spree_cm_commissioner 2.8.0 → 2.8.1.pre.pre.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a112e266f3450b307b12ea0ac4a28a4d5ee9a3eff8e2650d6de5c93c1b73df3
-  data.tar.gz: 3285f85273a6c1d19e2eb4b23f087eccca371af1f6cd48282c22042b97d4d8d8
+  metadata.gz: 19fd000fa15ceffed974595795de236e66b34973806086d138bc5867183bc9c0
+  data.tar.gz: e9cc2d23feeb9fd6b66384c3b3e2febeadc51ecfac906a3e546613578db19156
 SHA512:
-  metadata.gz: 81c02501bd52647acbc65cc34e6ebcfa309b349a1215a0eadde56101b8d508877cb96e08c044612863ea458be0e70ff018311dc5be59806bc67f97a7cff99061
-  data.tar.gz: feb4e3ef254c32769245dd1053ab3ec987f73250db800bd36373bf40e5d9e9ea981586b92a57fbe8bbcfc22ab09bf5cf7343b1a9b8d35bf672e1057510be11ad
+  metadata.gz: 87e417d02f3082ee1ec8905db14343bfe33309f2d7b4b04274c7abf2f86e22cb8998374bc34c64361632afdff581198a725d281c8c0f2b2bbe0ce91419a7a1cc
+  data.tar.gz: 75e78fd7b59fc796318dc24a70483fb51ab8ade2dc6df5714bdf2c6266d2055d8438679e6edf6d5089d8382501f8dc52d0d8684334f4c73e6a92820db6c6f110

data/.env.example

@@ -50,15 +50,3 @@ EXPORT_PRESIGNED_URL_EXPIRATION_MINUTES=15
 
 # import order batch size
 IMPORT_ORDERS_BATCH_SIZE=50
-
-# Inventory Hold System
-# See: app/services/spree_cm_commissioner/order_holds/hold.rb
-HOLD_DURATION_IN_MINUTES=8                  # How long a hold is active after checkout begins (address step)
-
-# See: app/services/spree_cm_commissioner/order_holds/lock_for_payment.rb
-PAYMENT_LOCK_MIN_DURATION_IN_MINUTES=5      # Minimum remaining hold time required when entering the payment step; hold is extended if below this threshold
-
-# See: app/services/spree_cm_commissioner/inventory_holds/validate_limits.rb
-MAX_ACTIVE_HOLDS_PER_USER=3                 # Max concurrent active holds allowed per user across all orders
-MAX_HOLDS_PER_IP_PER_HOUR=5                 # Max hold attempts per IP address within a rolling 1-hour window (abuse prevention)
-HOLD_COOLDOWN_AFTER_EXPIRY_IN_MINUTES=2     # Cooldown period before a user can re-acquire a hold after one expired on them

data/.gitignore

@@ -34,3 +34,7 @@ vendor/bundle/
 # Cursor
 .cursor
 dump.rdb
+# Added by code-review-graph
+.code-review-graph/
+.cursorrules
+.claude

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.0)
+    spree_cm_commissioner (2.8.1.pre.pre.1)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/concerns/spree_cm_commissioner/order_concern.rb

@@ -11,7 +11,6 @@ module SpreeCmCommissioner
         raise CanCan::AccessDenied
       end
 
-      @spree_current_order.last_ip_address = request.remote_ip
       @spree_current_order
     end
 

data/app/controllers/spree/admin/classifications_controller.rb

@@ -5,7 +5,7 @@ module Spree
 
       def recalculate_conversions
         if @taxon.parent.event?
-          SpreeCmCommissioner::MaintenanceTasks::Event.pending.create_or_find_by(
+          SpreeCmCommissioner::MaintenanceTasks::Event.pending.find_or_create_by(
             maintainable_type: 'Spree::Taxon',
             maintainable_id: @taxon.parent.id
           ) do |task|

data/app/controllers/spree/admin/homepage_section_controller.rb

@@ -51,7 +51,10 @@ module Spree
       def permitted_resource_params
         segment_value = helpers.calculate_segment_value(params[:spree_cm_commissioner_homepage_section])
 
-        params.require(:spree_cm_commissioner_homepage_section).permit(:title, :description, :active, :tenant_id).merge(segment: segment_value)
+        params
+          .require(:spree_cm_commissioner_homepage_section)
+          .permit(:title, :description, :active, :tenant_id, :preview)
+          .merge(segment: segment_value)
       end
 
       def load_tenants

data/app/controllers/spree/admin/inventory_monitorings_controller.rb

@@ -5,20 +5,19 @@ module Spree
         authorize! :manage, SpreeCmCommissioner::InventoryItem
 
         @time_range = params[:time_range] || 7
-        @product_type = params[:product_type].presence
+        @filter_type = params[:filter_type] || 'all'
         @vendor_id = params[:vendor_id]
 
         finder = SpreeCmCommissioner::InventoryItems::RecentlyChangedFinder.new(
           time_range: @time_range.to_i.days.ago,
           limit: 1000,
           vendor_id: @vendor_id,
-          product_type: @product_type
+          filter_type: @filter_type
         )
 
         @inventory_items = finder.execute
         @total_count = @inventory_items.size
         @out_of_sync_count = @inventory_items.count { |item| item[:out_of_sync] }
-        @on_hold_out_of_sync_count = @inventory_items.count { |item| item[:on_hold_out_of_sync] }
       end
 
       def reset
@@ -33,10 +32,7 @@ module Spree
           flash[:error] = "Failed to reset inventory: #{result.message}"
         end
 
-        redirect_to action: :index,
-                    time_range: params[:time_range],
-                    product_type: params[:product_type],
-                    vendor_id: params[:vendor_id]
+        redirect_to action: :index, time_range: params[:time_range], filter_type: params[:filter_type]
       end
     end
   end

data/app/controllers/spree/admin/stock_managements_controller.rb

@@ -5,7 +5,7 @@ module Spree
 
       before_action :load_parent
 
-      helper_method :inventory_item_message, :inventory_item_hold_message
+      helper_method :inventory_item_message
 
       def load_parent
         @product = Spree::Product.find_by(slug: params[:product_id])
@@ -75,15 +75,6 @@ module Spree
         end
       end
 
-      def inventory_item_hold_message(inventory_item, cached_inventory_item)
-        synced = inventory_item.quantity_on_hold == cached_inventory_item.quantity_on_hold
-        if synced
-          "Synced: Quantity on hold matches in both DB and Redis (#{cached_inventory_item.quantity_on_hold})."
-        else
-          "Out of sync: Redis shows #{cached_inventory_item.quantity_on_hold} on hold, which doesn't match the database."
-        end
-      end
-
       private
 
       def load_inventories

data/app/controllers/spree/admin/taxons_controller_decorator.rb

@@ -3,6 +3,7 @@ module Spree
     module TaxonsControllerDecorator
       def self.prepended(base)
         base.before_action :build_assets, only: %i[create update]
+        base.before_action :normalize_sti_taxon_params, only: %i[create update]
       end
 
       # override
@@ -50,6 +51,24 @@ module Spree
         @taxon.build_home_banner(attachment: permitted_resource_params.delete(:home_banner)) if permitted_resource_params[:home_banner]
         @taxon.build_video_banner(attachment: permitted_resource_params.delete(:video_banner)) if permitted_resource_params[:video_banner]
       end
+
+      # Some admin forms submit STI records under their class key
+      # (e.g. :spree_cm_commissioner_show) while Spree update reads :taxon.
+      # Merge both into :taxon so all edited fields are persisted.
+      def normalize_sti_taxon_params
+        return unless @taxon
+
+        sti_key = @taxon.class.model_name.param_key.to_sym
+        sti_params = params[sti_key]
+        return unless sti_params.is_a?(::ActionController::Parameters)
+
+        base_params = params[:taxon]
+        base_hash = base_params.is_a?(::ActionController::Parameters) ? base_params.to_unsafe_h : {}
+        sti_hash = sti_params.to_unsafe_h
+        merged_params = ::ActionController::Parameters.new(base_hash.merge(sti_hash))
+
+        params[:taxon] = merged_params
+      end
     end
   end
 end

data/app/controllers/spree/api/v2/operator/recalculate_tickets_controller.rb

@@ -7,7 +7,7 @@ module Spree
           before_action :load_taxon, only: :create
 
           def create
-            SpreeCmCommissioner::MaintenanceTasks::Event.pending.create_or_find_by(
+            SpreeCmCommissioner::MaintenanceTasks::Event.pending.find_or_create_by(
               maintainable: @taxon
             ).async_execute
 

data/app/controllers/spree/api/v2/storefront/homepage_sections_controller.rb

@@ -19,6 +19,7 @@ module Spree
             @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
                                        .active
                                        .where(tenant_id: nil)
+                                       .where(preview: false)
                                        .order(position: :asc)
           end
         end

data/app/controllers/spree/api/v2/storefront/preview_products_controller.rb

@@ -0,0 +1,48 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewProductsController < ::Spree::Api::V2::Storefront::ProductsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super(**args).rewhere(preview: true).where(status: :active)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_sections_controller.rb

@@ -0,0 +1,27 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= model_class.filter_by_segment(params[:homepage_id] || :general)
+                                       .active
+                                       .where(tenant_id: nil)
+                                       .where(preview: true)
+                                       .where(id: section_ids)
+                                       .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/preview_taxons_controller.rb

@@ -0,0 +1,18 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        class PreviewTaxonsController < ::Spree::Api::V2::Storefront::TaxonsController
+          before_action :require_spree_current_user
+
+          private
+
+          def scope(**args)
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            super(**args).rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/storefront/products_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module ProductsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::ProductsController.prepend(Spree::Api::V2::Storefront::ProductsControllerDecorator)

data/app/controllers/spree/api/v2/storefront/taxons_controller_decorator.rb

@@ -0,0 +1,15 @@
+module Spree
+  module Api
+    module V2
+      module Storefront
+        module TaxonsControllerDecorator
+          def scope
+            super.where(preview: false)
+          end
+        end
+      end
+    end
+  end
+end
+
+Spree::Api::V2::Storefront::TaxonsController.prepend(Spree::Api::V2::Storefront::TaxonsControllerDecorator)

data/app/controllers/spree/api/v2/tenant/base_controller.rb

@@ -16,6 +16,10 @@ module Spree
             set_current_tenant(@tenant)
           end
 
+          def current_vendor
+            @current_vendor ||= @tenant.active_vendor
+          end
+
           def render_serialized_payload(status = 200)
             render json: yield, status: status, content_type: content_type
           end

data/app/controllers/spree/api/v2/tenant/free_vote_claims_controller.rb

@@ -0,0 +1,37 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class FreeVoteClaimsController < BaseController
+          before_action :require_spree_current_user
+
+          def create
+            show = current_vendor.shows.find(params[:show_id])
+
+            result = SpreeCmCommissioner::VotingCredits::ClaimFreeVotes.new(
+              show: show,
+              user: spree_current_user,
+              tenant_id: MultiTenant.current_tenant_id,
+              votable_type: params[:votable_type],
+              votable_id: params[:votable_id]
+            ).call
+
+            if result.failure?
+              render_error_payload(result.error.to_s)
+            elsif result.value.nil?
+              head :no_content
+            else
+              render_serialized_payload { serialize_resource(result.value) }
+            end
+          end
+
+          private
+
+          def resource_serializer
+            Spree::V2::Tenant::VotingCreditSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/homepage_sections_controller.rb

@@ -5,6 +5,7 @@ module Spree
         class HomepageSectionsController < BaseController
           def collection
             @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .where(preview: false)
                                  .active
                                  .order(position: :asc)
           end

data/app/controllers/spree/api/v2/tenant/intercity_taxi/draft_orders_controller.rb

@@ -29,7 +29,6 @@ module Spree
               result = SpreeCmCommissioner::IntercityTaxiOrder::Update.call(
                 order: spree_current_order,
                 remark: params[:remark],
-                passenger_count: params[:passenger_count],
                 pickup_map_place_attributes: params[:pickup_map_place_attributes]&.permit(
                   :place_name,
                   :lat,

data/app/controllers/spree/api/v2/tenant/preview_products_controller.rb

@@ -0,0 +1,47 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewProductsController < ProductsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            taxon_type = model_class.reflect_on_association(:taxons).klass.polymorphic_name
+
+            # IDs of products that have been explicitly assigned their own PreviewRole.
+            products_with_own_roles = SpreeCmCommissioner::PreviewRole
+                                      .where(previewable_type: model_class.polymorphic_name)
+                                      .select(:previewable_id)
+
+            # Base: all active preview products from the parent scope.
+            base = super.where(status: :active, preview: true)
+
+            # Path A: product has its own PreviewRole → user must hold that role directly.
+            # Taxon membership is irrelevant for these products.
+            via_product_role = base
+                               .where(id: products_with_own_roles)
+                               .where(id: spree_current_user.preview_roles
+                                                              .where(previewable_type: model_class.polymorphic_name)
+                                                              .select(:previewable_id)
+                                     )
+
+            # Path B: product has no own PreviewRole → inherit access from its taxons.
+            # Accessible if the user holds a preview role for any taxon the product belongs to.
+            via_taxon = base
+                        .where.not(id: products_with_own_roles)
+                        .joins(:taxons)
+                        .where(spree_taxons: { id: spree_current_user.preview_roles
+                                                                       .where(previewable_type: taxon_type)
+                                                                       .select(:previewable_id)
+}
+                              )
+
+            # via_taxon uses joins(:taxons) which is incompatible with or — wrap as subquery.
+            via_product_role.or(base.where(id: via_taxon.select(:id)))
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_sections_controller.rb

@@ -0,0 +1,26 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewSectionsController < HomepageSectionsController
+          before_action :require_spree_current_user
+
+          # override
+          def collection
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: Spree::Taxon.polymorphic_name).pluck(:previewable_id)
+
+            section_ids = SpreeCmCommissioner::HomepageSectionRelatable
+                          .where(relatable_type: 'Spree::Taxon', relatable_id: allowed_ids.presence || [])
+                          .select(:homepage_section_id)
+
+            @collection ||= scope.filter_by_segment(params[:homepage_id] || :general)
+                                 .active
+                                 .where(preview: true)
+                                 .where(id: section_ids)
+                                 .order(position: :asc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_shows_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewShowsController < ShowsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            allowed_ids = spree_current_user.preview_roles
+                                            .where(previewable_type: SpreeCmCommissioner::Show.polymorphic_name)
+                                            .select(:previewable_id)
+            super.rewhere(preview: true).where(id: allowed_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/preview_taxons_controller.rb

@@ -0,0 +1,19 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class PreviewTaxonsController < TaxonsController
+          before_action :require_spree_current_user
+
+          # override
+          def scope
+            allowed_ids = spree_current_user.preview_roles.where(previewable_type: model_class.polymorphic_name).select(:previewable_id)
+            MultiTenant.with(@tenant) do
+              model_class.where(preview: true, id: allowed_ids)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/products_controller.rb

@@ -21,7 +21,7 @@ module Spree
 
           def scope
             MultiTenant.with(@tenant) do
-              model_class.where(tenant_id: MultiTenant.current_tenant_id)
+              model_class.where(tenant_id: MultiTenant.current_tenant_id, preview: false)
             end
           end
 

data/app/controllers/spree/api/v2/tenant/show_contestants_controller.rb

@@ -0,0 +1,51 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class ShowContestantsController < BaseController
+          private
+
+          # override
+          def model_class
+            SpreeCmCommissioner::ShowContestant
+          end
+
+          # override
+          def scope
+            return model_class.none unless current_show
+
+            model_class
+              .where(show_id: current_show.id)
+              .includes(
+                :show_contestant_images,
+                :current_voting_session,
+                :voting_contestants,
+                assigned_show_person: :show_person_images,
+                show: [
+                  :parent,
+                  { episodes: :voting_sessions },
+                  { seasons: { episodes: :voting_sessions } }
+                ]
+              )
+          end
+
+          def current_show
+            @current_show ||= show_scope.find_by!(slug: params[:show_id])
+          end
+
+          def show_scope
+            vendor_ids = @tenant.vendors.select(:id)
+            return SpreeCmCommissioner::Show.none if vendor_ids.blank?
+
+            SpreeCmCommissioner::Show.where(vendor_id: vendor_ids)
+          end
+
+          # override
+          def resource_serializer
+            Spree::V2::Tenant::ShowContestantSerializer
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/show_people_controller.rb

@@ -0,0 +1,49 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class ShowPeopleController < BaseController
+          private
+
+          # override
+          def model_class
+            SpreeCmCommissioner::ShowPerson
+          end
+
+          # override
+          def scope
+            scope = current_show.show_people
+                                .joins(:assignments)
+                                .distinct
+                                .includes(
+                                  :assignments,
+                                  assigned_contestants: %i[show_contestant_images current_voting_session]
+                                )
+
+            role = params[:role].presence
+            return scope if role.blank?
+
+            role_value = SpreeCmCommissioner::ShowPersonAssignment.roles[role.to_s]
+            return scope.none if role_value.nil?
+
+            scope.where(cm_show_people_assignments: { role: role_value })
+          end
+
+          # override
+          def collection_serializer
+            Spree::V2::Tenant::ShowPersonSerializer
+          end
+
+          def current_show
+            @current_show ||= show_scope.find_by!(slug: params[:show_id])
+          end
+
+          def show_scope
+            vendor_ids = @tenant.vendors.select(:id)
+            SpreeCmCommissioner::Show.where(vendor_id: vendor_ids)
+          end
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/api/v2/tenant/show_person_assignments_controller.rb

@@ -0,0 +1,36 @@
+module Spree
+  module Api
+    module V2
+      module Tenant
+        class ShowPersonAssignmentsController < BaseController
+          private
+
+          def model_class
+            SpreeCmCommissioner::ShowPersonAssignment
+          end
+
+          def scope
+            vendor_ids = @tenant.vendors.select(:id)
+            show_ids = SpreeCmCommissioner::Show.where(vendor_id: vendor_ids).select(:id)
+
+            model_class.where(show_id: show_ids)
+                       .where(show_person_id: params[:person_id], show_id: current_show.id)
+                       .includes(:show_person, :show)
+          end
+
+          def current_show
+            @current_show ||= SpreeCmCommissioner::Show.find_by!(slug: params[:show_id])
+          end
+
+          def resource_serializer
+            Spree::V2::Tenant::ShowPersonAssignmentSerializer
+          end
+
+          def collection_serializer
+            Spree::V2::Tenant::ShowPersonAssignmentSerializer
+          end
+        end
+      end
+    end
+  end
+end