spree_cm_commissioner 2.9.1.pre.pre3 → 2.9.2

data/app/interactors/spree_cm_commissioner/telegram_oauth_token_exchanger.rb

@@ -0,0 +1,71 @@
+module SpreeCmCommissioner
+  # Exchanges a Telegram OAuth authorization `code` for an `id_token` at
+  # Telegram's token endpoint. This is the server-side half of the mobile/web
+  # PKCE login: the client cannot call Telegram's /token directly (native apps
+  # have no registered HTTPS origin, and browsers are blocked by CORS), so it
+  # relays the exchange through us.
+  #
+  # Telegram validates the `redirect_uri` *parameter* against a BotFather-
+  # registered domain, not the caller's host, so this can safely run from the
+  # API server. This Telegram Login Widget client is confidential (it has a
+  # client_secret), so PKCE alone isn't enough — Telegram's /token endpoint
+  # still requires `client_secret`, which is why it must be injected here
+  # server-side rather than sent by the app.
+  #
+  # Docs: https://core.telegram.org/bots/telegram-login
+  class TelegramOauthTokenExchanger < BaseInteractor
+    TOKEN_ENDPOINT = 'https://oauth.telegram.org/token'.freeze
+
+    REQUIRED_PARAMS = %i[client_id code redirect_uri code_verifier].freeze
+
+    delegate :client_id, :code, :redirect_uri, :code_verifier, to: :context
+
+    def call
+      missing = REQUIRED_PARAMS.find { |key| context[key].blank? }
+      return context.fail!(message: "#{missing}_missing") if missing
+      return context.fail!(message: 'telegram_oauth_client_secret_not_configured') if client_secret.blank?
+
+      response = post_to_telegram
+
+      context.status = response.code.to_i
+      context.body = response.body
+    end
+
+    private
+
+    def client_secret
+      ENV['TELEGRAM_OAUTH_CLIENT_SECRET'].presence
+    end
+
+    def post_to_telegram
+      uri = URI(TOKEN_ENDPOINT)
+      request = Net::HTTP::Post.new(uri)
+      request.set_form_data(
+        'client_id' => client_id,
+        'client_secret' => client_secret,
+        'code' => code,
+        'grant_type' => 'authorization_code',
+        'redirect_uri' => redirect_uri,
+        'code_verifier' => code_verifier
+      )
+      # Telegram's /token endpoint also checks the caller against the client's
+      # registered Trusted Origins. A plain server-to-server POST sends no
+      # Origin header by default, so without this Telegram rejects the
+      # exchange with {"error":"invalid_client"} even though the auth code
+      # itself was issued successfully moments earlier.
+      request['Origin'] = origin_from(redirect_uri)
+
+      Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }
+    rescue StandardError => e
+      CmAppLogger.error(label: 'telegram_token_exchange_failed', data: e.message)
+      context.fail!(message: 'telegram_token_exchange_failed', error: e.message)
+    end
+
+    def origin_from(url)
+      uri = URI(url)
+      origin = "#{uri.scheme}://#{uri.host}"
+      origin += ":#{uri.port}" if uri.port && uri.port != uri.default_port
+      origin
+    end
+  end
+end

data/app/interactors/spree_cm_commissioner/user_id_token_authenticator.rb

@@ -2,11 +2,8 @@ module SpreeCmCommissioner
   class UserIdTokenAuthenticator < BaseInteractor
     # :id_token, :tenant_id (optional)
     def call
-      context.user = if checker.user.nil?
-                       register_user
-                     else
-                       checker.user
-                     end
+      context.user = checker.user || register_user
+      context.fail!(message: I18n.t('authenticator.incorrect_login')) if context.user.nil?
 
       update_user_email if context.user.email.blank?
 

data/app/interactors/spree_cm_commissioner/user_password_authenticator.rb

@@ -1,11 +1,16 @@
 module SpreeCmCommissioner
   class UserPasswordAuthenticator < BaseInteractor
-    delegate :login, :password, :tenant_id, to: :context
+    delegate :login, :password, :login_token, :tenant_id, to: :context
 
     def call
+      return authenticate_with_login_token if login_token.present?
+
       context.user = Spree.user_class.find_user_by_login(login, tenant_id)
       context.fail!(message: I18n.t('authenticator.incorrect_login')) if context.user.nil?
 
+      # Load-test accounts have no usable password — they authenticate only via login_token above.
+      context.fail!(message: I18n.t('authenticator.incorrect_login')) if context.user.load_test_account?
+
       if spree_confirmable? && active_for_authentication? && !validate_password(context.user)
         context.fail!(message: I18n.t('authenticator.incorrect_password'))
       end
@@ -16,6 +21,23 @@ module SpreeCmCommissioner
 
     private
 
+    # Load-test accounts have no real password (see rake load_test:create_accounts) — instead they
+    # authenticate with a stateless, signed id_token (JWT). k6 sends it as the `id_token` param on
+    # grant_type=password with no username/password; UserAuthenticator routes it here as a
+    # login_token. The token is self-identifying, like a Google id_token: its `sub` names the
+    # account it logs in as, verified by signature + expiry via LoginToken.decode (no DB-stored
+    # secret, no email lookup). Tenant scoping is enforced afterward by
+    # UserAuthenticator#validate_tenant_match!.
+    def authenticate_with_login_token
+      payload = SpreeCmCommissioner::LoadTest::LoginToken.decode(login_token)
+      context.fail!(message: I18n.t('authenticator.incorrect_login')) if payload.nil?
+
+      user = Spree.user_class.find_by(id: payload['sub'])
+      context.fail!(message: I18n.t('authenticator.incorrect_login')) if user.nil? || !user.load_test_account?
+
+      context.user = user
+    end
+
     def validate_password(user)
       user.valid_for_authentication? { user.valid_password?(password) }
     end

data/app/interactors/spree_cm_commissioner/user_telegram_oauth_authenticator.rb

@@ -0,0 +1,78 @@
+module SpreeCmCommissioner
+  # Authenticates a user from a verified Telegram OIDC id_token. Resolves an
+  # existing user by their telegram identity (sub) or registers a new one.
+  # Mirrors the inline identity handling of UserTelegramWebAppAuthenticator so
+  # that both Telegram login flows resolve to the same UserIdentityProvider.
+  class UserTelegramOauthAuthenticator < BaseInteractor
+    delegate :id_token, :tenant_id, to: :context
+
+    # :id_token, :tenant_id (optional)
+    def call
+      context.fail!(message: 'telegram_id_token_missing') if id_token.blank?
+
+      provider = verified_provider
+      context.user = find_or_register_user(provider)
+
+      context.fail!(message: 'account_temporarily_deleted') if context.user.soft_deleted?
+    end
+
+    private
+
+    def verified_provider
+      result = SpreeCmCommissioner::TelegramOauthIdTokenProvider.call(id_token: id_token)
+      context.fail!(message: result.message) unless result.success?
+
+      result.provider
+    end
+
+    def find_or_register_user(provider)
+      identity_checker = SpreeCmCommissioner::UserIdentityChecker.call(
+        identity_type: provider[:identity_type],
+        sub: provider[:sub],
+        tenant_id: tenant_id
+      )
+      return identity_checker.user if identity_checker.success?
+
+      register_user(provider)
+    end
+
+    def register_user(provider)
+      ActiveRecord::Base.transaction do
+        user = build_user(provider)
+        user.save!
+        link_identity!(user, provider)
+        user
+      end
+    end
+
+    def build_user(provider)
+      user = Spree.user_class.new(
+        email: provider[:email],
+        tenant_id: tenant_id,
+        password: SecureRandom.base64(16),
+        **name_attributes(provider[:name])
+      )
+
+      # Skip presence validation for email/login/phone_number for social signups.
+      user.registering_via_social_network = true
+      user.confirmed_at = Time.zone.now
+      user
+    end
+
+    def link_identity!(user, provider)
+      user.user_identity_providers.create!(
+        identity_type: :telegram,
+        sub: provider[:sub],
+        name: provider[:username].presence || provider[:name]
+      )
+    end
+
+    def name_attributes(name)
+      full_name = name.to_s.strip
+      return {} if full_name.blank?
+
+      parts = full_name.split
+      { first_name: parts[0], last_name: parts[1..].join(' ').presence }.compact
+    end
+  end
+end

data/app/mailers/spree/order_mailer_decorator.rb

@@ -25,6 +25,7 @@ module Spree
     def confirm_email(order, resend: false)
       @order = order.respond_to?(:id) ? order : Spree::Order.find(order)
       return false if @order.email.blank?
+      return false if @order.products.all?(&:vote_package?) # disable confirmation email for vote package orders
 
       setup_tenant_and_store
       if @tenant.present?

data/app/models/concerns/spree_cm_commissioner/kyc_bitwise.rb

@@ -36,6 +36,23 @@ module SpreeCmCommissioner
       guest_id_card
     ].freeze
 
+    # Maps each KYC bit field to the actual Guest attribute(s) it stores.
+    KYC_FIELD_ATTRIBUTES = {
+      guest_name: %i[first_name last_name],
+      guest_gender: %i[gender],
+      guest_dob: %i[dob],
+      guest_occupation: %i[occupation_id other_occupation],
+      guest_nationality: %i[nationality_id],
+      guest_age: %i[age],
+      guest_emergency_contact: %i[emergency_contact],
+      guest_organization: %i[other_organization],
+      guest_expectation: %i[expectation],
+      guest_social_contact: %i[social_contact_platform social_contact],
+      guest_address: %i[address],
+      guest_phone_number: %i[phone_number],
+      guest_contact: %i[contact]
+    }.freeze
+
     def kyc? = kyc != 0
 
     BIT_FIELDS.each do |field, bit_value|

data/app/models/concerns/spree_cm_commissioner/line_items_filter_scope.rb

@@ -19,15 +19,17 @@ module SpreeCmCommissioner
       scope :filter_by_event, lambda { |event|
         case event
         when 'upcoming'
-          complete_or_canceled.paid.where.not(to_date: nil).where('to_date >= ?', Time.zone.now)
+          complete_or_canceled.paid.where.not(to_date: nil).where.not(product_type: 'vote_package')
+                              .where('to_date >= ?', Time.zone.now)
                               .joins(:order).where(spree_orders: { canceled_at: nil })
 
         when 'complete'
-          complete_or_canceled.paid.where.not(to_date: nil).where('to_date < ?', Time.zone.now)
+          complete_or_canceled.paid.where.not(to_date: nil).where.not(product_type: 'vote_package')
+                              .where('to_date < ?', Time.zone.now)
                               .joins(:order).where(spree_orders: { canceled_at: nil })
 
         when 'canceled'
-          canceled
+          canceled.where.not(product_type: 'vote_package')
         else
           none
         end

data/app/models/concerns/spree_cm_commissioner/order_state_machine.rb

@@ -21,6 +21,8 @@ module SpreeCmCommissioner
 
       state_machine.after_transition to: :complete, do: :mark_user_as_has_incomplete_guest_info, if: :has_incomplete_guest_info?
       state_machine.after_transition to: :complete, do: :send_transaction_email_to_user, if: :user_has_email?
+
+      state_machine.before_transition to: :resumed, do: :clear_cancellation_details
       state_machine.after_transition to: :resumed, do: :precalculate_conversion
       state_machine.around_transition to: :resumed, do: :unstock_inventory!
 
@@ -241,6 +243,7 @@ module SpreeCmCommissioner
     def send_transaction_email_to_user
       line_items.each do |line_item|
         next if line_item.event.nil?
+        next unless line_item.enable_social_sharing_email?
 
         SpreeCmCommissioner::EventTransactionalMailer.send_to_participant(line_item.event_id, user.id).deliver_later
       end
@@ -370,5 +373,13 @@ module SpreeCmCommissioner
     def de_allocate_resources
       SpreeCmCommissioner::VotingCreditDeAllocationJob.perform_later(order_id: id)
     end
+
+    # Reset the cancellation info when an order is resumed.
+    # We only assign the values here; the resume transition already saves the order,
+    # so they get saved together with it (one validated save, no update_columns).
+    def clear_cancellation_details
+      self.canceled_at = nil
+      self.canceler_id = nil
+    end
   end
 end

data/app/models/concerns/spree_cm_commissioner/product_delegation.rb

@@ -13,6 +13,8 @@ module SpreeCmCommissioner
                :required_self_check_in_location?,
                :enable_telegram_alert,
                :enable_telegram_alert?,
+               :enable_social_sharing_email,
+               :enable_social_sharing_email?,
                to: :product
     end
   end

data/app/models/spree_cm_commissioner/homepage_section_relatable.rb

@@ -18,6 +18,31 @@ module SpreeCmCommissioner
         (discontinue_on.nil? || discontinue_on >= current_time)
     end
 
+    # This constant help preview sections to get the relatable class from the previewable_type of the preview role.
+    RELATABLE_CLASS_BY_PREVIEWABLE_TYPE = {
+      'Spree::Taxon' => 'Spree::Taxon',
+      'SpreeCmCommissioner::Show' => 'Spree::Taxon',
+      'Spree::Product' => 'Spree::Product'
+    }.freeze
+
+    # homepage_section ids reachable through a user's preview roles
+    def self.section_ids_previewable_by(user)
+      # get previewable_id/previewable_type from the user's preview roles,
+      # eg: [[798, "SpreeCmCommissioner::Show"], [245, "Spree::Product"], [449, "Spree::Taxon"]
+      # Then batch the ids by relatable_type so we run one query per type instead of one per row
+      # eg. {"Spree::Taxon" => [798, 449], "Spree::Product" => [245]}
+      ids_by_relatable_type = user.preview_roles.pluck(:previewable_id, :previewable_type)
+                                  .each_with_object(Hash.new { |h, k| h[k] = [] }) do |(id, previewable_type), acc|
+        relatable_type = RELATABLE_CLASS_BY_PREVIEWABLE_TYPE[previewable_type]
+        acc[relatable_type] << id if relatable_type
+      end
+
+      # find homepage_section_relatables matching those ids/types, then return the unique homepage_section ids
+      ids_by_relatable_type.flat_map do |relatable_type, ids|
+        where(relatable_type: relatable_type, relatable_id: ids).pluck(:homepage_section_id)
+      end.uniq
+    end
+
     private
 
     def update_homepage_section

data/app/models/spree_cm_commissioner/order_decorator.rb

@@ -71,12 +71,6 @@ module SpreeCmCommissioner
       end
     end
 
-    # override
-    def after_resume
-      super
-      update_columns(canceled_at: nil, canceler_id: nil) # rubocop:disable Rails/SkipsModelValidations
-    end
-
     # override to allow storing cancellation reason in one DB write
     def canceled_by(user, cancellation_reason: nil)
       transaction do

data/app/models/spree_cm_commissioner/payment_method_decorator.rb

@@ -5,6 +5,8 @@ module SpreeCmCommissioner
     def self.prepended(base)
       base.const_set(:DISPLAY, DISPLAY)
 
+      base.whitelisted_ransackable_attributes = %w[name]
+
       # Expose a dedicated class helper so services can call Spree::PaymentMethod.ticket_transfer
       # instead of duplicating lookup/creation logic.
       base.define_singleton_method(:ticket_transfer) do

data/app/models/spree_cm_commissioner/pricing_model_route.rb

@@ -1,10 +1,18 @@
 module SpreeCmCommissioner
+  # A pricing-model assignment. A row is either:
+  #   - route-scoped: trip_id NULL, keyed by route + O-D (unchanged legacy behaviour), or
+  #   - trip-scoped:  trip_id set, keyed by that specific trip + its own O-D (overrides route pricing
+  #     for that trip only).
   class PricingModelRoute < Base
     belongs_to :route, class_name: 'SpreeCmCommissioner::Route'
+    belongs_to :trip, class_name: 'SpreeCmCommissioner::Trip', optional: true
     belongs_to :pricing_model, class_name: 'SpreeCmCommissioner::PricingModel'
     belongs_to :origin_place, class_name: 'SpreeCmCommissioner::Place'
     belongs_to :destination_place, class_name: 'SpreeCmCommissioner::Place'
 
+    scope :route_scoped, -> { where(trip_id: nil) }
+    scope :trip_scoped, -> { where.not(trip_id: nil) }
+
     scope :for_origin_destination, lambda { |origin_place_id, destination_place_id|
       where(origin_place_id: origin_place_id, destination_place_id: destination_place_id)
     }

data/app/models/spree_cm_commissioner/product_decorator.rb

@@ -134,6 +134,7 @@ module SpreeCmCommissioner
       base.store_public_metadata :enable_inventory_hold, :boolean, default: false
       base.store_public_metadata :enable_telegram_alert, :boolean, default: true
       base.store_public_metadata :enable_send_receipt, :boolean, default: true
+      base.store_public_metadata :enable_social_sharing_email, :boolean, default: false
 
       base.store_private_metadata :advertise_weight, :integer, default: 1
       base.store_private_metadata :video_url, :string

data/app/models/spree_cm_commissioner/trip.rb

@@ -22,6 +22,8 @@ module SpreeCmCommissioner
     # before create, duplicate seat layout from vehicle_type if present
     before_validation :duplicate_seat_layout_from_vehicle, if: -> { seat_layout.nil? && vehicle_type&.seat_layout.present? }
 
+    before_validation :set_name_and_short_name_from_product, on: :create
+
     after_create :increment_route_metric_trip_count
     after_create :increment_vendor_route_metric_trip_count
 
@@ -52,6 +54,9 @@ module SpreeCmCommissioner
     has_many :trip_blazer_queries, as: :queryable, class_name: 'SpreeCmCommissioner::BlazerQueryable'
     has_many :blazer_queries, through: :trip_blazer_queries, source: :blazer_query, class_name: 'Blazer::Query'
 
+    has_many :pricing_model_routes, class_name: 'SpreeCmCommissioner::PricingModelRoute', dependent: :destroy
+    has_many :pricing_models, through: :pricing_model_routes, class_name: 'SpreeCmCommissioner::PricingModel'
+
     has_many :trip_stops, class_name: 'SpreeCmCommissioner::TripStop', dependent: :destroy
     has_many :boarding_trip_stops, -> { boarding.order('departure_time ASC NULLS LAST, id ASC') }, class_name: 'SpreeCmCommissioner::TripStop'
     has_many :drop_off_trip_stops, -> { drop_off.order('arrival_time ASC NULLS LAST') }, class_name: 'SpreeCmCommissioner::TripStop'
@@ -65,6 +70,7 @@ module SpreeCmCommissioner
     has_many :inventory_items, through: :variants
     has_many :blocks, through: :variants
 
+    validates :name, presence: true
     validates :departure_time, presence: true
     validates :duration, numericality: { greater_than: 0 }
 
@@ -120,7 +126,7 @@ module SpreeCmCommissioner
     end
 
     def display_name
-      product&.name
+      self[:name]
     end
 
     def featured?
@@ -129,6 +135,12 @@ module SpreeCmCommissioner
 
     private
 
+    # Snapshot product names on trip creation. Runs before validation
+    def set_name_and_short_name_from_product
+      self[:name] ||= product&.name
+      self[:short_name] ||= product&.short_name
+    end
+
     def resolve_service_origin_id
       route&.service_origin_id || vendor&.service_origin_id
     end

data/app/models/spree_cm_commissioner/user_decorator.rb

@@ -60,6 +60,12 @@ module SpreeCmCommissioner
       base.store_public_metadata :qr_data_invalidated_at, :datetime
       base.store_public_metadata :branch_ids, :array, default: []
 
+      # Private - marks accounts created by rake load_test:create_accounts. Real passwords never
+      # work for these accounts (see UserPasswordAuthenticator) — login is only possible by sending
+      # a stateless, signed JWT (minted on demand from the admin UI, see LoadTest::LoginToken) as
+      # the id_token param. Nothing token-related is stored on the account itself.
+      base.store_private_metadata :load_test_account, :boolean, default: false
+
       # Validations
       base.validates :primary_service_type,
                      inclusion: { in: SpreeCmCommissioner::ServiceType::SERVICE_TYPES.map(&:to_s) },

data/app/overrides/spree/admin/payment_methods/index/pagination.html.erb.deface

@@ -0,0 +1,3 @@
+<!-- insert_after ".table-responsive" -->
+
+<%= render partial: 'spree/admin/shared/index_table_options', locals: { collection: @payment_methods } %>

data/app/overrides/spree/admin/payment_methods/index/preserve_tab_in_search.html.erb.deface

@@ -0,0 +1,4 @@
+<!-- insert_after "[data-hook='admin_payment_methods_index_search']" -->
+
+<%# keep the current tab when the search form submits %>
+<%= hidden_field_tag :tab, params[:tab] if params[:tab].present? %>

data/app/overrides/spree/admin/products/_form/enable_social_sharing_email.html.erb.deface

@@ -0,0 +1,13 @@
+<!-- insert_after "[data-hook='admin_product_form_promotionable']" -->
+
+<div>
+  <%= f.field_container :enable_social_sharing_email do %>
+    <%= f.label :enable_social_sharing_email do %>
+      <%= f.check_box :enable_social_sharing_email %>
+      <strong><%= Spree.t(:enable_social_sharing_email) %></strong>
+    <% end %>
+    <small class="form-text text-muted">
+      When enabled, participants receive a transaction confirmation email after their order for this event is completed.
+    </small>
+  <% end %>
+</div>

data/app/overrides/spree/admin/variants/index/fixture_action.html.erb.deface

@@ -0,0 +1,9 @@
+<!-- insert_after "erb[loud]:contains('link_to_delete(variant, no_text: true)')" -->
+
+<% if can?(:edit, variant) && !variant.deleted? %>
+  <%= link_to fixture_admin_product_variant_path(@product, variant),
+              class: 'btn btn-light btn-sm with-tip icon-link',
+              data: {title: Spree.t(:fixture, default: 'Fixture') } do %>
+    <%= svg_icon name: "clipboard-data.svg", width: '12', height: '12' %>
+  <% end %>
+<% end %>

data/app/queries/spree_cm_commissioner/multi_leg_trips_query.rb

@@ -245,6 +245,8 @@ module SpreeCmCommissioner
     def build_trip_result(trip:, trip_row:, parent_trip:)
       SpreeCmCommissioner::TripResult.new(
         id: trip.id,
+        name: trip.display_name,
+        short_name: trip.short_name,
         departure_time: trip.departure_time,
         duration: trip.duration,
         distance: trip.distance,

data/app/serializers/spree_cm_commissioner/v2/storefront/trip_result_serializer.rb

@@ -15,8 +15,8 @@ module SpreeCmCommissioner
           expires_in: 30.minutes
         )
 
-        attributes :origin_place, :destination_place, :stops, :price, :compare_at_price, :currency, :quantity_available, :max_capacity,
-                   :allow_seat_selection, :departure_time, :route_type, :distance, :offset_days,
+        attributes :name, :short_name, :origin_place, :destination_place, :stops, :price, :compare_at_price, :currency, :quantity_available,
+                   :max_capacity, :allow_seat_selection, :departure_time, :route_type, :distance, :offset_days,
                    :featured_until, :display_price, :display_compare_at_price,
                    :open_dated_product_id, :open_dated_price, :open_dated_compare_at_price
 

data/app/serializers/spree_cm_commissioner/v2/storefront/trip_serializer.rb

@@ -2,7 +2,9 @@ module SpreeCmCommissioner
   module V2
     module Storefront
       class TripSerializer < BaseSerializer
-        attributes :departure_time, :arrival_time, :duration_in_hms, :route_type, :allow_seat_selection
+        attributes :departure_time, :arrival_time, :duration_in_hms, :route_type, :allow_seat_selection, :short_name
+
+        attribute :name, &:display_name
 
         has_one :vehicle_type, serializer: ::SpreeCmCommissioner::V2::Storefront::TripVehicleTypeSerializer
         has_one :seat_layout, serializer: SpreeCmCommissioner::V2::Storefront::SeatLayoutSerializer

data/app/services/spree_cm_commissioner/draft_order/create.rb

@@ -0,0 +1,86 @@
+# SpreeCmCommissioner::DraftOrder::Create builds a fresh order from a locally-assembled
+# list of line items in a single request, then advances it to `address` to hold inventory
+# where the product type requires it.
+#
+# This is the generic counterpart of SpreeCmCommissioner::TransitOrder::Create: instead of
+# transit legs/seats it takes plain `line_items` params, so the app can browse/add entirely
+# offline and only touch the server once, at Continue.
+#
+# Each line item is built the same way Spree::Cart::AddItem builds one: `options` is filtered
+# down to Spree::PermittedAttributes.line_item_attributes and passed through `options:` to
+# `order.line_items.new`, which routes it through LineItem#options= (`update_price_from_modifier`)
+# — the same price computation the regular add-to-cart path uses, including per-date pricing for
+# permanent-stock variants (see LineItemDecorator#update_price_from_modifier /
+# Variant#price_for_date). guests_attributes rides through the same way, via the standard
+# `accepts_nested_attributes_for :guests` writer.
+#
+# Attributes:
+# - line_items: [Array<Hash>] each { variant_id:, quantity:, options: {}, public_metadata: {}, private_metadata: {} }
+#   options may carry from_date/to_date (service/permanent-stock products) and guests_attributes
+#   (seat-selection products, [{ block_id: }, ...])
+# - user:       [Spree::User] the user for whom the order is being created (nil for guest checkout)
+# - store:      [Spree::Store] the current store (defaults to Spree::Store.default when nil)
+# - currency:   [String] the order currency (defaults to the store currency when nil)
+# - tenant:     [SpreeCmCommissioner::Tenant] the tenant the order is created under (nil outside tenant scope)
+module SpreeCmCommissioner
+  module DraftOrder
+    class Create
+      prepend ::Spree::ServiceModule::Base
+
+      def call(line_items:, user: nil, store: nil, currency: nil, tenant: nil)
+        return failure(nil, I18n.t('spree_cm_commissioner.draft_order.line_items_missing')) if line_items.blank?
+
+        order = create_order!(line_items, user, store, currency, tenant)
+        success(order: order)
+      rescue StandardError => e
+        failure(nil, e.message)
+      end
+
+      def create_order!(line_items_params, user, store, currency, tenant)
+        store ||= Spree::Store.default
+        currency ||= store&.default_currency
+        order = Spree::Order.new(state: 'cart', use_billing: true, user: user, store: store, currency: currency, tenant: tenant)
+        line_items_params.each { |line_item_params| build_line_item!(order, store, line_item_params) }
+
+        ActiveRecord::Base.transaction do
+          raise StandardError, order_error_message(order) unless order.save
+
+          order.update_with_updater!
+
+          # Build blank guests per line item so the client can render guest fields offline.
+          order.line_items.each(&:generate_remaining_guests)
+
+          raise StandardError, order_error_message(order) if order.has_checkout_step?('address') && !order.next
+        end
+
+        order
+      end
+
+      # Builds (unsaved) an order.line_items member — persisted together with the order via
+      # order.save's cascading autosave of new has_many records, same as TransitOrder::Create.
+      def build_line_item!(order, store, line_item_params)
+        variant = store.variants.find(line_item_params[:variant_id])
+        options = (line_item_params[:options] || {}).to_h.with_indifferent_access
+        permitted_opts = ::Spree::PermittedAttributes.line_item_attributes.flatten.index_with { |attribute| options[attribute] }
+        opts = permitted_opts.merge(currency: order.currency).compact
+
+        order.line_items.new(
+          variant: variant,
+          quantity: line_item_params[:quantity],
+          options: opts,
+          public_metadata: (line_item_params[:public_metadata] || {}).to_h,
+          private_metadata: (line_item_params[:private_metadata] || {}).to_h
+        )
+      end
+
+      # order.errors already includes line item errors (accepts_nested_attributes_for autosaves them
+      # in). Skip full_message's attribute prefix when the validator already wrote a full sentence,
+      # e.g. before: "Quantity Not enough stock" -> after: "Not enough stock".
+      def order_error_message(order)
+        order.errors.map do |error|
+          error.raw_type.is_a?(String) || error.options[:message].is_a?(String) ? error.message : error.full_message
+        end.uniq.to_sentence
+      end
+    end
+  end
+end