spree_cm_commissioner 2.14.2 → 2.14.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d7be2a8511db3eae8f7fc7bfac3b348effc7ff5c99a9d9ce5816bb1a0e09cdd
-  data.tar.gz: 98a4899d6a5ca428856e869a342da28a4447ae5f65c19ec7e27f4aaf996a6b97
+  metadata.gz: e5317bd75c6057165a07eae82d0e30f986371767925346783242d8d12a0a8d24
+  data.tar.gz: b015f2bebfc1105dee65f7b4b22f63ee909b113541741f9dbc5ed48482ab4b04
 SHA512:
-  metadata.gz: 99c278aa62a3ae56513ec4489b7945545cb937279df43b51478f95169bb7b22525ba9a4dd67fb42116b3aee61d06ec2973bee3a18b9978629857ae725e26cbe6
-  data.tar.gz: 74fba240707520ee96ea0a4f27ae585c7879c77d9e4515b037927ee9f3c1c9d7aec8d19824feaeb93e7f53b9f8afff8b06e39055ac830cb27a50402a6f41c080
+  metadata.gz: 7c59a388a335fcffdbb53ef8ebd470bf9b310a169ac8057ba6b464c6cef8e4ee6425cccfa5bfda366ea9c7fa89aaca854465c914521df040d460ba39994bd0b3
+  data.tar.gz: 0d8572c942886d56c1689ceb532e2d643f208d538dfb8fa40e21209198562dbe52fb7bb8a28f7573d0900407b8651421210eb4b99c6ea80aefa14b73677880c4

data/.env.example

@@ -47,14 +47,12 @@ ORGANIZER_URL=http://127.0.0.1:4000/organizer
 # spree_cm_commissioner/distance.rb
 DISTANCE_SIGNING_KEY=hei********************VY
 
-# Cache durations (in seconds) for different content types
+# CDN cache durations (s-maxage, in seconds) for listed public APIs; client max-age is always 0, unlisted APIs are never CDN-cached
 # See: app/controllers/concerns/spree_cm_commissioner/content_cachable.rb
 CACHE_AUTO_INVALIDATION_DISABLED="" # Set to yes to disable CDN cache invalidation entirely (kill switch)
-CACHE_STATIC_MAX_AGE=86400 # Static content (countries, provinces, seat layouts, CMS pages) - 1 day
-CACHE_SEMI_STATIC_MAX_AGE=3600 # Semi-static content (menus, homepage backgrounds, routes) - 1 hour
-CACHE_MODERATE_MAX_AGE=1800 # Moderate freshness (products, events, vendors) - 30 minutes
-CACHE_REALTIME_MAX_AGE=300 # High freshness (trips, trip search) - 5 minutes
-CACHE_DEFAULT_MAX_AGE=300 # Default for unlisted controllers - 5 minutes
+CACHE_SERIALIZER_DISABLED="" # Set to yes to turn off Spree's serializer record cache everywhere
+CACHE_STATIC_MAX_AGE=86400 # Static content (CMS pages) - 1 day
+CACHE_REALTIME_MAX_AGE=300 # Everything else listed (homepage, menus, products, events, vendors, trips, seat layouts, countries, provinces, guest card classes) - 5 minutes
 
 # Batch size for processing maintenance tasks in app/jobs/spree_cm_commissioner/maintenance_tasks/orchestrate_job.rb
 MAINTENANCE_TASKS_BATCH_SIZE=100

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.14.2)
+    spree_cm_commissioner (2.14.4)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -1,5 +1,5 @@
 # Check following file for spec:
-# spec/controllers/application_controller_spec.rb
+# spec/controllers/concerns/spree_cm_commissioner/content_cachable_spec.rb
 module SpreeCmCommissioner
   module ContentCachable
     extend ActiveSupport::Concern
@@ -8,88 +8,94 @@ module SpreeCmCommissioner
       after_action :set_cache_control_for_cdn
     end
 
-    # Cache duration priorities by content type
-    # Priority 1: Static/Rarely Changed (1 day)
-    STATIC_CONTENT_CONTROLLERS = %w[
-      CountriesController
-      ProvincesController
-      GuestCardClassesController
-      SeatLayoutsController
-      CmsPagesController
-      AdvertisementsController
-    ].freeze
+    # Every CDN-cached API, by full class name, with its GET actions and TTL tier. Anything not
+    # listed keeps Rails' default `max-age=0, private, must-revalidate` and never reaches the CDN.
+    #
+    # :static (CACHE_STATIC_MAX_AGE, 1 day) is for rarely changed content. :fresh
+    # (CACHE_REALTIME_MAX_AGE, 5 minutes) is for anything editors change, short enough that an edit
+    # shows up without a CloudFront invalidation.
+    #
+    # Full names, not demodulized ones: this concern runs on every ActionController::API, and short
+    # names collide with admin-only APIs (Platform, Operator, V1, webhooks) that must never be marked
+    # public. Never list an action whose response depends on the signed-in user, e.g.
+    # Tenant::VotePackagesController#claim_status: the CDN would serve one user's answer to everyone
+    # sharing the cache key.
+    CDN_CACHEABLE_ACTIONS = {
+      # JSON-LD
+      'Spree::Api::JsonLd::VendorsController' => { actions: %w[index show].freeze, max_age: :fresh },
 
-    # Priority 2: Semi-Static (1 hour)
-    SEMI_STATIC_CONTROLLERS = %w[
-      MenusController
-      HomepageBackgroundController
-      HomepageDataController
-      PopularRoutePlacesController
-      RoutePlacesController
-      ShowsController
-      EpisodesController
-      ShowPeopleController
-      ShowPersonAssignmentsController
-      ShowContestantsController
-      VotePackagesController
-      ShowEliminationSessionsController
-      PaymentMethodsController
-    ].freeze
+      # Storefront
+      'Spree::Api::V2::Storefront::AccommodationsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::CmsPagesController' => { actions: %w[index show].freeze, max_age: :static },
+      'Spree::Api::V2::Storefront::CountriesController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::DynamicFieldsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::EventMatchesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::EventsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::GuestCardClassesController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::HomepageBackgroundController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::HomepageDataController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::HomepageSectionsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::MenusController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::PaymentMethodsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::PopularRoutePlacesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::ProductsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::ProvincesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::RoutePlacesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::SeatLayoutsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::TaxonsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::TripSearchController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::TripsController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::VendorPhotosController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::VendorsController' => { actions: %w[index show].freeze, max_age: :fresh },
 
-    # Priority 3: Moderate Freshness (30 minutes)
-    MODERATE_FRESHNESS_CONTROLLERS = %w[
-      HomepageSectionsController
-      TaxonsController
-      ProductsController
-      EventsController
-      EventMatchesController
-      AccommodationsController
-      VendorsController
-      VendorPhotosController
-    ].freeze
+      # Tenant
+      'Spree::Api::V2::Tenant::CmsPagesController' => { actions: %w[index show].freeze, max_age: :static },
+      'Spree::Api::V2::Tenant::EpisodesController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::HomepageSectionsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::PaymentMethodsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::PopularRoutePlacesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ProductsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ShowContestantsController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ShowEliminationSessionsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ShowPeopleController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ShowPersonAssignmentsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ShowsController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::TaxonsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::TripSearchController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::TripsController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::VendorPhotosController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::VendorsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::VotePackagesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::VotingContestantsController' => { actions: %w[index].freeze, max_age: :fresh }
+    }.freeze
 
-    # Priority 4: High Freshness (5 minutes)
-    HIGH_FRESHNESS_CONTROLLERS = %w[
-      TripsController
-      TripSearchController
-      VotingContestantsController
-      DynamicFieldsController
-    ].freeze
-
-    # Override This Method based on your UseCase
-    # Or let it auto-detect based on controller name
-    def client_max_age
-      controller_name = self.class.name.demodulize
-
-      if STATIC_CONTENT_CONTROLLERS.include?(controller_name)
-        ENV.fetch('CACHE_STATIC_MAX_AGE', 1.day.to_i).to_i
-      elsif SEMI_STATIC_CONTROLLERS.include?(controller_name)
-        ENV.fetch('CACHE_SEMI_STATIC_MAX_AGE', 1.hour.to_i).to_i
-      elsif MODERATE_FRESHNESS_CONTROLLERS.include?(controller_name)
-        ENV.fetch('CACHE_MODERATE_MAX_AGE', 30.minutes.to_i).to_i
-      elsif HIGH_FRESHNESS_CONTROLLERS.include?(controller_name)
-        ENV.fetch('CACHE_REALTIME_MAX_AGE', 5.minutes.to_i).to_i
-      else
-        ENV.fetch('CACHE_DEFAULT_MAX_AGE', 0.minutes.to_i).to_i
+    # CDN (s-maxage) TTL, or nil for an unlisted controller. Override in a controller for a different one.
+    def shared_max_age
+      case cdn_cache_config&.dig(:max_age)
+      when :static then ENV.fetch('CACHE_STATIC_MAX_AGE', 1.day.to_i).to_i
+      when :fresh then ENV.fetch('CACHE_REALTIME_MAX_AGE', 5.minutes.to_i).to_i
       end
     end
 
-    # Defaults to the client TTL so a tier's max-age bounds CDN staleness too: most endpoints
-    # (e.g. trips, trip search) have no invalidation on change, and an unlisted controller
-    # (max-age 0) must not be CDN-cached at all.
-    def shared_max_age
-      client_max_age
+    def cdn_cacheable?
+      request.get? && cdn_cache_config.present? && cdn_cache_config[:actions].include?(action_name)
     end
 
     def set_cache_control_for_cdn
       return if response.committed?
       return if response.status != 200
+      return unless cdn_cacheable?
+
+      # max-age=0 makes the app revalidate with CloudFront on every request, since a CloudFront
+      # invalidation can never reach the copy already on a device. Rack::ETag tags each response,
+      # so a revalidation is a small 304. s-maxage alone decides how stale a response can get.
+      response.headers['Cache-Control'] = "public, max-age=0, s-maxage=#{shared_max_age}"
+    end
 
-      # max-age: browser/client cache, s-maxage: CDN cache
-      response.headers['Cache-Control'] = "public, max-age=#{client_max_age}, s-maxage=#{shared_max_age}"
+    private
 
-      # Expires: Absolute timestamp when cache becomes stale (HTTP/1.0 fallback)
-      response.headers['Expires'] = (Time.zone.now + client_max_age).httpdate
+    def cdn_cache_config
+      CDN_CACHEABLE_ACTIONS[self.class.name.to_s]
     end
   end
 end

data/app/controllers/spree/admin/api_caches_controller.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Admin
+    # Behind every admin clear-cache button (spree/admin/shared/_api_cache_button). Admin-only through
+    # BaseController#authorize_admin, which checks :api_caches since there is no model class.
+    class ApiCachesController < Spree::Admin::BaseController
+      # POST /admin/api_caches/clear?model=Spree::Product&id=1, or without id to clear every record of
+      # model on one storefront: tenant_id for that tenant's API, none for the BookMe+ storefront.
+      def clear
+        result = if params[:id].present?
+                   SpreeCmCommissioner::ApiCaches::Invalidate.call(model: params[:model], id: params[:id])
+                 else
+                   tenant = SpreeCmCommissioner::Tenant.find(params[:tenant_id]) if params[:tenant_id].present?
+                   SpreeCmCommissioner::ApiCaches::InvalidateAll.call(model: params[:model], tenant: tenant)
+                 end
+
+        if result.success?
+          flash[:success] = Spree.t(:clear_cache_requested)
+        else
+          flash[:error] = result.error.to_s
+        end
+
+        redirect_back fallback_location: admin_root_path
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/base_controller_decorator.rb

@@ -31,20 +31,6 @@ module Spree
         nil
       end
 
-      # POST
-      def invalidate_api_caches
-        if params[:model].present?
-          result = SpreeCmCommissioner::ApiCaches::Invalidate.call(
-            model: params[:model],
-            id: params[:id]
-          )
-
-          flash[:error] = result.error if result.failure?
-        end
-
-        redirect_back fallback_location: admin_root_path
-      end
-
       private
 
       # See SpreeCmCommissioner::Current#actor -- lets StoreCreditEventDecorator's after_create

data/app/controllers/spree/admin/guests_controller.rb

@@ -6,6 +6,7 @@ module Spree
 
       before_action :load_order
       before_action :load_guest, only: %i[check_in uncheck_in]
+      before_action :load_edit_data, only: :edit
 
       def model_class
         SpreeCmCommissioner::Guest
@@ -41,10 +42,17 @@ module Spree
         @kyc_fields = @line_item.kyc_fields
       end
 
-      def edit
-        @kyc_fields = @object.line_item.kyc_fields
-        @check_ins = @object.check_ins.includes(:check_in_session, :check_in_by)
-        @eligible_check_in_sessions = @object.eligible_check_in_sessions.order(:position)
+      def update
+        result = SpreeCmCommissioner::Guests::Update.call(guest: @object, guest_params: update_params)
+
+        if result.success?
+          flash[:success] = flash_message_for(@object, :successfully_updated)
+          redirect_to location_after_save
+        else
+          flash.now[:error] = result.error.to_s
+          load_edit_data
+          render :edit, status: :unprocessable_entity
+        end
       end
 
       def check_in
@@ -88,6 +96,37 @@ module Spree
         )
       end
 
+      # Saved through Guests::Update's single transaction so a failing custom field does not leave
+      # KYC or seat_number half-saved.
+      def update_params
+        attrs = permitted_resource_params.to_h.symbolize_keys
+        dynamic_fields = submitted_dynamic_fields
+        return attrs if dynamic_fields.blank?
+
+        attrs.merge(
+          guest_dynamic_fields_attributes: SpreeCmCommissioner::Guests::BuildDynamicFieldAttributes.call(
+            guest: @object, dynamic_fields: dynamic_fields
+          )
+        )
+      end
+
+      # The form lists every field of every stage, so blank scalar answers mean "not filled in" and
+      # are skipped rather than failing the presence validation (clearing an answer is not supported).
+      def submitted_dynamic_fields
+        raw = params.require(object_name).permit(dynamic_fields: {})[:dynamic_fields]
+
+        raw.to_h.reject { |_id, value| value.is_a?(String) && value.strip.empty? }
+      end
+
+      def load_edit_data
+        @kyc_fields = @object.line_item.kyc_fields
+        @check_ins = @object.check_ins.includes(:check_in_session, :check_in_by)
+        @eligible_check_in_sessions = @object.eligible_check_in_sessions.order(:position)
+        @dynamic_fields = @object.line_item.product.dynamic_fields.includes(:dynamic_field_options)
+                                 .reorder(:data_fill_stage, :position)
+        @guest_dynamic_fields = @object.guest_dynamic_fields.to_a
+      end
+
       def load_guest
         @guest = @order.guests.find(params[:id])
       end

data/app/factory/spree_cm_commissioner/order_telegram_message_factory.rb

@@ -3,17 +3,18 @@
 # Order Number:
 # <code>R621016753</code>
 #
-# [ x1 ]
+# 🎪 Event: Temple Run 2023
+# 🏪 Vendor: Temple Run with Sai
+#
 # <b>5km Running Ticket</b>
+# Quantity: 1
 # <i>👉 Distance: 5km, T-shirt: M</i>
 # <i>🗓️ Nov 15, 2023</i>
-# <i>🏪 Temple Run with Sai</i>
 #
-# [ x2 ]
 # <b>5km Running Ticket</b>
+# Quantity: 2
 # <i>👉 Distance: 5km, T-shirt: S</i>
 # <i>🗓️ Nov 15, 2023 -> Nov 17, 2023</i>
-# <i>🏪 Temple Run with Sai</i>
 #
 # <b>🙍 Customer Info</b>
 # Name: Vaneath Awesome
@@ -43,10 +44,31 @@ module SpreeCmCommissioner
     def body
       text = []
       text << "Order Number:\n#{inline_code(order.number)}\n"
+      summary = summary_content
+      text << "#{summary}\n" if summary.present?
       text << selected_line_items.map { |item| line_item_content(item) }.compact.join("\n\n")
       text.compact.join("\n")
     end
 
+    # Stated once for the whole order rather than per ticket: an order is almost always one
+    # event and one vendor, so a per-ticket line would just repeat the same name.
+    def summary_content
+      line_items = selected_line_items.to_a
+      ActiveRecord::Associations::Preloader.new(records: line_items, associations: %i[event vendor]).call
+
+      [
+        names_line('🎪 Event', line_items.map(&:event)),
+        names_line('🏪 Vendor', line_items.map(&:vendor))
+      ].compact.join("\n").presence
+    end
+
+    def names_line(label, records)
+      names = records.compact.map(&:name).compact_blank.uniq
+      return nil if names.empty?
+
+      "#{label}: #{names.map { |name| ERB::Util.html_escape(name) }.join(', ')}"
+    end
+
     def line_item_content(line_item)
       return transit_line_item_content(line_item) if line_item.transit?
 
@@ -56,7 +78,6 @@ module SpreeCmCommissioner
       text << "Quantity: #{line_item.quantity}"
       text << italic("👉 #{line_item.options_text}") if line_item.options_text.present?
       text << italic(pretty_date_for(line_item)) if pretty_date_for(line_item).present?
-      text << italic("🏪 #{line_item.vendor.name}") if line_item.vendor&.name.present? && vendor.blank?
       text << seat_labels_text(line_item) if seat_labels_text(line_item).present?
 
       text.compact.join("\n")

data/app/jobs/spree_cm_commissioner/audit_events/cleanup_expired_job.rb

@@ -0,0 +1,18 @@
+module SpreeCmCommissioner
+  module AuditEvents
+    class CleanupExpiredJob < SpreeCmCommissioner::ApplicationJob
+      # Gap before continuing a backlog, so the Sidekiq thread is free for other jobs in between.
+      CONTINUE_DELAY = 10.seconds
+
+      queue_as :maintenance
+
+      # Not an ApplicationUniqueJob: `unique :until_executed` would drop the continuation below as a duplicate of the
+      # running job. Overlapping with the daily cron is harmless because deleting is idempotent.
+      def perform
+        result = SpreeCmCommissioner::AuditEvents::CleanupExpired.new.call
+
+        self.class.set(wait: CONTINUE_DELAY).perform_later if result.value[:more_remaining]
+      end
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/vendor_preference.rb

@@ -2,7 +2,7 @@ module SpreeCmCommissioner
   module VendorPreference
     extend ActiveSupport::Concern
 
-    TELEGRAM_CHAT_TYPE = %i[channel group].freeze
+    TELEGRAM_CHAT_TYPE = %i[channel group supergroup].freeze
 
     included do
       preference :telegram_chat_id, :string

data/app/models/spree_cm_commissioner/audit_event.rb

@@ -1,5 +1,8 @@
 module SpreeCmCommissioner
   class AuditEvent < Base
+    # How long AuditLogger keeps an event when the caller gives no retention_days.
+    DEFAULT_RETENTION_DAYS = 90
+
     belongs_to :auditable, polymorphic: true, optional: true
     belongs_to :user, class_name: 'Spree::User', optional: true
 
@@ -7,5 +10,7 @@ module SpreeCmCommissioner
 
     scope :success, -> { where(success: true) }
     scope :failed,  -> { where(success: false) }
+
+    scope :expired, -> (now = Time.current) { where(retention_until: ...now.to_date) }
   end
 end

data/app/overrides/spree/admin/menus/index/clear_cache_button.html.erb.deface

@@ -0,0 +1,4 @@
+<!-- insert_after "erb[silent]:contains('content_for :page_actions')" -->
+
+<%# Menus are only served through homepage_data, whatever the menu, so one clear covers them all. %>
+<%= render 'spree/admin/shared/api_cache_button', model: Spree::Menu.name %>

data/app/overrides/spree/admin/payment_methods/index/clear_cache_button.html.erb.deface

@@ -0,0 +1,6 @@
+<!-- insert_after "erb[silent]:contains('content_for :page_actions')" -->
+
+<%# A payment method's paths don't depend on the record (vendor_id is a query param), so one clear
+    on the list covers them all. This admin lists BookMe+'s storefront; a tenant clears its own
+    from the dashboard. %>
+<%= render 'spree/admin/shared/api_cache_button', model: Spree::PaymentMethod.name %>

data/app/overrides/spree/admin/products/edit/clear_cache_button.html.erb.deface

@@ -1,3 +1,3 @@
 <!-- insert_after "erb[silent]:contains('content_for :page_actions')" -->
 
-<%= button_link_to Spree.t(:clear_cache), admin_invalidate_api_caches_path(model: Spree::Product.name, id: @product.id), method: :post, class: "btn btn-outline-primary" %>
+<%= render 'spree/admin/shared/api_cache_button', model: Spree::Product.name, id: @product.id %>

data/app/overrides/spree/admin/taxons/edit/clear_cache_button.html.erb.deface

@@ -1,8 +1,5 @@
 <!-- insert_after "erb[silent]:contains('content_for :page_actions')" -->
 
 <% if @taxon.depth == 1 %>
-      <%= button_link_to Spree.t(:clear_cache),
-          admin_invalidate_api_caches_path(model: Spree::Taxon.name, id: @taxon.id),
-          method: :post, 
-          class: "btn btn-outline-primary" %>
+  <%= render 'spree/admin/shared/api_cache_button', model: Spree::Taxon.name, id: @taxon.id %>
 <% end %>

data/app/overrides/spree/admin/vendors/edit/clear_cache_button.html.erb.deface

@@ -0,0 +1,5 @@
+<!-- insert_before "erb[loud]:contains('form_for [:admin, @vendor]')" -->
+
+<% content_for :page_actions do %>
+  <%= render 'spree/admin/shared/api_cache_button', model: Spree::Vendor.name, id: @vendor.id %>
+<% end %>

data/app/serializers/spree/api/v2/base_serializer_decorator.rb

@@ -0,0 +1,24 @@
+module Spree
+  module Api
+    module V2
+      # Spree caches every serializer's records keyed by each record's updated_at, so anything
+      # computed from other tables stays stale, and behind CloudFront an invalidation can't purge
+      # it. CACHE_SERIALIZER_DISABLED=yes turns it off everywhere.
+      module BaseSerializerDecorator
+        def self.prepended(base)
+          base.singleton_class.prepend(ClassMethods)
+        end
+
+        module ClassMethods
+          # jsonapi-serializer copies Spree's store into each subclass as it is defined, so this
+          # reader, which every subclass resolves through, is the one place to turn it off.
+          def cache_store_instance
+            ENV['CACHE_SERIALIZER_DISABLED'] == 'yes' ? nil : super
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::BaseSerializer.prepend(Spree::Api::V2::BaseSerializerDecorator)