spree_cm_commissioner 2.9.8 → 2.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8eb692e530b34906dfca4d757e6382b9b643e18760fd38ba31507ceb24bb687b
-  data.tar.gz: 782a651003a7817fb539def0a19697d434978c51f7f48c0f2184b48fe87c1260
+  metadata.gz: 6d59a44e1e25ec19ab8c634622f91006ea28bec265ea877dad8565cffa54bad3
+  data.tar.gz: 43415e8984f459f0387e110707963f4685c92251f589a2301342f82783c4e714
 SHA512:
-  metadata.gz: '090263c66bf5f79ea0edfcf6602185b0d80120f33308b2d0193cacf3bb2ebc5036543f1e1000b4e823a243a31cd3dc2eaf3e4b8772c6717d16891554b3da96a0'
-  data.tar.gz: 3540311c234819a354e154a532b7745e91ebf1faf7b15bcc40a5a6def80ea069d3820759b328decb2328f6ad60190a12686d5c23c0951c864ee89215160fd4a1
+  metadata.gz: 1fbfc67d4bc18eb071d854b643ef3bfbaf1312b75f5c241020d58b09855ee234a58064ce08a104ee856b48dec25ce8547ad9c442cbd2648c83ad350c04fec3e1
+  data.tar.gz: 53317e748ac053ed6b60ec7e9accdd915266aa6b3e547692865191868d6051693dcad05dee73bed5e196b027fc27436e72fba2c62e05b3b33f806a7558618cf9

data/.env.example

@@ -22,11 +22,6 @@ WAITING_ROOM_MIN_SESSIONS_COUNT=5
 WAITING_ROOM_DISABLED=no
 WAITING_ROOM_POSITION_STAMP_LIMIT=1000
 WAITING_ROOM_FIRESTORE_BATCH_SIZE=500
-WAITING_ROOM_MIN_WAIT_TO_ENTER_SECONDS=600 # Waiting Room step floor (10 min)
-WAITING_ROOM_MIN_QUEUE_TO_ENTER_SECONDS=300 # Queue step floor (5 min)
-WAITING_ROOM_MAX_WAIT_TO_DISPLAY_SECONDS=3600 # above this the ETA is hidden (1 h)
-WAITING_ROOM_CALLER_INTERVAL_SECONDS=60 # how often the caller runs; match the waiting_guests_caller cron
-WAITING_ROOM_MAX_ETA_BATCH_SIZE=50 # cap on batch size assumed when estimating the ETA
 
 # Vattanac Bank
 VATTANAC_AES_SECRET_KEY= ""

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.9.8)
+    spree_cm_commissioner (2.10.0)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -33,6 +33,7 @@ module SpreeCmCommissioner
       ShowContestantsController
       VotePackagesController
       ShowEliminationSessionsController
+      PaymentMethodsController
     ].freeze
 
     # Priority 3: Moderate Freshness (30 minutes)

data/app/controllers/spree/admin/users_controller_decorator.rb

@@ -26,8 +26,44 @@ module Spree
         super
       end
 
+      def block
+        return redirect_back_to_user(I18n.t('spree_user.cannot_block_yourself'), :error) if own_account?
+        return redirect_back_to_user(I18n.t('spree_user.cannot_block_super_admin'), :error) if @user.super_admin?
+
+        result = SpreeCmCommissioner::Users::Block.call(user: @user, reason: params[:blocked_reason])
+
+        if result.success?
+          redirect_back_to_user(I18n.t('spree_user.successfully_blocked'), :success)
+        else
+          redirect_back_to_user(result.error.to_s, :error)
+        end
+      end
+
+      def unblock
+        result = SpreeCmCommissioner::Users::Unblock.call(user: @user)
+
+        if result.success?
+          redirect_back_to_user(I18n.t('spree_user.successfully_unblocked'), :success)
+        else
+          redirect_back_to_user(result.error.to_s, :error)
+        end
+      end
+
       private
 
+      # An admin who blocks themselves would be locked out with no way back in through the UI.
+      def own_account?
+        @user.id == try_spree_current_user&.id
+      end
+
+      # Blocking is triggered from two places — the row action on the users list and the account
+      # status card on the edit page — so return to whichever one the admin came from instead of
+      # always landing them on the edit page.
+      def redirect_back_to_user(message, type)
+        flash[type] = message
+        redirect_back fallback_location: spree.edit_admin_user_path(@user)
+      end
+
       # Role types the user form doesn't render (assigned in organizer dashboards), e.g. check-in groups and preview.
       NON_FORM_ROLE_TYPES = %i[check_in preview].freeze
 

data/app/controllers/spree/api/v2/base_controller_decorator.rb

@@ -0,0 +1,41 @@
+module Spree
+  module Api
+    module V2
+      # Single enforcement point for blocked users on the API. Every authenticated v2 endpoint -
+      # storefront, tenant, organizer, platform - resolves its user through
+      # Spree::Api::V2::BaseController#spree_current_user, so guarding here covers them all,
+      # including the controllers that inherit BaseController directly rather than
+      # ResourceController.
+      #
+      # 403 rather than 401: the token is valid and the caller is authenticated, they are simply not
+      # allowed anymore. A 401 would tell clients to refresh the token, which would loop.
+      module BaseControllerDecorator
+        # Machine-readable, not translated, so clients can branch on it the same way they already
+        # branch on the authenticators' `account_temporarily_deleted`.
+        BLOCKED_ERROR = 'account_blocked'.freeze
+
+        def self.prepended(base)
+          base.before_action :reject_blocked_user
+        end
+
+        private
+
+        def reject_blocked_user
+          return unless blocked_token_owner?
+
+          render_error_payload(BLOCKED_ERROR, 403)
+        end
+
+        # Deliberately reads the owner off the token instead of calling spree_current_user: that
+        # helper runs doorkeeper_authorize!, which would start rejecting invalid tokens on public
+        # endpoints that today ignore them. No token (anonymous request) costs nothing.
+        def blocked_token_owner?
+          owner = doorkeeper_token&.resource_owner
+          owner.respond_to?(:blocked?) && owner.blocked?
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator)

data/app/controllers/spree/api/v2/storefront/payment_methods_controller.rb

@@ -0,0 +1,40 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        # Order & user independent catalog of the payment methods a vendor accepts.
+        # Takes vendor_id as a required query param. See
+        # Spree::Api::V2::Tenant::PaymentMethodsController for the caching caveat
+        # that comes with that, and for what this deliberately leaves out.
+        class PaymentMethodsController < Spree::Api::V2::ResourceController
+          # override
+          def index
+            render_serialized_payload do
+              collection_serializer.new(collection).serializable_hash
+            end
+          end
+
+          # override
+          def collection
+            @collection ||= SpreeCmCommissioner::PaymentMethods::Find.new(
+              vendor: vendor,
+              store: current_store,
+              type: params[:type]
+            ).execute
+          end
+
+          # override
+          def collection_serializer
+            ::Spree::V2::Storefront::PaymentMethodSerializer
+          end
+
+          private
+
+          def vendor
+            @vendor ||= ::Spree::Vendor.active.find(params[:vendor_id])
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/telegram_oauth_tokens_controller.rb

@@ -11,13 +11,13 @@ module Spree
           def create
             return render_error_payload(credential_mismatch_message) if credential_mismatch_message
 
-            result = SpreeCmCommissioner::TelegramOauthTokenExchanger.call(
+            result = SpreeCmCommissioner::Telegram::ExchangeOauthToken.call(
               exchange_params.merge(client_secret: resolved_client_secret)
             )
 
-            return render_error_payload(result.message) unless result.success?
+            return render_error_payload(result.error) unless result.success?
 
-            render json: result.body, status: result.status, content_type: 'application/json'
+            render json: result.value[:body], status: result.value[:status], content_type: 'application/json'
           end
 
           private
@@ -26,33 +26,19 @@ module Spree
             params.permit(:client_id, :code, :redirect_uri, :code_verifier).to_h.symbolize_keys
           end
 
-          # `tenant_id` scopes which tenant's bot this login belongs to; with none
-          # given, the default store's bot is used. Distinguished from
-          # telegram_oauth_client_secret_not_configured (raised by the exchanger
-          # when the owner has no secret set) so a caller can tell "wrong
-          # tenant/client_id" apart from "correct tenant, nothing configured yet".
           def credential_mismatch_message
-            return 'telegram_oauth_tenant_not_found' if params[:tenant_id].present? && credential_owner.nil?
-            return nil if credential_owner.nil? || credential_owner.preferred_telegram_oauth_client_id.blank?
-            return 'telegram_oauth_client_id_mismatch' unless client_id_matches_owner?
+            return nil if current_store.preferred_telegram_oauth_client_id.blank?
+            return 'telegram_oauth_client_id_mismatch' unless client_id_matches_store?
 
             nil
           end
 
-          def client_id_matches_owner?
-            credential_owner.preferred_telegram_oauth_client_id == exchange_params[:client_id]
+          def client_id_matches_store?
+            current_store.preferred_telegram_oauth_client_id == exchange_params[:client_id]
           end
 
           def resolved_client_secret
-            credential_owner&.preferred_telegram_oauth_client_secret.presence
-          end
-
-          def credential_owner
-            @credential_owner ||= if params[:tenant_id].present?
-                                    SpreeCmCommissioner::Tenant.find_by(id: params[:tenant_id])
-                                  else
-                                    Spree::Store.default
-                                  end
+            current_store.preferred_telegram_oauth_client_secret.presence
           end
         end
       end

data/app/controllers/spree/api/v2/tenant/payment_methods_controller.rb

@@ -0,0 +1,54 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        # Order & user independent catalog of the payment methods a vendor accepts.
+        #
+        # vendor_id is a required query param. A vendor id is globally unique and
+        # belongs to exactly one tenant, so it is what identifies tenant, vendor and
+        # store here — the tenant itself comes from the Doorkeeper token, not the URL.
+        #
+        # IMPORTANT for caching (see SpreeCmCommissioner::ContentCachable): the CDN
+        # must include vendor_id in its cache key. If query strings are stripped,
+        # every vendor collapses into one cache entry and the wrong payment methods
+        # are served. Moving to /vendors/:vendor_id/payment_methods would remove that
+        # dependency — tracked as a follow-up.
+        #
+        # For the per-order truth (store credit, early adopter, payout filtering)
+        # use CartPaymentMethodGroupsController instead.
+        class PaymentMethodsController < BaseController
+          # override
+          def index
+            render_serialized_payload do
+              collection_serializer.new(collection).serializable_hash
+            end
+          end
+
+          # override
+          def collection
+            @collection ||= SpreeCmCommissioner::PaymentMethods::Find.new(
+              vendor: vendor,
+              store: current_store,
+              type: params[:type]
+            ).execute
+          end
+
+          # override
+          def collection_serializer
+            Spree::V2::Tenant::PaymentMethodSerializer
+          end
+
+          private
+
+          # Scoped to the token's tenant, so a token from another tenant gets a 404
+          # rather than a cache hit on someone else's vendor.
+          def vendor
+            @vendor ||= MultiTenant.with(@tenant) do
+              ::Spree::Vendor.active.find(params[:vendor_id])
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/telegram_oauth_tokens_controller.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        # Identical PKCE code->id_token relay as Storefront::TelegramOauthTokensController,
+        # but scoped to the tenant behind the Doorkeeper app access token (see
+        # Tenant::BaseController#require_tenant), exposed under /api/v2/tenant so
+        # tenant-scoped clients can call it alongside /api/v2/tenant/token
+        class TelegramOauthTokensController < BaseController
+          def create
+            return render_error_payload(credential_mismatch_message) if credential_mismatch_message
+
+            result = SpreeCmCommissioner::Telegram::ExchangeOauthToken.call(
+              exchange_params.merge(client_secret: resolved_client_secret)
+            )
+
+            return render_error_payload(result.error) unless result.success?
+
+            render json: result.value[:body], status: result.value[:status], content_type: 'application/json'
+          end
+
+          private
+
+          def exchange_params
+            params.permit(:client_id, :code, :redirect_uri, :code_verifier).to_h.symbolize_keys
+          end
+
+          # @tenant is already resolved from the Doorkeeper app (see BaseController#require_tenant),
+          # so unlike the storefront endpoint there's no separate tenant_id param to validate.
+          def credential_mismatch_message
+            return nil if @tenant.preferred_telegram_oauth_client_id.blank?
+            return 'telegram_oauth_client_id_mismatch' unless client_id_matches_tenant?
+
+            nil
+          end
+
+          def client_id_matches_tenant?
+            @tenant.preferred_telegram_oauth_client_id == exchange_params[:client_id]
+          end
+
+          def resolved_client_secret
+            @tenant.preferred_telegram_oauth_client_secret.presence
+          end
+        end
+      end
+    end
+  end
+end

data/app/finders/spree_cm_commissioner/payment_methods/find.rb

@@ -0,0 +1,59 @@
+module SpreeCmCommissioner
+  module PaymentMethods
+    # Order & user independent lookup of the payment methods a vendor accepts.
+    #
+    # Mirrors the scope selection of Vpago::OrderDecorator#available_payment_methods,
+    # minus everything that depends on the order or the current user, so the result
+    # is safe to cache on the vendor id alone:
+    #
+    #   - available_for_order?  (only Spree::PaymentMethod::StoreCredit varies, on user balance)
+    #   - available_on_frontend_for_early_adopter  (user attribute)
+    #   - support_payout?       (order line items)
+    #   - preferred_payment_method_id  (user, affects sort only)
+    #
+    # Callers needing the per-order truth must keep using
+    # Spree::Api::V2::*::CartPaymentMethodGroupsController.
+    class Find
+      attr_reader :vendor, :store, :type
+
+      def initialize(vendor:, store: nil, type: nil)
+        @vendor = vendor
+        @store = store
+        @type = type
+      end
+
+      def execute
+        return mini_app_scope if type.present?
+
+        scope.reject(&:mini_app?)
+      end
+
+      private
+
+      def scope
+        @scope ||= source.available_on_front_end.order(:position).to_a
+      end
+
+      # Vendors without their own payment methods fall back to the store's,
+      # same as Vpago::OrderDecorator#available_payment_methods.
+      def source
+        vendor_payment_methods.exists? ? vendor_payment_methods : store_payment_methods
+      end
+
+      def vendor_payment_methods
+        @vendor_payment_methods ||= vendor&.payment_methods || Spree::PaymentMethod.none
+      end
+
+      def store_payment_methods
+        (store || Spree::Store.default).payment_methods
+      end
+
+      def mini_app_scope
+        mapped_type = SpreeCmCommissioner::PaymentMethodTypeMapper.call(type)
+        return [] if mapped_type.blank?
+
+        scope.select { |payment_method| payment_method.mini_app? && payment_method.type == mapped_type }
+      end
+    end
+  end
+end

data/app/interactors/spree_cm_commissioner/base_interactor.rb

@@ -1,5 +1,15 @@
 module SpreeCmCommissioner
   class BaseInteractor
     include Interactor
+
+    private
+
+    # Shared tail guard for the authenticators: an account can be resolved and hold a valid
+    # credential and still not be allowed to authenticate. Both messages are error_description values
+    # the mobile/web clients branch on, so they stay raw strings rather than translations.
+    def reject_unauthenticatable_user!(user)
+      context.fail!(message: 'account_temporarily_deleted') if user.soft_deleted?
+      context.fail!(message: 'account_blocked') if user.blocked?
+    end
   end
 end

data/app/interactors/spree_cm_commissioner/user_fb_token_authenticator.rb

@@ -12,7 +12,7 @@ module SpreeCmCommissioner
                        checker.user
                      end
 
-      context.fail!(message: 'account_temporarily_deleted') if context.user.soft_deleted?
+      reject_unauthenticatable_user!(context.user)
     end
 
     private

data/app/interactors/spree_cm_commissioner/user_id_token_authenticator.rb

@@ -7,7 +7,7 @@ module SpreeCmCommissioner
 
       update_user_email if context.user.email.blank?
 
-      context.fail!(message: 'account_temporarily_deleted') if context.user.soft_deleted?
+      reject_unauthenticatable_user!(context.user)
     end
 
     def register_user

data/app/interactors/spree_cm_commissioner/user_password_authenticator.rb

@@ -16,7 +16,7 @@ module SpreeCmCommissioner
       end
 
       context.fail!(message: I18n.t('authenticator.incorrect_password')) unless validate_password(context.user)
-      context.fail!(message: 'account_temporarily_deleted') if context.user.soft_deleted?
+      reject_unauthenticatable_user!(context.user)
     end
 
     private

data/app/interactors/spree_cm_commissioner/user_telegram_oauth_authenticator.rb

@@ -13,16 +13,16 @@ module SpreeCmCommissioner
       provider = verified_provider
       context.user = find_or_register_user(provider)
 
-      context.fail!(message: 'account_temporarily_deleted') if context.user.soft_deleted?
+      reject_unauthenticatable_user!(context.user)
     end
 
     private
 
     def verified_provider
-      result = SpreeCmCommissioner::TelegramOauthIdTokenProvider.call(id_token: id_token, client_id: telegram_client_id)
-      context.fail!(message: result.message) unless result.success?
+      result = SpreeCmCommissioner::Telegram::VerifyOauthIdToken.call(id_token: id_token, client_id: telegram_client_id)
+      context.fail!(message: result.error.to_s) unless result.success?
 
-      result.provider
+      result.value[:provider]
     end
 
     # Each tenant runs its own Telegram bot, so the audience an id_token must

data/app/interactors/spree_cm_commissioner/user_telegram_web_app_authenticator.rb

@@ -8,6 +8,10 @@ module SpreeCmCommissioner
 
       context.telegram_user = ActiveSupport::JSON.decode(checker_context.decoded_telegram_init_data['user'])
       context.user = find_or_create_telegram_user
+
+      # Block check only — this flow has never rejected soft-deleted accounts and this change is not
+      # the place to start.
+      context.fail!(message: 'account_blocked') if context.user.blocked?
     end
 
     def find_or_create_telegram_user

data/app/interactors/spree_cm_commissioner/user_vattanac_bank_web_app_authenticator.rb

@@ -8,6 +8,10 @@ module SpreeCmCommissioner
 
       verify_token!
 
+      # Block check only — this flow has never rejected soft-deleted accounts and this change is not
+      # the place to start.
+      return context.fail!(message: 'account_blocked') if user.blocked?
+
       context.user = user
     rescue JWT::DecodeError => e
       context.fail!(message: "Decode error: #{e.message}")