spree_cm_commissioner 2.14.7 → 2.14.9

data/app/models/concerns/spree_cm_commissioner/firestore_connection.rb

@@ -1,10 +1,11 @@
 require 'google/cloud/firestore'
 
 module SpreeCmCommissioner
-  # Shared Cloud Firestore client construction, used across the waiting-room services (see
-  # WaitingRoom::Admission::CallGuests, WaitingRoom::Positions::Stamp,
-  # WaitingRoom::Sessions::Issue) plus a #firestore_available? guard so environments without the
-  # credential (dev, test, CI) no-op instead of raising on connect.
+  # Cloud Firestore access for services (see WaitingRoom::Admission::CallGuests,
+  # WaitingRoom::Positions::Stamp, WaitingRoom::Sessions::Issue) plus a #firestore_available?
+  # guard so environments without the credential (dev, test, CI) no-op instead of raising on
+  # connect. The client comes from FirestoreClients, shared per process and per project; a service
+  # for another Firebase project overrides #service_account.
   module FirestoreConnection
     extend ActiveSupport::Concern
 
@@ -13,14 +14,11 @@ module SpreeCmCommissioner
     end
 
     def firestore
-      @firestore ||= Google::Cloud::Firestore.new(
-        project_id: service_account[:project_id],
-        credentials: service_account
-      )
+      @firestore ||= SpreeCmCommissioner::FirestoreClients.fetch(service_account)
     end
 
     def service_account
-      @service_account ||= Rails.application.credentials.cloud_firestore_service_account
+      @service_account ||= SpreeCmCommissioner::FirestoreClients.default_service_account
     end
   end
 end

data/app/models/concerns/spree_cm_commissioner/order_state_machine.rb

@@ -87,7 +87,7 @@ module SpreeCmCommissioner
         after_transition from: :requested, to: :accepted, do: :decrement_user_request_orders_count
         after_transition to: :accepted, do: :send_order_accepted_app_notification_to_user
         after_transition to: :accepted, do: :send_order_accepted_telegram_alert_to_store
-        after_transition to: :accepted, if: :confirmation_delivered?, do: :deliver_order_confirmation_email
+        after_transition to: :accepted, unless: :confirmation_delivered?, do: :deliver_order_confirmation_email
 
         event :reject do
           transition from: :requested, to: :rejected
@@ -144,14 +144,6 @@ module SpreeCmCommissioner
       subscription? || prepaid_top_up_order?
     end
 
-    # override
-    def deliver_order_confirmation_email
-      return if requested?
-      return if any_app_only_products?
-
-      super
-    end
-
     def increment_user_request_orders_count
       return if user.nil?
 

data/app/models/concerns/spree_cm_commissioner/sales_channel_bitwise.rb

@@ -0,0 +1,44 @@
+module SpreeCmCommissioner
+  module SalesChannelBitwise
+    extend ActiveSupport::Concern
+
+    # Append only: stored values are bit masks. Names follow the `channel_direct` /
+    # `channel_platform` channel types in docs/concepts/multi-channel-pricing.md.
+    BIT_SALES_CHANNEL = {
+      direct: 0b01,  # the tenant's own app/web
+      platform: 0b10 # the BookMe+ marketplace
+    }.freeze
+
+    included do
+      validates :sales_channel, numericality: { greater_than: 0 }
+
+      # Runs after ProductDecorator#set_tenant: a product without a tenant has no direct channel to sell on.
+      before_save -> { self.sales_channel = BIT_SALES_CHANNEL[:platform] if tenant_id.nil? }
+
+      scope :sellable_on, lambda { |channel|
+        where("#{table_name}.sales_channel & ? != 0", BIT_SALES_CHANNEL.fetch(channel))
+      }
+    end
+
+    class_methods do
+      # The channel a customer order is placed on: tenant storefront APIs set a tenant, the platform ones don't.
+      def sales_channel_for(tenant)
+        tenant.present? ? :direct : :platform
+      end
+    end
+
+    BIT_SALES_CHANNEL.each do |channel, bit_value|
+      define_method "sellable_on_#{channel}?" do
+        sales_channel.to_i & bit_value != 0
+      end
+    end
+
+    # Checkbox reader/writer for the dashboard: a tenant product opts in/out of being sold on BookMe+.
+    alias sellable_on_platform sellable_on_platform?
+
+    def sellable_on_platform=(value)
+      bit = BIT_SALES_CHANNEL[:platform]
+      self.sales_channel = ActiveModel::Type::Boolean.new.cast(value) ? sales_channel.to_i | bit : sales_channel.to_i & ~bit
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/user_uploaded_image.rb

@@ -0,0 +1,17 @@
+module SpreeCmCommissioner
+  # For images a customer uploads themselves (profile photo, ID card). Spree's own validation accepts
+  # any `image/*`, which lets formats like SVG reach libvips when variants are generated
+  # (CVE-2026-66066), so these are limited to the formats phone cameras and galleries produce.
+  # MAX_SIZE is also the `content_length_range` on the storefront/tenant presigned POST, so an
+  # oversized file is rejected by S3 before it is ever fetched back.
+  module UserUploadedImage
+    extend ActiveSupport::Concern
+
+    CONTENT_TYPES = %w[image/jpeg image/png image/webp image/heic image/heif].freeze
+    MAX_SIZE = 10.megabytes
+
+    included do
+      validates :attachment, content_type: CONTENT_TYPES, size: { less_than_or_equal_to: MAX_SIZE }
+    end
+  end
+end

data/app/models/spree_cm_commissioner/back_image.rb

@@ -1,5 +1,7 @@
 module SpreeCmCommissioner
   class BackImage < SpreeCmCommissioner::Asset
+    include SpreeCmCommissioner::UserUploadedImage
+
     def asset_styles
       {
         mini: '187x67>',

data/app/models/spree_cm_commissioner/front_image.rb

@@ -1,5 +1,7 @@
 module SpreeCmCommissioner
   class FrontImage < SpreeCmCommissioner::Asset
+    include SpreeCmCommissioner::UserUploadedImage
+
     def asset_styles
       {
         mini: '187x67>',

data/app/models/spree_cm_commissioner/inventory_hold.rb

@@ -23,6 +23,11 @@ module SpreeCmCommissioner
 
     store_public_metadata :total_quantity_on_hold, :integer
 
+    # The DB sync for this acquisition (see InventoryHolds::Acquire), kept so a re-entry can re-send
+    # it under the same ledger key when the original enqueue never happened.
+    store_private_metadata :on_hold_sync_idempotency_key, :string
+    store_private_metadata :on_hold_sync_payload, :array
+
     def finalized?
       converted? || released?
     end

data/app/models/spree_cm_commissioner/order_decorator.rb

@@ -190,6 +190,17 @@ module SpreeCmCommissioner
       super
     end
 
+    # Must live here, not in OrderStateMachine: that concern is included (below Spree::Order),
+    # while Spree::Emails::OrderDecorator is prepended above it and never calls super, so an
+    # override there is silently dead.
+    def deliver_order_confirmation_email
+      return if requested?
+      return if any_app_only_products?
+      return if products.none?(&:enable_confirmation_email?)
+
+      super
+    end
+
     def any_app_only_products?
       if products.loaded?
         products.any?(&:purchasable_on_app?)

data/app/models/spree_cm_commissioner/product_decorator.rb

@@ -143,6 +143,7 @@ module SpreeCmCommissioner
       base.store_public_metadata :enable_inventory_hold, :boolean, default: false
       base.store_public_metadata :enable_telegram_alert, :boolean, default: true
       base.store_public_metadata :enable_send_receipt, :boolean, default: true
+      base.store_public_metadata :enable_confirmation_email, :boolean, default: true
       base.store_public_metadata :enable_social_sharing_email, :boolean, default: false
 
       base.store_private_metadata :advertise_weight, :integer, default: 1
@@ -169,6 +170,9 @@ module SpreeCmCommissioner
       base.belongs_to :tenant, class_name: 'SpreeCmCommissioner::Tenant'
       base.before_save :set_tenant
 
+      # Included after set_tenant so its before_save sees the resolved tenant_id.
+      base.include SpreeCmCommissioner::SalesChannelBitwise
+
       # Create maintaining task to purge product related caches
       base.after_save { SpreeCmCommissioner::MaintenanceTasks::CacheInvalidation.pending.create_or_find_by(maintainable: self) }
 

data/app/models/spree_cm_commissioner/s3_presigned_url.rb

@@ -11,25 +11,26 @@ module SpreeCmCommissioner
       URI.parse(url).host
     end
 
-    def initialize(bucket_name, object_key, uuid = nil)
+    # content_length_range: [Range, nil] byte range S3 enforces on the upload itself; nil means no limit.
+    def initialize(bucket_name, object_key, uuid = nil, content_length_range: nil)
       @id = uuid.presence || generate_secure_random
 
       if object_key.blank?
         @error_message = I18n.t('s3_signed_url.missing_file_name')
       else
-        @s3_direct_post = presigned_post(bucket_name, object_key)
+        @s3_direct_post = presigned_post(bucket_name, object_key, content_length_range)
       end
     end
 
     private
 
-    def presigned_post(bucket_name, object_key)
+    def presigned_post(bucket_name, object_key, content_length_range)
+      options = { key: object_key, success_action_status: '201' }
+      options[:content_length_range] = content_length_range if content_length_range
+
       Aws::S3::Resource.new
                        .bucket(bucket_name)
-                       .presigned_post(
-                         key: object_key,
-                         success_action_status: '201'
-                       )
+                       .presigned_post(**options)
     end
 
     def generate_secure_random

data/app/models/spree_cm_commissioner/s3_presigned_url_builder.rb

@@ -6,13 +6,15 @@ module SpreeCmCommissioner
       new(options).call
     end
 
-    # {:bucket_name?, (:object_key | :file_name)? }
+    # {:bucket_name?, (:object_key | :file_name)?, :content_length_range? }
+    # bucket_name/object_key are for trusted server-side callers only (admin media uploads); API
+    # controllers must pass just file_name, so callers can only write under uploads/<uuid>/.
     def initialize(options)
       @options = options
     end
 
     def call
-      SpreeCmCommissioner::S3PresignedUrl.new(bucket_name, object_key, uuid)
+      SpreeCmCommissioner::S3PresignedUrl.new(bucket_name, object_key, uuid, content_length_range: options[:content_length_range])
     end
 
     private
@@ -20,7 +22,11 @@ module SpreeCmCommissioner
     def object_key
       return options[:object_key] if options[:object_key].present?
 
-      "uploads/#{uuid}/#{options[:file_name]}"
+      # basename so a file_name like "../x" or "a/b" can't move the key out of its uuid folder.
+      file_name = File.basename(options[:file_name].to_s)
+      return nil if file_name.blank? || %w[. .. /].include?(file_name)
+
+      "uploads/#{uuid}/#{file_name}"
     end
 
     def bucket_name

data/app/models/spree_cm_commissioner/tenant.rb

@@ -21,6 +21,9 @@ module SpreeCmCommissioner
                              allow_blank: true,
                              format: { without: %r{\Ahttps?://}, message: :format }
 
+    # The slug is the first segment of /api/v2/:tenant_slug/..., so it must not shadow a v2 namespace.
+    validates :slug, exclusion: { in: SpreeCmCommissioner::TenantSlugConstraint::RESERVED_SLUGS }
+
     validates :sms_sender_id, length: { maximum: 11 }, allow_blank: true
 
     validates :default_currency, inclusion: { in: -> (tenant) { tenant.supported_currencies_list } }, allow_blank: true

data/app/models/spree_cm_commissioner/user_profile.rb

@@ -1,5 +1,7 @@
 module SpreeCmCommissioner
   class UserProfile < Asset
+    include SpreeCmCommissioner::UserUploadedImage
+
     protected
 
     def asset_styles

data/app/overrides/spree/admin/products/_form/enable_confirmation_email.html.erb.deface

@@ -0,0 +1,13 @@
+<!-- insert_after "[data-hook='admin_product_form_promotionable']" -->
+
+<div>
+  <%= f.field_container :enable_confirmation_email do %>
+    <%= f.label :enable_confirmation_email do %>
+      <%= f.check_box :enable_confirmation_email %>
+      <%= Spree.t(:enable_confirmation_email) %>
+    <% end %>
+    <small class="form-text text-muted">
+      When enabled, customers receive the booking confirmation email after their order is completed.
+    </small>
+  <% end %>
+</div>

data/app/overrides/spree/admin/products/_form/sellable_on_platform.html.erb.deface

@@ -0,0 +1,12 @@
+<!-- insert_after "[data-hook='admin_product_form_promotionable']" -->
+
+<%# BookMe+'s own products are always sold on the platform, so only tenant products get the choice. %>
+<% if f.object.vendor&.tenant_id.present? %>
+  <div data-hook="admin_product_form_sellable_on_platform">
+    <%= f.field_container :sellable_on_platform do %>
+      <%= f.check_box :sellable_on_platform %>
+      <%= f.label :sellable_on_platform, 'Also sell on BookMe+' %>
+      <%= f.error_message_on :sales_channel %>
+    <% end %>
+  </div>
+<% end %>

data/app/serializers/spree/v2/storefront/taxon_serializer_decorator.rb

@@ -4,7 +4,10 @@ module Spree
       module TaxonSerializerDecorator
         def self.prepended(base)
           base.has_many :vendors, serializer: ::Spree::V2::Storefront::VendorSerializer
-          base.has_many :visible_products, serializer: ::Spree::V2::Storefront::ProductSerializer
+          # The app lists an event section's tickets from this relation, so products a tenant keeps off BookMe+ are dropped here.
+          base.has_many :visible_products, serializer: ::Spree::V2::Storefront::ProductSerializer do |taxon|
+            taxon.visible_products.sellable_on(:platform)
+          end
           base.has_many :places, serializer: ::Spree::V2::Storefront::PlaceSerializer
 
           base.has_one :vendor, serializer: ::Spree::V2::Storefront::VendorSerializer

data/app/services/spree_cm_commissioner/api_caches/invalidate.rb

@@ -4,13 +4,13 @@ module SpreeCmCommissioner
     # MaintenanceTasks::CacheInvalidation sends. Every record of a model goes through InvalidateAll.
     #
     # Only the record's own storefront is cleared, as InvalidateAll does: its tenant's API
-    # (/api/v2/tenant/ paths) when it belongs to a tenant, the BookMe+ storefront otherwise. Each path
-    # is billed, and the other storefront's copy, if anything ever fetched one, expires within a CDN
-    # TTL anyway.
+    # (/api/v2/<tenant slug>/ paths) when it belongs to a tenant, the BookMe+ storefront otherwise.
+    # Each path is billed, and the other storefront's copy, if anything ever fetched one, expires
+    # within a CDN TTL anyway. Legacy /api/v2/tenant/ paths are never CDN-cached, so never cleared.
     class Invalidate
       prepend ::Spree::ServiceModule::Base
 
-      TENANT_PREFIX = '/api/v2/tenant/'.freeze
+      TENANT_PREFIX = '/api/v2/:tenant_slug/'.freeze
 
       SUPPORTED_MODELS = {
         'SpreeCmCommissioner::HomepageSection' => SpreeCmCommissioner::HomepageSection,
@@ -30,7 +30,7 @@ module SpreeCmCommissioner
       # path per BIT_SEGMENT key.
       HOMEPAGE_SECTION_PATTERNS = [
         '/api/v2/storefront/homepage*',
-        '/api/v2/tenant/homepage*'
+        '/api/v2/:tenant_slug/homepage*'
       ].freeze
 
       HOMEPAGE_BACKGROUND_PATTERNS = ['/api/v2/storefront/homepage*'].freeze
@@ -42,12 +42,13 @@ module SpreeCmCommissioner
       # which vendors are affected.
       #
       # vendor_id is a query param, so the trailing `*` is what clears every
-      # vendor's cached variant of this path in one go.
+      # vendor's cached variant of this path in one go. CloudFront allows `*` only at the end, so the
+      # tenant path expands to one path per tenant.
       #
       # Payment methods change a handful of times a year, so a broad invalidation
       # is cheap.
       PAYMENT_METHOD_PATTERNS = [
-        '/api/v2/tenant/payment_methods*',
+        '/api/v2/:tenant_slug/payment_methods*',
         '/api/v2/storefront/payment_methods*'
       ].freeze
 
@@ -60,7 +61,7 @@ module SpreeCmCommissioner
         invalidate_single_record(model_class: model_class, id: id)
       end
 
-      # eg. 'Spree::Product', 123 => ['/api/v2/tenant/products/123', '/api/v2/tenant/products/slug-of-product', ...]
+      # eg. 'Spree::Product', 123 => ['/api/v2/hangmeas/products/123*', '/api/v2/hangmeas/products/slug-of-product*']
       def invalidate_single_record(model_class:, id:)
         return failure(nil, "#{model_class.name} ID is required") if id.blank?
 
@@ -79,17 +80,27 @@ module SpreeCmCommissioner
         # The record's own class first (a Show found as a Spree::Taxon keeps its show paths), then the
         # model asked for, since STI subclasses such as Spree::Gateway::Payway have no entry of their own.
         patterns = single_api_pattern[record.class.name] || single_api_pattern[model_class.name]
-        return patterns if patterns.equal?(PAYMENT_METHOD_PATTERNS)
+        return expand_tenant_slug(patterns, SpreeCmCommissioner::Tenant.pluck(:slug)) if patterns.equal?(PAYMENT_METHOD_PATTERNS)
 
         tenant = tenant_of(record)
         patterns.select { |pattern| pattern.start_with?(TENANT_PREFIX) == tenant.present? }.map do |pattern|
           pattern.gsub(/:(\w+)/) do
             key = Regexp.last_match(1)
-            record.public_send(key).to_s
+            key == 'tenant_slug' ? tenant.slug : record.public_send(key).to_s
           end
         end
       end
 
+      # One copy of each `:tenant_slug` pattern per tenant; storefront patterns pass through as is.
+      def expand_tenant_slug(patterns, slugs)
+        slugs = slugs.compact_blank
+        patterns.flat_map do |pattern|
+          next [pattern] unless pattern.start_with?(TENANT_PREFIX)
+
+          slugs.map { |slug| pattern.sub(':tenant_slug', slug) }
+        end
+      end
+
       # A product, vendor or homepage section has its own tenant; a taxon, show or voting session has
       # its vendor's. Menus, seat layouts and homepage backgrounds are BookMe+ only.
       def tenant_of(record)
@@ -106,23 +117,23 @@ module SpreeCmCommissioner
           # The app reads menus from homepage_data; nothing calls /menus any more.
           'Spree::Menu' => ['/api/v2/storefront/homepage_data*'],
           'Spree::Taxon' => [
-            '/api/v2/tenant/taxons/:id*',
-            '/api/v2/tenant/taxons/:permalink*',
+            '/api/v2/:tenant_slug/taxons/:id*',
+            '/api/v2/:tenant_slug/taxons/:permalink*',
             '/api/v2/storefront/taxons/:id*',
             '/api/v2/storefront/taxons/:permalink*'
           ],
           'Spree::Product' => [
-            '/api/v2/tenant/products/:id*',
-            '/api/v2/tenant/products/:slug*',
+            '/api/v2/:tenant_slug/products/:id*',
+            '/api/v2/:tenant_slug/products/:slug*',
             '/api/v2/storefront/products/:id*',
             '/api/v2/storefront/products/:slug*'
           ],
-          'SpreeCmCommissioner::Show' => ['/api/v2/tenant/shows/:slug*'],
+          'SpreeCmCommissioner::Show' => ['/api/v2/:tenant_slug/shows/:slug*'],
           'SpreeCmCommissioner::VotingSession' => [
-            '/api/v2/tenant/voting_sessions/:id/voting_contestants*'
+            '/api/v2/:tenant_slug/voting_sessions/:id/voting_contestants*'
           ],
           'Spree::Vendor' => [
-            '/api/v2/tenant/vendors/:id*',
+            '/api/v2/:tenant_slug/vendors/:id*',
             '/api/v2/storefront/vendors/:id*',
             '/api/v2/storefront/accommodations/:id*',
             '/api/v2/storefront/accommodations/:slug*'

data/app/services/spree_cm_commissioner/api_caches/invalidate_all.rb

@@ -4,10 +4,7 @@ module SpreeCmCommissioner
     # serve them, which MaintenanceTasks::CacheInvalidation sends, as for Invalidate. `tenant` is
     # required so a clear-all never pays for both namespaces by accident: nil is the BookMe+
     # storefront (/api/v2/storefront/ paths), a SpreeCmCommissioner::Tenant is that tenant's API
-    # (/api/v2/tenant/ paths).
-    #
-    # Tenant APIs take the tenant from the OAuth token, not the URL, so every tenant shares one path
-    # today; taking the record keeps callers the same if tenant paths ever carry it.
+    # (/api/v2/<tenant slug>/ paths).
     #
     # eg. InvalidateAll.call(model: 'SpreeCmCommissioner::HomepageSection', tenant: nil)
     class InvalidateAll
@@ -20,11 +17,11 @@ module SpreeCmCommissioner
         'Spree::Menu' => ['/api/v2/storefront/homepage_data*'],
         'Spree::Taxon' => ['/api/v2/storefront/taxons/*'],
         'Spree::Product' => [
-          '/api/v2/tenant/products/*',
+          '/api/v2/:tenant_slug/products/*',
           '/api/v2/storefront/products/*'
         ],
         'Spree::Vendor' => [
-          '/api/v2/tenant/vendors/*',
+          '/api/v2/:tenant_slug/vendors/*',
           '/api/v2/storefront/vendors/*',
           '/api/v2/storefront/accommodations/*'
         ],
@@ -44,7 +41,8 @@ module SpreeCmCommissioner
 
       # Side-effect free, so the clear-cache dialog can show what a clear would send.
       def patterns_for(model, tenant:)
-        API_PATTERNS.fetch(model, []).select { |pattern| pattern.start_with?(Invalidate::TENANT_PREFIX) == tenant.present? }
+        patterns = API_PATTERNS.fetch(model, []).select { |pattern| pattern.start_with?(Invalidate::TENANT_PREFIX) == tenant.present? }
+        tenant ? Invalidate.new.expand_tenant_slug(patterns, [tenant.slug]) : patterns
       end
 
       # updated_at keys Spree's serializer and collection caches, so only this storefront's records

data/app/services/spree_cm_commissioner/draft_orders/create.rb

@@ -72,7 +72,8 @@ module SpreeCmCommissioner
           device_id: options[:device_id],
           last_ip_address: options[:last_ip_address]
         )
-        line_items_params.each { |line_item_params| build_line_item!(order, store, line_item_params) }
+        sellable_variants = store.variants.joins(:product).merge(Spree::Product.sellable_on(Spree::Product.sales_channel_for(tenant)))
+        line_items_params.each { |line_item_params| build_line_item!(order, sellable_variants, line_item_params) }
 
         ActiveRecord::Base.transaction do
           raise StandardError, order_error_message(order) unless order.save
@@ -105,8 +106,10 @@ module SpreeCmCommissioner
 
       # Builds (unsaved) an order.line_items member — persisted together with the order via
       # order.save's cascading autosave of new has_many records, same as TransitOrder::Create.
-      def build_line_item!(order, store, line_item_params)
-        variant = store.variants.find(line_item_params[:variant_id])
+      def build_line_item!(order, sellable_variants, line_item_params)
+        variant = sellable_variants.find_by(id: line_item_params[:variant_id])
+        raise StandardError, I18n.t('spree_cm_commissioner.draft_order.variant_not_available') if variant.nil?
+
         options = (line_item_params[:options] || {}).to_h.with_indifferent_access
         permitted_opts = ::Spree::PermittedAttributes.line_item_attributes.flatten.index_with { |attribute| options[attribute] }
         opts = permitted_opts.merge(currency: order.currency).compact

data/app/services/spree_cm_commissioner/events/publish_stock_statuses_to_firestore.rb

@@ -35,10 +35,10 @@ module SpreeCmCommissioner
         return success(:skipped) unless firestore_available?
 
         products = active_products(taxon).to_a
-        return success(:skipped) if products.empty?
-
-        sums = aggregate_quantities(products)
         existing_products = existing_products_data(taxon)
+        return success(:skipped) if products.empty? && existing_products.empty?
+
+        sums = products.empty? ? {} : aggregate_quantities(products)
         now = Time.zone.now
 
         changed = {}
@@ -51,6 +51,8 @@ module SpreeCmCommissioner
           changed[product.id.to_s] = build_entry(product, status, quantities, existing_products, now)
         end
 
+        prune_stale_entries(changed, products, existing_products)
+
         return success(:unchanged) if changed.empty?
 
         event_document(taxon).set({ products: changed, server_time: now }, merge: true)
@@ -66,6 +68,20 @@ module SpreeCmCommissioner
 
       private
 
+      # The write below is always `merge: true`, which only ever adds or updates map entries — it
+      # never drops one. So a product that stops being active (unlisted/unlinked from its section,
+      # discontinued, status flipped off — see `active_products`) would otherwise keep its last
+      # stock status in Firestore forever, and the app would go on rendering the removed product.
+      # Deleting the `products.<id>` field (nested FieldValue.delete, carried in the same merge set)
+      # is what actually removes it. existing_products is read even when no product is active, so an
+      # event whose every ticket got unlisted still gets its stale entries cleared.
+      def prune_stale_entries(changed, products, existing_products)
+        active_ids = products.map { |product| product.id.to_s }
+        (existing_products.keys - active_ids).each do |stale_id|
+          changed[stale_id] = firestore.field_delete
+        end
+      end
+
       # `quantities` is the [available, on_hold, locked, locked_on_hold] tuple from
       # `aggregate_quantities`. `previous_status` is read back from what's already stored, not
       # recomputed — it's the bucket this product was in on the last publish, if any.
@@ -117,6 +133,16 @@ module SpreeCmCommissioner
       # true. Caught via a real event whose products all had available_on: nil: the poll job was
       # returning :skipped for it on every cycle, so Firestore just sat frozen with stale data.
       #
+      # `preview: false` for the same reason unlisted products are excluded: events/{event_id} is
+      # publicly readable (no auth on the Firestore rule), so a preview product — active but held
+      # back from the public pending a PreviewRole, product_decorator.rb `publicly_available` — must
+      # not leak a live stock-status entry there before launch.
+      #
+      # `offline: false` because an offline product is deliberately not inventory-monitored (the
+      # admin form labels it "not monitored in Inventory Monitor", and InventoryItems finders like
+      # RecentlyChangedFinder already filter it out) — its Redis pools aren't maintained, so any
+      # stock status published for it would be meaningless.
+      #
       # `where(status: 'active')` instead of core's `Product.active` scope: that scope also joins
       # variants/prices in to filter by currency (`with_currency`), and `spree_variants` carries its
       # own `available_on`/`discontinue_on` columns — once that join is present, the raw,
@@ -133,7 +159,7 @@ module SpreeCmCommissioner
       # is excluded here too rather than still getting a live stock-status entry in Firestore.
       def active_products(taxon)
         now = Time.zone.now
-        taxon.event_products.ecommerce.where(status: 'active')
+        taxon.event_products.ecommerce.where(status: 'active', preview: false, offline: false)
              .where('available_on IS NULL OR available_on <= ?', now)
              .where('discontinue_on IS NULL OR discontinue_on > ?', now)
              .where(id: taxon.children_classifications.where(visible: true).select(:product_id))

data/app/services/spree_cm_commissioner/inventory_holds/acquire.rb

@@ -33,7 +33,10 @@ module SpreeCmCommissioner
           hold = acquire_hold_for_order!(order, line_items, expires_at)
 
           enqueue_release_job(hold)
-          enqueue_sync_inventory_on_hold(order)
+          # Re-sent on every call, including re-entry with an existing hold: if this enqueue failed
+          # after the hold committed, the retry recovers it. The key stored with the acquisition makes
+          # a repeat a no-op in the ledger once the sync has applied.
+          enqueue_sync_inventory_on_hold(hold)
 
           CmAppLogger.log(
             label: "#{self.class.name}#call success",
@@ -88,7 +91,11 @@ module SpreeCmCommissioner
               payment_locked_at: nil,
               release_reason: nil,
               total_quantity_on_hold: line_items.sum(&:quantity),
-              ip_address: order.last_ip_address
+              ip_address: order.last_ip_address,
+              # Saved in the same transaction as the Redis reservation, so the DB sync for exactly
+              # this acquisition can be re-sent later without inventing a new key or payload.
+              on_hold_sync_idempotency_key: SecureRandom.uuid,
+              on_hold_sync_payload: on_hold_sync_payload(line_items)
             )
 
             hold.save!
@@ -107,6 +114,15 @@ module SpreeCmCommissioner
         end
       end
 
+      # Same line items and active inventory items that acquire_redis_stock! reserves.
+      def on_hold_sync_payload(line_items)
+        line_items.flat_map do |line_item|
+          line_item.inventory_items.active.map do |inventory_item|
+            { inventory_id: inventory_item.id, quantity: line_item.quantity, locked: line_item.locked_stock? }
+          end
+        end
+      end
+
       def acquire_redis_stock!(line_items)
         stock_keys = []
         hold_keys = []
@@ -146,25 +162,20 @@ module SpreeCmCommissioner
         SpreeCmCommissioner::InventoryHolds::ReleaseJob.set(wait_until: hold.expires_at).perform_later(hold_id: hold.id)
       end
 
-      def enqueue_sync_inventory_on_hold(order)
-        inventory_id_and_quantities = order.line_items.flat_map do |line_item|
-          next [] unless line_item.should_hold_inventory?
-
-          line_item.inventory_items.active.map do |inventory_item|
-            {
-              inventory_id: inventory_item.id,
-              quantity: line_item.quantity,
-              locked: line_item.locked_stock?
-            }
-          end
-        end
+      def enqueue_sync_inventory_on_hold(hold)
+        key = hold.on_hold_sync_idempotency_key
+        payload = hold.on_hold_sync_payload
 
-        return if inventory_id_and_quantities.blank?
+        # Holds acquired before the sync event was stored carry neither; their sync was sent when they
+        # were acquired.
+        return if key.blank? || payload.blank?
 
         SpreeCmCommissioner::InventoryItems::BulkAdjustQuantitiesOnHoldJob.perform_later(
-          order_id: order.id,
+          order_id: hold.order_id,
+          idempotency_key: key,
           caller_source: "#{self.class.name}#enqueue_sync_inventory_on_hold",
-          inventory_id_and_quantities: inventory_id_and_quantities
+          # Read back from jsonb with string keys; BulkAdjustQuantitiesOnHold reads symbol keys.
+          inventory_id_and_quantities: payload.map(&:symbolize_keys)
         )
       end
 

data/app/services/spree_cm_commissioner/inventory_holds/convert.rb

@@ -123,6 +123,7 @@ module SpreeCmCommissioner
 
         SpreeCmCommissioner::InventoryItems::BulkAdjustQuantitiesOnConvertJob.perform_later(
           order_id: order.id,
+          idempotency_key: SecureRandom.uuid,
           caller_source: "#{self.class.name}#enqueue_sync_inventory",
           inventory_id_and_quantities: adjustments
         )