spree_cm_commissioner 2.9.9 → 2.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 391b15d7aada08289da9a21d18a9d48d461ecf1fe0c36a361a276df201455a5e
-  data.tar.gz: af3f07ac5d9e449cb5300949dbbcdcb80981b78b41f0aa23a396ce6cdd49e68b
+  metadata.gz: 6d59a44e1e25ec19ab8c634622f91006ea28bec265ea877dad8565cffa54bad3
+  data.tar.gz: 43415e8984f459f0387e110707963f4685c92251f589a2301342f82783c4e714
 SHA512:
-  metadata.gz: 49e38586ae76dfcf37be8bb6f9c4ddef60a2ef694f491ffb648b5903070dd0932c2efb1d936f3c5a6b4c1af16355b2ddc26e4706cc04c7ed32bed0908ed88db5
-  data.tar.gz: be58778bd8a6124b8b3c914e9c0c83a44dce42a75c1df0f677ef00868bc388f3fa88518828e1833b701366eedf551e03a30528919a2c1f8ea16aec108d92b8fe
+  metadata.gz: 1fbfc67d4bc18eb071d854b643ef3bfbaf1312b75f5c241020d58b09855ee234a58064ce08a104ee856b48dec25ce8547ad9c442cbd2648c83ad350c04fec3e1
+  data.tar.gz: 53317e748ac053ed6b60ec7e9accdd915266aa6b3e547692865191868d6051693dcad05dee73bed5e196b027fc27436e72fba2c62e05b3b33f806a7558618cf9

data/.env.example

@@ -22,11 +22,6 @@ WAITING_ROOM_MIN_SESSIONS_COUNT=5
 WAITING_ROOM_DISABLED=no
 WAITING_ROOM_POSITION_STAMP_LIMIT=1000
 WAITING_ROOM_FIRESTORE_BATCH_SIZE=500
-WAITING_ROOM_MIN_WAIT_TO_ENTER_SECONDS=600 # Waiting Room step floor (10 min)
-WAITING_ROOM_MIN_QUEUE_TO_ENTER_SECONDS=300 # Queue step floor (5 min)
-WAITING_ROOM_MAX_WAIT_TO_DISPLAY_SECONDS=3600 # above this the ETA is hidden (1 h)
-WAITING_ROOM_CALLER_INTERVAL_SECONDS=60 # how often the caller runs; match the waiting_guests_caller cron
-WAITING_ROOM_MAX_ETA_BATCH_SIZE=50 # cap on batch size assumed when estimating the ETA
 
 # Vattanac Bank
 VATTANAC_AES_SECRET_KEY= ""

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.9.9)
+    spree_cm_commissioner (2.10.0)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/spree/admin/users_controller_decorator.rb

@@ -26,8 +26,44 @@ module Spree
         super
       end
 
+      def block
+        return redirect_back_to_user(I18n.t('spree_user.cannot_block_yourself'), :error) if own_account?
+        return redirect_back_to_user(I18n.t('spree_user.cannot_block_super_admin'), :error) if @user.super_admin?
+
+        result = SpreeCmCommissioner::Users::Block.call(user: @user, reason: params[:blocked_reason])
+
+        if result.success?
+          redirect_back_to_user(I18n.t('spree_user.successfully_blocked'), :success)
+        else
+          redirect_back_to_user(result.error.to_s, :error)
+        end
+      end
+
+      def unblock
+        result = SpreeCmCommissioner::Users::Unblock.call(user: @user)
+
+        if result.success?
+          redirect_back_to_user(I18n.t('spree_user.successfully_unblocked'), :success)
+        else
+          redirect_back_to_user(result.error.to_s, :error)
+        end
+      end
+
       private
 
+      # An admin who blocks themselves would be locked out with no way back in through the UI.
+      def own_account?
+        @user.id == try_spree_current_user&.id
+      end
+
+      # Blocking is triggered from two places — the row action on the users list and the account
+      # status card on the edit page — so return to whichever one the admin came from instead of
+      # always landing them on the edit page.
+      def redirect_back_to_user(message, type)
+        flash[type] = message
+        redirect_back fallback_location: spree.edit_admin_user_path(@user)
+      end
+
       # Role types the user form doesn't render (assigned in organizer dashboards), e.g. check-in groups and preview.
       NON_FORM_ROLE_TYPES = %i[check_in preview].freeze
 

data/app/controllers/spree/api/v2/base_controller_decorator.rb

@@ -0,0 +1,41 @@
+module Spree
+  module Api
+    module V2
+      # Single enforcement point for blocked users on the API. Every authenticated v2 endpoint -
+      # storefront, tenant, organizer, platform - resolves its user through
+      # Spree::Api::V2::BaseController#spree_current_user, so guarding here covers them all,
+      # including the controllers that inherit BaseController directly rather than
+      # ResourceController.
+      #
+      # 403 rather than 401: the token is valid and the caller is authenticated, they are simply not
+      # allowed anymore. A 401 would tell clients to refresh the token, which would loop.
+      module BaseControllerDecorator
+        # Machine-readable, not translated, so clients can branch on it the same way they already
+        # branch on the authenticators' `account_temporarily_deleted`.
+        BLOCKED_ERROR = 'account_blocked'.freeze
+
+        def self.prepended(base)
+          base.before_action :reject_blocked_user
+        end
+
+        private
+
+        def reject_blocked_user
+          return unless blocked_token_owner?
+
+          render_error_payload(BLOCKED_ERROR, 403)
+        end
+
+        # Deliberately reads the owner off the token instead of calling spree_current_user: that
+        # helper runs doorkeeper_authorize!, which would start rejecting invalid tokens on public
+        # endpoints that today ignore them. No token (anonymous request) costs nothing.
+        def blocked_token_owner?
+          owner = doorkeeper_token&.resource_owner
+          owner.respond_to?(:blocked?) && owner.blocked?
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator)

data/app/controllers/spree/api/v2/storefront/telegram_oauth_tokens_controller.rb

@@ -11,13 +11,13 @@ module Spree
           def create
             return render_error_payload(credential_mismatch_message) if credential_mismatch_message
 
-            result = SpreeCmCommissioner::TelegramOauthTokenExchanger.call(
+            result = SpreeCmCommissioner::Telegram::ExchangeOauthToken.call(
               exchange_params.merge(client_secret: resolved_client_secret)
             )
 
-            return render_error_payload(result.message) unless result.success?
+            return render_error_payload(result.error) unless result.success?
 
-            render json: result.body, status: result.status, content_type: 'application/json'
+            render json: result.value[:body], status: result.value[:status], content_type: 'application/json'
           end
 
           private
@@ -26,33 +26,19 @@ module Spree
             params.permit(:client_id, :code, :redirect_uri, :code_verifier).to_h.symbolize_keys
           end
 
-          # `tenant_id` scopes which tenant's bot this login belongs to; with none
-          # given, the default store's bot is used. Distinguished from
-          # telegram_oauth_client_secret_not_configured (raised by the exchanger
-          # when the owner has no secret set) so a caller can tell "wrong
-          # tenant/client_id" apart from "correct tenant, nothing configured yet".
           def credential_mismatch_message
-            return 'telegram_oauth_tenant_not_found' if params[:tenant_id].present? && credential_owner.nil?
-            return nil if credential_owner.nil? || credential_owner.preferred_telegram_oauth_client_id.blank?
-            return 'telegram_oauth_client_id_mismatch' unless client_id_matches_owner?
+            return nil if current_store.preferred_telegram_oauth_client_id.blank?
+            return 'telegram_oauth_client_id_mismatch' unless client_id_matches_store?
 
             nil
           end
 
-          def client_id_matches_owner?
-            credential_owner.preferred_telegram_oauth_client_id == exchange_params[:client_id]
+          def client_id_matches_store?
+            current_store.preferred_telegram_oauth_client_id == exchange_params[:client_id]
           end
 
           def resolved_client_secret
-            credential_owner&.preferred_telegram_oauth_client_secret.presence
-          end
-
-          def credential_owner
-            @credential_owner ||= if params[:tenant_id].present?
-                                    SpreeCmCommissioner::Tenant.find_by(id: params[:tenant_id])
-                                  else
-                                    Spree::Store.default
-                                  end
+            current_store.preferred_telegram_oauth_client_secret.presence
           end
         end
       end

data/app/controllers/spree/api/v2/tenant/telegram_oauth_tokens_controller.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        # Identical PKCE code->id_token relay as Storefront::TelegramOauthTokensController,
+        # but scoped to the tenant behind the Doorkeeper app access token (see
+        # Tenant::BaseController#require_tenant), exposed under /api/v2/tenant so
+        # tenant-scoped clients can call it alongside /api/v2/tenant/token
+        class TelegramOauthTokensController < BaseController
+          def create
+            return render_error_payload(credential_mismatch_message) if credential_mismatch_message
+
+            result = SpreeCmCommissioner::Telegram::ExchangeOauthToken.call(
+              exchange_params.merge(client_secret: resolved_client_secret)
+            )
+
+            return render_error_payload(result.error) unless result.success?
+
+            render json: result.value[:body], status: result.value[:status], content_type: 'application/json'
+          end
+
+          private
+
+          def exchange_params
+            params.permit(:client_id, :code, :redirect_uri, :code_verifier).to_h.symbolize_keys
+          end
+
+          # @tenant is already resolved from the Doorkeeper app (see BaseController#require_tenant),
+          # so unlike the storefront endpoint there's no separate tenant_id param to validate.
+          def credential_mismatch_message
+            return nil if @tenant.preferred_telegram_oauth_client_id.blank?
+            return 'telegram_oauth_client_id_mismatch' unless client_id_matches_tenant?
+
+            nil
+          end
+
+          def client_id_matches_tenant?
+            @tenant.preferred_telegram_oauth_client_id == exchange_params[:client_id]
+          end
+
+          def resolved_client_secret
+            @tenant.preferred_telegram_oauth_client_secret.presence
+          end
+        end
+      end
+    end
+  end
+end

data/app/interactors/spree_cm_commissioner/base_interactor.rb

@@ -1,5 +1,15 @@
 module SpreeCmCommissioner
   class BaseInteractor
     include Interactor
+
+    private
+
+    # Shared tail guard for the authenticators: an account can be resolved and hold a valid
+    # credential and still not be allowed to authenticate. Both messages are error_description values
+    # the mobile/web clients branch on, so they stay raw strings rather than translations.
+    def reject_unauthenticatable_user!(user)
+      context.fail!(message: 'account_temporarily_deleted') if user.soft_deleted?
+      context.fail!(message: 'account_blocked') if user.blocked?
+    end
   end
 end

data/app/interactors/spree_cm_commissioner/user_fb_token_authenticator.rb

@@ -12,7 +12,7 @@ module SpreeCmCommissioner
                        checker.user
                      end
 
-      context.fail!(message: 'account_temporarily_deleted') if context.user.soft_deleted?
+      reject_unauthenticatable_user!(context.user)
     end
 
     private

data/app/interactors/spree_cm_commissioner/user_id_token_authenticator.rb

@@ -7,7 +7,7 @@ module SpreeCmCommissioner
 
       update_user_email if context.user.email.blank?
 
-      context.fail!(message: 'account_temporarily_deleted') if context.user.soft_deleted?
+      reject_unauthenticatable_user!(context.user)
     end
 
     def register_user

data/app/interactors/spree_cm_commissioner/user_password_authenticator.rb

@@ -16,7 +16,7 @@ module SpreeCmCommissioner
       end
 
       context.fail!(message: I18n.t('authenticator.incorrect_password')) unless validate_password(context.user)
-      context.fail!(message: 'account_temporarily_deleted') if context.user.soft_deleted?
+      reject_unauthenticatable_user!(context.user)
     end
 
     private

data/app/interactors/spree_cm_commissioner/user_telegram_oauth_authenticator.rb

@@ -13,16 +13,16 @@ module SpreeCmCommissioner
       provider = verified_provider
       context.user = find_or_register_user(provider)
 
-      context.fail!(message: 'account_temporarily_deleted') if context.user.soft_deleted?
+      reject_unauthenticatable_user!(context.user)
     end
 
     private
 
     def verified_provider
-      result = SpreeCmCommissioner::TelegramOauthIdTokenProvider.call(id_token: id_token, client_id: telegram_client_id)
-      context.fail!(message: result.message) unless result.success?
+      result = SpreeCmCommissioner::Telegram::VerifyOauthIdToken.call(id_token: id_token, client_id: telegram_client_id)
+      context.fail!(message: result.error.to_s) unless result.success?
 
-      result.provider
+      result.value[:provider]
     end
 
     # Each tenant runs its own Telegram bot, so the audience an id_token must

data/app/interactors/spree_cm_commissioner/user_telegram_web_app_authenticator.rb

@@ -8,6 +8,10 @@ module SpreeCmCommissioner
 
       context.telegram_user = ActiveSupport::JSON.decode(checker_context.decoded_telegram_init_data['user'])
       context.user = find_or_create_telegram_user
+
+      # Block check only — this flow has never rejected soft-deleted accounts and this change is not
+      # the place to start.
+      context.fail!(message: 'account_blocked') if context.user.blocked?
     end
 
     def find_or_create_telegram_user

data/app/interactors/spree_cm_commissioner/user_vattanac_bank_web_app_authenticator.rb

@@ -8,6 +8,10 @@ module SpreeCmCommissioner
 
       verify_token!
 
+      # Block check only — this flow has never rejected soft-deleted accounts and this change is not
+      # the place to start.
+      return context.fail!(message: 'account_blocked') if user.blocked?
+
       context.user = user
     rescue JWT::DecodeError => e
       context.fail!(message: "Decode error: #{e.message}")

data/app/interactors/spree_cm_commissioner/waiting_guests_caller.rb

@@ -3,12 +3,6 @@ require 'google/cloud/firestore'
 # TODO: alert when available_slots is negative.
 module SpreeCmCommissioner
   class WaitingGuestsCaller < BaseInteractor
-    # 10 min floor — Waiting Room step (full journey, most uncertainty)
-    MIN_WAIT_TO_ENTER_SECONDS = (ENV['WAITING_ROOM_MIN_WAIT_TO_ENTER_SECONDS'] || 600).to_i
-
-    # 5 min floor — Queue step (position assigned, sub-segment of the journey)
-    MIN_QUEUE_TO_ENTER_SECONDS = (ENV['WAITING_ROOM_MIN_QUEUE_TO_ENTER_SECONDS'] || 300).to_i
-
     # Firestore bounds a batch update by payload size (10 MiB); 500 ops/commit leaves us far under that.
     FIRESTORE_BATCH_SIZE = (ENV['WAITING_ROOM_FIRESTORE_BATCH_SIZE'] || 500).to_i
 
@@ -16,8 +10,7 @@ module SpreeCmCommissioner
     # (cold start / lull → active_sessions low → available_slots ≈ max_sessions, e.g. 900) would
     # otherwise release every queued guest at once, dumping 900 simultaneous session-token requests
     # on the server. Capping paces entry at ~MAX_CALLS_PER_RUN/min (the caller runs every minute);
-    # the rest stay queued and drain over the following runs. Matches the stamper's MAX_ETA_BATCH_SIZE
-    # so the per-batch ETA the app shows reflects the real release rate.
+    # the rest stay queued and drain over the following runs.
     MAX_CALLS_PER_RUN = (ENV['WAITING_ROOM_MAX_CALLS_PER_RUN'] || 50).to_i
 
     def call
@@ -25,9 +18,8 @@ module SpreeCmCommissioner
       available_slots = fetch_available_slots
       call_limit = [available_slots, MAX_CALLS_PER_RUN].min
 
-      # Always run through to mark_as — even with no slots — so the lobby keeps a fresh heartbeat
-      # (logs.waiting_guests_caller_job) during peak/full periods instead of going stale
-      # and looking like a dead cron.
+      # Always run through to mark_as/publish_logs — even with no slots — so the lobby keeps a
+      # fresh heartbeat during peak/full periods instead of going stale and looking like a dead cron.
       long_waiting_guests = call_limit.positive? ? fetch_long_waiting_guests(call_limit) : []
       calling_all(long_waiting_guests) if long_waiting_guests.any?
 
@@ -35,13 +27,11 @@ module SpreeCmCommissioner
         full: long_waiting_guests.size >= available_slots,
         available_slots: available_slots - long_waiting_guests.size,
         has_queue: waiting_exists?([previous_records_path, records_path]),
-        avg_wait_to_enter_seconds: compute_avg_wait_to_enter_seconds(long_waiting_guests),
-        avg_queue_to_enter_seconds: compute_avg_queue_to_enter_seconds(long_waiting_guests),
-        recent_slots_per_call: call_limit.positive? ? call_limit : nil,
         active_sessions: @active_sessions,
-        max_sessions: @max_sessions,
-        logs: call_logs(started_at: started_at, called_count: long_waiting_guests.size)
+        max_sessions: @max_sessions
       )
+
+      publish_logs(started_at: started_at, called_count: long_waiting_guests.size)
     end
 
     def fetch_available_slots
@@ -105,22 +95,84 @@ module SpreeCmCommissioner
       "waiting_guests/#{date}/records"
     end
 
-    # For alert waiting guests to enter room, we just update :allow_to_enter_room_at.
-    # App will listen to firebase & start refresh session token to enter room.
+    # For alert waiting guests to enter room, we update :allow_to_enter_room_at and (when precreation
+    # succeeded) a :session map with a usable token — the app reads it straight off this same
+    # snapshot and enters without a separate createSession round trip. Precreating first, then
+    # writing both fields in the same batch, is what makes grant + session arrive atomically: a
+    # guest can never observe "allowed in" without also having a session, and there's no window for
+    # the old race where the app's own createSession beat this job's precreate to the same row.
     #
     # Commit in Firestore batches (chunks of FIRESTORE_BATCH_SIZE) instead of one update per guest,
     # so e.g. 1000 guests = 2 commits, not 1000 round-trips. update merges, so we only send the
-    # changed field and leave the rest of each doc intact.
+    # changed fields and leave the rest of each doc intact.
     def calling_all(waiting_guests)
       allow_at = Time.zone.now
+      sessions_by_guest_id = precreate_sessions(waiting_guests)
 
       waiting_guests.each_slice(FIRESTORE_BATCH_SIZE) do |slice|
         firestore.batch do |b|
-          slice.each { |document| b.update(document.ref, { allow_to_enter_room_at: allow_at }) }
+          slice.each do |document|
+            session = sessions_by_guest_id[document.ref.document_id]
+            data = {
+              allow_to_enter_room_at: allow_at,
+              session: {
+                id: session.id,
+                jwt_token: session.jwt_token,
+                expired_at: session.expired_at,
+                created_at: session.created_at
+              }
+            }
+            b.update(document.ref, data)
+          end
         end
       end
     end
 
+    # Pre-creates a real, usable WaitingRoomSession row (real signed JWT, not a placeholder) for
+    # every called guest, and returns them keyed by guest_identifier so #calling_all can hand each
+    # guest their own session in the same Firestore write that grants entry.
+    #
+    # A no-show's row simply expires on the normal TTL (no separate reclaim job needed). These rows
+    # only contain identity and timing; device attributes and remote_ip are left for the guest's real
+    # createSession call to fill in on renewal, keeping compatibility with older clients that never
+    # read the Firestore-carried session at all — they just call createSession like before and hit
+    # WaitingRoomSessionCreator's existing renew-active-row path.
+    #
+    # MAX_CALLS_PER_RUN caps this at ≤50 rows/run, making per-row writes cheap enough to avoid raw
+    # SQL batching. The guest_identifier unique index + rescue handles the concurrent-race case (like
+    # the guest's app calling createSession first) by looking up whichever row won — unscoped, not
+    # `.active`, so a row that's already inactive by the time we look is still picked up rather than
+    # treated as absent. `find_by!` (not `find_by`) is deliberate: allow_to_enter_room_at drops a
+    # guest out of every future run's eligibility filter for good (see #eligible_guests_in), and the
+    # app has no fallback of its own (entry is session-presence-only), so a guest that truly ends up
+    # without a row here — the colliding row vanishing between the unique-index hit and this lookup —
+    # is a bug worth a loud `ActiveRecord::RecordNotFound`, not a silently skipped `session` field.
+    def precreate_sessions(waiting_guests)
+      return {} if waiting_guests.empty?
+
+      waiting_guests.each_with_object({}) do |doc, sessions|
+        guest_id = doc.ref.document_id
+        expired_at = precreated_expired_at
+
+        sessions[guest_id] = SpreeCmCommissioner::WaitingRoomSession.create!(
+          guest_identifier: guest_id,
+          jwt_token: JWT.encode({ exp: expired_at.to_i }, ENV.fetch('WAITING_ROOM_SESSION_SIGNATURE'), 'HS256'),
+          expired_at: expired_at,
+          max_expired_at: precreated_max_expired_at
+        )
+      rescue ActiveRecord::RecordNotUnique
+        sessions[guest_id] = SpreeCmCommissioner::WaitingRoomSession.find_by!(guest_identifier: guest_id)
+      end
+    end
+
+    def precreated_expired_at
+      SpreeCmCommissioner::WaitingRoomSessionCreator::WAITING_ROOM_SESSION_EXPIRE_DURATION_IN_SECOND.seconds.from_now
+    end
+
+    def precreated_max_expired_at
+      SpreeCmCommissioner::WaitingRoomSessionCreator::WAITING_ROOM_SESSION_MAX_DURATION_IN_SECOND.seconds.from_now
+    end
+
     def current_date
       Time.zone.now.strftime('%Y-%m-%d')
     end
@@ -129,69 +181,40 @@ module SpreeCmCommissioner
       1.day.ago.strftime('%Y-%m-%d')
     end
 
-    # merge: true so we preserve the published `waiting_guests_records_path` on the lobby doc.
-    # App-facing fields plus live capacity state (full / available_slots / active_sessions /
-    # max_sessions / ETAs) stay top-level; this run's observability snapshot is namespaced under
-    # `logs.waiting_guests_caller_job` (see #call_logs). merge: true deep-merges nested maps, so
-    # each job owns its own key under `logs` without clobbering the others.
-    def mark_as( # rubocop:disable Metrics/ParameterLists
+    def mark_as(
       full:,
       available_slots:,
       has_queue:,
-      avg_wait_to_enter_seconds: nil,
-      avg_queue_to_enter_seconds: nil,
-      recent_slots_per_call: nil,
       active_sessions: nil,
-      max_sessions: nil,
-      logs: nil
+      max_sessions: nil
     )
-      data = { full: full, available_slots: available_slots, has_queue: has_queue }
+      data = {
+        full: full,
+        available_slots: available_slots,
+        has_queue: has_queue,
+        updated_at: Time.zone.now
+      }
 
-      data[:avg_wait_to_enter_seconds] = avg_wait_to_enter_seconds if avg_wait_to_enter_seconds
-      data[:avg_queue_to_enter_seconds] = avg_queue_to_enter_seconds if avg_queue_to_enter_seconds
-      data[:recent_slots_per_call] = recent_slots_per_call if recent_slots_per_call
       data[:active_sessions] = active_sessions unless active_sessions.nil?
       data[:max_sessions] = max_sessions unless max_sessions.nil?
-      data[:logs] = { waiting_guests_caller_job: logs } if logs
 
       lobby_document.set(data, merge: true)
     end
 
     # Point-in-time snapshot (overwritten each run, never cumulative) of this caller run: last-run
     # timing (heartbeat) and how many guests were called. Capacity state (active/max sessions,
-    # available_slots) lives top-level, not here.
-    def call_logs(started_at:, called_count:)
+    # available_slots) lives on the lobby doc itself, not here — see #mark_as.
+    def publish_logs(started_at:, called_count:)
       finished_at = Time.zone.now
-      {
-        called_count: called_count,
-        last_started_at: started_at,
-        last_finished_at: finished_at,
-        last_duration_ms: ((finished_at - started_at) * 1000).round
-      }
-    end
-
-    # Average total wait (queued_at → allow_to_enter_room_at) for just-called guests.
-    # Used for the Waiting Room step ETA: how long until I get in from when I joined.
-    def compute_avg_wait_to_enter_seconds(guests)
-      return nil if guests.empty?
-
-      now = Time.zone.now
-      total = guests.sum { |doc| (now - doc.data[:queued_at].to_time).to_f }
-      [(total / guests.size).round, MIN_WAIT_TO_ENTER_SECONDS].max
-    end
 
-    # Average queue wait (position_set_at → allow_to_enter_room_at) for just-called guests.
-    # Used for the Queue step ETA: how long after getting a position until I actually enter.
-    # Returns nil when none of the called guests had position_set_at (first run, or no prior stamp).
-    def compute_avg_queue_to_enter_seconds(guests)
-      return nil if guests.empty?
-
-      now = Time.zone.now
-      positioned = guests.select { |doc| doc.data[:position_set_at] }
-      return nil if positioned.empty?
-
-      total = positioned.sum { |doc| (now - doc.data[:position_set_at].to_time).to_f }
-      [(total / positioned.size).round, MIN_QUEUE_TO_ENTER_SECONDS].max
+      logs_document.set(
+        {
+          called_count: called_count,
+          last_started_at: started_at,
+          last_finished_at: finished_at,
+          last_duration_ms: ((finished_at - started_at) * 1000).round
+        }
+      )
     end
 
     def lobby_data
@@ -202,6 +225,10 @@ module SpreeCmCommissioner
       @lobby_document ||= firestore.col('waiting_rooms').doc('lobby')
     end
 
+    def logs_document
+      @logs_document ||= lobby_document.col('logs').doc('waiting_guests_caller_job')
+    end
+
     def fetch_max_sessions
       fetcher = SpreeCmCommissioner::WaitingRoomSystemMetadataFetcher.new(firestore: firestore)
       fetcher.load_document_data

data/app/interactors/spree_cm_commissioner/waiting_room_latest_system_metadata_puller.rb

@@ -1,18 +1,32 @@
 require 'aws-sdk-ecs'
 
-# TODO: UI to check all instances, max sessions, active_sessions, and available slots
 module SpreeCmCommissioner
   class WaitingRoomLatestSystemMetadataPuller < BaseInteractor
     def call
+      region = ENV.fetch('AWS_REGION', nil)
+      access_key_id = ENV.fetch('AWS_ACCESS_KEY_ID', nil)
+      secret_access_key = ENV.fetch('AWS_SECRET_ACCESS_KEY', nil)
+      cluster_name = ENV.fetch('AWS_CLUSTER_NAME', nil)
+      cluster_service_name = ENV.fetch('AWS_CLUSTER_SERVICE_NAME', nil)
+
+      # On dev/staging, these env vars might not be set, so skip the job instead of raising.
+      return if [
+        region,
+        access_key_id,
+        secret_access_key,
+        cluster_name,
+        cluster_service_name
+      ].any?(&:nil?)
+
       ecs_client = Aws::ECS::Client.new(
-        region: ENV.fetch('AWS_REGION'),
-        access_key_id: ENV.fetch('AWS_ACCESS_KEY_ID'),
-        secret_access_key: ENV.fetch('AWS_SECRET_ACCESS_KEY')
+        region: region,
+        access_key_id: access_key_id,
+        secret_access_key: secret_access_key
       )
 
       response = ecs_client.describe_services(
-        cluster: ENV.fetch('AWS_CLUSTER_NAME'),
-        services: [ENV.fetch('AWS_CLUSTER_SERVICE_NAME')]
+        cluster: cluster_name,
+        services: [cluster_service_name]
       )
 
       running_count = response.services.first.running_count