spree_cm_commissioner 2.8.0 → 2.8.1.pre.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a112e266f3450b307b12ea0ac4a28a4d5ee9a3eff8e2650d6de5c93c1b73df3
-  data.tar.gz: 3285f85273a6c1d19e2eb4b23f087eccca371af1f6cd48282c22042b97d4d8d8
+  metadata.gz: 8250d9a96dcceb058991c416ad4b91380fa42f5d43e301c366e74bfe9eb0e27b
+  data.tar.gz: a8c9301047c15f6ef760bdda1cc9087ac4f7a3539cd6aa86b43a99ab97fc6f16
 SHA512:
-  metadata.gz: 81c02501bd52647acbc65cc34e6ebcfa309b349a1215a0eadde56101b8d508877cb96e08c044612863ea458be0e70ff018311dc5be59806bc67f97a7cff99061
-  data.tar.gz: feb4e3ef254c32769245dd1053ab3ec987f73250db800bd36373bf40e5d9e9ea981586b92a57fbe8bbcfc22ab09bf5cf7343b1a9b8d35bf672e1057510be11ad
+  metadata.gz: 87bba18fe41a801abf62fc7a83c444452f5b3780b23edaa44bbf86b98271b06877bc8c52bddfc5761b5fdee5953226201c52556cfba30405c1e1f95af2067861
+  data.tar.gz: 2a7fd81827d6be81291146d17f46ff54a61a59aa4194a552f89ccc59463dc93a4ccc742c0534fd5c18354136314b2e9db571e97b6e8822fff3bbc6c116f3114d

data/.gitignore

@@ -34,3 +34,7 @@ vendor/bundle/
 # Cursor
 .cursor
 dump.rdb
+# Added by code-review-graph
+.code-review-graph/
+.cursorrules
+.claude

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.0)
+    spree_cm_commissioner (2.8.1.pre.3)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/spree/admin/featured_trips_controller.rb

@@ -0,0 +1,135 @@
+# rubocop:disable Rails/I18nLocaleTexts
+module Spree
+  module Admin
+    class FeaturedTripsController < BaseController
+      before_action :require_taxon_manager
+
+      def index
+        @status = filter_status
+        @query = params[:q].to_s.strip
+        @vendor_id = params[:vendor_id].presence
+        @origin_place_id = params[:origin_place_id].presence
+        @destination_place_id = params[:destination_place_id].presence
+        @vendors = Spree::Vendor.order(:name)
+        @places = SpreeCmCommissioner::Place.order(:name)
+        @active_count = SpreeCmCommissioner::Trip.currently_featured.count
+        @expired_count = SpreeCmCommissioner::Trip.where.not(featured_until: nil).where('featured_until < ?', Time.current).count
+        @featured_trips = filtered_featured_trips
+        @available_trips = available_trips
+      end
+
+      def create
+        trip = SpreeCmCommissioner::Trip.find(params[:trip_id])
+        featured_until = parse_featured_until(params[:featured_until])
+
+        if featured_until.present? && featured_until > Time.current && trip.update(featured_until: featured_until)
+          flash[:success] = 'Trip was added to featured trips.'
+        else
+          flash[:error] = 'Featured until must be a future date and time.'
+        end
+
+        redirect_to spree.admin_featured_trips_path
+      end
+
+      def update
+        trip = SpreeCmCommissioner::Trip.find(params[:id])
+
+        if ActiveModel::Type::Boolean.new.cast(params[:remove])
+          trip.update(featured_until: nil)
+          flash[:success] = 'Trip was removed from featured trips.'
+        else
+          update_featured_until(trip)
+        end
+
+        redirect_to spree.admin_featured_trips_path(
+          status: params[:status],
+          vendor_id: params[:vendor_id],
+          origin_place_id: params[:origin_place_id],
+          destination_place_id: params[:destination_place_id],
+          q: params[:q]
+        )
+      end
+
+      private
+
+      def require_taxon_manager
+        return if can?(:manage, Spree::Taxon)
+
+        flash[:error] = 'You are not authorized to access this page.'
+        redirect_to spree.admin_promotions_path
+      end
+
+      def update_featured_until(trip)
+        featured_until = parse_featured_until(params[:featured_until])
+
+        if featured_until.present? && featured_until > Time.current && trip.update(featured_until: featured_until)
+          flash[:success] = 'Featured trip was updated.'
+        else
+          flash[:error] = 'Featured until must be a future date and time.'
+        end
+      end
+
+      def filtered_featured_trips
+        scope = SpreeCmCommissioner::Trip.includes(:vendor, :product, :origin_place, :destination_place, :vehicle_type)
+                                         .where.not(featured_until: nil)
+        scope = apply_status_filter(scope)
+        scope = apply_place_filter(scope)
+        scope = apply_vendor_filter(scope)
+        scope = apply_text_filter(scope)
+        scope.order(featured_until: :asc, departure_time: :asc).page(params[:page]).per(50)
+      end
+
+      def available_trips
+        scope = SpreeCmCommissioner::Trip.includes(:vendor, :product, :origin_place, :destination_place, :vehicle_type)
+                                         .not_currently_featured
+        scope = apply_place_filter(scope)
+        scope = apply_vendor_filter(scope)
+        scope = apply_text_filter(scope)
+        scope.order(departure_time: :desc).limit(200)
+      end
+
+      def apply_status_filter(scope)
+        case @status
+        when 'expired'
+          scope.where('cm_trips.featured_until < ?', Time.current)
+        when 'all'
+          scope
+        else
+          scope.currently_featured
+        end
+      end
+
+      def apply_vendor_filter(scope)
+        return scope if @vendor_id.blank?
+
+        scope.where(vendor_id: @vendor_id)
+      end
+
+      def apply_place_filter(scope)
+        scope = scope.where(origin_place_id: @origin_place_id) if @origin_place_id.present?
+        scope = scope.where(destination_place_id: @destination_place_id) if @destination_place_id.present?
+        scope
+      end
+
+      def apply_text_filter(scope)
+        return scope if @query.blank?
+
+        scope.left_joins(:product, :vendor)
+             .where('spree_products.name ILIKE :query OR spree_vendors.name ILIKE :query', query: "%#{@query}%")
+      end
+
+      def filter_status
+        %w[active expired all].include?(params[:status]) ? params[:status] : 'active'
+      end
+
+      def parse_featured_until(value)
+        return if value.blank?
+
+        Time.zone.parse(value.to_s)
+      rescue ArgumentError, TypeError
+        nil
+      end
+    end
+  end
+end
+# rubocop:enable Rails/I18nLocaleTexts

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -51,7 +51,10 @@ module Spree
       def permitted_resource_params
         segment_value = helpers.calculate_segment_value(params[:spree_cm_commissioner_homepage_section])
 
-        params.require(:spree_cm_commissioner_homepage_section).permit(:title, :description, :active, :tenant_id).merge(segment: segment_value)
+        params
+          .require(:spree_cm_commissioner_homepage_section)
+          .permit(:title, :description, :active, :tenant_id, :preview)
+          .merge(segment: segment_value)
       end
 
       def load_tenants

data/app/controllers/spree/admin/oauth_applications_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Admin
+    class OauthApplicationsController < Spree::Admin::ResourceController
+      # Override default scopes behavior - only auto-assign 'admin' scope for new applications
+      # Edit forms allow users to modify scopes without forced default
+      before_action :set_default_scopes, only: [:new]
+
+      private
+
+      def create_turbo_stream_enabled?
+        true
+      end
+
+      def set_default_scopes
+        @object.scopes = 'admin' if @object.scopes.blank?
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/taxons_controller_decorator.rb

@@ -3,6 +3,7 @@ module Spree
     module TaxonsControllerDecorator
       def self.prepended(base)
         base.before_action :build_assets, only: %i[create update]
+        base.before_action :normalize_sti_taxon_params, only: %i[create update]
       end
 
       # override
@@ -50,6 +51,24 @@ module Spree
         @taxon.build_home_banner(attachment: permitted_resource_params.delete(:home_banner)) if permitted_resource_params[:home_banner]
         @taxon.build_video_banner(attachment: permitted_resource_params.delete(:video_banner)) if permitted_resource_params[:video_banner]
       end
+
+      # Some admin forms submit STI records under their class key
+      # (e.g. :spree_cm_commissioner_show) while Spree update reads :taxon.
+      # Merge both into :taxon so all edited fields are persisted.
+      def normalize_sti_taxon_params
+        return unless @taxon
+
+        sti_key = @taxon.class.model_name.param_key.to_sym
+        sti_params = params[sti_key]
+        return unless sti_params.is_a?(::ActionController::Parameters)
+
+        base_params = params[:taxon]
+        base_hash = base_params.is_a?(::ActionController::Parameters) ? base_params.to_unsafe_h : {}
+        sti_hash = sti_params.to_unsafe_h
+        merged_params = ::ActionController::Parameters.new(base_hash.merge(sti_hash))
+
+        params[:taxon] = merged_params
+      end
     end
   end
 end

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -19,6 +19,7 @@ module Spree
             @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
                                        .active
                                        .where(tenant_id: nil)
+                                       .where(preview: false)
                                        .order(position: :asc)
           end
         end

data/app/controllers/spree/api/v2/storefront/preview_products_controller.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewProductsController < ::Spree::Api::V2::Storefront::ProductsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super(**args).rewhere(preview: true).where(status: :active)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_sections_controller.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
+                                       .active
+                                       .where(tenant_id: nil)
+                                       .where(preview: true)
+                                       .where(id: section_ids)
+                                       .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_taxons_controller.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewTaxonsController < ::Spree::Api::V2::Storefront::TaxonsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            super(**args).rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/products_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module ProductsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::ProductsController.prepend(Spree::Api::V2::Storefront::ProductsControllerDecorator)

data/app/controllers/spree/api/v2/storefront/taxons_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module TaxonsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::TaxonsController.prepend(Spree::Api::V2::Storefront::TaxonsControllerDecorator)

data/app/controllers/spree/api/v2/storefront/transit/item_availabilities_controller.rb

@@ -0,0 +1,66 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module Transit
+          class ItemAvailabilitiesController < ::Spree::Api::V2::ResourceController
+            include SpreeCmCommissioner::Integrations::InventorySyncCachable
+
+            def create
+              sync_result = sync_item_availability!
+
+              unless sync_result.success?
+                error_message = sync_result.to_h.dig(:error, :message) || 'Sync failed'
+                return render_error_payload(error_message, 422)
+              end
+
+              item_availability = SpreeCmCommissioner::ItemAvailabilitySync.new(
+                id: trip.id,
+                last_sync_at: sync_result.last_synced_at
+              )
+              render_serialized_payload { serialize_resource(item_availability) }
+            rescue ActiveRecord::RecordNotFound => e
+              render_error_payload(e.message, 404)
+            end
+
+            private
+
+            def trip
+              @trip ||= SpreeCmCommissioner::Trip.find(params[:trip_id])
+            end
+
+            def integration
+              @integration ||= trip.vendor&.integration
+            end
+
+            def sync_item_availability!
+              # Return success result if vendor has no integration
+              return SpreeCmCommissioner::Integrations::Base::SyncResult.new if integration.nil?
+
+              # Check cache first for successful results only
+              cached_result = Rails.cache.read(sync_cache_key)
+              return cached_result if cached_result
+
+              # Perform sync
+              result = integration.sync_item_availability!(trip_id: trip.id, on_date: params[:on_date])
+
+              # Only cache successful results to avoid sticky failures
+              Rails.cache.write(sync_cache_key, result, expires_in: sync_cache_ttl) if result.success?
+
+              result
+            end
+
+            def sync_cache_key
+              # Include trip.updated_at to auto-bust cache when trip is updated by background syncs
+              "item_availability_syncs:#{trip.id}:#{params[:on_date]}:#{trip.updated_at.to_i}"
+            end
+
+            def resource_serializer
+              SpreeCmCommissioner::V2::Storefront::ItemAvailabilitySyncSerializer
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/trip_search_controller.rb

@@ -39,6 +39,7 @@ module Spree
               params[:date],
               params[:route_type],
               params[:vendor_id],
+              params[:featured],
               params[:number_of_guests],
               resource_includes&.sort&.join(','),
               sparse_fields&.sort&.join(','),

data/app/controllers/spree/api/v2/tenant/base_controller.rb

@@ -16,6 +16,10 @@ module Spree
             set_current_tenant(@tenant)
           end
 
+          def current_vendor
+            @current_vendor ||= @tenant.active_vendor
+          end
+
           def render_serialized_payload(status = 200)
             render json: yield, status: status, content_type: content_type
           end

data/app/controllers/spree/api/v2/tenant/free_vote_claims_controller.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class FreeVoteClaimsController < BaseController
+          before_action :require_spree_current_user
+
+          def create
+            show = current_vendor.shows.find(params[:show_id])
+
+            result = SpreeCmCommissioner::VotingCredits::ClaimFreeVotes.new(
+              show: show,
+              user: spree_current_user,
+              tenant_id: MultiTenant.current_tenant_id,
+              votable_type: params[:votable_type],
+              votable_id: params[:votable_id]
+            ).call
+
+            if result.failure?
+              render_error_payload(result.error.to_s)
+            elsif result.value.nil?
+              head :no_content
+            else
+              render_serialized_payload { serialize_resource(result.value) }
+            end
+          end
+
+          private
+
+          def resource_serializer
+            Spree::V2::Tenant::VotingCreditSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/homepage_sections_controller.rb

@@ -5,6 +5,7 @@ module Spree
         class HomepageSectionsController < BaseController
           def collection
             @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .where(preview: false)
                                  .active
                                  .order(position: :asc)
           end

data/app/controllers/spree/api/v2/tenant/preview_products_controller.rb

@@ -0,0 +1,47 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewProductsController < ProductsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super.where(status: :active, preview: true)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_sections_controller.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .active
+                                 .where(preview: true)
+                                 .where(id: section_ids)
+                                 .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_shows_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewShowsController < ShowsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            allowed_ids = spree_current_user.preview_roles
+                                            .where(previewable_type: SpreeCmCommissioner::Show.polymorphic_name)
+                                            .select(:previewable_id)
+            super.rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_taxons_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewTaxonsController < TaxonsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            MultiTenant.with(@tenant) do
+              model_class.where(preview: true, id: allowed_ids)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/products_controller.rb

@@ -21,7 +21,7 @@ module Spree
 
           def scope
             MultiTenant.with(@tenant) do
-              model_class.where(tenant_id: MultiTenant.current_tenant_id)
+              model_class.where(tenant_id: MultiTenant.current_tenant_id, preview: false)
             end
           end