spree_cm_commissioner 2.9.6 → 2.9.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f187ec143a0546d2099b322062ef981cac276ced2ef0ae9714bd5d5984040d2c
-  data.tar.gz: 1f2a838ce0779597fd0c5b06784b9e0fbb260085457612dcb7e646f61da0482b
+  metadata.gz: 8eb692e530b34906dfca4d757e6382b9b643e18760fd38ba31507ceb24bb687b
+  data.tar.gz: 782a651003a7817fb539def0a19697d434978c51f7f48c0f2184b48fe87c1260
 SHA512:
-  metadata.gz: 9f722ef15d8fef51009e1da877520831551d33d4c2391036dcd31db1ddc6f485cc0d475b6144843fb660404e7e75ecfb77769a646bc6933378b4eca181cadfaa
-  data.tar.gz: 8ef07513d2cb8b65635dfa960b60d84fdbb6d0ad2731cc098f3e99de64901bd3100e80b9a10c0ac1e1243a4c451f2633b93ca3496775f690b10bd6edc2f66369
+  metadata.gz: '090263c66bf5f79ea0edfcf6602185b0d80120f33308b2d0193cacf3bb2ebc5036543f1e1000b4e823a243a31cd3dc2eaf3e4b8772c6717d16891554b3da96a0'
+  data.tar.gz: 3540311c234819a354e154a532b7745e91ebf1faf7b15bcc40a5a6def80ea069d3820759b328decb2328f6ad60190a12686d5c23c0951c864ee89215160fd4a1

data/.env.example

@@ -32,14 +32,9 @@ WAITING_ROOM_MAX_ETA_BATCH_SIZE=50 # cap on batch size assumed when estimating t
 VATTANAC_AES_SECRET_KEY= ""
 VATTANAC_PUBLIC_KEY=""
 
-# Telegram OAuth (OpenID Connect) login.
-# client_id (audience) the mobile app uses when requesting an id_token from
-# Telegram. Verified as the `aud` claim in
-# app/interactors/spree_cm_commissioner/telegram_oauth_id_token_provider.rb
-TELEGRAM_OAUTH_CLIENT_ID=""
-# client_secret injected server-side when proxying the PKCE code -> id_token
-# exchange in app/interactors/spree_cm_commissioner/telegram_oauth_token_exchanger.rb
-TELEGRAM_OAUTH_CLIENT_SECRET=""
+# Telegram OAuth (OpenID Connect) login client_id/client_secret are configured
+# per tenant (or on the default store for tenant-less logins) from the admin
+# under Telegram Authentication - see docs/authentication/telegram-login.md.
 
 # Organizer URL
 ORGANIZER_URL=http://127.0.0.1:4000/organizer

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.9.6)
+    spree_cm_commissioner (2.9.8)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/order_concern.rb

@@ -12,6 +12,7 @@ module SpreeCmCommissioner
       end
 
       @spree_current_order.last_ip_address = request.remote_ip
+      @spree_current_order.device_id = device_id if device_id.present?
       @spree_current_order
     end
 
@@ -25,5 +26,9 @@ module SpreeCmCommissioner
         state: params[:state]
       )
     end
+
+    def device_id
+      params[:device_id].presence
+    end
   end
 end

data/app/controllers/spree/admin/users_controller_decorator.rb

@@ -20,8 +20,26 @@ module Spree
         end
       end
 
+      # override
+      def update
+        preserve_non_form_roles
+        super
+      end
+
       private
 
+      # Role types the user form doesn't render (assigned in organizer dashboards), e.g. check-in groups and preview.
+      NON_FORM_ROLE_TYPES = %i[check_in preview].freeze
+
+      # spree_role_ids= replaces the whole role set, so a submit that omits these would drop them. Merge
+      # the user's existing ones back in so they survive. Skip when the form didn't submit roles at all.
+      def preserve_non_form_roles
+        return if params.dig(:user, :spree_role_ids).nil?
+
+        preserved_ids = @user.spree_roles.where(role_type: NON_FORM_ROLE_TYPES).pluck(:id).map(&:to_s)
+        params[:user][:spree_role_ids] = (params[:user][:spree_role_ids] + preserved_ids).uniq
+      end
+
       def build_profile
         return unless permitted_resource_params[:profile]
 

data/app/controllers/spree/api/v2/storefront/draft_orders_controller.rb

@@ -15,7 +15,8 @@ module Spree
               line_items: draft_order_line_items,
               user: spree_current_user,
               store: current_store,
-              currency: current_currency
+              currency: current_currency,
+              options: { device_id: params[:device_id], last_ip_address: request.remote_ip }
             )
 
             if result.success?

data/app/controllers/spree/api/v2/storefront/telegram_oauth_tokens_controller.rb

@@ -9,7 +9,11 @@ module Spree
         # has no access token yet (this is part of logging in).
         class TelegramOauthTokensController < Spree::Api::V2::BaseController
           def create
-            result = SpreeCmCommissioner::TelegramOauthTokenExchanger.call(exchange_params.to_h.symbolize_keys)
+            return render_error_payload(credential_mismatch_message) if credential_mismatch_message
+
+            result = SpreeCmCommissioner::TelegramOauthTokenExchanger.call(
+              exchange_params.merge(client_secret: resolved_client_secret)
+            )
 
             return render_error_payload(result.message) unless result.success?
 
@@ -19,7 +23,36 @@ module Spree
           private
 
           def exchange_params
-            params.permit(:client_id, :code, :redirect_uri, :code_verifier)
+            params.permit(:client_id, :code, :redirect_uri, :code_verifier).to_h.symbolize_keys
+          end
+
+          # `tenant_id` scopes which tenant's bot this login belongs to; with none
+          # given, the default store's bot is used. Distinguished from
+          # telegram_oauth_client_secret_not_configured (raised by the exchanger
+          # when the owner has no secret set) so a caller can tell "wrong
+          # tenant/client_id" apart from "correct tenant, nothing configured yet".
+          def credential_mismatch_message
+            return 'telegram_oauth_tenant_not_found' if params[:tenant_id].present? && credential_owner.nil?
+            return nil if credential_owner.nil? || credential_owner.preferred_telegram_oauth_client_id.blank?
+            return 'telegram_oauth_client_id_mismatch' unless client_id_matches_owner?
+
+            nil
+          end
+
+          def client_id_matches_owner?
+            credential_owner.preferred_telegram_oauth_client_id == exchange_params[:client_id]
+          end
+
+          def resolved_client_secret
+            credential_owner&.preferred_telegram_oauth_client_secret.presence
+          end
+
+          def credential_owner
+            @credential_owner ||= if params[:tenant_id].present?
+                                    SpreeCmCommissioner::Tenant.find_by(id: params[:tenant_id])
+                                  else
+                                    Spree::Store.default
+                                  end
           end
         end
       end

data/app/controllers/spree/api/v2/tenant/draft_orders_controller.rb

@@ -13,7 +13,8 @@ module Spree
               user: spree_current_user,
               store: current_store,
               currency: current_currency,
-              tenant: @tenant
+              tenant: @tenant,
+              options: { device_id: params[:device_id], last_ip_address: request.remote_ip }
             )
 
             if result.success?

data/app/controllers/spree/api/v2/tenant/order_histories_controller.rb

@@ -43,6 +43,7 @@ module Spree
             # It related to user cancel or complete order flow, which relies on the most recent orders being returned first.
             if spree_current_user.present?
               spree_current_user.orders
+                                .exclude_vote_package
                                 .not_archived
                                 .incomplete
                                 .order(id: :desc)
@@ -51,6 +52,7 @@ module Spree
               return Spree::Order.none if order_tokens.empty?
 
               Spree::Order.not_archived
+                          .exclude_vote_package
                           .incomplete
                           .without_user
                           .where(token: order_tokens)

data/app/finders/spree_cm_commissioner/routes/find.rb

@@ -21,7 +21,7 @@ module SpreeCmCommissioner
         @destination_place_id = @params.dig(:filter, :destination_place_id)
         @query = @params.dig(:filter, :query) || @params[:query]
         @limit = (@params[:limit] || @params.dig(:page, :limit) || 50).to_i
-        @order = @params[:order] || 'created_at DESC'
+        @order = @params[:order] || 'created_at ASC'
       end
 
       def execute

data/app/interactors/spree_cm_commissioner/create_ticket.rb

@@ -117,12 +117,15 @@ module SpreeCmCommissioner
       end
     end
 
-    def ticket_params
+    def ticket_params # rubocop:disable Metrics/AbcSize
       {
         name: context.params[:name],
         price: context.params[:price],
         compare_at_price: context.params[:compare_at_price],
-        max_order_quantity: context.params[:max_order_quantity],
+        max_quantity_per_order: context.params[:max_quantity_per_order],
+        max_quantity_per_account: context.params[:max_quantity_per_account],
+        max_quantity_per_device: context.params[:max_quantity_per_device],
+        max_quantity_per_ip: context.params[:max_quantity_per_ip],
         available_on: context.params[:available_on],
         discontinue_on: context.params[:discontinue_on],
         description: context.params[:description],
@@ -132,7 +135,8 @@ module SpreeCmCommissioner
         shipping_category_id: context.params[:shipping_category_id],
         option_type_ids: context.params[:option_type_ids],
         allow_anonymous_booking: context.params[:allow_anonymous_booking],
-        allow_self_check_in: context.params[:allow_self_check_in]
+        allow_self_check_in: context.params[:allow_self_check_in],
+        purchasable_on: context.params[:purchasable_on] || 'both'
       }
     end
   end

data/app/interactors/spree_cm_commissioner/telegram_oauth_id_token_provider.rb

@@ -15,14 +15,12 @@ module SpreeCmCommissioner
     # "oidc-1") by default.
     SUPPORTED_ALGORITHMS = %w[RS256 ES256].freeze
 
-    # :id_token
+    # :id_token, :client_id
     def call
       context.fail!(message: 'telegram_id_token_missing') if context.id_token.blank?
+      context.fail!(message: 'telegram_oauth_client_id_not_configured') if context.client_id.blank?
 
-      audience = expected_audience
-      context.fail!(message: 'telegram_oauth_client_id_not_configured') if audience.blank?
-
-      claim = decode_id_token(audience)
+      claim = decode_id_token(context.client_id)
       return if claim.nil?
 
       context.claim = claim
@@ -83,10 +81,6 @@ module SpreeCmCommissioner
       context.fail!(message: 'telegram_jwks_fetch_failed', error: e.message)
     end
 
-    def expected_audience
-      ENV['TELEGRAM_OAUTH_CLIENT_ID'].presence
-    end
-
     # sub is the Telegram user id (also the chat id once the user has /started
     # the bot), which keeps OIDC logins consistent with the Telegram Web App
     # flow that also keys UserIdentityProvider.telegram on the Telegram user id.

data/app/interactors/spree_cm_commissioner/telegram_oauth_token_exchanger.rb

@@ -12,13 +12,17 @@ module SpreeCmCommissioner
   # still requires `client_secret`, which is why it must be injected here
   # server-side rather than sent by the app.
   #
+  # `client_secret` is resolved by the caller (which has tenant context from
+  # the request) and passed in like any other param - this interactor only
+  # forwards it to Telegram, it never looks up a tenant/store itself.
+  #
   # Docs: https://core.telegram.org/bots/telegram-login
   class TelegramOauthTokenExchanger < BaseInteractor
     TOKEN_ENDPOINT = 'https://oauth.telegram.org/token'.freeze
 
     REQUIRED_PARAMS = %i[client_id code redirect_uri code_verifier].freeze
 
-    delegate :client_id, :code, :redirect_uri, :code_verifier, to: :context
+    delegate :client_id, :client_secret, :code, :redirect_uri, :code_verifier, to: :context
 
     def call
       missing = REQUIRED_PARAMS.find { |key| context[key].blank? }
@@ -33,10 +37,6 @@ module SpreeCmCommissioner
 
     private
 
-    def client_secret
-      ENV['TELEGRAM_OAUTH_CLIENT_SECRET'].presence
-    end
-
     def post_to_telegram
       uri = URI(TOKEN_ENDPOINT)
       request = Net::HTTP::Post.new(uri)

data/app/interactors/spree_cm_commissioner/user_telegram_oauth_authenticator.rb

@@ -19,12 +19,22 @@ module SpreeCmCommissioner
     private
 
     def verified_provider
-      result = SpreeCmCommissioner::TelegramOauthIdTokenProvider.call(id_token: id_token)
+      result = SpreeCmCommissioner::TelegramOauthIdTokenProvider.call(id_token: id_token, client_id: telegram_client_id)
       context.fail!(message: result.message) unless result.success?
 
       result.provider
     end
 
+    # Each tenant runs its own Telegram bot, so the audience an id_token must
+    # carry is looked up on the tenant directly - no default-store or ENV
+    # fallback, so a misconfigured tenant fails loudly instead of silently
+    # authenticating against someone else's bot.
+    def telegram_client_id
+      return Spree::Store.default.preferred_telegram_oauth_client_id if tenant_id.blank?
+
+      SpreeCmCommissioner::Tenant.find_by(id: tenant_id)&.preferred_telegram_oauth_client_id
+    end
+
     def find_or_register_user(provider)
       identity_checker = SpreeCmCommissioner::UserIdentityChecker.call(
         identity_type: provider[:identity_type],

data/app/mailers/spree/order_mailer_decorator.rb

@@ -3,6 +3,7 @@ module Spree
     def cancel_email(order, resend: false)
       @order = order.respond_to?(:id) ? order : Spree::Order.find(order)
       return false if @order.email.blank?
+      return false if @order.products.all?(&:vote_package?) # disable cancel email for vote package orders
 
       setup_tenant_and_store
       if @tenant.present?

data/app/models/concerns/spree_cm_commissioner/event_metadata.rb

@@ -21,15 +21,25 @@ module SpreeCmCommissioner
       # ⚠️  CRITICAL: Cached seat layout IDs kept in sync by SeatLayout callback.
       # If callback is removed/modified without updating this, availability checks will fail.
       #
-      # Sync callback (see seat_layout.rb:L26-35):
+      # `preload_seat_layout_ids` is every seat layout ever attached to this event, regardless of
+      # status — kept for callers that need the full history/count. `preload_active_seat_layout_ids`
+      # is the subset with status `active`, so consumers checking "can this still be booked?"
+      # (e.g. hasSeatSelection on the app) should use that one instead — deactivating/archiving a
+      # layout removes it from this list even though it stays in `preload_seat_layout_ids`.
+      #
+      # Sync callback (see seat_layout.rb:L32-44):
       #   after_commit :sync_seat_layout_id_to_layoutable!, if: -> { layoutable.present? }
       #   def sync_seat_layout_id_to_layoutable!
-      #     layoutable.update!(preload_seat_layout_ids: layoutable.seat_layouts.pluck(:id))
+      #     layoutable.update!(
+      #       preload_seat_layout_ids: layoutable.seat_layouts.pluck(:id),
+      #       preload_active_seat_layout_ids: layoutable.seat_layouts.active.pluck(:id)
+      #     )
       #   end
       #
       # TODO: Not scalable for many seat layouts. Consider storing boolean flag
       # (has_active_seat_layout) instead when seat layouts become frequent.
       store_public_metadata :preload_seat_layout_ids, :array, default: []
+      store_public_metadata :preload_active_seat_layout_ids, :array, default: []
 
       before_validation :validate_at_least_one_check_in_flow_presence
     end

data/app/models/concerns/spree_cm_commissioner/option_type_attr_type.rb

@@ -29,7 +29,6 @@ module SpreeCmCommissioner
       'duration-in-seconds' => 'integer',
       'payment-option' => 'payment_option',
       'delivery-option' => 'delivery_option',
-      'max-quantity-per-order' => 'integer',
       'due-date' => 'integer',
       'month' => 'integer',
       'number-of-adults' => 'integer',

data/app/models/concerns/spree_cm_commissioner/order_state_machine.rb

@@ -281,6 +281,8 @@ module SpreeCmCommissioner
     end
 
     def notify_order_complete_app_notification_to_user
+      return if products.all?(&:vote_package?) # disable app push notification for vote package orders
+
       SpreeCmCommissioner::OrderCompleteNotificationSender.call(order: self)
     end
 

data/app/models/concerns/spree_cm_commissioner/purchase_limitable.rb

@@ -0,0 +1,59 @@
+# Product-level purchase caps per buyer identity (order, account, device, IP).
+# Stored as public metadata and enforced at cart time by
+# SpreeCmCommissioner::LineItems::ValidatePurchaseLimits.
+module SpreeCmCommissioner
+  module PurchaseLimitable
+    extend ActiveSupport::Concern
+
+    PURCHASE_LIMIT_KEYS = %i[
+      max_quantity_per_order
+      max_quantity_per_account
+      max_quantity_per_device
+      max_quantity_per_ip
+    ].freeze
+
+    POSITIVE_INTEGER = { only_integer: true, greater_than: 0, message: :must_be_positive_integer }.freeze
+
+    included do
+      store_public_metadata :max_quantity_per_order,   :integer
+      store_public_metadata :max_quantity_per_account, :integer
+      store_public_metadata :max_quantity_per_device,  :integer
+      store_public_metadata :max_quantity_per_ip,      :integer
+
+      validates :max_quantity_per_order,   numericality: POSITIVE_INTEGER, allow_nil: true
+      validates :max_quantity_per_account, numericality: POSITIVE_INTEGER, allow_nil: true
+      validates :max_quantity_per_device,  numericality: POSITIVE_INTEGER, allow_nil: true
+      validates :max_quantity_per_ip,      numericality: POSITIVE_INTEGER, allow_nil: true
+
+      validate :validate_max_quantity_per_account
+      validate :validate_max_quantity_per_device
+
+      before_validation :normalize_purchase_limits
+    end
+
+    private
+
+    # A blank cap means "unset". store_public_metadata writes the raw value and its
+    # :integer reader casts with to_i, so a form-submitted "" would otherwise read back
+    # as 0 and fail both the numericality check and the metadata type check.
+    def normalize_purchase_limits
+      return if public_metadata.blank?
+
+      public_metadata.slice(*PURCHASE_LIMIT_KEYS.map(&:to_s)).each do |key, value|
+        public_metadata[key] = nil if value.blank?
+      end
+    end
+
+    def validate_max_quantity_per_account
+      return unless max_quantity_per_account.to_i.positive? && allow_anonymous_booking?
+
+      errors.add(:base, I18n.t('purchase_limit.account_cap_requires_named_booking'))
+    end
+
+    def validate_max_quantity_per_device
+      return unless max_quantity_per_device.to_i.positive? && !purchasable_on_app?
+
+      errors.add(:base, I18n.t('purchase_limit.device_cap_requires_app_only'))
+    end
+  end
+end

data/app/models/concerns/spree_cm_commissioner/store_preference.rb

@@ -11,6 +11,8 @@ module SpreeCmCommissioner
       preference :telegram_order_anomaly_alert_chat_id, :string
       preference :assetlinks, :string, default: ''
       preference :apple_app_site_association, :string, default: ''
+      preference :telegram_oauth_client_id, :string, default: ''
+      preference :telegram_oauth_client_secret, :string, default: ''
     end
   end
 end

data/app/models/concerns/spree_cm_commissioner/tenant_preference.rb

@@ -15,6 +15,8 @@ module SpreeCmCommissioner
       preference :facebook, :string, default: ''
       preference :twitter, :string, default: ''
       preference :instagram, :string, default: ''
+      preference :telegram_oauth_client_id, :string, default: ''
+      preference :telegram_oauth_client_secret, :string, default: ''
     end
   end
 end

data/app/models/concerns/spree_cm_commissioner/variant_options_concern.rb

@@ -14,7 +14,6 @@ module SpreeCmCommissioner
                :duration_in_seconds,
                :payment_option,
                :delivery_option,
-               :max_quantity_per_order,
                :due_date,
                :month,
                :number_of_adults,

data/app/models/spree_cm_commissioner/line_item_decorator.rb

@@ -32,7 +32,7 @@ module SpreeCmCommissioner
       base.before_save :update_vendor_id
 
       base.before_create :add_due_date, if: :subscription?
-      base.validate :ensure_not_exceed_max_quantity_per_order, if: -> { variant&.max_quantity_per_order.present? }
+      base.validate :ensure_not_exceed_purchase_limits, if: -> { product.present? }
       base.validate :ensure_all_guests_have_blocks, if: :required_seat_selection?
 
       base.whitelisted_ransackable_associations |= %w[guests order]
@@ -290,8 +290,9 @@ module SpreeCmCommissioner
 
     private
 
-    def ensure_not_exceed_max_quantity_per_order
-      errors.add(:quantity, I18n.t('line_item.validation.exceeded_max_quantity_per_order')) if quantity > variant.max_quantity_per_order
+    def ensure_not_exceed_purchase_limits
+      result = SpreeCmCommissioner::LineItems::ValidatePurchaseLimits.call(line_item: self)
+      errors.add(:quantity, result.error.to_s) unless result.success?
     end
 
     def ensure_all_guests_have_blocks

data/app/models/spree_cm_commissioner/product_decorator.rb

@@ -11,6 +11,7 @@ module SpreeCmCommissioner
       base.include SpreeCmCommissioner::Integrations::IntegrationMappable
       base.include SpreeCmCommissioner::StoreMetadata
       base.include SpreeCmCommissioner::HomepageSectionRelatableConcern
+      base.include SpreeCmCommissioner::PurchaseLimitable
 
       base.delegate :is_open_dated, :is_open_dated?, to: :trip, allow_nil: true
 

data/app/models/spree_cm_commissioner/seat_layout.rb

@@ -33,11 +33,19 @@ module SpreeCmCommissioner
       # Update layoutable's seat layout metadata after any change (create/update/destroy).
       # This keeps the cache in sync with the actual seat_layouts association.
       if layoutable.respond_to?(:seat_layouts)
-        # Event has many seat layouts: cache all IDs for quick availability checks.
-        layoutable.update!(preload_seat_layout_ids: layoutable.seat_layouts.pluck(:id))
+        # Event has many seat layouts: `..._ids` caches every layout ever attached (any status);
+        # `active_..._ids` caches only the `active` ones, for callers checking bookability.
+        layoutable.update!(
+          preload_seat_layout_ids: layoutable.seat_layouts.pluck(:id),
+          preload_active_seat_layout_ids: layoutable.seat_layouts.active.pluck(:id)
+        )
       elsif layoutable.respond_to?(:seat_layout)
-        # Taxon/Vehicle has single seat layout: cache the ID (or nil if destroyed).
-        layoutable.update!(preload_seat_layout_id: destroyed? ? nil : id)
+        # Taxon/Vehicle has single seat layout: cache the ID (or nil if destroyed); the active
+        # variant is also nil while the layout is inactive/archived, not just when destroyed.
+        layoutable.update!(
+          preload_seat_layout_id: destroyed? ? nil : id,
+          preload_active_seat_layout_id: destroyed? || !active? ? nil : id
+        )
       end
     end
   end

data/app/models/spree_cm_commissioner/show.rb

@@ -13,7 +13,9 @@ module SpreeCmCommissioner
     has_many :vote_packages, -> { where(product_type: :vote_package) }, class_name: 'SpreeCmCommissioner::ShowEpisode', foreign_key: :event_id
     has_many :voting_sessions, through: :episodes, class_name: 'SpreeCmCommissioner::VotingSession'
 
-    has_one :current_episode, -> { current_or_next_upcoming }, class_name: 'SpreeCmCommissioner::ShowEpisode', foreign_key: :event_id
+    has_one :current_episode, lambda {
+                                current_or_next_upcoming.where(status: :active)
+                              }, class_name: 'SpreeCmCommissioner::ShowEpisode', foreign_key: :event_id
     has_one :current_voting_session, through: :current_episode
 
     before_validation { self.type = self.class.name }

data/app/models/spree_cm_commissioner/show_episode.rb

@@ -17,7 +17,9 @@ module SpreeCmCommissioner
              primary_key: :event_id
     has_many :contestants, through: :season, source: :show_contestants
 
-    has_one :current_voting_session, -> { current_or_next_upcoming }, class_name: 'SpreeCmCommissioner::VotingSession', foreign_key: :episode_id
+    has_one :current_voting_session, lambda {
+                                       current_or_next_upcoming.where.not(status: :disabled)
+                                     }, class_name: 'SpreeCmCommissioner::VotingSession', foreign_key: :episode_id
 
     validates :ends_at, presence: true, if: -> { product_type == 'show_episode' }
 

data/app/models/spree_cm_commissioner/trip.rb

@@ -8,10 +8,15 @@ module SpreeCmCommissioner
 
     enum trip_type: { direct: 0, multi_leg: 1 }
 
+    # public: shown in trip search results; unpublic: hidden from search (kept for the owning vendor).
+    # _prefix avoids generating a bare `public?` / `Trip.public` that would collide with Ruby's `public`.
+    enum visibility: { public: 0, unpublic: 1 }, _prefix: true, _default: :public
+
     # This model has no seat_layout column (polymorphic association), so we store the preload_seat_layout_id ID in public_metadata.
     # This lets us check if a seat layout exists without triggering a database query.
     # The ID is automatically updated whenever the seat_layout is saved.
     store_public_metadata :preload_seat_layout_id, :integer
+    store_public_metadata :preload_active_seat_layout_id, :integer
 
     # Trip: array of offsets for each leg # => [0, 1, 2]
     # Usage: trip.preload_offset_days_array[0] # => 0

data/app/models/spree_cm_commissioner/variant_options.rb

@@ -81,10 +81,6 @@ module SpreeCmCommissioner
       @delivery_option ||= option_value_name_for(option_type_name: 'delivery-option')
     end
 
-    def max_quantity_per_order
-      @max_quantity_per_order ||= option_value_name_for(option_type_name: 'max-quantity-per-order')&.to_i
-    end
-
     def due_date
       @due_date ||= option_value_name_for(option_type_name: 'due-date')&.to_i
     end

data/app/models/spree_cm_commissioner/vehicle_type.rb

@@ -7,6 +7,7 @@ module SpreeCmCommissioner
     # This lets us check if a seat layout exists without triggering a database query.
     # The ID is automatically updated whenever the seat_layout is saved.
     store_public_metadata :preload_seat_layout_id, :integer
+    store_public_metadata :preload_active_seat_layout_id, :integer
 
     attr_accessor :enable_seat_layout
 

data/app/overrides/spree/admin/stores/_form/telegram_auth.html.erb.deface

@@ -0,0 +1,73 @@
+<!-- insert_bottom "[data-hook='admin_store_form_fields']" -->
+
+<% if @store.persisted? %>
+  <%
+    telegram_client_id = @store.preferred_telegram_oauth_client_id.presence
+    telegram_client_secret = @store.preferred_telegram_oauth_client_secret.presence
+    telegram_configured = telegram_client_id.present? && telegram_client_secret.present?
+    telegram_partial = telegram_client_id.present? ^ telegram_client_secret.present?
+  %>
+  <div class="card mb-4">
+    <div class="card-header d-flex flex-wrap align-items-center justify-content-between">
+      <h5 class="card-title mb-0 h6">Telegram Authentication</h5>
+      <% if telegram_configured %>
+        <span class="badge badge-success">Using this store's bot</span>
+      <% elsif telegram_partial %>
+        <span class="badge badge-warning">Incomplete</span>
+      <% else %>
+        <span class="badge badge-danger">Not configured</span>
+      <% end %>
+    </div>
+    <div class="card-body">
+      <div id="telegram-auth-settings" data-hook class="form-group mb-0">
+        <div class="row">
+          <!-- Telegram OAuth Client ID -->
+          <div class="col-md-6">
+            <%= f.field_container :preferred_telegram_oauth_client_id do %>
+              <%= f.label :preferred_telegram_oauth_client_id, 'Client ID' %>
+              <%= f.text_field :preferred_telegram_oauth_client_id, class: 'form-control text-monospace',
+                    placeholder: 'e.g. 7123456789', autocomplete: 'off' %>
+              <small class="form-text text-muted">Bot ID &mdash; digits before the colon in the BotFather token.</small>
+              <%= f.error_message_on :preferred_telegram_oauth_client_id %>
+            <% end %>
+          </div>
+
+          <!-- Telegram OAuth Client Secret -->
+          <div class="col-md-6">
+            <%= f.field_container :preferred_telegram_oauth_client_secret do %>
+              <%= f.label :preferred_telegram_oauth_client_secret, 'Client Secret' %>
+              <div class="input-group">
+                <%= f.password_field :preferred_telegram_oauth_client_secret,
+                      class: 'form-control text-monospace', id: 'store_telegram_oauth_client_secret',
+                      autocomplete: 'new-password', value: f.object.preferred_telegram_oauth_client_secret %>
+                <div class="input-group-append">
+                  <button type="button" class="btn btn-outline-secondary"
+                          data-telegram-secret-toggle="store_telegram_oauth_client_secret">
+                    Show
+                  </button>
+                </div>
+              </div>
+              <small class="form-text text-muted">From BotFather. Server-side only &mdash; never sent to the app.</small>
+              <%= f.error_message_on :preferred_telegram_oauth_client_secret %>
+            <% end %>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <script>
+    (function () {
+      document.querySelectorAll('[data-telegram-secret-toggle]').forEach(function (button) {
+        button.addEventListener('click', function () {
+          var field = document.getElementById(button.dataset.telegramSecretToggle);
+          if (!field) return;
+
+          var hidden = field.type === 'password';
+          field.type = hidden ? 'text' : 'password';
+          button.textContent = hidden ? 'Hide' : 'Show';
+        });
+      });
+    })();
+  </script>
+<% end %>