spree_cm_commissioner 2.14.4 → 2.14.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e5317bd75c6057165a07eae82d0e30f986371767925346783242d8d12a0a8d24
-  data.tar.gz: b015f2bebfc1105dee65f7b4b22f63ee909b113541741f9dbc5ed48482ab4b04
+  metadata.gz: f7720d10f3459b8933df3d2521bdce4983e03adf800dc852cb4e6f28d689f146
+  data.tar.gz: 746c1c6e7cc864f5555020ab15d21eeac2c601d6f7d6b0bcfa1bff0b9633bb77
 SHA512:
-  metadata.gz: 7c59a388a335fcffdbb53ef8ebd470bf9b310a169ac8057ba6b464c6cef8e4ee6425cccfa5bfda366ea9c7fa89aaca854465c914521df040d460ba39994bd0b3
-  data.tar.gz: 0d8572c942886d56c1689ceb532e2d643f208d538dfb8fa40e21209198562dbe52fb7bb8a28f7573d0900407b8651421210eb4b99c6ea80aefa14b73677880c4
+  metadata.gz: 504fa1a8ea3a50979c1c23e366713e6e6b10bfe38efb4e3a4019b3f5f8cefa35ec460fd8a8b013cd1324c4ead1359fdbc0b00a7c0b56e71bd606c294cf180c6c
+  data.tar.gz: 5d1d182cbd5f0538d5d281c1c401b7724fe1bc27e0f3c5009345493a8335aa6bae62ed9dea22af2fc52b07ac8bfc1e617953851cbcaf7c5823773536ef4651ae

data/.env.example

@@ -54,6 +54,12 @@ CACHE_SERIALIZER_DISABLED="" # Set to yes to turn off Spree's serializer record
 CACHE_STATIC_MAX_AGE=86400 # Static content (CMS pages) - 1 day
 CACHE_REALTIME_MAX_AGE=300 # Everything else listed (homepage, menus, products, events, vendors, trips, seat layouts, countries, provinces, guest card classes) - 5 minutes
 
+# Shared secret(s) CloudFront sends to the origin as the X-Origin-Verify custom header. When set, listed CDN-cacheable
+# APIs return 403 to requests without a matching header. Comma-separate two values while rotating. Leave blank to turn off.
+# Set only after every client reaches these APIs through CloudFront, or they get 403.
+CDN_ORIGIN_SECRETS=""
+CDN_ORIGIN_REPORT_ONLY="" # Set to yes to log unverified requests instead of refusing them (use before enforcing)
+
 # Batch size for processing maintenance tasks in app/jobs/spree_cm_commissioner/maintenance_tasks/orchestrate_job.rb
 MAINTENANCE_TASKS_BATCH_SIZE=100
 

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.14.4)
+    spree_cm_commissioner (2.14.5)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -5,9 +5,14 @@ module SpreeCmCommissioner
     extend ActiveSupport::Concern
 
     included do
+      # Prepended so a request that skipped the CDN is refused before any other callback hits the DB.
+      prepend_before_action :verify_cdn_origin!, if: :cdn_cacheable?
       after_action :set_cache_control_for_cdn
     end
 
+    # CloudFront sends this as an origin custom header; clients never see or send it.
+    CDN_ORIGIN_HEADER = 'X-Origin-Verify'.freeze
+
     # Every CDN-cached API, by full class name, with its GET actions and TTL tier. Anything not
     # listed keeps Rails' default `max-age=0, private, must-revalidate` and never reaches the CDN.
     #
@@ -92,6 +97,34 @@ module SpreeCmCommissioner
       response.headers['Cache-Control'] = "public, max-age=0, s-maxage=#{shared_max_age}"
     end
 
+    # Refuses a listed action when it did not come through CloudFront, so the CDN can't be skipped by
+    # calling the origin directly. Off while CDN_ORIGIN_SECRETS is unset. It takes a comma-separated
+    # list so a new secret can be added to CloudFront before the old one is dropped. With
+    # CDN_ORIGIN_REPORT_ONLY=yes it only logs, to find clients still calling the origin before enforcing.
+    def verify_cdn_origin!
+      secrets = ENV.fetch('CDN_ORIGIN_SECRETS', '').split(',').map(&:strip).compact_blank
+      return if secrets.empty?
+
+      provided = request.headers[CDN_ORIGIN_HEADER].to_s
+      return if secrets.any? { |secret| ActiveSupport::SecurityUtils.secure_compare(provided, secret) }
+
+      if ENV['CDN_ORIGIN_REPORT_ONLY'] == 'yes'
+        CmAppLogger.log(
+          label: 'cdn_origin_unverified',
+          data: {
+            controller: self.class.name,
+            action: action_name,
+            path: request.path,
+            header_present: provided.present?,
+            via_cloudfront: request.headers['X-Amz-Cf-Id'].present?
+          }
+        )
+        return
+      end
+
+      head :forbidden
+    end
+
     private
 
     def cdn_cache_config

data/app/controllers/concerns/spree_cm_commissioner/waiting_room_authorization.rb

@@ -7,11 +7,30 @@ module SpreeCmCommissioner
     end
 
     def ensure_waiting_room_session_token
-      return if ENV['WAITING_ROOM_DISABLED'] == 'yes'
-      return if request_from_client?
+      return if waiting_room_disabled?
       return unless required_waiting_room_session?
+      return if active_waiting_room_session?
 
-      return if SpreeCmCommissioner::WaitingRoomSession.active.exists?(token: params[:waiting_room_session_token])
+      handle_waiting_room_session_token_error
+    end
+
+    # Product-based counterpart to the path-based check above, for draft-order endpoints: gating by
+    # path would hold every booking (hotel, transit, ...) behind the waiting room, while this only
+    # holds orders for products that opt in via Product#enforce_waiting_room_session?. Call it as a
+    # before_action on #create, next to ensure_anonymous_booking_allowed!.
+    #
+    # Products covered by the request's private sale link (`st`) are exempt: that buyer draws from a
+    # pool locked for them, not the public stock the queue is rationing. The exemption is per
+    # request, not per product — the same product is usually on public sale too.
+    #
+    # products: [Array<Spree::Product>] every distinct product referenced by this request.
+    def ensure_waiting_room_session!(products)
+      return if waiting_room_disabled?
+
+      private_sale_product_ids = waiting_room_private_sale&.product_ids || []
+      enforced = products.select(&:enforce_waiting_room_session?).reject { |product| private_sale_product_ids.include?(product.id) }
+      return if enforced.empty?
+      return if active_waiting_room_session?
 
       handle_waiting_room_session_token_error
     end
@@ -23,13 +42,27 @@ module SpreeCmCommissioner
       apis.any? { |prefix| request.path.start_with?(prefix) }
     end
 
-    # temporary disable session check from any client server requests.
-    def request_from_client?
-      request.headers['X-Cm-Api-Client-Version'].present?
-    end
-
     def handle_waiting_room_session_token_error
       render_error_payload(Spree.t(:invalid_session_token), 400)
     end
+
+    private
+
+    def waiting_room_disabled?
+      ENV['WAITING_ROOM_DISABLED'] == 'yes'
+    end
+
+    def active_waiting_room_session?
+      SpreeCmCommissioner::WaitingRoomSession.active.exists?(token: params[:waiting_room_session_token])
+    end
+
+    # Verified, not just present: a made-up `st` must not skip the queue, so a token that fails
+    # Authorize simply earns no exemption.
+    def waiting_room_private_sale
+      return if params[:st].blank?
+
+      result = SpreeCmCommissioner::PrivateSales::Authorize.call(token: params[:st], user: spree_current_user)
+      result.value if result.success?
+    end
   end
 end

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -4,6 +4,8 @@ module Spree
       helper SpreeCmCommissioner::Admin::HomepageSegmentHelper
 
       before_action :load_tenants, only: [:index]
+      before_action :reject_invalid_section_type, only: %i[create update]
+      before_action :build_assets, only: %i[create update]
 
       helper_method :selected_tenant
 
@@ -39,8 +41,62 @@ module Spree
         end
       end
 
+      def remove_app_background
+        remove_asset(@object.app_background)
+      end
+
+      def remove_web_background
+        remove_asset(@object.web_background)
+      end
+
       private
 
+      # Always redirects back to `edit` rather than re-rendering it on failure (unlike the
+      # sibling GuestCardClassesController#remove_asset) — this controller's `edit` action sets
+      # extra ivars (`@homepage_section_relatables`) that this action never loads, so rendering
+      # the template directly here would raise.
+      def remove_asset(asset)
+        if asset&.destroy
+          flash[:success] = Spree.t('notice_messages.icon_removed')
+        else
+          flash[:error] = Spree.t('errors.messages.cannot_remove_icon')
+        end
+
+        redirect_to edit_admin_homepage_feed_homepage_section_url(@object)
+      end
+
+      # Only `trending` sections use these assets; building them for another type would let a
+      # direct API call attach a background the form never shows and the model then has to
+      # discard on save (see HomepageSection#clear_non_trending_fields). Either way the raw
+      # upload must be pulled out of permitted_resource_params — left in place, it gets assigned
+      # straight to the has_one association by update_resource/create_resource, which raises
+      # ActiveRecord::AssociationTypeMismatch instead of being silently ignored.
+      def build_assets
+        unless trending_section?
+          permitted_resource_params.delete(:app_background)
+          permitted_resource_params.delete(:web_background)
+          return
+        end
+
+        @object.build_app_background(attachment: permitted_resource_params.delete(:app_background)) if permitted_resource_params[:app_background]
+        @object.build_web_background(attachment: permitted_resource_params.delete(:web_background)) if permitted_resource_params[:web_background]
+      end
+
+      def trending_section?
+        (permitted_resource_params[:section_type].presence || @object.section_type).to_s == 'trending'
+      end
+
+      # `enum section_type:` raises ArgumentError on assignment of an unrecognized value, which
+      # would otherwise 500 instead of a normal validation failure — strip it here and flash
+      # instead, before it ever reaches create_resource/update_resource's mass-assignment.
+      def reject_invalid_section_type
+        submitted = permitted_resource_params[:section_type]
+        return if submitted.blank? || SpreeCmCommissioner::HomepageSection.section_types.key?(submitted.to_s)
+
+        permitted_resource_params.delete(:section_type)
+        flash[:error] = Spree.t('errors.messages.invalid_section_type')
+      end
+
       def collection
         return @collection if defined?(@collection)
 
@@ -57,16 +113,18 @@ module Spree
         @collection = scoped.page(params[:page]).per(params[:per_page])
       end
 
-      # overrided
+      # overrided — memoized so `.delete()` in build_assets mutates the same hash instance
       def permitted_resource_params
+        return @permitted_resource_params if defined?(@permitted_resource_params)
+
         object_params = params[:spree_cm_commissioner_homepage_section]
         segment_value = helpers.calculate_segment_value(object_params)
         mini_app_value = helpers.calculate_mini_app_value(object_params)
 
-        params
-          .require(:spree_cm_commissioner_homepage_section)
-          .permit(:title, :description, :active, :preview)
-          .merge(segment: segment_value, mini_app: mini_app_value)
+        @permitted_resource_params = params
+                                     .require(:spree_cm_commissioner_homepage_section)
+                                     .permit(:title, :description, :active, :preview, :section_type, :font, :app_background, :web_background)
+                                     .merge(segment: segment_value, mini_app: mini_app_value)
       end
 
       # The storefront being viewed; no tenant in the URL means BookMe+. Also gates the mini app

data/app/controllers/spree/api/v2/storefront/draft_orders_controller.rb

@@ -8,6 +8,7 @@ module Spree
           include SpreeCmCommissioner::AnonymousBookingGuard
 
           before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
+          before_action -> { ensure_waiting_room_session!(draft_order_products) }, only: :create
 
           # A top-up credits a wallet, which must belong to a real user -- unlike #create,
           # this action has no guest-checkout path.
@@ -124,9 +125,12 @@ module Spree
             ).fetch(:line_items, [])
           end
 
+          # Memoized: both the anonymous-booking and waiting-room guards read it on the same request.
           def draft_order_products
-            variant_ids = draft_order_line_items.pluck(:variant_id).compact
-            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+            @draft_order_products ||= begin
+              variant_ids = draft_order_line_items.pluck(:variant_id).compact
+              Spree::Variant.where(id: variant_ids).includes(product: :event).map(&:product)
+            end
           end
 
           # override

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -23,6 +23,7 @@ module Spree
                                        .where(preview: false)
                                        .for_feed(params[:homepage_id] || :general, params[:mini_app])
                                        .order(position: :asc)
+                                       .includes(:app_background, :web_background)
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/preview_sections_controller.rb

@@ -13,6 +13,7 @@ module Spree
                                        .where(preview: true)
                                        .where(id: SpreeCmCommissioner::HomepageSectionRelatable.section_ids_previewable_by(spree_current_user))
                                        .order(position: :asc)
+                                       .includes(:app_background, :web_background)
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/queue_draft_orders_controller.rb

@@ -9,6 +9,7 @@ module Spree
           include SpreeCmCommissioner::AnonymousBookingGuard
 
           before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
+          before_action -> { ensure_waiting_room_session!(draft_order_products) }, only: :create
 
           # Accepts a draft order request without building it: writes a queued Firestore status
           # document and schedules the real build (SpreeCmCommissioner::DraftOrders::Create) on a
@@ -59,9 +60,12 @@ module Spree
                   .fetch(:line_items, [])
           end
 
+          # Memoized: both the anonymous-booking and waiting-room guards read it on the same request.
           def draft_order_products
-            variant_ids = draft_order_line_items.pluck(:variant_id).compact
-            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+            @draft_order_products ||= begin
+              variant_ids = draft_order_line_items.pluck(:variant_id).compact
+              Spree::Variant.where(id: variant_ids).includes(product: :event).map(&:product)
+            end
           end
         end
       end

data/app/controllers/spree/api/v2/tenant/draft_orders_controller.rb

@@ -6,6 +6,7 @@ module Spree
           include SpreeCmCommissioner::AnonymousBookingGuard
 
           before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
+          before_action -> { ensure_waiting_room_session!(draft_order_products) }, only: :create
 
           # A top-up credits a wallet, which must belong to a real user -- unlike #create,
           # this action has no guest-checkout path.
@@ -90,9 +91,12 @@ module Spree
                   .fetch(:line_items, [])
           end
 
+          # Memoized: both the anonymous-booking and waiting-room guards read it on the same request.
           def draft_order_products
-            variant_ids = draft_order_line_items.pluck(:variant_id).compact
-            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+            @draft_order_products ||= begin
+              variant_ids = draft_order_line_items.pluck(:variant_id).compact
+              Spree::Variant.where(id: variant_ids).includes(product: :event).map(&:product)
+            end
           end
 
           # override

data/app/controllers/spree/api/v2/tenant/homepage_sections_controller.rb

@@ -8,6 +8,7 @@ module Spree
                                  .where(preview: false)
                                  .active
                                  .order(position: :asc)
+                                 .includes(:app_background, :web_background)
           end
 
           def scope

data/app/controllers/spree/api/v2/tenant/preview_sections_controller.rb

@@ -12,6 +12,7 @@ module Spree
                                  .where(preview: true)
                                  .where(id: SpreeCmCommissioner::HomepageSectionRelatable.section_ids_previewable_by(spree_current_user))
                                  .order(position: :asc)
+                                 .includes(:app_background, :web_background)
           end
         end
       end

data/app/models/active_storage/variation_decorator.rb

@@ -0,0 +1,18 @@
+module ActiveStorage
+  module VariationDecorator
+    # ActiveStorage reuses a JPEG upload's own extension as the variant format, but libvips
+    # picks its encoder from the output extension and rejects aliases like `.jfif`
+    # ("is not a known file format"). Mapping here rather than renaming blobs also fixes
+    # variant URLs already handed out, since their signed key embeds `format: "jfif"`.
+    JPEG_FORMAT_ALIASES = %w[jfif jpe].freeze
+
+    def format
+      format = super
+      JPEG_FORMAT_ALIASES.include?(format.to_s.downcase) ? 'jpg' : format
+    end
+  end
+end
+
+unless ActiveStorage::Variation.ancestors.include?(ActiveStorage::VariationDecorator)
+  ActiveStorage::Variation.prepend(ActiveStorage::VariationDecorator)
+end

data/app/models/concerns/spree_cm_commissioner/event_metadata.rb

@@ -18,6 +18,10 @@ module SpreeCmCommissioner
       # For certain large events, admin can disable this manually.
       store_public_metadata :allow_manual_search_for_operator, :boolean, default: true
 
+      # Requires an active waiting-room session to create a draft order for this event's products
+      # (Product#enforce_waiting_room_session?). Server-only switch, so private.
+      store_private_metadata :enforce_waiting_room_session, :boolean, default: false
+
       # ⚠️  CRITICAL: Cached seat layout IDs kept in sync by SeatLayout callback.
       # If callback is removed/modified without updating this, availability checks will fail.
       #

data/app/models/concerns/spree_cm_commissioner/order_holdable.rb

@@ -4,8 +4,9 @@ module SpreeCmCommissioner
 
     included do
       # Store the earliest expiration time across all holds (seats + inventory)
-      # in `public_metadata[:hold_expires_at]`. This is used only for UI display
-      # (e.g., a countdown timer) and does not control the release logic.
+      # in `public_metadata[:hold_expires_at]`. This is used for UI display
+      # (e.g., a countdown timer) and by LineItems::ValidatePurchaseLimits to count an
+      # unpaid cart against the buyer's caps; it does not control the release logic.
       # Each hold is released independently when its own expiration time is reached.
       store_public_metadata :hold_expires_at, :datetime
 

data/app/models/concerns/spree_cm_commissioner/order_state_machine.rb

@@ -7,6 +7,7 @@ module SpreeCmCommissioner
     included do # rubocop:disable Metrics/BlockLength
       after_commit :clear_has_incomplete_guest_info_cache, on: %i[create update]
 
+      state_machine.before_transition to: :address, do: :ensure_within_purchase_limits
       state_machine.before_transition to: :address, do: :hold_order_holds
 
       # Same transitions core calls create_tax_charge! from (gems/core/app/models/spree/order/checkout.rb,
@@ -107,6 +108,22 @@ module SpreeCmCommissioner
       end
     end
 
+    # Line items are only validated when they change, so a cart sent back to `cart` (hold
+    # released) and advanced again would skip the purchase-limit check and could be held next to
+    # another cart the buyer opened meanwhile. Runs before hold_order_holds so a rejection never
+    # leaves a hold behind.
+    def ensure_within_purchase_limits
+      line_items.each do |line_item|
+        result = SpreeCmCommissioner::LineItems::ValidatePurchaseLimits.call(line_item: line_item)
+        next if result.success?
+
+        errors.add(:base, result.error.to_s)
+        return false
+      end
+
+      true
+    end
+
     # Best-effort, like apply_prepaid_payment!'s other callers: a user with no (or no
     # currency-matching) store credit just doesn't get a payment here, and the app can still
     # remove/reapply it afterwards through the existing checkout store-credit endpoints.

data/app/models/spree_cm_commissioner/homepage_section.rb

@@ -10,10 +10,26 @@ module SpreeCmCommissioner
     attribute :segment, :integer, default: 0
     attribute :mini_app, :integer, default: 0
 
+    enum section_type: { default: 0, trending: 1, big_banner: 2 }
+
     self.whitelisted_ransackable_attributes = %w[title active]
 
     has_many :homepage_section_relatables, -> { active }, inverse_of: :homepage_section, dependent: :destroy
 
+    has_one :app_background, as: :viewable, dependent: :destroy, class_name: 'SpreeCmCommissioner::HomepageSectionAppBackground'
+    has_one :web_background, as: :viewable, dependent: :destroy, class_name: 'SpreeCmCommissioner::HomepageSectionWebBackground'
+
+    # `font`/backgrounds only apply to `trending` sections. The admin form only hides those
+    # fields via JS when another type is picked — it doesn't clear them — and a direct API call
+    # could set them on any type, so normalize here rather than relying on the form. A hard
+    # validation would instead reject the common "switch an existing trending section back to
+    # default" edit, since the hidden `font` field still submits its stale value.
+    #
+    # Guarded beyond `unless: :trending?` so a routine save of an already-default/big_banner
+    # section (the steady-state case) skips the `app_background`/`web_background` association
+    # loads entirely instead of querying them on every save forever.
+    before_save :clear_non_trending_fields, if: :clear_non_trending_fields?
+
     scope :active, lambda {
       where(active: true)
         .joins(:homepage_section_relatables)
@@ -47,5 +63,22 @@ module SpreeCmCommissioner
 
     # Create maintaining task to purge homepage section related caches
     after_save { SpreeCmCommissioner::MaintenanceTasks::CacheInvalidation.pending.create_or_find_by(maintainable: self) }
+
+    private
+
+    # `.target` (not `.loaded?`) so this only fires for a background actually built/loaded in
+    # memory on *this* save. `.loaded?` stays true forever once an object has been saved once
+    # with the association touched, even after the target is nil'd out by a prior destroy —
+    # which made every later save of that same in-memory record re-run the clear unnecessarily.
+    def clear_non_trending_fields?
+      !trending? && (font.present? || section_type_changed? ||
+        association(:app_background).target.present? || association(:web_background).target.present?)
+    end
+
+    def clear_non_trending_fields
+      self.font = nil
+      app_background&.destroy
+      web_background&.destroy
+    end
   end
 end

data/app/models/spree_cm_commissioner/homepage_section_app_background.rb

@@ -0,0 +1,13 @@
+module SpreeCmCommissioner
+  class HomepageSectionAppBackground < Asset
+    # 3:2 — taller than 16:9 so the image fills a `trending` card's full height instead of
+    # letterboxing. `medium` (960x640) is the upload target; `mini`/`small` are downscaled copies.
+    def asset_styles
+      {
+        mini: '160x107>',
+        small: '480x320>',
+        medium: '960x640>'
+      }
+    end
+  end
+end

data/app/models/spree_cm_commissioner/homepage_section_web_background.rb

@@ -0,0 +1,13 @@
+module SpreeCmCommissioner
+  class HomepageSectionWebBackground < Asset
+    # 5:1 — wide and short so the image spans a `trending` banner's full width without pushing
+    # page content down. `medium` (1440x288) is the upload target; `mini`/`small` are downscaled copies.
+    def asset_styles
+      {
+        mini: '160x32>',
+        small: '720x144>',
+        medium: '1440x288>'
+      }
+    end
+  end
+end

data/app/models/spree_cm_commissioner/product_decorator.rb

@@ -222,6 +222,13 @@ module SpreeCmCommissioner
       end
     end
 
+    # Configured once on the event rather than per ticket product. Other product types (trips,
+    # rooms, ...) that need it later resolve their own source here; the draft-order guard
+    # (WaitingRoomAuthorization#ensure_waiting_room_session!) only ever asks the product.
+    def enforce_waiting_room_session?
+      event&.enforce_waiting_room_session? || false
+    end
+
     # Not yet on sale. Kept separate from available? so a scheduled product's real stock still
     # shows via in_stock? — Stock::AvailabilityValidatorDecorator checks this to block add-to-cart.
     def scheduled?

data/app/overrides/spree/admin/taxons/_form/enforce_waiting_room_session.html.erb.deface

@@ -0,0 +1,10 @@
+<!-- insert_before "erb[loud]:contains('field_container :hide_from_nav')" -->
+
+<%= f.field_container :enforce_waiting_room_session, class: ['custom-control', 'custom-checkbox', 'my-4'] do %>
+  <%= f.check_box :enforce_waiting_room_session, class: 'custom-control-input' %>
+  <%= f.label :enforce_waiting_room_session, Spree.t(:enforce_waiting_room_session), class: 'custom-control-label' %>
+  <%= f.error_message_on :enforce_waiting_room_session %>
+  <small class="form-text text-muted">
+    <%= Spree.t(:enforce_waiting_room_session_hint) %>
+  </small>
+<% end if @taxon.event? && @taxon.depth == 1 %> %>

data/app/serializers/spree/v2/storefront/homepage_section_serializer.rb

@@ -2,8 +2,11 @@ module Spree
   module V2
     module Storefront
       class HomepageSectionSerializer < BaseSerializer
-        attributes :id, :title, :segments, :mini_apps, :description, :active, :position, :preview, :created_at, :updated_at
+        attributes :id, :title, :segments, :mini_apps, :description, :active, :position, :preview,
+                   :section_type, :font, :created_at, :updated_at
         has_many :homepage_section_relatables
+        has_one :app_background, serializer: ::SpreeCmCommissioner::V2::Storefront::AssetSerializer
+        has_one :web_background, serializer: ::SpreeCmCommissioner::V2::Storefront::AssetSerializer
       end
     end
   end

data/app/serializers/spree/v2/tenant/homepage_section_serializer.rb

@@ -3,9 +3,11 @@ module Spree
     module Tenant
       class HomepageSectionSerializer < BaseSerializer
         attributes :id, :title, :segments, :description,
-                   :active, :position, :preview, :created_at, :updated_at
+                   :active, :position, :preview, :section_type, :font, :created_at, :updated_at
 
         has_many :homepage_section_relatables, serializer: ::Spree::V2::Tenant::HomepageSectionRelatableSerializer
+        has_one :app_background, serializer: ::Spree::V2::Tenant::AssetSerializer
+        has_one :web_background, serializer: ::Spree::V2::Tenant::AssetSerializer
       end
     end
   end

data/app/services/spree_cm_commissioner/integrations/book_me_bus_v1/polling/sync_trip_stop.rb

@@ -38,6 +38,8 @@ module SpreeCmCommissioner::Integrations::BookMeBusV1::Polling
       stop_times = trip_mapping.external_payload&.dig('stop_times')
       return [] unless stop_times.is_a?(Array)
 
+      previous_time = nil
+
       synced_mappings = stop_times.each_with_index.map do |stop_time_data, index|
         # BookMeBus's stop_times[i]['arrival_time'] is the time the trip arrives at the NEXT
         # physical stop (i+1), not at stop i itself - it's 0/absent on the last entry, which has
@@ -50,7 +52,15 @@ module SpreeCmCommissioner::Integrations::BookMeBusV1::Polling
         # missing' on every booking attempt - never caught by specs because their fixtures set
         # arrival_time == departure_time on the same entry, sidestepping the real shape.
         incoming_arrival_time = index.positive? ? stop_times[index - 1]['arrival_time'] : nil
-        sync_item!(trip_mapping, stop_time_data, incoming_arrival_time, index + 1, stop_times.size)
+
+        # BookMeBus sends time-of-day only, so an overnight trip (23:00 -> 05:00) needs its days rolled
+        # here: TransitOrder::Create trusts the stored datetimes and raises when arrival < departure.
+        arrival_time = roll_forward(parse_time(incoming_arrival_time), previous_time)
+        departure_time = roll_forward(parse_time(stop_time_data['departure_time']), arrival_time || previous_time)
+        previous_time = departure_time || arrival_time || previous_time
+
+        times = { arrival_time: arrival_time, departure_time: departure_time }
+        sync_item!(trip_mapping, stop_time_data, times, index + 1, stop_times.size)
       end.compact
 
       cleanup_stale_mappings!(trip_mapping, synced_mappings)
@@ -82,7 +92,7 @@ module SpreeCmCommissioner::Integrations::BookMeBusV1::Polling
     end
 
     # Sync a single trip stop
-    def sync_item!(trip_mapping, stop_time_data, incoming_arrival_time, sequence, total_stops)
+    def sync_item!(trip_mapping, stop_time_data, times, sequence, total_stops)
       stop_data = stop_time_data['stop']
       location_data = stop_time_data['location']
       return nil unless stop_data.is_a?(Hash) && location_data.is_a?(Hash)
@@ -119,8 +129,8 @@ module SpreeCmCommissioner::Integrations::BookMeBusV1::Polling
           # BookMeBus returns one entry per search.
           allow_boarding: sequence == 1,
           allow_drop_off: sequence == total_stops,
-          departure_time: parse_time(stop_time_data['departure_time']),
-          arrival_time: parse_time(incoming_arrival_time)
+          departure_time: times[:departure_time],
+          arrival_time: times[:arrival_time]
         )
         tracker.save_if_changed!(trip_stop)
       end
@@ -206,6 +216,13 @@ module SpreeCmCommissioner::Integrations::BookMeBusV1::Polling
       mapping&.internal
     end
 
+    def roll_forward(time, not_before)
+      return time if time.nil? || not_before.nil?
+
+      time += 1.day while time < not_before
+      time
+    end
+
     def parse_time(seconds_from_midnight)
       return nil unless seconds_from_midnight.present? && seconds_from_midnight.to_i.positive?
 

data/app/services/spree_cm_commissioner/integrations/book_me_bus_v1/polling/sync_trips.rb

@@ -762,6 +762,7 @@ module SpreeCmCommissioner::Integrations::BookMeBusV1::Polling
     def map_route_type(route_type)
       case route_type&.to_s&.downcase
       when 'ferry' then :ferry
+      when 'private_taxi' then :intercity_taxi
       else :bus
       end
     end

data/app/services/spree_cm_commissioner/line_items/validate_purchase_limits.rb

@@ -1,6 +1,7 @@
 # Per-product purchase caps, one independent check per scope. The order cap looks at a single
-# order; account/ip/device aggregate over the buyer's completed orders, so a customer can't
-# bypass a cap by splitting the purchase across carts.
+# order; account/ip/device aggregate over the buyer's completed orders and their other carts
+# still under an unexpired hold, so a customer can't bypass a cap by splitting the purchase
+# across carts - including carts opened while an earlier one is still unpaid.
 #
 # A cap of nil or 0 is off. A scope with no value on the order (guest order, no IP, no device
 # id) has nothing to count the buyer against, so its cap does not apply.
@@ -16,6 +17,32 @@ module SpreeCmCommissioner
 
       COUNTED_STATES = %w[complete resumed].freeze
 
+      # An unpaid cart counts until its hold expires. Without a hold (a product without inventory
+      # holds) it counts while still in checkout - not sent back to `cart`, not archived - for one
+      # hold duration after its last update; entering checkout or paying bumps updated_at. A
+      # released hold clears hold_expires_at and sends the cart back to `cart`, so it stops
+      # counting at once. A `cart` order can't be paid without re-entering `address`, which runs
+      # this check again (OrderStateMachine#ensure_within_purchase_limits).
+      # Spree's metadata serializer stores public_metadata as a JSON string inside the jsonb
+      # column, so `->>` on it is always NULL; `#>> '{}'` unwraps it (or an object) back to jsonb.
+      COUNTED_ORDERS_SQL = <<~SQL.squish.freeze
+        (spree_orders.completed_at IS NOT NULL AND spree_orders.state IN (:states))
+        OR (
+          spree_orders.completed_at IS NULL
+          AND COALESCE(
+            ((spree_orders.public_metadata #>> '{}')::jsonb->>'hold_expires_at')::timestamptz,
+            CASE WHEN spree_orders.state <> 'cart' AND spree_orders.archived_at IS NULL
+                 THEN spree_orders.updated_at + make_interval(secs => :hold_seconds) END
+          ) > :now
+        )
+      SQL
+
+      AGGREGATE_SCOPES = {
+        account: %i[max_quantity_per_account user_id],
+        device: %i[max_quantity_per_device device_id],
+        ip: %i[max_quantity_per_ip last_ip_address]
+      }.freeze
+
       def call(line_item:)
         @line_item = line_item
         @product = line_item.product
@@ -23,6 +50,8 @@ module SpreeCmCommissioner
 
         return success(nil) if @product.blank?
 
+        lock_buyer!
+
         check_order_limit!
         check_account_limit!
         check_ip_limit!
@@ -35,6 +64,22 @@ module SpreeCmCommissioner
 
       private
 
+      # Two carts for the same buyer saved at the same moment can't see each other's uncommitted
+      # rows, so both would pass. A transaction-level lock per capped identity makes the second
+      # wait until the first commits - in DraftOrders::Create that is after the hold sets
+      # hold_expires_at, so the second then counts it. Only capped identities are locked, so
+      # unrelated buyers never wait; outside a transaction (a bare valid?) the lock is released
+      # at once, which is harmless.
+      def lock_buyer!
+        AGGREGATE_SCOPES.each do |scope, (cap_attribute, identity_column)|
+          identity = @order&.public_send(identity_column)
+          next unless @product.public_send(cap_attribute).to_i.positive? && identity.present?
+
+          key = Zlib.crc32("spree_cm_commissioner:purchase_limit:#{scope}:#{identity}")
+          Spree::Order.connection.execute("SELECT pg_advisory_xact_lock(#{key})")
+        end
+      end
+
       def check_order_limit!
         limit = @product.max_quantity_per_order.to_i
         return unless limit.positive?
@@ -102,18 +147,24 @@ module SpreeCmCommissioner
         end
       end
 
-      # What the buyer already holds for this product, outside the order being validated.
+      # What the buyer already holds for this product, outside the order being validated:
+      # completed orders, plus unpaid carts still inside their hold (OrderHolds::Hold, kept
+      # alive through payment by OrderHolds::LockForPayment), see COUNTED_ORDERS_SQL. An
+      # abandoned cart stops counting on its own, so no cleanup is needed.
       # product_id is not a column on spree_line_items - it is `delegate :product_id, to:
       # :variant` - so the product filter joins through spree_variants, indexed on product_id.
       def purchased_by(scope)
         Spree::LineItem.joins(:order, :variant)
-                       .where(spree_orders: { state: COUNTED_STATES })
                        .where(spree_orders: scope)
                        .where(spree_variants: { product_id: @product.id })
-                       .where.not(spree_orders: { completed_at: nil })
                        .where.not(spree_orders: { id: @line_item.order_id })
+                       .where(COUNTED_ORDERS_SQL, states: COUNTED_STATES, now: Time.current, hold_seconds: hold_seconds)
                        .sum(:quantity)
       end
+
+      def hold_seconds
+        SpreeCmCommissioner::OrderHolds::Hold::HOLD_DURATION.to_i
+      end
     end
   end
 end

data/app/views/spree/admin/homepage_section/_form.html.erb

@@ -8,6 +8,32 @@
             <%= f.label :title %>
             <%= f.text_field :title, class: 'form-control' %>
           <% end %>
+          <%= f.field_container :section_type do %>
+            <%= f.label :section_type, Spree.t(:section_type) %>
+            <%= f.select :section_type,
+              SpreeCmCommissioner::HomepageSection.section_types.keys.map { |key| [Spree.t("section_types.#{key}"), key] },
+              {}, class: 'fullwidth select2' %>
+          <% end %>
+          <div id="homepage_section_trending_fields">
+            <%= f.field_container :font do %>
+              <%= f.label :font, Spree.t(:font) %>
+              <%= f.text_field :font, class: 'form-control' %>
+            <% end %>
+            <%= render 'shared/asset_field',
+              field: :app_background,
+              label: Spree.t(:app_background),
+              asset: f.object.app_background,
+              remove_url: (f.object.app_background.present? ? remove_app_background_admin_homepage_feed_homepage_section_url(f.object) : nil),
+              form: f,
+              classes: ['col-md-12'] %>
+            <%= render 'shared/asset_field',
+              field: :web_background,
+              label: Spree.t(:web_background),
+              asset: f.object.web_background,
+              remove_url: (f.object.web_background.present? ? remove_web_background_admin_homepage_feed_homepage_section_url(f.object) : nil),
+              form: f,
+              classes: ['col-md-12'] %>
+          </div>
           <%= f.field_container :segment do %>
             <%= f.label :segment, class: 'd-flex align-items-center' %>
             <div class="d-flex flex-wrap">
@@ -59,3 +85,21 @@
     </div>
   </div>
 </div>
+<script>
+  $(document).ready(function () {
+    const sectionTypeSelector = "#spree_cm_commissioner_homepage_section_section_type"
+    const trendingFieldsSelector = "#homepage_section_trending_fields"
+
+    // initialize
+    toggleTrendingFields();
+
+    $(sectionTypeSelector).on("change", function () {
+      toggleTrendingFields();
+    });
+
+    function toggleTrendingFields() {
+      var selectedType = $(sectionTypeSelector).val();
+      $(trendingFieldsSelector).toggle(selectedType === "trending");
+    }
+  });
+</script>

data/config/initializers/spree_permitted_attributes.rb

@@ -57,6 +57,7 @@ module Spree
       group_check_in_enabled
       individual_check_in_enabled
       allow_manual_search_for_operator
+      enforce_waiting_room_session
       show_badge_status
       purchasable_on
       available_on

data/config/locales/dry_validations.en.yml

@@ -2,6 +2,10 @@ en:
   dry_validation:
     errors:
       rules:
+        date:
+          must_be_in_future: Date must be today or in the future
+        origin_id:
+          must_be_different: Origin and destination must be different
         from_date:
           must_be_in_future: Start date must be today or in future
           must_be_later_than_start_date: 'End Date must be later than or equal Start Date'

data/config/locales/en.yml

@@ -195,6 +195,7 @@ en:
   errors:
     messages:
       must_be_positive_integer: "must be a positive whole number"
+      invalid_section_type: "Section type was not recognized, so it was left unchanged."
 
   purchase_limit:
     device_cap_requires_app_only: "Device limit requires the ticket to be app-only."
@@ -287,6 +288,14 @@ en:
     tenant: "Tenant"
     segment: "Segment"
     homepages: "Homepages"
+    section_type: "Section Type"
+    font: "Font"
+    app_background: "App Background"
+    web_background: "Web Background"
+    section_types:
+      default: "Default"
+      trending: "Trending"
+      big_banner: "Big Banner"
     purchase_limits:
       title: "Purchase Limits"
       hint: "Caps on how many units one buyer can purchase, checked independently per scope. Leave blank to disable. Caps never reset and lowering one does not claw back past purchases."
@@ -373,6 +382,8 @@ en:
       csv_unknown_status: "Something went wrong. Please try again."
     new_homepage_banner: "Add New Banner"
     invalid_session_token: "Invalid session token"
+    enforce_waiting_room_session: "Enforce waiting room on order"
+    enforce_waiting_room_session_hint: "Orders for this event are rejected unless the buyer holds an active waiting-room session. Buyers using a private sale link are exempt. The website has no waiting room yet, so web orders for this event are rejected too."
     intel_phone_number: "Intel Phone Number"
     phone_number: "Phone Number"
     contact: "Contact"

data/config/locales/km.yml

@@ -161,6 +161,7 @@ km:
   errors:
     messages:
       must_be_positive_integer: "ត្រូវតែជាចំនួនគត់វិជ្ជមាន"
+      invalid_section_type: "ប្រភេទផ្នែកមិនត្រឹមត្រូវទេ ដូច្នេះវានៅដូចដើម។"
 
   purchase_limit:
     device_cap_requires_app_only: "ដែនកំណត់តាមឧបករណ៍ត្រូវការឱ្យសំបុត្រមានតែក្នុងកម្មវិធីប៉ុណ្ណោះ។"
@@ -245,6 +246,14 @@ km:
     tenant: "អង្គភាព"
     segment: "ផ្នែក"
     homepages: "ទំព័រដើម"
+    section_type: "ប្រភេទផ្នែក"
+    font: "ពុម្ពអក្សរ"
+    app_background: "ផ្ទៃខាងក្រោយកម្មវិធី"
+    web_background: "ផ្ទៃខាងក្រោយវិបសាយ"
+    section_types:
+      default: "លំនាំដើម"
+      trending: "កំពុងពេញនិយម"
+      big_banner: "បដាធំ"
     purchase_limits:
       title: "ដែនកំណត់ការទិញ"
       hint: "ដែនកំណត់ចំនួនដែលអ្នកទិញម្នាក់អាចទិញបាន ដោយពិនិត្យដោយឡែកតាមប្រភេទនីមួយៗ។ ទុកទទេដើម្បីបិទ។ ដែនកំណត់មិនកំណត់ឡើងវិញទេ ហើយការបន្ថយវាមិនប៉ះពាល់ការទិញកន្លងមកឡើយ។"
@@ -326,6 +335,8 @@ km:
       csv_unknown_status: "Something went wrong. Please try again."
     new_homepage_banner: "បន្ថែមផ្ទាំងរូបភាពថ្មី"
     invalid_session_token: "Invalid session token"
+    enforce_waiting_room_session: "តម្រូវឱ្យឆ្លងកាត់បន្ទប់រង់ចាំមុនពេលបញ្ជាទិញ"
+    enforce_waiting_room_session_hint: "ការបញ្ជាទិញសម្រាប់ព្រឹត្តិការណ៍នេះនឹងត្រូវបដិសេធ លុះត្រាតែអ្នកទិញមានវគ្គបន្ទប់រង់ចាំដែលនៅសកម្ម។ អ្នកទិញតាមតំណលក់ឯកជនមិនស្ថិតក្រោមលក្ខខណ្ឌនេះទេ។ គេហទំព័រមិនទាន់មានបន្ទប់រង់ចាំនៅឡើយ ដូច្នេះការបញ្ជាទិញតាមគេហទំព័រសម្រាប់ព្រឹត្តិការណ៍នេះក៏នឹងត្រូវបដិសេធដែរ។"
     intel_phone_number: "លេខទូរសព្ទ"
     phone_number: "លេខទូរសព្ទ"
     new_customer: "អតិថិជនថ្មី"

data/config/routes.rb

@@ -375,6 +375,11 @@ Spree::Core::Engine.add_routes do
         collection do
           post :update_positions
         end
+
+        member do
+          delete :remove_app_background
+          delete :remove_web_background
+        end
       end
 
       resources :homepage_section_relatable do

data/db/migrate/20261021000001_add_section_type_to_cm_homepage_sections.rb

@@ -0,0 +1,6 @@
+class AddSectionTypeToCmHomepageSections < ActiveRecord::Migration[7.0]
+  def change
+    add_column :cm_homepage_sections, :section_type, :integer, default: 0, null: false
+    add_column :cm_homepage_sections, :font, :string
+  end
+end

data/lib/spree_cm_commissioner/version.rb

@@ -1,5 +1,5 @@
 module SpreeCmCommissioner
-  VERSION = '2.14.4'.freeze
+  VERSION = '2.14.5'.freeze
 
   module_function
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_cm_commissioner
 version: !ruby/object:Gem::Version
-  version: 2.14.4
+  version: 2.14.5
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-26 00:00:00.000000000 Z
+date: 2026-10-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree
@@ -1475,6 +1475,7 @@ files:
 - app/mailers/spree_cm_commissioner/pin_code_mailer.rb
 - app/mailers/spree_cm_commissioner/team_invite_mailer.rb
 - app/models/.gitkeep
+- app/models/active_storage/variation_decorator.rb
 - app/models/blazer/query_decorator.rb
 - app/models/concerns/spree_cm_commissioner/audit_wrapper.rb
 - app/models/concerns/spree_cm_commissioner/event_metadata.rb
@@ -1612,7 +1613,9 @@ files:
 - app/models/spree_cm_commissioner/homepage_banner_app_image.rb
 - app/models/spree_cm_commissioner/homepage_banner_web_image.rb
 - app/models/spree_cm_commissioner/homepage_section.rb
+- app/models/spree_cm_commissioner/homepage_section_app_background.rb
 - app/models/spree_cm_commissioner/homepage_section_relatable.rb
+- app/models/spree_cm_commissioner/homepage_section_web_background.rb
 - app/models/spree_cm_commissioner/hotel_google_wallet.rb
 - app/models/spree_cm_commissioner/icon_decorator.rb
 - app/models/spree_cm_commissioner/id_card.rb
@@ -1998,6 +2001,7 @@ files:
 - app/overrides/spree/admin/taxons/_form/background_color_and_foreground_color.html.erb.deface
 - app/overrides/spree/admin/taxons/_form/check_in_flows.html.erb.deface
 - app/overrides/spree/admin/taxons/_form/custom_redirect_url.html.erb.deface
+- app/overrides/spree/admin/taxons/_form/enforce_waiting_room_session.html.erb.deface
 - app/overrides/spree/admin/taxons/_form/hide_video_banner.html.erb.deface
 - app/overrides/spree/admin/taxons/_form/kind_html.erb.deface
 - app/overrides/spree/admin/taxons/_form/live_stock_window_form_date.html.erb.deface
@@ -3766,6 +3770,7 @@ files:
 - db/migrate/20261013000001_add_hidden_and_presentation_to_spree_product_option_types.rb
 - db/migrate/20261013000002_move_hidden_from_spree_option_types_to_product_option_types.rb
 - db/migrate/20261016000001_add_index_to_spree_line_items_number.rb
+- db/migrate/20261021000001_add_section_type_to_cm_homepage_sections.rb
 - docker-compose.yml
 - docs/api/scoped-access-token-endpoints.md
 - docs/option_types/attr_types.md