spree_cm_commissioner 2.9.2 → 2.9.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea1290341adc6665c82f0ca238b21620b882af5eff415f8d76866938ada20bf1
-  data.tar.gz: 5299a81a6a985807378d89609eed247006ec984a7a304f23d48d6deb659b1dcf
+  metadata.gz: 73795eb4d207d3bf219b7c5913512b6b82ff71b71f5f9c5ea41acd18a016ade6
+  data.tar.gz: 44ed0c0b84771995b3f858d6d3db3e5c8feb4cb872a5d23981022837c2c8f847
 SHA512:
-  metadata.gz: 0015dfa2635e073b48c0b0d694e7958d1e7951dac7af8e693a80122a16fc348c413e92bfc4d7ef91da16d232d0c5781e24407165401cad9eeba45c698b01049c
-  data.tar.gz: 837d04df6961bd72fbdc3784f3f9ce2a5283d4001eb37cf6588d1c52e52e6c2a6f77d1ea05f9980a678a9859c9415e310e1bc261b579da03abca0cdeb4e6dd83
+  metadata.gz: 56fa3d866b2de53c7f58978403eb1a04c26a0da14a95d4a8447502dfed4123db703e84ef733385aa0b271774940031a362096a10b3606f0b6dda63dbcb3136ba
+  data.tar.gz: 8343f2ec6ff570e80a833272763431b699d68b926648f5b0a98a8929fd321aa4df7636461cbd2b94c8685dfaef162131440cdd5a02a3610ab1a87ea090d7a02d

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.9.2)
+    spree_cm_commissioner (2.9.4)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/load_test_account_scope.rb

@@ -10,37 +10,30 @@ module SpreeCmCommissioner
       raise NotImplementedError, "#{self.class} must implement #load_test_tenant"
     end
 
-    # Scan cap for the tenant-scoped candidate set below — bounds the query while still comfortably
-    # covering realistic load-test pool sizes.
-    EXPORT_SCAN_LIMIT = 2000
-
-    DEFAULT_EXPORT_PER_PAGE = 20
+    DEFAULT_EXPORT_PER_PAGE = 10
 
     # Queried fresh from the DB every time, so it's always in sync with the current pool rather than
     # a stashed file or session state.
     #
-    # `load_test_account` lives in the `private_metadata` jsonb store (see UserDecorator's
-    # `store_private_metadata`), not a real column, so it can't be filtered in SQL directly —
-    # `store ..., coder: JSON` on top of an already-jsonb column double-encodes the value as a JSON
-    # string scalar rather than a native object, which breaks Postgres's `@>`/`->>` jsonb operators.
-    # Filter with the model's own `load_test_account?` in Ruby instead, which deserializes it
-    # correctly regardless of that storage quirk.
+    # Filters the `load_test_account` flag in SQL via the model's `load_test_accounts` scope (see
+    # UserDecorator), so only the tenant's load-test accounts are considered — never the whole users
+    # table. Unlike the old `order(:id).limit(2000).select(&:...)` approach, there's no scan cap:
+    # newly created accounts (highest ids, ordered first below) always show up even on tenants with
+    # far more than 2,000 users.
     #
-    # Filtering happens in Ruby, so this is a plain Array by the time it needs paging — wrap it
-    # with Kaminari.paginate_array (same pattern as VoteLogsController) to get the same
-    # `page`/`per_page` params and `paginate` view helper every other index page in this app uses,
-    # instead of hand-rolled pagination just for this one page.
+    # Kaminari pages on the relation itself, so the DB only ever loads the current page's rows
+    # (`LIMIT`/`OFFSET`) — never the full pool into memory — via the same `page`/`per_page` params
+    # and `paginate` view helper every other index page in this app uses.
     #
     # Shared between LoadTestAccountManagement (lists/mutates the pool) and
     # LoadTestLoginTokenGeneration (mints tokens for exactly the page shown), so both controllers
     # resolve the same page the same way.
     def export_accounts
-      matches = Spree::User.where(tenant_id: load_test_tenant&.id)
-                           .order(:id)
-                           .limit(EXPORT_SCAN_LIMIT)
-                           .select(&:load_test_account?)
-
-      Kaminari.paginate_array(matches).page(params[:page]).per(params[:per_page] || DEFAULT_EXPORT_PER_PAGE)
+      Spree::User.where(tenant_id: load_test_tenant&.id)
+                 .load_test_accounts
+                 .order(id: :desc)
+                 .page(params[:page])
+                 .per(params[:per_page] || DEFAULT_EXPORT_PER_PAGE)
     end
   end
 end

data/app/controllers/concerns/spree_cm_commissioner/load_test_bypassable.rb

@@ -0,0 +1,29 @@
+module SpreeCmCommissioner
+  # Sets Current.load_test_bypass when the request carries the correct X-Request-Verify secret, so
+  # anti-abuse services (e.g. InventoryHolds::ValidateLimits) can skip their checks for trusted
+  # load tests. No-op unless LOAD_TEST_BYPASS_KEY is set. Include in any controller that can
+  # trigger such a check.
+  module LoadTestBypassable
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :set_load_test_bypass_current
+    end
+
+    private
+
+    # Always assigns the flag (false unless the request carries the correct
+    # secret), so its value never leaks from a previous request.
+    def set_load_test_bypass_current
+      SpreeCmCommissioner::Current.load_test_bypass = load_test_bypass_requested?
+    end
+
+    def load_test_bypass_requested?
+      key = ENV.fetch('LOAD_TEST_BYPASS_KEY', nil)
+      return false if key.blank?
+
+      provided = request.headers.fetch('X-Request-Verify', nil).to_s
+      ActiveSupport::SecurityUtils.secure_compare(provided, key)
+    end
+  end
+end

data/app/controllers/spree/api/chatrace/guests_controller.rb

@@ -53,7 +53,7 @@ module Spree
           preferences upload_later social_contact_platform user_id
           bib_number bib_prefix bib_index public_metadata private_metadata
           seat_number intel_phone_number block_id saved_guest_id
-          data_fill_stage_phase
+          data_fill_stage
         ].freeze
 
         def guest_base_columns

data/app/controllers/spree/api/v2/storefront/account/guest_dynamic_fields_controller.rb

@@ -4,69 +4,40 @@ module Spree
       module Storefront
         module Account
           class GuestDynamicFieldsController < ::Spree::Api::V2::ResourceController
+            ALLOWED_PHASES = %w[pre_registration post_registration].freeze
+
             before_action :require_spree_current_user
             before_action :load_guest
 
             def update_dynamic_field
-              phase = params[:phase]
-
-              return render_error_payload('Invalid phase', 422) unless %w[pre_registration post_registration].include?(phase)
-
-              begin
-                fields = dynamic_fields_params
-              rescue ActionController::ParameterMissing
-                return render_error_payload('No dynamic fields provided', 422)
-              end
-
-              return render_error_payload('No dynamic fields provided', 422) if fields.blank?
-
-              ActiveRecord::Base.transaction do
-                fields.each do |field|
-                  process_dynamic_field(field)
-                end
-
-                @guest.save_and_move_to_next_stage
+              return render_error_payload('Invalid phase') unless ALLOWED_PHASES.include?(params[:phase])
+              return render_error_payload('No dynamic fields provided') if dynamic_fields_params.blank?
+
+              result = SpreeCmCommissioner::Guests::Update.call(
+                guest: @guest,
+                guest_params: {
+                  guest_dynamic_fields_attributes: dynamic_fields_params.map { |f| { dynamic_field_id: f[:id], value: f[:value] } }
+                }
+              )
+
+              if result.success?
+                render_serialized_payload { serialize_guest(result.value[:guest]) }
+              else
+                render_error_payload(result.error)
               end
-
-              render_serialized_payload { serialize_guest(@guest) }
-            rescue ActiveRecord::RecordInvalid => e
-              render_error_payload(e.record.errors, 422)
-            rescue ActiveRecord::RecordNotFound => e
-              render_error_payload(e.message, 404)
             end
 
             private
 
             def dynamic_fields_params
-              params.require(:dynamic_fields).map do |field|
-                field.permit(:id, :value)
-              end
+              Array(params[:dynamic_fields]).map { |field| field.permit(:id, :value) }
             end
 
             def load_guest
               @guest = SpreeCmCommissioner::Guest.find(params[:guest_id])
 
-              unless spree_current_user.guests.exists?(id: @guest.id) ||
-                  @guest.line_item.order.user == spree_current_user
-                render_error_payload('Unauthorized', 401)
-              end
-            end
-
-            def process_dynamic_field(field)
-              dynamic_field = SpreeCmCommissioner::DynamicField.find(field[:id])
-              guest_field = @guest.guest_dynamic_fields.build(dynamic_field_id: dynamic_field.id)
-
-              if dynamic_field.requires_dynamic_field_options?
-                option = dynamic_field.dynamic_field_options.find_by(value: field[:value])
-                raise ActiveRecord::RecordNotFound, "Invalid value for dynamic field #{dynamic_field.label}" unless option
-
-                guest_field.dynamic_field_option = option
-                guest_field.value = option.value
-              else
-                guest_field.value = field[:value]
-              end
-
-              guest_field.save!
+              raise CanCan::AccessDenied unless spree_current_user.guests.exists?(id: @guest.id) ||
+                @guest.line_item.order.user == spree_current_user
             end
 
             def serialize_guest(guest)

data/app/controllers/spree/api/v2/storefront/account/mark_guest_info_complete_controller.rb

@@ -7,7 +7,7 @@ module Spree
             before_action :require_spree_current_user
 
             def update
-              SpreeCmCommissioner::Users::IncompleteGuestCheckerService.new(spree_current_user).call
+              spree_current_user.clear_has_incomplete_guest_info_cache
               render_success
             end
 
@@ -18,7 +18,7 @@ module Spree
                 {
                   success: true,
                   message: 'Guest information marked as complete',
-                  has_incomplete_guest_info: false
+                  has_incomplete_guest_info: spree_current_user.has_incomplete_guest_info?
                 }
               end
             end

data/app/controllers/spree/api/v2/storefront/account/orders_controller_decorator.rb

@@ -24,21 +24,11 @@ module Spree
             private
 
             def find_orders_with_incomplete_guest_info
-              orders = spree_current_user.orders
-                                         .complete
-                                         .includes(line_items: { guests: [:guest_dynamic_fields] })
-
-              incomplete_order_ids = orders.select do |order|
-                order.line_items.any? do |line_item|
-                  line_item.guests.any? do |guest|
-                    guest.pre_registration_completed? &&
-                      guest.post_registration_fields? &&
-                      !guest.post_registration_completed?
-                  end
-                end
-              end.map(&:id)
-
-              spree_current_user.orders.where(id: incomplete_order_ids)
+              spree_current_user.orders
+                                .complete
+                                .joins(:guests)
+                                .merge(SpreeCmCommissioner::Guest.post_registration)
+                                .distinct
             end
 
             def collection_finder

data/app/controllers/spree/api/v2/storefront/account/saved_guests_controller.rb

@@ -0,0 +1,65 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module Account
+          class SavedGuestsController < ::Spree::Api::V2::ResourceController
+            before_action :require_spree_current_user
+            before_action :load_saved_guest, only: %i[show update destroy]
+
+            def collection
+              spree_current_user.saved_guests.order(created_at: :desc)
+                                .page(params[:page])
+                                .per(params[:per_page])
+            end
+
+            def create
+              saved_guest = spree_current_user.saved_guests.new(saved_guest_params)
+
+              if saved_guest.save
+                render_serialized_payload(201) { serialize_resource(saved_guest) }
+              else
+                render_error_payload(saved_guest.errors.full_messages.to_sentence, 422)
+              end
+            end
+
+            def update
+              if @saved_guest.update(saved_guest_params)
+                render_serialized_payload { serialize_resource(@saved_guest) }
+              else
+                render_error_payload(@saved_guest.errors.full_messages.to_sentence, 422)
+              end
+            end
+
+            def destroy
+              @saved_guest.destroy
+              head :no_content
+            end
+
+            private
+
+            def model_class
+              SpreeCmCommissioner::SavedGuest
+            end
+
+            def collection_serializer
+              resource_serializer
+            end
+
+            def resource_serializer
+              SpreeCmCommissioner::V2::Storefront::SavedGuestSerializer
+            end
+
+            def load_saved_guest
+              @saved_guest = spree_current_user.saved_guests.find(params[:id])
+            end
+
+            def saved_guest_params
+              params.require(:saved_guest).permit(*::Spree::PermittedAttributes.saved_guest_attributes)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/draft_orders_controller.rb

@@ -3,6 +3,9 @@ module Spree
     module V2
       module Storefront
         class DraftOrdersController < ::Spree::Api::V2::ResourceController
+          # Creating the order acquires the inventory hold, so honor the load-test bypass here too.
+          include SpreeCmCommissioner::LoadTestBypassable
+
           # Creates a generic draft order from a locally-assembled cart in a single request.
           # Endpoint: POST /api/v2/storefront/draft_orders
           # Params:

data/app/controllers/spree/api/v2/storefront/guests_controller.rb

@@ -31,26 +31,27 @@ module Spree
           def create
             spree_authorize! :update, spree_current_order, order_token
 
-            result = SpreeCmCommissioner::Cart::CreateGuest.call(
+            result = SpreeCmCommissioner::Guests::Create.call(
               line_item: parent,
-              options: guest_params
+              guest_params: guest_params
             )
 
             if result.success?
-              render_serialized_payload(201) { serialize_resource(result.value) }
+              render_serialized_payload(201) { serialize_resource(result.value[:guest]) }
             else
-              render_error_payload(result.value.errors, 422)
+              render_error_payload(result.error || result.value.errors, 422)
             end
           end
 
           def update
             spree_authorize! :update, spree_current_order, order_token unless guest_for_update.pre_registration?
 
-            begin
-              SpreeCmCommissioner::UpdateGuestService.new(guest_for_update, guest_params).call
-              render_serialized_payload { serialize_resource(guest_for_update) }
-            rescue ActiveRecord::RecordInvalid => e
-              render_error_payload(e.record.errors, 422)
+            result = SpreeCmCommissioner::Guests::Update.call(guest: guest_for_update, guest_params: guest_params)
+
+            if result.success?
+              render_serialized_payload { serialize_resource(result.value[:guest]) }
+            else
+              render_error_payload(result.error || result.value&.errors, 422)
             end
           end
 

data/app/controllers/spree/api/v2/storefront/order_histories_controller.rb

@@ -18,7 +18,6 @@ module Spree
             order = Spree::Order.not_archived.find_by!(token: order_token)
 
             spree_authorize! :update, order, order_token
-            raise CanCan::AccessDenied unless order.payment?
 
             if order.mark_as_archive
               render_serialized_payload { serialize_resource(order) }

data/app/controllers/spree/api/v2/tenant/account/saved_guests_controller.rb

@@ -0,0 +1,70 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        module Account
+          class SavedGuestsController < BaseController
+            around_action :wrap_with_multitenant_without
+            before_action :require_spree_current_user
+            before_action :load_saved_guest, only: %i[show update destroy]
+
+            def collection
+              spree_current_user.saved_guests.order(created_at: :desc)
+                                .page(params[:page])
+                                .per(params[:per_page])
+            end
+
+            def create
+              saved_guest = spree_current_user.saved_guests.new(saved_guest_params)
+
+              if saved_guest.save
+                render_serialized_payload(201) { serialize_resource(saved_guest) }
+              else
+                render_error_payload(saved_guest.errors.full_messages.to_sentence, 422)
+              end
+            end
+
+            def update
+              if @saved_guest.update(saved_guest_params)
+                render_serialized_payload { serialize_resource(@saved_guest) }
+              else
+                render_error_payload(@saved_guest.errors.full_messages.to_sentence, 422)
+              end
+            end
+
+            def destroy
+              @saved_guest.destroy
+              head :no_content
+            end
+
+            private
+
+            def wrap_with_multitenant_without(&block)
+              MultiTenant.without(&block)
+            end
+
+            def model_class
+              SpreeCmCommissioner::SavedGuest
+            end
+
+            def collection_serializer
+              resource_serializer
+            end
+
+            def resource_serializer
+              Spree::V2::Tenant::SavedGuestSerializer
+            end
+
+            def load_saved_guest
+              @saved_guest = spree_current_user.saved_guests.find(params[:id])
+            end
+
+            def saved_guest_params
+              params.require(:saved_guest).permit(*::Spree::PermittedAttributes.saved_guest_attributes)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/episodes_controller.rb

@@ -14,7 +14,9 @@ module Spree
           end
 
           def scope
-            current_season.episodes.where(product_type: :show_episode).includes(:voting_sessions, :vote_packages)
+            current_season.episodes
+                          .where(product_type: :show_episode, status: :active)
+                          .includes(:voting_sessions, :vote_packages)
           end
 
           def current_season

data/app/controllers/spree/api/v2/tenant/guests_controller.rb

@@ -30,28 +30,25 @@ module Spree
           def create
             spree_authorize! :update, spree_current_order, order_token
 
-            resource = scope.new(guest_params.except(:guest_dynamic_fields_attributes))
+            result = SpreeCmCommissioner::Guests::Create.call(line_item: parent, guest_params: guest_params)
 
-            ActiveRecord::Base.transaction do
-              resource.save!
-              run_dynamic_fields(resource)
-              resource.save_and_move_to_next_stage
+            if result.success?
+              render_serialized_payload(201) { serialize_resource(result.value[:guest]) }
+            else
+              render_error_payload(result.error || result.value&.errors, 422)
             end
-
-            render_serialized_payload(201) { serialize_resource(resource) }
           end
 
           def update
             spree_authorize! :update, spree_current_order, order_token
 
-            ActiveRecord::Base.transaction do
-              run_dynamic_fields(resource) if guest_params[:guest_dynamic_fields_attributes]
-              resource.assign_attributes(guest_params.except(:guest_dynamic_fields_attributes))
-              resource.save!
-              resource.save_and_move_to_next_stage
-            end
+            result = SpreeCmCommissioner::Guests::Update.call(guest: resource, guest_params: guest_params)
 
-            render_serialized_payload { serialize_resource(resource) }
+            if result.success?
+              render_serialized_payload { serialize_resource(result.value[:guest]) }
+            else
+              render_error_payload(result.error || result.value&.errors, 422)
+            end
           end
 
           private
@@ -99,13 +96,6 @@ module Spree
             )
           end
 
-          def run_dynamic_fields(resource)
-            SpreeCmCommissioner::GuestDynamicFieldsManager.call(
-              resource: resource,
-              dynamic_fields_attributes: guest_params[:guest_dynamic_fields_attributes]
-            )
-          end
-
           def handle_record_invalid(exception)
             render_error_payload(exception.record.errors, 422)
           end

data/app/controllers/spree/api/v2/tenant/order_histories_controller.rb

@@ -21,7 +21,6 @@ module Spree
             order = Spree::Order.not_archived.find_by!(token: order_token)
 
             spree_authorize! :update, order, order_token
-            raise CanCan::AccessDenied unless order.payment?
 
             if order.mark_as_archive
               render_serialized_payload { serialize_resource(order) }

data/app/controllers/spree_cm_commissioner/admin/variants_controller_decorator.rb

@@ -58,8 +58,14 @@ module SpreeCmCommissioner
 
       # Builds the load-test fixture for this variant so it can be used by the k6 booking flow.
       # Shown on a page (with a check for whether the variant can be booked) for the tester to
-      # copy into the load_testing config.
+      # copy into the load_testing config. A product with a tenant_id belongs to a tenant
+      # (SaaS-hosted) store rather than the platform — the two k6 workflows keep separate fixture
+      # folders (load_testing/config/fixture/platform/booking_ticket_flow/ vs
+      # load_testing/config/fixture/tenant/cash_on_booking_ticket_flow/ — the tenant flow is named
+      # cash_on_* since it has an ABA sibling; the platform flow doesn't).
       def fixture
+        @fixture_workflow = @variant.product.tenant_id.present? ? 'tenant' : 'platform'
+        @fixture_flow = @fixture_workflow == 'tenant' ? 'cash_on_booking_ticket_flow' : 'booking_ticket_flow'
         result = SpreeCmCommissioner::LoadTest::GenerateBookingTicketData.call(variant: @variant)
         @fixture = result.value[:data]
         @fixture_issues = result.value[:issues]

data/app/controllers/spree_cm_commissioner/api/v2/storefront/checkout_controller_decorator.rb

@@ -5,22 +5,11 @@ module SpreeCmCommissioner
         module CheckoutControllerDecorator
           def self.prepended(base)
             base.include SpreeCmCommissioner::OrderConcern
-
-            base.before_action :set_load_test_bypass_current
-          end
-
-          private
-
-          def set_load_test_bypass_current
-            key = ENV.fetch('LOAD_TEST_BYPASS_KEY', nil)
-            return if key.blank?
-
-            provided = request.headers.fetch('X-Request-Verify', nil).to_s
-            SpreeCmCommissioner::Current.load_test_bypass = ActiveSupport::SecurityUtils.secure_compare(provided, key)
+            # Sets Current.load_test_bypass from the X-Request-Verify secret so
+            # InventoryHolds::ValidateLimits can skip anti-abuse checks for trusted load tests.
+            base.include SpreeCmCommissioner::LoadTestBypassable
           end
 
-          public
-
           # Override Spree's default behavior:
           # By default, Spree raises an error if `complete` is called on a completed or confirmed order.
           # We want to allow this call to succeed, so the API can be used both to:

data/app/jobs/spree_cm_commissioner/maintenance_tasks/guest_data_fill_stage_batch_job.rb

@@ -0,0 +1,28 @@
+module SpreeCmCommissioner
+  module MaintenanceTasks
+    class GuestDataFillStageBatchJob < ApplicationJob
+      queue_as :maintenance
+
+      # Refreshes data_fill_stage (+ clears has_incomplete_guest_info caches, and optionally
+      # notifies newly-incomplete guests) for a bounded batch of guests. Enqueued in slices by
+      # MaintenanceTasks::GuestDataFillStage#maintain and by the recompute_guest_data_fill_stage
+      # rake task instead of looping over every guest inline, so neither a product with many
+      # completed-order guests nor a full-table backfill blocks a single job for a long time.
+      def perform(guest_ids:, notify: true)
+        SpreeCmCommissioner::Guest
+          .where(id: guest_ids)
+          .includes(line_item: :order)
+          .find_each do |guest|
+            result = SpreeCmCommissioner::Guests::RefreshDataFillStage.call(guest: guest, notify: notify)
+
+            next if result.success?
+
+            CmAppLogger.log(
+              label: "#{self.class.name} failed",
+              data: { guest_id: guest.id, error: result.error.to_s }
+            )
+          end
+      end
+    end
+  end
+end