spree_cm_commissioner 2.8.3.pre.pre5 → 2.8.3.pre6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 145ade12d325f15a3f1963b4fd75e56093cbb182e1f3ac115d0101c0c6cad285
-  data.tar.gz: e47239cbfa8a359ce7e0b0ed2f73e5270876f679d3047a2d88be89493683004a
+  metadata.gz: 03105af0ab1e480deee42cf481634c850da1a67603e5b443353d4aad31017181
+  data.tar.gz: 1add556af176fac0f8ac9be335406537e857c438dacd38a3a0769fa841a60e99
 SHA512:
-  metadata.gz: '06134389566fe49ae2dfe58a65919130cc57dcf43694d33af480d2930d517cfbba1ba97c7714f0b011cdb063a9a7d1611dc205fdcce1cf7f77fd4618c6d9ffd9'
-  data.tar.gz: 60d6491f501f2baa87fb971bee6a906f3180425d9f72917462adc2d266c0f3302a44bf532c39fe9885b3b965d7c94fdae9b158d0c7bc9263879b2d2e43197e23
+  metadata.gz: d6e85ae08be39fc2a66791c42a049ae3be212fa16af34bc0edaa7366c1b4b22305a381029f0d76a0f03807e7bc1e53ed82c35d8dd5b88f05cb806dc39f520492
+  data.tar.gz: fc23fd4348e6b70720c5e803b278f07e9c6303e37c3ea1080b254a511da02fd75c30426bbfe9107b925efa8280f6b10b5d4d84edc42d5e38b9643cc4f3190375

data/.env.example

@@ -34,6 +34,7 @@ DISTANCE_SIGNING_KEY=hei********************VY
 
 # Cache durations (in seconds) for different content types
 # See: app/controllers/concerns/spree_cm_commissioner/content_cachable.rb
+CACHE_AUTO_INVALIDATION_DISABLED="" # Set to yes to disable CDN cache invalidation entirely (kill switch)
 CACHE_CDN_MAX_AGE=86400 # CDN/server-side cache duration for all responses
 CACHE_STATIC_MAX_AGE=86400 # Static content (countries, provinces, seat layouts, CMS pages) - 1 day
 CACHE_SEMI_STATIC_MAX_AGE=3600 # Semi-static content (menus, homepage backgrounds, routes) - 1 hour

data/.github/workflows/test_and_build_gem.yml

@@ -164,8 +164,7 @@ jobs:
         env:
           DATABASE_URL: postgres://myuser:mypassword@localhost:5432/test_db
         run: |
-          # Using --no-threads to bypass a known Ruby 3.2.0 GC segmentation fault in CI.
-          bundle exec brakeman --no-threads --no-exit-on-warn
+          bundle exec brakeman --no-exit-on-warn
 
   test:
     needs: [setup]

data/.gitignore

@@ -34,9 +34,3 @@ vendor/bundle/
 # Cursor
 .cursor
 dump.rdb
-# Added by code-review-graph
-.code-review-graph/
-.cursorrules
-.claude
-CLAUDE.md
-AGENTS.md

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.3.pre.pre5)
+    spree_cm_commissioner (2.8.3.pre6)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -16,7 +16,6 @@ module SpreeCmCommissioner
       GuestCardClassesController
       SeatLayoutController
       CmsPagesController
-      AdvertisementsController
     ].freeze
 
     # Priority 2: Semi-Static (1 hour)
@@ -26,7 +25,6 @@ module SpreeCmCommissioner
       HomepageDataController
       PopularRoutesController
       RoutePlacesController
-      ShowsController
     ].freeze
 
     # Priority 3: Moderate Freshness (30 minutes)

data/app/controllers/spree/admin/guests_controller.rb

@@ -55,7 +55,7 @@ module Spree
         if result.success?
           flash[:success] = "Guest #{@guest.full_name} has been checked in."
         else
-          flash[:error] = result.message.to_s.titleize
+          flash[:error] = result.error.value.to_s.titleize
         end
 
         redirect_to collection_url

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -51,10 +51,7 @@ module Spree
       def permitted_resource_params
         segment_value = helpers.calculate_segment_value(params[:spree_cm_commissioner_homepage_section])
 
-        params
-          .require(:spree_cm_commissioner_homepage_section)
-          .permit(:title, :description, :active, :tenant_id, :preview)
-          .merge(segment: segment_value)
+        params.require(:spree_cm_commissioner_homepage_section).permit(:title, :description, :active, :tenant_id).merge(segment: segment_value)
       end
 
       def load_tenants

data/app/controllers/spree/admin/order_ticket_transfers_controller.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Admin
+    class OrderTicketTransfersController < Spree::Admin::ResourceController
+      include Spree::Admin::OrderConcern
+
+      helper SpreeCmCommissioner::Admin::TicketTransfersHelper
+
+      before_action :load_order
+
+      def show
+        @ticket_transfer = model_class.includes(:order, from_guest: :event).find(params[:id])
+      end
+
+      private
+
+      def model_class
+        SpreeCmCommissioner::TicketTransfer
+      end
+
+      def object_name
+        'spree_cm_commissioner_ticket_transfer'
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/stock_managements_controller.rb

@@ -92,7 +92,7 @@ module Spree
                                                                                                 .call
                                                                                                 .index_by(&:inventory_item_id)
         @reserved_stocks = Spree::LineItem
-                           .complete
+                           .affecting_inventory
                            .where(variant_id: @variants.pluck(:id))
                            .group('spree_line_items.variant_id')
                            .sum(:quantity)

data/app/controllers/spree/admin/taxons_controller_decorator.rb

@@ -3,7 +3,6 @@ module Spree
     module TaxonsControllerDecorator
       def self.prepended(base)
         base.before_action :build_assets, only: %i[create update]
-        base.before_action :normalize_sti_taxon_params, only: %i[create update]
       end
 
       # override
@@ -51,24 +50,6 @@ module Spree
         @taxon.build_home_banner(attachment: permitted_resource_params.delete(:home_banner)) if permitted_resource_params[:home_banner]
         @taxon.build_video_banner(attachment: permitted_resource_params.delete(:video_banner)) if permitted_resource_params[:video_banner]
       end
-
-      # Some admin forms submit STI records under their class key
-      # (e.g. :spree_cm_commissioner_show) while Spree update reads :taxon.
-      # Merge both into :taxon so all edited fields are persisted.
-      def normalize_sti_taxon_params
-        return unless @taxon
-
-        sti_key = @taxon.class.model_name.param_key.to_sym
-        sti_params = params[sti_key]
-        return unless sti_params.is_a?(::ActionController::Parameters)
-
-        base_params = params[:taxon]
-        base_hash = base_params.is_a?(::ActionController::Parameters) ? base_params.to_unsafe_h : {}
-        sti_hash = sti_params.to_unsafe_h
-        merged_params = ::ActionController::Parameters.new(base_hash.merge(sti_hash))
-
-        params[:taxon] = merged_params
-      end
     end
   end
 end

data/app/controllers/spree/admin/ticket_transfer_rules_controller.rb

@@ -0,0 +1,47 @@
+module Spree
+  module Admin
+    class TicketTransferRulesController < Spree::Admin::ResourceController
+      def index
+        @search = model_class.ransack(params[:q])
+        @ticket_transfer_rules = @search.result
+                                        .order(ruleable_type: :asc, ruleable_id: :asc, currency: :asc)
+                                        .page(params[:page])
+                                        .per(25)
+      end
+
+      private
+
+      def model_class
+        SpreeCmCommissioner::TicketTransferRule
+      end
+
+      def object_name
+        'spree_cm_commissioner_ticket_transfer_rule'
+      end
+
+      def collection_url
+        admin_ticket_transfer_rules_url
+      end
+
+      def location_after_save
+        edit_admin_ticket_transfer_rule_path(@object)
+      end
+
+      def permitted_resource_params
+        params.require(:spree_cm_commissioner_ticket_transfer_rule).permit(
+          :ruleable_type,
+          :ruleable_id,
+          :active,
+          :currency,
+          :fee_percentage,
+          :fee_flat_amount,
+          :cooldown_hours,
+          :max_transfers_per_ticket,
+          :event_cutoff_hours,
+          :min_price,
+          :max_price
+        )
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/ticket_transfers_controller.rb

@@ -0,0 +1,61 @@
+module Spree
+  module Admin
+    class TicketTransfersController < Spree::Admin::ResourceController
+      helper SpreeCmCommissioner::Admin::TicketTransfersHelper
+
+      def index
+        @search = model_class.includes(:from_user, :to_user, :from_guest).ransack(params[:q])
+        @ticket_transfers = @search.result.order(created_at: :desc).page(params[:page]).per(15)
+      end
+
+      def show
+        @ticket_transfer = model_class.includes(:order, from_guest: [:event, { line_item: :order }]).find(params[:id])
+      end
+
+      def state_changes
+        @ticket_transfer = model_class.find(params[:id])
+        @state_changes = @ticket_transfer.state_changes.includes(:user).order(created_at: :desc)
+      end
+
+      def cancel
+        @ticket_transfer = model_class.find(params[:id])
+        result = SpreeCmCommissioner::TicketTransfers::Cancel.call(
+          ticket_transfer: @ticket_transfer,
+          acting_user: try_spree_current_user
+        )
+
+        if result.success?
+          flash[:success] = 'Ticket transfer has been cancelled' # rubocop:disable Rails/I18nLocaleTexts
+        else
+          flash[:error] = result.error.value
+        end
+        redirect_to admin_ticket_transfer_path(@ticket_transfer)
+      end
+
+      def update_settlement_status
+        @ticket_transfer = model_class.find(params[:id])
+        new_status = params[:settlement_status]
+
+        unless @ticket_transfer.purchase? && @ticket_transfer.completed?
+          flash[:error] = 'Settlement status can only be updated for completed purchase transfers' # rubocop:disable Rails/I18nLocaleTexts
+          redirect_to admin_ticket_transfer_path(@ticket_transfer)
+          return
+        end
+
+        if @ticket_transfer.update(settlement_status: new_status)
+          @ticket_transfer.log_settlement_status_changes(user_id: try_spree_current_user&.id)
+          flash[:success] = "Settlement status updated to #{new_status}"
+        else
+          flash[:error] = @ticket_transfer.errors.full_messages.to_sentence.presence || 'Failed to update settlement status'
+        end
+        redirect_to admin_ticket_transfer_path(@ticket_transfer)
+      end
+
+      private
+
+      def model_class
+        SpreeCmCommissioner::TicketTransfer
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/account/recipients_controller.rb

@@ -0,0 +1,32 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module Account
+          class RecipientsController < ::Spree::Api::V2::ResourceController
+            before_action :require_spree_current_user
+
+            def show
+              identifier = params[:q].to_s.strip
+              return render_error_payload('Missing q parameter', 400) if identifier.blank?
+
+              user = SpreeCmCommissioner::RecipientSearcherQuery.new(identifier, MultiTenant.current_tenant_id).call
+
+              if user
+                render_serialized_payload { serialize_resource(user) }
+              else
+                render_error_payload('User not found', 404)
+              end
+            end
+
+            private
+
+            def resource_serializer
+              SpreeCmCommissioner::V2::Storefront::RecipientSerializer
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -19,7 +19,6 @@ module Spree
             @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
                                        .active
                                        .where(tenant_id: nil)
-                                       .where(preview: false)
                                        .order(position: :asc)
           end
         end

data/app/controllers/spree/api/v2/storefront/ticket_transfer_acceptances_controller.rb

@@ -0,0 +1,32 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class TicketTransferAcceptancesController < ::Spree::Api::V2::ResourceController
+          before_action :require_spree_current_user
+
+          def create
+            ticket_transfer = SpreeCmCommissioner::TicketTransfer.find_by!(token: params[:ticket_transfer_id])
+
+            result = SpreeCmCommissioner::TicketTransfers::Accept.call(
+              ticket_transfer: ticket_transfer,
+              buyer: spree_current_user
+            )
+
+            if result.success?
+              render_serialized_payload(201) { serialize_resource(result.value[:ticket_transfer]) }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          private
+
+          def resource_serializer
+            SpreeCmCommissioner::V2::Storefront::TicketTransferSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/ticket_transfers_controller.rb

@@ -0,0 +1,117 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class TicketTransfersController < ::Spree::Api::V2::ResourceController
+          before_action :require_spree_current_user
+
+          def index
+            render_serialized_payload do
+              serialize_collection(paginated_collection)
+            end
+          end
+
+          def show
+            ticket_transfer = model_class.includes(:order, from_guest: [:event, { line_item: :product }]).find_by!(token: params[:id])
+            return render_error_payload(I18n.t('ticket_transfer.unauthorized_view'), 403) unless authorized_to_view?(ticket_transfer)
+
+            render_serialized_payload { serialize_resource(ticket_transfer) }
+          end
+
+          def preview_rule
+            result = SpreeCmCommissioner::TicketTransfers::PreviewRule.call(
+              from_guest_id: params[:guest_id],
+              currency: params[:currency] || 'USD'
+            )
+
+            if result.success?
+              render json: { data: result.value }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          def create
+            result = SpreeCmCommissioner::TicketTransfers::Initiate.call(
+              from_user_id: spree_current_user.id,
+              to_user_id: ticket_transfer_params[:to_user_id],
+              from_guest_id: ticket_transfer_params[:guest_id],
+              price: ticket_transfer_params[:price] || 0,
+              currency: ticket_transfer_params[:currency] || 'USD',
+              expires_at: ticket_transfer_params[:expires_at],
+              transfer_type: ticket_transfer_params[:transfer_type] || 'purchase'
+            )
+
+            if result.success?
+              render_serialized_payload(201) { serialize_resource(result.value[:ticket_transfer]) }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          def cancel
+            ticket_transfer = model_class.find_by!(token: params[:id])
+
+            result = SpreeCmCommissioner::TicketTransfers::Cancel.call(
+              ticket_transfer: ticket_transfer,
+              acting_user: spree_current_user
+            )
+
+            if result.success?
+              render_serialized_payload { serialize_resource(result.value[:ticket_transfer]) }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          def reject
+            ticket_transfer = model_class.find_by!(token: params[:id])
+
+            result = SpreeCmCommissioner::TicketTransfers::Reject.call(
+              ticket_transfer: ticket_transfer,
+              acting_user: spree_current_user
+            )
+
+            if result.success?
+              render_serialized_payload { serialize_resource(result.value[:ticket_transfer]) }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          private
+
+          def model_class
+            SpreeCmCommissioner::TicketTransfer
+          end
+
+          def collection
+            SpreeCmCommissioner::TicketTransfer.includes(:order,
+                                                         from_guest: [:event, { line_item: :product }]
+                                                        ).where(from_user_id: spree_current_user.id)
+          end
+
+          def resource_serializer
+            SpreeCmCommissioner::V2::Storefront::TicketTransferSerializer
+          end
+
+          def collection_serializer
+            SpreeCmCommissioner::V2::Storefront::TicketTransferSerializer
+          end
+
+          def ticket_transfer_params
+            params.require(:ticket_transfer).permit(:to_user_id, :guest_id, :price, :currency, :expires_at, :transfer_type)
+          end
+
+          # When sending to a specific user, only sender and that buyer can access.
+          def authorized_to_view?(ticket_transfer)
+            return true if ticket_transfer.to_user_id.blank?
+
+            current_user_id = spree_current_user&.id
+            ticket_transfer.from_user_id == current_user_id || ticket_transfer.to_user_id == current_user_id
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/transit/item_availabilities_controller.rb

@@ -0,0 +1,66 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module Transit
+          class ItemAvailabilitiesController < ::Spree::Api::V2::ResourceController
+            include SpreeCmCommissioner::Integrations::InventorySyncCachable
+
+            def create
+              sync_result = sync_item_availability!
+
+              unless sync_result.success?
+                error_message = sync_result.to_h.dig(:error, :message) || 'Sync failed'
+                return render_error_payload(error_message, 422)
+              end
+
+              item_availability = SpreeCmCommissioner::ItemAvailabilitySync.new(
+                id: trip.id,
+                last_sync_at: sync_result.last_synced_at
+              )
+              render_serialized_payload { serialize_resource(item_availability) }
+            rescue ActiveRecord::RecordNotFound => e
+              render_error_payload(e.message, 404)
+            end
+
+            private
+
+            def trip
+              @trip ||= SpreeCmCommissioner::Trip.find(params[:trip_id])
+            end
+
+            def integration
+              @integration ||= trip.vendor&.integration
+            end
+
+            def sync_item_availability!
+              # Return success result if vendor has no integration
+              return SpreeCmCommissioner::Integrations::Base::SyncResult.new if integration.nil?
+
+              # Check cache first for successful results only
+              cached_result = Rails.cache.read(sync_cache_key)
+              return cached_result if cached_result
+
+              # Perform sync
+              result = integration.sync_item_availability!(trip_id: trip.id, on_date: params[:on_date])
+
+              # Only cache successful results to avoid sticky failures
+              Rails.cache.write(sync_cache_key, result, expires_in: sync_cache_ttl) if result.success?
+
+              result
+            end
+
+            def sync_cache_key
+              # Include trip.updated_at to auto-bust cache when trip is updated by background syncs
+              "item_availability_syncs:#{trip.id}:#{params[:on_date]}:#{trip.updated_at.to_i}"
+            end
+
+            def resource_serializer
+              SpreeCmCommissioner::V2::Storefront::ItemAvailabilitySyncSerializer
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/trip_search_controller.rb

@@ -39,7 +39,6 @@ module Spree
               params[:date],
               params[:route_type],
               params[:vendor_id],
-              params[:featured],
               params[:number_of_guests],
               resource_includes&.sort&.join(','),
               sparse_fields&.sort&.join(','),
@@ -65,8 +64,7 @@ module Spree
               'trips.vendor',
               'trips.vendor.logo',
               'trips.vehicle_type',
-              'trips.vehicle_type.vehicle_photos',
-              'trips.amenities'
+              'trips.vehicle_type.vehicle_photos'
             ]
           end
 
@@ -100,7 +98,11 @@ module Spree
 
           # override
           def serializer_params
-            params.permit(:include).to_hash
+            super.merge(
+              exclude_vendor_kind_option_types: true,
+              exclude_vendor_kind_option_values: true,
+              exclude_vehicle_type_amenities: true
+            )
           end
 
           # override

data/app/controllers/spree/api/v2/tenant/base_controller.rb

@@ -16,10 +16,6 @@ module Spree
             set_current_tenant(@tenant)
           end
 
-          def current_vendor
-            @current_vendor ||= @tenant.active_vendor
-          end
-
           def render_serialized_payload(status = 200)
             render json: yield, status: status, content_type: content_type
           end

data/app/controllers/spree/api/v2/tenant/homepage_sections_controller.rb

@@ -5,7 +5,6 @@ module Spree
         class HomepageSectionsController < BaseController
           def collection
             @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
-                                 .where(preview: false)
                                  .active
                                  .order(position: :asc)
           end

data/app/controllers/spree/api/v2/tenant/products_controller.rb

@@ -21,7 +21,7 @@ module Spree
 
           def scope
             MultiTenant.with(@tenant) do
-              model_class.where(tenant_id: MultiTenant.current_tenant_id, preview: false)
+              model_class.where(tenant_id: MultiTenant.current_tenant_id)
             end
           end
 

data/app/controllers/spree/api/v2/tenant/taxons_controller.rb

@@ -31,7 +31,7 @@ module Spree
 
           def scope
             MultiTenant.with(@tenant) do
-              model_class.where(preview: false)
+              model_class
             end
           end
 

data/app/controllers/spree/api/v2/tenant/trips_controller.rb

@@ -25,6 +25,17 @@ module Spree
           def resource_serializer
             Spree::V2::Tenant::TripSerializer
           end
+
+          # override
+          def serializer_params
+            super.merge(
+              include_details: include_details?
+            )
+          end
+
+          def include_details?
+            params.fetch(:include_details, 'true') == 'true'
+          end
         end
       end
     end

data/app/controllers/spree_cm_commissioner/admin/orders_controller_decorator.rb

@@ -40,9 +40,13 @@ module SpreeCmCommissioner
 
       # override
       def cancel
-        internal_note = params.dig(:order, :internal_note)
-        @order.canceled_by(try_spree_current_user, cancellation_reason: internal_note)
-        flash[:success] = Spree.t(:order_canceled)
+        if @order.guests_in_transfer?
+          flash[:error] = Spree.t('admin.orders.cannot_cancel_guest_transfer')
+        else
+          internal_note = params.dig(:order, :internal_note)
+          @order.canceled_by(try_spree_current_user, cancellation_reason: internal_note)
+          flash[:success] = Spree.t(:order_canceled)
+        end
         redirect_back fallback_location: spree.edit_admin_order_url(@order)
       end
 

data/app/controllers/spree_cm_commissioner/admin/products_controller_decorator.rb

@@ -6,7 +6,6 @@ module SpreeCmCommissioner
         base.around_action :set_writing_role, only: %i[index]
         base.after_action :set_tenant_after_update, only: %i[update]
         base.before_action :merge_industry_taxons_into_taxons, only: [:update]
-        base.before_action :normalize_sti_product_params, only: %i[create update]
       end
 
       # Override
@@ -52,24 +51,6 @@ module SpreeCmCommissioner
 
       protected
 
-      # Some admin forms submit STI records under their class key while
-      # Spree update reads :product. Merge both into :product so all edited
-      # fields are persisted for STI product subclasses.
-      def normalize_sti_product_params
-        return unless @product
-
-        sti_key = @product.class.model_name.param_key.to_sym
-        sti_params = params[sti_key]
-        return unless sti_params.is_a?(::ActionController::Parameters)
-
-        base_params = params[:product]
-        base_hash = base_params.is_a?(::ActionController::Parameters) ? base_params.to_unsafe_h : {}
-        sti_hash = sti_params.to_unsafe_h
-        merged_params = ::ActionController::Parameters.new(base_hash.merge(sti_hash))
-
-        params[:product] = merged_params
-      end
-
       def merge_industry_taxons_into_taxons
         return if params[:product].blank?