spree_cm_commissioner 2.14.7 → 2.14.8

data/app/models/spree_cm_commissioner/s3_presigned_url.rb

@@ -11,25 +11,26 @@ module SpreeCmCommissioner
       URI.parse(url).host
     end
 
-    def initialize(bucket_name, object_key, uuid = nil)
+    # content_length_range: [Range, nil] byte range S3 enforces on the upload itself; nil means no limit.
+    def initialize(bucket_name, object_key, uuid = nil, content_length_range: nil)
       @id = uuid.presence || generate_secure_random
 
       if object_key.blank?
         @error_message = I18n.t('s3_signed_url.missing_file_name')
       else
-        @s3_direct_post = presigned_post(bucket_name, object_key)
+        @s3_direct_post = presigned_post(bucket_name, object_key, content_length_range)
       end
     end
 
     private
 
-    def presigned_post(bucket_name, object_key)
+    def presigned_post(bucket_name, object_key, content_length_range)
+      options = { key: object_key, success_action_status: '201' }
+      options[:content_length_range] = content_length_range if content_length_range
+
       Aws::S3::Resource.new
                        .bucket(bucket_name)
-                       .presigned_post(
-                         key: object_key,
-                         success_action_status: '201'
-                       )
+                       .presigned_post(**options)
     end
 
     def generate_secure_random

data/app/models/spree_cm_commissioner/s3_presigned_url_builder.rb

@@ -6,13 +6,15 @@ module SpreeCmCommissioner
       new(options).call
     end
 
-    # {:bucket_name?, (:object_key | :file_name)? }
+    # {:bucket_name?, (:object_key | :file_name)?, :content_length_range? }
+    # bucket_name/object_key are for trusted server-side callers only (admin media uploads); API
+    # controllers must pass just file_name, so callers can only write under uploads/<uuid>/.
     def initialize(options)
       @options = options
     end
 
     def call
-      SpreeCmCommissioner::S3PresignedUrl.new(bucket_name, object_key, uuid)
+      SpreeCmCommissioner::S3PresignedUrl.new(bucket_name, object_key, uuid, content_length_range: options[:content_length_range])
     end
 
     private
@@ -20,7 +22,11 @@ module SpreeCmCommissioner
     def object_key
       return options[:object_key] if options[:object_key].present?
 
-      "uploads/#{uuid}/#{options[:file_name]}"
+      # basename so a file_name like "../x" or "a/b" can't move the key out of its uuid folder.
+      file_name = File.basename(options[:file_name].to_s)
+      return nil if file_name.blank? || %w[. .. /].include?(file_name)
+
+      "uploads/#{uuid}/#{file_name}"
     end
 
     def bucket_name

data/app/models/spree_cm_commissioner/tenant.rb

@@ -21,6 +21,9 @@ module SpreeCmCommissioner
                              allow_blank: true,
                              format: { without: %r{\Ahttps?://}, message: :format }
 
+    # The slug is the first segment of /api/v2/:tenant_slug/..., so it must not shadow a v2 namespace.
+    validates :slug, exclusion: { in: SpreeCmCommissioner::TenantSlugConstraint::RESERVED_SLUGS }
+
     validates :sms_sender_id, length: { maximum: 11 }, allow_blank: true
 
     validates :default_currency, inclusion: { in: -> (tenant) { tenant.supported_currencies_list } }, allow_blank: true

data/app/models/spree_cm_commissioner/user_profile.rb

@@ -1,5 +1,7 @@
 module SpreeCmCommissioner
   class UserProfile < Asset
+    include SpreeCmCommissioner::UserUploadedImage
+
     protected
 
     def asset_styles

data/app/overrides/spree/admin/products/_form/enable_confirmation_email.html.erb.deface

@@ -0,0 +1,13 @@
+<!-- insert_after "[data-hook='admin_product_form_promotionable']" -->
+
+<div>
+  <%= f.field_container :enable_confirmation_email do %>
+    <%= f.label :enable_confirmation_email do %>
+      <%= f.check_box :enable_confirmation_email %>
+      <%= Spree.t(:enable_confirmation_email) %>
+    <% end %>
+    <small class="form-text text-muted">
+      When enabled, customers receive the booking confirmation email after their order is completed.
+    </small>
+  <% end %>
+</div>

data/app/overrides/spree/admin/products/_form/sellable_on_platform.html.erb.deface

@@ -0,0 +1,12 @@
+<!-- insert_after "[data-hook='admin_product_form_promotionable']" -->
+
+<%# BookMe+'s own products are always sold on the platform, so only tenant products get the choice. %>
+<% if f.object.vendor&.tenant_id.present? %>
+  <div data-hook="admin_product_form_sellable_on_platform">
+    <%= f.field_container :sellable_on_platform do %>
+      <%= f.check_box :sellable_on_platform %>
+      <%= f.label :sellable_on_platform, 'Also sell on BookMe+' %>
+      <%= f.error_message_on :sales_channel %>
+    <% end %>
+  </div>
+<% end %>

data/app/serializers/spree/v2/storefront/taxon_serializer_decorator.rb

@@ -4,7 +4,10 @@ module Spree
       module TaxonSerializerDecorator
         def self.prepended(base)
           base.has_many :vendors, serializer: ::Spree::V2::Storefront::VendorSerializer
-          base.has_many :visible_products, serializer: ::Spree::V2::Storefront::ProductSerializer
+          # The app lists an event section's tickets from this relation, so products a tenant keeps off BookMe+ are dropped here.
+          base.has_many :visible_products, serializer: ::Spree::V2::Storefront::ProductSerializer do |taxon|
+            taxon.visible_products.sellable_on(:platform)
+          end
           base.has_many :places, serializer: ::Spree::V2::Storefront::PlaceSerializer
 
           base.has_one :vendor, serializer: ::Spree::V2::Storefront::VendorSerializer

data/app/services/spree_cm_commissioner/api_caches/invalidate.rb

@@ -4,13 +4,13 @@ module SpreeCmCommissioner
     # MaintenanceTasks::CacheInvalidation sends. Every record of a model goes through InvalidateAll.
     #
     # Only the record's own storefront is cleared, as InvalidateAll does: its tenant's API
-    # (/api/v2/tenant/ paths) when it belongs to a tenant, the BookMe+ storefront otherwise. Each path
-    # is billed, and the other storefront's copy, if anything ever fetched one, expires within a CDN
-    # TTL anyway.
+    # (/api/v2/<tenant slug>/ paths) when it belongs to a tenant, the BookMe+ storefront otherwise.
+    # Each path is billed, and the other storefront's copy, if anything ever fetched one, expires
+    # within a CDN TTL anyway. Legacy /api/v2/tenant/ paths are never CDN-cached, so never cleared.
     class Invalidate
       prepend ::Spree::ServiceModule::Base
 
-      TENANT_PREFIX = '/api/v2/tenant/'.freeze
+      TENANT_PREFIX = '/api/v2/:tenant_slug/'.freeze
 
       SUPPORTED_MODELS = {
         'SpreeCmCommissioner::HomepageSection' => SpreeCmCommissioner::HomepageSection,
@@ -30,7 +30,7 @@ module SpreeCmCommissioner
       # path per BIT_SEGMENT key.
       HOMEPAGE_SECTION_PATTERNS = [
         '/api/v2/storefront/homepage*',
-        '/api/v2/tenant/homepage*'
+        '/api/v2/:tenant_slug/homepage*'
       ].freeze
 
       HOMEPAGE_BACKGROUND_PATTERNS = ['/api/v2/storefront/homepage*'].freeze
@@ -42,12 +42,13 @@ module SpreeCmCommissioner
       # which vendors are affected.
       #
       # vendor_id is a query param, so the trailing `*` is what clears every
-      # vendor's cached variant of this path in one go.
+      # vendor's cached variant of this path in one go. CloudFront allows `*` only at the end, so the
+      # tenant path expands to one path per tenant.
       #
       # Payment methods change a handful of times a year, so a broad invalidation
       # is cheap.
       PAYMENT_METHOD_PATTERNS = [
-        '/api/v2/tenant/payment_methods*',
+        '/api/v2/:tenant_slug/payment_methods*',
         '/api/v2/storefront/payment_methods*'
       ].freeze
 
@@ -60,7 +61,7 @@ module SpreeCmCommissioner
         invalidate_single_record(model_class: model_class, id: id)
       end
 
-      # eg. 'Spree::Product', 123 => ['/api/v2/tenant/products/123', '/api/v2/tenant/products/slug-of-product', ...]
+      # eg. 'Spree::Product', 123 => ['/api/v2/hangmeas/products/123*', '/api/v2/hangmeas/products/slug-of-product*']
       def invalidate_single_record(model_class:, id:)
         return failure(nil, "#{model_class.name} ID is required") if id.blank?
 
@@ -79,17 +80,27 @@ module SpreeCmCommissioner
         # The record's own class first (a Show found as a Spree::Taxon keeps its show paths), then the
         # model asked for, since STI subclasses such as Spree::Gateway::Payway have no entry of their own.
         patterns = single_api_pattern[record.class.name] || single_api_pattern[model_class.name]
-        return patterns if patterns.equal?(PAYMENT_METHOD_PATTERNS)
+        return expand_tenant_slug(patterns, SpreeCmCommissioner::Tenant.pluck(:slug)) if patterns.equal?(PAYMENT_METHOD_PATTERNS)
 
         tenant = tenant_of(record)
         patterns.select { |pattern| pattern.start_with?(TENANT_PREFIX) == tenant.present? }.map do |pattern|
           pattern.gsub(/:(\w+)/) do
             key = Regexp.last_match(1)
-            record.public_send(key).to_s
+            key == 'tenant_slug' ? tenant.slug : record.public_send(key).to_s
           end
         end
       end
 
+      # One copy of each `:tenant_slug` pattern per tenant; storefront patterns pass through as is.
+      def expand_tenant_slug(patterns, slugs)
+        slugs = slugs.compact_blank
+        patterns.flat_map do |pattern|
+          next [pattern] unless pattern.start_with?(TENANT_PREFIX)
+
+          slugs.map { |slug| pattern.sub(':tenant_slug', slug) }
+        end
+      end
+
       # A product, vendor or homepage section has its own tenant; a taxon, show or voting session has
       # its vendor's. Menus, seat layouts and homepage backgrounds are BookMe+ only.
       def tenant_of(record)
@@ -106,23 +117,23 @@ module SpreeCmCommissioner
           # The app reads menus from homepage_data; nothing calls /menus any more.
           'Spree::Menu' => ['/api/v2/storefront/homepage_data*'],
           'Spree::Taxon' => [
-            '/api/v2/tenant/taxons/:id*',
-            '/api/v2/tenant/taxons/:permalink*',
+            '/api/v2/:tenant_slug/taxons/:id*',
+            '/api/v2/:tenant_slug/taxons/:permalink*',
             '/api/v2/storefront/taxons/:id*',
             '/api/v2/storefront/taxons/:permalink*'
           ],
           'Spree::Product' => [
-            '/api/v2/tenant/products/:id*',
-            '/api/v2/tenant/products/:slug*',
+            '/api/v2/:tenant_slug/products/:id*',
+            '/api/v2/:tenant_slug/products/:slug*',
             '/api/v2/storefront/products/:id*',
             '/api/v2/storefront/products/:slug*'
           ],
-          'SpreeCmCommissioner::Show' => ['/api/v2/tenant/shows/:slug*'],
+          'SpreeCmCommissioner::Show' => ['/api/v2/:tenant_slug/shows/:slug*'],
           'SpreeCmCommissioner::VotingSession' => [
-            '/api/v2/tenant/voting_sessions/:id/voting_contestants*'
+            '/api/v2/:tenant_slug/voting_sessions/:id/voting_contestants*'
           ],
           'Spree::Vendor' => [
-            '/api/v2/tenant/vendors/:id*',
+            '/api/v2/:tenant_slug/vendors/:id*',
             '/api/v2/storefront/vendors/:id*',
             '/api/v2/storefront/accommodations/:id*',
             '/api/v2/storefront/accommodations/:slug*'

data/app/services/spree_cm_commissioner/api_caches/invalidate_all.rb

@@ -4,10 +4,7 @@ module SpreeCmCommissioner
     # serve them, which MaintenanceTasks::CacheInvalidation sends, as for Invalidate. `tenant` is
     # required so a clear-all never pays for both namespaces by accident: nil is the BookMe+
     # storefront (/api/v2/storefront/ paths), a SpreeCmCommissioner::Tenant is that tenant's API
-    # (/api/v2/tenant/ paths).
-    #
-    # Tenant APIs take the tenant from the OAuth token, not the URL, so every tenant shares one path
-    # today; taking the record keeps callers the same if tenant paths ever carry it.
+    # (/api/v2/<tenant slug>/ paths).
     #
     # eg. InvalidateAll.call(model: 'SpreeCmCommissioner::HomepageSection', tenant: nil)
     class InvalidateAll
@@ -20,11 +17,11 @@ module SpreeCmCommissioner
         'Spree::Menu' => ['/api/v2/storefront/homepage_data*'],
         'Spree::Taxon' => ['/api/v2/storefront/taxons/*'],
         'Spree::Product' => [
-          '/api/v2/tenant/products/*',
+          '/api/v2/:tenant_slug/products/*',
           '/api/v2/storefront/products/*'
         ],
         'Spree::Vendor' => [
-          '/api/v2/tenant/vendors/*',
+          '/api/v2/:tenant_slug/vendors/*',
           '/api/v2/storefront/vendors/*',
           '/api/v2/storefront/accommodations/*'
         ],
@@ -44,7 +41,8 @@ module SpreeCmCommissioner
 
       # Side-effect free, so the clear-cache dialog can show what a clear would send.
       def patterns_for(model, tenant:)
-        API_PATTERNS.fetch(model, []).select { |pattern| pattern.start_with?(Invalidate::TENANT_PREFIX) == tenant.present? }
+        patterns = API_PATTERNS.fetch(model, []).select { |pattern| pattern.start_with?(Invalidate::TENANT_PREFIX) == tenant.present? }
+        tenant ? Invalidate.new.expand_tenant_slug(patterns, [tenant.slug]) : patterns
       end
 
       # updated_at keys Spree's serializer and collection caches, so only this storefront's records

data/app/services/spree_cm_commissioner/draft_orders/create.rb

@@ -72,7 +72,8 @@ module SpreeCmCommissioner
           device_id: options[:device_id],
           last_ip_address: options[:last_ip_address]
         )
-        line_items_params.each { |line_item_params| build_line_item!(order, store, line_item_params) }
+        sellable_variants = store.variants.joins(:product).merge(Spree::Product.sellable_on(Spree::Product.sales_channel_for(tenant)))
+        line_items_params.each { |line_item_params| build_line_item!(order, sellable_variants, line_item_params) }
 
         ActiveRecord::Base.transaction do
           raise StandardError, order_error_message(order) unless order.save
@@ -105,8 +106,10 @@ module SpreeCmCommissioner
 
       # Builds (unsaved) an order.line_items member — persisted together with the order via
       # order.save's cascading autosave of new has_many records, same as TransitOrder::Create.
-      def build_line_item!(order, store, line_item_params)
-        variant = store.variants.find(line_item_params[:variant_id])
+      def build_line_item!(order, sellable_variants, line_item_params)
+        variant = sellable_variants.find_by(id: line_item_params[:variant_id])
+        raise StandardError, I18n.t('spree_cm_commissioner.draft_order.variant_not_available') if variant.nil?
+
         options = (line_item_params[:options] || {}).to_h.with_indifferent_access
         permitted_opts = ::Spree::PermittedAttributes.line_item_attributes.flatten.index_with { |attribute| options[attribute] }
         opts = permitted_opts.merge(currency: order.currency).compact

data/app/services/spree_cm_commissioner/events/publish_stock_statuses_to_firestore.rb

@@ -35,10 +35,10 @@ module SpreeCmCommissioner
         return success(:skipped) unless firestore_available?
 
         products = active_products(taxon).to_a
-        return success(:skipped) if products.empty?
-
-        sums = aggregate_quantities(products)
         existing_products = existing_products_data(taxon)
+        return success(:skipped) if products.empty? && existing_products.empty?
+
+        sums = products.empty? ? {} : aggregate_quantities(products)
         now = Time.zone.now
 
         changed = {}
@@ -51,6 +51,8 @@ module SpreeCmCommissioner
           changed[product.id.to_s] = build_entry(product, status, quantities, existing_products, now)
         end
 
+        prune_stale_entries(changed, products, existing_products)
+
         return success(:unchanged) if changed.empty?
 
         event_document(taxon).set({ products: changed, server_time: now }, merge: true)
@@ -66,6 +68,20 @@ module SpreeCmCommissioner
 
       private
 
+      # The write below is always `merge: true`, which only ever adds or updates map entries — it
+      # never drops one. So a product that stops being active (unlisted/unlinked from its section,
+      # discontinued, status flipped off — see `active_products`) would otherwise keep its last
+      # stock status in Firestore forever, and the app would go on rendering the removed product.
+      # Deleting the `products.<id>` field (nested FieldValue.delete, carried in the same merge set)
+      # is what actually removes it. existing_products is read even when no product is active, so an
+      # event whose every ticket got unlisted still gets its stale entries cleared.
+      def prune_stale_entries(changed, products, existing_products)
+        active_ids = products.map { |product| product.id.to_s }
+        (existing_products.keys - active_ids).each do |stale_id|
+          changed[stale_id] = firestore.field_delete
+        end
+      end
+
       # `quantities` is the [available, on_hold, locked, locked_on_hold] tuple from
       # `aggregate_quantities`. `previous_status` is read back from what's already stored, not
       # recomputed — it's the bucket this product was in on the last publish, if any.
@@ -117,6 +133,16 @@ module SpreeCmCommissioner
       # true. Caught via a real event whose products all had available_on: nil: the poll job was
       # returning :skipped for it on every cycle, so Firestore just sat frozen with stale data.
       #
+      # `preview: false` for the same reason unlisted products are excluded: events/{event_id} is
+      # publicly readable (no auth on the Firestore rule), so a preview product — active but held
+      # back from the public pending a PreviewRole, product_decorator.rb `publicly_available` — must
+      # not leak a live stock-status entry there before launch.
+      #
+      # `offline: false` because an offline product is deliberately not inventory-monitored (the
+      # admin form labels it "not monitored in Inventory Monitor", and InventoryItems finders like
+      # RecentlyChangedFinder already filter it out) — its Redis pools aren't maintained, so any
+      # stock status published for it would be meaningless.
+      #
       # `where(status: 'active')` instead of core's `Product.active` scope: that scope also joins
       # variants/prices in to filter by currency (`with_currency`), and `spree_variants` carries its
       # own `available_on`/`discontinue_on` columns — once that join is present, the raw,
@@ -133,7 +159,7 @@ module SpreeCmCommissioner
       # is excluded here too rather than still getting a live stock-status entry in Firestore.
       def active_products(taxon)
         now = Time.zone.now
-        taxon.event_products.ecommerce.where(status: 'active')
+        taxon.event_products.ecommerce.where(status: 'active', preview: false, offline: false)
              .where('available_on IS NULL OR available_on <= ?', now)
              .where('discontinue_on IS NULL OR discontinue_on > ?', now)
              .where(id: taxon.children_classifications.where(visible: true).select(:product_id))

data/config/initializers/spree_permitted_attributes.rb

@@ -16,8 +16,12 @@ module Spree
     # store_accessor key (public_metadata), not a DB column, so it must be permitted explicitly
     @@product_attributes << :enable_telegram_alert unless @@product_attributes.include?(:enable_telegram_alert)
     @@product_attributes << :enable_send_receipt unless @@product_attributes.include?(:enable_send_receipt)
+    @@product_attributes << :enable_confirmation_email unless @@product_attributes.include?(:enable_confirmation_email)
     @@product_attributes << :enable_social_sharing_email unless @@product_attributes.include?(:enable_social_sharing_email)
 
+    # Virtual writer toggling the platform bit of sales_channel (SalesChannelBitwise)
+    @@product_attributes << :sellable_on_platform unless @@product_attributes.include?(:sellable_on_platform)
+
     # Permitted all guest attributes for now as permitting only some guest attributes is not working by design
     # of spree add_item service, if we want to only permit some guest attributes,
     # we need to override most part of add_item service.

data/config/locales/en.yml

@@ -320,6 +320,7 @@ en:
     preset: "Preset"
     enable_telegram_alert: "Enable Telegram Alert"
     enable_send_receipt: "Enable Send Receipt"
+    enable_confirmation_email: "Enable Confirmation Email"
     enable_social_sharing_email: "Enable Social Sharing Email"
     telegram_alert_channels: "Telegram Alert Channels"
     telegram_chat_name: "Telegram Chat Name"
@@ -1342,6 +1343,7 @@ en:
           failed: "Failed"
     draft_order:
       line_items_missing: "Line items are missing"
+      variant_not_available: "This item is not available for purchase here"
     inventory_item:
       variant_taken_on: "The variant is taken on %{date}"
     topup_draft_order:

data/config/locales/km.yml

@@ -919,6 +919,7 @@ km:
           failed: "បរាជ័យ"
     draft_order:
       line_items_missing: "គ្មានទំនិញនៅក្នុងកន្ត្រកទេ"
+      variant_not_available: "ទំនិញនេះមិនអាចទិញនៅទីនេះបានទេ"
     inventory_item:
       variant_taken_on: "វ៉ារ្យ៉ង់នេះមានរួចហើយនៅថ្ងៃ %{date}"
     topup_draft_order:

data/config/routes.rb

@@ -513,17 +513,15 @@ Spree::Core::Engine.add_routes do
       end
 
       namespace :organizer do
-        resources :tickets do
-          resources :ticket_images
-        end
-        resources :images
-        resource :s3_signed_urls
         resources :invites
         resources :invite_guests, only: %i[show update]
         resources :invite_crews, only: %i[show update]
       end
 
-      namespace :tenant do
+      # Drawn twice below: legacy /api/v2/tenant/... (tenant from the OAuth token) and
+      # /api/v2/:tenant_slug/... (tenant from the URL). Tenant APIs are CDN-cached by URL, so only the
+      # slug form gives each tenant its own cache key; see Spree::Api::V2::Tenant::BaseController.
+      concern :tenant_api do
         resource :token, controller: :access_tokens, only: [:create]
         resource :telegram_oauth_token, controller: :telegram_oauth_tokens, only: [:create]
         resources :vendors
@@ -665,6 +663,10 @@ Spree::Core::Engine.add_routes do
         resources :pricing_previews, only: [:index]
       end
 
+      namespace :tenant do
+        concerns :tenant_api
+      end
+
       namespace :storefront do
         resource :token, controller: :access_tokens, only: [:create]
         resource :telegram_oauth_token, controller: :telegram_oauth_tokens, only: [:create]
@@ -869,6 +871,12 @@ Spree::Core::Engine.add_routes do
           resources :event_charts, only: %i[index show]
         end
       end
+
+      # Keep last in v2: the slug segment overlaps every literal namespace above, which
+      # TenantSlugConstraint reserves.
+      scope ':tenant_slug', module: :tenant, as: :tenant_scoped, constraints: SpreeCmCommissioner::TenantSlugConstraint.new do
+        concerns :tenant_api
+      end
     end
 
     namespace :json_ld do

data/db/migrate/20261103000001_add_sales_channel_to_spree_products.rb

@@ -0,0 +1,14 @@
+class AddSalesChannelToSpreeProducts < ActiveRecord::Migration[7.0]
+  def up
+    # Default 3 (direct + platform) backfills every existing row with today's behaviour:
+    # tenant products stay visible on both their tenant storefront and BookMe+.
+    add_column :spree_products, :sales_channel, :integer, default: 0b11, null: false
+
+    # BookMe+'s own products have no tenant storefront to sell on.
+    execute 'UPDATE spree_products SET sales_channel = 2 WHERE tenant_id IS NULL'
+  end
+
+  def down
+    remove_column :spree_products, :sales_channel
+  end
+end

data/lib/spree_cm_commissioner/s3_url_generator.rb

@@ -1,10 +1,17 @@
 module SpreeCmCommissioner
   class S3UrlGenerator
+    # Only keys S3PresignedUrlBuilder hands out to API callers. Without this, a client-supplied
+    # URL could point at any object in the bucket (e.g. another guest's ID card) and have it
+    # copied into their own attachment.
+    UPLOAD_KEY_FORMAT = %r{\Auploads/[\w-]+/[^/]+\z}
+
     # https://docs.aws.amazon.com/sdk-for-ruby/v1/api/AWS/S3/S3Object.html
     # The bucket is private, ie all the public access is blocked
     # key = "uploads/5f31/1697038252270.jpg"
+    # Returns nil for any other key; callers treat that as a failed fetch.
     def self.s3_presigned_url(url)
-      key = url.split('amazonaws.com/').last
+      key = upload_key(url)
+      return nil if key.nil?
 
       s3 = Aws::S3::Resource.new(region: ENV.fetch('AWS_REGION'),
                                  access_key_id: ENV.fetch('AWS_ACCESS_KEY_ID'),
@@ -16,5 +23,10 @@ module SpreeCmCommissioner
       object = bucket.object(key)
       object.presigned_url(:get, expires_in: 3600)
     end
+
+    def self.upload_key(url)
+      key = url.to_s.split('amazonaws.com/').last
+      key if key&.match?(UPLOAD_KEY_FORMAT)
+    end
   end
 end

data/lib/spree_cm_commissioner/tenant_slug_constraint.rb

@@ -0,0 +1,23 @@
+module SpreeCmCommissioner
+  # Guards the `/api/v2/:tenant_slug/...` routes, which share their first path segment with every
+  # literal v2 namespace. Without it `/api/v2/storefront/products` could resolve as tenant
+  # "storefront" depending on which engine draws its routes first. A pure string check, so routing
+  # never hits the DB; an unknown but well-formed slug still routes and 404s in
+  # Spree::Api::V2::Tenant::BaseController.
+  #
+  # RESERVED_SLUGS lives here rather than on SpreeCmCommissioner::Tenant so routes don't load an
+  # ActiveRecord model at boot. The routing spec fails when a new v2 namespace is missing from it.
+  class TenantSlugConstraint
+    RESERVED_SLUGS = %w[storefront platform tenant organizer operator].freeze
+    SLUG_FORMAT = /\A[a-z0-9][a-z0-9_-]*\z/
+
+    def self.valid_slug?(slug)
+      slug = slug.to_s
+      SLUG_FORMAT.match?(slug) && RESERVED_SLUGS.exclude?(slug)
+    end
+
+    def matches?(request)
+      self.class.valid_slug?(request.path_parameters[:tenant_slug])
+    end
+  end
+end

data/lib/spree_cm_commissioner/version.rb

@@ -1,5 +1,5 @@
 module SpreeCmCommissioner
-  VERSION = '2.14.7'.freeze
+  VERSION = '2.14.8'.freeze
 
   module_function
 

data/lib/spree_cm_commissioner.rb

@@ -10,6 +10,7 @@ require 'spree_vpago'
 
 require 'spree_cm_commissioner/engine'
 require 'spree_cm_commissioner/version'
+require 'spree_cm_commissioner/tenant_slug_constraint'
 require 'spree_cm_commissioner/passenger_option'
 require 'spree_cm_commissioner/payment_method_group'
 require 'spree_cm_commissioner/calendar_event'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_cm_commissioner
 version: !ruby/object:Gem::Version
-  version: 2.14.7
+  version: 2.14.8
 platform: ruby
 authors:
 - You
@@ -815,6 +815,7 @@ files:
 - app/controllers/concerns/spree_cm_commissioner/anonymous_booking_guard.rb
 - app/controllers/concerns/spree_cm_commissioner/content_cachable.rb
 - app/controllers/concerns/spree_cm_commissioner/exception_notificable.rb
+- app/controllers/concerns/spree_cm_commissioner/guest_owner_authorization.rb
 - app/controllers/concerns/spree_cm_commissioner/load_test_account_management.rb
 - app/controllers/concerns/spree_cm_commissioner/load_test_account_scope.rb
 - app/controllers/concerns/spree_cm_commissioner/load_test_bypassable.rb
@@ -954,13 +955,9 @@ files:
 - app/controllers/spree/api/v2/operator/recalculate_tickets_controller.rb
 - app/controllers/spree/api/v2/operator/taxons_controller.rb
 - app/controllers/spree/api/v2/organizer/base_controller.rb
-- app/controllers/spree/api/v2/organizer/images_controller.rb
 - app/controllers/spree/api/v2/organizer/invite_crews_controller.rb
 - app/controllers/spree/api/v2/organizer/invite_guests_controller.rb
 - app/controllers/spree/api/v2/organizer/invites_controller.rb
-- app/controllers/spree/api/v2/organizer/s3_signed_urls_controller.rb
-- app/controllers/spree/api/v2/organizer/ticket_images_controller.rb
-- app/controllers/spree/api/v2/organizer/tickets_controller.rb
 - app/controllers/spree/api/v2/platform/homepage_section_relatable_options_controller.rb
 - app/controllers/spree/api/v2/platform/option_types_controller_decorator.rb
 - app/controllers/spree/api/v2/platform/places_controller.rb
@@ -1517,6 +1514,7 @@ files:
 - app/models/concerns/spree_cm_commissioner/reschedule_request_state_machine.rb
 - app/models/concerns/spree_cm_commissioner/route_order_countable.rb
 - app/models/concerns/spree_cm_commissioner/route_type.rb
+- app/models/concerns/spree_cm_commissioner/sales_channel_bitwise.rb
 - app/models/concerns/spree_cm_commissioner/scoped_fee_rule.rb
 - app/models/concerns/spree_cm_commissioner/service_calendar_type.rb
 - app/models/concerns/spree_cm_commissioner/service_origin.rb
@@ -1531,6 +1529,7 @@ files:
 - app/models/concerns/spree_cm_commissioner/user_identity.rb
 - app/models/concerns/spree_cm_commissioner/user_notification.rb
 - app/models/concerns/spree_cm_commissioner/user_preference.rb
+- app/models/concerns/spree_cm_commissioner/user_uploaded_image.rb
 - app/models/concerns/spree_cm_commissioner/variant_metadata.rb
 - app/models/concerns/spree_cm_commissioner/variant_options_concern.rb
 - app/models/concerns/spree_cm_commissioner/variant_rate_plannable.rb
@@ -1913,6 +1912,7 @@ files:
 - app/overrides/spree/admin/products/_form/allow_transfer.html.erb.deface
 - app/overrides/spree/admin/products/_form/available_on.html.erb.deface
 - app/overrides/spree/admin/products/_form/discontinue_on.html.erb.deface
+- app/overrides/spree/admin/products/_form/enable_confirmation_email.html.erb.deface
 - app/overrides/spree/admin/products/_form/enable_inventory_hold.html.erb.deface
 - app/overrides/spree/admin/products/_form/enable_send_receipt.html.erb.deface
 - app/overrides/spree/admin/products/_form/enable_social_sharing_email.html.erb.deface
@@ -1928,6 +1928,7 @@ files:
 - app/overrides/spree/admin/products/_form/replace_vendor_label.html.erb.deface
 - app/overrides/spree/admin/products/_form/required_self_check_in_location.html.erb.deface
 - app/overrides/spree/admin/products/_form/reveal_description_to_user.html.erb.deface
+- app/overrides/spree/admin/products/_form/sellable_on_platform.html.erb.deface
 - app/overrides/spree/admin/products/_form/subscribable_checkbox.html.erb.deface
 - app/overrides/spree/admin/products/_form/taxons.html.erb.deface
 - app/overrides/spree/admin/products/_form/use_video_as_default.html.erb.deface
@@ -2106,13 +2107,10 @@ files:
 - app/serializers/spree/api/v2/platform/service_fee_rule_serializer.rb
 - app/serializers/spree/v2/organizer/asset_serializer.rb
 - app/serializers/spree/v2/organizer/base_serializer.rb
-- app/serializers/spree/v2/organizer/image_serializer.rb
 - app/serializers/spree/v2/organizer/invite_crews_serializer.rb
 - app/serializers/spree/v2/organizer/invite_guest_serializer.rb
 - app/serializers/spree/v2/organizer/invite_serializer.rb
-- app/serializers/spree/v2/organizer/s3_signed_url_serializer.rb
 - app/serializers/spree/v2/organizer/taxon_serializer.rb
-- app/serializers/spree/v2/organizer/ticket_serializer.rb
 - app/serializers/spree/v2/organizer/user_serializer.rb
 - app/serializers/spree/v2/storefront/accommodation_serializer.rb
 - app/serializers/spree/v2/storefront/active_homepage_event_serializer.rb
@@ -3776,6 +3774,7 @@ files:
 - db/migrate/20261013000002_move_hidden_from_spree_option_types_to_product_option_types.rb
 - db/migrate/20261016000001_add_index_to_spree_line_items_number.rb
 - db/migrate/20261021000001_add_section_type_to_cm_homepage_sections.rb
+- db/migrate/20261103000001_add_sales_channel_to_spree_products.rb
 - docker-compose.yml
 - docs/api/scoped-access-token-endpoints.md
 - docs/option_types/attr_types.md
@@ -3833,6 +3832,7 @@ files:
 - lib/spree_cm_commissioner/stay_prices.rb
 - lib/spree_cm_commissioner/store_credit_currency_summary.rb
 - lib/spree_cm_commissioner/store_credit_summary.rb
+- lib/spree_cm_commissioner/tenant_slug_constraint.rb
 - lib/spree_cm_commissioner/test_helper/factories/address_factory.rb
 - lib/spree_cm_commissioner/test_helper/factories/agency_factory.rb
 - lib/spree_cm_commissioner/test_helper/factories/asset_factory.rb