spree_cm_commissioner 2.8.15.pre.pre1 → 2.8.15.pre.pre3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 400b9f97bf94e87bc297ba238423a80ef7f5b94774a39170c48e809350f24bb3
-  data.tar.gz: dade198707fa92ad3c258205d7616187007e865890906419fcbfaaa36b168dbe
+  metadata.gz: 3ac1f1c30c374b8f4ad3dd06b486bbe1e25cbfa1f1c26bbd7a3d53895aaefaa2
+  data.tar.gz: affc12ef47495c5c51530c1fae89c771380b3759825932ea263ec5474abbb289
 SHA512:
-  metadata.gz: bf0faa81d8026d4283c6292d40c3c0c60be8d5d5e1e755c9eb03c950fd94de02f262e3946473a45a2b8500355e37781b175c7d425ce5c292d5c59e1fbc316533
-  data.tar.gz: dfd7f46061291a7ddce0780aacb82d9e9129c52ec1b01244b6a48cb1a008a1ee339b5c878656dc4e4091d0492c89de627758cd42ff8c8706059d135a1bb604fc
+  metadata.gz: f14fbec2aadcfdf2ecb3e463fe26321d581f40ade6010ace88f1e2eb4dc9f8c3f80d329f8d3a8664133dd223376f17feca17a7413c3f9d515bc1c1f8eaa884d4
+  data.tar.gz: 53239fc959124a3cc3d6fe74804bbee08b576161b3914f45dab14b1e9be03c84000cfe716ce012c1c86f7903a3aa72d5127bc2979ff5f3a5a67c8a8a1a643407

data/.env.example

@@ -20,13 +20,6 @@ WAITING_ROOM_SESSION_SIGNATURE="e6b2********************26e3"
 WAITING_ROOM_SESSION_EXPIRE_DURATION_IN_SECOND=
 WAITING_ROOM_MIN_SESSIONS_COUNT=5
 WAITING_ROOM_DISABLED=no
-WAITING_ROOM_POSITION_STAMP_LIMIT=1000
-WAITING_ROOM_FIRESTORE_BATCH_SIZE=500
-WAITING_ROOM_MIN_WAIT_TO_ENTER_SECONDS=600 # Waiting Room step floor (10 min)
-WAITING_ROOM_MIN_QUEUE_TO_ENTER_SECONDS=300 # Queue step floor (5 min)
-WAITING_ROOM_MAX_WAIT_TO_DISPLAY_SECONDS=3600 # above this the ETA is hidden (1 h)
-WAITING_ROOM_CALLER_INTERVAL_SECONDS=60 # how often the caller runs; match the waiting_guests_caller cron
-WAITING_ROOM_MAX_ETA_BATCH_SIZE=50 # cap on batch size assumed when estimating the ETA
 
 # Vattanac Bank
 VATTANAC_AES_SECRET_KEY= ""
@@ -70,9 +63,3 @@ PAYMENT_LOCK_MIN_DURATION_IN_MINUTES=5      # Minimum remaining hold time requir
 MAX_ACTIVE_HOLDS_PER_USER=3                 # Max concurrent active holds allowed per user across all orders
 MAX_HOLDS_PER_IP_PER_HOUR=5                 # Max hold attempts per IP address within a rolling 1-hour window (abuse prevention)
 HOLD_COOLDOWN_AFTER_EXPIRY_IN_MINUTES=2     # Cooldown period before a user can re-acquire a hold after one expired on them
-
-# See: app/models/spree_cm_commissioner/payment_decorator.rb
-PAYMENT_INCOMPLETE_NOTIFICATION_DELAY_IN_MINUTES=5  # Delay before notifying a customer that their order is still unpaid after payment is created
-
-# See: app/jobs/spree_cm_commissioner/telegram_alerts/order_integrity_check_job.rb
-ORDER_INTEGRITY_TELEGRAM_ALERT_ENABLED="no"  # Set to yes to enable the order integrity Telegram alert job (off by default to avoid flooding Telegram rate limits during traffic spikes)

data/.github/workflows/test_and_build_gem.yml

@@ -163,9 +163,8 @@ jobs:
       - name: Security
         env:
           DATABASE_URL: postgres://myuser:mypassword@localhost:5432/test_db
-
-        # Using --no-threads to bypass a known Ruby 3.2.0 GC segmentation fault in CI.
         run: |
+          # Using --no-threads to bypass a known Ruby 3.2.0 GC segmentation fault in CI.
           bundle exec brakeman --no-threads --no-exit-on-warn
 
   test:

data/.gitignore

@@ -34,3 +34,9 @@ vendor/bundle/
 # Cursor
 .cursor
 dump.rdb
+# Added by code-review-graph
+.code-review-graph/
+.cursorrules
+.claude
+CLAUDE.md
+AGENTS.md

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.15.pre.pre1)
+    spree_cm_commissioner (2.8.15.pre.pre3)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -16,6 +16,7 @@ module SpreeCmCommissioner
       GuestCardClassesController
       SeatLayoutController
       CmsPagesController
+      AdvertisementsController
     ].freeze
 
     # Priority 2: Semi-Static (1 hour)
@@ -25,6 +26,7 @@ module SpreeCmCommissioner
       HomepageDataController
       PopularRoutesController
       RoutePlacesController
+      ShowsController
     ].freeze
 
     # Priority 3: Moderate Freshness (30 minutes)

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -51,7 +51,10 @@ module Spree
       def permitted_resource_params
         segment_value = helpers.calculate_segment_value(params[:spree_cm_commissioner_homepage_section])
 
-        params.require(:spree_cm_commissioner_homepage_section).permit(:title, :description, :active, :tenant_id).merge(segment: segment_value)
+        params
+          .require(:spree_cm_commissioner_homepage_section)
+          .permit(:title, :description, :active, :tenant_id, :preview)
+          .merge(segment: segment_value)
       end
 
       def load_tenants

data/app/controllers/spree/admin/import_new_orders_controller.rb

@@ -23,31 +23,6 @@ module Spree
           end
         end
       end
-
-      # POST: /admin/orders/import_new_orders/:id/cancel
-      def cancel
-        import = model_class.find(params[:id])
-        show_url = spree.admin_import_new_order_url(import.id)
-
-        unless import.cancellable?
-          flash[:error] = 'These orders cannot be canceled.' # rubocop:disable Rails/I18nLocaleTexts
-          redirect_to show_url and return
-        end
-
-        if params[:confirm_name].to_s.strip != import.name.to_s.strip
-          flash[:error] = 'Import name did not match. Cancellation aborted.' # rubocop:disable Rails/I18nLocaleTexts
-          redirect_to show_url and return
-        end
-
-        SpreeCmCommissioner::CancelImportOrderJob.perform_later(
-          import_order_id: import.id,
-          canceled_by_user_id: spree_current_user.id,
-          cancellation_reason: params[:cancellation_reason].to_s.strip.presence
-        )
-
-        flash[:success] = "Canceling orders from \"#{import.name}\". This runs in the background."
-        redirect_to show_url
-      end
     end
   end
 end

data/app/controllers/spree/admin/inventory_holds_controller.rb

@@ -9,7 +9,6 @@ module Spree
         q['s'] ||= 'created_at desc'
         q['created_at_gt'] = parse_time_or_nil(q['created_at_gt'], :beginning_of_day) if q['created_at_gt'].present?
         q['created_at_lt'] = parse_time_or_nil(q['created_at_lt'], :end_of_day) if q['created_at_lt'].present?
-        normalize_enum_filters!(q)
 
         @search = scope.ransack(q)
         result_scope = @search.result(distinct: true)
@@ -19,11 +18,7 @@ module Spree
                  .page(params[:page])
                  .per(params[:per_page] || Spree::Backend::Config[:admin_orders_per_page])
 
-        # Status tab counts must reflect every other filter but NOT the status filter, so
-        # each tab shows how many holds it would return (otherwise selecting one status
-        # zeroes out all the other tabs).
-        @status_counts = scope.ransack(q.except('status_eq')).result(distinct: true)
-                              .reorder(nil).group(:status).count
+        @status_counts = result_scope.reorder(nil).group(:status).count
       end
 
       def release
@@ -49,23 +44,8 @@ module Spree
 
       private
 
-      # `status` and `release_reason` are integer-backed enums. Ransack casts a string
-      # value for an integer column with String#to_i, so "payment_locked" becomes 0
-      # (== :pending) and every label silently filters to the wrong status. Translate
-      # enum labels to their stored integer before searching.
-      def normalize_enum_filters!(query)
-        {
-          'status_eq' => SpreeCmCommissioner::InventoryHold.statuses,
-          'release_reason_eq' => SpreeCmCommissioner::InventoryHold.release_reasons
-        }.each do |key, mapping|
-          value = query[key]
-          query[key] = mapping[value.to_s] if value.present? && mapping.key?(value.to_s)
-        end
-      end
-
       def back_params
         raw_params = params[:back_params].presence || params
-        raw_params = raw_params.to_unsafe_h if raw_params.respond_to?(:to_unsafe_h)
         ActionController::Parameters.new(raw_params).permit(:page, :per_page, q: {})
       end
 

data/app/controllers/spree/admin/system/waiting_room_controller.rb

@@ -4,10 +4,7 @@ module Spree
       class WaitingRoomController < Spree::Admin::BaseController
         def show
           @fetcher = SpreeCmCommissioner::WaitingRoomSystemMetadataFetcher.new
-          @lobby_fetcher = SpreeCmCommissioner::WaitingRoomLobbyMetadataFetcher.new
-
           @fetcher.load_document_data
-          @lobby_fetcher.load_document_data
 
           @active_sesions_count = SpreeCmCommissioner::WaitingRoomSession.active.count
         end
@@ -32,18 +29,6 @@ module Spree
 
           redirect_back fallback_location: admin_system_waiting_room_path
         end
-
-        def publish_lobby_path
-          result = SpreeCmCommissioner::WaitingRoom::PublishLobbyPath.call
-
-          if result.success?
-            flash[:success] = "Published waiting guests records path: #{result.value[:records_path]}"
-          else
-            flash[:error] = result.error.to_s
-          end
-
-          redirect_back fallback_location: admin_system_waiting_room_path
-        end
       end
     end
   end

data/app/controllers/spree/admin/taxons_controller_decorator.rb

@@ -3,6 +3,7 @@ module Spree
     module TaxonsControllerDecorator
       def self.prepended(base)
         base.before_action :build_assets, only: %i[create update]
+        base.before_action :normalize_sti_taxon_params, only: %i[create update]
       end
 
       # override
@@ -27,10 +28,6 @@ module Spree
         remove_asset(@taxon.home_banner)
       end
 
-      def remove_ad_banner
-        remove_asset(@taxon.ad_banner)
-      end
-
       def remove_video_banner
         remove_asset(@taxon.video_banner)
       end
@@ -52,9 +49,26 @@ module Spree
         @taxon.build_app_banner(attachment: permitted_resource_params.delete(:app_banner)) if permitted_resource_params[:app_banner]
         @taxon.build_web_banner(attachment: permitted_resource_params.delete(:web_banner)) if permitted_resource_params[:web_banner]
         @taxon.build_home_banner(attachment: permitted_resource_params.delete(:home_banner)) if permitted_resource_params[:home_banner]
-        @taxon.build_ad_banner(attachment: permitted_resource_params.delete(:ad_banner)) if permitted_resource_params[:ad_banner]
         @taxon.build_video_banner(attachment: permitted_resource_params.delete(:video_banner)) if permitted_resource_params[:video_banner]
       end
+
+      # Some admin forms submit STI records under their class key
+      # (e.g. :spree_cm_commissioner_show) while Spree update reads :taxon.
+      # Merge both into :taxon so all edited fields are persisted.
+      def normalize_sti_taxon_params
+        return unless @taxon
+
+        sti_key = @taxon.class.model_name.param_key.to_sym
+        sti_params = params[sti_key]
+        return unless sti_params.is_a?(::ActionController::Parameters)
+
+        base_params = params[:taxon]
+        base_hash = base_params.is_a?(::ActionController::Parameters) ? base_params.to_unsafe_h : {}
+        sti_hash = sti_params.to_unsafe_h
+        merged_params = ::ActionController::Parameters.new(base_hash.merge(sti_hash))
+
+        params[:taxon] = merged_params
+      end
     end
   end
 end

data/app/controllers/spree/api/v2/storefront/account/orders_controller_decorator.rb

@@ -44,11 +44,6 @@ module Spree
             def collection_finder
               SpreeCmCommissioner::Orders::FindByState
             end
-
-            # this allows fetching a single order regardless of its state.
-            def resource_finder
-              SpreeCmCommissioner::Orders::FindByAllState
-            end
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/guests_controller.rb

@@ -31,15 +31,13 @@ module Spree
           def create
             spree_authorize! :update, spree_current_order, order_token
 
-            result = SpreeCmCommissioner::Cart::CreateGuest.call(
-              line_item: parent,
-              options: guest_params
-            )
+            resource = scope.new(guest_params)
 
-            if result.success?
-              render_serialized_payload(201) { serialize_resource(result.value) }
+            if resource.save
+              resource.save_and_move_to_next_stage
+              render_serialized_payload(201) { serialize_resource(resource) }
             else
-              render_error_payload(result.value.errors, 422)
+              render_error_payload(resource.errors, 422)
             end
           end
 

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -19,6 +19,7 @@ module Spree
             @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
                                        .active
                                        .where(tenant_id: nil)
+                                       .where(preview: false)
                                        .order(position: :asc)
           end
         end

data/app/controllers/spree/api/v2/storefront/order_histories_controller.rb

@@ -30,25 +30,13 @@ module Spree
           private
 
           def collection
-            # WARNING: Do NOT remove .order(id: :desc).
-            # Mobile relies on this ordering for paginated order_histories.
-            # Removing it will cause mobile to paginate by oldest records first (last 10 oldest),
-            # breaking the "most recent orders" display on the order history screen.
-            # It related to user cancel or complete order flow, which relies on the most recent orders being returned first.
             if spree_current_user.present?
-              spree_current_user.orders
-                                .not_archived
-                                .incomplete
-                                .order(id: :desc)
+              spree_current_user.orders.payment.not_archived
             else
               order_tokens = Array(params[:order_tokens])
               return Spree::Order.none if order_tokens.empty?
 
-              Spree::Order.not_archived
-                          .incomplete
-                          .without_user
-                          .where(token: order_tokens)
-                          .order(id: :desc)
+              Spree::Order.payment.not_archived.without_user.where(token: order_tokens)
             end
           end
 

data/app/controllers/spree/api/v2/storefront/preview_products_controller.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewProductsController < ::Spree::Api::V2::Storefront::ProductsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super(**args).rewhere(preview: true).where(status: :active)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_sections_controller.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
+                                       .active
+                                       .where(tenant_id: nil)
+                                       .where(preview: true)
+                                       .where(id: section_ids)
+                                       .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_taxons_controller.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewTaxonsController < ::Spree::Api::V2::Storefront::TaxonsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            super(**args).rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/products_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module ProductsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::ProductsController.prepend(Spree::Api::V2::Storefront::ProductsControllerDecorator)

data/app/controllers/spree/api/v2/storefront/taxons_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module TaxonsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::TaxonsController.prepend(Spree::Api::V2::Storefront::TaxonsControllerDecorator)

data/app/controllers/spree/api/v2/storefront/ticket_transfers_controller.rb

@@ -86,10 +86,9 @@ module Spree
           end
 
           def collection
-            SpreeCmCommissioner::TicketTransfer
-              .includes(:order, from_guest: [:event, { line_item: :product }])
-              .where(from_user_id: spree_current_user.id)
-              .order(id: :desc)
+            SpreeCmCommissioner::TicketTransfer.includes(:order,
+                                                         from_guest: [:event, { line_item: :product }]
+                                                        ).where(from_user_id: spree_current_user.id)
           end
 
           def resource_serializer

data/app/controllers/spree/api/v2/tenant/ad_campaigns_controller.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class AdCampaignsController < BaseController
+          private
+
+          def scope
+            Spree::Taxon.ad_campaigns
+                        .joins(:vendor)
+                        .includes(:advertisements)
+                        .where(spree_vendors: { tenant_id: @tenant.id })
+                        .where('spree_taxons.from_date <= ? OR spree_taxons.from_date IS NULL', Time.current)
+                        .where('spree_taxons.to_date >= ? OR spree_taxons.to_date IS NULL', Time.current)
+                        .order(created_at: :asc)
+          end
+
+          def collection_serializer
+            Spree::V2::Tenant::AdCampaignSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/base_controller.rb

@@ -16,6 +16,10 @@ module Spree
             set_current_tenant(@tenant)
           end
 
+          def current_vendor
+            @current_vendor ||= @tenant.active_vendor
+          end
+
           def render_serialized_payload(status = 200)
             render json: yield, status: status, content_type: content_type
           end

data/app/controllers/spree/api/v2/tenant/episodes_controller.rb

@@ -0,0 +1,38 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class EpisodesController < BaseController
+          private
+
+          def model_class
+            SpreeCmCommissioner::ShowEpisode
+          end
+
+          def resource
+            @resource ||= scope.find(params[:id])
+          end
+
+          def scope
+            current_season.episodes.where(product_type: :show_episode).includes(:voting_sessions, :vote_packages)
+          end
+
+          def current_season
+            @current_season ||= SpreeCmCommissioner::Show
+                                .where(vendor_id: @tenant.vendors.select(:id))
+                                .where.not(parent_id: nil)
+                                .find_by!(slug: params[:show_id])
+          end
+
+          def resource_serializer
+            Spree::V2::Tenant::ShowEpisodeSerializer
+          end
+
+          def collection_serializer
+            Spree::V2::Tenant::ShowEpisodeSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/homepage_sections_controller.rb

@@ -5,6 +5,7 @@ module Spree
         class HomepageSectionsController < BaseController
           def collection
             @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .where(preview: false)
                                  .active
                                  .order(position: :asc)
           end

data/app/controllers/spree/api/v2/tenant/order_histories_controller.rb

@@ -37,25 +37,13 @@ module Spree
           end
 
           def collection
-            # WARNING: Do NOT remove .order(id: :desc).
-            # Mobile relies on this ordering for paginated order_histories.
-            # Removing it will cause mobile to paginate by oldest records first (last 10 oldest),
-            # breaking the "most recent orders" display on the order history screen.
-            # It related to user cancel or complete order flow, which relies on the most recent orders being returned first.
             if spree_current_user.present?
-              spree_current_user.orders
-                                .not_archived
-                                .incomplete
-                                .order(id: :desc)
+              spree_current_user.orders.payment.not_archived
             else
               order_tokens = Array(params[:order_tokens])
               return Spree::Order.none if order_tokens.empty?
 
-              Spree::Order.not_archived
-                          .incomplete
-                          .without_user
-                          .where(token: order_tokens)
-                          .order(id: :desc)
+              Spree::Order.payment.not_archived.without_user.where(token: order_tokens)
             end
           end
 

data/app/controllers/spree/api/v2/tenant/preview_products_controller.rb

@@ -0,0 +1,47 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewProductsController < ProductsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super.where(status: :active, preview: true)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_sections_controller.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .active
+                                 .where(preview: true)
+                                 .where(id: section_ids)
+                                 .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end