spree_cm_commissioner 2.8.3 → 2.8.4.pre.pre2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0774f6d0c4fad7ae396f14326fd6d0965164b74d89f355c3966bc8d1fd9563f9
-  data.tar.gz: 002d84c9f1273b54f01d5a25bdecc5f3b475a12e07b32d8e1846c19107fe776f
+  metadata.gz: f46f710655ba8b15a2ffa7413d62a1bfa7d82ec3f433e340730876d0a5d710fb
+  data.tar.gz: 21b459ea09087666eda42a19d4d0fcc2e048e29330a26d39d06145e7d936b1e9
 SHA512:
-  metadata.gz: 260d54db1f9dd63dbfef02edf2944d02e2c582972b8903815462e438be9cbfb6f5561a7b4a4b64c2cda4af18908c8c7a91958213c06764d1f7ee4d8e2c16dec3
-  data.tar.gz: 003d6ecd547b0215851266f06e823f2f7c5e7a8da35f5b4a8051784855a4d095d088b79f700dcadca8820d561d7a9989a3ee0d9eb7940943c3c5777cc7a4742c
+  metadata.gz: 3e78ff73c329e6afa9e95abd02e4aeeb9b0b3837eb1dfafbaaaf14bbcc54215e19f527aaee17326604fb2166d8ac93f519f72525121667343587d824b27e2cfa
+  data.tar.gz: 812c79c609318c28596a1826afc0bbc2ce9c53b40a8d04927da225d7b074d3a0f9dd0b63bd3c1bd7679194a86926de4d27245cb3db479be9aaaa92582ebaa822

data/.github/workflows/test_and_build_gem.yml

@@ -164,7 +164,8 @@ jobs:
         env:
           DATABASE_URL: postgres://myuser:mypassword@localhost:5432/test_db
         run: |
-          bundle exec brakeman --no-exit-on-warn
+          # Using --no-threads to bypass a known Ruby 3.2.0 GC segmentation fault in CI.
+          bundle exec brakeman --no-threads --no-exit-on-warn
 
   test:
     needs: [setup]

data/.gitignore

@@ -34,3 +34,9 @@ vendor/bundle/
 # Cursor
 .cursor
 dump.rdb
+# Added by code-review-graph
+.code-review-graph/
+.cursorrules
+.claude
+CLAUDE.md
+AGENTS.md

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.3)
+    spree_cm_commissioner (2.8.4.pre.pre2)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -16,6 +16,7 @@ module SpreeCmCommissioner
       GuestCardClassesController
       SeatLayoutController
       CmsPagesController
+      AdvertisementsController
     ].freeze
 
     # Priority 2: Semi-Static (1 hour)
@@ -25,6 +26,7 @@ module SpreeCmCommissioner
       HomepageDataController
       PopularRoutesController
       RoutePlacesController
+      ShowsController
     ].freeze
 
     # Priority 3: Moderate Freshness (30 minutes)

data/app/controllers/spree/admin/guests_controller.rb

@@ -55,7 +55,7 @@ module Spree
         if result.success?
           flash[:success] = "Guest #{@guest.full_name} has been checked in."
         else
-          flash[:error] = result.message.to_s.titleize
+          flash[:error] = result.error.value.to_s.titleize
         end
 
         redirect_to collection_url

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -51,7 +51,10 @@ module Spree
       def permitted_resource_params
         segment_value = helpers.calculate_segment_value(params[:spree_cm_commissioner_homepage_section])
 
-        params.require(:spree_cm_commissioner_homepage_section).permit(:title, :description, :active, :tenant_id).merge(segment: segment_value)
+        params
+          .require(:spree_cm_commissioner_homepage_section)
+          .permit(:title, :description, :active, :tenant_id, :preview)
+          .merge(segment: segment_value)
       end
 
       def load_tenants

data/app/controllers/spree/admin/order_ticket_transfers_controller.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Admin
+    class OrderTicketTransfersController < Spree::Admin::ResourceController
+      include Spree::Admin::OrderConcern
+
+      helper SpreeCmCommissioner::Admin::TicketTransfersHelper
+
+      before_action :load_order
+
+      def show
+        @ticket_transfer = model_class.includes(:order, from_guest: :event).find(params[:id])
+      end
+
+      private
+
+      def model_class
+        SpreeCmCommissioner::TicketTransfer
+      end
+
+      def object_name
+        'spree_cm_commissioner_ticket_transfer'
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/stock_managements_controller.rb

@@ -92,7 +92,7 @@ module Spree
                                                                                                 .call
                                                                                                 .index_by(&:inventory_item_id)
         @reserved_stocks = Spree::LineItem
-                           .complete
+                           .affecting_inventory
                            .where(variant_id: @variants.pluck(:id))
                            .group('spree_line_items.variant_id')
                            .sum(:quantity)

data/app/controllers/spree/admin/system/waiting_room_controller.rb

@@ -4,7 +4,10 @@ module Spree
       class WaitingRoomController < Spree::Admin::BaseController
         def show
           @fetcher = SpreeCmCommissioner::WaitingRoomSystemMetadataFetcher.new
+          @lobby_fetcher = SpreeCmCommissioner::WaitingRoomLobbyMetadataFetcher.new
+
           @fetcher.load_document_data
+          @lobby_fetcher.load_document_data
 
           @active_sesions_count = SpreeCmCommissioner::WaitingRoomSession.active.count
         end
@@ -29,6 +32,18 @@ module Spree
 
           redirect_back fallback_location: admin_system_waiting_room_path
         end
+
+        def publish_lobby_path
+          result = SpreeCmCommissioner::WaitingRoom::PublishLobbyPath.call
+
+          if result.success?
+            flash[:success] = "Published waiting guests records path: #{result.value[:records_path]}"
+          else
+            flash[:error] = result.error.to_s
+          end
+
+          redirect_back fallback_location: admin_system_waiting_room_path
+        end
       end
     end
   end

data/app/controllers/spree/admin/taxons_controller_decorator.rb

@@ -3,6 +3,7 @@ module Spree
     module TaxonsControllerDecorator
       def self.prepended(base)
         base.before_action :build_assets, only: %i[create update]
+        base.before_action :normalize_sti_taxon_params, only: %i[create update]
       end
 
       # override
@@ -27,6 +28,10 @@ module Spree
         remove_asset(@taxon.home_banner)
       end
 
+      def remove_ad_banner
+        remove_asset(@taxon.ad_banner)
+      end
+
       def remove_video_banner
         remove_asset(@taxon.video_banner)
       end
@@ -48,8 +53,27 @@ module Spree
         @taxon.build_app_banner(attachment: permitted_resource_params.delete(:app_banner)) if permitted_resource_params[:app_banner]
         @taxon.build_web_banner(attachment: permitted_resource_params.delete(:web_banner)) if permitted_resource_params[:web_banner]
         @taxon.build_home_banner(attachment: permitted_resource_params.delete(:home_banner)) if permitted_resource_params[:home_banner]
+        @taxon.build_ad_banner(attachment: permitted_resource_params.delete(:ad_banner)) if permitted_resource_params[:ad_banner]
         @taxon.build_video_banner(attachment: permitted_resource_params.delete(:video_banner)) if permitted_resource_params[:video_banner]
       end
+
+      # Some admin forms submit STI records under their class key
+      # (e.g. :spree_cm_commissioner_show) while Spree update reads :taxon.
+      # Merge both into :taxon so all edited fields are persisted.
+      def normalize_sti_taxon_params
+        return unless @taxon
+
+        sti_key = @taxon.class.model_name.param_key.to_sym
+        sti_params = params[sti_key]
+        return unless sti_params.is_a?(::ActionController::Parameters)
+
+        base_params = params[:taxon]
+        base_hash = base_params.is_a?(::ActionController::Parameters) ? base_params.to_unsafe_h : {}
+        sti_hash = sti_params.to_unsafe_h
+        merged_params = ::ActionController::Parameters.new(base_hash.merge(sti_hash))
+
+        params[:taxon] = merged_params
+      end
     end
   end
 end

data/app/controllers/spree/admin/ticket_transfer_rules_controller.rb

@@ -0,0 +1,47 @@
+module Spree
+  module Admin
+    class TicketTransferRulesController < Spree::Admin::ResourceController
+      def index
+        @search = model_class.ransack(params[:q])
+        @ticket_transfer_rules = @search.result
+                                        .order(ruleable_type: :asc, ruleable_id: :asc, currency: :asc)
+                                        .page(params[:page])
+                                        .per(25)
+      end
+
+      private
+
+      def model_class
+        SpreeCmCommissioner::TicketTransferRule
+      end
+
+      def object_name
+        'spree_cm_commissioner_ticket_transfer_rule'
+      end
+
+      def collection_url
+        admin_ticket_transfer_rules_url
+      end
+
+      def location_after_save
+        edit_admin_ticket_transfer_rule_path(@object)
+      end
+
+      def permitted_resource_params
+        params.require(:spree_cm_commissioner_ticket_transfer_rule).permit(
+          :ruleable_type,
+          :ruleable_id,
+          :active,
+          :currency,
+          :fee_percentage,
+          :fee_flat_amount,
+          :cooldown_hours,
+          :max_transfers_per_ticket,
+          :event_cutoff_hours,
+          :min_price,
+          :max_price
+        )
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/ticket_transfers_controller.rb

@@ -0,0 +1,61 @@
+module Spree
+  module Admin
+    class TicketTransfersController < Spree::Admin::ResourceController
+      helper SpreeCmCommissioner::Admin::TicketTransfersHelper
+
+      def index
+        @search = model_class.includes(:from_user, :to_user, :from_guest).ransack(params[:q])
+        @ticket_transfers = @search.result.order(created_at: :desc).page(params[:page]).per(15)
+      end
+
+      def show
+        @ticket_transfer = model_class.includes(:order, from_guest: [:event, { line_item: :order }]).find(params[:id])
+      end
+
+      def state_changes
+        @ticket_transfer = model_class.find(params[:id])
+        @state_changes = @ticket_transfer.state_changes.includes(:user).order(created_at: :desc)
+      end
+
+      def cancel
+        @ticket_transfer = model_class.find(params[:id])
+        result = SpreeCmCommissioner::TicketTransfers::Cancel.call(
+          ticket_transfer: @ticket_transfer,
+          acting_user: try_spree_current_user
+        )
+
+        if result.success?
+          flash[:success] = 'Ticket transfer has been cancelled' # rubocop:disable Rails/I18nLocaleTexts
+        else
+          flash[:error] = result.error.value
+        end
+        redirect_to admin_ticket_transfer_path(@ticket_transfer)
+      end
+
+      def update_settlement_status
+        @ticket_transfer = model_class.find(params[:id])
+        new_status = params[:settlement_status]
+
+        unless @ticket_transfer.purchase? && @ticket_transfer.completed?
+          flash[:error] = 'Settlement status can only be updated for completed purchase transfers' # rubocop:disable Rails/I18nLocaleTexts
+          redirect_to admin_ticket_transfer_path(@ticket_transfer)
+          return
+        end
+
+        if @ticket_transfer.update(settlement_status: new_status)
+          @ticket_transfer.log_settlement_status_changes(user_id: try_spree_current_user&.id)
+          flash[:success] = "Settlement status updated to #{new_status}"
+        else
+          flash[:error] = @ticket_transfer.errors.full_messages.to_sentence.presence || 'Failed to update settlement status'
+        end
+        redirect_to admin_ticket_transfer_path(@ticket_transfer)
+      end
+
+      private
+
+      def model_class
+        SpreeCmCommissioner::TicketTransfer
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/account/recipients_controller.rb

@@ -0,0 +1,32 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module Account
+          class RecipientsController < ::Spree::Api::V2::ResourceController
+            before_action :require_spree_current_user
+
+            def show
+              identifier = params[:q].to_s.strip
+              return render_error_payload('Missing q parameter', 400) if identifier.blank?
+
+              user = SpreeCmCommissioner::RecipientSearcherQuery.new(identifier, MultiTenant.current_tenant_id).call
+
+              if user
+                render_serialized_payload { serialize_resource(user) }
+              else
+                render_error_payload('User not found', 404)
+              end
+            end
+
+            private
+
+            def resource_serializer
+              SpreeCmCommissioner::V2::Storefront::RecipientSerializer
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/guests_controller.rb

@@ -31,13 +31,15 @@ module Spree
           def create
             spree_authorize! :update, spree_current_order, order_token
 
-            resource = scope.new(guest_params)
+            result = SpreeCmCommissioner::Cart::CreateGuest.call(
+              line_item: parent,
+              options: guest_params
+            )
 
-            if resource.save
-              resource.save_and_move_to_next_stage
-              render_serialized_payload(201) { serialize_resource(resource) }
+            if result.success?
+              render_serialized_payload(201) { serialize_resource(result.value) }
             else
-              render_error_payload(resource.errors, 422)
+              render_error_payload(result.value.errors, 422)
             end
           end
 

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -19,6 +19,7 @@ module Spree
             @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
                                        .active
                                        .where(tenant_id: nil)
+                                       .where(preview: false)
                                        .order(position: :asc)
           end
         end

data/app/controllers/spree/api/v2/storefront/preview_products_controller.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewProductsController < ::Spree::Api::V2::Storefront::ProductsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super(**args).rewhere(preview: true).where(status: :active)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_sections_controller.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
+                                       .active
+                                       .where(tenant_id: nil)
+                                       .where(preview: true)
+                                       .where(id: section_ids)
+                                       .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_taxons_controller.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewTaxonsController < ::Spree::Api::V2::Storefront::TaxonsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            super(**args).rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/products_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module ProductsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::ProductsController.prepend(Spree::Api::V2::Storefront::ProductsControllerDecorator)

data/app/controllers/spree/api/v2/storefront/taxons_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module TaxonsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::TaxonsController.prepend(Spree::Api::V2::Storefront::TaxonsControllerDecorator)

data/app/controllers/spree/api/v2/storefront/ticket_transfer_acceptances_controller.rb

@@ -0,0 +1,32 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class TicketTransferAcceptancesController < ::Spree::Api::V2::ResourceController
+          before_action :require_spree_current_user
+
+          def create
+            ticket_transfer = SpreeCmCommissioner::TicketTransfer.find_by!(token: params[:ticket_transfer_id])
+
+            result = SpreeCmCommissioner::TicketTransfers::Accept.call(
+              ticket_transfer: ticket_transfer,
+              buyer: spree_current_user
+            )
+
+            if result.success?
+              render_serialized_payload(201) { serialize_resource(result.value[:ticket_transfer]) }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          private
+
+          def resource_serializer
+            SpreeCmCommissioner::V2::Storefront::TicketTransferSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/ticket_transfers_controller.rb

@@ -0,0 +1,117 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class TicketTransfersController < ::Spree::Api::V2::ResourceController
+          before_action :require_spree_current_user
+
+          def index
+            render_serialized_payload do
+              serialize_collection(paginated_collection)
+            end
+          end
+
+          def show
+            ticket_transfer = model_class.includes(:order, from_guest: [:event, { line_item: :product }]).find_by!(token: params[:id])
+            return render_error_payload(I18n.t('ticket_transfer.unauthorized_view'), 403) unless authorized_to_view?(ticket_transfer)
+
+            render_serialized_payload { serialize_resource(ticket_transfer) }
+          end
+
+          def preview_rule
+            result = SpreeCmCommissioner::TicketTransfers::PreviewRule.call(
+              from_guest_id: params[:guest_id],
+              currency: params[:currency] || 'USD'
+            )
+
+            if result.success?
+              render json: { data: result.value }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          def create
+            result = SpreeCmCommissioner::TicketTransfers::Initiate.call(
+              from_user_id: spree_current_user.id,
+              to_user_id: ticket_transfer_params[:to_user_id],
+              from_guest_id: ticket_transfer_params[:guest_id],
+              price: ticket_transfer_params[:price] || 0,
+              currency: ticket_transfer_params[:currency] || 'USD',
+              expires_at: ticket_transfer_params[:expires_at],
+              transfer_type: ticket_transfer_params[:transfer_type] || 'purchase'
+            )
+
+            if result.success?
+              render_serialized_payload(201) { serialize_resource(result.value[:ticket_transfer]) }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          def cancel
+            ticket_transfer = model_class.find_by!(token: params[:id])
+
+            result = SpreeCmCommissioner::TicketTransfers::Cancel.call(
+              ticket_transfer: ticket_transfer,
+              acting_user: spree_current_user
+            )
+
+            if result.success?
+              render_serialized_payload { serialize_resource(result.value[:ticket_transfer]) }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          def reject
+            ticket_transfer = model_class.find_by!(token: params[:id])
+
+            result = SpreeCmCommissioner::TicketTransfers::Reject.call(
+              ticket_transfer: ticket_transfer,
+              acting_user: spree_current_user
+            )
+
+            if result.success?
+              render_serialized_payload { serialize_resource(result.value[:ticket_transfer]) }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          private
+
+          def model_class
+            SpreeCmCommissioner::TicketTransfer
+          end
+
+          def collection
+            SpreeCmCommissioner::TicketTransfer.includes(:order,
+                                                         from_guest: [:event, { line_item: :product }]
+                                                        ).where(from_user_id: spree_current_user.id)
+          end
+
+          def resource_serializer
+            SpreeCmCommissioner::V2::Storefront::TicketTransferSerializer
+          end
+
+          def collection_serializer
+            SpreeCmCommissioner::V2::Storefront::TicketTransferSerializer
+          end
+
+          def ticket_transfer_params
+            params.require(:ticket_transfer).permit(:to_user_id, :guest_id, :price, :currency, :expires_at, :transfer_type)
+          end
+
+          # When sending to a specific user, only sender and that buyer can access.
+          def authorized_to_view?(ticket_transfer)
+            return true if ticket_transfer.to_user_id.blank?
+
+            current_user_id = spree_current_user&.id
+            ticket_transfer.from_user_id == current_user_id || ticket_transfer.to_user_id == current_user_id
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/transit/draft_orders_controller.rb

@@ -11,6 +11,7 @@ module Spree
             # - inbound_date: Date of inbound transit (optional)
             # - outbound_legs: Array of outbound leg details (required)
             # - inbound_legs: Array of inbound leg details (optional)
+            # - include_return: Whether to add the trip's "return included" add-on as a line item (optional)
             def create
               @outbound_legs = params[:outbound_legs].is_a?(Array) && params[:outbound_legs].any? ? build_legs(:outbound, params[:outbound_legs]) : []
               @inbound_legs  = params[:inbound_legs].is_a?(Array) && params[:inbound_legs].any? ? build_legs(:inbound, params[:inbound_legs]) : []
@@ -20,7 +21,8 @@ module Spree
                 inbound_date: params[:inbound_date]&.to_date,
                 outbound_legs: @outbound_legs,
                 inbound_legs: @inbound_legs,
-                user: spree_current_user
+                user: spree_current_user,
+                include_return: ActiveModel::Type::Boolean.new.cast(params[:include_return])
               )
 
               if result.success?