spree_cm_commissioner 2.14.7 → 2.14.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2828d409efc450a1771a72ddee9866379996fbe09b29ee4eec5b446ed4d6acfc
-  data.tar.gz: 0cf499cd5d3bb7947385761cfff6c569a9180f96fe60426fa3ba802dece704a9
+  metadata.gz: ceb90915f56d7b2621b44c00abe7b65adbdf5093f566d3b801333496c3333402
+  data.tar.gz: 418a9332f9ddf34711f4c251c5c6040388e191efa8f2f8eefc11d12777a6f79a
 SHA512:
-  metadata.gz: c2531492454f38d71fbcb6115b97d442b29631b49b92cc5c8961cc395b761014bf24c53a99301150a5480ac42484838319dbac8c7d8f3d924708a6585bc7f9b1
-  data.tar.gz: 7e4bf0769cfdc8364a492fdb6fabbce2d72f1da7df9289dbbf68562312d3604880918f5eab80aa4b3e5f4098366fa8bc7c2ae38907bd8fc2a9b5fae60e92bcc0
+  metadata.gz: 6ef4fcfc3e0feb5af8d54f06a7321e1369a35b87f625d8465a70edb5c2ac2502e180812ba60fb3d5d081bc746367bcb756e9124416719f73af0143cea86242b6
+  data.tar.gz: 46af2a2e96874f557e5921b671838148b148791a408c0c55b26d7647fb4fc1fc11ea775d25ee5998da402d0f7cac4b00374bb269ee21eaef5edc088bb1053bdd

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.14.7)
+    spree_cm_commissioner (2.14.8)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -88,8 +88,16 @@ module SpreeCmCommissioner
       ContentCachable.cdn_max_age(cdn_cache_config&.dig(:max_age))
     end
 
+    # A tenant API is cacheable only on its /api/v2/:tenant_slug/ path. The legacy /api/v2/tenant/
+    # path takes the tenant from the OAuth token, which is not in the cache key, so caching it would
+    # serve one tenant's response to every other tenant.
     def cdn_cacheable?
-      request.get? && cdn_cache_config.present? && cdn_cache_config[:actions].include?(action_name)
+      request.get? && cdn_cache_config.present? && cdn_cache_config[:actions].include?(action_name) &&
+        (!tenant_api? || params[:tenant_slug].present?)
+    end
+
+    def tenant_api?
+      self.class.name.to_s.start_with?('Spree::Api::V2::Tenant::')
     end
 
     def set_cache_control_for_cdn

data/app/controllers/concerns/spree_cm_commissioner/guest_owner_authorization.rb

@@ -0,0 +1,30 @@
+module SpreeCmCommissioner
+  # For per-guest endpoints that touch the guest's ID card photos. The app calls these during
+  # checkout (order token, or the logged-in owner) and after it from pending guests (logged-in
+  # owner of a complete order). That's why ownership is checked here and not with the
+  # `:update, Order` ability, which refuses completed orders.
+  module GuestOwnerAuthorization
+    extend ActiveSupport::Concern
+
+    private
+
+    # 404 rather than 403 for someone else's guest, so sequential guest ids can't be probed.
+    def authorized_guest
+      @authorized_guest ||= begin
+        guest = SpreeCmCommissioner::Guest.find(params[:guest_id])
+        raise ActiveRecord::RecordNotFound unless guest_owned_by_requester?(guest)
+
+        guest
+      end
+    end
+
+    def guest_owned_by_requester?(guest)
+      order = guest.line_item&.order
+      user = spree_current_user
+      return true if user.present? && (guest.user_id == user.id || order&.user_id == user.id)
+
+      token = request.headers['X-Spree-Order-Token'].presence || params[:order_token].presence
+      token.present? && order&.token.present? && ActiveSupport::SecurityUtils.secure_compare(order.token, token)
+    end
+  end
+end

data/app/controllers/spree/admin/stock_managements_controller.rb

@@ -1,14 +1,25 @@
 module Spree
   module Admin
     class StockManagementsController < Spree::Admin::ResourceController
+      include Spree::Admin::ProductConcern
+
       skip_before_action :load_resource
 
       before_action :load_parent
 
       helper SpreeCmCommissioner::Admin::InventoryItemsHelper
 
+      # Same lookup as Spree's ProductsController: friendly.find accepts both slug and id links
+      # (e.g. /admin/products/938/stock_managements) and raises on a miss instead of leaving @product nil.
       def load_parent
-        @product = Spree::Product.find_by(slug: params[:product_id])
+        @product = product_scope.friendly.find(params[:product_id])
+      end
+
+      # ResourceController's handler names model_class (StockItem) in the flash and redirects to
+      # collection_url (/admin/stock_items), which has no GET route — so point both at products instead.
+      def resource_not_found
+        flash[:error] = flash_message_for(Spree::Product.new, :not_found)
+        redirect_to spree.admin_products_path
       end
 
       def index

data/app/controllers/spree/api/v2/organizer/invites_controller.rb

@@ -3,6 +3,10 @@ module Spree
     module V2
       module Organizer
         class InvitesController < ::Spree::Api::V2::Organizer::BaseController
+          # Accepting grants the operator role, so it must be the invitee's own decision: the
+          # token alone only proves someone has the link.
+          before_action :require_spree_current_user, only: :update
+
           def show
             if invite&.url_valid?
               render_serialized_payload { serialize_resource(invite) }
@@ -12,7 +16,7 @@ module Spree
           end
 
           def update
-            context = invite.confirm(params[:user_id])
+            context = invite.confirm(spree_current_user.id)
 
             if context.success?
               render_serialized_payload { serialize_resource(context.invite) }

data/app/controllers/spree/api/v2/storefront/guests_controller.rb

@@ -4,6 +4,7 @@ module Spree
       module Storefront
         class GuestsController < ::Spree::Api::V2::ResourceController
           include OrderConcern
+          include SpreeCmCommissioner::GuestOwnerAuthorization
 
           # raise 404 when no order, except for show
           before_action :ensure_order, except: [:show]
@@ -23,9 +24,9 @@ module Spree
             SpreeCmCommissioner::V2::Storefront::GuestSerializer
           end
 
+          # The serializer includes the guest's ID card, so show must be as strict as id_cards.
           def show
-            @guest = SpreeCmCommissioner::Guest.find(params[:id])
-            render_serialized_payload { serialize_resource(@guest) }
+            render_serialized_payload { serialize_resource(owned_guest) }
           end
 
           def create
@@ -44,9 +45,7 @@ module Spree
           end
 
           def update
-            spree_authorize! :update, spree_current_order, order_token unless guest_for_update.pre_registration?
-
-            result = SpreeCmCommissioner::Guests::Update.call(guest: guest_for_update, guest_params: guest_params)
+            result = SpreeCmCommissioner::Guests::Update.call(guest: owned_guest, guest_params: guest_params)
 
             if result.success?
               render_serialized_payload { serialize_resource(result.value[:guest]) }
@@ -66,8 +65,15 @@ module Spree
             @parent ||= spree_current_order.line_items.find(params[:line_item_id])
           end
 
-          def guest_for_update
-            @guest_for_update ||= SpreeCmCommissioner::Guest.find(params[:id])
+          # Checked against the guest's own order: spree_current_order is just the caller's cart,
+          # which says nothing about whether they own this guest.
+          def owned_guest
+            @owned_guest ||= begin
+              guest = SpreeCmCommissioner::Guest.find(params[:id])
+              raise ActiveRecord::RecordNotFound unless guest_owned_by_requester?(guest)
+
+              guest
+            end
           end
 
           def guest_params

data/app/controllers/spree/api/v2/storefront/id_cards_controller.rb

@@ -3,12 +3,14 @@ module Spree
     module V2
       module Storefront
         class IdCardsController < ::Spree::Api::V2::ResourceController
+          include SpreeCmCommissioner::GuestOwnerAuthorization
+
           def create
             context = SpreeCmCommissioner::GuestIdCardManager.call(
               card_type: id_card_params[:card_type],
               front_image_url: id_card_params[:front_image_url],
               back_image_url: id_card_params[:back_image_url],
-              guest_id: id_card_params[:guest_id]
+              guest: authorized_guest
             )
 
             if context.success?
@@ -23,7 +25,7 @@ module Spree
               card_type: id_card_params[:card_type],
               front_image_url: id_card_params[:front_image_url],
               back_image_url: id_card_params[:back_image_url],
-              guest_id: id_card_params[:guest_id]
+              guest: authorized_guest
             )
 
             if context.success?
@@ -34,7 +36,7 @@ module Spree
           end
 
           def destroy
-            id_card = SpreeCmCommissioner::IdCard.find(params[:id])
+            id_card = SpreeCmCommissioner::IdCard.find_by!(id: params[:id], guest_id: authorized_guest.id)
 
             if id_card.destroy
               render_serialized_payload(204) { serialize_resource(id_card) }
@@ -46,7 +48,7 @@ module Spree
           private
 
           def id_card_params
-            params.permit(:card_type, :front_image_url, :back_image_url, :guest_id)
+            params.permit(:card_type, :front_image_url, :back_image_url)
           end
 
           def model_class

data/app/controllers/spree/api/v2/storefront/products_controller_decorator.rb

@@ -4,7 +4,7 @@ module Spree
       module Storefront
         module ProductsControllerDecorator
           def scope
-            super.where(preview: false)
+            super.where(preview: false).sellable_on(:platform)
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/s3_signed_urls_controller.rb

@@ -12,10 +12,11 @@ module Spree
           end
 
           def resource
+            # Never take bucket_name/object_key from params: the key is always generated server-side.
+            # Reachable without login (app token only), so S3 also enforces the upload size.
             SpreeCmCommissioner::S3PresignedUrlBuilder.call(
-              bucket_name: params[:bucket_name],
-              object_key: params[:object_key],
-              file_name: params[:file_name]
+              file_name: params[:file_name],
+              content_length_range: 1..SpreeCmCommissioner::UserUploadedImage::MAX_SIZE
             )
           end
 

data/app/controllers/spree/api/v2/tenant/base_controller.rb

@@ -8,14 +8,34 @@ module Spree
           set_current_tenant_through_filter
           before_action :require_tenant
 
+          # /api/v2/:tenant_slug/... takes the tenant from the URL so the CDN, which caches by URL,
+          # never serves one tenant's response to another. Legacy /api/v2/tenant/... still takes it
+          # from the OAuth token and is not CDN-cached (see SpreeCmCommissioner::ContentCachable).
           def require_tenant
-            raise Doorkeeper::Errors::DoorkeeperError if doorkeeper_token&.application.nil?
-            raise Doorkeeper::Errors::DoorkeeperError if doorkeeper_token.application.tenant.nil?
+            @tenant = tenant_from_path || tenant_from_token
+            raise Doorkeeper::Errors::DoorkeeperError if @tenant.nil?
 
-            @tenant = doorkeeper_token.application.tenant
             set_current_tenant(@tenant)
           end
 
+          # Slugs only (current or FriendlyId history, so a renamed tenant keeps working in shipped
+          # apps), never numeric ids, so each tenant has one cacheable URL. A token minted for another
+          # tenant's app, or for the BookMe+ storefront app, is refused rather than letting its user
+          # act inside this tenant.
+          def tenant_from_path
+            return if params[:tenant_slug].blank?
+
+            # FriendlyId's own finder (slug + history, never the numeric id), not a dynamic finder.
+            tenant = SpreeCmCommissioner::Tenant.friendly.find_by_friendly_id(params[:tenant_slug]) # rubocop:disable Rails/DynamicFindBy
+            raise Doorkeeper::Errors::DoorkeeperError if doorkeeper_token && doorkeeper_token.application&.tenant_id != tenant.id
+
+            tenant
+          end
+
+          def tenant_from_token
+            doorkeeper_token&.application&.tenant
+          end
+
           def current_vendor
             @current_vendor ||= @tenant.active_vendor
           end

data/app/controllers/spree/api/v2/tenant/cart_controller.rb

@@ -192,7 +192,7 @@ module Spree
           end
 
           def load_variant
-            @variant = current_store.variants.find(add_item_params[:variant_id])
+            @variant = current_store.variants.joins(:product).merge(Spree::Product.sellable_on(:direct)).find(add_item_params[:variant_id])
           end
 
           def render_error_item_quantity

data/app/controllers/spree/api/v2/tenant/id_cards_controller.rb

@@ -3,12 +3,14 @@ module Spree
     module V2
       module Tenant
         class IdCardsController < BaseController
+          include SpreeCmCommissioner::GuestOwnerAuthorization
+
           def create
             context = SpreeCmCommissioner::GuestIdCardManager.call(
               card_type: id_card_params[:card_type],
               front_image_url: id_card_params[:front_image_url],
               back_image_url: id_card_params[:back_image_url],
-              guest_id: id_card_params[:guest_id]
+              guest: authorized_guest
             )
 
             if context.success?
@@ -23,7 +25,7 @@ module Spree
               card_type: id_card_params[:card_type],
               front_image_url: id_card_params[:front_image_url],
               back_image_url: id_card_params[:back_image_url],
-              guest_id: id_card_params[:guest_id]
+              guest: authorized_guest
             )
 
             if context.success?
@@ -34,7 +36,7 @@ module Spree
           end
 
           def destroy
-            id_card = SpreeCmCommissioner::IdCard.find(params[:id])
+            id_card = SpreeCmCommissioner::IdCard.find_by!(id: params[:id], guest_id: authorized_guest.id)
 
             if id_card.destroy
               head :no_content
@@ -46,7 +48,7 @@ module Spree
           private
 
           def id_card_params
-            params.permit(:card_type, :front_image_url, :back_image_url, :guest_id)
+            params.permit(:card_type, :front_image_url, :back_image_url)
           end
 
           def model_class

data/app/controllers/spree/api/v2/tenant/payment_methods_controller.rb

@@ -7,8 +7,7 @@ module Spree
         # vendor_id is a required query param, and payout is an optional one (caller
         # passes Order#required_payway_payout? — see PaymentMethods::Find). A vendor id
         # is globally unique and belongs to exactly one tenant, so it is what identifies
-        # tenant, vendor and store here — the tenant itself comes from the Doorkeeper
-        # token, not the URL.
+        # vendor and store here; the tenant comes from BaseController#require_tenant.
         #
         # IMPORTANT for caching (see SpreeCmCommissioner::ContentCachable): the CDN
         # must include vendor_id in its cache key. If query strings are stripped,

data/app/controllers/spree/api/v2/tenant/products_controller.rb

@@ -21,7 +21,7 @@ module Spree
 
           def scope
             MultiTenant.with(@tenant) do
-              model_class.where(tenant_id: MultiTenant.current_tenant_id, preview: false)
+              model_class.where(tenant_id: MultiTenant.current_tenant_id, preview: false).sellable_on(:direct)
             end
           end
 

data/app/controllers/spree/api/v2/tenant/s3_signed_urls_controller.rb

@@ -12,10 +12,11 @@ module Spree
           end
 
           def resource
+            # Never take bucket_name/object_key from params: the key is always generated server-side.
+            # Reachable without login (app token only), so S3 also enforces the upload size.
             SpreeCmCommissioner::S3PresignedUrlBuilder.call(
-              bucket_name: params[:bucket_name],
-              object_key: params[:object_key],
-              file_name: params[:file_name]
+              file_name: params[:file_name],
+              content_length_range: 1..SpreeCmCommissioner::UserUploadedImage::MAX_SIZE
             )
           end
 

data/app/interactors/spree_cm_commissioner/guest_id_card_manager.rb

@@ -1,6 +1,7 @@
 module SpreeCmCommissioner
   class GuestIdCardManager < BaseInteractor
-    delegate :card_type, :front_image_url, :back_image_url, :guest_id, to: :context
+    # guest: the caller must already have checked the requester owns this guest.
+    delegate :card_type, :front_image_url, :back_image_url, :guest, to: :context
 
     def call
       if guest.id_card.blank? && front_image_url.present?
@@ -31,31 +32,39 @@ module SpreeCmCommissioner
       context.result = guest.id_card
     end
 
-    def guest
-      SpreeCmCommissioner::Guest.find(guest_id)
-    end
-
     def manage_card_type(id_card)
       id_card.update(card_type: card_type)
     end
 
+    # Fails this interactor's own context: failing the updater's context instead raises a Failure
+    # that Interactor#run swallows, so the request would report success with nothing attached.
     def manage_front_image(id_card)
-      context = SpreeCmCommissioner::IdCardImageUpdater.call(
+      return if unchanged_image?(id_card.front_image, front_image_url)
+
+      result = SpreeCmCommissioner::IdCardImageUpdater.call(
         id_card: id_card,
         image_url: front_image_url,
         type: 'front_image'
       )
 
-      context.fail!(message: 'Failed to update front image') unless context.success?
+      context.fail!(message: 'Failed to update front image') unless result.success?
     end
 
     def manage_back_image(id_card)
-      context = SpreeCmCommissioner::IdCardImageUpdater.call(
+      return if unchanged_image?(id_card.back_image, back_image_url)
+
+      result = SpreeCmCommissioner::IdCardImageUpdater.call(
         id_card: id_card,
         image_url: back_image_url,
         type: 'back_image'
       )
-      context.fail!(message: 'Failed to update back image') unless context.success?
+      context.fail!(message: 'Failed to update back image') unless result.success?
+    end
+
+    # The app sends the whole card back on every edit, so a side the user didn't replace arrives as
+    # that image's existing URL rather than a new upload. Keep it instead of failing the fetch.
+    def unchanged_image?(image, url)
+      image.present? && SpreeCmCommissioner::S3UrlGenerator.upload_key(url).nil?
     end
   end
 end

data/app/interactors/spree_cm_commissioner/id_card_image_updater.rb

@@ -4,10 +4,9 @@ module SpreeCmCommissioner
 
     def call
       presigned_url = SpreeCmCommissioner::S3UrlGenerator.s3_presigned_url(context.image_url)
+      response = Faraday.get(presigned_url) if presigned_url
 
-      response = Faraday.get(presigned_url)
-
-      if response.success?
+      if response&.success?
         id_card = context.id_card
         io = StringIO.new(response.body)
         filename = File.basename(context.image_url)
@@ -20,7 +19,11 @@ module SpreeCmCommissioner
         else
           context.fail!(message: id_card_image.errors.full_messages.join(','))
         end
+      else
+        context.fail!(message: I18n.t('s3.image.upload.fail'))
       end
+    rescue Interactor::Failure
+      raise
     rescue StandardError => e
       context.fail!(message: "Error fetching the remote image: #{e.message}")
     end

data/app/interactors/spree_cm_commissioner/image_saver.rb

@@ -2,10 +2,9 @@ module SpreeCmCommissioner
   class ImageSaver < BaseInteractor
     def call
       presigned_url = SpreeCmCommissioner::S3UrlGenerator.s3_presigned_url(context.url)
+      response = Faraday.get(presigned_url) if presigned_url
 
-      response = Faraday.get(presigned_url)
-
-      if response.success?
+      if response&.success?
         io = StringIO.new(response.body)
         filename = File.basename(context.url)
 
@@ -20,6 +19,8 @@ module SpreeCmCommissioner
       else
         context.fail!(message: I18n.t('s3.image.upload.fail'))
       end
+    rescue Interactor::Failure
+      raise
     rescue StandardError => e
       context.fail!(message: e.message)
     end

data/app/interactors/spree_cm_commissioner/profile_image_updater.rb

@@ -3,10 +3,9 @@ module SpreeCmCommissioner
     # url: 'https://mybucket.s3.ap-southeast-1.amazonaws.com/uploads/5f31/1697038252270.jpg'
     def call
       presigned_url = SpreeCmCommissioner::S3UrlGenerator.s3_presigned_url(context.url)
+      response = Faraday.get(presigned_url) if presigned_url
 
-      response = Faraday.get(presigned_url)
-
-      if response.success?
+      if response&.success?
         user = context.user
         io = StringIO.new(response.body)
         filename = File.basename(context.url)
@@ -20,7 +19,11 @@ module SpreeCmCommissioner
         else
           context.fail!(message: profile.errors.full_messages.join(','))
         end
+      else
+        context.fail!(message: I18n.t('s3.image.upload.fail'))
       end
+    rescue Interactor::Failure
+      raise
     rescue StandardError => e
       context.fail!(message: "Error fetching the remote image: #{e.message}")
     end

data/app/models/concerns/spree_cm_commissioner/order_state_machine.rb

@@ -87,7 +87,7 @@ module SpreeCmCommissioner
         after_transition from: :requested, to: :accepted, do: :decrement_user_request_orders_count
         after_transition to: :accepted, do: :send_order_accepted_app_notification_to_user
         after_transition to: :accepted, do: :send_order_accepted_telegram_alert_to_store
-        after_transition to: :accepted, if: :confirmation_delivered?, do: :deliver_order_confirmation_email
+        after_transition to: :accepted, unless: :confirmation_delivered?, do: :deliver_order_confirmation_email
 
         event :reject do
           transition from: :requested, to: :rejected
@@ -144,14 +144,6 @@ module SpreeCmCommissioner
       subscription? || prepaid_top_up_order?
     end
 
-    # override
-    def deliver_order_confirmation_email
-      return if requested?
-      return if any_app_only_products?
-
-      super
-    end
-
     def increment_user_request_orders_count
       return if user.nil?
 

data/app/models/concerns/spree_cm_commissioner/sales_channel_bitwise.rb

@@ -0,0 +1,44 @@
+module SpreeCmCommissioner
+  module SalesChannelBitwise
+    extend ActiveSupport::Concern
+
+    # Append only: stored values are bit masks. Names follow the `channel_direct` /
+    # `channel_platform` channel types in docs/concepts/multi-channel-pricing.md.
+    BIT_SALES_CHANNEL = {
+      direct: 0b01,  # the tenant's own app/web
+      platform: 0b10 # the BookMe+ marketplace
+    }.freeze
+
+    included do
+      validates :sales_channel, numericality: { greater_than: 0 }
+
+      # Runs after ProductDecorator#set_tenant: a product without a tenant has no direct channel to sell on.
+      before_save -> { self.sales_channel = BIT_SALES_CHANNEL[:platform] if tenant_id.nil? }
+
+      scope :sellable_on, lambda { |channel|
+        where("#{table_name}.sales_channel & ? != 0", BIT_SALES_CHANNEL.fetch(channel))
+      }
+    end
+
+    class_methods do
+      # The channel a customer order is placed on: tenant storefront APIs set a tenant, the platform ones don't.
+      def sales_channel_for(tenant)
+        tenant.present? ? :direct : :platform
+      end
+    end
+
+    BIT_SALES_CHANNEL.each do |channel, bit_value|
+      define_method "sellable_on_#{channel}?" do
+        sales_channel.to_i & bit_value != 0
+      end
+    end
+
+    # Checkbox reader/writer for the dashboard: a tenant product opts in/out of being sold on BookMe+.
+    alias sellable_on_platform sellable_on_platform?
+
+    def sellable_on_platform=(value)
+      bit = BIT_SALES_CHANNEL[:platform]
+      self.sales_channel = ActiveModel::Type::Boolean.new.cast(value) ? sales_channel.to_i | bit : sales_channel.to_i & ~bit
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/user_uploaded_image.rb

@@ -0,0 +1,17 @@
+module SpreeCmCommissioner
+  # For images a customer uploads themselves (profile photo, ID card). Spree's own validation accepts
+  # any `image/*`, which lets formats like SVG reach libvips when variants are generated
+  # (CVE-2026-66066), so these are limited to the formats phone cameras and galleries produce.
+  # MAX_SIZE is also the `content_length_range` on the storefront/tenant presigned POST, so an
+  # oversized file is rejected by S3 before it is ever fetched back.
+  module UserUploadedImage
+    extend ActiveSupport::Concern
+
+    CONTENT_TYPES = %w[image/jpeg image/png image/webp image/heic image/heif].freeze
+    MAX_SIZE = 10.megabytes
+
+    included do
+      validates :attachment, content_type: CONTENT_TYPES, size: { less_than_or_equal_to: MAX_SIZE }
+    end
+  end
+end

data/app/models/spree_cm_commissioner/back_image.rb

@@ -1,5 +1,7 @@
 module SpreeCmCommissioner
   class BackImage < SpreeCmCommissioner::Asset
+    include SpreeCmCommissioner::UserUploadedImage
+
     def asset_styles
       {
         mini: '187x67>',

data/app/models/spree_cm_commissioner/front_image.rb

@@ -1,5 +1,7 @@
 module SpreeCmCommissioner
   class FrontImage < SpreeCmCommissioner::Asset
+    include SpreeCmCommissioner::UserUploadedImage
+
     def asset_styles
       {
         mini: '187x67>',

data/app/models/spree_cm_commissioner/order_decorator.rb

@@ -190,6 +190,17 @@ module SpreeCmCommissioner
       super
     end
 
+    # Must live here, not in OrderStateMachine: that concern is included (below Spree::Order),
+    # while Spree::Emails::OrderDecorator is prepended above it and never calls super, so an
+    # override there is silently dead.
+    def deliver_order_confirmation_email
+      return if requested?
+      return if any_app_only_products?
+      return if products.none?(&:enable_confirmation_email?)
+
+      super
+    end
+
     def any_app_only_products?
       if products.loaded?
         products.any?(&:purchasable_on_app?)

data/app/models/spree_cm_commissioner/product_decorator.rb

@@ -143,6 +143,7 @@ module SpreeCmCommissioner
       base.store_public_metadata :enable_inventory_hold, :boolean, default: false
       base.store_public_metadata :enable_telegram_alert, :boolean, default: true
       base.store_public_metadata :enable_send_receipt, :boolean, default: true
+      base.store_public_metadata :enable_confirmation_email, :boolean, default: true
       base.store_public_metadata :enable_social_sharing_email, :boolean, default: false
 
       base.store_private_metadata :advertise_weight, :integer, default: 1
@@ -169,6 +170,9 @@ module SpreeCmCommissioner
       base.belongs_to :tenant, class_name: 'SpreeCmCommissioner::Tenant'
       base.before_save :set_tenant
 
+      # Included after set_tenant so its before_save sees the resolved tenant_id.
+      base.include SpreeCmCommissioner::SalesChannelBitwise
+
       # Create maintaining task to purge product related caches
       base.after_save { SpreeCmCommissioner::MaintenanceTasks::CacheInvalidation.pending.create_or_find_by(maintainable: self) }