spree_cm_commissioner 2.5.0.pre.pre13 → 2.5.0.pre.pre14

data/app/services/spree_cm_commissioner/pricing_models/apply.rb

@@ -1,9 +1,9 @@
 module SpreeCmCommissioner
   module PricingModels
     class Apply
-      def initialize(line_item_id:, pricing_model_id:)
-        @line_item_id = line_item_id
-        @pricing_model_id = pricing_model_id
+      def initialize(line_item:, pricing_model:)
+        @line_item = line_item
+        @pricing_model = pricing_model
       end
 
       def call
@@ -14,15 +14,7 @@ module SpreeCmCommissioner
 
       private
 
-      attr_reader :line_item_id, :pricing_model_id
-
-      def line_item
-        @line_item ||= Spree::LineItem.find(line_item_id)
-      end
-
-      def pricing_model
-        @pricing_model ||= SpreeCmCommissioner::PricingModel.find(pricing_model_id)
-      end
+      attr_reader :line_item, :pricing_model
 
       def apply_group(group, line_item)
         eligible_rules = group.pricing_rules.select { |r| r.eligible?(line_item) }

data/app/services/spree_cm_commissioner/signing/sign_data.rb

@@ -0,0 +1,42 @@
+module SpreeCmCommissioner
+  module Signing
+    # Signs data hash using HMAC-SHA256 with a signing key.
+    # The data must be serialized to JSON in a consistent order for signature verification.
+    #
+    # == INPUT (keyword args)
+    #   hash:        [Hash]  REQUIRED - The hash to sign
+    #   signing_key: [String] REQUIRED - The signing key to use
+    #
+    # == OUTPUT (Result object)
+    #   result.success?  => true/false
+    #   result.failure?  => true/false
+    #   result.value     => String (Base64-encoded HMAC signature on success)
+    #   result.error     => String error message (on failure)
+    #
+    # == Example Usage
+    #   result = SpreeCmCommissioner::Signing::SignData.call(
+    #     hash: { 'distance_km' => 314.77 },
+    #     signing_key: ENV.fetch('DISTANCE_SIGNING_KEY')
+    #   )
+    #   if result.success?
+    #     signature = result.value
+    #     signed_hash = hash.merge('signature' => signature)
+    #   end
+    class SignData
+      prepend ::Spree::ServiceModule::Base
+
+      def call(hash:, signing_key:)
+        return failure(nil, 'Hash is required') if hash.nil?
+        return failure(nil, 'Signing key is required') if signing_key.blank?
+
+        digest = OpenSSL::Digest.new('sha256')
+        hmac = OpenSSL::HMAC.digest(digest, signing_key, hash.to_json)
+        signature = Base64.strict_encode64(hmac)
+
+        success(signature)
+      rescue StandardError => e
+        failure(nil, e.message)
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/signing/verify_signature.rb

@@ -0,0 +1,52 @@
+module SpreeCmCommissioner
+  module Signing
+    # Verifies if a signed hash's data matches the stored signature.
+    # Uses secure comparison to prevent timing attacks.
+    #
+    # == INPUT (keyword args)
+    #   signed_hash: [Hash]   REQUIRED - Hash containing data and signature
+    #   signing_key: [String] REQUIRED - The signing key to use for verification
+    #
+    # == OUTPUT (Result object)
+    #   result.success?  => true/false
+    #   result.failure?  => true/false
+    #   result.value     => Boolean (true if valid, false if invalid)
+    #   result.error     => String error message (on failure)
+    #
+    # == Example Usage
+    #   result = SpreeCmCommissioner::Signing::VerifySignature.call(
+    #     signed_hash: { 'distance_km' => 314.77, 'signature' => 'abc123...' },
+    #     signing_key: ENV.fetch('DISTANCE_SIGNING_KEY')
+    #   )
+    #   if result.success? && result.value
+    #     # Signature is valid
+    #   end
+    class VerifySignature
+      prepend ::Spree::ServiceModule::Base
+
+      def call(signed_hash:, signing_key:)
+        return failure(nil, 'Signed hash is required') if signed_hash.nil?
+        return failure(nil, 'Signing key is required') if signing_key.blank?
+
+        return success(false) if signed_hash['signature'].nil?
+
+        # Extract signature and data
+        hash = signed_hash.dup
+        signature = hash.delete('signature')
+
+        # Re-compute signature from data
+        sign_result = SpreeCmCommissioner::Signing::SignData.call(hash: hash, signing_key: signing_key)
+        return sign_result unless sign_result.success?
+
+        expected_signature = sign_result.value
+
+        # Use secure comparison to prevent timing attacks
+        is_valid = ActiveSupport::SecurityUtils.secure_compare(signature, expected_signature)
+
+        success(is_valid)
+      rescue StandardError => e
+        failure(nil, e.message)
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/transit/export_order.rb

@@ -0,0 +1,146 @@
+module SpreeCmCommissioner
+  module Transit
+    class ExportOrder
+      prepend ::Spree::ServiceModule::Base
+
+      def call(orders:, columns: nil, format: 'csv')
+        if format == 'csv'
+          csv_data = generate_csv(orders, columns)
+          success(csv: csv_data)
+        else
+          success(orders: orders, columns: columns)
+        end
+      end
+
+      private
+
+      def generate_csv(orders, columns)
+        headers = columns.nil? ? default_headers : columns.map { |col| header_name(col) }
+        CSV.generate(headers: true) do |csv|
+          csv << headers
+          orders.find_each do |order|
+            attrs = attributes_hash(order)
+            csv << (columns.nil? ? attrs.values : columns.map { |col| attrs[col] })
+          end
+        end
+      end
+
+      def default_headers
+        [
+          'Reservation',
+          'Amount',
+          'Trip',
+          'Depart',
+          'Seats',
+          'Pick Up',
+          'Contact',
+          'Ticket Type',
+          'Issuer',
+          'Status',
+          'Issued At'
+        ]
+      end
+
+      def header_name(col)
+        {
+          'reservation' => 'Reservation',
+          'amount' => 'Amount',
+          'trip' => 'Trip',
+          'depart' => 'Depart',
+          'seats' => 'Seats',
+          'pick_up' => 'Pick Up',
+          'contact' => 'Contact',
+          'ticket_type' => 'Ticket Type',
+          'issuer' => 'Issuer',
+          'status' => 'Status',
+          'issued_at' => 'Issued At'
+        }[col] || col
+      end
+
+      def attributes_hash(order)
+        {
+          'reservation' => order.number,
+          'amount' => display_total(order),
+          'trip' => trip_name(order),
+          'depart' => depart_datetime(order),
+          'seats' => seat_labels(order),
+          'pick_up' => pick_up_stops(order),
+          'contact' => order&.phone_number,
+          'ticket_type' => ticket_type(order),
+          'issuer' => issuer_name(order),
+          'status' => order.state,
+          'issued_at' => order.created_at.strftime('%d %b %Y - %H:%M:%S')
+        }
+      end
+
+      def passengers_name(order)
+        names = order.guests.map do |g|
+          g.saved_guest&.full_name.presence || g&.full_name.presence
+        end.compact
+        names.empty? ? 'N/A' : names.join(', ')
+      end
+
+      def display_subtotal(order)
+        order.display_item_total.to_s.gsub(',', '').gsub('.00', '').gsub('៛', '')
+      end
+
+      def display_total(order)
+        order.display_total.to_s.gsub(',', '').gsub('.00', '').gsub('៛', '')
+      end
+
+      def display_discount(order)
+        total_discount = order.adjustments.select { |adj| adj.amount.negative? }.sum(&:amount)
+        "-#{total_discount.abs.to_s.gsub(',', '').gsub('.00', '').gsub('៛', '')}"
+      end
+
+      def display_adjustment(order)
+        total_adjustment = order.adjustments.select { |adj| adj.amount.positive? }.sum(&:amount)
+        total_adjustment.to_s.gsub(',', '').gsub('.00', '').gsub('៛', '')
+      end
+
+      def trip_name(order)
+        line_item = order.line_items.first
+        return 'N/A' unless line_item
+
+        trip_id = line_item.private_metadata&.dig('trip_id')
+        return 'N/A' unless trip_id
+
+        trip = SpreeCmCommissioner::Trip.find_by(id: trip_id)
+        trip&.product&.name || 'N/A'
+      end
+
+      def depart_datetime(order)
+        line_item = order.line_items.first
+        line_item&.from_date&.strftime('%d %b %Y - %H:%M:%S') || 'N/A'
+      end
+
+      def seat_labels(order)
+        seat_labels = order.guests.map(&:seat_number).compact.join(', ')
+        quantity = order.line_items.sum(&:quantity)
+        "#{seat_labels} (#{quantity})"
+      end
+
+      def pick_up_stops(order)
+        line_item = order.line_items.first
+        return 'N/A' unless line_item
+
+        boarding_id = line_item.boarding_trip_stop_id
+        drop_off_id = line_item.drop_off_trip_stop_id
+
+        boarding_stop = boarding_id ? SpreeCmCommissioner::TripStop.find_by(id: boarding_id)&.stop_name : nil
+        drop_off_stop = drop_off_id ? SpreeCmCommissioner::TripStop.find_by(id: drop_off_id)&.stop_name : nil
+
+        "#{boarding_stop || 'N/A'} - #{drop_off_stop || 'N/A'}"
+      end
+
+      def ticket_type(order)
+        line_item = order.line_items.first
+        line_item&.product_type&.humanize || 'N/A'
+      end
+
+      def issuer_name(order)
+        order.created_by&.full_name || 'N/A'
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/update_guest_service.rb

@@ -0,0 +1,129 @@
+module SpreeCmCommissioner
+  # Updates guest records with dynamic fields.
+  # Handles create/update/delete of dynamic fields with automatic cleanup of removed fields.
+  class UpdateGuestService
+    attr_reader :guest, :guest_params
+
+    def initialize(guest, guest_params)
+      @guest = guest
+      @guest_params = guest_params
+    end
+
+    # Updates guest within transaction: process dynamic fields → update attributes → move to next stage
+    def call
+      ActiveRecord::Base.transaction do
+        process_dynamic_fields(guest_params[:guest_dynamic_fields_attributes]) if guest_params[:guest_dynamic_fields_attributes]
+
+        guest.assign_attributes(guest_params.except(:guest_dynamic_fields_attributes))
+        guest.save!
+
+        guest.save_and_move_to_next_stage
+      end
+      guest
+    end
+
+    private
+
+    # Processes dynamic fields: destroy marked fields, upsert valid ones, cleanup unlisted fields
+    def process_dynamic_fields(dynamic_fields_attributes)
+      sent_keys = []
+
+      dynamic_fields_attributes.each do |raw_attributes|
+        attributes = raw_attributes.to_h.symbolize_keys
+        should_destroy = ActiveModel::Type::Boolean.new.cast(attributes[:_destroy])
+
+        if should_destroy
+          destroy_guest_dynamic_field(attributes[:id])
+        elsif attributes[:id].blank? || guest.guest_dynamic_fields.exists?(attributes[:id])
+          field = upsert_guest_dynamic_field(attributes)
+          sent_keys << field_key(field)
+        end
+      end
+
+      # Auto-cleanup: delete existing fields not in current submission
+      guest.guest_dynamic_fields.includes(:dynamic_field).find_each do |field|
+        field.destroy! unless sent_keys.include?(field_key(field))
+      end
+    end
+
+    def field_key(field)
+      if field.dynamic_field.requires_dynamic_field_options?
+        [field.dynamic_field_id, field.dynamic_field_option_id]
+      else
+        [field.dynamic_field_id]
+      end
+    end
+
+    # Creates/updates field with validation: prevents dynamic_field_id changes, loads associations, sets options
+    def upsert_guest_dynamic_field(attributes)
+      field = find_or_initialize_guest_dynamic_field(attributes)
+
+      if attributes[:id].present? && attributes[:dynamic_field_id].present? && field.dynamic_field_id.to_i != attributes[:dynamic_field_id].to_i
+        field.errors.add(:base, "Cannot change dynamic_field_id for existing GuestDynamicField (ID: #{attributes[:id]})")
+        raise ActiveRecord::RecordInvalid, field
+      end
+
+      if attributes[:dynamic_field_id].present? && field.dynamic_field.blank?
+        field.dynamic_field = SpreeCmCommissioner::DynamicField.find_by(id: attributes[:dynamic_field_id])
+        unless field.dynamic_field
+          field.errors.add(:dynamic_field, 'not found')
+          raise ActiveRecord::RecordInvalid, field
+        end
+      end
+
+      field.assign_attributes(attributes.except(:id, :_destroy, :dynamic_field_option_id))
+
+      field.dynamic_field_option_id = attributes[:dynamic_field_option_id].to_i if attributes[:dynamic_field_option_id].present?
+
+      associate_dynamic_field_option(field) if field.dynamic_field&.requires_dynamic_field_options?
+
+      field.save!
+      field
+    end
+
+    # Finds and associates option by ID or value, sets field value if empty
+    def associate_dynamic_field_option(field)
+      return unless field.dynamic_field&.requires_dynamic_field_options?
+
+      option_id = field.dynamic_field_option_id.presence || field.value
+
+      option_lookup_id = option_id.to_s.match?(/\A\d+\z/) ? option_id.to_i : option_id
+
+      option = if option_lookup_id.is_a?(Integer)
+                 field.dynamic_field.dynamic_field_options.find_by(id: option_lookup_id)
+               else
+                 field.dynamic_field.dynamic_field_options.find_by(value: option_lookup_id)
+               end
+
+      raise ActiveRecord::RecordNotFound, 'Option not found' unless option
+
+      field.dynamic_field_option = option
+      field.value = option.value if field.value.blank?
+    end
+
+    def find_or_initialize_guest_dynamic_field(attributes)
+      if attributes[:id].present?
+        guest.guest_dynamic_fields.find(attributes[:id])
+
+      elsif attributes[:dynamic_field_option_id].present?
+        guest.guest_dynamic_fields.find_by(
+          dynamic_field_id: attributes[:dynamic_field_id],
+          dynamic_field_option_id: attributes[:dynamic_field_option_id]
+        ) || guest.guest_dynamic_fields.build
+
+      else
+        guest.guest_dynamic_fields.find_by(
+          dynamic_field_id: attributes[:dynamic_field_id],
+          dynamic_field_option_id: nil
+        ) || guest.guest_dynamic_fields.build
+      end
+    end
+
+    def destroy_guest_dynamic_field(id)
+      return if id.blank?
+
+      field = guest.guest_dynamic_fields.find_by(id: id)
+      field&.destroy!
+    end
+  end
+end

data/app/views/spree/admin/homepage_section/edit.html.erb

@@ -1,6 +1,11 @@
 <% content_for :page_title do %>
-  <%= link_to plural_resource_name(SpreeCmCommissioner::HomepageSection), spree.admin_homepage_feed_homepage_section_index_url %> /
-  <%= Spree.t(:edit_section_relatable) %>
+  <div class="d-flex justify-content-between">
+    <div>
+      <%= link_to plural_resource_name(SpreeCmCommissioner::HomepageSection), spree.admin_homepage_feed_homepage_section_index_url %> /
+      <%= Spree.t(:edit_section_relatable) %>
+    </div>
+    <%= button_link_to Spree.t(:clear_cache), admin_invalidate_api_caches_path(model: SpreeCmCommissioner::HomepageSection.name, id: @object.id), method: :post, class: "btn btn-outline-primary" %>
+  </div>
 <% end %>
 
 <%= form_with model: @object, url: { action: 'update' }, html: { multipart: true } do |f| %>

data/app/views/spree/order_mailer/cancel_email.html.erb

@@ -0,0 +1,19 @@
+<tr>
+  <td align="center">
+    <% if @order.tenant.nil? %>
+      <div class="content-wrapper">
+        <%= render 'spree_cm_commissioner/cancel_order_mailer/header'%>
+        <%= render 'spree_cm_commissioner/cancel_order_mailer/cancel_email', order: @order %>
+        <%= render 'spree_cm_commissioner/cancel_order_mailer/your_booking', order: @order, show_booking_header: true %>
+        <%= render 'spree_cm_commissioner/cancel_order_mailer/footer', order: @order%>
+      </div>
+    <% else %>
+      <div class="content-wrapper">
+        <%= render 'spree_cm_commissioner/cancel_order_mailer/tenant/header', order: @order ,logo: @logo, name: @name %>
+        <%= render 'spree_cm_commissioner/cancel_order_mailer/tenant/cancel_email', order: @order %>
+        <%= render 'spree_cm_commissioner/cancel_order_mailer/your_booking', order: @order , show_booking_header: true%>
+        <%= render 'spree_cm_commissioner/cancel_order_mailer/tenant/footer', order: @order, name: @name %>
+      </div>
+    <% end %>
+  </td>
+</tr>

data/app/views/spree_cm_commissioner/cancel_order_mailer/_cancel_email.html.erb

@@ -0,0 +1,12 @@
+<div class="cancel-greeting">
+  <h1>
+    <%= I18n.t('mail.order_mailer.hello', full_name: user_full_name(order))%>
+  </h1>
+  <p class="description">
+    <%= I18n.t('mail.order_mailer.cancel_description') %>
+  </p>
+  <b>
+    <%= I18n.t('mail.order_mailer.order_cancelled', order_number: order.number || 'NA') %>
+  </b>
+  <div style="border-bottom: 1px solid #E5E7EB; margin-top: 1.5rem;">
+</div>

data/app/views/spree_cm_commissioner/cancel_order_mailer/_footer.html.erb

@@ -0,0 +1,8 @@
+<div class="footer">
+  <p>
+    <%= I18n.t('mail.order_mailer.cancel_thank') %>
+  </p>
+  <p class="team">
+    <%= I18n.t('mail.order_mailer.from_team', store: order.store&.name) %>
+  </p>
+</div>  

data/app/views/spree_cm_commissioner/cancel_order_mailer/_header.html.erb

@@ -0,0 +1,3 @@
+<div class="header">
+    <%= image_tag "mailer/bookme-plus.png", class: "icon-bookme-plus"%>
+</div>

data/app/views/spree_cm_commissioner/cancel_order_mailer/_mailer_stylesheets.html.erb

@@ -0,0 +1,139 @@
+<style>
+  body, table, td {
+      font-family: 'Poppins', Arial, sans-serif;
+      margin: 0;
+      padding: 0;
+    }
+
+  .content-wrapper {
+    max-width: 500px;
+    margin: 0 auto;
+    border: 1px solid grey;
+    border-top: none;
+  }  
+
+  .content-wrapper .header{
+    display: flex;
+    justify-content: flex-start;
+    color: #fff;
+    padding: 1.5rem;
+    background-size: cover;
+    background-position: center;
+    background-repeat: no-repeat;
+    background: #653ed7;
+    background: url(<%= image_path("mailer/event-mailer-bg.png") %>) center center / cover,
+        linear-gradient(45deg, #653ed7, rgba(0, 0, 255, 0) 70.71%),
+        linear-gradient(225deg, #653ed7, rgba(0, 0, 255, 0) 70.71%),
+        linear-gradient(330deg, #35ace0, rgba(0, 0, 255, 0) 70.71%),
+        linear-gradient(150deg, #35ace0, rgba(0, 0, 255, 0) 70.71%);
+  }
+  
+  .content-wrapper .header .icon-bookme-plus{
+  }  
+
+  .content-wrapper .header-tenant{
+    color: #fff;
+    padding: 1rem;
+    background-size: cover;
+    background-position: center;
+    background-repeat: no-repeat;
+    <% if @brand_color.present? %>
+      background: <%= @brand_color %>;
+    <% end %>
+  }
+
+  .content-wrapper .header-tenant .tenant-name{
+    font-weight: bold;
+    font-size: 2rem;
+    color:#fff;
+  }
+
+  .content-wrapper .header-tenant .logo-tenant img{
+    width: 4rem;
+    height: 4rem; 
+    border-radius: 50%;
+    display: block;
+  }
+
+  .content-wrapper .cancel-greeting{
+    text-align: left;
+    padding: 1.5rem;
+  }
+
+  .content-wrapper .cancel-greeting h1{
+    font-size: 1.5rem;
+    font-weight: bold;
+    margin: 0;
+    padding: 0;
+  }
+
+  .content-wrapper .cancel-greeting .description{
+    font-size: 1rem;
+    color: gray;
+  }
+
+  .content-wrapper .cancel-greeting b{
+    font-size: 0.9rem;
+  }
+
+  .content-wrapper .purchase {
+    width: 100%;
+    border-collapse: collapse;
+  }
+
+  .content-wrapper .purchase_image {
+    width: 20%;
+  }
+  .content-wrapper .purchase_item {
+    padding: 0 0.625rem;
+    width: 60%;
+  }
+  .content-wrapper .purchase-item-option-text {
+    font-size: 0.8rem;
+    background-color: #F2F2F2;
+    color: #646161;
+    white-space: normal;
+    overflow: hidden;
+    display: inline-block;
+    max-width: 100%;
+    width: auto;
+    padding: 0.375rem 0.875rem;
+    margin: 0.625rem 0;
+    border-radius: 6.25rem;
+    word-wrap: break-word;
+    word-break: break-word;
+  }
+  .content-wrapper .purchase_item_price {
+    margin-bottom: 0.5rem;  }
+  .content-wrapper .purchase-summary-item {
+    margin-top: 0.625rem;
+  }
+  .purchase_total {
+    font-weight: normal;
+    text-align: right;
+    padding-top: 1rem;
+    margin: 0;
+  }
+  .content-wrapper .purchase-summary_sub_total {
+    margin-bottom: 0.875rem;
+  }
+  .content-wrapper .purchase_footer {
+    border-top: none;
+  }
+  .content-wrapper .purchase_total--label {
+    text-align: left;
+  }
+  .content-wrapper .purchase_total-col {
+    text-align: right;
+    align: right;
+  }
+  .content-wrapper .footer{
+    text-align: center;
+    color: gray;
+    font-size: 1rem;
+  }
+  .content-wrapper .footer .team{
+    margin: 0;
+    padding: 0;
+  }
+</style>    

data/app/views/spree_cm_commissioner/cancel_order_mailer/_your_booking.html.erb

@@ -0,0 +1,8 @@
+<table width="100%" cellpadding="0" cellspacing="0">
+  <tr>
+    <td>
+      <%= render 'spree_cm_commissioner/cancel_order_mailer/purchased_items/items', line_items: order.line_items %>
+      <%= render 'spree_cm_commissioner/cancel_order_mailer/purchased_items/summary', order: order%>
+    </td>
+  </tr>
+</table>

data/app/views/spree_cm_commissioner/cancel_order_mailer/purchased_items/_items.html.erb

@@ -0,0 +1,53 @@
+<table class="purchase order-info">
+  <% line_items.each do |line_item| %>
+    <tr>
+      <td class="purchase_image align-center-vertical">
+        <% if line_item.variant.present? && variant_image_url(line_item.variant).present? %>
+          <%= link_to(
+                image_tag(
+                  variant_image_url(line_item.variant),
+                  style: "border-radius: 10px; width: 100%;"),
+                custom_product_storefront_resource_url(line_item.product) || '#'
+              ) %>
+        <% end %>
+      </td>
+      <td class="purchase_item">
+        <% if line_item.name.present? %>
+          <p><%= link_to(
+                  raw(line_item.name),
+                  custom_product_storefront_resource_url(line_item.product) || '#'
+          ) %></p>
+        <% end %>
+        <% if line_item.variant.options_text.present? %>
+          <div class="purchase-item-option-text">
+            <%= sanitize(line_item.variant.options_text) %>
+          </div>
+        <% end %>
+        <div> <%= link_to 'View Details', custom_product_line_item_url(line_item) %></div>
+      </td>
+      <td class="align-right align-center-vertical" width="10%">
+        <span>
+          <%= line_item.quantity %>x
+        </span>
+      </td>
+      <td class="align-right align-center-vertical" width="20%">
+        <div class="f-fallback purchase_item_price">
+          <%= line_item.single_money %><br>
+        </div>
+        <div class="f-fallback purchase_item_price">
+          <%= line_item.display_amount %>
+        </div>
+      </td>
+    </tr>
+    <tr>
+      <td colspan="4">
+        <hr style="
+          border: none;
+          border-top: 1px solid #E5E7EB;
+          margin: 1.5rem 0 0 0;
+          height: 0;
+        ">
+      </td>
+    </tr>
+  <%end%>
+</table>