spree_cm_commissioner 2.14.5 → 2.14.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f7720d10f3459b8933df3d2521bdce4983e03adf800dc852cb4e6f28d689f146
-  data.tar.gz: 746c1c6e7cc864f5555020ab15d21eeac2c601d6f7d6b0bcfa1bff0b9633bb77
+  metadata.gz: 743a7213a36a799ebd7d68c8e2a770a9a253b9ca9e544c53dc89114344c35eec
+  data.tar.gz: c9697afd92b4175c73c1291224522b4b56fdf4056da7c8b4f441b33f0c828af4
 SHA512:
-  metadata.gz: 504fa1a8ea3a50979c1c23e366713e6e6b10bfe38efb4e3a4019b3f5f8cefa35ec460fd8a8b013cd1324c4ead1359fdbc0b00a7c0b56e71bd606c294cf180c6c
-  data.tar.gz: 5d1d182cbd5f0538d5d281c1c401b7724fe1bc27e0f3c5009345493a8335aa6bae62ed9dea22af2fc52b07ac8bfc1e617953851cbcaf7c5823773536ef4651ae
+  metadata.gz: 0bc416a5439a60e3daaa23cb031fee13bd2a5ab82795e05aa52005713bd27adf298f0b09ae793d7109f2b3b55bd8fd0b937d50323b3f53031c64217ad1396bff
+  data.tar.gz: '073149c66ec7fc0b4b32d0c9b76ee35c934a96e489ae68ca6116adc4b60f831dc4271dd696ce996dbe6f80cd1db2658d0ffdeabfc25630e238d9c7cff5301bbd'

data/.env.example

@@ -49,7 +49,7 @@ DISTANCE_SIGNING_KEY=hei********************VY
 
 # CDN cache durations (s-maxage, in seconds) for listed public APIs; client max-age is always 0, unlisted APIs are never CDN-cached
 # See: app/controllers/concerns/spree_cm_commissioner/content_cachable.rb
-CACHE_AUTO_INVALIDATION_DISABLED="" # Set to yes to disable CDN cache invalidation entirely (kill switch)
+CACHE_AUTO_INVALIDATION_DISABLED="" # Set to yes to stop automatic CDN cache invalidation on save (kill switch); a clear-cache click still sends one
 CACHE_SERIALIZER_DISABLED="" # Set to yes to turn off Spree's serializer record cache everywhere
 CACHE_STATIC_MAX_AGE=86400 # Static content (CMS pages) - 1 day
 CACHE_REALTIME_MAX_AGE=300 # Everything else listed (homepage, menus, products, events, vendors, trips, seat layouts, countries, provinces, guest card classes) - 5 minutes

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.14.5)
+    spree_cm_commissioner (2.14.6)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -74,14 +74,20 @@ module SpreeCmCommissioner
       'Spree::Api::V2::Tenant::VotingContestantsController' => { actions: %w[index].freeze, max_age: :fresh }
     }.freeze
 
-    # CDN (s-maxage) TTL, or nil for an unlisted controller. Override in a controller for a different one.
-    def shared_max_age
-      case cdn_cache_config&.dig(:max_age)
+    # Seconds for a TTL tier, or nil for none. Public so the clear-cache dialog can say how long an
+    # edit takes to show without a clear.
+    def self.cdn_max_age(tier)
+      case tier
       when :static then ENV.fetch('CACHE_STATIC_MAX_AGE', 1.day.to_i).to_i
       when :fresh then ENV.fetch('CACHE_REALTIME_MAX_AGE', 5.minutes.to_i).to_i
       end
     end
 
+    # CDN (s-maxage) TTL, or nil for an unlisted controller. Override in a controller for a different one.
+    def shared_max_age
+      ContentCachable.cdn_max_age(cdn_cache_config&.dig(:max_age))
+    end
+
     def cdn_cacheable?
       request.get? && cdn_cache_config.present? && cdn_cache_config[:actions].include?(action_name)
     end
@@ -102,12 +108,10 @@ module SpreeCmCommissioner
     # list so a new secret can be added to CloudFront before the old one is dropped. With
     # CDN_ORIGIN_REPORT_ONLY=yes it only logs, to find clients still calling the origin before enforcing.
     def verify_cdn_origin!
-      secrets = ENV.fetch('CDN_ORIGIN_SECRETS', '').split(',').map(&:strip).compact_blank
-      return if secrets.empty?
+      return if cdn_origin_secrets.empty?
+      return if cdn_origin_verified?
 
       provided = request.headers[CDN_ORIGIN_HEADER].to_s
-      return if secrets.any? { |secret| ActiveSupport::SecurityUtils.secure_compare(provided, secret) }
-
       if ENV['CDN_ORIGIN_REPORT_ONLY'] == 'yes'
         CmAppLogger.log(
           label: 'cdn_origin_unverified',
@@ -125,8 +129,27 @@ module SpreeCmCommissioner
       head :forbidden
     end
 
+    # True when CloudFront will cache this response, so a controller-level Rails.cache in front of it
+    # only stacks its TTL on CloudFront's and hands a stale body to the refetch that follows a
+    # CloudFront invalidation. Requires a matching secret, not just the header: a header any caller
+    # can set must not let them skip both caches and hit the query directly.
+    def served_to_cdn?
+      return @served_to_cdn if defined?(@served_to_cdn)
+
+      @served_to_cdn = cdn_cacheable? && cdn_origin_verified?
+    end
+
     private
 
+    def cdn_origin_verified?
+      provided = request.headers[CDN_ORIGIN_HEADER].to_s
+      cdn_origin_secrets.any? { |secret| ActiveSupport::SecurityUtils.secure_compare(provided, secret) }
+    end
+
+    def cdn_origin_secrets
+      ENV.fetch('CDN_ORIGIN_SECRETS', '').split(',').map(&:strip).compact_blank
+    end
+
     def cdn_cache_config
       CDN_CACHEABLE_ACTIONS[self.class.name.to_s]
     end

data/app/controllers/spree/admin/api_caches_controller.rb

@@ -2,16 +2,16 @@ module Spree
   module Admin
     # Behind every admin clear-cache button (spree/admin/shared/_api_cache_button). Admin-only through
     # BaseController#authorize_admin, which checks :api_caches since there is no model class.
+    #
+    # Both actions take model and id, or no id to clear every record of model on one storefront:
+    # tenant_id for that tenant's API, none for the BookMe+ storefront.
     class ApiCachesController < Spree::Admin::BaseController
-      # POST /admin/api_caches/clear?model=Spree::Product&id=1, or without id to clear every record of
-      # model on one storefront: tenant_id for that tenant's API, none for the BookMe+ storefront.
+      before_action :load_tenant
+
       def clear
-        result = if params[:id].present?
-                   SpreeCmCommissioner::ApiCaches::Invalidate.call(model: params[:model], id: params[:id])
-                 else
-                   tenant = SpreeCmCommissioner::Tenant.find(params[:tenant_id]) if params[:tenant_id].present?
-                   SpreeCmCommissioner::ApiCaches::InvalidateAll.call(model: params[:model], tenant: tenant)
-                 end
+        result = SpreeCmCommissioner::ApiCaches::RequestClear.call(
+          model: params[:model], id: params[:id], tenant: @tenant, user: try_spree_current_user
+        )
 
         if result.success?
           flash[:success] = Spree.t(:clear_cache_requested)
@@ -21,6 +21,21 @@ module Spree
 
         redirect_back fallback_location: admin_root_path
       end
+
+      # The dialog's contents, loaded into spree/admin/api_caches/_dialog's frame by the button.
+      def show
+        result = SpreeCmCommissioner::ApiCaches::FetchDetails.call(model: params[:model], id: params[:id], tenant: @tenant)
+        raise ActiveRecord::RecordNotFound if result.failure?
+
+        @details = result.value
+        render layout: false
+      end
+
+      private
+
+      def load_tenant
+        @tenant = SpreeCmCommissioner::Tenant.find(params[:tenant_id]) if params[:tenant_id].present?
+      end
     end
   end
 end

data/app/controllers/spree/admin/homepage_section_relatable_controller.rb

@@ -1,6 +1,8 @@
 module Spree
   module Admin
     class HomepageSectionRelatableController < Spree::Admin::ResourceController
+      skip_before_action :load_resource, only: :sort_by_start_date
+
       def model_class
         SpreeCmCommissioner::HomepageSectionRelatable
       end
@@ -27,6 +29,28 @@ module Spree
       def permitted_resource_params
         params.require(object_name).permit(:homepage_section_id, :relatable_id, :relatable_type, :available_on, :discontinue_on)
       end
+
+      # One-shot bulk reorder: ranks taxon relatables with an event `from_date` ascending, keeps every other
+      # relatable (dateless taxons, products) at the bottom in its current relative order. Drag-and-drop remains
+      # available afterward and simply overwrites these positions again, same as it would after a manual reorder.
+      def sort_by_start_date
+        homepage_section = SpreeCmCommissioner::HomepageSection.find(params[:homepage_section_id])
+        relatables = homepage_section.homepage_section_relatables.includes(:relatable).to_a
+
+        dated, undated = relatables.partition { |relatable| relatable.relatable.is_a?(Spree::Taxon) && relatable.relatable.from_date.present? }
+        dated.sort_by! { |relatable| relatable.relatable.from_date }
+        undated.sort_by!(&:position)
+
+        SpreeCmCommissioner::HomepageSectionRelatable.transaction do
+          (dated + undated).each.with_index(1) do |relatable, position|
+            relatable.update_columns(position: position, updated_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
+          end
+        end
+        homepage_section.update_columns(updated_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
+
+        redirect_to edit_admin_homepage_feed_homepage_section_url(homepage_section),
+                    notice: Spree.t(:successfully_updated, resource: 'Homepage Section Relatable')
+      end
     end
   end
 end

data/app/controllers/spree/api/v2/organizer/invite_guests_controller.rb

@@ -20,7 +20,7 @@ module Spree
 
             if guest.save
               @invite_guest.update(claimed_status: :claimed) if @line_item.guests.count == @invite_guest.quantity
-              send_guest_claimed_invitation_telegram_alert_to_vendor(guest) if guest.event.vendor.preferred_telegram_chat_id.present?
+              send_guest_claimed_invitation_telegram_alert_to_vendor(guest)
 
               render json: SpreeCmCommissioner::V2::Storefront::GuestSerializer.new(guest.reload).serializable_hash
             else
@@ -32,7 +32,7 @@ module Spree
 
           def send_guest_claimed_invitation_telegram_alert_to_vendor(guest)
             title = '📣 --- [NEW GUEST CLAIMED INVITATION] ---' # Style/StringLiterals
-            chat_id = guest.event.vendor.preferred_telegram_chat_id
+            chat_id = guest.event.telegram_alert_chat_id || guest.event.vendor.preferred_telegram_chat_id
             return if chat_id.blank?
 
             factory = SpreeCmCommissioner::InviteGuestClaimedTelegramMessageFactory.new(

data/app/controllers/spree/api/v2/resource_controller_decorator.rb

@@ -10,6 +10,14 @@ module Spree
           base.attr_reader :schema
         end
 
+        # override: Spree wraps this in a Rails.cache.fetch keyed on ids + max updated_at (1h TTL),
+        # which goes stale when only an association changes. See ContentCachable#served_to_cdn?.
+        def index
+          return render_serialized_payload { serialize_collection(paginated_collection) } if served_to_cdn?
+
+          super
+        end
+
         def app_version
           request.headers['X-Cm-App-Version']
         end

data/app/controllers/spree/api/v2/storefront/invite_guests_controller.rb

@@ -32,7 +32,7 @@ module Spree
 
           def send_guest_claimed_invitation_telegram_alert_to_vendor(guest)
             title = '📣 --- [NEW GUEST CLAIMED INVITATION] ---' # Style/StringLiterals
-            chat_id = guest.event&.vendor&.preferred_telegram_chat_id
+            chat_id = guest.event&.telegram_alert_chat_id || guest.event&.vendor&.preferred_telegram_chat_id
             return if chat_id.blank?
 
             factory = SpreeCmCommissioner::InviteGuestClaimedTelegramMessageFactory.new(
@@ -97,7 +97,7 @@ module Spree
           def finalize_guest_claim(guest)
             if guest.save
               @invite_guest.update(claimed_status: :claimed) if @line_item.guests.count == @invite_guest.quantity
-              send_guest_claimed_invitation_telegram_alert_to_vendor(guest) if guest.event&.vendor&.preferred_telegram_chat_id.present?
+              send_guest_claimed_invitation_telegram_alert_to_vendor(guest)
 
               order = @invite_guest.order
               render_serialized_payload { serialize_resource(order) }

data/app/controllers/spree/api/v2/storefront/trip_search_controller.rb

@@ -6,25 +6,30 @@ module Spree
           CACHE_EXPIRES_IN = 5.minutes
 
           def index
-            render_serialized_payload do
-              Rails.cache.fetch(collection_cache_key, collection_cache_opts) do
-                trips = SpreeCmCommissioner::TripQuery.new(
-                  origin_id: params[:origin_id],
-                  destination_id: params[:destination_id],
-                  date: params[:date],
-                  route_type: params[:route_type],
-                  vendor_id: params[:vendor_id],
-                  number_of_guests: params[:number_of_guests],
-                  options: params
-                ).call
+            # CloudFront already caches this action; see ContentCachable#served_to_cdn?.
+            return render_serialized_payload { search_and_serialize } if served_to_cdn?
 
-                serialize_collection(trips)
-              end
+            render_serialized_payload do
+              Rails.cache.fetch(collection_cache_key, collection_cache_opts) { search_and_serialize }
             end
           end
 
           private
 
+          def search_and_serialize
+            trips = SpreeCmCommissioner::TripQuery.new(
+              origin_id: params[:origin_id],
+              destination_id: params[:destination_id],
+              date: params[:date],
+              route_type: params[:route_type],
+              vendor_id: params[:vendor_id],
+              number_of_guests: params[:number_of_guests],
+              options: params
+            ).call
+
+            serialize_collection(trips)
+          end
+
           # override
           def collection_cache_key
             cache_key_parts = [

data/app/controllers/spree/api/v2/storefront/user_contacts_controller.rb

@@ -3,6 +3,8 @@ module Spree
     module V2
       module Storefront
         class UserContactsController < Spree::Api::V2::ResourceController
+          before_action :require_spree_current_user
+
           def update
             options = user_with_pin_code_params
 

data/app/controllers/spree/api/v2/tenant/trip_search_controller.rb

@@ -6,25 +6,30 @@ module Spree
           CACHE_EXPIRES_IN = 5.minutes
 
           def index
-            render_serialized_payload do
-              Rails.cache.fetch(collection_cache_key, collection_cache_opts) do
-                trips = SpreeCmCommissioner::TripQuery.new(
-                  origin_id: params[:origin_id],
-                  destination_id: params[:destination_id],
-                  date: params[:date],
-                  route_type: params[:route_type],
-                  number_of_guests: params[:number_of_guests],
-                  tenant_id: @tenant.id,
-                  options: params
-                ).call
+            # CloudFront already caches this action; see ContentCachable#served_to_cdn?.
+            return render_serialized_payload { search_and_serialize } if served_to_cdn?
 
-                serialize_collection(trips)
-              end
+            render_serialized_payload do
+              Rails.cache.fetch(collection_cache_key, collection_cache_opts) { search_and_serialize }
             end
           end
 
           private
 
+          def search_and_serialize
+            trips = SpreeCmCommissioner::TripQuery.new(
+              origin_id: params[:origin_id],
+              destination_id: params[:destination_id],
+              date: params[:date],
+              route_type: params[:route_type],
+              number_of_guests: params[:number_of_guests],
+              tenant_id: @tenant.id,
+              options: params
+            ).call
+
+            serialize_collection(trips)
+          end
+
           # override
           def collection_cache_key
             cache_key_parts = [

data/app/factory/spree_cm_commissioner/order_telegram_message_factory.rb

@@ -26,15 +26,19 @@ module SpreeCmCommissioner
   class OrderTelegramMessageFactory < TelegramMessageFactory # rubocop:disable Metrics/ClassLength
     attr_reader :order, :vendor, :show_details_link
 
-    def initialize(title:, order:, subtitle: nil, show_details_link: nil, vendor: nil)
+    # `line_items` narrows the message to an explicit subset and wins over `vendor`: an event with its own
+    # group takes its items out of the vendor's message, so neither message is simply "all vendor items".
+    def initialize(title:, order:, subtitle: nil, show_details_link: nil, vendor: nil, line_items: nil) # rubocop:disable Metrics/ParameterLists
       @order = order
       @vendor = vendor
+      @line_items = line_items
       @show_details_link = show_details_link || false
 
       super(title: title, subtitle: subtitle)
     end
 
     def selected_line_items
+      return @line_items if @line_items
       return order.line_items.for_vendor(vendor) if vendor.present?
 
       order.line_items

data/app/helpers/spree_cm_commissioner/admin/homepage_segment_helper.rb

@@ -43,8 +43,36 @@ module SpreeCmCommissioner
         calculate_bitwise_value(params, SpreeCmCommissioner::HomepageSectionBitwise::BIT_MINI_APP)
       end
 
+      # Only event-kind taxons carry `from_date`/`to_date` (see TaxonDecorator); plain category taxons and
+      # products return nil here so the caller can fall back to a placeholder.
+      def homepage_section_relatable_event_dates(section_relatable)
+        taxon = section_relatable.relatable
+        return unless taxon.is_a?(Spree::Taxon) && taxon.from_date.present?
+
+        range = taxon.to_date.present? ? "#{pretty_date(taxon.from_date)} – #{pretty_date(taxon.to_date)}" : pretty_date(taxon.from_date)
+        safe_join([content_tag(:div, range), content_tag(:small, event_date_status_label(taxon), class: 'text-muted')])
+      end
+
       private
 
+      # Date-only (no time-of-day/timezone), unlike `pretty_time` — a list column scanned for date ranges
+      # doesn't need per-row clock precision, and the full timestamp roughly doubled this column's width.
+      def pretty_date(time)
+        time.to_date.strftime('%d %B %Y')
+      end
+
+      def event_date_status_label(taxon)
+        now = Time.current
+
+        if taxon.from_date > now
+          "Starts in #{distance_of_time_in_words(now, taxon.from_date)}"
+        elsif taxon.to_date.present? && taxon.to_date > now
+          "Ongoing · ends in #{distance_of_time_in_words(now, taxon.to_date)}"
+        else
+          "Ended #{distance_of_time_in_words(now, taxon.to_date || taxon.from_date)} ago"
+        end
+      end
+
       # Sums the checked boxes into one integer. Keyed by name, not position, so a checkbox the
       # form omits cannot shift the rest onto the wrong bits. Returns 0, never nil: `value & bit`
       # raises on NULL.

data/app/interactors/spree_cm_commissioner/account_recover.rb

@@ -18,8 +18,7 @@ module SpreeCmCommissioner
         context.user = Spree.user_class.find_user_by_login(login, tenant_id)
       # get social user
       elsif id_token.present?
-        checker_context = SpreeCmCommissioner::UserIdTokenChecker.call(id_token: id_token)
-        context.user = checker_context.user
+        context.user = id_token_user
       end
 
       if context.user.present?
@@ -28,5 +27,27 @@ module SpreeCmCommissioner
         context.fail!(message: 'User is not valid')
       end
     end
+
+    def id_token_user
+      if telegram_id_token?
+        result = SpreeCmCommissioner::Telegram::CheckIdToken.call(
+          id_token: id_token,
+          client_id: SpreeCmCommissioner::Telegram::VerifyOauthIdToken.client_id_for(tenant_id),
+          tenant_id: tenant_id
+        )
+        result.value[:user] if result.success?
+      else
+        SpreeCmCommissioner::UserIdTokenChecker.call(id_token: id_token).user
+      end
+    end
+
+    # The app sends Telegram OIDC tokens here as `id_token` too. The unverified `iss` only picks the
+    # checker; CheckIdToken still verifies the signature, issuer, audience and expiry before trusting it.
+    def telegram_id_token?
+      payload = JWT.decode(id_token, nil, false).first
+      payload.is_a?(Hash) && payload['iss'] == SpreeCmCommissioner::Telegram::VerifyOauthIdToken::ISSUER
+    rescue JWT::DecodeError
+      false
+    end
   end
 end

data/app/interactors/spree_cm_commissioner/firebase_id_token_provider.rb

@@ -84,9 +84,13 @@ module SpreeCmCommissioner
 
       return nil if claim.nil?
 
-      provider_name = claim['firebase']['sign_in_provider']
+      # A non-Firebase token (e.g. a Telegram OIDC id_token, or a crafted non-object payload)
+      # has no `firebase` section.
+      provider_name = claim.dig('firebase', 'sign_in_provider') if claim.is_a?(Hash)
+      context.fail!(message: I18n.t('firebase_id_token.failure')) if provider_name.blank?
+
       user_id = claim['user_id']
-      sub = claim['firebase']['identities'][provider_name].first
+      sub = claim.dig('firebase', 'identities', provider_name)&.first
       email = claim['email'] || get_user_email(user_id)
       name = claim['name']
 

data/app/interactors/spree_cm_commissioner/telegram_chats_auto_finder.rb

@@ -1,6 +1,9 @@
 module SpreeCmCommissioner
   class TelegramChatsAutoFinder < BaseInteractor
-    delegate :contact, :pin_code, to: :context
+    # Pass `event:` to connect that event's alert group instead of the vendor's (contact is then
+    # the event id). Event mode writes only the event's metadata: no vendor preference and no
+    # vendor-owned TelegramChat row.
+    delegate :contact, :pin_code, :event, to: :context
 
     def call
       context.chats = []
@@ -59,6 +62,8 @@ module SpreeCmCommissioner
       pin_code_record = find_pin_code_record
       return unless pin_code_record
 
+      return connect_event(message, chat_id, pin_code_record) if event
+
       vendor = find_vendor
       return unless vendor
 
@@ -73,7 +78,8 @@ module SpreeCmCommissioner
     end
 
     def find_pin_code_record
-      pin_code_record = SpreeCmCommissioner::PinCodeTelegram.find_by(code: pin_code, contact: contact)
+      pin_code_class = event ? SpreeCmCommissioner::PinCodeEventTelegram : SpreeCmCommissioner::PinCodeTelegram
+      pin_code_record = pin_code_class.find_by(code: pin_code, contact: contact)
       unless pin_code_record
         context.fail!(message: "Pin code #{pin_code} not found for contact #{contact}")
         return nil
@@ -114,6 +120,24 @@ module SpreeCmCommissioner
       context.verified_chat_ids << chat.chat_id
     end
 
+    def connect_event(message, chat_id, pin_code_record)
+      title = message.dig('chat', 'title') || 'Unnamed Chat'
+
+      unless event.update(telegram_alert_chat_id: chat_id.to_s, telegram_alert_chat_name: title,
+                          telegram_alert_chat_type: message.dig('chat', 'type')
+      )
+        context.fail!(message: "Failed to connect event: #{event.errors.full_messages.join(', ')}")
+        return
+      end
+
+      context.chats << { id: chat_id, title: title, type: message.dig('chat', 'type') }
+      expire_pin_code(pin_code_record)
+      send_message(chat_id, "✅ PIN code verified successfully! This chat is now connected to <b>#{CGI.escapeHTML(event.name.to_s)}</b>.\n\n" \
+                            'Completed orders for this event will be sent to this chat.'
+      )
+      context.verified_chat_ids << chat_id
+    end
+
     def update_vendor_preferences(vendor, chat)
       vendor.update(
         preferred_telegram_chat_id: chat.chat_id,

data/app/interactors/spree_cm_commissioner/telegram_chats_finder.rb

@@ -11,7 +11,7 @@ module SpreeCmCommissioner
       updates['result'].filter_map do |update|
         chat = update.dig('my_chat_member', 'chat')
 
-        if chat.present? && chat['title'] == telegram_chat_name.strip && chat['type'] == telegram_chat_type
+        if chat.present? && chat['title'] == telegram_chat_name.to_s.strip && chat['type'] == telegram_chat_type
           return {
             id: chat['id'],
             title: chat['title'],

data/app/interactors/spree_cm_commissioner/user_telegram_oauth_authenticator.rb

@@ -22,22 +22,13 @@ module SpreeCmCommissioner
     private
 
     def verified_provider
-      result = SpreeCmCommissioner::Telegram::VerifyOauthIdToken.call(id_token: id_token, client_id: telegram_client_id)
+      client_id = SpreeCmCommissioner::Telegram::VerifyOauthIdToken.client_id_for(tenant_id)
+      result = SpreeCmCommissioner::Telegram::VerifyOauthIdToken.call(id_token: id_token, client_id: client_id)
       context.fail!(message: result.error.to_s) unless result.success?
 
       result.value[:provider]
     end
 
-    # Each tenant runs its own Telegram bot, so the audience an id_token must
-    # carry is looked up on the tenant directly - no default-store or ENV
-    # fallback, so a misconfigured tenant fails loudly instead of silently
-    # authenticating against someone else's bot.
-    def telegram_client_id
-      return Spree::Store.default.preferred_telegram_oauth_client_id if tenant_id.blank?
-
-      SpreeCmCommissioner::Tenant.find_by(id: tenant_id)&.preferred_telegram_oauth_client_id
-    end
-
     def find_or_register_user(provider)
       identity_checker = SpreeCmCommissioner::UserIdentityChecker.call(
         identity_type: provider[:identity_type],

data/app/models/concerns/spree_cm_commissioner/order_state_machine.rb

@@ -345,19 +345,7 @@ module SpreeCmCommissioner
     end
 
     def send_order_complete_telegram_alert_to_vendors
-      return unless telegram_alert_enabled?
-
-      vendor_list.each do |vendor|
-        # `next`, not `return`: the mask is per-vendor, so one opted-out vendor on a
-        # multi-vendor order must not suppress the others.
-        next unless vendor.alerts_telegram_for_channel?(channel_key)
-
-        chat_id = vendor.preferred_telegram_chat_id
-        next if chat_id.blank?
-
-        factory = OrderTelegramMessageFactory.new(title: vendor_alert_title(vendor), order: self, vendor: vendor)
-        TelegramNotificationSenderJob.perform_later(chat_id: chat_id, message: factory.message, parse_mode: factory.parse_mode)
-      end
+      SpreeCmCommissioner::TelegramAlerts::SendTelegramOrderAlerts.call(order: self)
     end
 
     # White-label vendors announce their own brand; platform vendors stay BookMe+.