spree_cm_commissioner 2.8.15.pre.pre8 → 2.8.15.pre.pre9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f0d6bc194265bc170fa7f5d480c4c3aead23d86827c1f80896237f8c3864d6c
-  data.tar.gz: 7fb03f4121f2cdead7cbb774489c675663dc172bb62c9b6c3a7b06c67c52c08a
+  metadata.gz: db6de320351a3caae8243230898ce35ae85406e84424101bc01b126ce7eefb4c
+  data.tar.gz: 97a586260f667681ee89ca8aa224fc3ba05137dfcfbf4453191137e15d724735
 SHA512:
-  metadata.gz: cb11254307ddad72b7941b7474ee8fc473474dac0abfaa95a3d6eb15c803fe86a7bafb60b8705d40a93c00e83d39836846ed6ed16bf45453e47301f5666ce058
-  data.tar.gz: 1880e96a3b09bc6fb3efcc72649221b0603ab1a87d1774dd13badf47ba38f57d94b875a9261f369ab839ada7c35d698ffe4230c1d6b327654ecec693e74cc41d
+  metadata.gz: 8d9ab3710513dd89d55d6422d924ce10c0e83f661cdf2576650586b1a11a627db19a161a8aa657c04d305201a10d1f4823d1ea2fff44657638829d7ba7c2ef52
+  data.tar.gz: de4d493586903410f18877bbb2e959383b42765b241c4d90cb08e0aef5cda6618433a24c6c18714391d60805176971b0aa12bb7165a694818abea06915164697

data/.env.example

@@ -20,6 +20,13 @@ WAITING_ROOM_SESSION_SIGNATURE="e6b2********************26e3"
 WAITING_ROOM_SESSION_EXPIRE_DURATION_IN_SECOND=
 WAITING_ROOM_MIN_SESSIONS_COUNT=5
 WAITING_ROOM_DISABLED=no
+WAITING_ROOM_POSITION_STAMP_LIMIT=1000
+WAITING_ROOM_FIRESTORE_BATCH_SIZE=500
+WAITING_ROOM_MIN_WAIT_TO_ENTER_SECONDS=600 # Waiting Room step floor (10 min)
+WAITING_ROOM_MIN_QUEUE_TO_ENTER_SECONDS=300 # Queue step floor (5 min)
+WAITING_ROOM_MAX_WAIT_TO_DISPLAY_SECONDS=3600 # above this the ETA is hidden (1 h)
+WAITING_ROOM_CALLER_INTERVAL_SECONDS=60 # how often the caller runs; match the waiting_guests_caller cron
+WAITING_ROOM_MAX_ETA_BATCH_SIZE=50 # cap on batch size assumed when estimating the ETA
 
 # Vattanac Bank
 VATTANAC_AES_SECRET_KEY= ""
@@ -45,6 +52,9 @@ CACHE_DEFAULT_MAX_AGE=300 # Default for unlisted controllers - 5 minutes
 # Batch size for processing maintenance tasks in app/jobs/spree_cm_commissioner/maintenance_tasks/orchestrate_job.rb
 MAINTENANCE_TASKS_BATCH_SIZE=100
 
+# Batch size for slicing guest_ids when enqueuing RefinalizeGuestsBatchJob in app/models/spree_cm_commissioner/maintenance_tasks/event.rb
+MAINTENANCE_TASKS_REFINALIZE_GUESTS_BATCH_SIZE=300
+
 # Export related:
 OPERATOR_GUEST_JSON_GZIP_CACHE_HOURS=24
 EXPORT_PRESIGNED_URL_EXPIRATION_MINUTES=15
@@ -63,3 +73,9 @@ PAYMENT_LOCK_MIN_DURATION_IN_MINUTES=5      # Minimum remaining hold time requir
 MAX_ACTIVE_HOLDS_PER_USER=3                 # Max concurrent active holds allowed per user across all orders
 MAX_HOLDS_PER_IP_PER_HOUR=5                 # Max hold attempts per IP address within a rolling 1-hour window (abuse prevention)
 HOLD_COOLDOWN_AFTER_EXPIRY_IN_MINUTES=2     # Cooldown period before a user can re-acquire a hold after one expired on them
+
+# See: app/models/spree_cm_commissioner/payment_decorator.rb
+PAYMENT_INCOMPLETE_NOTIFICATION_DELAY_IN_MINUTES=5  # Delay before notifying a customer that their order is still unpaid after payment is created
+
+# See: app/jobs/spree_cm_commissioner/telegram_alerts/order_integrity_check_job.rb
+ORDER_INTEGRITY_TELEGRAM_ALERT_ENABLED="no"  # Set to yes to enable the order integrity Telegram alert job (off by default to avoid flooding Telegram rate limits during traffic spikes)

data/.github/workflows/test_and_build_gem.yml

@@ -163,8 +163,9 @@ jobs:
       - name: Security
         env:
           DATABASE_URL: postgres://myuser:mypassword@localhost:5432/test_db
+
+        # Using --no-threads to bypass a known Ruby 3.2.0 GC segmentation fault in CI.
         run: |
-          # Using --no-threads to bypass a known Ruby 3.2.0 GC segmentation fault in CI.
           bundle exec brakeman --no-threads --no-exit-on-warn
 
   test:

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.8.15.pre.pre8)
+    spree_cm_commissioner (2.8.15.pre.pre9)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/spree/admin/import_new_orders_controller.rb

@@ -23,6 +23,31 @@ module Spree
           end
         end
       end
+
+      # POST: /admin/orders/import_new_orders/:id/cancel
+      def cancel
+        import = model_class.find(params[:id])
+        show_url = spree.admin_import_new_order_url(import.id)
+
+        unless import.cancellable?
+          flash[:error] = 'These orders cannot be canceled.' # rubocop:disable Rails/I18nLocaleTexts
+          redirect_to show_url and return
+        end
+
+        if params[:confirm_name].to_s.strip != import.name.to_s.strip
+          flash[:error] = 'Import name did not match. Cancellation aborted.' # rubocop:disable Rails/I18nLocaleTexts
+          redirect_to show_url and return
+        end
+
+        SpreeCmCommissioner::CancelImportOrderJob.perform_later(
+          import_order_id: import.id,
+          canceled_by_user_id: spree_current_user.id,
+          cancellation_reason: params[:cancellation_reason].to_s.strip.presence
+        )
+
+        flash[:success] = "Canceling orders from \"#{import.name}\". This runs in the background."
+        redirect_to show_url
+      end
     end
   end
 end

data/app/controllers/spree/admin/inventory_holds_controller.rb

@@ -9,6 +9,7 @@ module Spree
         q['s'] ||= 'created_at desc'
         q['created_at_gt'] = parse_time_or_nil(q['created_at_gt'], :beginning_of_day) if q['created_at_gt'].present?
         q['created_at_lt'] = parse_time_or_nil(q['created_at_lt'], :end_of_day) if q['created_at_lt'].present?
+        normalize_enum_filters!(q)
 
         @search = scope.ransack(q)
         result_scope = @search.result(distinct: true)
@@ -18,7 +19,11 @@ module Spree
                  .page(params[:page])
                  .per(params[:per_page] || Spree::Backend::Config[:admin_orders_per_page])
 
-        @status_counts = result_scope.reorder(nil).group(:status).count
+        # Status tab counts must reflect every other filter but NOT the status filter, so
+        # each tab shows how many holds it would return (otherwise selecting one status
+        # zeroes out all the other tabs).
+        @status_counts = scope.ransack(q.except('status_eq')).result(distinct: true)
+                              .reorder(nil).group(:status).count
       end
 
       def release
@@ -44,8 +49,23 @@ module Spree
 
       private
 
+      # `status` and `release_reason` are integer-backed enums. Ransack casts a string
+      # value for an integer column with String#to_i, so "payment_locked" becomes 0
+      # (== :pending) and every label silently filters to the wrong status. Translate
+      # enum labels to their stored integer before searching.
+      def normalize_enum_filters!(query)
+        {
+          'status_eq' => SpreeCmCommissioner::InventoryHold.statuses,
+          'release_reason_eq' => SpreeCmCommissioner::InventoryHold.release_reasons
+        }.each do |key, mapping|
+          value = query[key]
+          query[key] = mapping[value.to_s] if value.present? && mapping.key?(value.to_s)
+        end
+      end
+
       def back_params
         raw_params = params[:back_params].presence || params
+        raw_params = raw_params.to_unsafe_h if raw_params.respond_to?(:to_unsafe_h)
         ActionController::Parameters.new(raw_params).permit(:page, :per_page, q: {})
       end
 

data/app/controllers/spree/admin/system/maintenance_tasks_controller.rb

@@ -0,0 +1,64 @@
+module Spree
+  module Admin
+    module System
+      class MaintenanceTasksController < Spree::Admin::BaseController
+        def index
+          authorize! :manage, SpreeCmCommissioner::MaintenanceTask
+
+          @search = scope.ransack(params[:q])
+          @tasks = @search.result(distinct: true)
+                          .order(created_at: :desc)
+                          .page(params[:page])
+                          .per(params[:per_page] || Spree::Backend::Config[:admin_orders_per_page])
+        end
+
+        def run_now
+          authorize! :manage, SpreeCmCommissioner::MaintenanceTask
+
+          task = SpreeCmCommissioner::MaintenanceTask.find(params[:id])
+
+          if task.completed_at.present?
+            flash[:error] = "Task ##{task.id} is already completed."
+          else
+            task.update!(manually_triggered: true)
+            task.execute
+
+            if task.completed_at.present?
+              flash[:success] = "Task ##{task.id} (#{task.type.demodulize}) ran successfully."
+            else
+              flash[:error] = "Task ##{task.id} (#{task.type.demodulize}) failed: #{task.last_error}"
+            end
+          end
+
+          redirect_to admin_system_maintenance_tasks_path(back_params)
+        end
+
+        def destroy
+          authorize! :manage, SpreeCmCommissioner::MaintenanceTask
+
+          task = SpreeCmCommissioner::MaintenanceTask.find(params[:id])
+
+          if task.destroy
+            flash[:success] = "Task ##{task.id} has been deleted."
+          else
+            flash[:error] = task.errors.full_messages.to_sentence.presence || "Failed to delete task ##{task.id}."
+          end
+
+          redirect_to admin_system_maintenance_tasks_path(back_params)
+        end
+
+        private
+
+        def scope
+          SpreeCmCommissioner::MaintenanceTask.accessible_by(current_ability, :manage)
+        end
+
+        def back_params
+          raw_params = params[:back_params].presence || params
+          raw_params = raw_params.to_unsafe_h if raw_params.respond_to?(:to_unsafe_h)
+          ActionController::Parameters.new(raw_params).permit(:page, :per_page, q: {})
+        end
+      end
+    end
+  end
+end

data/app/controllers/spree/admin/system/waiting_room_controller.rb

@@ -4,7 +4,10 @@ module Spree
       class WaitingRoomController < Spree::Admin::BaseController
         def show
           @fetcher = SpreeCmCommissioner::WaitingRoomSystemMetadataFetcher.new
+          @lobby_fetcher = SpreeCmCommissioner::WaitingRoomLobbyMetadataFetcher.new
+
           @fetcher.load_document_data
+          @lobby_fetcher.load_document_data
 
           @active_sesions_count = SpreeCmCommissioner::WaitingRoomSession.active.count
         end
@@ -23,12 +26,31 @@ module Spree
           redirect_back fallback_location: admin_system_waiting_room_path
         end
 
+        def modify_max_sessions_count_cap
+          modifier = params[:max_sessions_count_cap]&.to_i || 0
+          SpreeCmCommissioner::WaitingRoomSystemMetadataSetter.new.modify_max_sessions_count_cap(modifier)
+
+          redirect_back fallback_location: admin_system_waiting_room_path
+        end
+
         def force_pull
           SpreeCmCommissioner::WaitingRoomLatestSystemMetadataPullerJob.perform_now
           SpreeCmCommissioner::WaitingGuestsCallerJob.perform_now
 
           redirect_back fallback_location: admin_system_waiting_room_path
         end
+
+        def publish_lobby_path
+          result = SpreeCmCommissioner::WaitingRoom::PublishLobbyPath.call
+
+          if result.success?
+            flash[:success] = "Published waiting guests records path: #{result.value[:records_path]}"
+          else
+            flash[:error] = result.error.to_s
+          end
+
+          redirect_back fallback_location: admin_system_waiting_room_path
+        end
       end
     end
   end

data/app/controllers/spree/admin/taxons_controller_decorator.rb

@@ -28,6 +28,10 @@ module Spree
         remove_asset(@taxon.home_banner)
       end
 
+      def remove_ad_banner
+        remove_asset(@taxon.ad_banner)
+      end
+
       def remove_video_banner
         remove_asset(@taxon.video_banner)
       end
@@ -49,6 +53,7 @@ module Spree
         @taxon.build_app_banner(attachment: permitted_resource_params.delete(:app_banner)) if permitted_resource_params[:app_banner]
         @taxon.build_web_banner(attachment: permitted_resource_params.delete(:web_banner)) if permitted_resource_params[:web_banner]
         @taxon.build_home_banner(attachment: permitted_resource_params.delete(:home_banner)) if permitted_resource_params[:home_banner]
+        @taxon.build_ad_banner(attachment: permitted_resource_params.delete(:ad_banner)) if permitted_resource_params[:ad_banner]
         @taxon.build_video_banner(attachment: permitted_resource_params.delete(:video_banner)) if permitted_resource_params[:video_banner]
       end
 

data/app/controllers/spree/api/v2/storefront/account/orders_controller_decorator.rb

@@ -44,6 +44,11 @@ module Spree
             def collection_finder
               SpreeCmCommissioner::Orders::FindByState
             end
+
+            # this allows fetching a single order regardless of its state.
+            def resource_finder
+              SpreeCmCommissioner::Orders::FindByAllState
+            end
           end
         end
       end

data/app/controllers/spree/api/v2/storefront/guests_controller.rb

@@ -31,13 +31,15 @@ module Spree
           def create
             spree_authorize! :update, spree_current_order, order_token
 
-            resource = scope.new(guest_params)
+            result = SpreeCmCommissioner::Cart::CreateGuest.call(
+              line_item: parent,
+              options: guest_params
+            )
 
-            if resource.save
-              resource.save_and_move_to_next_stage
-              render_serialized_payload(201) { serialize_resource(resource) }
+            if result.success?
+              render_serialized_payload(201) { serialize_resource(result.value) }
             else
-              render_error_payload(resource.errors, 422)
+              render_error_payload(result.value.errors, 422)
             end
           end
 

data/app/controllers/spree/api/v2/storefront/order_histories_controller.rb

@@ -30,13 +30,25 @@ module Spree
           private
 
           def collection
+            # WARNING: Do NOT remove .order(id: :desc).
+            # Mobile relies on this ordering for paginated order_histories.
+            # Removing it will cause mobile to paginate by oldest records first (last 10 oldest),
+            # breaking the "most recent orders" display on the order history screen.
+            # It related to user cancel or complete order flow, which relies on the most recent orders being returned first.
             if spree_current_user.present?
-              spree_current_user.orders.payment.not_archived
+              spree_current_user.orders
+                                .not_archived
+                                .incomplete
+                                .order(id: :desc)
             else
               order_tokens = Array(params[:order_tokens])
               return Spree::Order.none if order_tokens.empty?
 
-              Spree::Order.payment.not_archived.without_user.where(token: order_tokens)
+              Spree::Order.not_archived
+                          .incomplete
+                          .without_user
+                          .where(token: order_tokens)
+                          .order(id: :desc)
             end
           end
 

data/app/controllers/spree/api/v2/storefront/ticket_transfers_controller.rb

@@ -86,9 +86,10 @@ module Spree
           end
 
           def collection
-            SpreeCmCommissioner::TicketTransfer.includes(:order,
-                                                         from_guest: [:event, { line_item: :product }]
-                                                        ).where(from_user_id: spree_current_user.id)
+            SpreeCmCommissioner::TicketTransfer
+              .includes(:order, from_guest: [:event, { line_item: :product }])
+              .where(from_user_id: spree_current_user.id)
+              .order(id: :desc)
           end
 
           def resource_serializer

data/app/controllers/spree/api/v2/tenant/order_histories_controller.rb

@@ -37,13 +37,25 @@ module Spree
           end
 
           def collection
+            # WARNING: Do NOT remove .order(id: :desc).
+            # Mobile relies on this ordering for paginated order_histories.
+            # Removing it will cause mobile to paginate by oldest records first (last 10 oldest),
+            # breaking the "most recent orders" display on the order history screen.
+            # It related to user cancel or complete order flow, which relies on the most recent orders being returned first.
             if spree_current_user.present?
-              spree_current_user.orders.payment.not_archived
+              spree_current_user.orders
+                                .not_archived
+                                .incomplete
+                                .order(id: :desc)
             else
               order_tokens = Array(params[:order_tokens])
               return Spree::Order.none if order_tokens.empty?
 
-              Spree::Order.payment.not_archived.without_user.where(token: order_tokens)
+              Spree::Order.not_archived
+                          .incomplete
+                          .without_user
+                          .where(token: order_tokens)
+                          .order(id: :desc)
             end
           end
 

data/app/finders/spree_cm_commissioner/orders/find.rb

@@ -4,14 +4,30 @@
 module SpreeCmCommissioner
   module Orders
     class Find
+      CURRENT_CART_STATES = %w[cart address].freeze
+      CART_MAX_AGE_IN_MINUTES = ENV.fetch('CART_MAX_AGE_IN_MINUTES', '720').to_i # Default: 12 hours
+
       def execute(store:, user:, currency:, token: nil, state: nil)
+        state = Array(state).map(&:to_s)
+
         params = { store_id: store.id, currency: currency }
         params[:state] = state if state.present?
 
-        return find_by_token(params, token) if token.present?
-        return find_by_user(params, user) if user.present?
+        order = if token.present?
+                  find_by_token(params, token)
+                elsif user.present?
+                  find_by_user(params, user)
+                end
+
+        # Only enforce hold and age expiration when fetching current cart states ('cart' or 'address').
+        # For other states (like 'payment,complete'), we want to return the order even if it's old or expired
+        # because some pages on client still need some specific state of order to display.
+        if state.intersect?(CURRENT_CART_STATES)
+          return nil if hold_expired?(order)
+          return nil if cart_too_old?(order)
+        end
 
-        nil
+        order
       end
 
       def find_by_token(params, token)
@@ -24,6 +40,20 @@ module SpreeCmCommissioner
         scope.order(created_at: :desc).find_by(params)
       end
 
+      def hold_expired?(order)
+        return false if order.nil?
+
+        # Check if the order has a hold_expires_at column and if it has already passed
+        order.hold_expires_at.present? && order.hold_expires_at < Time.current
+      end
+
+      def cart_too_old?(order)
+        return false if order.nil?
+
+        # Treat the cart as active based on its last update time, not its creation time.
+        order.updated_at < CART_MAX_AGE_IN_MINUTES.minutes.ago
+      end
+
       private
 
       def scope

data/app/finders/spree_cm_commissioner/orders/find_by_all_state.rb

@@ -0,0 +1,11 @@
+module SpreeCmCommissioner
+  module Orders
+    class FindByAllState < Spree::Orders::FindComplete
+      private
+
+      def scope
+        user? ? user.orders.includes(scope_includes) : Spree::Order.includes(scope_includes)
+      end
+    end
+  end
+end

data/app/interactors/spree_cm_commissioner/payment_incomplete_notification_sender.rb

@@ -0,0 +1,25 @@
+module SpreeCmCommissioner
+  class PaymentIncompleteNotificationSender < BaseInteractor
+    def call
+      order = context.notificable
+      return if order.user.blank?
+      return if order.reload.payment_fulfilled?
+
+      SpreeCmCommissioner::OrderGeneralNotification.with(
+        notificable: order,
+        title: title,
+        message: message(order)
+      ).deliver_later(order.user)
+    end
+
+    private
+
+    def title
+      I18n.t('notifications.spree_cm_commissioner.payment_incomplete_notification.title')
+    end
+
+    def message(order)
+      I18n.t('notifications.spree_cm_commissioner.payment_incomplete_notification.message', order_number: order.number)
+    end
+  end
+end

data/app/interactors/spree_cm_commissioner/release_inventory_item_notification_sender.rb

@@ -0,0 +1,24 @@
+module SpreeCmCommissioner
+  class ReleaseInventoryItemNotificationSender < BaseInteractor
+    def call
+      order = context.notificable
+      return if order.user.blank?
+
+      SpreeCmCommissioner::OrderGeneralNotification.with(
+        notificable: order,
+        title: title,
+        message: message(order)
+      ).deliver_later(order.user)
+    end
+
+    private
+
+    def title
+      I18n.t('notifications.spree_cm_commissioner.release_inventory_item_notification.title')
+    end
+
+    def message(order)
+      I18n.t('notifications.spree_cm_commissioner.release_inventory_item_notification.message', order_number: order.number)
+    end
+  end
+end