spree_cm_commissioner 2.9.1.pre.pre3 → 2.9.2

data/app/services/spree_cm_commissioner/load_test/create_accounts.rb

@@ -0,0 +1,68 @@
+module SpreeCmCommissioner
+  module LoadTest
+    # Creates N load-test accounts (tenant-scoped when client_id given, platform accounts
+    # otherwise). Each gets a unique random email — "#{email_prefix}_#{32 hex}@#{domain}" — so runs
+    # are NOT idempotent: every call adds N fresh accounts to the pool (unlike the old +1/+2/+N
+    # scheme, random emails can't be matched to skip or reuse existing rows). Clean up with
+    # LoadTest::DestroyAccounts, which removes them by the load_test_account flag, not by email.
+    #
+    # Accounts are flagged `load_test_account` and can never authenticate with a real password —
+    # from any client, mobile app included (see SpreeCmCommissioner::UserPasswordAuthenticator).
+    # This service only creates the account pool; it does NOT mint login tokens. Login tokens are
+    # stateless, signed JWTs minted on demand from the admin UI (see LoginToken) — an account needs
+    # nothing stored on it beyond the flag.
+    class CreateAccounts
+      prepend ::Spree::ServiceModule::Base
+
+      def call(client_id: nil, count: 20, email_prefix: 'loadtest', email_domain: nil)
+        tenant = resolve_tenant(client_id)
+        domain = email_domain.presence || (tenant ? "#{tenant.slug}.test" : 'bookmeplus.test')
+
+        accounts = Array.new(count) { create_account!(email: unique_email(email_prefix, domain), tenant: tenant) }
+
+        success(created: accounts.size, accounts: accounts.map { |user| account_row(user) }, email_domain: domain)
+      rescue StandardError => e
+        failure(nil, e.message)
+      end
+
+      private
+
+      # "#{prefix}_#{32 hex chars}@#{domain}" — SecureRandom.hex(16) is 16 bytes rendered as 32 hex
+      # characters, unique enough that collisions within a tenant are effectively impossible.
+      def unique_email(prefix, domain)
+        "#{prefix}_#{SecureRandom.hex(16)}@#{domain}"
+      end
+
+      def account_row(user)
+        { email: user.email, user_id: user.id, registered_by: user.registered_by }
+      end
+
+      def resolve_tenant(client_id)
+        return nil if client_id.blank?
+
+        application = Spree::OauthApplication.find_by(uid: client_id)
+        raise "No OAuth application found for CLIENT_ID=#{client_id}" unless application
+
+        tenant = application.tenant
+        raise "OAuth application #{client_id} has no tenant associated" unless tenant
+
+        tenant
+      end
+
+      def create_account!(email:, tenant:)
+        account_password = SecureRandom.base58(24)
+
+        Spree::User.create!(
+          email: email,
+          password: account_password,
+          password_confirmation: account_password,
+          confirmed_at: Time.current,
+          failed_attempts: 0,
+          tenant_id: tenant&.id,
+          load_test_account: true,
+          registered_by: :system_registered
+        )
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/load_test/destroy_accounts.rb

@@ -0,0 +1,50 @@
+module SpreeCmCommissioner
+  module LoadTest
+    # Soft-deletes up to N load-test accounts for a scope (acts_as_paranoid). Since accounts now
+    # get random emails (see LoadTest::CreateAccounts), they can't be found by reconstructing a
+    # deterministic email — they're located by the `load_test_account` flag + tenant instead, the
+    # same way the admin UI lists them. Not needed on staging — accounts are reusable across runs.
+    class DestroyAccounts
+      prepend ::Spree::ServiceModule::Base
+
+      # Scan cap for the candidate set below — bounds the query while comfortably covering realistic
+      # load-test pool sizes (mirrors the admin controller's export scan).
+      SCAN_LIMIT = 2000
+
+      def call(client_id: nil, count: 20, **_ignored)
+        tenant = resolve_tenant(client_id)
+
+        accounts = load_test_accounts(tenant).first(count)
+        accounts.each(&:destroy!)
+
+        success(destroyed: accounts.size, not_found: [count - accounts.size, 0].max)
+      rescue StandardError => e
+        failure(nil, e.message)
+      end
+
+      private
+
+      # `load_test_account` lives in the `private_metadata` jsonb store (double-encoded as a JSON
+      # string scalar), so it can't be filtered in SQL — load the tenant's candidates and filter
+      # with the model's own `load_test_account?` in Ruby (same approach as the admin controller).
+      def load_test_accounts(tenant)
+        Spree::User.where(tenant_id: tenant&.id)
+                   .order(:id)
+                   .limit(SCAN_LIMIT)
+                   .select(&:load_test_account?)
+      end
+
+      def resolve_tenant(client_id)
+        return nil if client_id.blank?
+
+        application = Spree::OauthApplication.find_by(uid: client_id)
+        raise "No OAuth application found for CLIENT_ID=#{client_id}" unless application
+
+        tenant = application.tenant
+        raise "OAuth application #{client_id} has no tenant associated" unless tenant
+
+        tenant
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/load_test/flow_registry.rb

@@ -0,0 +1,26 @@
+module SpreeCmCommissioner
+  module LoadTest
+    # Reads config/load_test_flows/{platform,tenant}.yml — the registry of k6 flows
+    # (../../../../load_testing) and where to find real data for each one. Purely descriptive:
+    # nothing here queries the DB or generates JSON, it just surfaces the YAML for the
+    # "Test Data Sources" card on the admin/organizer Load Testing pages. See those files'
+    # header comments for the field shapes.
+    module FlowRegistry
+      YAML_DIR = File.join(SpreeCmCommissioner::Engine.root, 'config', 'load_test_flows')
+      YAML_PATHS = {
+        'platform' => File.join(YAML_DIR, 'platform.yml'),
+        'tenant' => File.join(YAML_DIR, 'tenant.yml')
+      }.freeze
+
+      # workflow: 'platform' or 'tenant'. Returns { flow_name => attributes } in file order.
+      def self.for_workflow(workflow)
+        all.fetch(workflow.to_s, {})
+      end
+
+      def self.all
+        @all ||= YAML_PATHS.transform_values { |path| YAML.load_file(path) }
+                           .deep_symbolize_keys.transform_keys(&:to_s)
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/load_test/generate_booking_ticket_data.rb

@@ -0,0 +1,140 @@
+module SpreeCmCommissioner
+  module LoadTest
+    # Generates the booking_ticket_flow load-test data for one variant so it can be used by the
+    # k6 booking flow. An admin picks a ticket variant in the dashboard; this reads its
+    # product / variant / event straight off the models and returns the payload the flow needs,
+    # plus a "can this actually be booked?" check so the tester knows it will drive the flow.
+    #
+    # Flow: pick a ticket variant in admin -> copy this payload into
+    # load_testing/config/fixture/platform/booking_ticket_flow/<env>.json -> Env.fixture() reads
+    # that file when running k6 (load_testing/tests/platform/booking_ticket_flow).
+    #
+    # Returns success({ data: {...}, issues: [...] }). `issues` is empty when the variant
+    # is ready to load-test; otherwise it lists why the booking flow would fail. The same
+    # `issues` (plus a `ready` flag) are duplicated into `data[:metadata]` so they travel with
+    # the copied JSON — the k6 flow ignores that key, it's there for a human to read later.
+    class GenerateBookingTicketData
+      prepend ::Spree::ServiceModule::Base
+
+      def call(variant:)
+        product = variant.product
+        event = product.event
+        issues = issues_for(variant, event)
+
+        data = {
+          event_permalink: event&.permalink,
+          product_slug: product.slug,
+          product_id: product.id,
+          variant_id: variant.id,
+          # Informational only — the k6 flow never reads this. Carries the readiness check into
+          # the copied JSON itself, so it's visible later without regenerating from admin.
+          metadata: {
+            ready: issues.empty?,
+            issues: issues
+          }
+        }
+
+        success(data: data, issues: issues)
+      rescue StandardError => e
+        failure(nil, e.message)
+      end
+
+      private
+
+      # Each check returns an explanatory string when it would break the booking flow, or nil when the
+      # variant is fine on that axis. Order mirrors the flow: availability first, then checkout shape.
+      def issues_for(variant, event)
+        product = variant.product
+
+        [
+          inactive_product_issue(product),
+          discontinued_variant_issue(variant),
+          permanent_stock_issue(variant),
+          request_to_book_issue(variant),
+          out_of_stock_issue(variant),
+          seat_selection_issue(variant, product),
+          max_quantity_issue(variant),
+          missing_event_issue(event)
+        ].compact
+      end
+
+      # add-to-cart runs SpreeCmCommissioner::Stock::AvailabilityChecker#can_supply?, which returns false
+      # the moment variant.available? is false — before it ever looks at stock. available? is
+      # !discontinued? && product.available? (active? && !deleted?), none of which purchasable?
+      # (in_stock? || backorderable?) checks. So an inactive product with stock still reports
+      # purchasable? == true yet fails add-to-cart with only_active_products_can_be_added_to_cart.
+      def inactive_product_issue(product)
+        return if product.available?
+
+        'Product is not active (status is draft/archived, or the product is deleted).'
+      end
+
+      # Reported independently of the inactive-product check so a product that is both archived and
+      # discontinued surfaces both problems at once, rather than hiding one behind the other.
+      def discontinued_variant_issue(variant)
+        return unless variant.discontinued?
+
+        'Variant is discontinued (discontinue_on is in the past, on the variant or its product).'
+      end
+
+      # accommodation/service/transit variants hold date-scoped inventory: the availability check needs
+      # from/to dates to find any inventory item, but the booking flow adds a ticket with no date, so
+      # cached_inventory_items comes back empty and add-to-cart fails. This flow is for event tickets.
+      def permanent_stock_issue(variant)
+        return unless variant.permanent_stock?
+
+        'Product is a date-based (permanent-stock) type — accommodation / service / transit.'
+      end
+
+      # request-to-book skips payment (payment_required? is false) and "complete" diverts the order to a
+      # request state instead of a paid order — the flow's cash payment + complete no longer represent a
+      # real purchase.
+      def request_to_book_issue(variant)
+        return unless variant.need_confirmation?
+
+        'Variant is request-to-book (need_confirmation).'
+      end
+
+      # Reported on its own axis (stock), independent of whether the product is active — an inactive AND
+      # empty variant should surface both. Only skipped for permanent-stock and request-to-book variants,
+      # where purchasable? legitimately reads false while the item is still bookable, so this would be a
+      # false alarm rather than a real problem.
+      def out_of_stock_issue(variant)
+        return if variant.permanent_stock? || variant.need_confirmation?
+        return if variant.purchasable?
+
+        'Variant is out of stock (not in stock and not backorderable).'
+      end
+
+      def seat_selection_issue(variant, product)
+        return unless seat_selection_required?(variant, product)
+
+        'Variant requires seat selection (it has seat blocks).'
+      end
+
+      def max_quantity_issue(variant)
+        max = variant.max_quantity_per_order
+        return if max.blank? || max >= 1
+
+        "Variant max-quantity-per-order is #{max} (less than one ticket)."
+      end
+
+      def missing_event_issue(event)
+        return unless event.nil?
+
+        'Product has no event taxon — event_permalink is blank.'
+      end
+
+      # Reproduces LineItem#set_required_seat_selection_flag: a ticket needs a seat/block when its
+      # variant has seat blocks, gated by the trip's allow_seat_selection when the product is a trip.
+      # The load-test flow never picks a seat, so any such variant fails the ensure_all_guests_have_blocks
+      # validation at add-to-cart.
+      def seat_selection_required?(variant, product)
+        return false unless variant.blocks.any?
+        return product.trip.allow_seat_selection if product.trip.present?
+
+        true
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/load_test/generate_voting_fixture_data.rb

@@ -0,0 +1,178 @@
+module SpreeCmCommissioner
+  module LoadTest
+    # Generates a load-test fixture for one of the tenant voting-related k6 flows, scoped to a
+    # single voting session, so it can be copied into load_testing/config/fixture/tenant/.
+    # An organizer opens a voting session, picks a flow (voting_flow / aba_topup_vote_flow /
+    # cash_on_topup_vote_flow), and this resolves show_slug + voting_session_id straight off the
+    # models, plus (for the topup flows) the tenant's active payment method for that gateway.
+    #
+    # Mirrors GenerateBookingTicketData's shape: success({ data:, issues: }). `issues` lists why
+    # the flow isn't ready to load-test (e.g. no ABA payment method configured yet); the same
+    # issues are duplicated into data[:metadata] so they travel with the copied JSON.
+    class GenerateVotingFixtureData
+      prepend ::Spree::ServiceModule::Base
+
+      FLOWS = %w[voting_flow aba_topup_vote_flow cash_on_topup_vote_flow].freeze
+
+      # ABA's checkout endpoint is fixed regardless of tenant/environment — only `host` (sandbox
+      # vs production) differs, and that comes off the payment method. See
+      # Vpago::PaywayV2::Checkout#checkout_url in gems/spree_vpago.
+      PAYWAY_CHECKOUT_PATH = '/api/payment-gateway/v1/payments/purchase'.freeze
+
+      def call(voting_session:, flow:)
+        unless FLOWS.include?(flow)
+          raise ArgumentError, I18n.t('load_test.generate_voting_fixture_data.unknown_flow', flow: flow, flows: FLOWS.join(', '))
+        end
+
+        show = voting_session.show
+        issues = []
+        issues << I18n.t('load_test.generate_voting_fixture_data.no_show') if show.nil?
+
+        data = { show_slug: show&.slug, voting_session_id: voting_session.id }
+
+        if flow == 'voting_flow'
+          issues.concat(voting_readiness_issues(voting_session))
+        else
+          issues.concat(topup_flow_issues(flow, voting_session, data))
+        end
+
+        data[:metadata] = { ready: issues.empty?, issues: issues }
+
+        success(data: data, issues: issues)
+      rescue StandardError => e
+        failure(nil, e.message)
+      end
+
+      private
+
+      # Resolves the payment method + (for ABA) its payway payload into `data`, and returns the
+      # readiness issues for whichever topup flow this is.
+      def topup_flow_issues(flow, voting_session, data)
+        issues = []
+        payment_method = resolve_payment_method(voting_session.vendor, flow)
+
+        if payment_method.nil?
+          issues << I18n.t('load_test.generate_voting_fixture_data.no_payment_method', label: payment_method_label(flow))
+        else
+          data[:payment_method_id] = payment_method.id
+          issues.concat(aba_payment_method_issues(payment_method, data)) if flow == 'aba_topup_vote_flow'
+        end
+
+        issues.concat(vote_package_issues(voting_session))
+      end
+
+      def aba_payment_method_issues(payment_method, data)
+        data[:payway] = payway_payload(payment_method)
+
+        return [] if payment_method.preferred_host.to_s.match?(/sandbox/i)
+
+        [
+          I18n.t('load_test.generate_voting_fixture_data.sandbox_host_mismatch', host: payment_method.preferred_host.inspect)
+        ]
+      end
+
+      # Mirrors VotingSession#can_vote? (enabled? && now.between?(opens_at, closes_at) &&
+      # !manual_advance?) — the actual gate VoteProcessor#validate! applies to POST votes.
+      # Reports only the sub-condition(s) that are actually failing, in plain sentences, rather
+      # than dumping the whole rule regardless of which part broke it.
+      def can_vote_issues(voting_session)
+        issues = []
+
+        unless voting_session.enabled?
+          issues << I18n.t('load_test.generate_voting_fixture_data.session_status_invalid', status: voting_session.status.inspect)
+        end
+
+        issues << I18n.t('load_test.generate_voting_fixture_data.manual_advance_never_votes') if voting_session.manual_advance?
+        issues << voting_window_issue(voting_session) unless Time.zone.now.between?(voting_session.opens_at, voting_session.closes_at)
+
+        issues
+      end
+
+      def voting_window_issue(voting_session)
+        now = Time.zone.now
+
+        if now < voting_session.opens_at
+          I18n.t('load_test.generate_voting_fixture_data.voting_not_opened', opens_at: voting_session.opens_at)
+        else
+          I18n.t('load_test.generate_voting_fixture_data.voting_already_closed', closes_at: voting_session.closes_at)
+        end
+      end
+
+      # Mirrors VoteProcessor#validate! (votes_controller's actual gate on POST .../votes) and
+      # VotingContestantsController#index (returns [] with no status filter, which the flow's
+      # random contestant pick can't survive).
+      def voting_readiness_issues(voting_session)
+        issues = can_vote_issues(voting_session)
+
+        issues << I18n.t('load_test.generate_voting_fixture_data.no_contestants') if voting_session.voting_contestants.empty?
+
+        issues << I18n.t('load_test.generate_voting_fixture_data.no_eligible_credit') unless VotingCredit.active.eligible(voting_session).exists?
+
+        issues
+      end
+
+      # Mirrors VotePackagesController's collection (status: active, scoped to this season) plus
+      # Spree's real purchasability gate (Variant#purchasable?) — nothing in checkout ties a
+      # package's purchasability to the voting session's own status, so that's not checked here.
+      def vote_package_issues(voting_session)
+        return [] if resolve_paid_vote_package(voting_session)
+
+        [I18n.t('load_test.generate_voting_fixture_data.no_vote_package')]
+      end
+
+      def resolve_paid_vote_package(voting_session)
+        vendor = voting_session.vendor
+        return nil if vendor.nil?
+
+        votable_scopes(voting_session).each do |votable_type, votable_id|
+          next if votable_id.nil?
+
+          package = vendor.vote_packages
+                          .where(status: :active)
+                          .by_votable(votable_type, votable_id)
+                          .joins(master: :prices)
+                          .where.not(spree_prices: { amount: 0 })
+                          .find { |p| p.vote_variant&.purchasable? }
+
+          return package if package
+        end
+
+        nil
+      end
+
+      # Same three-level fallback VotingCredit::eligible and VotePackagesController use to scope
+      # a session/episode/show to its vote packages and credits.
+      def votable_scopes(voting_session)
+        [
+          ['SpreeCmCommissioner::VotingSession', voting_session.id],
+          ['SpreeCmCommissioner::ShowEpisode', voting_session.episode_id],
+          ['SpreeCmCommissioner::Show', voting_session.show&.id]
+        ]
+      end
+
+      def resolve_payment_method(vendor, flow)
+        type = flow == 'aba_topup_vote_flow' ? Vpago::PaymentMethodDecorator::TYPE_PAYWAY_V2 : Vpago::PaymentMethodDecorator::TYPE_CASH_ON
+
+        Spree::PaymentMethod.active.where(vendor_id: vendor&.id, type: type).first
+      end
+
+      def payment_method_label(flow)
+        key = flow == 'aba_topup_vote_flow' ? 'aba' : 'cash_on'
+        I18n.t("load_test.generate_voting_fixture_data.payment_method_labels.#{key}")
+      end
+
+      def payway_payload(payment_method)
+        {
+          host: payment_method.preferred_host,
+          checkout_path: PAYWAY_CHECKOUT_PATH,
+          merchant_id: payment_method.preferred_merchant_id,
+          api_key: payment_method.preferred_api_key,
+          payment_option: payment_method.preferred_payment_option,
+          transaction_fee_fix: payment_method.preferred_transaction_fee_fix.to_f,
+          transaction_fee_percentage: payment_method.preferred_transaction_fee_percentage.to_f,
+          enable_pre_auth: payment_method.enable_pre_auth?
+        }
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/load_test/login_token.rb

@@ -0,0 +1,46 @@
+module SpreeCmCommissioner
+  module LoadTest
+    # Stateless, signed login token for load-test accounts — modeled on FB/Google-style login.
+    #
+    # A self-contained JWT whose claims are all the auth layer needs:
+    #   sub   – the load-test user this token logs in as (what UserPasswordAuthenticator trusts)
+    #   email – that user's email, so it travels inside the token (k6 needs nothing alongside it)
+    #   aud   – the admin who minted it (audit trail, carried through to the copied JSON)
+    #   exp   – hard expiry; JWT.decode rejects an expired token on its own, no DB lookup needed
+    #
+    # Nothing is stored on the account and nothing is minted at account-creation time. Tokens are
+    # generated on demand from the admin UI (System → Load Testing → Generate Login Tokens) and
+    # pasted straight into k6, which sends the JWT as the `user_id_token` param on grant_type=password
+    # (UserAuthenticator routes a user_id_token that decodes with our secret to the load-test flow).
+    module LoginToken
+      TTL = 1.hour
+      ALGORITHM = 'HS256'.freeze
+
+      # Purpose-scoped signing key derived from the app's secret_key_base: deterministic per
+      # environment (a token minted now still verifies later on the same box), isolated from every
+      # other use of secret_key_base, and zero-config — no credential to set up per environment.
+      def self.secret
+        Rails.application.key_generator.generate_key('load_test/login_token')
+      end
+
+      # audience is required, not defaulted — callers must state who's minting the token (the
+      # admin's id) rather than letting it silently fall back to something like 'system'.
+      def self.generate(user:, audience:)
+        now = Time.current
+        expires_at = now + TTL
+        payload = { sub: user.id, email: user.email, aud: audience.to_s, iat: now.to_i, exp: expires_at.to_i }
+
+        { token: JWT.encode(payload, secret, ALGORITHM), expires_at: expires_at }
+      end
+
+      # Returns the decoded payload for a validly-signed, unexpired token; nil otherwise.
+      # verify_expiration defaults on, so an expired token raises JWT::ExpiredSignature (a
+      # JWT::DecodeError subclass) and is rejected here. aud is informational — not verified.
+      def self.decode(token)
+        JWT.decode(token, secret, true, algorithm: ALGORITHM).first
+      rescue JWT::DecodeError
+        nil
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/order/guests/update.rb

@@ -0,0 +1,56 @@
+module SpreeCmCommissioner
+  module Order
+    module Guests
+      # Whitelists submitted guest params down to whatever KYC fields and dynamic
+      # fields are actually configured for the guest's line item, then delegates
+      # persistence to UpdateGuestService.
+      #
+      # Expects params shaped as:
+      #   { first_name: '...', ..., dynamic_fields: { '<dynamic_field_id>' => value_or_option_id_or_array_of_option_ids } }
+      class Update
+        prepend ::Spree::ServiceModule::Base
+
+        def call(guest:, params:)
+          SpreeCmCommissioner::UpdateGuestService.new(guest, permitted_params(guest, params)).call
+          success(guest: guest)
+        rescue ActiveRecord::RecordInvalid => e
+          failure(guest, e.record.errors.full_messages.to_sentence)
+        end
+
+        private
+
+        def permitted_params(guest, params)
+          attrs = params.to_h.deep_symbolize_keys
+          editable_attrs = guest.kyc_fields.flat_map { |field| SpreeCmCommissioner::KycBitwise::KYC_FIELD_ATTRIBUTES[field] || [] }
+
+          filtered = attrs.slice(*editable_attrs)
+          filtered[:guest_dynamic_fields_attributes] = build_dynamic_field_attributes(guest, attrs[:dynamic_fields])
+          filtered
+        end
+
+        # Builds the guest_dynamic_fields_attributes array UpdateGuestService expects,
+        # restricted to dynamic fields actually enabled for this guest's product (one
+        # `pluck`/load, not a query per submitted field). Option-based fields (checkbox/
+        # radio/selection) submit one or more selected option ids and become one
+        # GuestDynamicField row per selected option; UpdateGuestService's own auto-cleanup
+        # destroys any existing rows for options that were deselected.
+        def build_dynamic_field_attributes(guest, dynamic_fields)
+          return [] if dynamic_fields.blank?
+
+          enabled_fields = guest.line_item.product.dynamic_fields.index_by(&:id)
+
+          dynamic_fields.flat_map do |dynamic_field_id, value|
+            dynamic_field = enabled_fields[dynamic_field_id.to_s.to_i]
+            next [] unless dynamic_field
+
+            if dynamic_field.requires_dynamic_field_options?
+              Array(value).compact_blank.map { |option_id| { dynamic_field_id: dynamic_field.id, dynamic_field_option_id: option_id } }
+            else
+              [{ dynamic_field_id: dynamic_field.id, value: value }]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/spree_cm_commissioner/pricing_models/create_with_rule_groups.rb

@@ -3,13 +3,13 @@ module SpreeCmCommissioner
     class CreateWithRuleGroups
       prepend ::Spree::ServiceModule::Base
 
-      def call(vendor:, params:, route: nil, origin_place_id: nil, destination_place_id: nil)
+      def call(vendor:, params:, route: nil, trip: nil, origin_place_id: nil, destination_place_id: nil) # rubocop:disable Metrics/ParameterLists
         pricing_model = vendor.pricing_models.new(model_params(params))
 
         ApplicationRecord.transaction do
           pricing_model.save!
           build_rule_groups(pricing_model, params[:rule_groups])
-          create_route_assignment(pricing_model, route, origin_place_id, destination_place_id) if route.present?
+          create_route_assignment(pricing_model, route, trip, origin_place_id, destination_place_id) if route.present?
         end
 
         success(pricing_model)
@@ -41,11 +41,17 @@ module SpreeCmCommissioner
         end
       end
 
-      def create_route_assignment(pricing_model, route, origin_place_id, destination_place_id)
+      # A row is trip-scoped when a trip is given (overrides route pricing for that trip);
+      # otherwise route-scoped (unchanged legacy behaviour). Trip-scoped rows take their O-D from
+      # the trip so they match the trip's own journey at resolution time.
+      def create_route_assignment(pricing_model, route, trip, origin_place_id, destination_place_id)
+        origin_place_id = trip.origin_place_id if trip.present?
+        destination_place_id = trip.destination_place_id if trip.present?
         return unless origin_place_id.present? && destination_place_id.present?
 
         PricingModelRoute.create!(
           route: route,
+          trip: trip,
           pricing_model: pricing_model,
           origin_place_id: origin_place_id,
           destination_place_id: destination_place_id