spree_cm_commissioner 2.9.0 → 2.9.1.pre.pre2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2887149aa3d7b984f85a248a19ce14f006cab9cf0871c029b3c2e3ea3d5c71fd
-  data.tar.gz: 4e2d3e9795feabdbcfaeade160c22ce589025f403cf1f86000cef6e12d7194d5
+  metadata.gz: 44f0714e8ec1fab5074038112f26db55308feffc75b103ccda9e9d5d5d38409a
+  data.tar.gz: 7f963001ae3a8de9f3f829d03eb83f6a2d310cf5a28ddafc477473e1b2fa9678
 SHA512:
-  metadata.gz: 51766ff04913bebdad7e9a0f906738f731de1feb3a10e2418d5dbbc95d68d09816b61d75da54900e5b836600d3762787a19491182dd13899627a773ec5a2b42f
-  data.tar.gz: 6777256bdada7cfbd7e4c147e4d4a13f921b9be104369924af9694dacc5e8c61a5bed58be0ce945242b5004ea32720769aa07e4bf98687998635fc0444b38aa3
+  metadata.gz: 2afbdbb418fbdca1c4ebfb9c6327a5fb0394663b87881e3ce56950c1aca7e4a1467708c6249ad2bab098564349d432187866966b6704e662ca87b34966466760
+  data.tar.gz: 569d3213e604558bf4d17134aa51fd8cb2e854780f141187a6bff0af167070fe4c53b5f9eda404f4c38c47659aa79fed702ad1f801dc61d9d62d9ceb775e4480

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.9.0)
+    spree_cm_commissioner (2.9.1.pre.pre2)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/spree/api/v2/storefront/waiting_room_sessions_controller.rb

@@ -14,7 +14,8 @@ module Spree
               tenant_id: nil,
               remote_ip: request.remote_ip,
               waiting_guest_firebase_doc_id: params[:waiting_guest_firebase_doc_id],
-              page_path: params[:page_path]
+              page_path: params[:page_path],
+              device_attributes: permitted_device_attributes
             )
 
             if context.success?
@@ -27,6 +28,12 @@ module Spree
           def resource_serializer
             SpreeCmCommissioner::V2::Storefront::WaitingRoomSessionSerializer
           end
+
+          private
+
+          def permitted_device_attributes
+            params.permit(*SpreeCmCommissioner::WaitingRoomSessionCreator::PERMITTED_DEVICE_ATTRIBUTES)
+          end
         end
       end
     end

data/app/controllers/spree/api/v2/tenant/user_account_linkages_controller.rb

@@ -15,7 +15,8 @@ module Spree
             context = SpreeCmCommissioner::AccountLinkage.call(
               user: spree_current_user,
               id_token: params[:id_token],
-              fb_access_token: params[:fb_access_token]
+              fb_access_token: params[:fb_access_token],
+              fb_jwt: params[:fb_jwt]
             )
 
             if context.success?

data/app/controllers/spree/api/v2/tenant/voting_contestants_controller.rb

@@ -12,8 +12,7 @@ module Spree
                             .includes(:voting_session, :show_contestant,
                                       :show_contestant_images, :show_contestant_videos,
                                       :advanced_to, :advanced_from
-                            )
-                            .order(:id)
+                            ).order(:position)
           end
 
           # override

data/app/controllers/spree/api/v2/tenant/waiting_room_sessions_controller.rb

@@ -10,7 +10,8 @@ module Spree
               tenant_id: MultiTenant.current_tenant_id,
               remote_ip: request.remote_ip,
               waiting_guest_firebase_doc_id: params[:waiting_guest_firebase_doc_id],
-              page_path: params[:page_path]
+              page_path: params[:page_path],
+              device_attributes: permitted_device_attributes
             )
 
             if context.success?
@@ -23,6 +24,12 @@ module Spree
           def resource_serializer
             Spree::V2::Tenant::WaitingRoomSessionSerializer
           end
+
+          private
+
+          def permitted_device_attributes
+            params.permit(*SpreeCmCommissioner::WaitingRoomSessionCreator::PERMITTED_DEVICE_ATTRIBUTES)
+          end
         end
       end
     end

data/app/controllers/spree_cm_commissioner/admin/orders_controller_decorator.rb

@@ -10,6 +10,7 @@ module SpreeCmCommissioner
           close_adjustments cart channel set_channel
           accept_all reject_all alert_request_to_vendor
           notifications fire_notification queue_webhooks_requests update_order_status
+          update_internal_note
         ]
 
         base.before_action :initialize_notification_methods, only: %i[
@@ -81,6 +82,14 @@ module SpreeCmCommissioner
 
       def notifications; end
 
+      def update_internal_note
+        internal_note = params.dig(:order, :internal_note).to_s.strip.presence
+        @order.update_columns(internal_note: internal_note, updated_at: Time.current) # rubocop:disable Rails/SkipsModelValidations
+
+        flash[:success] = Spree.t(:internal_note_updated, default: 'Internal note updated')
+        redirect_back fallback_location: spree.edit_admin_order_url(@order)
+      end
+
       def update_order_status
         if @order.next
           flash[:success] = I18n.t('orders.update_order_status.success')

data/app/interactors/spree_cm_commissioner/account_linkage.rb

@@ -1,7 +1,7 @@
 module SpreeCmCommissioner
   class AccountLinkage
     include Interactor
-    delegate :id_token, :fb_access_token, :user, to: :context
+    delegate :id_token, :fb_access_token, :fb_jwt, :user, to: :context
 
     # id_token:, user:
     def call
@@ -10,6 +10,8 @@ module SpreeCmCommissioner
         handle_id_token
       elsif fb_access_token.present?
         handle_fb_access_token
+      elsif fb_jwt.present?
+        handle_fb_jwt
       else
         context.fail!(message: 'missing_social_token')
       end
@@ -37,6 +39,16 @@ module SpreeCmCommissioner
       end
     end
 
+    def handle_fb_jwt
+      facebook_context = FetchFacebookUserDataFromJwt.call(fb_jwt: fb_jwt)
+
+      if facebook_context.success?
+        build_user_identify_provider(facebook_context.provider)
+      else
+        context.fail!(message: facebook_context.message)
+      end
+    end
+
     # {
     #   provider_name: provider_name,
     #   email: email,

data/app/interactors/spree_cm_commissioner/fetch_facebook_user_data_from_jwt.rb

@@ -0,0 +1,90 @@
+module SpreeCmCommissioner
+  class FetchFacebookUserDataFromJwt < BaseInteractor
+    JWKS_URL = 'https://limited.facebook.com/.well-known/oauth/openid/jwks/'.freeze
+    EXPECTED_ISSUER = 'https://www.facebook.com'.freeze
+
+    delegate :fb_jwt, to: :context
+
+    def call
+      context.fail!(message: 'fb_jwt_missing') if fb_jwt.blank?
+
+      claim = decode_jwt
+
+      context.provider = {
+        identity_type: SpreeCmCommissioner::UserIdentityProvider.identity_types[:facebook],
+        sub: claim['sub'],
+        name: claim['name'],
+        email: nil, # Facebook Limited Login JWT does not include email
+        first_name: claim['given_name'],
+        last_name: claim['family_name'],
+        picture: claim['picture']
+      }
+    end
+
+    private
+
+    def decode_jwt
+      result = JWT.decode(fb_jwt, nil, true, algorithms: ['RS256']) do |header|
+        kid = header['kid']
+        jwk_data = find_jwk(fetch_jwks, kid) || find_jwk(refresh_jwks, kid)
+        context.fail!(message: 'invalid_facebook_jwt_kid') unless jwk_data
+        public_key_from_jwk(jwk_data)
+      end
+
+      claim = result[0]
+      context.fail!(message: 'invalid_facebook_issuer') if claim['iss'] != EXPECTED_ISSUER
+      claim
+    rescue JWT::ExpiredSignature
+      context.fail!(message: 'fb_jwt_expired')
+    rescue JWT::DecodeError => e
+      context.fail!(message: e.message)
+    end
+
+    def find_jwk(jwks, kid)
+      jwks['keys'].find { |k| k['kid'] == kid }
+    end
+
+    def public_key_from_jwk(jwk_data)
+      n = OpenSSL::BN.new(Base64.urlsafe_decode64(jwk_data['n']), 2)
+      e = OpenSSL::BN.new(Base64.urlsafe_decode64(jwk_data['e']), 2)
+
+      pkcs1 = OpenSSL::ASN1::Sequence([
+        OpenSSL::ASN1::Integer(n),
+        OpenSSL::ASN1::Integer(e)
+      ]
+                                     )
+
+      spki = OpenSSL::ASN1::Sequence([
+        OpenSSL::ASN1::Sequence([
+          OpenSSL::ASN1::ObjectId('rsaEncryption'),
+          OpenSSL::ASN1::Null(nil)
+        ]
+                               ),
+        OpenSSL::ASN1::BitString(pkcs1.to_der)
+      ]
+                                    )
+
+      OpenSSL::PKey::RSA.new(spki.to_der)
+    end
+
+    def refresh_jwks
+      Rails.cache.delete('facebook-limited-jwks')
+      fetch_jwks
+    end
+
+    def fetch_jwks
+      Rails.cache.fetch('facebook-limited-jwks', expires_in: 1.hour) do
+        url = URI(JWKS_URL)
+        http = Net::HTTP.new(url.host, url.port)
+        http.use_ssl = true
+        http.open_timeout = 5
+        http.read_timeout = 10
+        response = http.get(url.request_uri)
+        JSON.parse(response.body)
+      end
+    rescue StandardError => e
+      CmAppLogger.error("Facebook JWKS fetch error: #{e.message}")
+      context.fail!(message: 'facebook_jwks_fetch_error')
+    end
+  end
+end

data/app/interactors/spree_cm_commissioner/user_fb_jwt_authenticator.rb

@@ -0,0 +1,37 @@
+module SpreeCmCommissioner
+  class UserFbJwtAuthenticator < BaseInteractor
+    delegate :fb_jwt, :tenant_id, to: :context
+
+    # :fb_jwt, :tenant_id (optional)
+    def call
+      context.fail!(message: 'fb_jwt_missing') unless fb_jwt
+      context.fail!(message: checker.message) if checker.failure?
+
+      context.user = if checker.user.nil?
+                       register_user
+                     else
+                       checker.user
+                     end
+
+      context.fail!(message: 'account_temporarily_deleted') if context.user.soft_deleted?
+    end
+
+    private
+
+    def checker
+      @checker ||= SpreeCmCommissioner::UserFbJwtChecker.call(
+        fb_jwt: fb_jwt,
+        tenant_id: tenant_id
+      )
+    end
+
+    def register_user
+      register_context = SpreeCmCommissioner::UserRegistrationWithFbToken.call(
+        provider: checker.provider,
+        tenant_id: tenant_id
+      )
+
+      register_context.user
+    end
+  end
+end

data/app/interactors/spree_cm_commissioner/user_fb_jwt_checker.rb

@@ -0,0 +1,20 @@
+module SpreeCmCommissioner
+  class UserFbJwtChecker < BaseInteractor
+    delegate :tenant_id, :fb_jwt, to: :context
+
+    def call
+      fb_data = SpreeCmCommissioner::FetchFacebookUserDataFromJwt.call(fb_jwt: fb_jwt)
+      context.fail!(message: fb_data.message) if fb_data.failure?
+
+      context.provider = fb_data.provider
+
+      identity_checker = SpreeCmCommissioner::UserIdentityChecker.call(
+        identity_type: context.provider[:identity_type],
+        sub: context.provider[:sub],
+        tenant_id: tenant_id
+      )
+
+      context.user = identity_checker.success? ? identity_checker.user : nil
+    end
+  end
+end

data/app/interactors/spree_cm_commissioner/user_fb_token_authenticator.rb

@@ -5,6 +5,7 @@ module SpreeCmCommissioner
     # :fb_access_token, :tenant_id (optional)
     def call
       context.fail!(message: 'fb_access_token_missing') unless fb_access_token
+      context.fail!(message: checker.message) if checker.failure?
 
       context.user = if checker.user.nil?
                        register_user

data/app/interactors/spree_cm_commissioner/waiting_guests_caller.rb

@@ -12,14 +12,23 @@ module SpreeCmCommissioner
     # Firestore bounds a batch update by payload size (10 MiB); 500 ops/commit leaves us far under that.
     FIRESTORE_BATCH_SIZE = (ENV['WAITING_ROOM_FIRESTORE_BATCH_SIZE'] || 500).to_i
 
+    # Release at most this many guests per run, even when far more slots are free. A capacity spike
+    # (cold start / lull → active_sessions low → available_slots ≈ max_sessions, e.g. 900) would
+    # otherwise release every queued guest at once, dumping 900 simultaneous session-token requests
+    # on the server. Capping paces entry at ~MAX_CALLS_PER_RUN/min (the caller runs every minute);
+    # the rest stay queued and drain over the following runs. Matches the stamper's MAX_ETA_BATCH_SIZE
+    # so the per-batch ETA the app shows reflects the real release rate.
+    MAX_CALLS_PER_RUN = (ENV['WAITING_ROOM_MAX_CALLS_PER_RUN'] || 50).to_i
+
     def call
       started_at = Time.zone.now
       available_slots = fetch_available_slots
+      call_limit = [available_slots, MAX_CALLS_PER_RUN].min
 
       # Always run through to mark_as — even with no slots — so the lobby keeps a fresh heartbeat
       # (logs.waiting_guests_caller_job) during peak/full periods instead of going stale
       # and looking like a dead cron.
-      long_waiting_guests = available_slots.positive? ? fetch_long_waiting_guests(available_slots) : []
+      long_waiting_guests = call_limit.positive? ? fetch_long_waiting_guests(call_limit) : []
       calling_all(long_waiting_guests) if long_waiting_guests.any?
 
       mark_as(
@@ -28,7 +37,7 @@ module SpreeCmCommissioner
         has_queue: waiting_exists?([previous_records_path, records_path]),
         avg_wait_to_enter_seconds: compute_avg_wait_to_enter_seconds(long_waiting_guests),
         avg_queue_to_enter_seconds: compute_avg_queue_to_enter_seconds(long_waiting_guests),
-        recent_slots_per_call: available_slots.positive? ? available_slots : nil,
+        recent_slots_per_call: call_limit.positive? ? call_limit : nil,
         active_sessions: @active_sessions,
         max_sessions: @max_sessions,
         logs: call_logs(started_at: started_at, called_count: long_waiting_guests.size)

data/app/interactors/spree_cm_commissioner/waiting_room_session_creator.rb

@@ -3,10 +3,21 @@ require 'zlib'
 
 module SpreeCmCommissioner
   class WaitingRoomSessionCreator < BaseInteractor
-    delegate :remote_ip, :waiting_guest_firebase_doc_id, :page_path, :tenant_id, to: :context
+    delegate :remote_ip, :waiting_guest_firebase_doc_id, :page_path, :tenant_id,
+             :device_attributes, to: :context
 
     SESSION_CREATION_LOCK_KEY = 'waiting_room_session_creation'.freeze
 
+    # Device attributes the client may set on the session. device_id and
+    # device_fingerprint are real columns; the rest are virtual columns backed by
+    # public/private metadata (see WaitingRoomSession). Anything else the client
+    # sends is dropped so we never persist arbitrary payloads.
+    PERMITTED_DEVICE_ATTRIBUTES = %w[
+      device_id device_fingerprint
+      os_name os_version device_model device_manufacturer device_type
+      device_environment app_version app_build timezone network_type
+    ].freeze
+
     def call
       return context.fail!(message: 'must_provide_waiting_guest_firebase_doc_id') if waiting_guest_firebase_doc_id.blank?
       return context.fail!(message: 'must_provide_remote_ip') if remote_ip.blank?
@@ -53,15 +64,29 @@ module SpreeCmCommissioner
       # create or renew
       context.room_session = SpreeCmCommissioner::WaitingRoomSession.where(guest_identifier: waiting_guest_firebase_doc_id).first_or_initialize
       context.room_session.assign_attributes(
-        jwt_token: context.jwt_token,
-        expired_at: expired_at,
-        remote_ip: remote_ip,
-        page_path: page_path,
-        tenant_id: tenant_id
+        {
+          jwt_token: context.jwt_token,
+          expired_at: expired_at,
+          remote_ip: remote_ip,
+          page_path: page_path,
+          tenant_id: tenant_id
+        }.merge(sanitized_device_attributes)
       )
+
       context.room_session.save!
     end
 
+    # Whitelisted, flat device attributes. Real columns (device_id,
+    # device_fingerprint) and virtual columns (StoreMetadata) are assigned the
+    # same way; the model routes each to the right store.
+    def sanitized_device_attributes
+      attributes = device_attributes
+      attributes = attributes.to_unsafe_h if attributes.respond_to?(:to_unsafe_h)
+      return {} unless attributes.is_a?(Hash)
+
+      attributes.symbolize_keys.slice(*PERMITTED_DEVICE_ATTRIBUTES.map(&:to_sym))
+    end
+
     def log_to_firebase
       SpreeCmCommissioner::WaitingRoomSessionFirebaseLoggerJob.perform_later(
         room_session_id: context.room_session.id,

data/app/models/spree_cm_commissioner/order_decorator.rb

@@ -71,6 +71,12 @@ module SpreeCmCommissioner
       end
     end
 
+    # override
+    def after_resume
+      super
+      update_columns(canceled_at: nil, canceler_id: nil) # rubocop:disable Rails/SkipsModelValidations
+    end
+
     # override to allow storing cancellation reason in one DB write
     def canceled_by(user, cancellation_reason: nil)
       transaction do

data/app/models/spree_cm_commissioner/voting_contestant.rb

@@ -23,19 +23,20 @@ module SpreeCmCommissioner
     before_destroy :prevent_if_has_advanced_to
     before_destroy :prevent_if_pre_vote_session
 
+    acts_as_list scope: :voting_session_id
+
     validates :eliminated_via, presence: true, if: :eliminated?
 
-    # Uniqueness validation: vote_number must be unique per contestant per voting_session
-    # Scope: [show_contestant_id, voting_session_id]
+    # Uniqueness validation: vote_number must be unique among contestants within the same voting_session
+    # Scope: voting_session_id
     #
     # | contestant_id | session_id | vote_number | Status | Reason                    |
     # |---------------|-----------|-------------|--------|---------------------------|
     # | 1             | 1         | 1           | ✓ OK   | First record              |
-    # | 1             | 1         | 1           | ✗ FAIL | Duplicate in same scope   |
+    # | 2             | 1         | 1           | ✗ FAIL | Duplicate in same session |
     # | 1             | 1         | 2           | ✓ OK   | Can update/change number  |
-    # | 2             | 1         | 1           | ✓ OK   | Different contestant      |
     # | 1             | 2         | 1           | ✓ OK   | Different session         |
-    validates :vote_number, uniqueness: { scope: %i[show_contestant_id voting_session_id], allow_nil: true }
+    validates :vote_number, uniqueness: { scope: :voting_session_id, allow_nil: true }
 
     delegate :name, :contestant_number, :category, :gender, :eliminated_at, to: :show_contestant, allow_nil: true
     delegate :can_vote?, to: :voting_session, allow_nil: true

data/app/models/spree_cm_commissioner/waiting_room_session.rb

@@ -1,5 +1,19 @@
 module SpreeCmCommissioner
   class WaitingRoomSession < Base
+    include SpreeCmCommissioner::StoreMetadata
+
+    store_public_metadata :os_name, :string # e.g. "ios", "android", "web"
+    store_public_metadata :os_version, :string # e.g. "17.4", "14"
+    store_public_metadata :device_model, :string # e.g. "iPhone15,2", "Pixel 8"
+    store_public_metadata :device_manufacturer, :string # e.g. "Apple", "Google", "Samsung"
+    store_public_metadata :device_type, :string # e.g. "phone", "tablet", "web", "desktop"
+    store_public_metadata :device_environment, :string # e.g. "physical", "emulator", "simulator"
+    store_public_metadata :app_version, :string # e.g. "2.3.1"
+    store_public_metadata :app_build, :string # e.g. "450"
+
+    store_private_metadata :timezone, :string # e.g. "ICT", "+07", "UTC"
+    store_private_metadata :network_type, :string # e.g. "wifi", "cellular", "ethernet", "none"
+
     validates :jwt_token, presence: true
     validates :expired_at, presence: true
     validates :remote_ip, presence: true

data/app/overrides/spree/admin/shared/_order_summary/internal_note.html.erb.deface

@@ -0,0 +1,23 @@
+<!-- insert_after "li:has(#order_channel)" -->
+
+<li class="list-group-item d-flex justify-content-between align-items-center" data-hook="admin_order_tab_internal_note">
+  <small><%= Spree.t(:internal_note, default: 'Internal Note') %></small>
+  <span class="d-flex align-items-center" style="gap: .35rem; min-width: 0;">
+    <% if @order.internal_note.present? %>
+      <span class="small text-muted text-truncate text-right" style="max-width: 150px;" title="<%= @order.internal_note %>"><%= @order.internal_note %></span>
+      <% if can?(:update, @order) %>
+        <%= link_to '#', class: 'btn btn-light btn-sm with-tip icon-link p-1',
+              title: Spree.t(:edit),
+              data: { toggle: 'modal', target: "#internal-note-modal-#{@order.number}" } do %>
+          <%= svg_icon name: 'pencil-square.svg', width: '13', height: '13' %>
+        <% end %>
+      <% end %>
+    <% elsif can?(:update, @order) %>
+      <%= link_to Spree.t(:add_internal_note, default: 'Add note'), '#',
+            class: 'small',
+            data: { toggle: 'modal', target: "#internal-note-modal-#{@order.number}" } %>
+    <% else %>
+      <span class="small text-muted font-italic"><%= Spree.t(:no_internal_note, default: 'No note') %></span>
+    <% end %>
+  </span>
+</li>

data/app/overrides/spree/admin/shared/_order_summary/internal_note_modal.html.erb.deface

@@ -0,0 +1,40 @@
+<!-- insert_after "#order_tab_summary" -->
+
+<% if can?(:update, @order) %>
+  <div id="internal-note-modal-<%= @order.number %>" class="modal fade" tabindex="-1" role="dialog" aria-labelledby="internalNoteModalLabel-<%= @order.number %>" aria-hidden="true">
+    <div class="modal-dialog" role="document">
+      <div class="modal-content">
+        <div class="modal-header">
+          <h5 class="modal-title mr-auto" id="internalNoteModalLabel-<%= @order.number %>"><%= Spree.t(:internal_note, default: 'Internal Note') %></h5>
+          <button type="button" class="close" data-dismiss="modal" aria-label="<%= Spree.t(:close) %>">
+            <span aria-hidden="true">&times;</span>
+          </button>
+        </div>
+
+        <%= form_with model: @order, url: update_internal_note_admin_order_path(@order), method: :patch, local: true do |f| %>
+          <div class="modal-body">
+            <div class="form-group text-left text-start">
+              <%= f.text_area :internal_note, rows: 5, class: 'form-control' %>
+            </div>
+          </div>
+          <div class="modal-footer d-flex justify-end">
+            <button type="button" class="btn btn-light" data-dismiss="modal"><%= Spree.t(:close) %></button>
+            <%= f.submit Spree.t(:save_internal_note, default: 'Save Note'), class: 'btn btn-primary' %>
+          </div>
+        <% end %>
+      </div>
+    </div>
+  </div>
+
+  <%# The summary renders inside #contextualSideMenu (position: sticky/fixed), whose %>
+  <%# stacking context sits below Bootstrap's body-level .modal-backdrop. Relocate the %>
+  <%# modal to <body> so it layers above the backdrop and stays interactive. %>
+  <script>
+    (function () {
+      var modal = document.getElementById('internal-note-modal-<%= @order.number %>');
+      if (modal && modal.parentNode !== document.body) {
+        document.body.appendChild(modal);
+      }
+    })();
+  </script>
+<% end %>

data/app/request_schemas/spree_cm_commissioner/user_account_linkage_request_schema.rb

@@ -3,13 +3,15 @@ module SpreeCmCommissioner
     params do
       optional(:id_token).maybe(:string)
       optional(:fb_access_token).maybe(:string)
+      optional(:fb_jwt).maybe(:string)
     end
 
-    rule(:id_token, :fb_access_token) do
+    rule(:id_token, :fb_access_token, :fb_jwt) do
       idt = values[:id_token]
       fbt = values[:fb_access_token]
+      fbj = values[:fb_jwt]
 
-      key(:base).failure('id_token_or_fb_access_token_required') if blank_or_empty?(idt) && blank_or_empty?(fbt)
+      key(:base).failure('id_token_or_fb_access_token_required') if blank_or_empty?(idt) && blank_or_empty?(fbt) && blank_or_empty?(fbj)
     end
 
     private

data/app/serializers/spree/v2/tenant/show_episode_serializer.rb

@@ -2,15 +2,7 @@ module Spree
   module V2
     module Tenant
       class ShowEpisodeSerializer < BaseSerializer
-        attributes :episode_number, :name, :scheduled_at, :ends_at
-
-        attribute :status do |episode|
-          if episode.current?
-            'current'
-          elsif episode.upcoming?
-            'upcoming'
-          end
-        end
+        attributes :episode_number, :name, :scheduled_at, :ends_at, :status, :preview
 
         has_many :voting_sessions, serializer: Spree::V2::Tenant::VotingSessionSerializer
         has_many :vote_packages, serializer: Spree::V2::Tenant::VotePackageSerializer

data/app/services/spree_cm_commissioner/user_authenticator.rb

@@ -4,6 +4,7 @@ module SpreeCmCommissioner
     # :username, :password
     # :id_token
     # :fb_access_token
+    # :fb_jwt
     # :telegram_init_data, :tg_bot
     # :session_id
 
@@ -42,6 +43,9 @@ module SpreeCmCommissioner
       when 'facebook_auth'
         options = { fb_access_token: params[:fb_access_token], tenant_id: tenant_id }
         SpreeCmCommissioner::UserFbTokenAuthenticator.call(options)
+      when 'facebook_jwt_auth'
+        options = { fb_jwt: params[:fb_jwt], tenant_id: tenant_id }
+        SpreeCmCommissioner::UserFbJwtAuthenticator.call(options)
       when 'telegram_web_app_auth'
         options = { telegram_init_data: params[:telegram_init_data], telegram_bot_username: params[:tg_bot] }
         SpreeCmCommissioner::UserTelegramWebAppAuthenticator.call(options)
@@ -55,6 +59,7 @@ module SpreeCmCommissioner
       return 'login_auth' if params.key?(:username) && params.key?(:password)
       return 'social_auth' if params.key?(:id_token)
       return 'facebook_auth' if params.key?(:fb_access_token)
+      return 'facebook_jwt_auth' if params.key?(:fb_jwt)
       return 'telegram_web_app_auth' if params.key?(:telegram_init_data) && params.key?(:tg_bot)
       return 'vattanac_bank_web_app_auth' if params.key?(:session_id)
 

data/config/locales/en.yml

@@ -216,6 +216,11 @@ en:
     riel: "៛"
 
   spree:
+    internal_note: "Internal Note"
+    add_internal_note: "Add note"
+    no_internal_note: "No note"
+    save_internal_note: "Save Note"
+    internal_note_updated: "Internal note updated"
     voting_contestant_advancer:
       reversion_error: "Cannot eliminate here yet. This contestant appears in a later session."
     is_open_dated: "Is Open Dated Trip?"

data/config/locales/km.yml

@@ -200,6 +200,11 @@ km:
     riel: "៛"
 
   spree:
+    internal_note: "ចំណាំផ្ទៃក្នុង"
+    add_internal_note: "បន្ថែមចំណាំ"
+    no_internal_note: "គ្មានចំណាំ"
+    save_internal_note: "រក្សាទុកចំណាំ"
+    internal_note_updated: "បានរក្សាទុកចំណាំផ្ទៃក្នុង"
     voting_contestant_advancer:
       reversion_error: "មិនអាចដកចេញនៅវគ្គនេះបានទេ។ បេក្ខជននេះមាននៅវគ្គបោះឆ្នោតក្រោយ។"
     registered_by:

data/config/routes.rb

@@ -308,6 +308,7 @@ Spree::Core::Engine.add_routes do
         put :fire_notification
         put :queue_webhooks_requests
         put :update_order_status
+        patch :update_internal_note
       end
 
       resources :line_items, only: %i[edit update]

data/db/migrate/20260701000001_add_device_info_to_cm_waiting_room_sessions.rb

@@ -0,0 +1,14 @@
+class AddDeviceInfoToCmWaitingRoomSessions < ActiveRecord::Migration[7.0]
+  def change
+    # Indexed identifiers used for dedup / abuse detection.
+    add_column :cm_waiting_room_sessions, :device_id, :string, if_not_exists: true
+    add_column :cm_waiting_room_sessions, :device_fingerprint, :string, if_not_exists: true
+
+    # Typed device attributes live here via SpreeCmCommissioner::StoreMetadata.
+    add_column :cm_waiting_room_sessions, :public_metadata, :jsonb, default: {}, if_not_exists: true
+    add_column :cm_waiting_room_sessions, :private_metadata, :jsonb, default: {}, if_not_exists: true
+
+    add_index :cm_waiting_room_sessions, :device_id, if_not_exists: true
+    add_index :cm_waiting_room_sessions, :device_fingerprint, if_not_exists: true
+  end
+end

data/db/migrate/20260703065239_add_position_to_cm_voting_contestants.rb

@@ -0,0 +1,6 @@
+class AddPositionToCmVotingContestants < ActiveRecord::Migration[7.0]
+  def change
+    add_column :cm_voting_contestants, :position, :integer, default: nil, if_not_exists: true
+    add_index :cm_voting_contestants, :position, if_not_exists: true
+  end
+end

data/lib/spree_cm_commissioner/version.rb

@@ -1,5 +1,5 @@
 module SpreeCmCommissioner
-  VERSION = '2.9.0'.freeze
+  VERSION = '2.9.1.pre.pre2'.freeze
 
   module_function
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_cm_commissioner
 version: !ruby/object:Gem::Version
-  version: 2.9.0
+  version: 2.9.1.pre.pre2
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-01 00:00:00.000000000 Z
+date: 2026-07-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree
@@ -1243,6 +1243,7 @@ files:
 - app/interactors/spree_cm_commissioner/event_qr_generator.rb
 - app/interactors/spree_cm_commissioner/existing_account_checker.rb
 - app/interactors/spree_cm_commissioner/fetch_facebook_user_data.rb
+- app/interactors/spree_cm_commissioner/fetch_facebook_user_data_from_jwt.rb
 - app/interactors/spree_cm_commissioner/firebase_email_fetcher.rb
 - app/interactors/spree_cm_commissioner/firebase_email_fetcher_cron_executor.rb
 - app/interactors/spree_cm_commissioner/firebase_id_token_provider.rb
@@ -1319,6 +1320,8 @@ files:
 - app/interactors/spree_cm_commissioner/user_contact_updater.rb
 - app/interactors/spree_cm_commissioner/user_device_token_deregister.rb
 - app/interactors/spree_cm_commissioner/user_device_token_register.rb
+- app/interactors/spree_cm_commissioner/user_fb_jwt_authenticator.rb
+- app/interactors/spree_cm_commissioner/user_fb_jwt_checker.rb
 - app/interactors/spree_cm_commissioner/user_fb_token_authenticator.rb
 - app/interactors/spree_cm_commissioner/user_fb_token_checker.rb
 - app/interactors/spree_cm_commissioner/user_forgotten_password_updater.rb
@@ -1828,6 +1831,8 @@ files:
 - app/overrides/spree/admin/shared/_main_menu/sidebar_customer_notification.html.erb.deface
 - app/overrides/spree/admin/shared/_main_menu/sidebar_homepage.html.erb.deface
 - app/overrides/spree/admin/shared/_order_summary/adjustment_total.html.erb.deface
+- app/overrides/spree/admin/shared/_order_summary/internal_note.html.erb.deface
+- app/overrides/spree/admin/shared/_order_summary/internal_note_modal.html.erb.deface
 - app/overrides/spree/admin/shared/_order_summary/order_status.html.erb.deface
 - app/overrides/spree/admin/shared/_order_summary/request_state.html.erb.deface
 - app/overrides/spree/admin/shared/_order_tabs/guests.html.erb.deface
@@ -3407,6 +3412,8 @@ files:
 - db/migrate/20260623082233_create_cm_claims.rb
 - db/migrate/20260624175658_add_unique_index_to_cm_claims.rb
 - db/migrate/20260629000001_add_term_of_use_to_spree_vendors.rb
+- db/migrate/20260701000001_add_device_info_to_cm_waiting_room_sessions.rb
+- db/migrate/20260703065239_add_position_to_cm_voting_contestants.rb
 - docker-compose.yml
 - docs/api/scoped-access-token-endpoints.md
 - docs/option_types/attr_types.md
@@ -3619,9 +3626,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '2.7'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements:
 - none
 rubygems_version: 3.4.1