spree_cm_commissioner 2.9.4 → 2.9.6

data/app/models/spree_cm_commissioner/role_decorator.rb

@@ -1,12 +1,20 @@
 module SpreeCmCommissioner
   module RoleDecorator
-    def self.prepended(base)
-      base.enum role_type: { internal: 0, external: 1, preview: 2 }
+    def self.prepended(base) # rubocop:disable Metrics/AbcSize
+      base.include SpreeCmCommissioner::StoreMetadata
+
+      base.enum role_type: { internal: 0, external: 1, preview: 2, check_in: 3 }
+      base.enum check_in_mode: { all: 0, include: 1, exclude: 2 }, _prefix: :check_in
 
       base.has_many :role_permissions, class_name: 'SpreeCmCommissioner::RolePermission'
       base.has_many :permissions, through: :role_permissions, class_name: 'SpreeCmCommissioner::Permission'
       base.has_many :preview_roles, class_name: 'SpreeCmCommissioner::PreviewRole'
 
+      # Check-in Group scoping: a check_in role belongs to one event (taxon) and lists the products
+      # (ticket types) it may check in, stored as a product_ids array — see #check_in_allows?.
+      base.store_public_metadata :product_ids, :array, default: []
+      base.belongs_to :event, class_name: 'Spree::Taxon', optional: true
+
       base.belongs_to :vendor, optional: true
 
       base.scope :non_vendor, -> { where(vendor_id: nil) }
@@ -16,19 +24,59 @@ module SpreeCmCommissioner
       base.scope :filter_external, -> { where(role_type: :external) }
       base.scope :filter_internal, -> { where(role_type: :internal) }
       base.scope :filter_preview, -> { where(role_type: :preview) }
+      base.scope :filter_check_in, -> { where(role_type: :check_in) }
 
       base.accepts_nested_attributes_for :role_permissions, allow_destroy: true
 
       base.before_validation :generate_unique_name, if: -> { vendor_id.present? }
 
-      base.validates :presentation, uniqueness: { scope: :vendor_id }, presence: true, if: -> { vendor_id.present? }
+      base.validates :presentation, presence: true, if: -> { vendor_id.present? }
+      base.validates :event_id, presence: true, if: -> { check_in? }
+      # Permission roles are unique per vendor; check-in groups are unique per event, so two
+      # events under the same vendor can each own a "VIP" group.
+      base.validates :presentation, uniqueness: { scope: :vendor_id }, if: -> { vendor_id.present? && !check_in? }
+      base.validates :presentation, uniqueness: { scope: %i[vendor_id event_id] }, if: -> { vendor_id.present? && check_in? }
+
+      base.after_commit :sync_event_has_check_in_groups_flag, on: %i[create destroy], if: -> { check_in? }
     end
 
     def generate_unique_name
       return if name.present?
       return if presentation.blank?
 
-      self.name = "#{vendor.slug}-#{presentation.downcase.parameterize(separator: '-')}"
+      slug = presentation.downcase.parameterize(separator: '-')
+      # Include the event so a vendor can reuse a group name (e.g. "VIP") across events without
+      # colliding on the globally-unique spree_roles.name.
+      self.name = check_in? ? "#{vendor.slug}-event-#{event_id}-#{slug}" : "#{vendor.slug}-#{slug}"
+    end
+
+    # Whether this check-in group lets a crew check in the given line item. The group's mode decides
+    # how product_ids is read: all = everything, include = allowlist, exclude = blocklist. A group
+    # with no products behaves like "all" regardless of mode.
+    def check_in_allows?(line_item)
+      return true if check_in_all? || product_ids.blank?
+
+      matched = product_ids.include?(line_item.product_id)
+      check_in_exclude? ? !matched : matched
+    end
+
+    # The concrete product ids this group covers, for scoping a data pull (the dashboard preview,
+    # the operator export). `nil` = unrestricted — an all-mode group or one with no products
+    # covers every ticket.
+    def check_in_scoped_product_ids(event_product_ids)
+      return nil if check_in_all? || product_ids.blank?
+
+      ids = product_ids.map(&:to_i)
+      check_in_exclude? ? event_product_ids.map(&:to_i) - ids : ids
+    end
+
+    private
+
+    # Keeps Taxon#has_check_in_groups? in sync so User#check_in_group_for can skip querying
+    # spree_roles for events with none. Recomputes from scratch rather than assuming true/false from
+    # the create/destroy alone, since an event can have more than one check-in group.
+    def sync_event_has_check_in_groups_flag
+      event.update!(has_check_in_groups: event.check_in_groups.exists?)
     end
   end
 end

data/app/models/spree_cm_commissioner/role_user_decorator.rb

@@ -1,5 +1,16 @@
 module SpreeCmCommissioner
   module RoleUserDecorator
+    def self.prepended(base)
+      base.validate :single_check_in_role_per_event, if: -> { role&.check_in? }
+    end
+
+    private
+
+    # Restricts a user to at most one check-in role per event.
+    def single_check_in_role_per_event
+      existing_check_in_roles = user.spree_roles.filter_check_in.where(event_id: role.event_id).where.not(id: role_id)
+      errors.add(:role, 'already has a check-in group for this event') if existing_check_in_roles.exists?
+    end
   end
 end
 

data/app/models/spree_cm_commissioner/show_person.rb

@@ -5,7 +5,11 @@ module SpreeCmCommissioner
     has_many :show_person_images, -> { order(:position) }, as: :viewable, class_name: 'SpreeCmCommissioner::ShowPersonImage', dependent: :destroy
     has_many :assignments, class_name: 'SpreeCmCommissioner::ShowPersonAssignment', dependent: :destroy
     has_many :shows, through: :assignments, source: :show
-    has_many :assigned_contestants, class_name: 'SpreeCmCommissioner::ShowContestant', foreign_key: :assigned_show_person_id, dependent: :nullify
+    has_many :assigned_contestants,
+             -> { active },
+             class_name: 'SpreeCmCommissioner::ShowContestant',
+             foreign_key: :assigned_show_person_id,
+             dependent: :nullify
 
     validates :name, presence: true
 

data/app/models/spree_cm_commissioner/show_person_assignment.rb

@@ -12,7 +12,7 @@ module SpreeCmCommissioner
     validates :role, presence: true
 
     has_many :assigned_contestants,
-             -> (assignment) { where(show_id: assignment.show_id) },
+             -> (assignment) { where(show_id: assignment.show_id).active },
              class_name: 'SpreeCmCommissioner::ShowContestant',
              primary_key: :show_person_id,
              foreign_key: :assigned_show_person_id,

data/app/models/spree_cm_commissioner/taxon_decorator.rb

@@ -18,6 +18,8 @@ module SpreeCmCommissioner
       base.has_many :products, through: :classifications, class_name: 'Spree::Product'
       base.has_many :guests, foreign_key: :event_id, class_name: 'SpreeCmCommissioner::Guest', dependent: :nullify
       base.has_many :check_ins, as: :checkinable, class_name: 'SpreeCmCommissioner::CheckIn', dependent: :nullify
+      # Check-in groups for this event (Spree::Role, role_type :check_in). Scoped by event_id (indexed),
+      base.has_many :check_in_groups, -> { filter_check_in }, class_name: 'Spree::Role', foreign_key: :event_id
       base.has_many :customer_taxons, class_name: 'SpreeCmCommissioner::CustomerTaxon'
 
       base.has_many :seat_layouts, as: :layoutable, class_name: 'SpreeCmCommissioner::SeatLayout', dependent: :destroy

data/app/models/spree_cm_commissioner/tenant.rb

@@ -13,10 +13,13 @@ module SpreeCmCommissioner
                                       through: :vendors,
                                       source: :payment_methods
 
-    validates :host, presence: true, uniqueness: true,
-                     format: { without: %r{\Ahttps?://},
-                               message: :format
-                             }
+    validates :host, presence: true,
+                     uniqueness: true,
+                     format: { without: %r{\Ahttps?://}, message: :format }
+
+    validates :payment_host, uniqueness: true,
+                             allow_blank: true,
+                             format: { without: %r{\Ahttps?://}, message: :format }
 
     validates :sms_sender_id, length: { maximum: 11 }, allow_blank: true
 
@@ -35,13 +38,21 @@ module SpreeCmCommissioner
     end
 
     def formatted_url
-      return if host.blank?
+      format_host(host)
+    end
 
-      Rails.env.development? || Rails.env.test? ? "http://#{host}" : "https://#{host}"
+    def payment_url
+      format_host(payment_host)
     end
 
     private
 
+    def format_host(host)
+      return if host.blank?
+
+      Rails.env.development? || Rails.env.test? ? "http://#{host}" : "https://#{host}"
+    end
+
     def generate_slug
       self.slug = name.parameterize if slug.blank?
     end

data/app/models/spree_cm_commissioner/user_decorator.rb

@@ -154,6 +154,41 @@ module SpreeCmCommissioner
       has_spree_role?('operator')
     end
 
+    # Check-in Group: this crew's check-in group (Spree::Role, role_type :check_in) for the event.
+    # One role per user per event — memoized per event so a bulk check-in looks it up once, not per
+    # guest. `nil` = no group (can check in any product). Uses `key?` (not `||=`) so the common "no
+    # group" result — itself `nil` — is cached too, instead of re-querying on every call.
+    def check_in_group_for(event_id)
+      @check_in_group_cache ||= {}
+      return @check_in_group_cache[event_id] if @check_in_group_cache.key?(event_id)
+
+      @check_in_group_cache[event_id] = spree_roles.find_by(role_type: :check_in, event_id: event_id)
+    end
+
+    # Whether this user may check in the given guest. Events with no check-in groups at all are
+    # unrestricted. Otherwise admins and organizers are never restricted; everyone else may check in
+    # the guest's ticket only if their check-in group allows it (include/exclude evaluated on that one
+    # group).
+    def can_check_in_guest?(guest)
+      return true unless guest.event.has_check_in_groups?
+      return true if admin? || organizer?
+
+      group = check_in_group_for(guest.event_id)
+      return true if group.nil?
+
+      group.check_in_allows?(guest.line_item)
+    end
+
+    # This user's check-in role for the event, used to scope the operator offline export (one role, one
+    # export — see Exports::OperatorGuestJsonGzip#role). `nil` = unrestricted (admins/organizers, crew in
+    # no group, or an event with no check-in groups at all — see #can_check_in_guest?).
+    def check_in_role_for(event)
+      return nil unless event.has_check_in_groups?
+      return nil if admin? || organizer?
+
+      check_in_group_for(event.id)
+    end
+
     def vendor_organizer?(vendor)
       spree_roles.any? do |role|
         role.name == "#{vendor.id}-organizer"

data/app/models/spree_cm_commissioner/voting_contestant.rb

@@ -41,6 +41,8 @@ module SpreeCmCommissioner
     validate :advanced_to_and_advanced_from_must_differ
 
     delegate :name, :contestant_number, :category, :gender, :eliminated_at, to: :show_contestant, allow_nil: true
+    delegate :assigned_show_person, to: :show_contestant, allow_nil: true
+    delegate :name, to: :assigned_show_person, prefix: true, allow_nil: true
     delegate :can_vote?, to: :voting_session, allow_nil: true
 
     def special_rule_type=(value)

data/app/queries/spree_cm_commissioner/event_chart_queries.rb

@@ -1,16 +1,19 @@
 module SpreeCmCommissioner
   class EventChartQueries
-    attr_reader :taxon_id, :chart_type, :refreshed
+    attr_reader :taxon_id, :chart_type, :check_in_session_id, :refreshed
 
     # chart_type: 'participation | gender | entry_type' taxon_id: taxon_id, refreshed: false
-    def initialize(taxon_id:, chart_type:, refreshed: false)
+    # check_in_session_id: scopes check-in counts to a single session. When nil, a guest
+    # is counted once regardless of how many sessions they checked into.
+    def initialize(taxon_id:, chart_type:, check_in_session_id: nil, refreshed: false)
       @taxon_id = taxon_id
       @chart_type = chart_type || 'participation'
+      @check_in_session_id = check_in_session_id.presence
       @refreshed = refreshed
     end
 
     def call
-      cache_key = "#{chart_type}-#{taxon_id}"
+      cache_key = [chart_type, taxon_id, check_in_session_id].compact.join('-')
       Rails.cache.delete(cache_key) if refreshed
 
       product_charts = Rails.cache.fetch(cache_key, expires_in: 30.minutes) do
@@ -38,10 +41,10 @@ module SpreeCmCommissioner
 
     def base_joins
       query = SpreeCmCommissioner::Guest
-      join_type = chart_type.in?(%w[participation occupation nationality]) ? 'LEFT' : 'INNER'
+      join_type = chart_type.in?(%w[participation guest_occupation guest_nationality]) ? 'LEFT' : 'INNER'
 
       query
-        .joins("#{join_type} JOIN cm_check_ins ON cm_check_ins.guest_id = cm_guests.id")
+        .joins("#{join_type} JOIN cm_check_ins ON #{check_in_join_condition}")
         .joins('INNER JOIN spree_line_items ON spree_line_items.id = cm_guests.line_item_id')
         .joins('INNER JOIN spree_variants ON spree_variants.id = spree_line_items.variant_id')
         .joins('INNER JOIN spree_orders ON spree_orders.id = spree_line_items.order_id')
@@ -49,6 +52,19 @@ module SpreeCmCommissioner
         .joins('INNER JOIN spree_products_taxons ON spree_products.id = spree_products_taxons.product_id')
         .joins('INNER JOIN spree_taxons ON spree_taxons.id = spree_products_taxons.taxon_id')
         .where(spree_orders: { state: 'complete' }, spree_taxons: { parent_id: taxon_id })
+        .where.not(cm_guests: { state: :transferred })
+    end
+
+    # Filter check-ins to a single session inside the JOIN's ON clause (not WHERE), so
+    # LEFT JOINs still keep no-show guests. When no session is given, every check-in row
+    # is joined and the DISTINCT-guest counts below collapse multiple sessions into one.
+    def check_in_join_condition
+      condition = 'cm_check_ins.guest_id = cm_guests.id'
+      return condition if check_in_session_id.blank?
+
+      ActiveRecord::Base.sanitize_sql_array(
+        ["#{condition} AND cm_check_ins.check_in_session_id = ?", check_in_session_id]
+      )
     end
 
     def participation_event_chart
@@ -117,7 +133,7 @@ module SpreeCmCommissioner
            spree_products.name AS product_name,
            occupation_taxons.name AS name,
            COUNT(DISTINCT cm_guests.id) AS total,
-           COUNT(DISTINCT cm_check_ins.id) AS show'
+           COUNT(DISTINCT cm_check_ins.guest_id) AS show'
              )
              .group('spree_products.id, spree_products.name, occupation_taxons.name')
              .group_by(&:product_id)
@@ -136,7 +152,7 @@ module SpreeCmCommissioner
            spree_products.name AS product_name,
            nationality_taxons.name AS name,
            COUNT(DISTINCT cm_guests.id) AS total,
-           COUNT(DISTINCT cm_check_ins.id) AS show'
+           COUNT(DISTINCT cm_check_ins.guest_id) AS show'
              )
              .group('spree_products.id, spree_products.name, nationality_taxons.name')
              .group_by(&:product_id)

data/app/queries/spree_cm_commissioner/guest_searcher_query.rb

@@ -7,10 +7,25 @@ module SpreeCmCommissioner
     end
 
     def event_id = params[:event_id]
+    def product_ids = params[:product_ids]
 
-    def call # rubocop:disable Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity
+    def call
       return SpreeCmCommissioner::Guest.none if event_id.blank?
 
+      # Optional check-in-group scope (see Role#check_in_scoped_product_ids), set by the operator export
+      # and the dashboard preview. nil = unrestricted; an array narrows to guests whose ticket's product
+      # is in it — an EMPTY array is a real "no tickets" scope and correctly yields no guests.
+      if product_ids.nil?
+        query
+      else
+        query.joins(line_item: :variant).where(spree_variants: { product_id: product_ids })
+      end
+    end
+
+    private
+
+    # The base guest search: QR (order / line item / guest / user), term, ids, or the whole event.
+    def query # rubocop:disable Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity
       if params[:qr_data].present? && order_qr_data?
         search_by_order_qr
       elsif params[:qr_data].present? && line_item_qr_data?
@@ -31,8 +46,6 @@ module SpreeCmCommissioner
       end
     end
 
-    private
-
     def search_by_order_qr
       order = Spree::Order.complete_or_canceled.search_by_qr_data!(params[:qr_data])
       order.guests.where(event_id: event_id)

data/app/queries/spree_cm_commissioner/pie_chart_event_aggregator_queries.rb

@@ -48,6 +48,7 @@ module SpreeCmCommissioner
         .joins('INNER JOIN spree_products_taxons ON spree_products.id = spree_products_taxons.product_id')
         .joins('INNER JOIN spree_taxons ON spree_taxons.id = spree_products_taxons.taxon_id')
         .where(spree_orders: { state: 'complete' }, spree_taxons: { parent_id: taxon_id })
+        .where.not(cm_guests: { state: :transferred })
     end
 
     def participation_pie_chart

data/app/queries/spree_cm_commissioner/user_votes_per_contestant_query.rb

@@ -0,0 +1,48 @@
+# Returns a voting_session's contestants, each carrying the current user's own
+# vote tally for that contestant as a computed my_vote_count attribute.
+#
+# The DB (cm_votes) is the source of truth for per-user tallies — Redis only
+# holds the global, non-user-scoped leaderboard totals, so it cannot answer
+# "how many votes did THIS user give each contestant".
+#
+# Runs as two queries total, regardless of contestant count:
+#   1. voting_contestants LEFT JOINed against a per-contestant SUM(quantity)
+#      subquery scoped to this user+session (no N+1, no per-record query)
+#   2. a batched preload of show_contestant (needed for name/contestant_number)
+#
+# Usage:
+#   SpreeCmCommissioner::UserVotesPerContestantQuery.new(
+#     user: current_user, voting_session: session
+#   ).contestants
+module SpreeCmCommissioner
+  class UserVotesPerContestantQuery
+    attr_reader :user, :voting_session
+
+    def initialize(user:, voting_session:)
+      @user = user
+      @voting_session = voting_session
+    end
+
+    def contestants
+      return SpreeCmCommissioner::VotingContestant.none if user.nil? || voting_session.nil?
+
+      voting_session.voting_contestants
+                    .includes(:show_contestant)
+                    .select('cm_voting_contestants.*, COALESCE(user_votes.total_quantity, 0) AS my_vote_count')
+                    .joins(
+                      "LEFT JOIN (#{user_votes_subquery.to_sql}) user_votes " \
+                      'ON user_votes.contestant_id = cm_voting_contestants.id'
+                    )
+                    .order(:vote_number)
+    end
+
+    private
+
+    def user_votes_subquery
+      SpreeCmCommissioner::Vote
+        .select(:contestant_id, 'SUM(quantity) AS total_quantity')
+        .where(user_id: user.id, voting_session_id: voting_session.id)
+        .group(:contestant_id)
+    end
+  end
+end

data/app/serializers/spree/v2/tenant/my_vote_serializer.rb

@@ -0,0 +1,19 @@
+module Spree
+  module V2
+    module Tenant
+      # Serializes a VotingContestant together with the current user's own vote
+      # tally (my_vote_count) for that contestant in a voting session.
+      #
+      # my_vote_count is a virtual attribute (see VotingContestant) that the
+      # controller sets on each record before serialization — see
+      # MyVotesController#collection.
+      class MyVoteSerializer < BaseSerializer
+        set_type :voting_contestant
+
+        attributes :name, :contestant_number, :vote_number, :my_vote_count
+
+        attribute :voting_session_id, &:voting_session_id
+      end
+    end
+  end
+end

data/app/serializers/spree/v2/tenant/show_serializer.rb

@@ -5,7 +5,8 @@ module Spree
         set_type :show
 
         attributes :slug, :description, :permalink, :from_date, :to_date, :preview, :created_at, :updated_at,
-                   :free_vote_limit, :free_vote_limit_type, :show_type, :credit_votable_type
+                   :free_vote_limit, :free_vote_limit_type, :show_type, :credit_votable_type,
+                   :background_color, :foreground_color
 
         attribute :name, &:display_name
 

data/app/serializers/spree/v2/tenant/voting_contestant_serializer.rb

@@ -10,6 +10,8 @@ module Spree
 
         attribute :voting_session_id, &:voting_session_id
 
+        attribute :assigned_person_name, &:assigned_show_person_name
+
         attribute :can_vote, &:can_vote?
 
         belongs_to :voting_session, serializer: ::Spree::V2::Tenant::VotingSessionSerializer

data/app/services/spree_cm_commissioner/check_ins/create_bulk.rb

@@ -19,12 +19,7 @@ module SpreeCmCommissioner
             guest = indexed_guests[attrs[:guest_id].to_i]
             raise ActiveRecord::RecordNotFound, 'Guest or related record not found' if guest.blank?
 
-            order = guest.line_item.order
-            fail_check_in!(guest, 'Cannot check in Guest from cancelled order') if order.canceled?
-
-            # Validate guest state for check-in
-            fail_check_in!(guest, 'Guest is locked and cannot be checked in') if guest.locked?
-            fail_check_in!(guest, 'Guest has been transferred and cannot be checked in') if guest.transferred?
+            validate_guest_for_check_in!(guest, check_in_by)
 
             check_in = check_in!(guest, attrs, check_in_by, confirmed_at)
             update_guest!(guest, attrs[:guest_attributes]) if attrs[:guest_attributes].present?
@@ -48,6 +43,15 @@ module SpreeCmCommissioner
         raise error
       end
 
+      def validate_guest_for_check_in!(guest, check_in_by)
+        fail_check_in!(guest, I18n.t('spree.check_in.order_canceled')) if guest.line_item.order.canceled?
+        fail_check_in!(guest, I18n.t('spree.check_in.guest_locked')) if guest.locked?
+        fail_check_in!(guest, I18n.t('spree.check_in.guest_transferred')) if guest.transferred?
+
+        # Check-in Groups: crew may only check in the ticket types in their check-in groups for this event.
+        fail_check_in!(guest, I18n.t('spree.check_in.check_in_group_not_allowed')) if check_in_by && !check_in_by.can_check_in_guest?(guest)
+      end
+
       def check_in!(guest, check_in_attributes, check_in_by, confirmed_at)
         check_in = SpreeCmCommissioner::CheckIn.new(
           guest: guest,

data/app/services/spree_cm_commissioner/imports/contestants/create.rb

@@ -8,6 +8,7 @@ module SpreeCmCommissioner
         IMPORTABLE_COLUMNS = %w[
           contestant_number name gender category status origin age bio
           facebook instagram twitter linkedin youtube tiktok telegram
+          video_highlights
         ].freeze
         MAX_ROWS = 50
         SOCIAL_LINK_COLUMNS = %w[facebook instagram twitter linkedin youtube tiktok telegram].freeze
@@ -71,7 +72,7 @@ module SpreeCmCommissioner
           end
         end
 
-        def extract_attrs(row)
+        def extract_attrs(row) # rubocop:disable Metrics/AbcSize
           normalized = row.transform_keys { |k| k.to_s.strip.downcase.tr(' ', '_') }
 
           social_links = SOCIAL_LINK_COLUMNS.each_with_object({}) do |key, hash|
@@ -91,9 +92,26 @@ module SpreeCmCommissioner
           }.compact
 
           attrs[:social_links] = social_links if social_links.any?
+
+          video_highlights = extract_video_highlights(normalized['video_highlights'])
+          attrs[:video_highlights] = video_highlights unless video_highlights.nil?
+
           attrs
         end
 
+        def extract_video_highlights(raw_value)
+          raw_value = raw_value.to_s.strip
+          return nil if raw_value.blank?
+
+          parsed = JSON.parse(raw_value)
+          raise "video_highlights must be a JSON array, got #{parsed.class}" unless parsed.is_a?(Array)
+
+          result = SpreeCmCommissioner::ShowContestants::NormalizeVideoHighlights.call(raw_video_highlights: parsed)
+          raise "invalid video_highlights: #{result.error.value}" unless result.success?
+
+          result.value[:video_highlights]
+        end
+
         def resolve_enum(mapping, value)
           return nil if value.blank?
 

data/app/services/spree_cm_commissioner/operator_guest_json_gzips/create.rb

@@ -5,13 +5,15 @@ module SpreeCmCommissioner
     class Create
       prepend ::Spree::ServiceModule::Base
 
-      def call(exportable:, force_create: false, options: {})
+      # `role`: nil = unrestricted (full event); a Spree::Role (check_in type) scopes the file to that
+      # role's tickets (see User#check_in_role_for). One role, one export.
+      def call(exportable:, role: nil, force_create: false, options: {})
         unless force_create
-          recent_export = find_recent_export(exportable)
+          recent_export = find_recent_export(exportable, role)
           return success(recent_export) if recent_export
         end
 
-        export = build_export(exportable, options)
+        export = build_export(exportable, role, options)
         if export.save
           success(export)
         else
@@ -21,24 +23,29 @@ module SpreeCmCommissioner
 
       private
 
-      def find_recent_export(exportable)
+      def find_recent_export(exportable, role)
         # Cache exports for 24 hours (configurable via OPERATOR_GUEST_JSON_GZIP_CACHE_HOURS).
-        # This ensures all staff see consistent guest data throughout the event day,
+        # This ensures staff sharing the same scope see consistent guest data throughout the event day,
         # minimizes server load, and prevents mid-event data refresh issues.
         #
+        # The cache is keyed on exportable AND role_id so a scoped operator is never handed a broader —
+        # or another group's — cached file, while same-role operators still share one. `role_id: nil`
+        # correctly matches unrestricted exports.
+        #
         # Use force_create=true to manually trigger fresh exports when needed.
         cache_duration = ENV.fetch('OPERATOR_GUEST_JSON_GZIP_CACHE_HOURS', '24').to_i.hours
 
-        SpreeCmCommissioner::Exports::OperatorGuestJsonGzip.where(exportable: exportable)
+        SpreeCmCommissioner::Exports::OperatorGuestJsonGzip.where(exportable: exportable, role_id: role&.id)
                                                            .not_failed
                                                            .where('created_at > ?', cache_duration.ago)
                                                            .order(created_at: :desc)
                                                            .first
       end
 
-      def build_export(exportable, options)
+      def build_export(exportable, role, options)
         SpreeCmCommissioner::Exports::OperatorGuestJsonGzip.new(
           exportable: exportable,
+          role: role,
           **options
         )
       end

data/app/services/spree_cm_commissioner/organizer/export_guest_csv_service.rb

@@ -19,7 +19,7 @@ module SpreeCmCommissioner
       private
 
       def headers
-        columns.map { |col| col.titleize(keep_id_suffix: true) }.uniq
+        columns.map { |col| dynamic_fields_by_id[col]&.label || col.titleize(keep_id_suffix: true) }.uniq
       end
 
       def build_row(guest)
@@ -41,15 +41,11 @@ module SpreeCmCommissioner
       end
 
       def dynamic_field?(column)
-        return false unless dynamic_fields_exist?
-
-        dynamic_field_labels.include?(column)
+        dynamic_fields_by_id.key?(column)
       end
 
-      def dynamic_field_labels
-        return [] unless dynamic_fields_exist?
-
-        @dynamic_field_labels ||= load_dynamic_field_labels
+      def dynamic_fields_by_id
+        @dynamic_fields_by_id ||= load_dynamic_fields.index_by { |field| field.id.to_s }
       end
 
       def dynamic_fields_exist?
@@ -58,12 +54,17 @@ module SpreeCmCommissioner
         @has_dynamic_fields = event.event_products.joins(:product_dynamic_fields).exists?
       end
 
-      def load_dynamic_field_labels
-        event.event_products.joins(product_dynamic_fields: :dynamic_field).distinct.pluck('label')
+      def load_dynamic_fields
+        return [] unless dynamic_fields_exist?
+
+        SpreeCmCommissioner::DynamicField
+          .joins(:product_dynamic_fields)
+          .where(cm_product_dynamic_fields: { product_id: event.event_products.pluck(:id) })
+          .distinct
       end
 
       def fetch_dynamic_field_value(guest, column)
-        guest_dynamic_field = guest.guest_dynamic_fields.find { |gdf| gdf.dynamic_field&.label == column }
+        guest_dynamic_field = guest.guest_dynamic_fields.find { |gdf| gdf.dynamic_field_id.to_s == column }
         return '' unless guest_dynamic_field
 
         if guest_dynamic_field.dynamic_field_option.present?

data/app/services/spree_cm_commissioner/show_contestants/normalize_video_highlights.rb

@@ -31,7 +31,7 @@ module SpreeCmCommissioner
 
       def normalize_video(payload)
         payload_hash = payload.to_h
-        uri = extract_value(payload_hash, 'uri').to_s.strip
+        uri = extract_uri(payload_hash).to_s.strip
 
         {
           'title' => extract_value(payload_hash, 'title').to_s.strip,
@@ -44,6 +44,10 @@ module SpreeCmCommissioner
         hash[key] || hash[key.to_sym]
       end
 
+      def extract_uri(hash)
+        extract_value(hash, 'uri').presence || extract_value(hash, 'url')
+      end
+
       def embed_youtube_url(uri)
         result = UrlEmbed::YoutubeEmbed.call(url: uri)
         result.success? ? result.value : uri