50,12 @@ module Spree
           # The organizer who owns the event's vendor always sees check-in history.
           # Crew/operators assigned via user.events only see it while the event is
           # ongoing — once it ends, it becomes organizer-owned history. A missing/
-          # nonexistent taxon_id is restricted the same way.
+          # nonexistent taxon_id is restricted the same way. Any user, organizer included,
+          # loses it when the event turns off allow_check_in_history_for_operator (mirrors DashboardCrewEventSerializer#permissions).
           def restricted?
             taxon = Spree::Taxon.find_by(id: params[:taxon_id])
             return true if taxon.nil?
+            return true unless taxon.allow_check_in_history_for_operator
             return false if organizer_for_event?(taxon)
             return true unless spree_current_user.events.exists?(id: taxon.id)
 

data/app/controllers/spree/api/v2/operator/event_charts_controller.rb

@@ -11,30 +11,26 @@ module Spree
           ADDITIONAL_FIELDS = %i[participation entry_type].freeze
 
           def index
-            resources = if restricted?
-                          []
-                        else
-                          kyc_fields = fetch_filtered_kyc_fields
-                          types = ADDITIONAL_FIELDS + kyc_fields
+            kyc_fields = fetch_filtered_kyc_fields
+            types = (ADDITIONAL_FIELDS + kyc_fields).select { |type| chart_type_allowed?(event_taxon, type) }
 
-                          types.map do |type|
-                            # Create unique ID by using chart_type as the identifier
-                            SpreeCmCommissioner::EventChart.new(
-                              id: type.to_s,
-                              chart_type: type,
-                              product_charts: nil
-                            )
-                          end
-                        end
+            resources = types.map do |type|
+              # Create unique ID by using chart_type as the identifier
+              SpreeCmCommissioner::EventChart.new(
+                id: type.to_s,
+                chart_type: type,
+                product_charts: nil
+              )
+            end
 
             render json: SpreeCmCommissioner::V2::Operator::PieChartEventAggregatorSerializer.new(resources).serializable_hash
           end
 
           def resource
-            @resource = if restricted?
-                          SpreeCmCommissioner::EventChart.new(id: params[:id], chart_type: params[:id] || 'participation', product_charts: [])
-                        else
+            @resource = if chart_type_allowed?(event_taxon, chart_type)
                           event_chart_aggregator_queries.call
+                        else
+                          SpreeCmCommissioner::EventChart.new(id: params[:id], chart_type: chart_type, product_charts: [])
                         end
           end
 
@@ -44,18 +40,18 @@ module Spree
 
           private
 
-          # Only the organizer who owns the event's vendor may see chart data —
-          # crew/operators assigned via user.events never see it, regardless of
-          # whether the event is ongoing or ended. See organizer_for_event? (EventAuthorization).
-          def restricted?
-            taxon = Spree::Taxon.find_by(id: params[:taxon_id])
-            !organizer_for_event?(taxon)
+          def chart_type
+            params[:id] || 'participation'
+          end
+
+          def event_taxon
+            @event_taxon ||= Spree::Taxon.find_by(id: params[:taxon_id])
           end
 
           def event_chart_aggregator_queries
             SpreeCmCommissioner::EventChartQueries.new(
               taxon_id: params[:taxon_id],
-              chart_type: params[:id] || 'participation',
+              chart_type: chart_type,
               check_in_session_id: params[:check_in_session_id],
               refreshed: params[:refreshed] || false
             )

data/app/controllers/spree/api/v2/operator/pie_chart_event_aggregators_controller.rb

@@ -10,12 +10,12 @@ module Spree
           def resource
             taxon = Spree::Taxon.find_by(id: params[:taxon_id])
 
-            @resource = if organizer_for_event?(taxon)
+            @resource = if chart_type_allowed?(taxon, chart_type)
                           pie_chart_event_aggregator_queries.call
                         else
                           SpreeCmCommissioner::EventChart.new(
-                            id: params[:chart_type] || 'participation',
-                            chart_type: params[:chart_type] || 'participation',
+                            id: chart_type,
+                            chart_type: chart_type,
                             product_charts: []
                           )
                         end
@@ -27,10 +27,14 @@ module Spree
 
           private
 
+          def chart_type
+            params[:chart_type] || 'participation'
+          end
+
           def pie_chart_event_aggregator_queries
             SpreeCmCommissioner::PieChartEventAggregatorQueries.new(
               taxon_id: params[:taxon_id],
-              chart_type: params[:chart_type] || 'participation',
+              chart_type: chart_type,
               refreshed: params[:refreshed] || false
             )
           end

data/app/controllers/spree/api/v2/storefront/draft_orders_controller.rb

@@ -30,7 +30,9 @@ module Spree
               options: {
                 device_id: device_id,
                 last_ip_address: request.remote_ip,
-                private_sale_token: params[:st]
+                private_sale_token: params[:st],
+                waiting_room_session_id: current_waiting_room_session&.id,
+                oauth_application_id: doorkeeper_token&.application_id
               }
             )
 

data/app/controllers/spree/api/v2/storefront/queue_draft_orders_controller.rb

@@ -32,6 +32,11 @@ module Spree
                   device_id: device_id,
                   last_ip_address: request.remote_ip,
                   private_sale_token: params[:st],
+
+                  # Resolved now, not in ProcessJob: the session may have expired by the time the job runs.
+                  waiting_room_session_id: current_waiting_room_session&.id,
+                  oauth_application_id: doorkeeper_token&.application_id,
+
                   # Carried into the job so it can bypass hold limits for a load test (see ProcessJob).
                   load_test_bypass: SpreeCmCommissioner::Current.load_test_bypass
                 }

data/app/controllers/spree/api/v2/storefront/transit/draft_orders_controller.rb

@@ -25,7 +25,8 @@ module Spree
                 outbound_legs: @outbound_legs,
                 inbound_legs: @inbound_legs,
                 user: spree_current_user,
-                include_return: ActiveModel::Type::Boolean.new.cast(params[:include_return])
+                include_return: ActiveModel::Type::Boolean.new.cast(params[:include_return]),
+                oauth_application_id: doorkeeper_token&.application_id
               )
 
               if result.success?

data/app/controllers/spree/api/v2/tenant/draft_orders_controller.rb

@@ -27,7 +27,9 @@ module Spree
               options: {
                 device_id: params[:device_id],
                 last_ip_address: request.remote_ip,
-                private_sale_token: params[:st]
+                private_sale_token: params[:st],
+                waiting_room_session_id: current_waiting_room_session&.id,
+                oauth_application_id: doorkeeper_token&.application_id
               }
             )
 

data/app/controllers/spree/api/v2/tenant/private_sale_products_controller.rb

@@ -0,0 +1,33 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        # GET /api/v2/tenant/private_sale_products?st=<private sale token>
+        class PrivateSaleProductsController < ::Spree::Api::V2::Tenant::ProductsController
+          before_action :require_spree_current_user
+          before_action :authorize_private_sale_token!
+
+          private
+
+          attr_reader :private_sale
+
+          def authorize_private_sale_token!
+            result = SpreeCmCommissioner::PrivateSales::Authorize.call(
+              token: params[:st],
+              user: spree_current_user
+            )
+
+            return @private_sale = result.value if result.success?
+
+            render_error_payload(SpreeCmCommissioner::PrivateSales::Authorize.error_message(result.error.value), 403)
+          end
+
+          # override — super keeps it to this tenant's products, so a token for another tenant's sale returns nothing.
+          def scope
+            super.where(id: private_sale.product_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/queue_draft_orders_controller.rb

@@ -0,0 +1,64 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class QueueDraftOrdersController < BaseController
+          include SpreeCmCommissioner::LoadTestBypassable
+          include SpreeCmCommissioner::AnonymousBookingGuard
+
+          before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
+          before_action -> { ensure_waiting_room_session!(draft_order_products) }, only: :create
+
+          # Tenant counterpart of Storefront::QueueDraftOrdersController: the order is built later by
+          # QueueDraftOrders::ProcessJob, under this tenant.
+          #
+          # Endpoint: POST /api/v2/tenant/queue_draft_orders
+          # Params: same as POST /api/v2/tenant/draft_orders
+          def create
+            result = SpreeCmCommissioner::QueueDraftOrders::Enqueue.call(
+              create_type: 'generic',
+              creation_params: {
+                line_items: draft_order_line_items,
+                user: spree_current_user,
+                store: current_store,
+                currency: current_currency,
+                tenant: @tenant,
+                options: {
+                  device_id: params[:device_id],
+                  last_ip_address: request.remote_ip,
+                  private_sale_token: params[:st],
+                  load_test_bypass: SpreeCmCommissioner::Current.load_test_bypass
+                }
+              },
+              locale: I18n.locale.to_s
+            )
+
+            if result.success?
+              render_serialized_payload { result.value }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          private
+
+          # Plain symbol-keyed Hashes: this crosses the ActiveJob serialization boundary.
+          def draft_order_line_items
+            params.permit(line_items: [:variant_id, :quantity, { options: {}, public_metadata: {}, private_metadata: {} }])
+                  .to_h
+                  .deep_symbolize_keys
+                  .fetch(:line_items, [])
+          end
+
+          # Memoized: both the anonymous-booking and waiting-room guards read it on the same request.
+          def draft_order_products
+            @draft_order_products ||= begin
+              variant_ids = draft_order_line_items.pluck(:variant_id).compact
+              Spree::Variant.where(id: variant_ids).includes(product: :event).map(&:product)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/seat_layouts_controller.rb

@@ -0,0 +1,93 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class SeatLayoutsController < BaseController
+          # GET /api/v2/tenant/seat_layouts/:id
+          # - include_details=true|false (optional, default: true)
+          #
+          # Always returns `product_ids` (see SeatLayout#product_ids).
+          def show
+            render_serialized_payload { serialize_resource(resource) }
+          end
+
+          private
+
+          # GET /api/v2/tenant/seat_layouts?
+          # - variant_ids[]=[1,2]
+          # - include_details=true|false (optional, default: true)
+          #
+          # override
+          def collection
+            return @collection if defined?(@collection)
+
+            collection = scope.active.joins(:blocks).where(blocks: { variant_id: params[:variant_ids] }).distinct
+            collection = collection.includes(:top_level_blocks, seat_sections: :blocks) if include_details?
+
+            @collection = collection
+          end
+
+          # override
+          def resource
+            SpreeCmCommissioner::SeatLayout.includes(
+              :top_level_blocks,
+              { seat_sections: :blocks }
+            ).where(id: scope.select(:id)).find(params[:id])
+          end
+
+          # Seat layouts have no tenant_id. Event layouts reach the tenant through their blocks' variants;
+          # trip layouts are copied without variant_id on their blocks, so they go through the trip's vendor.
+          # override
+          def scope
+            event_layouts = SpreeCmCommissioner::SeatLayout.joins(blocks: { variant: :vendor })
+                                                           .where(spree_vendors: { tenant_id: @tenant.id })
+            tenant_trips = SpreeCmCommissioner::Trip.joins(:vendor).where(spree_vendors: { tenant_id: @tenant.id })
+            trip_layouts = SpreeCmCommissioner::SeatLayout.where(
+              layoutable_type: 'SpreeCmCommissioner::Trip',
+              layoutable_id: tenant_trips.select(:id)
+            )
+
+            SpreeCmCommissioner::SeatLayout.where(id: event_layouts.select(:id)).or(
+              SpreeCmCommissioner::SeatLayout.where(id: trip_layouts.select(:id))
+            )
+          end
+
+          # override
+          def default_resource_includes
+            [
+              'top_level_blocks',
+              'seat_sections',
+              'seat_sections.blocks'
+            ]
+          end
+
+          # override
+          def required_schema
+            return nil unless action_name == 'index'
+
+            SpreeCmCommissioner::SeatLayoutSchema
+          end
+
+          # override
+          def resource_serializer
+            SpreeCmCommissioner::V2::Storefront::SeatLayoutSerializer
+          end
+
+          # override
+          def collection_serializer
+            SpreeCmCommissioner::V2::Storefront::SeatLayoutSerializer
+          end
+
+          # override
+          def serializer_params
+            super.merge(include_details: include_details?, include_product_ids: action_name == 'show')
+          end
+
+          def include_details?
+            params.fetch(:include_details, 'true') == 'true'
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/transit/draft_orders_controller.rb

@@ -25,7 +25,8 @@ module Spree
                 outbound_legs: @outbound_legs,
                 inbound_legs: @inbound_legs,
                 user: spree_current_user,
-                include_return: ActiveModel::Type::Boolean.new.cast(params[:include_return])
+                include_return: ActiveModel::Type::Boolean.new.cast(params[:include_return]),
+                oauth_application_id: doorkeeper_token&.application_id
               )
 
               if result.success?

data/app/jobs/spree_cm_commissioner/queue_draft_orders/process_job.rb

@@ -16,9 +16,12 @@ module SpreeCmCommissioner
           # Current doesn't cross into the job, so restore the load-test-bypass flag here — otherwise
           # ValidateLimits would reject a trusted load test.
           SpreeCmCommissioner::Current.set(load_test_bypass: creation_params.dig(:options, :load_test_bypass) || false) do
-            SpreeCmCommissioner::QueueDraftOrders::Process.call(
-              document_path: document_path, create_type: create_type, creation_params: creation_params
-            )
+            # Order#set_tenant_id reads MultiTenant.current_tenant_id, which the request set but the job doesn't.
+            MultiTenant.with(creation_params[:tenant]) do
+              SpreeCmCommissioner::QueueDraftOrders::Process.call(
+                document_path: document_path, create_type: create_type, creation_params: creation_params
+              )
+            end
           end
         end
       end

data/app/models/concerns/spree_cm_commissioner/event_metadata.rb

@@ -18,6 +18,16 @@ module SpreeCmCommissioner
       # For certain large events, admin can disable this manually.
       store_public_metadata :allow_manual_search_for_operator, :boolean, default: true
 
+      # Whether operators may see this event's total ticket number (and the entry type chart) in the
+      # operator app. Organizers of the event's vendor always see it. Admin can disable per event.
+      store_public_metadata :allow_total_ticket_order_for_operator, :boolean, default: true
+
+      # Operator app switches for this event. Only users holding the operator role are restricted
+      # (see DashboardCrewEventSerializer): check-in history screens, and the full Home screen with
+      # the dashboard charts ("event overview").
+      store_public_metadata :allow_check_in_history_for_operator, :boolean, default: true
+      store_public_metadata :allow_event_overview_for_operator, :boolean, default: true
+
       # Requires an active waiting-room session to create a draft order for this event's products
       # (Product#enforce_waiting_room_session?). Server-only switch, so private.
       store_private_metadata :enforce_waiting_room_session, :boolean, default: false

data/app/models/concerns/spree_cm_commissioner/homepage_section_relatable_concern.rb

@@ -12,14 +12,6 @@ module SpreeCmCommissioner
       has_many :homepage_sections,
                through: :homepage_section_relatables,
                class_name: 'SpreeCmCommissioner::HomepageSection'
-
-      after_save :schedule_homepage_section_caches_invalidation
-    end
-
-    def schedule_homepage_section_caches_invalidation
-      homepage_sections.each do |homepage_section|
-        SpreeCmCommissioner::MaintenanceTasks::CacheInvalidation.pending.create_or_find_by(maintainable: homepage_section)
-      end
     end
   end
 end

data/app/models/concerns/spree_cm_commissioner/order_attribution.rb

@@ -0,0 +1,16 @@
+module SpreeCmCommissioner
+  # Where an order came from, recorded once by DraftOrders::Create for analytics.
+  module OrderAttribution
+    extend ActiveSupport::Concern
+
+    included do
+      # The active session the order was created through. Continuing checkout on another device or
+      # from booking history never updates it, so a later admission by the same buyer shows up as a
+      # session with no order of its own.
+      belongs_to :waiting_room_session, class_name: 'SpreeCmCommissioner::WaitingRoomSession', optional: true
+
+      # The OAuth client app whose access token created the order. nil for a request without a token.
+      belongs_to :oauth_application, class_name: 'Spree::OauthApplication', optional: true
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/promotion/rules/oauth_application_scoped.rb

@@ -0,0 +1,44 @@
+module SpreeCmCommissioner
+  module Promotion
+    module Rules
+      # The OAuth applications a promotion rule is scoped to, shared by every rule that narrows by
+      # app. Kept in `cm_oauth_application_promotion_rules` rather than a preference so "which
+      # promotions use this app" is a join, and deleting an app cannot leave a dead id in a rule.
+      # How an empty list behaves is up to the rule.
+      module OauthApplicationScoped
+        extend ActiveSupport::Concern
+
+        included do
+          has_many :oauth_application_promotion_rules,
+                   class_name: 'SpreeCmCommissioner::OauthApplicationPromotionRule',
+                   foreign_key: :promotion_rule_id,
+                   inverse_of: :promotion_rule,
+                   autosave: true,
+                   dependent: :destroy
+
+          # For reading and reporting. Not written through: that would load and validate every
+          # Spree::OauthApplication (whose `api_key` is encrypted) just to link it, and the admin form
+          # posts ids anyway.
+          has_many :oauth_applications, through: :oauth_application_promotion_rules, class_name: 'Spree::OauthApplication'
+        end
+
+        # Reads the join rows, loaded once per rule instance: eligibility is re-checked several times in
+        # one cart update, and a plain `pluck` would query every time. Join rows rather than
+        # `oauth_applications`, which would load every app just to get its id.
+        def oauth_application_ids
+          oauth_application_promotion_rules.load.reject(&:marked_for_destruction?).map(&:oauth_application_id)
+        end
+
+        # What the admin form posts. Only the join rows change, saved with the rule. The blank value a
+        # multi-select always submits is dropped.
+        def oauth_application_ids=(ids)
+          wanted = Array(ids).compact_blank.map(&:to_i).uniq
+          existing = oauth_application_promotion_rules.load.to_a
+
+          existing.each { |row| row.mark_for_destruction unless wanted.include?(row.oauth_application_id) }
+          (wanted - existing.map(&:oauth_application_id)).each { |id| oauth_application_promotion_rules.build(oauth_application_id: id) }
+        end
+      end
+    end
+  end
+end