spree_cm_commissioner 2.15.0 → 2.15.2

data/app/serializers/spree/v2/tenant/line_item_serializer.rb

@@ -12,7 +12,7 @@ module Spree
                    :completion_steps, :available_social_contact_platforms, :allow_anonymous_booking,
                    :discontinue_on, :high_demand, :jwt_token, :pre_tax_amount, :display_pre_tax_amount, :public_metadata,
                    :direction, :trip_id, :boarding_trip_stop_id, :drop_off_trip_stop_id, :remark,
-                   :service_fee_total, :display_service_fee_total
+                   :service_fee_total, :display_service_fee_total, :seat_assignment_status
 
         attribute :required_self_check_in_location, &:required_self_check_in_location?
         attribute :allowed_self_check_in, &:allowed_self_check_in?

data/app/services/spree_cm_commissioner/doorkeeper_refresh_token_request_decorator.rb

@@ -0,0 +1,23 @@
+module SpreeCmCommissioner
+  # Doorkeeper only refreshes a token for the client it was issued to. A mini app token belongs to its
+  # mini app's application (see DoorkeeperServerDecorator), but the client that refreshes it holds no
+  # credentials for that application, so the match would always fail.
+  #
+  # For these tokens the refresh token itself is the proof, as it is for a public client. A wrong client
+  # secret is still refused: Doorkeeper checks it before the match, and this only relaxes the match.
+  module DoorkeeperRefreshTokenRequestDecorator
+    private
+
+    def validate_client_match
+      super || mini_app_token?
+    end
+
+    def mini_app_token?
+      refresh_token.application&.provider.present?
+    end
+  end
+end
+
+unless Doorkeeper::OAuth::RefreshTokenRequest.included_modules.include?(SpreeCmCommissioner::DoorkeeperRefreshTokenRequestDecorator)
+  Doorkeeper::OAuth::RefreshTokenRequest.prepend(SpreeCmCommissioner::DoorkeeperRefreshTokenRequestDecorator)
+end

data/app/services/spree_cm_commissioner/doorkeeper_server_decorator.rb

@@ -0,0 +1,28 @@
+module SpreeCmCommissioner
+  # A mini app login is issued its token for that mini app's OAuth application, found by
+  # MiniAppLoginApplication, whatever client credentials the request carries. Doorkeeper would otherwise
+  # take the client from those credentials (the default BookMe+ client, or none), and the order made with
+  # the token would not say which mini app it came from.
+  #
+  # The login itself is the proof: UserAuthenticator only accepts a session key the bank signed for the
+  # user, so no client secret is needed to say which bank it is.
+  module DoorkeeperServerDecorator
+    def client
+      mini_app_client || super
+    end
+
+    private
+
+    # Only the password grant: a refresh keeps the application its token was issued for.
+    def mini_app_client
+      return @mini_app_client if defined?(@mini_app_client)
+
+      application = MiniAppLoginApplication.for(parameters) if parameters[:grant_type] == Doorkeeper::OAuth::PASSWORD
+      @mini_app_client = application && Doorkeeper::OAuth::Client.new(application)
+    end
+  end
+end
+
+unless Doorkeeper::Server.included_modules.include?(SpreeCmCommissioner::DoorkeeperServerDecorator)
+  Doorkeeper::Server.prepend(SpreeCmCommissioner::DoorkeeperServerDecorator)
+end

data/app/services/spree_cm_commissioner/mini_app_login_application.rb

@@ -0,0 +1,32 @@
+module SpreeCmCommissioner
+  # Finds the OAuth application a mini app login belongs to, from the login itself: the parameter the
+  # client sends already names the bank (`session_key` → ACLEDA, `wing_session_key` → Wing, `session_id` →
+  # Vattanac), so the client needs no client id or secret of its own. The application is the one whose
+  # `provider` is that bank (see MiniAppProvider::Base.providers).
+  #
+  # Nil for any other login (web, Telegram, password), or when no application carries that provider yet.
+  class MiniAppLoginApplication
+    FLOW_SUFFIX = '_web_app_auth'.freeze
+
+    def self.for(params)
+      provider = provider_of(params)
+      return nil if provider.nil?
+
+      application = Spree::OauthApplication.find_by(provider: provider)
+      CmAppLogger.log(label: 'Mini app login: no OAuth application with this provider', data: { provider: provider }) if application.nil?
+      application
+    end
+
+    def self.provider_of(params)
+      flow = UserAuthenticator.flow_type(params)
+      return nil unless flow.end_with?(FLOW_SUFFIX)
+
+      provider = flow.delete_suffix(FLOW_SUFFIX)
+      provider if MiniAppProvider::Base.providers.map(&:provider).include?(provider)
+    rescue Doorkeeper::Errors::DoorkeeperError
+      # Params no flow recognises: the login fails on its own further down, with its own message.
+      nil
+    end
+    private_class_method :provider_of
+  end
+end

data/app/services/spree_cm_commissioner/order_holds/release.rb

@@ -41,7 +41,9 @@ module SpreeCmCommissioner
       end
 
       def cancel_seat_blocks!(order)
-        return unless order.should_manage_blocks?
+        # auto_assign_seats?: Seats::AutoAssignJob may have seated the guests after this order
+        # instance was loaded, leaving its preload_block_ids stale and empty.
+        return unless order.should_manage_blocks? || order.auto_assign_seats?
 
         result = SpreeCmCommissioner::ReservedBlocks::Cancel.call!(
           order_id: order.id,

data/app/services/spree_cm_commissioner/seat_layouts/save_seat_order.rb

@@ -0,0 +1,111 @@
+module SpreeCmCommissioner
+  module SeatLayouts
+    # Persists an organizer's seat order from the "Seat order" page.
+    #
+    # Strokes arrive as ordered arrays of block ids. Each stroke is one row of side-by-side seats of a
+    # single ticket type (variant), and a variant's stroke order is its sell order — the order between
+    # strokes of different variants means nothing, since auto-assign only ever ranks one variant's
+    # seats. A seat with no variant can never be sold, so it has no place in the order.
+    #
+    # Each variant's strokes are flattened into its own Block#seat_index sequence: consecutive inside
+    # a stroke, one number skipped between strokes, so a single integer answers both "are these two
+    # seats together?" (differ by exactly 1) and "which sells first?" (lower). Numbering per variant
+    # keeps one type's edits from renumbering another's. The Seat order page rebuilds the strokes by
+    # grouping by variant and splitting at the skipped numbers, so it must agree with `indexes_for`.
+    #
+    # Replaces the whole layout's order on every save. Assignments live on ReservedBlock and
+    # Guest#block_id, never on seat_index, so re-saving mid-sale moves no sold seat — it only
+    # changes how future auto-assign picks are ranked.
+    #
+    #   success(linked_count)
+    #   | failure(nil, :duplicate_seat | :unknown_seat | :not_a_seat | :no_ticket_type | :mixed_ticket_types)
+    class SaveSeatOrder
+      prepend ::Spree::ServiceModule::Base
+
+      def call(seat_layout:, strokes:)
+        strokes = normalize(strokes)
+        ids = strokes.flatten
+        blocks = ids.include?(nil) ? [] : seat_layout.blocks.where(id: ids).to_a
+        variant_ids = blocks.to_h { |block| [block.id, block.variant_id] }
+
+        reason = refusal(strokes, ids, blocks, variant_ids)
+        return failure(nil, reason) if reason
+
+        indexes = indexes_for(strokes, variant_ids)
+
+        # Clear first, then write: the unique (variant_id, seat_layout_id, seat_index) index is
+        # checked row by row, so rewriting in place would collide with numbers not yet moved.
+        ActiveRecord::Base.transaction do
+          seat_layout.blocks.where.not(seat_index: nil).update_all(seat_index: nil, updated_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
+          write_indexes!(indexes) if indexes.any?
+        end
+
+        success(indexes.size)
+      end
+
+      private
+
+      # Each ticket type keeps its own counter, so the same number can appear once per type: VIP 1 and
+      # Regular 1 are two different first seats. `variant_ids` is { block_id => variant_id }.
+      #
+      #   strokes: [[R1, R2], [V1, V2], [R3, R4]]   (R = Regular seats, V = VIP seats)
+      #
+      #   Regular: R1 → 1, R2 → 2, (3 skipped: row break), R3 → 4, R4 → 5
+      #   VIP:     V1 → 1, V2 → 2
+      def indexes_for(strokes, variant_ids)
+        next_index = Hash.new(1)
+
+        strokes.each_with_object({}) do |stroke, indexes|
+          variant_id = variant_ids[stroke.first]
+
+          stroke.each do |id|
+            indexes[id] = next_index[variant_id]
+            next_index[variant_id] += 1
+          end
+
+          # The row split: skip one number, so this row's last seat and the next row's first are 2 apart.
+          next_index[variant_id] += 1
+        end
+      end
+
+      def refusal(strokes, ids, blocks, variant_ids)
+        return :unknown_seat if ids.include?(nil)
+        return :duplicate_seat if ids.uniq.size != ids.size
+        return :unknown_seat if blocks.size != ids.size
+        return :not_a_seat unless blocks.all?(&:seatable?)
+        return :no_ticket_type if blocks.any? { |block| block.variant_id.nil? }
+
+        :mixed_ticket_types if mixed_ticket_types?(strokes, variant_ids)
+      end
+
+      # Two seats of different ticket types are never sold as a pair, and each type is numbered on its
+      # own, so a row spanning both has no single sequence to live in.
+      def mixed_ticket_types?(strokes, variant_ids)
+        strokes.any? { |stroke| stroke.map { |id| variant_ids[id] }.uniq.size > 1 }
+      end
+
+      # Turns the param ids into integers and drops empty rows. A non-numeric id becomes nil, which
+      # `refusal` reports as :unknown_seat, instead of raising here.
+      #
+      #   [["12", "13"], [], ["14", "x"]] → [[12, 13], [14, nil]]
+      #   nil                             → []   (clears the whole order)
+      def normalize(strokes)
+        Array(strokes).map { |stroke| Array(stroke).map { |id| Integer(id, exception: false) } }.reject(&:empty?)
+      end
+
+      # One statement instead of one UPDATE per seat: a stadium layout is thousands of seats, and
+      # Block's callbacks/validations (layout sync, variant-unassign guard) are irrelevant to this
+      # one integer column.
+      def write_indexes!(indexes)
+        values = indexes.map { |id, index| "(#{Integer(id)}, #{Integer(index)})" }.join(', ')
+
+        ActiveRecord::Base.connection.execute(<<~SQL.squish)
+          UPDATE cm_blocks
+          SET seat_index = v.seat_index, updated_at = NOW()
+          FROM (VALUES #{values}) AS v(id, seat_index)
+          WHERE cm_blocks.id = v.id
+        SQL
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/seats/auto_assign.rb

@@ -0,0 +1,135 @@
+module SpreeCmCommissioner
+  module Seats
+    # Seats the unseated guests of a paid order's auto-assign line items. Runs from Seats::AutoAssignJob
+    # once completion has committed: payment and stock are already final, so a slow or failed
+    # assignment never holds up or rolls back the completion — the job just retries.
+    #
+    # One assignment per inventory item at a time (a transaction-scoped advisory lock). Jobs are
+    # enqueued in completion order, so serializing them keeps "first to pay gets the better seats",
+    # and the free runs read under the lock cannot go stale because of another assignment.
+    #
+    # Steps: advisory lock → Seats::FreeRunsQuery (free seats as side-by-side runs) →
+    # Seats::PickSeats (which seats this party gets, plain Ruby) → reserve_seats!.
+    #
+    # A seat for every paid ticket is guaranteed by the Redis count hold taken at checkout (plus
+    # Seats::AutoAssignValidator). Sitting together is best effort: near sell-out a party can be
+    # split, which is recorded on the line item (seat_assignment_status) for the organizer to fix.
+    #
+    #   success([{ line_item_id:, status: :together | :split | :unseated, block_ids: [...] }, ...])
+    class AutoAssign
+      prepend ::Spree::ServiceModule::Base
+
+      # Seats::LockBlocks does not take the advisory lock, so an operator can still take a seat between
+      # the free runs read and reserve_seats!. Raised so the whole assignment rolls back and the job
+      # retries against fresh runs — rare enough not to retry in place.
+      SeatTakenError = Class.new(StandardError)
+
+      # A stuck assignment must not queue every later job for the same event behind it forever.
+      # Postgres applies lock_timeout to advisory locks too; the job retries on the timeout.
+      LOCK_TIMEOUT = '30s'.freeze
+
+      UNSEATED = { status: :unseated, block_ids: [] }.freeze
+
+      def call(order:)
+        inventory_item_ids = order.line_items.select(&:auto_assign_seats?).filter_map { |li| li.inventory_items.first&.id }.uniq
+        return success([]) if inventory_item_ids.empty?
+
+        outcomes = ActiveRecord::Base.transaction do
+          lock_inventory_items!(inventory_item_ids)
+
+          # Taken after the advisory lock so the order row is not held while queueing. The job is
+          # enqueued inside the completion transaction, which still holds this row: lock! waits for
+          # it to commit, then reloads — a rolled-back completion or a committed cancel gets no
+          # seats, and a cancel still in flight waits here, then finds the rows written below.
+          order.lock!
+
+          unless order.completed? && !order.canceled?
+            # A party canceled before the job ran is no longer waiting for a seat.
+            order.line_items.seat_assignment_pending.update_all(seat_assignment_status: nil) # rubocop:disable Rails/SkipsModelValidations
+            next []
+          end
+
+          order.line_items.select(&:auto_assign_seats?).filter_map { |line_item| assign_line_item!(order, line_item) }
+        end
+
+        report(order, outcomes) if outcomes.any?
+        success(outcomes)
+      end
+
+      private
+
+      # Sorted so two orders spanning the same items always lock them in the same order.
+      def lock_inventory_items!(inventory_item_ids)
+        connection = ActiveRecord::Base.connection
+        connection.execute("SET LOCAL lock_timeout = '#{LOCK_TIMEOUT}'")
+
+        inventory_item_ids.sort.each do |id|
+          connection.execute("SELECT pg_advisory_xact_lock(#{Zlib.crc32("spree_cm_commissioner:seat_auto_assign:#{id}")})")
+        end
+      end
+
+      def assign_line_item!(order, line_item)
+        guests = line_item.guests.where(block_id: nil).order(:id).to_a
+        return nil if guests.empty?
+
+        inventory_item = line_item.inventory_items.first
+        return record!(line_item, UNSEATED) if inventory_item.nil?
+
+        runs = FreeRunsQuery.new(variant_id: line_item.variant_id, inventory_item_id: inventory_item.id).call
+        pick = PickSeats.call(runs: runs, count: guests.size)
+        return record!(line_item, UNSEATED) if pick.nil?
+
+        reserve_seats!(order, guests, pick.block_ids, inventory_item)
+        record!(line_item, { status: pick.together? ? :together : :split, block_ids: pick.block_ids })
+      end
+
+      def reserve_seats!(order, guests, block_ids, inventory_item)
+        guests.zip(block_ids).each do |guest, block_id|
+          # Row-locked for LockBlocks, which locks the inventory item rather than the block. A seat
+          # with no row yet is covered by the unique index instead: a concurrent insert raises
+          # RecordNotUnique, which retries the job like SeatTakenError.
+          key = { block_id: block_id, inventory_item_id: inventory_item.id }
+          reserved_block = SpreeCmCommissioner::ReservedBlock.lock.find_by(key) || SpreeCmCommissioner::ReservedBlock.new(key)
+          raise SeatTakenError, "block #{block_id}" if taken?(reserved_block)
+
+          # Same attributes ReservedBlocks::Reserve writes. Gender is what neighbour rules evaluated by
+          # the next assignment read.
+          reserved_block.update!(
+            status: :reserved,
+            guest: guest,
+            gender: guest.gender || guest.saved_guest&.gender,
+            expired_at: nil,
+            payment_locked_at: nil,
+            inventory_date: inventory_item.inventory_date,
+            updated_by: order.user
+          )
+
+          # Guest#assign_seat_number_with_block copies the block label into seat_number, and
+          # Guest#preload_order_block_ids refreshes order.preload_block_ids so a later cancel releases it.
+          guest.update!(block_id: block_id)
+        end
+      end
+
+      def taken?(reserved_block)
+        reserved_block.reserved? || reserved_block.locked? || reserved_block.active_on_hold?
+      end
+
+      # update_columns: LineItem validations (purchase limits) must not block a paid order's seats.
+      def record!(line_item, outcome)
+        line_item.update_columns(seat_assignment_status: outcome[:status]) # rubocop:disable Rails/SkipsModelValidations
+
+        outcome.merge(line_item_id: line_item.id)
+      end
+
+      def report(order, outcomes)
+        data = { order_id: order.id, order_number: order.number, outcomes: outcomes }
+
+        if outcomes.all? { |outcome| outcome[:status] == :together }
+          CmAppLogger.log(label: self.class.name, data: data)
+        else
+          CmAppLogger.error(label: "#{self.class.name} party not seated together", data: data)
+        end
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/seats/block_date_iteration.rb

@@ -28,7 +28,10 @@ module SpreeCmCommissioner
       # Yields [block, date, inventory_item] for every pair that resolves to an inventory item, and
       # records a :no_inventory skip for those that do not — a service calendar can legitimately exclude
       # dates, so a missing item is normal input rather than an error.
+      # No dates means the undated item every event ticket has (inventory_date: nil) — there is no
+      # departure to choose, so the dashboard sends none.
       def each_block_date(blocks, dates, skipped)
+        dates = Array(dates).presence || [nil]
         index = inventory_index(blocks, dates)
 
         # Warm every Redis key once for the whole grid instead of once per seat-date.
@@ -39,9 +42,9 @@ module SpreeCmCommissioner
         # fewer round-trips, which matters as soon as Redis is a network hop rather than localhost.
         SpreeCmCommissioner::RedisStock::CachedInventoryItemsBuilder.new(index.values).call if index.any?
 
-        Array(dates).each do |date|
+        dates.each do |date|
           blocks.each do |block|
-            item = index[[block.variant_id, date.to_date]]
+            item = index[[block.variant_id, date&.to_date]]
 
             if item.nil?
               skipped << skip(date, block, :no_inventory)

data/app/services/spree_cm_commissioner/seats/pick_seats.rb

@@ -0,0 +1,79 @@
+module SpreeCmCommissioner
+  module Seats
+    # Chooses which free seats a party of `count` gets, from Seats::FreeRunsQuery runs.
+    #
+    # Rules, in order:
+    # 1. Together — the run in the earliest stroke that fits, then the best fit inside that stroke:
+    #    exact fit, then leaving ≥ 2 behind, and only then leaving exactly 1 (an orphan only a solo
+    #    buyer can ever use). Stroke ranks above fit so an earlier payer is never pushed back a row
+    #    just to pack better. Seats come from the start of the run, keeping the rest contiguous.
+    # 2. Split — anchor on the biggest run, fill from the nearest strokes of the same layout first.
+    #    Organizers drag rows in order, so the nearest stroke is usually the row behind or in front.
+    # nil — fewer than `count` free seats in total (stock/seat drift).
+    #
+    # Deliberately plain Ruby over duck-typed runs (seat_layout_id, stroke, start_index, block_ids,
+    # size): no database, so it is unit-tested with Structs and can be replayed offline against a
+    # venue to measure how often parties split.
+    class PickSeats
+      Pick = Struct.new(:block_ids, :pieces, keyword_init: true) do
+        def together? = pieces == 1
+      end
+
+      def self.call(runs:, count:)
+        new(runs, count).call
+      end
+
+      def initialize(runs, count)
+        @runs = runs
+        @count = count
+      end
+
+      def call
+        return nil if @count <= 0 || @runs.sum(&:size) < @count
+
+        together || split
+      end
+
+      private
+
+      def together
+        run = @runs.select { |r| r.size >= @count }
+                   .min_by { |r| [r.seat_layout_id, r.stroke, fit_penalty(r), r.start_index] }
+        return nil if run.nil?
+
+        Pick.new(block_ids: run.block_ids.first(@count), pieces: 1)
+      end
+
+      def fit_penalty(run)
+        case run.size - @count
+        when 0 then 0
+        when 1 then 2
+        else 1
+        end
+      end
+
+      def split
+        anchor = @runs.max_by { |r| [r.size, -r.stroke, -r.start_index] }
+        nearest = (@runs - [anchor]).sort_by do |r|
+          [
+            r.seat_layout_id == anchor.seat_layout_id ? 0 : 1,
+            (r.stroke - anchor.stroke).abs,
+            (r.start_index - anchor.start_index).abs
+          ]
+        end
+
+        ids = []
+        pieces = 0
+
+        [anchor, *nearest].each do |run|
+          break if ids.size == @count
+
+          ids.concat(run.block_ids.first(@count - ids.size))
+          pieces += 1
+        end
+
+        Pick.new(block_ids: ids, pieces: pieces)
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/transit_order/create.rb

@@ -6,6 +6,8 @@
 # - outbound_legs: [Array<SpreeCmCommissioner::Transit::Leg>] Outbound transit legs (one for direct, multiple for connecting)
 # - inbound_legs:  [Array<SpreeCmCommissioner::Transit::Leg>] Inbound transit legs (one for direct, multiple for connecting)
 # - user:          [User] The user for whom the order is being created
+# - oauth_application_id: [Integer, nil] The client app of the request's access token (nil without a token or
+#                  from a path that has none), recorded on the order for promotions limited to one app.
 #
 # Each line item is built with precise from_date and to_date based on legs and trip stop times.
 # Each line item has guests built corresponding to seat selection blocks.
@@ -17,13 +19,13 @@ module SpreeCmCommissioner
       prepend ::Spree::ServiceModule::Base
 
       def call(outbound_date:, inbound_date:, outbound_legs:, inbound_legs: [], user: nil, created_by: nil, # rubocop:disable Metrics/ParameterLists
-               include_return: false, channel: SpreeCmCommissioner::OrderChannelBitwise::SPREE_CHANNEL
+               include_return: false, channel: SpreeCmCommissioner::OrderChannelBitwise::SPREE_CHANNEL, oauth_application_id: nil
       )
         return failure(nil, 'Outbound legs are missing') if outbound_legs.blank?
 
         begin
           order = create_order!(outbound_date, inbound_date, outbound_legs, inbound_legs, user, include_return,
-                                created_by: created_by, channel: channel
+                                created_by: created_by, channel: channel, oauth_application_id: oauth_application_id
           )
           success(order: order)
         rescue StandardError => e
@@ -32,9 +34,12 @@ module SpreeCmCommissioner
       end
 
       def create_order!(outbound_date, inbound_date, outbound_legs, inbound_legs, user, include_return, # rubocop:disable Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity,Metrics/ParameterLists
-                        created_by: nil, channel: SpreeCmCommissioner::OrderChannelBitwise::SPREE_CHANNEL
+                        created_by: nil, channel: SpreeCmCommissioner::OrderChannelBitwise::SPREE_CHANNEL, oauth_application_id: nil
       )
-        order = Spree::Order.new(state: 'cart', use_billing: true, user: user, created_by: created_by, channel: channel)
+        order = Spree::Order.new(
+          state: 'cart', use_billing: true, user: user, created_by: created_by, channel: channel,
+          oauth_application_id: oauth_application_id
+        )
 
         all_legs = outbound_legs + inbound_legs
         preload_trips_and_stops!(all_legs)

data/app/views/spree/admin/promotions/rules/_customer_order_count.html.erb

@@ -0,0 +1,20 @@
+<div class="card-body">
+  <div class="row mb-0">
+    <div class="form-group col-6 mb-0">
+      <%= label_tag "#{param_prefix}_preferred_min_order_number", Spree.t('customer_order_count_rule.from') %>
+      <%= number_field_tag "#{param_prefix}[preferred_min_order_number]", promotion_rule.min_order_number,
+            min: 1, step: 1, class: 'form-control', id: "#{param_prefix}_preferred_min_order_number" %>
+    </div>
+    <div class="form-group col-6 mb-0">
+      <%= label_tag "#{param_prefix}_preferred_max_order_number", Spree.t('customer_order_count_rule.to') %>
+      <%= number_field_tag "#{param_prefix}[preferred_max_order_number]", promotion_rule.max_order_number,
+            min: 1, step: 1, class: 'form-control', id: "#{param_prefix}_preferred_max_order_number" %>
+    </div>
+  </div>
+  <div class="mt-3">
+    <%= render 'spree/admin/promotions/rules/oauth_application_select',
+          param_prefix: param_prefix, promotion_rule: promotion_rule,
+          label: Spree.t('customer_order_count_rule.oauth_applications'),
+          hint: Spree.t('customer_order_count_rule.oauth_applications_hint') %>
+  </div>
+</div>

data/app/views/spree/admin/promotions/rules/_oauth_application_select.html.erb

@@ -0,0 +1,15 @@
+<%# Labelled with the tenant or mini-app provider, because app names alone ("Client app",
+    "Storefront") do not say which channel an admin is picking.
+    Locals: param_prefix, promotion_rule, label, hint. %>
+<% applications = Spree::OauthApplication.includes(:tenant).order(:name) %>
+<div class="form-group mb-0">
+  <%= label_tag "#{param_prefix}_oauth_application_ids", label %>
+  <%= select_tag("#{param_prefix}[oauth_application_ids][]",
+      options_for_select(
+        applications.map { |app| [[app.name, app.tenant&.name || app.provider.presence].compact.join(' — '), app.id] },
+        promotion_rule.oauth_application_ids
+      ),
+      { class: 'select2 form-control', multiple: true, id: "#{param_prefix}_oauth_application_ids" }
+  ) %>
+  <small class="form-text text-muted"><%= hint %></small>
+</div>

data/app/views/spree/admin/promotions/rules/_oauth_applications.html.erb

@@ -0,0 +1,6 @@
+<div class="card-body">
+  <%= render 'spree/admin/promotions/rules/oauth_application_select',
+        param_prefix: param_prefix, promotion_rule: promotion_rule,
+        label: Spree.t('oauth_applications_rule.choose_oauth_applications'),
+        hint: Spree.t('oauth_applications_rule.hint') %>
+</div>

data/config/locales/en.yml

@@ -424,6 +424,12 @@ en:
       guest_age_group:
         name: "Guest Age Group"
         description: "Guest Age Group"
+      oauth_applications:
+        name: "OAuth Applications"
+        description: "Order must be placed through one of the selected apps (tenant app or mini app)"
+      customer_order_count:
+        name: "Customer Order Count"
+        description: "Order must be the customer's Nth booking (e.g. 2nd only, or 5th and later)"
       customers:
         name: "Customers"
         description: "Customers"
@@ -464,6 +470,19 @@ en:
       choose_guest_age_group: "Choose Guest Age Group"
       match_any: "Some line items must from selected age group"
       match_all: "All line items must from selected age group"
+    oauth_applications_rule:
+      choose_oauth_applications: "Choose apps"
+      hint: "Leave empty and the promotion applies to no app."
+    customer_order_count_rule:
+      from: "Eligible from the customer's booking number"
+      to: "Up to booking number (empty = no limit)"
+      oauth_applications: "Count only bookings from these apps"
+      oauth_applications_hint: "Empty = bookings from every app are counted."
+    eligibility_errors:
+      messages:
+        oauth_application_not_eligible: "This coupon is for a special offer and can't be used here."
+        customer_order_count_login_required: "Please log in to use this promotion."
+        customer_order_count_not_eligible: "This promotion is not available for this booking."
     billing:
       six_month_discount: "6 Months discount"
       twelve_month_discount: "12 Months discount"
@@ -940,6 +959,11 @@ en:
         place: "Place"
     errors:
       models:
+        spree_cm_commissioner/promotion/rules/customer_order_count:
+          attributes:
+            base:
+              customer_order_count_min_too_low: "'Eligible from the customer's booking number' must be 1 or more."
+              customer_order_count_max_below_min: "'Up to booking number' must be empty or not less than the 'from' number."
         spree_cm_commissioner/reschedule_policy:
           attributes:
             base:

data/config/locales/km.yml

@@ -368,6 +368,12 @@ km:
       guest_age_group:
         name: "Guest Age Group"
         description: "Guest Age Group"
+      oauth_applications:
+        name: "OAuth Applications"
+        description: "Order must be placed through one of the selected apps (tenant app or mini app)"
+      customer_order_count:
+        name: "Customer Order Count"
+        description: "Order must be the customer's Nth booking (e.g. 2nd only, or 5th and later)"
     promotion_action_types:
       create_date_specific_item_adjustments:
         name: "Create date specific item adjustment"
@@ -402,6 +408,19 @@ km:
       choose_guest_age_group: "Choose Guest Age Group"
       match_any: "Some line items must from selected age group"
       match_all: "All line items must from selected age group"
+    oauth_applications_rule:
+      choose_oauth_applications: "Choose apps"
+      hint: "Leave empty and the promotion applies to no app."
+    customer_order_count_rule:
+      from: "Eligible from the customer's booking number"
+      to: "Up to booking number (empty = no limit)"
+      oauth_applications: "Count only bookings from these apps"
+      oauth_applications_hint: "Empty = bookings from every app are counted."
+    eligibility_errors:
+      messages:
+        oauth_application_not_eligible: "គូប៉ុងនេះសម្រាប់ការផ្តល់ជូនពិសេស ហើយមិនអាចប្រើនៅទីនេះបានទេ។"
+        customer_order_count_login_required: "Please log in to use this promotion."
+        customer_order_count_not_eligible: "This promotion is not available for this booking."
     billing:
       six_month_discount: "Six Month discount"
       twelve_month_discount: "Twelve Month discount"
@@ -555,6 +574,11 @@ km:
         cashier: "អ្នកគិតលុយ"
     errors:
       models:
+        spree_cm_commissioner/promotion/rules/customer_order_count:
+          attributes:
+            base:
+              customer_order_count_min_too_low: "'Eligible from the customer's booking number' must be 1 or more."
+              customer_order_count_max_below_min: "'Up to booking number' must be empty or not less than the 'from' number."
         spree_cm_commissioner/inventory_item:
           attributes:
             variant_id:

data/db/migrate/20261106000001_add_seat_index_to_cm_blocks.rb

@@ -0,0 +1,16 @@
+class AddSeatIndexToCmBlocks < ActiveRecord::Migration[7.0]
+  def change
+    add_column :cm_blocks, :seat_index, :integer, if_not_exists: true
+
+    # One seat order per ticket type on a layout: each variant's seats are numbered on their own, so
+    # editing one type's rows never renumbers another's. Unique so SeatLayouts::SaveSeatOrder can make
+    # a corrupt order (two seats claiming the same place) impossible rather than merely unlikely; in
+    # this column order because auto-assign looks up free seats the same way: by ticket type (variant_id),
+    # per layout (seat_layout_id), in seat order (seat_index).
+    add_index :cm_blocks, %i[variant_id seat_layout_id seat_index],
+              unique: true,
+              where: 'seat_index IS NOT NULL',
+              name: 'index_cm_blocks_on_variant_layout_and_seat_index',
+              if_not_exists: true
+  end
+end