spree_cm_commissioner 2.9.1.pre.pre3 → 2.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 84c27f4187a23acbe9422e5b33cba6cca077dee5fe7a5e879acd3a5d06ee20c9
-  data.tar.gz: e46311b9f88d5a32ddb2272506e99dc1aee786acf800163a833134d942705bc1
+  metadata.gz: ea1290341adc6665c82f0ca238b21620b882af5eff415f8d76866938ada20bf1
+  data.tar.gz: 5299a81a6a985807378d89609eed247006ec984a7a304f23d48d6deb659b1dcf
 SHA512:
-  metadata.gz: f679ac4607b2c7a6b01d6151605cd7339ff57ad721bb18708cff888362b4c19bb9b7f9847016b3e1f93fd0ce31a74635eb6635de83f6764b89873fc44aeb8d2e
-  data.tar.gz: 0705c2ddb0b22a1bd2581645cfe18f2488b7aaf827ba90873130c782ac253fd95a50aa9795f982b863fc401744eb8654bc4c225caebec1af08965bab8144c72f
+  metadata.gz: 0015dfa2635e073b48c0b0d694e7958d1e7951dac7af8e693a80122a16fc348c413e92bfc4d7ef91da16d232d0c5781e24407165401cad9eeba45c698b01049c
+  data.tar.gz: 837d04df6961bd72fbdc3784f3f9ce2a5283d4001eb37cf6588d1c52e52e6c2a6f77d1ea05f9980a678a9859c9415e310e1bc261b579da03abca0cdeb4e6dd83

data/.env.example

@@ -32,6 +32,15 @@ WAITING_ROOM_MAX_ETA_BATCH_SIZE=50 # cap on batch size assumed when estimating t
 VATTANAC_AES_SECRET_KEY= ""
 VATTANAC_PUBLIC_KEY=""
 
+# Telegram OAuth (OpenID Connect) login.
+# client_id (audience) the mobile app uses when requesting an id_token from
+# Telegram. Verified as the `aud` claim in
+# app/interactors/spree_cm_commissioner/telegram_oauth_id_token_provider.rb
+TELEGRAM_OAUTH_CLIENT_ID=""
+# client_secret injected server-side when proxying the PKCE code -> id_token
+# exchange in app/interactors/spree_cm_commissioner/telegram_oauth_token_exchanger.rb
+TELEGRAM_OAUTH_CLIENT_SECRET=""
+
 # Organizer URL
 ORGANIZER_URL=http://127.0.0.1:4000/organizer
 

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.9.1.pre.pre3)
+    spree_cm_commissioner (2.9.2)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront
@@ -886,7 +886,7 @@ GEM
       spree_backend (>= 4.3.0.rc1)
       spree_emails (>= 4.3.0.rc1)
       spree_extension
-    spree_vpago (2.0.5.pre.beta)
+    spree_vpago (2.3.4)
       faraday
       google-cloud-firestore
       spree_api (>= 4.5)

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -27,6 +27,12 @@ module SpreeCmCommissioner
       PopularRoutesController
       RoutePlacesController
       ShowsController
+      EpisodesController
+      ShowPeopleController
+      ShowPersonAssignmentsController
+      ShowContestantsController
+      VotePackagesController
+      ShowEliminationSessionsController
     ].freeze
 
     # Priority 3: Moderate Freshness (30 minutes)
@@ -46,6 +52,7 @@ module SpreeCmCommissioner
     HIGH_FRESHNESS_CONTROLLERS = %w[
       TripsController
       TripSearchController
+      VotingContestantsController
     ].freeze
 
     def shared_max_age

data/app/controllers/concerns/spree_cm_commissioner/load_test_account_management.rb

@@ -0,0 +1,80 @@
+module SpreeCmCommissioner
+  module LoadTestAccountManagement
+    extend ActiveSupport::Concern
+
+    include SpreeCmCommissioner::LoadTestAccountScope
+
+    included do
+      before_action :authorize_load_testing!, only: %i[create bulk_destroy]
+    end
+
+    # Ensures N load-test accounts exist (idempotent) for `load_test_tenant` (nil = platform).
+    def create
+      result = SpreeCmCommissioner::LoadTest::CreateAccounts.call(**pool_params)
+
+      if result.success?
+        flash[:success] = "#{result.value[:created]} load-test accounts created."
+      else
+        flash[:error] = result.error.value
+      end
+
+      redirect_to manage_accounts_redirect_path
+    rescue StandardError => e
+      flash[:error] = e.message
+      redirect_to manage_accounts_redirect_path
+    end
+
+    def bulk_destroy
+      result = SpreeCmCommissioner::LoadTest::DestroyAccounts.call(**pool_params)
+
+      if result.success?
+        flash[:success] = "#{result.value[:destroyed]} destroyed, #{result.value[:not_found]} not found (already removed)."
+      else
+        flash[:error] = result.error.value
+      end
+
+      redirect_to manage_accounts_redirect_path
+    rescue StandardError => e
+      flash[:error] = e.message
+      redirect_to manage_accounts_redirect_path
+    end
+
+    private
+
+    # Default: cancancan's `authorize!`. Override in the including controller if it doesn't use
+    # cancancan (e.g. the organizer dashboard, which authorizes via RoleAuthorization/can_manage?).
+    def authorize_load_testing!
+      authorize! :manage, :load_testing
+    end
+
+    # Where create/bulk_destroy redirect back to. Must be implemented by the including controller
+    # (points at its own Load Test Accounts page).
+    def manage_accounts_redirect_path
+      raise NotImplementedError, "#{self.class} must implement #manage_accounts_redirect_path"
+    end
+
+    def pool_params
+      {
+        client_id: resolve_client_id,
+        count: params[:count].presence&.to_i || 20,
+        email_prefix: params[:email_prefix].presence || 'loadtest',
+        email_domain: params[:email_domain].presence
+      }
+    end
+
+    # Carries the form field values through the redirect so the index page re-renders with the
+    # same count/prefix/domain/page/per_page the admin/organizer just submitted with.
+    def redirect_params
+      params.slice(:count, :email_prefix, :email_domain, :page, :per_page).permit!
+    end
+
+    def resolve_client_id
+      return nil if load_test_tenant.nil?
+
+      application = Spree::OauthApplication.where(tenant_id: load_test_tenant.id).order(:id).first
+      raise "No OAuth application found for tenant #{load_test_tenant.name}" unless application
+
+      application.uid
+    end
+  end
+end

data/app/controllers/concerns/spree_cm_commissioner/load_test_account_scope.rb

@@ -0,0 +1,46 @@
+module SpreeCmCommissioner
+  module LoadTestAccountScope
+    extend ActiveSupport::Concern
+
+    private
+
+    # The tenant these accounts are scoped to. nil means the platform (no tenant). Must be
+    # implemented by the including controller.
+    def load_test_tenant
+      raise NotImplementedError, "#{self.class} must implement #load_test_tenant"
+    end
+
+    # Scan cap for the tenant-scoped candidate set below — bounds the query while still comfortably
+    # covering realistic load-test pool sizes.
+    EXPORT_SCAN_LIMIT = 2000
+
+    DEFAULT_EXPORT_PER_PAGE = 20
+
+    # Queried fresh from the DB every time, so it's always in sync with the current pool rather than
+    # a stashed file or session state.
+    #
+    # `load_test_account` lives in the `private_metadata` jsonb store (see UserDecorator's
+    # `store_private_metadata`), not a real column, so it can't be filtered in SQL directly —
+    # `store ..., coder: JSON` on top of an already-jsonb column double-encodes the value as a JSON
+    # string scalar rather than a native object, which breaks Postgres's `@>`/`->>` jsonb operators.
+    # Filter with the model's own `load_test_account?` in Ruby instead, which deserializes it
+    # correctly regardless of that storage quirk.
+    #
+    # Filtering happens in Ruby, so this is a plain Array by the time it needs paging — wrap it
+    # with Kaminari.paginate_array (same pattern as VoteLogsController) to get the same
+    # `page`/`per_page` params and `paginate` view helper every other index page in this app uses,
+    # instead of hand-rolled pagination just for this one page.
+    #
+    # Shared between LoadTestAccountManagement (lists/mutates the pool) and
+    # LoadTestLoginTokenGeneration (mints tokens for exactly the page shown), so both controllers
+    # resolve the same page the same way.
+    def export_accounts
+      matches = Spree::User.where(tenant_id: load_test_tenant&.id)
+                           .order(:id)
+                           .limit(EXPORT_SCAN_LIMIT)
+                           .select(&:load_test_account?)
+
+      Kaminari.paginate_array(matches).page(params[:page]).per(params[:per_page] || DEFAULT_EXPORT_PER_PAGE)
+    end
+  end
+end

data/app/controllers/concerns/spree_cm_commissioner/load_test_login_token_generation.rb

@@ -0,0 +1,53 @@
+module SpreeCmCommissioner
+  module LoadTestLoginTokenGeneration
+    extend ActiveSupport::Concern
+
+    include SpreeCmCommissioner::LoadTestAccountScope
+
+    included do
+      before_action :authorize_load_testing!, only: %i[create]
+    end
+
+    # Mints a fresh, stateless login-token JWT for each account on the requested page (same
+    # page/per_page as the Load Test Accounts index) and returns them as JSON. Nothing is
+    # persisted — the tokens are self-contained and verified by signature + expiry alone (see
+    # SpreeCmCommissioner::LoadTest::LoginToken).
+    def create
+      render json: login_tokens_payload(export_accounts)
+    rescue StandardError => e
+      render json: { error: e.message }, status: :unprocessable_entity
+    end
+
+    private
+
+    # Default: cancancan's `authorize!`. Override in the including controller if it doesn't use
+    # cancancan (e.g. the organizer dashboard, which authorizes via RoleAuthorization/can_manage?).
+    def authorize_load_testing!
+      authorize! :manage, :load_testing
+    end
+
+    # aud claim: the admin/organizer who minted the tokens. No fallback — both hosting controllers
+    # already require an authenticated user for every action here, so spree_current_user being
+    # absent would be a bug worth raising on, not silently mislabeling as 'system'.
+    def token_audience
+      spree_current_user.id
+    end
+
+    # user_id + the user_id_token are all k6 needs (email and expiry are already claims inside the
+    # JWT itself — sub / exp — and the token alone identifies + authenticates the account via
+    # UserPasswordAuthenticator's token-only path). expires_at is included too, purely so the
+    # generated-tokens list can show it to a human without decoding the JWT. Named `user_id_token`
+    # (not `id_token`) so UserAuthenticator can route on the params key alone, without decoding
+    # every request's `id_token` to check whether it's a load-test token.
+    def login_tokens_payload(accounts)
+      accounts.map do |user|
+        generated = SpreeCmCommissioner::LoadTest::LoginToken.generate(user: user, audience: token_audience)
+        {
+          user_id: user.id,
+          user_id_token: generated[:token],
+          expires_at: generated[:expires_at]
+        }
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/guests_controller.rb

@@ -80,8 +80,10 @@ module Spree
 
       def permitted_resource_params
         params.require(object_name).permit(:first_name, :last_name, :gender, :dob, :occupation_id,
-                                           :nationality_id, :age, :emergency_contact, :line_item_id,
-                                           :seat_number, :phone_number
+                                           :nationality_id, :age, :emergency_contact,
+                                           :line_item_id, :seat_number, :phone_number, :contact,
+                                           :other_organization, :expectation, :address,
+                                           :social_contact_platform, :social_contact
         )
       end
 

data/app/controllers/spree/admin/system/load_test_accounts_controller.rb

@@ -0,0 +1,24 @@
+module Spree
+  module Admin
+    module System
+      class LoadTestAccountsController < Spree::Admin::BaseController
+        include SpreeCmCommissioner::LoadTestAccountManagement
+
+        def index
+          @export_accounts = export_accounts
+        end
+
+        private
+
+        # nil = platform. Admin load testing never operates on a tenant.
+        def load_test_tenant
+          nil
+        end
+
+        def manage_accounts_redirect_path
+          admin_system_load_test_accounts_path(**redirect_params)
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/system/load_test_flows_controller.rb

@@ -0,0 +1,11 @@
+module Spree
+  module Admin
+    module System
+      class LoadTestFlowsController < Spree::Admin::BaseController
+        def index
+          @load_test_flows = SpreeCmCommissioner::LoadTest::FlowRegistry.for_workflow('platform')
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/system/load_test_login_tokens_controller.rb

@@ -0,0 +1,16 @@
+module Spree
+  module Admin
+    module System
+      class LoadTestLoginTokensController < Spree::Admin::BaseController
+        include SpreeCmCommissioner::LoadTestLoginTokenGeneration
+
+        private
+
+        # nil = platform. Admin load testing never operates on a tenant.
+        def load_test_tenant
+          nil
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/system/load_testing_controller.rb

@@ -0,0 +1,9 @@
+module Spree
+  module Admin
+    module System
+      class LoadTestingController < Spree::Admin::BaseController
+        def index; end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/draft_orders_controller.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class DraftOrdersController < ::Spree::Api::V2::ResourceController
+          # Creates a generic draft order from a locally-assembled cart in a single request.
+          # Endpoint: POST /api/v2/storefront/draft_orders
+          # Params:
+          # - line_items: Array of { variant_id:, quantity:, options: {}, public_metadata: {}, private_metadata: {} } (required)
+          def create
+            result = SpreeCmCommissioner::DraftOrder::Create.call(
+              line_items: draft_order_line_items,
+              user: spree_current_user,
+              store: current_store,
+              currency: current_currency
+            )
+
+            if result.success?
+              render_serialized_payload { serialize_resource(serializable_order(result.value[:order])) }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          private
+
+          # Re-fetch the created order with everything the enriched payload touches eager-loaded, so
+          # serializing N line items / M guests stays a fixed number of queries (not N+1 / M+1).
+          def serializable_order(order)
+            Spree::Order.where(id: order.id)
+                        .includes(line_items: :guests)
+                        .first || order
+          end
+
+          def draft_order_line_items
+            params.permit(line_items: [:variant_id, :quantity, { options: {}, public_metadata: {}, private_metadata: {} }])
+                  .fetch(:line_items, [])
+          end
+
+          # override
+          def resource_serializer
+            Spree::Api::Dependencies.storefront_cart_serializer.constantize
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_sections_controller.rb

@@ -7,17 +7,11 @@ module Spree
 
           # override
           def collection
-            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
-
-            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
-                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
-                          .select(:homepage_section_id)
-
             @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
                                        .active
                                        .where(tenant_id: nil)
                                        .where(preview: true)
-                                       .where(id: section_ids)
+                                       .where(id: SpreeCmCommissioner::HomepageSectionRelatable.section_ids_previewable_by(spree_current_user))
                                        .order(position: :asc)
           end
         end

data/app/controllers/spree/api/v2/storefront/telegram_oauth_tokens_controller.rb

@@ -0,0 +1,28 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        # Server-side relay for the Telegram OAuth PKCE `code -> id_token`
+        # exchange. The mobile/web clients cannot hit Telegram's /token endpoint
+        # directly, so they POST the PKCE parameters here and we forward them to
+        # Telegram, returning its response verbatim. Public endpoint: the caller
+        # has no access token yet (this is part of logging in).
+        class TelegramOauthTokensController < Spree::Api::V2::BaseController
+          def create
+            result = SpreeCmCommissioner::TelegramOauthTokenExchanger.call(exchange_params.to_h.symbolize_keys)
+
+            return render_error_payload(result.message) unless result.success?
+
+            render json: result.body, status: result.status, content_type: 'application/json'
+          end
+
+          private
+
+          def exchange_params
+            params.permit(:client_id, :code, :redirect_uri, :code_verifier)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/draft_orders_controller.rb

@@ -0,0 +1,49 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class DraftOrdersController < BaseController
+          # Creates a generic draft order from a locally-assembled cart in a single request.
+          # Endpoint: POST /api/v2/tenant/draft_orders
+          # Params:
+          # - line_items: Array of { variant_id:, quantity:, options: {}, public_metadata: {}, private_metadata: {} } (required)
+          def create
+            result = SpreeCmCommissioner::DraftOrder::Create.call(
+              line_items: draft_order_line_items,
+              user: spree_current_user,
+              store: current_store,
+              currency: current_currency,
+              tenant: @tenant
+            )
+
+            if result.success?
+              render_serialized_payload { serialize_resource(serializable_order(result.value[:order])) }
+            else
+              render_error_payload(result.error)
+            end
+          end
+
+          private
+
+          # Re-fetch the created order with everything the enriched payload touches eager-loaded, so
+          # serializing N line items / M guests stays a fixed number of queries (not N+1 / M+1).
+          def serializable_order(order)
+            Spree::Order.where(id: order.id)
+                        .includes(line_items: :guests)
+                        .first || order
+          end
+
+          def draft_order_line_items
+            params.permit(line_items: [:variant_id, :quantity, { options: {}, public_metadata: {}, private_metadata: {} }])
+                  .fetch(:line_items, [])
+          end
+
+          # override
+          def resource_serializer
+            Spree::V2::Tenant::CartSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_products_controller.rb

@@ -15,7 +15,7 @@ module Spree
                                       .select(:previewable_id)
 
             # Base: all active preview products from the parent scope.
-            base = super.where(status: :active, preview: true)
+            base = super.rewhere(preview: true).where(status: :active)
 
             # Path A: product has its own PreviewRole → user must hold that role directly.
             # Taxon membership is irrelevant for these products.

data/app/controllers/spree/api/v2/tenant/preview_sections_controller.rb

@@ -7,16 +7,10 @@ module Spree
 
           # override
           def collection
-            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
-
-            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
-                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
-                          .select(:homepage_section_id)
-
             @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
                                  .active
                                  .where(preview: true)
-                                 .where(id: section_ids)
+                                 .where(id: SpreeCmCommissioner::HomepageSectionRelatable.section_ids_previewable_by(spree_current_user))
                                  .order(position: :asc)
           end
         end

data/app/controllers/spree_cm_commissioner/admin/variants_controller_decorator.rb

@@ -55,6 +55,17 @@ module SpreeCmCommissioner
         option_value.validate
         option_value.name
       end
+
+      # Builds the load-test fixture for this variant so it can be used by the k6 booking flow.
+      # Shown on a page (with a check for whether the variant can be booked) for the tester to
+      # copy into the load_testing config.
+      def fixture
+        result = SpreeCmCommissioner::LoadTest::GenerateBookingTicketData.call(variant: @variant)
+        @fixture = result.value[:data]
+        @fixture_issues = result.value[:issues]
+        # The load_testing config calls it "local", not "development".
+        @fixture_env = Rails.env.development? ? 'local' : Rails.env.to_s
+      end
     end
   end
 end

data/app/controllers/spree_cm_commissioner/api/v2/storefront/checkout_controller_decorator.rb

@@ -5,10 +5,8 @@ module SpreeCmCommissioner
         module CheckoutControllerDecorator
           def self.prepended(base)
             base.include SpreeCmCommissioner::OrderConcern
-            base.include SpreeCmCommissioner::TurnstileProtectable
 
             base.before_action :set_load_test_bypass_current
-            base.before_action -> { verify_turnstile! }, only: %i[create_payment]
           end
 
           private

data/app/interactors/spree_cm_commissioner/telegram_oauth_id_token_provider.rb

@@ -0,0 +1,105 @@
+module SpreeCmCommissioner
+  # Verifies a Telegram "Login Library / OpenID Connect" id_token and extracts
+  # the user claims. The mobile app obtains the id_token directly from Telegram
+  # using PKCE (no client secret), so here we only need to validate the JWT
+  # signature against Telegram's public JWKS and check iss/aud/exp.
+  #
+  # Docs: https://core.telegram.org/bots/telegram-login
+  class TelegramOauthIdTokenProvider < BaseInteractor
+    ISSUER = 'https://oauth.telegram.org'.freeze
+    JWKS_URL = 'https://oauth.telegram.org/.well-known/jwks.json'.freeze
+    JWKS_CACHE_KEY = 'telegram-oauth-jwks'.freeze
+
+    # ruby-jwt ships native support for RS256 and ES256. Telegram's JWKS also
+    # advertises EdDSA/ES256K keys, but id_tokens are signed with RS256 (kid
+    # "oidc-1") by default.
+    SUPPORTED_ALGORITHMS = %w[RS256 ES256].freeze
+
+    # :id_token
+    def call
+      context.fail!(message: 'telegram_id_token_missing') if context.id_token.blank?
+
+      audience = expected_audience
+      context.fail!(message: 'telegram_oauth_client_id_not_configured') if audience.blank?
+
+      claim = decode_id_token(audience)
+      return if claim.nil?
+
+      context.claim = claim
+      context.provider = extract_provider_params(claim)
+    end
+
+    private
+
+    def decode_id_token(audience)
+      jwk = find_jwk(unverified_header['kid'])
+
+      if jwk.nil?
+        context.fail!(message: 'telegram_unknown_signing_key')
+        return nil
+      end
+
+      payload, = JWT.decode(
+        context.id_token,
+        JWT::JWK.import(jwk).public_key,
+        true,
+        algorithms: SUPPORTED_ALGORITHMS,
+        iss: ISSUER,
+        verify_iss: true,
+        aud: audience,
+        verify_aud: true
+      )
+      payload
+    rescue JWT::DecodeError => e
+      CmAppLogger.error(label: 'telegram_id_token_verification_failed', data: e.message)
+      context.fail!(message: 'invalid_telegram_id_token', error: e.message)
+      nil
+    end
+
+    def unverified_header
+      JWT.decode(context.id_token, nil, false).last
+    end
+
+    def find_jwk(kid)
+      jwks.find { |key| key['kid'] == kid } ||
+        refresh_jwks.find { |key| key['kid'] == kid }
+    end
+
+    def jwks
+      @jwks ||= fetch_jwks
+    end
+
+    def refresh_jwks
+      Rails.cache.delete(JWKS_CACHE_KEY)
+      @jwks = fetch_jwks
+    end
+
+    def fetch_jwks
+      Rails.cache.fetch(JWKS_CACHE_KEY, expires_in: 6.hours) do
+        JSON.parse(Net::HTTP.get(URI(JWKS_URL))).fetch('keys', [])
+      end
+    rescue StandardError => e
+      CmAppLogger.error(label: 'telegram_jwks_fetch_failed', data: e.message)
+      context.fail!(message: 'telegram_jwks_fetch_failed', error: e.message)
+    end
+
+    def expected_audience
+      ENV['TELEGRAM_OAUTH_CLIENT_ID'].presence
+    end
+
+    # sub is the Telegram user id (also the chat id once the user has /started
+    # the bot), which keeps OIDC logins consistent with the Telegram Web App
+    # flow that also keys UserIdentityProvider.telegram on the Telegram user id.
+    def extract_provider_params(claim)
+      {
+        identity_type: SpreeCmCommissioner::UserIdentityProvider.identity_types[:telegram],
+        sub: claim['sub'].to_s,
+        name: claim['name'],
+        username: claim['preferred_username'],
+        picture: claim['picture'],
+        phone_number: claim['phone_number'],
+        email: nil # Telegram does not provide email
+      }
+    end
+  end
+end