spree_cm_commissioner 2.8.7 → 2.8.9.pre.pre1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f8d11251736536036263c451dde5cb82e34a6d54b12fe116866a338346d8097
-  data.tar.gz: f1cec56cfe9db369b4bf70a40c8545e09fd2b89a9d0fd1e2d0547cf4818a04eb
+  metadata.gz: 21353bffad01d109c6d6cecd34a9a99fff871cd505adc678c725f94ed4e733ef
+  data.tar.gz: 55641da3ba827c4533e6362aa376abcbd33d8f454543fc289d45df56da772cce
 SHA512:
-  metadata.gz: b0d1ef1dca4921e6493b8455b31c31b9289444aa64b3d5378dc6d87c0676c081ee2c0148dfd3a46fb8572d30fb8fb86d6c53a24249768b3b9001fbb3f2f6a4fa
-  data.tar.gz: a3dfc479c74f38e3889e84ab72246fc01e31134a630563f4f3bf2b3713e3e13d2df1389a0bdf1aae4337e56d891cb6a6dc29e21570d28b84d9d75a5b1d1cd152
+  metadata.gz: 266f2dc7d634dcb279f1b84631ea17b07bb511c54b5212f58c0354fe32ea54ffb82cf37e2b349b60768f82fbb83959df4d5da4b6b41a6cf5bd1522b8efc91027
+  data.tar.gz: 1009f16a54fdb769f5885d00555500c4e30920622258d3ce0c5e06fe72be2da462e8e1d256dd79dfbd755f2221329f41fce398223cb9ad54a9c54524882e61f0

data/.gitignore

@@ -34,3 +34,9 @@ vendor/bundle/
 # Cursor
 .cursor
 dump.rdb
+# Added by code-review-graph
+.code-review-graph/
+.cursorrules
+.claude
+CLAUDE.md
+AGENTS.md

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.7)
+    spree_cm_commissioner (2.8.9.pre.pre1)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -16,6 +16,7 @@ module SpreeCmCommissioner
       GuestCardClassesController
       SeatLayoutController
       CmsPagesController
+      AdvertisementsController
     ].freeze
 
     # Priority 2: Semi-Static (1 hour)
@@ -25,6 +26,7 @@ module SpreeCmCommissioner
       HomepageDataController
       PopularRoutesController
       RoutePlacesController
+      ShowsController
     ].freeze
 
     # Priority 3: Moderate Freshness (30 minutes)

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -51,7 +51,10 @@ module Spree
       def permitted_resource_params
         segment_value = helpers.calculate_segment_value(params[:spree_cm_commissioner_homepage_section])
 
-        params.require(:spree_cm_commissioner_homepage_section).permit(:title, :description, :active, :tenant_id).merge(segment: segment_value)
+        params
+          .require(:spree_cm_commissioner_homepage_section)
+          .permit(:title, :description, :active, :tenant_id, :preview)
+          .merge(segment: segment_value)
       end
 
       def load_tenants

data/app/controllers/spree/admin/inventory_holds_controller.rb

@@ -9,6 +9,7 @@ module Spree
         q['s'] ||= 'created_at desc'
         q['created_at_gt'] = parse_time_or_nil(q['created_at_gt'], :beginning_of_day) if q['created_at_gt'].present?
         q['created_at_lt'] = parse_time_or_nil(q['created_at_lt'], :end_of_day) if q['created_at_lt'].present?
+        normalize_enum_filters!(q)
 
         @search = scope.ransack(q)
         result_scope = @search.result(distinct: true)
@@ -18,7 +19,11 @@ module Spree
                  .page(params[:page])
                  .per(params[:per_page] || Spree::Backend::Config[:admin_orders_per_page])
 
-        @status_counts = result_scope.reorder(nil).group(:status).count
+        # Status tab counts must reflect every other filter but NOT the status filter, so
+        # each tab shows how many holds it would return (otherwise selecting one status
+        # zeroes out all the other tabs).
+        @status_counts = scope.ransack(q.except('status_eq')).result(distinct: true)
+                              .reorder(nil).group(:status).count
       end
 
       def release
@@ -44,6 +49,20 @@ module Spree
 
       private
 
+      # `status` and `release_reason` are integer-backed enums. Ransack casts a string
+      # value for an integer column with String#to_i, so "payment_locked" becomes 0
+      # (== :pending) and every label silently filters to the wrong status. Translate
+      # enum labels to their stored integer before searching.
+      def normalize_enum_filters!(query)
+        {
+          'status_eq' => SpreeCmCommissioner::InventoryHold.statuses,
+          'release_reason_eq' => SpreeCmCommissioner::InventoryHold.release_reasons
+        }.each do |key, mapping|
+          value = query[key]
+          query[key] = mapping[value.to_s] if value.present? && mapping.key?(value.to_s)
+        end
+      end
+
       def back_params
         raw_params = params[:back_params].presence || params
         ActionController::Parameters.new(raw_params).permit(:page, :per_page, q: {})

data/app/controllers/spree/admin/taxons_controller_decorator.rb

@@ -3,6 +3,7 @@ module Spree
     module TaxonsControllerDecorator
       def self.prepended(base)
         base.before_action :build_assets, only: %i[create update]
+        base.before_action :normalize_sti_taxon_params, only: %i[create update]
       end
 
       # override
@@ -55,6 +56,24 @@ module Spree
         @taxon.build_ad_banner(attachment: permitted_resource_params.delete(:ad_banner)) if permitted_resource_params[:ad_banner]
         @taxon.build_video_banner(attachment: permitted_resource_params.delete(:video_banner)) if permitted_resource_params[:video_banner]
       end
+
+      # Some admin forms submit STI records under their class key
+      # (e.g. :spree_cm_commissioner_show) while Spree update reads :taxon.
+      # Merge both into :taxon so all edited fields are persisted.
+      def normalize_sti_taxon_params
+        return unless @taxon
+
+        sti_key = @taxon.class.model_name.param_key.to_sym
+        sti_params = params[sti_key]
+        return unless sti_params.is_a?(::ActionController::Parameters)
+
+        base_params = params[:taxon]
+        base_hash = base_params.is_a?(::ActionController::Parameters) ? base_params.to_unsafe_h : {}
+        sti_hash = sti_params.to_unsafe_h
+        merged_params = ::ActionController::Parameters.new(base_hash.merge(sti_hash))
+
+        params[:taxon] = merged_params
+      end
     end
   end
 end

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -19,6 +19,7 @@ module Spree
             @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
                                        .active
                                        .where(tenant_id: nil)
+                                       .where(preview: false)
                                        .order(position: :asc)
           end
         end

data/app/controllers/spree/api/v2/storefront/order_histories_controller.rb

@@ -30,13 +30,18 @@ module Spree
           private
 
           def collection
+            # WARNING: Do NOT remove .order(id: :desc).
+            # Mobile relies on this ordering for paginated order_histories.
+            # Removing it will cause mobile to paginate by oldest records first (last 10 oldest),
+            # breaking the "most recent orders" display on the order history screen.
+            # It related to user cancel or complete order flow, which relies on the most recent orders being returned first.
             if spree_current_user.present?
-              spree_current_user.orders.not_archived
+              spree_current_user.orders.not_archived.order(id: :desc)
             else
               order_tokens = Array(params[:order_tokens])
               return Spree::Order.none if order_tokens.empty?
 
-              Spree::Order.not_archived.without_user.where(token: order_tokens)
+              Spree::Order.not_archived.without_user.where(token: order_tokens).order(id: :desc)
             end
           end
 

data/app/controllers/spree/api/v2/storefront/preview_products_controller.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewProductsController < ::Spree::Api::V2::Storefront::ProductsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super(**args).rewhere(preview: true).where(status: :active)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_sections_controller.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
+                                       .active
+                                       .where(tenant_id: nil)
+                                       .where(preview: true)
+                                       .where(id: section_ids)
+                                       .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_taxons_controller.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewTaxonsController < ::Spree::Api::V2::Storefront::TaxonsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            super(**args).rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/products_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module ProductsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::ProductsController.prepend(Spree::Api::V2::Storefront::ProductsControllerDecorator)

data/app/controllers/spree/api/v2/storefront/taxons_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module TaxonsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::TaxonsController.prepend(Spree::Api::V2::Storefront::TaxonsControllerDecorator)

data/app/controllers/spree/api/v2/tenant/ad_campaigns_controller.rb

@@ -0,0 +1,25 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class AdCampaignsController < BaseController
+          private
+
+          def scope
+            Spree::Taxon.ad_campaigns
+                        .joins(:vendor)
+                        .includes(:advertisements)
+                        .where(spree_vendors: { tenant_id: @tenant.id })
+                        .where('spree_taxons.from_date <= ? OR spree_taxons.from_date IS NULL', Time.current)
+                        .where('spree_taxons.to_date >= ? OR spree_taxons.to_date IS NULL', Time.current)
+                        .order(created_at: :asc)
+          end
+
+          def collection_serializer
+            Spree::V2::Tenant::AdCampaignSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/base_controller.rb

@@ -16,6 +16,10 @@ module Spree
             set_current_tenant(@tenant)
           end
 
+          def current_vendor
+            @current_vendor ||= @tenant.active_vendor
+          end
+
           def render_serialized_payload(status = 200)
             render json: yield, status: status, content_type: content_type
           end

data/app/controllers/spree/api/v2/tenant/episodes_controller.rb

@@ -0,0 +1,38 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class EpisodesController < BaseController
+          private
+
+          def model_class
+            SpreeCmCommissioner::ShowEpisode
+          end
+
+          def resource
+            @resource ||= scope.find(params[:id])
+          end
+
+          def scope
+            current_season.episodes.where(product_type: :show_episode).includes(:voting_sessions, :vote_packages)
+          end
+
+          def current_season
+            @current_season ||= SpreeCmCommissioner::Show
+                                .where(vendor_id: @tenant.vendors.select(:id))
+                                .where.not(parent_id: nil)
+                                .find_by!(slug: params[:show_id])
+          end
+
+          def resource_serializer
+            Spree::V2::Tenant::ShowEpisodeSerializer
+          end
+
+          def collection_serializer
+            Spree::V2::Tenant::ShowEpisodeSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/free_vote_claims_controller.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class FreeVoteClaimsController < BaseController
+          before_action :require_spree_current_user
+
+          def create
+            show = current_vendor.shows.find(params[:show_id])
+
+            result = SpreeCmCommissioner::VotingCredits::ClaimFreeVotes.new(
+              show: show,
+              user: spree_current_user,
+              tenant_id: MultiTenant.current_tenant_id,
+              votable_type: params[:votable_type],
+              votable_id: params[:votable_id]
+            ).call
+
+            if result.failure?
+              render_error_payload(result.error.to_s)
+            elsif result.value.nil?
+              head :no_content
+            else
+              render_serialized_payload { serialize_resource(result.value) }
+            end
+          end
+
+          private
+
+          def resource_serializer
+            Spree::V2::Tenant::VotingCreditSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/homepage_sections_controller.rb

@@ -5,6 +5,7 @@ module Spree
         class HomepageSectionsController < BaseController
           def collection
             @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .where(preview: false)
                                  .active
                                  .order(position: :asc)
           end

data/app/controllers/spree/api/v2/tenant/order_histories_controller.rb

@@ -37,13 +37,18 @@ module Spree
           end
 
           def collection
+            # WARNING: Do NOT remove .order(id: :desc).
+            # Mobile relies on this ordering for paginated order_histories.
+            # Removing it will cause mobile to paginate by oldest records first (last 10 oldest),
+            # breaking the "most recent orders" display on the order history screen.
+            # It related to user cancel or complete order flow, which relies on the most recent orders being returned first.
             if spree_current_user.present?
-              spree_current_user.orders.not_archived
+              spree_current_user.orders.not_archived.order(id: :desc)
             else
               order_tokens = Array(params[:order_tokens])
               return Spree::Order.none if order_tokens.empty?
 
-              Spree::Order.not_archived.without_user.where(token: order_tokens)
+              Spree::Order.not_archived.without_user.where(token: order_tokens).order(id: :desc)
             end
           end
 

data/app/controllers/spree/api/v2/tenant/preview_products_controller.rb

@@ -0,0 +1,47 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewProductsController < ProductsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super.where(status: :active, preview: true)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_sections_controller.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .active
+                                 .where(preview: true)
+                                 .where(id: section_ids)
+                                 .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_shows_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewShowsController < ShowsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            allowed_ids = spree_current_user.preview_roles
+                                            .where(previewable_type: SpreeCmCommissioner::Show.polymorphic_name)
+                                            .select(:previewable_id)
+            super.rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_taxons_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewTaxonsController < TaxonsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            MultiTenant.with(@tenant) do
+              model_class.where(preview: true, id: allowed_ids)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/products_controller.rb

@@ -21,7 +21,7 @@ module Spree
 
           def scope
             MultiTenant.with(@tenant) do
-              model_class.where(tenant_id: MultiTenant.current_tenant_id)
+              model_class.where(tenant_id: MultiTenant.current_tenant_id, preview: false)
             end
           end
 

data/app/controllers/spree/api/v2/tenant/show_contestants_controller.rb

@@ -0,0 +1,52 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class ShowContestantsController < BaseController
+          private
+
+          # override
+          def model_class
+            SpreeCmCommissioner::ShowContestant
+          end
+
+          # override
+          def scope
+            return model_class.none unless current_show
+
+            model_class
+              .where(show_id: current_show.id)
+              .includes(
+                :show_contestant_images,
+                :show_contestant_videos,
+                :current_voting_session,
+                :voting_contestants,
+                assigned_show_person: :show_person_images,
+                show: [
+                  :parent,
+                  { episodes: :voting_sessions },
+                  { seasons: { episodes: :voting_sessions } }
+                ]
+              )
+          end
+
+          def current_show
+            @current_show ||= show_scope.find_by!(slug: params[:show_id])
+          end
+
+          def show_scope
+            vendor_ids = @tenant.vendors.select(:id)
+            return SpreeCmCommissioner::Show.none if vendor_ids.blank?
+
+            SpreeCmCommissioner::Show.where(vendor_id: vendor_ids)
+          end
+
+          # override
+          def resource_serializer
+            Spree::V2::Tenant::ShowContestantSerializer
+          end
+        end
+      end
+    end
+  end
+end