spree_cm_commissioner 2.14.9 → 2.14.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b5426f6a834611d1c303d1305de10998cea1cd5b6ca72c23f512ddff53614b2a
-  data.tar.gz: cb6688095f5daef9df50906c20d5adb5cba20dc4f2657a430b1d2ab00afaaaf6
+  metadata.gz: 404c51ec35ca9f40be93a12f9d7c9af99621231ec51b47b4300e34570e0ee2c6
+  data.tar.gz: 4cc03fe1be1e9dbae9b4e7eca107e1b882b34fb2d0bb0ff6372c6d55f24935a2
 SHA512:
-  metadata.gz: e609a94743b1283a225d077dad5ba3f775ed599985d687f8b6c4408de286bc6f8b6e91e4024e675ec03ae06a67a013fa43cc6242cc50070a334bc2ac4731e7d0
-  data.tar.gz: d007f4f9a802452c020d32f32f44c466e88469ea24386c87f8b45c834ced740d1faf55185d953901640fd1dd73f19af686667ef9f29e615b97642aadc8645020
+  metadata.gz: 2d8d4d96eeb4e6b3e659cdc3660cb0213fb3da8b39ea09f680b8eb116e028c2205ebabf74cab3fcc6b1146725f25d7035d212b22215522b7b8950bd84b9ab88d
+  data.tar.gz: fab1f613701eec7c9ce563bf668781a8356d9cabd088cc3f55cf59a70eb527d8cb29fd6b5658272f871831ba17641a1c0914b63c971f9d0e5dd920311d37649d

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.14.9)
+    spree_cm_commissioner (2.14.11)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/taxon_visible_products_preloadable.rb

@@ -0,0 +1,24 @@
+module SpreeCmCommissioner
+  # The taxon serializer renders `visible_products` as loaded, so the sales-channel filter lives here:
+  # preloading it scoped to the request's channel hides tenant-only products on BookMe+ and platform-only ones on a tenant app.
+  # Prepend it (not include) so it wraps a controller's own `resource`/`paginated_collection`.
+  module TaxonVisibleProductsPreloadable
+    private
+
+    def resource
+      @resource ||= super.tap { |taxon| preload_visible_products([taxon]) }
+    end
+
+    def paginated_collection
+      @paginated_collection ||= super.tap { |taxons| preload_visible_products(taxons.to_a) }
+    end
+
+    def preload_visible_products(taxons)
+      ActiveRecord::Associations::Preloader.new(
+        records: taxons,
+        associations: :visible_products,
+        scope: Spree::Product.sellable_on(Spree::Product.sales_channel_for(@tenant))
+      ).call
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/taxons_controller_decorator.rb

@@ -3,6 +3,8 @@ module Spree
     module V2
       module Storefront
         module TaxonsControllerDecorator
+          include SpreeCmCommissioner::TaxonVisibleProductsPreloadable
+
           def scope
             super.where(preview: false)
           end

data/app/controllers/spree/api/v2/tenant/taxons_controller.rb

@@ -3,6 +3,8 @@ module Spree
     module V2
       module Tenant
         class TaxonsController < BaseController
+          prepend SpreeCmCommissioner::TaxonVisibleProductsPreloadable
+
           private
 
           def collection_serializer

data/app/serializers/spree/v2/storefront/taxon_serializer_decorator.rb

@@ -4,10 +4,7 @@ module Spree
       module TaxonSerializerDecorator
         def self.prepended(base)
           base.has_many :vendors, serializer: ::Spree::V2::Storefront::VendorSerializer
-          # The app lists an event section's tickets from this relation, so products a tenant keeps off BookMe+ are dropped here.
-          base.has_many :visible_products, serializer: ::Spree::V2::Storefront::ProductSerializer do |taxon|
-            taxon.visible_products.sellable_on(:platform)
-          end
+          base.has_many :visible_products, serializer: ::Spree::V2::Storefront::ProductSerializer
           base.has_many :places, serializer: ::Spree::V2::Storefront::PlaceSerializer
 
           base.has_one :vendor, serializer: ::Spree::V2::Storefront::VendorSerializer

data/app/services/spree_cm_commissioner/checkout/strip_uncollected_guest_fields.rb

@@ -0,0 +1,57 @@
+# A guest only stores what its line item collects (kyc_fields + dynamic fields), whatever a client
+# submits. Clients may send every guest with prefilled values — the app seeds guest #1 with the
+# buyer's contact info even for products that collect nothing — which would make guest #1 read as
+# the buyer while the others stay blank. Unenabled attributes are dropped rather than rejected so a
+# client that over-sends still checks out.
+module SpreeCmCommissioner
+  module Checkout
+    class StripUncollectedGuestFields
+      ALWAYS_ALLOWED = %w[id guest_dynamic_fields_attributes].freeze
+
+      # Not in KYC_FIELD_ATTRIBUTES; each only means something alongside the field it pairs with.
+      PAIRED_ATTRIBUTES = {
+        guest_phone_number: %w[country_code],
+        guest_id_card: %w[upload_later]
+      }.freeze
+
+      def self.call(order:, params:)
+        new.call(order: order, params: params)
+      end
+
+      def call(order:, params:)
+        line_items_params = params[:order]&.[](:line_items_attributes)
+        return if line_items_params.blank?
+
+        each_entry(line_items_params) do |line_item_params|
+          guests_params = line_item_params[:guests_attributes]
+          next if guests_params.blank?
+
+          line_item = order.line_items.find { |item| item.id.to_s == line_item_params[:id].to_s }
+          next if line_item.nil?
+
+          allowed = allowed_attributes(line_item)
+          each_entry(guests_params) do |guest_params|
+            rejected = guest_params.keys.reject { |key| allowed.include?(key.to_s) }
+            rejected.each { |key| guest_params.delete(key) }
+          end
+        end
+      end
+
+      private
+
+      def allowed_attributes(line_item)
+        kyc_fields = line_item.kyc.nil? ? [] : line_item.kyc_fields
+
+        ALWAYS_ALLOWED + kyc_fields.flat_map do |field|
+          Array(SpreeCmCommissioner::KycBitwise::KYC_FIELD_ATTRIBUTES[field]).map(&:to_s) + PAIRED_ATTRIBUTES.fetch(field, [])
+        end
+      end
+
+      # Nested attributes arrive either as an array or as an index-keyed hash ({ '0' => {...} }).
+      def each_entry(collection)
+        entries = collection.is_a?(Array) ? collection : collection.values
+        entries.each { |entry| yield(entry) if entry.respond_to?(:delete) && entry.respond_to?(:keys) }
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/checkout/update_decorator.rb

@@ -5,6 +5,7 @@ module SpreeCmCommissioner
       # 1. Validate line items are in stock before updating address
       # 2. Skip automatic state transitions (lines 17-18 commented out)
       #    State changes are handled by the advance action, not update
+      # 3. Drop guest attributes the line item doesn't collect (see StripUncollectedGuestFields)
       def call(order:, params:, permitted_attributes:, request_env:)
         return failure(order) unless order.ensure_line_items_are_in_stock
 
@@ -17,6 +18,8 @@ module SpreeCmCommissioner
         # order.state = 'address' if (ship_changed || bill_changed) && order.has_checkout_step?('address')
         # order.state = 'delivery' if selected_shipping_rate_present?(params) && order.has_checkout_step?('delivery')
 
+        SpreeCmCommissioner::Checkout::StripUncollectedGuestFields.call(order: order, params: params)
+
         if order.update_from_params(params, permitted_attributes, request_env)
           # Recalculate pricing models after order/guest updates to ensure adjustments reflect current rules
           SpreeCmCommissioner::PricingModels::Activate.call(order: order)

data/lib/spree_cm_commissioner/version.rb

@@ -1,5 +1,5 @@
 module SpreeCmCommissioner
-  VERSION = '2.14.9'.freeze
+  VERSION = '2.14.11'.freeze
 
   module_function
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_cm_commissioner
 version: !ruby/object:Gem::Version
-  version: 2.14.9
+  version: 2.14.11
 platform: ruby
 authors:
 - You
@@ -822,6 +822,7 @@ files:
 - app/controllers/concerns/spree_cm_commissioner/load_test_login_token_generation.rb
 - app/controllers/concerns/spree_cm_commissioner/operator/event_authorization.rb
 - app/controllers/concerns/spree_cm_commissioner/order_concern.rb
+- app/controllers/concerns/spree_cm_commissioner/taxon_visible_products_preloadable.rb
 - app/controllers/concerns/spree_cm_commissioner/turnstile_protectable.rb
 - app/controllers/concerns/spree_cm_commissioner/waiting_room_authorization.rb
 - app/controllers/spree/admin/account_deletions_controller.rb
@@ -2346,6 +2347,7 @@ files:
 - app/services/spree_cm_commissioner/checkout/advance_to_payment.rb
 - app/services/spree_cm_commissioner/checkout/complete_decorator.rb
 - app/services/spree_cm_commissioner/checkout/remove_store_credit_decorator.rb
+- app/services/spree_cm_commissioner/checkout/strip_uncollected_guest_fields.rb
 - app/services/spree_cm_commissioner/checkout/update_decorator.rb
 - app/services/spree_cm_commissioner/completion_steps/mark_line_item_as_completed.rb
 - app/services/spree_cm_commissioner/completion_steps/regenerate_for_line_items.rb