spree_cm_commissioner 2.8.15.pre.pre9 → 2.8.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db6de320351a3caae8243230898ce35ae85406e84424101bc01b126ce7eefb4c
-  data.tar.gz: 97a586260f667681ee89ca8aa224fc3ba05137dfcfbf4453191137e15d724735
+  metadata.gz: ca0138759a1da40541b5d076fb9709847d44d88885593f5b69921993cfd26591
+  data.tar.gz: 79408535d56a9d4b62cac5154a316f6652d6d8664c04a030f00588b39f7ddd24
 SHA512:
-  metadata.gz: 8d9ab3710513dd89d55d6422d924ce10c0e83f661cdf2576650586b1a11a627db19a161a8aa657c04d305201a10d1f4823d1ea2fff44657638829d7ba7c2ef52
-  data.tar.gz: de4d493586903410f18877bbb2e959383b42765b241c4d90cb08e0aef5cda6618433a24c6c18714391d60805176971b0aa12bb7165a694818abea06915164697
+  metadata.gz: 3e1a90b2f9115755fcd8cb777e0cd4d3c05b950a8a1b913ac526be4c5967d062533b5683bf48d3ca979e726347bb1945520b0701337872e7626d2fc3524d7952
+  data.tar.gz: 8b4813fe21cc8495e2a512ea1662e2105ba61994c1866794bd9da91ef5c805b1b49cc9d8ea5cdf53f35dd2fe6a96295491eea72853cfdaf899377264922e8a84

data/.env.example

@@ -32,6 +32,10 @@ WAITING_ROOM_MAX_ETA_BATCH_SIZE=50 # cap on batch size assumed when estimating t
 VATTANAC_AES_SECRET_KEY= ""
 VATTANAC_PUBLIC_KEY=""
 
+# Telegram OAuth (OpenID Connect) login client_id/client_secret are configured
+# per tenant (or on the default store for tenant-less logins) from the admin
+# under Telegram Authentication - see docs/authentication/telegram-login.md.
+
 # Organizer URL
 ORGANIZER_URL=http://127.0.0.1:4000/organizer
 

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.15.pre.pre9)
+    spree_cm_commissioner (2.8.15)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront
@@ -886,7 +886,7 @@ GEM
       spree_backend (>= 4.3.0.rc1)
       spree_emails (>= 4.3.0.rc1)
       spree_extension
-    spree_vpago (2.0.5.pre.beta)
+    spree_vpago (2.3.4)
       faraday
       google-cloud-firestore
       spree_api (>= 4.5)

data/app/controllers/concerns/spree_cm_commissioner/content_cachable.rb

@@ -27,6 +27,13 @@ module SpreeCmCommissioner
       PopularRoutesController
       RoutePlacesController
       ShowsController
+      EpisodesController
+      ShowPeopleController
+      ShowPersonAssignmentsController
+      ShowContestantsController
+      VotePackagesController
+      ShowEliminationSessionsController
+      PaymentMethodsController
     ].freeze
 
     # Priority 3: Moderate Freshness (30 minutes)
@@ -46,6 +53,7 @@ module SpreeCmCommissioner
     HIGH_FRESHNESS_CONTROLLERS = %w[
       TripsController
       TripSearchController
+      VotingContestantsController
     ].freeze
 
     def shared_max_age

data/app/controllers/concerns/spree_cm_commissioner/load_test_account_management.rb

@@ -0,0 +1,80 @@
+module SpreeCmCommissioner
+  module LoadTestAccountManagement
+    extend ActiveSupport::Concern
+
+    include SpreeCmCommissioner::LoadTestAccountScope
+
+    included do
+      before_action :authorize_load_testing!, only: %i[create bulk_destroy]
+    end
+
+    # Ensures N load-test accounts exist (idempotent) for `load_test_tenant` (nil = platform).
+    def create
+      result = SpreeCmCommissioner::LoadTest::CreateAccounts.call(**pool_params)
+
+      if result.success?
+        flash[:success] = "#{result.value[:created]} load-test accounts created."
+      else
+        flash[:error] = result.error.value
+      end
+
+      redirect_to manage_accounts_redirect_path
+    rescue StandardError => e
+      flash[:error] = e.message
+      redirect_to manage_accounts_redirect_path
+    end
+
+    def bulk_destroy
+      result = SpreeCmCommissioner::LoadTest::DestroyAccounts.call(**pool_params)
+
+      if result.success?
+        flash[:success] = "#{result.value[:destroyed]} destroyed, #{result.value[:not_found]} not found (already removed)."
+      else
+        flash[:error] = result.error.value
+      end
+
+      redirect_to manage_accounts_redirect_path
+    rescue StandardError => e
+      flash[:error] = e.message
+      redirect_to manage_accounts_redirect_path
+    end
+
+    private
+
+    # Default: cancancan's `authorize!`. Override in the including controller if it doesn't use
+    # cancancan (e.g. the organizer dashboard, which authorizes via RoleAuthorization/can_manage?).
+    def authorize_load_testing!
+      authorize! :manage, :load_testing
+    end
+
+    # Where create/bulk_destroy redirect back to. Must be implemented by the including controller
+    # (points at its own Load Test Accounts page).
+    def manage_accounts_redirect_path
+      raise NotImplementedError, "#{self.class} must implement #manage_accounts_redirect_path"
+    end
+
+    def pool_params
+      {
+        client_id: resolve_client_id,
+        count: params[:count].presence&.to_i || 20,
+        email_prefix: params[:email_prefix].presence || 'loadtest',
+        email_domain: params[:email_domain].presence
+      }
+    end
+
+    # Carries the form field values through the redirect so the index page re-renders with the
+    # same count/prefix/domain/page/per_page the admin/organizer just submitted with.
+    def redirect_params
+      params.slice(:count, :email_prefix, :email_domain, :page, :per_page).permit!
+    end
+
+    def resolve_client_id
+      return nil if load_test_tenant.nil?
+
+      application = Spree::OauthApplication.where(tenant_id: load_test_tenant.id).order(:id).first
+      raise "No OAuth application found for tenant #{load_test_tenant.name}" unless application
+
+      application.uid
+    end
+  end
+end

data/app/controllers/concerns/spree_cm_commissioner/load_test_account_scope.rb

@@ -0,0 +1,39 @@
+module SpreeCmCommissioner
+  module LoadTestAccountScope
+    extend ActiveSupport::Concern
+
+    private
+
+    # The tenant these accounts are scoped to. nil means the platform (no tenant). Must be
+    # implemented by the including controller.
+    def load_test_tenant
+      raise NotImplementedError, "#{self.class} must implement #load_test_tenant"
+    end
+
+    DEFAULT_EXPORT_PER_PAGE = 10
+
+    # Queried fresh from the DB every time, so it's always in sync with the current pool rather than
+    # a stashed file or session state.
+    #
+    # Filters the `load_test_account` flag in SQL via the model's `load_test_accounts` scope (see
+    # UserDecorator), so only the tenant's load-test accounts are considered — never the whole users
+    # table. Unlike the old `order(:id).limit(2000).select(&:...)` approach, there's no scan cap:
+    # newly created accounts (highest ids, ordered first below) always show up even on tenants with
+    # far more than 2,000 users.
+    #
+    # Kaminari pages on the relation itself, so the DB only ever loads the current page's rows
+    # (`LIMIT`/`OFFSET`) — never the full pool into memory — via the same `page`/`per_page` params
+    # and `paginate` view helper every other index page in this app uses.
+    #
+    # Shared between LoadTestAccountManagement (lists/mutates the pool) and
+    # LoadTestLoginTokenGeneration (mints tokens for exactly the page shown), so both controllers
+    # resolve the same page the same way.
+    def export_accounts
+      Spree::User.where(tenant_id: load_test_tenant&.id)
+                 .load_test_accounts
+                 .order(id: :desc)
+                 .page(params[:page])
+                 .per(params[:per_page] || DEFAULT_EXPORT_PER_PAGE)
+    end
+  end
+end

data/app/controllers/concerns/spree_cm_commissioner/load_test_bypassable.rb

@@ -0,0 +1,29 @@
+module SpreeCmCommissioner
+  # Sets Current.load_test_bypass when the request carries the correct X-Request-Verify secret, so
+  # anti-abuse services (e.g. InventoryHolds::ValidateLimits) can skip their checks for trusted
+  # load tests. No-op unless LOAD_TEST_BYPASS_KEY is set. Include in any controller that can
+  # trigger such a check.
+  module LoadTestBypassable
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :set_load_test_bypass_current
+    end
+
+    private
+
+    # Always assigns the flag (false unless the request carries the correct
+    # secret), so its value never leaks from a previous request.
+    def set_load_test_bypass_current
+      SpreeCmCommissioner::Current.load_test_bypass = load_test_bypass_requested?
+    end
+
+    def load_test_bypass_requested?
+      key = ENV.fetch('LOAD_TEST_BYPASS_KEY', nil)
+      return false if key.blank?
+
+      provided = request.headers.fetch('X-Request-Verify', nil).to_s
+      ActiveSupport::SecurityUtils.secure_compare(provided, key)
+    end
+  end
+end

data/app/controllers/concerns/spree_cm_commissioner/load_test_login_token_generation.rb

@@ -0,0 +1,53 @@
+module SpreeCmCommissioner
+  module LoadTestLoginTokenGeneration
+    extend ActiveSupport::Concern
+
+    include SpreeCmCommissioner::LoadTestAccountScope
+
+    included do
+      before_action :authorize_load_testing!, only: %i[create]
+    end
+
+    # Mints a fresh, stateless login-token JWT for each account on the requested page (same
+    # page/per_page as the Load Test Accounts index) and returns them as JSON. Nothing is
+    # persisted — the tokens are self-contained and verified by signature + expiry alone (see
+    # SpreeCmCommissioner::LoadTest::LoginToken).
+    def create
+      render json: login_tokens_payload(export_accounts)
+    rescue StandardError => e
+      render json: { error: e.message }, status: :unprocessable_entity
+    end
+
+    private
+
+    # Default: cancancan's `authorize!`. Override in the including controller if it doesn't use
+    # cancancan (e.g. the organizer dashboard, which authorizes via RoleAuthorization/can_manage?).
+    def authorize_load_testing!
+      authorize! :manage, :load_testing
+    end
+
+    # aud claim: the admin/organizer who minted the tokens. No fallback — both hosting controllers
+    # already require an authenticated user for every action here, so spree_current_user being
+    # absent would be a bug worth raising on, not silently mislabeling as 'system'.
+    def token_audience
+      spree_current_user.id
+    end
+
+    # user_id + the user_id_token are all k6 needs (email and expiry are already claims inside the
+    # JWT itself — sub / exp — and the token alone identifies + authenticates the account via
+    # UserPasswordAuthenticator's token-only path). expires_at is included too, purely so the
+    # generated-tokens list can show it to a human without decoding the JWT. Named `user_id_token`
+    # (not `id_token`) so UserAuthenticator can route on the params key alone, without decoding
+    # every request's `id_token` to check whether it's a load-test token.
+    def login_tokens_payload(accounts)
+      accounts.map do |user|
+        generated = SpreeCmCommissioner::LoadTest::LoginToken.generate(user: user, audience: token_audience)
+        {
+          user_id: user.id,
+          user_id_token: generated[:token],
+          expires_at: generated[:expires_at]
+        }
+      end
+    end
+  end
+end

data/app/controllers/concerns/spree_cm_commissioner/order_concern.rb

@@ -12,6 +12,7 @@ module SpreeCmCommissioner
       end
 
       @spree_current_order.last_ip_address = request.remote_ip
+      @spree_current_order.device_id = device_id if device_id.present?
       @spree_current_order
     end
 
@@ -25,5 +26,9 @@ module SpreeCmCommissioner
         state: params[:state]
       )
     end
+
+    def device_id
+      params[:device_id].presence
+    end
   end
 end

data/app/controllers/concerns/spree_cm_commissioner/turnstile_protectable.rb

@@ -27,13 +27,15 @@ module SpreeCmCommissioner
       return unless result.failure?
 
       render json: {
-        errors: [{
-          status: '403',
-          error_code: 'human_verification_failed',
-          title: I18n.t('turnstile.verification_failed'),
-          detail: result.message
-        }
-]
+        errors: [
+          {
+            status: '403',
+            error_code: 'human_verification_failed',
+            title: I18n.t('turnstile.verification_failed'),
+            detail: result.message,
+            turnstile_error_code: result.respond_to?(:error_code) ? result.error_code : nil
+          }
+        ]
       }, status: :forbidden
     end
 

data/app/controllers/spree/admin/guests_controller.rb

@@ -80,8 +80,10 @@ module Spree
 
       def permitted_resource_params
         params.require(object_name).permit(:first_name, :last_name, :gender, :dob, :occupation_id,
-                                           :nationality_id, :age, :emergency_contact, :line_item_id,
-                                           :seat_number, :phone_number
+                                           :nationality_id, :age, :emergency_contact,
+                                           :line_item_id, :seat_number, :phone_number, :contact,
+                                           :other_organization, :expectation, :address,
+                                           :social_contact_platform, :social_contact
         )
       end
 

data/app/controllers/spree/admin/system/load_test_accounts_controller.rb

@@ -0,0 +1,24 @@
+module Spree
+  module Admin
+    module System
+      class LoadTestAccountsController < Spree::Admin::BaseController
+        include SpreeCmCommissioner::LoadTestAccountManagement
+
+        def index
+          @export_accounts = export_accounts
+        end
+
+        private
+
+        # nil = platform. Admin load testing never operates on a tenant.
+        def load_test_tenant
+          nil
+        end
+
+        def manage_accounts_redirect_path
+          admin_system_load_test_accounts_path(**redirect_params)
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/system/load_test_flows_controller.rb

@@ -0,0 +1,11 @@
+module Spree
+  module Admin
+    module System
+      class LoadTestFlowsController < Spree::Admin::BaseController
+        def index
+          @load_test_flows = SpreeCmCommissioner::LoadTest::FlowRegistry.for_workflow('platform')
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/system/load_test_login_tokens_controller.rb

@@ -0,0 +1,16 @@
+module Spree
+  module Admin
+    module System
+      class LoadTestLoginTokensController < Spree::Admin::BaseController
+        include SpreeCmCommissioner::LoadTestLoginTokenGeneration
+
+        private
+
+        # nil = platform. Admin load testing never operates on a tenant.
+        def load_test_tenant
+          nil
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/system/load_testing_controller.rb

@@ -0,0 +1,9 @@
+module Spree
+  module Admin
+    module System
+      class LoadTestingController < Spree::Admin::BaseController
+        def index; end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/users_controller_decorator.rb

@@ -20,8 +20,26 @@ module Spree
         end
       end
 
+      # override
+      def update
+        preserve_non_form_roles
+        super
+      end
+
       private
 
+      # Role types the user form doesn't render (assigned in organizer dashboards), e.g. check-in groups and preview.
+      NON_FORM_ROLE_TYPES = %i[check_in preview].freeze
+
+      # spree_role_ids= replaces the whole role set, so a submit that omits these would drop them. Merge
+      # the user's existing ones back in so they survive. Skip when the form didn't submit roles at all.
+      def preserve_non_form_roles
+        return if params.dig(:user, :spree_role_ids).nil?
+
+        preserved_ids = @user.spree_roles.where(role_type: NON_FORM_ROLE_TYPES).pluck(:id).map(&:to_s)
+        params[:user][:spree_role_ids] = (params[:user][:spree_role_ids] + preserved_ids).uniq
+      end
+
       def build_profile
         return unless permitted_resource_params[:profile]
 

data/app/controllers/spree/api/chatrace/guests_controller.rb

@@ -53,7 +53,7 @@ module Spree
           preferences upload_later social_contact_platform user_id
           bib_number bib_prefix bib_index public_metadata private_metadata
           seat_number intel_phone_number block_id saved_guest_id
-          data_fill_stage_phase
+          data_fill_stage
         ].freeze
 
         def guest_base_columns

data/app/controllers/spree/api/v2/operator/event_charts_controller.rb

@@ -36,6 +36,7 @@ module Spree
             SpreeCmCommissioner::EventChartQueries.new(
               taxon_id: params[:taxon_id],
               chart_type: params[:id] || 'participation',
+              check_in_session_id: params[:check_in_session_id],
               refreshed: params[:refreshed] || false
             )
           end

data/app/controllers/spree/api/v2/operator/guest_json_gzips_controller.rb

@@ -26,6 +26,8 @@ module Spree
 
             result = SpreeCmCommissioner::OperatorGuestJsonGzips::Create.call(
               exportable: exportable,
+              # Scope the offline file to the requesting operator's check-in role (nil = unrestricted).
+              role: spree_current_user.check_in_role_for(exportable),
               force_create: false,
               options: {
                 created_by_id: spree_current_user.id.to_s,
@@ -53,11 +55,19 @@ module Spree
           end
 
           # override
+          # Scope the list to the requesting operator's check-in group, the same way the create cache
+          # does — otherwise a restricted crew could list (and download via exported_file_url) other
+          # groups' files for the event.
           def scope
-            SpreeCmCommissioner::Exports::OperatorGuestJsonGzip.where(
-              exportable_type: 'Spree::Taxon',
-              exportable_id: params[:taxon_id]
-            ).order(created_at: :desc)
+            exportable = Spree::Taxon.find(params[:taxon_id])
+
+            SpreeCmCommissioner::Exports::OperatorGuestJsonGzip
+              .where(
+                exportable_type: 'Spree::Taxon',
+                exportable_id: params[:taxon_id],
+                role_id: spree_current_user.check_in_role_for(exportable)&.id
+              )
+              .order(created_at: :desc)
           end
 
           # override

data/app/controllers/spree/api/v2/storefront/account/guest_dynamic_fields_controller.rb

@@ -4,69 +4,40 @@ module Spree
       module Storefront
         module Account
           class GuestDynamicFieldsController < ::Spree::Api::V2::ResourceController
+            ALLOWED_PHASES = %w[pre_registration post_registration].freeze
+
             before_action :require_spree_current_user
             before_action :load_guest
 
             def update_dynamic_field
-              phase = params[:phase]
-
-              return render_error_payload('Invalid phase', 422) unless %w[pre_registration post_registration].include?(phase)
-
-              begin
-                fields = dynamic_fields_params
-              rescue ActionController::ParameterMissing
-                return render_error_payload('No dynamic fields provided', 422)
-              end
-
-              return render_error_payload('No dynamic fields provided', 422) if fields.blank?
-
-              ActiveRecord::Base.transaction do
-                fields.each do |field|
-                  process_dynamic_field(field)
-                end
-
-                @guest.save_and_move_to_next_stage
+              return render_error_payload('Invalid phase') unless ALLOWED_PHASES.include?(params[:phase])
+              return render_error_payload('No dynamic fields provided') if dynamic_fields_params.blank?
+
+              result = SpreeCmCommissioner::Guests::Update.call(
+                guest: @guest,
+                guest_params: {
+                  guest_dynamic_fields_attributes: dynamic_fields_params.map { |f| { dynamic_field_id: f[:id], value: f[:value] } }
+                }
+              )
+
+              if result.success?
+                render_serialized_payload { serialize_guest(result.value[:guest]) }
+              else
+                render_error_payload(result.error)
               end
-
-              render_serialized_payload { serialize_guest(@guest) }
-            rescue ActiveRecord::RecordInvalid => e
-              render_error_payload(e.record.errors, 422)
-            rescue ActiveRecord::RecordNotFound => e
-              render_error_payload(e.message, 404)
             end
 
             private
 
             def dynamic_fields_params
-              params.require(:dynamic_fields).map do |field|
-                field.permit(:id, :value)
-              end
+              Array(params[:dynamic_fields]).map { |field| field.permit(:id, :value) }
             end
 
             def load_guest
               @guest = SpreeCmCommissioner::Guest.find(params[:guest_id])
 
-              unless spree_current_user.guests.exists?(id: @guest.id) ||
-                  @guest.line_item.order.user == spree_current_user
-                render_error_payload('Unauthorized', 401)
-              end
-            end
-
-            def process_dynamic_field(field)
-              dynamic_field = SpreeCmCommissioner::DynamicField.find(field[:id])
-              guest_field = @guest.guest_dynamic_fields.build(dynamic_field_id: dynamic_field.id)
-
-              if dynamic_field.requires_dynamic_field_options?
-                option = dynamic_field.dynamic_field_options.find_by(value: field[:value])
-                raise ActiveRecord::RecordNotFound, "Invalid value for dynamic field #{dynamic_field.label}" unless option
-
-                guest_field.dynamic_field_option = option
-                guest_field.value = option.value
-              else
-                guest_field.value = field[:value]
-              end
-
-              guest_field.save!
+              raise CanCan::AccessDenied unless spree_current_user.guests.exists?(id: @guest.id) ||
+                @guest.line_item.order.user == spree_current_user
             end
 
             def serialize_guest(guest)

data/app/controllers/spree/api/v2/storefront/account/mark_guest_info_complete_controller.rb

@@ -7,7 +7,7 @@ module Spree
             before_action :require_spree_current_user
 
             def update
-              SpreeCmCommissioner::Users::IncompleteGuestCheckerService.new(spree_current_user).call
+              spree_current_user.clear_has_incomplete_guest_info_cache
               render_success
             end
 
@@ -18,7 +18,7 @@ module Spree
                 {
                   success: true,
                   message: 'Guest information marked as complete',
-                  has_incomplete_guest_info: false
+                  has_incomplete_guest_info: spree_current_user.has_incomplete_guest_info?
                 }
               end
             end

data/app/controllers/spree/api/v2/storefront/account/orders_controller_decorator.rb

@@ -24,21 +24,11 @@ module Spree
             private
 
             def find_orders_with_incomplete_guest_info
-              orders = spree_current_user.orders
-                                         .complete
-                                         .includes(line_items: { guests: [:guest_dynamic_fields] })
-
-              incomplete_order_ids = orders.select do |order|
-                order.line_items.any? do |line_item|
-                  line_item.guests.any? do |guest|
-                    guest.pre_registration_completed? &&
-                      guest.post_registration_fields? &&
-                      !guest.post_registration_completed?
-                  end
-                end
-              end.map(&:id)
-
-              spree_current_user.orders.where(id: incomplete_order_ids)
+              spree_current_user.orders
+                                .complete
+                                .joins(:guests)
+                                .merge(SpreeCmCommissioner::Guest.post_registration)
+                                .distinct
             end
 
             def collection_finder