spree_cm_commissioner 2.15.0 → 2.15.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b32073d2114c66c1a2f712bbcfb05712cb153b8a651c2c33800665b0422d2541
-  data.tar.gz: 790420e894c681441fba0109c0aafc51bbcbd19a3c076743404db71dd0c6ce7b
+  metadata.gz: 7cd929df06e0243dc4cf2b0b4ffc57d3346ced9f9d0cb5bdd3142d6adc153a88
+  data.tar.gz: 29a71dceac61e9e6497137c525ff9e76ace8ca1a179f0dc6eab157fd83a30a4d
 SHA512:
-  metadata.gz: 79d3b977f4d3d63523ff5920cc17c7598eb320ed3b6e3dae89bff7d3ee3a0d3f40744a2788e033910da0fa61fcddeaff589414d2b6d9373c52b9f444fe44ff2a
-  data.tar.gz: ca37c84b2064fe10e2187b9610385c6db5ab1016aa64df2f8e34b520fd65f37c59566f1d879aedb822fa43467f43da8f2acda7609ae9aba56ea67d40dc807e72
+  metadata.gz: 2bd7890db6844d7057a5e89f8e2cd0285e387772aaccba0ba2806aee4b7f78de3cea566402fb5a97279613bae6be342bbef2b55e2d185c82d8d85fec59401520
+  data.tar.gz: 682f9b46dae492ff3f0bdb9f558dccc3185ec4b9a6a0770e4fca4146ecd496e90577b97c049a9a171f7ab6ac76486fc14d4cdefe6bf7098ec96de9b8c09c170b

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.15.0)
+    spree_cm_commissioner (2.15.1)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/spree/api/v2/storefront/transit/draft_orders_controller.rb

@@ -25,7 +25,8 @@ module Spree
                 outbound_legs: @outbound_legs,
                 inbound_legs: @inbound_legs,
                 user: spree_current_user,
-                include_return: ActiveModel::Type::Boolean.new.cast(params[:include_return])
+                include_return: ActiveModel::Type::Boolean.new.cast(params[:include_return]),
+                oauth_application_id: doorkeeper_token&.application_id
               )
 
               if result.success?

data/app/controllers/spree/api/v2/tenant/transit/draft_orders_controller.rb

@@ -25,7 +25,8 @@ module Spree
                 outbound_legs: @outbound_legs,
                 inbound_legs: @inbound_legs,
                 user: spree_current_user,
-                include_return: ActiveModel::Type::Boolean.new.cast(params[:include_return])
+                include_return: ActiveModel::Type::Boolean.new.cast(params[:include_return]),
+                oauth_application_id: doorkeeper_token&.application_id
               )
 
               if result.success?

data/app/models/concerns/spree_cm_commissioner/promotion/rules/oauth_application_scoped.rb

@@ -0,0 +1,44 @@
+module SpreeCmCommissioner
+  module Promotion
+    module Rules
+      # The OAuth applications a promotion rule is scoped to, shared by every rule that narrows by
+      # app. Kept in `cm_oauth_application_promotion_rules` rather than a preference so "which
+      # promotions use this app" is a join, and deleting an app cannot leave a dead id in a rule.
+      # How an empty list behaves is up to the rule.
+      module OauthApplicationScoped
+        extend ActiveSupport::Concern
+
+        included do
+          has_many :oauth_application_promotion_rules,
+                   class_name: 'SpreeCmCommissioner::OauthApplicationPromotionRule',
+                   foreign_key: :promotion_rule_id,
+                   inverse_of: :promotion_rule,
+                   autosave: true,
+                   dependent: :destroy
+
+          # For reading and reporting. Not written through: that would load and validate every
+          # Spree::OauthApplication (whose `api_key` is encrypted) just to link it, and the admin form
+          # posts ids anyway.
+          has_many :oauth_applications, through: :oauth_application_promotion_rules, class_name: 'Spree::OauthApplication'
+        end
+
+        # Reads the join rows, loaded once per rule instance: eligibility is re-checked several times in
+        # one cart update, and a plain `pluck` would query every time. Join rows rather than
+        # `oauth_applications`, which would load every app just to get its id.
+        def oauth_application_ids
+          oauth_application_promotion_rules.load.reject(&:marked_for_destruction?).map(&:oauth_application_id)
+        end
+
+        # What the admin form posts. Only the join rows change, saved with the rule. The blank value a
+        # multi-select always submits is dropped.
+        def oauth_application_ids=(ids)
+          wanted = Array(ids).compact_blank.map(&:to_i).uniq
+          existing = oauth_application_promotion_rules.load.to_a
+
+          existing.each { |row| row.mark_for_destruction unless wanted.include?(row.oauth_application_id) }
+          (wanted - existing.map(&:oauth_application_id)).each { |id| oauth_application_promotion_rules.build(oauth_application_id: id) }
+        end
+      end
+    end
+  end
+end

data/app/models/spree_cm_commissioner/oauth_application_promotion_rule.rb

@@ -0,0 +1,8 @@
+module SpreeCmCommissioner
+  class OauthApplicationPromotionRule < Base
+    belongs_to :promotion_rule, class_name: 'Spree::PromotionRule'
+    belongs_to :oauth_application, class_name: 'Spree::OauthApplication'
+
+    validates :oauth_application_id, uniqueness: { scope: :promotion_rule_id }
+  end
+end

data/app/models/spree_cm_commissioner/promotion/rules/customer_order_count.rb

@@ -0,0 +1,87 @@
+module SpreeCmCommissioner
+  module Promotion
+    module Rules
+      # Limits a promotion to a customer's Nth booking: 2 → 2 is "2nd booking only", 5 → (empty) is
+      # "5th booking and later". With apps chosen, only bookings placed through them count (the 2nd
+      # Wing booking); with none, bookings from every app count. Narrow by vendor with its own rule.
+      class CustomerOrderCount < Spree::PromotionRule
+        include OauthApplicationScoped
+
+        # Bookings that still stand. Also exactly the predicate of the partial index
+        # `idx_orders_user_for_limits` (user_id WHERE state IN complete, resumed), so the count is an
+        # index lookup on one user's rows.
+        COUNTED_STATES = %w[complete resumed].freeze
+
+        preference :min_order_number, :integer, default: 2
+        # Spree casts an empty integer field to 0, so 0 (or empty) means "no upper limit".
+        preference :max_order_number, :integer, default: 0
+
+        validate :order_number_range_valid
+
+        # Line items too: PromotionHandler::Cart activates a promotion when it is eligible for the
+        # line item just added, and a rule that does not apply to line items is skipped there.
+        def applicable?(promotable)
+          promotable.is_a?(Spree::Order) || promotable.is_a?(Spree::LineItem)
+        end
+
+        def eligible?(promotable, _options = {})
+          order = promotable.is_a?(Spree::LineItem) ? promotable.order : promotable
+
+          if order.user_id.nil?
+            eligibility_errors.add(:base, eligibility_error_message(:customer_order_count_login_required))
+          elsif !order_number_in_range?(order_number(order))
+            eligibility_errors.add(:base, eligibility_error_message(:customer_order_count_not_eligible))
+          end
+
+          eligibility_errors.empty?
+        end
+
+        # Which booking this order is for its customer, counted no further than the range needs.
+        # Memoized: one cart update calls eligible? several times (line item, order, each adjustment)
+        # and the answer can't change within it.
+        def order_number(order)
+          @order_numbers ||= {}
+          @order_numbers[[order.id, order.completed_at]] ||= previous_orders(order).limit(count_cap).count + 1
+        end
+
+        def min_order_number
+          preferred_min_order_number.to_i
+        end
+
+        def max_order_number
+          max = preferred_max_order_number.to_i
+          max.positive? ? max : nil
+        end
+
+        private
+
+        # A completed order counts only bookings completed before it, so re-checking it later
+        # (recalculation, cancel) isn't changed by bookings the customer made afterwards.
+        def previous_orders(order)
+          scope = Spree::Order.where(user_id: order.user_id, state: COUNTED_STATES).where.not(id: order.id)
+          app_ids = oauth_application_ids
+          scope = scope.where(oauth_application_id: app_ids) if app_ids.any?
+          order.completed_at ? scope.where(completed_at: ...order.completed_at) : scope
+        end
+
+        # Counting past this can't change the answer, so a customer with 300 bookings costs the
+        # same as one with 3.
+        def count_cap
+          max_order_number || min_order_number
+        end
+
+        def order_number_in_range?(number)
+          number >= min_order_number && (max_order_number.nil? || number <= max_order_number)
+        end
+
+        def order_number_range_valid
+          if min_order_number < 1
+            errors.add(:base, :customer_order_count_min_too_low)
+          elsif max_order_number && max_order_number < min_order_number
+            errors.add(:base, :customer_order_count_max_below_min)
+          end
+        end
+      end
+    end
+  end
+end

data/app/models/spree_cm_commissioner/promotion/rules/oauth_applications.rb

@@ -0,0 +1,34 @@
+module SpreeCmCommissioner
+  module Promotion
+    module Rules
+      # Limits a promotion to orders placed through chosen OAuth applications — a tenant app or a
+      # mini app (Wing, ACLEDA, Vattanac), each of which logs its users in with its own client.
+      #
+      # Unlike Vendors/GuestAgeGroup, an empty list matches nothing: a channel promotion saved
+      # before anyone picked a channel must not leak to every channel. An order with no
+      # `oauth_application_id` (older orders, or a path that does not record it) never matches.
+      class OauthApplications < Spree::PromotionRule
+        include OauthApplicationScoped
+
+        # Line items too: PromotionHandler::Cart activates a promotion when it is eligible for the
+        # line item just added, and a rule that does not apply to line items is skipped there — so
+        # an order-only rule let every cart attach the promotion with a dead (ineligible) adjustment.
+        def applicable?(promotable)
+          promotable.is_a?(Spree::Order) || promotable.is_a?(Spree::LineItem)
+        end
+
+        # Reads the column rather than the association, so eligibility — re-checked on every cart
+        # recalculation — costs no query.
+        def eligible?(promotable, _options = {})
+          order = promotable.is_a?(Spree::LineItem) ? promotable.order : promotable
+
+          unless oauth_application_ids.include?(order.oauth_application_id)
+            eligibility_errors.add(:base, eligibility_error_message(:oauth_application_not_eligible))
+          end
+
+          eligibility_errors.empty?
+        end
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/doorkeeper_refresh_token_request_decorator.rb

@@ -0,0 +1,23 @@
+module SpreeCmCommissioner
+  # Doorkeeper only refreshes a token for the client it was issued to. A mini app token belongs to its
+  # mini app's application (see DoorkeeperServerDecorator), but the client that refreshes it holds no
+  # credentials for that application, so the match would always fail.
+  #
+  # For these tokens the refresh token itself is the proof, as it is for a public client. A wrong client
+  # secret is still refused: Doorkeeper checks it before the match, and this only relaxes the match.
+  module DoorkeeperRefreshTokenRequestDecorator
+    private
+
+    def validate_client_match
+      super || mini_app_token?
+    end
+
+    def mini_app_token?
+      refresh_token.application&.provider.present?
+    end
+  end
+end
+
+unless Doorkeeper::OAuth::RefreshTokenRequest.included_modules.include?(SpreeCmCommissioner::DoorkeeperRefreshTokenRequestDecorator)
+  Doorkeeper::OAuth::RefreshTokenRequest.prepend(SpreeCmCommissioner::DoorkeeperRefreshTokenRequestDecorator)
+end

data/app/services/spree_cm_commissioner/doorkeeper_server_decorator.rb

@@ -0,0 +1,28 @@
+module SpreeCmCommissioner
+  # A mini app login is issued its token for that mini app's OAuth application, found by
+  # MiniAppLoginApplication, whatever client credentials the request carries. Doorkeeper would otherwise
+  # take the client from those credentials (the default BookMe+ client, or none), and the order made with
+  # the token would not say which mini app it came from.
+  #
+  # The login itself is the proof: UserAuthenticator only accepts a session key the bank signed for the
+  # user, so no client secret is needed to say which bank it is.
+  module DoorkeeperServerDecorator
+    def client
+      mini_app_client || super
+    end
+
+    private
+
+    # Only the password grant: a refresh keeps the application its token was issued for.
+    def mini_app_client
+      return @mini_app_client if defined?(@mini_app_client)
+
+      application = MiniAppLoginApplication.for(parameters) if parameters[:grant_type] == Doorkeeper::OAuth::PASSWORD
+      @mini_app_client = application && Doorkeeper::OAuth::Client.new(application)
+    end
+  end
+end
+
+unless Doorkeeper::Server.included_modules.include?(SpreeCmCommissioner::DoorkeeperServerDecorator)
+  Doorkeeper::Server.prepend(SpreeCmCommissioner::DoorkeeperServerDecorator)
+end

data/app/services/spree_cm_commissioner/mini_app_login_application.rb

@@ -0,0 +1,32 @@
+module SpreeCmCommissioner
+  # Finds the OAuth application a mini app login belongs to, from the login itself: the parameter the
+  # client sends already names the bank (`session_key` → ACLEDA, `wing_session_key` → Wing, `session_id` →
+  # Vattanac), so the client needs no client id or secret of its own. The application is the one whose
+  # `provider` is that bank (see MiniAppProvider::Base.providers).
+  #
+  # Nil for any other login (web, Telegram, password), or when no application carries that provider yet.
+  class MiniAppLoginApplication
+    FLOW_SUFFIX = '_web_app_auth'.freeze
+
+    def self.for(params)
+      provider = provider_of(params)
+      return nil if provider.nil?
+
+      application = Spree::OauthApplication.find_by(provider: provider)
+      CmAppLogger.log(label: 'Mini app login: no OAuth application with this provider', data: { provider: provider }) if application.nil?
+      application
+    end
+
+    def self.provider_of(params)
+      flow = UserAuthenticator.flow_type(params)
+      return nil unless flow.end_with?(FLOW_SUFFIX)
+
+      provider = flow.delete_suffix(FLOW_SUFFIX)
+      provider if MiniAppProvider::Base.providers.map(&:provider).include?(provider)
+    rescue Doorkeeper::Errors::DoorkeeperError
+      # Params no flow recognises: the login fails on its own further down, with its own message.
+      nil
+    end
+    private_class_method :provider_of
+  end
+end

data/app/services/spree_cm_commissioner/transit_order/create.rb

@@ -6,6 +6,8 @@
 # - outbound_legs: [Array<SpreeCmCommissioner::Transit::Leg>] Outbound transit legs (one for direct, multiple for connecting)
 # - inbound_legs:  [Array<SpreeCmCommissioner::Transit::Leg>] Inbound transit legs (one for direct, multiple for connecting)
 # - user:          [User] The user for whom the order is being created
+# - oauth_application_id: [Integer, nil] The client app of the request's access token (nil without a token or
+#                  from a path that has none), recorded on the order for promotions limited to one app.
 #
 # Each line item is built with precise from_date and to_date based on legs and trip stop times.
 # Each line item has guests built corresponding to seat selection blocks.
@@ -17,13 +19,13 @@ module SpreeCmCommissioner
       prepend ::Spree::ServiceModule::Base
 
       def call(outbound_date:, inbound_date:, outbound_legs:, inbound_legs: [], user: nil, created_by: nil, # rubocop:disable Metrics/ParameterLists
-               include_return: false, channel: SpreeCmCommissioner::OrderChannelBitwise::SPREE_CHANNEL
+               include_return: false, channel: SpreeCmCommissioner::OrderChannelBitwise::SPREE_CHANNEL, oauth_application_id: nil
       )
         return failure(nil, 'Outbound legs are missing') if outbound_legs.blank?
 
         begin
           order = create_order!(outbound_date, inbound_date, outbound_legs, inbound_legs, user, include_return,
-                                created_by: created_by, channel: channel
+                                created_by: created_by, channel: channel, oauth_application_id: oauth_application_id
           )
           success(order: order)
         rescue StandardError => e
@@ -32,9 +34,12 @@ module SpreeCmCommissioner
       end
 
       def create_order!(outbound_date, inbound_date, outbound_legs, inbound_legs, user, include_return, # rubocop:disable Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity,Metrics/ParameterLists
-                        created_by: nil, channel: SpreeCmCommissioner::OrderChannelBitwise::SPREE_CHANNEL
+                        created_by: nil, channel: SpreeCmCommissioner::OrderChannelBitwise::SPREE_CHANNEL, oauth_application_id: nil
       )
-        order = Spree::Order.new(state: 'cart', use_billing: true, user: user, created_by: created_by, channel: channel)
+        order = Spree::Order.new(
+          state: 'cart', use_billing: true, user: user, created_by: created_by, channel: channel,
+          oauth_application_id: oauth_application_id
+        )
 
         all_legs = outbound_legs + inbound_legs
         preload_trips_and_stops!(all_legs)

data/app/views/spree/admin/promotions/rules/_customer_order_count.html.erb

@@ -0,0 +1,20 @@
+<div class="card-body">
+  <div class="row mb-0">
+    <div class="form-group col-6 mb-0">
+      <%= label_tag "#{param_prefix}_preferred_min_order_number", Spree.t('customer_order_count_rule.from') %>
+      <%= number_field_tag "#{param_prefix}[preferred_min_order_number]", promotion_rule.min_order_number,
+            min: 1, step: 1, class: 'form-control', id: "#{param_prefix}_preferred_min_order_number" %>
+    </div>
+    <div class="form-group col-6 mb-0">
+      <%= label_tag "#{param_prefix}_preferred_max_order_number", Spree.t('customer_order_count_rule.to') %>
+      <%= number_field_tag "#{param_prefix}[preferred_max_order_number]", promotion_rule.max_order_number,
+            min: 1, step: 1, class: 'form-control', id: "#{param_prefix}_preferred_max_order_number" %>
+    </div>
+  </div>
+  <div class="mt-3">
+    <%= render 'spree/admin/promotions/rules/oauth_application_select',
+          param_prefix: param_prefix, promotion_rule: promotion_rule,
+          label: Spree.t('customer_order_count_rule.oauth_applications'),
+          hint: Spree.t('customer_order_count_rule.oauth_applications_hint') %>
+  </div>
+</div>

data/app/views/spree/admin/promotions/rules/_oauth_application_select.html.erb

@@ -0,0 +1,15 @@
+<%# Labelled with the tenant or mini-app provider, because app names alone ("Client app",
+    "Storefront") do not say which channel an admin is picking.
+    Locals: param_prefix, promotion_rule, label, hint. %>
+<% applications = Spree::OauthApplication.includes(:tenant).order(:name) %>
+<div class="form-group mb-0">
+  <%= label_tag "#{param_prefix}_oauth_application_ids", label %>
+  <%= select_tag("#{param_prefix}[oauth_application_ids][]",
+      options_for_select(
+        applications.map { |app| [[app.name, app.tenant&.name || app.provider.presence].compact.join(' — '), app.id] },
+        promotion_rule.oauth_application_ids
+      ),
+      { class: 'select2 form-control', multiple: true, id: "#{param_prefix}_oauth_application_ids" }
+  ) %>
+  <small class="form-text text-muted"><%= hint %></small>
+</div>

data/app/views/spree/admin/promotions/rules/_oauth_applications.html.erb

@@ -0,0 +1,6 @@
+<div class="card-body">
+  <%= render 'spree/admin/promotions/rules/oauth_application_select',
+        param_prefix: param_prefix, promotion_rule: promotion_rule,
+        label: Spree.t('oauth_applications_rule.choose_oauth_applications'),
+        hint: Spree.t('oauth_applications_rule.hint') %>
+</div>

data/config/locales/en.yml

@@ -424,6 +424,12 @@ en:
       guest_age_group:
         name: "Guest Age Group"
         description: "Guest Age Group"
+      oauth_applications:
+        name: "OAuth Applications"
+        description: "Order must be placed through one of the selected apps (tenant app or mini app)"
+      customer_order_count:
+        name: "Customer Order Count"
+        description: "Order must be the customer's Nth booking (e.g. 2nd only, or 5th and later)"
       customers:
         name: "Customers"
         description: "Customers"
@@ -464,6 +470,19 @@ en:
       choose_guest_age_group: "Choose Guest Age Group"
       match_any: "Some line items must from selected age group"
       match_all: "All line items must from selected age group"
+    oauth_applications_rule:
+      choose_oauth_applications: "Choose apps"
+      hint: "Leave empty and the promotion applies to no app."
+    customer_order_count_rule:
+      from: "Eligible from the customer's booking number"
+      to: "Up to booking number (empty = no limit)"
+      oauth_applications: "Count only bookings from these apps"
+      oauth_applications_hint: "Empty = bookings from every app are counted."
+    eligibility_errors:
+      messages:
+        oauth_application_not_eligible: "This coupon is for a special offer and can't be used here."
+        customer_order_count_login_required: "Please log in to use this promotion."
+        customer_order_count_not_eligible: "This promotion is not available for this booking."
     billing:
       six_month_discount: "6 Months discount"
       twelve_month_discount: "12 Months discount"
@@ -940,6 +959,11 @@ en:
         place: "Place"
     errors:
       models:
+        spree_cm_commissioner/promotion/rules/customer_order_count:
+          attributes:
+            base:
+              customer_order_count_min_too_low: "'Eligible from the customer's booking number' must be 1 or more."
+              customer_order_count_max_below_min: "'Up to booking number' must be empty or not less than the 'from' number."
         spree_cm_commissioner/reschedule_policy:
           attributes:
             base:

data/config/locales/km.yml

@@ -368,6 +368,12 @@ km:
       guest_age_group:
         name: "Guest Age Group"
         description: "Guest Age Group"
+      oauth_applications:
+        name: "OAuth Applications"
+        description: "Order must be placed through one of the selected apps (tenant app or mini app)"
+      customer_order_count:
+        name: "Customer Order Count"
+        description: "Order must be the customer's Nth booking (e.g. 2nd only, or 5th and later)"
     promotion_action_types:
       create_date_specific_item_adjustments:
         name: "Create date specific item adjustment"
@@ -402,6 +408,19 @@ km:
       choose_guest_age_group: "Choose Guest Age Group"
       match_any: "Some line items must from selected age group"
       match_all: "All line items must from selected age group"
+    oauth_applications_rule:
+      choose_oauth_applications: "Choose apps"
+      hint: "Leave empty and the promotion applies to no app."
+    customer_order_count_rule:
+      from: "Eligible from the customer's booking number"
+      to: "Up to booking number (empty = no limit)"
+      oauth_applications: "Count only bookings from these apps"
+      oauth_applications_hint: "Empty = bookings from every app are counted."
+    eligibility_errors:
+      messages:
+        oauth_application_not_eligible: "គូប៉ុងនេះសម្រាប់ការផ្តល់ជូនពិសេស ហើយមិនអាចប្រើនៅទីនេះបានទេ។"
+        customer_order_count_login_required: "Please log in to use this promotion."
+        customer_order_count_not_eligible: "This promotion is not available for this booking."
     billing:
       six_month_discount: "Six Month discount"
       twelve_month_discount: "Twelve Month discount"
@@ -555,6 +574,11 @@ km:
         cashier: "អ្នកគិតលុយ"
     errors:
       models:
+        spree_cm_commissioner/promotion/rules/customer_order_count:
+          attributes:
+            base:
+              customer_order_count_min_too_low: "'Eligible from the customer's booking number' must be 1 or more."
+              customer_order_count_max_below_min: "'Up to booking number' must be empty or not less than the 'from' number."
         spree_cm_commissioner/inventory_item:
           attributes:
             variant_id:

data/db/migrate/20261110000001_create_cm_oauth_application_promotion_rules.rb

@@ -0,0 +1,16 @@
+class CreateCmOauthApplicationPromotionRules < ActiveRecord::Migration[7.0]
+  def change
+    create_table :cm_oauth_application_promotion_rules, if_not_exists: true do |t|
+      t.references :promotion_rule, null: false, foreign_key: { to_table: :spree_promotion_rules, on_delete: :cascade }, index: false
+      t.references :oauth_application, null: false, foreign_key: { to_table: :spree_oauth_applications, on_delete: :cascade },
+                                       index: { name: 'idx_cm_oauth_app_promotion_rules_on_app' }
+
+      t.timestamps
+    end
+
+    # One row per rule and app; also serves "which apps does this rule use". The index on
+    # oauth_application_id above serves the report direction, "which promotions use this app".
+    add_index :cm_oauth_application_promotion_rules, %i[promotion_rule_id oauth_application_id],
+              unique: true, name: 'idx_cm_oauth_app_promotion_rules_on_rule_and_app', if_not_exists: true
+  end
+end

data/lib/spree_cm_commissioner/engine.rb

@@ -31,7 +31,9 @@ module SpreeCmCommissioner
         SpreeCmCommissioner::Promotion::Rules::Weekend,
         SpreeCmCommissioner::Promotion::Rules::CustomDates,
         SpreeCmCommissioner::Promotion::Rules::GuestOccupations,
-        SpreeCmCommissioner::Promotion::Rules::GuestAgeGroup
+        SpreeCmCommissioner::Promotion::Rules::GuestAgeGroup,
+        SpreeCmCommissioner::Promotion::Rules::OauthApplications,
+        SpreeCmCommissioner::Promotion::Rules::CustomerOrderCount
       ]
 
       Rails.application.config.spree.promotions.actions.concat [

data/lib/spree_cm_commissioner/version.rb

@@ -1,5 +1,5 @@
 module SpreeCmCommissioner
-  VERSION = '2.15.0'.freeze
+  VERSION = '2.15.1'.freeze
 
   module_function
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_cm_commissioner
 version: !ruby/object:Gem::Version
-  version: 2.15.0
+  version: 2.15.1
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-11-10 00:00:00.000000000 Z
+date: 2026-11-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree
@@ -1514,6 +1514,7 @@ files:
 - app/models/concerns/spree_cm_commissioner/product_delegation.rb
 - app/models/concerns/spree_cm_commissioner/product_relation_type.rb
 - app/models/concerns/spree_cm_commissioner/product_type.rb
+- app/models/concerns/spree_cm_commissioner/promotion/rules/oauth_application_scoped.rb
 - app/models/concerns/spree_cm_commissioner/purchase_limitable.rb
 - app/models/concerns/spree_cm_commissioner/rate_plan_options_concern.rb
 - app/models/concerns/spree_cm_commissioner/reschedule_request_state_machine.rb
@@ -1665,6 +1666,7 @@ files:
 - app/models/spree_cm_commissioner/notification_taxon.rb
 - app/models/spree_cm_commissioner/oauth_access_token_decorator.rb
 - app/models/spree_cm_commissioner/oauth_application_decorator.rb
+- app/models/spree_cm_commissioner/oauth_application_promotion_rule.rb
 - app/models/spree_cm_commissioner/option_type_decorator.rb
 - app/models/spree_cm_commissioner/option_value_decorator.rb
 - app/models/spree_cm_commissioner/option_value_rate_plan.rb
@@ -1724,12 +1726,14 @@ files:
 - app/models/spree_cm_commissioner/promotion/actions/create_date_specific_item_adjustments.rb
 - app/models/spree_cm_commissioner/promotion/actions/create_guest_item_adjustments.rb
 - app/models/spree_cm_commissioner/promotion/rules/custom_dates.rb
+- app/models/spree_cm_commissioner/promotion/rules/customer_order_count.rb
 - app/models/spree_cm_commissioner/promotion/rules/customers.rb
 - app/models/spree_cm_commissioner/promotion/rules/date.rb
 - app/models/spree_cm_commissioner/promotion/rules/fixed_date.rb
 - app/models/spree_cm_commissioner/promotion/rules/guest.rb
 - app/models/spree_cm_commissioner/promotion/rules/guest_age_group.rb
 - app/models/spree_cm_commissioner/promotion/rules/guest_occupations.rb
+- app/models/spree_cm_commissioner/promotion/rules/oauth_applications.rb
 - app/models/spree_cm_commissioner/promotion/rules/vendors.rb
 - app/models/spree_cm_commissioner/promotion/rules/weekend.rb
 - app/models/spree_cm_commissioner/promotion_category_decorator.rb
@@ -2363,6 +2367,8 @@ files:
 - app/services/spree_cm_commissioner/customer_notifications/clone.rb
 - app/services/spree_cm_commissioner/distribution_agreements/create.rb
 - app/services/spree_cm_commissioner/distribution_agreements/update.rb
+- app/services/spree_cm_commissioner/doorkeeper_refresh_token_request_decorator.rb
+- app/services/spree_cm_commissioner/doorkeeper_server_decorator.rb
 - app/services/spree_cm_commissioner/draft_orders/create.rb
 - app/services/spree_cm_commissioner/events/clone.rb
 - app/services/spree_cm_commissioner/events/publish_stock_statuses_to_firestore.rb
@@ -2553,6 +2559,7 @@ files:
 - app/services/spree_cm_commissioner/load_test/generate_booking_ticket_data.rb
 - app/services/spree_cm_commissioner/load_test/generate_voting_fixture_data.rb
 - app/services/spree_cm_commissioner/load_test/login_token.rb
+- app/services/spree_cm_commissioner/mini_app_login_application.rb
 - app/services/spree_cm_commissioner/mini_app_provider/api_key_history.rb
 - app/services/spree_cm_commissioner/mini_app_provider/ip_rules.rb
 - app/services/spree_cm_commissioner/mini_app_provider/session_gate.rb
@@ -2959,10 +2966,13 @@ files:
 - app/views/spree/admin/promotions/actions/_create_date_specific_item_adjustments.html.erb
 - app/views/spree/admin/promotions/actions/_create_guest_item_adjustments.html.erb
 - app/views/spree/admin/promotions/rules/_custom_dates.html.erb
+- app/views/spree/admin/promotions/rules/_customer_order_count.html.erb
 - app/views/spree/admin/promotions/rules/_customers.html.erb
 - app/views/spree/admin/promotions/rules/_fixed_date.html.erb
 - app/views/spree/admin/promotions/rules/_guest_age_group.html.erb
 - app/views/spree/admin/promotions/rules/_guest_occupations.html.erb
+- app/views/spree/admin/promotions/rules/_oauth_application_select.html.erb
+- app/views/spree/admin/promotions/rules/_oauth_applications.html.erb
 - app/views/spree/admin/promotions/rules/_product.html.erb
 - app/views/spree/admin/promotions/rules/_user.html.erb
 - app/views/spree/admin/promotions/rules/_vendors.html.erb
@@ -3789,6 +3799,7 @@ files:
 - db/migrate/20261105000002_add_index_to_spree_orders_waiting_room_session_id.rb
 - db/migrate/20261105000003_add_queue_fields_to_cm_waiting_room_sessions.rb
 - db/migrate/20261105000004_add_oauth_application_id_to_spree_orders.rb
+- db/migrate/20261110000001_create_cm_oauth_application_promotion_rules.rb
 - docker-compose.yml
 - docs/api/scoped-access-token-endpoints.md
 - docs/option_types/attr_types.md