spree_cm_commissioner 2.8.15 → 2.8.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca0138759a1da40541b5d076fb9709847d44d88885593f5b69921993cfd26591
-  data.tar.gz: 79408535d56a9d4b62cac5154a316f6652d6d8664c04a030f00588b39f7ddd24
+  metadata.gz: 793be478c9e769be1ddebd446fb98201ed4277176ca0cc64880a1fdeb71297b2
+  data.tar.gz: fe71e91c4f124dcb730cad8ff27dd87dddd92e0ffab66aaf292845e797b3fa01
 SHA512:
-  metadata.gz: 3e1a90b2f9115755fcd8cb777e0cd4d3c05b950a8a1b913ac526be4c5967d062533b5683bf48d3ca979e726347bb1945520b0701337872e7626d2fc3524d7952
-  data.tar.gz: 8b4813fe21cc8495e2a512ea1662e2105ba61994c1866794bd9da91ef5c805b1b49cc9d8ea5cdf53f35dd2fe6a96295491eea72853cfdaf899377264922e8a84
+  metadata.gz: c15e41fc7108a69dd080a6610af697f6b1a669a4b830de63dbb725242b3c0ca899fc00e47b1086b9eb1c3da2df0567d94f95cdab60e230994f9abfc031dc2cb8
+  data.tar.gz: 1f25bae14db105a7b0db5225fe2df2fd232e6d507940bac7876cd038ed2eb71fff35799d9809a39c208972e70d2c2c9ce90f51ca78c86b904cc7cfe6f3edd6a5

data/.env.example

@@ -32,10 +32,6 @@ WAITING_ROOM_MAX_ETA_BATCH_SIZE=50 # cap on batch size assumed when estimating t
 VATTANAC_AES_SECRET_KEY= ""
 VATTANAC_PUBLIC_KEY=""
 
-# Telegram OAuth (OpenID Connect) login client_id/client_secret are configured
-# per tenant (or on the default store for tenant-less logins) from the admin
-# under Telegram Authentication - see docs/authentication/telegram-login.md.
-
 # Organizer URL
 ORGANIZER_URL=http://127.0.0.1:4000/organizer
 

data/.gitignore

@@ -34,9 +34,3 @@ vendor/bundle/
 # Cursor
 .cursor
 dump.rdb
-# Added by code-review-graph
-.code-review-graph/
-.cursorrules
-.claude
-CLAUDE.md
-AGENTS.md

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.15)
+    spree_cm_commissioner (2.8.16)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront
@@ -886,7 +886,7 @@ GEM
       spree_backend (>= 4.3.0.rc1)
       spree_emails (>= 4.3.0.rc1)
       spree_extension
-    spree_vpago (2.3.4)
+    spree_vpago (2.0.5.pre.beta)
       faraday
       google-cloud-firestore
       spree_api (>= 4.5)

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -16,7 +16,6 @@ module SpreeCmCommissioner
       GuestCardClassesController
       SeatLayoutController
       CmsPagesController
-      AdvertisementsController
     ].freeze
 
     # Priority 2: Semi-Static (1 hour)
@@ -26,14 +25,6 @@ module SpreeCmCommissioner
       HomepageDataController
       PopularRoutesController
       RoutePlacesController
-      ShowsController
-      EpisodesController
-      ShowPeopleController
-      ShowPersonAssignmentsController
-      ShowContestantsController
-      VotePackagesController
-      ShowEliminationSessionsController
-      PaymentMethodsController
     ].freeze
 
     # Priority 3: Moderate Freshness (30 minutes)
@@ -53,7 +44,6 @@ module SpreeCmCommissioner
     HIGH_FRESHNESS_CONTROLLERS = %w[
       TripsController
       TripSearchController
-      VotingContestantsController
     ].freeze
 
     def shared_max_age

data/app/controllers/concerns/spree_cm_commissioner/order_concern.rb

@@ -12,7 +12,6 @@ module SpreeCmCommissioner
       end
 
       @spree_current_order.last_ip_address = request.remote_ip
-      @spree_current_order.device_id = device_id if device_id.present?
       @spree_current_order
     end
 
@@ -26,9 +25,5 @@ module SpreeCmCommissioner
         state: params[:state]
       )
     end
-
-    def device_id
-      params[:device_id].presence
-    end
   end
 end

data/app/controllers/concerns/spree_cm_commissioner/turnstile_protectable.rb

@@ -27,15 +27,13 @@ module SpreeCmCommissioner
       return unless result.failure?
 
       render json: {
-        errors: [
-          {
-            status: '403',
-            error_code: 'human_verification_failed',
-            title: I18n.t('turnstile.verification_failed'),
-            detail: result.message,
-            turnstile_error_code: result.respond_to?(:error_code) ? result.error_code : nil
-          }
-        ]
+        errors: [{
+          status: '403',
+          error_code: 'human_verification_failed',
+          title: I18n.t('turnstile.verification_failed'),
+          detail: result.message
+        }
+]
       }, status: :forbidden
     end
 

data/app/controllers/spree/admin/guests_controller.rb

@@ -80,10 +80,8 @@ module Spree
 
       def permitted_resource_params
         params.require(object_name).permit(:first_name, :last_name, :gender, :dob, :occupation_id,
-                                           :nationality_id, :age, :emergency_contact,
-                                           :line_item_id, :seat_number, :phone_number, :contact,
-                                           :other_organization, :expectation, :address,
-                                           :social_contact_platform, :social_contact
+                                           :nationality_id, :age, :emergency_contact, :line_item_id,
+                                           :seat_number, :phone_number
         )
       end
 

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -51,10 +51,7 @@ module Spree
       def permitted_resource_params
         segment_value = helpers.calculate_segment_value(params[:spree_cm_commissioner_homepage_section])
 
-        params
-          .require(:spree_cm_commissioner_homepage_section)
-          .permit(:title, :description, :active, :tenant_id, :preview)
-          .merge(segment: segment_value)
+        params.require(:spree_cm_commissioner_homepage_section).permit(:title, :description, :active, :tenant_id).merge(segment: segment_value)
       end
 
       def load_tenants

data/app/controllers/spree/admin/taxons_controller_decorator.rb

@@ -3,7 +3,6 @@ module Spree
     module TaxonsControllerDecorator
       def self.prepended(base)
         base.before_action :build_assets, only: %i[create update]
-        base.before_action :normalize_sti_taxon_params, only: %i[create update]
       end
 
       # override
@@ -56,24 +55,6 @@ module Spree
         @taxon.build_ad_banner(attachment: permitted_resource_params.delete(:ad_banner)) if permitted_resource_params[:ad_banner]
         @taxon.build_video_banner(attachment: permitted_resource_params.delete(:video_banner)) if permitted_resource_params[:video_banner]
       end
-
-      # Some admin forms submit STI records under their class key
-      # (e.g. :spree_cm_commissioner_show) while Spree update reads :taxon.
-      # Merge both into :taxon so all edited fields are persisted.
-      def normalize_sti_taxon_params
-        return unless @taxon
-
-        sti_key = @taxon.class.model_name.param_key.to_sym
-        sti_params = params[sti_key]
-        return unless sti_params.is_a?(::ActionController::Parameters)
-
-        base_params = params[:taxon]
-        base_hash = base_params.is_a?(::ActionController::Parameters) ? base_params.to_unsafe_h : {}
-        sti_hash = sti_params.to_unsafe_h
-        merged_params = ::ActionController::Parameters.new(base_hash.merge(sti_hash))
-
-        params[:taxon] = merged_params
-      end
     end
   end
 end

data/app/controllers/spree/admin/users_controller_decorator.rb

@@ -20,26 +20,8 @@ module Spree
         end
       end
 
-      # override
-      def update
-        preserve_non_form_roles
-        super
-      end
-
       private
 
-      # Role types the user form doesn't render (assigned in organizer dashboards), e.g. check-in groups and preview.
-      NON_FORM_ROLE_TYPES = %i[check_in preview].freeze
-
-      # spree_role_ids= replaces the whole role set, so a submit that omits these would drop them. Merge
-      # the user's existing ones back in so they survive. Skip when the form didn't submit roles at all.
-      def preserve_non_form_roles
-        return if params.dig(:user, :spree_role_ids).nil?
-
-        preserved_ids = @user.spree_roles.where(role_type: NON_FORM_ROLE_TYPES).pluck(:id).map(&:to_s)
-        params[:user][:spree_role_ids] = (params[:user][:spree_role_ids] + preserved_ids).uniq
-      end
-
       def build_profile
         return unless permitted_resource_params[:profile]
 

data/app/controllers/spree/api/chatrace/guests_controller.rb

@@ -53,7 +53,7 @@ module Spree
           preferences upload_later social_contact_platform user_id
           bib_number bib_prefix bib_index public_metadata private_metadata
           seat_number intel_phone_number block_id saved_guest_id
-          data_fill_stage
+          data_fill_stage_phase
         ].freeze
 
         def guest_base_columns

data/app/controllers/spree/api/v2/operator/event_charts_controller.rb

@@ -36,7 +36,6 @@ module Spree
             SpreeCmCommissioner::EventChartQueries.new(
               taxon_id: params[:taxon_id],
               chart_type: params[:id] || 'participation',
-              check_in_session_id: params[:check_in_session_id],
               refreshed: params[:refreshed] || false
             )
           end

data/app/controllers/spree/api/v2/operator/guest_json_gzips_controller.rb

@@ -26,8 +26,6 @@ module Spree
 
             result = SpreeCmCommissioner::OperatorGuestJsonGzips::Create.call(
               exportable: exportable,
-              # Scope the offline file to the requesting operator's check-in role (nil = unrestricted).
-              role: spree_current_user.check_in_role_for(exportable),
               force_create: false,
               options: {
                 created_by_id: spree_current_user.id.to_s,
@@ -55,19 +53,11 @@ module Spree
           end
 
           # override
-          # Scope the list to the requesting operator's check-in group, the same way the create cache
-          # does — otherwise a restricted crew could list (and download via exported_file_url) other
-          # groups' files for the event.
           def scope
-            exportable = Spree::Taxon.find(params[:taxon_id])
-
-            SpreeCmCommissioner::Exports::OperatorGuestJsonGzip
-              .where(
-                exportable_type: 'Spree::Taxon',
-                exportable_id: params[:taxon_id],
-                role_id: spree_current_user.check_in_role_for(exportable)&.id
-              )
-              .order(created_at: :desc)
+            SpreeCmCommissioner::Exports::OperatorGuestJsonGzip.where(
+              exportable_type: 'Spree::Taxon',
+              exportable_id: params[:taxon_id]
+            ).order(created_at: :desc)
           end
 
           # override

data/app/controllers/spree/api/v2/storefront/account/guest_dynamic_fields_controller.rb

@@ -4,40 +4,69 @@ module Spree
       module Storefront
         module Account
           class GuestDynamicFieldsController < ::Spree::Api::V2::ResourceController
-            ALLOWED_PHASES = %w[pre_registration post_registration].freeze
-
             before_action :require_spree_current_user
             before_action :load_guest
 
             def update_dynamic_field
-              return render_error_payload('Invalid phase') unless ALLOWED_PHASES.include?(params[:phase])
-              return render_error_payload('No dynamic fields provided') if dynamic_fields_params.blank?
-
-              result = SpreeCmCommissioner::Guests::Update.call(
-                guest: @guest,
-                guest_params: {
-                  guest_dynamic_fields_attributes: dynamic_fields_params.map { |f| { dynamic_field_id: f[:id], value: f[:value] } }
-                }
-              )
-
-              if result.success?
-                render_serialized_payload { serialize_guest(result.value[:guest]) }
-              else
-                render_error_payload(result.error)
+              phase = params[:phase]
+
+              return render_error_payload('Invalid phase', 422) unless %w[pre_registration post_registration].include?(phase)
+
+              begin
+                fields = dynamic_fields_params
+              rescue ActionController::ParameterMissing
+                return render_error_payload('No dynamic fields provided', 422)
               end
+
+              return render_error_payload('No dynamic fields provided', 422) if fields.blank?
+
+              ActiveRecord::Base.transaction do
+                fields.each do |field|
+                  process_dynamic_field(field)
+                end
+
+                @guest.save_and_move_to_next_stage
+              end
+
+              render_serialized_payload { serialize_guest(@guest) }
+            rescue ActiveRecord::RecordInvalid => e
+              render_error_payload(e.record.errors, 422)
+            rescue ActiveRecord::RecordNotFound => e
+              render_error_payload(e.message, 404)
             end
 
             private
 
             def dynamic_fields_params
-              Array(params[:dynamic_fields]).map { |field| field.permit(:id, :value) }
+              params.require(:dynamic_fields).map do |field|
+                field.permit(:id, :value)
+              end
             end
 
             def load_guest
               @guest = SpreeCmCommissioner::Guest.find(params[:guest_id])
 
-              raise CanCan::AccessDenied unless spree_current_user.guests.exists?(id: @guest.id) ||
-                @guest.line_item.order.user == spree_current_user
+              unless spree_current_user.guests.exists?(id: @guest.id) ||
+                  @guest.line_item.order.user == spree_current_user
+                render_error_payload('Unauthorized', 401)
+              end
+            end
+
+            def process_dynamic_field(field)
+              dynamic_field = SpreeCmCommissioner::DynamicField.find(field[:id])
+              guest_field = @guest.guest_dynamic_fields.build(dynamic_field_id: dynamic_field.id)
+
+              if dynamic_field.requires_dynamic_field_options?
+                option = dynamic_field.dynamic_field_options.find_by(value: field[:value])
+                raise ActiveRecord::RecordNotFound, "Invalid value for dynamic field #{dynamic_field.label}" unless option
+
+                guest_field.dynamic_field_option = option
+                guest_field.value = option.value
+              else
+                guest_field.value = field[:value]
+              end
+
+              guest_field.save!
             end
 
             def serialize_guest(guest)

data/app/controllers/spree/api/v2/storefront/account/mark_guest_info_complete_controller.rb

@@ -7,7 +7,7 @@ module Spree
             before_action :require_spree_current_user
 
             def update
-              spree_current_user.clear_has_incomplete_guest_info_cache
+              SpreeCmCommissioner::Users::IncompleteGuestCheckerService.new(spree_current_user).call
               render_success
             end
 
@@ -18,7 +18,7 @@ module Spree
                 {
                   success: true,
                   message: 'Guest information marked as complete',
-                  has_incomplete_guest_info: spree_current_user.has_incomplete_guest_info?
+                  has_incomplete_guest_info: false
                 }
               end
             end

data/app/controllers/spree/api/v2/storefront/account/orders_controller_decorator.rb

@@ -24,11 +24,21 @@ module Spree
             private
 
             def find_orders_with_incomplete_guest_info
-              spree_current_user.orders
-                                .complete
-                                .joins(:guests)
-                                .merge(SpreeCmCommissioner::Guest.post_registration)
-                                .distinct
+              orders = spree_current_user.orders
+                                         .complete
+                                         .includes(line_items: { guests: [:guest_dynamic_fields] })
+
+              incomplete_order_ids = orders.select do |order|
+                order.line_items.any? do |line_item|
+                  line_item.guests.any? do |guest|
+                    guest.pre_registration_completed? &&
+                      guest.post_registration_fields? &&
+                      !guest.post_registration_completed?
+                  end
+                end
+              end.map(&:id)
+
+              spree_current_user.orders.where(id: incomplete_order_ids)
             end
 
             def collection_finder

data/app/controllers/spree/api/v2/storefront/account_checker_controller.rb

@@ -3,10 +3,6 @@ module Spree
     module V2
       module Storefront
         class AccountCheckerController < Spree::Api::V2::BaseController
-          include SpreeCmCommissioner::TurnstileProtectable
-
-          before_action :verify_turnstile!, only: :index
-
           def index
             checker = SpreeCmCommissioner::ExistingAccountChecker.call(filter_params.to_h)
 

data/app/controllers/spree/api/v2/storefront/guests_controller.rb

@@ -31,27 +31,26 @@ module Spree
           def create
             spree_authorize! :update, spree_current_order, order_token
 
-            result = SpreeCmCommissioner::Guests::Create.call(
+            result = SpreeCmCommissioner::Cart::CreateGuest.call(
               line_item: parent,
-              guest_params: guest_params
+              options: guest_params
             )
 
             if result.success?
-              render_serialized_payload(201) { serialize_resource(result.value[:guest]) }
+              render_serialized_payload(201) { serialize_resource(result.value) }
             else
-              render_error_payload(result.error || result.value.errors, 422)
+              render_error_payload(result.value.errors, 422)
             end
           end
 
           def update
             spree_authorize! :update, spree_current_order, order_token unless guest_for_update.pre_registration?
 
-            result = SpreeCmCommissioner::Guests::Update.call(guest: guest_for_update, guest_params: guest_params)
-
-            if result.success?
-              render_serialized_payload { serialize_resource(result.value[:guest]) }
-            else
-              render_error_payload(result.error || result.value&.errors, 422)
+            begin
+              SpreeCmCommissioner::UpdateGuestService.new(guest_for_update, guest_params).call
+              render_serialized_payload { serialize_resource(guest_for_update) }
+            rescue ActiveRecord::RecordInvalid => e
+              render_error_payload(e.record.errors, 422)
             end
           end
 

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -19,7 +19,6 @@ module Spree
             @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
                                        .active
                                        .where(tenant_id: nil)
-                                       .where(preview: false)
                                        .order(position: :asc)
           end
         end

data/app/controllers/spree/api/v2/storefront/order_histories_controller.rb

@@ -18,6 +18,7 @@ module Spree
             order = Spree::Order.not_archived.find_by!(token: order_token)
 
             spree_authorize! :update, order, order_token
+            raise CanCan::AccessDenied unless order.payment?
 
             if order.mark_as_archive
               render_serialized_payload { serialize_resource(order) }

data/app/controllers/spree/api/v2/storefront/saved_guests_controller.rb

@@ -0,0 +1,77 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class SavedGuestsController < ::Spree::Api::V2::ResourceController
+          before_action :require_spree_current_user
+          before_action :load_saved_guest, only: %i[show update destroy]
+
+          def collection
+            spree_current_user.saved_guests.order(created_at: :desc)
+                              .page(params[:page])
+                              .per(params[:per_page])
+          end
+
+          def create
+            saved_guest = spree_current_user.saved_guests.new(saved_guest_params)
+
+            if saved_guest.save
+              render_serialized_payload(201) { serialize_resource(saved_guest) }
+            else
+              render_error_payload(saved_guest.errors.full_messages.to_sentence, 422)
+            end
+          end
+
+          def update
+            if @saved_guest.update(saved_guest_params)
+              render_serialized_payload { serialize_resource(@saved_guest) }
+            else
+              render_error_payload(@saved_guest.errors.full_messages.to_sentence, 400)
+            end
+          end
+
+          def destroy
+            @saved_guest.destroy
+            head :no_content
+          end
+
+          private
+
+          def model_class
+            SpreeCmCommissioner::SavedGuest
+          end
+
+          def collection_serializer
+            resource_serializer
+          end
+
+          def resource_serializer
+            SpreeCmCommissioner::V2::Storefront::SavedGuestSerializer
+          end
+
+          def load_saved_guest
+            @saved_guest = spree_current_user.saved_guests.find(params[:id])
+          end
+
+          def saved_guest_params
+            params.require(:saved_guest).permit(
+              :first_name,
+              :last_name,
+              :dob,
+              :age,
+              :gender,
+              :email,
+              :country_code,
+              :phone_number,
+              :intel_phone_number,
+              :nationality_id,
+              :occupation_id,
+              :nationality_group,
+              :age_group
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/waiting_room_sessions_controller.rb

@@ -14,8 +14,7 @@ module Spree
               tenant_id: nil,
               remote_ip: request.remote_ip,
               waiting_guest_firebase_doc_id: params[:waiting_guest_firebase_doc_id],
-              page_path: params[:page_path],
-              device_attributes: permitted_device_attributes
+              page_path: params[:page_path]
             )
 
             if context.success?
@@ -28,12 +27,6 @@ module Spree
           def resource_serializer
             SpreeCmCommissioner::V2::Storefront::WaitingRoomSessionSerializer
           end
-
-          private
-
-          def permitted_device_attributes
-            params.permit(*SpreeCmCommissioner::WaitingRoomSessionCreator::PERMITTED_DEVICE_ATTRIBUTES)
-          end
         end
       end
     end

data/app/controllers/spree/api/v2/tenant/account/orders_controller.rb

@@ -26,7 +26,7 @@ module Spree
             end
 
             def scope
-              spree_current_user.orders.complete.exclude_vote_package
+              spree_current_user.orders.complete
             end
 
             def collection_serializer

data/app/controllers/spree/api/v2/tenant/base_controller.rb

@@ -16,10 +16,6 @@ module Spree
             set_current_tenant(@tenant)
           end
 
-          def current_vendor
-            @current_vendor ||= @tenant.active_vendor
-          end
-
           def render_serialized_payload(status = 200)
             render json: yield, status: status, content_type: content_type
           end

data/app/controllers/spree/api/v2/tenant/guests_controller.rb

@@ -30,25 +30,28 @@ module Spree
           def create
             spree_authorize! :update, spree_current_order, order_token
 
-            result = SpreeCmCommissioner::Guests::Create.call(line_item: parent, guest_params: guest_params)
+            resource = scope.new(guest_params.except(:guest_dynamic_fields_attributes))
 
-            if result.success?
-              render_serialized_payload(201) { serialize_resource(result.value[:guest]) }
-            else
-              render_error_payload(result.error || result.value&.errors, 422)
+            ActiveRecord::Base.transaction do
+              resource.save!
+              run_dynamic_fields(resource)
+              resource.save_and_move_to_next_stage
             end
+
+            render_serialized_payload(201) { serialize_resource(resource) }
           end
 
           def update
             spree_authorize! :update, spree_current_order, order_token
 
-            result = SpreeCmCommissioner::Guests::Update.call(guest: resource, guest_params: guest_params)
-
-            if result.success?
-              render_serialized_payload { serialize_resource(result.value[:guest]) }
-            else
-              render_error_payload(result.error || result.value&.errors, 422)
+            ActiveRecord::Base.transaction do
+              run_dynamic_fields(resource) if guest_params[:guest_dynamic_fields_attributes]
+              resource.assign_attributes(guest_params.except(:guest_dynamic_fields_attributes))
+              resource.save!
+              resource.save_and_move_to_next_stage
             end
+
+            render_serialized_payload { serialize_resource(resource) }
           end
 
           private
@@ -96,6 +99,13 @@ module Spree
             )
           end
 
+          def run_dynamic_fields(resource)
+            SpreeCmCommissioner::GuestDynamicFieldsManager.call(
+              resource: resource,
+              dynamic_fields_attributes: guest_params[:guest_dynamic_fields_attributes]
+            )
+          end
+
           def handle_record_invalid(exception)
             render_error_payload(exception.record.errors, 422)
           end

data/app/controllers/spree/api/v2/tenant/homepage_sections_controller.rb

@@ -5,7 +5,6 @@ module Spree
         class HomepageSectionsController < BaseController
           def collection
             @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
-                                 .where(preview: false)
                                  .active
                                  .order(position: :asc)
           end