spree_cm_commissioner 2.9.4 → 2.9.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 73795eb4d207d3bf219b7c5913512b6b82ff71b71f5f9c5ea41acd18a016ade6
-  data.tar.gz: 44ed0c0b84771995b3f858d6d3db3e5c8feb4cb872a5d23981022837c2c8f847
+  metadata.gz: 8b5fced09e0795a88c5dfc1cd5ef84584dc557c0c8f0c26f0c1ed8f0c62f5b9a
+  data.tar.gz: 612e81f2f3b4f7e15e6481c9910523fabc9fed36c9b8b265c83bd9fa1834b826
 SHA512:
-  metadata.gz: 56fa3d866b2de53c7f58978403eb1a04c26a0da14a95d4a8447502dfed4123db703e84ef733385aa0b271774940031a362096a10b3606f0b6dda63dbcb3136ba
-  data.tar.gz: 8343f2ec6ff570e80a833272763431b699d68b926648f5b0a98a8929fd321aa4df7636461cbd2b94c8685dfaef162131440cdd5a02a3610ab1a87ea090d7a02d
+  metadata.gz: 460533fe4a445145c9edd9e4c0fa1c9fa4c4fc6153105f0dea7e9cf2e873e423e6f967ba734931b5206a9309706a40d92c0a0a13b93d3c59bc57d65fc8be023f
+  data.tar.gz: 5f11f494bc107000bd15cf51a6ba29f43c64436f8803257f793488fce84f8d4549c15057f2c5b169460cc601a9fd5cea86bf5ec044999467fe013f9a5c6e5778

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.9.4)
+    spree_cm_commissioner (2.9.5)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/turnstile_protectable.rb

@@ -27,13 +27,15 @@ module SpreeCmCommissioner
       return unless result.failure?
 
       render json: {
-        errors: [{
-          status: '403',
-          error_code: 'human_verification_failed',
-          title: I18n.t('turnstile.verification_failed'),
-          detail: result.message
-        }
-]
+        errors: [
+          {
+            status: '403',
+            error_code: 'human_verification_failed',
+            title: I18n.t('turnstile.verification_failed'),
+            detail: result.message,
+            turnstile_error_code: result.respond_to?(:error_code) ? result.error_code : nil
+          }
+        ]
       }, status: :forbidden
     end
 

data/app/controllers/spree/api/v2/operator/event_charts_controller.rb

@@ -36,6 +36,7 @@ module Spree
             SpreeCmCommissioner::EventChartQueries.new(
               taxon_id: params[:taxon_id],
               chart_type: params[:id] || 'participation',
+              check_in_session_id: params[:check_in_session_id],
               refreshed: params[:refreshed] || false
             )
           end

data/app/controllers/spree/api/v2/operator/guest_json_gzips_controller.rb

@@ -26,6 +26,8 @@ module Spree
 
             result = SpreeCmCommissioner::OperatorGuestJsonGzips::Create.call(
               exportable: exportable,
+              # Scope the offline file to the requesting operator's check-in role (nil = unrestricted).
+              role: spree_current_user.check_in_role_for(exportable),
               force_create: false,
               options: {
                 created_by_id: spree_current_user.id.to_s,
@@ -53,11 +55,19 @@ module Spree
           end
 
           # override
+          # Scope the list to the requesting operator's check-in group, the same way the create cache
+          # does — otherwise a restricted crew could list (and download via exported_file_url) other
+          # groups' files for the event.
           def scope
-            SpreeCmCommissioner::Exports::OperatorGuestJsonGzip.where(
-              exportable_type: 'Spree::Taxon',
-              exportable_id: params[:taxon_id]
-            ).order(created_at: :desc)
+            exportable = Spree::Taxon.find(params[:taxon_id])
+
+            SpreeCmCommissioner::Exports::OperatorGuestJsonGzip
+              .where(
+                exportable_type: 'Spree::Taxon',
+                exportable_id: params[:taxon_id],
+                role_id: spree_current_user.check_in_role_for(exportable)&.id
+              )
+              .order(created_at: :desc)
           end
 
           # override

data/app/controllers/spree/api/v2/storefront/account_checker_controller.rb

@@ -3,6 +3,10 @@ module Spree
     module V2
       module Storefront
         class AccountCheckerController < Spree::Api::V2::BaseController
+          include SpreeCmCommissioner::TurnstileProtectable
+
+          before_action :verify_turnstile!, only: :index
+
           def index
             checker = SpreeCmCommissioner::ExistingAccountChecker.call(filter_params.to_h)
 

data/app/controllers/spree/api/v2/tenant/account/orders_controller.rb

@@ -26,7 +26,7 @@ module Spree
             end
 
             def scope
-              spree_current_user.orders.complete
+              spree_current_user.orders.complete.exclude_vote_package
             end
 
             def collection_serializer

data/app/controllers/spree/api/v2/tenant/my_votes_controller.rb

@@ -0,0 +1,51 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        # Returns the session's contestants each annotated with the current
+        # user's own vote tally (my_vote_count).
+        #
+        # Kept separate from the public VotingContestantsController — that
+        # endpoint does not require an authenticated user and is cacheable,
+        # whereas this one is strictly per-user and must never be cached.
+        class MyVotesController < BaseController
+          before_action :require_spree_current_user
+          before_action :load_voting_session
+
+          def show
+            render_serialized_payload do
+              serialize_collection(collection)
+            end
+          end
+
+          private
+
+          def collection
+            @collection ||= SpreeCmCommissioner::UserVotesPerContestantQuery.new(
+              user: spree_current_user,
+              voting_session: @voting_session
+            ).contestants
+          end
+
+          def load_voting_session
+            @voting_session = current_vendor.voting_sessions.find(params[:voting_session_id])
+          end
+
+          # Overrided: skip collection_options (pagination/links) — this is a
+          # bounded per-session collection, not a paginated one.
+          def serialize_collection(collection)
+            collection_serializer.new(collection).serializable_hash
+          end
+
+          def collection_serializer
+            Spree::V2::Tenant::MyVoteSerializer
+          end
+
+          def model_class
+            SpreeCmCommissioner::VotingContestant
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/show_people_controller.rb

@@ -15,10 +15,7 @@ module Spree
             scope = current_show.show_people
                                 .joins(:assignments)
                                 .distinct
-                                .includes(
-                                  :assignments,
-                                  assigned_contestants: %i[show_contestant_images current_voting_session]
-                                )
+                                .includes(:assignments, :show_person_images)
 
             role = params[:role].presence
             return scope if role.blank?

data/app/controllers/spree/api/v2/tenant/show_person_assignments_controller.rb

@@ -15,7 +15,10 @@ module Spree
 
             model_class.where(show_id: show_ids)
                        .where(show_person_id: params[:person_id], show_id: current_show.id)
-                       .includes(:show_person, :show)
+                       .includes(:show_person, :show, assigned_contestants: %i[
+                         show_contestant_images show_contestant_videos current_voting_session voting_contestants
+                       ]
+                       )
           end
 
           def current_show

data/app/controllers/spree/api/v2/tenant/voting_contestants_controller.rb

@@ -6,13 +6,17 @@ module Spree
           before_action :load_voting_session, only: %i[index]
 
           # override
+          #
+          # Ordered by vote_number. vote_number is nullable — Postgres' default
+          # ASC ordering places nulls last, so contestants without a vote_number
+          # appear at the end.
           def collection
             @collection ||= @voting_session
                             .voting_contestants
-                            .includes(:voting_session, :show_contestant,
+                            .includes(:voting_session, { show_contestant: :assigned_show_person },
                                       :show_contestant_images, :show_contestant_videos,
                                       :advanced_to, :advanced_from
-                            ).order(:position)
+                            ).order(:vote_number)
           end
 
           # override

data/app/interactors/spree_cm_commissioner/host_matcher.rb

@@ -5,10 +5,10 @@ module SpreeCmCommissioner
     def call
       normalized_host = normalize_host(host)
 
-      context.store = find_store(normalized_host)
-      return if context.store.present?
-
       context.tenant = find_tenant(normalized_host)
+      return if context.tenant.present?
+
+      context.store = find_store(normalized_host)
     end
 
     private
@@ -18,11 +18,12 @@ module SpreeCmCommissioner
     end
 
     def find_store(normalized_host)
-      Spree::Store.find_by(code: normalized_host)
+      store_class = Spree::Store
+      store_class.find_by(code: normalized_host) || store_class.default
     end
 
     def find_tenant(normalized_host)
-      SpreeCmCommissioner::Tenant.find_by(host: normalized_host)
+      SpreeCmCommissioner::Tenant.where('host = :host OR payment_host = :host', host: normalized_host).first
     end
   end
 end

data/app/interactors/spree_cm_commissioner/turnstile_token_validator.rb

@@ -2,22 +2,23 @@ module SpreeCmCommissioner
   class TurnstileTokenValidator < BaseInteractor
     SITE_VERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify'.freeze
 
+    # https://developers.cloudflare.com/turnstile/get-started/server-side-validation/#error-codes
+    # Our own secret/setup is wrong -- not something a retry or a fresh token can fix.
+    CONFIG_ERROR_CODES = %w[missing-input-secret invalid-input-secret bad-request].freeze
+    # The token itself expired or was already redeemed -- a fresh token will fix this.
+    EXPIRED_ERROR_CODES = %w[timeout-or-duplicate].freeze
+    # The token we received was malformed/missing -- client should fetch a new one.
+    INVALID_TOKEN_ERROR_CODES = %w[missing-input-response invalid-input-response].freeze
+
     delegate :token, :remote_ip, to: :context
 
     def call
-      context.fail!(message: I18n.t('turnstile.token_missing')) if token.blank?
+      context.fail!(message: I18n.t('turnstile.token_missing'), error_code: :token_missing) if token.blank?
 
       response = verify_token
       body = parse_response(response)
 
-      unless body['success']
-        error_codes = body['error-codes']&.join(', ') || 'unknown'
-        Rails.logger.warn(
-          "Turnstile verification failed: #{error_codes} " \
-          "from IP #{remote_ip} | hostname=#{body['hostname']}"
-        )
-        context.fail!(message: I18n.t('turnstile.verification_failed'))
-      end
+      handle_failure(body) unless body['success']
 
       context.challenge_ts = body['challenge_ts']
       context.hostname = body['hostname']
@@ -26,24 +27,53 @@ module SpreeCmCommissioner
 
     private
 
+    def handle_failure(body)
+      error_codes = Array(body['error-codes'])
+      Rails.logger.warn(
+        "Turnstile verification failed: #{error_codes.join(', ')} " \
+        "from IP #{remote_ip} | hostname=#{body['hostname']}"
+      )
+
+      if error_codes.intersect?(CONFIG_ERROR_CODES)
+        # Not the visitor's fault -- alert ops, but don't leak config details to the client.
+        Rails.logger.error("Turnstile misconfiguration detected: #{error_codes.join(', ')}")
+        context.fail!(message: I18n.t('turnstile.service_unavailable'), error_code: :service_unavailable)
+      elsif error_codes.intersect?(EXPIRED_ERROR_CODES)
+        context.fail!(message: I18n.t('turnstile.token_expired'), error_code: :token_expired)
+      elsif error_codes.intersect?(INVALID_TOKEN_ERROR_CODES)
+        context.fail!(message: I18n.t('turnstile.invalid_token'), error_code: :invalid_token)
+      else
+        context.fail!(message: I18n.t('turnstile.verification_failed'), error_code: :verification_failed)
+      end
+    end
+
     def parse_response(response)
       JSON.parse(response.body)
     rescue JSON::ParserError => e
       Rails.logger.error("Turnstile response parse error: #{e.message}")
-      context.fail!(message: I18n.t('turnstile.service_unavailable'))
+      context.fail!(message: I18n.t('turnstile.service_unavailable'), error_code: :service_unavailable)
     end
 
     def verify_token
-      connection.post do |req|
+      response = connection.post do |req|
         req.body = {
           secret: secret_key,
           response: token,
           remoteip: remote_ip
         }
       end
-    rescue Faraday::TimeoutError, Faraday::ConnectionFailed => e
+
+      unless response.success?
+        Rails.logger.error("Turnstile API returned HTTP #{response.status}")
+        context.fail!(message: I18n.t('turnstile.service_unavailable'), error_code: :service_unavailable)
+      end
+
+      response
+    rescue Faraday::Error => e
+      # Covers timeouts, connection refused/failed, SSL errors, DNS failures, etc. --
+      # anything that means Cloudflare's siteverify endpoint is temporarily unreachable.
       Rails.logger.error("Turnstile API error: #{e.class} - #{e.message}")
-      context.fail!(message: I18n.t('turnstile.service_unavailable'))
+      context.fail!(message: I18n.t('turnstile.service_unavailable'), error_code: :service_unavailable)
     end
 
     def connection

data/app/models/concerns/spree_cm_commissioner/order_qr_codeable.rb

@@ -0,0 +1,39 @@
+module SpreeCmCommissioner
+  module OrderQrCodeable
+    def generate_svg_qr
+      qrcode = RQRCode::QRCode.new(qr_data)
+      qrcode.as_svg(
+        color: '000',
+        shape_rendering: 'crispEdges',
+        module_size: 5,
+        standalone: true,
+        use_path: true,
+        viewbox: '0 0 20 10'
+      )
+    end
+
+    def generate_png_qr(size = 120)
+      qrcode = RQRCode::QRCode.new(qr_data)
+      qrcode.as_png(
+        bit_depth: 1,
+        border_modules: 1,
+        color_mode: ChunkyPNG::COLOR_GRAYSCALE,
+        color: 'black',
+        file: nil,
+        fill: 'white',
+        module_px_size: 4,
+        resize_exactly_to: false,
+        resize_gte_to: false,
+        size: size
+      )
+    end
+
+    def qr_data
+      "#{number}-#{token}"
+    end
+
+    def jwt_qr_data
+      SpreeCmCommissioner::Orders::JwtToken::Generate.call(order: self).value[:token]
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/order_scopes.rb

@@ -40,6 +40,11 @@ module SpreeCmCommissioner
       scope :filter_by_vendor, lambda { |vendor|
         joins(:line_items).where(spree_line_items: { vendor_id: vendor }).distinct
       }
+
+      # Excludes orders containing a vote_package line item.
+      scope :exclude_vote_package, lambda {
+        where.not(id: Spree::LineItem.where(product_type: :vote_package).select(:order_id))
+      }
     end
   end
 end

data/app/models/spree_cm_commissioner/check_in_session.rb

@@ -5,15 +5,51 @@ module SpreeCmCommissioner
     belongs_to :event, class_name: 'Spree::Taxon', optional: false
 
     has_many :check_in_rules, class_name: 'SpreeCmCommissioner::CheckInRule', dependent: :destroy
+    has_many :check_ins, class_name: 'SpreeCmCommissioner::CheckIn', dependent: :restrict_with_error
 
     scope :active, -> { where(is_archived: false) }
 
     accepts_nested_attributes_for :check_in_rules, allow_destroy: true
 
+    validate :start_time_must_be_present_datetime
+    validate :end_time_must_be_present_datetime
+    validate :end_time_after_start_time
+
     after_commit :preload_check_in_session_ids_to_event_guests
 
+    self.whitelisted_ransackable_attributes = %w[is_archived]
+
     private
 
+    def start_time_must_be_present_datetime
+      validate_present_datetime(:start_time)
+    end
+
+    def end_time_must_be_present_datetime
+      validate_present_datetime(:end_time)
+    end
+
+    # Ensures the attribute was both entered by the user and is a real datetime.
+    # A datetime column type-casts unparseable input to nil while keeping the
+    # raw value in `*_before_type_cast`, so blank raw input means "not entered"
+    # and present raw input with a nil cast means "not a valid date/time".
+    def validate_present_datetime(attribute)
+      raw = read_attribute_before_type_cast(attribute)
+
+      if raw.blank?
+        errors.add(attribute, :blank)
+      elsif public_send(attribute).blank?
+        errors.add(attribute, :invalid)
+      end
+    end
+
+    def end_time_after_start_time
+      return if start_time.blank? || end_time.blank?
+      return if end_time > start_time
+
+      errors.add(:base, I18n.t('spree.check_in_session.end_time_after_start_time'))
+    end
+
     def preload_check_in_session_ids_to_event_guests
       SpreeCmCommissioner::Guests::PreloadCheckInSessionIdsJob.perform_later(event_id: event.id)
     end

data/app/models/spree_cm_commissioner/exports/operator_guest_json_gzip.rb

@@ -17,6 +17,12 @@ module SpreeCmCommissioner
         'line_item.variant'
       ].freeze
 
+      # Check-in group scope: one role, one export. `role` is the requesting operator's check-in group
+      # (see User#check_in_role_for) — the file holds only guests whose ticket that role's product scope
+      # allows. `role_id` IS the cache key: callers filter on it directly (a plain `where(role_id:)`),
+      # no product-set comparison needed. `role` nil = unrestricted (the full event).
+      belongs_to :role, class_name: 'Spree::Role', optional: true
+
       store_public_metadata :guests_count, :integer, default: 0
       store_public_metadata :created_by_id, :string
       store_public_metadata :created_by_login, :string
@@ -35,7 +41,7 @@ module SpreeCmCommissioner
         track_messages << "Export started at #{Time.current.iso8601}"
         update(status: :progress, track_messages: track_messages)
 
-        guests_query = SpreeCmCommissioner::GuestSearcherQuery.new(event_id: exportable_id).call
+        guests_query = scoped_guests_query
         self.guests_count = guests_query.count(:id)
 
         track_messages << "Processing #{guests_count} guests in batches"
@@ -68,6 +74,25 @@ module SpreeCmCommissioner
 
       private
 
+      # The event's guests, narrowed to the export's role's products when the export is scoped. Same
+      # GuestSearcherQuery (with its product_ids scope) the dashboard preview runs, so both always
+      # report the same guests. No role = unrestricted (full event).
+      def scoped_guests_query
+        SpreeCmCommissioner::GuestSearcherQuery.new(
+          event_id: exportable_id,
+          product_ids: role_scoped_product_ids
+        ).call
+      end
+
+      # Resolves this export's role into the concrete product ids it covers, computed at export-run
+      # time so a later edit to the role's config doesn't leave an export scoped to stale data.
+      def role_scoped_product_ids
+        return nil if role.nil?
+
+        event_product_ids = role.check_in_exclude? ? exportable.event_products.ids : []
+        role.check_in_scoped_product_ids(event_product_ids)
+      end
+
       def stream_export_data_and_includes_to_separate_files(guests_query, guests_file, included_file)
         # Track "user:123", "order:456" to avoid duplicates includes. For current event scale, Set growth
         # (~20-25 MB for 100K guests × 5 relationships) is manageable.

data/app/models/spree_cm_commissioner/guest.rb

@@ -28,6 +28,10 @@ module SpreeCmCommissioner
     scope :complete_or_canceled, -> { joins(:line_item).merge(Spree::LineItem.complete_or_canceled) }
     scope :unassigned_event, -> { where(event_id: nil) }
     scope :none_bib, -> { where(bib_prefix: [nil, '']) }
+    # Excludes guests whose ticket was transferred away. The original guest keeps its
+    # (still complete) line_item, so `complete` alone would double-count it alongside the
+    # new active guest created for the buyer. Use for attendee counts / aggregates.
+    scope :not_transferred, -> { where.not(state: :transferred) }
 
     belongs_to :line_item, class_name: 'Spree::LineItem'
 

data/app/models/spree_cm_commissioner/maintenance_tasks/event.rb

@@ -23,7 +23,15 @@ module SpreeCmCommissioner
       end
 
       def update_conversion_for(product_taxon)
-        total_count = product_taxon.complete_line_items.sum(:quantity)
+        # Count guests (attendees) instead of line item quantity so this stays consistent
+        # with EventChartQueries, which counts DISTINCT cm_guests.id on complete orders.
+        # Flat join guest -> line_item -> variant -> product filtered by product_id: no
+        # IN-subquery, no self-join, cheapest plan of the variants we benchmarked.
+        total_count = SpreeCmCommissioner::Guest.complete
+                                                .not_transferred
+                                                .joins(line_item: { variant: :product })
+                                                .where(spree_products: { id: product_taxon.product_id })
+                                                .count
         revenue = product_taxon.complete_line_items.sum('quantity * price')
 
         product_taxon.update_columns( # rubocop:disable Rails/SkipsModelValidations

data/app/models/spree_cm_commissioner/order_decorator.rb

@@ -15,6 +15,7 @@ module SpreeCmCommissioner
       base.include SpreeCmCommissioner::RouteOrderCountable
       base.include SpreeCmCommissioner::OrderScopes
       base.include SpreeCmCommissioner::TicketTransferable
+      base.include SpreeCmCommissioner::OrderQrCodeable
 
       base.before_create :link_by_phone_number
       base.before_create :associate_customer
@@ -285,42 +286,6 @@ module SpreeCmCommissioner
       "order/#{id}/has_incomplete_guest_info"
     end
 
-    def generate_svg_qr
-      qrcode = RQRCode::QRCode.new(qr_data)
-      qrcode.as_svg(
-        color: '000',
-        shape_rendering: 'crispEdges',
-        module_size: 5,
-        standalone: true,
-        use_path: true,
-        viewbox: '0 0 20 10'
-      )
-    end
-
-    def generate_png_qr(size = 120)
-      qrcode = RQRCode::QRCode.new(qr_data)
-      qrcode.as_png(
-        bit_depth: 1,
-        border_modules: 1,
-        color_mode: ChunkyPNG::COLOR_GRAYSCALE,
-        color: 'black',
-        file: nil,
-        fill: 'white',
-        module_px_size: 4,
-        resize_exactly_to: false,
-        resize_gte_to: false,
-        size: size
-      )
-    end
-
-    def qr_data
-      "#{number}-#{token}"
-    end
-
-    def jwt_qr_data
-      SpreeCmCommissioner::Orders::JwtToken::Generate.call(order: self).value[:token]
-    end
-
     def enable_send_receipt?
       products.any?(&:enable_send_receipt?)
     end
@@ -331,7 +296,7 @@ module SpreeCmCommissioner
 
     # override spree_vpago method
     def payment_host
-      tenant&.formatted_url.presence || ENV.fetch('DEFAULT_URL_HOST')
+      tenant&.payment_url.presence || tenant&.formatted_url.presence || ENV.fetch('DEFAULT_URL_HOST')
     end
 
     # Returns arrays of connected line_item IDs grouped by connected_trip_id.

data/app/models/spree_cm_commissioner/role_decorator.rb

@@ -1,12 +1,20 @@
 module SpreeCmCommissioner
   module RoleDecorator
-    def self.prepended(base)
-      base.enum role_type: { internal: 0, external: 1, preview: 2 }
+    def self.prepended(base) # rubocop:disable Metrics/AbcSize
+      base.include SpreeCmCommissioner::StoreMetadata
+
+      base.enum role_type: { internal: 0, external: 1, preview: 2, check_in: 3 }
+      base.enum check_in_mode: { all: 0, include: 1, exclude: 2 }, _prefix: :check_in
 
       base.has_many :role_permissions, class_name: 'SpreeCmCommissioner::RolePermission'
       base.has_many :permissions, through: :role_permissions, class_name: 'SpreeCmCommissioner::Permission'
       base.has_many :preview_roles, class_name: 'SpreeCmCommissioner::PreviewRole'
 
+      # Check-in Group scoping: a check_in role belongs to one event (taxon) and lists the products
+      # (ticket types) it may check in, stored as a product_ids array — see #check_in_allows?.
+      base.store_public_metadata :product_ids, :array, default: []
+      base.belongs_to :event, class_name: 'Spree::Taxon', optional: true
+
       base.belongs_to :vendor, optional: true
 
       base.scope :non_vendor, -> { where(vendor_id: nil) }
@@ -16,19 +24,48 @@ module SpreeCmCommissioner
       base.scope :filter_external, -> { where(role_type: :external) }
       base.scope :filter_internal, -> { where(role_type: :internal) }
       base.scope :filter_preview, -> { where(role_type: :preview) }
+      base.scope :filter_check_in, -> { where(role_type: :check_in) }
 
       base.accepts_nested_attributes_for :role_permissions, allow_destroy: true
 
       base.before_validation :generate_unique_name, if: -> { vendor_id.present? }
 
-      base.validates :presentation, uniqueness: { scope: :vendor_id }, presence: true, if: -> { vendor_id.present? }
+      base.validates :presentation, presence: true, if: -> { vendor_id.present? }
+      base.validates :event_id, presence: true, if: -> { check_in? }
+      # Permission roles are unique per vendor; check-in groups are unique per event, so two
+      # events under the same vendor can each own a "VIP" group.
+      base.validates :presentation, uniqueness: { scope: :vendor_id }, if: -> { vendor_id.present? && !check_in? }
+      base.validates :presentation, uniqueness: { scope: %i[vendor_id event_id] }, if: -> { vendor_id.present? && check_in? }
     end
 
     def generate_unique_name
       return if name.present?
       return if presentation.blank?
 
-      self.name = "#{vendor.slug}-#{presentation.downcase.parameterize(separator: '-')}"
+      slug = presentation.downcase.parameterize(separator: '-')
+      # Include the event so a vendor can reuse a group name (e.g. "VIP") across events without
+      # colliding on the globally-unique spree_roles.name.
+      self.name = check_in? ? "#{vendor.slug}-event-#{event_id}-#{slug}" : "#{vendor.slug}-#{slug}"
+    end
+
+    # Whether this check-in group lets a crew check in the given line item. The group's mode decides
+    # how product_ids is read: all = everything, include = allowlist, exclude = blocklist. A group
+    # with no products behaves like "all" regardless of mode.
+    def check_in_allows?(line_item)
+      return true if check_in_all? || product_ids.blank?
+
+      matched = product_ids.include?(line_item.product_id)
+      check_in_exclude? ? !matched : matched
+    end
+
+    # The concrete product ids this group covers, for scoping a data pull (the dashboard preview,
+    # the operator export). `nil` = unrestricted — an all-mode group or one with no products
+    # covers every ticket.
+    def check_in_scoped_product_ids(event_product_ids)
+      return nil if check_in_all? || product_ids.blank?
+
+      ids = product_ids.map(&:to_i)
+      check_in_exclude? ? event_product_ids.map(&:to_i) - ids : ids
     end
   end
 end

data/app/models/spree_cm_commissioner/role_user_decorator.rb

@@ -1,5 +1,16 @@
 module SpreeCmCommissioner
   module RoleUserDecorator
+    def self.prepended(base)
+      base.validate :single_check_in_role_per_event, if: -> { role&.check_in? }
+    end
+
+    private
+
+    # Restricts a user to at most one check-in role per event.
+    def single_check_in_role_per_event
+      existing_check_in_roles = user.spree_roles.filter_check_in.where(event_id: role.event_id).where.not(id: role_id)
+      errors.add(:role, 'already has a check-in group for this event') if existing_check_in_roles.exists?
+    end
   end
 end