spree_cm_commissioner 2.8.3.pre6 → 2.8.3.pre.pre7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 03105af0ab1e480deee42cf481634c850da1a67603e5b443353d4aad31017181
-  data.tar.gz: 1add556af176fac0f8ac9be335406537e857c438dacd38a3a0769fa841a60e99
+  metadata.gz: 6453df013c8c48c7750f2c78315a47a008d71d2d08a18a627e6f23d1cb8e0564
+  data.tar.gz: d28c67f073a707a50fe3f44a6bb6c9184fe3403ffc6909585137b73ae8305c39
 SHA512:
-  metadata.gz: d6e85ae08be39fc2a66791c42a049ae3be212fa16af34bc0edaa7366c1b4b22305a381029f0d76a0f03807e7bc1e53ed82c35d8dd5b88f05cb806dc39f520492
-  data.tar.gz: fc23fd4348e6b70720c5e803b278f07e9c6303e37c3ea1080b254a511da02fd75c30426bbfe9107b925efa8280f6b10b5d4d84edc42d5e38b9643cc4f3190375
+  metadata.gz: 18c051ff735f3af699821c909d430921a245cae3ba50bf798db8a5e7d20decab213b2432855d28ad22283e9fbdc17e45326a78e14e6c6a9f42d332be94a91b45
+  data.tar.gz: 37cbb8aea0043989a2eac1ade7f2184aa71d8a57349c1fd9978c2147787a65aa80134be083cf48d3e9074134eccb3e91197694dca20098140340276333b71e5a

data/.github/workflows/test_and_build_gem.yml

@@ -164,7 +164,8 @@ jobs:
         env:
           DATABASE_URL: postgres://myuser:mypassword@localhost:5432/test_db
         run: |
-          bundle exec brakeman --no-exit-on-warn
+          # Using --no-threads to bypass a known Ruby 3.2.0 GC segmentation fault in CI.
+          bundle exec brakeman --no-threads --no-exit-on-warn
 
   test:
     needs: [setup]

data/.gitignore

@@ -34,3 +34,9 @@ vendor/bundle/
 # Cursor
 .cursor
 dump.rdb
+# Added by code-review-graph
+.code-review-graph/
+.cursorrules
+.claude
+CLAUDE.md
+AGENTS.md

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.3.pre6)
+    spree_cm_commissioner (2.8.3.pre.pre7)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -16,6 +16,7 @@ module SpreeCmCommissioner
       GuestCardClassesController
       SeatLayoutController
       CmsPagesController
+      AdvertisementsController
     ].freeze
 
     # Priority 2: Semi-Static (1 hour)
@@ -25,6 +26,7 @@ module SpreeCmCommissioner
       HomepageDataController
       PopularRoutesController
       RoutePlacesController
+      ShowsController
     ].freeze
 
     # Priority 3: Moderate Freshness (30 minutes)

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -51,7 +51,10 @@ module Spree
       def permitted_resource_params
         segment_value = helpers.calculate_segment_value(params[:spree_cm_commissioner_homepage_section])
 
-        params.require(:spree_cm_commissioner_homepage_section).permit(:title, :description, :active, :tenant_id).merge(segment: segment_value)
+        params
+          .require(:spree_cm_commissioner_homepage_section)
+          .permit(:title, :description, :active, :tenant_id, :preview)
+          .merge(segment: segment_value)
       end
 
       def load_tenants

data/app/controllers/spree/admin/taxons_controller_decorator.rb

@@ -3,6 +3,7 @@ module Spree
     module TaxonsControllerDecorator
       def self.prepended(base)
         base.before_action :build_assets, only: %i[create update]
+        base.before_action :normalize_sti_taxon_params, only: %i[create update]
       end
 
       # override
@@ -50,6 +51,24 @@ module Spree
         @taxon.build_home_banner(attachment: permitted_resource_params.delete(:home_banner)) if permitted_resource_params[:home_banner]
         @taxon.build_video_banner(attachment: permitted_resource_params.delete(:video_banner)) if permitted_resource_params[:video_banner]
       end
+
+      # Some admin forms submit STI records under their class key
+      # (e.g. :spree_cm_commissioner_show) while Spree update reads :taxon.
+      # Merge both into :taxon so all edited fields are persisted.
+      def normalize_sti_taxon_params
+        return unless @taxon
+
+        sti_key = @taxon.class.model_name.param_key.to_sym
+        sti_params = params[sti_key]
+        return unless sti_params.is_a?(::ActionController::Parameters)
+
+        base_params = params[:taxon]
+        base_hash = base_params.is_a?(::ActionController::Parameters) ? base_params.to_unsafe_h : {}
+        sti_hash = sti_params.to_unsafe_h
+        merged_params = ::ActionController::Parameters.new(base_hash.merge(sti_hash))
+
+        params[:taxon] = merged_params
+      end
     end
   end
 end

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -19,6 +19,7 @@ module Spree
             @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
                                        .active
                                        .where(tenant_id: nil)
+                                       .where(preview: false)
                                        .order(position: :asc)
           end
         end

data/app/controllers/spree/api/v2/storefront/preview_products_controller.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewProductsController < ::Spree::Api::V2::Storefront::ProductsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super(**args).rewhere(preview: true).where(status: :active)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_sections_controller.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
+                                       .active
+                                       .where(tenant_id: nil)
+                                       .where(preview: true)
+                                       .where(id: section_ids)
+                                       .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_taxons_controller.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewTaxonsController < ::Spree::Api::V2::Storefront::TaxonsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            super(**args).rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/products_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module ProductsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::ProductsController.prepend(Spree::Api::V2::Storefront::ProductsControllerDecorator)

data/app/controllers/spree/api/v2/storefront/taxons_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module TaxonsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::TaxonsController.prepend(Spree::Api::V2::Storefront::TaxonsControllerDecorator)

data/app/controllers/spree/api/v2/tenant/advertisements_controller.rb

@@ -0,0 +1,24 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class AdvertisementsController < BaseController
+          private
+
+          def scope
+            Spree::Taxon.campaigns
+                        .joins(:vendor)
+                        .where(spree_vendors: { tenant_id: @tenant.id })
+                        .where('spree_taxons.from_date <= ? OR spree_taxons.from_date IS NULL', Time.current)
+                        .where('spree_taxons.to_date >= ? OR spree_taxons.to_date IS NULL', Time.current)
+                        .order(created_at: :asc)
+          end
+
+          def collection_serializer
+            Spree::V2::Tenant::CampaignSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/base_controller.rb

@@ -16,6 +16,10 @@ module Spree
             set_current_tenant(@tenant)
           end
 
+          def current_vendor
+            @current_vendor ||= @tenant.active_vendor
+          end
+
           def render_serialized_payload(status = 200)
             render json: yield, status: status, content_type: content_type
           end

data/app/controllers/spree/api/v2/tenant/episodes_controller.rb

@@ -0,0 +1,38 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class EpisodesController < BaseController
+          private
+
+          def model_class
+            SpreeCmCommissioner::ShowEpisode
+          end
+
+          def resource
+            @resource ||= scope.find(params[:id])
+          end
+
+          def scope
+            current_season.episodes.where(product_type: :show_episode).includes(:voting_sessions, :vote_packages)
+          end
+
+          def current_season
+            @current_season ||= SpreeCmCommissioner::Show
+                                .where(vendor_id: @tenant.vendors.select(:id))
+                                .where.not(parent_id: nil)
+                                .find_by!(slug: params[:show_id])
+          end
+
+          def resource_serializer
+            Spree::V2::Tenant::ShowEpisodeSerializer
+          end
+
+          def collection_serializer
+            Spree::V2::Tenant::ShowEpisodeSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/free_vote_claims_controller.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class FreeVoteClaimsController < BaseController
+          before_action :require_spree_current_user
+
+          def create
+            show = current_vendor.shows.find(params[:show_id])
+
+            result = SpreeCmCommissioner::VotingCredits::ClaimFreeVotes.new(
+              show: show,
+              user: spree_current_user,
+              tenant_id: MultiTenant.current_tenant_id,
+              votable_type: params[:votable_type],
+              votable_id: params[:votable_id]
+            ).call
+
+            if result.failure?
+              render_error_payload(result.error.to_s)
+            elsif result.value.nil?
+              head :no_content
+            else
+              render_serialized_payload { serialize_resource(result.value) }
+            end
+          end
+
+          private
+
+          def resource_serializer
+            Spree::V2::Tenant::VotingCreditSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/homepage_sections_controller.rb

@@ -5,6 +5,7 @@ module Spree
         class HomepageSectionsController < BaseController
           def collection
             @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .where(preview: false)
                                  .active
                                  .order(position: :asc)
           end

data/app/controllers/spree/api/v2/tenant/preview_products_controller.rb

@@ -0,0 +1,47 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewProductsController < ProductsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super.where(status: :active, preview: true)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_sections_controller.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .active
+                                 .where(preview: true)
+                                 .where(id: section_ids)
+                                 .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_shows_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewShowsController < ShowsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            allowed_ids = spree_current_user.preview_roles
+                                            .where(previewable_type: SpreeCmCommissioner::Show.polymorphic_name)
+                                            .select(:previewable_id)
+            super.rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_taxons_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewTaxonsController < TaxonsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            MultiTenant.with(@tenant) do
+              model_class.where(preview: true, id: allowed_ids)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/products_controller.rb

@@ -21,7 +21,7 @@ module Spree
 
           def scope
             MultiTenant.with(@tenant) do
-              model_class.where(tenant_id: MultiTenant.current_tenant_id)
+              model_class.where(tenant_id: MultiTenant.current_tenant_id, preview: false)
             end
           end
 

data/app/controllers/spree/api/v2/tenant/show_contestants_controller.rb

@@ -0,0 +1,52 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class ShowContestantsController < BaseController
+          private
+
+          # override
+          def model_class
+            SpreeCmCommissioner::ShowContestant
+          end
+
+          # override
+          def scope
+            return model_class.none unless current_show
+
+            model_class
+              .where(show_id: current_show.id)
+              .includes(
+                :show_contestant_images,
+                :show_contestant_videos,
+                :current_voting_session,
+                :voting_contestants,
+                assigned_show_person: :show_person_images,
+                show: [
+                  :parent,
+                  { episodes: :voting_sessions },
+                  { seasons: { episodes: :voting_sessions } }
+                ]
+              )
+          end
+
+          def current_show
+            @current_show ||= show_scope.find_by!(slug: params[:show_id])
+          end
+
+          def show_scope
+            vendor_ids = @tenant.vendors.select(:id)
+            return SpreeCmCommissioner::Show.none if vendor_ids.blank?
+
+            SpreeCmCommissioner::Show.where(vendor_id: vendor_ids)
+          end
+
+          # override
+          def resource_serializer
+            Spree::V2::Tenant::ShowContestantSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/show_elimination_sessions_controller.rb

@@ -0,0 +1,57 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class ShowEliminationSessionsController < BaseController
+          # override
+          def collection
+            @collection ||= scope
+                            .includes(
+                              :episode,
+                              :show,
+                              eliminated_voting_contestants: [
+                                :show_contestant,
+                                { show_contestant: %i[show_contestant_images show_contestant_videos] }
+                              ]
+                            )
+                            .order('cm_voting_sessions.closes_at DESC')
+          end
+
+          # override
+          def collection_serializer
+            Spree::V2::Tenant::VotingSessionSerializer
+          end
+
+          private
+
+          # override
+          def model_class
+            SpreeCmCommissioner::VotingSession
+          end
+
+          # override
+          def scope
+            return model_class.none unless current_show
+
+            current_show.voting_sessions
+                        .joins(:episode)
+                        .joins(:voting_contestants)
+                        .where(voting_contestants: { eliminated: true })
+                        .distinct
+          end
+
+          def current_show
+            @current_show ||= show_scope.find_by!(slug: params[:show_id])
+          end
+
+          def show_scope
+            vendor_ids = @tenant.vendors.select(:id)
+            return SpreeCmCommissioner::Show.none if vendor_ids.blank?
+
+            SpreeCmCommissioner::Show.where(vendor_id: vendor_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/show_people_controller.rb

@@ -0,0 +1,49 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class ShowPeopleController < BaseController
+          private
+
+          # override
+          def model_class
+            SpreeCmCommissioner::ShowPerson
+          end
+
+          # override
+          def scope
+            scope = current_show.show_people
+                                .joins(:assignments)
+                                .distinct
+                                .includes(
+                                  :assignments,
+                                  assigned_contestants: %i[show_contestant_images current_voting_session]
+                                )
+
+            role = params[:role].presence
+            return scope if role.blank?
+
+            role_value = SpreeCmCommissioner::ShowPersonAssignment.roles[role.to_s]
+            return scope.none if role_value.nil?
+
+            scope.where(cm_show_people_assignments: { role: role_value })
+          end
+
+          # override
+          def collection_serializer
+            Spree::V2::Tenant::ShowPersonSerializer
+          end
+
+          def current_show
+            @current_show ||= show_scope.find_by!(slug: params[:show_id])
+          end
+
+          def show_scope
+            vendor_ids = @tenant.vendors.select(:id)
+            SpreeCmCommissioner::Show.where(vendor_id: vendor_ids)
+          end
+        end
+      end
+    end
+  end
+end