spree_cm_commissioner 2.14.7 → 2.14.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2828d409efc450a1771a72ddee9866379996fbe09b29ee4eec5b446ed4d6acfc
-  data.tar.gz: 0cf499cd5d3bb7947385761cfff6c569a9180f96fe60426fa3ba802dece704a9
+  metadata.gz: b5426f6a834611d1c303d1305de10998cea1cd5b6ca72c23f512ddff53614b2a
+  data.tar.gz: cb6688095f5daef9df50906c20d5adb5cba20dc4f2657a430b1d2ab00afaaaf6
 SHA512:
-  metadata.gz: c2531492454f38d71fbcb6115b97d442b29631b49b92cc5c8961cc395b761014bf24c53a99301150a5480ac42484838319dbac8c7d8f3d924708a6585bc7f9b1
-  data.tar.gz: 7e4bf0769cfdc8364a492fdb6fabbce2d72f1da7df9289dbbf68562312d3604880918f5eab80aa4b3e5f4098366fa8bc7c2ae38907bd8fc2a9b5fae60e92bcc0
+  metadata.gz: e609a94743b1283a225d077dad5ba3f775ed599985d687f8b6c4408de286bc6f8b6e91e4024e675ec03ae06a67a013fa43cc6242cc50070a334bc2ac4731e7d0
+  data.tar.gz: d007f4f9a802452c020d32f32f44c466e88469ea24386c87f8b45c834ced740d1faf55185d953901640fd1dd73f19af686667ef9f29e615b97642aadc8645020

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.14.7)
+    spree_cm_commissioner (2.14.9)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -88,8 +88,16 @@ module SpreeCmCommissioner
       ContentCachable.cdn_max_age(cdn_cache_config&.dig(:max_age))
     end
 
+    # A tenant API is cacheable only on its /api/v2/:tenant_slug/ path. The legacy /api/v2/tenant/
+    # path takes the tenant from the OAuth token, which is not in the cache key, so caching it would
+    # serve one tenant's response to every other tenant.
     def cdn_cacheable?
-      request.get? && cdn_cache_config.present? && cdn_cache_config[:actions].include?(action_name)
+      request.get? && cdn_cache_config.present? && cdn_cache_config[:actions].include?(action_name) &&
+        (!tenant_api? || params[:tenant_slug].present?)
+    end
+
+    def tenant_api?
+      self.class.name.to_s.start_with?('Spree::Api::V2::Tenant::')
     end
 
     def set_cache_control_for_cdn

data/app/controllers/concerns/spree_cm_commissioner/guest_owner_authorization.rb

@@ -0,0 +1,30 @@
+module SpreeCmCommissioner
+  # For per-guest endpoints that touch the guest's ID card photos. The app calls these during
+  # checkout (order token, or the logged-in owner) and after it from pending guests (logged-in
+  # owner of a complete order). That's why ownership is checked here and not with the
+  # `:update, Order` ability, which refuses completed orders.
+  module GuestOwnerAuthorization
+    extend ActiveSupport::Concern
+
+    private
+
+    # 404 rather than 403 for someone else's guest, so sequential guest ids can't be probed.
+    def authorized_guest
+      @authorized_guest ||= begin
+        guest = SpreeCmCommissioner::Guest.find(params[:guest_id])
+        raise ActiveRecord::RecordNotFound unless guest_owned_by_requester?(guest)
+
+        guest
+      end
+    end
+
+    def guest_owned_by_requester?(guest)
+      order = guest.line_item&.order
+      user = spree_current_user
+      return true if user.present? && (guest.user_id == user.id || order&.user_id == user.id)
+
+      token = request.headers['X-Spree-Order-Token'].presence || params[:order_token].presence
+      token.present? && order&.token.present? && ActiveSupport::SecurityUtils.secure_compare(order.token, token)
+    end
+  end
+end

data/app/controllers/spree/admin/stock_managements_controller.rb

@@ -1,14 +1,25 @@
 module Spree
   module Admin
     class StockManagementsController < Spree::Admin::ResourceController
+      include Spree::Admin::ProductConcern
+
       skip_before_action :load_resource
 
       before_action :load_parent
 
       helper SpreeCmCommissioner::Admin::InventoryItemsHelper
 
+      # Same lookup as Spree's ProductsController: friendly.find accepts both slug and id links
+      # (e.g. /admin/products/938/stock_managements) and raises on a miss instead of leaving @product nil.
       def load_parent
-        @product = Spree::Product.find_by(slug: params[:product_id])
+        @product = product_scope.friendly.find(params[:product_id])
+      end
+
+      # ResourceController's handler names model_class (StockItem) in the flash and redirects to
+      # collection_url (/admin/stock_items), which has no GET route — so point both at products instead.
+      def resource_not_found
+        flash[:error] = flash_message_for(Spree::Product.new, :not_found)
+        redirect_to spree.admin_products_path
       end
 
       def index

data/app/controllers/spree/api/v2/organizer/invites_controller.rb

@@ -3,6 +3,10 @@ module Spree
     module V2
       module Organizer
         class InvitesController < ::Spree::Api::V2::Organizer::BaseController
+          # Accepting grants the operator role, so it must be the invitee's own decision: the
+          # token alone only proves someone has the link.
+          before_action :require_spree_current_user, only: :update
+
           def show
             if invite&.url_valid?
               render_serialized_payload { serialize_resource(invite) }
@@ -12,7 +16,7 @@ module Spree
           end
 
           def update
-            context = invite.confirm(params[:user_id])
+            context = invite.confirm(spree_current_user.id)
 
             if context.success?
               render_serialized_payload { serialize_resource(context.invite) }

data/app/controllers/spree/api/v2/storefront/guests_controller.rb

@@ -4,6 +4,7 @@ module Spree
       module Storefront
         class GuestsController < ::Spree::Api::V2::ResourceController
           include OrderConcern
+          include SpreeCmCommissioner::GuestOwnerAuthorization
 
           # raise 404 when no order, except for show
           before_action :ensure_order, except: [:show]
@@ -23,9 +24,9 @@ module Spree
             SpreeCmCommissioner::V2::Storefront::GuestSerializer
           end
 
+          # The serializer includes the guest's ID card, so show must be as strict as id_cards.
           def show
-            @guest = SpreeCmCommissioner::Guest.find(params[:id])
-            render_serialized_payload { serialize_resource(@guest) }
+            render_serialized_payload { serialize_resource(owned_guest) }
           end
 
           def create
@@ -44,9 +45,7 @@ module Spree
           end
 
           def update
-            spree_authorize! :update, spree_current_order, order_token unless guest_for_update.pre_registration?
-
-            result = SpreeCmCommissioner::Guests::Update.call(guest: guest_for_update, guest_params: guest_params)
+            result = SpreeCmCommissioner::Guests::Update.call(guest: owned_guest, guest_params: guest_params)
 
             if result.success?
               render_serialized_payload { serialize_resource(result.value[:guest]) }
@@ -66,8 +65,15 @@ module Spree
             @parent ||= spree_current_order.line_items.find(params[:line_item_id])
           end
 
-          def guest_for_update
-            @guest_for_update ||= SpreeCmCommissioner::Guest.find(params[:id])
+          # Checked against the guest's own order: spree_current_order is just the caller's cart,
+          # which says nothing about whether they own this guest.
+          def owned_guest
+            @owned_guest ||= begin
+              guest = SpreeCmCommissioner::Guest.find(params[:id])
+              raise ActiveRecord::RecordNotFound unless guest_owned_by_requester?(guest)
+
+              guest
+            end
           end
 
           def guest_params

data/app/controllers/spree/api/v2/storefront/id_cards_controller.rb

@@ -3,12 +3,14 @@ module Spree
     module V2
       module Storefront
         class IdCardsController < ::Spree::Api::V2::ResourceController
+          include SpreeCmCommissioner::GuestOwnerAuthorization
+
           def create
             context = SpreeCmCommissioner::GuestIdCardManager.call(
               card_type: id_card_params[:card_type],
               front_image_url: id_card_params[:front_image_url],
               back_image_url: id_card_params[:back_image_url],
-              guest_id: id_card_params[:guest_id]
+              guest: authorized_guest
             )
 
             if context.success?
@@ -23,7 +25,7 @@ module Spree
               card_type: id_card_params[:card_type],
               front_image_url: id_card_params[:front_image_url],
               back_image_url: id_card_params[:back_image_url],
-              guest_id: id_card_params[:guest_id]
+              guest: authorized_guest
             )
 
             if context.success?
@@ -34,7 +36,7 @@ module Spree
           end
 
           def destroy
-            id_card = SpreeCmCommissioner::IdCard.find(params[:id])
+            id_card = SpreeCmCommissioner::IdCard.find_by!(id: params[:id], guest_id: authorized_guest.id)
 
             if id_card.destroy
               render_serialized_payload(204) { serialize_resource(id_card) }
@@ -46,7 +48,7 @@ module Spree
           private
 
           def id_card_params
-            params.permit(:card_type, :front_image_url, :back_image_url, :guest_id)
+            params.permit(:card_type, :front_image_url, :back_image_url)
           end
 
           def model_class

data/app/controllers/spree/api/v2/storefront/products_controller_decorator.rb

@@ -4,7 +4,7 @@ module Spree
       module Storefront
         module ProductsControllerDecorator
           def scope
-            super.where(preview: false)
+            super.where(preview: false).sellable_on(:platform)
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/s3_signed_urls_controller.rb

@@ -12,10 +12,11 @@ module Spree
           end
 
           def resource
+            # Never take bucket_name/object_key from params: the key is always generated server-side.
+            # Reachable without login (app token only), so S3 also enforces the upload size.
             SpreeCmCommissioner::S3PresignedUrlBuilder.call(
-              bucket_name: params[:bucket_name],
-              object_key: params[:object_key],
-              file_name: params[:file_name]
+              file_name: params[:file_name],
+              content_length_range: 1..SpreeCmCommissioner::UserUploadedImage::MAX_SIZE
             )
           end
 

data/app/controllers/spree/api/v2/tenant/base_controller.rb

@@ -8,14 +8,34 @@ module Spree
           set_current_tenant_through_filter
           before_action :require_tenant
 
+          # /api/v2/:tenant_slug/... takes the tenant from the URL so the CDN, which caches by URL,
+          # never serves one tenant's response to another. Legacy /api/v2/tenant/... still takes it
+          # from the OAuth token and is not CDN-cached (see SpreeCmCommissioner::ContentCachable).
           def require_tenant
-            raise Doorkeeper::Errors::DoorkeeperError if doorkeeper_token&.application.nil?
-            raise Doorkeeper::Errors::DoorkeeperError if doorkeeper_token.application.tenant.nil?
+            @tenant = tenant_from_path || tenant_from_token
+            raise Doorkeeper::Errors::DoorkeeperError if @tenant.nil?
 
-            @tenant = doorkeeper_token.application.tenant
             set_current_tenant(@tenant)
           end
 
+          # Slugs only (current or FriendlyId history, so a renamed tenant keeps working in shipped
+          # apps), never numeric ids, so each tenant has one cacheable URL. A token minted for another
+          # tenant's app, or for the BookMe+ storefront app, is refused rather than letting its user
+          # act inside this tenant.
+          def tenant_from_path
+            return if params[:tenant_slug].blank?
+
+            # FriendlyId's own finder (slug + history, never the numeric id), not a dynamic finder.
+            tenant = SpreeCmCommissioner::Tenant.friendly.find_by_friendly_id(params[:tenant_slug]) # rubocop:disable Rails/DynamicFindBy
+            raise Doorkeeper::Errors::DoorkeeperError if doorkeeper_token && doorkeeper_token.application&.tenant_id != tenant.id
+
+            tenant
+          end
+
+          def tenant_from_token
+            doorkeeper_token&.application&.tenant
+          end
+
           def current_vendor
             @current_vendor ||= @tenant.active_vendor
           end

data/app/controllers/spree/api/v2/tenant/cart_controller.rb

@@ -192,7 +192,7 @@ module Spree
           end
 
           def load_variant
-            @variant = current_store.variants.find(add_item_params[:variant_id])
+            @variant = current_store.variants.joins(:product).merge(Spree::Product.sellable_on(:direct)).find(add_item_params[:variant_id])
           end
 
           def render_error_item_quantity

data/app/controllers/spree/api/v2/tenant/id_cards_controller.rb

@@ -3,12 +3,14 @@ module Spree
     module V2
       module Tenant
         class IdCardsController < BaseController
+          include SpreeCmCommissioner::GuestOwnerAuthorization
+
           def create
             context = SpreeCmCommissioner::GuestIdCardManager.call(
               card_type: id_card_params[:card_type],
               front_image_url: id_card_params[:front_image_url],
               back_image_url: id_card_params[:back_image_url],
-              guest_id: id_card_params[:guest_id]
+              guest: authorized_guest
             )
 
             if context.success?
@@ -23,7 +25,7 @@ module Spree
               card_type: id_card_params[:card_type],
               front_image_url: id_card_params[:front_image_url],
               back_image_url: id_card_params[:back_image_url],
-              guest_id: id_card_params[:guest_id]
+              guest: authorized_guest
             )
 
             if context.success?
@@ -34,7 +36,7 @@ module Spree
           end
 
           def destroy
-            id_card = SpreeCmCommissioner::IdCard.find(params[:id])
+            id_card = SpreeCmCommissioner::IdCard.find_by!(id: params[:id], guest_id: authorized_guest.id)
 
             if id_card.destroy
               head :no_content
@@ -46,7 +48,7 @@ module Spree
           private
 
           def id_card_params
-            params.permit(:card_type, :front_image_url, :back_image_url, :guest_id)
+            params.permit(:card_type, :front_image_url, :back_image_url)
           end
 
           def model_class

data/app/controllers/spree/api/v2/tenant/payment_methods_controller.rb

@@ -7,8 +7,7 @@ module Spree
         # vendor_id is a required query param, and payout is an optional one (caller
         # passes Order#required_payway_payout? — see PaymentMethods::Find). A vendor id
         # is globally unique and belongs to exactly one tenant, so it is what identifies
-        # tenant, vendor and store here — the tenant itself comes from the Doorkeeper
-        # token, not the URL.
+        # vendor and store here; the tenant comes from BaseController#require_tenant.
         #
         # IMPORTANT for caching (see SpreeCmCommissioner::ContentCachable): the CDN
         # must include vendor_id in its cache key. If query strings are stripped,

data/app/controllers/spree/api/v2/tenant/products_controller.rb

@@ -21,7 +21,7 @@ module Spree
 
           def scope
             MultiTenant.with(@tenant) do
-              model_class.where(tenant_id: MultiTenant.current_tenant_id, preview: false)
+              model_class.where(tenant_id: MultiTenant.current_tenant_id, preview: false).sellable_on(:direct)
             end
           end
 

data/app/controllers/spree/api/v2/tenant/s3_signed_urls_controller.rb

@@ -12,10 +12,11 @@ module Spree
           end
 
           def resource
+            # Never take bucket_name/object_key from params: the key is always generated server-side.
+            # Reachable without login (app token only), so S3 also enforces the upload size.
             SpreeCmCommissioner::S3PresignedUrlBuilder.call(
-              bucket_name: params[:bucket_name],
-              object_key: params[:object_key],
-              file_name: params[:file_name]
+              file_name: params[:file_name],
+              content_length_range: 1..SpreeCmCommissioner::UserUploadedImage::MAX_SIZE
             )
           end
 

data/app/interactors/spree_cm_commissioner/guest_id_card_manager.rb

@@ -1,6 +1,7 @@
 module SpreeCmCommissioner
   class GuestIdCardManager < BaseInteractor
-    delegate :card_type, :front_image_url, :back_image_url, :guest_id, to: :context
+    # guest: the caller must already have checked the requester owns this guest.
+    delegate :card_type, :front_image_url, :back_image_url, :guest, to: :context
 
     def call
       if guest.id_card.blank? && front_image_url.present?
@@ -31,31 +32,39 @@ module SpreeCmCommissioner
       context.result = guest.id_card
     end
 
-    def guest
-      SpreeCmCommissioner::Guest.find(guest_id)
-    end
-
     def manage_card_type(id_card)
       id_card.update(card_type: card_type)
     end
 
+    # Fails this interactor's own context: failing the updater's context instead raises a Failure
+    # that Interactor#run swallows, so the request would report success with nothing attached.
     def manage_front_image(id_card)
-      context = SpreeCmCommissioner::IdCardImageUpdater.call(
+      return if unchanged_image?(id_card.front_image, front_image_url)
+
+      result = SpreeCmCommissioner::IdCardImageUpdater.call(
         id_card: id_card,
         image_url: front_image_url,
         type: 'front_image'
       )
 
-      context.fail!(message: 'Failed to update front image') unless context.success?
+      context.fail!(message: 'Failed to update front image') unless result.success?
     end
 
     def manage_back_image(id_card)
-      context = SpreeCmCommissioner::IdCardImageUpdater.call(
+      return if unchanged_image?(id_card.back_image, back_image_url)
+
+      result = SpreeCmCommissioner::IdCardImageUpdater.call(
         id_card: id_card,
         image_url: back_image_url,
         type: 'back_image'
       )
-      context.fail!(message: 'Failed to update back image') unless context.success?
+      context.fail!(message: 'Failed to update back image') unless result.success?
+    end
+
+    # The app sends the whole card back on every edit, so a side the user didn't replace arrives as
+    # that image's existing URL rather than a new upload. Keep it instead of failing the fetch.
+    def unchanged_image?(image, url)
+      image.present? && SpreeCmCommissioner::S3UrlGenerator.upload_key(url).nil?
     end
   end
 end

data/app/interactors/spree_cm_commissioner/id_card_image_updater.rb

@@ -4,10 +4,9 @@ module SpreeCmCommissioner
 
     def call
       presigned_url = SpreeCmCommissioner::S3UrlGenerator.s3_presigned_url(context.image_url)
+      response = Faraday.get(presigned_url) if presigned_url
 
-      response = Faraday.get(presigned_url)
-
-      if response.success?
+      if response&.success?
         id_card = context.id_card
         io = StringIO.new(response.body)
         filename = File.basename(context.image_url)
@@ -20,7 +19,11 @@ module SpreeCmCommissioner
         else
           context.fail!(message: id_card_image.errors.full_messages.join(','))
         end
+      else
+        context.fail!(message: I18n.t('s3.image.upload.fail'))
       end
+    rescue Interactor::Failure
+      raise
     rescue StandardError => e
       context.fail!(message: "Error fetching the remote image: #{e.message}")
     end

data/app/interactors/spree_cm_commissioner/image_saver.rb

@@ -2,10 +2,9 @@ module SpreeCmCommissioner
   class ImageSaver < BaseInteractor
     def call
       presigned_url = SpreeCmCommissioner::S3UrlGenerator.s3_presigned_url(context.url)
+      response = Faraday.get(presigned_url) if presigned_url
 
-      response = Faraday.get(presigned_url)
-
-      if response.success?
+      if response&.success?
         io = StringIO.new(response.body)
         filename = File.basename(context.url)
 
@@ -20,6 +19,8 @@ module SpreeCmCommissioner
       else
         context.fail!(message: I18n.t('s3.image.upload.fail'))
       end
+    rescue Interactor::Failure
+      raise
     rescue StandardError => e
       context.fail!(message: e.message)
     end

data/app/interactors/spree_cm_commissioner/profile_image_updater.rb

@@ -3,10 +3,9 @@ module SpreeCmCommissioner
     # url: 'https://mybucket.s3.ap-southeast-1.amazonaws.com/uploads/5f31/1697038252270.jpg'
     def call
       presigned_url = SpreeCmCommissioner::S3UrlGenerator.s3_presigned_url(context.url)
+      response = Faraday.get(presigned_url) if presigned_url
 
-      response = Faraday.get(presigned_url)
-
-      if response.success?
+      if response&.success?
         user = context.user
         io = StringIO.new(response.body)
         filename = File.basename(context.url)
@@ -20,7 +19,11 @@ module SpreeCmCommissioner
         else
           context.fail!(message: profile.errors.full_messages.join(','))
         end
+      else
+        context.fail!(message: I18n.t('s3.image.upload.fail'))
       end
+    rescue Interactor::Failure
+      raise
     rescue StandardError => e
       context.fail!(message: "Error fetching the remote image: #{e.message}")
     end

data/app/jobs/concerns/spree_cm_commissioner/idempotent_job.rb

@@ -1,12 +1,13 @@
 module SpreeCmCommissioner
   module IdempotentJob
-    def with_idempotency(key = nil, &block)
-      SpreeCmCommissioner::IdempotencyKey.run_once(key.presence || default_idempotency_key, &block)
-    end
+    # The enqueuer mints one key per side effect being mirrored (e.g. one per Redis change) and
+    # passes it in the job args, so a retry or re-delivery of that job dedups while a genuinely new
+    # change always applies. No fallback: a key derived from the payload made legitimate repeats
+    # (unstock after restock, a re-acquired hold) look like duplicates and silently skipped them.
+    def with_idempotency(key, &block)
+      raise ArgumentError, "#{self.class.name} requires an idempotency_key" if key.blank?
 
-    # Namespaced so the key is self-describing in the DB (no `source` column needed).
-    def default_idempotency_key
-      "#{self.class.name}:#{job_id}"
+      SpreeCmCommissioner::IdempotencyKey.run_once(key, &block)
     end
   end
 end

data/app/jobs/spree_cm_commissioner/inventory_items/bulk_adjust_quantities_job.rb

@@ -6,26 +6,17 @@ module SpreeCmCommissioner
       queue_as :inventory_item
 
       def perform(options = {})
-        with_idempotency(idempotency_key_for(options)) do
+        with_idempotency(options[:idempotency_key]) do
           bulk_adjust_quantities!(options)
         end
       end
 
       private
 
-      # Dedup on the line items being synced, so a re-pushed payload for the same
-      # line items no-ops. An explicit key wins; with no line items we fall back to
-      # the per-enqueue job_id (returning nil lets with_idempotency apply that default).
-      def idempotency_key_for(options)
-        return options[:idempotency_key] if options[:idempotency_key].present?
-        return nil if options[:line_item_ids].blank?
-
-        "line_item:#{options[:line_item_ids].compact.uniq.sort.join(':')}"
-      end
-
-      # :line_item_ids, :inventory_id_and_quantities, :caller_source
+      # :line_item_ids, :inventory_id_and_quantities, :caller_source, :idempotency_key
       #
-      # :caller_source is a string like "ClassName#method" identifying who enqueued the job.
+      # :line_item_ids is for tracing only. :caller_source is a string like "ClassName#method"
+      # identifying who enqueued the job.
       def bulk_adjust_quantities!(options = {})
         SpreeCmCommissioner::InventoryItems::BulkAdjustQuantities.call!(
           inventory_id_and_quantities: options[:inventory_id_and_quantities],

data/app/jobs/spree_cm_commissioner/inventory_items/bulk_adjust_quantities_on_convert_job.rb

@@ -6,33 +6,14 @@ module SpreeCmCommissioner
       queue_as :inventory_item
 
       def perform(options = {})
-        with_idempotency(idempotency_key_for(options)) do
+        with_idempotency(options[:idempotency_key]) do
           bulk_adjust_quantities_on_convert(options)
         end
       end
 
       private
 
-      # Dedup on the order + the exact adjustment set, same shape as BulkAdjustQuantitiesOnHoldJob.
-      # An explicit key wins; with no order_id we fall back to the per-enqueue job_id (returning
-      # nil lets with_idempotency apply that default).
-      def idempotency_key_for(options)
-        return options[:idempotency_key] if options[:idempotency_key].present?
-        return nil if options[:order_id].blank?
-
-        "order:#{options[:order_id]}:convert:#{adjustments_fingerprint(options[:inventory_id_and_quantities])}"
-      end
-
-      # Readable, order-independent fingerprint of the adjustment payload, e.g. "1=2,2=-1:locked".
-      def adjustments_fingerprint(adjustments)
-        Array(adjustments)
-          .map { |adj| adj.with_indifferent_access.values_at(:inventory_id, :quantity, :locked) }
-          .sort_by { |inventory_id, quantity, locked| [inventory_id.to_s, quantity.to_s, locked.to_s] }
-          .map { |inventory_id, quantity, locked| locked ? "#{inventory_id}=#{quantity}:locked" : "#{inventory_id}=#{quantity}" }
-          .join(',')
-      end
-
-      # :order_id, :inventory_id_and_quantities, :caller_source
+      # :order_id, :inventory_id_and_quantities, :caller_source, :idempotency_key
       def bulk_adjust_quantities_on_convert(options = {})
         raise ArgumentError, 'order_id is required' if options[:order_id].blank?
         raise ArgumentError, 'inventory_id_and_quantities is required' if options[:inventory_id_and_quantities].blank?

data/app/jobs/spree_cm_commissioner/inventory_items/bulk_adjust_quantities_on_hold_job.rb

@@ -6,42 +6,16 @@ module SpreeCmCommissioner
       queue_as :inventory_item
 
       def perform(options = {})
-        with_idempotency(idempotency_key_for(options)) do
+        with_idempotency(options[:idempotency_key]) do
           bulk_adjust_quantities_on_hold(options)
         end
       end
 
       private
 
-      # Dedup on the order + the exact adjustment set, so a re-pushed identical
-      # on-hold payload no-ops while a genuinely different one re-applies. An explicit
-      # key wins; with no order_id we fall back to the per-enqueue job_id (returning
-      # nil lets with_idempotency apply that default).
-      def idempotency_key_for(options)
-        return options[:idempotency_key] if options[:idempotency_key].present?
-        return nil if options[:order_id].blank?
-
-        "order:#{options[:order_id]}:hold:#{adjustments_fingerprint(options[:inventory_id_and_quantities])}"
-      end
-
-      # Readable, order-independent fingerprint of the adjustment payload, e.g. "1=2,2=-1:locked".
-      # Delimiter hierarchy: ":" separates key fields, "," separates adjustments, "=" pairs id/qty.
-      #
-      # The pool is part of the identity: a mixed order can carry a public and a locked adjustment
-      # with the same inventory_id and quantity, and without this they fingerprint identically — so
-      # one of the two would be dropped as a duplicate and its counter never mirrored.
-      def adjustments_fingerprint(adjustments)
-        Array(adjustments)
-          .map { |adj| adj.with_indifferent_access.values_at(:inventory_id, :quantity, :locked) }
-          .sort_by { |inventory_id, quantity, locked| [inventory_id.to_s, quantity.to_s, locked.to_s] }
-          .map { |inventory_id, quantity, locked| locked ? "#{inventory_id}=#{quantity}:locked" : "#{inventory_id}=#{quantity}" }
-          .join(',')
-      end
-
-      # :order_id, :inventory_id_and_quantities, :caller_source
+      # :order_id, :inventory_id_and_quantities, :caller_source, :idempotency_key
       #
-      # :order_id is used for unique idempotency key generation to prevent duplicate
-      # processing, though it's not used in the adjustment itself.
+      # :order_id is required for tracing, though it's not used in the adjustment itself.
       # :caller_source is a string like "ClassName#method" identifying who enqueued the job.
       def bulk_adjust_quantities_on_hold(options = {})
         raise ArgumentError, 'order_id is required' if options[:order_id].blank?