spree_cm_commissioner 2.14.3 → 2.14.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c169ca8f3c24e2294f37a17142112c820953fbd3b109c7e53c3a39ccf19e88e4
-  data.tar.gz: ec8aee4c537d0f1f47b705eb4e248a0b148b124979e743adfd02d1b510b4a9f9
+  metadata.gz: f7720d10f3459b8933df3d2521bdce4983e03adf800dc852cb4e6f28d689f146
+  data.tar.gz: 746c1c6e7cc864f5555020ab15d21eeac2c601d6f7d6b0bcfa1bff0b9633bb77
 SHA512:
-  metadata.gz: 4cb10cc3987eff0d89409c4275cafa26263a9ed349deacb81c816c3fca496927973a640eb1fe875a4e724eebdc43ecc3cec6f5e8626b7f9653e422704bad6553
-  data.tar.gz: 1f68fa692abff8ab900ac03cc864b5509270c863b62606b8f2ddca4b98c7f05358b61c82663af1f580ab7a5510f690fc3827d2f07c1cc60c574e6146add476be
+  metadata.gz: 504fa1a8ea3a50979c1c23e366713e6e6b10bfe38efb4e3a4019b3f5f8cefa35ec460fd8a8b013cd1324c4ead1359fdbc0b00a7c0b56e71bd606c294cf180c6c
+  data.tar.gz: 5d1d182cbd5f0538d5d281c1c401b7724fe1bc27e0f3c5009345493a8335aa6bae62ed9dea22af2fc52b07ac8bfc1e617953851cbcaf7c5823773536ef4651ae

data/.env.example

@@ -47,14 +47,18 @@ ORGANIZER_URL=http://127.0.0.1:4000/organizer
 # spree_cm_commissioner/distance.rb
 DISTANCE_SIGNING_KEY=hei********************VY
 
-# Cache durations (in seconds) for different content types
+# CDN cache durations (s-maxage, in seconds) for listed public APIs; client max-age is always 0, unlisted APIs are never CDN-cached
 # See: app/controllers/concerns/spree_cm_commissioner/content_cachable.rb
 CACHE_AUTO_INVALIDATION_DISABLED="" # Set to yes to disable CDN cache invalidation entirely (kill switch)
-CACHE_STATIC_MAX_AGE=86400 # Static content (countries, provinces, seat layouts, CMS pages) - 1 day
-CACHE_SEMI_STATIC_MAX_AGE=3600 # Semi-static content (menus, homepage backgrounds, routes) - 1 hour
-CACHE_MODERATE_MAX_AGE=1800 # Moderate freshness (products, events, vendors) - 30 minutes
-CACHE_REALTIME_MAX_AGE=300 # High freshness (trips, trip search) - 5 minutes
-CACHE_DEFAULT_MAX_AGE=300 # Default for unlisted controllers - 5 minutes
+CACHE_SERIALIZER_DISABLED="" # Set to yes to turn off Spree's serializer record cache everywhere
+CACHE_STATIC_MAX_AGE=86400 # Static content (CMS pages) - 1 day
+CACHE_REALTIME_MAX_AGE=300 # Everything else listed (homepage, menus, products, events, vendors, trips, seat layouts, countries, provinces, guest card classes) - 5 minutes
+
+# Shared secret(s) CloudFront sends to the origin as the X-Origin-Verify custom header. When set, listed CDN-cacheable
+# APIs return 403 to requests without a matching header. Comma-separate two values while rotating. Leave blank to turn off.
+# Set only after every client reaches these APIs through CloudFront, or they get 403.
+CDN_ORIGIN_SECRETS=""
+CDN_ORIGIN_REPORT_ONLY="" # Set to yes to log unverified requests instead of refusing them (use before enforcing)
 
 # Batch size for processing maintenance tasks in app/jobs/spree_cm_commissioner/maintenance_tasks/orchestrate_job.rb
 MAINTENANCE_TASKS_BATCH_SIZE=100

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.14.3)
+    spree_cm_commissioner (2.14.5)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -1,95 +1,134 @@
 # Check following file for spec:
-# spec/controllers/application_controller_spec.rb
+# spec/controllers/concerns/spree_cm_commissioner/content_cachable_spec.rb
 module SpreeCmCommissioner
   module ContentCachable
     extend ActiveSupport::Concern
 
     included do
+      # Prepended so a request that skipped the CDN is refused before any other callback hits the DB.
+      prepend_before_action :verify_cdn_origin!, if: :cdn_cacheable?
       after_action :set_cache_control_for_cdn
     end
 
-    # Cache duration priorities by content type
-    # Priority 1: Static/Rarely Changed (1 day)
-    STATIC_CONTENT_CONTROLLERS = %w[
-      CountriesController
-      ProvincesController
-      GuestCardClassesController
-      SeatLayoutsController
-      CmsPagesController
-      AdvertisementsController
-    ].freeze
+    # CloudFront sends this as an origin custom header; clients never see or send it.
+    CDN_ORIGIN_HEADER = 'X-Origin-Verify'.freeze
 
-    # Priority 2: Semi-Static (1 hour)
-    SEMI_STATIC_CONTROLLERS = %w[
-      MenusController
-      HomepageBackgroundController
-      HomepageDataController
-      PopularRoutePlacesController
-      RoutePlacesController
-      ShowsController
-      EpisodesController
-      ShowPeopleController
-      ShowPersonAssignmentsController
-      ShowContestantsController
-      VotePackagesController
-      ShowEliminationSessionsController
-      PaymentMethodsController
-    ].freeze
+    # Every CDN-cached API, by full class name, with its GET actions and TTL tier. Anything not
+    # listed keeps Rails' default `max-age=0, private, must-revalidate` and never reaches the CDN.
+    #
+    # :static (CACHE_STATIC_MAX_AGE, 1 day) is for rarely changed content. :fresh
+    # (CACHE_REALTIME_MAX_AGE, 5 minutes) is for anything editors change, short enough that an edit
+    # shows up without a CloudFront invalidation.
+    #
+    # Full names, not demodulized ones: this concern runs on every ActionController::API, and short
+    # names collide with admin-only APIs (Platform, Operator, V1, webhooks) that must never be marked
+    # public. Never list an action whose response depends on the signed-in user, e.g.
+    # Tenant::VotePackagesController#claim_status: the CDN would serve one user's answer to everyone
+    # sharing the cache key.
+    CDN_CACHEABLE_ACTIONS = {
+      # JSON-LD
+      'Spree::Api::JsonLd::VendorsController' => { actions: %w[index show].freeze, max_age: :fresh },
 
-    # Priority 3: Moderate Freshness (30 minutes)
-    MODERATE_FRESHNESS_CONTROLLERS = %w[
-      HomepageSectionsController
-      TaxonsController
-      ProductsController
-      EventsController
-      EventMatchesController
-      AccommodationsController
-      VendorsController
-      VendorPhotosController
-    ].freeze
+      # Storefront
+      'Spree::Api::V2::Storefront::AccommodationsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::CmsPagesController' => { actions: %w[index show].freeze, max_age: :static },
+      'Spree::Api::V2::Storefront::CountriesController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::DynamicFieldsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::EventMatchesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::EventsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::GuestCardClassesController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::HomepageBackgroundController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::HomepageDataController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::HomepageSectionsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::MenusController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::PaymentMethodsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::PopularRoutePlacesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::ProductsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::ProvincesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::RoutePlacesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::SeatLayoutsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::TaxonsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::TripSearchController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::TripsController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::VendorPhotosController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Storefront::VendorsController' => { actions: %w[index show].freeze, max_age: :fresh },
 
-    # Priority 4: High Freshness (5 minutes)
-    HIGH_FRESHNESS_CONTROLLERS = %w[
-      TripsController
-      TripSearchController
-      VotingContestantsController
-      DynamicFieldsController
-    ].freeze
+      # Tenant
+      'Spree::Api::V2::Tenant::CmsPagesController' => { actions: %w[index show].freeze, max_age: :static },
+      'Spree::Api::V2::Tenant::EpisodesController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::HomepageSectionsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::PaymentMethodsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::PopularRoutePlacesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ProductsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ShowContestantsController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ShowEliminationSessionsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ShowPeopleController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ShowPersonAssignmentsController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::ShowsController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::TaxonsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::TripSearchController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::TripsController' => { actions: %w[show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::VendorPhotosController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::VendorsController' => { actions: %w[index show].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::VotePackagesController' => { actions: %w[index].freeze, max_age: :fresh },
+      'Spree::Api::V2::Tenant::VotingContestantsController' => { actions: %w[index].freeze, max_age: :fresh }
+    }.freeze
 
-    # Override This Method based on your UseCase
-    # Or let it auto-detect based on controller name
-    def client_max_age
-      controller_name = self.class.name.demodulize
-
-      if STATIC_CONTENT_CONTROLLERS.include?(controller_name)
-        ENV.fetch('CACHE_STATIC_MAX_AGE', 1.day.to_i).to_i
-      elsif SEMI_STATIC_CONTROLLERS.include?(controller_name)
-        ENV.fetch('CACHE_SEMI_STATIC_MAX_AGE', 1.hour.to_i).to_i
-      elsif MODERATE_FRESHNESS_CONTROLLERS.include?(controller_name)
-        ENV.fetch('CACHE_MODERATE_MAX_AGE', 30.minutes.to_i).to_i
-      elsif HIGH_FRESHNESS_CONTROLLERS.include?(controller_name)
-        ENV.fetch('CACHE_REALTIME_MAX_AGE', 5.minutes.to_i).to_i
-      else
-        ENV.fetch('CACHE_DEFAULT_MAX_AGE', 0.minutes.to_i).to_i
+    # CDN (s-maxage) TTL, or nil for an unlisted controller. Override in a controller for a different one.
+    def shared_max_age
+      case cdn_cache_config&.dig(:max_age)
+      when :static then ENV.fetch('CACHE_STATIC_MAX_AGE', 1.day.to_i).to_i
+      when :fresh then ENV.fetch('CACHE_REALTIME_MAX_AGE', 5.minutes.to_i).to_i
       end
     end
 
-    # Defaults to the client TTL so a tier's max-age bounds CDN staleness too: most endpoints
-    # (e.g. trips, trip search) have no invalidation on change, and an unlisted controller
-    # (max-age 0) must not be CDN-cached at all.
-    def shared_max_age
-      client_max_age
+    def cdn_cacheable?
+      request.get? && cdn_cache_config.present? && cdn_cache_config[:actions].include?(action_name)
     end
 
     def set_cache_control_for_cdn
       return if response.committed?
       return if response.status != 200
+      return unless cdn_cacheable?
+
+      # max-age=0 makes the app revalidate with CloudFront on every request, since a CloudFront
+      # invalidation can never reach the copy already on a device. Rack::ETag tags each response,
+      # so a revalidation is a small 304. s-maxage alone decides how stale a response can get.
+      response.headers['Cache-Control'] = "public, max-age=0, s-maxage=#{shared_max_age}"
+    end
+
+    # Refuses a listed action when it did not come through CloudFront, so the CDN can't be skipped by
+    # calling the origin directly. Off while CDN_ORIGIN_SECRETS is unset. It takes a comma-separated
+    # list so a new secret can be added to CloudFront before the old one is dropped. With
+    # CDN_ORIGIN_REPORT_ONLY=yes it only logs, to find clients still calling the origin before enforcing.
+    def verify_cdn_origin!
+      secrets = ENV.fetch('CDN_ORIGIN_SECRETS', '').split(',').map(&:strip).compact_blank
+      return if secrets.empty?
+
+      provided = request.headers[CDN_ORIGIN_HEADER].to_s
+      return if secrets.any? { |secret| ActiveSupport::SecurityUtils.secure_compare(provided, secret) }
+
+      if ENV['CDN_ORIGIN_REPORT_ONLY'] == 'yes'
+        CmAppLogger.log(
+          label: 'cdn_origin_unverified',
+          data: {
+            controller: self.class.name,
+            action: action_name,
+            path: request.path,
+            header_present: provided.present?,
+            via_cloudfront: request.headers['X-Amz-Cf-Id'].present?
+          }
+        )
+        return
+      end
+
+      head :forbidden
+    end
 
-      # max-age: browser/client cache, s-maxage: CDN cache
-      response.headers['Cache-Control'] = "public, max-age=#{client_max_age}, s-maxage=#{shared_max_age}"
+    private
 
-      # Expires: Absolute timestamp when cache becomes stale (HTTP/1.0 fallback)
-      response.headers['Expires'] = (Time.zone.now + client_max_age).httpdate
+    def cdn_cache_config
+      CDN_CACHEABLE_ACTIONS[self.class.name.to_s]
     end
   end
 end

data/app/controllers/concerns/spree_cm_commissioner/waiting_room_authorization.rb

@@ -7,11 +7,30 @@ module SpreeCmCommissioner
     end
 
     def ensure_waiting_room_session_token
-      return if ENV['WAITING_ROOM_DISABLED'] == 'yes'
-      return if request_from_client?
+      return if waiting_room_disabled?
       return unless required_waiting_room_session?
+      return if active_waiting_room_session?
 
-      return if SpreeCmCommissioner::WaitingRoomSession.active.exists?(token: params[:waiting_room_session_token])
+      handle_waiting_room_session_token_error
+    end
+
+    # Product-based counterpart to the path-based check above, for draft-order endpoints: gating by
+    # path would hold every booking (hotel, transit, ...) behind the waiting room, while this only
+    # holds orders for products that opt in via Product#enforce_waiting_room_session?. Call it as a
+    # before_action on #create, next to ensure_anonymous_booking_allowed!.
+    #
+    # Products covered by the request's private sale link (`st`) are exempt: that buyer draws from a
+    # pool locked for them, not the public stock the queue is rationing. The exemption is per
+    # request, not per product — the same product is usually on public sale too.
+    #
+    # products: [Array<Spree::Product>] every distinct product referenced by this request.
+    def ensure_waiting_room_session!(products)
+      return if waiting_room_disabled?
+
+      private_sale_product_ids = waiting_room_private_sale&.product_ids || []
+      enforced = products.select(&:enforce_waiting_room_session?).reject { |product| private_sale_product_ids.include?(product.id) }
+      return if enforced.empty?
+      return if active_waiting_room_session?
 
       handle_waiting_room_session_token_error
     end
@@ -23,13 +42,27 @@ module SpreeCmCommissioner
       apis.any? { |prefix| request.path.start_with?(prefix) }
     end
 
-    # temporary disable session check from any client server requests.
-    def request_from_client?
-      request.headers['X-Cm-Api-Client-Version'].present?
-    end
-
     def handle_waiting_room_session_token_error
       render_error_payload(Spree.t(:invalid_session_token), 400)
     end
+
+    private
+
+    def waiting_room_disabled?
+      ENV['WAITING_ROOM_DISABLED'] == 'yes'
+    end
+
+    def active_waiting_room_session?
+      SpreeCmCommissioner::WaitingRoomSession.active.exists?(token: params[:waiting_room_session_token])
+    end
+
+    # Verified, not just present: a made-up `st` must not skip the queue, so a token that fails
+    # Authorize simply earns no exemption.
+    def waiting_room_private_sale
+      return if params[:st].blank?
+
+      result = SpreeCmCommissioner::PrivateSales::Authorize.call(token: params[:st], user: spree_current_user)
+      result.value if result.success?
+    end
   end
 end

data/app/controllers/spree/admin/api_caches_controller.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Admin
+    # Behind every admin clear-cache button (spree/admin/shared/_api_cache_button). Admin-only through
+    # BaseController#authorize_admin, which checks :api_caches since there is no model class.
+    class ApiCachesController < Spree::Admin::BaseController
+      # POST /admin/api_caches/clear?model=Spree::Product&id=1, or without id to clear every record of
+      # model on one storefront: tenant_id for that tenant's API, none for the BookMe+ storefront.
+      def clear
+        result = if params[:id].present?
+                   SpreeCmCommissioner::ApiCaches::Invalidate.call(model: params[:model], id: params[:id])
+                 else
+                   tenant = SpreeCmCommissioner::Tenant.find(params[:tenant_id]) if params[:tenant_id].present?
+                   SpreeCmCommissioner::ApiCaches::InvalidateAll.call(model: params[:model], tenant: tenant)
+                 end
+
+        if result.success?
+          flash[:success] = Spree.t(:clear_cache_requested)
+        else
+          flash[:error] = result.error.to_s
+        end
+
+        redirect_back fallback_location: admin_root_path
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/base_controller_decorator.rb

@@ -31,20 +31,6 @@ module Spree
         nil
       end
 
-      # POST
-      def invalidate_api_caches
-        if params[:model].present?
-          result = SpreeCmCommissioner::ApiCaches::Invalidate.call(
-            model: params[:model],
-            id: params[:id]
-          )
-
-          flash[:error] = result.error if result.failure?
-        end
-
-        redirect_back fallback_location: admin_root_path
-      end
-
       private
 
       # See SpreeCmCommissioner::Current#actor -- lets StoreCreditEventDecorator's after_create

data/app/controllers/spree/admin/guests_controller.rb

@@ -6,6 +6,7 @@ module Spree
 
       before_action :load_order
       before_action :load_guest, only: %i[check_in uncheck_in]
+      before_action :load_edit_data, only: :edit
 
       def model_class
         SpreeCmCommissioner::Guest
@@ -41,10 +42,17 @@ module Spree
         @kyc_fields = @line_item.kyc_fields
       end
 
-      def edit
-        @kyc_fields = @object.line_item.kyc_fields
-        @check_ins = @object.check_ins.includes(:check_in_session, :check_in_by)
-        @eligible_check_in_sessions = @object.eligible_check_in_sessions.order(:position)
+      def update
+        result = SpreeCmCommissioner::Guests::Update.call(guest: @object, guest_params: update_params)
+
+        if result.success?
+          flash[:success] = flash_message_for(@object, :successfully_updated)
+          redirect_to location_after_save
+        else
+          flash.now[:error] = result.error.to_s
+          load_edit_data
+          render :edit, status: :unprocessable_entity
+        end
       end
 
       def check_in
@@ -88,6 +96,37 @@ module Spree
         )
       end
 
+      # Saved through Guests::Update's single transaction so a failing custom field does not leave
+      # KYC or seat_number half-saved.
+      def update_params
+        attrs = permitted_resource_params.to_h.symbolize_keys
+        dynamic_fields = submitted_dynamic_fields
+        return attrs if dynamic_fields.blank?
+
+        attrs.merge(
+          guest_dynamic_fields_attributes: SpreeCmCommissioner::Guests::BuildDynamicFieldAttributes.call(
+            guest: @object, dynamic_fields: dynamic_fields
+          )
+        )
+      end
+
+      # The form lists every field of every stage, so blank scalar answers mean "not filled in" and
+      # are skipped rather than failing the presence validation (clearing an answer is not supported).
+      def submitted_dynamic_fields
+        raw = params.require(object_name).permit(dynamic_fields: {})[:dynamic_fields]
+
+        raw.to_h.reject { |_id, value| value.is_a?(String) && value.strip.empty? }
+      end
+
+      def load_edit_data
+        @kyc_fields = @object.line_item.kyc_fields
+        @check_ins = @object.check_ins.includes(:check_in_session, :check_in_by)
+        @eligible_check_in_sessions = @object.eligible_check_in_sessions.order(:position)
+        @dynamic_fields = @object.line_item.product.dynamic_fields.includes(:dynamic_field_options)
+                                 .reorder(:data_fill_stage, :position)
+        @guest_dynamic_fields = @object.guest_dynamic_fields.to_a
+      end
+
       def load_guest
         @guest = @order.guests.find(params[:id])
       end

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -4,6 +4,8 @@ module Spree
       helper SpreeCmCommissioner::Admin::HomepageSegmentHelper
 
       before_action :load_tenants, only: [:index]
+      before_action :reject_invalid_section_type, only: %i[create update]
+      before_action :build_assets, only: %i[create update]
 
       helper_method :selected_tenant
 
@@ -39,8 +41,62 @@ module Spree
         end
       end
 
+      def remove_app_background
+        remove_asset(@object.app_background)
+      end
+
+      def remove_web_background
+        remove_asset(@object.web_background)
+      end
+
       private
 
+      # Always redirects back to `edit` rather than re-rendering it on failure (unlike the
+      # sibling GuestCardClassesController#remove_asset) — this controller's `edit` action sets
+      # extra ivars (`@homepage_section_relatables`) that this action never loads, so rendering
+      # the template directly here would raise.
+      def remove_asset(asset)
+        if asset&.destroy
+          flash[:success] = Spree.t('notice_messages.icon_removed')
+        else
+          flash[:error] = Spree.t('errors.messages.cannot_remove_icon')
+        end
+
+        redirect_to edit_admin_homepage_feed_homepage_section_url(@object)
+      end
+
+      # Only `trending` sections use these assets; building them for another type would let a
+      # direct API call attach a background the form never shows and the model then has to
+      # discard on save (see HomepageSection#clear_non_trending_fields). Either way the raw
+      # upload must be pulled out of permitted_resource_params — left in place, it gets assigned
+      # straight to the has_one association by update_resource/create_resource, which raises
+      # ActiveRecord::AssociationTypeMismatch instead of being silently ignored.
+      def build_assets
+        unless trending_section?
+          permitted_resource_params.delete(:app_background)
+          permitted_resource_params.delete(:web_background)
+          return
+        end
+
+        @object.build_app_background(attachment: permitted_resource_params.delete(:app_background)) if permitted_resource_params[:app_background]
+        @object.build_web_background(attachment: permitted_resource_params.delete(:web_background)) if permitted_resource_params[:web_background]
+      end
+
+      def trending_section?
+        (permitted_resource_params[:section_type].presence || @object.section_type).to_s == 'trending'
+      end
+
+      # `enum section_type:` raises ArgumentError on assignment of an unrecognized value, which
+      # would otherwise 500 instead of a normal validation failure — strip it here and flash
+      # instead, before it ever reaches create_resource/update_resource's mass-assignment.
+      def reject_invalid_section_type
+        submitted = permitted_resource_params[:section_type]
+        return if submitted.blank? || SpreeCmCommissioner::HomepageSection.section_types.key?(submitted.to_s)
+
+        permitted_resource_params.delete(:section_type)
+        flash[:error] = Spree.t('errors.messages.invalid_section_type')
+      end
+
       def collection
         return @collection if defined?(@collection)
 
@@ -57,16 +113,18 @@ module Spree
         @collection = scoped.page(params[:page]).per(params[:per_page])
       end
 
-      # overrided
+      # overrided — memoized so `.delete()` in build_assets mutates the same hash instance
       def permitted_resource_params
+        return @permitted_resource_params if defined?(@permitted_resource_params)
+
         object_params = params[:spree_cm_commissioner_homepage_section]
         segment_value = helpers.calculate_segment_value(object_params)
         mini_app_value = helpers.calculate_mini_app_value(object_params)
 
-        params
-          .require(:spree_cm_commissioner_homepage_section)
-          .permit(:title, :description, :active, :preview)
-          .merge(segment: segment_value, mini_app: mini_app_value)
+        @permitted_resource_params = params
+                                     .require(:spree_cm_commissioner_homepage_section)
+                                     .permit(:title, :description, :active, :preview, :section_type, :font, :app_background, :web_background)
+                                     .merge(segment: segment_value, mini_app: mini_app_value)
       end
 
       # The storefront being viewed; no tenant in the URL means BookMe+. Also gates the mini app

data/app/controllers/spree/api/v2/storefront/draft_orders_controller.rb

@@ -8,6 +8,7 @@ module Spree
           include SpreeCmCommissioner::AnonymousBookingGuard
 
           before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
+          before_action -> { ensure_waiting_room_session!(draft_order_products) }, only: :create
 
           # A top-up credits a wallet, which must belong to a real user -- unlike #create,
           # this action has no guest-checkout path.
@@ -124,9 +125,12 @@ module Spree
             ).fetch(:line_items, [])
           end
 
+          # Memoized: both the anonymous-booking and waiting-room guards read it on the same request.
           def draft_order_products
-            variant_ids = draft_order_line_items.pluck(:variant_id).compact
-            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+            @draft_order_products ||= begin
+              variant_ids = draft_order_line_items.pluck(:variant_id).compact
+              Spree::Variant.where(id: variant_ids).includes(product: :event).map(&:product)
+            end
           end
 
           # override

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -23,6 +23,7 @@ module Spree
                                        .where(preview: false)
                                        .for_feed(params[:homepage_id] || :general, params[:mini_app])
                                        .order(position: :asc)
+                                       .includes(:app_background, :web_background)
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/preview_sections_controller.rb

@@ -13,6 +13,7 @@ module Spree
                                        .where(preview: true)
                                        .where(id: SpreeCmCommissioner::HomepageSectionRelatable.section_ids_previewable_by(spree_current_user))
                                        .order(position: :asc)
+                                       .includes(:app_background, :web_background)
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/queue_draft_orders_controller.rb

@@ -9,6 +9,7 @@ module Spree
           include SpreeCmCommissioner::AnonymousBookingGuard
 
           before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
+          before_action -> { ensure_waiting_room_session!(draft_order_products) }, only: :create
 
           # Accepts a draft order request without building it: writes a queued Firestore status
           # document and schedules the real build (SpreeCmCommissioner::DraftOrders::Create) on a
@@ -59,9 +60,12 @@ module Spree
                   .fetch(:line_items, [])
           end
 
+          # Memoized: both the anonymous-booking and waiting-room guards read it on the same request.
           def draft_order_products
-            variant_ids = draft_order_line_items.pluck(:variant_id).compact
-            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+            @draft_order_products ||= begin
+              variant_ids = draft_order_line_items.pluck(:variant_id).compact
+              Spree::Variant.where(id: variant_ids).includes(product: :event).map(&:product)
+            end
           end
         end
       end

data/app/controllers/spree/api/v2/tenant/draft_orders_controller.rb

@@ -6,6 +6,7 @@ module Spree
           include SpreeCmCommissioner::AnonymousBookingGuard
 
           before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
+          before_action -> { ensure_waiting_room_session!(draft_order_products) }, only: :create
 
           # A top-up credits a wallet, which must belong to a real user -- unlike #create,
           # this action has no guest-checkout path.
@@ -90,9 +91,12 @@ module Spree
                   .fetch(:line_items, [])
           end
 
+          # Memoized: both the anonymous-booking and waiting-room guards read it on the same request.
           def draft_order_products
-            variant_ids = draft_order_line_items.pluck(:variant_id).compact
-            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+            @draft_order_products ||= begin
+              variant_ids = draft_order_line_items.pluck(:variant_id).compact
+              Spree::Variant.where(id: variant_ids).includes(product: :event).map(&:product)
+            end
           end
 
           # override

data/app/controllers/spree/api/v2/tenant/homepage_sections_controller.rb

@@ -8,6 +8,7 @@ module Spree
                                  .where(preview: false)
                                  .active
                                  .order(position: :asc)
+                                 .includes(:app_background, :web_background)
           end
 
           def scope

data/app/controllers/spree/api/v2/tenant/preview_sections_controller.rb

@@ -12,6 +12,7 @@ module Spree
                                  .where(preview: true)
                                  .where(id: SpreeCmCommissioner::HomepageSectionRelatable.section_ids_previewable_by(spree_current_user))
                                  .order(position: :asc)
+                                 .includes(:app_background, :web_background)
           end
         end
       end