spree_cm_commissioner 2.14.4 → 2.14.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e5317bd75c6057165a07eae82d0e30f986371767925346783242d8d12a0a8d24
-  data.tar.gz: b015f2bebfc1105dee65f7b4b22f63ee909b113541741f9dbc5ed48482ab4b04
+  metadata.gz: 743a7213a36a799ebd7d68c8e2a770a9a253b9ca9e544c53dc89114344c35eec
+  data.tar.gz: c9697afd92b4175c73c1291224522b4b56fdf4056da7c8b4f441b33f0c828af4
 SHA512:
-  metadata.gz: 7c59a388a335fcffdbb53ef8ebd470bf9b310a169ac8057ba6b464c6cef8e4ee6425cccfa5bfda366ea9c7fa89aaca854465c914521df040d460ba39994bd0b3
-  data.tar.gz: 0d8572c942886d56c1689ceb532e2d643f208d538dfb8fa40e21209198562dbe52fb7bb8a28f7573d0900407b8651421210eb4b99c6ea80aefa14b73677880c4
+  metadata.gz: 0bc416a5439a60e3daaa23cb031fee13bd2a5ab82795e05aa52005713bd27adf298f0b09ae793d7109f2b3b55bd8fd0b937d50323b3f53031c64217ad1396bff
+  data.tar.gz: '073149c66ec7fc0b4b32d0c9b76ee35c934a96e489ae68ca6116adc4b60f831dc4271dd696ce996dbe6f80cd1db2658d0ffdeabfc25630e238d9c7cff5301bbd'

data/.env.example

@@ -49,11 +49,17 @@ DISTANCE_SIGNING_KEY=hei********************VY
 
 # CDN cache durations (s-maxage, in seconds) for listed public APIs; client max-age is always 0, unlisted APIs are never CDN-cached
 # See: app/controllers/concerns/spree_cm_commissioner/content_cachable.rb
-CACHE_AUTO_INVALIDATION_DISABLED="" # Set to yes to disable CDN cache invalidation entirely (kill switch)
+CACHE_AUTO_INVALIDATION_DISABLED="" # Set to yes to stop automatic CDN cache invalidation on save (kill switch); a clear-cache click still sends one
 CACHE_SERIALIZER_DISABLED="" # Set to yes to turn off Spree's serializer record cache everywhere
 CACHE_STATIC_MAX_AGE=86400 # Static content (CMS pages) - 1 day
 CACHE_REALTIME_MAX_AGE=300 # Everything else listed (homepage, menus, products, events, vendors, trips, seat layouts, countries, provinces, guest card classes) - 5 minutes
 
+# Shared secret(s) CloudFront sends to the origin as the X-Origin-Verify custom header. When set, listed CDN-cacheable
+# APIs return 403 to requests without a matching header. Comma-separate two values while rotating. Leave blank to turn off.
+# Set only after every client reaches these APIs through CloudFront, or they get 403.
+CDN_ORIGIN_SECRETS=""
+CDN_ORIGIN_REPORT_ONLY="" # Set to yes to log unverified requests instead of refusing them (use before enforcing)
+
 # Batch size for processing maintenance tasks in app/jobs/spree_cm_commissioner/maintenance_tasks/orchestrate_job.rb
 MAINTENANCE_TASKS_BATCH_SIZE=100
 

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.14.4)
+    spree_cm_commissioner (2.14.6)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -5,9 +5,14 @@ module SpreeCmCommissioner
     extend ActiveSupport::Concern
 
     included do
+      # Prepended so a request that skipped the CDN is refused before any other callback hits the DB.
+      prepend_before_action :verify_cdn_origin!, if: :cdn_cacheable?
       after_action :set_cache_control_for_cdn
     end
 
+    # CloudFront sends this as an origin custom header; clients never see or send it.
+    CDN_ORIGIN_HEADER = 'X-Origin-Verify'.freeze
+
     # Every CDN-cached API, by full class name, with its GET actions and TTL tier. Anything not
     # listed keeps Rails' default `max-age=0, private, must-revalidate` and never reaches the CDN.
     #
@@ -69,14 +74,20 @@ module SpreeCmCommissioner
       'Spree::Api::V2::Tenant::VotingContestantsController' => { actions: %w[index].freeze, max_age: :fresh }
     }.freeze
 
-    # CDN (s-maxage) TTL, or nil for an unlisted controller. Override in a controller for a different one.
-    def shared_max_age
-      case cdn_cache_config&.dig(:max_age)
+    # Seconds for a TTL tier, or nil for none. Public so the clear-cache dialog can say how long an
+    # edit takes to show without a clear.
+    def self.cdn_max_age(tier)
+      case tier
       when :static then ENV.fetch('CACHE_STATIC_MAX_AGE', 1.day.to_i).to_i
       when :fresh then ENV.fetch('CACHE_REALTIME_MAX_AGE', 5.minutes.to_i).to_i
       end
     end
 
+    # CDN (s-maxage) TTL, or nil for an unlisted controller. Override in a controller for a different one.
+    def shared_max_age
+      ContentCachable.cdn_max_age(cdn_cache_config&.dig(:max_age))
+    end
+
     def cdn_cacheable?
       request.get? && cdn_cache_config.present? && cdn_cache_config[:actions].include?(action_name)
     end
@@ -92,8 +103,53 @@ module SpreeCmCommissioner
       response.headers['Cache-Control'] = "public, max-age=0, s-maxage=#{shared_max_age}"
     end
 
+    # Refuses a listed action when it did not come through CloudFront, so the CDN can't be skipped by
+    # calling the origin directly. Off while CDN_ORIGIN_SECRETS is unset. It takes a comma-separated
+    # list so a new secret can be added to CloudFront before the old one is dropped. With
+    # CDN_ORIGIN_REPORT_ONLY=yes it only logs, to find clients still calling the origin before enforcing.
+    def verify_cdn_origin!
+      return if cdn_origin_secrets.empty?
+      return if cdn_origin_verified?
+
+      provided = request.headers[CDN_ORIGIN_HEADER].to_s
+      if ENV['CDN_ORIGIN_REPORT_ONLY'] == 'yes'
+        CmAppLogger.log(
+          label: 'cdn_origin_unverified',
+          data: {
+            controller: self.class.name,
+            action: action_name,
+            path: request.path,
+            header_present: provided.present?,
+            via_cloudfront: request.headers['X-Amz-Cf-Id'].present?
+          }
+        )
+        return
+      end
+
+      head :forbidden
+    end
+
+    # True when CloudFront will cache this response, so a controller-level Rails.cache in front of it
+    # only stacks its TTL on CloudFront's and hands a stale body to the refetch that follows a
+    # CloudFront invalidation. Requires a matching secret, not just the header: a header any caller
+    # can set must not let them skip both caches and hit the query directly.
+    def served_to_cdn?
+      return @served_to_cdn if defined?(@served_to_cdn)
+
+      @served_to_cdn = cdn_cacheable? && cdn_origin_verified?
+    end
+
     private
 
+    def cdn_origin_verified?
+      provided = request.headers[CDN_ORIGIN_HEADER].to_s
+      cdn_origin_secrets.any? { |secret| ActiveSupport::SecurityUtils.secure_compare(provided, secret) }
+    end
+
+    def cdn_origin_secrets
+      ENV.fetch('CDN_ORIGIN_SECRETS', '').split(',').map(&:strip).compact_blank
+    end
+
     def cdn_cache_config
       CDN_CACHEABLE_ACTIONS[self.class.name.to_s]
     end

data/app/controllers/concerns/spree_cm_commissioner/waiting_room_authorization.rb

@@ -7,11 +7,30 @@ module SpreeCmCommissioner
     end
 
     def ensure_waiting_room_session_token
-      return if ENV['WAITING_ROOM_DISABLED'] == 'yes'
-      return if request_from_client?
+      return if waiting_room_disabled?
       return unless required_waiting_room_session?
+      return if active_waiting_room_session?
 
-      return if SpreeCmCommissioner::WaitingRoomSession.active.exists?(token: params[:waiting_room_session_token])
+      handle_waiting_room_session_token_error
+    end
+
+    # Product-based counterpart to the path-based check above, for draft-order endpoints: gating by
+    # path would hold every booking (hotel, transit, ...) behind the waiting room, while this only
+    # holds orders for products that opt in via Product#enforce_waiting_room_session?. Call it as a
+    # before_action on #create, next to ensure_anonymous_booking_allowed!.
+    #
+    # Products covered by the request's private sale link (`st`) are exempt: that buyer draws from a
+    # pool locked for them, not the public stock the queue is rationing. The exemption is per
+    # request, not per product — the same product is usually on public sale too.
+    #
+    # products: [Array<Spree::Product>] every distinct product referenced by this request.
+    def ensure_waiting_room_session!(products)
+      return if waiting_room_disabled?
+
+      private_sale_product_ids = waiting_room_private_sale&.product_ids || []
+      enforced = products.select(&:enforce_waiting_room_session?).reject { |product| private_sale_product_ids.include?(product.id) }
+      return if enforced.empty?
+      return if active_waiting_room_session?
 
       handle_waiting_room_session_token_error
     end
@@ -23,13 +42,27 @@ module SpreeCmCommissioner
       apis.any? { |prefix| request.path.start_with?(prefix) }
     end
 
-    # temporary disable session check from any client server requests.
-    def request_from_client?
-      request.headers['X-Cm-Api-Client-Version'].present?
-    end
-
     def handle_waiting_room_session_token_error
       render_error_payload(Spree.t(:invalid_session_token), 400)
     end
+
+    private
+
+    def waiting_room_disabled?
+      ENV['WAITING_ROOM_DISABLED'] == 'yes'
+    end
+
+    def active_waiting_room_session?
+      SpreeCmCommissioner::WaitingRoomSession.active.exists?(token: params[:waiting_room_session_token])
+    end
+
+    # Verified, not just present: a made-up `st` must not skip the queue, so a token that fails
+    # Authorize simply earns no exemption.
+    def waiting_room_private_sale
+      return if params[:st].blank?
+
+      result = SpreeCmCommissioner::PrivateSales::Authorize.call(token: params[:st], user: spree_current_user)
+      result.value if result.success?
+    end
   end
 end

data/app/controllers/spree/admin/api_caches_controller.rb

@@ -2,16 +2,16 @@ module Spree
   module Admin
     # Behind every admin clear-cache button (spree/admin/shared/_api_cache_button). Admin-only through
     # BaseController#authorize_admin, which checks :api_caches since there is no model class.
+    #
+    # Both actions take model and id, or no id to clear every record of model on one storefront:
+    # tenant_id for that tenant's API, none for the BookMe+ storefront.
     class ApiCachesController < Spree::Admin::BaseController
-      # POST /admin/api_caches/clear?model=Spree::Product&id=1, or without id to clear every record of
-      # model on one storefront: tenant_id for that tenant's API, none for the BookMe+ storefront.
+      before_action :load_tenant
+
       def clear
-        result = if params[:id].present?
-                   SpreeCmCommissioner::ApiCaches::Invalidate.call(model: params[:model], id: params[:id])
-                 else
-                   tenant = SpreeCmCommissioner::Tenant.find(params[:tenant_id]) if params[:tenant_id].present?
-                   SpreeCmCommissioner::ApiCaches::InvalidateAll.call(model: params[:model], tenant: tenant)
-                 end
+        result = SpreeCmCommissioner::ApiCaches::RequestClear.call(
+          model: params[:model], id: params[:id], tenant: @tenant, user: try_spree_current_user
+        )
 
         if result.success?
           flash[:success] = Spree.t(:clear_cache_requested)
@@ -21,6 +21,21 @@ module Spree
 
         redirect_back fallback_location: admin_root_path
       end
+
+      # The dialog's contents, loaded into spree/admin/api_caches/_dialog's frame by the button.
+      def show
+        result = SpreeCmCommissioner::ApiCaches::FetchDetails.call(model: params[:model], id: params[:id], tenant: @tenant)
+        raise ActiveRecord::RecordNotFound if result.failure?
+
+        @details = result.value
+        render layout: false
+      end
+
+      private
+
+      def load_tenant
+        @tenant = SpreeCmCommissioner::Tenant.find(params[:tenant_id]) if params[:tenant_id].present?
+      end
     end
   end
 end

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -4,6 +4,8 @@ module Spree
       helper SpreeCmCommissioner::Admin::HomepageSegmentHelper
 
       before_action :load_tenants, only: [:index]
+      before_action :reject_invalid_section_type, only: %i[create update]
+      before_action :build_assets, only: %i[create update]
 
       helper_method :selected_tenant
 
@@ -39,8 +41,62 @@ module Spree
         end
       end
 
+      def remove_app_background
+        remove_asset(@object.app_background)
+      end
+
+      def remove_web_background
+        remove_asset(@object.web_background)
+      end
+
       private
 
+      # Always redirects back to `edit` rather than re-rendering it on failure (unlike the
+      # sibling GuestCardClassesController#remove_asset) — this controller's `edit` action sets
+      # extra ivars (`@homepage_section_relatables`) that this action never loads, so rendering
+      # the template directly here would raise.
+      def remove_asset(asset)
+        if asset&.destroy
+          flash[:success] = Spree.t('notice_messages.icon_removed')
+        else
+          flash[:error] = Spree.t('errors.messages.cannot_remove_icon')
+        end
+
+        redirect_to edit_admin_homepage_feed_homepage_section_url(@object)
+      end
+
+      # Only `trending` sections use these assets; building them for another type would let a
+      # direct API call attach a background the form never shows and the model then has to
+      # discard on save (see HomepageSection#clear_non_trending_fields). Either way the raw
+      # upload must be pulled out of permitted_resource_params — left in place, it gets assigned
+      # straight to the has_one association by update_resource/create_resource, which raises
+      # ActiveRecord::AssociationTypeMismatch instead of being silently ignored.
+      def build_assets
+        unless trending_section?
+          permitted_resource_params.delete(:app_background)
+          permitted_resource_params.delete(:web_background)
+          return
+        end
+
+        @object.build_app_background(attachment: permitted_resource_params.delete(:app_background)) if permitted_resource_params[:app_background]
+        @object.build_web_background(attachment: permitted_resource_params.delete(:web_background)) if permitted_resource_params[:web_background]
+      end
+
+      def trending_section?
+        (permitted_resource_params[:section_type].presence || @object.section_type).to_s == 'trending'
+      end
+
+      # `enum section_type:` raises ArgumentError on assignment of an unrecognized value, which
+      # would otherwise 500 instead of a normal validation failure — strip it here and flash
+      # instead, before it ever reaches create_resource/update_resource's mass-assignment.
+      def reject_invalid_section_type
+        submitted = permitted_resource_params[:section_type]
+        return if submitted.blank? || SpreeCmCommissioner::HomepageSection.section_types.key?(submitted.to_s)
+
+        permitted_resource_params.delete(:section_type)
+        flash[:error] = Spree.t('errors.messages.invalid_section_type')
+      end
+
       def collection
         return @collection if defined?(@collection)
 
@@ -57,16 +113,18 @@ module Spree
         @collection = scoped.page(params[:page]).per(params[:per_page])
       end
 
-      # overrided
+      # overrided — memoized so `.delete()` in build_assets mutates the same hash instance
       def permitted_resource_params
+        return @permitted_resource_params if defined?(@permitted_resource_params)
+
         object_params = params[:spree_cm_commissioner_homepage_section]
         segment_value = helpers.calculate_segment_value(object_params)
         mini_app_value = helpers.calculate_mini_app_value(object_params)
 
-        params
-          .require(:spree_cm_commissioner_homepage_section)
-          .permit(:title, :description, :active, :preview)
-          .merge(segment: segment_value, mini_app: mini_app_value)
+        @permitted_resource_params = params
+                                     .require(:spree_cm_commissioner_homepage_section)
+                                     .permit(:title, :description, :active, :preview, :section_type, :font, :app_background, :web_background)
+                                     .merge(segment: segment_value, mini_app: mini_app_value)
       end
 
       # The storefront being viewed; no tenant in the URL means BookMe+. Also gates the mini app

data/app/controllers/spree/admin/homepage_section_relatable_controller.rb

@@ -1,6 +1,8 @@
 module Spree
   module Admin
     class HomepageSectionRelatableController < Spree::Admin::ResourceController
+      skip_before_action :load_resource, only: :sort_by_start_date
+
       def model_class
         SpreeCmCommissioner::HomepageSectionRelatable
       end
@@ -27,6 +29,28 @@ module Spree
       def permitted_resource_params
         params.require(object_name).permit(:homepage_section_id, :relatable_id, :relatable_type, :available_on, :discontinue_on)
       end
+
+      # One-shot bulk reorder: ranks taxon relatables with an event `from_date` ascending, keeps every other
+      # relatable (dateless taxons, products) at the bottom in its current relative order. Drag-and-drop remains
+      # available afterward and simply overwrites these positions again, same as it would after a manual reorder.
+      def sort_by_start_date
+        homepage_section = SpreeCmCommissioner::HomepageSection.find(params[:homepage_section_id])
+        relatables = homepage_section.homepage_section_relatables.includes(:relatable).to_a
+
+        dated, undated = relatables.partition { |relatable| relatable.relatable.is_a?(Spree::Taxon) && relatable.relatable.from_date.present? }
+        dated.sort_by! { |relatable| relatable.relatable.from_date }
+        undated.sort_by!(&:position)
+
+        SpreeCmCommissioner::HomepageSectionRelatable.transaction do
+          (dated + undated).each.with_index(1) do |relatable, position|
+            relatable.update_columns(position: position, updated_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
+          end
+        end
+        homepage_section.update_columns(updated_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
+
+        redirect_to edit_admin_homepage_feed_homepage_section_url(homepage_section),
+                    notice: Spree.t(:successfully_updated, resource: 'Homepage Section Relatable')
+      end
     end
   end
 end

data/app/controllers/spree/api/v2/organizer/invite_guests_controller.rb

@@ -20,7 +20,7 @@ module Spree
 
             if guest.save
               @invite_guest.update(claimed_status: :claimed) if @line_item.guests.count == @invite_guest.quantity
-              send_guest_claimed_invitation_telegram_alert_to_vendor(guest) if guest.event.vendor.preferred_telegram_chat_id.present?
+              send_guest_claimed_invitation_telegram_alert_to_vendor(guest)
 
               render json: SpreeCmCommissioner::V2::Storefront::GuestSerializer.new(guest.reload).serializable_hash
             else
@@ -32,7 +32,7 @@ module Spree
 
           def send_guest_claimed_invitation_telegram_alert_to_vendor(guest)
             title = '📣 --- [NEW GUEST CLAIMED INVITATION] ---' # Style/StringLiterals
-            chat_id = guest.event.vendor.preferred_telegram_chat_id
+            chat_id = guest.event.telegram_alert_chat_id || guest.event.vendor.preferred_telegram_chat_id
             return if chat_id.blank?
 
             factory = SpreeCmCommissioner::InviteGuestClaimedTelegramMessageFactory.new(

data/app/controllers/spree/api/v2/resource_controller_decorator.rb

@@ -10,6 +10,14 @@ module Spree
           base.attr_reader :schema
         end
 
+        # override: Spree wraps this in a Rails.cache.fetch keyed on ids + max updated_at (1h TTL),
+        # which goes stale when only an association changes. See ContentCachable#served_to_cdn?.
+        def index
+          return render_serialized_payload { serialize_collection(paginated_collection) } if served_to_cdn?
+
+          super
+        end
+
         def app_version
           request.headers['X-Cm-App-Version']
         end

data/app/controllers/spree/api/v2/storefront/draft_orders_controller.rb

@@ -8,6 +8,7 @@ module Spree
           include SpreeCmCommissioner::AnonymousBookingGuard
 
           before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
+          before_action -> { ensure_waiting_room_session!(draft_order_products) }, only: :create
 
           # A top-up credits a wallet, which must belong to a real user -- unlike #create,
           # this action has no guest-checkout path.
@@ -124,9 +125,12 @@ module Spree
             ).fetch(:line_items, [])
           end
 
+          # Memoized: both the anonymous-booking and waiting-room guards read it on the same request.
           def draft_order_products
-            variant_ids = draft_order_line_items.pluck(:variant_id).compact
-            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+            @draft_order_products ||= begin
+              variant_ids = draft_order_line_items.pluck(:variant_id).compact
+              Spree::Variant.where(id: variant_ids).includes(product: :event).map(&:product)
+            end
           end
 
           # override

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -23,6 +23,7 @@ module Spree
                                        .where(preview: false)
                                        .for_feed(params[:homepage_id] || :general, params[:mini_app])
                                        .order(position: :asc)
+                                       .includes(:app_background, :web_background)
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/invite_guests_controller.rb

@@ -32,7 +32,7 @@ module Spree
 
           def send_guest_claimed_invitation_telegram_alert_to_vendor(guest)
             title = '📣 --- [NEW GUEST CLAIMED INVITATION] ---' # Style/StringLiterals
-            chat_id = guest.event&.vendor&.preferred_telegram_chat_id
+            chat_id = guest.event&.telegram_alert_chat_id || guest.event&.vendor&.preferred_telegram_chat_id
             return if chat_id.blank?
 
             factory = SpreeCmCommissioner::InviteGuestClaimedTelegramMessageFactory.new(
@@ -97,7 +97,7 @@ module Spree
           def finalize_guest_claim(guest)
             if guest.save
               @invite_guest.update(claimed_status: :claimed) if @line_item.guests.count == @invite_guest.quantity
-              send_guest_claimed_invitation_telegram_alert_to_vendor(guest) if guest.event&.vendor&.preferred_telegram_chat_id.present?
+              send_guest_claimed_invitation_telegram_alert_to_vendor(guest)
 
               order = @invite_guest.order
               render_serialized_payload { serialize_resource(order) }

data/app/controllers/spree/api/v2/storefront/preview_sections_controller.rb

@@ -13,6 +13,7 @@ module Spree
                                        .where(preview: true)
                                        .where(id: SpreeCmCommissioner::HomepageSectionRelatable.section_ids_previewable_by(spree_current_user))
                                        .order(position: :asc)
+                                       .includes(:app_background, :web_background)
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/queue_draft_orders_controller.rb

@@ -9,6 +9,7 @@ module Spree
           include SpreeCmCommissioner::AnonymousBookingGuard
 
           before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
+          before_action -> { ensure_waiting_room_session!(draft_order_products) }, only: :create
 
           # Accepts a draft order request without building it: writes a queued Firestore status
           # document and schedules the real build (SpreeCmCommissioner::DraftOrders::Create) on a
@@ -59,9 +60,12 @@ module Spree
                   .fetch(:line_items, [])
           end
 
+          # Memoized: both the anonymous-booking and waiting-room guards read it on the same request.
           def draft_order_products
-            variant_ids = draft_order_line_items.pluck(:variant_id).compact
-            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+            @draft_order_products ||= begin
+              variant_ids = draft_order_line_items.pluck(:variant_id).compact
+              Spree::Variant.where(id: variant_ids).includes(product: :event).map(&:product)
+            end
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/trip_search_controller.rb

@@ -6,25 +6,30 @@ module Spree
           CACHE_EXPIRES_IN = 5.minutes
 
           def index
-            render_serialized_payload do
-              Rails.cache.fetch(collection_cache_key, collection_cache_opts) do
-                trips = SpreeCmCommissioner::TripQuery.new(
-                  origin_id: params[:origin_id],
-                  destination_id: params[:destination_id],
-                  date: params[:date],
-                  route_type: params[:route_type],
-                  vendor_id: params[:vendor_id],
-                  number_of_guests: params[:number_of_guests],
-                  options: params
-                ).call
+            # CloudFront already caches this action; see ContentCachable#served_to_cdn?.
+            return render_serialized_payload { search_and_serialize } if served_to_cdn?
 
-                serialize_collection(trips)
-              end
+            render_serialized_payload do
+              Rails.cache.fetch(collection_cache_key, collection_cache_opts) { search_and_serialize }
             end
           end
 
           private
 
+          def search_and_serialize
+            trips = SpreeCmCommissioner::TripQuery.new(
+              origin_id: params[:origin_id],
+              destination_id: params[:destination_id],
+              date: params[:date],
+              route_type: params[:route_type],
+              vendor_id: params[:vendor_id],
+              number_of_guests: params[:number_of_guests],
+              options: params
+            ).call
+
+            serialize_collection(trips)
+          end
+
           # override
           def collection_cache_key
             cache_key_parts = [

data/app/controllers/spree/api/v2/storefront/user_contacts_controller.rb

@@ -3,6 +3,8 @@ module Spree
     module V2
       module Storefront
         class UserContactsController < Spree::Api::V2::ResourceController
+          before_action :require_spree_current_user
+
           def update
             options = user_with_pin_code_params
 

data/app/controllers/spree/api/v2/tenant/draft_orders_controller.rb

@@ -6,6 +6,7 @@ module Spree
           include SpreeCmCommissioner::AnonymousBookingGuard
 
           before_action -> { ensure_anonymous_booking_allowed!(draft_order_products) }, only: :create
+          before_action -> { ensure_waiting_room_session!(draft_order_products) }, only: :create
 
           # A top-up credits a wallet, which must belong to a real user -- unlike #create,
           # this action has no guest-checkout path.
@@ -90,9 +91,12 @@ module Spree
                   .fetch(:line_items, [])
           end
 
+          # Memoized: both the anonymous-booking and waiting-room guards read it on the same request.
           def draft_order_products
-            variant_ids = draft_order_line_items.pluck(:variant_id).compact
-            Spree::Variant.where(id: variant_ids).includes(:product).map(&:product)
+            @draft_order_products ||= begin
+              variant_ids = draft_order_line_items.pluck(:variant_id).compact
+              Spree::Variant.where(id: variant_ids).includes(product: :event).map(&:product)
+            end
           end
 
           # override

data/app/controllers/spree/api/v2/tenant/homepage_sections_controller.rb

@@ -8,6 +8,7 @@ module Spree
                                  .where(preview: false)
                                  .active
                                  .order(position: :asc)
+                                 .includes(:app_background, :web_background)
           end
 
           def scope

data/app/controllers/spree/api/v2/tenant/preview_sections_controller.rb

@@ -12,6 +12,7 @@ module Spree
                                  .where(preview: true)
                                  .where(id: SpreeCmCommissioner::HomepageSectionRelatable.section_ids_previewable_by(spree_current_user))
                                  .order(position: :asc)
+                                 .includes(:app_background, :web_background)
           end
         end
       end

data/app/controllers/spree/api/v2/tenant/trip_search_controller.rb

@@ -6,25 +6,30 @@ module Spree
           CACHE_EXPIRES_IN = 5.minutes
 
           def index
-            render_serialized_payload do
-              Rails.cache.fetch(collection_cache_key, collection_cache_opts) do
-                trips = SpreeCmCommissioner::TripQuery.new(
-                  origin_id: params[:origin_id],
-                  destination_id: params[:destination_id],
-                  date: params[:date],
-                  route_type: params[:route_type],
-                  number_of_guests: params[:number_of_guests],
-                  tenant_id: @tenant.id,
-                  options: params
-                ).call
+            # CloudFront already caches this action; see ContentCachable#served_to_cdn?.
+            return render_serialized_payload { search_and_serialize } if served_to_cdn?
 
-                serialize_collection(trips)
-              end
+            render_serialized_payload do
+              Rails.cache.fetch(collection_cache_key, collection_cache_opts) { search_and_serialize }
             end
           end
 
           private
 
+          def search_and_serialize
+            trips = SpreeCmCommissioner::TripQuery.new(
+              origin_id: params[:origin_id],
+              destination_id: params[:destination_id],
+              date: params[:date],
+              route_type: params[:route_type],
+              number_of_guests: params[:number_of_guests],
+              tenant_id: @tenant.id,
+              options: params
+            ).call
+
+            serialize_collection(trips)
+          end
+
           # override
           def collection_cache_key
             cache_key_parts = [