spree_cm_commissioner 2.14.6 → 2.14.8

data/app/models/spree_cm_commissioner/integrations/book_me_bus_v1.rb

@@ -6,6 +6,7 @@ class SpreeCmCommissioner::Integrations::BookMeBusV1 < SpreeCmCommissioner::Inte
   store_private_metadata :access_token, :string
   store_private_metadata :token_expires_at, :datetime
   store_private_metadata :operator_id, :string
+  store_private_metadata :sync_days, :integer, default: 7
   # override
   def sync_manager
     SpreeCmCommissioner::Integrations::BookMeBusV1::SyncManager.new(integration: self)

data/app/models/spree_cm_commissioner/order_decorator.rb

@@ -190,6 +190,17 @@ module SpreeCmCommissioner
       super
     end
 
+    # Must live here, not in OrderStateMachine: that concern is included (below Spree::Order),
+    # while Spree::Emails::OrderDecorator is prepended above it and never calls super, so an
+    # override there is silently dead.
+    def deliver_order_confirmation_email
+      return if requested?
+      return if any_app_only_products?
+      return if products.none?(&:enable_confirmation_email?)
+
+      super
+    end
+
     def any_app_only_products?
       if products.loaded?
         products.any?(&:purchasable_on_app?)

data/app/models/spree_cm_commissioner/product_decorator.rb

@@ -143,6 +143,7 @@ module SpreeCmCommissioner
       base.store_public_metadata :enable_inventory_hold, :boolean, default: false
       base.store_public_metadata :enable_telegram_alert, :boolean, default: true
       base.store_public_metadata :enable_send_receipt, :boolean, default: true
+      base.store_public_metadata :enable_confirmation_email, :boolean, default: true
       base.store_public_metadata :enable_social_sharing_email, :boolean, default: false
 
       base.store_private_metadata :advertise_weight, :integer, default: 1
@@ -169,6 +170,9 @@ module SpreeCmCommissioner
       base.belongs_to :tenant, class_name: 'SpreeCmCommissioner::Tenant'
       base.before_save :set_tenant
 
+      # Included after set_tenant so its before_save sees the resolved tenant_id.
+      base.include SpreeCmCommissioner::SalesChannelBitwise
+
       # Create maintaining task to purge product related caches
       base.after_save { SpreeCmCommissioner::MaintenanceTasks::CacheInvalidation.pending.create_or_find_by(maintainable: self) }
 

data/app/models/spree_cm_commissioner/s3_presigned_url.rb

@@ -11,25 +11,26 @@ module SpreeCmCommissioner
       URI.parse(url).host
     end
 
-    def initialize(bucket_name, object_key, uuid = nil)
+    # content_length_range: [Range, nil] byte range S3 enforces on the upload itself; nil means no limit.
+    def initialize(bucket_name, object_key, uuid = nil, content_length_range: nil)
       @id = uuid.presence || generate_secure_random
 
       if object_key.blank?
         @error_message = I18n.t('s3_signed_url.missing_file_name')
       else
-        @s3_direct_post = presigned_post(bucket_name, object_key)
+        @s3_direct_post = presigned_post(bucket_name, object_key, content_length_range)
       end
     end
 
     private
 
-    def presigned_post(bucket_name, object_key)
+    def presigned_post(bucket_name, object_key, content_length_range)
+      options = { key: object_key, success_action_status: '201' }
+      options[:content_length_range] = content_length_range if content_length_range
+
       Aws::S3::Resource.new
                        .bucket(bucket_name)
-                       .presigned_post(
-                         key: object_key,
-                         success_action_status: '201'
-                       )
+                       .presigned_post(**options)
     end
 
     def generate_secure_random

data/app/models/spree_cm_commissioner/s3_presigned_url_builder.rb

@@ -6,13 +6,15 @@ module SpreeCmCommissioner
       new(options).call
     end
 
-    # {:bucket_name?, (:object_key | :file_name)? }
+    # {:bucket_name?, (:object_key | :file_name)?, :content_length_range? }
+    # bucket_name/object_key are for trusted server-side callers only (admin media uploads); API
+    # controllers must pass just file_name, so callers can only write under uploads/<uuid>/.
     def initialize(options)
       @options = options
     end
 
     def call
-      SpreeCmCommissioner::S3PresignedUrl.new(bucket_name, object_key, uuid)
+      SpreeCmCommissioner::S3PresignedUrl.new(bucket_name, object_key, uuid, content_length_range: options[:content_length_range])
     end
 
     private
@@ -20,7 +22,11 @@ module SpreeCmCommissioner
     def object_key
       return options[:object_key] if options[:object_key].present?
 
-      "uploads/#{uuid}/#{options[:file_name]}"
+      # basename so a file_name like "../x" or "a/b" can't move the key out of its uuid folder.
+      file_name = File.basename(options[:file_name].to_s)
+      return nil if file_name.blank? || %w[. .. /].include?(file_name)
+
+      "uploads/#{uuid}/#{file_name}"
     end
 
     def bucket_name

data/app/models/spree_cm_commissioner/tenant.rb

@@ -21,6 +21,9 @@ module SpreeCmCommissioner
                              allow_blank: true,
                              format: { without: %r{\Ahttps?://}, message: :format }
 
+    # The slug is the first segment of /api/v2/:tenant_slug/..., so it must not shadow a v2 namespace.
+    validates :slug, exclusion: { in: SpreeCmCommissioner::TenantSlugConstraint::RESERVED_SLUGS }
+
     validates :sms_sender_id, length: { maximum: 11 }, allow_blank: true
 
     validates :default_currency, inclusion: { in: -> (tenant) { tenant.supported_currencies_list } }, allow_blank: true

data/app/models/spree_cm_commissioner/user_profile.rb

@@ -1,5 +1,7 @@
 module SpreeCmCommissioner
   class UserProfile < Asset
+    include SpreeCmCommissioner::UserUploadedImage
+
     protected
 
     def asset_styles

data/app/overrides/spree/admin/products/_form/enable_confirmation_email.html.erb.deface

@@ -0,0 +1,13 @@
+<!-- insert_after "[data-hook='admin_product_form_promotionable']" -->
+
+<div>
+  <%= f.field_container :enable_confirmation_email do %>
+    <%= f.label :enable_confirmation_email do %>
+      <%= f.check_box :enable_confirmation_email %>
+      <%= Spree.t(:enable_confirmation_email) %>
+    <% end %>
+    <small class="form-text text-muted">
+      When enabled, customers receive the booking confirmation email after their order is completed.
+    </small>
+  <% end %>
+</div>

data/app/overrides/spree/admin/products/_form/sellable_on_platform.html.erb.deface

@@ -0,0 +1,12 @@
+<!-- insert_after "[data-hook='admin_product_form_promotionable']" -->
+
+<%# BookMe+'s own products are always sold on the platform, so only tenant products get the choice. %>
+<% if f.object.vendor&.tenant_id.present? %>
+  <div data-hook="admin_product_form_sellable_on_platform">
+    <%= f.field_container :sellable_on_platform do %>
+      <%= f.check_box :sellable_on_platform %>
+      <%= f.label :sellable_on_platform, 'Also sell on BookMe+' %>
+      <%= f.error_message_on :sales_channel %>
+    <% end %>
+  </div>
+<% end %>

data/app/serializers/spree/v2/storefront/taxon_serializer_decorator.rb

@@ -4,7 +4,10 @@ module Spree
       module TaxonSerializerDecorator
         def self.prepended(base)
           base.has_many :vendors, serializer: ::Spree::V2::Storefront::VendorSerializer
-          base.has_many :visible_products, serializer: ::Spree::V2::Storefront::ProductSerializer
+          # The app lists an event section's tickets from this relation, so products a tenant keeps off BookMe+ are dropped here.
+          base.has_many :visible_products, serializer: ::Spree::V2::Storefront::ProductSerializer do |taxon|
+            taxon.visible_products.sellable_on(:platform)
+          end
           base.has_many :places, serializer: ::Spree::V2::Storefront::PlaceSerializer
 
           base.has_one :vendor, serializer: ::Spree::V2::Storefront::VendorSerializer

data/app/services/spree_cm_commissioner/api_caches/invalidate.rb

@@ -4,13 +4,13 @@ module SpreeCmCommissioner
     # MaintenanceTasks::CacheInvalidation sends. Every record of a model goes through InvalidateAll.
     #
     # Only the record's own storefront is cleared, as InvalidateAll does: its tenant's API
-    # (/api/v2/tenant/ paths) when it belongs to a tenant, the BookMe+ storefront otherwise. Each path
-    # is billed, and the other storefront's copy, if anything ever fetched one, expires within a CDN
-    # TTL anyway.
+    # (/api/v2/<tenant slug>/ paths) when it belongs to a tenant, the BookMe+ storefront otherwise.
+    # Each path is billed, and the other storefront's copy, if anything ever fetched one, expires
+    # within a CDN TTL anyway. Legacy /api/v2/tenant/ paths are never CDN-cached, so never cleared.
     class Invalidate
       prepend ::Spree::ServiceModule::Base
 
-      TENANT_PREFIX = '/api/v2/tenant/'.freeze
+      TENANT_PREFIX = '/api/v2/:tenant_slug/'.freeze
 
       SUPPORTED_MODELS = {
         'SpreeCmCommissioner::HomepageSection' => SpreeCmCommissioner::HomepageSection,
@@ -30,7 +30,7 @@ module SpreeCmCommissioner
       # path per BIT_SEGMENT key.
       HOMEPAGE_SECTION_PATTERNS = [
         '/api/v2/storefront/homepage*',
-        '/api/v2/tenant/homepage*'
+        '/api/v2/:tenant_slug/homepage*'
       ].freeze
 
       HOMEPAGE_BACKGROUND_PATTERNS = ['/api/v2/storefront/homepage*'].freeze
@@ -42,12 +42,13 @@ module SpreeCmCommissioner
       # which vendors are affected.
       #
       # vendor_id is a query param, so the trailing `*` is what clears every
-      # vendor's cached variant of this path in one go.
+      # vendor's cached variant of this path in one go. CloudFront allows `*` only at the end, so the
+      # tenant path expands to one path per tenant.
       #
       # Payment methods change a handful of times a year, so a broad invalidation
       # is cheap.
       PAYMENT_METHOD_PATTERNS = [
-        '/api/v2/tenant/payment_methods*',
+        '/api/v2/:tenant_slug/payment_methods*',
         '/api/v2/storefront/payment_methods*'
       ].freeze
 
@@ -60,7 +61,7 @@ module SpreeCmCommissioner
         invalidate_single_record(model_class: model_class, id: id)
       end
 
-      # eg. 'Spree::Product', 123 => ['/api/v2/tenant/products/123', '/api/v2/tenant/products/slug-of-product', ...]
+      # eg. 'Spree::Product', 123 => ['/api/v2/hangmeas/products/123*', '/api/v2/hangmeas/products/slug-of-product*']
       def invalidate_single_record(model_class:, id:)
         return failure(nil, "#{model_class.name} ID is required") if id.blank?
 
@@ -79,17 +80,27 @@ module SpreeCmCommissioner
         # The record's own class first (a Show found as a Spree::Taxon keeps its show paths), then the
         # model asked for, since STI subclasses such as Spree::Gateway::Payway have no entry of their own.
         patterns = single_api_pattern[record.class.name] || single_api_pattern[model_class.name]
-        return patterns if patterns.equal?(PAYMENT_METHOD_PATTERNS)
+        return expand_tenant_slug(patterns, SpreeCmCommissioner::Tenant.pluck(:slug)) if patterns.equal?(PAYMENT_METHOD_PATTERNS)
 
         tenant = tenant_of(record)
         patterns.select { |pattern| pattern.start_with?(TENANT_PREFIX) == tenant.present? }.map do |pattern|
           pattern.gsub(/:(\w+)/) do
             key = Regexp.last_match(1)
-            record.public_send(key).to_s
+            key == 'tenant_slug' ? tenant.slug : record.public_send(key).to_s
           end
         end
       end
 
+      # One copy of each `:tenant_slug` pattern per tenant; storefront patterns pass through as is.
+      def expand_tenant_slug(patterns, slugs)
+        slugs = slugs.compact_blank
+        patterns.flat_map do |pattern|
+          next [pattern] unless pattern.start_with?(TENANT_PREFIX)
+
+          slugs.map { |slug| pattern.sub(':tenant_slug', slug) }
+        end
+      end
+
       # A product, vendor or homepage section has its own tenant; a taxon, show or voting session has
       # its vendor's. Menus, seat layouts and homepage backgrounds are BookMe+ only.
       def tenant_of(record)
@@ -106,23 +117,23 @@ module SpreeCmCommissioner
           # The app reads menus from homepage_data; nothing calls /menus any more.
           'Spree::Menu' => ['/api/v2/storefront/homepage_data*'],
           'Spree::Taxon' => [
-            '/api/v2/tenant/taxons/:id*',
-            '/api/v2/tenant/taxons/:permalink*',
+            '/api/v2/:tenant_slug/taxons/:id*',
+            '/api/v2/:tenant_slug/taxons/:permalink*',
             '/api/v2/storefront/taxons/:id*',
             '/api/v2/storefront/taxons/:permalink*'
           ],
           'Spree::Product' => [
-            '/api/v2/tenant/products/:id*',
-            '/api/v2/tenant/products/:slug*',
+            '/api/v2/:tenant_slug/products/:id*',
+            '/api/v2/:tenant_slug/products/:slug*',
             '/api/v2/storefront/products/:id*',
             '/api/v2/storefront/products/:slug*'
           ],
-          'SpreeCmCommissioner::Show' => ['/api/v2/tenant/shows/:slug*'],
+          'SpreeCmCommissioner::Show' => ['/api/v2/:tenant_slug/shows/:slug*'],
           'SpreeCmCommissioner::VotingSession' => [
-            '/api/v2/tenant/voting_sessions/:id/voting_contestants*'
+            '/api/v2/:tenant_slug/voting_sessions/:id/voting_contestants*'
           ],
           'Spree::Vendor' => [
-            '/api/v2/tenant/vendors/:id*',
+            '/api/v2/:tenant_slug/vendors/:id*',
             '/api/v2/storefront/vendors/:id*',
             '/api/v2/storefront/accommodations/:id*',
             '/api/v2/storefront/accommodations/:slug*'

data/app/services/spree_cm_commissioner/api_caches/invalidate_all.rb

@@ -4,10 +4,7 @@ module SpreeCmCommissioner
     # serve them, which MaintenanceTasks::CacheInvalidation sends, as for Invalidate. `tenant` is
     # required so a clear-all never pays for both namespaces by accident: nil is the BookMe+
     # storefront (/api/v2/storefront/ paths), a SpreeCmCommissioner::Tenant is that tenant's API
-    # (/api/v2/tenant/ paths).
-    #
-    # Tenant APIs take the tenant from the OAuth token, not the URL, so every tenant shares one path
-    # today; taking the record keeps callers the same if tenant paths ever carry it.
+    # (/api/v2/<tenant slug>/ paths).
     #
     # eg. InvalidateAll.call(model: 'SpreeCmCommissioner::HomepageSection', tenant: nil)
     class InvalidateAll
@@ -20,11 +17,11 @@ module SpreeCmCommissioner
         'Spree::Menu' => ['/api/v2/storefront/homepage_data*'],
         'Spree::Taxon' => ['/api/v2/storefront/taxons/*'],
         'Spree::Product' => [
-          '/api/v2/tenant/products/*',
+          '/api/v2/:tenant_slug/products/*',
           '/api/v2/storefront/products/*'
         ],
         'Spree::Vendor' => [
-          '/api/v2/tenant/vendors/*',
+          '/api/v2/:tenant_slug/vendors/*',
           '/api/v2/storefront/vendors/*',
           '/api/v2/storefront/accommodations/*'
         ],
@@ -44,7 +41,8 @@ module SpreeCmCommissioner
 
       # Side-effect free, so the clear-cache dialog can show what a clear would send.
       def patterns_for(model, tenant:)
-        API_PATTERNS.fetch(model, []).select { |pattern| pattern.start_with?(Invalidate::TENANT_PREFIX) == tenant.present? }
+        patterns = API_PATTERNS.fetch(model, []).select { |pattern| pattern.start_with?(Invalidate::TENANT_PREFIX) == tenant.present? }
+        tenant ? Invalidate.new.expand_tenant_slug(patterns, [tenant.slug]) : patterns
       end
 
       # updated_at keys Spree's serializer and collection caches, so only this storefront's records

data/app/services/spree_cm_commissioner/draft_orders/create.rb

@@ -72,7 +72,8 @@ module SpreeCmCommissioner
           device_id: options[:device_id],
           last_ip_address: options[:last_ip_address]
         )
-        line_items_params.each { |line_item_params| build_line_item!(order, store, line_item_params) }
+        sellable_variants = store.variants.joins(:product).merge(Spree::Product.sellable_on(Spree::Product.sales_channel_for(tenant)))
+        line_items_params.each { |line_item_params| build_line_item!(order, sellable_variants, line_item_params) }
 
         ActiveRecord::Base.transaction do
           raise StandardError, order_error_message(order) unless order.save
@@ -105,8 +106,10 @@ module SpreeCmCommissioner
 
       # Builds (unsaved) an order.line_items member — persisted together with the order via
       # order.save's cascading autosave of new has_many records, same as TransitOrder::Create.
-      def build_line_item!(order, store, line_item_params)
-        variant = store.variants.find(line_item_params[:variant_id])
+      def build_line_item!(order, sellable_variants, line_item_params)
+        variant = sellable_variants.find_by(id: line_item_params[:variant_id])
+        raise StandardError, I18n.t('spree_cm_commissioner.draft_order.variant_not_available') if variant.nil?
+
         options = (line_item_params[:options] || {}).to_h.with_indifferent_access
         permitted_opts = ::Spree::PermittedAttributes.line_item_attributes.flatten.index_with { |attribute| options[attribute] }
         opts = permitted_opts.merge(currency: order.currency).compact

data/app/services/spree_cm_commissioner/events/publish_stock_statuses_to_firestore.rb

@@ -35,10 +35,10 @@ module SpreeCmCommissioner
         return success(:skipped) unless firestore_available?
 
         products = active_products(taxon).to_a
-        return success(:skipped) if products.empty?
-
-        sums = aggregate_quantities(products)
         existing_products = existing_products_data(taxon)
+        return success(:skipped) if products.empty? && existing_products.empty?
+
+        sums = products.empty? ? {} : aggregate_quantities(products)
         now = Time.zone.now
 
         changed = {}
@@ -51,6 +51,8 @@ module SpreeCmCommissioner
           changed[product.id.to_s] = build_entry(product, status, quantities, existing_products, now)
         end
 
+        prune_stale_entries(changed, products, existing_products)
+
         return success(:unchanged) if changed.empty?
 
         event_document(taxon).set({ products: changed, server_time: now }, merge: true)
@@ -66,6 +68,20 @@ module SpreeCmCommissioner
 
       private
 
+      # The write below is always `merge: true`, which only ever adds or updates map entries — it
+      # never drops one. So a product that stops being active (unlisted/unlinked from its section,
+      # discontinued, status flipped off — see `active_products`) would otherwise keep its last
+      # stock status in Firestore forever, and the app would go on rendering the removed product.
+      # Deleting the `products.<id>` field (nested FieldValue.delete, carried in the same merge set)
+      # is what actually removes it. existing_products is read even when no product is active, so an
+      # event whose every ticket got unlisted still gets its stale entries cleared.
+      def prune_stale_entries(changed, products, existing_products)
+        active_ids = products.map { |product| product.id.to_s }
+        (existing_products.keys - active_ids).each do |stale_id|
+          changed[stale_id] = firestore.field_delete
+        end
+      end
+
       # `quantities` is the [available, on_hold, locked, locked_on_hold] tuple from
       # `aggregate_quantities`. `previous_status` is read back from what's already stored, not
       # recomputed — it's the bucket this product was in on the last publish, if any.
@@ -117,6 +133,16 @@ module SpreeCmCommissioner
       # true. Caught via a real event whose products all had available_on: nil: the poll job was
       # returning :skipped for it on every cycle, so Firestore just sat frozen with stale data.
       #
+      # `preview: false` for the same reason unlisted products are excluded: events/{event_id} is
+      # publicly readable (no auth on the Firestore rule), so a preview product — active but held
+      # back from the public pending a PreviewRole, product_decorator.rb `publicly_available` — must
+      # not leak a live stock-status entry there before launch.
+      #
+      # `offline: false` because an offline product is deliberately not inventory-monitored (the
+      # admin form labels it "not monitored in Inventory Monitor", and InventoryItems finders like
+      # RecentlyChangedFinder already filter it out) — its Redis pools aren't maintained, so any
+      # stock status published for it would be meaningless.
+      #
       # `where(status: 'active')` instead of core's `Product.active` scope: that scope also joins
       # variants/prices in to filter by currency (`with_currency`), and `spree_variants` carries its
       # own `available_on`/`discontinue_on` columns — once that join is present, the raw,
@@ -133,7 +159,7 @@ module SpreeCmCommissioner
       # is excluded here too rather than still getting a live stock-status entry in Firestore.
       def active_products(taxon)
         now = Time.zone.now
-        taxon.event_products.ecommerce.where(status: 'active')
+        taxon.event_products.ecommerce.where(status: 'active', preview: false, offline: false)
              .where('available_on IS NULL OR available_on <= ?', now)
              .where('discontinue_on IS NULL OR discontinue_on > ?', now)
              .where(id: taxon.children_classifications.where(visible: true).select(:product_id))

data/app/services/spree_cm_commissioner/integrations/book_me_bus_v1/polling/sync_inventory.rb

@@ -41,31 +41,53 @@ module SpreeCmCommissioner::Integrations::BookMeBusV1::Polling
       available_seats = external_trip.available_seats
       return if available_seats.nil? # unknown, not zero - don't zero out real inventory
 
-      current_stock = stock_item.count_on_hand.to_i
-      difference = available_seats.to_i - current_stock
+      sync_stock_item(stock_item, vehicle_capacity(external_trip, available_seats.to_i))
+      sync_inventory_item_for_date(stock_item.variant, external_trip, available_seats.to_i)
+    end
+
+    # count_on_hand is one number shared by every date and seeds new inventory items, so it holds the vehicle's seats.
+    # A date's own seats would rewrite it (and enqueue VendorJob) on most polls, and could seed new dates with 0.
+    def vehicle_capacity(external_trip, available_seats)
+      number_of_seats = external_trip.number_of_seats.to_i
+
+      number_of_seats.positive? ? number_of_seats : available_seats
+    end
+
+    def sync_stock_item(stock_item, seats)
+      difference = seats - stock_item.count_on_hand.to_i
       return if difference.zero?
 
       @sync_result.track(:stock_item, stock_item) do
         stock_item.adjust_count_on_hand(difference)
         @sync_result.increment_metric(:inventory, :adjusted, difference.abs)
       end
-
-      adjust_inventory_item_for_date(stock_item.variant, external_trip, difference)
     end
 
     # StockItem.count_on_hand isn't date-aware and isn't read for real availability checks
-    # (see docs/concepts/inventory-system.md) - apply the same delta to the specific date's
-    # InventoryItem so ongoing BookMeBus availability changes actually reach bookable inventory.
-    # If it doesn't exist yet, PermanentInventoryItemsGeneratorJob will seed it later from
-    # count_on_hand, so there's nothing to adjust yet.
-    def adjust_inventory_item_for_date(variant, external_trip, difference)
+    # (see docs/concepts/inventory-system.md), so each date's InventoryItem is set to that date's own seats_remaining,
+    # never moved by its difference from another date's seats: an item seeded from a different count (0 after a sold-out
+    # first date) would go negative and fail the whole trip's sync. If the item doesn't exist yet, the permanent items
+    # job seeds it later from count_on_hand.
+    def sync_inventory_item_for_date(variant, external_trip, available_seats)
       trip_date = parse_trip_date(external_trip.on_date)
       return unless trip_date
 
       inventory_item = variant.inventory_items.find_by(inventory_date: trip_date)
-      return unless inventory_item
+      return if inventory_item.nil? || inventory_item.quantity_available == seats_for_sale(inventory_item, available_seats)
+
+      inventory_item.with_lock do
+        SpreeCmCommissioner::InventoryItems::AdjustAvailableQuantity.call!(
+          inventory_item: inventory_item,
+          delta: seats_for_sale(inventory_item, available_seats) - inventory_item.quantity_available,
+          caller_source: self.class.name,
+          lock: false
+        )
+      end
+    end
 
-      inventory_item.adjust_quantity!(difference)
+    # BookMeBus doesn't know about seats an operator withheld here, so its count still includes them.
+    def seats_for_sale(inventory_item, available_seats)
+      [available_seats - inventory_item.quantity_locked - inventory_item.locked_count, 0].max
     end
 
     def parse_trip_date(date_string)

data/app/services/spree_cm_commissioner/integrations/book_me_bus_v1/polling/sync_product.rb

@@ -33,7 +33,8 @@ module SpreeCmCommissioner::Integrations::BookMeBusV1::Polling
           status: :active,
           vendor: @vendor,
           product_type: :transit,
-          available_on: Time.current,
+          # Keeps the first value: a fresh time counts as a change, so every poll would save the product and purge its API cache.
+          available_on: product.available_on || Time.current,
           shipping_category: default_shipping_category,
           stores: [Spree::Store.default],
           option_types: [seat_type_option].compact,
@@ -42,7 +43,7 @@ module SpreeCmCommissioner::Integrations::BookMeBusV1::Polling
         tracker.save_if_changed!(product)
       end
 
-      mapping.mark_as_active!(external_payload: { trip_id: external_trip.trip_id })
+      mapping.confirm_active!(external_payload: { trip_id: external_trip.trip_id })
       product
     end
 

data/app/services/spree_cm_commissioner/integrations/book_me_bus_v1/polling/sync_trip_stop.rb

@@ -135,11 +135,12 @@ module SpreeCmCommissioner::Integrations::BookMeBusV1::Polling
         tracker.save_if_changed!(trip_stop)
       end
 
-      mapping.mark_as_active!(
+      mapping.confirm_active!(
         external_payload: stop_time_data.merge(
           'stop_name' => stop_data['name'],
           'location_name' => location_data['name']
-        )
+        ),
+        ignoring: SpreeCmCommissioner::Integrations::BookMeBusV1::Resources::Trip::VOLATILE_PAYLOAD_KEYS
       )
 
       mapping
@@ -177,7 +178,10 @@ module SpreeCmCommissioner::Integrations::BookMeBusV1::Polling
         tracker.save_if_changed!(stop_vendor_place)
       end
 
-      mapping.mark_as_active!(external_payload: external_stop.to_h.merge('place_type' => external_stop.vendor_place_type.to_s))
+      mapping.confirm_active!(
+        external_payload: external_stop.to_h.merge('place_type' => external_stop.vendor_place_type.to_s),
+        ignoring: SpreeCmCommissioner::Integrations::BookMeBusV1::Resources::Trip::VOLATILE_PAYLOAD_KEYS
+      )
 
       # Return the appropriate place based on stop type:
       # - BRANCHES: return location_vendor_place.place (the city/location)