spree_cm_commissioner 2.8.6 → 2.8.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4099b82b9c0b05292b810ed04e00714e847c0f9757912ccfdb2fe9f98d0e79a9
-  data.tar.gz: 4047434d7d6aebaeca53abe171efbb02df51651cd31fb19824effc88e6dbaf0b
+  metadata.gz: 4f8d11251736536036263c451dde5cb82e34a6d54b12fe116866a338346d8097
+  data.tar.gz: f1cec56cfe9db369b4bf70a40c8545e09fd2b89a9d0fd1e2d0547cf4818a04eb
 SHA512:
-  metadata.gz: 3834ecd9e3496a49180c8be39c5bf8e4b81828f1f3a9dab73122fc772e63264e8f1d6a1ce30c634223e910b696bcedb30ecfcf1fe60ace739f1c1dc725a119df
-  data.tar.gz: b47b5250978bdd1eebcebcc74329f79ae74837a86d3167006539b68d73dc8835b81c03d877ae46441e939667f913dcf615c9ffeedccc21d980cda1e953eb96c1
+  metadata.gz: b0d1ef1dca4921e6493b8455b31c31b9289444aa64b3d5378dc6d87c0676c081ee2c0148dfd3a46fb8572d30fb8fb86d6c53a24249768b3b9001fbb3f2f6a4fa
+  data.tar.gz: a3dfc479c74f38e3889e84ab72246fc01e31134a630563f4f3bf2b3713e3e13d2df1389a0bdf1aae4337e56d891cb6a6dc29e21570d28b84d9d75a5b1d1cd152

data/.env.example

@@ -22,6 +22,11 @@ WAITING_ROOM_MIN_SESSIONS_COUNT=5
 WAITING_ROOM_DISABLED=no
 WAITING_ROOM_POSITION_STAMP_LIMIT=1000
 WAITING_ROOM_FIRESTORE_BATCH_SIZE=500
+WAITING_ROOM_MIN_WAIT_TO_ENTER_SECONDS=600 # Waiting Room step floor (10 min)
+WAITING_ROOM_MIN_QUEUE_TO_ENTER_SECONDS=300 # Queue step floor (5 min)
+WAITING_ROOM_MAX_WAIT_TO_DISPLAY_SECONDS=3600 # above this the ETA is hidden (1 h)
+WAITING_ROOM_CALLER_INTERVAL_SECONDS=60 # how often the caller runs; match the waiting_guests_caller cron
+WAITING_ROOM_MAX_ETA_BATCH_SIZE=50 # cap on batch size assumed when estimating the ETA
 
 # Vattanac Bank
 VATTANAC_AES_SECRET_KEY= ""
@@ -68,3 +73,6 @@ HOLD_COOLDOWN_AFTER_EXPIRY_IN_MINUTES=2     # Cooldown period before a user can
 
 # See: app/models/spree_cm_commissioner/payment_decorator.rb
 PAYMENT_INCOMPLETE_NOTIFICATION_DELAY_IN_MINUTES=5  # Delay before notifying a customer that their order is still unpaid after payment is created
+
+# See: app/jobs/spree_cm_commissioner/telegram_alerts/order_integrity_check_job.rb
+ORDER_INTEGRITY_TELEGRAM_ALERT_ENABLED="no"  # Set to yes to enable the order integrity Telegram alert job (off by default to avoid flooding Telegram rate limits during traffic spikes)

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.6)
+    spree_cm_commissioner (2.8.7)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/spree/admin/import_new_orders_controller.rb

@@ -23,6 +23,31 @@ module Spree
           end
         end
       end
+
+      # POST: /admin/orders/import_new_orders/:id/cancel
+      def cancel
+        import = model_class.find(params[:id])
+        show_url = spree.admin_import_new_order_url(import.id)
+
+        unless import.cancellable?
+          flash[:error] = 'These orders cannot be canceled.' # rubocop:disable Rails/I18nLocaleTexts
+          redirect_to show_url and return
+        end
+
+        if params[:confirm_name].to_s.strip != import.name.to_s.strip
+          flash[:error] = 'Import name did not match. Cancellation aborted.' # rubocop:disable Rails/I18nLocaleTexts
+          redirect_to show_url and return
+        end
+
+        SpreeCmCommissioner::CancelImportOrderJob.perform_later(
+          import_order_id: import.id,
+          canceled_by_user_id: spree_current_user.id,
+          cancellation_reason: params[:cancellation_reason].to_s.strip.presence
+        )
+
+        flash[:success] = "Canceling orders from \"#{import.name}\". This runs in the background."
+        redirect_to show_url
+      end
     end
   end
 end

data/app/controllers/spree/api/v2/storefront/account/orders_controller_decorator.rb

@@ -44,6 +44,11 @@ module Spree
             def collection_finder
               SpreeCmCommissioner::Orders::FindByState
             end
+
+            # this allows fetching a single order regardless of its state.
+            def resource_finder
+              SpreeCmCommissioner::Orders::FindByAllState
+            end
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/order_histories_controller.rb

@@ -31,12 +31,12 @@ module Spree
 
           def collection
             if spree_current_user.present?
-              spree_current_user.orders.payment.not_archived
+              spree_current_user.orders.not_archived
             else
               order_tokens = Array(params[:order_tokens])
               return Spree::Order.none if order_tokens.empty?
 
-              Spree::Order.payment.not_archived.without_user.where(token: order_tokens)
+              Spree::Order.not_archived.without_user.where(token: order_tokens)
             end
           end
 

data/app/controllers/spree/api/v2/storefront/ticket_transfers_controller.rb

@@ -86,9 +86,10 @@ module Spree
           end
 
           def collection
-            SpreeCmCommissioner::TicketTransfer.includes(:order,
-                                                         from_guest: [:event, { line_item: :product }]
-                                                        ).where(from_user_id: spree_current_user.id)
+            SpreeCmCommissioner::TicketTransfer
+              .includes(:order, from_guest: [:event, { line_item: :product }])
+              .where(from_user_id: spree_current_user.id)
+              .order(id: :desc)
           end
 
           def resource_serializer

data/app/controllers/spree/api/v2/tenant/order_histories_controller.rb

@@ -38,12 +38,12 @@ module Spree
 
           def collection
             if spree_current_user.present?
-              spree_current_user.orders.payment.not_archived
+              spree_current_user.orders.not_archived
             else
               order_tokens = Array(params[:order_tokens])
               return Spree::Order.none if order_tokens.empty?
 
-              Spree::Order.payment.not_archived.without_user.where(token: order_tokens)
+              Spree::Order.not_archived.without_user.where(token: order_tokens)
             end
           end
 

data/app/finders/spree_cm_commissioner/orders/find.rb

@@ -4,14 +4,30 @@
 module SpreeCmCommissioner
   module Orders
     class Find
+      CURRENT_CART_STATES = %w[cart address].freeze
+      CART_MAX_AGE_IN_MINUTES = ENV.fetch('CART_MAX_AGE_IN_MINUTES', '720').to_i # Default: 12 hours
+
       def execute(store:, user:, currency:, token: nil, state: nil)
+        state = Array(state).map(&:to_s)
+
         params = { store_id: store.id, currency: currency }
         params[:state] = state if state.present?
 
-        return find_by_token(params, token) if token.present?
-        return find_by_user(params, user) if user.present?
+        order = if token.present?
+                  find_by_token(params, token)
+                elsif user.present?
+                  find_by_user(params, user)
+                end
+
+        # Only enforce hold and age expiration when fetching current cart states ('cart' or 'address').
+        # For other states (like 'payment,complete'), we want to return the order even if it's old or expired
+        # because some pages on client still need some specific state of order to display.
+        if state.intersect?(CURRENT_CART_STATES)
+          return nil if hold_expired?(order)
+          return nil if cart_too_old?(order)
+        end
 
-        nil
+        order
       end
 
       def find_by_token(params, token)
@@ -24,6 +40,20 @@ module SpreeCmCommissioner
         scope.order(created_at: :desc).find_by(params)
       end
 
+      def hold_expired?(order)
+        return false if order.nil?
+
+        # Check if the order has a hold_expires_at column and if it has already passed
+        order.hold_expires_at.present? && order.hold_expires_at < Time.current
+      end
+
+      def cart_too_old?(order)
+        return false if order.nil?
+
+        # Treat the cart as active based on its last update time, not its creation time.
+        order.updated_at < CART_MAX_AGE_IN_MINUTES.minutes.ago
+      end
+
       private
 
       def scope

data/app/finders/spree_cm_commissioner/orders/find_by_all_state.rb

@@ -0,0 +1,11 @@
+module SpreeCmCommissioner
+  module Orders
+    class FindByAllState < Spree::Orders::FindComplete
+      private
+
+      def scope
+        user? ? user.orders.includes(scope_includes) : Spree::Order.includes(scope_includes)
+      end
+    end
+  end
+end

data/app/interactors/spree_cm_commissioner/waiting_guests_caller.rb

@@ -3,8 +3,11 @@ require 'google/cloud/firestore'
 # TODO: alert when available_slots is negative.
 module SpreeCmCommissioner
   class WaitingGuestsCaller < BaseInteractor
-    MIN_WAIT_TO_ENTER_SECONDS = 120 # 2 min floor — Waiting Room step (full journey, more uncertainty)
-    MIN_QUEUE_TO_ENTER_SECONDS = 60 # 1 min floor — Queue step (position assigned, one caller cycle minimum)
+    # 10 min floor — Waiting Room step (full journey, most uncertainty)
+    MIN_WAIT_TO_ENTER_SECONDS = (ENV['WAITING_ROOM_MIN_WAIT_TO_ENTER_SECONDS'] || 600).to_i
+
+    # 5 min floor — Queue step (position assigned, sub-segment of the journey)
+    MIN_QUEUE_TO_ENTER_SECONDS = (ENV['WAITING_ROOM_MIN_QUEUE_TO_ENTER_SECONDS'] || 300).to_i
 
     # Firestore bounds a batch update by payload size (10 MiB); 500 ops/commit leaves us far under that.
     FIRESTORE_BATCH_SIZE = (ENV['WAITING_ROOM_FIRESTORE_BATCH_SIZE'] || 500).to_i
@@ -20,7 +23,8 @@ module SpreeCmCommissioner
         full: long_waiting_guests.size >= available_slots,
         available_slots: available_slots - long_waiting_guests.size,
         avg_wait_to_enter_seconds: compute_avg_wait_to_enter_seconds(long_waiting_guests),
-        avg_queue_to_enter_seconds: compute_avg_queue_to_enter_seconds(long_waiting_guests)
+        avg_queue_to_enter_seconds: compute_avg_queue_to_enter_seconds(long_waiting_guests),
+        slots_per_call: available_slots
       )
     end
 
@@ -96,10 +100,18 @@ module SpreeCmCommissioner
     end
 
     # merge: true so we preserve the published `waiting_guests_records_path` on the lobby doc.
-    def mark_as(full:, available_slots:, avg_wait_to_enter_seconds: nil, avg_queue_to_enter_seconds: nil)
+    def mark_as(
+      full:,
+      available_slots:,
+      avg_wait_to_enter_seconds: nil,
+      avg_queue_to_enter_seconds: nil,
+      slots_per_call: nil
+    )
       data = { full: full, available_slots: available_slots }
       data[:avg_wait_to_enter_seconds] = avg_wait_to_enter_seconds if avg_wait_to_enter_seconds
       data[:avg_queue_to_enter_seconds] = avg_queue_to_enter_seconds if avg_queue_to_enter_seconds
+      data[:slots_per_call] = slots_per_call if slots_per_call
+
       lobby_document.set(data, merge: true)
     end
 

data/app/jobs/concerns/spree_cm_commissioner/idempotent_job.rb

@@ -0,0 +1,12 @@
+module SpreeCmCommissioner
+  module IdempotentJob
+    def with_idempotency(key = nil, &block)
+      SpreeCmCommissioner::IdempotencyKey.run_once(key.presence || default_idempotency_key, &block)
+    end
+
+    # Namespaced so the key is self-describing in the DB (no `source` column needed).
+    def default_idempotency_key
+      "#{self.class.name}:#{job_id}"
+    end
+  end
+end

data/app/jobs/spree_cm_commissioner/cancel_import_order_job.rb

@@ -0,0 +1,11 @@
+module SpreeCmCommissioner
+  class CancelImportOrderJob < ApplicationUniqueJob
+    def perform(options = {})
+      SpreeCmCommissioner::Imports::Orders::Cancel.new(
+        import_order_id: options[:import_order_id],
+        canceled_by_user_id: options[:canceled_by_user_id],
+        cancellation_reason: options[:cancellation_reason]
+      ).call
+    end
+  end
+end

data/app/jobs/spree_cm_commissioner/idempotency_keys/prune_job.rb

@@ -0,0 +1,20 @@
+# Prunes old idempotency keys. Keys only matter within the retry window
+# (minutes–hours), so anything older than the cutoff is safe to delete.
+# The `created_at` index supports the delete.
+module SpreeCmCommissioner
+  module IdempotencyKeys
+    class PruneJob < SpreeCmCommissioner::ApplicationJob
+      DEFAULT_CUTOFF_DAYS = 3
+
+      queue_as :default
+
+      def perform(cutoff_days = DEFAULT_CUTOFF_DAYS)
+        days = [cutoff_days.to_i, 1].max
+
+        SpreeCmCommissioner::IdempotencyKey
+          .where(created_at: ...days.days.ago)
+          .delete_all
+      end
+    end
+  end
+end

data/app/jobs/spree_cm_commissioner/inventory_items/bulk_adjust_quantities_job.rb

@@ -1,12 +1,30 @@
 module SpreeCmCommissioner
   module InventoryItems
     class BulkAdjustQuantitiesJob < ApplicationUniqueJob
+      include SpreeCmCommissioner::IdempotentJob
+
+      def perform(options = {})
+        with_idempotency(idempotency_key_for(options)) do
+          bulk_adjust_quantities!(options)
+        end
+      end
+
+      private
+
+      # Dedup on the line items being synced, so a re-pushed payload for the same
+      # line items no-ops. An explicit key wins; with no line items we fall back to
+      # the per-enqueue job_id (returning nil lets with_idempotency apply that default).
+      def idempotency_key_for(options)
+        return options[:idempotency_key] if options[:idempotency_key].present?
+        return nil if options[:line_item_ids].blank?
+
+        "line_item:#{options[:line_item_ids].compact.uniq.sort.join(':')}"
+      end
+
       # :line_item_ids, :inventory_id_and_quantities, :caller_source
       #
-      # :line_item_ids is included for unique job key generation to prevent duplicate jobs,
-      # though it's not used in the perform method implementation.
       # :caller_source is a string like "ClassName#method" identifying who enqueued the job.
-      def perform(options = {})
+      def bulk_adjust_quantities!(options = {})
         SpreeCmCommissioner::InventoryItems::BulkAdjustQuantities.call!(
           inventory_id_and_quantities: options[:inventory_id_and_quantities],
           caller_source: options[:caller_source]

data/app/jobs/spree_cm_commissioner/inventory_items/bulk_adjust_quantities_on_hold_job.rb

@@ -1,14 +1,45 @@
 module SpreeCmCommissioner
   module InventoryItems
     class BulkAdjustQuantitiesOnHoldJob < ApplicationUniqueJob
+      include SpreeCmCommissioner::IdempotentJob
+
       queue_as :default
 
+      def perform(options = {})
+        with_idempotency(idempotency_key_for(options)) do
+          bulk_adjust_quantities_on_hold(options)
+        end
+      end
+
+      private
+
+      # Dedup on the order + the exact adjustment set, so a re-pushed identical
+      # on-hold payload no-ops while a genuinely different one re-applies. An explicit
+      # key wins; with no order_id we fall back to the per-enqueue job_id (returning
+      # nil lets with_idempotency apply that default).
+      def idempotency_key_for(options)
+        return options[:idempotency_key] if options[:idempotency_key].present?
+        return nil if options[:order_id].blank?
+
+        "order:#{options[:order_id]}:hold:#{adjustments_fingerprint(options[:inventory_id_and_quantities])}"
+      end
+
+      # Readable, order-independent fingerprint of the adjustment payload, e.g. "1=2,2=-1".
+      # Delimiter hierarchy: ":" separates key fields, "," separates adjustments, "=" pairs id/qty.
+      def adjustments_fingerprint(adjustments)
+        Array(adjustments)
+          .map { |adj| adj.with_indifferent_access.values_at(:inventory_id, :quantity) }
+          .sort_by { |inventory_id, quantity| [inventory_id.to_s, quantity.to_s] }
+          .map { |inventory_id, quantity| "#{inventory_id}=#{quantity}" }
+          .join(',')
+      end
+
       # :order_id, :inventory_id_and_quantities, :caller_source
       #
-      # :order_id is included for unique job key generation to prevent duplicate jobs,
-      # though it's not used in the perform method implementation.
+      # :order_id is used for unique idempotency key generation to prevent duplicate
+      # processing, though it's not used in the adjustment itself.
       # :caller_source is a string like "ClassName#method" identifying who enqueued the job.
-      def perform(options = {})
+      def bulk_adjust_quantities_on_hold(options = {})
         raise ArgumentError, 'order_id is required' if options[:order_id].blank?
         raise ArgumentError, 'inventory_id_and_quantities is required' if options[:inventory_id_and_quantities].blank?
 

data/app/jobs/spree_cm_commissioner/telegram_alerts/order_integrity_check_job.rb

@@ -0,0 +1,17 @@
+module SpreeCmCommissioner
+  module TelegramAlerts
+    class OrderIntegrityCheckJob < ApplicationUniqueJob
+      queue_as :telegram_bot
+      # retry: 0 sends failed jobs straight to the dead queue, avoiding retry storms.
+      # Guarded since sidekiq_options requires the host app's Sidekiq integration.
+      sidekiq_options retry: 0 if respond_to?(:sidekiq_options)
+
+      def perform(order_id:)
+        order = Spree::Order.find_by(id: order_id)
+        return unless order
+
+        SpreeCmCommissioner::TelegramAlerts::OrderIntegrityChecksRunner.call(order: order)
+      end
+    end
+  end
+end

data/app/jobs/spree_cm_commissioner/waiting_guests_caller_job.rb

@@ -1,6 +1,11 @@
+# Scheduled as a cron job (see cm-market-server/config/schedule.yml):
 # waiting_guests_caller:
 #   cron: "*/1 * * * *" # Every minute
 #   class: "SpreeCmCommissioner::WaitingGuestsCallerJob"
+#
+# NOTE: the queue ETA assumes one batch is released per run, so this interval must match
+# SpreeCmCommissioner::WaitingRoom::StampQueuePositions::CALLER_INTERVAL_SECONDS
+# (env WAITING_ROOM_CALLER_INTERVAL_SECONDS). If you change the cron, update that too.
 module SpreeCmCommissioner
   class WaitingGuestsCallerJob < ApplicationUniqueJob
     queue_as :waiting_room

data/app/models/concerns/spree_cm_commissioner/order_state_machine.rb

@@ -28,6 +28,7 @@ module SpreeCmCommissioner
       state_machine.after_transition to: :canceled, do: :restock_inventory!
 
       state_machine.after_transition to: :complete, do: :increment_route_fulfilled_order_count
+      state_machine.after_transition to: :complete, do: :run_order_complete_alerts
 
       scope :accepted, -> { where(request_state: 'accepted') }
 
@@ -322,6 +323,15 @@ module SpreeCmCommissioner
       TelegramNotificationSenderJob.perform_later(chat_id: chat_id, message: factory.message, parse_mode: factory.parse_mode)
     end
 
+    def run_order_complete_alerts
+      return unless ENV['ORDER_INTEGRITY_TELEGRAM_ALERT_ENABLED'] == 'yes'
+
+      # Allow async payment processors time to settle before checking for alerts
+      SpreeCmCommissioner::TelegramAlerts::OrderIntegrityCheckJob
+        .set(wait: 2.minutes)
+        .perform_later(order_id: id)
+    end
+
     def send_order_complete_telegram_alert_to_store
       title = '🎫 --- [NEW ORDER] ---'
       chat_id = store.preferred_telegram_order_alert_chat_id

data/app/models/concerns/spree_cm_commissioner/store_preference.rb

@@ -8,6 +8,7 @@ module SpreeCmCommissioner
       preference :telegram_order_request_alert_chat_id, :string
       preference :telegram_new_vendor_alert_chat_id, :string
       preference :telegram_new_event_alert_chat_id, :string
+      preference :telegram_order_anomaly_alert_chat_id, :string
       preference :assetlinks, :string, default: ''
       preference :apple_app_site_association, :string, default: ''
     end

data/app/models/spree_cm_commissioner/idempotency_key.rb

@@ -0,0 +1,21 @@
+module SpreeCmCommissioner
+  class IdempotencyKey < Base
+    # Runs the block exactly once per key. A re-run finds the row and no-ops.
+    # Key row + block side effects commit atomically. `requires_new: true` opens a
+    # savepoint so a rescued insert race rolls back only this block, not an outer txn.
+    def self.run_once(key)
+      return yield if key.blank?
+
+      transaction(requires_new: true) do
+        create!(key: key)
+        yield
+      end
+    rescue ActiveRecord::RecordNotUnique
+      CmAppLogger.log(
+        label: 'SpreeCmCommissioner::IdempotencyKey.run_once',
+        data: { event: 'duplicate_skipped', key: key }
+      )
+      nil # already applied by a concurrent run
+    end
+  end
+end

data/app/models/spree_cm_commissioner/import.rb

@@ -2,12 +2,13 @@ module SpreeCmCommissioner
   class Import < Base
     extend FriendlyId
 
-    enum :status, { :queue => 0, :progress => 1, :done => 2, :failed => 3 }
+    enum :status, { :queue => 0, :progress => 1, :done => 2, :failed => 3, :canceling => 4, :canceled => 5 }
     enum :import_type, { :new_order => 0, :existing_order => 1, :aba_payment_reference => 2 }
     has_one_attached :imported_file
     friendly_id :name, use: :slugged
 
     belongs_to :importable, polymorphic: true, optional: true
     belongs_to :import_by, class_name: 'Spree::User', optional: true
+    belongs_to :canceled_by, class_name: 'Spree::User', optional: true
   end
 end

data/app/models/spree_cm_commissioner/imported_order.rb

@@ -0,0 +1,6 @@
+module SpreeCmCommissioner
+  class ImportedOrder < Base
+    belongs_to :order, class_name: 'Spree::Order'
+    belongs_to :import_order, class_name: 'SpreeCmCommissioner::Imports::ImportOrder'
+  end
+end

data/app/models/spree_cm_commissioner/imports/import_order.rb

@@ -2,6 +2,27 @@ module SpreeCmCommissioner
   module Imports
     class ImportOrder < Import
       preference :fail_rows, :string
+      # Stored as ISO8601 string — Spree's preferences have no :datetime cast.
+      preference :canceled_at, :string
+      preference :cancellation_reason, :string
+
+      has_many :imported_orders,
+               class_name: 'SpreeCmCommissioner::ImportedOrder',
+               dependent: :destroy,
+               inverse_of: :import_order
+      has_many :orders, through: :imported_orders, source: :order
+
+      # done   → order rows were created; cancel will reverse them.
+      # failed → may have created some orders before failing; cancel cleans those up.
+      def cancellable?
+        done? || failed?
+      end
+
+      def canceled_at
+        return nil if preferred_canceled_at.blank?
+
+        Time.zone.parse(preferred_canceled_at)
+      end
     end
   end
 end

data/app/models/spree_cm_commissioner/order_decorator.rb

@@ -31,6 +31,10 @@ module SpreeCmCommissioner
 
       base.has_one :invoice, dependent: :destroy, class_name: 'SpreeCmCommissioner::Invoice'
       base.has_one :customer, class_name: 'SpreeCmCommissioner::Customer', through: :subscription
+      base.has_one :imported_order,
+                   class_name: 'SpreeCmCommissioner::ImportedOrder',
+                   dependent: :destroy,
+                   inverse_of: :order
 
       base.belongs_to :tenant, class_name: 'SpreeCmCommissioner::Tenant', optional: true
       base.belongs_to :subscription, class_name: 'SpreeCmCommissioner::Subscription', optional: true
@@ -80,6 +84,16 @@ module SpreeCmCommissioner
       end
     end
 
+    # override: imported orders are bulk-loaded from CSV and the contact email
+    # often belongs to a third party (organizer, importer) rather than the buyer,
+    # so the cancellation email would notify the wrong recipient. Normal orders
+    # still receive the cancel email via the spree_emails decorator.
+    def send_cancel_email
+      return if imported_order.present?
+
+      super
+    end
+
     # override spree_core behavior to intentionally avoid calling `next!`.
     #
     # Goal: keep the order state at 'cart' when restarting checkout, especially

data/app/models/spree_cm_commissioner/payment_decorator.rb

@@ -39,6 +39,7 @@ module SpreeCmCommissioner
     def after_completed
       super
       complete_ticket_transfer if ticket_transfer_completable?
+      order.run_order_complete_alerts
     end
 
     def can_void?

data/app/overrides/spree/admin/products/_form/allow_gift_transfer.html.erb.deface

@@ -1,4 +1,4 @@
-<!-- insert_after "[data-hook='admin_product_form_use_video_as_default']" -->
+<!-- insert_after "[data-hook='admin_product_form_promotionable']" -->
 
 <div data-hook="admin_product_form_allow_gift_transfer">
   <%= f.field_container :allow_gift_transfer do %>

data/app/overrides/spree/admin/products/_form/allow_transfer.html.erb.deface

@@ -1,4 +1,4 @@
-<!-- insert_after "[data-hook='admin_product_form_use_video_as_default']" -->
+<!-- insert_after "[data-hook='admin_product_form_promotionable']" -->
 
 <div data-hook="admin_product_form_allow_transfer">
   <%= f.field_container :allow_transfer do %>

data/app/overrides/spree/admin/stores/_form/store_preferences.html.erb.deface

@@ -55,6 +55,15 @@
             <% end %>
           </div>
 
+          <!-- Telegram Order Anomaly Alert Chat ID -->
+          <div class="col-6">
+            <%= f.field_container :preferred_telegram_order_anomaly_alert_chat_id do %>
+              <%= f.label :preferred_telegram_order_anomaly_alert_chat_id, Spree.t(:telegram_order_anomaly_alert_chat_id) %>
+              <%= f.text_field :preferred_telegram_order_anomaly_alert_chat_id, class: 'form-control' %>
+              <%= f.error_message_on :preferred_telegram_order_anomaly_alert_chat_id %>
+            <% end %>
+          </div>
+
           <!-- Assetlinks -->
           <div class="col-12">
             <%= f.field_container :preferred_assetlinks do %>

data/app/services/spree_cm_commissioner/imports/orders/cancel.rb

@@ -0,0 +1,63 @@
+module SpreeCmCommissioner
+  module Imports
+    module Orders
+      class Cancel < Base
+        BATCH_SIZE = ENV.fetch('CANCEL_IMPORT_ORDERS_BATCH_SIZE', '50').to_i
+
+        attr_reader :canceled_by_user_id, :cancellation_reason
+
+        def initialize(import_order_id:, canceled_by_user_id:, cancellation_reason: nil)
+          super(import_order_id: import_order_id)
+          @canceled_by_user_id = canceled_by_user_id
+          @cancellation_reason = cancellation_reason
+        end
+
+        def call
+          return if import_order.canceled?
+
+          mark_canceling!
+          cancel_orders
+          mark_canceled!
+        end
+
+        def cancel_orders
+          import_order.orders.includes(:imported_order).where.not(state: 'canceled').find_in_batches(batch_size: BATCH_SIZE) do |batch|
+            batch.each do |order|
+              order.canceled_by(canceled_by_user, cancellation_reason: cancellation_reason)
+            rescue StandardError => e
+              CmAppLogger.error(
+                label: "#{self.class.name}#cancel_orders",
+                data: { message: e.message, order_id: order.id, order_number: order.number }
+              )
+            end
+          end
+        end
+
+        private
+
+        def canceled_by_user
+          @canceled_by_user ||= Spree::User.find(canceled_by_user_id)
+        end
+
+        def mark_canceling!
+          # Skip on Sidekiq retry — keep the original canceler attribution.
+          return if import_order.canceling?
+
+          import_order.update!(
+            status: :canceling,
+            canceled_by_id: canceled_by_user_id,
+            preferred_canceled_at: Time.zone.now.iso8601,
+            preferred_cancellation_reason: cancellation_reason
+          )
+        end
+
+        def mark_canceled!
+          import_order.update!(
+            status: :canceled,
+            finished_at: Time.zone.now
+          )
+        end
+      end
+    end
+  end
+end