spree_cm_commissioner 2.14.4 → 2.14.6

data/app/factory/spree_cm_commissioner/order_telegram_message_factory.rb

@@ -26,15 +26,19 @@ module SpreeCmCommissioner
   class OrderTelegramMessageFactory < TelegramMessageFactory # rubocop:disable Metrics/ClassLength
     attr_reader :order, :vendor, :show_details_link
 
-    def initialize(title:, order:, subtitle: nil, show_details_link: nil, vendor: nil)
+    # `line_items` narrows the message to an explicit subset and wins over `vendor`: an event with its own
+    # group takes its items out of the vendor's message, so neither message is simply "all vendor items".
+    def initialize(title:, order:, subtitle: nil, show_details_link: nil, vendor: nil, line_items: nil) # rubocop:disable Metrics/ParameterLists
       @order = order
       @vendor = vendor
+      @line_items = line_items
       @show_details_link = show_details_link || false
 
       super(title: title, subtitle: subtitle)
     end
 
     def selected_line_items
+      return @line_items if @line_items
       return order.line_items.for_vendor(vendor) if vendor.present?
 
       order.line_items

data/app/helpers/spree_cm_commissioner/admin/homepage_segment_helper.rb

@@ -43,8 +43,36 @@ module SpreeCmCommissioner
         calculate_bitwise_value(params, SpreeCmCommissioner::HomepageSectionBitwise::BIT_MINI_APP)
       end
 
+      # Only event-kind taxons carry `from_date`/`to_date` (see TaxonDecorator); plain category taxons and
+      # products return nil here so the caller can fall back to a placeholder.
+      def homepage_section_relatable_event_dates(section_relatable)
+        taxon = section_relatable.relatable
+        return unless taxon.is_a?(Spree::Taxon) && taxon.from_date.present?
+
+        range = taxon.to_date.present? ? "#{pretty_date(taxon.from_date)} – #{pretty_date(taxon.to_date)}" : pretty_date(taxon.from_date)
+        safe_join([content_tag(:div, range), content_tag(:small, event_date_status_label(taxon), class: 'text-muted')])
+      end
+
       private
 
+      # Date-only (no time-of-day/timezone), unlike `pretty_time` — a list column scanned for date ranges
+      # doesn't need per-row clock precision, and the full timestamp roughly doubled this column's width.
+      def pretty_date(time)
+        time.to_date.strftime('%d %B %Y')
+      end
+
+      def event_date_status_label(taxon)
+        now = Time.current
+
+        if taxon.from_date > now
+          "Starts in #{distance_of_time_in_words(now, taxon.from_date)}"
+        elsif taxon.to_date.present? && taxon.to_date > now
+          "Ongoing · ends in #{distance_of_time_in_words(now, taxon.to_date)}"
+        else
+          "Ended #{distance_of_time_in_words(now, taxon.to_date || taxon.from_date)} ago"
+        end
+      end
+
       # Sums the checked boxes into one integer. Keyed by name, not position, so a checkbox the
       # form omits cannot shift the rest onto the wrong bits. Returns 0, never nil: `value & bit`
       # raises on NULL.

data/app/interactors/spree_cm_commissioner/account_recover.rb

@@ -18,8 +18,7 @@ module SpreeCmCommissioner
         context.user = Spree.user_class.find_user_by_login(login, tenant_id)
       # get social user
       elsif id_token.present?
-        checker_context = SpreeCmCommissioner::UserIdTokenChecker.call(id_token: id_token)
-        context.user = checker_context.user
+        context.user = id_token_user
       end
 
       if context.user.present?
@@ -28,5 +27,27 @@ module SpreeCmCommissioner
         context.fail!(message: 'User is not valid')
       end
     end
+
+    def id_token_user
+      if telegram_id_token?
+        result = SpreeCmCommissioner::Telegram::CheckIdToken.call(
+          id_token: id_token,
+          client_id: SpreeCmCommissioner::Telegram::VerifyOauthIdToken.client_id_for(tenant_id),
+          tenant_id: tenant_id
+        )
+        result.value[:user] if result.success?
+      else
+        SpreeCmCommissioner::UserIdTokenChecker.call(id_token: id_token).user
+      end
+    end
+
+    # The app sends Telegram OIDC tokens here as `id_token` too. The unverified `iss` only picks the
+    # checker; CheckIdToken still verifies the signature, issuer, audience and expiry before trusting it.
+    def telegram_id_token?
+      payload = JWT.decode(id_token, nil, false).first
+      payload.is_a?(Hash) && payload['iss'] == SpreeCmCommissioner::Telegram::VerifyOauthIdToken::ISSUER
+    rescue JWT::DecodeError
+      false
+    end
   end
 end

data/app/interactors/spree_cm_commissioner/firebase_id_token_provider.rb

@@ -84,9 +84,13 @@ module SpreeCmCommissioner
 
       return nil if claim.nil?
 
-      provider_name = claim['firebase']['sign_in_provider']
+      # A non-Firebase token (e.g. a Telegram OIDC id_token, or a crafted non-object payload)
+      # has no `firebase` section.
+      provider_name = claim.dig('firebase', 'sign_in_provider') if claim.is_a?(Hash)
+      context.fail!(message: I18n.t('firebase_id_token.failure')) if provider_name.blank?
+
       user_id = claim['user_id']
-      sub = claim['firebase']['identities'][provider_name].first
+      sub = claim.dig('firebase', 'identities', provider_name)&.first
       email = claim['email'] || get_user_email(user_id)
       name = claim['name']
 

data/app/interactors/spree_cm_commissioner/telegram_chats_auto_finder.rb

@@ -1,6 +1,9 @@
 module SpreeCmCommissioner
   class TelegramChatsAutoFinder < BaseInteractor
-    delegate :contact, :pin_code, to: :context
+    # Pass `event:` to connect that event's alert group instead of the vendor's (contact is then
+    # the event id). Event mode writes only the event's metadata: no vendor preference and no
+    # vendor-owned TelegramChat row.
+    delegate :contact, :pin_code, :event, to: :context
 
     def call
       context.chats = []
@@ -59,6 +62,8 @@ module SpreeCmCommissioner
       pin_code_record = find_pin_code_record
       return unless pin_code_record
 
+      return connect_event(message, chat_id, pin_code_record) if event
+
       vendor = find_vendor
       return unless vendor
 
@@ -73,7 +78,8 @@ module SpreeCmCommissioner
     end
 
     def find_pin_code_record
-      pin_code_record = SpreeCmCommissioner::PinCodeTelegram.find_by(code: pin_code, contact: contact)
+      pin_code_class = event ? SpreeCmCommissioner::PinCodeEventTelegram : SpreeCmCommissioner::PinCodeTelegram
+      pin_code_record = pin_code_class.find_by(code: pin_code, contact: contact)
       unless pin_code_record
         context.fail!(message: "Pin code #{pin_code} not found for contact #{contact}")
         return nil
@@ -114,6 +120,24 @@ module SpreeCmCommissioner
       context.verified_chat_ids << chat.chat_id
     end
 
+    def connect_event(message, chat_id, pin_code_record)
+      title = message.dig('chat', 'title') || 'Unnamed Chat'
+
+      unless event.update(telegram_alert_chat_id: chat_id.to_s, telegram_alert_chat_name: title,
+                          telegram_alert_chat_type: message.dig('chat', 'type')
+      )
+        context.fail!(message: "Failed to connect event: #{event.errors.full_messages.join(', ')}")
+        return
+      end
+
+      context.chats << { id: chat_id, title: title, type: message.dig('chat', 'type') }
+      expire_pin_code(pin_code_record)
+      send_message(chat_id, "✅ PIN code verified successfully! This chat is now connected to <b>#{CGI.escapeHTML(event.name.to_s)}</b>.\n\n" \
+                            'Completed orders for this event will be sent to this chat.'
+      )
+      context.verified_chat_ids << chat_id
+    end
+
     def update_vendor_preferences(vendor, chat)
       vendor.update(
         preferred_telegram_chat_id: chat.chat_id,

data/app/interactors/spree_cm_commissioner/telegram_chats_finder.rb

@@ -11,7 +11,7 @@ module SpreeCmCommissioner
       updates['result'].filter_map do |update|
         chat = update.dig('my_chat_member', 'chat')
 
-        if chat.present? && chat['title'] == telegram_chat_name.strip && chat['type'] == telegram_chat_type
+        if chat.present? && chat['title'] == telegram_chat_name.to_s.strip && chat['type'] == telegram_chat_type
           return {
             id: chat['id'],
             title: chat['title'],

data/app/interactors/spree_cm_commissioner/user_telegram_oauth_authenticator.rb

@@ -22,22 +22,13 @@ module SpreeCmCommissioner
     private
 
     def verified_provider
-      result = SpreeCmCommissioner::Telegram::VerifyOauthIdToken.call(id_token: id_token, client_id: telegram_client_id)
+      client_id = SpreeCmCommissioner::Telegram::VerifyOauthIdToken.client_id_for(tenant_id)
+      result = SpreeCmCommissioner::Telegram::VerifyOauthIdToken.call(id_token: id_token, client_id: client_id)
       context.fail!(message: result.error.to_s) unless result.success?
 
       result.value[:provider]
     end
 
-    # Each tenant runs its own Telegram bot, so the audience an id_token must
-    # carry is looked up on the tenant directly - no default-store or ENV
-    # fallback, so a misconfigured tenant fails loudly instead of silently
-    # authenticating against someone else's bot.
-    def telegram_client_id
-      return Spree::Store.default.preferred_telegram_oauth_client_id if tenant_id.blank?
-
-      SpreeCmCommissioner::Tenant.find_by(id: tenant_id)&.preferred_telegram_oauth_client_id
-    end
-
     def find_or_register_user(provider)
       identity_checker = SpreeCmCommissioner::UserIdentityChecker.call(
         identity_type: provider[:identity_type],

data/app/models/active_storage/variation_decorator.rb

@@ -0,0 +1,18 @@
+module ActiveStorage
+  module VariationDecorator
+    # ActiveStorage reuses a JPEG upload's own extension as the variant format, but libvips
+    # picks its encoder from the output extension and rejects aliases like `.jfif`
+    # ("is not a known file format"). Mapping here rather than renaming blobs also fixes
+    # variant URLs already handed out, since their signed key embeds `format: "jfif"`.
+    JPEG_FORMAT_ALIASES = %w[jfif jpe].freeze
+
+    def format
+      format = super
+      JPEG_FORMAT_ALIASES.include?(format.to_s.downcase) ? 'jpg' : format
+    end
+  end
+end
+
+unless ActiveStorage::Variation.ancestors.include?(ActiveStorage::VariationDecorator)
+  ActiveStorage::Variation.prepend(ActiveStorage::VariationDecorator)
+end

data/app/models/concerns/spree_cm_commissioner/event_metadata.rb

@@ -18,6 +18,10 @@ module SpreeCmCommissioner
       # For certain large events, admin can disable this manually.
       store_public_metadata :allow_manual_search_for_operator, :boolean, default: true
 
+      # Requires an active waiting-room session to create a draft order for this event's products
+      # (Product#enforce_waiting_room_session?). Server-only switch, so private.
+      store_private_metadata :enforce_waiting_room_session, :boolean, default: false
+
       # ⚠️  CRITICAL: Cached seat layout IDs kept in sync by SeatLayout callback.
       # If callback is removed/modified without updating this, availability checks will fail.
       #

data/app/models/concerns/spree_cm_commissioner/order_holdable.rb

@@ -4,8 +4,9 @@ module SpreeCmCommissioner
 
     included do
       # Store the earliest expiration time across all holds (seats + inventory)
-      # in `public_metadata[:hold_expires_at]`. This is used only for UI display
-      # (e.g., a countdown timer) and does not control the release logic.
+      # in `public_metadata[:hold_expires_at]`. This is used for UI display
+      # (e.g., a countdown timer) and by LineItems::ValidatePurchaseLimits to count an
+      # unpaid cart against the buyer's caps; it does not control the release logic.
       # Each hold is released independently when its own expiration time is reached.
       store_public_metadata :hold_expires_at, :datetime
 

data/app/models/concerns/spree_cm_commissioner/order_state_machine.rb

@@ -7,6 +7,7 @@ module SpreeCmCommissioner
     included do # rubocop:disable Metrics/BlockLength
       after_commit :clear_has_incomplete_guest_info_cache, on: %i[create update]
 
+      state_machine.before_transition to: :address, do: :ensure_within_purchase_limits
       state_machine.before_transition to: :address, do: :hold_order_holds
 
       # Same transitions core calls create_tax_charge! from (gems/core/app/models/spree/order/checkout.rb,
@@ -107,6 +108,22 @@ module SpreeCmCommissioner
       end
     end
 
+    # Line items are only validated when they change, so a cart sent back to `cart` (hold
+    # released) and advanced again would skip the purchase-limit check and could be held next to
+    # another cart the buyer opened meanwhile. Runs before hold_order_holds so a rejection never
+    # leaves a hold behind.
+    def ensure_within_purchase_limits
+      line_items.each do |line_item|
+        result = SpreeCmCommissioner::LineItems::ValidatePurchaseLimits.call(line_item: line_item)
+        next if result.success?
+
+        errors.add(:base, result.error.to_s)
+        return false
+      end
+
+      true
+    end
+
     # Best-effort, like apply_prepaid_payment!'s other callers: a user with no (or no
     # currency-matching) store credit just doesn't get a payment here, and the app can still
     # remove/reapply it afterwards through the existing checkout store-credit endpoints.
@@ -328,19 +345,7 @@ module SpreeCmCommissioner
     end
 
     def send_order_complete_telegram_alert_to_vendors
-      return unless telegram_alert_enabled?
-
-      vendor_list.each do |vendor|
-        # `next`, not `return`: the mask is per-vendor, so one opted-out vendor on a
-        # multi-vendor order must not suppress the others.
-        next unless vendor.alerts_telegram_for_channel?(channel_key)
-
-        chat_id = vendor.preferred_telegram_chat_id
-        next if chat_id.blank?
-
-        factory = OrderTelegramMessageFactory.new(title: vendor_alert_title(vendor), order: self, vendor: vendor)
-        TelegramNotificationSenderJob.perform_later(chat_id: chat_id, message: factory.message, parse_mode: factory.parse_mode)
-      end
+      SpreeCmCommissioner::TelegramAlerts::SendTelegramOrderAlerts.call(order: self)
     end
 
     # White-label vendors announce their own brand; platform vendors stay BookMe+.

data/app/models/spree_cm_commissioner/homepage_section.rb

@@ -10,10 +10,26 @@ module SpreeCmCommissioner
     attribute :segment, :integer, default: 0
     attribute :mini_app, :integer, default: 0
 
+    enum section_type: { default: 0, trending: 1, big_banner: 2 }
+
     self.whitelisted_ransackable_attributes = %w[title active]
 
     has_many :homepage_section_relatables, -> { active }, inverse_of: :homepage_section, dependent: :destroy
 
+    has_one :app_background, as: :viewable, dependent: :destroy, class_name: 'SpreeCmCommissioner::HomepageSectionAppBackground'
+    has_one :web_background, as: :viewable, dependent: :destroy, class_name: 'SpreeCmCommissioner::HomepageSectionWebBackground'
+
+    # `font`/backgrounds only apply to `trending` sections. The admin form only hides those
+    # fields via JS when another type is picked — it doesn't clear them — and a direct API call
+    # could set them on any type, so normalize here rather than relying on the form. A hard
+    # validation would instead reject the common "switch an existing trending section back to
+    # default" edit, since the hidden `font` field still submits its stale value.
+    #
+    # Guarded beyond `unless: :trending?` so a routine save of an already-default/big_banner
+    # section (the steady-state case) skips the `app_background`/`web_background` association
+    # loads entirely instead of querying them on every save forever.
+    before_save :clear_non_trending_fields, if: :clear_non_trending_fields?
+
     scope :active, lambda {
       where(active: true)
         .joins(:homepage_section_relatables)
@@ -47,5 +63,22 @@ module SpreeCmCommissioner
 
     # Create maintaining task to purge homepage section related caches
     after_save { SpreeCmCommissioner::MaintenanceTasks::CacheInvalidation.pending.create_or_find_by(maintainable: self) }
+
+    private
+
+    # `.target` (not `.loaded?`) so this only fires for a background actually built/loaded in
+    # memory on *this* save. `.loaded?` stays true forever once an object has been saved once
+    # with the association touched, even after the target is nil'd out by a prior destroy —
+    # which made every later save of that same in-memory record re-run the clear unnecessarily.
+    def clear_non_trending_fields?
+      !trending? && (font.present? || section_type_changed? ||
+        association(:app_background).target.present? || association(:web_background).target.present?)
+    end
+
+    def clear_non_trending_fields
+      self.font = nil
+      app_background&.destroy
+      web_background&.destroy
+    end
   end
 end

data/app/models/spree_cm_commissioner/homepage_section_app_background.rb

@@ -0,0 +1,13 @@
+module SpreeCmCommissioner
+  class HomepageSectionAppBackground < Asset
+    # 3:2 — taller than 16:9 so the image fills a `trending` card's full height instead of
+    # letterboxing. `medium` (960x640) is the upload target; `mini`/`small` are downscaled copies.
+    def asset_styles
+      {
+        mini: '160x107>',
+        small: '480x320>',
+        medium: '960x640>'
+      }
+    end
+  end
+end

data/app/models/spree_cm_commissioner/homepage_section_web_background.rb

@@ -0,0 +1,13 @@
+module SpreeCmCommissioner
+  class HomepageSectionWebBackground < Asset
+    # 5:1 — wide and short so the image spans a `trending` banner's full width without pushing
+    # page content down. `medium` (1440x288) is the upload target; `mini`/`small` are downscaled copies.
+    def asset_styles
+      {
+        mini: '160x32>',
+        small: '720x144>',
+        medium: '1440x288>'
+      }
+    end
+  end
+end

data/app/models/spree_cm_commissioner/maintenance_tasks/cache_invalidation.rb

@@ -1,30 +1,114 @@
-# Class for invalidating cache across all models.
+# One CloudFront invalidation, queued automatically on save (debounced by OrchestrateJob) or by a
+# clear-cache click (ApiCaches::RequestClear), and kept as the record's clear-cache history.
+#
+# A clear-all (every record of a model on one storefront, ApiCaches::InvalidateAll) is a task too,
+# so it is queued, deduplicated and shown in the clear-cache dialog's history like any other clear,
+# and counts towards its cooldown. It has no record of its own, so its maintainable is the
+# storefront it clears: the SpreeCmCommissioner::Tenant, or the default Spree::Store for BookMe+'s.
+# Clear-alls of every model share that maintainable, so the model is stored (invalidation_model).
 module SpreeCmCommissioner
   module MaintenanceTasks
     class CacheInvalidation < MaintenanceTask
+      OUTCOMES = %w[sent skipped failed].freeze
+      STOREFRONT_TYPES = %w[SpreeCmCommissioner::Tenant Spree::Store].freeze
+
+      store_private_metadata :triggered_by_id, :integer
+      store_private_metadata :outcome, :string
+      store_private_metadata :invalidation_model, :string
+
+      # For finding the invalidation in the AWS console.
+      store_private_metadata :cloudfront_invalidation_id, :string
+
       def maintain
-        if ENV['CACHE_AUTO_INVALIDATION_DISABLED'] == 'yes'
-          log_invalidation('skipped: CACHE_AUTO_INVALIDATION_DISABLED')
+        # The switch is for automatic invalidations only; a click is someone asking for one now.
+        if ENV['CACHE_AUTO_INVALIDATION_DISABLED'] == 'yes' && !manually_triggered?
+          record_outcome('skipped', message: 'CACHE_AUTO_INVALIDATION_DISABLED')
           return
         end
 
-        result = SpreeCmCommissioner::ApiCaches::Invalidate.call(model: maintainable.class.name, id: maintainable.id)
+        result = refresh_records
+        return record_failure(result.error.to_s) if result.failure?
 
-        if result.success?
-          log_invalidation('sent', patterns: result.value[:api_patterns])
-        else
-          log_invalidation("failed: #{result.error}")
+        patterns = result.value[:api_patterns]
+
+        # CloudFront rejects an empty batch, e.g. homepage backgrounds on a tenant's API.
+        return record_outcome('skipped', message: 'no API serves it on this storefront') if patterns.empty?
+
+        send_invalidation(patterns)
+      end
+
+      # The task's maintainable for a clear of model: the record with id, or for a clear-all (no id)
+      # the storefront, see above. nil for anything that can't be cleared.
+      def self.maintainable_for(model:, id: nil, tenant: nil)
+        if id.present?
+          SpreeCmCommissioner::ApiCaches::Invalidate::SUPPORTED_MODELS[model]&.find_by(id: id)
+        elsif SpreeCmCommissioner::ApiCaches::InvalidateAll::API_PATTERNS.key?(model)
+          tenant || Spree::Store.default
+        end
+      end
+
+      # Only a clear-all hangs off a storefront rather than the record it clears.
+      def invalidate_all?
+        STOREFRONT_TYPES.include?(maintainable_type)
+      end
+
+      def target_model
+        invalidation_model.presence || maintainable.class.name
+      end
+
+      # :queued until the job runs, and :failed once it has used up its retries.
+      def clear_status
+        return attempt_count >= MAX_ATTEMPTS ? :failed : :queued if completed_at.nil?
+
+        case outcome.presence || legacy_outcome
+        when 'sent' then :sent
+        when 'skipped' then :skipped
+        else :failed
         end
       end
 
       private
 
+      def refresh_records
+        if invalidate_all?
+          tenant = maintainable if maintainable.is_a?(SpreeCmCommissioner::Tenant)
+          SpreeCmCommissioner::ApiCaches::InvalidateAll.call(model: target_model, tenant: tenant)
+        else
+          SpreeCmCommissioner::ApiCaches::Invalidate.call(model: target_model, id: maintainable_id)
+        end
+      end
+
+      # Synchronous, since this already runs in ProcessJob, so the task only says sent once CloudFront
+      # has accepted it. Errors other than CloudFront's own refusal raise, so the task is retried.
+      def send_invalidation(patterns)
+        request = SpreeCmCommissioner::InvalidateCacheRequest.call(patterns: patterns)
+        return record_failure(request.message) if request.failure?
+
+        self.cloudfront_invalidation_id = request.response.invalidation.id
+        record_outcome('sent', message: patterns.join(', '))
+      end
+
+      # Tasks completed before `outcome` was stored only have it in their log line.
+      def legacy_outcome
+        track_messages.reverse_each do |message|
+          match = message.match(/\AInvalidation (\w+)/)
+          return match[1] if match && OUTCOMES.include?(match[1])
+        end
+        nil
+      end
+
+      def record_failure(error)
+        self.last_error = error
+        record_outcome('failed', message: error)
+      end
+
       # Each path costs money on CloudFront, so every outcome is logged and kept on the task for troubleshooting.
-      def log_invalidation(outcome, patterns: [])
-        log_run("Invalidation #{outcome} #{patterns.join(', ')}".strip)
+      def record_outcome(outcome, message:)
+        self.outcome = outcome
+        log_run("Invalidation #{outcome}: #{message}")
         CmAppLogger.log(
           label: "#{self.class.name} #{outcome}",
-          data: { maintenance_task_id: id, maintainable_type: maintainable_type, maintainable_id: maintainable_id, patterns: patterns }
+          data: { maintenance_task_id: id, maintainable_type: maintainable_type, maintainable_id: maintainable_id, message: message }
         )
       end
     end

data/app/models/spree_cm_commissioner/pin_code.rb

@@ -139,7 +139,8 @@ module SpreeCmCommissioner
         'SpreeCmCommissioner::PinCodeUpdateUserLogin' => I18n.t('pincode.readable_type.update_user_login'),
         'SpreeCmCommissioner::PinCodeEmailConfirm' => I18n.t('pincode.readable_type.confirmation_code'),
         'SpreeCmCommissioner::PinCodeOtp' => I18n.t('pincode.readable_type.otp_code'),
-        'SpreeCmCommissioner::PinCodeTelegram' => I18n.t('pincode.readable_type.telegram_verification')
+        'SpreeCmCommissioner::PinCodeTelegram' => I18n.t('pincode.readable_type.telegram_verification'),
+        'SpreeCmCommissioner::PinCodeEventTelegram' => I18n.t('pincode.readable_type.telegram_verification')
       }
     end
 

data/app/models/spree_cm_commissioner/pin_code_event_telegram.rb

@@ -0,0 +1,31 @@
+module SpreeCmCommissioner
+  # PIN for connecting an event's order-alert Telegram group; `contact` is the event (Spree::Taxon) id.
+  # Not a PinCodeTelegram subclass on purpose: STI queries on PinCodeTelegram would then also return
+  # these rows, and an event id equal to a vendor id would surface as that vendor's PIN.
+  class PinCodeEventTelegram < PinCode
+    before_validation :set_telegram_attrs, on: :create
+    validates :contact, presence: true, numericality: { only_integer: true }
+
+    belongs_to :event, class_name: 'Spree::Taxon', foreign_key: 'contact', primary_key: 'id'
+
+    def telegram?
+      true
+    end
+
+    def expires_in_seconds
+      5 * 60
+    end
+
+    def expired?
+      expired_at < Time.zone.now
+    end
+
+    private
+
+    def set_telegram_attrs
+      self.contact_type = :telegram
+      self.type = 'SpreeCmCommissioner::PinCodeEventTelegram'
+      self.expired_at = Time.zone.now + expires_in_seconds unless expired_at
+    end
+  end
+end

data/app/models/spree_cm_commissioner/product_decorator.rb

@@ -222,6 +222,13 @@ module SpreeCmCommissioner
       end
     end
 
+    # Configured once on the event rather than per ticket product. Other product types (trips,
+    # rooms, ...) that need it later resolve their own source here; the draft-order guard
+    # (WaitingRoomAuthorization#ensure_waiting_room_session!) only ever asks the product.
+    def enforce_waiting_room_session?
+      event&.enforce_waiting_room_session? || false
+    end
+
     # Not yet on sale. Kept separate from available? so a scheduled product's real stock still
     # shows via in_stock? — Stock::AvailabilityValidatorDecorator checks this to block add-to-cart.
     def scheduled?

data/app/models/spree_cm_commissioner/service_calendar.rb

@@ -33,13 +33,13 @@ module SpreeCmCommissioner
       end
     end
 
-    private
-
     def set_dates
       self.start_date = Date.new(2000, 1, 1) if start_date.blank?
       self.end_date   = Date.new(2100, 1, 1) if end_date.blank?
     end
 
+    private
+
     def in_weekly_service?(date)
       day_name = date.strftime('%A').downcase
       send(day_name.to_sym)

data/app/models/spree_cm_commissioner/taxon_decorator.rb

@@ -51,6 +51,13 @@ module SpreeCmCommissioner
 
       base.store_public_metadata :live_stock_path, :string
 
+      # The event's own order-alert Telegram group, connected from the organizer event page. When set,
+      # this event's line items alert here instead of the vendor's group. Private so the chat id never
+      # reaches storefront serializers.
+      base.store_private_metadata :telegram_alert_chat_id, :string
+      base.store_private_metadata :telegram_alert_chat_name, :string
+      base.store_private_metadata :telegram_alert_chat_type, :string
+
       base.before_save :set_kind
       base.before_save :set_slug
       base.before_save :normalize_custom_redirect_url

data/app/models/spree_cm_commissioner/vendor_decorator.rb

@@ -253,6 +253,12 @@ module SpreeCmCommissioner
       "#{Spree::Store.default.formatted_url}/organizers/#{slug}"
     end
 
+    def find_event_by_id(event_id: nil)
+      return nil if event_id.blank?
+
+      taxons.events.find_by(slug: "events-#{event_id}")
+    end
+
     # Deep links to the public hotel detail page with a default 1-room/2-adult, 2-night search
     # pre-filled — same query params the storefront's hotel page reads (see cm-market-client's
     # JsonLd::HotelRequest), so "View Profile" previews the real booking page instead of the

data/app/overrides/spree/admin/taxons/_form/enforce_waiting_room_session.html.erb.deface

@@ -0,0 +1,10 @@
+<!-- insert_before "erb[loud]:contains('field_container :hide_from_nav')" -->
+
+<%= f.field_container :enforce_waiting_room_session, class: ['custom-control', 'custom-checkbox', 'my-4'] do %>
+  <%= f.check_box :enforce_waiting_room_session, class: 'custom-control-input' %>
+  <%= f.label :enforce_waiting_room_session, Spree.t(:enforce_waiting_room_session), class: 'custom-control-label' %>
+  <%= f.error_message_on :enforce_waiting_room_session %>
+  <small class="form-text text-muted">
+    <%= Spree.t(:enforce_waiting_room_session_hint) %>
+  </small>
+<% end if @taxon.event? && @taxon.depth == 1 %> %>